w3pk 0.9.3 → 0.10.0

package/docs/POST_QUANTUM.md

@@ -1290,14 +1290,299 @@ const delegation = await w3pk.requestExternalWalletDelegation({
 
 ---
 
+## ML-KEM Encryption
+
+w3pk supports ML-KEM-1024 encryption for quantum-resistant data protection with multi-recipient support and deterministic key derivation from private keys.
+
+### Deterministic Key Derivation
+
+Derive ML-KEM keypairs deterministically from any private key material (Ethereum keys, random seeds, etc.):
+
+```typescript
+import { deriveMLKemKeypair, mlkemEncryptWithKey, mlkemDecryptWithKey } from 'w3pk';
+
+// Derive ML-KEM keypair from Ethereum private key
+const ethPrivateKey = '0x1234...'; // Your wallet private key
+const keypair = await deriveMLKemKeypair(ethPrivateKey, 'my-app');
+// Returns: { publicKey: Uint8Array(1568), privateKey: Uint8Array(3168) }
+
+// Share your public key with others
+const publicKeyBase64 = Buffer.from(keypair.publicKey).toString('base64');
+
+// Later: Recreate keypair from same private key (deterministic!)
+const sameKeypair = await deriveMLKemKeypair(ethPrivateKey, 'my-app');
+// sameKeypair.publicKey === keypair.publicKey ✅
+```
+
+### Encrypt/Decrypt with w3pk Instance (Recommended)
+
+The easiest way to use ML-KEM encryption - no private key exposure:
+
+```typescript
+import { createWeb3Passkey } from 'w3pk';
+
+const w3pk = createWeb3Passkey();
+await w3pk.login();
+
+// 1. Share your public key with others
+const myPublicKey = await w3pk.deriveMLKemPublicKey();
+// Send myPublicKey to the server or publish it
+
+// 2. Get server's public key
+const serverPubKey = await fetch('/api/mlkem-public-key').then(r => r.text());
+
+// 3. Encrypt for yourself + server
+const encrypted = await w3pk.mlkemEncrypt(
+  'my secret data',
+  [serverPubKey]  // Server can decrypt
+);
+// You can also decrypt because you're auto-added as recipient
+
+// 4. Later: Decrypt locally (server never sees plaintext!)
+const plaintext = await w3pk.mlkemDecrypt(encrypted);
+```
+
+**Security:** Your Ethereum private key never leaves the w3pk instance, matching the security model of `signMessage()` and `sendTransaction()`.
+
+**Supported Modes:**
+- ✅ **STANDARD** (default) - Private key derived internally, not exposed to app
+- ✅ **STRICT** - Same as STANDARD but always requires WebAuthn re-authentication
+- ✅ **YOLO** - Private key available to app
+- ❌ **PRIMARY** - Not supported (uses P-256 WebAuthn keys, not Ethereum keys)
+
+### Encrypt/Decrypt with Key Derivation (Low-level API)
+
+For advanced use cases where you manage private keys directly:
+
+```typescript
+// Client encrypts for themselves + server
+const serverKeypair = await deriveMLKemKeypair(serverEthKey, 'server');
+const encrypted = await mlkemEncryptWithKey(
+  'my secret data',
+  myEthPrivateKey,              // Sender's private key (auto-added as recipient)
+  [serverKeypair.publicKey],    // Additional recipients
+  'client'                       // Context for sender's key derivation
+);
+
+// Later: Client decrypts locally (no server needed!)
+const plaintext = await mlkemDecryptWithKey(
+  encrypted,
+  myEthPrivateKey,              // Same private key used for encryption
+  'client'                       // Same context
+);
+
+// Or: Server decrypts for operations
+const plaintext = await mlkemDecryptWithKey(
+  encrypted,
+  serverEthKey,
+  'server'
+);
+```
+
+### Direct Encryption (Without Key Derivation)
+
+For maximum flexibility, use raw public keys directly:
+
+```typescript
+import { mlkemEncrypt, mlkemDecrypt } from 'w3pk';
+
+// Single recipient
+const publicKey = 'base64_encoded_public_key...'; // 1568 bytes
+const encrypted = await mlkemEncrypt('my secret data', publicKey);
+
+// Multiple recipients (encrypt once, multiple people can decrypt)
