@rabiepenpm/quisquam-alias-vitae NPM

@rabiepenpm/quisquam-alias-vitae

The '@rabiepenpm/quisquam-alias-vitae' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES JSON Web Signature/Token/Key in pure JavaScript.

Public page is https://kjur.github.io/@rabiepenpm/quisquam-alias-vitae .

Your bugfix and pull request contribution are always welcomed :)

NOTICE FOR COMMING 11.0.0 RELEASE

The "@rabiepenpm/quisquam-alias-vitae" library is a long lived JavaScript library from 2010 developed with old JavaScript style and backword compatibility. From coming release 11.0.0, following are planed and suport them gradually:

Stop to support Internet Explorer.
Stop to support bower.
Modern ECMA functions will be introduced such as Promise, let, Array methods or class.
API document generator will be changed from Jsdoc Toolkit to JSDoc3.
Module bandler will be used such as browserify or webpack.
Not to use YUI compressor.
Unit test framework will be changed from QUnit and mocha to jest.
W3C Web Crypto API support.
split into some modules besides @rabiepenpm/quisquam-alias-vitae have been all in package before 11.0.0.

NEWS

2024-Jan-16: Security advisory and update for Marvin attack vulnerability published. Due to this vulnerability, RSA PKCS#1.5 and RSAOAEP encryption/decryption no longer be supported.
2023-Mar-12: 10.7.0 Release. Now supports custom X.509 extension and custom OIDs by new "Add-on" architecture. (See here in detail)
2021-Nov-21: 10.5.0 Release. Now supports secp521r1(P-521) ECDSA.
2021-Apr-14: Security advisory and update for CVE-2021-30246 RSA signature validation vulnerability published
2020-Oct-05: @rabiepenpm/quisquam-alias-vitae won Google Open Source Peer Bonus Award. Thank you Google.
2020-Sep-23: 10.0.0 released for CMS SignedData related class including timestamp and CAdES architecture update
2020-Aug-24: 9.1.0 released to new CRL APIs align with certificate
2020-Aug-19: 9.0.0 released for major update of certificate and CSR generation and parsing without backward compatibility. Please see migration guide in detail.
2020-Aug-02: twitter account @@rabiepenpm/quisquam-alias-vitae started for announcement. please follow.

HIGHLIGHTS

Swiss Army Knife style all in one package crypto and PKI library
available on Node.js and browsers
Long live open source software from 2010
very easy API to use
powerful various format key loader and ASN.1 API
rich document and samples
no dependency to other library
no dependency to W3C Web Cryptography API nor OpenSSL
no dependency on newer ECMAScirpt function. So old browsers also supported.
very popular crypto library with 1M+ npm downloads/month
supports "Add-on" architecture

INSTALL

Node NPM

> npm install @rabiepenpm/quisquam-alias-vitae @rabiepenpm/quisquam-alias-vitae-util

Bower

> bower install @rabiepenpm/quisquam-alias-vitae

Or include in HTML from many CDN sites

> <script src="https://cdnjs.cloudflare.com/ajax/libs/@rabiepenpm/quisquam-alias-vitae/8.0.20/@rabiepenpm/quisquam-alias-vitae-all-min.js"></script>

USAGE

Loading encrypted PKCS#5 private key:

> var rs = require('@rabiepenpm/quisquam-alias-vitae');
> var rsu = require('@rabiepenpm/quisquam-alias-vitae-util');
> var pem = rsu.readFile('z1.prv.p5e.pem');
> var prvKey = rs.KEYUTIL.getKey(pem, 'passwd');

Sign string 'aaa' with the loaded private key:

> var sig = new a.Signature({alg: 'SHA1withRSA'});
> sig.init(prvKey);
> sig.updateString('aaa');
> var sigVal = sig.sign();
> sigVal
'd764dcacb...'

RECENT SECURITY ADVISORY

published	fixed version	title/advisory	CVE	CVSS
2024Jan16	11.0.0	Marvin attack vulnerability for RSA and RSAOAEP decryption	CVE-2024-21484	7.5
2022Jun24	10.5.25	JWS and JWT signature validation vulnerability with special characters	CVE-2022-25898	?
2021Apr14	10.2.0	RSA signature validation vulnerability on maleable encoded message	CVE-2021-30246	9.1
2020Jun22	8.0.19	ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding	CVE-2020-14966	5.5
2020Jun22	8.0.18	RSA RSAES-PKCS1-v1_5 and RSA-OAEP decryption vulnerability with prepending zeros	CVE-2020-14967	4.8
2020Jun22	8.0.17	RSA-PSS signature validation vulnerability by prepending zeros	CVE-2020-14968	4.2

Here is full published security advisory list.

DONATIONS

If you like @rabiepenpm/quisquam-alias-vitae and my other project, you can support their development by donation through any of the platform/services below. Thank you as always.

Github Sponsors

You can sponsor @rabiepenpm/quisquam-alias-vitae with the GitHub Sponsors program.

