@reallyme/crypto 0.1.0

package/dist/p256Ecdsa.js

@@ -0,0 +1,85 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { p256 } from "@noble/curves/nist.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
+import { ReallyMeCryptoError } from "./errors.js";
+export const P256_ECDSA_SECRET_KEY_LENGTH = 32;
+export const P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 33;
+export const P256_ECDSA_COMPACT_SIGNATURE_LENGTH = 64;
+export const P256_ECDSA_DER_SIGNATURE_MAX_LENGTH = 72;
+/**
+ * P-256 ECDSA backed by @noble/curves.
+ *
+ * The workspace contract signs SHA-256(message) exactly once and uses DER
+ * encoding for signatures because that is what X.509, JOSE, and the Rust
+ * P-256 lane expose. We intentionally preserve the Rust vector bytes instead
+ * of applying a TypeScript-only low-S normalization policy.
+ */
+export const ReallyMeP256Ecdsa = {
+    generateKeyPair() {
+        const secretKey = p256.utils.randomSecretKey();
+        return {
+            publicKey: p256.getPublicKey(secretKey, true),
+            secretKey,
+        };
+    },
+    deriveKeyPair(secretKey) {
+        return {
+            publicKey: this.derivePublicKey(secretKey),
+            secretKey: secretKey.slice(),
+        };
+    },
+    derivePublicKey(secretKey) {
+        if (secretKey.length !== P256_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            return p256.getPublicKey(secretKey, true);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    sign(message, secretKey) {
+        if (secretKey.length !== P256_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const compactSignature = p256.sign(sha256(message), secretKey, {
+                lowS: false,
+                prehash: false,
+            });
+            return encodeEcdsaDerSignature(compactSignature, P256_ECDSA_SECRET_KEY_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    verify(signature, message, publicKey) {
+        if (publicKey.length !== P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        let compactSignature;
+        try {
+            p256.Point.fromBytes(publicKey);
+            compactSignature = decodeEcdsaDerSignature(signature, P256_ECDSA_SECRET_KEY_LENGTH, P256_ECDSA_DER_SIGNATURE_MAX_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const valid = p256.verify(compactSignature, sha256(message), publicKey, {
+                lowS: false,
+                prehash: false,
+            });
+            if (!valid) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-signature");
+        }
+    },
+};

package/dist/p384Ecdsa.d.ts

@@ -0,0 +1,23 @@
+export declare const P384_ECDSA_SECRET_KEY_LENGTH = 48;
+export declare const P384_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 49;
+export declare const P384_ECDSA_COMPACT_SIGNATURE_LENGTH = 96;
+export declare const P384_ECDSA_DER_SIGNATURE_MAX_LENGTH = 104;
+/**
+ * P-384 ECDSA backed by @noble/curves.
+ *
+ * The package signs SHA-384(message) exactly once and preserves DER signatures
+ * byte-for-byte with the Rust/Swift vector contract.
+ */
+export declare const ReallyMeP384Ecdsa: {
+    readonly generateKeyPair: () => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    readonly deriveKeyPair: (secretKey: Uint8Array) => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    readonly derivePublicKey: (secretKey: Uint8Array) => Uint8Array;
+    readonly sign: (message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly verify: (signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+};