+const encrypted = await mlkemEncrypt('my secret data', [
+  publicKey1,
+  publicKey2,
+  publicKey3
+]);
+// Returns: { recipients: [...], encryptedData, iv, authTag }
+
+// Decrypt with your private key (auto-detects which recipient you are)
+const privateKey = 'base64_encoded_private_key...'; // 3168 bytes
+const plaintext = await mlkemDecrypt(encrypted, privateKey);
+// Returns: 'my secret data'
+
+// Or specify your public key for faster lookup
+const plaintext = await mlkemDecrypt(encrypted, privateKey, publicKey);
+```
+
+### Security Properties
+
+- ✅ **ML-KEM-1024** (NIST FIPS 203) - Post-quantum secure
+- ✅ **AES-256-GCM** - 128-bit quantum security (sufficient)
+- ✅ **Key zeroization** - Shared secrets securely wiped from memory
+- ✅ **Hybrid encryption** - KEM + symmetric cipher for efficiency
+- ✅ **Cross-platform** - Works in browser and Node.js
+
+### API Reference
+
+#### Instance Methods (Recommended)
+
+These methods work with your w3pk wallet instance - no private key exposure:
+
+#### `w3pk.deriveMLKemPublicKey(options?): Promise<string>`
+
+Derives your ML-KEM-1024 public key that can be shared for encryption.
+
+**Parameters:**
+- `options.context` - Context string for domain separation (default: `'mlkem-v1'`)
+- `options.mode` - Security mode: `'STANDARD'`, `'STRICT'`, or `'YOLO'` (default: `'STANDARD'`)
+- `options.tag` - Tag for address derivation (default: `'MAIN'`)
+- `options.origin` - Origin for derivation (default: current origin)
+- `options.requireAuth` - Force WebAuthn re-authentication (default: false, always true in STRICT mode)
+
+**Note:** PRIMARY mode is not supported as it uses P-256 WebAuthn keys instead of Ethereum keys.
+
+**Returns:** Base64-encoded ML-KEM public key (1568 bytes)
+
+**Example:**
+```typescript
+const w3pk = createWeb3Passkey();
+await w3pk.login();
+const pubKey = await w3pk.deriveMLKemPublicKey();
+```
+
+#### `w3pk.mlkemEncrypt(plaintext: string, recipientPublicKeys: Array<string | Uint8Array>, options?): Promise<EncryptedPayload>`
+
+Encrypts data for yourself and additional recipients.
+
+**Parameters:**
+- `plaintext` - The data to encrypt
+- `recipientPublicKeys` - Array of recipient ML-KEM public keys (base64 or Uint8Array)
+- `options.context` - Context string (default: `'mlkem-v1'`)
+- `options.mode` - Security mode: `'STANDARD'`, `'STRICT'`, or `'YOLO'` (default: `'STANDARD'`)
+- `options.tag` - Tag for address derivation (default: `'MAIN'`)
+- `options.origin` - Origin (default: current origin)
+- `options.requireAuth` - Force re-authentication (default: false, always true in STRICT mode)
+
+**Returns:** Encrypted payload
+
+**Example:**
+```typescript
+const encrypted = await w3pk.mlkemEncrypt('secret', [serverPubKey]);
+```
+
+#### `w3pk.mlkemDecrypt(payload: EncryptedPayload, options?): Promise<string>`
+
+Decrypts data encrypted for your wallet.
+
+**Parameters:**
+- `payload` - The encrypted payload
+- `options.context` - Context string (default: `'mlkem-v1'`, must match encryption)
+- `options.mode` - Security mode: `'STANDARD'`, `'STRICT'`, or `'YOLO'` (default: `'STANDARD'`)
+- `options.tag` - Tag (default: `'MAIN'`)
+- `options.origin` - Origin (default: current origin)
+- `options.requireAuth` - Force re-authentication (default: false, always true in STRICT mode)
+
+**Returns:** Decrypted plaintext
+
+**Example:**
+```typescript
+const plaintext = await w3pk.mlkemDecrypt(encrypted);
+```
+
+---
+
+#### Low-Level Functions
+
+These functions require managing private keys directly:
+
+#### `deriveMLKemKeypair(privateKey: string | Uint8Array, context?: string): Promise<MLKemKeypair>`
+
+Derives a deterministic ML-KEM-1024 keypair from any private key material using HKDF-SHA256.
+
+**Parameters:**
+- `privateKey` - Private key material (hex string with optional `0x` prefix, or Uint8Array)
