@libp2p/keychain 0.6.1 → 1.0.0

package/src/util.ts

@@ -1,69 +1,3 @@
-import 'node-forge/lib/x509.js'
-// @ts-expect-error types are missing
-import forge from 'node-forge/lib/forge.js'
-
-const pki = forge.pki
-
-/**
- * Gets a self-signed X.509 certificate for the key.
- *
- * The output Uint8Array contains the PKCS #7 message in DER.
- *
- * TODO: move to libp2p-crypto package
- */
-export const certificateForKey = (key: any, privateKey: forge.pki.rsa.PrivateKey) => {
-  const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e)
-  const cert = pki.createCertificate()
-  cert.publicKey = publicKey
-  cert.serialNumber = '01'
-  cert.validity.notBefore = new Date()
-  cert.validity.notAfter = new Date()
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10) // eslint-disable-line @typescript-eslint/restrict-plus-operands
-  const attrs = [{
-    name: 'organizationName',
-    value: 'ipfs'
-  }, {
-    shortName: 'OU',
-    value: 'keystore'
-  }, {
-    name: 'commonName',
-    value: key.id
-  }]
-  cert.setSubject(attrs)
-  cert.setIssuer(attrs)
-  cert.setExtensions([{
-    name: 'basicConstraints',
-    cA: true
-  }, {
-    name: 'keyUsage',
-    keyCertSign: true,
-    digitalSignature: true,
-    nonRepudiation: true,
-    keyEncipherment: true,
-    dataEncipherment: true
-  }, {
-    name: 'extKeyUsage',
-    serverAuth: true,
-    clientAuth: true,
-    codeSigning: true,
-    emailProtection: true,
-    timeStamping: true
-  }, {
-    name: 'nsCertType',
-    client: true,
-    server: true,
-    email: true,
-    objsign: true,
-    sslCA: true,
-    emailCA: true,
-    objCA: true
-  }])
-  // self-sign certificate
-  cert.sign(privateKey)
-
-  return cert
-}
-
 /**
  * Finds the first item in a collection that is matched in the
  * `asyncCompare` function.
@@ -74,7 +8,7 @@ export const certificateForKey = (key: any, privateKey: forge.pki.rsa.PrivateKey
  * @param {Array} array
  * @param {function(*)} asyncCompare - An async function that returns a boolean
  */
-export async function findAsync <T> (array: T[], asyncCompare: (val: T) => Promise<any>) {
+export async function findAsync <T> (array: T[], asyncCompare: (val: T) => Promise<any>): Promise<T | undefined> {
   const promises = array.map(asyncCompare)
   const results = await Promise.all(promises)
   const index = results.findIndex(result => result)

package/dist/src/cms.d.ts

@@ -1,33 +0,0 @@
-import 'node-forge/lib/pkcs7.js';
-import 'node-forge/lib/pbe.js';
-import type { KeyChain } from './index.js';
-/**
- * Cryptographic Message Syntax (aka PKCS #7)
- *
- * CMS describes an encapsulation syntax for data protection. It
- * is used to digitally sign, digest, authenticate, or encrypt
- * arbitrary message content.
- *
- * See RFC 5652 for all the details.
- */
-export declare class CMS {
-    private readonly keychain;
-    /**
-     * Creates a new instance with a keychain
-     */
-    constructor(keychain: KeyChain, dek: string);
-    /**
-     * Creates some protected data.
-     *
-     * The output Uint8Array contains the PKCS #7 message in DER.
-     */
-    encrypt(name: string, plain: Uint8Array): Promise<Uint8Array>;
-    /**
-     * Reads some protected data.
-     *
-     * The keychain must contain one of the keys used to encrypt the data.  If none of the keys
-     * exists, an Error is returned with the property 'missingKeys'.  It is array of key ids.
-     */
-    decrypt(cmsData: Uint8Array): Promise<Uint8Array>;
-}
-//# sourceMappingURL=cms.d.ts.map

package/dist/src/cms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cms.d.ts","sourceRoot":"","sources":["../../src/cms.ts"],"names":[],"mappings":"AAAA,OAAO,yBAAyB,CAAA;AAChC,OAAO,uBAAuB,CAAA;AAS9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAM1C;;;;;;;;GAQG;AACH,qBAAa,GAAG;IACd,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IAEnC;;OAEG;gBACU,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM;IAS5C;;;;OAIG;IACG,OAAO,CAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IA4BpE;;;;;OAKG;IACG,OAAO,CAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAsEzD"}

