@ohos-ports/react-native-quick-crypto 0.0.0-stage → 1.1.8-beta.0

package/src/keys/signVerify.ts

@@ -0,0 +1,329 @@
+import { Buffer } from '@craftzdog/react-native-buffer';
+import { NitroModules } from 'react-native-nitro-modules';
+import type {
+  SignHandle as SignHandleSpec,
+  VerifyHandle as VerifyHandleSpec,
+} from '../specs/sign.nitro';
+import { KeyObject, CryptoKey } from './classes';
+import { isCryptoKey } from './utils';
+import type { BinaryLike } from '../utils';
+import {
+  binaryLikeToArrayBuffer as toAB,
+  isStringOrBuffer,
+  KFormatType,
+  KeyEncoding,
+} from '../utils';
+import { constants } from '../constants';
+
+type KeyInput = BinaryLike | KeyObject | CryptoKey | KeyInputObject;
+
+interface KeyInputObject {
+  key: BinaryLike | KeyObject | CryptoKey;
+  format?: 'pem' | 'der';
+  type?: 'pkcs1' | 'pkcs8' | 'spki' | 'sec1';
+  passphrase?: BinaryLike;
+  padding?: number;
+  saltLength?: number;
+  dsaEncoding?: 'der' | 'ieee-p1363';
+}
+
+interface SignOptions {
+  padding?: number;
+  saltLength?: number;
+  dsaEncoding?: 'der' | 'ieee-p1363';
+}
+
+interface PreparedKey {
+  keyObject: KeyObject;
+  options?: SignOptions;
+}
+
+function prepareKey(key: KeyInput, isPublic: boolean): PreparedKey {
+  // Already a KeyObject
+  if (key instanceof KeyObject) {
+    if (isPublic) {
+      if (key.type === 'secret') {
+        throw new Error('Cannot use secret key for signature verification');
+      }
+    } else {
+      if (key.type !== 'private') {
+        throw new Error('Key must be a private key for signing');
+      }
+    }
+    return { keyObject: key };
+  }
+
+  // CryptoKey - extract KeyObject
+  if (isCryptoKey(key)) {
+    const cryptoKey = key as CryptoKey;
+    return prepareKey(cryptoKey.keyObject, isPublic);
+  }
+
+  // Raw string or buffer - create KeyObject
+  if (isStringOrBuffer(key)) {
+    const isPem = typeof key === 'string' && key.includes('-----BEGIN');
+    const format = isPem ? KFormatType.PEM : undefined;
+    const type = isPublic ? 'public' : 'private';
+    const keyData = toAB(key);
+    const keyObject = KeyObject.createKeyObject(type, keyData, format);
+    return { keyObject };
+  }
+
+  // KeyInputObject with options
+  if (typeof key === 'object' && 'key' in key) {
+    const keyObj = key as KeyInputObject;
+    const {
+      key: data,
+      format,
+      type,
+      padding,
+      saltLength,
+      dsaEncoding,
+    } = keyObj;
+
+    // Nested KeyObject
+    if (data instanceof KeyObject) {
+      return {
+        keyObject: data,
+        options: { padding, saltLength, dsaEncoding },
+      };
+    }
+
+    // Nested CryptoKey
+    if (isCryptoKey(data)) {
+      return {
+        keyObject: (data as CryptoKey).keyObject,
+        options: { padding, saltLength, dsaEncoding },
+      };
+    }
+
+    if (!isStringOrBuffer(data)) {
+      throw new Error('Invalid key data type');
+    }
+
+    // Determine format
+    const isPem =
+      format === 'pem' ||
+      (typeof data === 'string' && data.includes('-----BEGIN'));
+    const kFormat = isPem
+      ? KFormatType.PEM
+      : format === 'der'
+        ? KFormatType.DER
+        : undefined;
+
+    // Determine encoding type
+    let kType: KeyEncoding | undefined;
+    if (type === 'pkcs8') kType = KeyEncoding.PKCS8;
+    else if (type === 'pkcs1') kType = KeyEncoding.PKCS1;
+    else if (type === 'sec1') kType = KeyEncoding.SEC1;
+    else if (type === 'spki') kType = KeyEncoding.SPKI;
+
+    const keyType = isPublic ? 'public' : 'private';
+    // Always convert to ArrayBuffer to avoid Nitro bridge string truncation bug
+    const keyData = toAB(data);
+    const keyObject = KeyObject.createKeyObject(
+      keyType,
+      keyData,
+      kFormat,
+      kType,
+    );
+
+    return {
+      keyObject,
+      options: { padding, saltLength, dsaEncoding },
+    };
+  }
+
+  throw new Error('Invalid key input');