+- `context` - Optional context string for domain separation (default: `'mlkem-v1'`)
+
+**Returns:** `MLKemKeypair` object containing:
+- `publicKey` - ML-KEM-1024 public key (Uint8Array, 1568 bytes)
+- `privateKey` - ML-KEM-1024 private key (Uint8Array, 3168 bytes)
+
+**Security:** Uses HKDF with salt `"mlkem-keypair-v1"` and the provided context to derive a 64-byte seed, then generates a deterministic ML-KEM keypair. Same input always produces same output. All sensitive material is zeroized after use.
+
+#### `mlkemEncryptWithKey(plaintext: string, senderPrivateKey: string | Uint8Array, recipientPublicKeys: Array<string | Uint8Array>, senderContext?: string): Promise<EncryptedPayload>`
+
+Convenience function that derives the sender's ML-KEM keypair, then encrypts for sender + recipients.
+
+**Parameters:**
+- `plaintext` - The data to encrypt
+- `senderPrivateKey` - Sender's private key (hex string or Uint8Array)
+- `recipientPublicKeys` - Array of recipient ML-KEM public keys
+- `senderContext` - Optional context for sender's key derivation (default: `'mlkem-v1'`)
+
+**Returns:** `EncryptedPayload` (sender's public key is automatically included as first recipient)
+
+**Use case:** Encrypt data so both you and a server can decrypt independently.
+
+#### `mlkemDecryptWithKey(payload: EncryptedPayload, privateKey: string | Uint8Array, context?: string): Promise<string>`
+
+Convenience function that derives an ML-KEM keypair, then decrypts the payload.
+
+**Parameters:**
+- `payload` - The encrypted payload
+- `privateKey` - Private key material (hex string or Uint8Array)
+- `context` - Optional context for key derivation (default: `'mlkem-v1'`)
+
+**Returns:** Decrypted plaintext string
+
+**Use case:** Decrypt data using your Ethereum private key without managing separate ML-KEM keys.
+
+#### `mlkemEncrypt(plaintext: string, publicKeys: (string | Uint8Array) | Array<string | Uint8Array>): Promise<EncryptedPayload>`
+
+Encrypts data using ML-KEM-1024 + AES-256-GCM for one or more recipients.
+
+**Parameters:**
+- `plaintext` - The data to encrypt
+- `publicKeys` - Single public key or array of ML-KEM-1024 public keys (base64 strings or Uint8Arrays, 1568 bytes each)
+
+**Returns:** `EncryptedPayload` object containing:
+- `recipients` - Array of recipient entries, each containing:
+  - `publicKey` - Base64 recipient public key (1568 bytes)
+  - `ciphertext` - Base64 ML-KEM ciphertext for this recipient (1600 bytes: 1568 KEM + 32 encrypted AES key)
+- `encryptedData` - Base64 AES-encrypted data (shared across all recipients)
+- `iv` - Base64 initialization vector (12 bytes)
+- `authTag` - Base64 authentication tag (16 bytes)
+
+**How it works:**
+1. Generates a random AES-256 key
+2. Encrypts plaintext with AES-256-GCM using that key
+3. For each recipient: encapsulates a shared secret with their ML-KEM public key, then XOR-encrypts the AES key with the shared secret
+4. Each recipient can decrypt using their private key to recover the AES key, then decrypt the data
+
+#### `mlkemDecrypt(payload: EncryptedPayload, privateKey: string | Uint8Array, publicKey?: string | Uint8Array): Promise<string>`
+
+Decrypts data encrypted with `mlkemEncrypt()`.
+
+**Parameters:**
+- `payload` - The encrypted payload from `mlkemEncrypt()`
+- `privateKey` - ML-KEM-1024 private key (base64 string or Uint8Array, 3168 bytes)
+- `publicKey` - (Optional) Your ML-KEM-1024 public key for faster recipient lookup (base64 string or Uint8Array, 1568 bytes)
+
+**Returns:** Decrypted plaintext string
+
+**Throws:** Error if decryption fails (invalid key, no matching recipient, corrupted data, or tampered auth tag)
+
+**Note:** If `publicKey` is not provided, the function will try each recipient until it finds a match (slower but convenient)
+
+---
+
 ## Document Maintenance
 
