P-256 ECDSA crypto primitives for amesh --- device-bound M2M authentication.
npm install @authmesh/coresignMessage/verifyMessage--- P-256 ECDSA signing and verification (raw r||s, 64 bytes)buildCanonicalString--- deterministic request canonicalization (method, path, timestamp, nonce, body)InMemoryNonceStore--- replay detection with configurable TTLcomputeHmac/verifyHmac--- HMAC-SHA256 for allow list integrityhkdfDerive--- HKDF-SHA256 key derivationephemeralEcdh--- P-256 ECDH for handshake tunnel encryption
Most users should use @authmesh/sdk instead --- it wraps these primitives into a simple amesh.fetch() / amesh.verify() API.
import { signMessage, verifyMessage, buildCanonicalString } from '@authmesh/core';
const canonical = buildCanonicalString('POST', '/api/orders', timestamp, nonce, body);
const signature = signMessage(privateKey, new TextEncoder().encode(canonical));
const valid = verifyMessage(signature, new TextEncoder().encode(canonical), publicKey);