@nmshd/crypto 2.1.1 → 2.2.0-alpha.1

package/dist/crypto-layer/CryptoLayerProviders.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initCryptoLayerProviders = initCryptoLayerProviders;
+exports.getProvider = getProvider;
+exports.hasProviderForSecurityLevel = hasProviderForSecurityLevel;
+const CryptoError_1 = require("../CryptoError");
+const CryptoErrorCode_1 = require("../CryptoErrorCode");
+let PROVIDERS_BY_SECURITY = undefined;
+let PROVIDERS_BY_NAME = undefined;
+const DEFAULT_PROVIDER_CONFIG = {
+    max_security_level: "Hardware",
+    min_security_level: "Software",
+    supported_asym_spec: ["P256", "Curve25519"],
+    supported_ciphers: ["AesCbc256", "AesGcm256"],
+    supported_hashes: ["Sha2_256", "Sha2_512"]
+};
+async function providerBySecurityMapFromProviderByNameMap(providersByName) {
+    const providersBySecurity = new Map();
+    for (const [providerName, provider] of providersByName) {
+        const capabilities = await provider.getCapabilities();
+        if (!capabilities) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalLoadingProvider, `Failed fetching capabilities or security levels of provider ${providerName}`).setContext(providerBySecurityMapFromProviderByNameMap);
+        }
+        if (capabilities.max_security_level !== capabilities.min_security_level) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalLoadingProvider, `Minimum and maximum security levels of provider ${providerName} must be the same.`).setContext(providerBySecurityMapFromProviderByNameMap);
+        }
+        const securityLevel = capabilities.min_security_level;
+        if (!providersBySecurity.has(securityLevel)) {
+            providersBySecurity.set(securityLevel, []);
+        }
+        providersBySecurity.get(securityLevel).push(provider);
+    }
+    return providersBySecurity;
+}
+/**
+ * Creates a provider if possible with the given provider filter. This means, that the provider created must adhere to the filter.
+ *
+ * If a `SecurityLevel` is given, the default provider config {@link DEFAULT_PROVIDER_CONFIG} will be used to fill in the rest for the selection.
+ */
+async function createProviderFromProviderFilter(providerToBeInitialized, factoryFunctions, providerImplConfig) {
+    if ("providerName" in providerToBeInitialized) {
+        return await factoryFunctions.createProviderFromName(providerToBeInitialized.providerName, providerImplConfig);
+    }
+    if ("securityLevel" in providerToBeInitialized) {
+        const providerConfig = Object.assign(Object.assign({}, DEFAULT_PROVIDER_CONFIG), { max_security_level: providerToBeInitialized.securityLevel, min_security_level: providerToBeInitialized.securityLevel });
+        return await factoryFunctions.createProvider(providerConfig, providerImplConfig);
+    }
+    if ("providerConfig" in providerToBeInitialized) {
+        return await factoryFunctions.createProvider(providerToBeInitialized.providerConfig, providerImplConfig);
+    }
+    throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, `No available provider matches the given requirements: ${JSON.stringify(providerToBeInitialized)}`).setContext(createProviderFromProviderFilter);
+}
+/**
+ * Initializes a list of global providers with the given configuration.
+ */
+async function initCryptoLayerProviders(config) {
+    if (PROVIDERS_BY_NAME !== undefined && PROVIDERS_BY_SECURITY !== undefined) {
+        throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalProvidersAlreadyInitialized, "Providers cannot be initialized again.").setContext(initCryptoLayerProviders);
+    }
+    const providers = new Map();
+    for (const [providerToBeInitialized, providerImplConfig] of config.providersToBeInitialized) {
+        const provider = await createProviderFromProviderFilter(providerToBeInitialized, config.factoryFunctions, providerImplConfig);
+        if (provider === undefined) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalLoadingProvider, `Failed loading provider with given requirements: ${JSON.stringify(providerToBeInitialized)}`).setContext(initCryptoLayerProviders);
+        }
+        providers.set(await provider.providerName(), provider);
+    }
+    PROVIDERS_BY_NAME = providers;
+    PROVIDERS_BY_SECURITY = await providerBySecurityMapFromProviderByNameMap(PROVIDERS_BY_NAME);
+}
+/**
+ * Returns an initialized provider with the given name or security level if possible,
+ * otherwise throws {@link CryptoError} with {@link CryptoErrorCode.CalThisProviderNotInitialized}.
+ *
+ * Providers need to be initialized via the {@link initCryptoLayerProviders} function,
+ * else throws {@link CryptoError} with  {@link CryptoErrorCode.CalProvidersNotInitialized}.
