@opentdf/sdk 0.1.0-beta.1701

package/src/nanotdf-crypto/encrypt.ts

@@ -0,0 +1,30 @@
+import { Ciphers, CipherTagLengths } from './ciphers.js';
+
+/**
+ * Encrypt plaintext buffer to ciphertext buffer
+ *
+ * Only supports AES-GCM
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/decrypt
+ *
+ * @param key Encryption key
+ * @param plaintext Bytes to encrypt
+ * @param iv Initialization vector
+ * @param tagLength Size (bits) of authentication tag
+ * @returns Resolves ciphertext buffer
+ */
+export default async function encrypt(
+  key: CryptoKey,
+  plaintext: Uint8Array,
+  iv: Uint8Array,
+  tagLength?: number
+): Promise<ArrayBuffer> {
+  return crypto.subtle.encrypt(
+    {
+      name: Ciphers.AesGcm,
+      iv,
+      tagLength: tagLength || CipherTagLengths.AesGcm,
+    },
+    key,
+    plaintext
+  );
+}

package/src/nanotdf-crypto/enums.ts

@@ -0,0 +1,47 @@
+export enum AlgorithmName {
+  ECDH = 'ECDH',
+  ECDSA = 'ECDSA',
+  ES256 = 'ES256',
+  HKDF = 'HKDF',
+  RSA_OAEP = 'RSA-OAEP',
+  RSA_PSS = 'RSA-PSS',
+}
+
+export enum NamedCurve {
+  P256 = 'P-256',
+  P384 = 'P-384',
+  P512 = 'P-512',
+}
+
+export enum CipherType {
+  AesGcm = 'AES-GCM',
+}
+
+export enum HashType {
+  Sha1 = 'SHA-1',
+  Sha256 = 'SHA-256',
+  Sha384 = 'SHA-384',
+  Sha512 = 'SHA-512',
+}
+
+export enum KeyFormat {
+  Raw = 'raw',
+  Pkcs8 = 'pkcs8',
+  Spki = 'spki',
+}
+
+export enum KeyType {
+  Private = 'private',
+  Public = 'public',
+}
+
+export enum KeyUsageType {
+  Encrypt = 'encrypt',
+  Decrypt = 'decrypt',
+  DeriveBits = 'deriveBits',
+  DeriveKey = 'deriveKey',
+  Verify = 'verify',
+  Sign = 'sign',
+  UnwrapKey = 'unwrapKey',
+  WrapKey = 'wrapKey',
+}

package/src/nanotdf-crypto/exportCryptoKey.ts

@@ -0,0 +1,17 @@
+/**
+ *
+ * Export to PEM format to binary buffer
+ * - key    {CryptoKey}     default: "undefined" CryptoKey generated by WebCrypto API
+ */
+export default async function exportCryptoKey(key: CryptoKey): Promise<ArrayBuffer> {
+  const exportedKey = await crypto.subtle.exportKey('raw', key);
+  const keyBuffer = new Uint8Array(exportedKey);
+  const len = keyBuffer.byteLength;
+  const xPoint = keyBuffer.slice(0, (1 + len) >>> 1); // drop `y`
+  xPoint[0] = 0x2 | (keyBuffer[len - 1] & 0x01); // encode sign of `y` in first bit
+
+  // Copy to Arraybuffer
+  const compressedPubKeyBuf = new ArrayBuffer(xPoint.byteLength);
+  new Uint8Array(compressedPubKeyBuf).set(new Uint8Array(xPoint));
+  return compressedPubKeyBuf;
+}

package/src/nanotdf-crypto/generateKeyPair.ts

@@ -0,0 +1,19 @@
+import { AlgorithmName, NamedCurve, KeyUsageType } from './enums.js';
+
+interface GenerateKeyPairOptions {
+  type: AlgorithmName.ECDH | AlgorithmName.ECDSA;
+  curve: NamedCurve;
+  keyUsages: Array<KeyUsageType>;
+  isExtractable: boolean;
+}
+
+export default async function generateKeyPair(
+  { type: name, curve: namedCurve, keyUsages, isExtractable }: GenerateKeyPairOptions = {
+    type: AlgorithmName.ECDH,
+    curve: NamedCurve.P256,
+    keyUsages: [KeyUsageType.DeriveBits, KeyUsageType.DeriveKey],
+    isExtractable: true,
+  }
+): Promise<CryptoKeyPair | never> {
+  return crypto.subtle.generateKey({ name, namedCurve }, isExtractable, keyUsages);
+}

