@enclave-technologies/pqc-primitives 0.1.0

package/dist/bundler/enclave_pqc_primitives_wasm_bg.wasm.d.ts

@@ -0,0 +1,41 @@
+/* tslint:disable */
+/* eslint-disable */
+export const memory: WebAssembly.Memory;
+export const aeadDecrypt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number, number];
+export const aeadEncrypt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number, number];
+export const hashUtf8: (a: number, b: number, c: number) => [number, number, number, number];
+export const shake256: (a: number, b: number, c: number) => [number, number, number, number];
+export const sigExpandedSecretKey: (a: number, b: number) => [number, number, number, number];
+export const sigGenerateKeypair: () => [number, number, number];
+export const sigKeypairFromSeed: (a: number, b: number) => [number, number, number];
+export const sigSign: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const sigSignWithContext: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
+export const sigVerify: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+export const sigVerifyWithContext: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number];
+export const PWHASH_ALGORITHM: () => [number, number];
+export const PWHASH_OUTPUT_BYTES: () => number;
+export const PWHASH_SALT_BYTES: () => number;
+export const RECOMMENDED_PARAMS: () => [number, number, number];
+export const generateSalt: () => [number, number, number, number];
+export const kemDecapsulate: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const kemEncapsulate: (a: number, b: number) => [number, number, number];
+export const kemEncapsulateDeterministic: (a: number, b: number, c: number, d: number) => [number, number, number];
+export const kemExpandedSecretKey: (a: number, b: number) => [number, number, number, number];
+export const kemGenerateKeypair: () => [number, number, number];
+export const kemKeypairFromSeed: (a: number, b: number) => [number, number, number];
+export const pwhashDeriveKey: (a: number, b: number, c: number, d: number, e: any) => [number, number, number, number];
+export const ENCLAVE_PQ_SUITE_ID: () => [number, number];
+export const KDF_LABEL_PREFIX: () => [number, number];
+export const getLastUsageRecord: () => [number, number, number];
+export const labeledKdf: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
+export const labeledKdf32: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const runSelfTests: () => [number, number];
+export const zeroize: (a: any) => void;
+export const __wbindgen_exn_store: (a: number) => void;
+export const __externref_table_alloc: () => number;
+export const __wbindgen_externrefs: WebAssembly.Table;
+export const __wbindgen_free: (a: number, b: number, c: number) => void;
+export const __externref_table_dealloc: (a: number) => void;
+export const __wbindgen_malloc: (a: number, b: number) => number;
+export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+export const __wbindgen_start: () => void;

