@digitaldefiance/node-ecies-lib 1.0.1 → 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +266 -0
- package/dist/services/aes-gcm.d.ts +59 -0
- package/dist/services/aes-gcm.d.ts.map +1 -0
- package/dist/services/aes-gcm.js +91 -0
- package/dist/services/aes-gcm.js.map +1 -0
- package/dist/services/index.d.ts +1 -0
- package/dist/services/index.d.ts.map +1 -1
- package/dist/services/index.js +1 -0
- package/dist/services/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
ADDED
|
@@ -0,0 +1,266 @@
|
|
|
1
|
+
# @digitaldefiance/node-ecies-lib
|
|
2
|
+
|
|
3
|
+
A Node.js-specific implementation of the Digital Defiance ECIES (Elliptic Curve Integrated Encryption Scheme) library, providing secure encryption, decryption, and key management capabilities using Node.js crypto primitives.
|
|
4
|
+
|
|
5
|
+
## Features
|
|
6
|
+
|
|
7
|
+
- **ECIES Encryption/Decryption**: Secure elliptic curve integrated encryption scheme
|
|
8
|
+
- **Multi-recipient Encryption**: Encrypt data for multiple recipients simultaneously
|
|
9
|
+
- **PBKDF2 Key Derivation**: Password-based key derivation with configurable profiles
|
|
10
|
+
- **Digital Signatures**: Sign and verify data using elliptic curve cryptography
|
|
11
|
+
- **Member Management**: Comprehensive user/member system with key management
|
|
12
|
+
- **Cross-platform Compatibility**: Works seamlessly with the browser-based `@digitaldefiance/ecies-lib`
|
|
13
|
+
|
|
14
|
+
## Installation
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npm install @digitaldefiance/node-ecies-lib
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
## Quick Start
|
|
21
|
+
|
|
22
|
+
```typescript
|
|
23
|
+
import { ECIESService, Member, MemberType, EmailString } from '@digitaldefiance/node-ecies-lib';
|
|
24
|
+
import { getEciesI18nEngine } from '@digitaldefiance/ecies-lib';
|
|
25
|
+
|
|
26
|
+
// Initialize the service
|
|
27
|
+
const eciesService = new ECIESService(getEciesI18nEngine());
|
|
28
|
+
|
|
29
|
+
// Create a new member
|
|
30
|
+
const { member, mnemonic } = Member.newMember(
|
|
31
|
+
eciesService,
|
|
32
|
+
MemberType.User,
|
|
33
|
+
'Alice',
|
|
34
|
+
new EmailString('alice@example.com')
|
|
35
|
+
);
|
|
36
|
+
|
|
37
|
+
// Encrypt data
|
|
38
|
+
const message = 'Hello, secure world!';
|
|
39
|
+
const encrypted = member.encryptData(message);
|
|
40
|
+
|
|
41
|
+
// Decrypt data
|
|
42
|
+
const decrypted = member.decryptData(encrypted);
|
|
43
|
+
console.log(decrypted.toString()); // "Hello, secure world!"
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
## Core Components
|
|
47
|
+
|
|
48
|
+
### ECIESService
|
|
49
|
+
|
|
50
|
+
The main service class providing encryption, decryption, and key management:
|
|
51
|
+
|
|
52
|
+
```typescript
|
|
53
|
+
import { ECIESService } from '@digitaldefiance/node-ecies-lib';
|
|
54
|
+
import { getEciesI18nEngine } from '@digitaldefiance/ecies-lib';
|
|
55
|
+
|
|
56
|
+
const service = new ECIESService(getEciesI18nEngine());
|
|
57
|
+
|
|
58
|
+
// Generate mnemonic
|
|
59
|
+
const mnemonic = service.generateNewMnemonic();
|
|
60
|
+
|
|
61
|
+
// Single recipient encryption
|
|
62
|
+
const encrypted = service.encryptSimpleOrSingle(
|
|
63
|
+
false, // use single mode (not simple)
|
|
64
|
+
recipientPublicKey,
|
|
65
|
+
Buffer.from('message')
|
|
66
|
+
);
|
|
67
|
+
|
|
68
|
+
// Multi-recipient encryption
|
|
69
|
+
const multiEncrypted = service.encryptMultiple(
|
|
70
|
+
[member1, member2, member3],
|
|
71
|
+
Buffer.from('message')
|
|
72
|
+
);
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
### Member Class
|
|
76
|
+
|
|
77
|
+
Represents a user with cryptographic capabilities:
|
|
78
|
+
|
|
79
|
+
```typescript
