@pryv/encryption 3.10.0

package/test/events-cipher.test.js

@@ -0,0 +1,350 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/* global describe, it, expect, beforeEach */
+
+const { EventsCipher, Keyring } = require('../src');
+const vector = require('./fixtures/aes-256-gcm.json');
+
+const KEY_REF = 'journal-2026';
+
+function newCipher (opts) {
+  const keyring = new Keyring({ [KEY_REF]: vector.keyBase64 });
+  return new EventsCipher(keyring, opts);
+}
+
+function plainEvent (over) {
+  return Object.assign({
+    id: 'evt-1',
+    streamIds: ['journal'],
+    time: 1500000000,
+    created: 1500000000,
+    createdBy: 'test',
+    type: 'note/txt',
+    content: 'a plaintext note'
+  }, over);
+}
+
+describe('[ENCC] EventsCipher', function () {
+  describe('[ENCCE] encryptEvent', function () {
+    it('[ENCCEA] wraps type as encrypted/<method> and builds a payload content', async function () {
+      const cipher = newCipher();
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(enc.type).to.equal('encrypted/aes-256-gcm');
+      expect(enc.content).to.have.property('payload').that.is.a('string');
+      expect(enc.content).to.have.property('keyRef', KEY_REF);
+    });
+
+    it('[ENCCEB] passes non-content/type fields through as plaintext', async function () {
+      const cipher = newCipher();
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(enc.id).to.equal('evt-1');
+      expect(enc.streamIds).to.deep.equal(['journal']);
+      expect(enc.time).to.equal(1500000000);
+      expect(enc.createdBy).to.equal('test');
+    });
+
+    it('[ENCCEC] includes hint only when provided; omits keyRef/hint when absent', async function () {
+      const cipher = newCipher();
+      const withHint = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF, hint: { kid: 1 } });
+      expect(withHint.content.hint).to.deep.equal({ kid: 1 });
+
+      // key resolvable via a resolver (no keyRef), so content should carry neither keyRef nor hint
+      const keyring = new Keyring();
+      keyring.use(async () => vector.keyBase64);
+      const cipher2 = new EventsCipher(keyring);
+      const noRefs = await cipher2.encryptEvent(plainEvent(), { method: 'aes-256-gcm' });
+      expect(noRefs.content).to.not.have.property('keyRef');
+      expect(noRefs.content).to.not.have.property('hint');
+    });
+
+    it('[ENCCED] does not mutate the input event', async function () {
+      const cipher = newCipher();
+      const input = plainEvent();
+      const snapshot = JSON.parse(JSON.stringify(input));
+      await cipher.encryptEvent(input, { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(input).to.deep.equal(snapshot);
+    });
+
+    it('[ENCCEE] throws on unknown method', async function () {
+      const cipher = newCipher();
+      await expect(cipher.encryptEvent(plainEvent(), { method: 'no-such', keyRef: KEY_REF }))
+        .to.be.rejected;
+    });
+
+    it('[ENCCEF] throws when no key can be resolved', async function () {
+      const cipher = newCipher();
+      await expect(cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: 'unknown-ref' }))
+        .to.be.rejected;
+    });
+  });
+
+  describe('[ENCCU] encryptEventContent', function () {
+    it('[ENCCUA] returns exactly { type: encrypted/<method>, content: { payload } }', async function () {
+      const cipher = newCipher();
+      const res = await cipher.encryptEventContent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(res).to.have.all.keys(['type', 'content']);
+      expect(res.type).to.equal('encrypted/aes-256-gcm');
+      expect(res.content).to.have.property('payload').that.is.a('string');
