@icure/api 6.4.0 → 7.0.0-beta.1

package/icc-x-api/crypto/KeyRecovery.js

@@ -0,0 +1,253 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyRecovery = void 0;
+const utils_1 = require("../utils");
+const utils_2 = require("./utils");
+/**
+ * @internal this class is intended only for internal use and may be changed without notice.
+ *
+ */
+class KeyRecovery {
+    constructor(primitives, baseExchangeKeysManager, dataOwnerApi) {
+        this.primitives = primitives;
+        this.baseExchangeKeysManager = baseExchangeKeysManager;
+        this.dataOwnerApi = dataOwnerApi;
+    }
+    /**
+     * Attempt to recover private keys of a data owner using all available key recovery methods and all available private keys. The method will
+     * automatically try to use newly recovered key pairs to recover additional key pairs.
+     * @param dataOwner a data owner.
+     * @param knownKeys keys available for the data owner.
+     * @return new key pairs (exclude already known pairs) which could be recovered using the known keys.
+     */
+    recoverKeys(dataOwner, knownKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfPublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(dataOwner.dataOwner));
+            const knownKeysFpSet = new Set(Object.keys(knownKeys));
+            const missingKeysFpSet = new Set(selfPublicKeys.map((x) => x.slice(-32)).filter((x) => !knownKeysFpSet.has(x)));
+            const recoveryFunctions = [this.recoverFromTransferKeys.bind(this), this.recoverFromShamirSplitKeys.bind(this)];
+            let allPrivateKeys = Object.assign({}, knownKeys);
+            let foundNewPrivateKeys = true;
+            while (missingKeysFpSet.size > 0 && foundNewPrivateKeys) {
+                // TODO for each recovered verify correct association with public key
+                foundNewPrivateKeys = false;
+                for (const recover of recoveryFunctions) {
+                    const recovered = yield recover(dataOwner, allPrivateKeys, missingKeysFpSet);
+                    const validatedRecovered = {};
+                    for (const [fp, keyPair] of Object.entries(recovered)) {
+                        const valid = yield this.primitives.RSA.checkKeyPairValidity(keyPair);
+                        if (valid) {
+                            validatedRecovered[fp] = keyPair;
+                        }
+                    }
+                    if (Object.keys(validatedRecovered).length > 0) {
+                        foundNewPrivateKeys = true;
+                        Object.keys(validatedRecovered).forEach((fp) => missingKeysFpSet.delete(fp));
+                        allPrivateKeys = Object.assign(Object.assign({}, allPrivateKeys), validatedRecovered);
+                    }
+                }
+            }
+            return Object.fromEntries(Object.entries(allPrivateKeys).filter(([keyFp]) => !knownKeysFpSet.has(keyFp)));
+        });
+    }
+    /*TODO?
+     * Ask access back suggestion: if by getting access back to an exchange key with another data owner I may recover additional keys we could suggest
+     * to ask for access back to that data owner.
+     */
+    recoverFromShamirSplitKeys(dataOwner, allKeys, missingKeysFp) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (dataOwner.dataOwner.publicKey &&
+                dataOwner.dataOwner.privateKeyShamirPartitions &&
+                Object.keys(dataOwner.dataOwner.privateKeyShamirPartitions).length > 0) {
+                const selfId = dataOwner.dataOwner.id;
+                const shamirSplits = {
+                    [dataOwner.dataOwner.publicKey.slice(-32)]: dataOwner.dataOwner.privateKeyShamirPartitions,
+                };
+                const delegatesOfSplits = Array.from(new Set(Object.entries(shamirSplits).flatMap(([splitKeyFp, splitKeyData]) => (missingKeysFp.has(splitKeyFp) ? Object.keys(splitKeyData) : []))));
+                const exchangeKeys = {};
+                for (const delegate of delegatesOfSplits) {
+                    const currExchangeKeys = yield this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(selfId, delegate);
+                    exchangeKeys[delegate] = (yield this.baseExchangeKeysManager.tryDecryptExchangeKeys(currExchangeKeys, allKeys)).successfulDecryptions;
+                }
+                return yield this.recoverWithSplits(dataOwner, shamirSplits, exchangeKeys);
+            }
+            else
+                return {};
+        });
+    }
+    recoverWithSplits(dataOwner, splits, exchangeKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = {};
+            const keysByFp = (0, utils_2.fingerprintToPublicKeysMapOf)(dataOwner.dataOwner);
+            for (const [fp, split] of Object.entries(splits)) {
+                const recovered = yield this.tryRecoverSplitPrivate(split, exchangeKeys);
+                if (recovered) {
+                    const pub = keysByFp[fp];
+                    if (!pub) {
+                        console.warn(`Missing public key for fingerprint ${fp} of recovered shamir key.`);
+                    }
+                    else {
+                        try {
+                            res[fp] = {
+                                privateKey: recovered,
+                                publicKey: yield this.primitives.RSA.importKey('spki', (0, utils_1.hex2ua)(pub), ['encrypt']),
+                            };
+                        }
+                        catch (e) {
+                            console.warn(`Failed to import public key ${pub}`, e);
+                        }
+                    }
+                }
+            }
+            return res;
+        });
+    }
+    tryRecoverSplitPrivate(split, exchangeKeys) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const splitsCount = Object.keys(split).length;
+            if (splitsCount === 1) {
+                // Not sure about the key nor if the key is accessible
+                const [delegate, encryptedKey] = Object.entries(split)[0];
+                for (const exchangeKey of (_a = exchangeKeys[delegate]) !== null && _a !== void 0 ? _a : []) {
+                    try {
+                        const decrypted = yield this.primitives.AES.decrypt(exchangeKey, (0, utils_1.hex2ua)(encryptedKey));
+                        const importedKey = yield this.primitives.RSA.importKey('pkcs8', decrypted, ['decrypt']);
+                        if (importedKey)
+                            return importedKey;
+                    }
+                    catch (e) { }
+                }
+                return undefined;
+            }
+            else {
+                const decryptedSplits = [];
+                for (const delegateAndEncryptedSplit of Object.entries(split)) {
+                    const decrypted = yield this.tryDecryptSplitPiece(delegateAndEncryptedSplit, exchangeKeys, splitsCount);
+                    if (decrypted)
+                        decryptedSplits.push((0, utils_1.ua2hex)(decrypted).slice(1)); // Drop padding
+                }
+                try {
+                    const combinedKey = (0, utils_1.hex2ua)(this.primitives.shamir.combine(decryptedSplits));
+                    return yield this.primitives.RSA.importKey('pkcs8', combinedKey, ['decrypt']);
+                }
+                catch (e) {
+                    // Could be not enough splits decrypted
+                    return undefined;
+                }
+            }
+        });
+    }
+    tryDecryptSplitPiece(delegateAndEncryptedSplit, exchangeKeys, splitsCount) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const [delegate, encryptedPiece] = delegateAndEncryptedSplit;
+            for (const exchangeKey of (_a = exchangeKeys[delegate]) !== null && _a !== void 0 ? _a : []) {
+                try {
+                    const decrypted = yield this.primitives.AES.decrypt(exchangeKey, (0, utils_1.hex2ua)(encryptedPiece));
+                    if (this.validateDecryptedSplit(decrypted, splitsCount))
+                        return decrypted;
+                }
+                catch (e) { }
+            }
+            return undefined;
+        });
+    }
+    validateDecryptedSplit(decryptedSplit, splitsCount) {
+        // Normally shamir split starts with 8 followed by the index of the split in hexadecimal.