|
|
80
|
+
import { Member, MemberType, EmailString } from '@digitaldefiance/node-ecies-lib';
|
|
81
|
+
|
|
82
|
+
// Create from mnemonic
|
|
83
|
+
const member = Member.fromMnemonic(mnemonic, eciesService);
|
|
84
|
+
|
|
85
|
+
// Sign data
|
|
86
|
+
const signature = member.sign(Buffer.from('data to sign'));
|
|
87
|
+
|
|
88
|
+
// Verify signature
|
|
89
|
+
const isValid = member.verify(signature, Buffer.from('data to sign'));
|
|
90
|
+
|
|
91
|
+
// Encrypt for another member
|
|
92
|
+
const encrypted = member.encryptData('secret message', otherMember.publicKey);
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
### PBKDF2 Service
|
|
96
|
+
|
|
97
|
+
Password-based key derivation with multiple security profiles:
|
|
98
|
+
|
|
99
|
+
```typescript
|
|
100
|
+
import { Pbkdf2Service, Pbkdf2ProfileEnum } from '@digitaldefiance/node-ecies-lib';
|
|
101
|
+
|
|
102
|
+
// Use predefined profile
|
|
103
|
+
const result = Pbkdf2Service.deriveKeyFromPasswordWithProfile(
|
|
104
|
+
Buffer.from('password'),
|
|
105
|
+
Pbkdf2ProfileEnum.USER_LOGIN
|
|
106
|
+
);
|
|
107
|
+
|
|
108
|
+
// Custom parameters
|
|
109
|
+
const customResult = Pbkdf2Service.deriveKeyFromPassword(
|
|
110
|
+
Buffer.from('password'),
|
|
111
|
+
salt,
|
|
112
|
+
100000, // iterations
|
|
113
|
+
32, // salt bytes
|
|
114
|
+
32, // key bytes
|
|
115
|
+
'sha256' // algorithm
|
|
116
|
+
);
|
|
117
|
+
|
|
118
|
+
// Async version
|
|
119
|
+
const asyncResult = await Pbkdf2Service.deriveKeyFromPasswordAsync(
|
|
120
|
+
Buffer.from('password')
|
|
121
|
+
);
|
|
122
|
+
```
|
|
123
|
+
|
|
124
|
+
## PBKDF2 Profiles
|
|
125
|
+
|
|
126
|
+
The library includes several predefined PBKDF2 profiles for different use cases:
|
|
127
|
+
|
|
128
|
+
| Profile | Salt Size | Iterations | Algorithm | Hash Size | Use Case |
|
|
129
|
+
|---------|-----------|------------|-----------|-----------|----------|
|
|
130
|
+
| `USER_LOGIN` | 32 bytes | 1,304,000 | SHA-256 | 32 bytes | User authentication |
|
|
131
|
+
| `KEY_WRAPPING` | 32 bytes | 100,000 | SHA-256 | 32 bytes | Key encryption |
|
|
132
|
+
| `BACKUP_CODES` | 32 bytes | 1,304,000 | SHA-256 | 32 bytes | Backup codes |
|
|
133
|
+
| `HIGH_SECURITY` | 64 bytes | 2,000,000 | SHA-512 | 64 bytes | Sensitive operations |
|
|
134
|
+
| `FAST_TEST` | 16 bytes | 1,000 | SHA-256 | 32 bytes | Testing/development |
|
|
135
|
+
|
|
136
|
+
## Encryption Types
|
|
137
|
+
|
|
138
|
+
The library supports multiple encryption modes:
|
|
139
|
+
|
|
140
|
+
- **Simple**: Basic ECIES encryption for single recipients
|
|
141
|
+
- **Single**: Enhanced ECIES with additional metadata
|
|
142
|
+
- **Multiple**: Efficient encryption for multiple recipients
|
|
143
|
+
|
|
144
|
+
```typescript
|
|
145
|
+
// Single recipient
|
|
146
|
+
const singleEncrypted = service.encryptSimpleOrSingle(
|
|
147
|
+
false, // single mode
|
|
148
|
+
recipientPublicKey,
|
|
149
|
+
message
|
|
150
|
+
);
|
|
151
|
+
|
|
152
|
+
// Multiple recipients
|
|
153
|
+
const multiEncrypted = service.encryptMultiple(
|
|
154
|
+
[member1, member2, member3],
|
|
155
|
+
message
|
|
156
|
+
);
|
|
157
|
+
```
|
|
158
|
+
|
|
159
|
+
## Cross-Platform Compatibility
|
|
160
|
+
|
|
161
|
+
This Node.js library is designed to work seamlessly with the browser-based `@digitaldefiance/ecies-lib`:
|
|
162
|
+
|
|
163
|
+
```typescript
|
|
164
|
+
// Data encrypted in browser can be decrypted in Node.js
|
|
165
|
+
const browserEncrypted = /* data from browser */;
|
|
166
|
+
const nodeDecrypted = nodeMember.decryptData(browserEncrypted);
|
|
167
|
+
|
|
168
|
+
// Data encrypted in Node.js can be decrypted in browser
|
|
169
|
+
const nodeEncrypted = nodeMember.encryptData('message');
