kxco-verify 1.4.0 → 1.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -0
- package/README.md +2 -2
- package/package.json +3 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.4.1
|
|
4
|
+
|
|
5
|
+
Documentation. No source change.
|
|
6
|
+
|
|
7
|
+
The package description, the opening of the README and the keywords now say
|
|
8
|
+
what 1.4.0 already does: it verifies ML-DSA-87 signatures as well as ML-DSA-65.
|
|
9
|
+
The description now fits the 255 characters the npm registry keeps, so it no
|
|
10
|
+
longer ends mid-sentence. `ml-dsa-87` joins the keywords.
|
|
11
|
+
|
|
3
12
|
## 1.4.0
|
|
4
13
|
ML-DSA-87 manifests verify alongside ML-DSA-65. parseManifest accepts
|
|
5
14
|
`"ML-DSA-87"` where all three alg fields name it, and requires the public key
|
package/README.md
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
[](https://nodejs.org)
|
|
12
12
|
[](https://verify.kxco.ai)
|
|
13
13
|
|
|
14
|
-
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 20.19 and later.
|
|
14
|
+
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 20.19 and later.
|
|
15
15
|
|
|
16
16
|
- **No KXCO server in the trust path.** `verifyManifest()` makes no network request at all, and `verifyUrl()` contacts only the attestation URL you pass and the key endpoint the manifest names.
|
|
17
17
|
- **Runs in the browser as shipped.** No `Buffer`, no `process` and SHA-256 from WebCrypto, which is how [verify.kxco.ai](https://verify.kxco.ai) checks a signature entirely in the tab.
|
|
@@ -322,7 +322,7 @@ version, and every GitHub Action is pinned by commit SHA.
|
|
|
322
322
|
|
|
323
323
|
## Security
|
|
324
324
|
|
|
325
|
-
**ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
|
|
325
|
+
**ML-DSA-87** and **ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
|
|
326
326
|
|
|
327
327
|
Evidenced, and reproducible on your own machine:
|
|
328
328
|
|
package/package.json
CHANGED
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.4.
|
|
4
|
-
"description": "Free, browser-safe verifier for KXCO ML-DSA-
|
|
3
|
+
"version": "1.4.1",
|
|
4
|
+
"description": "Free, browser-safe verifier for KXCO ML-DSA-87 and ML-DSA-65 signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live on chain.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
7
7
|
"pqc",
|
|
8
8
|
"ml-dsa",
|
|
9
|
+
"ml-dsa-87",
|
|
9
10
|
"dilithium",
|
|
10
11
|
"nist",
|
|
11
12
|
"fips-204",
|