+ */
+function getProvider(identifier) {
+    var _a;
+    if (PROVIDERS_BY_NAME === undefined || PROVIDERS_BY_SECURITY === undefined) {
+        throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalProvidersNotInitialized, "Failed to get providers as providers are not initialized.").setContext(getProvider);
+    }
+    let provider;
+    if ("providerName" in identifier) {
+        provider = PROVIDERS_BY_NAME.get(identifier.providerName);
+    }
+    else if ("securityLevel" in identifier) {
+        provider = (_a = PROVIDERS_BY_SECURITY.get(identifier.securityLevel)) === null || _a === void 0 ? void 0 : _a[0];
+    }
+    else {
+        throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, "Provider identifier was not able to be parsed while trying to get a provider.").setContext(getProvider);
+    }
+    if (provider === undefined) {
+        throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalThisProviderNotInitialized, `Failed finding provider with name or security level ${identifier}`).setContext(getProvider);
+    }
+    return provider;
+}
+function hasProviderForSecurityLevel(securityLevel) {
+    if (PROVIDERS_BY_SECURITY === undefined) {
+        throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalProvidersNotInitialized, "Failed to get providers as providers are not initialized.").setContext(hasProviderForSecurityLevel);
+    }
+    const providers = PROVIDERS_BY_SECURITY.get(securityLevel);
+    return providers !== undefined && providers.length > 0;
+}
+//# sourceMappingURL=CryptoLayerProviders.js.map

package/dist/crypto-layer/CryptoLayerProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoLayerProviders.js","sourceRoot":"","sources":["../../src/crypto-layer/CryptoLayerProviders.ts"],"names":[],"mappings":";;AAuFA,4DA6BC;AAWD,kCA4BC;AAED,kEAUC;AA9JD,gDAA6C;AAC7C,wDAAqD;AAGrD,IAAI,qBAAqB,GAA+C,SAAS,CAAC;AAClF,IAAI,iBAAiB,GAAsC,SAAS,CAAC;AAErE,MAAM,uBAAuB,GAAmB;IAC5C,kBAAkB,EAAE,UAAU;IAC9B,kBAAkB,EAAE,UAAU;IAC9B,mBAAmB,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;IAC3C,iBAAiB,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;CAC7C,CAAC;AAEF,KAAK,UAAU,0CAA0C,CACrD,eAAsC;IAEtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjE,KAAK,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,kBAAkB,EAClC,+DAA+D,YAAY,EAAE,CAChF,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,YAAY,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACtE,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,kBAAkB,EAClC,mDAAmD,YAAY,oBAAoB,CACtF,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,aAAa,GAAG,YAAY,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gCAAgC,CAC3C,uBAA2D,EAC3D,gBAA0C,EAC1C,kBAAsC;IAEtC,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;QAC5C,OAAO,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,eAAe,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,cAAc,mCACb,uBAAuB,KAC1B,kBAAkB,EAAE,uBAAuB,CAAC,aAAa,EACzD,kBAAkB,EAAE,uBAAuB,CAAC,aAAa,GAC5D,CAAC;QACF,OAAO,MAAM,gBAAgB,CAAC,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;QAC9C,OAAO,MAAM,gBAAgB,CAAC,cAAc,CAAC,uBAAuB,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,yDAAyD,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,CACrG,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,wBAAwB,CAAC,MAAyB;IACpE,IAAI,iBAAiB,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,8BAA8B,EAC9C,wCAAwC,CAC3C,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;IAEnD,KAAK,MAAM,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CACnD,uBAAuB,EACvB,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,CACrB,CAAC;QAEF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,kBAAkB,EAClC,oDAAoD,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,CAChG,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,SAAS,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,iBAAiB,GAAG,SAAS,CAAC;IAC9B,qBAAqB,GAAG,MAAM,0CAA0C,CAAC,iBAAiB,CAAC,CAAC;AAChG,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,UAA8B;;IACtD,IAAI,iBAAiB,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,0BAA0B,EAC1C,2DAA2D,CAC9D,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,QAA8B,CAAC;IAEnC,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QAC/B,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,eAAe,IAAI,UAAU,EAAE,CAAC;QACvC,QAAQ,GAAG,MAAA,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,0CAAG,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,+EAA+E,CAClF,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,6BAA6B,EAC7C,uDAAuD,UAAU,EAAE,CACtE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAgB,2BAA2B,CAAC,aAA4B;IACpE,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,0BAA0B,EAC1C,2DAA2D,CAC9D,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/crypto-layer/CryptoLayerUtils.d.ts

@@ -0,0 +1,14 @@
+import { Argon2Options, AsymmetricKeySpec, Cipher, CryptoHash, KDF } from "@nmshd/rs-crypto-types";
