@opentdf/sdk 0.1.0-beta.1701

package/tdf3/src/client/validation.ts

@@ -0,0 +1,79 @@
+import { AttributeValidationError } from '../../../src/errors.js';
+
+const sageGetMatch = (match: RegExpMatchArray | null) => (match ? match[0] : null);
+
+export const ATTR_NAME_PROP_NAME = 'attr';
+export const ATTR_VALUE_PROP_NAME = 'value';
+
+// Validate attribute url protocol starts with `http://` or `https://`
+const SCHEME = '(https?://)';
+
+// validate url host be like `localhost:4000`
+const HOST_PORT = '([a-z0-9][a-z0-9]{1,}:[0-9]{1,4})';
+
+// validate url host be like `www.example.com`
+const WWW_HOST = '([a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+[a-z]{2,}';
+
+// validate url host be like `127.0.0.1:4000`
+const IP_HOST_PORT = '([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}:[0-9]{1,4})';
+
+// validate host is one of those above
+const HOST = `(${HOST_PORT}|${WWW_HOST}|${IP_HOST_PORT})`;
+
+// validate attr  name be like `/attr/<attr_name>`
+export const ATTR_NAME = `(/${ATTR_NAME_PROP_NAME}/[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]?)`;
+
+// validate value pattern
+export const ATTR_VALUE = `(/${ATTR_VALUE_PROP_NAME}/[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]?)`;
+
+// validate attribute authority  e.g. https://example.com
+const ATTR_AUTHORITY_PATTERN = `(${SCHEME}${HOST})`;
+
+// validate attribute namespace e.g. https://example.com/attr/someattribute
+const ATTR_NAMESPACE_PATTERN = `(${ATTR_AUTHORITY_PATTERN}${ATTR_NAME})`;
+
+// validate whole attribute e.g. https://example.com/attr/someattribute/value/somevalue
+export const ATTR_ATTRIBUTE_PATTERN = `^(${ATTR_NAMESPACE_PATTERN}${ATTR_VALUE})$`;
+
+export const validateAttributeObject = (attr: unknown): true | never => {
+  const isObject = typeof attr === 'object';
+  if (!isObject) {
+    throw new AttributeValidationError(`attribute should be an object`, attr);
+  }
+
+  const { attribute } = attr as Record<string, unknown>;
+  const isString = typeof attribute === 'string';
+  if (!isString) {
+    throw new AttributeValidationError(`attribute prop should be a string`, attr);
+  }
+
+  return validateAttribute(attribute);
+};
+
+export function validateAttribute(attribute: string): true | never {
+  if (!attribute.match(ATTR_ATTRIBUTE_PATTERN)) {
+    throw new AttributeValidationError(`attribute is in invalid format [${attribute}]`, attribute);
+  }
+
+  const ATTR_NAME_PREFIX = `/${ATTR_NAME_PROP_NAME}/`;
+  const ATTR_VALUE_PREFIX = `/${ATTR_VALUE_PROP_NAME}/`;
+  const attrNameMatch = sageGetMatch(attribute.match(ATTR_NAME));
+  const attrValueMatch = sageGetMatch(attribute.match(ATTR_VALUE));
+
+  if (!attrNameMatch) {
+    throw new AttributeValidationError(`attribute name matching error`, attribute);
+  }
+
+  if (!attrValueMatch) {
+    throw new AttributeValidationError(`attribute value matching error`, attribute);
+  }
+
+  const attributeName = attrNameMatch.slice(ATTR_NAME_PREFIX.length);
+  const attributeValue = attrValueMatch.slice(ATTR_VALUE_PREFIX.length);
+
+  if (attributeName === attributeValue) {
+    throw new AttributeValidationError(`attribute name should be unique with its value`, attribute);
+  }
+
+  return true;
+}

package/tdf3/src/crypto/crypto-utils.ts

@@ -0,0 +1,119 @@
+import { base64 } from '../../../src/encodings/index.js';
+import { type AnyKeyPair, type PemKeyPair } from './declarations.js';
+import { rsaPkcs1Sha256 } from './index.js';
+
+/**
+ * Validates a specified key size
+ * @param size in bits requested
+ * @param minSize in bits allowed
+ */
+export const isValidAsymmetricKeySize = (size: number | undefined, minSize?: number): boolean => {
+  // No size specified is fine because the minSize will be used
+  if (size === undefined) {
+    return !!minSize;
+  }
+
+  if (typeof size !== 'number' || (minSize && size < minSize)) {
+    return false;
+  }
+
+  return true;
+};
+
+/**
+ * Format a base64 string representation of a key file
+ * in PEM PKCS#8 format by adding a header and footer
+ * and new lines.
