@nmshd/crypto 2.1.2 → 2.2.0-alpha.1

package/dist/crypto-layer/CryptoLayerUtils.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoLayerUtils = void 0;
+const CryptoError_1 = require("../CryptoError");
+const CryptoErrorCode_1 = require("../CryptoErrorCode");
+class CryptoLayerUtils {
+    static asymSpecFromCryptoExchangeOrSignatureAlgorithm(algorithm) {
+        switch (algorithm) {
+            case 1 /* CryptoExchangeAlgorithm.ECDH_P256 */:
+                return "P256";
+            case 2 /* CryptoExchangeAlgorithm.ECDH_P521 */:
+                return "P521";
+            case 3 /* CryptoExchangeAlgorithm.ECDH_X25519 */:
+                return "Curve25519";
+            case 1 /* CryptoSignatureAlgorithm.ECDSA_P256 */:
+                return "P256";
+            case 2 /* CryptoSignatureAlgorithm.ECDSA_P521 */:
+                return "P521";
+            case 3 /* CryptoSignatureAlgorithm.ECDSA_ED25519 */:
+                return "Curve25519";
+        }
+    }
+    static cryptoHashAlgorithmFromCryptoHash(cryptoHash) {
+        // eslint-disable-next-line @typescript-eslint/switch-exhaustiveness-check
+        switch (cryptoHash) {
+            case "Sha2_256":
+                return 1 /* CryptoHashAlgorithm.SHA256 */;
+            case "Sha2_512":
+                return 2 /* CryptoHashAlgorithm.SHA512 */;
+            case "Blake2b":
+                return 3 /* CryptoHashAlgorithm.BLAKE2B */;
+            default:
+                throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalUnsupportedAlgorithm, `Hash function ${cryptoHash} is not supported by ts crypto.`);
+        }
+    }
+    static cryptoHashFromCryptoHashAlgorithm(algorithm) {
+        switch (algorithm) {
+            case 1 /* CryptoHashAlgorithm.SHA256 */:
+                return "Sha2_256";
+            case 2 /* CryptoHashAlgorithm.SHA512 */:
+                return "Sha2_512";
+            case 3 /* CryptoHashAlgorithm.BLAKE2B */:
+                return "Blake2b";
+        }
+    }
+    static cipherFromCryptoEncryptionAlgorithm(alg) {
+        switch (alg) {
+            case 1 /* CryptoEncryptionAlgorithm.AES128_GCM */:
+                return "AesGcm128";
+            case 2 /* CryptoEncryptionAlgorithm.AES256_GCM */:
+                return "AesGcm256";
+            case 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */:
+                return "XChaCha20Poly1305";
+            case 4 /* CryptoEncryptionAlgorithm.AES128_CBC */:
+                return "AesCbc128";
+            case 5 /* CryptoEncryptionAlgorithm.AES256_CBC */:
+                return "AesCbc256";
+            case 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */:
+                return "ChaCha20Poly1305";
+        }
+    }
+    static cryptoEncryptionAlgorithmFromCipher(cipher) {
+        switch (cipher) {
+            case "AesGcm128":
+                return 1 /* CryptoEncryptionAlgorithm.AES128_GCM */;
+            case "AesGcm256":
+                return 2 /* CryptoEncryptionAlgorithm.AES256_GCM */;
+            case "AesCbc128":
+                return 4 /* CryptoEncryptionAlgorithm.AES128_CBC */;
+            case "AesCbc256":
+                return 5 /* CryptoEncryptionAlgorithm.AES256_CBC */;
+            case "XChaCha20Poly1305":
+                return 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */;
+            case "ChaCha20Poly1305":
+                return 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */;
+        }
+    }
+    static argon2OptionsFromIterationsMemLimitAndParallelism(iterations, memlimit, parallelism) {
+        const kibiByteBase = 2 ^ 10;
+        if (memlimit % kibiByteBase !== 0) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, "rust-crypto uses kibibytes for Argon2. The `memlimit` parameter (in bytes) is not a multiple of `2^10` and thus not convertible without loss.").setContext(CryptoLayerUtils.argon2OptionsFromIterationsMemLimitAndParallelism);
+        }
+        const memory = memlimit / kibiByteBase;
+        const options = {
+            memory: memory,
+            iterations: iterations,
+            parallelism: parallelism
+        };
+        return options;
+    }
+    static kdfFromCryptoDerivation(derivationAlgorithm, iterations, memlimit, parallelism) {
+        const options = CryptoLayerUtils.argon2OptionsFromIterationsMemLimitAndParallelism(iterations, memlimit, parallelism);
+        switch (derivationAlgorithm) {
+            case "argon2id" /* CryptoDerivationAlgorithm.ARGON2ID */:
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                return { Argon2id: options };
+            case "argon2i" /* CryptoDerivationAlgorithm.ARGON2I */:
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                return { Argon2i: options };
+            default:
+                throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.WrongParameters, `Crypto derivation algorithm '${derivationAlgorithm}' not supported.`).setContext(CryptoLayerUtils.kdfFromCryptoDerivation);
+        }
+    }
+}
+exports.CryptoLayerUtils = CryptoLayerUtils;
+//# sourceMappingURL=CryptoLayerUtils.js.map