+import { CryptoDerivationAlgorithm, CryptoEncryptionAlgorithm } from "..";
+import { CryptoExchangeAlgorithm } from "../exchange/CryptoExchange";
+import { CryptoHashAlgorithm } from "../hash/CryptoHash";
+import { CryptoSignatureAlgorithm } from "../signature/CryptoSignatureAlgorithm";
+export declare class CryptoLayerUtils {
+    static asymSpecFromCryptoExchangeOrSignatureAlgorithm(algorithm: CryptoExchangeAlgorithm | CryptoSignatureAlgorithm): AsymmetricKeySpec;
+    static cryptoHashAlgorithmFromCryptoHash(cryptoHash: CryptoHash): CryptoHashAlgorithm;
+    static cryptoHashFromCryptoHashAlgorithm(algorithm: CryptoHashAlgorithm): CryptoHash;
+    static cipherFromCryptoEncryptionAlgorithm(alg: CryptoEncryptionAlgorithm): Cipher;
+    static cryptoEncryptionAlgorithmFromCipher(cipher: Cipher): CryptoEncryptionAlgorithm;
+    static argon2OptionsFromIterationsMemLimitAndParallelism(iterations: number, memlimit: number, parallelism: number): Argon2Options;
+    static kdfFromCryptoDerivation(derivationAlgorithm: CryptoDerivationAlgorithm, iterations: number, memlimit: number, parallelism: number): KDF;
+}

package/dist/crypto-layer/CryptoLayerUtils.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoLayerUtils = void 0;
+const CryptoError_1 = require("../CryptoError");
+const CryptoErrorCode_1 = require("../CryptoErrorCode");
+class CryptoLayerUtils {
+    static asymSpecFromCryptoExchangeOrSignatureAlgorithm(algorithm) {
+        switch (algorithm) {
+            case 1 /* CryptoExchangeAlgorithm.ECDH_P256 */:
+                return "P256";
+            case 2 /* CryptoExchangeAlgorithm.ECDH_P521 */:
+                return "P521";
+            case 3 /* CryptoExchangeAlgorithm.ECDH_X25519 */:
+                return "Curve25519";
+            case 1 /* CryptoSignatureAlgorithm.ECDSA_P256 */:
+                return "P256";
+            case 2 /* CryptoSignatureAlgorithm.ECDSA_P521 */:
+                return "P521";
+            case 3 /* CryptoSignatureAlgorithm.ECDSA_ED25519 */:
+                return "Curve25519";
+        }
+    }
+    static cryptoHashAlgorithmFromCryptoHash(cryptoHash) {
+        // eslint-disable-next-line @typescript-eslint/switch-exhaustiveness-check
+        switch (cryptoHash) {
+            case "Sha2_256":
+                return 1 /* CryptoHashAlgorithm.SHA256 */;
+            case "Sha2_512":
+                return 2 /* CryptoHashAlgorithm.SHA512 */;
+            case "Blake2b":
+                return 3 /* CryptoHashAlgorithm.BLAKE2B */;
+            default:
+                throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalUnsupportedAlgorithm, `Hash function ${cryptoHash} is not supported by ts crypto.`);
+        }
+    }
+    static cryptoHashFromCryptoHashAlgorithm(algorithm) {
+        switch (algorithm) {
+            case 1 /* CryptoHashAlgorithm.SHA256 */:
+                return "Sha2_256";
+            case 2 /* CryptoHashAlgorithm.SHA512 */:
+                return "Sha2_512";
+            case 3 /* CryptoHashAlgorithm.BLAKE2B */:
+                return "Blake2b";
+        }
+    }
+    static cipherFromCryptoEncryptionAlgorithm(alg) {
+        switch (alg) {
+            case 1 /* CryptoEncryptionAlgorithm.AES128_GCM */:
+                return "AesGcm128";
+            case 2 /* CryptoEncryptionAlgorithm.AES256_GCM */:
+                return "AesGcm256";
+            case 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */:
+                return "XChaCha20Poly1305";
+            case 4 /* CryptoEncryptionAlgorithm.AES128_CBC */:
+                return "AesCbc128";
+            case 5 /* CryptoEncryptionAlgorithm.AES256_CBC */:
+                return "AesCbc256";
+            case 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */:
+                return "ChaCha20Poly1305";
+        }
+    }
+    static cryptoEncryptionAlgorithmFromCipher(cipher) {
+        switch (cipher) {
+            case "AesGcm128":
+                return 1 /* CryptoEncryptionAlgorithm.AES128_GCM */;
+            case "AesGcm256":
+                return 2 /* CryptoEncryptionAlgorithm.AES256_GCM */;
+            case "AesCbc128":
+                return 4 /* CryptoEncryptionAlgorithm.AES128_CBC */;
+            case "AesCbc256":
+                return 5 /* CryptoEncryptionAlgorithm.AES256_CBC */;
+            case "XChaCha20Poly1305":
+                return 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */;
+            case "ChaCha20Poly1305":
+                return 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */;
+        }
+    }
+    static argon2OptionsFromIterationsMemLimitAndParallelism(iterations, memlimit, parallelism) {
+        const kibiByteBase = 2 ^ 10;
