quantum-resistant-rustykey 0.13.6 → 0.13.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +44 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,8 +4,44 @@
|
|
|
4
4
|
[](https://antonymott.github.io/quantum-resistant-rustykey/)
|
|
5
5
|
|
|
6
6
|
|
|
7
|
-
TypeScript-first **WebAssembly
|
|
8
|
-
RustyKey® is a **FIDO Alliance** member.
|
|
7
|
+
TypeScript-first **WebAssembly and WebGPU\* quantum-resistant** crypto for Node and browser — SQIsign, ML-DSA, FN-DSA, SLH-DSA, ML-KEM.
|
|
8
|
+
RustyKey® is a **FIDO® Alliance** member.
|
|
9
|
+
|
|
10
|
+
> \*Only the SQIsign algorithm ships WebGPU-accelerated variants, at all three security
|
|
11
|
+
> levels (L5, L3, L1). We introduced them experimentally, since several of SQIsign's
|
|
12
|
+
> isogeny computations are GPU-parallelizable, and offloading them to WebGPU
|
|
13
|
+
> meaningfully speeds up signature creation over the WebAssembly path (itself already
|
|
14
|
+
> faster than plain JS) — typically 1.25x–1.8x, depending on security level and GPU.
|
|
15
|
+
>
|
|
16
|
+
> **⚠️ Treat WebGPU variants as experimental — no production use at all — until v1.0.0.**
|
|
17
|
+
> Combining WebAssembly and WebGPU with the inherent mathematical properties of isogenies
|
|
18
|
+
> shifts the most likely attack vectors toward algorithmic side-channels, GPU
|
|
19
|
+
> memory-architecture quirks, and memory-safety mismatches at the Wasm/WGSL translation
|
|
20
|
+
> boundary (full analysis: `docs/security/threat-model.md`). This risk is more likely to
|
|
21
|
+
> affect the WebGPU-accelerated path — the WebAssembly-only implementation is less likely
|
|
22
|
+
> affected by these GPU-specific vectors.
|
|
23
|
+
>
|
|
24
|
+
> These WebGPU variants are **browser-only** and require the page to be served with
|
|
25
|
+
> COOP and COEP headers so that `self.crossOriginIsolated === true`. Without cross-origin
|
|
26
|
+
> isolation, WebGPU compute cannot be used at all — the library detects this and
|
|
27
|
+
> automatically falls back to the WebAssembly implementation, which is also the
|
|
28
|
+
> default (and only) backend in Node.
|
|
29
|
+
>
|
|
30
|
+
> **Do not patch out or bypass the `crossOriginIsolated` check to force WebGPU execution
|
|
31
|
+
> on a non-isolated page.** That check is not a convenience gate — it enforces the same
|
|
32
|
+
> isolation boundary that limits the cross-tab cache-timing and high-resolution-timer
|
|
33
|
+
> attacks this package's WebGPU path is otherwise exposed to. The same applies if your
|
|
34
|
+
> own application runs keygen and other, untrusted code in the same tab, worker, or
|
|
35
|
+
> execution context even with the check fully intact — that is not isolation, it's just
|
|
36
|
+
> two things sharing a room. Builds or integrations that do either of these fall outside
|
|
37
|
+
> this package's threat model and support/disclosure scope — key-recovery incidents on
|
|
38
|
+
> such setups should not be attributed to the maintained package's supported
|
|
39
|
+
> configuration.
|
|
40
|
+
>
|
|
41
|
+
> **Think you've found a genuine key-recovery or forgery issue under a properly isolated
|
|
42
|
+
> configuration?** Please report it per `SECURITY.md` before sharing it publicly or with
|
|
43
|
+
> standards bodies — it defines what's in scope and includes a safe-harbor commitment for
|
|
44
|
+
> good-faith research.
|
|
9
45
|
|
|
10
46
|
```bash
|
|
11
47
|
pnpm i quantum-resistant-rustykey@latest
|
|
@@ -13,6 +49,12 @@ pnpm i quantum-resistant-rustykey@latest
|
|
|
13
49
|
|
|
14
50
|
TypeScript types are included (`dist/index.d.ts`) — no `@types/quantum-resistant-rustykey`.
|
|
15
51
|
|
|
52
|
+
### NIST™ approval status: quantum resistant algorithms
|
|
53
|
+
- ML-DSA, FN-DSA, SLH-DSA, ML-KEM [NIST™ approved](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)
|
|
54
|
+
- SQIsign [NIST™ NOT YET approved, advanced to round 3](https://csrc.nist.gov/projects/pqc-dig-sig/round-3-additional-signatures)
|
|
55
|
+
|
|
56
|
+
A model running in the browser eventually becomes a sequence of GPU operations: matrix multiplications, normalizations, convolutions, attention primitives, quantization operations, data-layout transformations, and many more. WebGPU makes these operations available across modern browsers through a portable API, while WGSL provides a common language for the shaders that execute them.
|
|
57
|
+
|
|
16
58
|
**Docs:** [antonymott.github.io/quantum-resistant-rustykey](https://antonymott.github.io/quantum-resistant-rustykey/)
|
|
17
59
|
**Live testbed:** [pqc.rustykey.me](https://pqc.rustykey.me)
|
|
18
60
|
**License:** ISC
|
package/package.json
CHANGED