spd-lib 1.1.7 → 1.1.9

package/index.js

@@ -11,27 +11,11 @@ class SPD {
         this.keyPair; // Generate a key pair for encryption/decryption
         this.userKey;
         this.salt;
-        this.signingKeyPair;
         this.init();
     }
     async init() {
         await sodium.ready;
         this.keyPair = sodium.crypto_box_keypair()
-        this.signingKeyPair = sodium.crypto_sign_keypair();
-    }
-    static async deriveSigningKeys(passcode, salt) {
-        if (!passcode || typeof passcode !== 'string' || passcode.length < 8 ||
-            !salt || !(salt instanceof Buffer) || salt.length !== 16) {
-            throw new Error('Invalid passcode or salt.');
-        }
-    
-        const { pbk } = await SPD.derivePBK(passcode, salt);
-        await sodium.ready;
-        // Derive separate keys for signing to avoid key reuse
-        const signingSeed = pbk.slice(0, sodium.crypto_sign_SEEDBYTES);
-        const signingKeyPair = sodium.crypto_sign_seed_keypair(signingSeed);
-    
-        return { signingKeyPair };
     }
     async setPassKey(passcode){
             await sodium.ready;
@@ -40,8 +24,6 @@ class SPD {
 const userKey = pqcKey.publicKey;
 this.userKey = userKey;
 this.salt = salt;
-const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
-    this.signingKeyPair = derivedKeys.signingKeyPair;
     }
 
     async addData(name, data) {
@@ -50,12 +32,13 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
         const dmap = await this.CITS(data)
         await sodium.ready;
         const dat = Buffer.from(dmap[0]);
-        const compressedData = zlib.deflateSync(dat);
+        const compressedData = zlib.deflateSync(dat,{
+            level:9
+        });
         const nonce = sodium.randombytes_buf(sodium.crypto_box_NONCEBYTES);
         const encryptedData = sodium.crypto_secretbox_easy(compressedData, nonce, this.userKey);
         const hash = crypto.createHash('sha256').update(encryptedData).digest('hex');
-        const signature = sodium.crypto_sign_detached(encryptedData, this.signingKeyPair.privateKey);
-        this.data.push({ dataName: name, nonce: Array.from(nonce), data: Array.from(encryptedData),signature:Array.from(signature), hash, dataType: dmap[1] });
+        this.data.push({ dataName: name, nonce: Array.from(nonce), data: Array.from(encryptedData), hash, dataType: dmap[1] });
     }
 
     saveToFile(outputPath) {
@@ -63,8 +46,10 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
             throw new Error('Invalid output path or salt.');
         }
 
-        const spdData = JSON.stringify({ data: this.data, salt: Array.from(this.salt),signingPublicKey:Array.from(this.signingKeyPair.publicKey) });
-        const compressedSpdData = zlib.deflateSync(spdData);
+        const spdData = JSON.stringify({ data: this.data, salt: Array.from(this.salt) });
+        const compressedSpdData = zlib.deflateSync(spdData,{
+            level:9
+        });
         fs.writeFileSync(outputPath, compressedSpdData, { mode: 0o600 });
     }
 
@@ -78,8 +63,8 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
 
         await sodium.ready;
         const compressedSpdData = fs.readFileSync(spdPath);
-        const spdData = zlib.inflateSync(compressedSpdData).toString('utf8');
-        const { data, salt, signingPublicKey } = JSON.parse(spdData);
+        const spdData = zlib.inflateSync(compressedSpdData,{level:9}).toString('utf8');
+        const { data, salt } = JSON.parse(spdData);
 