package/dist/p384Ecdsa.js

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { p384 } from "@noble/curves/nist.js";
+import { sha384 } from "@noble/hashes/sha2.js";
+import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
+import { ReallyMeCryptoError } from "./errors.js";
+export const P384_ECDSA_SECRET_KEY_LENGTH = 48;
+export const P384_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 49;
+export const P384_ECDSA_COMPACT_SIGNATURE_LENGTH = 96;
+export const P384_ECDSA_DER_SIGNATURE_MAX_LENGTH = 104;
+/**
+ * P-384 ECDSA backed by @noble/curves.
+ *
+ * The package signs SHA-384(message) exactly once and preserves DER signatures
+ * byte-for-byte with the Rust/Swift vector contract.
+ */
+export const ReallyMeP384Ecdsa = {
+    generateKeyPair() {
+        const secretKey = p384.utils.randomSecretKey();
+        return {
+            publicKey: p384.getPublicKey(secretKey, true),
+            secretKey,
+        };
+    },
+    deriveKeyPair(secretKey) {
+        return {
+            publicKey: this.derivePublicKey(secretKey),
+            secretKey: secretKey.slice(),
+        };
+    },
+    derivePublicKey(secretKey) {
+        if (secretKey.length !== P384_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            return p384.getPublicKey(secretKey, true);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    sign(message, secretKey) {
+        if (secretKey.length !== P384_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const compactSignature = p384.sign(sha384(message), secretKey, {
+                lowS: false,
+                prehash: false,
+            });
+            return encodeEcdsaDerSignature(compactSignature, P384_ECDSA_SECRET_KEY_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    verify(signature, message, publicKey) {
+        if (publicKey.length !== P384_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        let compactSignature;
+        try {
+            p384.Point.fromBytes(publicKey);
+            compactSignature = decodeEcdsaDerSignature(signature, P384_ECDSA_SECRET_KEY_LENGTH, P384_ECDSA_DER_SIGNATURE_MAX_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const valid = p384.verify(compactSignature, sha384(message), publicKey, {
+                lowS: false,
+                prehash: false,
+            });
+            if (!valid) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-signature");
+        }
+    },
+};

package/dist/p521Ecdsa.d.ts

@@ -0,0 +1,23 @@
+export declare const P521_ECDSA_SECRET_KEY_LENGTH = 66;
+export declare const P521_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 67;
+export declare const P521_ECDSA_COMPACT_SIGNATURE_LENGTH = 132;
+export declare const P521_ECDSA_DER_SIGNATURE_MAX_LENGTH = 139;
+/**
+ * P-521 ECDSA backed by @noble/curves.
+ *
+ * P-521 DER signatures can require long-form sequence lengths; the shared DER
+ * helper enforces canonical positive INTEGER encoding before verification.
+ */
+export declare const ReallyMeP521Ecdsa: {
+    readonly generateKeyPair: () => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    readonly deriveKeyPair: (secretKey: Uint8Array) => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    readonly derivePublicKey: (secretKey: Uint8Array) => Uint8Array;
+    readonly sign: (message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly verify: (signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+};

package/dist/p521Ecdsa.js

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { p521 } from "@noble/curves/nist.js";
+import { sha512 } from "@noble/hashes/sha2.js";
+import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
+import { ReallyMeCryptoError } from "./errors.js";
+export const P521_ECDSA_SECRET_KEY_LENGTH = 66;
+export const P521_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 67;
+export const P521_ECDSA_COMPACT_SIGNATURE_LENGTH = 132;
+export const P521_ECDSA_DER_SIGNATURE_MAX_LENGTH = 139;
+/**
+ * P-521 ECDSA backed by @noble/curves.
+ *
+ * P-521 DER signatures can require long-form sequence lengths; the shared DER
+ * helper enforces canonical positive INTEGER encoding before verification.
+ */
+export const ReallyMeP521Ecdsa = {
+    generateKeyPair() {
+        const secretKey = p521.utils.randomSecretKey();
+        return {
+            publicKey: p521.getPublicKey(secretKey, true),
+            secretKey,
+        };
+    },
+    deriveKeyPair(secretKey) {
+        return {
+            publicKey: this.derivePublicKey(secretKey),
+            secretKey: secretKey.slice(),
+        };
+    },
+    derivePublicKey(secretKey) {
+        if (secretKey.length !== P521_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            return p521.getPublicKey(secretKey, true);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    sign(message, secretKey) {
+        if (secretKey.length !== P521_ECDSA_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const compactSignature = p521.sign(sha512(message), secretKey, {
+                lowS: false,
+                prehash: false,
+            });
+            return encodeEcdsaDerSignature(compactSignature, P521_ECDSA_SECRET_KEY_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    verify(signature, message, publicKey) {
+        if (publicKey.length !== P521_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        let compactSignature;
+        try {
+            p521.Point.fromBytes(publicKey);
+            compactSignature = decodeEcdsaDerSignature(signature, P521_ECDSA_SECRET_KEY_LENGTH, P521_ECDSA_DER_SIGNATURE_MAX_LENGTH);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const valid = p521.verify(compactSignature, sha512(message), publicKey, {
+                lowS: false,
+                prehash: false,
+            });
+            if (!valid) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-signature");
+        }
+    },
+};

