@matter/general 0.11.0-alpha.0-20241005-e3e4e4a7a

package/src/codec/DerTypes.ts

@@ -0,0 +1,145 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {
+    BitByteArray,
+    ContextTagged,
+    ContextTaggedBytes,
+    DatatypeOverride,
+    DerCodec,
+    DerError,
+    DerObject,
+    DerType,
+    ObjectId,
+} from "../codec/DerCodec.js";
+
+export namespace X962 {
+    export const PublicKeyEcPrime256v1 = (key: Uint8Array) => ({
+        type: {
+            algorithm: ObjectId("2A8648CE3D0201") /* EC Public Key */,
+            curve: ObjectId("2A8648CE3D030107") /* Curve P256_V1 */,
+        },
+        bytes: BitByteArray(key),
+    });
+    export const EcdsaWithSHA256 = DerObject("2A8648CE3D040302");
+}
+
+export const SHA256_CMS = DerObject("608648016503040201"); // 2.16.840.1.101.3.4.2.1
+
+export namespace X509 {
+    export const SubjectKeyIdentifier = (identifier: Uint8Array) =>
+        DerObject("551d0e", { value: DerCodec.encode(identifier) });
+    export const AuthorityKeyIdentifier = (identifier: Uint8Array) =>
+        DerObject("551d23", { value: DerCodec.encode({ id: ContextTaggedBytes(0, identifier) }) });
+    export const BasicConstraints = (constraints: any) => {
+        const toEncode = { ...constraints };
+        if (toEncode?.isCa === false) {
+            // This is the default value, so we can remove it according to
+            // https://datatracker.ietf.org/doc/html/rfc5280#appendix-B
+            delete toEncode.isCa;
+        }
+        return DerObject("551d13", { critical: true, value: DerCodec.encode(toEncode) });
+    };
+    export const ExtendedKeyUsage = (values: number[] | undefined) => {
+        if (values === undefined) {
+            return undefined;
+        }
+        const data = {} as any;
+        values.forEach(value => {
+            switch (value) {
+                case 1: // server Auth
+                    data.serverAuth = ObjectId("2b06010505070301");
+                    break;
+                case 2: // client Auth
+                    data.clientAuth = ObjectId("2b06010505070302");
+                    break;
+                case 3: // Code Signing
+                    data.codeSigning = ObjectId("2b06010505070303");
+                    break;
+                case 4: // Email Protection
+                    data.emailProtection = ObjectId("2b06010505070304");
+                    break;
+                case 5: // Time Stamping
+                    data.timeStamping = ObjectId("2b06010505070308");
+                    break;
+                case 6: // OCSP Signing
+                    data.ocspSigning = ObjectId("2b06010505070309");
+                    break;
+                default:
+                    throw new DerError(`Unsupported extended key usage value ${value}`);
+            }
+        });
+        return DerObject("551d25", {
+            critical: true,
+            value: DerCodec.encode(data),
+        });
+    };
+    export const KeyUsage = (value: number) => {
+        return DerObject("551d0f", {
+            critical: true,
+            value: DerCodec.encode(DatatypeOverride(DerType.BitString, value)),
+        });
+    };
+}
+
+export namespace Pkcs7 {
+    export const Data = (data: any) => DerObject("2A864886F70D010701", { value: ContextTagged(0, data) });
+    export const SignedData = (data: any) => DerObject("2a864886f70d010702", { value: ContextTagged(0, data) });
+}
+
+export namespace X520 {
+    export const NON_WELL_DEFINED_DATE = new Date("9999-12-31 23:59:59Z");
+
+    /**
+     * Generator function to create a specific ASN string field for a DN with the OID base 2.5.4.*.
+     * The returned function takes the value of the string and returns the ASN.1 DER object. Optionally the string
+     * can be encoded as a Printable String which adjusts the OID accordingly..
