@thurinlabs/identity-kit 1.0.1 → 1.0.2

package/README.md

@@ -264,6 +264,10 @@ The card talks directly to Ethereum and each proof platform — no intermediary,
 | Codeberg | Repository description |
 | Mastodon | Profile metadata |
 
+## Key algorithms
+
+Any curve openpgp.js can compute is accepted: Ed25519, Cv25519, NIST P-256/384/521, brainpool, RSA, and **secp256k1**. openpgp.js rejects secp256k1 by default because RFC 9580 does not list it; identity-kit turns that rejection off, since it is a compatibility rule, not a security one. A secp256k1 PGP key doubles as an Ethereum key (the address is derived from the same public point), so anything that can sign with the PGP key can sign Ethereum transactions: hold such a key if you like, but do not fund its derived address. In Node, openpgp.js needs the `eckey-utils` package for this curve; identity-kit depends on it, so `npm install` brings it in. The browser build needs nothing extra.
+
 ## Migrating from 0.9.x
 
 1.0.0 reads the **PGPRegistry v2** contract. The v1 registry is no longer read.

package/dist/embed.global.js

@@ -31148,6 +31148,7 @@ ${prettyStateOverride(stateOverride)}`;
   }
 
   // src/core/pgp.ts
+  var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
   function algorithmName(keyOrSubkey) {
     try {
       const info = keyOrSubkey.getAlgorithmInfo();
@@ -31188,7 +31189,9 @@ ${prettyStateOverride(stateOverride)}`;
             await cert.verify(
               key.keyPacket,
               cert.signatureType,
-              { userID: user.userID, key: key.keyPacket }
+              { userID: user.userID, key: key.keyPacket },
+              void 0,
+              PGP_CONFIG
             );
           } catch {
             continue;
@@ -31239,7 +31242,7 @@ ${prettyStateOverride(stateOverride)}`;
         return { verified: false, reason: "Key fingerprint mismatch" };
       }
       const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-      const { signatures } = await verify({ message, verificationKeys: publicKey });
+      const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
       await signatures[0].verified;
       const signedText = message.getText();
       if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {