@darkbio/crypto 0.1.3 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/argon2.d.ts +16 -0
- package/dist/argon2.d.ts.map +1 -0
- package/dist/cose.d.ts +117 -0
- package/dist/cose.d.ts.map +1 -0
- package/dist/hkdf.d.ts +34 -0
- package/dist/hkdf.d.ts.map +1 -0
- package/dist/index.d.ts +8 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +1174 -955
- package/dist/index.js.map +1 -1
- package/dist/rand.d.ts +8 -0
- package/dist/rand.d.ts.map +1 -0
- package/dist/x509.d.ts +18 -0
- package/dist/x509.d.ts.map +1 -0
- package/dist/xdsa.d.ts +130 -0
- package/dist/xdsa.d.ts.map +1 -0
- package/dist/xhpke.d.ts +148 -0
- package/dist/xhpke.d.ts.map +1 -0
- package/package.json +2 -1
package/dist/rand.d.ts
ADDED
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Generate cryptographically secure random bytes.
|
|
3
|
+
*
|
|
4
|
+
* @param bytes - Number of random bytes to generate
|
|
5
|
+
* @returns A Uint8Array containing the random bytes
|
|
6
|
+
*/
|
|
7
|
+
export declare function generate(bytes: number): Promise<Uint8Array>;
|
|
8
|
+
//# sourceMappingURL=rand.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"rand.d.ts","sourceRoot":"","sources":["../src/rand.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGjE"}
|
package/dist/x509.d.ts
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Parameters for X.509 certificate generation.
|
|
3
|
+
*/
|
|
4
|
+
export interface Params {
|
|
5
|
+
/** The subject's common name (CN) in the certificate. */
|
|
6
|
+
subjectName: string;
|
|
7
|
+
/** The issuer's common name (CN) in the certificate. */
|
|
8
|
+
issuerName: string;
|
|
9
|
+
/** The certificate validity start time (Unix timestamp in seconds). */
|
|
10
|
+
notBefore: bigint;
|
|
11
|
+
/** The certificate validity end time (Unix timestamp in seconds). */
|
|
12
|
+
notAfter: bigint;
|
|
13
|
+
/** Whether this certificate is a CA certificate (ignored for xHPKE). */
|
|
14
|
+
isCa?: boolean;
|
|
15
|
+
/** Maximum number of intermediate CAs allowed below this one (only if isCa is true, ignored for xHPKE). */
|
|
16
|
+
pathLen?: number;
|
|
17
|
+
}
|
|
18
|
+
//# sourceMappingURL=x509.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
|
package/dist/xdsa.d.ts
ADDED
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
import { Params } from './x509.js';
|
|
2
|
+
/** Size of the secret key in bytes (64). */
|
|
3
|
+
export declare const SECRET_KEY_SIZE = 64;
|
|
4
|
+
/** Size of the public key in bytes (1984). */
|
|
5
|
+
export declare const PUBLIC_KEY_SIZE = 1984;
|
|
6
|
+
/** Size of a signature in bytes (3373). */
|
|
7
|
+
export declare const SIGNATURE_SIZE = 3373;
|
|
8
|
+
/** Size of a fingerprint in bytes (32). */
|
|
9
|
+
export declare const FINGERPRINT_SIZE = 32;
|
|
10
|
+
/**
|
|
11
|
+
* Get the size constants (requires WASM initialization).
|
|
12
|
+
*/
|
|
13
|
+
export declare function sizes(): Promise<{
|
|
14
|
+
secretKey: number;
|
|
15
|
+
publicKey: number;
|
|
16
|
+
signature: number;
|
|
17
|
+
fingerprint: number;
|
|
18
|
+
}>;
|
|
19
|
+
/**
|
|
20
|
+
* Fingerprint is a 32-byte unique identifier for an xDSA key.