package/dist/bundler/index.d.ts

@@ -0,0 +1,157 @@
+/** Category 5 sizes — must match Rust ENCLAVE_PQ_SUITE_v1. */
+export declare const ENCLAVE_PQ_SUITE_ID: "ENCLAVE_PQ_SUITE_v1";
+export declare const KDF_LABEL_PREFIX: "enclave-kdf-v1";
+export declare const KEM: {
+  readonly ALGORITHM: "ML-KEM-1024";
+  readonly PUBLIC_KEY_BYTES: 1568;
+  readonly SECRET_KEY_SEED_BYTES: 64;
+  readonly SECRET_KEY_EXPANDED_BYTES: 3168;
+  readonly SECRET_KEY_BYTES: 3168;
+  readonly CIPHERTEXT_BYTES: 1568;
+  readonly SHARED_SECRET_BYTES: 32;
+  readonly ENCAP_RANDOMNESS_BYTES: 32;
+};
+export declare const SIG: {
+  readonly ALGORITHM: "ML-DSA-87";
+  readonly PUBLIC_KEY_BYTES: 2592;
+  readonly SECRET_KEY_SEED_BYTES: 32;
+  readonly SECRET_KEY_EXPANDED_BYTES: 4896;
+  readonly SECRET_KEY_BYTES: 4896;
+  readonly SIGNATURE_BYTES: 4627;
+  readonly MAX_CONTEXT_BYTES: 255;
+};
+export declare const AEAD: {
+  readonly ALGORITHM: "AES-256-GCM";
+  readonly KEY_BYTES: 32;
+  readonly NONCE_BYTES: 12;
+  readonly TAG_BYTES: 16;
+};
+export declare const HASH: {
+  readonly ALGORITHM: "SHAKE256";
+  readonly DEFAULT_OUTPUT_BYTES: 32;
+};
+export declare const PWHASH: {
+  readonly ALGORITHM: "Argon2id";
+  readonly SALT_BYTES: 16;
+  readonly OUTPUT_BYTES: 32;
+  readonly RECOMMENDED_PARAMS: {
+    readonly memoryCostKib: 19456;
+    readonly iterations: 2;
+    readonly parallelism: 1;
+  };
+};
+
+export type Argon2Params = {
+  memoryCostKib: number;
+  iterations: number;
+  parallelism: number;
+};
+
+export type KemKeypair = { publicKey: Uint8Array; secretKey: Uint8Array };
+export type KemEncapsulation = {
+  ciphertext: Uint8Array;
+  sharedSecret: Uint8Array;
+};
+export type SigKeypair = { publicKey: Uint8Array; secretKey: Uint8Array };
+export type CryptoUsageRecord = {
+  algorithm: string;
+  suiteId: string;
+  operation: string;
+  crateVersion: string;
+};
+
+export declare function isPairwiseConsistencyFailure(err: unknown): boolean;
+export declare function isSelfTestFailure(err: unknown): boolean;
+
+export declare function kemGenerateKeypair(): KemKeypair;
+export declare function kemKeypairFromSeed(seed: Uint8Array): KemKeypair;
+export declare function kemExpandedSecretKey(secretKey: Uint8Array): Uint8Array;
+export declare function kemEncapsulate(publicKey: Uint8Array): KemEncapsulation;
+/** Hazmat — KATs only. Prefer kemEncapsulate. */
+export declare function kemEncapsulateDeterministic(
+  publicKey: Uint8Array,
+  m: Uint8Array,
+): KemEncapsulation;
+export declare function kemDecapsulate(
+  ciphertext: Uint8Array,
+  secretKey: Uint8Array,
+): Uint8Array;
+
+export declare function sigGenerateKeypair(): SigKeypair;
+export declare function sigKeypairFromSeed(seed: Uint8Array): SigKeypair;
+export declare function sigExpandedSecretKey(secretKey: Uint8Array): Uint8Array;
+export declare function sigSign(
+  secretKey: Uint8Array,
+  message: Uint8Array,
+): Uint8Array;
+export declare function sigSignWithContext(
+  secretKey: Uint8Array,
+  message: Uint8Array,
+  context: Uint8Array,
+): Uint8Array;
+export declare function sigVerify(
+  publicKey: Uint8Array,
+  message: Uint8Array,
+  signature: Uint8Array,
+): boolean;
+export declare function sigVerifyWithContext(
+  publicKey: Uint8Array,
+  message: Uint8Array,
+  signature: Uint8Array,
+  context: Uint8Array,
+): boolean;
+
+export declare function aeadEncrypt(
+  key: Uint8Array,
+  nonce: Uint8Array,
+  plaintext: Uint8Array,
+  aad: Uint8Array,
+): Uint8Array;
+export declare function aeadDecrypt(
+  key: Uint8Array,
+  nonce: Uint8Array,
+  ciphertext: Uint8Array,
+  aad: Uint8Array,
+): Uint8Array;
+
+export declare function shake256(
+  input: Uint8Array,
+  outputLen: number,
+): Uint8Array;
+export declare function hashUtf8(value: string, outputLen: number): Uint8Array;
+
+export declare function labeledKdf(
+  label: string,
+  ikm: Uint8Array,
+  length: number,
+): Uint8Array;
+export declare function labeledKdf32(
+  label: string,
+  ikm: Uint8Array,
+): Uint8Array;
+
+/**
+ * Argon2id password → 32-byte key. Deliberately slow / memory-hard.
+ * Prefer PWHASH.RECOMMENDED_PARAMS unless you have measured otherwise.
+ */
+export declare function pwhashDeriveKey(
+  password: Uint8Array,
+  salt: Uint8Array,
+  params: Argon2Params,
+): Uint8Array;
+/** Cryptographically random 16-byte Argon2id salt. */
+export declare function generateSalt(): Uint8Array;
+/** Same values as PWHASH.RECOMMENDED_PARAMS (WASM mirror). */
+export declare function RECOMMENDED_PARAMS(): Argon2Params;
+
+/** CBOM attach point: usage from the last WASM primitive call, or undefined. */
+export declare function getLastUsageRecord(): CryptoUsageRecord | undefined;
+
+/** CAST self-tests; rejects with SelfTestFailureError (`err.name`). */
+export declare function runSelfTests(): Promise<void>;
+
+/**
+ * Overwrite buffer bytes in place. WASM Drop zeroization does not apply to
+ * secret material copied into JS Uint8Arrays — call this when finished.
+ */
+export declare function zeroize(buf: Uint8Array): void;