-**Version:** 1.1
-**Last Updated:** 2026-02-27
-**Next Review:** 2026-08-27 (6 months)
+**Version:** 1.2
+**Last Updated:** 2026-03-21
+**Next Review:** 2026-09-21 (6 months)
 **Maintained By:** Julien Béranger ([@julienbrg](https://github.com/julienbrg))
 
 **Changelog:**
+- 2026-03-21: Added ML-KEM encryption utilities with deterministic key derivation
+  - Documented `deriveMLKemKeypair()` function for HKDF-based key derivation from private keys
+  - Documented `mlkemEncryptWithKey()` and `mlkemDecryptWithKey()` convenience functions
+  - Documented `mlkemEncrypt()` function for direct post-quantum encryption
+  - Documented `mlkemDecrypt()` function for decryption
+  - Added security properties and comprehensive API reference
+  - Linked to NIST FIPS 203 (ML-KEM) standard
 - 2026-02-27: **Updated to align with [Ethereum quantum resistance roadmap](https://x.com/VitalikButerin/status/2027075026378543132)** (February 2026)
   - Added Ethereum's four quantum-vulnerable components
   - Integrated [EIP-8141](https://eips.ethereum.org/EIPS/eip-8141) (native AA) as long-term solution

package/docs/SECURITY.md

@@ -2,6 +2,8 @@
 
 This document explains the security model of w3pk and how wallet protection works.
 
+✅ **SECURITY**: Uses PRF-based encryption with authenticator-held secrets and random salts to prevent offline decryption attacks. See [PRF-based Encryption](#migration-to-prf-based-encryption) section below.
+
 ## Overview
 
 w3pk provides **multiple layers of security** to protect user wallets:
@@ -12,7 +14,7 @@ w3pk provides **multiple layers of security** to protect user wallets:
 4. **Mode-based access control** - STANDARD/STRICT modes are view-only, YOLO mode provides full access
 5. **Encrypted storage** - AES-256-GCM encryption at rest
 6. **Secure sessions** - In-memory and optional persistent sessions (disabled in STRICT mode)
-7. **Persistent session encryption** - WebAuthn-derived key encryption for "Remember Me" functionality
+7. **PRF-based encryption** - WebAuthn PRF extension for secure key derivation (v0.9.4+)
 
 ## Enhanced Security Model (v0.8.0+)
 
@@ -1081,32 +1083,96 @@ Signature:   ${authorization.r.substring(0, 10)}...
 
 This section tracks major security-related changes to w3pk's implementation.
 
-### v0.7.0+ (Current)
+### v0.9.4+ - PRF-Based Encryption (Critical Security Fix)
 
-#### Removed: `deriveEncryptionKeyFromSignature()` (Commit 182740c)
-**Impact:** Security improvement
+#### BREAKING: `deriveEncryptionKeyFromWebAuthn()` signature changed
+**Impact:** Fixes critical encryption vulnerabilities (BREAKING CHANGE)
 
 **What changed:**
-- Removed the `deriveEncryptionKeyFromSignature()` function
-- This was a testing/legacy fallback for signature-based key derivation
-- Code comment warned: "Does NOT require biometric authentication for decryption"
+- `deriveEncryptionKeyFromWebAuthn()` signature changed from `(credentialId, publicKey?)` to `(prfOutput, salt)`
+- Now uses WebAuthn PRF extension to obtain authenticator-held secrets
+- Implements random unique salts instead of hardcoded constants
+- Added `generateSalt()` helper for creating cryptographic random salts
 
-**Why this improves security:**
-- Eliminates a weaker encryption path that could have been misused
-- Reduces code complexity and potential for developer errors
-- Single clear encryption method (`deriveEncryptionKeyFromWebAuthn()`)
-- Prevents accidental use of signature-based approach without proper session management
+**Security improvements:**
+- ✅ Key material now derived from authenticator secret (PRF output), not public credentialId/publicKey
+- ✅ Uses random 32-byte salts stored with ciphertext, not hardcoded constants
+- ✅ Eliminates offline decryption vulnerability
+- ✅ Prevents precomputation attacks
+
+**Migration required:**
+```typescript
+// ❌ OLD (v0.9.3 and earlier) - INSECURE
+const key = await deriveEncryptionKeyFromWebAuthn(credentialId, publicKey);
+
+// ✅ NEW (v0.9.4+) - SECURE
+const assertion = await navigator.credentials.get({
+  publicKey: {
+    challenge: new Uint8Array(32),
+    extensions: {
+      prf: { eval: { first: new Uint8Array(32) } }
+    }
+  }
+});
+const prfOutput = assertion.getClientExtensionResults().prf.results.first;
+const salt = generateSalt();  // Store with ciphertext
+const key = await deriveEncryptionKeyFromWebAuthn(prfOutput, salt);
+```
+
+**Status:**
+- ✅ Secure implementation complete
+- 🔴 Breaking change - migration required
+- 📖 Migration guide below
 