+}
+
+function dsaEncodingToNumber(
+  dsaEncoding?: 'der' | 'ieee-p1363',
+): number | undefined {
+  if (dsaEncoding === 'der') return 0;
+  if (dsaEncoding === 'ieee-p1363') return 1;
+  return undefined;
+}
+
+function getSaltLength(options?: SignOptions): number | undefined {
+  if (
+    options?.padding === constants.RSA_PKCS1_PSS_PADDING &&
+    options?.saltLength === undefined
+  ) {
+    return constants.RSA_PSS_SALTLEN_MAX_SIGN;
+  }
+  return options?.saltLength;
+}
+
+export class Sign {
+  private handle: SignHandleSpec;
+
+  constructor(algorithm: string) {
+    this.handle = NitroModules.createHybridObject<SignHandleSpec>('SignHandle');
+    this.handle.init(algorithm);
+  }
+
+  update(data: BinaryLike): this {
+    const dataBuffer = toAB(data);
+    this.handle.update(dataBuffer);
+    return this;
+  }
+
+  sign(privateKey: KeyInput, outputEncoding?: BufferEncoding): Buffer;
+  sign(privateKey: KeyInput, outputEncoding?: BufferEncoding): Buffer | string {
+    if (privateKey === null || privateKey === undefined) {
+      throw new Error('Private key is required');
+    }
+
+    const { keyObject, options } = prepareKey(privateKey, false);
+
+    const signature = this.handle.sign(
+      keyObject.handle,
+      options?.padding,
+      getSaltLength(options),
+      dsaEncodingToNumber(options?.dsaEncoding),
+    );
+
+    const buf = Buffer.from(signature);
+    if (outputEncoding) {
+      return buf.toString(outputEncoding);
+    }
+    return buf;
+  }
+}
+
+export class Verify {
+  private handle: VerifyHandleSpec;
+
+  constructor(algorithm: string) {
+    this.handle =
+      NitroModules.createHybridObject<VerifyHandleSpec>('VerifyHandle');
+    this.handle.init(algorithm);
+  }
+
+  update(data: BinaryLike): this {
+    const dataBuffer = toAB(data);
+    this.handle.update(dataBuffer);
+    return this;
+  }
+
+  verify(
+    publicKey: KeyInput,
+    signature: BinaryLike,
+    signatureEncoding?: BufferEncoding,
+  ): boolean {
+    if (publicKey === null || publicKey === undefined) {
+      throw new Error('Public key is required');
+    }
+
+    const { keyObject, options } = prepareKey(publicKey, true);
+
+    // Convert signature to ArrayBuffer
+    let sigBuffer: ArrayBuffer;
+    if (signatureEncoding && typeof signature === 'string') {
+      sigBuffer = toAB(Buffer.from(signature, signatureEncoding));
+    } else {
+      sigBuffer = toAB(signature);
+    }
+
+    return this.handle.verify(
+      keyObject.handle,
+      sigBuffer,
+      options?.padding,
+      getSaltLength(options),
+      dsaEncodingToNumber(options?.dsaEncoding),
+    );
+  }
+}
+
+export function createSign(algorithm: string): Sign {
+  return new Sign(algorithm);
+}
+
+export function createVerify(algorithm: string): Verify {
+  return new Verify(algorithm);
+}
+
+type SignCallback = (err: Error | null, signature?: Buffer) => void;
+type VerifyCallback = (err: Error | null, result?: boolean) => void;
+
+export function sign(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+): Buffer;
+export function sign(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+  callback: SignCallback,
+): void;
+export function sign(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+  callback?: SignCallback,
+): Buffer | void {
+  const doSign = (): Buffer => {
+    if (key === null || key === undefined) {
+      throw new Error('Private key is required');
+    }
+    const signer = new Sign(algorithm ?? '');
+    signer.update(data);
+    return signer.sign(key);
+  };
+
+  if (callback) {
+    try {
+      const signature = doSign();
+      process.nextTick(callback, null, signature);
+    } catch (err) {
+      process.nextTick(callback, err as Error);
+    }
+    return;
+  }
+
+  return doSign();
+}
+
+export function verify(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+  signature: BinaryLike,
+): boolean;
