@opentdf/sdk 0.1.0-beta.1701

package/src/nanotdf/models/Policy/EmbeddedPolicy.ts

@@ -0,0 +1,101 @@
+import AbstractPolicy from './AbstractPolicy.js';
+import { EmbeddedPolicyInterface } from '../../interfaces/PolicyInterface.js';
+import PolicyTypes from '../../enum/PolicyTypeEnum.js';
+import { ConfigurationError } from '../../../errors.js';
+
+/**
+ * Embedded Policy
+ *
+ * These policy types allow for creation and binding of arbitrary policies.
+ *
+ * | Section                      | Minimum Length (B) | Maximum Length (B) |
+ * |------------------------------|--------------------|--------------------|
+ * | Content Length               | 2                  | 2                  |
+ * | Plaintext/Ciphertext         | 1                  | 255                |
+ * | (Optional) Policy Key Access | 36                 | 136                |
+ */
+class EmbeddedPolicy extends AbstractPolicy implements EmbeddedPolicyInterface {
+  static MAX_POLICY_SIZE = 65535; // 2 bytes unsigned int.
+  readonly content: Uint8Array;
+
+  static override parse(
+    buff: Uint8Array,
+    useEcdsaBinding: boolean,
+    type: PolicyTypes
+  ): { offset: number; policy: EmbeddedPolicy } {
+    let offset = 0;
+
+    // TODO: May not work on Big Endian systems. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DataView/getUint16
+    // Also http://calculist.org/blog/2012/04/24/the-little-endian-web/
+    const length = new DataView(buff.slice(offset, 2).buffer).getUint16(0);
+    offset += 2;
+
+    const content = buff.subarray(offset, offset + length);
+    offset += length;
+
+    const { binding, newOffset: bindingOffset } = this.parseBinding(buff, useEcdsaBinding, offset);
+    offset = bindingOffset;
+
+    return {
+      policy: new EmbeddedPolicy(type, binding, content),
+      offset,
+    };
+  }
+
+  constructor(type: PolicyTypes, binding: Uint8Array, content: Uint8Array) {
+    super(type, binding);
+    this.content = content;
+  }
+
+  /**
+   * Length of policy
+   *
+   * @returns { number } length
+   */
+  override getLength(): number {
+    return (
+      // Type length
+      1 +
+      // Policy length
+      2 +
+      // Content length
+      this.content.length +
+      // Binding length
+      this.binding.length
+    );
+  }
+
+  /**
+   * Return the content of the policy
+   */
+  override toBuffer(): Uint8Array {
+    const target = new Uint8Array(this.getLength());
+
+    if (this.content.length > EmbeddedPolicy.MAX_POLICY_SIZE) {
+      throw new ConfigurationError("TDF Policy can't be more that 2^16");
+    }
+
+    target.set([this.type], 0);
+
+    // Write the policy length, assuming the host system is little endian
+    // TODO: There should be better way to convert to big endian
+    const lengthAsUint16 = new Uint16Array(1);
+    lengthAsUint16[0] = this.content.length;
+
+    const temp = new Uint8Array(lengthAsUint16.buffer);
+    const policyContentSizeAsBg = new Uint8Array(2);
+    policyContentSizeAsBg[0] = temp[1];
+    policyContentSizeAsBg[1] = temp[0];
+    target.set(policyContentSizeAsBg, 1);
+
+    // Write the policy content
+    target.set(this.content, policyContentSizeAsBg.length + 1);
+
+    // Write the binding.
+    target.set(this.binding, this.content.length + policyContentSizeAsBg.length + 1);
+
+    return target;
+  }
+}
+
+export default EmbeddedPolicy;

