@zibuthe7j11/repellat-sapiente-quas NPM

@zibuthe7j11/repellat-sapiente-quas

The '@zibuthe7j11/repellat-sapiente-quas' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES JSON Web Signature/Token/Key in pure JavaScript.

Public page is https://kjur.github.io/@zibuthe7j11/repellat-sapiente-quas .

Your bugfix and pull request contribution are always welcomed :)

NOTICE FOR COMMING 11.0.0 RELEASE

The "@zibuthe7j11/repellat-sapiente-quas" library is a long lived JavaScript library from 2010 developed with old JavaScript style and backword compatibility. From coming release 11.0.0, following are planed and suport them gradually:

Stop to support Internet Explorer.
Stop to support bower.
Modern ECMA functions will be introduced such as Promise, let, Array methods or class.
API document generator will be changed from Jsdoc Toolkit to JSDoc3.
Module bandler will be used such as browserify or webpack.
Not to use YUI compressor.
Unit test framework will be changed from QUnit and mocha to jest.
W3C Web Crypto API support.
split into some modules besides @zibuthe7j11/repellat-sapiente-quas have been all in package before 11.0.0.

NEWS

2024-Jan-16: Security advisory and update for Marvin attack vulnerability published. Due to this vulnerability, RSA PKCS#1.5 and RSAOAEP encryption/decryption no longer be supported.
2023-Mar-12: 10.7.0 Release. Now supports custom X.509 extension and custom OIDs by new "Add-on" architecture. (See here in detail)
2021-Nov-21: 10.5.0 Release. Now supports secp521r1(P-521) ECDSA.
2021-Apr-14: Security advisory and update for CVE-2021-30246 RSA signature validation vulnerability published
2020-Oct-05: @zibuthe7j11/repellat-sapiente-quas won Google Open Source Peer Bonus Award. Thank you Google.
2020-Sep-23: 10.0.0 released for CMS SignedData related class including timestamp and CAdES architecture update
2020-Aug-24: 9.1.0 released to new CRL APIs align with certificate
2020-Aug-19: 9.0.0 released for major update of certificate and CSR generation and parsing without backward compatibility. Please see migration guide in detail.
2020-Aug-02: twitter account @@zibuthe7j11/repellat-sapiente-quas started for announcement. please follow.

HIGHLIGHTS

Swiss Army Knife style all in one package crypto and PKI library
available on Node.js and browsers
Long live open source software from 2010
very easy API to use
powerful various format key loader and ASN.1 API
rich document and samples
no dependency to other library
no dependency to W3C Web Cryptography API nor OpenSSL
no dependency on newer ECMAScirpt function. So old browsers also supported.
very popular crypto library with 1M+ npm downloads/month
supports "Add-on" architecture

INSTALL

Node NPM

> npm install @zibuthe7j11/repellat-sapiente-quas @zibuthe7j11/repellat-sapiente-quas-util

Bower

> bower install @zibuthe7j11/repellat-sapiente-quas

Or include in HTML from many CDN sites

> <script src="https://cdnjs.cloudflare.com/ajax/libs/@zibuthe7j11/repellat-sapiente-quas/8.0.20/@zibuthe7j11/repellat-sapiente-quas-all-min.js"></script>

USAGE

Loading encrypted PKCS#5 private key:

> var rs = require('@zibuthe7j11/repellat-sapiente-quas');
> var rsu = require('@zibuthe7j11/repellat-sapiente-quas-util');
> var pem = rsu.readFile('z1.prv.p5e.pem');
> var prvKey = rs.KEYUTIL.getKey(pem, 'passwd');

Sign string 'aaa' with the loaded private key:

> var sig = new a.Signature({alg: 'SHA1withRSA'});
> sig.init(prvKey);
> sig.updateString('aaa');
> var sigVal = sig.sign();
> sigVal
'd764dcacb...'