|
|
170
|
+
// Send nodeEncrypted to browser for decryption
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
## Security Features
|
|
174
|
+
|
|
175
|
+
- **Secure Memory Management**: Uses `SecureBuffer` and `SecureString` for sensitive data
|
|
176
|
+
- **Key Zeroization**: Automatic cleanup of cryptographic material
|
|
177
|
+
- **Configurable Security Levels**: Multiple PBKDF2 profiles for different security requirements
|
|
178
|
+
- **Input Validation**: Comprehensive validation of all cryptographic inputs
|
|
179
|
+
- **Error Handling**: Detailed error types for debugging and security analysis
|
|
180
|
+
|
|
181
|
+
## API Reference
|
|
182
|
+
|
|
183
|
+
### Constants
|
|
184
|
+
|
|
185
|
+
```typescript
|
|
186
|
+
import { Constants, PBKDF2, PBKDF2_PROFILES } from '@digitaldefiance/node-ecies-lib';
|
|
187
|
+
|
|
188
|
+
// Access configuration constants
|
|
189
|
+
const saltSize = Constants.PBKDF2.SALT_BYTES; // 32
|
|
190
|
+
const iterations = Constants.PBKDF2.ITERATIONS_PER_SECOND; // 1,304,000
|
|
191
|
+
const keyWrappingProfile = Constants.PBKDF2_PROFILES.KEY_WRAPPING;
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
### Interfaces
|
|
195
|
+
|
|
196
|
+
Key interfaces for type safety:
|
|
197
|
+
|
|
198
|
+
- `IPbkdf2Result`: Result of key derivation operations
|
|
199
|
+
- `IMultiEncryptedMessage`: Multi-recipient encrypted data structure
|
|
200
|
+
- `IMemberOperational`: Member interface with operational methods
|
|
201
|
+
- `IWalletSeed`: Wallet and seed information
|
|
202
|
+
|
|
203
|
+
## Testing
|
|
204
|
+
|
|
205
|
+
The library includes comprehensive test coverage:
|
|
206
|
+
|
|
207
|
+
```bash
|
|
208
|
+
# Run all tests
|
|
209
|
+
npm test
|
|
210
|
+
|
|
211
|
+
# Run specific test suites
|
|
212
|
+
npm test -- pbkdf2.spec.ts
|
|
213
|
+
npm test -- ecies-compatibility.e2e.spec.ts
|
|
214
|
+
```
|
|
215
|
+
|
|
216
|
+
Test categories:
|
|
217
|
+
- Unit tests for individual components
|
|
218
|
+
- Integration tests for cross-component functionality
|
|
219
|
+
- End-to-end tests for complete workflows
|
|
220
|
+
- Cross-platform compatibility tests
|
|
221
|
+
|
|
222
|
+
## Error Handling
|
|
223
|
+
|
|
224
|
+
The library provides detailed error types for different failure scenarios:
|
|
225
|
+
|
|
226
|
+
```typescript
|
|
227
|
+
import { Pbkdf2Error, Pbkdf2ErrorType, MemberError, MemberErrorType } from '@digitaldefiance/node-ecies-lib';
|
|
228
|
+
|
|
229
|
+
try {
|
|
230
|
+
const result = Pbkdf2Service.deriveKeyFromPassword(password, invalidSalt);
|
|
231
|
+
} catch (error) {
|
|
232
|
+
if (error instanceof Pbkdf2Error) {
|
|
233
|
+
if (error.type === Pbkdf2ErrorType.InvalidSaltLength) {
|
|
234
|
+
console.log('Salt length is invalid');
|
|
235
|
+
}
|
|
236
|
+
}
|
|
237
|
+
}
|
|
238
|
+
```
|
|
239
|
+
|
|
240
|
+
## Performance Considerations
|
|
241
|
+
|
|
242
|
+
- **Async Operations**: Use async versions of PBKDF2 operations to avoid blocking the event loop
|
|
243
|
+
- **Memory Management**: Dispose of members and secure buffers when no longer needed
|
|
244
|
+
- **Profile Selection**: Choose appropriate PBKDF2 profiles based on security vs. performance requirements
|
|
245
|
+
|
|
246
|
+
```typescript
|
|
247
|
+
// Use async for better performance
|
|
248
|
+
const result = await Pbkdf2Service.deriveKeyFromPasswordAsync(password);
|
|
249
|
+
|
|
250
|
+
// Dispose of resources
|
|
251
|
+
member.dispose();
|
|
252
|
+
secureString.dispose();
|
|
253
|
+
```
|
|
254
|
+
|
|
255
|
+
## License
|
|
256
|
+
|
|
257
|
+
MIT
|
|
258
|
+
|
|
259
|
+
## Contributing
|
|
260
|
+
|
|
261
|
+
Please read the contributing guidelines in the main repository.