package/src/nanotdf/models/Policy/PolicyFactory.ts

@@ -0,0 +1,48 @@
+import AbstractPolicy from './AbstractPolicy.js';
+import EmbeddedPolicy from './EmbeddedPolicy.js';
+import RemotePolicy from './RemotePolicy.js';
+import PolicyTypeEnum from '../../enum/PolicyTypeEnum.js';
+import { UnsupportedFeatureError } from '../../../errors.js';
+import CurveNameEnum from '../../enum/CurveNameEnum.js';
+
+function parse(
+  buff: Uint8Array,
+  useEcdsaBinding: boolean,
+  curve: CurveNameEnum
+): { policy: AbstractPolicy; offset: number } | never {
+  const type = buff[AbstractPolicy.TYPE_BYTE_OFF];
+  let policy: AbstractPolicy;
+  let offset: number;
+
+  // Check if remote policy
+  if (type === PolicyTypeEnum.Remote) {
+    ({ policy, offset } = RemotePolicy.parse(
+      buff.subarray(AbstractPolicy.TYPE_BYTE_LEN),
+      useEcdsaBinding
+    ));
+  } else if (
+    [
+      //  Check if is an embedded policy
+      PolicyTypeEnum.EmbeddedEncrypted,
+      PolicyTypeEnum.EmbeddedEncryptedPKA,
+      PolicyTypeEnum.EmbeddedText,
+    ].includes(type)
+  ) {
+    ({ policy, offset } = EmbeddedPolicy.parse(
+      buff.subarray(AbstractPolicy.TYPE_BYTE_LEN),
+      useEcdsaBinding,
+      type
+    ));
+  } else {
+    throw new UnsupportedFeatureError(`unsupported policy type: ${type}`);
+  }
+
+  return {
+    policy,
+    offset: offset + AbstractPolicy.TYPE_BYTE_LEN,
+  };
+}
+
+export default {
+  parse,
+};

package/src/nanotdf/models/Policy/RemotePolicy.ts

@@ -0,0 +1,74 @@
+import AbstractPolicy from './AbstractPolicy.js';
+import ResourceLocator from '../ResourceLocator.js';
+import { RemotePolicyInterface } from '../../interfaces/PolicyInterface.js';
+import PolicyTypeEnum from '../../enum/PolicyTypeEnum.js';
+
+/**
+ * Set remote policy body
+ *
+ * If the policy type is set to use a Remote Policy, then the Resource Locator object described in Section 3.4.1 is
+ * used to describe the remote policy.
+ */
+class RemotePolicy extends AbstractPolicy implements RemotePolicyInterface {
+  override readonly type: PolicyTypeEnum = PolicyTypeEnum.Remote;
+  readonly remotePolicy: ResourceLocator;
+
+  static override parse(
+    buff: Uint8Array,
+    useEcdsaBinding: boolean
+  ): { offset: number; policy: RemotePolicy } {
+    let offset = 0;
+    const resource = ResourceLocator.parse(buff);
+    offset += resource.offset;
+
+    const { binding, newOffset: bindingOffset } = this.parseBinding(buff, useEcdsaBinding, offset);
+    offset = bindingOffset;
+
+    return {
+      policy: new RemotePolicy(PolicyTypeEnum.Remote, binding, resource),
+      offset,
+    };
+  }
+
+  constructor(type: PolicyTypeEnum, binding: Uint8Array, resource: ResourceLocator) {
+    super(type, binding);
+    this.type = PolicyTypeEnum.Remote;
+    this.remotePolicy = resource;
+  }
+
+  /**
+   * Length of policy
+   *
+   * @returns { number } length
+   */
+  override getLength(): number {
+    return (
+      // Type length
+      1 +
+      // Resource locator length
+      this.remotePolicy.length +
+      // Binding length
+      this.binding.length
+    );
+  }
+
+  /**
+   * Return the content of the policy
+   */
+  override toBuffer(): Uint8Array {
+    const target = new Uint8Array(this.getLength());
+
+    target.set([PolicyTypeEnum.Remote], 0);
+
+    // Write the remote policy location
+    const resourceLocatorAsBuf = this.remotePolicy.toBuffer();
+    target.set(resourceLocatorAsBuf, 1);
+
+    // Write the binding.
+    target.set(this.binding, resourceLocatorAsBuf.length + 1);
+
+    return target;
+  }
+}
+
+export default RemotePolicy;