package/dist/crypto-layer/CryptoLayerUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoLayerUtils.js","sourceRoot":"","sources":["../../src/crypto-layer/CryptoLayerUtils.ts"],"names":[],"mappings":";;;AAEA,gDAA6C;AAC7C,wDAAqD;AAKrD,MAAa,gBAAgB;IAClB,MAAM,CAAC,8CAA8C,CACxD,SAA6D;QAE7D,QAAQ,SAAS,EAAE,CAAC;YAChB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,YAAY,CAAC;YACxB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,MAAM,CAAC;YAClB;gBACI,OAAO,YAAY,CAAC;QAC5B,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iCAAiC,CAAC,UAAsB;QAClE,0EAA0E;QAC1E,QAAQ,UAAU,EAAE,CAAC;YACjB,KAAK,UAAU;gBACX,0CAAkC;YACtC,KAAK,UAAU;gBACX,0CAAkC;YACtC,KAAK,SAAS;gBACV,2CAAmC;YACvC;gBACI,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,uBAAuB,EACvC,iBAAiB,UAAU,iCAAiC,CAC/D,CAAC;QACV,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iCAAiC,CAAC,SAA8B;QAC1E,QAAQ,SAAS,EAAE,CAAC;YAChB;gBACI,OAAO,UAAU,CAAC;YACtB;gBACI,OAAO,UAAU,CAAC;YACtB;gBACI,OAAO,SAAS,CAAC;QACzB,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,mCAAmC,CAAC,GAA8B;QAC5E,QAAQ,GAAG,EAAE,CAAC;YACV;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,mBAAmB,CAAC;YAC/B;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,WAAW,CAAC;YACvB;gBACI,OAAO,kBAAkB,CAAC;QAClC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,mCAAmC,CAAC,MAAc;QAC5D,QAAQ,MAAM,EAAE,CAAC;YACb,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,WAAW;gBACZ,oDAA4C;YAChD,KAAK,mBAAmB;gBACpB,4DAAoD;YACxD,KAAK,kBAAkB;gBACnB,2DAAmD;QAC3D,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,iDAAiD,CAC3D,UAAkB,EAClB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,+IAA+I,CAClJ,CAAC,UAAU,CAAC,gBAAgB,CAAC,iDAAiD,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;QAEvC,MAAM,OAAO,GAAkB;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,WAAW;SAC3B,CAAC;QAEF,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,uBAAuB,CACjC,mBAA8C,EAC9C,UAAkB,EAClB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,OAAO,GAAkB,gBAAgB,CAAC,iDAAiD,CAC7F,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;QAEF,QAAQ,mBAAmB,EAAE,CAAC;YAC1B;gBACI,gEAAgE;gBAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACjC;gBACI,gEAAgE;gBAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAChC;gBACI,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,eAAe,EAC/B,gCAAgC,mBAAmB,kBAAkB,CACxE,CAAC,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;CACJ;AAnID,4CAmIC"}

package/dist/crypto-layer/encryption/BaseKeyHandle.d.ts

@@ -0,0 +1,59 @@
+import { ISerializable, ISerialized, SerializableAsync } from "@js-soft/ts-serval";
+import { KeyHandle, KeySpec, Provider } from "@nmshd/rs-crypto-types";
+import { CoreBuffer, ICoreBuffer } from "../../CoreBuffer";
+import { CryptoSerializableAsync } from "../../CryptoSerializable";
+import { ProviderIdentifier } from "../CryptoLayerProviders";
+export interface IBaseKeyHandleSerialized extends ISerialized {
+    kid: string;
+    pnm: string;
+    spc: KeySpec;
+}
+export interface IBaseKeyHandle extends ISerializable {
+    id: string;
+    providerName: string;
+    spec: KeySpec;
+}
+export interface BaseKeyHandleConstructor<T extends BaseKeyHandle> {
+    new (): T;
+    deserialize(value: string): Promise<T>;
+    fromProviderAndKeyHandle(provider: Provider, keyHandle: KeyHandle, other?: {
+        providerName?: string;
+        keyId?: string;
+        keySpec?: KeySpec;
+    }): Promise<T>;
+    fromAny(value: any): Promise<T>;
+}
+/**
+ * Represents a handle to a secret key used for symmetric encryption/decryption within the crypto layer.
+ * This handle encapsulates a reference to the key material, managed by the underlying crypto provider,
+ * without exposing the raw key material directly.
+ */
+export declare abstract class BaseKeyHandle extends CryptoSerializableAsync implements IBaseKeyHandle {
+    id: string;
+    providerName: string;
+    spec: KeySpec;
+    provider: Provider;
+    keyHandle: KeyHandle;
+    /**
+     * Deserializes an object representation of a {@link BaseKeyHandle}.
+     *
+     * This method is not able to import raw keys or {@link KeyHandle}.
+     */
+    static from<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: BaseKeyHandleConstructor<T> | IBaseKeyHandle | CoreBuffer): Promise<T>;
+    /** @see from */
+    static fromJSON<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: IBaseKeyHandleSerialized): Promise<T>;
+    /** @see from */
+    static fromBase64<T extends BaseKeyHandle>(this: BaseKeyHandleConstructor<T>, value: string): Promise<T>;
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child from an existing {@link KeyHandle}.
+     */
+    static fromProviderAndKeyHandle<T extends BaseKeyHandle>(this: new () => T, provider: Provider, keyHandle: KeyHandle): Promise<T>;
+    protected static preFrom(value: any): any;
+    static postFrom<T extends SerializableAsync>(value: T): Promise<T>;
+}
+export declare abstract class ImportableBaseKeyHandle extends BaseKeyHandle {
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child by importing a raw key into a provider.
+     */
+    static fromRawKey<T extends ImportableBaseKeyHandle>(this: BaseKeyHandleConstructor<T>, providerIdent: ProviderIdentifier, rawKey: ICoreBuffer, spec: KeySpec): Promise<T>;
+}

