@sebastienrousseau/crypto-cli 0.0.9 → 0.0.24

package/README.md

@@ -263,6 +263,13 @@ Commands:
                             valid
   password                  Hash or verify a password (Argon2id)
   cbom                      Generate or audit a Cryptographic Bill of Materials
+  stream                    Post-quantum hybrid streaming AEAD operations
+  opaque                    OPAQUE zero-knowledge password authentication (RFC
+                            9807)
+  hpke                      Hybrid Public Key Encryption (HPKE RFC 9180 and PQ
+                            hybrid)
+  kms                       Key Management Service (KMS) operations across
+                            native cloud providers
 ```
 
 #### `crypto-cli hash`
@@ -484,6 +491,359 @@ Options:
   -h, --help           print help
 ```
 
+#### `crypto-cli stream`
+
+```text
+Usage: crypto-cli stream [options] [command]
+
+Post-quantum hybrid streaming AEAD operations
+
+Options:
+  -h, --help                      print help
+
+Commands:
+  encrypt [options] [file]        Encrypt with post-quantum hybrid STREAM AEAD
+                                  (X25519 + ML-KEM-768)
+  decrypt [options] [file]        Decrypt post-quantum hybrid STREAM ciphertext;
+                                  exits 1 on error
+  multi-encrypt [options] [file]  Encrypt for multiple recipients with
+                                  post-quantum hybrid STREAM AEAD
+  multi-decrypt [options] [file]  Decrypt multi-recipient post-quantum hybrid
+                                  STREAM ciphertext; exits 1 on error
+  help [command]                  display help for command
+```
+
+#### `crypto-cli stream encrypt`
+
+```text
+Usage: crypto-cli stream encrypt [options] [file]
+
+Encrypt with post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768)
+
+Arguments:
+  file                       file to encrypt; '-' or omitted reads standard
+                             input
+
+Options:
+  -x, --x25519-public <hex>  recipient X25519 public key (hex)
+  -m, --ml-kem-public <hex>  recipient ML-KEM-768 public key (hex)
+  -c, --chunk-size <bytes>   chunk size in bytes (minimum 64, default 65536)
+  --json                     print the result as one line of JSON
+  -h, --help                 print help
+```
+
+#### `crypto-cli stream decrypt`
+
+```text
+Usage: crypto-cli stream decrypt [options] [file]
+
+Decrypt post-quantum hybrid STREAM ciphertext; exits 1 on error
+
+Arguments:
+  file                       output of stream encrypt (base64 or its --json
+                             line)
+
+Options:
+  -x, --x25519-secret <hex>  recipient X25519 secret key (hex)
+  -m, --ml-kem-secret <hex>  recipient ML-KEM-768 secret key (hex)
+  -c, --chunk-size <bytes>   chunk size in bytes
+  --json                     print the result as one line of JSON
+  -h, --help                 print help
+```
+
+#### `crypto-cli stream multi-encrypt`
+
+```text
+Usage: crypto-cli stream multi-encrypt [options] [file]
+
+Encrypt for multiple recipients with post-quantum hybrid STREAM AEAD
+
+Arguments:
+  file                             file to encrypt; '-' or omitted reads
+                                   standard input
+
+Options:
+  -r, --recipients <json-or-path>  JSON array string or file path containing
+                                   recipient public key descriptors
+  -c, --chunk-size <bytes>         chunk size in bytes (minimum 1024, default
+                                   65536)
+  --json                           print the result as one line of JSON
+  -h, --help                       print help
+```
+
+#### `crypto-cli stream multi-decrypt`
+
+```text
+Usage: crypto-cli stream multi-decrypt [options] [file]
+
+Decrypt multi-recipient post-quantum hybrid STREAM ciphertext; exits 1 on error
+
+Arguments:
+  file                       output of stream multi-encrypt (base64 or its
+                             --json line)
+
+Options:
+  -x, --x25519-secret <hex>  recipient X25519 secret key (hex)
+  -m, --ml-kem-secret <hex>  recipient ML-KEM-768 secret key (hex)
+  -i, --recipient-id <id>    optional recipient identifier for direct slot
+                             lookup
+  -c, --chunk-size <bytes>   chunk size in bytes
+  --json                     print the result as one line of JSON