package/src/nanotdf/models/ResourceLocator.ts

@@ -0,0 +1,212 @@
+import { ConfigurationError, InvalidFileError } from '../../errors.js';
+import ProtocolEnum from '../enum/ProtocolEnum.js';
+import ResourceLocatorIdentifierEnum from '../enum/ResourceLocatorIdentifierEnum.js';
+
+/**
+ *
+ * The Resource Locator is a way for the nanotdf to represent references to external resources in as succinct a format
+ * as possible.
+ *
+ * | Section       | Minimum Length (B) | Maximum Length (B) |
+ * |---------------|--------------------|--------------------|
+ * | Protocol Enum | 1                  | 1                  |
+ * | Body Length   | 1                  | 1                  |
+ * | Body          | 1                  | 255                |
+ * | Identifier    | 0                  | n                  |
+ *
+ * @link https://github.com/virtru/nanotdf/blob/master/spec/index.md#3312-kas
+ * @link https://github.com/virtru/nanotdf/blob/master/spec/index.md#341-resource-locator
+ */
+export default class ResourceLocator {
+  static readonly PROTOCOL_OFFSET = 0;
+  static readonly PROTOCOL_LENGTH = 1;
+  static readonly LENGTH_OFFSET = 1;
+  static readonly LENGTH_LENGTH = 1;
+  static readonly BODY_OFFSET = 2;
+  static readonly IDENTIFIER_0_BYTE: number = 0 << 4; // 0
+  static readonly IDENTIFIER_2_BYTE: number = 1 << 4; // 16
+  static readonly IDENTIFIER_8_BYTE: number = 2 << 4; // 32
+  static readonly IDENTIFIER_32_BYTE: number = 3 << 4; // 48
+
+  constructor(
+    readonly protocol: ProtocolEnum,
+    readonly lengthOfBody: number,
+    readonly body: string,
+    readonly offset: number,
+    readonly id?: string,
+    readonly idType: ResourceLocatorIdentifierEnum = ResourceLocatorIdentifierEnum.None
+  ) {}
+
+  /**
+   * Construct a new URL or URL + identifier pair, for use with NanoTDF envelopes.
+   * @param url The URL to encrypt; `http` and `https` schemes are supported
+   * @param identifier An optional identifier.
+   *    For KAS URLs, this is usually a public key identifier (kid). Limit 32 characters
+   * @returns a value representing the URL and identifier, if present.
+   *    This method throws an Error if the URL is invalid or of the wrong schema,
+   *    or if the identifier is an unsupported value.
+   */
+  static fromURL(url: string, identifier?: string): ResourceLocator {
+    const [protocolStr, body] = url.split('://');
+
+    let protocol: ProtocolEnum;
+
+    // Validate and set protocol identifier byte
+    switch (protocolStr.toLowerCase()) {
+      case 'http':
+        protocol = ProtocolEnum.Http;
+        break;
+      case 'https':
+        protocol = ProtocolEnum.Https;
+        break;
+      default:
+        throw new ConfigurationError(`resource locator protocol [${protocolStr}] unsupported`);
+    }
+
+    // Set identifier padded length and protocol identifier byte
+    const identifierType = (() => {
+      if (!identifier) {
+        return ResourceLocatorIdentifierEnum.None;
+      }
+      const identifierLength = new TextEncoder().encode(identifier).length;
+      if (identifierLength <= 2) {
+        return ResourceLocatorIdentifierEnum.TwoBytes;
+      } else if (identifierLength <= 8) {
+        return ResourceLocatorIdentifierEnum.EightBytes;
+      } else if (identifierLength <= 32) {
+        return ResourceLocatorIdentifierEnum.ThirtyTwoBytes;
+      }
+      throw new ConfigurationError(`unsupported identifier length: ${identifier.length}`);
+    })();
+
+    // Create buffer to hold protocol, body length, body, and identifier
+    const lengthOfBody = new TextEncoder().encode(body).length;
+    if (lengthOfBody == 0) {
+      throw new ConfigurationError('url body empty');
+    }
+    const identifierLength = identifierType.valueOf();
+    const offset = ResourceLocator.BODY_OFFSET + lengthOfBody + identifierLength;
+    return new ResourceLocator(protocol, lengthOfBody, body, offset, identifier, identifierType);
+  }
+
+  static parse(buff: Uint8Array) {
+    // Protocol
+    const protocolAndIdentifierType = buff[ResourceLocator.PROTOCOL_OFFSET];
+    // Length of body
+    const lengthOfBody = buff[ResourceLocator.LENGTH_OFFSET];
+    if (lengthOfBody == 0) {
+      throw new InvalidFileError('url body empty');
+    }