package/src/nanotdf-crypto/generateRandomNumber.ts

@@ -0,0 +1,8 @@
+/**
+ * Generate a random number of given length
+ */
+export default function generateRandomNumber(length: number): Uint8Array {
+  const byteArray = new Uint8Array(length);
+  crypto.getRandomValues(byteArray);
+  return byteArray;
+}

package/src/nanotdf-crypto/importRawKey.ts

@@ -0,0 +1,19 @@
+import { CipherType, KeyFormat, KeyUsageType } from './enums.js';
+
+/**
+ * Import raw key
+ *
+ * A specific implementation of the importKey method to import raw keys. Specifies some defaults
+ * to ensure security.
+ *
+ * @param key Key which needs to be imported
+ * @param keyUsages How the key will be used
+ * @param isExtractable Whether key is extractable
+ */
+export default async function importRawKey(
+  key: ArrayBuffer,
+  keyUsages: Array<KeyUsageType>,
+  isExtractable = false
+): Promise<CryptoKey> {
+  return crypto.subtle.importKey(KeyFormat.Raw, key, CipherType.AesGcm, isExtractable, keyUsages);
+}

package/src/nanotdf-crypto/index.ts

@@ -0,0 +1,11 @@
+export { Ciphers } from './ciphers.js';
+export { default as decrypt } from './decrypt.js';
+export { default as digest } from './digest.js';
+export { default as encrypt } from './encrypt.js';
+export { default as generateKeyPair } from './generateKeyPair.js';
+export { default as importRawKey } from './importRawKey.js';
+export { keyAgreement } from './keyAgreement.js';
+export { default as exportCryptoKey } from './exportCryptoKey.js';
+export { default as generateRandomNumber } from './generateRandomNumber.js';
+export { pemPublicToCrypto, pemCertToCrypto } from './pemPublicToCrypto.js';
+export * as enums from './enums.js';

