@reallyme/crypto 0.1.7 → 0.2.0

package/dist/mlDsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const ML_DSA_44_PUBLIC_KEY_LENGTH = 1312;
 export declare const ML_DSA_44_SIGNATURE_LENGTH = 2420;
 export declare const ML_DSA_65_PUBLIC_KEY_LENGTH = 1952;
@@ -12,7 +13,11 @@ export type ReallyMeMlDsaKeyPair = Readonly<{
 }>;
 export declare const ReallyMeMlDsa: {
     readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeMlDsaKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm) => ReallyMeMlDsaKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeMlDsaKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeMlDsaKeyPair;
     readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly signWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
 };

package/dist/mlDsa.js

@@ -13,6 +13,9 @@ export const ML_DSA_87_SIGNATURE_LENGTH = 4_627;
 export const ML_DSA_SECRET_KEY_LENGTH = 32;
 const mlDsaSuite = (algorithm) => {
     const provider = requireReallyMeWasmProvider();
+    return mlDsaSuiteWithProvider(algorithm, provider);
+};
+const mlDsaSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-DSA-44":
             return {
@@ -66,6 +69,10 @@ export const ReallyMeMlDsa = {
         const suite = mlDsaSuite(algorithm);
         return readKeyPair(suite.generateKeyPair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeyPair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         // Import an existing FIPS 204 seed and reconstruct its public key. Do not
         // feed passwords or other low-entropy material here.
@@ -73,15 +80,31 @@ export const ReallyMeMlDsa = {
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
         return readKeyPair(suite.deriveKeyPair(secretKey), suite);
     },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+    },
     sign(algorithm, message, secretKey) {
         const suite = mlDsaSuite(algorithm);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
         return readSignature(suite.sign(secretKey, message), suite);
     },
+    signWithProvider(provider, algorithm, message, secretKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
+        return readSignature(suite.sign(secretKey, message), suite);
+    },
     verify(algorithm, signature, message, publicKey) {
         const suite = mlDsaSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
         ensureBytes(signature, suite.signatureLength);
         readVoid(suite.verify(publicKey, message, signature));
     },
+    verifyWithProvider(provider, algorithm, signature, message, publicKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        ensureBytes(signature, suite.signatureLength);
+        readVoid(suite.verify(publicKey, message, signature));
+    },
 };

package/dist/mlKem.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeKemAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const ML_KEM_512_PUBLIC_KEY_LENGTH = 800;
 export declare const ML_KEM_512_CIPHERTEXT_LENGTH = 768;
 export declare const ML_KEM_768_PUBLIC_KEY_LENGTH = 1184;
@@ -18,8 +19,13 @@ export type ReallyMeMlKemEncapsulation = Readonly<{
 }>;
 export declare const ReallyMeMlKem: {
     readonly generateKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeMlKemKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm) => ReallyMeMlKemKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeMlKemKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeMlKemKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
+    readonly encapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
     readonly encapsulateDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, randomness: Uint8Array) => ReallyMeMlKemEncapsulation;
+    readonly encapsulateDeterministicallyWithProviderForTest: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, randomness: Uint8Array) => ReallyMeMlKemEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly decapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
 };

package/dist/mlKem.js

@@ -15,6 +15,9 @@ export const ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH = 32;
 export const ML_KEM_SHARED_SECRET_LENGTH = 32;
 const mlKemSuite = (algorithm) => {
     const provider = requireReallyMeWasmProvider();
+    return mlKemSuiteWithProvider(algorithm, provider);
+};
+const mlKemSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-KEM-512":
             return {
@@ -70,6 +73,10 @@ export const ReallyMeMlKem = {
         const suite = mlKemSuite(algorithm);
         return readKeyPair(suite.generateKeyPair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeyPair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         // Import an existing FIPS 203 seed-form secret and reconstruct its public
         // key. Do not feed passwords or other low-entropy material here.
@@ -77,21 +84,43 @@ export const ReallyMeMlKem = {
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
         return readKeyPair(suite.deriveKeyPair(secretKey), suite);
     },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+    },
     encapsulate(algorithm, publicKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
         return readEncapsulation(suite.encapsulate(publicKey), suite);
     },
+    encapsulateWithProvider(provider, algorithm, publicKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        return readEncapsulation(suite.encapsulate(publicKey), suite);
+    },
     encapsulateDeterministicallyForTest(algorithm, publicKey, randomness) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
         ensureBytes(randomness, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH);
         return readEncapsulation(suite.encapsulateDerand(publicKey, randomness), suite);
     },
+    encapsulateDeterministicallyWithProviderForTest(provider, algorithm, publicKey, randomness) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        ensureBytes(randomness, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH);
+        return readEncapsulation(suite.encapsulateDerand(publicKey, randomness), suite);
+    },
     decapsulate(algorithm, ciphertext, secretKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(ciphertext, suite.ciphertextLength);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
         return readSharedSecret(suite.decapsulate(ciphertext, secretKey));
     },
+    decapsulateWithProvider(provider, algorithm, ciphertext, secretKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(ciphertext, suite.ciphertextLength);
+        ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey));
+    },
 };

package/dist/p256Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-256 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP256Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p256.getSharedSecret(secretKey, publicKey, false).slice(1, 33);
+            const uncompressed = p256.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 33);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p384Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p384 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-384 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP384Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p384.getSharedSecret(secretKey, publicKey, false).slice(1, 49);
+            const uncompressed = p384.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 49);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p521Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p521 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-521 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP521Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p521.getSharedSecret(secretKey, publicKey, false).slice(1, 67);
+            const uncompressed = p521.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 67);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");