+        if (memlimit % kibiByteBase !== 0) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, "rust-crypto uses kibibytes for Argon2. The `memlimit` parameter (in bytes) is not a multiple of `2^10` and thus not convertible without loss.").setContext(CryptoLayerUtils.argon2OptionsFromIterationsMemLimitAndParallelism);
+        }
+        const memory = memlimit / kibiByteBase;
+        const options = {
+            memory: memory,
+            iterations: iterations,
+            parallelism: parallelism
+        };
+        return options;
+    }
+    static kdfFromCryptoDerivation(derivationAlgorithm, iterations, memlimit, parallelism) {
+        const options = CryptoLayerUtils.argon2OptionsFromIterationsMemLimitAndParallelism(iterations, memlimit, parallelism);
+        switch (derivationAlgorithm) {
+            case "argon2id" /* CryptoDerivationAlgorithm.ARGON2ID */:
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                return { Argon2id: options };
+            case "argon2i" /* CryptoDerivationAlgorithm.ARGON2I */:
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                return { Argon2i: options };
+            default:
+                throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, `Crypto derivation algorithm '${derivationAlgorithm}' not supported.`).setContext(CryptoLayerUtils.kdfFromCryptoDerivation);
+        }
+    }
+}
+exports.CryptoLayerUtils = CryptoLayerUtils;
+//# sourceMappingURL=CryptoLayerUtils.js.map

package/dist/crypto-layer/CryptoLayerUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoLayerUtils.js","sourceRoot":"","sources":["../../src/crypto-layer/CryptoLayerUtils.ts"],"names":[],"mappings":";;;AAEA,gDAA6C;AAC7C,wDAAqD;AAKrD,MAAa,gBAAgB;IAClB,MAAM,CAAC,8CAA8C,CACxD,SAA6D;QAE7D,QAAQ,SAAS,EAAE,CAAC;YAChB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,YAAY,CAAC;YACxB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,YAAY,CAAC;QAC5B,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iCAAiC,CAAC,UAAsB;QAClE,0EAA0E;QAC1E,QAAQ,UAAU,EAAE,CAAC;YACjB,KAAK,UAAU;gBACX,0CAAkC;YACtC,KAAK,UAAU;gBACX,0CAAkC;YACtC,KAAK,SAAS;gBACV,2CAAmC;YACvC;gBACI,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,uBAAuB,EACvC,iBAAiB,UAAU,iCAAiC,CAC/D,CAAC;QACV,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iCAAiC,CAAC,SAA8B;QAC1E,QAAQ,SAAS,EAAE,CAAC;YAChB;gBACI,OAAO,UAAU,CAAC;YACtB;gBACI,OAAO,UAAU,CAAC;YACtB;gBACI,OAAO,SAAS,CAAC;QACzB,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,mCAAmC,CAAC,GAA8B;QAC5E,QAAQ,GAAG,EAAE,CAAC;YACV;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,mBAAmB,CAAC;YAC/B;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,kBAAkB,CAAC;QAClC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,mCAAmC,CAAC,MAAc;QAC5D,QAAQ,MAAM,EAAE,CAAC;YACb,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,mBAAmB;gBACpB,4DAAoD;YACxD,KAAK,kBAAkB;gBACnB,2DAAmD;QAC3D,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iDAAiD,CAC3D,UAAkB,EAClB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,+IAA+I,CAClJ,CAAC,UAAU,CAAC,gBAAgB,CAAC,iDAAiD,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;QAEvC,MAAM,OAAO,GAAkB;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,WAAW;SAC3B,CAAC;QAEF,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,uBAAuB,CACjC,mBAA8C,EAC9C,UAAkB,EAClB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,OAAO,GAAkB,gBAAgB,CAAC,iDAAiD,CAC7F,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;QAEF,QAAQ,mBAAmB,EAAE,CAAC;YAC1B;gBACI,gEAAgE;gBAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACjC;gBACI,gEAAgE;gBAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAChC;gBACI,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,gCAAgC,mBAAmB,kBAAkB,CACxE,CAAC,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;CACJ;AAnID,4CAmIC"}

package/dist/crypto-layer/encryption/BaseKeyHandle.d.ts

@@ -0,0 +1,59 @@
+import { ISerializable, ISerialized, SerializableAsync } from "@js-soft/ts-serval";
+import { KeyHandle, KeySpec, Provider } from "@nmshd/rs-crypto-types";
+import { CoreBuffer, ICoreBuffer } from "../../CoreBuffer";
+import { CryptoSerializableAsync } from "../../CryptoSerializable";
+import { ProviderIdentifier } from "../CryptoLayerProviders";
+export interface IBaseKeyHandleSerialized extends ISerialized {
+    kid: string;
+    pnm: string;
+    spc: KeySpec;
+}
+export interface IBaseKeyHandle extends ISerializable {
+    id: string;
+    providerName: string;
+    spec: KeySpec;
+}
+export interface BaseKeyHandleConstructor<T extends BaseKeyHandle> {
+    new (): T;
+    deserialize(value: string): Promise<T>;
+    fromProviderAndKeyHandle(provider: Provider, keyHandle: KeyHandle, other?: {
+        providerName?: string;
+        keyId?: string;
+        keySpec?: KeySpec;
+    }): Promise<T>;
+    fromAny(value: any): Promise<T>;
+}
+/**
+ * Represents a handle to a secret key used for symmetric encryption/decryption within the crypto layer.