+export function verify(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+  signature: BinaryLike,
+  callback: VerifyCallback,
+): void;
+export function verify(
+  algorithm: string | null | undefined,
+  data: BinaryLike,
+  key: KeyInput,
+  signature: BinaryLike,
+  callback?: VerifyCallback,
+): boolean | void {
+  const doVerify = (): boolean => {
+    if (key === null || key === undefined) {
+      throw new Error('Key is required');
+    }
+    const verifier = new Verify(algorithm ?? '');
+    verifier.update(data);
+    return verifier.verify(key, signature);
+  };
+
+  if (callback) {
+    try {
+      const result = doVerify();
+      process.nextTick(callback, null, result);
+    } catch (err) {
+      process.nextTick(callback, err as Error);
+    }
+    return;
+  }
+
+  return doVerify();
+}

package/src/keys/utils.ts

@@ -0,0 +1,263 @@
+import {
+  binaryLikeToArrayBuffer,
+  isStringOrBuffer,
+  KeyEncoding,
+  KFormatType,
+} from '../utils';
+import type { CryptoKeyPair, EncodingOptions } from '../utils';
+import type { CryptoKey, PublicKeyObject, PrivateKeyObject } from './classes';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const isCryptoKey = (obj: any): boolean => {
+  return obj !== null && obj?.keyObject !== undefined;
+};
+
+export function exportPublicKeyRaw(
+  pub: PublicKeyObject,
+  pointType: 'compressed' | 'uncompressed' | undefined,
+): ArrayBuffer {
+  if (pub.asymmetricKeyType === 'ec') {
+    return pub.handle.exportECPublicRaw(pointType === 'compressed');
+  }
+  return pub.handle.exportRawPublic();
+}
+
+export function exportPrivateKeyRaw(
+  priv: PrivateKeyObject,
+  format: 'raw-private' | 'raw-seed',
+): ArrayBuffer {
+  if (format === 'raw-seed') {
+    return priv.handle.exportRawSeed();
+  }
+  if (priv.asymmetricKeyType === 'ec') {
+    return priv.handle.exportECPrivateRaw();
+  }
+  return priv.handle.exportRawPrivate();
+}
+
+export function getCryptoKeyPair(
+  key: CryptoKey | CryptoKeyPair,
+): CryptoKeyPair {
+  if ('publicKey' in key && 'privateKey' in key) return key;
+  throw new Error('Invalid CryptoKeyPair');
+}
+
+/**
+ * Parses the public key encoding based on an object. keyType must be undefined
+ * when this is used to parse an input encoding and must be a valid key type if
+ * used to parse an output encoding.
+ */
+export function parsePublicKeyEncoding(
+  enc: EncodingOptions,
+  keyType: string | undefined,
+  objName?: string,
+) {
+  return parseKeyEncoding(enc, keyType, keyType ? true : undefined, objName);
+}
+
+/**
+ * Parses the private key encoding based on an object. keyType must be undefined
+ * when this is used to parse an input encoding and must be a valid key type if
+ * used to parse an output encoding.
+ */
+export function parsePrivateKeyEncoding(
+  enc: EncodingOptions,
+  keyType: string | undefined,
+  objName?: string,
+) {
+  return parseKeyEncoding(enc, keyType, false, objName);
+}
+
+export function parseKeyEncoding(
+  enc: EncodingOptions,
+  keyType?: string,
+  isPublic?: boolean,
+  objName?: string,
+) {
+  // validateObject(enc, 'options');
+
+  const isInput = keyType === undefined;
+
+  const { format, type } = parseKeyFormatAndType(
+    enc,
+    keyType,
+    isPublic,
+    objName,
+  );
+
+  if (
+    format === 'raw-public' ||
+    format === 'raw-private' ||
+    format === 'raw-seed'
+  ) {
+    if (enc.cipher != null || enc.passphrase !== undefined) {
+      throw new Error(
+        `Incompatible key options: ${format} does not support encryption`,
+      );
+    }
+    return { format, type, cipher: undefined, passphrase: undefined };
+  }
+
+  let cipher, passphrase, encoding;
+  if (isPublic !== true) {
+    ({ cipher, passphrase, encoding } = enc);
+
+    if (!isInput) {
+      if (cipher != null) {
+        if (typeof cipher !== 'string')
+          throw new Error(
+            `Invalid argument ${option('cipher', objName)}: ${cipher}`,