|
|
21
|
+
*/
|
|
22
|
+
export declare class Fingerprint {
|
|
23
|
+
private readonly bytes;
|
|
24
|
+
private constructor();
|
|
25
|
+
/** Converts a 32-byte array into a fingerprint. */
|
|
26
|
+
static fromBytes(bytes: Uint8Array): Fingerprint;
|
|
27
|
+
/** Converts a fingerprint into a 32-byte array. */
|
|
28
|
+
toBytes(): Uint8Array;
|
|
29
|
+
}
|
|
30
|
+
/**
|
|
31
|
+
* Signature is a 3373-byte xDSA signature.
|
|
32
|
+
* Format: ML-DSA (3309 bytes) || Ed25519 (64 bytes)
|
|
33
|
+
*/
|
|
34
|
+
export declare class Signature {
|
|
35
|
+
private readonly bytes;
|
|
36
|
+
private constructor();
|
|
37
|
+
/** Converts a 3373-byte array into a signature. */
|
|
38
|
+
static fromBytes(bytes: Uint8Array): Signature;
|
|
39
|
+
/** Converts a signature into a 3373-byte array. */
|
|
40
|
+
toBytes(): Uint8Array;
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* PublicKey is an ML-DSA-65 public key paired with an Ed25519 public key for
|
|
44
|
+
* verifying quantum resistant digital signatures.
|
|
45
|
+
* Format: ML-DSA (1952 bytes) || Ed25519 (32 bytes)
|
|
46
|
+
*/
|
|
47
|
+
export declare class PublicKey {
|
|
48
|
+
private readonly bytes;
|
|
49
|
+
private constructor();
|
|
50
|
+
/** Converts a 1984-byte array into a public key. */
|
|
51
|
+
static fromBytes(bytes: Uint8Array): PublicKey;
|
|
52
|
+
/** Parses a PEM string into a public key. */
|
|
53
|
+
static fromPem(pem: string): Promise<PublicKey>;
|
|
54
|
+
/**
|
|
55
|
+
* Parses a public key from a PEM-encoded X.509 certificate.
|
|
56
|
+
* Verifies the certificate signature against the provided signer.
|
|
57
|
+
*
|
|
58
|
+
* @param pem - PEM-encoded X.509 certificate
|
|
59
|
+
* @param signer - The xDSA public key that signed this certificate
|
|
60
|
+
* @returns The parsed public key and validity period (notBefore, notAfter as Unix timestamps)
|
|
61
|
+
*/
|
|
62
|
+
static fromCertPem(pem: string, signer: PublicKey): Promise<{
|
|
63
|
+
key: PublicKey;
|
|
64
|
+
notBefore: bigint;
|
|
65
|
+
notAfter: bigint;
|
|
66
|
+
}>;
|
|
67
|
+
/**
|
|
68
|
+
* Parses a public key from a DER-encoded X.509 certificate.
|
|
69
|
+
* Verifies the certificate signature against the provided signer.
|
|
70
|
+
*
|
|
71
|
+
* @param der - DER-encoded X.509 certificate
|
|
72
|
+
* @param signer - The xDSA public key that signed this certificate
|
|
73
|
+
* @returns The parsed public key and validity period (notBefore, notAfter as Unix timestamps)
|
|
74
|
+
*/
|
|
75
|
+
static fromCertDer(der: Uint8Array, signer: PublicKey): Promise<{
|
|
76
|
+
key: PublicKey;
|
|
77
|
+
notBefore: bigint;
|
|
78
|
+
notAfter: bigint;
|
|
79
|
+
}>;
|
|
80
|
+
/** Converts a public key into a 1984-byte array. */
|
|
81
|
+
toBytes(): Uint8Array;
|
|
82
|
+
/** Serializes a public key into a PEM string. */
|
|
83
|
+
toPem(): Promise<string>;
|
|
84
|
+
/** Returns a 256-bit unique identifier for this key. */
|
|
85
|
+
fingerprint(): Promise<Fingerprint>;
|
|
86
|
+
/** Verifies a digital signature of the message. */
|
|
87
|
+
verify(message: Uint8Array, signature: Signature): Promise<boolean>;
|
|
88
|
+
/**
|
|
89
|
+
* Generates a PEM-encoded X.509 certificate for this public key.
