2bffbc62bc
Wires @quantus/crypto into the four TYPE_* maps, so a keyring pair of type dilithium65/dilithium87 can be created, addressed, signed with and verified. The curve arms are untouched: quantus/common#6 removes them, but only once post-quantum signing is proven end to end, so that a rejected first extrinsic has two suspects rather than three. util-crypto gains thin dilithium/ wrappers so keyring composes primitives the way it already does for ed25519, rather than reaching into @quantus/crypto directly. TYPE_ADDRESS is the interesting arm. Every other entry is identity or a cheap re-encoding because on Substrate the address *is* the public key; ML-DSA takes 1952 or 2592 bytes to 32 with no way back. dilithiumVerify therefore mirrors the runtime's Verify::verify rather than inventing anything: split sig||pk, hash the embedded public key, check it equals the account being verified against, and only then check the signature. Skipping the account check would accept a valid signature from *some* key rather than *the* key, which is the whole property. TYPE_PREFIX gets 0 for dilithium87 and 1 for dilithium65. For the curve types those index Substrate's MultiSignature; here they index the runtime's DilithiumSignatureScheme — a different enum reached by the same withType mechanism, so nothing upstream of createPair needs to know. Signing takes a mandatory context, which is quantus/common#5 arriving early because the two are inseparable: TYPE_SIGNATURE cannot have an ML-DSA arm without one. There is deliberately no default. Extrinsics on spec >= 148 verify under QUANTUS_EXTRINSIC and earlier ones under the empty context, and the wrong choice is a valid signature the chain rejects, indistinguishable locally. Only the caller knows the spec version. The curve sign functions are wrapped rather than passed by reference: ed25519Sign and sr25519Sign take a third argument of their own (onlyJs), and letting it line up with the context slot would silently reinterpret a Uint8Array as a boolean. VRF signing refuses for ML-DSA. The construction fakes a VRF from an ordinary signature, which is sound only given properties ML-DSA's signature does not have; producing something that looks like a VRF proof and cannot be verified as one is worse than refusing. Two runtime whitelists sat behind the KeypairType union and silently rejected the new types — the Keyring constructor and createFromJson. The compiler cannot see those, and the first failed at construction with a message listing four types. Both now use one named KEYPAIR_TYPES so the next change to the union has a single place to look and the message cannot drift from the check. Verified against quantus-cli, not against ourselves: keyring.addFromSeed with 32 zero bytes yields crystal_alice's address, signs to the runtime's wire length, verifies under the extrinsic context and fails under the spec-147 one, and another account's signature is rejected for it. Refs quantus/common#2, quantus/common#5 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
48 lines
1.5 KiB
JSON
48 lines
1.5 KiB
JSON
{
|
|
"author": "Jaco Greeff <jacogr@gmail.com>",
|
|
"bugs": "https://github.com/polkadot-js/common/issues",
|
|
"engines": {
|
|
"node": ">=18.14"
|
|
},
|
|
"homepage": "https://github.com/polkadot-js/common#readme",
|
|
"license": "Apache-2.0",
|
|
"packageManager": "yarn@4.9.1",
|
|
"private": true,
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/polkadot-js/common.git"
|
|
},
|
|
"sideEffects": false,
|
|
"type": "module",
|
|
"version": "14.0.3",
|
|
"versions": {
|
|
"git": "14.0.3",
|
|
"npm": "14.0.3"
|
|
},
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"scripts": {
|
|
"build": "polkadot-dev-build-ts",
|
|
"build:networks": "polkadot-dev-run-test packages/networks/src",
|
|
"build:release": "polkadot-ci-ghact-build",
|
|
"build:rollup": "polkadot-exec-rollup --config",
|
|
"clean": "polkadot-dev-clean-build",
|
|
"deno": "yarn polkadot-dev-deno-map && yarn build && deno check --import-map=import_map.json mod.ts",
|
|
"lint": "polkadot-dev-run-lint",
|
|
"postinstall": "polkadot-dev-yarn-only",
|
|
"test": "polkadot-dev-run-test --env browser ^mnemonic/toMiniSecretCmp",
|
|
"test:mnemonicCmp": "polkadot-dev-run-test --env browser mnemonic/toMiniSecretCmp",
|
|
"test:node": "polkadot-dev-run-test --env browser ^mnemonic/toMiniSecretCmp",
|
|
"test:one": "polkadot-dev-run-test --env browser"
|
|
},
|
|
"devDependencies": {
|
|
"@polkadot/dev": "^0.83.3",
|
|
"@types/node": "^22.7.5"
|
|
},
|
|
"resolutions": {
|
|
"@quantus/crypto": "link:../wasm/packages/quantus-crypto/build",
|
|
"typescript": "^5.5.4"
|
|
}
|
|
}
|