Merge pull request #1935 from cosmos/crypto-updates

webmaster128 · web-flow · commit 2988ab9652a4 · 2025-12-31T09:15:57.000+01:00
Upgrade @noble/ciphers, @noble/curves, @noble/hashes and @scure/bip39 to v2
diff --git a/.pnp.cjs b/.pnp.cjs
diff --git a/.yarn/cache/@noble-ciphers-npm-1.3.0-73a7db337f-3ba6da645c.zip b/.yarn/cache/@noble-ciphers-npm-1.3.0-73a7db337f-3ba6da645c.zip
diff --git a/.yarn/cache/@noble-ciphers-npm-2.1.1-624aa44155-f026627234.zip b/.yarn/cache/@noble-ciphers-npm-2.1.1-624aa44155-f026627234.zip
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b72596fa6686a8a1fd0fa5f758281335ee51344a23ab8cc61aee5a65d77a0337
+size 498941
diff --git a/.yarn/cache/@noble-curves-npm-1.9.2-2584df26a7-21d049ae45.zip b/.yarn/cache/@noble-curves-npm-1.9.2-2584df26a7-21d049ae45.zip
diff --git a/.yarn/cache/@noble-curves-npm-2.0.1-cd0988b6b8-e0b329eb92.zip b/.yarn/cache/@noble-curves-npm-2.0.1-cd0988b6b8-e0b329eb92.zip
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b962a7445619c4fef4357b7da45fa652b3c95425dd3f53a514856dae9697138c
+size 1258233
diff --git a/.yarn/cache/@noble-hashes-npm-2.0.1-3deaaa8c92-e81769ce21.zip b/.yarn/cache/@noble-hashes-npm-2.0.1-3deaaa8c92-e81769ce21.zip
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c1418d1af628db45a47de1fe940d1cc2f6cb36733e9c9b51ae5931108d6cf76b
+size 685555
diff --git a/.yarn/cache/@scure-bip39-npm-1.6.0-63a27ac0b7-73a54b5566.zip b/.yarn/cache/@scure-bip39-npm-1.6.0-63a27ac0b7-73a54b5566.zip
diff --git a/.yarn/cache/@scure-bip39-npm-2.0.1-715af0e367-ed8a0788bc.zip b/.yarn/cache/@scure-bip39-npm-2.0.1-715af0e367-ed8a0788bc.zip
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4a411036cb2d0f07e6b72a92a3138d67813c96fa31f190cfb3a16d6190ecff74
+size 202966
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,10 @@ and this project adheres to
 ### Changed
 
 - all: Drop support for Node.js < 22.
+- @cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves,
+  @noble/hashes and @scure/bip39 to v2. ([#1935])
+
+[#1935]: https://github.com/cosmos/cosmjs/pull/1935
 
 ## [0.38.0] - 2025-12-30
 
diff --git a/packages/crypto/package.json b/packages/crypto/package.json
@@ -43,10 +43,10 @@
     "@cosmjs/encoding": "workspace:^",
     "@cosmjs/math": "workspace:^",
     "@cosmjs/utils": "workspace:^",
-    "@noble/ciphers": "^1.3.0",
-    "@noble/curves": "^1.9.2",
-    "@noble/hashes": "^1.8.0",
-    "@scure/bip39": "^1.6.0",
+    "@noble/ciphers": "^2.1.1",
+    "@noble/curves": "^2.0.1",
+    "@noble/hashes": "^2.0.1",
+    "@scure/bip39": "^2.0.1",
     "hash-wasm": "^4.12.0"
   },
   "devDependencies": {
diff --git a/packages/crypto/src/bip39.spec.ts b/packages/crypto/src/bip39.spec.ts
@@ -20,26 +20,26 @@ describe("Bip39", () => {
 