package/src/nanotdf-crypto/keyAgreement.ts

@@ -0,0 +1,139 @@
+/**
+ *
+ * Copyright (c) 2016 SafeBash
+ * Cryptography consultant: Andrew Kozlik, Ph.D.
+ *
+ * @link https://github.com/safebash/opencrypto
+ *
+ */
+
+/**
+ * MIT License
+ *
+ * Copyright (c) 2016 SafeBash
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+ * to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+ * NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+import { ConfigurationError } from '../errors.js';
+import { AlgorithmName, CipherType, HashType, KeyFormat, KeyType, KeyUsageType } from './enums.js';
+
+const KEY_USAGE_DERIVE_KEY = 'deriveKey';
+
+interface KeyAgreementOptions {
+  bitLength: number;
+  hkdfHash: HashAlgorithmIdentifier;
+  hkdfInfo: Uint8Array;
+  hkdfSalt: Uint8Array | ArrayBuffer;
+  keyCipher: string;
+  keyLength: number;
+  keyUsages: KeyUsage[];
+  isExtractable: boolean;
+}
+
+/**
+ *
+ * ECDH Key Agreement
+ * - publicKey          {CryptoKey}     default: "undefined"
+ * - privateKey         {CryptoKey}     default: "undefined"
+ * - options            {Object}        default: { bitLength: 256, hkdfHash: 'SHA-512', hkdfSalt: "new UInt8Array()", hkdfInfo: "new UInt8Array()", keyCipher: 'AES-GCM', keyLength: 256, keyUsages: ['encrypt', 'decrypt', 'wrapKey', 'unwrapKey'], isExtractable: true }
+ */
+export async function keyAgreement(
+  privateKey: CryptoKey,
+  publicKey: CryptoKey,
+  options: Partial<KeyAgreementOptions> = {
+    bitLength: 256,
+    hkdfHash: HashType.Sha256,
+    hkdfInfo: new Uint8Array(),
+    hkdfSalt: new Uint8Array(),
+    keyCipher: CipherType.AesGcm,
+    keyLength: 256,
+    keyUsages: [
+      KeyUsageType.Encrypt,
+      KeyUsageType.Decrypt,
+      KeyUsageType.UnwrapKey,
+      KeyUsageType.WrapKey,
+    ],
+    isExtractable: true,
+  }
+): Promise<CryptoKey> {
+  if (
+    publicKey?.algorithm?.name !== AlgorithmName.ECDSA &&
+    publicKey?.algorithm?.name !== AlgorithmName.ECDH
+  ) {
+    throw new ConfigurationError('CryptoKey is expected to be of type ECDSA or ECDH');
+  }
+
+  if (privateKey.type !== KeyType.Private) {
+    throw new ConfigurationError('Expected input of privateKey to be a CryptoKey of type private');
+  }
+
+  if (publicKey.type !== KeyType.Public) {
+    throw new ConfigurationError('Expected input of publicKey to be a CryptoKey of type public');
+  }
+
+  const {
+    bitLength = 256,
+    hkdfHash = HashType.Sha256,
+    hkdfInfo = new Uint8Array(),
+    hkdfSalt = new Uint8Array(),
+    keyCipher = CipherType.AesGcm,
+    keyLength = 256,
+    isExtractable = true,
+    keyUsages = [
+      KeyUsageType.Encrypt,
+      KeyUsageType.Decrypt,
+      KeyUsageType.UnwrapKey,
+      KeyUsageType.WrapKey,
+    ],
+  } = options;
+
+  const derivedBits = await crypto.subtle.deriveBits(
+    {
+      name: AlgorithmName.ECDH,
+      public: publicKey,
+    },
+    privateKey,
+    bitLength
+  );
+
+  const derivedKey = await crypto.subtle.importKey(
+    KeyFormat.Raw,
+    derivedBits,
+    {
+      name: AlgorithmName.HKDF,
+    },
+    false,
+    [KEY_USAGE_DERIVE_KEY]
+  );
+
+  const symmetricKey = await crypto.subtle.deriveKey(
+    {
+      name: AlgorithmName.HKDF,
+      hash: hkdfHash,
+      salt: hkdfSalt,
+      info: hkdfInfo,
+    },
+    derivedKey,
+    {
+      name: keyCipher,
+      length: keyLength,
+    },
+    isExtractable,
+    keyUsages
+  );
+
+  return symmetricKey;
+}