+     */
+    const GenericString_X520 =
+        (id: number) =>
+        (data: string, asPrintedString = false) => {
+            let value: any = data;
+            if (asPrintedString) {
+                value = DatatypeOverride(DerType.PrintableString, value);
+            }
+            return [DerObject(`5504${id.toString(16).padStart(2, "0")}`, { value })];
+        };
+
+    /** commonName = ASN.1 OID 2.5.4.3 */
+    export const CommonName = GenericString_X520(3);
+    /** surName = ASN.1 OID 2.5.4.4 */
+    export const SurName = GenericString_X520(4);
+    /** serialNumber = ASN.1 OID 2.5.4.5 */
+    export const SerialNumber = GenericString_X520(5);
+    /** countryName = ASN.1 OID 2.5.4.6 */
+    export const CountryName = GenericString_X520(6);
+    /** localityName = ASN.1 OID 2.5.4.7 */
+    export const LocalityName = GenericString_X520(7);
+    /** stateOrProvinceName = ASN.1 OID 2.5.4.8 */
+    export const StateOrProvinceName = GenericString_X520(8);
+    /** organizationName = ASN.1 OID 2.5.4.10 */
+    export const OrganisationName = GenericString_X520(10);
+    /** organizationalUnitName = ASN.1 OID 2.5.4.11 */
+    export const OrganizationalUnitName = GenericString_X520(11);
+    /** title = ASN.1 OID 2.5.4.12 */
+    export const Title = GenericString_X520(12);
+    /** name = ASN.1 OID 2.5.4.41 */
+    export const Name = GenericString_X520(41);
+    /** givenName = ASN.1 OID 2.5.4.42 */
+    export const GivenName = GenericString_X520(42);
+    /** initials = ASN.1 OID 2.5.4.43 */
+    export const Initials = GenericString_X520(43);
+    /** generationQualifier = ASN.1 OID 2.5.4.44 */
+    export const GenerationQualifier = GenericString_X520(44);
+    /** dnQualifier = ASN.1 OID 2.5.4.46 */
+    export const DnQualifier = GenericString_X520(46);
+    /** pseudonym = ASN.1 OID 2.5.4.65 */
+    export const Pseudonym = GenericString_X520(65);
+    /** domain-component = ASN.1 OID 0.9.2342.19200300.100.1.25, IA5String */
+    export const DomainComponent = (value: string) => [
+        DerObject("06092A864886F70D010901", { value: DatatypeOverride(DerType.IA5String, value) }),
+    ];
+}

package/src/codec/DnsCodec.ts

@@ -0,0 +1,393 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { InternalError, NotImplementedError, UnexpectedDataError } from "../MatterError.js";
+import { Bytes, Endian } from "../util/Bytes.js";
+import { DataReader } from "../util/DataReader.js";
+import { DataWriter } from "../util/DataWriter.js";
+import { isIPv4, isIPv6 } from "../util/Ip.js";
+
+/**
+ * The maximum MDNS message size to usually fit into one UDP network MTU packet. Data are split into multiple messages
+ * when needed.
+ */
+export const MAX_MDNS_MESSAGE_SIZE = 1232; // 1280bytes (IPv6 packet size) - 8bytes (UDP header) - 40bytes (IPv6 IP header, IPv4 is only 20bytes)
+
+export const PtrRecord = (name: string, ptr: string, ttl = 120, flushCache = false): DnsRecord<string> => ({
+    name,
+    value: ptr,
+    ttl,
+    recordType: DnsRecordType.PTR,
+    recordClass: DnsRecordClass.IN,
+    flushCache,
+});
+export const ARecord = (name: string, ip: string, ttl = 120, flushCache = false): DnsRecord<string> => ({
+    name,
+    value: ip,
+    ttl,
+    recordType: DnsRecordType.A,
+    recordClass: DnsRecordClass.IN,
+    flushCache,
+});
+export const AAAARecord = (name: string, ip: string, ttl = 120, flushCache = false): DnsRecord<string> => ({
+    name,
+    value: ip,
+    ttl,
+    recordType: DnsRecordType.AAAA,
+    recordClass: DnsRecordClass.IN,
+    flushCache,
+});
+export const TxtRecord = (name: string, entries: string[], ttl = 120, flushCache = false): DnsRecord<string[]> => ({
+    name,
+    value: entries,
+    ttl,
+    recordType: DnsRecordType.TXT,
+    recordClass: DnsRecordClass.IN,