+        // However, we pad with an extra 'f' at the beginning
+        const decryptedHex = (0, utils_1.ua2hex)(decryptedSplit);
+        if (decryptedHex[0] !== 'f' || decryptedHex[1] !== '8')
+            return false;
+        try {
+            const splitIndex = parseInt(decryptedHex.slice(2, 4), 16);
+            return splitIndex > 0 && splitIndex <= splitsCount;
+        }
+        catch (e) {
+            return false;
+        }
+    }
+    recoverFromTransferKeys(dataOwner, allKeys, missingKeysFp) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeyFingerprintToPublicKey = (0, utils_2.fingerprintToPublicKeysMapOf)(dataOwner.dataOwner);
+            const missingKeysTransferData = {};
+            Object.values((_a = dataOwner.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}).forEach((transferKeysByEncryptor) => {
+                Object.entries(transferKeysByEncryptor).forEach(([transferToPublicKey, transferPrivateKeyEncrypted]) => {
+                    const transferToPublicKeyFp = transferToPublicKey.slice(-32); // We are not sure if transfer public key will be a fp or not
+                    if (missingKeysFp.has(transferToPublicKeyFp)) {
+                        const existingEntryValue = missingKeysTransferData[transferToPublicKeyFp];
+                        if (existingEntryValue) {
+                            existingEntryValue.encryptedPrivateKey.add(transferPrivateKeyEncrypted);
+                        }
+                        else {
+                            const fullPublicKey = publicKeyFingerprintToPublicKey[transferToPublicKeyFp];
+                            if (fullPublicKey) {
+                                missingKeysTransferData[transferToPublicKeyFp] = {
+                                    publicKey: fullPublicKey,
+                                    encryptedPrivateKey: new Set([transferPrivateKeyEncrypted]),
+                                };
+                            }
+                            else {
+                                console.warn('Invalid data owner: there is a transfer key for an unknown public key');
+                            }
+                        }
+                    }
+                });
+            });
+            const { successfulDecryptions: availableExchangeKeys } = yield this.baseExchangeKeysManager.tryDecryptExchangeKeys(yield this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(dataOwner.dataOwner.id, dataOwner.dataOwner.id), allKeys);
+            return Object.entries(missingKeysTransferData).reduce((acc, [recoverableKeyPubFp, transferData]) => __awaiter(this, void 0, void 0, function* () {
+                const awaitedAcc = yield acc;
+                const decryptedTransferData = yield this.tryDecryptTransferData(transferData, availableExchangeKeys);
+                if (decryptedTransferData != undefined) {
+                    return Object.assign(Object.assign({}, awaitedAcc), { [recoverableKeyPubFp]: decryptedTransferData });
+                }
+                else
+                    return awaitedAcc;
+            }), Promise.resolve({}));
+        });
+    }
+    tryDecryptTransferData(transferData, availableExchangeKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const encryptedTransferKey of transferData.encryptedPrivateKey) {
+                const decryptedTransferKey = yield this.tryDecryptTransferKey(encryptedTransferKey, availableExchangeKeys);
+                if (decryptedTransferKey != undefined)
+                    return {
+                        privateKey: decryptedTransferKey,
+                        publicKey: yield this.primitives.RSA.importKey('spki', (0, utils_1.hex2ua)(transferData.publicKey), ['encrypt']),
+                    };
+            }
+            return undefined;
+        });
+    }
+    // attempt to decrypt a transfer key in pkcs8 using any of the provided exchange keys
+    tryDecryptTransferKey(encryptedTransferKey, // in hex format
+    exchangeKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encryptedKeyBytes = (0, utils_1.hex2ua)(encryptedTransferKey);
+            for (const exchangeKey of exchangeKeys) {
+                try {
+                    const decryptedKeyData = yield this.primitives.AES.decrypt(exchangeKey, encryptedKeyBytes);
+                    const importedPrivateKey = yield this.primitives.RSA.importPrivateKey('pkcs8', decryptedKeyData);
+                    if (importedPrivateKey != undefined)
+                        return importedPrivateKey;
+                }
+                catch (e) {
+                    /* failure is a valid possibility: we don't know the correct key to use */
+                }
+            }
+            return undefined;
+        });
+    }
+}
+exports.KeyRecovery = KeyRecovery;
+//# sourceMappingURL=KeyRecovery.js.map

