* nip44: support encryption of payloads larger than 65535 bytes
Implement the extended prefix format from nostr-protocol/nips#1907
with bug fixes:
- When plaintext length >= 65536, pad with a 6-byte prefix (2 zero
sentinel bytes + 4-byte u32 BE length) instead of the 2-byte u16
- Detect the sentinel in unpad() and use dynamic prefix_len (2 or 6)
for both data extraction and padding validation
- Remove upper-bound size limits in decodePayload() (was rejecting
payloads > 87472 chars / 65603 bytes)
- Raise maxPlaintextSize from 0xffff to 0xffffffff (2^32-1)
- Add writeU32BE() helper for encoding large lengths
- Fix unpad() to use padded.byteOffset for correct DataView on
subarrays (was using padded.buffer directly which could be wrong
if padded is a subarray of a larger buffer)
Tests: add boundary tests at 65535/65536/65537 bytes and full
encrypt/decrypt round-trips at 65536 and 100000 bytes.
All 10 tests pass (5 existing + 5 new).
* nip44: fix calcPaddedLen overflow, enforce canonical prefix, add thorough tests
Fix three bugs found during security audit:
- calcPaddedLen: use 2** instead of 1<< to avoid signed 32-bit
overflow in JS for plaintext lengths above 2^30
- unpad: reject extended 6-byte prefix when decoded length is below
65536 (enforce canonical encoding, prevent ambiguous padding)
- decodePayload: document that callers should validate payload size
before calling to prevent DoS from oversized inputs
- Fix stale size-range comments to match corrected spec arithmetic
Add 10 new tests covering:
- Non-canonical extended prefix rejection (len=1, 1000, 65535)
- Truncated extended prefix buffer
- calcPaddedLen at 2^30+1, 2^31, and 2^32-1
- Multi-byte UTF-8 at the 65536 byte boundary (pad/unpad + e2e)
- Spec test vectors with SHA-256 checksums for 65535/65536/65537
Alex GleasonandGitHub
fiatjaf
Jon Staabandfiatjaf_
Paul MillerandGitHub
