ephem 1.0.0 → 1.0.2

package/README.md

@@ -42,12 +42,32 @@ Ephem is also suitable for **Server-to-Server** communication for high-security
 
 ---
 
+## Cryptography
+
+Ephem relies on standard, proven algorithms:
+
+-   **Asymmetric**: RSA-OAEP (2048-bit, SHA-256)
+-   **Symmetric**: AES-256-GCM
+-   **Randomness**: `crypto.getRandomValues` (Browser) / `node:crypto` (Server)
+-   **Integrity**: Authenticated encryption (AEAD) via AES-GCM (CID is used as Additional Authenticated Data)
+
+---
+
 ## Installation
 
 ```bash
 npm install ephem
 ```
 
+## Browser Support
+
+Ephem Client relies on the **Web Crypto API**.
+
+-   **Works in**: All modern browsers (Chrome, Firefox, Safari, Edge).
+-   **Requirements**: Secure Context (HTTPS or `localhost`).
+-   **Legacy**: Does **not** work in IE11.
+
+
 ---
 
 ## Quick Start
@@ -147,7 +167,7 @@ For projects without a bundler, you can use the pre-built unpkg/CDN version. Thi
 
 ```html
 <!-- Load Ephem client from CDN -->
-<script src="https://unpkg.com/ephem/dist/client/index.global.js"></script>
+<script src="https://unpkg.com/ephem/dist/index.global.js"></script>
 
 <script>
     "use strict";
@@ -278,12 +298,14 @@ await fetch('/checkout', { body: JSON.stringify({ sealedCC, sealedCVV, sealedSSN
 *   **Man-in-the-Middle (MITM)**: If a corporate proxy or malicious actor intercepts the request (even with a trusted root CA), they cannot read the payload because they lack the ephemeral private key, which never leaves your app server's memory.
 *   **Replay Attacks**: Because capsules have `maxOpens` (default: 1), a captured valid request cannot be replayed to trigger a second action (e.g., duplicate payment).
 *   **Accidental Logging**: If you accidentally log the raw request body, you are only logging ciphertext.
+*   **Accidental Data Persistence**: If sensitive data is accidentally written to disk (swap files, core dumps, or persistent logs), it remains encrypted.
 
 ### What Ephem Does NOT Protect Against
 
 *   **XSS (Cross-Site Scripting)**: If an attacker can run JS on your page, they can hook the `seal()` function or read the input before it is sealed.
 *   **Compromised Server**: If the attacker controls your server, they can access the memory where private keys are stored (temporarily).
 *   **Compromised Client Device**: Keyloggers or malware on the user's machine.
+*   **Weak Application Authentication**: Ephem encrypts the payload, but it does not authenticate the user. You still need strong session management (cookies, JWTs) to ensure *who* submitted the capsule.
 
 ---
 
@@ -478,4 +500,4 @@ const ephem = new Ephem({
 Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
 
 ## License
-[ISC](/LICENSE)
+[ISC](https://github.com/newben420/ephem/blob/main/LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ephem",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Robust, Ephemeral End-to-End Encryption for the Application Layer. Secure data-in-transit with disposable capsules.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -57,4 +57,4 @@
     "README.md",
     "LICENSE"
   ]
-}
+}