+    });
+
+    it('[ENCCUB] includes keyRef in content when provided', async function () {
+      const cipher = newCipher();
+      const res = await cipher.encryptEventContent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(res.content).to.have.property('keyRef', KEY_REF);
+    });
+
+    it('[ENCCUC] includes hint when provided; omits keyRef/hint when resolvable without refs', async function () {
+      const cipher = newCipher();
+      const withHint = await cipher.encryptEventContent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF, hint: { kid: 1 } });
+      expect(withHint.content.hint).to.deep.equal({ kid: 1 });
+
+      const keyring = new Keyring();
+      keyring.use(async () => vector.keyBase64);
+      const cipher2 = new EventsCipher(keyring);
+      const noRefs = await cipher2.encryptEventContent(plainEvent(), { method: 'aes-256-gcm' });
+      expect(noRefs.content).to.not.have.property('keyRef');
+      expect(noRefs.content).to.not.have.property('hint');
+    });
+
+    it('[ENCCUD] does not mutate the input material', async function () {
+      const cipher = newCipher();
+      const input = plainEvent();
+      const snapshot = JSON.parse(JSON.stringify(input));
+      await cipher.encryptEventContent(input, { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(input).to.deep.equal(snapshot);
+    });
+
+    it('[ENCCUE] only carries type + content of the material into the ciphertext (envelope fields excluded)', async function () {
+      const cipher = newCipher();
+      const res = await cipher.encryptEventContent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      // assemble a synthetic event and decrypt: restored material must be just type/content
+      const synthetic = { id: 'x', streamIds: ['s'], type: res.type, content: res.content };
+      const dec = await cipher.decryptEvent(synthetic);
+      expect(dec.type).to.equal('note/txt');
+      expect(dec.content).to.equal('a plaintext note');
+      // envelope-only fields of the ORIGINAL material must not have leaked into the payload
+      expect(dec).to.not.have.property('createdBy', 'test-should-not-be-in-payload');
+    });
+
+    it('[ENCCUF] round-trips: a synthetic event assembled from the result decrypts back', async function () {
+      const cipher = newCipher();
+      const material = { type: 'note/txt', content: 'updated body' };
+      const res = await cipher.encryptEventContent(material, { method: 'aes-256-gcm', keyRef: KEY_REF });
+      const synthetic = { id: 'evt-9', streamIds: ['journal'], type: res.type, content: res.content };
+      const dec = await cipher.decryptEvent(synthetic);
+      expect(dec.type).to.equal('note/txt');
+      expect(dec.content).to.equal('updated body');
+      expect(dec.decryptedFrom).to.equal(synthetic);
+    });
+
+    it('[ENCCUG] throws on unknown method', async function () {
+      const cipher = newCipher();
+      await expect(cipher.encryptEventContent(plainEvent(), { method: 'no-such', keyRef: KEY_REF }))
+        .to.be.rejected;
+    });
+
+    it('[ENCCUH] throws when the method is decrypt-only', async function () {
+      const cipher = newCipher();
+      cipher.registerMethod('read-only', {
+        decrypt: async (content, key) => JSON.parse(content.payload)
+      });
+      await expect(cipher.encryptEventContent(plainEvent(), { method: 'read-only', keyRef: KEY_REF }))
+        .to.be.rejected;
+    });
+
+    it('[ENCCUI] throws when no key can be resolved', async function () {
+      const cipher = newCipher();
+      await expect(cipher.encryptEventContent(plainEvent(), { method: 'aes-256-gcm', keyRef: 'unknown-ref' }))