+ * This handle encapsulates a reference to the key material, managed by the underlying crypto provider,
+ * without exposing the raw key material directly.
+ */
+export declare abstract class BaseKeyHandle extends CryptoSerializableAsync implements IBaseKeyHandle {
+    id: string;
+    providerName: string;
+    spec: KeySpec;
+    provider: Provider;
+    keyHandle: KeyHandle;
+    /**
+     * Deserializes an object representation of a {@link BaseKeyHandle}.
+     *
+     * This method is not able to import raw keys or {@link KeyHandle}.
+     */
+    static from<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: BaseKeyHandleConstructor<T> | IBaseKeyHandle | CoreBuffer): Promise<T>;
+    /** @see from */
+    static fromJSON<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: IBaseKeyHandleSerialized): Promise<T>;
+    /** @see from */
+    static fromBase64<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: string): Promise<T>;
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child from an existing {@link KeyHandle}.
+     */
+    static fromProviderAndKeyHandle<T extends BaseKeyHandle>(this: new () => T, provider: Provider, keyHandle: KeyHandle): Promise<T>;
+    protected static preFrom(value: any): any;
+    static postFrom<T extends SerializableAsync>(value: T): Promise<T>;
+}
+export declare abstract class ImportableBaseKeyHandle extends BaseKeyHandle {
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child by importing a raw key into a provider.
+     */
+    static fromRawKey<T extends ImportableBaseKeyHandle>(this: BaseKeyHandleConstructor<T>, providerIdent: ProviderIdentifier, rawKey: ICoreBuffer, spec: KeySpec): Promise<T>;
+}

package/dist/crypto-layer/encryption/BaseKeyHandle.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImportableBaseKeyHandle = exports.BaseKeyHandle = void 0;
+const ts_serval_1 = require("@js-soft/ts-serval");
+const checks_1 = require("@nmshd/rs-crypto-types/checks");
+const CoreBuffer_1 = require("../../CoreBuffer");
+const CryptoError_1 = require("../../CryptoError");
+const CryptoErrorCode_1 = require("../../CryptoErrorCode");
+const CryptoSerializable_1 = require("../../CryptoSerializable");
+const CryptoLayerProviders_1 = require("../CryptoLayerProviders");
+/**
+ * Represents a handle to a secret key used for symmetric encryption/decryption within the crypto layer.
+ * This handle encapsulates a reference to the key material, managed by the underlying crypto provider,
+ * without exposing the raw key material directly.
+ */
+let BaseKeyHandle = class BaseKeyHandle extends CryptoSerializable_1.CryptoSerializableAsync {
+    /**
+     * Deserializes an object representation of a {@link BaseKeyHandle}.
+     *
+     * This method is not able to import raw keys or {@link KeyHandle}.
+     */
+    static async from(value) {
+        return await this.fromAny(value);
+    }
+    /** @see from */
+    static async fromJSON(value) {
+        return await this.fromAny(value);
+    }
+    /** @see from */
+    static async fromBase64(value) {
+        return await this.deserialize(CoreBuffer_1.CoreBuffer.base64_utf8(value));
+    }
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child from an existing {@link KeyHandle}.
+     */
+    static async fromProviderAndKeyHandle(provider, keyHandle) {
+        const result = new this();
+        [result.providerName, result.id, result.spec] = await Promise.all([
+            provider.providerName(),
+            keyHandle.id(),
+            keyHandle.spec()
+        ]);
+        result.provider = provider;
+        result.keyHandle = keyHandle;
+        return result;
+    }
+    static preFrom(value) {
+        if (value.kid) {
+            value = {
+                id: value.kid,
+                providerName: value.pnm,
+                spec: value.spc
+            };
+        }
+        return value;
+    }
+    static async postFrom(value) {
+        if (!(value instanceof this)) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.DeserializeValidation, "Expected 'BaseKeyHandle' in postFrom.");
+        }
+        const provider = (0, CryptoLayerProviders_1.getProvider)({ providerName: value.providerName });
+        const keyHandle = await provider.loadKey(value.id);
+        value.keyHandle = keyHandle;
+        value.provider = provider;
+        return value;
+    }
+};
+exports.BaseKeyHandle = BaseKeyHandle;
+__decorate([
+    (0, ts_serval_1.validate)(),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", String)
+], BaseKeyHandle.prototype, "id", void 0);
+__decorate([
+    (0, ts_serval_1.validate)(),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", String)
+], BaseKeyHandle.prototype, "providerName", void 0);
+__decorate([
+    (0, ts_serval_1.validate)({
+        customValidator: (value) => {
+            if ((0, checks_1.isKeySpec)(value))
+                return undefined;
+            return "Is not of type KeySpec.";
+        }
+    }),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", Object)
+], BaseKeyHandle.prototype, "spec", void 0);
+exports.BaseKeyHandle = BaseKeyHandle = __decorate([
+    (0, ts_serval_1.type)("BaseKeyHandle")
+], BaseKeyHandle);
+class ImportableBaseKeyHandle extends BaseKeyHandle {
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child by importing a raw key into a provider.
