@getmyenv/crypto 0.5.0 → 0.6.0

package/dist/fingerprint.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Change detection for a push: HMAC-SHA256 over the sorted name/value pairs,
+ * keyed from the context key. Not a protection for the values. The key only
+ * stops the server, which stores the result, from guessing short values.
+ */
+export declare function pushFingerprint(contextKey: Uint8Array, values: Record<string, string>): string;

package/dist/fingerprint.js

@@ -0,0 +1,21 @@
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToBase64Url, utf8Encode } from "./bytes.js";
+import { wipe } from "./wrap.js";
+const HKDF_INFO_PUSH = "getmyenv push fingerprint";
+/**
+ * Change detection for a push: HMAC-SHA256 over the sorted name/value pairs,
+ * keyed from the context key. Not a protection for the values. The key only
+ * stops the server, which stores the result, from guessing short values.
+ */
+export function pushFingerprint(contextKey, values) {
+    const key = hkdf(sha256, contextKey, new Uint8Array(0), utf8Encode(HKDF_INFO_PUSH), 32);
+    const lines = Object.keys(values)
+        .sort()
+        .map((name) => `${name}\0${values[name]}`)
+        .join("\n");
+    const mac = hmac(sha256, key, utf8Encode(lines));
+    wipe(key);
+    return bytesToBase64Url(mac);
+}

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export * from "./envelope.js";
 export * from "./recovery.js";
 export * from "./backup.js";
 export * from "./identity.js";
+export * from "./fingerprint.js";

package/dist/index.js

@@ -5,3 +5,4 @@ export * from "./envelope.js";
 export * from "./recovery.js";
 export * from "./backup.js";
 export * from "./identity.js";
+export * from "./fingerprint.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmyenv/crypto",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Encryption for getmyenv: Argon2id-wrapped X25519 keys, sealed per-context keys, AES-256-GCM values",
   "type": "module",
   "main": "./dist/index.js",