+        .to.be.rejected;
+    });
+  });
+
+  describe('[ENCCD] decryptEvent', function () {
+    let cipher;
+    let encrypted;
+    beforeEach(async function () {
+      cipher = newCipher();
+      encrypted = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+    });
+
+    it('[ENCCDA] decrypts to a NEW object with restored type/content + decryptedFrom', async function () {
+      const out = await cipher.decryptEvent(encrypted);
+      expect(out).to.not.equal(encrypted);
+      expect(out.type).to.equal('note/txt');
+      expect(out.content).to.equal('a plaintext note');
+      expect(out.decryptedFrom).to.equal(encrypted);
+    });
+
+    it('[ENCCDB] preserves envelope fields from the encrypted event', async function () {
+      const out = await cipher.decryptEvent(encrypted);
+      expect(out.id).to.equal('evt-1');
+      expect(out.streamIds).to.deep.equal(['journal']);
+      expect(out.time).to.equal(1500000000);
+      expect(out.createdBy).to.equal('test');
+    });
+
+    it('[ENCCDC] does not mutate the original encrypted event', async function () {
+      const snapshot = JSON.parse(JSON.stringify(encrypted));
+      await cipher.decryptEvent(encrypted);
+      expect(encrypted).to.deep.equal(snapshot);
+    });
+
+    it('[ENCCDD] returns the SAME reference when type is not encrypted/<method>', async function () {
+      const ev = plainEvent();
+      const out = await cipher.decryptEvent(ev);
+      expect(out).to.equal(ev);
+    });
+
+    it('[ENCCDE] returns the SAME reference when method is not registered', async function () {
+      const ev = plainEvent({ type: 'encrypted/unregistered-method', content: { payload: 'x' } });
+      const out = await cipher.decryptEvent(ev);
+      expect(out).to.equal(ev);
+    });
+
+    it('[ENCCDF] no key found: returns SAME ref, calls onDecryptError, never throws', async function () {
+      const errors = [];
+      const keyring = new Keyring(); // empty store, no resolvers
+      const c = new EventsCipher(keyring, { onDecryptError: (event, error) => errors.push({ event, error }) });
+      const out = await c.decryptEvent(encrypted);
+      expect(out).to.equal(encrypted);
+      expect(errors).to.have.length(1);
+      expect(errors[0].event).to.equal(encrypted);
+      expect(errors[0].error).to.be.instanceOf(Error);
+    });
+
+    it('[ENCCDG] resolver that throws: returns SAME ref, calls onDecryptError, never throws', async function () {
+      const errors = [];
+      const keyring = new Keyring();
+      keyring.use(async () => { throw new Error('resolver boom'); });
+      const c = new EventsCipher(keyring, { onDecryptError: (event, error) => errors.push(error) });
+      const out = await c.decryptEvent(encrypted);
+      expect(out).to.equal(encrypted);
+      expect(errors).to.have.length(1);
+    });
+
+    it('[ENCCDH] wrong key: returns SAME ref, calls onDecryptError', async function () {
+      const errors = [];
+      const keyring = new Keyring({ [KEY_REF]: 'BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU=' });
+      const c = new EventsCipher(keyring, { onDecryptError: () => errors.push(1) });
+      const out = await c.decryptEvent(encrypted);
+      expect(out).to.equal(encrypted);
+      expect(errors).to.have.length(1);
+    });
+
+    it('[ENCCDI] malformed payload: returns SAME ref', async function () {
+      const bad = plainEvent({ type: 'encrypted/aes-256-gcm', content: { payload: 'not-a-valid-payload', keyRef: KEY_REF } });
+      const out = await cipher.decryptEvent(bad);