+ *
+ * The PEM spec says to use <CR><LF> (\r\n) per
+ * https://tools.ietf.org/html/rfc1421#section-4.3.2.2, but
+ * many implementations use just \n, so this function
+ * follows the convention over the spec.
+ *
+ * @param  base64KeyString input
+ * @param  label header and footer label that identifies key type
+ * @return formatted output
+ */
+export const formatAsPem = (bytes: ArrayBuffer, label: string): string => {
+  let pemCert = `-----BEGIN ${label}-----\n`;
+  let nextIndex = 0;
+  const base64KeyString = base64.encodeArrayBuffer(bytes);
+  while (nextIndex < base64KeyString.length) {
+    if (nextIndex + 64 <= base64KeyString.length) {
+      pemCert += `${base64KeyString.substr(nextIndex, 64)}\n`;
+    } else {
+      pemCert += `${base64KeyString.substr(nextIndex)}\n`;
+    }
+    nextIndex += 64;
+  }
+  pemCert += `-----END ${label}-----\n`;
+  return pemCert;
+};
+
+/**
+ * Remove PEM formatting (new line characters and headers / footers)
+ * from a PEM string
+ *
+ * @param  input - PEM formatted string
+ * @return String with formatting removed
+ */
+export const removePemFormatting = (input: string): string => {
+  if (typeof input !== 'string') {
+    console.error('Not a pem string', input);
+    return input;
+  }
+  const oneLiner = input.replace(/[\n\r]/g, '');
+  // https://www.rfc-editor.org/rfc/rfc7468#section-2
+  return oneLiner.replace(
+    /-----(?:BEGIN|END)\s(?:RSA\s)?(?:PUBLIC|PRIVATE|CERTIFICATE)\sKEY-----/g,
+    ''
+  );
+};
+
+const PEMRE =
+  /-----BEGIN\s((?:RSA\s)?(?:PUBLIC\sKEY|PRIVATE\sKEY|CERTIFICATE))-----[\s0-9A-Za-z+/=]+-----END\s\1-----/;
+
+export const isPemKeyPair = (i: AnyKeyPair): i is PemKeyPair => {
+  const { privateKey, publicKey } = i;
+  if (typeof privateKey !== 'string' || typeof publicKey !== 'string') {
+    return false;
+  }
+  const privateMatch = PEMRE.exec(privateKey);
+  if (!privateMatch || !privateMatch[1] || privateMatch[1].indexOf('PRIVATE KEY') < 0) {
+    return false;
+  }
+  const publicMatch = PEMRE.exec(publicKey);
+  if (!publicMatch || !publicMatch[1] || publicMatch[1].indexOf('PRIVATE') >= 0) {
+    return false;
+  }
+  return true;
+};
+
+export const isCryptoKeyPair = (i: AnyKeyPair): i is CryptoKeyPair => {
+  const { privateKey, publicKey } = i;
+  if (typeof privateKey !== 'object' || typeof publicKey !== 'object') {
+    return false;
+  }
+  if (!(privateKey instanceof CryptoKey) || !(publicKey instanceof CryptoKey)) {
+    return false;
+  }
+  return privateKey.type === 'private' && publicKey.type === 'public';
+};
+
+export const toCryptoKeyPair = async (input: AnyKeyPair): Promise<CryptoKeyPair> => {
+  if (isCryptoKeyPair(input)) {
+    return input;
+  }
+  if (!isPemKeyPair(input)) {
+    throw new Error('internal: generated invalid keypair');
+  }
+  const k = [input.publicKey, input.privateKey]
+    .map(removePemFormatting)
+    .map((e) => base64.decodeArrayBuffer(e));
+  const algorithm = rsaPkcs1Sha256();
+  const [publicKey, privateKey] = await Promise.all([
+    crypto.subtle.importKey('spki', k[0], algorithm, true, ['verify']),
+    crypto.subtle.importKey('pkcs8', k[1], algorithm, true, ['sign']),
+  ]);
+  return { privateKey, publicKey };
+};

package/tdf3/src/crypto/declarations.ts

@@ -0,0 +1,89 @@
+import { Binary } from '../binary.js';
+import { type AlgorithmUrn } from '../ciphers/algorithms.js';
+
+export type EncryptResult = {
+  /** Encrypted payload. */
+  payload: Binary;
+  /** Auth tag, if generated/ */
+  authTag?: Binary;
+};
+
+export type DecryptResult = {
+  payload: Binary;
+};
+
+/**
+ * PEM formatted keypair.