|
|
262
|
+
|
|
263
|
+
## Related Packages
|
|
264
|
+
|
|
265
|
+
- `@digitaldefiance/ecies-lib`: Browser-compatible ECIES library
|
|
266
|
+
- `@digitaldefiance/i18n-lib`: Internationalization support
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
export declare abstract class AESGCMService {
|
|
2
|
+
static readonly ALGORITHM_NAME: string;
|
|
3
|
+
static readonly MODE: string;
|
|
4
|
+
static readonly KEY_BITS: number;
|
|
5
|
+
/**
|
|
6
|
+
* Encrypt data using AES-GCM
|
|
7
|
+
* @param data Data to encrypt
|
|
8
|
+
* @param key Key to use for encryption (must be 16, 24 or 32 bytes for AES)
|
|
9
|
+
* @param authTag Whether to return separate auth tag
|
|
10
|
+
* @returns Encrypted data with IV and optional separate auth tag
|
|
11
|
+
*/
|
|
12
|
+
static encrypt(data: Buffer, key: Buffer, authTag?: boolean): {
|
|
13
|
+
encrypted: Buffer;
|
|
14
|
+
iv: Buffer;
|
|
15
|
+
tag?: Buffer;
|
|
16
|
+
};
|
|
17
|
+
/**
|
|
18
|
+
* Combine encrypted data and auth tag into a single Buffer
|
|
19
|
+
* @param encryptedData The encrypted data
|
|
20
|
+
* @param authTag The authentication tag
|
|
21
|
+
* @returns The combined Buffer
|
|
22
|
+
*/
|
|
23
|
+
static combineEncryptedDataAndTag(encryptedData: Buffer, authTag: Buffer): Buffer;
|
|
24
|
+
/**
|
|
25
|
+
* Combine IV and encrypted data (with optional auth tag) into a single Buffer
|
|
26
|
+
* @param iv The initialization vector
|
|
27
|
+
* @param encryptedDataWithTag The encrypted data with auth tag already appended (if applicable)
|
|
28
|
+
* @returns The combined Buffer
|
|
29
|
+
*/
|
|
30
|
+
static combineIvAndEncryptedData(iv: Buffer, encryptedDataWithTag: Buffer): Buffer;
|
|
31
|
+
/**
|
|
32
|
+
* Combine IV, encrypted data and auth tag into a single Buffer
|
|
33
|
+
* @param iv The initialization vector
|
|
34
|
+
* @param encryptedData The encrypted data
|
|
35
|
+
* @param authTag The authentication tag
|
|
36
|
+
* @returns The combined Buffer
|
|
37
|
+
*/
|
|
38
|
+
static combineIvTagAndEncryptedData(iv: Buffer, encryptedData: Buffer, authTag: Buffer): Buffer;
|
|
39
|
+
/**
|
|
40
|
+
* Split combined encrypted data back into its components
|
|
41
|
+
* @param combinedData The combined data containing IV, encrypted data, and optionally auth tag
|
|
42
|
+
* @param hasAuthTag Whether the combined data includes an authentication tag
|
|
43
|
+
* @returns Object containing the split components
|
|
44
|
+
*/
|
|
45
|
+
static splitEncryptedData(combinedData: Buffer, hasAuthTag?: boolean): {
|
|
46
|
+
iv: Buffer;
|
|
47
|
+
encryptedDataWithTag: Buffer;
|
|
48
|
+
};
|
|
49
|
+
/**
|
|
50
|
+
* Decrypt data using AES-GCM
|
|
51
|
+
* @param iv The initialization vector
|
|
52
|
+
* @param encryptedData Data to decrypt (with auth tag appended)
|
|
53
|
+
* @param key Key to use for decryption (must be 16, 24 or 32 bytes for AES)
|
|
54
|
+
* @param authTag Whether the encrypted data includes an authentication tag
|
|
55
|
+
* @returns Decrypted data
|
|
56
|
+
*/
|
|
57
|
+
static decrypt(iv: Buffer, encryptedData: Buffer, key: Buffer, authTag?: boolean): Buffer;
|
|
58
|
+
}
|
|
59
|
+
