nervur 0.21.4 → 0.21.5

package/dist/crypto/ed25519.js

@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
-// Ed25519 signs, as RFC 8032 defines it, and verifies with the cofactorless
-// check. The spec names exactly where a check fails, and Web Crypto promises
-// none of the decoding rules, so they are held here before Web Crypto runs:
+// Ed25519 signs, as RFC 8032 defines it, by `@noble/curves` in every
+// engine, since an engine's Web Crypto may refuse a secret the curve takes,
+// and verifies with the cofactorless check the spec names, which the
+// library's own verify does not make. The decoding rules are held here:
 //
 //   a signature of any length but sixty-four
 //   an `s` at or above the group order
 //   an `R` that does not decode, or whose bytes are not its point's encoding
 //   a public key that does not decode, or whose y is at or above the prime
 //   a public key of small order, in any spelling
-import { importSecret, own, publicOf, subtle } from './subtle.js';
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { concat } from './bytes.js';
+import { own, subtle } from './subtle.js';
 const P = 2n ** 255n - 19n;
 const L = 2n ** 252n + 27742317777372353535851937790883648493n;
 const mod = (a) => ((a % P) + P) % P;
@@ -63,8 +66,14 @@ const smallOrder = (p) => {
         q = add(q, q);
     return q.x === 0n && q.y === q.z;
 };
-export const ed25519Public = async (secret) => publicOf(await importSecret('Ed25519', secret, ['sign']));
-export const sign = async (secret, message) => new Uint8Array(await subtle().sign('Ed25519', await importSecret('Ed25519', secret, ['sign']), own(message)));
+const secretOf = (secret) => {
+    if (secret.length !== 32)
+        throw new TypeError('a secret is thirty-two bytes');
+    return secret;
+};
+export const ed25519Public = async (secret) => ed25519.getPublicKey(secretOf(secret));
+export const sign = async (secret, message) => ed25519.sign(message, secretOf(secret));
+// The cofactorless check, `[s]B = R + [k]A`, on points decoded as above.
 export const verify = async (pk, message, signature) => {
     if (signature.length !== 64)
         return false;
@@ -73,13 +82,12 @@ export const verify = async (pk, message, signature) => {
         return false;
     if (decode(signature.subarray(0, 32)) === null)
         return false;
-    if (little(signature.subarray(32)) >= L)
-        return false;
-    try {
-        const imported = await subtle().importKey('raw', own(pk), { name: 'Ed25519' }, false, ['verify']);
-        return await subtle().verify('Ed25519', imported, own(signature), own(message));
-    }
-    catch {
+    const s = little(signature.subarray(32));
+    if (s >= L)
         return false;
-    }
+    const R = ed25519.Point.fromBytes(signature.subarray(0, 32));
+    const A = ed25519.Point.fromBytes(pk);
+    const hashed = new Uint8Array(await subtle().digest('SHA-512', own(concat(signature.subarray(0, 32), pk, message))));
+    const k = little(hashed) % L;
+    return ed25519.Point.BASE.multiplyUnsafe(s).equals(R.add(A.multiplyUnsafe(k)));
 };

package/dist/crypto/subtle.d.ts

@@ -1,10 +1,3 @@
 export declare const subtle: () => SubtleCrypto;
 export type Bytes = Uint8Array<ArrayBuffer>;
 export declare const own: (bytes: Uint8Array) => Bytes;
-declare const PKCS8: {
-    readonly Ed25519: '302e020100300506032b657004220420';
-    readonly X25519: '302e020100300506032b656e04220420';
-};
-export declare const importSecret: (curve: keyof typeof PKCS8, secret: Uint8Array, uses: KeyUsage[]) => Promise<CryptoKey>;
-export declare const publicOf: (key: CryptoKey) => Promise<Uint8Array>;
-export {};

package/dist/crypto/subtle.js

@@ -9,21 +9,3 @@ export const subtle = () => {
 };
 // Web Crypto takes a buffer it owns, so every input is copied into one.
 export const own = (bytes) => Uint8Array.from(bytes);
-// The PKCS#8 wrapping of a thirty-two byte secret, which is the whole of it
-// for both curves.
-const PKCS8 = { Ed25519: '302e020100300506032b657004220420', X25519: '302e020100300506032b656e04220420' };
-export const importSecret = (curve, secret, uses) => {
-    if (secret.length !== 32)
-        throw new TypeError('a secret is thirty-two bytes');
-    const prefix = Uint8Array.from(PKCS8[curve].match(/../g), (b) => parseInt(b, 16));
-    const wrapped = new Uint8Array(48);
-    wrapped.set(prefix);
-    wrapped.set(secret, 16);
-    return subtle().importKey('pkcs8', wrapped, { name: curve }, true, uses);
-};
-// Web Crypto gives a private key's public half only through a JWK.
-export const publicOf = async (key) => {
-    const { x } = await subtle().exportKey('jwk', key);
-    const binary = atob(x.replaceAll('-', '+').replaceAll('_', '/'));
-    return Uint8Array.from(binary, (c) => c.charCodeAt(0));
-};