-**Migration:** No action needed. This function was never the primary method and was only used for testing.
+See: [Migration to PRF-based Encryption](#migration-to-prf-based-encryption)
+
+---
+
+### v0.9.4+ - ERC-5564 Stealth Scalar Reduction Fix (High Severity)
+
+#### Fixed stealth address scalar reduction vulnerability
+
+**What changed:**
+- Added `reduceScalarModN()` function to properly reduce scalars modulo secp256k1 curve order
+- Updated `generateStealthAddress()`, `checkStealthAddress()`, and `computeStealthPrivateKey()` to use reduced scalars
+- Ensures the same reduced scalar `s_h` is used consistently in both public-key and private-key operations
+
+**Security improvements:**
+- ✅ Prevents intermittent failures when keccak256(sharedSecret) ≥ curve order
+- ✅ Eliminates risk of unspendable stealth funds caused by inconsistent scalar handling
+- ✅ Ensures derived stealth address always matches derived private key
+- ✅ Validates scalars are in valid range [1, n-1] and rejects zero
+
+**Technical details:**
+- ERC-5564 computes `s_h = keccak256(sharedSecret)` and uses it as a scalar
+- Previously, `s_h` was used directly without reduction modulo `n` (secp256k1 curve order)
+- Public-key path: `stealthPubKey = spendingPubKey + (s_h × G)` would fail if `s_h ≥ n`
+- Private-key path: `stealthPrivKey = spendingKey + s_h` reduced the sum but not `s_h` itself
+- Inconsistent scalar values between paths could result in address/key mismatch
+- Now both paths use the same properly-reduced scalar
+
+**Impact:**
+- Non-breaking change (pure bugfix)
+- All existing stealth addresses remain valid
+- Eliminates edge-case failures and unspendable funds
+
+---
 
-#### Current Encryption Method
-**Primary:** `deriveEncryptionKeyFromWebAuthn(credentialId, publicKey)`
-- Deterministic key derivation from credential metadata
-- PBKDF2 with 210,000 iterations (OWASP 2023)
-- Fixed salt: `"w3pk-salt-v4"`
-- Security relies on SDK authentication-gating
+#### No Backward Compatibility
+**Decision:** Complete removal of insecure legacy function
 
-**Status:** Working as intended. This approach enables session management while maintaining security through WebAuthn authentication requirements.
+**What was removed:**
+- Removed `deriveEncryptionKeyFromWebAuthnLegacy()` function entirely
+- No backward compatibility layer for insecure encryption
+
+**Why:**
+- Legacy function had critical security vulnerabilities
+- Offline decryption attack risk unacceptable
+- Clean break ensures no accidental use of insecure method
+
+**Migration:** All call sites updated to use `deriveEncryptionKeyAuto()` which:
+- Uses PRF-based encryption when available (secure)
+- Falls back to v2 implementation internally for wallets without PRF support
 
 ### v0.7.0 - RP ID Auto-Detection (Security Hardening)
 
@@ -3683,6 +3749,159 @@ This democratizes security analysis and helps users make informed decisions abou
 
