@digitaldefiance/ecies-lib 4.4.2 → 4.4.3

package/src/lib/invariants/encryption-algorithm-consistency.ts

@@ -0,0 +1,73 @@
+import { IConstants } from '../../interfaces/constants';
+import { BaseInvariant } from '../../interfaces/invariant';
+
+/**
+ * Validates that encryption algorithm parameters are consistent.
+ * 
+ * Checks:
+ * - Symmetric key size matches the algorithm (AES-256 = 32 bytes)
+ * - Curve name is supported
+ * - Key derivation path is valid
+ */
+export class EncryptionAlgorithmConsistencyInvariant extends BaseInvariant {
+  private static readonly SUPPORTED_CURVES = [
+    'secp256k1',
+    'p256',
+    'p384',
+    'p521',
+  ];
+
+  constructor() {
+    super(
+      'EncryptionAlgorithmConsistency',
+      'Encryption algorithm parameters must be consistent'
+    );
+  }
+
+  check(config: IConstants): boolean {
+    // AES-256 requires 32-byte keys
+    if (config.ECIES.SYMMETRIC.KEY_SIZE !== 32) {
+      return false;
+    }
+
+    // Check curve is supported
+    if (!EncryptionAlgorithmConsistencyInvariant.SUPPORTED_CURVES.includes(
+      config.ECIES.CURVE_NAME
+    )) {
+      return false;
+    }
+
+    // Key derivation path should be valid BIP32 path
+    if (!config.ECIES.PRIMARY_KEY_DERIVATION_PATH.startsWith('m/')) {
+      return false;
+    }
+
+    return true;
+  }
+
+  errorMessage(config: IConstants): string {
+    const issues: string[] = [];
+
+    if (config.ECIES.SYMMETRIC.KEY_SIZE !== 32) {
+      issues.push(
+        `SYMMETRIC.KEY_SIZE (${config.ECIES.SYMMETRIC.KEY_SIZE}) must be 32 for AES-256`
+      );
+    }
+
+    if (!EncryptionAlgorithmConsistencyInvariant.SUPPORTED_CURVES.includes(
+      config.ECIES.CURVE_NAME
+    )) {
+      issues.push(
+        `CURVE_NAME (${config.ECIES.CURVE_NAME}) must be one of: ${EncryptionAlgorithmConsistencyInvariant.SUPPORTED_CURVES.join(', ')}`
+      );
+    }
+
+    if (!config.ECIES.PRIMARY_KEY_DERIVATION_PATH.startsWith('m/')) {
+      issues.push(
+        `PRIMARY_KEY_DERIVATION_PATH (${config.ECIES.PRIMARY_KEY_DERIVATION_PATH}) must be a valid BIP32 path starting with 'm/'`
+      );
+    }
+
+    return `Invariant '${this.name}' failed:\n  ${issues.join('\n  ')}`;
+  }
+}

package/src/lib/invariants/{index.js → index.ts}

@@ -1,4 +1,3 @@
 export * from './recipient-id-consistency';
 export * from './pbkdf2-profiles-validity';
 export * from './encryption-algorithm-consistency';
-//# sourceMappingURL=index.js.map

package/src/lib/invariants/pbkdf2-profiles-validity.ts

@@ -0,0 +1,78 @@
+import { IConstants } from '../../interfaces/constants';
+import { BaseInvariant } from '../../interfaces/invariant';
+import { Pbkdf2ProfileEnum } from '../../enumerations/pbkdf2-profile';
+
+/**
+ * Validates that PBKDF2 profiles have sensible parameters.
+ * 
+ * Checks:
+ * - iterations > 0 and not too low (security risk)
+ * - saltBytes > 0 and reasonable
+ * - hashBytes > 0 and matches expected hash output
+ */
+export class Pbkdf2ProfilesValidityInvariant extends BaseInvariant {
+  constructor() {
+    super(
+      'Pbkdf2ProfilesValidity',
+      'PBKDF2 profiles must have valid cryptographic parameters'
+    );
+  }
+
+  check(config: IConstants): boolean {
+    const profiles = [
+      config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.BROWSER_PASSWORD],
+      config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.HIGH_SECURITY],
+      config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.TEST_FAST],
+    ];
+
+    for (const profile of profiles) {
+      // iterations must be positive and reasonable
+      if (profile.iterations < 1000 || profile.iterations > 10_000_000) {
+        return false;
+      }
+
+      // saltBytes must be at least 16 bytes (128 bits)
+      if (profile.saltBytes < 16 || profile.saltBytes > 256) {
+        return false;
+      }
+
+      // hashBytes must be positive and reasonable for sha256
+      if (profile.hashBytes < 16 || profile.hashBytes > 64) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  errorMessage(config: IConstants): string {
+    const issues: string[] = [];
+    const profileTests = [
+      { name: 'BROWSER_PASSWORD', profile: config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.BROWSER_PASSWORD] },
+      { name: 'HIGH_SECURITY', profile: config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.HIGH_SECURITY] },
+      { name: 'TEST_FAST', profile: config.PBKDF2_PROFILES[Pbkdf2ProfileEnum.TEST_FAST] },
+    ];
+
+    for (const { name, profile } of profileTests) {
+      if (profile.iterations < 1000 || profile.iterations > 10_000_000) {
+        issues.push(
+          `${name}.iterations (${profile.iterations}) must be between 1000 and 10,000,000`
+        );
+      }
+
+      if (profile.saltBytes < 16 || profile.saltBytes > 256) {
+        issues.push(
+          `${name}.saltBytes (${profile.saltBytes}) must be between 16 and 256`
+        );
+      }
+
+      if (profile.hashBytes < 16 || profile.hashBytes > 64) {
+        issues.push(
+          `${name}.hashBytes (${profile.hashBytes}) must be between 16 and 64`
+        );
+      }
+    }
+
+    return `Invariant '${this.name}' failed:\n  ${issues.join('\n  ')}`;
+  }
+}

