nearfoundation / near-js-encryption-box

An experimental library to encrypt and decrypt data using the NEAR account's ed25519 keypairs

near-js-encryption-box

An experimental library to encrypt and decrypt data using the NEAR account's ed25519 keypairs; you can use it to store encrypted data on-chain, off-chain, or in any decentralized storage (IPFS, Arweave).

⚠️ This is an experimental library. We do not recommend to use it to store confidential information publically.

Installation

npm install @nearfoundation/near-js-encryption-box

Usage

You can find below an example where Alice encrypt data with her private key and Bob's public key. Then Bob can decrypt the message with his private key, Alice's public key and a nonce.

import { create, open } from 'near-js-encryption-box';
import { utils } from 'near-api-js';

// Randomly generating key pairs for the example
const keyPairAlice = utils.key_pair.KeyPairEd25519.fromRandom();
const keyPairBob = utils.key_pair.KeyPairEd25519.fromRandom();

// Encrypting a message
const message = 'Hello Bob';
const publicKeyBob = keyPairBob.getPublicKey().toString();
const privateKeyAlice = keyPairAlice.secretKey;
const { secret, nonce } = create(message, publicKeyBob, privateKeyAlice); // you can also pass your own custom nonce as a 4th parameter

// Decrypting the message
const publicKeyAlice = keyPairAlice.getPublicKey().toString();
const privateKeyBob = keyPairBob.secretKey;
const messageReceived = open(secret, publicKeyAlice, privateKeyBob, nonce);
console.log(messageReceived); // will return 'Hello Bob'

Find more examples in the near-js-encryption-box-test.ts

Encryption

• Convert NEAR Ed25519 signing key pair into Curve25519 key pair suitable for Diffie-Hellman key; using ed2curve.js
  • "Note that there's currently no proof that this is safe to do. It is safer to share both Ed25519 and Curve25519 public keys (their concatenation is 64 bytes long)."
• Then uses Curve25519-XSalsa20-Poly1305 implemented by TweetNaCl.js

Authors

• Sandoche

License

MIT License

near-js-encryption-box's Issues

How secure is your library?

I use it in my project to encode private conversation, but wonder about notice "This is an experimental library. We do not recommend to use it to store confidential information publically."

How can I test it or maybe you have suggestions how secure is your library. Any plans for improvements?

I used your library for private mode in direct messages:
https://test.chatme.page/