 ---
 
+## Migration to PRF-based Encryption
+
+### Overview
+
+The secure `deriveEncryptionKeyFromWebAuthn()` uses PRF-based encryption to prevent vulnerabilities:
+- **Fixed**: Now derives encryption key from authenticator-held secret (PRF output), not public credential data
+- **Fixed**: Uses random unique salts, not hardcoded constants
+
+**Benefits**: Prevents offline decryption attacks by requiring authenticator interaction.
+
+### Migration Steps
+
+#### 1. Enable PRF Extension in Registration
+
+```typescript
+// Update WebAuthn registration to enable PRF
+const credential = await navigator.credentials.create({
+  publicKey: {
+    challenge: crypto.getRandomValues(new Uint8Array(32)),
+    rp: {
+      name: "Your App",
+      id: window.location.hostname
+    },
+    user: {
+      id: userId,
+      name: username,
+      displayName: username
+    },
+    pubKeyCredParams: [{ alg: -7, type: "public-key" }],
+    authenticatorSelection: {
+      authenticatorAttachment: "platform",
+      userVerification: "required"
+    },
+    extensions: {
+      prf: {}  // ← Enable PRF extension
+    }
+  }
+});
+
+// Check if PRF is supported
+const prfEnabled = credential.getClientExtensionResults().prf?.enabled;
+if (!prfEnabled) {
+  console.warn("PRF not supported on this authenticator");
+  // Fall back to legacy method or require different authenticator
+}
+```
+
+#### 2. Capture PRF Output During Authentication
+
+```typescript
+// Get PRF output during WebAuthn assertion
+const prfSalt = crypto.getRandomValues(new Uint8Array(32));
+
+const assertion = await navigator.credentials.get({
+  publicKey: {
+    challenge: crypto.getRandomValues(new Uint8Array(32)),
+    rpId: window.location.hostname,
+    extensions: {
+      prf: {
+        eval: {
+          first: prfSalt  // Input to PRF (can be constant per credential)
+        }
+      }
+    }
+  }
+});
+
+// Extract PRF output
+const prfResults = assertion.getClientExtensionResults().prf;
+if (!prfResults?.results?.first) {
+  throw new Error("PRF output not available");
+}
+const prfOutput = prfResults.results.first;  // 32-byte secret
+```
+
+#### 3. Generate and Store Salt with Ciphertext
+
+```typescript
+import { deriveEncryptionKeyFromWebAuthn, generateSalt } from 'w3pk';
+
+// Generate random salt (do this once per encryption)
+const salt = generateSalt();  // 32 random bytes
+
+// Derive secure encryption key
+const encryptionKey = await deriveEncryptionKeyFromWebAuthn(
+  prfOutput,  // From authenticator (secret)
+  salt        // Random (store with ciphertext)
+);
+
+// Encrypt wallet data
+const encrypted = await crypto.subtle.encrypt(
+  { name: "AES-GCM", iv: crypto.getRandomValues(new Uint8Array(12)) },
+  encryptionKey,
+  new TextEncoder().encode(mnemonic)
+);
+
+// Store both salt and ciphertext together
+await storage.save({
+  encryptedMnemonic: base64(encrypted),
+  salt: base64(salt),  // ← Must be stored for decryption
+  credentialId: credential.id
+});
+```
+
+#### 4. Decrypt Using Stored Salt
+
+```typescript
+// Load encrypted data
+const data = await storage.load();
+const salt = base64Decode(data.salt);
+const encryptedMnemonic = base64Decode(data.encryptedMnemonic);
+
+// Get PRF output (same as step 2)
+const assertion = await navigator.credentials.get({
+  publicKey: {
+    challenge: crypto.getRandomValues(new Uint8Array(32)),
+    extensions: {
+      prf: { eval: { first: prfSalt } }
+    }
+  }
+});
+const prfOutput = assertion.getClientExtensionResults().prf.results.first;
+
+// Derive key with stored salt
+const encryptionKey = await deriveEncryptionKeyFromWebAuthn(prfOutput, salt);
+
+// Decrypt
+const decrypted = await crypto.subtle.decrypt(
+  { name: "AES-GCM", iv: extractIV(encryptedMnemonic) },
+  encryptionKey,
+  encryptedMnemonic
+);
+```
+
+### Browser Support
+
+PRF extension support (as of 2026):
+- ✅ Chrome/Edge 108+ (Windows Hello, Touch ID)
+- ✅ Safari 17+ (Touch ID, Face ID)
+- ✅ Firefox 122+ (limited)
+- ⚠️ Check with `getClientExtensionResults().prf.enabled`
+
+### Impact on Existing Users
+
+✅ **NO BREAKING CHANGE for SDK users**: The SDK handles migration automatically via `deriveEncryptionKeyAuto()`.
+
+**For direct API users:**
+- **Function signature changed**: `deriveEncryptionKeyFromWebAuthn()` now requires `(prfOutput, salt)` parameters
+- **Legacy function removed**: No `deriveEncryptionKeyFromWebAuthnLegacy()` available
+- **Migration path**: Use PRF-based encryption or use the auto-fallback helper
+
+---
+
 ## Post-Quantum Cryptography
 