+    flushCache,
+});
+export const SrvRecord = (
+    name: string,
+    srv: SrvRecordValue,
+    ttl = 120,
+    flushCache = false,
+): DnsRecord<SrvRecordValue> => ({
+    name,
+    value: srv,
+    ttl,
+    recordType: DnsRecordType.SRV,
+    recordClass: DnsRecordClass.IN,
+    flushCache,
+});
+
+export type SrvRecordValue = {
+    priority: number;
+    weight: number;
+    port: number;
+    target: string;
+};
+
+export type DnsQuery = {
+    name: string;
+    recordType: DnsRecordType;
+    recordClass: DnsRecordClass;
+    uniCastResponse?: boolean;
+};
+
+export type DnsRecord<T> = {
+    name: string;
+    recordType: DnsRecordType;
+    recordClass: DnsRecordClass;
+    flushCache?: boolean;
+    ttl: number;
+    value: T;
+};
+
+export type DnsMessage = {
+    transactionId: number;
+    messageType: DnsMessageType;
+    queries: DnsQuery[];
+    answers: DnsRecord<any>[];
+    authorities: DnsRecord<any>[];
+    additionalRecords: DnsRecord<any>[];
+};
+
+export type DnsMessagePartiallyPreEncoded = Omit<DnsMessage, "answers" | "additionalRecords"> & {
+    answers: (DnsRecord<any> | Uint8Array)[];
+    additionalRecords: (DnsRecord<any> | Uint8Array)[];
+};
+
+export enum DnsMessageType {
+    Query = 0x0000,
+    TruncatedQuery = 0x0200,
+    Response = 0x8400, // Authoritative Answer
+    TruncatedResponse = 0x8600,
+}
+
+export enum DnsRecordType {
+    A = 0x01,
+    PTR = 0x0c,
+    TXT = 0x10,
+    AAAA = 0x1c,
+    SRV = 0x21,
+    NSEC = 0x2f,
+    ANY = 0xff,
+}
+
+export enum DnsRecordClass {
+    IN = 0x01,
+    ANY = 0xff,
+}
+
+export class DnsCodec {
+    static decode(message: Uint8Array): DnsMessage | undefined {
+        try {
+            const reader = new DataReader(message, Endian.Big);
+            const transactionId = reader.readUInt16();
+            const messageType = reader.readUInt16();
+            const queriesCount = reader.readUInt16();
+            const answersCount = reader.readUInt16();
+            const authoritiesCount = reader.readUInt16();
+            const additionalRecordsCount = reader.readUInt16();
+            const queries = new Array<DnsQuery>();
+            for (let i = 0; i < queriesCount; i++) {
+                queries.push(this.decodeQuery(reader, message));
+            }
+            const answers = new Array<DnsRecord<any>>();
+            for (let i = 0; i < answersCount; i++) {
+                answers.push(this.decodeRecord(reader, message));
+            }
+            const authorities = new Array<DnsRecord<any>>();
+            for (let i = 0; i < authoritiesCount; i++) {
+                authorities.push(this.decodeRecord(reader, message));
+            }
+            const additionalRecords = new Array<DnsRecord<any>>();
+            for (let i = 0; i < additionalRecordsCount; i++) {
+                additionalRecords.push(this.decodeRecord(reader, message));
+            }
+            return { transactionId, messageType, queries, answers, authorities, additionalRecords };
+        } catch (error) {
+            return undefined;
+        }
+    }
+
+    private static decodeQuery(reader: DataReader<Endian.Big>, message: Uint8Array): DnsQuery {
+        const name = this.decodeQName(reader, message);
+        const recordType = reader.readUInt16();
+        const classInt = reader.readUInt16();
+        const uniCastResponse = (classInt & 0x8000) !== 0;
+        const recordClass = classInt & 0x7fff;
+        return { name, recordType, recordClass, uniCastResponse };
+    }
+
+    private static decodeRecord(reader: DataReader<Endian.Big>, message: Uint8Array): DnsRecord<any> {
+        const name = this.decodeQName(reader, message);
+        const recordType = reader.readUInt16();
+        const classInt = reader.readUInt16();