|
|
90
|
+
*
|
|
91
|
+
* @param signer - The xDSA secret key to sign the certificate
|
|
92
|
+
* @param params - Certificate parameters (subject, issuer, validity, etc.)
|
|
93
|
+
* @returns PEM-encoded X.509 certificate
|
|
94
|
+
*/
|
|
95
|
+
toCertPem(signer: SecretKey, params: Params): Promise<string>;
|
|
96
|
+
/**
|
|
97
|
+
* Generates a DER-encoded X.509 certificate for this public key.
|
|
98
|
+
*
|
|
99
|
+
* @param signer - The xDSA secret key to sign the certificate
|
|
100
|
+
* @param params - Certificate parameters (subject, issuer, validity, etc.)
|
|
101
|
+
* @returns DER-encoded X.509 certificate
|
|
102
|
+
*/
|
|
103
|
+
toCertDer(signer: SecretKey, params: Params): Promise<Uint8Array>;
|
|
104
|
+
}
|
|
105
|
+
/**
|
|
106
|
+
* SecretKey is an ML-DSA-65 private key paired with an Ed25519 private key for
|
|
107
|
+
* creating quantum resistant digital signatures.
|
|
108
|
+
* Format: ML-DSA seed (32 bytes) || Ed25519 seed (32 bytes)
|
|
109
|
+
*/
|
|
110
|
+
export declare class SecretKey {
|
|
111
|
+
private readonly bytes;
|
|
112
|
+
private constructor();
|
|
113
|
+
/** Creates a new, random private key. */
|
|
114
|
+
static generate(): Promise<SecretKey>;
|
|
115
|
+
/** Creates a private key from a 64-byte seed. */
|
|
116
|
+
static fromBytes(bytes: Uint8Array): SecretKey;
|
|
117
|
+
/** Parses a PEM string into a private key. */
|
|
118
|
+
static fromPem(pem: string): Promise<SecretKey>;
|
|
119
|
+
/** Converts a secret key into a 64-byte array. */
|
|
120
|
+
toBytes(): Uint8Array;
|
|
121
|
+
/** Serializes a private key into a PEM string. */
|
|
122
|
+
toPem(): Promise<string>;
|
|
123
|
+
/** Retrieves the public counterpart of the secret key. */
|
|
124
|
+
publicKey(): Promise<PublicKey>;
|
|
125
|
+
/** Returns a 256-bit unique identifier for this key. */
|
|
126
|
+
fingerprint(): Promise<Fingerprint>;
|
|
127
|
+
/** Creates a digital signature of the message. */
|
|
128
|
+
sign(message: Uint8Array): Promise<Signature>;
|
|
129
|
+
}
|
|
130
|
+
//# sourceMappingURL=xdsa.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"xdsa.d.ts","sourceRoot":"","sources":["../src/xdsa.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAWxC,4CAA4C;AAC5C,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,8CAA8C;AAC9C,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,2CAA2C;AAC3C,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;GAEG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAQD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,mDAAmD;IACnD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW;IAOhD,mDAAmD;IACnD,OAAO,IAAI,UAAU;CAGtB;AAED;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,mDAAmD;IACnD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS;IAO9C,mDAAmD;IACnD,OAAO,IAAI,UAAU;CAGtB;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,oDAAoD;IACpD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS;IAO9C,6CAA6C;WAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAMrD;;;;;;;OAOG;WACU,WAAW,CACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAenE;;;;;;;OAOG;WACU,WAAW,CACtB,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAenE,oDAAoD;IACpD,OAAO,IAAI,UAAU;IAIrB,iDAAiD;IAC3C,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B,wDAAwD;IAClD,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAMzC,mDAAmD;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAcnE;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAexE;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,yCAAyC;WAC5B,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC;IAM3C,iDAAiD;IACjD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS;IAO9C,8CAA8C;WACjC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAMrD,kDAAkD;IAClD,OAAO,IAAI,UAAU;IAIrB,kDAAkD;IAC5C,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B,0DAA0D;IACpD,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;IAMrC,wDAAwD;IAClD,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAKzC,kDAAkD;IAC5C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;CAKpD"}
|
package/dist/xhpke.d.ts
ADDED
|
@@ -0,0 +1,148 @@
|
|
|
1
|
+
import { PublicKey as XdsaPublicKey, SecretKey as XdsaSecretKey } from './xdsa.js';
|
|
2
|
+
import { Params } from './x509.js';
|
|
3
|
+
/** Size of the secret key seed in bytes (32). */
|
|
4
|
+
export declare const SECRET_KEY_SIZE = 32;
|
|
5
|
+
/** Size of the public key in bytes (1216). */
|
|
6
|
+
export declare const PUBLIC_KEY_SIZE = 1216;
|
|
7
|
+
/** Size of the encapsulated key in bytes (1120). */
|
|
8
|
+
export declare const ENCAP_KEY_SIZE = 1120;
|
|
9
|
+
/** Size of a fingerprint in bytes (32). */
|
|
10
|
+
export declare const FINGERPRINT_SIZE = 32;
|
|
11
|
+
/**
|
|
12
|
+
* Get the size constants (requires WASM initialization).