+ */
+export type PemKeyPair = {
+  publicKey: string;
+  privateKey: string;
+};
+
+/**
+ * The minimum acceptable asymetric key size, currently 2^11.
+ */
+export const MIN_ASYMMETRIC_KEY_SIZE_BITS = 2048;
+
+export type AnyKeyPair = PemKeyPair | CryptoKeyPair;
+
+export type CryptoService = {
+  /** Track which crypto implementation we are using */
+  name: string;
+
+  /** Default algorithm identifier. */
+  method: AlgorithmUrn;
+
+  /** Convert or narrow from AnyKeyPair to PemKeyPair */
+  cryptoToPemPair: (keys: AnyKeyPair) => Promise<PemKeyPair>;
+
+  /**
+   * Try to decrypt content with the default or handed algorithm. Throws on
+   * most failure, if auth tagging is implemented for example.
+   */
+  decrypt: (
+    payload: Binary,
+    key: Binary,
+    iv: Binary,
+    algorithm?: AlgorithmUrn,
+    authTag?: Binary
+  ) => Promise<DecryptResult>;
+
+  decryptWithPrivateKey: (encryptedPayload: Binary, privateKey: string) => Promise<Binary>;
+
+  /**
+   * Encrypt content with the default or handed algorithm.
+   */
+  encrypt: (
+    payload: Binary,
+    key: Binary,
+    iv: Binary,
+    algorithm?: AlgorithmUrn
+  ) => Promise<EncryptResult>;
+
+  encryptWithPublicKey: (payload: Binary, publicKey: string) => Promise<Binary>;
+
+  /** Get length random bytes as a hex-encoded string. */
+  generateInitializationVector: (length?: number) => Promise<string>;
+
+  /** Get length random bytes as a hex-encoded string. */
+  generateKey: (length?: number) => Promise<string>;
+
+  /**
+   * Generate an RSA key pair
+   * @param size in bits, defaults to a reasonable size for the default method
+   */
+  generateKeyPair: (size?: number) => Promise<AnyKeyPair>;
+
+  generateSigningKeyPair: () => Promise<AnyKeyPair>;
+
+  /**
+   * Create an HMAC SHA256 hash
+   */
+  hmac: (key: string, content: string) => Promise<string>;
+
+  randomBytes: (byteLength: number) => Promise<Uint8Array>;
+
+  /** Compute the hex-encoded SHA hash of a UTF-16 encoded string. */
+  sha256: (content: string) => Promise<string>;
+};

package/tdf3/src/crypto/index.ts

@@ -0,0 +1,394 @@
+/**
+ * This file is for using native crypto in the browser.
+ *
+ * @private
+ */
+
+import { Algorithms } from '../ciphers/index.js';
+import { Binary } from '../binary.js';
+import {
+  CryptoService,
+  DecryptResult,
+  EncryptResult,
+  MIN_ASYMMETRIC_KEY_SIZE_BITS,
+  PemKeyPair,
+} from './declarations.js';
+import { ConfigurationError, DecryptError } from '../../../src/errors.js';
+import { formatAsPem, removePemFormatting } from './crypto-utils.js';
+import { encodeArrayBuffer as hexEncode } from '../../../src/encodings/hex.js';
+import { decodeArrayBuffer as base64Decode } from '../../../src/encodings/base64.js';
+import { AlgorithmUrn } from '../ciphers/algorithms.js';
+
+// Used to pass into native crypto functions
+const METHODS: KeyUsage[] = ['encrypt', 'decrypt'];
+export const isSupported = typeof globalThis?.crypto !== 'undefined';
+
+export const method = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc';
+export const name = 'BrowserNativeCryptoService';
+
+/**
+ * Get a DOMString representing the algorithm to use for an
+ * asymmetric key generation.