package/src/nanotdf-crypto/pemPublicToCrypto.ts

@@ -0,0 +1,232 @@
+/**
+ *
+ * Copyright (c) 2016 SafeBash
+ * Cryptography consultant: Andrew Kozlik, Ph.D.
+ *
+ * @link https://github.com/safebash/opencrypto
+ *
+ */
+
+/**
+ * MIT License
+ *
+ * Copyright (c) 2016 SafeBash
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+ * to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+ * NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+import * as base64 from '../encodings/base64.js';
+import { importX509 } from 'jose';
+import { type KeyObject } from 'crypto';
+import { encodeArrayBuffer as hexEncodeArrayBuffer } from '../encodings/hex.js';
+import { ConfigurationError, TdfError } from '../errors.js';
+
+const RSA_OID = '06092a864886f70d010101';
+const EC_OID = '06072a8648ce3d0201';
+const P256_OID = '06082a8648ce3d030107';
+const P384_OID = '06052b81040022';
+const P521_OID = '06052b81040023';
+const SHA_512 = 'SHA-512';
+const SPKI = 'spki';
+const CERT_BEGIN = '-----BEGIN CERTIFICATE-----';
+const CERT_END = '-----END CERTIFICATE-----';
+
+const P_256 = 'P-256';
+const P_384 = 'P-384';
+const P_512 = 'P-512';
+type CurveName = typeof P_256 | typeof P_384 | typeof P_512;
+
+const ECDH = 'ECDH';
+const ECDSA = 'ECDSA';
+const RSA_OAEP = 'RSA-OAEP';
+const RSA_PSS = 'RSA-PSS';
+type AlgorithmName = typeof ECDH | typeof ECDSA | typeof RSA_OAEP | typeof RSA_PSS;
+
+interface PemPublicToCryptoOptions {
+  name?: string;
+  hash?: string;
+  usages?: KeyUsage[];
+  isExtractable: boolean;
+}
+
+function guessKeyUsages(algorithmName: AlgorithmName, usages?: KeyUsage[]): KeyUsage[] {
+  if (usages) return usages;
+  switch (algorithmName) {
+    case ECDSA:
+      return ['verify'];
+    case RSA_OAEP:
+      return ['encrypt', 'wrapKey'];
+    case RSA_PSS:
+      return ['verify'];
+    case ECDH:
+    default:
+      return [];
+  }
+}
+
+function guessAlgorithmName(hex: string, algorithmName?: string): AlgorithmName {
+  if (hex.includes(EC_OID)) {
+    if (!algorithmName || algorithmName === ECDH) {
+      return ECDH;
+    } else if (algorithmName === ECDSA) {
+      return ECDSA;
+    }
+  } else if (hex.includes(RSA_OID)) {
+    if (!algorithmName || algorithmName === RSA_OAEP) {
+      return RSA_OAEP;
+    } else if (algorithmName === RSA_PSS) {
+      return RSA_PSS;
+    }
+  }
+  throw new TypeError(`Invalid public key, ${algorithmName}`);
+}
+
+function guessCurveName(hex: string): CurveName {
+  if (hex.includes(P256_OID)) {
+    return P_256;
+  } else if (hex.includes(P384_OID)) {
+    return P_384;
+  } else if (hex.includes(P521_OID)) {
+    return P_512;
+  }
+  throw new TdfError('Unsupported curve name or invalid key');
+}
+
+/**
+ *
+ * Converts asymmetric public key from PEM to CryptoKey
+ * - publicKey       {String}      default: "undefined" PEM public key
+ * - options         {Object}      default: (depends on algorithm)
+ * -- ECDH: { name: 'ECDH', usages: [], isExtractable: true }
+ * -- ECDSA: { name: 'ECDSA', usages: ['verify'], isExtractable: true }
+ * -- RSA-OAEP: { name: 'RSA-OAEP', hash: { name: 'SHA-512' }, usages: ['encrypt', 'wrapKey'], isExtractable: true }
+ * -- RSA-PSS: { name: 'RSA-PSS', hash: { name: 'SHA-512' }, usages: ['verify'], isExtractable: true }
+ */
+export async function pemPublicToCrypto(
+  pem: string,
+  options: PemPublicToCryptoOptions = {
+    isExtractable: true,
+  }
+): Promise<CryptoKey> {
+  pem = pem.replace('-----BEGIN PUBLIC KEY-----', '');
+  pem = pem.replace('-----END PUBLIC KEY-----', '');
+  const b64 = pem.replace(/\s/g, '');
+  const arrayBuffer = base64.decodeArrayBuffer(b64);
+  const hex = hexEncodeArrayBuffer(arrayBuffer);
+
+  const algorithmName = guessAlgorithmName(hex, options.name);
+  const keyUsages = guessKeyUsages(algorithmName, options.usages);
+
+  if (algorithmName === ECDH || algorithmName === ECDSA) {
+    const namedCurve = guessCurveName(hex);
+    return crypto.subtle.importKey(
+      SPKI,
+      arrayBuffer,
+      {
+        name: algorithmName,
+        namedCurve,
+      },
+      options.isExtractable,
+      keyUsages
+    );
+  } else if (algorithmName === RSA_OAEP || algorithmName === RSA_PSS) {
+    return crypto.subtle.importKey(
+      SPKI,
+      arrayBuffer,
+      {
+        name: algorithmName,
+        hash: {
+          name: options.hash || SHA_512,
+        },
+      },
+      options.isExtractable,
+      keyUsages
+    );
+  } else {
+    throw new TypeError('Invalid public key');
+  }
+}
+
+/**
+ * Look up JWK algorithm at https://github.com/panva/jose/issues/210
+ */
+function toJwsAlg(hex: string) {
+  const a = guessAlgorithmName(hex);
+  if (a === ECDH) {
+    return 'ECDH-ES';
+  } else if (a === ECDSA) {
+    switch (guessCurveName(hex)) {
+      case 'P-256':
+        return 'ES256';
+      case 'P-384':
+        return 'ES384';
+      case 'P-512':
+        return 'ES512';
+    }
+  } else if (a === RSA_OAEP) {
+    return 'RS512';
+  } else {
+    return 'RSA-OAEP-512';
+  }
+}
+function toSubtleAlg(hex: string) {
+  const name = guessAlgorithmName(hex);
+  if (name === ECDH || name === ECDSA) {
+    return {
+      name,
+      namedCurve: guessCurveName(hex),
+    };
+  }
+  return {
+    name,
+    hash: { name: SHA_512 },
+  };
+}
+
+export async function pemCertToCrypto(
+  pem: string,
+  options: PemPublicToCryptoOptions = {
+    isExtractable: true,
+  }
+): Promise<CryptoKey> {
+  let crt = pem.replace(CERT_BEGIN, '');
+  crt = crt.replace(CERT_END, '');
+  const b64 = crt.replace(/\s/g, '');
+  const arrayBuffer = base64.decodeArrayBuffer(b64);
+  const hex = hexEncodeArrayBuffer(arrayBuffer);
+  const jwsAlg = toJwsAlg(hex);
+  const keylike = await importX509(pem, jwsAlg, { extractable: options.isExtractable });
+  const { type } = keylike;
+  if (type !== 'public') {
+    throw new ConfigurationError('unpublic');
+  }
+  // FIXME Jose workaround for node clients.
+  // jose returns a crypto key on node, but we expect a subtle-crypto key
+  // The below should convert it, I hope, by exporting to a JWK and back.
+  if ((keylike as KeyObject)?.export) {
+    const keyObject = keylike as KeyObject;
+    const subtleAlg = toSubtleAlg(hex);
+    const keyUsages = guessKeyUsages(subtleAlg.name, options.usages);
+    const subtleKey = await crypto.subtle.importKey(
+      'jwk',
+      keyObject.export({ format: 'jwk' }),
+      subtleAlg,
+      options.isExtractable,
+      keyUsages
+    );
+    return subtleKey;
+  }
+  return keylike as CryptoKey;
+}