+      expect(out).to.equal(bad);
+    });
+
+    it('[ENCCDJ] decrypted material lacking type/content: returns SAME ref', async function () {
+      // encrypt an event whose type is missing -> decrypted material won't carry `type`
+      const halfPlain = { id: 'h1', streamIds: ['s'], content: 'no type here' };
+      const enc = await cipher.encryptEvent(halfPlain, { method: 'aes-256-gcm', keyRef: KEY_REF });
+      const errors = [];
+      const c = newCipher({ onDecryptError: () => errors.push(1) });
+      const out = await c.decryptEvent(enc);
+      expect(out).to.equal(enc);
+      expect(errors).to.have.length(1);
+    });
+
+    it('[ENCCDK] default onDecryptError is silent (no throw)', async function () {
+      const keyring = new Keyring();
+      const c = new EventsCipher(keyring);
+      const out = await c.decryptEvent(encrypted);
+      expect(out).to.equal(encrypted);
+    });
+  });
+
+  describe('[ENCCB] batch + streaming helpers', function () {
+    it('[ENCCBA] decryptEvents maps an array, decrypting matching events', async function () {
+      const cipher = newCipher();
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      const plain = plainEvent({ id: 'evt-2' });
+      const out = await cipher.decryptEvents([enc, plain]);
+      expect(out).to.have.length(2);
+      expect(out[0].type).to.equal('note/txt');
+      expect(out[0].decryptedFrom).to.equal(enc);
+      expect(out[1]).to.equal(plain); // untouched
+    });
+
+    it('[ENCCBB] wrapForEachEvent decrypts then forwards to the user callback', async function () {
+      const cipher = newCipher();
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      const seen = [];
+      const wrapped = cipher.wrapForEachEvent((event) => seen.push(event));
+      await wrapped(enc);
+      expect(seen).to.have.length(1);
+      expect(seen[0].type).to.equal('note/txt');
+      expect(seen[0].decryptedFrom).to.equal(enc);
+    });
+  });
+
+  describe('[ENCCS] stripDecrypted', function () {
+    it('[ENCCSA] returns the original encrypted event for a decrypted one', async function () {
+      const cipher = newCipher();
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      const dec = await cipher.decryptEvent(enc);
+      expect(cipher.stripDecrypted(dec)).to.equal(enc);
+    });
+
+    it('[ENCCSB] returns the event itself when it was not decrypted', function () {
+      const cipher = newCipher();
+      const ev = plainEvent();
+      expect(cipher.stripDecrypted(ev)).to.equal(ev);
+    });
+  });
+
+  describe('[ENCCM] registerMethod', function () {
+    it('[ENCCMA] registers a custom method usable for encrypt + decrypt', async function () {
+      const keyring = new Keyring({ [KEY_REF]: 'passthrough' });
+      const cipher = new EventsCipher(keyring);
+      // a trivial (insecure, test-only) method that base64-JSONs the material
+      cipher.registerMethod('plain-json', {
+        encrypt: async (material, key) => ({ payload: JSON.stringify(material) }),
+        decrypt: async (content, key) => JSON.parse(content.payload)
+      });
+      const enc = await cipher.encryptEvent(plainEvent(), { method: 'plain-json', keyRef: KEY_REF });
+      expect(enc.type).to.equal('encrypted/plain-json');
+      const dec = await cipher.decryptEvent(enc);
+      expect(dec.type).to.equal('note/txt');
+      expect(dec.content).to.equal('a plaintext note');
+    });
+
+    it('[ENCCMC] accepts a decrypt-only method (no encrypt)', async function () {
+      const cipher = newCipher();
+      cipher.registerMethod('read-only', {
+        decrypt: async (content, key) => JSON.parse(content.payload)