package/dist/crypto-layer/encryption/BaseKeyHandle.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImportableBaseKeyHandle = exports.BaseKeyHandle = void 0;
+const ts_serval_1 = require("@js-soft/ts-serval");
+const checks_1 = require("@nmshd/rs-crypto-types/checks");
+const CoreBuffer_1 = require("../../CoreBuffer");
+const CryptoError_1 = require("../../CryptoError");
+const CryptoErrorCode_1 = require("../../CryptoErrorCode");
+const CryptoSerializable_1 = require("../../CryptoSerializable");
+const CryptoLayerProviders_1 = require("../CryptoLayerProviders");
+/**
+ * Represents a handle to a secret key used for symmetric encryption/decryption within the crypto layer.
+ * This handle encapsulates a reference to the key material, managed by the underlying crypto provider,
+ * without exposing the raw key material directly.
+ */
+let BaseKeyHandle = class BaseKeyHandle extends CryptoSerializable_1.CryptoSerializableAsync {
+    /**
+     * Deserializes an object representation of a {@link BaseKeyHandle}.
+     *
+     * This method is not able to import raw keys or {@link KeyHandle}.
+     */
+    static async from(value) {
+        return await this.fromAny(value);
+    }
+    /** @see from */
+    static async fromJSON(value) {
+        return await this.fromAny(value);
+    }
+    /** @see from */
+    static async fromBase64(value) {
+        return await this.deserialize(CoreBuffer_1.CoreBuffer.base64_utf8(value));
+    }
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child from an existing {@link KeyHandle}.
+     */
+    static async fromProviderAndKeyHandle(provider, keyHandle) {
+        const result = new this();
+        [result.providerName, result.id, result.spec] = await Promise.all([
+            provider.providerName(),
+            keyHandle.id(),
+            keyHandle.spec()
+        ]);
+        result.provider = provider;
+        result.keyHandle = keyHandle;
+        return result;
+    }
+    static preFrom(value) {
+        if (value.kid) {
+            value = {
+                id: value.kid,
+                providerName: value.pnm,
+                spec: value.spc
+            };
+        }
+        return value;
+    }
+    static async postFrom(value) {
+        if (!(value instanceof this)) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.DeserializeValidation, "Expected 'BaseKeyHandle' in postFrom.");
+        }
+        const provider = (0, CryptoLayerProviders_1.getProvider)({ providerName: value.providerName });
+        const keyHandle = await provider.loadKey(value.id);
+        value.keyHandle = keyHandle;
+        value.provider = provider;
+        return value;
+    }
+};
+exports.BaseKeyHandle = BaseKeyHandle;
+__decorate([
+    (0, ts_serval_1.validate)(),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", String)
+], BaseKeyHandle.prototype, "id", void 0);
+__decorate([
+    (0, ts_serval_1.validate)(),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", String)
+], BaseKeyHandle.prototype, "providerName", void 0);
+__decorate([
+    (0, ts_serval_1.validate)({
+        customValidator: (value) => {
+            if ((0, checks_1.isKeySpec)(value))
+                return undefined;
+            return "Is not of type KeySpec.";
+        }
+    }),
+    (0, ts_serval_1.serialize)(),
+    __metadata("design:type", Object)
+], BaseKeyHandle.prototype, "spec", void 0);
+exports.BaseKeyHandle = BaseKeyHandle = __decorate([
+    (0, ts_serval_1.type)("BaseKeyHandle")
+], BaseKeyHandle);
+class ImportableBaseKeyHandle extends BaseKeyHandle {
+    /**
+     * Creates a new {@link BaseKeyHandle} or its child by importing a raw key into a provider.
+     */
+    static async fromRawKey(providerIdent, rawKey, spec) {
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        let keyHandle;
+        try {
+            keyHandle = await provider.importKey(spec, rawKey.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.CalImportOfKey, "Failed to import raw symmetric key.", undefined, e, ImportableBaseKeyHandle.fromRawKey);
+        }
+        return await this.fromProviderAndKeyHandle(provider, keyHandle);
+    }
+}
+exports.ImportableBaseKeyHandle = ImportableBaseKeyHandle;
+//# sourceMappingURL=BaseKeyHandle.js.map

