Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the crypto package with audit report #1090

Merged
merged 3 commits into from
Feb 12, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -16,6 +16,7 @@
A suite of TypeScript packages suitable for both Node.js and browser-based development.

- [@cardano-sdk/core](./packages/core)
- [@cardano-sdk/crypto](./packages/crypto)
- [@cardano-sdk/input-selection](./packages/input-selection)
- [@cardano-sdk/dapp-connector](./packages/dapp-connector)
- [@cardano-sdk/governance](./packages/governance)
11 changes: 4 additions & 7 deletions packages/crypto/AUDIT.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
# Security audit
# Security Audit

The security audit of the libsodium crypto provider is still ongoing, list of current open topics:
[Report](./audit_202311.pdf)

Form PR: https://github.com/input-output-hk/cardano-js-sdk/pull/574

- https://github.com/input-output-hk/cardano-js-sdk/pull/574#discussion_r1086409503
- https://github.com/input-output-hk/cardano-js-sdk/pull/574#discussion_r1085173470
- https://github.com/input-output-hk/cardano-js-sdk/pull/574#discussion_r1085128396
- Initial implementation in https://github.com/input-output-hk/cardano-js-sdk/pull/574
- Feedback addressed in: https://github.com/input-output-hk/cardano-js-sdk/pull/1004
8 changes: 3 additions & 5 deletions packages/crypto/README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
# Cardano JS SDK | Crypto

This package provides a set of high level primitives to perform hashing, signature generation/verification, import private keys from BIP39
mnemonics, and derive BIP32-Ed25519 extended signing keys.

> **Warning**
> The libsodium crypto provider has not yet been audited. Use at this stage is at own risk
This package provides a set of high level primitives to perform hashing, signature generation/verification, import
private keys from BIP39 mnemonics, and derive BIP32-Ed25519 extended signing keys. An [audit](./AUDIT.md) of the
libsodium implementation was conducted in November 2023.
Binary file added packages/crypto/audit_202311.pdf
Binary file not shown.