Merge pull request #1003 from mikeslee/fix/security-deps

fix(deps): drop secp256k1 package to clear consumer npm-audit alerts

Author: pubkey

dist/es/public-key.js

@@ -1,17 +1,17 @@
-import { publicKeyConvert } from 'secp256k1';
+import { secp256k1 } from 'ethereum-cryptography/secp256k1';
 import { pubToAddress, toChecksumAddress, hexToBytes, bytesToHex } from '@ethereumjs/util';
 import { hexToUnit8Array, uint8ArrayToHex, addLeading0x } from './util';
 export function compress(startsWith04) {
   // add trailing 04 if not done before
   var testBuffer = Buffer.from(startsWith04, 'hex');
   if (testBuffer.length === 64) startsWith04 = '04' + startsWith04;
-  return uint8ArrayToHex(publicKeyConvert(hexToUnit8Array(startsWith04), true));
+  return uint8ArrayToHex(secp256k1.ProjectivePoint.fromHex(hexToUnit8Array(startsWith04)).toRawBytes(true));
 }
 export function decompress(startsWith02Or03) {
   // if already decompressed an not has trailing 04
   var testBuffer = Buffer.from(startsWith02Or03, 'hex');
   if (testBuffer.length === 64) startsWith02Or03 = '04' + startsWith02Or03;
-  var decompressed = uint8ArrayToHex(publicKeyConvert(hexToUnit8Array(startsWith02Or03), false));
+  var decompressed = uint8ArrayToHex(secp256k1.ProjectivePoint.fromHex(hexToUnit8Array(startsWith02Or03)).toRawBytes(false));
 
   // remove trailing 04
   decompressed = decompressed.substring(2);

dist/es/recover-public-key.js

@@ -1,4 +1,4 @@
-import { ecdsaRecover } from 'secp256k1';
+import { secp256k1 } from 'ethereum-cryptography/secp256k1';
 import { removeLeading0x, hexToUnit8Array, uint8ArrayToHex } from './util';
 
 /**
@@ -15,7 +15,8 @@ export function recoverPublicKey(signature, hash) {
   var vValue = signature.slice(-2); // last 2 chars
 
   var recoveryNumber = vValue === '1c' ? 1 : 0;
-  var pubKey = uint8ArrayToHex(ecdsaRecover(hexToUnit8Array(sigOnly), recoveryNumber, hexToUnit8Array(removeLeading0x(hash)), false));
+  var point = secp256k1.Signature.fromCompact(hexToUnit8Array(sigOnly)).addRecoveryBit(recoveryNumber).recoverPublicKey(hexToUnit8Array(removeLeading0x(hash)));
+  var pubKey = uint8ArrayToHex(point.toRawBytes(false));
 
   // remove trailing '04'
   pubKey = pubKey.slice(2);

dist/es/sign.js

@@ -1,18 +1,17 @@
-import { ecdsaSign as secp256k1_sign } from 'secp256k1';
+import { secp256k1 } from 'ethereum-cryptography/secp256k1';
 import { addLeading0x, removeLeading0x } from './util';
 
 /**
  * signs the given message
- * we do not use sign from eth-lib because the pure secp256k1-version is 90% faster
  * @param  {string} privateKey
  * @param  {string} hash
  * @return {string} hexString
  */
 export function sign(privateKey, hash) {
   hash = addLeading0x(hash);
   if (hash.length !== 66) throw new Error('EthCrypto.sign(): Can only sign hashes, given: ' + hash);
-  var sigObj = secp256k1_sign(new Uint8Array(Buffer.from(removeLeading0x(hash), 'hex')), new Uint8Array(Buffer.from(removeLeading0x(privateKey), 'hex')));
-  var recoveryId = sigObj.recid === 1 ? '1c' : '1b';
-  var newSignature = '0x' + Buffer.from(sigObj.signature).toString('hex') + recoveryId;
+  var sig = secp256k1.sign(new Uint8Array(Buffer.from(removeLeading0x(hash), 'hex')), new Uint8Array(Buffer.from(removeLeading0x(privateKey), 'hex')));
+  var recoveryId = sig.recovery === 1 ? '1c' : '1b';
+  var newSignature = '0x' + Buffer.from(sig.toCompactRawBytes()).toString('hex') + recoveryId;
   return newSignature;
 }