+    // Body as utf8 string
+    const decoder = new TextDecoder();
+    let offset = ResourceLocator.BODY_OFFSET + lengthOfBody;
+    if (offset > buff.length) {
+      throw new InvalidFileError('url parser: out of bounds error');
+    }
+    const body = decoder.decode(buff.subarray(ResourceLocator.BODY_OFFSET, offset));
+    const protocol = protocolAndIdentifierType & 0xf;
+    switch (protocol) {
+      case ProtocolEnum.Http:
+      case ProtocolEnum.Https:
+        break;
+      default:
+        throw new InvalidFileError(`url parser: unsupported protocol type [${protocol}]`);
+    }
+    // identifier
+    const identifierTypeNibble = protocolAndIdentifierType & 0xf0;
+    let identifierType = ResourceLocatorIdentifierEnum.None;
+    if (identifierTypeNibble === ResourceLocator.IDENTIFIER_2_BYTE) {
+      identifierType = ResourceLocatorIdentifierEnum.TwoBytes;
+    } else if (identifierTypeNibble === ResourceLocator.IDENTIFIER_8_BYTE) {
+      identifierType = ResourceLocatorIdentifierEnum.EightBytes;
+    } else if (identifierTypeNibble === ResourceLocator.IDENTIFIER_32_BYTE) {
+      identifierType = ResourceLocatorIdentifierEnum.ThirtyTwoBytes;
+    } else if (identifierTypeNibble !== ResourceLocator.IDENTIFIER_0_BYTE) {
+      throw new InvalidFileError(`url parser: unsupported fragment type [${identifierTypeNibble}]`);
+    }
+
+    let identifier: string | undefined = undefined;
+
+    switch (identifierType) {
+      case ResourceLocatorIdentifierEnum.None:
+        // noop
+        break;
+      case ResourceLocatorIdentifierEnum.TwoBytes:
+      case ResourceLocatorIdentifierEnum.EightBytes:
+      case ResourceLocatorIdentifierEnum.ThirtyTwoBytes: {
+        const kidStart = offset;
+        offset = kidStart + identifierType.valueOf();
+        if (offset > buff.length) {
+          throw new InvalidFileError('url parser: out of bounds error');
+        }
+        const kidSubarray = buff.subarray(kidStart, offset);
+        // Remove padding (assuming the padding is null bytes, 0x00)
+        const zeroIndex = kidSubarray.indexOf(0);
+        if (zeroIndex >= 0) {
+          const trimmedSubarray = kidSubarray.subarray(0, zeroIndex);
+          identifier = decoder.decode(trimmedSubarray);
+        } else {
+          identifier = decoder.decode(kidSubarray);
+        }
+        break;
+      }
+    }
+    return new ResourceLocator(protocol, lengthOfBody, body, offset, identifier, identifierType);
+  }
+
+  /**
+   * Length
+   *
+   * @returns { number } Length of resource locator
+   */
+  get length(): number {
+    return this.offset;
+  }
+
+  get url(): string | never {
+    switch (this.protocol) {
+      case ProtocolEnum.Http:
+        return 'http://' + this.body;
+      case ProtocolEnum.Https:
+        return 'https://' + this.body;
+      default:
+        throw new ConfigurationError(`resource locator protocol unsupported [${this.protocol}]`);
+    }
+  }
+
+  /**
+   * Return the contents of the Resource Locator in buffer
+   */
+  toBuffer(): Uint8Array {
+    const target = new Uint8Array(ResourceLocator.BODY_OFFSET + this.body.length + this.idType);
+    let idTypeNibble = 0;
+    switch (this.idType) {
+      case ResourceLocatorIdentifierEnum.TwoBytes:
+        idTypeNibble = ResourceLocator.IDENTIFIER_2_BYTE;
+        break;
+      case ResourceLocatorIdentifierEnum.EightBytes:
+        idTypeNibble = ResourceLocator.IDENTIFIER_8_BYTE;
+        break;
+      case ResourceLocatorIdentifierEnum.ThirtyTwoBytes:
+        idTypeNibble = ResourceLocator.IDENTIFIER_32_BYTE;
+        break;
+    }
+    target.set([this.protocol | idTypeNibble], ResourceLocator.PROTOCOL_OFFSET);
+    target.set([this.lengthOfBody], ResourceLocator.LENGTH_OFFSET);
+    target.set(new TextEncoder().encode(this.body), ResourceLocator.BODY_OFFSET);
+    if (this.id) {
+      target.set(new TextEncoder().encode(this.id), ResourceLocator.BODY_OFFSET + this.body.length);
+    }
+    return target;
+  }
+
+  /**
+   * Get Identifier
+   *
+   * Returns the identifier of the ResourceLocator or an empty string if no identifier is present.
+   * @returns { string } Identifier of the resource locator.
+   */
+  get identifier(): string {
+    return this.id ?? '';
+  }
+}