//# sourceMappingURL=aes-gcm.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"aes-gcm.d.ts","sourceRoot":"","sources":["../../src/services/aes-gcm.ts"],"names":[],"mappings":"AAGA,8BAAsB,aAAa;IACjC,gBAAuB,cAAc,SAA+B;IACpE,gBAAuB,IAAI,SAA0B;IACrD,gBAAuB,QAAQ,SAA8B;IAE7D;;;;;;OAMG;WACW,OAAO,CACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAe,GACvB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;IAmBlD;;;;;OAKG;WACW,0BAA0B,CACtC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM;IAIT;;;;;OAKG;WACW,yBAAyB,CACrC,EAAE,EAAE,MAAM,EACV,oBAAoB,EAAE,MAAM,GAC3B,MAAM;IAIT;;;;;;OAMG;WACW,4BAA4B,CACxC,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM;IAQT;;;;;OAKG;WACW,kBAAkB,CAC9B,YAAY,EAAE,MAAM,EACpB,UAAU,GAAE,OAAc,GACzB;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE;IAgB/C;;;;;;;OAOG;WACW,OAAO,CACnB,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAe,GACvB,MAAM;CAWV"}
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
|
|
2
|
+
import { Constants } from '../constants';
|
|
3
|
+
export class AESGCMService {
|
|
4
|
+
static ALGORITHM_NAME = Constants.KEYRING.ALGORITHM;
|
|
5
|
+
static MODE = Constants.KEYRING.MODE;
|
|
6
|
+
static KEY_BITS = Constants.KEYRING.KEY_BITS;
|
|
7
|
+
/**
|
|
8
|
+
* Encrypt data using AES-GCM
|
|
9
|
+
* @param data Data to encrypt
|
|
10
|
+
* @param key Key to use for encryption (must be 16, 24 or 32 bytes for AES)
|
|
11
|
+
* @param authTag Whether to return separate auth tag
|
|
12
|
+
* @returns Encrypted data with IV and optional separate auth tag
|
|
13
|
+
*/
|
|
14
|
+
static encrypt(data, key, authTag = false) {
|
|
15
|
+
const iv = randomBytes(Constants.WRAPPED_KEY.IV_SIZE);
|
|
16
|
+
const cipher = createCipheriv(Constants.KEYRING_ALGORITHM_CONFIGURATION, key, iv);
|
|
17
|
+
const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
|
|
18
|
+
const tag = cipher.getAuthTag();
|
|
19
|
+
if (!authTag) {
|
|
20
|
+
const encryptedWithTag = Buffer.concat([encrypted, tag]);
|
|
21
|
+
return { encrypted: encryptedWithTag, iv: iv };
|
|
22
|
+
}
|
|
23
|
+
return {
|
|
24
|
+
encrypted: encrypted,
|
|
25
|
+
iv: iv,
|
|
26
|
+
tag: tag,
|
|
27
|
+
};
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* Combine encrypted data and auth tag into a single Buffer
|
|
31
|
+
* @param encryptedData The encrypted data
|
|
32
|
+
* @param authTag The authentication tag
|
|
33
|
+
* @returns The combined Buffer
|
|
34
|
+
*/
|
|
35
|
+
static combineEncryptedDataAndTag(encryptedData, authTag) {
|
|
36
|
+
return Buffer.concat([encryptedData, authTag]);
|
|
37
|
+
}
|
|
38
|
+
/**
|
|
39
|
+
* Combine IV and encrypted data (with optional auth tag) into a single Buffer
|
|
40
|
+
* @param iv The initialization vector
|
|
41
|
+
* @param encryptedDataWithTag The encrypted data with auth tag already appended (if applicable)
|
|
42
|
+
* @returns The combined Buffer
|
|
43
|
+
*/
|
|
44
|
+
static combineIvAndEncryptedData(iv, encryptedDataWithTag) {
|
|
45
|
+
return Buffer.concat([iv, encryptedDataWithTag]);
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Combine IV, encrypted data and auth tag into a single Buffer
|
|
49
|
+
* @param iv The initialization vector
|
|
50
|
+
* @param encryptedData The encrypted data
|
|
51
|
+
* @param authTag The authentication tag
|
|
52
|
+
* @returns The combined Buffer
|
|
53
|
+
*/
|
|
54
|
+
static combineIvTagAndEncryptedData(iv, encryptedData, authTag) {
|
|
55
|
+
const encryptedWithTag = AESGCMService.combineEncryptedDataAndTag(encryptedData, authTag);
|
|
56
|
+
return AESGCMService.combineIvAndEncryptedData(iv, encryptedWithTag);
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Split combined encrypted data back into its components
|
|
60
|
+
