kxco-verify 1.1.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -231,9 +231,11 @@ The verifier is architecturally independent of the signer — the two share no c
|
|
|
231
231
|
|
|
232
232
|
## Security
|
|
233
233
|
|
|
234
|
-
Signature verification uses [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65, independently audited by
|
|
234
|
+
Signature verification uses [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65, with no transitive dependencies. That package has **not** been independently audited by a third party; it has been self-audited by its maintainer. Cure53's 2023 NDS-01 audit of the `@noble` ecosystem covered `ciphers`, `curves` and `hashes`, and did not cover `@noble/post-quantum`. We state this plainly because you should not adopt a verification library on the strength of an audit that does not exist.
|
|
235
235
|
|
|
236
|
-
|
|
236
|
+
The library makes no outbound requests beyond the attestation URL you supply and the `pinAt` endpoint declared in the manifest. No data is sent to KXCO.
|
|
237
|
+
|
|
238
|
+
To report a vulnerability, open a [private security advisory](https://github.com/KnightsbridgeAIQ/kxco-verify/security/advisories/new) or email **john@knightsbridgelaw.com**. Acknowledgement within 2 business days, triage decision within 5. Full policy, including safe harbour for good-faith research: <https://kxco.ai/security>.
|
|
237
239
|
|
|
238
240
|
---
|
|
239
241
|
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials
|
|
3
|
+
"version": "1.2.0",
|
|
4
|
+
"description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials, for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
7
7
|
"pqc",
|
|
@@ -35,10 +35,10 @@
|
|
|
35
35
|
"funding": "https://kxco.ai",
|
|
36
36
|
"repository": {
|
|
37
37
|
"type": "git",
|
|
38
|
-
"url": "https://github.com/
|
|
38
|
+
"url": "https://github.com/KnightsbridgeAIQ/kxco-verify.git"
|
|
39
39
|
},
|
|
40
40
|
"bugs": {
|
|
41
|
-
"url": "https://github.com/
|
|
41
|
+
"url": "https://github.com/KnightsbridgeAIQ/kxco-verify/issues"
|
|
42
42
|
},
|
|
43
43
|
"type": "module",
|
|
44
44
|
"sideEffects": false,
|
|
@@ -72,7 +72,7 @@
|
|
|
72
72
|
"node": ">=20.19"
|
|
73
73
|
},
|
|
74
74
|
"dependencies": {
|
|
75
|
-
"@noble/post-quantum": "
|
|
75
|
+
"@noble/post-quantum": "0.7.0"
|
|
76
76
|
},
|
|
77
77
|
"scripts": {
|
|
78
78
|
"test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
|