         const { pqcKey } = await new SPD().convertPasscodeToPQCKeySalted(passcode, new Uint8Array(salt));
         const pbk = pqcKey.publicKey;
@@ -88,34 +73,19 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
         spd.keyPair = {
             publicKey: pbk.publicKey
         };
-        
-        spd.signingKeyPair = { publicKey: Uint8Array.from(signingPublicKey) };
         spd.data = data.map(dat => ({
             dataName: dat.dataName,
             nonce: Buffer.from(dat.nonce),
             data: Buffer.from(dat.data),
-            signature: Buffer.from(dat.signature),
             hash: dat.hash,
             dataType: dat.dataType
         }));
         spd.data.forEach(dat => {
-            const encryptedBuffer = Buffer.from(dat.data);
-            const signatureBuffer = Buffer.from(dat.signature);
-            const signingPublicKeyBuffer = Uint8Array.from(signingPublicKey);
-
-            const isValid = sodium.crypto_sign_verify_detached(signatureBuffer, encryptedBuffer, signingPublicKeyBuffer);
-            if (!isValid) {
-                rej(new Error(`Signature verification failed for ${dat.dataName}`));
-                return;
-            }
-
-            const calculatedHash = crypto.createHash('sha256').update(encryptedBuffer).digest('hex');
+            const calculatedHash = crypto.createHash('sha256').update(Buffer.from(dat.data)).digest('hex');
             if (calculatedHash !== dat.hash) {
                 rej(new Error(`Data integrity check failed for ${dat.dataName}`));
-                return;
             }
         });
-        
         res(spd);
     }catch{
         rej()
@@ -130,30 +100,10 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
         let extractedFiles = {};
         this.data.forEach(async dat => {
             try{
-                const calculatedHash = crypto.createHash('sha256').update(dat.data).digest('hex');
-                if (calculatedHash !== dat.hash) {
-                    throw new Error(`Hash mismatch for ${dat.dataName}`);
-                }
-
-                // Verify signature
-                const isValid = sodium.crypto_sign_verify_detached(
-                    Buffer.from(dat.signature),
-                    Buffer.from(dat.data),
-                    this.signingKeyPair.publicKey
-                );
-                if (!isValid) {
-                    throw new Error(`Signature verification failed for ${dat.dataName}`);
-                }
-
-                // Decrypt data
-                const decryptedData = sodium.crypto_secretbox_open_easy(
-                    Buffer.from(dat.data),
-                    Buffer.from(dat.nonce),
-                    this.userKey
-                );
-                const decompressedData = zlib.inflateSync(decryptedData);
-                const dt = decompressedData.toString('utf8');
-                extractedFiles[dat.dataName] = await this.CSTI(dt, dat.dataType);
+            const decryptedData = sodium.crypto_secretbox_open_easy(dat.data, dat.nonce, this.userKey);
+            const decompressedData = zlib.inflateSync(decryptedData,{level:9});
+            const dt = decompressedData.toString('utf8');
+            extractedFiles[dat.dataName] = await this.CSTI(dt, dat.dataType);
             }catch{
                 rej()
             }
@@ -185,7 +135,7 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
 
     saveData() {
         const spdData = JSON.stringify({ data: this.data, salt: Array.from(this.salt) });
-        const compressedSpdData = zlib.deflateSync(spdData);
+        const compressedSpdData = zlib.deflateSync(spdData,{level:9});
         return compressedSpdData;
     }
 
@@ -198,17 +148,15 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
       
         await sodium.ready;
         const spdDataBuffer = Buffer.from(spdData, 'base64');
-        const spdData2 = zlib.inflateSync(spdDataBuffer).toString('utf8');
-        const { data, salt, signingPublicKey } = JSON.parse(spdData2);
+        const spdData2 = zlib.inflateSync(spdDataBuffer,{level:9}).toString('utf8');
+        const { data, salt } = JSON.parse(spdData2);
         const { pqcKey } = await new SPD().convertPasscodeToPQCKeySalted(passcode, new Uint8Array(salt));
-        
         const pbk = pqcKey.publicKey;
         const spd = new SPD();
         spd.userKey = pbk;
         spd.keyPair = {
             publicKey: pbk.publicKey
         };
-        spd.signingKeyPair = { publicKey: Uint8Array.from(signingPublicKey) };
         spd.data = data.map(dat => ({
             dataName: dat.dataName,
             nonce: Buffer.from(dat.nonce),
@@ -217,21 +165,10 @@ const derivedKeys = await SPD.deriveSigningKeys(passcode, salt);
             dataType: dat.dataType
         }));
         spd.data.forEach(dat => {
-            const encryptedBuffer = Buffer.from(dat.data);
-                const signatureBuffer = Buffer.from(dat.signature);
-                const signingPublicKeyBuffer = Uint8Array.from(signingPublicKey);
-
-                const isValid = sodium.crypto_sign_verify_detached(signatureBuffer, encryptedBuffer, signingPublicKeyBuffer);
-                if (!isValid) {
-                    rej(new Error(`Signature verification failed for ${dat.dataName}`));
-                    return;
-                }
-
-                const calculatedHash = crypto.createHash('sha256').update(encryptedBuffer).digest('hex');
-                if (calculatedHash !== dat.hash) {
-                    rej(new Error(`Data integrity check failed for ${dat.dataName}`));
-                    return;
-                }
+            const calculatedHash = crypto.createHash('sha256').update(Buffer.from(dat.data)).digest('hex');
+            if (calculatedHash !== dat.hash) {
+                rej(new Error(`Data integrity check failed for ${dat.dataName}`));
+            }
         });
         res(spd);
     }catch{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spd-lib",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "description": "SPD or Secure Packaged Data is a compress PQC protected file format to store sensitive data localy",
   "main": "index.js",
   "scripts": {
@@ -21,6 +21,6 @@
   "author": "ALS-OPSS",
   "license": "ISC",
   "dependencies": {
-    "libsodium-wrappers": "^0.7.13"
+    "libsodium-wrappers": "^0.7.15"
   }
 }