package/src/nanotdf/models/Signature.ts

@@ -0,0 +1,85 @@
+import Header from './Header.js';
+import { lengthOfPublicKey, lengthOfSignature } from '../helpers/calculateByCurve.js';
+import { ConfigurationError } from '../../errors.js';
+
+/**
+ * NanoTDF Signature
+ *
+ * The signature section is an optional section that contains an ECDSA signature used to cryptographically bind the Header and Payload to a creator of the nanotdf. The key used for signing is the private key of the creator of the nanotdf. The ECC Params used for the signature are described in Section 3.3.1.4.2. The private key used for this signature is distinctly different than the ephemeral private key. This is a persistent key belonging to an individual, entity, or device that creates nanotdfs. The signature is used to authenticate the entire nanotdf and contains both the public key related to the creators private key and the resulting signature. The structure of this section:
+ *
+ * | Section    | Minimum Length (B) | Maximum Length (B) |
+ * |------------|--------------------|--------------------|
+ * | Public Key | 33                 | 67                 |
+ * | Signature  | 64                 | 132                |
+ *
+ * @link https://github.com/virtru/nanotdf/blob/master/spec/index.md#333-signature
+ */
+export default class Signature {
+  public publicKey: Uint8Array;
+  public signature: Uint8Array;
+
+  static parse(header: Header, buff: Uint8Array): { signature: Signature; offset: number } | never {
+    let offset = 0;
+
+    /**
+     * Parse the public key
+     *
+     * This section contains the compressed public key of the private key used to sign the message.
+     */
+    // TODO: Resolve where offset is missing 1 byte
+    const publicKeyLength = lengthOfPublicKey(header.signatureCurveName) + 1;
+    const publicKey = buff.subarray(offset, offset + publicKeyLength);
+    offset += publicKeyLength;
+
+    /**
+     * Parse signature
+     *
+     * This section contains the encoded `r` and `s` values of the ECDSA signature.
+     *
+     * ECDSA signatures are big endian encodings of the `r` and `s` values of an ECDSA signature.The length of `r` and `s`
+     * values is determined by the ECC Mode used for the signature. The encoding for the signature is the big endian
+     * encodings of R and S concatenated to each other. For example, `r = 1` and `s = 2` for an ECDSA signature of a
+     * ecp256k1 key would be (line breaks and spaces are added for easier visualization):
+     *
+     * ```
+     * 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+     * 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
+     * 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+     * 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
+     * ```
+     *
+     * @link https://github.com/virtru/nanotdf/blob/master/spec/index.md#52-ecdsa-signature-encoding
+     */
+    const signatureLength = lengthOfSignature(header.signatureCurveName);
+    const signature = buff.subarray(offset, offset + signatureLength);
+    offset += signatureLength;
+
+    return { signature: new Signature(publicKey, signature), offset };
+  }
+
+  constructor(publicKey: Uint8Array, signature: Uint8Array) {
+    this.publicKey = publicKey;
+    this.signature = signature;
+  }
+
+  /**
+   * Length
+   *
+   * @returns { number } Length of signature
+   */
+  get length(): number {
+    return this.publicKey.length + this.signature.length;
+  }
+
+  /**
+   * Copy the contents of the signature to buffer
+   */
+  copyToBuffer(target: Uint8Array): void {
+    if (this.length > target.length) {
+      throw new ConfigurationError('Invalid buffer size to copy signature');
+    }
+
+    target.set(this.publicKey, 0);
+    target.set(this.signature, this.publicKey.length);
+  }
+}

package/src/nanotdf-crypto/ciphers.ts

@@ -0,0 +1,13 @@
+export enum Ciphers {
+  AesGcm = 'AES-GCM',
+}
+
+export enum CipherTagLengths {
+  AesGcm = 128,
+}
+
+const cipherKeys = [];
+for (const cipherKey in Ciphers) {
+  cipherKeys.push(cipherKey);
+}
+export const supportedCiphers = cipherKeys;

package/src/nanotdf-crypto/decrypt.ts

@@ -0,0 +1,30 @@
+import { Ciphers, CipherTagLengths } from './ciphers.js';
+
+/**
+ * Decrypt plaintext buffer to plaintext buffer
+ *
+ * Only supports AES-GCM
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt
+ *
+ * @param key Encryption key
+ * @param ciphertext Encrypted buffer
+ * @param iv Initialization vector
+ * @param tagLength Size (bits) of authentication tag
+ * @returns Resolves plaintext buffer
+ */
+export default async function decrypt(
+  key: CryptoKey,
+  ciphertext: Uint8Array,
+  iv: Uint8Array,
+  tagLength?: number
+): Promise<ArrayBuffer> {
+  return crypto.subtle.decrypt(
+    {
+      name: Ciphers.AesGcm,
+      iv,
+      tagLength: tagLength || CipherTagLengths.AesGcm,
+    },
+    key,
+    ciphertext
+  );
+}