package/src/lib/invariants/recipient-id-consistency.ts

@@ -0,0 +1,46 @@
+import { IConstants } from '../../interfaces/constants';
+import { BaseInvariant } from '../../interfaces/invariant';
+
+/**
+ * Validates that all recipient ID size configurations are consistent.
+ * 
+ * This invariant would have caught the 12 vs 32 byte discrepancy.
+ * 
+ * Checks:
+ * - MEMBER_ID_LENGTH === idProvider.byteLength
+ * - ECIES.MULTIPLE.RECIPIENT_ID_SIZE === idProvider.byteLength
+ * - All three values must be in sync
+ */
+export class RecipientIdConsistencyInvariant extends BaseInvariant {
+  constructor() {
+    super(
+      'RecipientIdConsistency',
+      'All recipient ID size configurations must match the ID provider byte length'
+    );
+  }
+
+  check(config: IConstants): boolean {
+    return (
+      config.MEMBER_ID_LENGTH === config.idProvider.byteLength &&
+      config.ECIES.MULTIPLE.RECIPIENT_ID_SIZE === config.idProvider.byteLength
+    );
+  }
+
+  errorMessage(config: IConstants): string {
+    const issues: string[] = [];
+
+    if (config.MEMBER_ID_LENGTH !== config.idProvider.byteLength) {
+      issues.push(
+        `MEMBER_ID_LENGTH (${config.MEMBER_ID_LENGTH}) !== idProvider.byteLength (${config.idProvider.byteLength})`
+      );
+    }
+
+    if (config.ECIES.MULTIPLE.RECIPIENT_ID_SIZE !== config.idProvider.byteLength) {
+      issues.push(
+        `ECIES.MULTIPLE.RECIPIENT_ID_SIZE (${config.ECIES.MULTIPLE.RECIPIENT_ID_SIZE}) !== idProvider.byteLength (${config.idProvider.byteLength})`
+      );
+    }
+
+    return `Invariant '${this.name}' failed:\n  ${issues.join('\n  ')}`;
+  }
+}

package/src/lib/multi-recipient-chunk-utils.ts

@@ -0,0 +1,63 @@
+/**
+ * Multi-recipient format constants structure
+ */
+export interface IMultiRecipientConstants {
+  readonly MAGIC: number;
+  readonly VERSION: number;
+  readonly HEADER_SIZE: number;
+  readonly RECIPIENT_ID_SIZE: number;
+  readonly KEY_SIZE_BYTES: number;
+  readonly FLAG_IS_LAST: number;
+  readonly FLAG_HAS_CHECKSUM: number;
+  readonly MAX_RECIPIENTS: number;
+}
+
+/**
+ * Get multi-recipient constants for a specific recipient ID size.
+ * This allows the format to adapt to different ID providers.
+ *
+ * @param recipientIdSize - The byte length of recipient IDs (from ID provider)
+ * @returns Frozen constants object for the multi-recipient format
+ *
+ * @example
+ * ```typescript
+ * // For ObjectID (12 bytes)
+ * const constants = getMultiRecipientConstants(12);
+ *
+ * // For GUID (16 bytes)
+ * const constants = getMultiRecipientConstants(16);
+ * ```
+ */
+export function getMultiRecipientConstants(
+  recipientIdSize: number,
+): IMultiRecipientConstants {
+  if (
+    !Number.isInteger(recipientIdSize) ||
+    recipientIdSize < 1 ||
+    recipientIdSize > 255
+  ) {
+    throw new Error(
+      `Invalid recipientIdSize: ${recipientIdSize}. Must be an integer between 1 and 255.`,
+    );
+  }
+
+  return Object.freeze({
+    MAGIC: 0x4d524543, // "MREC"
+    VERSION: 0x0002, // Updated to 0x0002 for Shared Ephemeral Key support
+    HEADER_SIZE: 64, // Increased to 64 bytes to accommodate Ephemeral Public Key (33 bytes)
+    RECIPIENT_ID_SIZE: recipientIdSize,
+    KEY_SIZE_BYTES: 2,
+    FLAG_IS_LAST: 0x01,
+    FLAG_HAS_CHECKSUM: 0x02,
+    MAX_RECIPIENTS: 65535,
+  });
+}
+
+/**
+ * Default multi-recipient constants using ObjectID size (12 bytes).
+ *
+ * @deprecated Use getMultiRecipientConstants(config.idProvider.byteLength) instead
+ * for dynamic ID size support. This constant is provided for backward compatibility only.
+ */
+export const MULTI_RECIPIENT_CONSTANTS: IMultiRecipientConstants =
+  getMultiRecipientConstants(12);