package/dist/crypto/x25519.js

@@ -1,18 +1,21 @@
 // SPDX-License-Identifier: Apache-2.0
-// X25519 agrees. A secret is thirty-two bytes, clamped by the function and
-// never before.
+// X25519 agrees, by `@noble/curves` in every engine, since an engine's Web
+// Crypto may refuse a secret the curve takes. A secret is thirty-two bytes,
+// clamped by the function and never before.
+import { x25519 } from '@noble/curves/ed25519.js';
 import { zero } from './bytes.js';
-import { importSecret, own, publicOf, subtle } from './subtle.js';
-export const x25519Public = async (secret) => publicOf(await importSecret('X25519', secret, ['deriveBits']));
+export const x25519Public = async (secret) => {
+    if (secret.length !== 32)
+        throw new TypeError('a secret is thirty-two bytes');
+    return x25519.getPublicKey(secret);
+};
 // The agreement, or null for a public key that takes no seal: one whose
-// agreement is thirty-two zero bytes, or one the terrain refuses to read.
+// agreement is thirty-two zero bytes.
 export const agree = async (secret, pk) => {
-    if (pk.length !== 32)
+    if (pk.length !== 32 || secret.length !== 32)
         return null;
     try {
-        const mine = await importSecret('X25519', secret, ['deriveBits']);
-        const theirs = await subtle().importKey('raw', own(pk), { name: 'X25519' }, false, []);
-        const shared = new Uint8Array(await subtle().deriveBits({ name: 'X25519', public: theirs }, mine, 256));
+        const shared = x25519.getSharedSecret(secret, pk);
         return zero(shared) ? null : shared;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervur",
-  "version": "0.21.4",
+  "version": "0.21.5",
   "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is.",
   "keywords": [
     "quo",
@@ -64,6 +64,7 @@
     "node": ">=22.18"
   },
   "dependencies": {
+    "@noble/curves": "2.4.0",
     "@noble/post-quantum": "0.7.1"
   },
   "publishConfig": {

package/src/crypto/ed25519.ts

@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
-// Ed25519 signs, as RFC 8032 defines it, and verifies with the cofactorless
-// check. The spec names exactly where a check fails, and Web Crypto promises
-// none of the decoding rules, so they are held here before Web Crypto runs:
+// Ed25519 signs, as RFC 8032 defines it, by `@noble/curves` in every
+// engine, since an engine's Web Crypto may refuse a secret the curve takes,
+// and verifies with the cofactorless check the spec names, which the
+// library's own verify does not make. The decoding rules are held here:
 //
 //   a signature of any length but sixty-four
 //   an `s` at or above the group order
 //   an `R` that does not decode, or whose bytes are not its point's encoding
 //   a public key that does not decode, or whose y is at or above the prime
 //   a public key of small order, in any spelling
-import { importSecret, own, publicOf, subtle } from './subtle.ts';
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { concat } from './bytes.ts';
+import { own, subtle } from './subtle.ts';
 
 const P = 2n ** 255n - 19n;
 const L = 2n ** 252n + 27742317777372353535851937790883648493n;
@@ -64,21 +67,26 @@ const smallOrder = (p: Point): boolean => {
   return q.x === 0n && q.y === q.z;
 };
 
-export const ed25519Public = async (secret: Uint8Array): Promise<Uint8Array> => publicOf(await importSecret('Ed25519', secret, ['sign']));
+const secretOf = (secret: Uint8Array): Uint8Array => {
+  if (secret.length !== 32) throw new TypeError('a secret is thirty-two bytes');
+  return secret;
+};
+
+export const ed25519Public = async (secret: Uint8Array): Promise<Uint8Array> => ed25519.getPublicKey(secretOf(secret));
 
-export const sign = async (secret: Uint8Array, message: Uint8Array): Promise<Uint8Array> =>
-  new Uint8Array(await subtle().sign('Ed25519', await importSecret('Ed25519', secret, ['sign']), own(message)));
+export const sign = async (secret: Uint8Array, message: Uint8Array): Promise<Uint8Array> => ed25519.sign(message, secretOf(secret));
 