+     */
+    static async fromRawKey(providerIdent, rawKey, spec) {
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        let keyHandle;
+        try {
+            keyHandle = await provider.importKey(spec, rawKey.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalImportOfKey, "Failed to import raw symmetric key.", undefined, e, ImportableBaseKeyHandle.fromRawKey);
+        }
+        return await this.fromProviderAndKeyHandle(provider, keyHandle);
+    }
+}
+exports.ImportableBaseKeyHandle = ImportableBaseKeyHandle;
+//# sourceMappingURL=BaseKeyHandle.js.map

package/dist/crypto-layer/encryption/BaseKeyHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseKeyHandle.js","sourceRoot":"","sources":["../../../src/crypto-layer/encryption/BaseKeyHandle.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAA8G;AAE9G,0DAA0D;AAC1D,iDAA2D;AAC3D,mDAAgD;AAChD,2DAAwD;AACxD,iEAAmE;AACnE,kEAA0E;AA0B1E;;;;GAIG;AAEI,IAAe,aAAa,GAA5B,MAAe,aAAc,SAAQ,4CAAuB;IAqB/D;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAEpB,KAAgE;QAEhE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,QAAQ,CAExB,KAA+B;QAE/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,UAAU,CAE1B,KAAa;QAEb,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAExC,QAAkB,EAClB,SAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAE1B,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,QAAQ,CAAC,YAAY,EAAE;YACvB,SAAS,CAAC,EAAE,EAAE;YACd,SAAS,CAAC,IAAI,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,MAAM,CAAU,OAAO,CAAC,KAAU;QACxC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,KAAK,GAAG;gBACJ,EAAE,EAAE,KAAK,CAAC,GAAG;gBACb,YAAY,EAAE,KAAK,CAAC,GAAG;gBACvB,IAAI,EAAE,KAAK,CAAC,GAAG;aAClB,CAAC;QACN,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAEM,MAAM,CAAU,KAAK,CAAC,QAAQ,CAA8B,KAAQ;QACvE,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAW,CAAC,iCAAe,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEnD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AA9FqB,sCAAa;AAGxB;IAFN,IAAA,oBAAQ,GAAE;IACV,IAAA,qBAAS,GAAE;;yCACM;AAIX;IAFN,IAAA,oBAAQ,GAAE;IACV,IAAA,qBAAS,GAAE;;mDACgB;AASrB;IAPN,IAAA,oBAAQ,EAAC;QACN,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAA,kBAAS,EAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,yBAAyB,CAAC;QACrC,CAAC;KACJ,CAAC;IACD,IAAA,qBAAS,GAAE;;2CACS;wBAhBH,aAAa;IADlC,IAAA,gBAAI,EAAC,eAAe,CAAC;GACA,aAAa,CA8FlC;AAED,MAAsB,uBAAwB,SAAQ,aAAa;IAC/D;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,UAAU,CAE1B,aAAiC,EACjC,MAAmB,EACnB,IAAa;QAEb,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,cAAc,EAC9B,qCAAqC,EACrC,SAAS,EACT,CAAU,EACV,uBAAuB,CAAC,UAAU,CACrC,CAAC;QACN,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACJ;AAzBD,0DAyBC"}

package/dist/crypto-layer/encryption/CryptoEncryptionHandle.d.ts

@@ -0,0 +1,27 @@
+import { Provider } from "@nmshd/rs-crypto-types";
+import { CoreBuffer } from "../../CoreBuffer";
+import { CryptoCipher } from "../../encryption/CryptoCipher";
+import { CryptoEncryptionAlgorithm } from "../../encryption/CryptoEncryption";
+import { CryptoSecretKey } from "../../encryption/CryptoSecretKey";
+import { CryptoHashAlgorithm } from "../../hash/CryptoHash";
+import { ProviderIdentifier } from "../CryptoLayerProviders";
+import { BaseKeyHandle } from "./BaseKeyHandle";
+import { DeviceBoundKeyHandle } from "./DeviceBoundKeyHandle";
+import { PortableDerivedKeyHandle } from "./PortableDerivedKeyHandle";
+import { PortableKeyHandle } from "./PortableKeyHandle";
+export declare class CryptoEncryptionHandle {
+    private static generateKeyHandle;
+    static generateDeviceBoundKeyHandle(providerIdent: ProviderIdentifier, encryptionAlgorithm: CryptoEncryptionAlgorithm, hashAlgorithm: CryptoHashAlgorithm): Promise<DeviceBoundKeyHandle>;
+    static generatePortableKeyHandle(providerIdent: ProviderIdentifier, encryptionAlgorithm: CryptoEncryptionAlgorithm, hashAlgorithm: CryptoHashAlgorithm): Promise<PortableKeyHandle>;
+    static encrypt<T extends BaseKeyHandle>(plaintext: CoreBuffer, secretKeyHandle: T, nonce?: CoreBuffer): Promise<CryptoCipher>;
+    static encryptWithCounter<T extends BaseKeyHandle>(plaintext: CoreBuffer, secretKeyHandle: T, nonce: CoreBuffer, counter: number): Promise<CryptoCipher>;
+    static decrypt<T extends BaseKeyHandle>(cipher: CryptoCipher, secretKeyHandle: T, nonce?: CoreBuffer): Promise<CoreBuffer>;
+    static decryptWithCounter<T extends BaseKeyHandle>(cipher: CryptoCipher, secretKeyHandle: T, nonce: CoreBuffer, counter: number): Promise<CoreBuffer>;
+    static createNonce(algorithm: CryptoEncryptionAlgorithm, provider: Provider): Promise<CoreBuffer>;
+    static extractRawKey(portableKeyHandle: PortableKeyHandle | PortableDerivedKeyHandle): Promise<CoreBuffer>;