package/dist/crypto-layer/encryption/BaseKeyHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseKeyHandle.js","sourceRoot":"","sources":["../../../src/crypto-layer/encryption/BaseKeyHandle.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAA8G;AAE9G,0DAA0D;AAC1D,iDAA2D;AAC3D,mDAAgD;AAChD,2DAAwD;AACxD,iEAAmE;AACnE,kEAA0E;AA0B1E;;;;GAIG;AAEI,IAAe,aAAa,GAA5B,MAAe,aAAc,SAAQ,4CAAuB;IAqB/D;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAEpB,KAAgE;QAEhE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,QAAQ,CAExB,KAA+B;QAE/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,UAAU,CAE1B,KAAa;QAEb,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAExC,QAAkB,EAClB,SAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAE1B,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,QAAQ,CAAC,YAAY,EAAE;YACvB,SAAS,CAAC,EAAE,EAAE;YACd,SAAS,CAAC,IAAI,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,MAAM,CAAU,OAAO,CAAC,KAAU;QACxC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,KAAK,GAAG;gBACJ,EAAE,EAAE,KAAK,CAAC,GAAG;gBACb,YAAY,EAAE,KAAK,CAAC,GAAG;gBACvB,IAAI,EAAE,KAAK,CAAC,GAAG;aAClB,CAAC;QACN,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAEM,MAAM,CAAU,KAAK,CAAC,QAAQ,CAA8B,KAAQ;QACvE,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAW,CAAC,iCAAe,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEnD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AA9FqB,sCAAa;AAGxB;IAFN,IAAA,oBAAQ,GAAE;IACV,IAAA,qBAAS,GAAE;;yCACM;AAIX;IAFN,IAAA,oBAAQ,GAAE;IACV,IAAA,qBAAS,GAAE;;mDACgB;AASrB;IAPN,IAAA,oBAAQ,EAAC;QACN,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAA,kBAAS,EAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvC,OAAO,yBAAyB,CAAC;QACrC,CAAC;KACJ,CAAC;IACD,IAAA,qBAAS,GAAE;;2CACS;wBAhBH,aAAa;IADlC,IAAA,gBAAI,EAAC,eAAe,CAAC;GACA,aAAa,CA8FlC;AAED,MAAsB,uBAAwB,SAAQ,aAAa;IAC/D;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,UAAU,CAE1B,aAAiC,EACjC,MAAmB,EACnB,IAAa;QAEb,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,cAAc,EAC9B,qCAAqC,EACrC,SAAS,EACT,CAAU,EACV,uBAAuB,CAAC,UAAU,CACrC,CAAC;QACN,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACJ;AAzBD,0DAyBC"}

package/dist/crypto-layer/encryption/CryptoEncryptionHandle.d.ts

@@ -0,0 +1,27 @@
+import { Provider } from "@nmshd/rs-crypto-types";
+import { CoreBuffer } from "../../CoreBuffer";
+import { CryptoCipher } from "../../encryption/CryptoCipher";
+import { CryptoEncryptionAlgorithm } from "../../encryption/CryptoEncryption";
+import { CryptoSecretKey } from "../../encryption/CryptoSecretKey";
+import { CryptoHashAlgorithm } from "../../hash/CryptoHash";
+import { ProviderIdentifier } from "../CryptoLayerProviders";
+import { BaseKeyHandle } from "./BaseKeyHandle";
+import { DeviceBoundKeyHandle } from "./DeviceBoundKeyHandle";
+import { PortableDerivedKeyHandle } from "./PortableDerivedKeyHandle";
+import { PortableKeyHandle } from "./PortableKeyHandle";
+export declare class CryptoEncryptionHandle {
+    private static generateKeyHandle;
+    static generateDeviceBoundKeyHandle(providerIdent: ProviderIdentifier, encryptionAlgorithm: CryptoEncryptionAlgorithm, hashAlgorithm: CryptoHashAlgorithm): Promise<DeviceBoundKeyHandle>;
+    static generatePortableKeyHandle(providerIdent: ProviderIdentifier, encryptionAlgorithm: CryptoEncryptionAlgorithm, hashAlgorithm: CryptoHashAlgorithm): Promise<PortableKeyHandle>;
+    static encrypt<T extends BaseKeyHandle>(plaintext: CoreBuffer, secretKeyHandle: T, nonce?: CoreBuffer): Promise<CryptoCipher>;
+    static encryptWithCounter<T extends BaseKeyHandle>(plaintext: CoreBuffer, secretKeyHandle: T, nonce: CoreBuffer, counter: number): Promise<CryptoCipher>;
+    static decrypt<T extends BaseKeyHandle>(cipher: CryptoCipher, secretKeyHandle: T, nonce?: CoreBuffer): Promise<CoreBuffer>;
+    static decryptWithCounter<T extends BaseKeyHandle>(cipher: CryptoCipher, secretKeyHandle: T, nonce: CoreBuffer, counter: number): Promise<CoreBuffer>;
+    static createNonce(algorithm: CryptoEncryptionAlgorithm, provider: Provider): Promise<CoreBuffer>;
+    static extractRawKey(portableKeyHandle: PortableKeyHandle | PortableDerivedKeyHandle): Promise<CoreBuffer>;
+    static cryptoSecretKeyFromPortableKeyHandle(portableKeyHandle: PortableKeyHandle | PortableDerivedKeyHandle): Promise<CryptoSecretKey>;
+    private static keyHandleFromCryptoSecretKey;
+    static portableKeyHandleFromCryptoSecretKey(providerIdent: ProviderIdentifier, cryptoSecretKey: CryptoSecretKey, signingHash?: CryptoHashAlgorithm): Promise<PortableKeyHandle>;
+    static portableDerivedKeyHandleFromCryptoSecretKey(providerIdent: ProviderIdentifier, cryptoSecretKey: CryptoSecretKey, signingHash?: CryptoHashAlgorithm): Promise<PortableDerivedKeyHandle>;
+    private static _addCounter;
+}