package/icc-x-api/crypto/KeyRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyRecovery.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/KeyRecovery.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,oCAAyC;AACzC,mCAAsD;AAEtD;;;GAGG;AACH,MAAa,WAAW;IAKtB,YAAY,UAA4B,EAAE,uBAAgD,EAAE,YAA8B;QACxH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAA;QACtD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;IAED;;;;;;OAMG;IACG,WAAW,CACf,SAA4B,EAC5B,SAAqD;;YAErD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;YAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE/G,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC/G,IAAI,cAAc,qBAA6D,SAAS,CAAE,CAAA;YAC1F,IAAI,mBAAmB,GAAG,IAAI,CAAA;YAE9B,OAAO,gBAAgB,CAAC,IAAI,GAAG,CAAC,IAAI,mBAAmB,EAAE;gBACvD,qEAAqE;gBACrE,mBAAmB,GAAG,KAAK,CAAA;gBAC3B,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE;oBACvC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAA;oBAC5E,MAAM,kBAAkB,GAAyC,EAAE,CAAA;oBACnE,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;wBACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;wBACrE,IAAI,KAAK,EAAE;4BACT,kBAAkB,CAAC,EAAE,CAAC,GAAG,OAAO,CAAA;yBACjC;qBACF;oBACD,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC9C,mBAAmB,GAAG,IAAI,CAAA;wBAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;wBAC5E,cAAc,mCAAQ,cAAc,GAAK,kBAAkB,CAAE,CAAA;qBAC9D;iBACF;aACF;YAED,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3G,CAAC;KAAA;IAED;;;OAGG;IAEW,0BAA0B,CACtC,SAA4B,EAC5B,OAA4D,EAC5D,aAA0B;;YAE1B,IACE,SAAS,CAAC,SAAS,CAAC,SAAS;gBAC7B,SAAS,CAAC,SAAS,CAAC,0BAA0B;gBAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,EACtE;gBACA,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,EAAG,CAAA;gBACtC,MAAM,YAAY,GAA8D;oBAC9E,CAAC,SAAS,CAAC,SAAS,CAAC,SAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,0BAA2B;iBAC7F,CAAA;gBACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,IAAI,GAAG,CACL,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACvI,CACF,CAAA;gBACD,MAAM,YAAY,GAA0C,EAAE,CAAA;gBAC9D,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE;oBACxC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;oBACzG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAA;iBACtI;gBACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;aAC3E;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEa,iBAAiB,CAC7B,SAA4B,EAC5B,MAAiE,EACjE,YAAmD;;YAEnD,MAAM,GAAG,GAAwD,EAAE,CAAA;YACnE,MAAM,QAAQ,GAAG,IAAA,oCAA4B,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAClE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;gBACxE,IAAI,SAAS,EAAE;oBACb,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;oBACxB,IAAI,CAAC,GAAG,EAAE;wBACR,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,2BAA2B,CAAC,CAAA;qBAClF;yBAAM;wBACL,IAAI;4BACF,GAAG,CAAC,EAAE,CAAC,GAAG;gCACR,UAAU,EAAE,SAAS;gCACrB,SAAS,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;6BACjF,CAAA;yBACF;wBAAC,OAAO,CAAC,EAAE;4BACV,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;yBACtD;qBACF;iBACF;aACF;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,sBAAsB,CAClC,KAAuC,EACvC,YAAmD;;;YAEnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;YAC7C,IAAI,WAAW,KAAK,CAAC,EAAE;gBACrB,sDAAsD;gBACtD,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;gBACzD,KAAK,MAAM,WAAW,IAAI,MAAA,YAAY,CAAC,QAAQ,CAAC,mCAAI,EAAE,EAAE;oBACtD,IAAI;wBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAA,cAAM,EAAC,YAAY,CAAC,CAAC,CAAA;wBACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;wBACxF,IAAI,WAAW;4BAAE,OAAO,WAAW,CAAA;qBACpC;oBAAC,OAAO,CAAC,EAAE,GAAE;iBACf;gBACD,OAAO,SAAS,CAAA;aACjB;iBAAM;gBACL,MAAM,eAAe,GAAa,EAAE,CAAA;gBACpC,KAAK,MAAM,yBAAyB,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvG,IAAI,SAAS;wBAAE,eAAe,CAAC,IAAI,CAAC,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,eAAe;iBAChF;gBACD,IAAI;oBACF,MAAM,WAAW,GAAG,IAAA,cAAM,EAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAA;oBAC3E,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;iBAC9E;gBAAC,OAAO,CAAC,EAAE;oBACV,uCAAuC;oBACvC,OAAO,SAAS,CAAA;iBACjB;aACF;;KACF;IAEa,oBAAoB,CAChC,yBAA2C,EAC3C,YAAmD,EACnD,WAAmB;;;YAEnB,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,yBAAyB,CAAA;YAC5D,KAAK,MAAM,WAAW,IAAI,MAAA,YAAY,CAAC,QAAQ,CAAC,mCAAI,EAAE,EAAE;gBACtD,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;oBACxF,IAAI,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC;wBAAE,OAAO,SAAS,CAAA;iBAC1E;gBAAC,OAAO,CAAC,EAAE,GAAE;aACf;YACD,OAAO,SAAS,CAAA;;KACjB;IAEO,sBAAsB,CAAC,cAA2B,EAAE,WAAmB;QAC7E,yFAAyF;QACzF,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAA,cAAM,EAAC,cAAc,CAAC,CAAA;QAC3C,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACpE,IAAI;YACF,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,WAAW,CAAA;SACnD;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,KAAK,CAAA;SACb;IACH,CAAC;IAEa,uBAAuB,CACnC,SAA4B,EAC5B,OAA4D,EAC5D,aAA0B;;;YAE1B,MAAM,+BAA+B,GAAG,IAAA,oCAA4B,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACzF,MAAM,uBAAuB,GAA+F,EAAE,CAAA;YAC9H,MAAM,CAAC,MAAM,CAAC,MAAA,SAAS,CAAC,SAAS,CAAC,YAAY,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,EAAE;gBACxF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,EAAE,EAAE;oBACrG,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA,CAAC,6DAA6D;oBAC1H,IAAI,aAAa,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE;wBAC5C,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAA;wBACzE,IAAI,kBAAkB,EAAE;4BACtB,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;yBACxE;6BAAM;4BACL,MAAM,aAAa,GAAG,+BAA+B,CAAC,qBAAqB,CAAC,CAAA;4BAC5E,IAAI,aAAa,EAAE;gCACjB,uBAAuB,CAAC,qBAAqB,CAAC,GAAG;oCAC/C,SAAS,EAAE,aAAa;oCACxB,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAC;iCAC5D,CAAA;6BACF;iCAAM;gCACL,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;6BACtF;yBACF;qBACF;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,MAAM,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAChH,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,EAChH,OAAO,CACR,CAAA;YAED,OAAO,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAAE,EAAE;gBACvG,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAA;gBACpG,IAAI,qBAAqB,IAAI,SAAS,EAAE;oBACtC,uCAAY,UAAU,KAAE,CAAC,mBAAmB,CAAC,EAAE,qBAAqB,IAAE;iBACvE;;oBAAM,OAAO,UAAU,CAAA;YAC1B,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAyD,CAAC,CAAC,CAAA;;KAC/E;IAEa,sBAAsB,CAClC,YAAqE,EACrE,qBAAkC;;YAElC,KAAK,MAAM,oBAAoB,IAAI,YAAY,CAAC,mBAAmB,EAAE;gBACnE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;gBAC1G,IAAI,oBAAoB,IAAI,SAAS;oBACnC,OAAO;wBACL,UAAU,EAAE,oBAAoB;wBAChC,SAAS,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;qBACpG,CAAA;aACJ;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KAAA;IAED,qFAAqF;IACvE,qBAAqB,CACjC,oBAA4B,EAAE,gBAAgB;IAC9C,YAAyB;;YAEzB,MAAM,iBAAiB,GAAG,IAAA,cAAM,EAAC,oBAAoB,CAAC,CAAA;YACtD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;gBACtC,IAAI;oBACF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;oBAC1F,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;oBAChG,IAAI,kBAAkB,IAAI,SAAS;wBAAE,OAAO,kBAAkB,CAAA;iBAC/D;gBAAC,OAAO,CAAC,EAAE;oBACV,0EAA0E;iBAC3E;aACF;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KAAA;CACF;AAzPD,kCAyPC","sourcesContent":["import { DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { hex2ua, ua2hex } from '../utils'\nimport { fingerprintToPublicKeysMapOf } from './utils'\n\n/**\n * @internal this class is intended only for internal use and may be changed without notice.\n *\n */\nexport class KeyRecovery {\n  private readonly primitives: CryptoPrimitives\n  private readonly baseExchangeKeysManager: BaseExchangeKeysManager\n  private readonly dataOwnerApi: IccDataOwnerXApi\n\n  constructor(primitives: CryptoPrimitives, baseExchangeKeysManager: BaseExchangeKeysManager, dataOwnerApi: IccDataOwnerXApi) {\n    this.primitives = primitives\n    this.baseExchangeKeysManager = baseExchangeKeysManager\n    this.dataOwnerApi = dataOwnerApi\n  }\n\n  /**\n   * Attempt to recover private keys of a data owner using all available key recovery methods and all available private keys. The method will\n   * automatically try to use newly recovered key pairs to recover additional key pairs.\n   * @param dataOwner a data owner.\n   * @param knownKeys keys available for the data owner.\n   * @return new key pairs (exclude already known pairs) which could be recovered using the known keys.\n   */\n  async recoverKeys(\n    dataOwner: DataOwnerWithType,\n    knownKeys: { [pubKeyFp: string]: KeyPair<CryptoKey> }\n  ): Promise<{ [pubKeyFp: string]: KeyPair<CryptoKey> }> {\n    const selfPublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(dataOwner.dataOwner))\n    const knownKeysFpSet = new Set(Object.keys(knownKeys))\n    const missingKeysFpSet = new Set(selfPublicKeys.map((x) => x.slice(-32)).filter((x) => !knownKeysFpSet.has(x)))\n\n    const recoveryFunctions = [this.recoverFromTransferKeys.bind(this), this.recoverFromShamirSplitKeys.bind(this)]\n    let allPrivateKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> } = { ...knownKeys }\n    let foundNewPrivateKeys = true\n\n    while (missingKeysFpSet.size > 0 && foundNewPrivateKeys) {\n      // TODO for each recovered verify correct association with public key\n      foundNewPrivateKeys = false\n      for (const recover of recoveryFunctions) {\n        const recovered = await recover(dataOwner, allPrivateKeys, missingKeysFpSet)\n        const validatedRecovered: { [fp: string]: KeyPair<CryptoKey> } = {}\n        for (const [fp, keyPair] of Object.entries(recovered)) {\n          const valid = await this.primitives.RSA.checkKeyPairValidity(keyPair)\n          if (valid) {\n            validatedRecovered[fp] = keyPair\n          }\n        }\n        if (Object.keys(validatedRecovered).length > 0) {\n          foundNewPrivateKeys = true\n          Object.keys(validatedRecovered).forEach((fp) => missingKeysFpSet.delete(fp))\n          allPrivateKeys = { ...allPrivateKeys, ...validatedRecovered }\n        }\n      }\n    }\n\n    return Object.fromEntries(Object.entries(allPrivateKeys).filter(([keyFp]) => !knownKeysFpSet.has(keyFp)))\n  }\n\n  /*TODO?\n   * Ask access back suggestion: if by getting access back to an exchange key with another data owner I may recover additional keys we could suggest\n   * to ask for access back to that data owner.\n   */\n\n  private async recoverFromShamirSplitKeys(\n    dataOwner: DataOwnerWithType,\n    allKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> },\n    missingKeysFp: Set<string>\n  ): Promise<{ [pubKeyFingerprint: string]: KeyPair<CryptoKey> }> {\n    if (\n      dataOwner.dataOwner.publicKey &&\n      dataOwner.dataOwner.privateKeyShamirPartitions &&\n      Object.keys(dataOwner.dataOwner.privateKeyShamirPartitions).length > 0\n    ) {\n      const selfId = dataOwner.dataOwner.id!