     it("throws for invalid input", () => {
       // invalid input length
-      expect(() => Bip39.encode(fromHex(""))).toThrowError(/got length/);
-      expect(() => Bip39.encode(fromHex("00"))).toThrowError(/got length/);
+      expect(() => Bip39.encode(fromHex(""))).toThrowError(/invalid entropy length/);
+      expect(() => Bip39.encode(fromHex("00"))).toThrowError(/invalid entropy length/);
       expect(() => Bip39.encode(fromHex("000000000000000000000000000000"))).toThrowError(
-        /expected of length .*, got length=15/,
+        /invalid entropy length/,
       );
       expect(() => Bip39.encode(fromHex("0000000000000000000000000000000000"))).toThrowError(
-        /expected of length .*, got length=17/,
+        /invalid entropy length/,
       );
       expect(() => Bip39.encode(fromHex("0000000000000000000000000000000000000000000000"))).toThrowError(
-        /got length/,
+        /invalid entropy length/,
       );
       expect(() => Bip39.encode(fromHex("00000000000000000000000000000000000000000000000000"))).toThrowError(
-        /got length/,
+        /invalid entropy length/,
       );
       expect(() =>
         Bip39.encode(fromHex("00000000000000000000000000000000000000000000000000000000000000")),
-      ).toThrowError(/got length/);
+      ).toThrowError(/invalid entropy length/);
       expect(() =>
         Bip39.encode(fromHex("000000000000000000000000000000000000000000000000000000000000000000")),
-      ).toThrowError(/got length/);
+      ).toThrowError(/invalid entropy length/);
     });
   });
 
diff --git a/packages/crypto/src/bip39.ts b/packages/crypto/src/bip39.ts
@@ -1,6 +1,6 @@
 import { fixUint8Array } from "@cosmjs/encoding";
 import { entropyToMnemonic, mnemonicToEntropy, mnemonicToSeed } from "@scure/bip39";
-import { wordlist } from "@scure/bip39/wordlists/english";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
 
 export class EnglishMnemonic {
   public static readonly wordlist: readonly string[] = wordlist;
diff --git a/packages/crypto/src/ed25519.spec.ts b/packages/crypto/src/ed25519.spec.ts
@@ -72,13 +72,17 @@ describe("Libsodium", () => {
       {
         // seed too short
         const seed = fromHex("43a9c17ccbb0e767ea29ce1f10813afde5f1e0a7a504e89b4d2cc2b952b8e0");
-        await expectAsync(Ed25519.makeKeypair(seed)).toBeRejectedWithError(/key of length 32 expected/);
+        await expectAsync(Ed25519.makeKeypair(seed)).toBeRejectedWithError(
+          /"secretKey" expected Uint8Array of length 32, got length=31/,
+        );
       }
 
       {
         // seed too long
         const seed = fromHex("43a9c17ccbb0e767ea29ce1f10813afde5f1e0a7a504e89b4d2cc2b952b8e0b9aa");
-        await expectAsync(Ed25519.makeKeypair(seed)).toBeRejectedWithError(/key of length 32 expected/);
+        await expectAsync(Ed25519.makeKeypair(seed)).toBeRejectedWithError(
+          /"secretKey" expected Uint8Array of length 32, got length=33/,
+        );
       }
     });
 
diff --git a/packages/crypto/src/secp256k1.ts b/packages/crypto/src/secp256k1.ts
@@ -1,6 +1,6 @@
 import { fixUint8Array, fromHex, toHex } from "@cosmjs/encoding";
 import { assert } from "@cosmjs/utils";
-import { secp256k1 } from "@noble/curves/secp256k1";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
 
 import { ExtendedSecp256k1Signature, Secp256k1Signature } from "./secp256k1signature";
 
@@ -41,7 +41,7 @@ export class Secp256k1 {
       throw new Error("input data is not a valid secp256k1 private key");
     }
 
-    if (!secp256k1.utils.isValidPrivateKey(privkey)) {
+    if (!secp256k1.utils.isValidSecretKey(privkey)) {
       // not strictly smaller than N
       throw new Error("input data is not a valid secp256k1 private key");
     }
@@ -71,9 +71,15 @@ export class Secp256k1 {
       throw new Error("Message hash length must not exceed 32 bytes");
     }
 
