rob thijssen
e1d88c6f63
KeypairType is now 'dilithium65' | 'dilithium87'. Upstream's four types are
gone with their primitives, not merely unoffered. Each falls to Shor's
algorithm, and a keyring that can hold such a key invites someone to keep funds
under it, inside a tool whose premise is that this is unsafe.
This was deferred until post-quantum signing was proven end to end (real
transfers on Heisenberg, a real mainnet wallet in the extension), so that
tearing out half of util-crypto could not muddy the diagnosis of a first
rejected extrinsic. That has happened.
util-crypto, removed:
- ed25519/, sr25519/, secp256k1/, and signature/ (signatureVerify, which only
knew those three; dilithiumVerify is the verifier);
- hd/ethereum and hd/ledger;
- key/fromPath and keyHdkd{Ecdsa,Ed25519,Sr25519}, the junction derivation;
- address/derive (sr25519 soft derivation);
- mnemonic/toMiniSecret, Substrate's classical seeding.
util-crypto, kept because none of it holds a key:
- ethereumEncode, isEthereumAddress and isEthereumChecksum. @polkadot/types and
the identicon renderer format 20-byte addresses with them, and a wallet has
to be able to show an Ethereum address to recognise and refuse one.
ethereumEncode now refuses a secp256k1 public key, saying why.
- evm ↔ substrate address conversion (its blake2/keccak hasher moved out of
secp256k1/ into address/), derived and multi addresses, BIP39, and suri
parsing.
keyring:
- Only ML-DSA arms remain. The default type is dilithium65.
- Every entry point (constructor, createFromUri, createFromPair, addFromAddress
and, above all, createFromJson for a backup the user chose) refuses a
quantum-unsafe type with "<type> keys are not quantum-safe and cannot be held
here", not "unknown crypto type", which reads like a bug in this software.
- pair.verify handles ML-DSA, a bare signature or signature ‖ publicKey, under
a context that defaults to the empty raw-bytes one. Derivation and VRF
refuse.
- The test keyring is the Quantus dev accounts (crystal_alice, dilithium_bob,
crystal_charlie: ML-DSA-87 from seeds of 0, 1 and 2) in place of sr25519
Alice…Ferdie and ethereum Alith…Faith.
Fixed along the way: addFromAddress passed the decoded address as a public key.
That is the same bytes on Substrate. Here it is the account id, a hash of the
key, so every watch-only account reported the hash of its own address. It now
carries the address as an account id.
Specs:
- Upstream's per-scheme keyring specs (index, pair, encode, decode, toJson,
vrf, suri, testingPairs) are replaced by keyring.spec.ts. It covers refusals
at every entry point (including a polkadot{.js} ed25519 JSON backup), the
dev-account addresses, watch-only addresses, JSON round trips for both
schemes, verify in both signature forms and failing under the wrong context
or signer, and the absence of derivation and VRF.
- The "classical paths unchanged" pins in the ML-DSA specs are gone with the
paths.
- The BIP39 vectors toEntropy.spec used moved from sr25519/ to
mnemonic/bip39Vectors.spec.ts.
yarn test: 2747 passing, 0 failing. yarn lint: clean.
hw-ledger and hw-ledger-transports remain. They are device transports holding
no primitives, and nothing consumes them.
Closes #6. Refs #1: signatureVerify is gone rather than made to take a
context; dilithiumVerify is the replacement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
46 lines
1.3 KiB
JSON
46 lines
1.3 KiB
JSON
{
|
|
"author": "Jaco Greeff <jacogr@gmail.com>",
|
|
"bugs": "https://github.com/polkadot-js/common/issues",
|
|
"engines": {
|
|
"node": ">=18.14"
|
|
},
|
|
"homepage": "https://github.com/polkadot-js/common#readme",
|
|
"license": "Apache-2.0",
|
|
"packageManager": "yarn@4.9.1",
|
|
"private": true,
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/polkadot-js/common.git"
|
|
},
|
|
"sideEffects": false,
|
|
"type": "module",
|
|
"version": "14.0.3",
|
|
"versions": {
|
|
"git": "14.0.3",
|
|
"npm": "14.0.3"
|
|
},
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"scripts": {
|
|
"build": "polkadot-dev-build-ts",
|
|
"build:networks": "polkadot-dev-run-test packages/networks/src",
|
|
"build:release": "polkadot-ci-ghact-build",
|
|
"build:rollup": "polkadot-exec-rollup --config",
|
|
"clean": "polkadot-dev-clean-build",
|
|
"deno": "yarn polkadot-dev-deno-map && yarn build && deno check --import-map=import_map.json mod.ts",
|
|
"lint": "polkadot-dev-run-lint",
|
|
"postinstall": "polkadot-dev-yarn-only",
|
|
"test": "polkadot-dev-run-test --env browser",
|
|
"test:node": "polkadot-dev-run-test --env browser ^mnemonic/toMiniSecretCmp",
|
|
"test:one": "polkadot-dev-run-test --env browser"
|
|
},
|
|
"devDependencies": {
|
|
"@polkadot/dev": "^0.83.3",
|
|
"@types/node": "^22.7.5"
|
|
},
|
|
"resolutions": {
|
|
"typescript": "^5.5.4"
|
|
}
|
|
}
|