+    static cryptoSecretKeyFromPortableKeyHandle(portableKeyHandle: PortableKeyHandle | PortableDerivedKeyHandle): Promise<CryptoSecretKey>;
+    private static keyHandleFromCryptoSecretKey;
+    static portableKeyHandleFromCryptoSecretKey(providerIdent: ProviderIdentifier, cryptoSecretKey: CryptoSecretKey, signingHash?: CryptoHashAlgorithm): Promise<PortableKeyHandle>;
+    static portableDerivedKeyHandleFromCryptoSecretKey(providerIdent: ProviderIdentifier, cryptoSecretKey: CryptoSecretKey, signingHash?: CryptoHashAlgorithm): Promise<PortableDerivedKeyHandle>;
+    private static _addCounter;
+}

package/dist/crypto-layer/encryption/CryptoEncryptionHandle.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoEncryptionHandle = void 0;
+const CoreBuffer_1 = require("../../CoreBuffer");
+const CryptoError_1 = require("../../CryptoError");
+const CryptoErrorCode_1 = require("../../CryptoErrorCode");
+const CryptoValidation_1 = require("../../CryptoValidation");
+const CryptoCipher_1 = require("../../encryption/CryptoCipher");
+const CryptoSecretKey_1 = require("../../encryption/CryptoSecretKey");
+const CryptoLayerProviders_1 = require("../CryptoLayerProviders");
+const CryptoLayerUtils_1 = require("../CryptoLayerUtils");
+const DeviceBoundKeyHandle_1 = require("./DeviceBoundKeyHandle");
+const PortableDerivedKeyHandle_1 = require("./PortableDerivedKeyHandle");
+const PortableKeyHandle_1 = require("./PortableKeyHandle");
+class CryptoEncryptionHandle {
+    static async generateKeyHandle(constructor, providerIdent, spec) {
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        const keyHandle = await provider.createKey(spec);
+        const secretKeyHandle = await constructor.fromProviderAndKeyHandle(provider, keyHandle, {
+            keySpec: spec
+        });
+        return secretKeyHandle;
+    }
+    static async generateDeviceBoundKeyHandle(providerIdent, encryptionAlgorithm, hashAlgorithm) {
+        const deviceBoundSpec = {
+            cipher: CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(encryptionAlgorithm),
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(hashAlgorithm),
+            ephemeral: false,
+            non_exportable: true
+        };
+        return await this.generateKeyHandle(DeviceBoundKeyHandle_1.DeviceBoundKeyHandle, providerIdent, deviceBoundSpec);
+    }
+    static async generatePortableKeyHandle(providerIdent, encryptionAlgorithm, hashAlgorithm) {
+        const portableSpec = {
+            cipher: CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(encryptionAlgorithm),
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(hashAlgorithm),
+            ephemeral: false,
+            non_exportable: false
+        };
+        return await this.generateKeyHandle(PortableKeyHandle_1.PortableKeyHandle, providerIdent, portableSpec);
+    }
+    static async encrypt(plaintext, secretKeyHandle, nonce) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        if (nonce === undefined || nonce.buffer.length === 0) {
+            nonce = await this.createNonce(encryptionAlgorithm, secretKeyHandle.provider);
+        }
+        else {
+            CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        }
+        let cipher;
+        try {
+            cipher = await secretKeyHandle.keyHandle.encryptWithIv(plaintext.buffer, nonce.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.encrypt);
+        }
+        return CryptoCipher_1.CryptoCipher.from({
+            cipher: CoreBuffer_1.CoreBuffer.from(cipher),
+            algorithm: encryptionAlgorithm,
+            nonce
+        });
+    }
+    static async encryptWithCounter(plaintext, secretKeyHandle, nonce, counter) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        CryptoValidation_1.CryptoValidation.checkCounter(counter);
+        CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        const publicNonce = this._addCounter(nonce.buffer, counter);
+        let cipher;
+        try {
+            cipher = await secretKeyHandle.keyHandle.encryptWithIv(plaintext.buffer, publicNonce.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.encryptWithCounter);
+        }
+        return CryptoCipher_1.CryptoCipher.from({
+            cipher: CoreBuffer_1.CoreBuffer.from(cipher),
+            algorithm: encryptionAlgorithm,
+            counter
+        });
+    }
+    static async decrypt(cipher, secretKeyHandle, nonce) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        let publicNonce;
+        if (nonce !== undefined) {
+            CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+            publicNonce = nonce.buffer;
