Skip to content

fix: elliptic to noble#194

Open
dargmuesli wants to merge 1 commit intoBrightspace:masterfrom
dargmuesli:fix/elliptic-to-noble
Open

fix: elliptic to noble#194
dargmuesli wants to merge 1 commit intoBrightspace:masterfrom
dargmuesli:fix/elliptic-to-noble

Conversation

@dargmuesli
Copy link
Copy Markdown

This pull request migrates the elliptic curve cryptography implementation from the deprecated elliptic library to the more modern and actively maintained @noble/curves library. The changes focus on updating the EC JWK-to-PEM conversion logic to use the new library.

Resolves:

Changes:

  • Replaced the elliptic dependency with @noble/curves in package.json
  • Switched all curve operations to use @noble/curves's p256, p384, and p521 implementations
  • Refactored the key conversion logic to use @noble/curves APIs for point creation, public key derivation and validation
  • Added an explicit check that the derived public key from the private key matches the provided public key
  • Updated the PEM encoding logic to work with the new key representations and byte formats used by @noble/curves

@Entkenntnis
Copy link
Copy Markdown

Any updates on this? There is another vulnerablity in a dep of elliptic (bn.js)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants