kxco-pq-audit 1.2.2 → 1.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +26 -0
- package/README.md +13 -1
- package/package.json +6 -4
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 1.2.3
|
|
4
|
+
|
|
5
|
+
### Corrected
|
|
6
|
+
|
|
7
|
+
The README claimed `@noble/post-quantum` was audited by Cure53 in 2024.
|
|
8
|
+
It is maintainer-audited (v0.6.1, April 2026), not Cure53-audited.
|
|
9
|
+
|
|
10
|
+
The other Noble packages were audited separately and at different dates, and
|
|
11
|
+
none of those engagements reached the post-quantum package:
|
|
12
|
+
|
|
13
|
+
| Package | Audited by |
|
|
14
|
+
|---|---|
|
|
15
|
+
| `@noble/post-quantum` | maintainer-audited |
|
|
16
|
+
| `@noble/hashes` | Cure53, Jan 2022, v1.0.0 |
|
|
17
|
+
| `@noble/curves` | Trail of Bits Feb 2023; Kudelski Sep 2023; Cure53 Sep 2024 |
|
|
18
|
+
| `@noble/ciphers` | Cure53, Sep 2024, v1.0.0 |
|
|
19
|
+
|
|
20
|
+
Dates from `kxco-post-quantum/audit/dependency-review.json`, which is generated
|
|
21
|
+
by `audit/run-audit.mjs` rather than written by hand.
|
|
22
|
+
|
|
23
|
+
Documentation only. No code changed and no behaviour changed.
|
|
24
|
+
|
|
25
|
+
`.socket.yml` said `@noble/hashes` was audited by Cure53 in 2024. The audit
|
|
26
|
+
was real but the date was wrong: January 2022, at v1.0.0.
|
package/README.md
CHANGED
|
@@ -172,7 +172,19 @@ The checkpoint provides an on-chain timestamp proving that at least N entries ex
|
|
|
172
172
|
|
|
173
173
|
## Security
|
|
174
174
|
|
|
175
|
-
|
|
175
|
+
**ML-DSA-65** (NIST FIPS 204) via [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum), running on the OpenSSL 3.5 primitives where the runtime provides them. No custom cryptography.
|
|
176
|
+
|
|
177
|
+
Evidenced, and reproducible on your own machine:
|
|
178
|
+
|
|
179
|
+
- **2,103 NIST ACVP vectors** across FIPS 203, 204 and 205, pinned by digest
|
|
180
|
+
- **225 interoperability checks** against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions
|
|
181
|
+
- **SLSA provenance** on every published release — verify with `npm audit signatures`
|
|
182
|
+
- **CycloneDX SBOM** published with each release
|
|
183
|
+
- `npm run evidence` regenerates the whole bundle from source
|
|
184
|
+
|
|
185
|
+
Dependency audit history is recorded in [AUDIT.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/AUDIT.md).
|
|
186
|
+
|
|
187
|
+
The hash chain means a compromised or deleted entry cannot be hidden: any gap breaks verification of every subsequent entry.
|
|
176
188
|
|
|
177
189
|
To report a vulnerability, open a [private security advisory](https://github.com/KnightsbridgeAIQ/kxco-pq-audit/security/advisories/new) or email **security@kxco.ai**.
|
|
178
190
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-pq-audit",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.3",
|
|
4
4
|
"description": "Tamper-evident post-quantum audit log for regulated institutions. ML-DSA-65-signed, SHA-256 hash-chained entries. Any tampering breaks the chain. Optional Armature L1 checkpoint anchoring via the KXCO relay.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
@@ -50,14 +50,16 @@
|
|
|
50
50
|
}
|
|
51
51
|
},
|
|
52
52
|
"files": [
|
|
53
|
-
"
|
|
54
|
-
"LICENSE"
|
|
53
|
+
"CHANGELOG.md",
|
|
54
|
+
"LICENSE",
|
|
55
|
+
"README.md",
|
|
56
|
+
"src"
|
|
55
57
|
],
|
|
56
58
|
"engines": {
|
|
57
59
|
"node": ">=20.19"
|
|
58
60
|
},
|
|
59
61
|
"dependencies": {
|
|
60
|
-
"@noble/hashes": "2.
|
|
62
|
+
"@noble/hashes": "2.4.0",
|
|
61
63
|
"kxco-post-quantum": "^1.3.0"
|
|
62
64
|
},
|
|
63
65
|
"scripts": {
|