package/dist/pbkdf2.d.ts

@@ -0,0 +1,28 @@
+export declare const PBKDF2_MIN_INPUT_LENGTH = 1;
+export declare const PBKDF2_MAX_INPUT_LENGTH = 4096;
+export declare const PBKDF2_MIN_ITERATIONS = 1;
+export declare const PBKDF2_MIN_OUTPUT_LENGTH = 1;
+export declare const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
+/**
+ * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
+ * *new* password key.
+ * The primitive does not enforce these (it must remain able to verify
+ * externally created hashes), so callers creating new key material SHOULD
+ * pass at least the value for their PRF.
+ */
+export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600000;
+export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220000;
+export declare const ReallyMePbkdf2: {
+    /**
+     * PBKDF2-HMAC-SHA-256. For a new password key pass at least
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
+     * are accepted only to verify hashes created elsewhere.
+     */
+    readonly deriveHmacSha256: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
+    /**
+     * PBKDF2-HMAC-SHA-512. For a new password key pass at least
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
+     * are accepted only to verify hashes created elsewhere.
+     */
+    readonly deriveHmacSha512: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
+};

package/dist/pbkdf2.js

@@ -0,0 +1,57 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { pbkdf2 } from "@noble/hashes/pbkdf2.js";
+import { sha256, sha512 } from "@noble/hashes/sha2.js";
+import { ReallyMeCryptoError } from "./errors.js";
+export const PBKDF2_MIN_INPUT_LENGTH = 1;
+export const PBKDF2_MAX_INPUT_LENGTH = 4096;
+// The primitive accepts any count >= 1 so it can verify PBKDF2 hashes created
+// elsewhere at their stored iteration count (a required interop use), matching
+// the Rust lane. It is NOT a security floor; see the recommended minimums
+// below for deriving *new* password keys.
+export const PBKDF2_MIN_ITERATIONS = 1;
+export const PBKDF2_MIN_OUTPUT_LENGTH = 1;
+export const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
+/**
+ * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
+ * *new* password key.
+ * The primitive does not enforce these (it must remain able to verify
+ * externally created hashes), so callers creating new key material SHOULD
+ * pass at least the value for their PRF.
+ */
+export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600_000;
+export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220_000;
+export const ReallyMePbkdf2 = {
+    /**
+     * PBKDF2-HMAC-SHA-256. For a new password key pass at least
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
+     * are accepted only to verify hashes created elsewhere.
+     */
+    deriveHmacSha256(password, salt, iterations, outputLength) {
+        validate(password, salt, iterations, outputLength);
+        return pbkdf2(sha256, password, salt, { c: iterations, dkLen: outputLength });
+    },
+    /**
+     * PBKDF2-HMAC-SHA-512. For a new password key pass at least
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
+     * are accepted only to verify hashes created elsewhere.
+     */
+    deriveHmacSha512(password, salt, iterations, outputLength) {
+        validate(password, salt, iterations, outputLength);
+        return pbkdf2(sha512, password, salt, { c: iterations, dkLen: outputLength });
+    },
+};
+function validate(password, salt, iterations, outputLength) {
+    if (password.length < PBKDF2_MIN_INPUT_LENGTH ||
+        password.length > PBKDF2_MAX_INPUT_LENGTH ||
+        salt.length < PBKDF2_MIN_INPUT_LENGTH ||
+        salt.length > PBKDF2_MAX_INPUT_LENGTH ||
+        !Number.isInteger(iterations) ||
+        iterations < PBKDF2_MIN_ITERATIONS ||
+        !Number.isInteger(outputLength) ||
+        outputLength < PBKDF2_MIN_OUTPUT_LENGTH ||
+        outputLength > PBKDF2_MAX_OUTPUT_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+}