quantum-resistant-rustykey 0.13.1 → 0.13.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -602,6 +602,24 @@ See the live [PQC testbed](https://pqc.rustykey.me) or run the frontend examples
|
|
|
602
602
|
|
|
603
603
|
ML-KEM logic comes from **mlkem-native** (C), compiled with **Emscripten** under `wasm/`, wrapped by TypeScript in `mlkem-src/`, then bundled into `src/vendor/mlkem*.js`.
|
|
604
604
|
|
|
605
|
+
## Supply-chain provenance
|
|
606
|
+
|
|
607
|
+
Each release tarball is built in GitHub Actions and signed with a Sigstore-backed
|
|
608
|
+
**build provenance attestation** (keyless, via GitHub OIDC). This proves the exact
|
|
609
|
+
published artifact was produced by this repository's CI at a specific commit. Verify
|
|
610
|
+
before installing:
|
|
611
|
+
|
|
612
|
+
```bash
|
|
613
|
+
gh attestation verify "$(npm pack quantum-resistant-rustykey@<version> 2>/dev/null)" \
|
|
614
|
+
--repo antonymott/quantum-resistant-rustykey
|
|
615
|
+
```
|
|
616
|
+
|
|
617
|
+
**Scope of this guarantee:** the attestation proves *provenance* — who built the
|
|
618
|
+
artifact, from which repository and commit. It is **not** a reproducible build and
|
|
619
|
+
does **not**, on its own, prove that the compiled WASM is bit-for-bit derivable from
|
|
620
|
+
the C sources. WASM behavioural correctness is covered separately by the Known Answer
|
|
621
|
+
Tests below.
|
|
622
|
+
|
|
605
623
|
## Security Considerations
|
|
606
624
|
|
|
607
625
|
This implementation includes patches to withstand side-channel attacks. For more information about the security improvements, see: [RaspberryPi recovers secret keys from NIST winner implementation...within minutes](https://kannwischer.eu/papers/2024_kyberslash_preprint20240628.pdf)
|
package/package.json
CHANGED