Skip to content

2.0.0

Choose a tag to compare

View all tags
@paulmillr paulmillr released this 25 Aug 15:16
· 8 commits to main since this release
2.0.0
This tag was signed with the committer’s verified signature.
paulmillr Paul Miller
GPG key ID: 697079DA6878B89B
Verified
Learn about vigilant mode.
24d3110
This commit was signed with the committer’s verified signature.
paulmillr Paul Miller
GPG key ID: 697079DA6878B89B
Verified
Learn about vigilant mode.

High-level

v2 massively simplifies internals, improves security, reduces bundle size and lays path for the future. To simplify upgrading, upgrade first to curves 1.9.x. It would show deprecations in vscode-like text editor.

  • The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
    • Node v20.19 is now the minimum required version
    • Package imports now work correctly in bundler-less environments, such as browsers
    • Reduces npm package size (traffic consumed): 354KB => 300KB
    • Reduces unpacked npm size (on-disk space): 2.1MB => 1.2MB
  • Make bundle sizes smaller, compared to v1.x: -4KB for schnorr, -5.3KB for ristretto255, -9.4KB for x448
  • .js extension must be used for all modules
    • Old: @noble/curves/ed25519
    • New: @noble/curves/ed25519.js
    • This simplifies working in browsers natively without transpilers

New features

  • webcrypto: create friendly noble-like wrapper over built-in WebCrypto
  • oprf: implement RFC 9497 OPRFs (oblivious pseudorandom functions)
    • We support p256, p384, p521, ristretto255 and decaf448
  • weierstrass, edwards: add isValidSecretKey, isValidPublicKey
  • misc: add Brainpool curves: brainpoolP256r1, brainpoolP384r1, brainpoolP512r1

Changes

  • Most methods now expect Uint8Array, string hex inputs are prohibited
    • The change simplifies reasoning, improves security and reduces malleability
    • Point.fromHex now expects string-only hex inputs, use Point.fromBytes for Uint8Array
  • Breaking changes of ECDSA (secp256k1, p256, p384...):
    • sign, verify: Switch to prehashed messages. Instead of
      messageHash, the methods now expect unhashed message.
      To bring back old behavior, use option {prehash: false}
    • sign, verify: Switch to lowS signatures by default.
      This change doesn't affect secp256k1, which has been using lowS since beginning.
      To bring back old behavior, use option {lowS: true}
    • sign, verify: Switch to Uint8Array signatures (format: 'compact') by default.
    • verify: der format must be explicitly specified in {format: 'der'}.
      This reduces malleability
    • verify: prohibit Signature-instance signature. User must now always do
      signature.toBytes()
  • Breaking changes of BLS signatures (bls12-381, bn254):
    • Move getPublicKey, sign, verify, signShortSignature etc into two new namespaces:
      bls.longSignatures (G1 pubkeys, G2 sigs) and bls.shortSignatures (G1 sigs, G2 pubkeys).
    • verifyBatch now expects array of inputs {message: ..., publicKey: ...}[]
  • Curve changes:
    • Massively simplify curve creation, split it into point creation & sig generator creation
    • New methods are weierstrass() + ecdsa() / edwards() + eddsa()
    • weierstrass / edwards expect simplified curve params (Fp became p)
    • ecdsa / eddsa expect Point class and hash
    • Remove unnecessary Fn argument in pippenger
  • modular changes:
    • Field#fromBytes() now validates elements to be in 0..order-1 range
  • Upgrade typescript compilation env to ts5.9 and es2022
  • Massively improve error messages, make them more descriptive

Renamings

  • Module changes
    • p256, p384, p521 modules have been moved into nist
    • jubjub module has been moved into misc
  • Point changes
    • ExtendedPoint, ProjectivePoint => Point
    • Point coordinates (projective / extended) from px/ex, py/ey, pz/ez, et => X, Y, Z, T
    • Point.normalizeZ, Point.msm => separate methods in abstract/curve.js submodule
    • Point.fromPrivateKey() got removed, use Point.BASE.multiply() and Point.Fn.fromBytes(secretKey)
    • toRawBytes, fromRawBytes => toBytes, fromBytes
    • RistrettoPoint => ristretto255.Point, DecafPoiont => decaf448.Point
  • Signature (ECDSA) changes
    • toCompactRawBytes, toDERRawBytes => toBytes('compact'), toBytes('der')
    • toCompactHex, toDERHex => toHex('compact'), toHex('der')
    • fromCompact, fromDER => fromBytes(format), fromHex(format)
  • utils changes
    • randomPrivateKey => randomSecretKey
    • utils.precompute, Point#_setWindowSize => Point#precompute
    • edwardsToMontgomery => utils.toMontgomery
    • edwardsToMontgomeryPriv => utils.toMontgomerySecret
  • Rename all curve-specific hash-to-curve methods to *curve*_hasher.
    Example: secp256k1.hashToCurve => secp256k1_hasher.hashToCurve()
  • Massive type renamings and improvements

Removed features

  • Point#multiplyAndAddUnsafe, Point#hasEvenY
  • CURVE property with all kinds of random stuff. Point.CURVE() now replaces it, but only provides
    curve parameters
  • Remove pasta, bn254_weierstrass (NOT pairing-based bn254) curves
  • Field.MASK
  • utils.normPrivateKeyToScalar

Full Changelog: 1.9.6...2.0.0

Assets 4
Loading