package/src/package-lock.json

@@ -0,0 +1,6 @@
+{
+    "name": "src",
+    "lockfileVersion": 3,
+    "requires": true,
+    "packages": {}
+}

package/src/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "module"
+}

package/src/platform/authorization/authorization_connect.d.ts

@@ -0,0 +1,44 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file authorization/authorization.proto (package authorization, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetDecisionsByTokenRequest, GetDecisionsByTokenResponse, GetDecisionsRequest, GetDecisionsResponse, GetEntitlementsRequest, GetEntitlementsResponse } from "./authorization_pb";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service authorization.AuthorizationService
+ */
+export declare const AuthorizationService: {
+  readonly typeName: "authorization.AuthorizationService",
+  readonly methods: {
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetDecisions
+     */
+    readonly getDecisions: {
+      readonly name: "GetDecisions",
+      readonly I: typeof GetDecisionsRequest,
+      readonly O: typeof GetDecisionsResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetDecisionsByToken
+     */
+    readonly getDecisionsByToken: {
+      readonly name: "GetDecisionsByToken",
+      readonly I: typeof GetDecisionsByTokenRequest,
+      readonly O: typeof GetDecisionsByTokenResponse,
+      readonly kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetEntitlements
+     */
+    readonly getEntitlements: {
+      readonly name: "GetEntitlements",
+      readonly I: typeof GetEntitlementsRequest,
+      readonly O: typeof GetEntitlementsResponse,
+      readonly kind: MethodKind.Unary,
+    },
+  }
+};
+

package/src/platform/authorization/authorization_connect.js

@@ -0,0 +1,44 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file authorization/authorization.proto (package authorization, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetDecisionsByTokenRequest, GetDecisionsByTokenResponse, GetDecisionsRequest, GetDecisionsResponse, GetEntitlementsRequest, GetEntitlementsResponse } from "./authorization_pb";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service authorization.AuthorizationService
+ */
+export const AuthorizationService = {
+  typeName: "authorization.AuthorizationService",
+  methods: {
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetDecisions
+     */
+    getDecisions: {
+      name: "GetDecisions",
+      I: GetDecisionsRequest,
+      O: GetDecisionsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetDecisionsByToken
+     */
+    getDecisionsByToken: {
+      name: "GetDecisionsByToken",
+      I: GetDecisionsByTokenRequest,
+      O: GetDecisionsByTokenResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc authorization.AuthorizationService.GetEntitlements
+     */
+    getEntitlements: {
+      name: "GetEntitlements",
+      I: GetEntitlementsRequest,
+      O: GetEntitlementsResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+};
+