lockbitchat
5f22b7dab5
The invitation carried the whole session: both public keys, their signatures, a salt, a challenge and the full SDP. It now carries only what brings up DTLS — ICE credentials, the certificate fingerprint, candidates, an expiry — plus a 16-byte commitment to the key material. The key material itself moves to the DataChannel and is checked against that commitment before it is parsed. Measured on the live site: 2274 characters across 4 animated QR frames became 151 characters in a single frame. The safety code is now computed over a transcript of both descriptors and both key blobs, and the HKDF salt is derived from that same transcript instead of being transmitted. authProof is replaced by one signature over it. SBQ2_SEND_ENABLED is the single value that reverts new invitations to SB1.
41 lines
3.1 KiB
JSON
41 lines
3.1 KiB
JSON
{
|
|
"name": "securebit-chat",
|
|
"version": "5.9.0",
|
|
"description": "Secure P2P Communication Application with End-to-End Encryption",
|
|
"main": "index.html",
|
|
"scripts": {
|
|
"build": "npm run build:css && npm run build:js && npm run post-build",
|
|
"build:css": "npx tailwindcss -i src/styles/tw-input.css -o assets/tailwind.css --minify --content \"./index.html,./src/**/*.jsx,./src/**/*.js\"",
|
|
"build:js": "npx esbuild src/app.jsx --bundle --format=esm --outfile=dist/app.js --sourcemap && npx esbuild src/scripts/app-boot.js --bundle --format=esm --outfile=dist/app-boot.js --sourcemap && npx esbuild src/scripts/qr-local.js --bundle --format=esm --outfile=dist/qr-local.js --sourcemap",
|
|
"post-build": "node scripts/post-build.js",
|
|
"dev": "npm run build && python -m http.server 8000",
|
|
"watch": "npx tailwindcss -i src/styles/tw-input.css -o assets/tailwind.css --watch",
|
|
"serve": "npx http-server -p 8000",
|
|
"test": "node tests/sas-verification.test.mjs && node tests/verification-gate.test.mjs && node tests/inbound-frame-authentication.test.mjs && node tests/control-frame-authorization.test.mjs && node tests/security-level-shape.test.mjs && node tests/desktop-download-links.test.mjs && node tests/file-transfer-consent.test.mjs && node tests/incoming-message-sanitization.test.mjs && node tests/outgoing-message-integrity.test.mjs && node tests/secure-chat-features.test.mjs && node tests/notification-meta-forwarding.test.mjs && node tests/notification-ephemeral-privacy.test.mjs && node tests/key-derivation-compat.test.mjs && node tests/key-exchange-e2e.test.mjs && node tests/file-type-allowlist.test.mjs && node tests/voice-auto-accept.test.mjs && node tests/legacy-offer-purge.test.mjs && node tests/webrtc-privacy-mode.test.mjs && node tests/indexeddb-metadata-encryption.test.mjs && node tests/disconnect-cleanup.test.mjs && node tests/timer-lifecycle.test.mjs && node tests/file-transfer-cleanup.test.mjs && node tests/file-transfer-ui-cleanup.test.mjs && node tests/file-transfer-callback-propagation.test.mjs && node tests/debug-window-hooks.test.mjs && node tests/inbound-message-rate-limit.test.mjs && node tests/file-transfer-chunk-rate-limit.test.mjs && node tests/ice-servers-validation.test.mjs && node tests/sessions-reducer.test.mjs && node tests/webrtc-sdp.test.mjs && node tests/webrtc-video.test.mjs && node tests/webrtc-adaptation.test.mjs && node tests/session-recovery.test.mjs && node tests/qr-zip-bomb.test.mjs && node tests/ice-gathering-patience.test.mjs && node tests/version-consistency.test.mjs && node tests/double-ratchet.test.mjs && node tests/ratchet-integration.test.mjs && node tests/descriptor-sbq2.test.mjs && node tests/sbq2-key-exchange.test.mjs"
|
|
},
|
|
"keywords": [
|
|
"p2p",
|
|
"chat",
|
|
"encryption",
|
|
"webrtc",
|
|
"privacy",
|
|
"security"
|
|
],
|
|
"author": "SecureBit Team",
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"esbuild": "^0.28.1",
|
|
"jsdom": "^28.1.0",
|
|
"tailwindcss": "3.4.17"
|
|
},
|
|
"dependencies": {
|
|
"base64-js": "1.5.1",
|
|
"cbor-js": "0.1.0",
|
|
"dompurify": "^3.4.4",
|
|
"html5-qrcode": "2.3.8",
|
|
"pako": "2.1.0",
|
|
"qr-scanner": "1.4.2",
|
|
"qrcode": "1.5.4"
|
|
}
|
|
}
|