+      });
+      const ev = plainEvent({
+        type: 'encrypted/read-only',
+        content: { payload: JSON.stringify({ type: 'note/txt', content: 'decoded' }), keyRef: KEY_REF }
+      });
+      const dec = await cipher.decryptEvent(ev);
+      expect(dec.type).to.equal('note/txt');
+      expect(dec.content).to.equal('decoded');
+    });
+
+    it('[ENCCMD] encryptEvent with a decrypt-only method throws', async function () {
+      const cipher = newCipher();
+      cipher.registerMethod('read-only', {
+        decrypt: async (content, key) => JSON.parse(content.payload)
+      });
+      await expect(cipher.encryptEvent(plainEvent(), { method: 'read-only', keyRef: KEY_REF }))
+        .to.be.rejected;
+    });
+
+    it('[ENCCMB] can override a built-in method', async function () {
+      const cipher = newCipher();
+      let used = false;
+      cipher.registerMethod('aes-256-gcm', {
+        encrypt: async (material) => { used = true; return { payload: JSON.stringify(material) }; },
+        decrypt: async (content) => JSON.parse(content.payload)
+      });
+      await cipher.encryptEvent(plainEvent(), { method: 'aes-256-gcm', keyRef: KEY_REF });
+      expect(used).to.equal(true);
+    });
+  });
+});

package/test/fixtures/aes-256-gcm.json

@@ -0,0 +1,11 @@
+{
+  "description": "Deterministic AES-256-GCM test vector. payload = base64(iv || ciphertext || gcmTag). Generated once with a fixed 32-byte key (bytes 0..31) and a fixed 12-byte IV (bytes 0..11).",
+  "keyBase64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
+  "ivBase64": "AAECAwQFBgcICQoL",
+  "plaintextObject": {
+    "type": "note/txt",
+    "content": "secret message"
+  },
+  "plaintextJson": "{\"type\":\"note/txt\",\"content\":\"secret message\"}",
+  "payload": "AAECAwQFBgcICQoLPCCiYrWA4CGvL/j/1MYMFff0qxaTFDEIXQmRpydLc9diYsuIj6x36wfFGIiq+v9cBfRF8sIXTsUY8kkKszA="
+}

package/test/fixtures/aes-text-base64.json

@@ -0,0 +1,32 @@
+{
+  "description": "Legacy aes-text-base64 known-answer vectors. payload = base64(\"Salted__\" || salt[8] || AES-256-CBC(JSON, key, iv)); key+iv derived from the passphrase STRING via OpenSSL EVP_BytesToKey (MD5, 1 iteration). Generated by generate-aes-text-base64.js using node:crypto as an implementation-independent oracle.",
+  "vectors": [
+    {
+      "passphrase": "correct horse battery staple",
+      "plaintextObject": {
+        "type": "note/txt",
+        "content": "a legacy secret note"
+      },
+      "plaintextJson": "{\"type\":\"note/txt\",\"content\":\"a legacy secret note\"}",
+      "saltHex": "0102030405060708",
+      "payload": "U2FsdGVkX18BAgMEBQYHCCFXymfQ/729Q7VKEGY0z96dPk5U5mmdyxlVYODjTVlk4HeEYoe5lpeKH6WKiWG942x67xmSLxCd7cc0KDG+5Tw="
+    },
+    {
+      "passphrase": "p@ssw0rd — ünîcode ✓",
+      "plaintextObject": {
+        "type": "mass/kg",
+        "content": {
+          "value": 42,
+          "extra": [
+            1,
+            2,
+            3
+          ]
+        }
+      },
+      "plaintextJson": "{\"type\":\"mass/kg\",\"content\":{\"value\":42,\"extra\":[1,2,3]}}",
+      "saltHex": "a1b2c3d4e5f60718",
+      "payload": "U2FsdGVkX1+hssPU5fYHGFIbDqx7aqo8mD7JDhgtW/15wTNO8fWYALHGXd+RsnnIuajQ41t1JAVlCh/Ay2Q6QD7dDALC0AZRoOytp7oMIoU="
+    }
+  ]
+}

package/test/fixtures/ecies-aes-256-gcm.json

@@ -0,0 +1,40 @@
+{
+  "description": "Known-answer decrypt vector for ecies-aes-256-gcm. payload = base64(ephemeralPublicKey[65] || iv[12] || ciphertext || tag[16]); AES-256-GCM key = HKDF-SHA-256(ECDH(ephemeral, recipient), salt=<empty>, info=\"encrypted/ecies-aes-256-gcm\"). Recipient + ephemeral key pairs, IV and plaintext are all fixed. Generated by generate-ecies.js (Node WebCrypto).",