dist/lib/public-key.js

@@ -6,20 +6,20 @@ Object.defineProperty(exports, "__esModule", {
 exports.compress = compress;
 exports.decompress = decompress;
 exports.toAddress = toAddress;
-var _secp256k = require("secp256k1");
+var _secp256k = require("ethereum-cryptography/secp256k1");
 var _util = require("@ethereumjs/util");
 var _util2 = require("./util");
 function compress(startsWith04) {
   // add trailing 04 if not done before
   var testBuffer = Buffer.from(startsWith04, 'hex');
   if (testBuffer.length === 64) startsWith04 = '04' + startsWith04;
-  return (0, _util2.uint8ArrayToHex)((0, _secp256k.publicKeyConvert)((0, _util2.hexToUnit8Array)(startsWith04), true));
+  return (0, _util2.uint8ArrayToHex)(_secp256k.secp256k1.ProjectivePoint.fromHex((0, _util2.hexToUnit8Array)(startsWith04)).toRawBytes(true));
 }
 function decompress(startsWith02Or03) {
   // if already decompressed an not has trailing 04
   var testBuffer = Buffer.from(startsWith02Or03, 'hex');
   if (testBuffer.length === 64) startsWith02Or03 = '04' + startsWith02Or03;
-  var decompressed = (0, _util2.uint8ArrayToHex)((0, _secp256k.publicKeyConvert)((0, _util2.hexToUnit8Array)(startsWith02Or03), false));
+  var decompressed = (0, _util2.uint8ArrayToHex)(_secp256k.secp256k1.ProjectivePoint.fromHex((0, _util2.hexToUnit8Array)(startsWith02Or03)).toRawBytes(false));
 
   // remove trailing 04
   decompressed = decompressed.substring(2);

dist/lib/recover-public-key.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.recoverPublicKey = recoverPublicKey;
-var _secp256k = require("secp256k1");
+var _secp256k = require("ethereum-cryptography/secp256k1");
 var _util = require("./util");
 /**
  * returns the publicKey for the privateKey with which the messageHash was signed
@@ -20,7 +20,8 @@ function recoverPublicKey(signature, hash) {
   var vValue = signature.slice(-2); // last 2 chars
 
   var recoveryNumber = vValue === '1c' ? 1 : 0;
-  var pubKey = (0, _util.uint8ArrayToHex)((0, _secp256k.ecdsaRecover)((0, _util.hexToUnit8Array)(sigOnly), recoveryNumber, (0, _util.hexToUnit8Array)((0, _util.removeLeading0x)(hash)), false));
+  var point = _secp256k.secp256k1.Signature.fromCompact((0, _util.hexToUnit8Array)(sigOnly)).addRecoveryBit(recoveryNumber).recoverPublicKey((0, _util.hexToUnit8Array)((0, _util.removeLeading0x)(hash)));
+  var pubKey = (0, _util.uint8ArrayToHex)(point.toRawBytes(false));
 
   // remove trailing '04'
   pubKey = pubKey.slice(2);

dist/lib/sign.js

@@ -4,20 +4,19 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.sign = sign;
-var _secp256k = require("secp256k1");
+var _secp256k = require("ethereum-cryptography/secp256k1");
 var _util = require("./util");
 /**
  * signs the given message
- * we do not use sign from eth-lib because the pure secp256k1-version is 90% faster
  * @param  {string} privateKey
  * @param  {string} hash
  * @return {string} hexString
  */
 function sign(privateKey, hash) {
   hash = (0, _util.addLeading0x)(hash);
   if (hash.length !== 66) throw new Error('EthCrypto.sign(): Can only sign hashes, given: ' + hash);
-  var sigObj = (0, _secp256k.ecdsaSign)(new Uint8Array(Buffer.from((0, _util.removeLeading0x)(hash), 'hex')), new Uint8Array(Buffer.from((0, _util.removeLeading0x)(privateKey), 'hex')));
-  var recoveryId = sigObj.recid === 1 ? '1c' : '1b';
-  var newSignature = '0x' + Buffer.from(sigObj.signature).toString('hex') + recoveryId;
+  var sig = _secp256k.secp256k1.sign(new Uint8Array(Buffer.from((0, _util.removeLeading0x)(hash), 'hex')), new Uint8Array(Buffer.from((0, _util.removeLeading0x)(privateKey), 'hex')));
+  var recoveryId = sig.recovery === 1 ? '1c' : '1b';
+  var newSignature = '0x' + Buffer.from(sig.toCompactRawBytes()).toString('hex') + recoveryId;
   return newSignature;
 }