+          );
+        if (
+          format === KFormatType.DER &&
+          (type === KeyEncoding.PKCS1 || type === KeyEncoding.SEC1)
+        ) {
+          throw new Error(
+            `Incompatible key options ${encodingNames[type as KeyEncoding]} does not support encryption`,
+          );
+        }
+      } else if (passphrase !== undefined) {
+        throw new Error(
+          `invalid argument ${option('cipher', objName)}: ${cipher}`,
+        );
+      }
+    }
+
+    if (
+      (isInput && passphrase !== undefined && !isStringOrBuffer(passphrase)) ||
+      (!isInput && cipher != null && !isStringOrBuffer(passphrase))
+    ) {
+      throw new Error(
+        `Invalid argument value ${option('passphrase', objName)}: ${passphrase}`,
+      );
+    }
+  }
+
+  if (passphrase !== undefined)
+    passphrase = binaryLikeToArrayBuffer(passphrase, encoding);
+
+  return { format, type, cipher, passphrase };
+}
+
+const encodingNames = {
+  [KeyEncoding.PKCS1]: 'pkcs1',
+  [KeyEncoding.PKCS8]: 'pkcs8',
+  [KeyEncoding.SPKI]: 'spki',
+  [KeyEncoding.SEC1]: 'sec1',
+};
+
+function option(name: string, objName?: string) {
+  return objName === undefined
+    ? `options.${name}`
+    : `options.${objName}.${name}`;
+}
+
+function parseKeyFormat(
+  formatStr?: string,
+  defaultFormat?: KFormatType,
+  optionName?: string,
+): KFormatType | 'raw-public' | 'raw-private' | 'raw-seed' {
+  if (formatStr === undefined && defaultFormat !== undefined)
+    return defaultFormat;
+  else if (formatStr === 'pem') return KFormatType.PEM;
+  else if (formatStr === 'der') return KFormatType.DER;
+  else if (formatStr === 'jwk') return KFormatType.JWK;
+  else if (formatStr === 'raw-public') return 'raw-public';
+  else if (formatStr === 'raw-private') return 'raw-private';
+  else if (formatStr === 'raw-seed') return 'raw-seed';
+  throw new Error(`Invalid key format str: ${optionName}`);
+}
+
+function parseKeyType(
+  typeStr: string | undefined,
+  required: boolean,
+  keyType: string | undefined,
+  isPublic: boolean | undefined,
+  optionName: string,
+): KeyEncoding | undefined {
+  if (typeStr === undefined && !required) {
+    return undefined;
+  } else if (typeStr === 'pkcs1') {
+    if (keyType !== undefined && keyType !== 'rsa') {
+      throw new Error(
+        `Crypto incompatible key options: ${typeStr} can only be used for RSA keys`,
+      );
+    }
+    return KeyEncoding.PKCS1;
+  } else if (typeStr === 'spki' && isPublic !== false) {
+    return KeyEncoding.SPKI;
+  } else if (typeStr === 'pkcs8' && isPublic !== true) {
+    return KeyEncoding.PKCS8;
+  } else if (typeStr === 'sec1' && isPublic !== true) {
+    if (keyType !== undefined && keyType !== 'ec') {
+      throw new Error(
+        `Incompatible key options ${typeStr} can only be used for EC keys`,
+      );
+    }
+    return KeyEncoding.SEC1;
+  }
+
+  throw new Error(`Invalid option ${optionName} - ${typeStr}`);
+}
+
+function parseKeyFormatAndType(
+  enc: EncodingOptions,
+  keyType?: string,
+  isPublic?: boolean,
+  objName?: string,
+): {
+  format: KFormatType | 'raw-public' | 'raw-private' | 'raw-seed';
+  type: KeyEncoding | 'compressed' | 'uncompressed' | undefined;
+} {
+  const { format: formatStr, type: typeStr } = enc;
+
+  const isInput = keyType === undefined;
+  const format = parseKeyFormat(
+    formatStr,
+    isInput ? KFormatType.PEM : undefined,
+    option('format', objName),
+  );
+
+  if (format === 'raw-public') {
+    if (isPublic === false) {
+      throw new Error(
+        `Invalid format 'raw-public' for ${option('format', objName)}`,
+      );
+    }
+    if (typeStr === undefined || typeStr === 'uncompressed') {
+      return { format, type: 'uncompressed' };
+    }
+    if (typeStr === 'compressed') {
+      return { format, type: 'compressed' };
+    }
+    throw new Error(
+      `Invalid ${option('type', objName)} for raw-public: ${typeStr}`,