+ */
+export function rsaOaepSha1(
+  modulusLength: number = MIN_ASYMMETRIC_KEY_SIZE_BITS
+): RsaHashedKeyGenParams {
+  if (!modulusLength || modulusLength < MIN_ASYMMETRIC_KEY_SIZE_BITS) {
+    throw new ConfigurationError('Invalid key size requested');
+  }
+  return {
+    name: 'RSA-OAEP',
+    hash: {
+      name: 'SHA-1',
+    },
+    modulusLength,
+    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // 24 bit representation of 65537
+  };
+}
+
+export function rsaPkcs1Sha256(
+  modulusLength: number = MIN_ASYMMETRIC_KEY_SIZE_BITS
+): RsaHashedKeyGenParams {
+  if (!modulusLength || modulusLength < MIN_ASYMMETRIC_KEY_SIZE_BITS) {
+    throw new ConfigurationError('Invalid key size requested');
+  }
+  return {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: {
+      name: 'SHA-256',
+    },
+    modulusLength,
+    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // 24 bit representation of 65537
+  };
+}
+
+/**
+ * Generate a random hex key
+ * @return New key as a hex string
+ */
+export async function generateKey(length?: number): Promise<string> {
+  return randomBytesAsHex(length || 32);
+}
+
+/**
+ * Generate an RSA key pair
+ * @see    {@link https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey}
+ * @param  size in bits
+ */
+export async function generateKeyPair(size?: number): Promise<CryptoKeyPair> {
+  const algoDomString = rsaOaepSha1(size || MIN_ASYMMETRIC_KEY_SIZE_BITS);
+  return crypto.subtle.generateKey(algoDomString, true, METHODS);
+}
+
+/**
+ * Generate an RSA key pair suitable for signatures
+ * @see    {@link https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey}
+ */
+export async function generateSigningKeyPair(): Promise<CryptoKeyPair> {
+  return crypto.subtle.generateKey(
+    {
+      name: 'RSASSA-PKCS1-v1_5',
+      hash: 'SHA-256',
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+    },
+    true,
+    ['sign', 'verify']
+  );
+}
+
+export async function cryptoToPemPair(keysMaybe: unknown): Promise<PemKeyPair> {
+  const keys = keysMaybe as CryptoKeyPair;
+  if (!keys.privateKey || !keys.publicKey) {
+    // These are only ever generated here, so this should not happen
+    throw new Error('internal: invalid keys');
+  }
+
+  const [exPublic, exPrivate] = await Promise.all([
+    crypto.subtle.exportKey('spki', keys.publicKey),
+    crypto.subtle.exportKey('pkcs8', keys.privateKey),
+  ]);
+  return {
+    publicKey: formatAsPem(exPublic, 'PUBLIC KEY'),
+    privateKey: formatAsPem(exPrivate, 'PRIVATE KEY'),
+  };
+}
+
+/**
+ * Encrypt using a public key
+ * @param payload Payload to encrypt
+ * @param publicKey PEM formatted public key
+ * @return Encrypted payload
+ */
+export async function encryptWithPublicKey(payload: Binary, publicKey: string): Promise<Binary> {
+  console.assert(typeof payload === 'object');
+  console.assert(typeof publicKey === 'string');
+
+  const algoDomString = rsaOaepSha1();
+
+  // Web Crypto APIs don't work with PEM formatted strings
+  publicKey = removePemFormatting(publicKey);
+
+  const keyBuffer = base64Decode(publicKey);
+  const cryptoKey = await crypto.subtle.importKey('spki', keyBuffer, algoDomString, false, [
+    'encrypt',
+  ]);
+  const result = await crypto.subtle.encrypt(
+    { name: 'RSA-OAEP' },
+    cryptoKey,
+    payload.asArrayBuffer()
+  );
+  return Binary.fromArrayBuffer(result);
+}
+
+/**
+ * Generate a 16-byte initialization vector
+ */
+export async function generateInitializationVector(length?: number): Promise<string> {
+  return randomBytesAsHex(length || 16);
+}
+
+export async function randomBytes(byteLength: number): Promise<Uint8Array> {
+  const r = new Uint8Array(byteLength);
+  crypto.getRandomValues(r);
+  return r;
+}
+
+/**
+ * Returns a promise to the encryption key as a binary string.