package/dist/crypto-layer/encryption/CryptoEncryptionHandle.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoEncryptionHandle = void 0;
+const CoreBuffer_1 = require("../../CoreBuffer");
+const CryptoError_1 = require("../../CryptoError");
+const CryptoErrorCode_1 = require("../../CryptoErrorCode");
+const CryptoValidation_1 = require("../../CryptoValidation");
+const CryptoCipher_1 = require("../../encryption/CryptoCipher");
+const CryptoSecretKey_1 = require("../../encryption/CryptoSecretKey");
+const CryptoLayerProviders_1 = require("../CryptoLayerProviders");
+const CryptoLayerUtils_1 = require("../CryptoLayerUtils");
+const DeviceBoundKeyHandle_1 = require("./DeviceBoundKeyHandle");
+const PortableDerivedKeyHandle_1 = require("./PortableDerivedKeyHandle");
+const PortableKeyHandle_1 = require("./PortableKeyHandle");
+class CryptoEncryptionHandle {
+    static async generateKeyHandle(constructor, providerIdent, spec) {
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        const keyHandle = await provider.createKey(spec);
+        const secretKeyHandle = await constructor.fromProviderAndKeyHandle(provider, keyHandle, {
+            keySpec: spec
+        });
+        return secretKeyHandle;
+    }
+    static async generateDeviceBoundKeyHandle(providerIdent, encryptionAlgorithm, hashAlgorithm) {
+        const deviceBoundSpec = {
+            cipher: CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(encryptionAlgorithm),
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(hashAlgorithm),
+            ephemeral: false,
+            non_exportable: true
+        };
+        return await this.generateKeyHandle(DeviceBoundKeyHandle_1.DeviceBoundKeyHandle, providerIdent, deviceBoundSpec);
+    }
+    static async generatePortableKeyHandle(providerIdent, encryptionAlgorithm, hashAlgorithm) {
+        const portableSpec = {
+            cipher: CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(encryptionAlgorithm),
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(hashAlgorithm),
+            ephemeral: false,
+            non_exportable: false
+        };
+        return await this.generateKeyHandle(PortableKeyHandle_1.PortableKeyHandle, providerIdent, portableSpec);
+    }
+    static async encrypt(plaintext, secretKeyHandle, nonce) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        if (nonce === undefined || nonce.buffer.length === 0) {
+            nonce = await this.createNonce(encryptionAlgorithm, secretKeyHandle.provider);
+        }
+        else {
+            CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        }
+        let cipher;
+        try {
+            cipher = await secretKeyHandle.keyHandle.encryptWithIv(plaintext.buffer, nonce.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.encrypt);
+        }
+        return CryptoCipher_1.CryptoCipher.from({
+            cipher: CoreBuffer_1.CoreBuffer.from(cipher),
+            algorithm: encryptionAlgorithm,
+            nonce
+        });
+    }
+    static async encryptWithCounter(plaintext, secretKeyHandle, nonce, counter) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        CryptoValidation_1.CryptoValidation.checkCounter(counter);
+        CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        const publicNonce = this._addCounter(nonce.buffer, counter);
+        let cipher;
+        try {
+            cipher = await secretKeyHandle.keyHandle.encryptWithIv(plaintext.buffer, publicNonce.buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.encryptWithCounter);
+        }
+        return CryptoCipher_1.CryptoCipher.from({
+            cipher: CoreBuffer_1.CoreBuffer.from(cipher),
+            algorithm: encryptionAlgorithm,
+            counter
+        });
+    }
+    static async decrypt(cipher, secretKeyHandle, nonce) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        let publicNonce;
+        if (nonce !== undefined) {
+            CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+            publicNonce = nonce.buffer;
+        }
+        else if (cipher.nonce !== undefined) {
+            publicNonce = cipher.nonce.buffer;
+        }
+        else {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionWrongNonce, "Cipher does not contain a nonce and no nonce is given.").setContext(CryptoEncryptionHandle.decrypt);
+        }
+        try {
+            const buffer = await secretKeyHandle.keyHandle.decryptData(cipher.cipher.buffer, publicNonce);