|
|
13
|
+
*/
|
|
14
|
+
export declare function sizes(): Promise<{
|
|
15
|
+
secretKey: number;
|
|
16
|
+
publicKey: number;
|
|
17
|
+
encapKey: number;
|
|
18
|
+
fingerprint: number;
|
|
19
|
+
}>;
|
|
20
|
+
/**
|
|
21
|
+
* Fingerprint is a 32-byte unique identifier for an xHPKE key.
|
|
22
|
+
* It is the SHA256 hash of the raw public key.
|
|
23
|
+
*/
|
|
24
|
+
export declare class Fingerprint {
|
|
25
|
+
private readonly bytes;
|
|
26
|
+
private constructor();
|
|
27
|
+
/** Converts a 32-byte array into a fingerprint. */
|
|
28
|
+
static fromBytes(bytes: Uint8Array): Fingerprint;
|
|
29
|
+
/** Converts a fingerprint into a 32-byte array. */
|
|
30
|
+
toBytes(): Uint8Array;
|
|
31
|
+
}
|
|
32
|
+
/**
|
|
33
|
+
* PublicKey contains an X-Wing public key for hybrid post-quantum encryption.
|
|
34
|
+
* Uses X-Wing KEM (ML-KEM-768 + X25519) with HPKE Base mode.
|
|
35
|
+
*/
|
|
36
|
+
export declare class PublicKey {
|
|
37
|
+
private readonly bytes;
|
|
38
|
+
private constructor();
|
|
39
|
+
/**
|
|
40
|
+
* Converts a 1216-byte array into a public key.
|
|
41
|
+
*
|
|
42
|
+
* This validates the ML-KEM-768 component by checking that all polynomial
|
|
43
|
+
* coefficients are in the valid range [0, 3329).
|
|
44
|
+
*/
|
|
45
|
+
static fromBytes(bytes: Uint8Array): PublicKey;
|
|
46
|
+
/** Parses a PEM string into a public key. */
|
|
47
|
+
static fromPem(pem: string): Promise<PublicKey>;
|
|
48
|
+
/**
|
|
49
|
+
* Parses a public key from a PEM-encoded X.509 certificate.
|
|
50
|
+
* Verifies the certificate signature against the provided xDSA signer.
|
|
51
|
+
*
|
|
52
|
+
* @param pem - PEM-encoded X.509 certificate
|
|
53
|
+
* @param signer - The xDSA public key that signed this certificate
|
|
54
|
+
* @returns The parsed public key and validity period (notBefore, notAfter as Unix timestamps)
|
|
55
|
+
*/
|
|
56
|
+
static fromCertPem(pem: string, signer: XdsaPublicKey): Promise<{
|
|
57
|
+
key: PublicKey;
|
|
58
|
+
notBefore: bigint;
|
|
59
|
+
notAfter: bigint;
|
|
60
|
+
}>;
|
|
61
|
+
/**
|
|
62
|
+
* Parses a public key from a DER-encoded X.509 certificate.