+        const flushCache = (classInt & 0x8000) !== 0;
+        const recordClass = classInt & 0x7fff;
+        const ttl = reader.readUInt32();
+        const valueLength = reader.readUInt16();
+        const valueBytes = reader.readByteArray(valueLength);
+        const value = this.decodeRecordValue(valueBytes, recordType, message);
+        return { name, recordType, recordClass, ttl, value, flushCache };
+    }
+
+    private static decodeQName(reader: DataReader<Endian.Big>, message: Uint8Array) {
+        const messageReader = new DataReader(message, Endian.Big);
+        const qNameItems = new Array<string>();
+        while (true) {
+            const itemLength = reader.readUInt8();
+            if (itemLength === 0) break;
+            if ((itemLength & 0xc0) !== 0) {
+                // Compressed Qname
+                const indexInMessage = reader.readUInt8() | ((itemLength & 0x3f) << 8);
+                messageReader.setOffset(indexInMessage);
+                qNameItems.push(this.decodeQName(messageReader, message));
+                break;
+            }
+            qNameItems.push(reader.readUtf8String(itemLength));
+        }
+        return qNameItems.join(".");
+    }
+
+    private static decodeRecordValue(valueBytes: Uint8Array, recordType: DnsRecordType, message: Uint8Array) {
+        switch (recordType) {
+            case DnsRecordType.PTR:
+                return this.decodeQName(new DataReader(valueBytes, Endian.Big), message);
+            case DnsRecordType.SRV:
+                return this.decodeSrvRecord(valueBytes, message);
+            case DnsRecordType.TXT:
+                return this.decodeTxtRecord(valueBytes);
+            case DnsRecordType.AAAA:
+                return this.decodeAaaaRecord(valueBytes);
+            case DnsRecordType.A:
+                return this.decodeARecord(valueBytes);
+            default:
+                // Unknown type, don't decode
+                return valueBytes;
+        }
+    }
+
+    private static decodeSrvRecord(valueBytes: Uint8Array, message: Uint8Array): SrvRecordValue {
+        const reader = new DataReader(valueBytes, Endian.Big);
+        const priority = reader.readUInt16();
+        const weight = reader.readUInt16();
+        const port = reader.readUInt16();
+        const target = this.decodeQName(reader, message);
+        return { priority, weight, port, target };
+    }
+
+    private static decodeTxtRecord(valueBytes: Uint8Array): string[] {
+        const reader = new DataReader(valueBytes, Endian.Big);
+        const result = new Array<string>();
+        let bytesRead = 0;
+        while (bytesRead < valueBytes.length) {
+            const length = reader.readUInt8();
+            result.push(reader.readUtf8String(length));
+            bytesRead += length + 1;
+        }
+        return result;
+    }
+
+    private static decodeAaaaRecord(valueBytes: Uint8Array): string {
+        const reader = new DataReader(valueBytes, Endian.Big);
+        const ipItems = new Array<string>();
+        for (let i = 0; i < 8; i++) {
+            ipItems.push(reader.readUInt16().toString(16));
+        }
+        // Compress 0 sequences
+        const zeroSequences = new Array<{ start: number; length: number }>();
+        for (let i = 0; i < 8; i++) {
+            if (ipItems[i] !== "0") continue;
+            const start = i;
+            i++;
+            while (i < 8 && ipItems[i] === "0") {
+                i++;
+            }
+            zeroSequences.push({ start, length: i - start });
+        }
+        if (zeroSequences.length > 0) {
+            zeroSequences.sort((a, b) => a.length - b.length);
+            const { start, length } = zeroSequences[0];
+            ipItems[start] = "";
+            ipItems.splice(start + 1, length - 1);
+        }