* @param combinedData The combined data containing IV, encrypted data, and optionally auth tag
|
|
61
|
+
* @param hasAuthTag Whether the combined data includes an authentication tag
|
|
62
|
+
* @returns Object containing the split components
|
|
63
|
+
*/
|
|
64
|
+
static splitEncryptedData(combinedData, hasAuthTag = true) {
|
|
65
|
+
const ivLength = Constants.WRAPPED_KEY.IV_SIZE;
|
|
66
|
+
const minLength = ivLength + (hasAuthTag ? 16 : 0);
|
|
67
|
+
if (combinedData.length < minLength) {
|
|
68
|
+
throw new Error('Combined data is too short to contain required components');
|
|
69
|
+
}
|
|
70
|
+
const iv = combinedData.slice(0, ivLength);
|
|
71
|
+
const encryptedDataWithTag = combinedData.slice(ivLength);
|
|
72
|
+
return { iv, encryptedDataWithTag };
|
|
73
|
+
}
|
|
74
|
+
/**
|
|
75
|
+
* Decrypt data using AES-GCM
|
|
76
|
+
* @param iv The initialization vector
|
|
77
|
+
* @param encryptedData Data to decrypt (with auth tag appended)
|
|
78
|
+
* @param key Key to use for decryption (must be 16, 24 or 32 bytes for AES)
|
|
79
|
+
* @param authTag Whether the encrypted data includes an authentication tag
|
|
80
|
+
* @returns Decrypted data
|
|
81
|
+
*/
|
|
82
|
+
static decrypt(iv, encryptedData, key, authTag = false) {
|
|
83
|
+
const decipher = createDecipheriv(Constants.KEYRING_ALGORITHM_CONFIGURATION, key, iv);
|
|
84
|
+
const tagLength = 16;
|
|
85
|
+
const tag = encryptedData.subarray(-tagLength);
|
|
86
|
+
const ciphertext = encryptedData.subarray(0, -tagLength);
|
|
87
|
+
decipher.setAuthTag(tag);
|
|
88
|
+
return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
//# sourceMappingURL=aes-gcm.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"aes-gcm.js","sourceRoot":"","sources":["../../src/services/aes-gcm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,OAAgB,aAAa;IAC1B,MAAM,CAAU,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7D,MAAM,CAAU,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,MAAM,CAAU,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;IAE7D;;;;;;OAMG;IACI,MAAM,CAAC,OAAO,CACnB,IAAY,EACZ,GAAW,EACX,UAAmB,KAAK;QAExB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,+BAA+B,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAElF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,EAAE,EAAE,EAAE;YACN,GAAG,EAAE,GAAG;SACT,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,0BAA0B,CACtC,aAAqB,EACrB,OAAe;QAEf,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,yBAAyB,CACrC,EAAU,EACV,oBAA4B;QAE5B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,4BAA4B,CACxC,EAAU,EACV,aAAqB,EACrB,OAAe;QAEf,MAAM,gBAAgB,GAAG,aAAa,CAAC,0BAA0B,CAC/D,aAAa,EACb,OAAO,CACR,CAAC;QACF,OAAO,aAAa,CAAC,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,kBAAkB,CAC9B,YAAoB,EACpB,aAAsB,IAAI;QAE1B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnD,IAAI,YAAY,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,oBAAoB,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE1D,OAAO,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CACnB,EAAU,EACV,aAAqB,EACrB,GAAW,EACX,UAAmB,KAAK;QAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,+BAA+B,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEtF,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAEzD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC"}
|
package/dist/services/index.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
|
package/dist/services/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
|