+            return CoreBuffer_1.CoreBuffer.from(buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionEncrypt, `${e}`, undefined, e, CryptoEncryptionHandle.decrypt);
+        }
+    }
+    static async decryptWithCounter(cipher, secretKeyHandle, nonce, counter) {
+        const encryptionAlgorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(secretKeyHandle.spec.cipher);
+        CryptoValidation_1.CryptoValidation.checkCounter(counter);
+        CryptoValidation_1.CryptoValidation.checkNonceForAlgorithm(nonce, encryptionAlgorithm);
+        const publicNonce = this._addCounter(nonce.buffer, counter);
+        try {
+            const buffer = await secretKeyHandle.keyHandle.decryptData(cipher.cipher.buffer, publicNonce.buffer);
+            return CoreBuffer_1.CoreBuffer.from(buffer);
+        }
+        catch (e) {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionDecrypt, `${e}`, undefined, e, CryptoEncryptionHandle.decryptWithCounter);
+        }
+    }
+    static async createNonce(algorithm, provider) {
+        let nonceLength;
+        switch (algorithm) {
+            case 1 /* CryptoEncryptionAlgorithm.AES128_GCM */:
+            case 2 /* CryptoEncryptionAlgorithm.AES256_GCM */:
+            case 6 /* CryptoEncryptionAlgorithm.CHACHA20_POLY1305 */:
+                nonceLength = 12;
+                break;
+            case 4 /* CryptoEncryptionAlgorithm.AES128_CBC */:
+            case 5 /* CryptoEncryptionAlgorithm.AES256_CBC */:
+                nonceLength = 16;
+                break;
+            case 3 /* CryptoEncryptionAlgorithm.XCHACHA20_POLY1305 */:
+                nonceLength = 24;
+                break;
+        }
+        const buffer = await provider.getRandom(nonceLength);
+        return CoreBuffer_1.CoreBuffer.from(buffer);
+    }
+    static async extractRawKey(portableKeyHandle) {
+        const rawKey = await portableKeyHandle.keyHandle.extractKey();
+        return new CoreBuffer_1.CoreBuffer(rawKey);
+    }
+    static async cryptoSecretKeyFromPortableKeyHandle(portableKeyHandle) {
+        const rawKeyPromise = CryptoEncryptionHandle.extractRawKey(portableKeyHandle);
+        const algorithm = CryptoLayerUtils_1.CryptoLayerUtils.cryptoEncryptionAlgorithmFromCipher(portableKeyHandle.spec.cipher);
+        const cryptoSecretKeyObj = {
+            algorithm: algorithm,
+            secretKey: await rawKeyPromise
+        };
+        return CryptoSecretKey_1.CryptoSecretKey.from(cryptoSecretKeyObj);
+    }
+    static async keyHandleFromCryptoSecretKey(constructor, providerIdent, cryptoSecretKey, signingHash, ephemeral) {
+        const cipher = CryptoLayerUtils_1.CryptoLayerUtils.cipherFromCryptoEncryptionAlgorithm(cryptoSecretKey.algorithm);
+        const keySpec = {
+            cipher: cipher,
+            ephemeral: ephemeral,
+            signing_hash: CryptoLayerUtils_1.CryptoLayerUtils.cryptoHashFromCryptoHashAlgorithm(signingHash),
+            non_exportable: false
+        };
+        const provider = (0, CryptoLayerProviders_1.getProvider)(providerIdent);
+        const keyHandle = await provider.importKey(keySpec, cryptoSecretKey.secretKey.buffer);
+        return await constructor.fromProviderAndKeyHandle(provider, keyHandle);
+    }
+    static async portableKeyHandleFromCryptoSecretKey(providerIdent, cryptoSecretKey, signingHash = 2 /* CryptoHashAlgorithm.SHA512 */) {
+        return await CryptoEncryptionHandle.keyHandleFromCryptoSecretKey(PortableKeyHandle_1.PortableKeyHandle, providerIdent, cryptoSecretKey, signingHash, false);
+    }
+    static async portableDerivedKeyHandleFromCryptoSecretKey(providerIdent, cryptoSecretKey, signingHash = 2 /* CryptoHashAlgorithm.SHA512 */) {
+        return await CryptoEncryptionHandle.keyHandleFromCryptoSecretKey(PortableDerivedKeyHandle_1.PortableDerivedKeyHandle, providerIdent, cryptoSecretKey, signingHash, true);
+    }
+    static _addCounter(nonce, counter) {
+        let buffer;
+        if (nonce instanceof Uint8Array) {
+            buffer = new CoreBuffer_1.CoreBuffer(nonce);
+        }
+        else if (nonce instanceof CoreBuffer_1.CoreBuffer) {
+            buffer = nonce;
+        }
+        else {
+            throw new CryptoError_1.CryptoError(CryptoErrorCode_1.CryptoErrorCode.EncryptionWrongNonce).setContext(CryptoEncryptionHandle.decryptWithCounter);
+        }
+        const clone = buffer.clone().add(counter);
+        return clone;
+    }
+}
+exports.CryptoEncryptionHandle = CryptoEncryptionHandle;
+//# sourceMappingURL=CryptoEncryptionHandle.js.map