+        return ipItems.join(":");
+    }
+
+    private static decodeARecord(valueBytes: Uint8Array): string {
+        const reader = new DataReader(valueBytes, Endian.Big);
+        const ipItems = new Array<string>();
+        for (let i = 0; i < 4; i++) {
+            ipItems.push(reader.readUInt8().toString());
+        }
+        return ipItems.join(".");
+    }
+
+    static encode({
+        messageType,
+        transactionId = 0,
+        queries = [],
+        answers = [],
+        authorities = [],
+        additionalRecords = [],
+    }: Partial<DnsMessagePartiallyPreEncoded>): Uint8Array {
+        if (messageType === undefined) throw new InternalError("Message type must be specified!");
+        if (queries.length > 0 && messageType !== DnsMessageType.Query && messageType !== DnsMessageType.TruncatedQuery)
+            throw new InternalError("Queries can only be included in query messages!");
+        if (authorities.length > 0) throw new NotImplementedError("Authority answers are not supported yet!");
+
+        const writer = new DataWriter(Endian.Big);
+        writer.writeUInt16(transactionId);
+        writer.writeUInt16(messageType);
+        writer.writeUInt16(queries.length);
+        writer.writeUInt16(answers.length);
+        writer.writeUInt16(authorities.length);
+        writer.writeUInt16(additionalRecords.length);
+        queries.forEach(({ name, recordClass, recordType, uniCastResponse = false }) => {
+            writer.writeByteArray(this.encodeQName(name));
+            writer.writeUInt16(recordType);
+            writer.writeUInt16(recordClass | (uniCastResponse ? 0x8000 : 0));
+        });
+        [...answers, ...authorities, ...additionalRecords].forEach(record => {
+            if (record instanceof Uint8Array) {
+                writer.writeByteArray(record);
+            } else {
+                writer.writeByteArray(this.encodeRecord(record));
+            }
+        });
+        return writer.toByteArray();
+    }
+
+    static encodeRecord(record: DnsRecord<any>): Uint8Array {
+        const { name, recordType, recordClass, ttl, value, flushCache = false } = record;
+
+        const writer = new DataWriter(Endian.Big);
+        writer.writeByteArray(this.encodeQName(name));
+        writer.writeUInt16(recordType);
+        writer.writeUInt16(recordClass | (flushCache ? 0x8000 : 0));
+        writer.writeUInt32(ttl);
+        const encodedValue = this.encodeRecordValue(value, recordType);
+        writer.writeUInt16(encodedValue.length);
+        writer.writeByteArray(encodedValue);
+        return writer.toByteArray();
+    }
+
+    private static encodeRecordValue(value: any, recordType: DnsRecordType): Uint8Array {
+        switch (recordType) {
+            case DnsRecordType.PTR:
+                return this.encodeQName(value as string);
+            case DnsRecordType.SRV:
+                return this.encodeSrvRecord(value as SrvRecordValue);
+            case DnsRecordType.TXT:
+                return this.encodeTxtRecord(value as string[]);
+            case DnsRecordType.AAAA:
+                return this.encodeAaaaRecord(value as string);
+            case DnsRecordType.A:
+                return this.encodeARecord(value as string);
+            default:
+                if (value instanceof Uint8Array) return value;
+                throw new UnexpectedDataError(`Unsupported record type ${recordType}`);
+        }
+    }
+
+    private static encodeARecord(ip: string) {
+        if (!isIPv4(ip)) throw new UnexpectedDataError(`Invalid A Record value: ${ip}`);
+        const writer = new DataWriter(Endian.Big);
+        ip.split(".").forEach(part => {
+            writer.writeUInt8(parseInt(part));
+        });
+        return writer.toByteArray();
+    }
+
