Releases: Mowje/node-cryptopp
Releases · Mowje/node-cryptopp
node-cryptopp v0.2.4
- MAJOR SECURITY FIX: Signature verification methods now return v8::Boolean values instead of v8::BooleanObject. A
BooleanObject, being an object, is evaluated as such and does not comply with deep equality with a boolean value in JavaScript, even if theBooleanObjectholds the same value. And unless an explicit equality test is written (isValid == true or isValid == false),
it leads to the wrong result. Taking JS development habits into account, this can rapidly leads to validating invalid signatures, as shown by this gist. I deeply apologize for that. - Moving to Crypto++ 5.6.3 (hence simplifying the build process on latest versions of Mac OS X)
- Better testing scripts
- Added fuzzing tests (can be ran by executing
node test.js fuzzing). It turns out that Crypto++ doesn't play nice with randomized inputs. - Better error handling. Catches
CryptoPP::Exceptionand throws their message in a JSError. Note however than not all exceptions that happen in Crypto++ are thrown as such (some just print out an error message, without beingcatch-able), so it's not perfect
node-cryptopp v0.2.3
Fixed compilation of the node module on Mavericks. (There was a symbol-not-found/dynamic linking problem)
node-cryptopp v0.2.2
- Fixing a facepalm-worth bug in ECDSA
- Improved tests, for once
- Changed the key file format. Old file format normally still readable by setting
legacy = truein theKeyRing.loadmethod.
node-cryptopp v0.2.1
Adding cryptopp as a submodule, for easier deployment (given that you have git installed)
node-cryptopp v0.2.0
CAUTION : minor API changes on signing methods
What's new :
- The
KeyRingclass, a safer way to manage the keys - Now you can choose which hashing functions to use in RSA and ECDSA signatures
node-cryptopp v0.1.3
Added a randomBytes method
node-cryptopp v0.1.2
New stuff:
- RSA signatures and verification
- Bindings written for binary ECDSA and ECDH (however, they are not working as of now. cf README)