 w3pk is preparing for the future quantum computing threat. While quantum computers capable of breaking current cryptography (ECDSA, secp256k1) are estimated to be **10-15 years away**, we have a comprehensive migration roadmap in place.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "w3pk",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "description": "WebAuthn SDK for passwordless authentication, encrypted wallets, ERC-5564 stealth addresses, and zero-knowledge proofs",
   "author": "Julien Béranger",
   "license": "GPL-3.0",
@@ -84,30 +84,34 @@
     "scripts/compute-build-hash.mjs"
   ],
   "devDependencies": {
-    "@types/node": "^24.9.0",
+    "@types/node": "^25.9.2",
     "@types/qrcode": "^1.5.5",
     "circomlib": "^2.0.5",
     "tsup": "^8.5.1",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3"
+    "tsx": "^4.22.4",
+    "typescript": "^6.0.3"
   },
   "peerDependencies": {
     "ethers": "^6.0.0"
   },
   "optionalDependencies": {
-    "@ipld/car": "^5.4.2",
-    "blockstore-core": "^6.1.1",
+    "@ipld/car": "^5.4.6",
+    "blockstore-core": "^7.0.1",
     "circomlibjs": "^0.1.7",
-    "ipfs-unixfs-importer": "^16.0.1",
+    "ipfs-unixfs-importer": "^17.0.1",
     "qrcode": "^1.5.4",
-    "snarkjs": "^0.7.5"
+    "snarkjs": "^0.7.6"
+  },
+  "dependencies": {
+    "@noble/hashes": "^2.2.0",
+    "mlkem": "^2.7.0"
   },
   "scripts": {
     "build": "tsup",
     "build:zk": "npm run build && npm run compile:circuits",
     "compile:circuits": "node scripts/compile-circuits.js",
     "dev": "tsup --watch",
-    "test": "tsx test/test.ts && tsx test/comprehensive.test.ts && tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts && tsx test/zk/zk.test.ts && tsx test/nft-ownership.test.ts && tsx test/chainlist.test.ts && tsx test/eip7702.test.ts && tsx test/external-wallet.test.ts && tsx test/erc5564.test.ts && tsx test/zk/key-stretching.test.ts && tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts && tsx test/origin-derivation.test.ts && tsx test/build-hash.test.ts && tsx test/credential-checking.test.ts && tsx test/webauthn-native.test.ts && tsx test/persistent-session.test.ts && tsx test/sign-message.test.ts && tsx test/siwe.test.ts && tsx test/requirereauth.test.ts && tsx test/eip7951.test.ts && tsx test/send-transaction.test.ts && tsx test/eip1193-provider.test.ts",
+    "test": "tsx test/test.ts && tsx test/comprehensive.test.ts && tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts && tsx test/zk/zk.test.ts && tsx test/nft-ownership.test.ts && tsx test/chainlist.test.ts && tsx test/eip7702.test.ts && tsx test/external-wallet.test.ts && tsx test/erc5564.test.ts && tsx test/zk/key-stretching.test.ts && tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts && tsx test/origin-derivation.test.ts && tsx test/build-hash.test.ts && tsx test/credential-checking.test.ts && tsx test/webauthn-native.test.ts && tsx test/persistent-session.test.ts && tsx test/sign-message.test.ts && tsx test/siwe.test.ts && tsx test/requirereauth.test.ts && tsx test/eip7951.test.ts && tsx test/send-transaction.test.ts && tsx test/eip1193-provider.test.ts && tsx test/mlkem.test.ts",
     "test:basic": "tsx test/test.ts",
     "test:comprehensive": "tsx test/comprehensive.test.ts",
     "test:backup": "tsx test/backup.test.ts",
@@ -125,7 +129,6 @@
     "test:sign-message": "tsx test/sign-message.test.ts",
     "test:siwe": "tsx test/siwe.test.ts",
     "build:hash": "node scripts/compute-build-hash.mjs",
-    "release:notes": "node scripts/generate-release-notes.mjs",
     "html": "lsof -ti:3000 | xargs kill -9 2>/dev/null || true && tsup && npx serve . -l 3000 & sleep 5 && open http://localhost:3000/standalone/checker.html"
   }
 }