+    private static encodeAaaaRecord(ip: string) {
+        if (!isIPv6(ip)) throw new UnexpectedDataError(`Invalid AAAA Record value: ${ip}`);
+        const writer = new DataWriter(Endian.Big);
+        const parts = ip.split(":");
+        parts.forEach(part => {
+            if (part === "") {
+                const compressedParts = 8 - parts.length;
+                for (let i = 0; i < compressedParts; i++) {
+                    writer.writeUInt16(0);
+                }
+            }
+            writer.writeUInt16(parseInt(part, 16));
+        });
+        return writer.toByteArray();
+    }
+
+    private static encodeTxtRecord(entries: string[]) {
+        const writer = new DataWriter(Endian.Big);
+        entries.forEach(entry => {
+            const entryData = Bytes.fromString(entry);
+            writer.writeUInt8(entryData.length);
+            writer.writeByteArray(entryData);
+        });
+        return writer.toByteArray();
+    }
+
+    private static encodeSrvRecord({ priority, weight, port, target }: SrvRecordValue) {
+        const writer = new DataWriter(Endian.Big);
+        writer.writeUInt16(priority);
+        writer.writeUInt16(weight);
+        writer.writeUInt16(port);
+        writer.writeByteArray(this.encodeQName(target));
+        return writer.toByteArray();
+    }
+
+    private static encodeQName(qname: string) {
+        const writer = new DataWriter(Endian.Big);
+        if (qname.length > 0) {
+            qname.split(".").forEach(label => {
+                const labelData = Bytes.fromString(label);
+                writer.writeUInt8(labelData.length);
+                writer.writeByteArray(labelData);
+            });
+        }
+        writer.writeUInt8(0);
+        return writer.toByteArray();
+    }
+}

package/src/codec/index.ts

@@ -0,0 +1,10 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export * from "./Base64Codec.js";
+export * from "./DerCodec.js";
+export * from "./DerTypes.js";
+export * from "./DnsCodec.js";

package/src/crypto/Crypto.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import * as mod from "@noble/curves/abstract/modular";
+import * as utils from "@noble/curves/abstract/utils";
+import { p256 } from "@noble/curves/p256";
+import { MatterError, NoProviderError } from "../MatterError.js";
+import { Endian } from "../util/Bytes.js";
+import { DataReader } from "../util/DataReader.js";
+import { PrivateKey } from "./Key.js";
+
+export const ec = {
+    p256,
+    ...utils,
+    ...mod,
+};
+
+export const CRYPTO_RANDOM_LENGTH = 32;
+export const CRYPTO_ENCRYPT_ALGORITHM = "aes-128-ccm";
+export const CRYPTO_HASH_ALGORITHM = "sha256";
+export const CRYPTO_EC_CURVE = "prime256v1";
+export const CRYPTO_EC_KEY_BYTES = 32;
+export const CRYPTO_AUTH_TAG_LENGTH = 16;
+export const CRYPTO_SYMMETRIC_KEY_LENGTH = 16;
+export type CryptoDsaEncoding = "ieee-p1363" | "der";
+
+export class CryptoVerifyError extends MatterError {}
+
+export abstract class Crypto {
+    static get: () => Crypto = () => {
+        throw new NoProviderError("No provider configured");
+    };
+
+    abstract encrypt(key: Uint8Array, data: Uint8Array, nonce: Uint8Array, aad?: Uint8Array): Uint8Array;
+    static readonly encrypt = (key: Uint8Array, data: Uint8Array, nonce: Uint8Array, aad?: Uint8Array): Uint8Array =>
+        Crypto.get().encrypt(key, data, nonce, aad);
+
+    abstract decrypt(key: Uint8Array, data: Uint8Array, nonce: Uint8Array, aad?: Uint8Array): Uint8Array;
+    static readonly decrypt = (key: Uint8Array, data: Uint8Array, nonce: Uint8Array, aad?: Uint8Array): Uint8Array =>
+        Crypto.get().decrypt(key, data, nonce, aad);
+
+    abstract getRandomData(length: number): Uint8Array;
+    static readonly getRandomData = (length: number): Uint8Array => Crypto.get().getRandomData(length);
+