+// The cofactorless check, `[s]B = R + [k]A`, on points decoded as above.
 export const verify = async (pk: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<boolean> => {
   if (signature.length !== 64) return false;
   const key = decode(pk);
   if (key === null || smallOrder(key)) return false;
   if (decode(signature.subarray(0, 32)) === null) return false;
-  if (little(signature.subarray(32)) >= L) return false;
-  try {
-    const imported = await subtle().importKey('raw', own(pk), { name: 'Ed25519' }, false, ['verify']);
-    return await subtle().verify('Ed25519', imported, own(signature), own(message));
-  } catch {
-    return false;
-  }
+  const s = little(signature.subarray(32));
+  if (s >= L) return false;
+  const R = ed25519.Point.fromBytes(signature.subarray(0, 32));
+  const A = ed25519.Point.fromBytes(pk);
+  const hashed = new Uint8Array(await subtle().digest('SHA-512', own(concat(signature.subarray(0, 32), pk, message))));
+  const k = little(hashed) % L;
+  return ed25519.Point.BASE.multiplyUnsafe(s).equals(R.add(A.multiplyUnsafe(k)));
 };

package/src/crypto/subtle.ts

@@ -11,23 +11,3 @@ export type Bytes = Uint8Array<ArrayBuffer>;
 
 // Web Crypto takes a buffer it owns, so every input is copied into one.
 export const own = (bytes: Uint8Array): Bytes => Uint8Array.from(bytes);
-
-// The PKCS#8 wrapping of a thirty-two byte secret, which is the whole of it
-// for both curves.
-const PKCS8 = { Ed25519: '302e020100300506032b657004220420', X25519: '302e020100300506032b656e04220420' } as const;
-
-export const importSecret = (curve: keyof typeof PKCS8, secret: Uint8Array, uses: KeyUsage[]): Promise<CryptoKey> => {
-  if (secret.length !== 32) throw new TypeError('a secret is thirty-two bytes');
-  const prefix = Uint8Array.from(PKCS8[curve].match(/../g)!, (b) => parseInt(b, 16));
-  const wrapped = new Uint8Array(48);
-  wrapped.set(prefix);
-  wrapped.set(secret, 16);
-  return subtle().importKey('pkcs8', wrapped, { name: curve }, true, uses);
-};
-
-// Web Crypto gives a private key's public half only through a JWK.
-export const publicOf = async (key: CryptoKey): Promise<Uint8Array> => {
-  const { x } = await subtle().exportKey('jwk', key);
-  const binary = atob(x!.replaceAll('-', '+').replaceAll('_', '/'));
-  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
-};

package/src/crypto/x25519.ts

@@ -1,19 +1,21 @@
 // SPDX-License-Identifier: Apache-2.0
-// X25519 agrees. A secret is thirty-two bytes, clamped by the function and
-// never before.
+// X25519 agrees, by `@noble/curves` in every engine, since an engine's Web
+// Crypto may refuse a secret the curve takes. A secret is thirty-two bytes,
+// clamped by the function and never before.
+import { x25519 } from '@noble/curves/ed25519.js';
 import { zero } from './bytes.ts';
-import { importSecret, own, publicOf, subtle } from './subtle.ts';
 
-export const x25519Public = async (secret: Uint8Array): Promise<Uint8Array> => publicOf(await importSecret('X25519', secret, ['deriveBits']));
+export const x25519Public = async (secret: Uint8Array): Promise<Uint8Array> => {
+  if (secret.length !== 32) throw new TypeError('a secret is thirty-two bytes');
+  return x25519.getPublicKey(secret);
+};
 
 // The agreement, or null for a public key that takes no seal: one whose
-// agreement is thirty-two zero bytes, or one the terrain refuses to read.
+// agreement is thirty-two zero bytes.
 export const agree = async (secret: Uint8Array, pk: Uint8Array): Promise<Uint8Array | null> => {
-  if (pk.length !== 32) return null;
+  if (pk.length !== 32 || secret.length !== 32) return null;
   try {
-    const mine = await importSecret('X25519', secret, ['deriveBits']);
-    const theirs = await subtle().importKey('raw', own(pk), { name: 'X25519' }, false, []);
-    const shared = new Uint8Array(await subtle().deriveBits({ name: 'X25519', public: theirs }, mine, 256));
+    const shared = x25519.getSharedSecret(secret, pk);
     return zero(shared) ? null : shared;
   } catch {
     return null;