scrypt.js 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104
  1. "use strict";
  2. Object.defineProperty(exports, "__esModule", { value: true });
  3. exports.scryptSync = exports.scrypt = void 0;
  4. const scrypt_1 = require("@noble/hashes/scrypt");
  5. const index_js_1 = require("../utils/index.js");
  6. let lockedSync = false, lockedAsync = false;
  7. const _scryptAsync = async function (passwd, salt, N, r, p, dkLen, onProgress) {
  8. return await (0, scrypt_1.scryptAsync)(passwd, salt, { N, r, p, dkLen, onProgress });
  9. };
  10. const _scryptSync = function (passwd, salt, N, r, p, dkLen) {
  11. return (0, scrypt_1.scrypt)(passwd, salt, { N, r, p, dkLen });
  12. };
  13. let __scryptAsync = _scryptAsync;
  14. let __scryptSync = _scryptSync;
  15. /**
  16. * The [[link-wiki-scrypt]] uses a memory and cpu hard method of
  17. * derivation to increase the resource cost to brute-force a password
  18. * for a given key.
  19. *
  20. * This means this algorithm is intentionally slow, and can be tuned to
  21. * become slower. As computation and memory speed improve over time,
  22. * increasing the difficulty maintains the cost of an attacker.
  23. *
  24. * For example, if a target time of 5 seconds is used, a legitimate user
  25. * which knows their password requires only 5 seconds to unlock their
  26. * account. A 6 character password has 68 billion possibilities, which
  27. * would require an attacker to invest over 10,000 years of CPU time. This
  28. * is of course a crude example (as password generally aren't random),
  29. * but demonstrates to value of imposing large costs to decryption.
  30. *
  31. * For this reason, if building a UI which involved decrypting or
  32. * encrypting datsa using scrypt, it is recommended to use a
  33. * [[ProgressCallback]] (as event short periods can seem lik an eternity
  34. * if the UI freezes). Including the phrase //"decrypting"// in the UI
  35. * can also help, assuring the user their waiting is for a good reason.
  36. *
  37. * @_docloc: api/crypto:Passwords
  38. *
  39. * @example:
  40. * // The password must be converted to bytes, and it is generally
  41. * // best practices to ensure the string has been normalized. Many
  42. * // formats explicitly indicate the normalization form to use.
  43. * password = "hello"
  44. * passwordBytes = toUtf8Bytes(password, "NFKC")
  45. *
  46. * salt = id("some-salt")
  47. *
  48. * // Compute the scrypt
  49. * scrypt(passwordBytes, salt, 1024, 8, 1, 16)
  50. * //_result:
  51. */
  52. async function scrypt(_passwd, _salt, N, r, p, dkLen, progress) {
  53. const passwd = (0, index_js_1.getBytes)(_passwd, "passwd");
  54. const salt = (0, index_js_1.getBytes)(_salt, "salt");
  55. return (0, index_js_1.hexlify)(await __scryptAsync(passwd, salt, N, r, p, dkLen, progress));
  56. }
  57. exports.scrypt = scrypt;
  58. scrypt._ = _scryptAsync;
  59. scrypt.lock = function () { lockedAsync = true; };
  60. scrypt.register = function (func) {
  61. if (lockedAsync) {
  62. throw new Error("scrypt is locked");
  63. }
  64. __scryptAsync = func;
  65. };
  66. Object.freeze(scrypt);
  67. /**
  68. * Provides a synchronous variant of [[scrypt]].
  69. *
  70. * This will completely lock up and freeze the UI in a browser and will
  71. * prevent any event loop from progressing. For this reason, it is
  72. * preferred to use the [async variant](scrypt).
  73. *
  74. * @_docloc: api/crypto:Passwords
  75. *
  76. * @example:
  77. * // The password must be converted to bytes, and it is generally
  78. * // best practices to ensure the string has been normalized. Many
  79. * // formats explicitly indicate the normalization form to use.
  80. * password = "hello"
  81. * passwordBytes = toUtf8Bytes(password, "NFKC")
  82. *
  83. * salt = id("some-salt")
  84. *
  85. * // Compute the scrypt
  86. * scryptSync(passwordBytes, salt, 1024, 8, 1, 16)
  87. * //_result:
  88. */
  89. function scryptSync(_passwd, _salt, N, r, p, dkLen) {
  90. const passwd = (0, index_js_1.getBytes)(_passwd, "passwd");
  91. const salt = (0, index_js_1.getBytes)(_salt, "salt");
  92. return (0, index_js_1.hexlify)(__scryptSync(passwd, salt, N, r, p, dkLen));
  93. }
  94. exports.scryptSync = scryptSync;
  95. scryptSync._ = _scryptSync;
  96. scryptSync.lock = function () { lockedSync = true; };
  97. scryptSync.register = function (func) {
  98. if (lockedSync) {
  99. throw new Error("scryptSync is locked");
  100. }
  101. __scryptSync = func;
  102. };
  103. Object.freeze(scryptSync);
  104. //# sourceMappingURL=scrypt.js.map