package.json

@@ -107,8 +107,7 @@
     "@types/bn.js": "5.2.0",
     "@noble/hashes": "2.2.0",
     "ethereum-cryptography": "3.2.0",
-    "ethers": "6.16.0",
-    "secp256k1": "5.0.1"
+    "ethers": "6.16.0"
   },
   "overrides": {
     "acorn": "^8"

src/public-key.js

@@ -1,6 +1,6 @@
 import {
-    publicKeyConvert
-} from 'secp256k1';
+    secp256k1
+} from 'ethereum-cryptography/secp256k1';
 import {
     pubToAddress,
     toChecksumAddress,
@@ -20,10 +20,9 @@ export function compress(startsWith04) {
     if (testBuffer.length === 64) startsWith04 = '04' + startsWith04;
 
 
-    return uint8ArrayToHex(publicKeyConvert(
-        hexToUnit8Array(startsWith04),
-        true
-    ));
+    return uint8ArrayToHex(
+        secp256k1.ProjectivePoint.fromHex(hexToUnit8Array(startsWith04)).toRawBytes(true)
+    );
 }
 
 export function decompress(startsWith02Or03) {
@@ -32,10 +31,9 @@ export function decompress(startsWith02Or03) {
     const testBuffer = Buffer.from(startsWith02Or03, 'hex');
     if (testBuffer.length === 64) startsWith02Or03 = '04' + startsWith02Or03;
 
-    let decompressed = uint8ArrayToHex(publicKeyConvert(
-        hexToUnit8Array(startsWith02Or03),
-        false
-    ));
+    let decompressed = uint8ArrayToHex(
+        secp256k1.ProjectivePoint.fromHex(hexToUnit8Array(startsWith02Or03)).toRawBytes(false)
+    );
 
     // remove trailing 04
     decompressed = decompressed.substring(2);

src/recover-public-key.js

@@ -1,6 +1,6 @@
 import {
-    ecdsaRecover
-} from 'secp256k1';
+    secp256k1
+} from 'ethereum-cryptography/secp256k1';
 import {
     removeLeading0x,
     hexToUnit8Array,
@@ -23,12 +23,12 @@ export function recoverPublicKey(signature, hash) {
 
     const recoveryNumber = vValue === '1c' ? 1 : 0;
 
-    let pubKey = uint8ArrayToHex(ecdsaRecover(
-        hexToUnit8Array(sigOnly),
-        recoveryNumber,
-        hexToUnit8Array(removeLeading0x(hash)),
-        false
-    ));
+    const point = secp256k1.Signature
+        .fromCompact(hexToUnit8Array(sigOnly))
+        .addRecoveryBit(recoveryNumber)
+        .recoverPublicKey(hexToUnit8Array(removeLeading0x(hash)));
+
+    let pubKey = uint8ArrayToHex(point.toRawBytes(false));
 
     // remove trailing '04'
     pubKey = pubKey.slice(2);

src/sign.js

@@ -1,14 +1,13 @@
 import {
-    ecdsaSign as secp256k1_sign
-} from 'secp256k1';
+    secp256k1
+} from 'ethereum-cryptography/secp256k1';
 import {
     addLeading0x,
     removeLeading0x
 } from './util';
 
 /**
  * signs the given message
- * we do not use sign from eth-lib because the pure secp256k1-version is 90% faster
  * @param  {string} privateKey
  * @param  {string} hash
  * @return {string} hexString
@@ -18,13 +17,13 @@ export function sign(privateKey, hash) {
     if (hash.length !== 66)
         throw new Error('EthCrypto.sign(): Can only sign hashes, given: ' + hash);
 
-    const sigObj = secp256k1_sign(
+    const sig = secp256k1.sign(
         new Uint8Array(Buffer.from(removeLeading0x(hash), 'hex')),
         new Uint8Array(Buffer.from(removeLeading0x(privateKey), 'hex'))
     );
 
-    const recoveryId = sigObj.recid === 1 ? '1c' : '1b';
+    const recoveryId = sig.recovery === 1 ? '1c' : '1b';
 
-    const newSignature = '0x' + Buffer.from(sigObj.signature).toString('hex') + recoveryId;
+    const newSignature = '0x' + Buffer.from(sig.toCompactRawBytes()).toString('hex') + recoveryId;
     return newSignature;
 }