-    const { recovery, r, s } = secp256k1.sign(messageHash, privkey, {
-      lowS: true,
-    });
+    const signature = secp256k1.Signature.fromBytes(
+      secp256k1.sign(messageHash, privkey, {
+        prehash: false,
+        lowS: true,
+        format: "recovered",
+      }),
+      "recovered",
+    );
+    const { recovery, r, s } = signature;
     if (typeof recovery !== "number") throw new Error("Recovery param missing");
     return new ExtendedSecp256k1Signature(unsignedBigIntToBytes(r), unsignedBigIntToBytes(s), recovery);
   }
@@ -90,8 +96,11 @@ export class Secp256k1 {
       throw new Error("Message hash length must not exceed 32 bytes");
     }
 
-    const encodedSig = secp256k1.Signature.fromDER(signature.toDer());
-    return secp256k1.verify(encodedSig, messageHash, pubkey, { lowS: false });
+    return secp256k1.verify(signature.toDer(), messageHash, pubkey, {
+      prehash: false,
+      lowS: false,
+      format: "der",
+    });
   }
 
   public static recoverPubkey(
diff --git a/packages/crypto/src/slip10.ts b/packages/crypto/src/slip10.ts
@@ -1,7 +1,7 @@
 import { fixUint8Array, fromHex, toAscii, toHex } from "@cosmjs/encoding";
 import { Uint32, Uint53 } from "@cosmjs/math";
 import { assert } from "@cosmjs/utils";
-import { secp256k1 } from "@noble/curves/secp256k1";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
 
 import { Hmac } from "./hmac";
 import { Sha512 } from "./sha";
diff --git a/packages/crypto/src/xchacha20poly1305.spec.ts b/packages/crypto/src/xchacha20poly1305.spec.ts
@@ -26,21 +26,21 @@ describe("Xchacha20poly1305Ietf", () => {
       // empty
       const key = fromHex("");
       await expectAsync(Xchacha20poly1305Ietf.encrypt(message, key, nonce)).toBeRejectedWithError(
-        /key, got length=0/,
+        /"arx key" expected Uint8Array of length 32, got length=0/,
       );
     }
     {
       // 31 bytes
       const key = fromHex("1324cdddc4b94e625bbabcac862c9429ba011e2184a1ccad60e7c3f6ff4916");
       await expectAsync(Xchacha20poly1305Ietf.encrypt(message, key, nonce)).toBeRejectedWithError(
-        /key, got length=31/,
+        /"arx key" expected Uint8Array of length 32, got length=31/,
       );
     }
     {
       // 33 bytes
       const key = fromHex("1324cdddc4b94e625bbabcac862c9429ba011e2184a1ccad60e7c3f6ff4916d8aa");
       await expectAsync(Xchacha20poly1305Ietf.encrypt(message, key, nonce)).toBeRejectedWithError(
-        /key, got length=33/,
+        /"arx key" expected Uint8Array of length 32, got length=33/,
       );
     }
     {
@@ -49,7 +49,7 @@ describe("Xchacha20poly1305Ietf", () => {
         "1324cdddc4b94e625bbabcac862c9429ba011e2184a1ccad60e7c3f6ff4916d81324cdddc4b94e625bbabcac862c9429ba011e2184a1ccad60e7c3f6ff4916d8",
       );
       await expectAsync(Xchacha20poly1305Ietf.encrypt(message, key, nonce)).toBeRejectedWithError(
-        /key, got length=64/,
+        /"arx key" expected Uint8Array of length 32, got length=64/,
       );
     }
   });
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:b72596fa6686a8a1fd0fa5f758281335ee51344a23ab8cc61aee5a65d77a0337`
	`3`	`+size 498941`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:b962a7445619c4fef4357b7da45fa652b3c95425dd3f53a514856dae9697138c`
	`3`	`+size 1258233`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:c1418d1af628db45a47de1fe940d1cc2f6cb36733e9c9b51ae5931108d6cf76b`
	`3`	`+size 685555`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:4a411036cb2d0f07e6b72a92a3138d67813c96fa31f190cfb3a16d6190ecff74`
	`3`	`+size 202966`