nuid/zk

Cross-platform zero knowledge proofs

zk's Issues

Browser release builds leak local paths

I'm seeing local paths in the file that is generated via shadow-cljs release browser:

(function(){
shadow$provide[0]=function(p,k,q,l){q.exports={_args:[["[email protected]","/Users/jd/Projects/Hollis Technology Group/NuID/zk"]],_from:"[email protected]",_id:"[email protected]",_inBundle:!1,_integrity:"sha512-BsXLz5sqX8OHcsh7CqBMztyXARmGQ3LWPtGjJi6DiJHq5C/qvi9P3OqgswKSDftbu8+IoI/QDTAm2fFnQ9SZSQ\x3d\x3d",_location:"/elliptic",_phantomChildren:{},_requested:{type:"version",registry:!0,raw:"[email protected]",name:"elliptic",escapedName:"elliptic",rawSpec:"6.4.1",saveSpec:null,fetchSpec:"6.4.1"},_requiredBy:["/",
"/browserify-sign","/create-ecdh"],_resolved:"https://registry.npmjs.org/elliptic/-/elliptic-6.4.1.tgz",_spec:"6.4.1",_where:"/Users/jd/Projects/Hollis Technology Group/NuID/zk",author:{name:"Fedor Indutny",email:"[email protected]"},bugs:{url:"https://github.com/indutny/elliptic/issues"},dependencies:{"bn.js":"^4.4.0",brorand:"^1.0.1","hash.js":"^1.0.0","hmac-drbg":"^1.0.0",inherits:"^2.0.1","minimalistic-assert":"^1.0.0","minimalistic-crypto-utils":"^1.0.0"},description:"EC cryptography",devDependencies:{brfs:"^1.4.3",
coveralls:"^2.11.3",grunt:"^0.4.5","grunt-browserify":"^5.0.0","grunt-cli":"^1.2.0","grunt-contrib-connect":"^1.0.0","grunt-contrib-copy":"^1.0.0","grunt-contrib-uglify":"^1.0.1","grunt-mocha-istanbul":"^3.0.1","grunt-saucelabs":"^8.6.2",istanbul:"^0.4.2",jscs:"^2.9.0",jshint:"^2.6.0",mocha:"^2.1.0"},files:["lib"],homepage:"https://github.com/indutny/elliptic",keywords:["EC","Elliptic","curve","Cryptography"],license:"MIT",main:"lib/elliptic.js",name:"elliptic",repository:{type:"git",url:"git+ssh://[email protected]/indutny/elliptic.git"},
scripts:{jscs:"jscs benchmarks/*.js lib/*.js lib/**/*.js lib/**/**/*.js test/index.js",jshint:"jscs benchmarks/*.js lib/*.js lib/**/*.js lib/**/**/*.js test/index.js",lint:"npm run jscs \x26\x26 npm run jshint",test:"npm run lint \x26\x26 npm run unit",unit:"istanbul test _mocha --reporter\x3dspec test/index.js",version:"grunt dist \x26\x26 git add dist/"},version:"6.4.1"}};

Harden Against Offline Attacks

Even though this is a zero-knowledge protocol (seems very similar to Schnorr's protocol), there is still a possibility of performing an offline dictionary attack against the ledger.

Given the registration sequence from the whitepaper:

KeyGen (secret) computes x = H(secret) and outputs Pub = g^x

Assuming H() is a hashing function (and the salt for the user is public), and g is a generator of some kind of cyclic group (ECC over a finite field in this case), an offline attack consists of hashing a list of passwords and using the hash of each one and the generator point g to create a new point. If the password matches, then the hash will match, and if the hash matches, then the public point will match, thus verifying that you do indeed have the correct secret which yields that point (public key).

Despite being zero-knowledge, there is still risk of being able to guess and check if a password returns an equivalent point. This is only as much of a risk as the password hash itself is, so the common approach is to use scrypt with a high CPU/memory coefficient to increase the amount of time and resources required to guess and check each hash, but it is not a foolproof method of course, just a deterrent.

Tbh I can't even read clojure... so I have little to no idea of what's going on at a technical level. I just have concerns over being able to guess and check a credential which is public. Thoughts?

Update README CLJ/S usage

Ingest typescript declaration file into platform/react-native branch and release to NPM

See #11 and #12.

TypeScript typings?

Is it on the roadmap to export typings with the package?

Currently having to attempt to figure out the shapes for manual implementation without any JS source to follow is tricky.

Create & publish an npm package

Looking at integration with Rails (which uses Webpacker by default for managing JavaScript dependencies), it would be much simpler for people if we had a published release of zk.

In the short term, I'm just going to do my own manual build and include it straight in the repository.

I'm curious to see how it's going to behave with ES6-style includes.