+    static readonly getRandom = (): Uint8Array => Crypto.get().getRandomData(CRYPTO_RANDOM_LENGTH);
+
+    static readonly getRandomUInt16 = (): number =>
+        new DataReader(Crypto.get().getRandomData(2), Endian.Little).readUInt16();
+
+    static readonly getRandomUInt32 = (): number =>
+        new DataReader(Crypto.get().getRandomData(4), Endian.Little).readUInt32();
+
+    static readonly getRandomBigUInt64 = (): bigint =>
+        new DataReader(Crypto.get().getRandomData(8), Endian.Little).readUInt64();
+
+    static readonly getRandomBigInt = (size: number, maxValue?: bigint): bigint => {
+        const { bytesToNumberBE } = ec;
+        if (maxValue === undefined) {
+            return bytesToNumberBE(Crypto.getRandomData(size));
+        }
+        while (true) {
+            const random = bytesToNumberBE(Crypto.getRandomData(size));
+            if (random < maxValue) return random;
+        }
+    };
+
+    abstract ecdhGeneratePublicKey(): { publicKey: Uint8Array; ecdh: any };
+    static readonly ecdhGeneratePublicKey = (): { publicKey: Uint8Array; ecdh: any } =>
+        Crypto.get().ecdhGeneratePublicKey();
+
+    abstract ecdhGeneratePublicKeyAndSecret(peerPublicKey: Uint8Array): {
+        publicKey: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    static readonly ecdhGeneratePublicKeyAndSecret = (
+        peerPublicKey: Uint8Array,
+    ): { publicKey: Uint8Array; sharedSecret: Uint8Array } =>
+        Crypto.get().ecdhGeneratePublicKeyAndSecret(peerPublicKey);
+
+    abstract ecdhGenerateSecret(peerPublicKey: Uint8Array, ecdh: any): Uint8Array;
+    static readonly ecdhGenerateSecret = (peerPublicKey: Uint8Array, ecdh: any): Uint8Array =>
+        Crypto.get().ecdhGenerateSecret(peerPublicKey, ecdh);
+
+    abstract hash(data: Uint8Array | Uint8Array[]): Uint8Array;
+    static readonly hash = (data: Uint8Array | Uint8Array[]): Uint8Array => Crypto.get().hash(data);
+
+    abstract pbkdf2(secret: Uint8Array, salt: Uint8Array, iteration: number, keyLength: number): Promise<Uint8Array>;
+    static readonly pbkdf2 = (
+        secret: Uint8Array,
+        salt: Uint8Array,
+        iteration: number,
+        keyLength: number,
+    ): Promise<Uint8Array> => Crypto.get().pbkdf2(secret, salt, iteration, keyLength);
+
+    abstract hkdf(secret: Uint8Array, salt: Uint8Array, info: Uint8Array, length?: number): Promise<Uint8Array>;
+    static readonly hkdf = (
+        secret: Uint8Array,
+        salt: Uint8Array,
+        info: Uint8Array,
+        length?: number,
+    ): Promise<Uint8Array> => Crypto.get().hkdf(secret, salt, info, length);
+
+    abstract hmac(key: Uint8Array, data: Uint8Array): Uint8Array;
+    static readonly hmac = (key: Uint8Array, data: Uint8Array): Uint8Array => Crypto.get().hmac(key, data);
+
+    abstract sign(privateKey: JsonWebKey, data: Uint8Array | Uint8Array[], dsaEncoding?: CryptoDsaEncoding): Uint8Array;
+    static readonly sign = (
+        privateKey: JsonWebKey,
+        data: Uint8Array | Uint8Array[],
+        dsaEncoding?: CryptoDsaEncoding,
+    ): Uint8Array => Crypto.get().sign(privateKey, data, dsaEncoding);
+
+    abstract verify(
+        publicKey: JsonWebKey,
+        data: Uint8Array,
+        signature: Uint8Array,
+        dsaEncoding?: CryptoDsaEncoding,
+    ): void;
+    static readonly verify = (
+        publicKey: JsonWebKey,
+        data: Uint8Array,
+        signature: Uint8Array,
+        dsaEncoding?: CryptoDsaEncoding,
+    ): void => Crypto.get().verify(publicKey, data, signature, dsaEncoding);
+
+    abstract createKeyPair(): PrivateKey;
+    static readonly createKeyPair = (): PrivateKey => Crypto.get().createKeyPair();
+}
+
+// Hook for testing frameworks
+if (typeof MatterHooks !== "undefined") {
+    MatterHooks.cryptoSetup?.(Crypto);
+}