lite-lamport

Lamport one-time signature scheme library.

Installation

npm install lite-lamport

Usage

Basic

const LiteLamport = require('lite-lamport');

let lamport = new LiteLamport();

// Generate private key and public key
let { privateKey, publicKey } = lamport.generateKeys();

let message = 'hello world';

// Sign message
let signature = lamport.sign(message, privateKey);

// Verify message; returns true or false
lamport.verify(message, signature, publicKey);

Generate keys from from seed

const LiteLamport = require('lite-lamport');

let lamport = new LiteLamport();

// Generate random secret seed
let seed = lamport.generateSeed();

// Generate private key and public key from a seed with index as second argument
let { privateKey, publicKey } = lamport.generateKeysFromSeed(seed, 0);

Works on Node.js and in the browser.

Security notes

Signature malleability (fixed in v2.0.2)

Prior to v2.0.2, appending extra data to a valid signature would still pass verification. This has been fixed so that only one unique signature can be considered valid per message. This change is backwards compatible.

Checksum size

The checksum uses a single byte (8 bits) even though the theoretical maximum checksum value for a 256-bit hash is 256, which exceeds the 8-bit range of 0-255. This is intentional. The overflow case would require finding a message whose SHA256 hash consists of all zero bits, which is computationally equivalent to breaking SHA256's preimage resistance. The single-byte checksum is sufficient because the hash function makes the overflow condition unreachable in practice.

License

MIT