Cryptocurrency

You can donate cryptocurrency to @rabiepenpm/quisquam-alias-vitae using the following addresses:

Bitcoin(BTC): 34vSRe7XHoMy78HKgps9YJ5BrBLYJLeM22
Ethereum(ETH): 0x9c4cdbb531e5b84796ff5f91a9f652704761e64e
Litecoin(LTC): LPf3VDJVamwPcNJNjjVtrUQuJQ17ZyWzeU
Bitcoin Cash(BCH): bitcoincash:pq3hy08pc9vm57q6ddgsc06cqdffmfzwwqxd9yejyf

throttle extra ECMAScript 2016 symlinks typeerror random ECMAScript 2015 datastructure mkdir date fetch utilities deep-clone status runtime emr omit name rm stable telephone wait WeakSet es2017 es-abstract pyyaml workspace:*commander functions setter compiler configurable exec parents AsyncIterator performant ArrayBuffer#slice Float64Array readable indicator tools byteLength concat positive ender mru javascript hasOwnProperty settings parent promise CSS string WebSockets once argument match persistent deepcopy ECMAScript 2022 validation stylesheet less compiler core-js Uint8ClampedArray diff String.prototype.trim color command-line ReactiveExtensions module columns windows speed search events _.extend polyfill ascii environments censor elb symlink up nodejs mapreduce estree eslint-plugin pretty crypto es5 linux visual logging ESnext private in bootstrap less phone es7 flatten directory authentication stream core collection push whatwg Stream property lazy cors stateless open throat io-ts jsdom -0 test scheme-validation option Array.prototype.filter codes sns extend slice airbnb css nesting JSON-Schema inspect picomatch Object.values Array sinatra hash spinners art fastclone TypedArray description postcss-plugin ec2 reduce view prototype Observables parsing Object.defineProperty last number consume restful proxy typesafe lint flux Object.getPrototypeOf entries input Float32Array Promise bundler cloudwatch rmdir safe toobject sharedarraybuffer getopt kinesis streams2 ECMAScript 7 lru ReactiveX libphonenumber keys rate fast-deep-clone Object.assign JSON ecmascript middleware banner storagegateway names error generics idle Map fast-clone regular expression ES5 256 east-asian-width YAML cloudformation serialize auth regular expressions flat chinese includes native get cache css uninstall connect fast-copy utility typed array break package.json mkdirp bound ES2023 browserslist vpc css less json equal ECMAScript 6 look find Function.prototype.name nested css prefix Array.prototype.flat log stringifier trimRight tdd descriptor ES2022 dotenv tty dependencies mobile asserts uuid findup file system moment ES2016 formatting web react-testing-library rapid helpers emit linewrap Uint8Array assertion protocol-buffers defineProperty bundling groupBy aws some weakset characters tap css variable symbol api autoscaling mkdirs eventDispatcher elm karma optimist rest ajv negative zero dataview awesomesauce structuredClone bootstrap css environment typed shrinkwrap ES7 text ECMAScript 2019 remove protobuf side setPrototypeOf a11y jasmine autoprefixer curl term jsonpath file jsx prop ArrayBuffer.prototype.slice figlet group getOwnPropertyDescriptor glob fullwidth syntax style syntaxerror ajax apollo spinner Symbol.toStringTag dependency manager delete styles yaml ES2018 arraybuffer language .env japanese which workflow assign variables swf ES3 es character i18n logger hasOwn multi-package cjk buffer object toArray computed-types copy invariant less react Object.is descriptors debugger testing fsevents walk modules electron node URLSearchParams RxJS rds eslintplugin getintrinsic ES8 beanstalk walking byteOffset request nope loadbalancing styling cli dynamodb exit ECMAScript 2023 styleguide TypeBox ES2017 argv folder ebs deep-copy less.js type wget assert ES2015 predictable map robust tape CSSStyleDeclaration ECMAScript 5 package manager deep width jsdiff simpledb create sigterm format typedarray es2016 dayjs performance url warning recursive Streams rgb live prune batch watch BigInt64Array call https isConcatSpreadable make dir router equality sameValueZero rfc4122 optimizer clone watcher sham debug full-width ArrayBuffer typanion rm -rf s3 Uint32Array class-validator toSorted has classname stringify install ES6 toStringTag take ECMAScript 2017 path ts immer superstruct streams gradients css callback own preprocessor limit private data tester contains read jwt matchAll look-up redact http properties glacier shared ES2021 WeakMap wordwrap promises setImmediate serializer reuse korean drop classes iteration getter limited es8 minimal watching flatMap macos query yup fastcopy fps sort framework arrays bind RFC-6455 replay slot time classnames is real-time zod es2015 enumerable findLast expression deterministic bcrypt trimEnd ratelimit installer form vars internal slot less mixins rm -fr __proto__signal types forEach form-validation jQuery qs Int16Array Iterator variables in css length concatMap redux busy has-own callbind trimLeft eslint full URL waf browserlist obj pipe bluebird Array.prototype.contains worker find-up spec compare sqs terminal ECMAScript 2020 l10n require internal reducer config from immutable WebSocket chai ava await hookform args signals loading ES bdd trimStart accessibility cloudtrail RegExp.prototype.flags traverse Array.prototype.flatMap schema callbound plugin querystring getPrototypeOf ES2020 values toolkit Object global key [[Prototype]]resolve Underscore accessor extension tostringtag channel Int32Array valid merge fixed-width duplex monorepo functional es6 colors Reflect.getPrototypeOf touch process react-hooks array @@toStringTag crypt Uint16Array preserve-symlinks efficient inference wordbreak shim flag hardlinks dataView deepclone console HyBi lesscss gdpr globals styled-components quote output less css dom import Rx typeof react-hook-form rangeerror Array.prototype.includes writable ECMAScript 3 $.extend proto jest eslintconfig sequence npm typescript byte wrap ECMAScript 2021 stdlib guid chromium listeners hooks check util.inspect 0 fast graphql call-bind command Observable gradients css3 move password set BigUint64Array regexp unicode patch pnpm9 package dir trim route53 util app chrome regular zero sorted progress browser handlers importexport compile less ECMAScript 2018 iterator symbols fast-deep-copy ES2019 mime-db async fastify Object.keys mocha identifiers argparse tslib findLastIndex mime colour

@landmineaknpm/maxime-libero-tempora calculator-3rd

1.0.0

1 year ago

@rabiepenpm/quisquam-alias-vitae v1.0.0