+ *
+ * Note: This function should almost never fail as it includes a fallback
+ * if for some reason the native generate key fails.
+ *
+ * @param length The key length, defaults to 256
+ *
+ * @returns The hex string.
+ */
+export async function randomBytesAsHex(length: number): Promise<string> {
+  // Create a typed array of the correct length to fill
+  const r = new Uint8Array(length);
+  crypto.getRandomValues(r);
+  return hexEncode(r.buffer);
+}
+
+/**
+ * Decrypt a public-key encrypted payload with a private key
+ * @param  encryptedPayload  Payload to decrypt
+ * @param  privateKey        PEM formatted private keynpmv
+ * @return Decrypted payload
+ */
+export async function decryptWithPrivateKey(
+  encryptedPayload: Binary,
+  privateKey: string
+): Promise<Binary> {
+  console.assert(typeof encryptedPayload === 'object', 'encryptedPayload must be object');
+  console.assert(typeof privateKey === 'string', 'privateKey must be string');
+
+  const algoDomString = rsaOaepSha1();
+
+  // Web Crypto APIs don't work with PEM formatted strings
+  const keyDataString = removePemFormatting(privateKey);
+  const keyData = base64Decode(keyDataString);
+
+  const key = await crypto.subtle.importKey('pkcs8', keyData, algoDomString, false, ['decrypt']);
+  const payload = await crypto.subtle.decrypt(
+    { name: 'RSA-OAEP' },
+    key,
+    encryptedPayload.asArrayBuffer()
+  );
+  const bufferView = new Uint8Array(payload);
+  return Binary.fromArrayBuffer(bufferView.buffer);
+}
+
+/**
+ * Decrypt content synchronously
+ * @param payload The payload to decrypt
+ * @param key     The encryption key
+ * @param iv      The initialization vector
+ * @param algorithm The algorithm to use for encryption
+ * @param authTag The authentication tag for authenticated crypto.
+ */
+export function decrypt(
+  payload: Binary,
+  key: Binary,
+  iv: Binary,
+  algorithm?: AlgorithmUrn,
+  authTag?: Binary
+): Promise<DecryptResult> {
+  return _doDecrypt(payload, key, iv, algorithm, authTag);
+}
+
+/**
+ * Encrypt content synchronously
+ * @param payload   The payload to encrypt
+ * @param key       The encryption key
+ * @param iv        The initialization vector
+ * @param algorithm The algorithm to use for encryption
+ */
+export function encrypt(
+  payload: Binary,
+  key: Binary,
+  iv: Binary,
+  algorithm?: AlgorithmUrn
+): Promise<EncryptResult> {
+  return _doEncrypt(payload, key, iv, algorithm);
+}
+
+async function _doEncrypt(
+  payload: Binary,
+  key: Binary,
+  iv: Binary,
+  algorithm?: AlgorithmUrn
+): Promise<EncryptResult> {
+  console.assert(payload != null);
+  console.assert(key != null);
+  console.assert(iv != null);
+
+  const payloadBuffer = payload.asArrayBuffer();
+  const algoDomString = getSymmetricAlgoDomString(iv, algorithm);
+
+  const importedKey = await _importKey(key, algoDomString);
+  const encrypted = await crypto.subtle.encrypt(algoDomString, importedKey, payloadBuffer);
+  if (algoDomString.name === 'AES-GCM') {
+    return {
+      payload: Binary.fromArrayBuffer(encrypted.slice(0, -16)),
+      authTag: Binary.fromArrayBuffer(encrypted.slice(-16)),
+    };
+  }
+  return {
+    payload: Binary.fromArrayBuffer(encrypted),
+  };
+}
+
+async function _doDecrypt(
+  payload: Binary,
+  key: Binary,
+  iv: Binary,
+  algorithm?: AlgorithmUrn,
+  authTag?: Binary
+): Promise<DecryptResult> {
+  console.assert(payload != null);
+  console.assert(key != null);
+  console.assert(iv != null);
+
+  let payloadBuffer = payload.asArrayBuffer();
+
+  // Concat the the auth tag to the payload for decryption
+  if (authTag) {