\n      const shamirSplits: { [keyPairFp: string]: { [delegateId: string]: string } } = {\n        [dataOwner.dataOwner.publicKey!.slice(-32)]: dataOwner.dataOwner.privateKeyShamirPartitions!,\n      }\n      const delegatesOfSplits = Array.from(\n        new Set(\n          Object.entries(shamirSplits).flatMap(([splitKeyFp, splitKeyData]) => (missingKeysFp.has(splitKeyFp) ? Object.keys(splitKeyData) : []))\n        )\n      )\n      const exchangeKeys: { [delegateId: string]: CryptoKey[] } = {}\n      for (const delegate of delegatesOfSplits) {\n        const currExchangeKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(selfId, delegate)\n        exchangeKeys[delegate] = (await this.baseExchangeKeysManager.tryDecryptExchangeKeys(currExchangeKeys, allKeys)).successfulDecryptions\n      }\n      return await this.recoverWithSplits(dataOwner, shamirSplits, exchangeKeys)\n    } else return {}\n  }\n\n  private async recoverWithSplits(\n    dataOwner: DataOwnerWithType,\n    splits: { [keyPairFp: string]: { [delegateId: string]: string } },\n    exchangeKeys: { [delegateId: string]: CryptoKey[] }\n  ): Promise<{ [pubKeyFingerprint: string]: KeyPair<CryptoKey> }> {\n    const res: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> } = {}\n    const keysByFp = fingerprintToPublicKeysMapOf(dataOwner.dataOwner)\n    for (const [fp, split] of Object.entries(splits)) {\n      const recovered = await this.tryRecoverSplitPrivate(split, exchangeKeys)\n      if (recovered) {\n        const pub = keysByFp[fp]\n        if (!pub) {\n          console.warn(`Missing public key for fingerprint ${fp} of recovered shamir key.`)\n        } else {\n          try {\n            res[fp] = {\n              privateKey: recovered,\n              publicKey: await this.primitives.RSA.importKey('spki', hex2ua(pub), ['encrypt']),\n            }\n          } catch (e) {\n            console.warn(`Failed to import public key ${pub}`, e)\n          }\n        }\n      }\n    }\n    return res\n  }\n\n  private async tryRecoverSplitPrivate(\n    split: { [delegateId: string]: string },\n    exchangeKeys: { [delegateId: string]: CryptoKey[] }\n  ): Promise<CryptoKey | undefined> {\n    const splitsCount = Object.keys(split).length\n    if (splitsCount === 1) {\n      // Not sure about the key nor if the key is accessible\n      const [delegate, encryptedKey] = Object.entries(split)[0]\n      for (const exchangeKey of exchangeKeys[delegate] ?? []) {\n        try {\n          const decrypted = await this.primitives.AES.decrypt(exchangeKey, hex2ua(encryptedKey))\n          const importedKey = await this.primitives.RSA.importKey('pkcs8', decrypted, ['decrypt'])\n          if (importedKey) return importedKey\n        } catch (e) {}\n      }\n      return undefined\n    } else {\n      const decryptedSplits: string[] = []\n      for (const delegateAndEncryptedSplit of Object.entries(split)) {\n        const decrypted = await this.tryDecryptSplitPiece(delegateAndEncryptedSplit, exchangeKeys, splitsCount)\n        if (decrypted) decryptedSplits.push(ua2hex(decrypted).slice(1)) // Drop padding\n      }\n      try {\n        const combinedKey = hex2ua(this.primitives.shamir.combine(decryptedSplits))\n        return await this.primitives.RSA.importKey('pkcs8', combinedKey, ['decrypt'])\n      } catch (e) {\n        // Could be not enough splits decrypted\n        return undefined\n      }\n    }\n  }\n\n  private async tryDecryptSplitPiece(\n    delegateAndEncryptedSplit: [string, string],\n    exchangeKeys: { [delegateId: string]: CryptoKey[] },\n    splitsCount: number\n  ): Promise<ArrayBuffer | undefined> {\n    const [delegate, encryptedPiece] = delegateAndEncryptedSplit\n    for (const exchangeKey of exchangeKeys[delegate] ?? []) {\n      try {\n        const decrypted = await this.primitives.AES.decrypt(exchangeKey, hex2ua(encryptedPiece))\n        if (this.validateDecryptedSplit(decrypted, splitsCount)) return decrypted\n      } catch (e) {}\n    }\n    return undefined\n  }\n\n  private validateDecryptedSplit(decryptedSplit: ArrayBuffer, splitsCount: number): boolean {\n    // Normally shamir split starts with 8 followed by the index of the split in hexadecimal.\n    // However, we pad with an extra 'f' at the beginning\n    const decryptedHex = ua2hex(decryptedSplit)\n    if (decryptedHex[0] !== 'f' || decryptedHex[1] !== '8') return false\n    try {\n      const splitIndex = parseInt(decryptedHex.slice(2, 4), 16)\n      return splitIndex > 0 && splitIndex <= splitsCount\n    } catch (e) {\n      return false\n    }\n  }\n\n  private async recoverFromTransferKeys(\n    dataOwner: DataOwnerWithType,\n    allKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> },\n    missingKeysFp: Set<string>\n  ): Promise<{ [pubKeyFingerprint: string]: KeyPair<CryptoKey> }> {\n    const publicKeyFingerprintToPublicKey = fingerprintToPublicKeysMapOf(dataOwner.dataOwner)\n    const missingKeysTransferData: { [recoverableKeyPubFp: string]: { publicKey: string; encryptedPrivateKey: Set<string> } } = {}\n    Object.values(dataOwner.dataOwner.transferKeys ?? {}).forEach((transferKeysByEncryptor) => {\n      Object.entries(transferKeysByEncryptor).forEach(([transferToPublicKey, transferPrivateKeyEncrypted]) => {\n        