package/dist/src/cms.js

@@ -1,129 +0,0 @@
-import 'node-forge/lib/pkcs7.js';
-import 'node-forge/lib/pbe.js';
-// @ts-expect-error types are missing
-import forge from 'node-forge/lib/forge.js';
-import { certificateForKey, findAsync } from './util.js';
-import errCode from 'err-code';
-import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string';
-import { toString as uint8ArrayToString } from 'uint8arrays/to-string';
-import { codes } from './errors.js';
-import { logger } from '@libp2p/logger';
-const log = logger('libp2p:keychain:cms');
-const privates = new WeakMap();
-/**
- * Cryptographic Message Syntax (aka PKCS #7)
- *
- * CMS describes an encapsulation syntax for data protection. It
- * is used to digitally sign, digest, authenticate, or encrypt
- * arbitrary message content.
- *
- * See RFC 5652 for all the details.
- */
-export class CMS {
-    /**
-     * Creates a new instance with a keychain
-     */
-    constructor(keychain, dek) {
-        if (keychain == null) {
-            throw errCode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED);
-        }
-        this.keychain = keychain;
-        privates.set(this, { dek });
-    }
-    /**
-     * Creates some protected data.
-     *
-     * The output Uint8Array contains the PKCS #7 message in DER.
-     */
-    async encrypt(name, plain) {
-        if (!(plain instanceof Uint8Array)) {
-            throw errCode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS);
-        }
-        const key = await this.keychain.findKeyByName(name);
-        const pem = await this.keychain.getPrivateKey(name);
-        const cached = privates.get(this);
-        if (cached == null) {
-            throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS);
-        }
-        const dek = cached.dek;
-        const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek);
-        const certificate = await certificateForKey(key, privateKey);
-        // create a p7 enveloped message
-        const p7 = forge.pkcs7.createEnvelopedData();
-        p7.addRecipient(certificate);
-        p7.content = forge.util.createBuffer(plain);
-        p7.encrypt();
-        // convert message to DER
-        const der = forge.asn1.toDer(p7.toAsn1()).getBytes();
-        return uint8ArrayFromString(der, 'ascii');
-    }
-    /**
-     * Reads some protected data.
-     *
-     * The keychain must contain one of the keys used to encrypt the data.  If none of the keys
-     * exists, an Error is returned with the property 'missingKeys'.  It is array of key ids.
-     */
-    async decrypt(cmsData) {
-        if (!(cmsData instanceof Uint8Array)) {
-            throw errCode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS);
-        }
-        let cms;
-        try {
-            const buf = forge.util.createBuffer(uint8ArrayToString(cmsData, 'ascii'));
-            const obj = forge.asn1.fromDer(buf);
-            cms = forge.pkcs7.messageFromAsn1(obj);
-        }
-        catch (err) {
-            log.error(err);
-            throw errCode(new Error('Invalid CMS'), codes.ERR_INVALID_CMS);
-        }
-        // Find a recipient whose key we hold. We only deal with recipient certs
-        // issued by ipfs (O=ipfs).
-        const recipients = cms.recipients
-            // @ts-expect-error cms types not defined
-            .filter(r => r.issuer.find(a => a.shortName === 'O' && a.value === 'ipfs'))
-            // @ts-expect-error cms types not defined
-            .filter(r => r.issuer.find(a => a.shortName === 'CN'))
-            // @ts-expect-error cms types not defined
-            .map(r => {
-            return {
-                recipient: r,
-                // @ts-expect-error cms types not defined
-                keyId: r.issuer.find(a => a.shortName === 'CN').value
-            };
-        });
-        const r = await findAsync(recipients, async (recipient) => {
-            try {
-                const key = await this.keychain.findKeyById(recipient.keyId);
-                if (key != null) {
-                    return true;
-                }
-            }
-            catch (err) {
-                return false;
-            }
-            return false;
-        });
-        if (r == null) {
-            // @ts-expect-error cms types not defined
-            const missingKeys = recipients.map(r => r.keyId);
-            throw errCode(new Error(`Decryption needs one of the key(s): ${missingKeys.join(', ')}`), codes.ERR_MISSING_KEYS, {
-                missingKeys
-            });
-        }
-        const key = await this.keychain.findKeyById(r.keyId);
-        if (key == null) {
-            throw errCode(new Error('No key available to decrypto'), codes.ERR_NO_KEY);
-        }
-        const pem = await this.keychain.getPrivateKey(key.name);
-        const cached = privates.get(this);
-        if (cached == null) {
-            throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS);
-        }
-        const dek = cached.dek;
-        const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek);
-        cms.decrypt(r.recipient, privateKey);
-        return uint8ArrayFromString(cms.content.getBytes(), 'ascii');
-    }
-}
-//# sourceMappingURL=cms.js.map

package/dist/src/cms.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cms.js","sourceRoot":"","sources":["../../src/cms.ts"],"names":[],"mappings":"AAAA,OAAO,yBAAyB,CAAA;AAChC,OAAO,uBAAuB,CAAA;AAC9B,qCAAqC;AACrC,OAAO,KAAK,MAAM,yBAAyB,CAAA;AAC3C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,OAAO,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAGvC,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;AAEzC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA2B,CAAA;AAEvD;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IAGd;;OAEG;IACH,YAAa,QAAkB,EAAE,GAAW;QAC1C,IAAI,QAAQ,IAAI,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAA;SAC9E;QAED,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAE,IAAY,EAAE,KAAiB;QAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE;YAClC,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAA;SAC1F;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAEjC,IAAI,MAAM,IAAI,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAA;SACtE;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAE5D,gCAAgC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAA;QAC5C,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAA;QAC5B,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAC3C,EAAE,CAAC,OAAO,EAAE,CAAA;QAEZ,yBAAyB;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpD,OAAO,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAE,OAAmB;QAChC,IAAI,CAAC,CAAC,OAAO,YAAY,UAAU,CAAC,EAAE;YACpC,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAA;SAC/E;QAED,IAAI,GAAQ,CAAA;QACZ,IAAI;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;YACzE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEnC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;SACvC;QAAC,OAAO,GAAQ,EAAE;YACjB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACd,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;SAC/D;QAED,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,UAAU,GAAQ,GAAG,CAAC,UAAU;YACpC,yCAAyC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YAC3E,yCAAyC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YACtD,yCAAyC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE;YACP,OAAO;gBACL,SAAS,EAAE,CAAC;gBACZ,yCAAyC;gBACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,KAAK;aACtD,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,SAAc,EAAE,EAAE;YAC7D,IAAI;gBACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC5D,IAAI,GAAG,IAAI,IAAI,EAAE;oBACf,OAAO,IAAI,CAAA;iBACZ;aACF;YAAC,OAAO,GAAQ,EAAE;gBACjB,OAAO,KAAK,CAAA;aACb;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,EAAE;YACb,yCAAyC;YACzC,MAAM,WAAW,GAAa,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAC1D,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,uCAAuC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,gBAAgB,EAAE;gBAChH,WAAW;aACZ,CAAC,CAAA;SACH;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAEpD,IAAI,GAAG,IAAI,IAAI,EAAE;YACf,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;SAC3E;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAEjC,IAAI,MAAM,IAAI,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAA;SACtE;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QACpC,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF"}

package/src/cms.ts

@@ -1,150 +0,0 @@
-import 'node-forge/lib/pkcs7.js'
-import 'node-forge/lib/pbe.js'
-// @ts-expect-error types are missing
-import forge from 'node-forge/lib/forge.js'
-import { certificateForKey, findAsync } from './util.js'
-import errCode from 'err-code'
-import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
-import { toString as uint8ArrayToString } from 'uint8arrays/to-string'
-import { codes } from './errors.js'
-import { logger } from '@libp2p/logger'
-import type { KeyChain } from './index.js'
-
-const log = logger('libp2p:keychain:cms')
-
-const privates = new WeakMap<object, { dek: string }>()
-
-/**
- * Cryptographic Message Syntax (aka PKCS #7)
- *
- * CMS describes an encapsulation syntax for data protection. It
- * is used to digitally sign, digest, authenticate, or encrypt
- * arbitrary message content.
- *
- * See RFC 5652 for all the details.
- */
-export class CMS {
-  private readonly keychain: KeyChain
-
-  /**
-   * Creates a new instance with a keychain
-   */
-  constructor (keychain: KeyChain, dek: string) {
-    if (keychain == null) {
-      throw errCode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED)
-    }
-
-    this.keychain = keychain
-    privates.set(this, { dek })
-  }
-
-  /**
-   * Creates some protected data.
-   *
-   * The output Uint8Array contains the PKCS #7 message in DER.
-   */
-  async encrypt (name: string, plain: Uint8Array): Promise<Uint8Array> {
-    if (!(plain instanceof Uint8Array)) {
-      throw errCode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS)
-    }
-
-    const key = await this.keychain.findKeyByName(name)
-    const pem = await this.keychain.getPrivateKey(name)
-    const cached = privates.get(this)
-
-    if (cached == null) {
-      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
-    }
-
-    const dek = cached.dek
-    const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
-    const certificate = await certificateForKey(key, privateKey)
-
-    // create a p7 enveloped message
-    const p7 = forge.pkcs7.createEnvelopedData()
-    p7.addRecipient(certificate)
-    p7.content = forge.util.createBuffer(plain)
-    p7.encrypt()
-
-    // convert message to DER
-    const der = forge.asn1.toDer(p7.toAsn1()).getBytes()
-    return uint8ArrayFromString(der, 'ascii')
-  }
-
-  /**
-   * Reads some protected data.
-   *
-   * The keychain must contain one of the keys used to encrypt the data.  If none of the keys
-   * exists, an Error is returned with the property 'missingKeys'.  It is array of key ids.
-   */
-  async decrypt (cmsData: Uint8Array): Promise<Uint8Array> {
-    if (!(cmsData instanceof Uint8Array)) {
-      throw errCode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS)
-    }
-
-    let cms: any
-    try {
-      const buf = forge.util.createBuffer(uint8ArrayToString(cmsData, 'ascii'))
-      const obj = forge.asn1.fromDer(buf)
-
-      cms = forge.pkcs7.messageFromAsn1(obj)
-    } catch (err: any) {
-      log.error(err)
-      throw errCode(new Error('Invalid CMS'), codes.ERR_INVALID_CMS)
-    }
-
-    // Find a recipient whose key we hold. We only deal with recipient certs
-    // issued by ipfs (O=ipfs).
-    const recipients: any = cms.recipients
-      // @ts-expect-error cms types not defined
-      .filter(r => r.issuer.find(a => a.shortName === 'O' && a.value === 'ipfs'))
-      // @ts-expect-error cms types not defined
-      .filter(r => r.issuer.find(a => a.shortName === 'CN'))
-      // @ts-expect-error cms types not defined
-      .map(r => {
-        return {
-          recipient: r,
-          // @ts-expect-error cms types not defined
-          keyId: r.issuer.find(a => a.shortName === 'CN').value
-        }
-      })
-
-    const r = await findAsync(recipients, async (recipient: any) => {
-      try {
-        const key = await this.keychain.findKeyById(recipient.keyId)
-        if (key != null) {
-          return true
-        }
-      } catch (err: any) {
-        return false
-      }
-      return false
-    })
-
-    if (r == null) {
-      // @ts-expect-error cms types not defined
-      const missingKeys: string[] = recipients.map(r => r.keyId)
-      throw errCode(new Error(`Decryption needs one of the key(s): ${missingKeys.join(', ')}`), codes.ERR_MISSING_KEYS, {
-        missingKeys
-      })
-    }
-
-    const key = await this.keychain.findKeyById(r.keyId)
-
-    if (key == null) {
-      throw errCode(new Error('No key available to decrypto'), codes.ERR_NO_KEY)
-    }
-
-    const pem = await this.keychain.getPrivateKey(key.name)
-    const cached = privates.get(this)
-
-    if (cached == null) {
-      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
-    }
-
-    const dek = cached.dek
-    const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
-    cms.decrypt(r.recipient, privateKey)
-    return uint8ArrayFromString(cms.content.getBytes(), 'ascii')
-  }
-}