+    const authTagBuffer = authTag.asArrayBuffer();
+    const gcmPayload = new Uint8Array(payloadBuffer.byteLength + authTagBuffer.byteLength);
+    gcmPayload.set(new Uint8Array(payloadBuffer), 0);
+    gcmPayload.set(new Uint8Array(authTagBuffer), payloadBuffer.byteLength);
+    payloadBuffer = gcmPayload.buffer;
+  }
+
+  const algoDomString = getSymmetricAlgoDomString(iv, algorithm);
+
+  const importedKey = await _importKey(key, algoDomString);
+  algoDomString.iv = iv.asArrayBuffer();
+
+  const decrypted = await crypto.subtle
+    .decrypt(algoDomString, importedKey, payloadBuffer)
+    // Catching this error so we can specifically check for OperationError
+    .catch((err) => {
+      if (err.name === 'OperationError') {
+        throw new DecryptError(err);
+      }
+
+      throw err;
+    });
+  return { payload: Binary.fromArrayBuffer(decrypted) };
+}
+
+function _importKey(key: Binary, algorithm: AesCbcParams | AesGcmParams) {
+  return crypto.subtle.importKey('raw', key.asArrayBuffer(), algorithm, true, METHODS);
+}
+
+/**
+ * Get a DOMString representing the algorithm to use for a crypto
+ * operation. Defaults to AES-CBC.
+ * @param  {String|undefined} algorithm
+ * @return {DOMString} Algorithm to use
+ */
+function getSymmetricAlgoDomString(
+  iv: Binary,
+  algorithm?: AlgorithmUrn
+): AesCbcParams | AesGcmParams {
+  let nativeAlgorithm = 'AES-CBC';
+  if (algorithm === Algorithms.AES_256_GCM) {
+    nativeAlgorithm = 'AES-GCM';
+  }
+
+  return {
+    name: nativeAlgorithm,
+    iv: iv.asArrayBuffer(),
+  };
+}
+
+/**
+ * Create a SHA256 hash. Code refrenced from MDN:
+ * https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest
+ * @param  content  String content
+ * @return Hex hash
+ */
+export async function sha256(content: string): Promise<string> {
+  const buffer = new TextEncoder().encode(content);
+  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);
+  return hexEncode(hashBuffer);
+}
+
+/**
+ * Create an HMAC SHA256 hash
+ * @param  key     Key string
+ * @param  content Content string
+ * @return Hex hash
+ */
+export async function hmac(key: string, content: string): Promise<string> {
+  const contentBuffer = new TextEncoder().encode(content);
+  const keyBuffer = hex2Ab(key);
+  const cryptoKey = await crypto.subtle.importKey(
+    'raw',
+    keyBuffer,
+    {
+      name: 'HMAC',
+      hash: { name: 'SHA-256' },
+    },
+    true,
+    ['sign', 'verify']
+  );
+  const hashBuffer = await crypto.subtle.sign('HMAC', cryptoKey, contentBuffer);
+  return hexEncode(hashBuffer);
+}
+
+/**
+ * Create an ArrayBuffer from a hex string.
+ * https://developers.google.com/web/updates/2012/06/How-to-convert-ArrayBuffer-to-and-from-String?hl=en
+ * @param  hex - Hex string
+ */
+export function hex2Ab(hex: string): ArrayBuffer {
+  const buffer = new ArrayBuffer(hex.length / 2);
+  const bufferView = new Uint8Array(buffer);
+
+  for (let i = 0; i < hex.length; i += 2) {
+    bufferView[i / 2] = parseInt(hex.substr(i, 2), 16);
+  }
+
+  return buffer;
+}
+
+export const DefaultCryptoService: CryptoService = {
+  name,
+  method,
+  cryptoToPemPair,
+  decrypt,
+  decryptWithPrivateKey,
+  encrypt,
+  encryptWithPublicKey,
+  generateInitializationVector,
+  generateKey,
+  generateKeyPair,
+  generateSigningKeyPair,
+  hmac,
+  randomBytes,
+  sha256,
+};

package/tdf3/src/index.ts

@@ -0,0 +1,4 @@
+export * as Client from './client/index.js';
+export { Client as TDF3Client } from './client/index.js';
+export * as Errors from '../../src/errors.js';
+export { version, clientType } from './version.js';