const transferToPublicKeyFp = transferToPublicKey.slice(-32) // We are not sure if transfer public key will be a fp or not\n        if (missingKeysFp.has(transferToPublicKeyFp)) {\n          const existingEntryValue = missingKeysTransferData[transferToPublicKeyFp]\n          if (existingEntryValue) {\n            existingEntryValue.encryptedPrivateKey.add(transferPrivateKeyEncrypted)\n          } else {\n            const fullPublicKey = publicKeyFingerprintToPublicKey[transferToPublicKeyFp]\n            if (fullPublicKey) {\n              missingKeysTransferData[transferToPublicKeyFp] = {\n                publicKey: fullPublicKey,\n                encryptedPrivateKey: new Set([transferPrivateKeyEncrypted]),\n              }\n            } else {\n              console.warn('Invalid data owner: there is a transfer key for an unknown public key')\n            }\n          }\n        }\n      })\n    })\n\n    const { successfulDecryptions: availableExchangeKeys } = await this.baseExchangeKeysManager.tryDecryptExchangeKeys(\n      await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(dataOwner.dataOwner.id!, dataOwner.dataOwner.id!),\n      allKeys\n    )\n\n    return Object.entries(missingKeysTransferData).reduce(async (acc, [recoverableKeyPubFp, transferData]) => {\n      const awaitedAcc = await acc\n      const decryptedTransferData = await this.tryDecryptTransferData(transferData, availableExchangeKeys)\n      if (decryptedTransferData != undefined) {\n        return { ...awaitedAcc, [recoverableKeyPubFp]: decryptedTransferData }\n      } else return awaitedAcc\n    }, Promise.resolve({} as { [pubKeyFingerprint: string]: KeyPair<CryptoKey> }))\n  }\n\n  private async tryDecryptTransferData(\n    transferData: { publicKey: string; encryptedPrivateKey: Set<string> },\n    availableExchangeKeys: CryptoKey[]\n  ): Promise<KeyPair<CryptoKey> | undefined> {\n    for (const encryptedTransferKey of transferData.encryptedPrivateKey) {\n      const decryptedTransferKey = await this.tryDecryptTransferKey(encryptedTransferKey, availableExchangeKeys)\n      if (decryptedTransferKey != undefined)\n        return {\n          privateKey: decryptedTransferKey,\n          publicKey: await this.primitives.RSA.importKey('spki', hex2ua(transferData.publicKey), ['encrypt']),\n        }\n    }\n    return undefined\n  }\n\n  // attempt to decrypt a transfer key in pkcs8 using any of the provided exchange keys\n  private async tryDecryptTransferKey(\n    encryptedTransferKey: string, // in hex format\n    exchangeKeys: CryptoKey[]\n  ): Promise<CryptoKey | undefined> {\n    const encryptedKeyBytes = hex2ua(encryptedTransferKey)\n    for (const exchangeKey of exchangeKeys) {\n      try {\n        const decryptedKeyData = await this.primitives.AES.decrypt(exchangeKey, encryptedKeyBytes)\n        const importedPrivateKey = await this.primitives.RSA.importPrivateKey('pkcs8', decryptedKeyData)\n        if (importedPrivateKey != undefined) return importedPrivateKey\n      } catch (e) {\n        /* failure is a valid possibility: we don't know the correct key to use */\n      }\n    }\n    return undefined\n  }\n}\n"]}

package/icc-x-api/crypto/LegacyCryptoStrategies.d.ts

@@ -0,0 +1,28 @@
+import { CryptoStrategies } from './CryptoStrategies';
+import { DataOwner } from '../icc-data-owner-x-api';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { KeyPair } from './RSA';
+/**
+ * Implementation of crypto strategies which should closely resemble a basic legacy behaviour of the crypto api:
+ * - Automatically creates a new key if there is no verified key available
+ * - Fully trusts the public keys coming from the server for the creation of aes exchange keys to delegates
+ * - Never trust the own public keys coming from the server: this way the sdk will not automatically create data for key recovery.
+ */
+export declare class LegacyCryptoStrategies implements CryptoStrategies {
+    generateNewKeyForDataOwner(self: DataOwner, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean>;
+    recoverAndVerifySelfHierarchyKeys(keysData: {
+        dataOwner: DataOwner;
+        unknownKeys: string[];
+        unavailableKeys: string[];
+    }[], cryptoPrimitives: CryptoPrimitives): Promise<{
+        [p: string]: {
+            recoveredKeys: {
+                [p: string]: KeyPair<CryptoKey>;
+            };
+            keyAuthenticity: {
+                [p: string]: boolean;
+            };
+        };
+    }>;
+    verifyDelegatePublicKeys(delegate: DataOwner, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]>;
+}

package/icc-x-api/crypto/LegacyCryptoStrategies.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyCryptoStrategies = void 0;
+/**
+ * Implementation of crypto strategies which should closely resemble a basic legacy behaviour of the crypto api:
+ * - Automatically creates a new key if there is no verified key available
+ * - Fully trusts the public keys coming from the server for the creation of aes exchange keys to delegates
+ * - Never trust the own public keys coming from the server: this way the sdk will not automatically create data for key recovery.
+ */
+class LegacyCryptoStrategies {
+    generateNewKeyForDataOwner(self, cryptoPrimitives) {
+        return Promise.resolve(true);
+    }
+    recoverAndVerifySelfHierarchyKeys(keysData, cryptoPrimitives) {
+        return Promise.resolve(Object.fromEntries(keysData.map(({ dataOwner }) => [dataOwner.id, { recoveredKeys: {}, keyAuthenticity: {} }])));
+    }
+    verifyDelegatePublicKeys(delegate, publicKeys, cryptoPrimitives) {
+        return Promise.resolve(publicKeys);
+    }
+}
+exports.LegacyCryptoStrategies = LegacyCryptoStrategies;
+//# sourceMappingURL=LegacyCryptoStrategies.js.map

package/icc-x-api/crypto/LegacyCryptoStrategies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LegacyCryptoStrategies.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/LegacyCryptoStrategies.ts"],"names":[],"mappings":";;;AAKA;;;;;GAKG;AACH,MAAa,sBAAsB;IACjC,0BAA0B,CAAC,IAAe,EAAE,gBAAkC;QAC5E,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAED,iCAAiC,CAC/B,QAAsF,EACtF,gBAAkC;QAElC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACzI,CAAC;IAED,wBAAwB,CAAC,QAAmB,EAAE,UAAoB,EAAE,gBAAkC;QACpG,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;CACF;AAfD,wDAeC","sourcesContent":["import { CryptoStrategies } from './CryptoStrategies'\nimport { DataOwner } from '../icc-data-owner-x-api'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyPair } from './RSA'\n\n/**\n * Implementation of crypto strategies which should closely resemble a basic legacy behaviour of the crypto api:\n * - Automatically creates a new key if there is no verified key available\n * - Fully trusts the public keys coming from the server for the creation of aes exchange keys to delegates\n * - Never trust the own public keys coming from the server: this way the sdk will not automatically create data for key recovery.\n */\nexport class LegacyCryptoStrategies implements CryptoStrategies {\n  generateNewKeyForDataOwner(self: DataOwner, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean> {\n    return Promise.resolve(true)\n  }\n\n  recoverAndVerifySelfHierarchyKeys(\n    keysData: { dataOwner: DataOwner; unknownKeys: string[]; unavailableKeys: string[] }[],\n    cryptoPrimitives: CryptoPrimitives\n  ): Promise<{ [p: string]: { recoveredKeys: { [p: string]: KeyPair<CryptoKey> }; keyAuthenticity: { [p: string]: boolean } } }> {\n    return Promise.resolve(Object.fromEntries(keysData.map(({ dataOwner }) => [dataOwner.id, { recoveredKeys: {}, keyAuthenticity: {} }])))\n  }\n\n  verifyDelegatePublicKeys(delegate: DataOwner, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]> {\n    return Promise.resolve(publicKeys)\n  }\n}\n"]}

package/icc-x-api/crypto/RSA.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Represents an RSA KeyPair in a generic format.
+ */
+export type KeyPair<T> = {
+    publicKey: T;
+    privateKey: T;
+};
 export declare class RSAUtils {
     /********* RSA Config **********/
     rsaParams: any;
@@ -7,10 +14,10 @@ export declare class RSAUtils {
     /**
      * It returns CryptoKey promise, which doesn't hold the bytes of the key.
      * If bytes are needed, you must export the generated key.
-     * R
+     *
      * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}
      */
-    generateKeyPair(): Promise<CryptoKeyPair>;
+    generateKeyPair(): Promise<KeyPair<CryptoKey>>;
     /**
      *
      * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)
@@ -22,20 +29,8 @@ export declare class RSAUtils {
      * @param pubKeyFormat will be 'spki' or 'jwk'
      * @returns {Promise} will the AES Key
      */
-    exportKeys(keyPair: {
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<{
-        publicKey: JsonWebKey;
-        privateKey: JsonWebKey;
-    }>;
-    exportKeys(keyPair: {
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<{
-        publicKey: ArrayBuffer;
-        privateKey: ArrayBuffer;
-    }>;
+    exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>;
+    exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>;
     /**
      *  Format:
      *
@@ -85,9 +80,13 @@ export declare class RSAUtils {
      * @param publicKeyData should be the key data based on the format.
      * @returns {Promise|*}
      */
-    importKeyPair(privateKeyFormat: string, privateKeydata: JsonWebKey | ArrayBuffer, publicKeyFormat: string, publicKeyData: JsonWebKey | ArrayBuffer): Promise<{
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }>;
+    importKeyPair(privateKeyFormat: string, privateKeydata: JsonWebKey | ArrayBuffer, publicKeyFormat: string, publicKeyData: JsonWebKey | ArrayBuffer): Promise<KeyPair<CryptoKey>>;
+    /**
+     * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the
+     * original data returns true, else false.
+     * @param keyPair a key pair.
+     * @return if the key pair could be successfully used to encrypt then decrypt data.
+     */
+    checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean>;
 }
 export declare const RSA: RSAUtils;

package/icc-x-api/crypto/RSA.js

@@ -1,6 +1,16 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RSA = exports.RSAUtils = void 0;
+const utils_1 = require("../utils");
 class RSAUtils {
     constructor(crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
         /********* RSA Config **********/
@@ -19,7 +29,7 @@ class RSAUtils {
     /**
      * It returns CryptoKey promise, which doesn't hold the bytes of the key.
      * If bytes are needed, you must export the generated key.
-     * R
+     *
      * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}
      */
     generateKeyPair() {
@@ -108,6 +118,25 @@ class RSAUtils {
             };
         });
     }
+    /**
+     * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the
+     * original data returns true, else false.
+     * @param keyPair a key pair.
+     * @return if the key pair could be successfully used to encrypt then decrypt data.
+     */
+    checkKeyPairValidity(keyPair) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const text = 'shibboleth';
+                const encryptedText = yield this.encrypt(keyPair.publicKey, (0, utils_1.utf8_2ua)(text));
+                const decryptedText = (0, utils_1.ua2utf8)(yield this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)));
+                return decryptedText === text;
+            }
+            catch (e) {
+                return false;
+            }
+        });
+    }
 }
 exports.RSAUtils = RSAUtils;
 exports.RSA = new RSAUtils();

package/icc-x-api/crypto/RSA.js.map

@@ -1 +1 @@
-{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;AAEA,MAAa,QAAQ;IAenB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QAdvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAsC,EAAE,MAAM,EAAE,EAAE;YACpE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACpG,CAAC,CAAC,CAAA;IACJ,CAAC;IAuBD,UAAU,CACR,OAAwD,EACxD,aAAqB,EACrB,YAAoB;QAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB;QAChF,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACnI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC;QAEvC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAChJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAE7I,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AArKD,4BAqKC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { RsaPrivateKey } from 'crypto'\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * It returns CryptoKey promise, which doesn't hold the bytes of the key.\n   * If bytes are needed, you must export the generated key.\n   * R\n   * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}\n   */\n  generateKeyPair(): Promise<CryptoKeyPair> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n\n    return new Promise((resolve: (value: CryptoKeyPair) => any, reject) => {\n      this.crypto.subtle.generateKey(this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(\n    keyPair: { publicKey: CryptoKey; privateKey: CryptoKey },\n    privKeyFormat: 'jwk',\n    pubKeyFormat: 'jwk'\n  ): Promise<{ publicKey: JsonWebKey; privateKey: JsonWebKey }>\n  exportKeys(\n    keyPair: { publicKey: CryptoKey; privateKey: CryptoKey },\n    privKeyFormat: 'pkcs8',\n    pubKeyFormat: 'spki'\n  ): Promise<{ publicKey: ArrayBuffer; privateKey: ArrayBuffer }>\n  exportKeys(\n    keyPair: { publicKey: CryptoKey; privateKey: CryptoKey },\n    privKeyFormat: string,\n    pubKeyFormat: string\n  ): Promise<{ publicKey: JsonWebKey | ArrayBuffer; privateKey: JsonWebKey | ArrayBuffer }> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array) {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[]) {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer) {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer\n  ) {\n    const extractable = true\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, this.rsaHashedParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, this.rsaHashedParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}
+{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4C;AAO5C,MAAa,QAAQ;IAenB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QAdvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAEpD,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACpG,CAAC,CAAC,CAAA;IACJ,CAAC;IAeD,UAAU,CAAC,OAA2B,EAAE,aAAqB,EAAE,YAAoB;QACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB;QAChF,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACnI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC;QAEvC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAChJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAE7I,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,OAA2B;;YACpD,IAAI;gBACF,MAAM,IAAI,GAAG,YAAY,CAAA;gBACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAA;gBAC3E,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;gBACpG,OAAO,aAAa,KAAK,IAAI,CAAA;aAC9B;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,KAAK,CAAA;aACb;QACH,CAAC;KAAA;CACF;AA1KD,4BA0KC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { ua2utf8, utf8_2ua } from '../utils'\n\n/**\n * Represents an RSA KeyPair in a generic format.\n */\nexport type KeyPair<T> = { publicKey: T; privateKey: T }\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * It returns CryptoKey promise, which doesn't hold the bytes of the key.\n   * If bytes are needed, you must export the generated key.\n   *\n   * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}\n   */\n  generateKeyPair(): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n\n    return new Promise<KeyPair<CryptoKey>>((resolve, reject) => {\n      this.crypto.subtle.generateKey(this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: string, pubKeyFormat: string): Promise<KeyPair<JsonWebKey | ArrayBuffer>> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[]): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer\n  ): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, this.rsaHashedParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, this.rsaHashedParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the\n   * original data returns true, else false.\n   * @param keyPair a key pair.\n   * @return if the key pair could be successfully used to encrypt then decrypt data.\n   */\n  async checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean> {\n    try {\n      const text = 'shibboleth'\n      const encryptedText = await this.encrypt(keyPair.publicKey, utf8_2ua(text))\n      const decryptedText = ua2utf8(await this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)))\n      return decryptedText === text\n    } catch (e) {\n      return false\n    }\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}

package/icc-x-api/crypto/ShamirKeysManager.d.ts

@@ -0,0 +1,43 @@
+import { DataOwner, DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { KeyManager } from './KeyManager';
+import { ExchangeKeysManager } from './ExchangeKeysManager';
+import { CryptoPrimitives } from './CryptoPrimitives';
+/**
+ * Allows to create or update shamir split keys.
+ */
+export declare class ShamirKeysManager {
+    private readonly primitives;
+    private readonly dataOwnerApi;
+    private readonly keyManager;
+    private readonly exchangeKeysManager;
+    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, keyManager: KeyManager, exchangeKeysManager: ExchangeKeysManager);
+    /**
+     * Get information on existing private keys splits for the provided data owner. For each private key of the provided data owner which has been
+     * split using the Shamir sharing algorithm gives the list of the notaries (other data owners) which hold a copy of the key part.
+     * @param dataOwner a data owner
+     * @return the existing splits for the current data owner as a publicKeyFingerprint -> notariesIds object
+     */
+    getExistingSplitsInfo(dataOwner: DataOwner): {
+        [keyPairFingerprint: string]: string[];
+    };
+    /**
+     * Creates, updates or deletes shamir splits for keys of the current data owner. Any request to update the splits for a specific key will completely
+     * replace any existing data on that split (all previous notaries will be ignored).
+     * Note: currently you can only split the legacy key pair.
+     * @param keySplitsToUpdate the fingerprints of key pairs which will have updated/new splits and the details on how to create the updated splits.
+     * @param keySplitsToDelete the fingerprints or hex-encoded spki public keys which will not be shared anymore.
+     * @throws if the parameters refer to non-existing or unavailable keys, have split creation details, or if they request to delete a non-existing
+     * split.
+     */
+    updateSelfSplits(keySplitsToUpdate: {
+        [publicKeyHexOrFp: string]: {
+            notariesIds: string[];
+            minShares: number;
+        };
+    }, keySplitsToDelete: string[]): Promise<DataOwnerWithType>;
+    private validateShamirParams;
+    private deleteKeySplit;
+    private updateKeySplit;
+    private createPartitionsFor;
+    private encryptShares;
+}