+  "recipient": {
+    "publicKey": {
+      "kty": "EC",
+      "crv": "P-256",
+      "x": "vN2pTQ7eQd3gDo9E9-T6XlK4J7nkkHDNPo5CEi54nIg",
+      "y": "v-noMfXE5bc8WQr7DLUVMw186XLeYnqNEyZEBacQnes"
+    },
+    "privateKey": {
+      "kty": "EC",
+      "crv": "P-256",
+      "x": "vN2pTQ7eQd3gDo9E9-T6XlK4J7nkkHDNPo5CEi54nIg",
+      "y": "v-noMfXE5bc8WQr7DLUVMw186XLeYnqNEyZEBacQnes",
+      "d": "kCm5Pa7sj_7firW_nild7COqV0eR3vI5ofaBJTRY3h4"
+    }
+  },
+  "ephemeral": {
+    "publicKey": {
+      "kty": "EC",
+      "crv": "P-256",
+      "x": "itduLILJK0LFNFSX4DJGsJveY0eMALL72we3KH38VDs",
+      "y": "XkK7ZETz45gBXbDDJS7QXpFKxLBQngvw8J29dDj04C4"
+    },
+    "privateKey": {
+      "kty": "EC",
+      "crv": "P-256",
+      "x": "itduLILJK0LFNFSX4DJGsJveY0eMALL72we3KH38VDs",
+      "y": "XkK7ZETz45gBXbDDJS7QXpFKxLBQngvw8J29dDj04C4",
+      "d": "Dm1NsoliiiaCF6PvfQMupI4a1FJ8UQhfy2faUXtYxU4"
+    }
+  },
+  "ivBase64": "AAECAwQFBgcICQoL",
+  "plaintextObject": {
+    "type": "note/txt",
+    "content": "an asymmetric secret note"
+  },
+  "plaintextJson": "{\"type\":\"note/txt\",\"content\":\"an asymmetric secret note\"}",
+  "payload": "BIrXbiyCyStCxTRUl+AyRrCb3mNHjACy+9sHtyh9/FQ7XkK7ZETz45gBXbDDJS7QXpFKxLBQngvw8J29dDj04C4AAQIDBAUGBwgJCguCp20WLofBEKOMIn3UAuXg8+iUZ9VUVw6wn7MmNIOX8Rg9tK6/Cr0A0o8Zecv+MsnHsZplOb2aOEZy7lwe7QmNPDLxBNo5N2iK"
+}

package/test/fixtures/generate-aes-text-base64.js

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/**
+ * One-off generator for `aes-text-base64.json` — an implementation-independent
+ * oracle for the legacy `aes-text-base64` decrypt-only method.
+ *
+ * The legacy on-disk format is the one produced historically by
+ * `CryptoJS.AES.encrypt(text, passphrase).toString()`:
+ *
+ *   base64( "Salted__" || salt[8] || AES-256-CBC(text, key, iv) )
+ *
+ * where `key` (32 bytes) and `iv` (16 bytes) are derived from the passphrase
+ * STRING and the salt via OpenSSL's EVP_BytesToKey (MD5, one iteration), and
+ * the cipher is AES-256-CBC with PKCS#7 padding.
+ *
+ * This script depends ONLY on `node:crypto` (createHash('md5') +
+ * createCipheriv('aes-256-cbc', …)) so it is an oracle independent of the
+ * WebCrypto implementation under test. Salts are FIXED so the emitted vectors
+ * are deterministic and can be committed as known-answer fixtures.
+ *
+ * Run: `node components/pryv-encryption/test/fixtures/generate-aes-text-base64.js`
+ */
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * OpenSSL EVP_BytesToKey with MD5 and a single hashing chain (count = 1).
+ * @param {Buffer} passphrase - the passphrase bytes (UTF-8 of the string).
+ * @param {Buffer} salt - 8 salt bytes.
+ * @param {number} keyLen - key length in bytes (32 for AES-256).
+ * @param {number} ivLen - IV length in bytes (16 for CBC).
+ * @returns {{ key: Buffer, iv: Buffer }}
+ */
+function evpBytesToKey (passphrase, salt, keyLen, ivLen) {
+  let derived = Buffer.alloc(0);
+  let block = Buffer.alloc(0);
+  while (derived.length < keyLen + ivLen) {
+    const hash = crypto.createHash('md5');
+    hash.update(block);
+    hash.update(passphrase);
+    hash.update(salt);
+    block = hash.digest();
+    derived = Buffer.concat([derived, block]);
+  }
+  return { key: derived.subarray(0, keyLen), iv: derived.subarray(keyLen, keyLen + ivLen) };
+}
+
+/**
+ * Encrypt a material object into a legacy `aes-text-base64` payload.
+ * @param {string} passphrase
+ * @param {Object} material - the `{ type, content }` object to protect.
+ * @param {Buffer} salt - 8 fixed salt bytes.