|
|
63
|
+
* Verifies the certificate signature against the provided xDSA signer.
|
|
64
|
+
*
|
|
65
|
+
* @param der - DER-encoded X.509 certificate
|
|
66
|
+
* @param signer - The xDSA public key that signed this certificate
|
|
67
|
+
* @returns The parsed public key and validity period (notBefore, notAfter as Unix timestamps)
|
|
68
|
+
*/
|
|
69
|
+
static fromCertDer(der: Uint8Array, signer: XdsaPublicKey): Promise<{
|
|
70
|
+
key: PublicKey;
|
|
71
|
+
notBefore: bigint;
|
|
72
|
+
notAfter: bigint;
|
|
73
|
+
}>;
|
|
74
|
+
/** Converts a public key into a 1216-byte array. */
|
|
75
|
+
toBytes(): Uint8Array;
|
|
76
|
+
/** Serializes a public key into a PEM string. */
|
|
77
|
+
toPem(): Promise<string>;
|
|
78
|
+
/** Returns a 256-bit unique identifier for this key (SHA256 of raw public key). */
|
|
79
|
+
fingerprint(): Promise<Fingerprint>;
|
|
80
|
+
/**
|
|
81
|
+
* Seal (encrypt) a message to this public key.
|
|
82
|
+
*
|
|
83
|
+
* Uses X-Wing KEM (ML-KEM-768 + X25519) with HPKE Base mode.
|
|
84
|
+
*
|
|
85
|
+
* @param msgToSeal - The message to encrypt
|
|
86
|
+
* @param msgToAuth - Additional data to authenticate (but not encrypt)
|
|
87
|
+
* @param domain - Application domain for context separation
|
|
88
|
+
* @returns Sealed data (encapsulated key + ciphertext)
|
|
89
|
+
*/
|
|
90
|
+
seal(msgToSeal: Uint8Array, msgToAuth: Uint8Array, domain: Uint8Array): Promise<Uint8Array>;
|
|
91
|
+
/**
|
|
92
|
+
* Generates a PEM-encoded X.509 certificate for this public key.
|
|
93
|
+
* Note: HPKE certificates are always end-entity certificates.
|
|
94
|
+
*
|
|
95
|
+
* @param signer - The xDSA secret key to sign the certificate
|
|
96
|
+
* @param params - Certificate parameters (subject, issuer, validity)
|
|
97
|
+
* @returns PEM-encoded X.509 certificate
|
|
98
|
+
*/
|
|
99
|
+
toCertPem(signer: XdsaSecretKey, params: Params): Promise<string>;
|
|
100
|
+
/**
|
|
101
|
+
* Generates a DER-encoded X.509 certificate for this public key.
|
|
102
|
+
* Note: HPKE certificates are always end-entity certificates.
|
|
103
|
+
*
|
|
104
|
+
* @param signer - The xDSA secret key to sign the certificate
|
|
105
|
+
* @param params - Certificate parameters (subject, issuer, validity)
|
|
106
|
+
* @returns DER-encoded X.509 certificate
|
|
107
|
+
*/
|
|
108
|
+
toCertDer(signer: XdsaSecretKey, params: Params): Promise<Uint8Array>;
|
|
109
|
+
}
|
|
110
|
+
/**
|
|
111
|
+
* SecretKey contains an X-Wing private key for hybrid post-quantum encryption.
|
|
112
|
+
* Uses X-Wing KEM (ML-KEM-768 + X25519) with HPKE Base mode.
|
|
113
|
+
*/
|
|
114
|
+
export declare class SecretKey {
|
|
115
|
+
private readonly bytes;
|
|
116
|
+
private constructor();
|
|
117
|
+
/** Creates a new, random private key. */
|
|
118
|
+
static generate(): Promise<SecretKey>;
|
|
119
|
+
/** Converts a 32-byte seed into a private key. */
|
|
120
|
+
static fromBytes(bytes: Uint8Array): SecretKey;
|
|
121
|
+
/** Parses a PEM string into a private key. */
|
|
122
|
+
static fromPem(pem: string): Promise<SecretKey>;
|
|
123
|
+
/** Converts a private key into a 32-byte seed. */
|
|
124
|
+
toBytes(): Uint8Array;
|
|
125
|
+
/** Serializes a private key into a PEM string. */
|
|
126
|
+
toPem(): Promise<string>;
|
|
127
|
+
/** Retrieves the public counterpart of the secret key. */
|
|
128
|
+
publicKey(): Promise<PublicKey>;
|
|
129
|
+
/** Returns a 256-bit unique identifier for this key (SHA256 of raw public key). */
|
|
130
|
+
fingerprint(): Promise<Fingerprint>;
|
|
131
|
+
/**
|
|
132
|
+
* Open (decrypt) a sealed message with this secret key.
|
|
133
|
+
*
|
|
134
|
+
* Deconstructs the encapsulated key and ciphertext, verifying the
|
|
135
|
+
* authenticity of the (unencrypted) message-to-auth.
|
|
136
|
+
*
|
|
137
|
+
* Note: X-Wing uses Base mode (no sender authentication). The sender's
|
|
138
|
+
* identity cannot be verified from the ciphertext alone.
|
|
139
|
+
*
|
|
140
|
+
* @param sealed - The sealed data from `seal()`
|
|
141
|
+
* @param msgToAuth - The same additional authenticated data used during sealing
|
|
142
|
+
* @param domain - The same application domain used during sealing
|
|
143
|
+
* @returns The decrypted message
|
|
144
|
+
* @throws If decryption fails (wrong key, tampered data, or wrong AAD/domain)
|
|
145
|
+
*/
|
|
146
|
+
open(sealed: Uint8Array, msgToAuth: Uint8Array, domain: Uint8Array): Promise<Uint8Array>;
|
|
147
|
+
}
|
|
148
|
+
//# sourceMappingURL=xhpke.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"xhpke.d.ts","sourceRoot":"","sources":["../src/xhpke.ts"],"names":[],"mappings":"AA0BA,OAAO,EACL,SAAS,IAAI,aAAa,EAC1B,SAAS,IAAI,aAAa,EAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAWxC,iDAAiD;AACjD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,8CAA8C;AAC9C,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;GAEG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAQD;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,mDAAmD;IACnD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW;IAOhD,mDAAmD;IACnD,OAAO,IAAI,UAAU;CAGtB;AAED;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP;;;;;OAKG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS;IAO9C,6CAA6C;WAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAMrD;;;;;;;OAOG;WACU,WAAW,CACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAenE;;;;;;;OAOG;WACU,WAAW,CACtB,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAenE,oDAAoD;IACpD,OAAO,IAAI,UAAU;IAIrB,iDAAiD;IAC3C,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B,mFAAmF;IAC7E,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAMzC;;;;;;;;;OASG;IACG,IAAI,CACR,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC;IAKtB;;;;;;;OAOG;IACG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYvE;;;;;;;OAOG;IACG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAa5E;AAED;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO;IAIP,yCAAyC;WAC5B,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC;IAM3C,kDAAkD;IAClD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS;IAO9C,8CAA8C;WACjC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAMrD,kDAAkD;IAClD,OAAO,IAAI,UAAU;IAIrB,kDAAkD;IAC5C,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B,0DAA0D;IACpD,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;IAMrC,mFAAmF;IAC7E,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;IAKzC;;;;;;;;;;;;;;OAcG;IACG,IAAI,CACR,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC;CAIvB"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@darkbio/crypto",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"author": "Péter Szilágyi <peter@dark.bio>",
|
|
5
5
|
"description": "Cryptography primitives and wrappers",
|
|
6
6
|
"repository": {
|
|
@@ -36,6 +36,7 @@
|
|
|
36
36
|
"playwright": "^1.50.0",
|
|
37
37
|
"typescript": "^5.7.0",
|
|
38
38
|
"vite": "^6.0.0",
|
|
39
|
+
"vite-plugin-dts": "^4.5.4",
|
|
39
40
|
"vitest": "^3.0.0"
|
|
40
41
|
},
|
|
41
42
|
"keywords": [
|