package/dist/crypto-layer/encryption/CryptoEncryptionHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoEncryptionHandle.js","sourceRoot":"","sources":["../../../src/crypto-layer/encryption/CryptoEncryptionHandle.ts"],"names":[],"mappings":";;;AAEA,iDAA8C;AAC9C,mDAAgD;AAChD,2DAAwD;AACxD,6DAA0D;AAC1D,gEAA6D;AAE7D,sEAAqF;AAErF,kEAA0E;AAC1E,0DAAuD;AAEvD,iEAA8D;AAC9D,yEAAsE;AACtE,2DAAwD;AAExD,MAAa,sBAAsB;IACvB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAClC,WAAwC,EACxC,aAAiC,EACjC,IAAa;QAEb,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE;YACpF,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IAC3B,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC5C,aAAiC,EACjC,mBAA8C,EAC9C,aAAkC;QAElC,MAAM,eAAe,GAAY;YAC7B,MAAM,EAAE,mCAAgB,CAAC,mCAAmC,CAAC,mBAAmB,CAAC;YACjF,YAAY,EAAE,mCAAgB,CAAC,iCAAiC,CAAC,aAAa,CAAC;YAC/E,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;SACvB,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAuB,2CAAoB,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IACpH,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,yBAAyB,CACzC,aAAiC,EACjC,mBAA8C,EAC9C,aAAkC;QAElC,MAAM,YAAY,GAAY;YAC1B,MAAM,EAAE,mCAAgB,CAAC,mCAAmC,CAAC,mBAAmB,CAAC;YACjF,YAAY,EAAE,mCAAgB,CAAC,iCAAiC,CAAC,aAAa,CAAC;YAC/E,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,KAAK;SACxB,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAoB,qCAAiB,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3G,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,OAAO,CACvB,SAAqB,EACrB,eAAkB,EAClB,KAAkB;QAElB,MAAM,mBAAmB,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9G,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACJ,mCAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,iBAAiB,EACjC,GAAG,CAAC,EAAE,EACN,SAAS,EACT,CAAU,EACV,sBAAsB,CAAC,OAAO,CACjC,CAAC;QACN,CAAC;QAED,OAAO,2BAAY,CAAC,IAAI,CAAC;YACrB,MAAM,EAAE,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,mBAAmB;YAC9B,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAClC,SAAqB,EACrB,eAAkB,EAClB,KAAiB,EACjB,OAAe;QAEf,MAAM,mBAAmB,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9G,mCAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,mCAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,iBAAiB,EACjC,GAAG,CAAC,EAAE,EACN,SAAS,EACT,CAAU,EACV,sBAAsB,CAAC,kBAAkB,CAC5C,CAAC;QACN,CAAC;QAED,OAAO,2BAAY,CAAC,IAAI,CAAC;YACrB,MAAM,EAAE,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,mBAAmB;YAC9B,OAAO;SACV,CAAC,CAAC;IACP,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,OAAO,CACvB,MAAoB,EACpB,eAAkB,EAClB,KAAkB;QAElB,MAAM,mBAAmB,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9G,IAAI,WAAW,CAAC;QAChB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,mCAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACpE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,oBAAoB,EACpC,wDAAwD,CAC3D,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC9F,OAAO,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,iBAAiB,EACjC,GAAG,CAAC,EAAE,EACN,SAAS,EACT,CAAU,EACV,sBAAsB,CAAC,OAAO,CACjC,CAAC;QACN,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAClC,MAAoB,EACpB,eAAkB,EAClB,KAAiB,EACjB,OAAe;QAEf,MAAM,mBAAmB,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9G,mCAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,mCAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YACrG,OAAO,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,yBAAW,CACjB,iCAAe,CAAC,iBAAiB,EACjC,GAAG,CAAC,EAAE,EACN,SAAS,EACT,CAAU,EACV,sBAAsB,CAAC,kBAAkB,CAC5C,CAAC;QACN,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAoC,EAAE,QAAkB;QACpF,IAAI,WAAW,CAAC;QAChB,QAAQ,SAAS,EAAE,CAAC;YAChB,kDAA0C;YAC1C,kDAA0C;YAC1C;gBACI,WAAW,GAAG,EAAE,CAAC;gBACjB,MAAM;YACV,kDAA0C;YAC1C;gBACI,WAAW,GAAG,EAAE,CAAC;gBACjB,MAAM;YACV;gBACI,WAAW,GAAG,EAAE,CAAC;gBACjB,MAAM;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,OAAO,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,aAAa,CAC7B,iBAA+D;QAE/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC9D,OAAO,IAAI,uBAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,oCAAoC,CACpD,iBAA+D;QAE/D,MAAM,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtG,MAAM,kBAAkB,GAAqB;YACzC,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,MAAM,aAAa;SACjC,CAAC;QACF,OAAO,iCAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC7C,WAAwC,EACxC,aAAiC,EACjC,eAAgC,EAChC,WAAgC,EAChC,SAAkB;QAElB,MAAM,MAAM,GAAG,mCAAgB,CAAC,mCAAmC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAY;YACrB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,mCAAgB,CAAC,iCAAiC,CAAC,WAAW,CAAC;YAC7E,cAAc,EAAE,KAAK;SACxB,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAA,kCAAW,EAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEtF,OAAO,MAAM,WAAW,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,oCAAoC,CACpD,aAAiC,EACjC,eAAgC,EAChC,gDAA6D;QAE7D,OAAO,MAAM,sBAAsB,CAAC,4BAA4B,CAC5D,qCAAiB,EACjB,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,CACR,CAAC;IACN,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC3D,aAAiC,EACjC,eAAgC,EAChC,gDAA6D;QAE7D,OAAO,MAAM,sBAAsB,CAAC,4BAA4B,CAC5D,mDAAwB,EACxB,aAAa,EACb,eAAe,EACf,WAAW,EACX,IAAI,CACP,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,KAA8B,EAAE,OAAe;QACtE,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAC9B,MAAM,GAAG,IAAI,uBAAU,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,YAAY,uBAAU,EAAE,CAAC;YACrC,MAAM,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,yBAAW,CAAC,iCAAe,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAClE,sBAAsB,CAAC,kBAAkB,CAC5C,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE1C,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ;AApRD,wDAoRC"}

package/dist/crypto-layer/encryption/DeviceBoundDerivedKeyHandle.d.ts

@@ -0,0 +1,7 @@
+import { BaseKeyHandle, IBaseKeyHandleSerialized } from "./BaseKeyHandle";
+/** Non exportable, ephemeral key handle that is derived from a device bound key handle. */
+export declare class DeviceBoundDerivedKeyHandle extends BaseKeyHandle {
+    readonly _isDeviceBoundDerivedKeyHandle = true;
+    toJSON(verbose?: boolean): IBaseKeyHandleSerialized;
+    toBase64(verbose?: boolean): string;
+}

package/dist/crypto-layer/encryption/DeviceBoundDerivedKeyHandle.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceBoundDerivedKeyHandle = void 0;
+const ts_serval_1 = require("@js-soft/ts-serval");
+const CoreBuffer_1 = require("../../CoreBuffer");
+const BaseKeyHandle_1 = require("./BaseKeyHandle");
+/** Non exportable, ephemeral key handle that is derived from a device bound key handle. */
+let DeviceBoundDerivedKeyHandle = class DeviceBoundDerivedKeyHandle extends BaseKeyHandle_1.BaseKeyHandle {
+    constructor() {
+        super(...arguments);
+        // Phantom marker to make this type incompatible to other types that extend `BaseKeyHandle`.
+        this._isDeviceBoundDerivedKeyHandle = true;
+    }
+    toJSON(verbose = true) {
+        return {
+            kid: this.id,
+            pnm: this.providerName,
+            spc: this.spec,
+            "@type": verbose ? "DeviceBoundDerivedKeyHandle" : undefined
+        };
+    }
+    toBase64(verbose = true) {
+        return CoreBuffer_1.CoreBuffer.utf8_base64(this.serialize(verbose));
+    }
+};
+exports.DeviceBoundDerivedKeyHandle = DeviceBoundDerivedKeyHandle;
+exports.DeviceBoundDerivedKeyHandle = DeviceBoundDerivedKeyHandle = __decorate([
+    (0, ts_serval_1.type)("DeviceBoundDerivedKeyHandle")
+], DeviceBoundDerivedKeyHandle);
+//# sourceMappingURL=DeviceBoundDerivedKeyHandle.js.map

package/dist/crypto-layer/encryption/DeviceBoundDerivedKeyHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceBoundDerivedKeyHandle.js","sourceRoot":"","sources":["../../../src/crypto-layer/encryption/DeviceBoundDerivedKeyHandle.ts"],"names":[],"mappings":";;;;;;;;;AAAA,kDAA0C;AAC1C,iDAA8C;AAC9C,mDAA0E;AAE1E,2FAA2F;AAEpF,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,6BAAa;IAAvD;;QACH,4FAA4F;QAC5E,mCAA8B,GAAG,IAAI,CAAC;IAc1D,CAAC;IAZmB,MAAM,CAAC,OAAO,GAAG,IAAI;QACjC,OAAO;YACH,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC;IACN,CAAC;IAEe,QAAQ,CAAC,OAAO,GAAG,IAAI;QACnC,OAAO,uBAAU,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;CACJ,CAAA;AAhBY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,gBAAI,EAAC,6BAA6B,CAAC;GACvB,2BAA2B,CAgBvC"}

package/dist/crypto-layer/encryption/DeviceBoundKeyHandle.d.ts

@@ -0,0 +1,7 @@
+import { BaseKeyHandle, IBaseKeyHandleSerialized } from "./BaseKeyHandle";
+/** Key handle that is non exportable (the key cannot be extracted). */
+export declare class DeviceBoundKeyHandle extends BaseKeyHandle {
+    readonly _isDeviceBoundKeyHandle = true;
+    toJSON(verbose?: boolean): IBaseKeyHandleSerialized;
+    toBase64(verbose?: boolean): string;
+}

package/dist/crypto-layer/encryption/DeviceBoundKeyHandle.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceBoundKeyHandle = void 0;
+const ts_serval_1 = require("@js-soft/ts-serval");
+const CoreBuffer_1 = require("../../CoreBuffer");
+const BaseKeyHandle_1 = require("./BaseKeyHandle");
+/** Key handle that is non exportable (the key cannot be extracted). */
+let DeviceBoundKeyHandle = class DeviceBoundKeyHandle extends BaseKeyHandle_1.BaseKeyHandle {
+    constructor() {
+        super(...arguments);
+        // Phantom marker to make this type incompatible to other types that extend `BaseKeyHandle`.
+        this._isDeviceBoundKeyHandle = true;
+    }
+    toJSON(verbose = true) {
+        return {
+            kid: this.id,
+            pnm: this.providerName,
+            spc: this.spec,
+            "@type": verbose ? "DeviceBoundKeyHandle" : undefined
+        };
+    }
+    toBase64(verbose = true) {
+        return CoreBuffer_1.CoreBuffer.utf8_base64(this.serialize(verbose));
+    }
+};
+exports.DeviceBoundKeyHandle = DeviceBoundKeyHandle;
+exports.DeviceBoundKeyHandle = DeviceBoundKeyHandle = __decorate([
+    (0, ts_serval_1.type)("DeviceBoundKeyHandle")
+], DeviceBoundKeyHandle);
+//# sourceMappingURL=DeviceBoundKeyHandle.js.map

package/dist/crypto-layer/encryption/DeviceBoundKeyHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceBoundKeyHandle.js","sourceRoot":"","sources":["../../../src/crypto-layer/encryption/DeviceBoundKeyHandle.ts"],"names":[],"mappings":";;;;;;;;;AAAA,kDAA0C;AAC1C,iDAA8C;AAC9C,mDAA0E;AAE1E,uEAAuE;AAEhE,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,6BAAa;IAAhD;;QACH,4FAA4F;QAC5E,4BAAuB,GAAG,IAAI,CAAC;IAcnD,CAAC;IAZmB,MAAM,CAAC,OAAO,GAAG,IAAI;QACjC,OAAO;YACH,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC;IACN,CAAC;IAEe,QAAQ,CAAC,OAAO,GAAG,IAAI;QACnC,OAAO,uBAAU,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;CACJ,CAAA;AAhBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,gBAAI,EAAC,sBAAsB,CAAC;GAChB,oBAAoB,CAgBhC"}

package/dist/crypto-layer/encryption/PortableDerivedKeyHandle.d.ts

@@ -0,0 +1,6 @@
+import { BaseKeyHandle, IBaseKeyHandleSerialized } from "./BaseKeyHandle";
+export declare class PortableDerivedKeyHandle extends BaseKeyHandle {
+    readonly _isPortableDeriveKeyHandle = true;
+    toJSON(verbose?: boolean): IBaseKeyHandleSerialized;
+    toBase64(verbose?: boolean): string;
+}