+ * @returns {{ plaintextJson: string, payload: string, saltHex: string }}
+ */
+function encryptLegacy (passphrase, material, salt) {
+  const plaintextJson = JSON.stringify(material);
+  const { key, iv } = evpBytesToKey(Buffer.from(passphrase, 'utf8'), salt, 32, 16);
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv); // PKCS#7 padding by default
+  const ciphertext = Buffer.concat([cipher.update(plaintextJson, 'utf8'), cipher.final()]);
+  const blob = Buffer.concat([Buffer.from('Salted__', 'ascii'), salt, ciphertext]);
+  return { plaintextJson, payload: blob.toString('base64'), saltHex: salt.toString('hex') };
+}
+
+const cases = [
+  {
+    passphrase: 'correct horse battery staple',
+    material: { type: 'note/txt', content: 'a legacy secret note' },
+    salt: Buffer.from('0102030405060708', 'hex')
+  },
+  {
+    passphrase: 'p@ssw0rd — ünîcode ✓',
+    material: { type: 'mass/kg', content: { value: 42, extra: [1, 2, 3] } },
+    salt: Buffer.from('a1b2c3d4e5f60718', 'hex')
+  }
+];
+
+const vectors = cases.map((c) => {
+  const { plaintextJson, payload, saltHex } = encryptLegacy(c.passphrase, c.material, c.salt);
+  return {
+    passphrase: c.passphrase,
+    plaintextObject: c.material,
+    plaintextJson,
+    saltHex,
+    payload
+  };
+});
+
+const out = {
+  description: 'Legacy aes-text-base64 known-answer vectors. payload = base64("Salted__" || salt[8] || AES-256-CBC(JSON, key, iv)); key+iv derived from the passphrase STRING via OpenSSL EVP_BytesToKey (MD5, 1 iteration). Generated by generate-aes-text-base64.js using node:crypto as an implementation-independent oracle.',
+  vectors
+};
+
+const target = path.join(__dirname, 'aes-text-base64.json');
+fs.writeFileSync(target, JSON.stringify(out, null, 2) + '\n');
+console.log('wrote', target, 'with', vectors.length, 'vectors');

package/test/fixtures/generate-ecies.js

@@ -0,0 +1,129 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/**
+ * One-off generator for `ecies-aes-256-gcm.json` — a known-answer DECRYPT
+ * vector for the asymmetric `ecies-aes-256-gcm` method.
+ *
+ * The wire format is FROZEN (published in the event-type registry):
+ *
+ *   payload = base64( ephemeralPublicKey[65, SEC1 uncompressed 0x04||X||Y]
+ *                     || iv[12] || ciphertext || tag[16] )
+ *
+ * Encryption steps:
+ *   1. ECDH(ephemeral private, recipient public) -> 32-byte shared secret.
+ *   2. HKDF-SHA-256(secret, salt = <empty>, info = ASCII "encrypted/ecies-aes-256-gcm"),
+ *      length 32 -> AES-256-GCM key.
+ *   3. AES-256-GCM(plaintext, key, iv) where plaintext = UTF-8 JSON of material.
+ *
+ * To make the vector reproducible and byte-exact, BOTH the recipient and the
+ * ephemeral key pairs, the 12-byte IV and the plaintext are FIXED here (the
+ * runtime `encrypt` uses a random ephemeral + random IV by design, which the
+ * round-trip tests cover separately). Generation runs on Node's WebCrypto; the
+ * emitted vector is plain JSON.
+ *
+ * Run: `node components/pryv-encryption/test/fixtures/generate-ecies.js`
+ */
+'use strict';
+
+const { webcrypto } = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const subtle = webcrypto.subtle;
+const INFO = 'encrypted/ecies-aes-256-gcm';
+
+// Fixed recipient key pair (P-256, JWK).
+const RECIPIENT = {
+  publicKey: {
+    kty: 'EC',
+    crv: 'P-256',
+    x: 'vN2pTQ7eQd3gDo9E9-T6XlK4J7nkkHDNPo5CEi54nIg',
+    y: 'v-noMfXE5bc8WQr7DLUVMw186XLeYnqNEyZEBacQnes'
+  },
+  privateKey: {
+    kty: 'EC',
+    crv: 'P-256',
+    x: 'vN2pTQ7eQd3gDo9E9-T6XlK4J7nkkHDNPo5CEi54nIg',
+    y: 'v-noMfXE5bc8WQr7DLUVMw186XLeYnqNEyZEBacQnes',
+    d: 'kCm5Pa7sj_7firW_nild7COqV0eR3vI5ofaBJTRY3h4'
+  }
+};
+
+// Fixed ephemeral key pair (P-256, JWK).