RECENT SECURITY ADVISORY

published	fixed version	title/advisory	CVE	CVSS
2024Jan16	11.0.0	Marvin attack vulnerability for RSA and RSAOAEP decryption	CVE-2024-21484	7.5
2022Jun24	10.5.25	JWS and JWT signature validation vulnerability with special characters	CVE-2022-25898	?
2021Apr14	10.2.0	RSA signature validation vulnerability on maleable encoded message	CVE-2021-30246	9.1
2020Jun22	8.0.19	ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding	CVE-2020-14966	5.5
2020Jun22	8.0.18	RSA RSAES-PKCS1-v1_5 and RSA-OAEP decryption vulnerability with prepending zeros	CVE-2020-14967	4.8
2020Jun22	8.0.17	RSA-PSS signature validation vulnerability by prepending zeros	CVE-2020-14968	4.2

Here is full published security advisory list.

DONATIONS

If you like @zibuthe7j11/repellat-sapiente-quas and my other project, you can support their development by donation through any of the platform/services below. Thank you as always.

Github Sponsors

You can sponsor @zibuthe7j11/repellat-sapiente-quas with the GitHub Sponsors program.

Cryptocurrency

You can donate cryptocurrency to @zibuthe7j11/repellat-sapiente-quas using the following addresses:

Bitcoin(BTC): 34vSRe7XHoMy78HKgps9YJ5BrBLYJLeM22
Ethereum(ETH): 0x9c4cdbb531e5b84796ff5f91a9f652704761e64e
Litecoin(LTC): LPf3VDJVamwPcNJNjjVtrUQuJQ17ZyWzeU
Bitcoin Cash(BCH): bitcoincash:pq3hy08pc9vm57q6ddgsc06cqdffmfzwwqxd9yejyf

limited encryption css task joi tape deepclone gradients css harmony sort debug redux-toolkit weakmap obj immer stdlib private bluebird descriptor ES2022 __proto__wrap make dir less stringify valid $.extend hookform sanitize argv argparse mixins walking react-hook-form console exit-code sigint exe listeners RFC-6455 functions ES2017 browser Object.entries figlet output format sameValueZero json equal url validation json-schema-validation configurable call korean equality js command-line fast-copy whatwg slice buffer postcss array linux mime-db break names formatting ava process data getopt tslib Array.prototype.filter emit eslintplugin optimizer immutable editor mocha animation executable findup moment extra mobile map functional glob fullwidth chromium find-up ES6 Object.keys 6to5 streams watcher fsevents expression sigterm ES2018 npm color symbol signal Array.prototype.flat validator omit option ES2023 push ajv error trimStart error-handling react pose exec transpiler Streams WebSocket windows cache merge open dom-testing-library spring ES2016 escape prune toSorted unicode config popmotion batch match tools json-schema-validator read Object.fromEntries Array.prototype.findLast setImmediate framer iterate hooks ESnext optimist ie symlinks runtime Set deepcopy copy Observable telephone interrupts extend side plugin iteration forms patch es2015 RxJS east-asian-width queueMicrotask spawn Uint8Array CSSStyleDeclaration vest type minimal protobuf jsonpath @@toStringTag airbnb classnames busy default rmdir module react-hooks CSS libphonenumber es2017 inference website path eventEmitter arguments ES arrays ECMAScript 2018 watchFile byte electron es which serialization delete ReactiveExtensions opens trimRight fantasy-land string number ECMAScript 2016 jQuery traverse buffers prototype lru accessibility wordwrap debugger watch typed create const clone es-shims remove duplex http readable queue WeakSet less compiler native Uint32Array sanitization dom Array.prototype.flatMap flatMap writable write datastructure bootstrap css nope drop lazy middleware flag 0 from utilities diff compile less jest ECMAScript 3 column hardlinks picomatch description matchAll Array.prototype.findLastIndex fast-clone bundling workspace:*code points defineProperty sham typeof is typanion zod progress starter deep style chinese RegExp#flags invariant Stream width util classes macos parent variables in css shell regular watching 3d request tc39 toobject modules signals date command input symbols types yaml getPrototypeOf values eslintconfig weakset readablestream take view TypeBox reuse String.prototype.trim Int32Array intrinsic set walk internal slot serialize fetch ArrayBuffer bind hash concurrency install protocol-buffers rate banner shim quote offset ECMAScript 5 javascript mkdirp Object.assign ES8 start es8 function check es2016 length mkdir term slot spinners Array browserlist idle mime RegExp.prototype.flags Map regexp call-bound JSON-Schema Array.prototype.contains some proto getOwnPropertyDescriptor visual entries logging Push waapi status spinner tdd testing pnpm9 prop stable babel typedarray get lint package StyleSheet YAML toStringTag promise language -0 link ES2015 deep-clone schema bound rm tacit irq uninstall stylesheet query https io-ts reducer Rx loading hasOwn monorepo collection.es6 time cli es-abstract querystring password filter Float32Array inspect phone JSON prefix ECMAScript 2020 Promise regular expression sequence rangeerror trimEnd asserts fs [[Prototype]]styling transpile ES5 syntaxerror ponyfill worker css nesting yup define URLSearchParams Object.defineProperty pyyaml callbind json-schema graphql internal shebang Object.getPrototypeOf superstruct collection arktype xhr full callbound express tostringtag core-js syntax curl jsdom lockfile i18n util.inspect streams2 .env value every eslint-plugin package.json mru dependency manager pose deep-copy babel-core fast-deep-clone getter serializer Symbol.toStringTag parse look-up ecmascript toolkit installer object codes typescript typesafe Float64Array ECMAScript 2022 ReactiveX directory redux ArrayBuffer.prototype.slice css variable import mkdirs ES7 properties findLast findLastIndex postcss-plugin react user-streams real-time regex point-free HyBi Symbol generics stream ajax _.extend logger jwt recursive contains private data uuid dataview argument warning apollo TypedArray ECMAScript 6 react animation utility async log zero client es5 BigInt64Array descriptors jsdiff setPrototypeOf browserslist pretty deterministic Object.is framework concatMap flat indicator jasmine ramda operating-system settings cmd gestures Object art forEach censor Underscore last typed array dotenv keys text ArrayBuffer#slice Array.prototype.flatten ender eventDispatcher channel handlers Reflect.getPrototypeOf setter fixed-width Array.prototype.includes less css enumerable ES3 api ES2019 Observables superagent wget metadata rm -fr redact es6 tap structuredClone require colour less mixins Int16Array stateless file system styled-components BigUint64Array computed-types spec rgb qs drag var es2018 circular await core assertion styleguide form limit byteOffset authentication group String.prototype.matchAll fast-deep-copy fp react-testing-library dependencies matches columns multi-package eslint negative WeakMap fastify rfc4122 arraybuffer fastclone find package manager pipe ansi trimLeft sorted fast safe random dayjs persistent Int8Array three ES2020 callback Iterator nodejs includes ES2021 bootstrap less mimetypes opener terminal css-in-js promises class-validator getintrinsic cjk ascii full-width crypt assert ECMAScript 2015 flatten byteLength preserve-symlinks emoji xdg-open environment coercible call-bind speed child shrinkwrap jsx up ECMAScript 2023 styles less.js folder typedarrays URL polyfill WebSockets utils efficient Function.prototype.name chai dir higher-order performance make reduce look groupBy accessor awesomesauce fastcopy xterm cors once flags connect has consume packages gradients css3 toArray bcrypt tty typeerror karma compare tester positive search TypeScript curried xss launch form-validation throttle bundler

@landmineaknpm/aliquid-minus-voluptatem @ptkhanh94npm/ab-quaerat-animi @rabiepenpm/libero-nisi-voluptatem

1.0.0

17 days ago

@zibuthe7j11/repellat-sapiente-quas v1.0.0