+    );
+  }
+
+  if (format === 'raw-private' || format === 'raw-seed') {
+    if (isPublic === true) {
+      throw new Error(
+        `Invalid format '${format}' for ${option('format', objName)}`,
+      );
+    }
+    if (typeStr !== undefined) {
+      throw new Error(
+        `Invalid ${option('type', objName)} for ${format}: ${typeStr}`,
+      );
+    }
+    return { format, type: undefined };
+  }
+
+  const isRequired =
+    (!isInput || format === KFormatType.DER) && format !== KFormatType.JWK;
+
+  const type = parseKeyType(
+    typeStr as string | undefined,
+    isRequired,
+    keyType,
+    isPublic,
+    option('type', objName),
+  );
+  return { format, type };
+}

package/src/mldsa.ts

@@ -0,0 +1,125 @@
+import { NitroModules } from 'react-native-nitro-modules';
+import type { MlDsaKeyPair } from './specs/mlDsaKeyPair.nitro';
+import {
+  CryptoKey,
+  KeyObject,
+  PublicKeyObject,
+  PrivateKeyObject as PrivateKeyObjectClass,
+} from './keys';
+import type { CryptoKeyPair, KeyUsage, SubtleAlgorithm } from './utils';
+import {
+  hasAnyNotIn,
+  lazyDOMException,
+  getUsagesUnion,
+  KFormatType,
+  KeyEncoding,
+} from './utils';
+
+export type MlDsaVariant = 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87';
+
+export class MlDsa {
+  variant: MlDsaVariant;
+  native: MlDsaKeyPair;
+
+  constructor(variant: MlDsaVariant) {
+    this.variant = variant;
+    this.native = NitroModules.createHybridObject<MlDsaKeyPair>('MlDsaKeyPair');
+    this.native.setVariant(variant);
+  }
+
+  async generateKeyPair(): Promise<void> {
+    await this.native.generateKeyPair(
+      KFormatType.DER,
+      KeyEncoding.SPKI,
+      KFormatType.DER,
+      KeyEncoding.PKCS8,
+    );
+  }
+
+  generateKeyPairSync(): void {
+    this.native.generateKeyPairSync(
+      KFormatType.DER,
+      KeyEncoding.SPKI,
+      KFormatType.DER,
+      KeyEncoding.PKCS8,
+    );
+  }
+
+  getPublicKey(): ArrayBuffer {
+    return this.native.getPublicKey();
+  }
+
+  getPrivateKey(): ArrayBuffer {
+    return this.native.getPrivateKey();
+  }
+
+  async sign(message: ArrayBuffer): Promise<ArrayBuffer> {
+    return this.native.sign(message);
+  }
+
+  signSync(message: ArrayBuffer): ArrayBuffer {
+    return this.native.signSync(message);
+  }
+
+  async verify(signature: ArrayBuffer, message: ArrayBuffer): Promise<boolean> {
+    return this.native.verify(signature, message);
+  }
+
+  verifySync(signature: ArrayBuffer, message: ArrayBuffer): boolean {
+    return this.native.verifySync(signature, message);
+  }
+}
+
+export async function mldsa_generateKeyPairWebCrypto(
+  variant: MlDsaVariant,
+  extractable: boolean,
+  keyUsages: KeyUsage[],
+): Promise<CryptoKeyPair> {
+  if (hasAnyNotIn(keyUsages, ['sign', 'verify'])) {
+    throw lazyDOMException(
+      `Unsupported key usage for ${variant}`,
+      'SyntaxError',
+    );
+  }
+
+  const publicUsages = getUsagesUnion(keyUsages, 'verify');
+  const privateUsages = getUsagesUnion(keyUsages, 'sign');
+
+  if (privateUsages.length === 0) {
+    throw lazyDOMException('Usages cannot be empty', 'SyntaxError');
+  }
+
+  const mldsa = new MlDsa(variant);
+  await mldsa.generateKeyPair();
+
+  const publicKeyData = mldsa.getPublicKey();
+  const privateKeyData = mldsa.getPrivateKey();
+
+  const pub = KeyObject.createKeyObject(
+    'public',
+    publicKeyData,
+    KFormatType.DER,
+    KeyEncoding.SPKI,
+  ) as PublicKeyObject;
+  const publicKey = new CryptoKey(
+    pub,
+    { name: variant } as SubtleAlgorithm,
+    publicUsages,
+    true,
+  );
+
+  const priv = KeyObject.createKeyObject(
+    'private',
+    privateKeyData,
+    KFormatType.DER,
+    KeyEncoding.PKCS8,
+  ) as PrivateKeyObjectClass;
+  const privateKey = new CryptoKey(
+    priv,
+    { name: variant } as SubtleAlgorithm,
+    privateUsages,
+    extractable,
+  );
+
+  return { publicKey, privateKey };
+}