package/dist/bundler/index.js

@@ -0,0 +1,80 @@
+/**
+ * @enclave-technologies/pqc-primitives — algorithm-only façade (bundler).
+ *
+ * Category 5 exclusively (ML-KEM-1024 / ML-DSA-87). No suite parameter.
+ *
+ * Secret zeroization does NOT cross the WASM boundary. Call zeroize(buf) on
+ * long-lived secret Uint8Arrays when finished.
+ */
+export {
+  AEAD,
+  ENCLAVE_PQ_SUITE_ID,
+  HASH,
+  KDF_LABEL_PREFIX,
+  KEM,
+  PWHASH,
+  SIG,
+  isPairwiseConsistencyFailure,
+  isSelfTestFailure,
+} from "./constants.js";
+
+import {
+  aeadDecrypt,
+  aeadEncrypt,
+  generateSalt,
+  getLastUsageRecord,
+  hashUtf8,
+  kemDecapsulate,
+  kemEncapsulate,
+  kemEncapsulateDeterministic,
+  kemExpandedSecretKey,
+  kemGenerateKeypair,
+  kemKeypairFromSeed,
+  labeledKdf,
+  labeledKdf32,
+  pwhashDeriveKey,
+  RECOMMENDED_PARAMS,
+  runSelfTests as runSelfTestsSync,
+  shake256,
+  sigExpandedSecretKey,
+  sigGenerateKeypair,
+  sigKeypairFromSeed,
+  sigSign,
+  sigSignWithContext,
+  sigVerify,
+  sigVerifyWithContext,
+  zeroize,
+} from "./enclave_pqc_primitives_wasm.js";
+
+export {
+  aeadDecrypt,
+  aeadEncrypt,
+  generateSalt,
+  getLastUsageRecord,
+  hashUtf8,
+  kemDecapsulate,
+  kemEncapsulate,
+  /** Hazmat — KATs only. Prefer kemEncapsulate in production. */
+  kemEncapsulateDeterministic,
+  kemExpandedSecretKey,
+  kemGenerateKeypair,
+  kemKeypairFromSeed,
+  labeledKdf,
+  labeledKdf32,
+  pwhashDeriveKey,
+  RECOMMENDED_PARAMS,
+  shake256,
+  sigExpandedSecretKey,
+  sigGenerateKeypair,
+  sigKeypairFromSeed,
+  sigSign,
+  sigSignWithContext,
+  sigVerify,
+  sigVerifyWithContext,
+  zeroize,
+};
+
+/** Run CAST self-tests; throws SelfTestFailureError on failure. */
+export async function runSelfTests() {
+  runSelfTestsSync();
+}

package/dist/nodejs/constants.js

@@ -0,0 +1,63 @@
+/** @type {const} */
+export const ENCLAVE_PQ_SUITE_ID = "ENCLAVE_PQ_SUITE_v1";
+/** @type {const} */
+export const KDF_LABEL_PREFIX = "enclave-kdf-v1";
+/** @type {const} */
+export const KEM = Object.freeze({
+  ALGORITHM: "ML-KEM-1024",
+  PUBLIC_KEY_BYTES: 1568,
+  SECRET_KEY_SEED_BYTES: 64,
+  SECRET_KEY_EXPANDED_BYTES: 3168,
+  SECRET_KEY_BYTES: 3168,
+  CIPHERTEXT_BYTES: 1568,
+  SHARED_SECRET_BYTES: 32,
+  ENCAP_RANDOMNESS_BYTES: 32,
+});
+/** @type {const} */
+export const SIG = Object.freeze({
+  ALGORITHM: "ML-DSA-87",
+  PUBLIC_KEY_BYTES: 2592,
+  SECRET_KEY_SEED_BYTES: 32,
+  SECRET_KEY_EXPANDED_BYTES: 4896,
+  SECRET_KEY_BYTES: 4896,
+  SIGNATURE_BYTES: 4627,
+  MAX_CONTEXT_BYTES: 255,
+});
+/** @type {const} */
+export const AEAD = Object.freeze({
+  ALGORITHM: "AES-256-GCM",
+  KEY_BYTES: 32,
+  NONCE_BYTES: 12,
+  TAG_BYTES: 16,
+});
+/** @type {const} */
+export const HASH = Object.freeze({
+  ALGORITHM: "SHAKE256",
+  DEFAULT_OUTPUT_BYTES: 32,
+});
+/** @type {const} */
+export const PWHASH = Object.freeze({
+  ALGORITHM: "Argon2id",
+  SALT_BYTES: 16,
+  OUTPUT_BYTES: 32,
+  /**
+   * OWASP Password Storage Cheat Sheet baseline (verified 2026-07-14):
+   * m=19456 (19 MiB), t=2, p=1. Deliberately slow + memory-hard — do not
+   * lower these for login latency without treating that as a security tradeoff.
+   */
+  RECOMMENDED_PARAMS: Object.freeze({
+    memoryCostKib: 19456,
+    iterations: 2,
+    parallelism: 1,
+  }),
+});
+
+/** @param {unknown} err */
+export function isPairwiseConsistencyFailure(err) {
+  return err instanceof Error && err.name === "PairwiseConsistencyFailureError";
+}
+
+/** @param {unknown} err */
+export function isSelfTestFailure(err) {
+  return err instanceof Error && err.name === "SelfTestFailureError";
+}