+const EPHEMERAL = {
+  publicKey: {
+    kty: 'EC',
+    crv: 'P-256',
+    x: 'itduLILJK0LFNFSX4DJGsJveY0eMALL72we3KH38VDs',
+    y: 'XkK7ZETz45gBXbDDJS7QXpFKxLBQngvw8J29dDj04C4'
+  },
+  privateKey: {
+    kty: 'EC',
+    crv: 'P-256',
+    x: 'itduLILJK0LFNFSX4DJGsJveY0eMALL72we3KH38VDs',
+    y: 'XkK7ZETz45gBXbDDJS7QXpFKxLBQngvw8J29dDj04C4',
+    d: 'Dm1NsoliiiaCF6PvfQMupI4a1FJ8UQhfy2faUXtYxU4'
+  }
+};
+
+// Fixed 12-byte IV and plaintext material.
+const IV = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]);
+const MATERIAL = { type: 'note/txt', content: 'an asymmetric secret note' };
+
+function bytesToBase64 (bytes) {
+  let bin = '';
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return Buffer.from(bin, 'binary').toString('base64');
+}
+
+async function main () {
+  // ECDH(ephemeral private, recipient public) -> 32-byte shared secret.
+  const ephPriv = await subtle.importKey('jwk', EPHEMERAL.privateKey, { name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits']);
+  const recipPub = await subtle.importKey('jwk', RECIPIENT.publicKey, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const secretBits = await subtle.deriveBits({ name: 'ECDH', public: recipPub }, ephPriv, 256);
+  const secret = new Uint8Array(secretBits);
+
+  // HKDF-SHA-256 -> AES-256-GCM key.
+  const hkdfKey = await subtle.importKey('raw', secret, 'HKDF', false, ['deriveBits']);
+  const aesBits = await subtle.deriveBits(
+    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode(INFO) },
+    hkdfKey,
+    256
+  );
+  const aesKey = await subtle.importKey('raw', new Uint8Array(aesBits), 'AES-GCM', false, ['encrypt']);
+
+  // AES-256-GCM encrypt.
+  const plaintext = new TextEncoder().encode(JSON.stringify(MATERIAL));
+  const cipherBuf = await subtle.encrypt({ name: 'AES-GCM', iv: IV }, aesKey, plaintext);
+  const cipherBytes = new Uint8Array(cipherBuf);
+
+  // Ephemeral public key as raw SEC1 uncompressed (65 bytes: 0x04 || X || Y).
+  const ephPub = await subtle.importKey('jwk', EPHEMERAL.publicKey, { name: 'ECDH', namedCurve: 'P-256' }, true, []);
+  const ephRaw = new Uint8Array(await subtle.exportKey('raw', ephPub));
+  if (ephRaw.length !== 65 || ephRaw[0] !== 0x04) {
+    throw new Error('unexpected ephemeral public key raw encoding');
+  }
+
+  const out = new Uint8Array(ephRaw.length + IV.length + cipherBytes.length);
+  out.set(ephRaw, 0);
+  out.set(IV, ephRaw.length);
+  out.set(cipherBytes, ephRaw.length + IV.length);
+
+  const fixture = {
+    description: 'Known-answer decrypt vector for ecies-aes-256-gcm. payload = base64(ephemeralPublicKey[65] || iv[12] || ciphertext || tag[16]); AES-256-GCM key = HKDF-SHA-256(ECDH(ephemeral, recipient), salt=<empty>, info="' + INFO + '"). Recipient + ephemeral key pairs, IV and plaintext are all fixed. Generated by generate-ecies.js (Node WebCrypto).',
+    recipient: RECIPIENT,
+    ephemeral: EPHEMERAL,
+    ivBase64: bytesToBase64(IV),
+    plaintextObject: MATERIAL,
+    plaintextJson: JSON.stringify(MATERIAL),
+    payload: bytesToBase64(out)
+  };
+
+  const target = path.join(__dirname, 'ecies-aes-256-gcm.json');
+  fs.writeFileSync(target, JSON.stringify(fixture, null, 2) + '\n');
+  console.log('wrote', target);
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });