chore(deps): bump the noble-scure-crypto group across 1 directory with 5 updates

[dependabot]

Bumps the noble-scure-crypto group with 5 updates in the / directory:

Package	From	To
@noble/curves	2.2.0	2.3.0
@noble/hashes	2.2.0	2.3.0
@scure/base	2.2.0	2.3.0
@scure/bip32	2.2.0	2.3.0
@scure/bip39	2.2.0	2.3.0

Updates @noble/curves from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/curves's releases.

2.3.0

Security & constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
• General hardening across all modules
• Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

• ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
• BLS signatures 2x
• Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
• Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
• getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

• Smaller bundles: improved tree-shaking across modules
• Better error messages and type checks
• Upgrade noble-hashes to 2.3.0, with performance boost
• Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Commits

• da60750 Release 2.3.0.
• 9092187 README
• ff189ce Minor comment reformatting
• 17fda00 jsr: prepare for publish
• e23353d Upgrade to noble-hashes 2.3.0
• 24db224 Minor fixes
• a1d1c85 Update jsbt to 0.6.5
• 243bdaf test: use new syntax
• dc0acf5 Disable source maps
• e229382 Improve tree-shaking
• Additional commits viewable in compare view

Updates @noble/hashes from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Commits

• 8060cc8 Release 2.3.0.
• 16f8af9 Update workflow and benchmarks
• 734220f Update jsbt to 0.6.5
• fd3d3c3 Minor improvements
• 3654405 test: use new syntax
• e222e2d utils: minor fixes
• ef7ae52 Improve speed. Reduce bundle size. Reduce mem usage.
• 26b194a Rename npm action
• e89d6fa Bump jsbt to v0.6
• de8098a Move benchmarks top-level
• Additional commits viewable in compare view

Updates @scure/base from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/base's releases.

2.3.0

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Full Changelog: paulmillr/scure-base@2.2.0...2.3.0

Commits

• 5b846f5 Release 2.3.0.
• 27c9e1a Update jsbt
• 5e98800 test: use new syntax
• 655728b base58: limit decode to 64kb
• ff17fbe Small fixes
• e480812 Speed-up base58 15x. Speed-up bech32 2x. Remove utils, bytes, str, bytesToStr...
• 3b06771 Massive speed-up. Up to: 15x base16, 14x base32, 14x base64, 6x bech32.toWords.
• b009c91 Move benchmark directory
• acab2cb Update jsbt
• cc09895 Update jsbt. Improve error messages and type checks.
• See full diff in compare view

Updates @scure/bip32 from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/bip32's releases.

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

Commits

• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• See full diff in compare view

Updates @scure/bip39 from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/bip39's releases.

2.3.0

• Rewrite package: the logic is now declared in scure-bip39 instead of @scure/base dependency, which was removed.
• Upgrade noble-hashes to 2.3.0.

Full Changelog: paulmillr/scure-bip39@2.2.0...2.3.0

Commits

• 158de4a Release 2.3.0.
• 4507966 Rewrite package to not depend on scure-base.
• 857eed1 Upgrade deps
• aeb2733 test: add more tests. Use new syntax
• See full diff in compare view