package/src/nanotdf-crypto/digest.ts

@@ -0,0 +1,8 @@
+import { TypedArray } from '../tdf/index.js';
+
+export default function digest(
+  hashType: AlgorithmIdentifier,
+  data: TypedArray | ArrayBuffer
+): Promise<ArrayBuffer> {
+  return crypto.subtle.digest(hashType, data);
+}

package/src/nanotdf-crypto/ecdsaSignature.ts

@@ -0,0 +1,109 @@
+import { ConfigurationError } from '../errors.js';
+import { AlgorithmName } from './../nanotdf-crypto/enums.js';
+
+/**
+ * Computes an ECDSA signature for the given data using the provided private key.
+ *
+ * This function uses the Web Crypto API to generate a digital signature
+ * for the input data using the ECDSA algorithm with SHA-256 as the hash function.
+ *
+ * @param {CryptoKey} privateKey - The ECDSA private key used for signing.
+ * @param {Uint8Array} data - The data to be signed.
+ * @returns {Promise<ArrayBuffer>} - A promise that resolves to the generated signature.
+ */
+export async function computeECDSASig(
+  privateKey: CryptoKey,
+  data: Uint8Array
+): Promise<ArrayBuffer> {
+  const signature = await crypto.subtle.sign(
+    {
+      name: AlgorithmName.ECDSA,
+      hash: { name: 'SHA-256' },
+    },
+    privateKey,
+    data
+  );
+  return signature;
+}
+
+/**
+ * Verifies an ECDSA signature using the provided public key and data.
+ *
+ * This function uses the Web Crypto API to verify the digital signature
+ * for the input data using the ECDSA algorithm with SHA-256 as the hash function.
+ *
+ * @param {CryptoKey} publicKey - The ECDSA public key used for verification.
+ * @param {Uint8Array} signature - The signature to be verified.
+ * @param {Uint8Array} data - The data that was signed.
+ * @returns {Promise<boolean>} - A promise that resolves to a boolean indicating whether the signature is valid.
+ */
+export async function verifyECDSASignature(
+  publicKey: CryptoKey,
+  signature: Uint8Array,
+  data: Uint8Array
+): Promise<boolean> {
+  const isValid = await crypto.subtle.verify(
+    {
+      name: AlgorithmName.ECDSA,
+      hash: { name: 'SHA-256' },
+    },
+    publicKey,
+    signature,
+    data
+  );
+  return isValid;
+}
+
+/**
+ * Extracts the r and s values from a given ECDSA signature.
+ *
+ * @param {Uint8Array} signatureBytes - The raw ECDSA signature bytes.
+ * @returns {{ r: Uint8Array; s: Uint8Array }} An object containing the r and s values as Uint8Arrays.
+ * @throws {Error} If the validation of the signature fails.
+ */
+export function extractRSValuesFromSignature(signatureBytes: Uint8Array): {
+  r: Uint8Array;
+  s: Uint8Array;
+} {
+  // Split the raw signature into r and s values
+  const halfLength = Math.floor(signatureBytes.length / 2);
+  const rValue = signatureBytes.slice(0, halfLength);
+  const sValue = signatureBytes.slice(halfLength);
+
+  // Correct validation
+  if (!concatAndCompareUint8Arrays(rValue, sValue, signatureBytes)) {
+    throw new ConfigurationError('invalid ECDSA signature');
+  }
+
+  return {
+    r: rValue,
+    s: sValue,
+  };
+}
+
+function concatAndCompareUint8Arrays(
+  arr1: Uint8Array,
+  arr2: Uint8Array,
+  arr3: Uint8Array
+): boolean {
+  // Create a new Uint8Array with the combined length of arr1 and arr2
+  const concatenated = new Uint8Array(arr1.length + arr2.length);
+
+  // Copy arr1 and arr2 into the new array
+  concatenated.set(arr1, 0);
+  concatenated.set(arr2, arr1.length);
+
+  // Check if the lengths are the same
+  if (concatenated.length !== arr3.length) {
+    return false;
+  }
+
+  // Compare each element
+  for (let i = 0; i < concatenated.length; i++) {
+    if (concatenated[i] !== arr3[i]) {
+      return false;
+    }
+  }
+
+  return true;
+}