+        }
+        else if (cipher.nonce !== undefined) {
+            publicNonce = cipher.nonce.buffer;
+        }
+        else {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionWrongNonce, "Cipher does not contain a nonce and no nonce is given.").setContext(CryptoEncryptionHandle.decrypt);
+        }
+        try {
+            const buffer = await secretKeyHandle.keyHandle.decryptData(cipher.cipher.buffer, publicNonce);
+            return CoreBuffer_1.CoreBuffer.from(buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.decrypt);
+        }
+    }
+    static async decryptWithCounter(cipher, secretKeyHandle, nonce, counter) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        CryptoValidation_1.CryptoValidation.checkCounter(counter);
+        CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        const publicNonce = this._addCounter(nonce.buffer, counter);
+        try {
+            const buffer = await secretKeyHandle.keyHandle.decryptData(cipher.cipher.buffer, publicNonce.buffer);
+            return CoreBuffer_1.CoreBuffer.from(buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionDecrypt, `${e}`, undefined, e, CryptoEncryptionHandle.decryptWithCounter);
+        }
+    }
+    static async createNonce(algorithm, provider) {
+        let nonceLength;
+        switch (algorithm) {
+            case 1 /* CryptoEncryptionAlgorithm.AES128_GCM */:
+            case 2 /* CryptoEncryptionAlgorithm.AES256_GCM */:
+            case 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */:
+                nonceLength = 12;
+                break;
+            case 4 /* CryptoEncryptionAlgorithm.AES128_CBC */:
+            case 5 /* CryptoEncryptionAlgorithm.AES256_CBC */:
+                nonceLength = 16;
+                break;
+            case 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */:
+                nonceLength = 24;
+                break;
+        }
+        const buffer = await provider.getRandom(nonceLength);
+        return CoreBuffer_1.CoreBuffer.from(buffer);
+    }
+    static async extractRawKey(portableKeyHandle) {
+        const rawKey = await portableKeyHandle.keyHandle.extractKey();
+        return new CoreBuffer_1.CoreBuffer(rawKey);
+    }
+    static async cryptoSecretKeyFromPortableKeyHandle(portableKeyHandle) {
+        const rawKeyPromise = CryptoEncryptionHandle.extractRawKey(portableKeyHandle);
+        const algorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(portableKeyHandle.spec.cipher);
+        const cryptoSecretKeyObj = {
+            algorithm: algorithm,
+            secretKey: await rawKeyPromise
+        };
+        return CryptoSecretKey_1.CryptoSecretKey.from(cryptoSecretKeyObj);
+    }
+    static async keyHandleFromCryptoSecretKey(constructor, providerIdent, cryptoSecretKey, signingHash, ephemeral) {
+        const cipher = CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(cryptoSecretKey.algorithm);
+        const keySpec = {
+            cipher: cipher,
+            ephemeral: ephemeral,
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(signingHash),
+            non_exportable: false
+        };
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        const keyHandle = await provider.importKey(keySpec, cryptoSecretKey.secretKey.buffer);
+        return await constructor.fromProviderAndKeyHandle(provider, keyHandle);
+    }
+    static async portableKeyHandleFromCryptoSecretKey(providerIdent, cryptoSecretKey, signingHash = 2 /* CryptoHashAlgorithm.SHA512 */) {
+        return await CryptoEncryptionHandle.keyHandleFromCryptoSecretKey(PortableKeyHandle_1.PortableKeyHandle, providerIdent, cryptoSecretKey, signingHash, false);
+    }
+    static async portableDerivedKeyHandleFromCryptoSecretKey(providerIdent, cryptoSecretKey, signingHash = 2 /* CryptoHashAlgorithm.SHA512 */) {
+        return await CryptoEncryptionHandle.keyHandleFromCryptoSecretKey(PortableDerivedKeyHandle_1.PortableDerivedKeyHandle, providerIdent, cryptoSecretKey, signingHash, true);
+    }
+    static _addCounter(nonce, counter) {
+        let buffer;
+        if (nonce instanceof Uint8Array) {
+            buffer = new CoreBuffer_1.CoreBuffer(nonce);
+        }
+        else if (nonce instanceof CoreBuffer_1.CoreBuffer) {
+            buffer = nonce;
+        }
+        else {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionWrongNonce).setContext(CryptoEncryptionHandle.decryptWithCounter);
+        }
+        const clone = buffer.clone().add(counter);
+        return clone;
+    }
+}
+exports.CryptoEncryptionHandle = CryptoEncryptionHandle;
+//# sourceMappingURL=CryptoEncryptionHandle.js.map