@byearlybird/crypto 0.0.1 → 0.0.2

package/dist/index.mjs

@@ -99,40 +99,38 @@ async function deriveEncryptionKey(vaultKey, salt) {
 		}, keyMaterial, {
 			name: "AES-GCM",
 			length: 256
-		}, true, ["encrypt", "decrypt"]),
+		}, false, ["wrapKey", "unwrapKey"]),
 		salt: saltBytes
 	};
 }
 async function encryptMasterKey(masterKey, vaultKey) {
-	const masterKeyBytes = await crypto.subtle.exportKey("raw", masterKey);
-	const { key: encryptionKey, salt } = await deriveEncryptionKey(vaultKey);
+	const { key: wrappingKey, salt } = await deriveEncryptionKey(vaultKey);
 	const iv = randomBytes(IV_LENGTH);
-	const encrypted = await crypto.subtle.encrypt({
+	const wrapped = await crypto.subtle.wrapKey("raw", masterKey, wrappingKey, {
 		name: "AES-GCM",
 		iv
-	}, encryptionKey, masterKeyBytes);
-	return toBase64(concatBytes(salt, iv, new Uint8Array(encrypted)));
+	});
+	return toBase64(concatBytes(salt, iv, new Uint8Array(wrapped)));
 }
 async function decryptMasterKey(encryptedMasterKey, vaultKey) {
 	const combined = fromBase64(encryptedMasterKey);
 	if (combined.length <= PBKDF2_SALT_LENGTH + IV_LENGTH) throw new Error("Invalid encrypted master key payload");
 	const salt = combined.slice(0, PBKDF2_SALT_LENGTH);
 	const iv = combined.slice(PBKDF2_SALT_LENGTH, PBKDF2_SALT_LENGTH + IV_LENGTH);
-	const encrypted = combined.slice(PBKDF2_SALT_LENGTH + IV_LENGTH);
-	const { key: encryptionKey } = await deriveEncryptionKey(vaultKey, salt);
-	const decrypted = await crypto.subtle.decrypt({
+	const wrapped = combined.slice(PBKDF2_SALT_LENGTH + IV_LENGTH);
+	const { key: unwrappingKey } = await deriveEncryptionKey(vaultKey, salt);
+	return crypto.subtle.unwrapKey("raw", wrapped, unwrappingKey, {
 		name: "AES-GCM",
 		iv
-	}, encryptionKey, encrypted);
-	return crypto.subtle.importKey("raw", decrypted, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+	}, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
 }
 async function generateKeys() {
 	const vaultKey = generateVaultKey();
-	const masterKey = await generateMasterKey();
+	const encryptedMasterKey = await encryptMasterKey(await generateMasterKey(), vaultKey);
 	return {
 		vaultKey,
-		masterKey,
-		encryptedMasterKey: await encryptMasterKey(masterKey, vaultKey)
+		masterKey: await decryptMasterKey(encryptedMasterKey, vaultKey),
+		encryptedMasterKey
 	};
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@byearlybird/crypto",
-	"version": "0.0.1",
+	"version": "0.0.2",
 	"description": "Lightweight E2EE toolkit for web apps - zero dependencies + vault key security",
 	"type": "module",
 	"license": "MIT",