+  -h, --help                 print help
+```
+
+#### `crypto-cli opaque`
+
+```text
+Usage: crypto-cli opaque [options] [command]
+
+OPAQUE zero-knowledge password authentication (RFC 9807)
+
+Options:
+  -h, --help               print help
+
+Commands:
+  setup [options]          Generate server long-term keys and fake record
+  register [options] <id>  Register a password with an OPAQUE server
+  login [options] <id>     Authenticate against an OPAQUE server
+```
+
+#### `crypto-cli opaque setup`
+
+```text
+Usage: crypto-cli opaque setup [options]
+
+Generate server long-term keys and fake record
+
+Options:
+  -s, --suite <name>  ciphersuite (choices: "P256-SHA256",
+                      "ristretto255-SHA512", default: "P256-SHA256")
+  --json              print result as JSON
+  -h, --help          print help
+```
+
+#### `crypto-cli opaque register`
+
+```text
+Usage: crypto-cli opaque register [options] <id>
+
+Register a password with an OPAQUE server
+
+Options:
+  -u, --server-url <url>  server base URL
+  -s, --suite <name>      ciphersuite (choices: "P256-SHA256",
+                          "ristretto255-SHA512", default: "P256-SHA256")
+  --json                  print result as JSON
+  --password-file <path>  read the password from a file: one trailing line break
+                          is ignored
+  --password-stdin        read the password from standard input
+  -h, --help              print help
+```
+
+#### `crypto-cli opaque login`
+
+```text
+Usage: crypto-cli opaque login [options] <id>
+
+Authenticate against an OPAQUE server
+
+Options:
+  -u, --server-url <url>  server base URL
+  -s, --suite <name>      ciphersuite (choices: "P256-SHA256",
+                          "ristretto255-SHA512", default: "P256-SHA256")
+  --json                  print result as JSON
+  --password-file <path>  read the password from a file: one trailing line break
+                          is ignored
+  --password-stdin        read the password from standard input
+  -h, --help              print help
+```
+
+#### `crypto-cli hpke`
+
+```text
+Usage: crypto-cli hpke [options] [command]
+
+Hybrid Public Key Encryption (HPKE RFC 9180 and PQ hybrid)
+
+Options:
+  -h, --help             print help
+
+Commands:
+  keygen [options]       Generate an HPKE key pair
+  seal [options] [file]  Encrypt a message using HPKE
+  open [options] [file]  Decrypt an HPKE ciphertext
+  help [command]         display help for command
+```
+
+#### `crypto-cli hpke keygen`
+
+```text
+Usage: crypto-cli hpke keygen [options]
+
+Generate an HPKE key pair
+
+Options:
+  -k, --kem <kem>  key encapsulation mechanism (choices: "x25519-ml-kem-768",
+                   "x25519", "p256", default: "x25519-ml-kem-768")
+  --json           print key pair as JSON
+  -h, --help       print help
+```
+
+#### `crypto-cli hpke seal`
+
+```text
+Usage: crypto-cli hpke seal [options] [file]
+
+Encrypt a message using HPKE
+
+Options:
+  -p, --public-key <hex>  recipient public key (hex)
+  -k, --kem <kem>         key encapsulation mechanism (choices:
+                          "x25519-ml-kem-768", "x25519", "p256", default:
+                          "x25519-ml-kem-768")
+  -a, --aead <aead>       authenticated encryption algorithm (choices:
+                          "chacha20-poly1305", "aes-128-gcm", default:
+                          "chacha20-poly1305")
+  --info <info>           application-supplied info string
+  --aad <aad>             additional authenticated data
+  --json                  print ciphertext and encapsulated key as JSON
+  -h, --help              print help
+```
+
+#### `crypto-cli hpke open`
+
+```text
+Usage: crypto-cli hpke open [options] [file]
+
+Decrypt an HPKE ciphertext
+
+Options:
+  -s, --secret-key <hex>        recipient private key (hex)
+  -e, --encapsulated-key <hex>  encapsulated key (hex)
+  -k, --kem <kem>               key encapsulation mechanism (choices:
+                                "x25519-ml-kem-768", "x25519", "p256", default:
+                                "x25519-ml-kem-768")
+  -a, --aead <aead>             authenticated encryption algorithm (choices:
+                                "chacha20-poly1305", "aes-128-gcm", default:
+                                "chacha20-poly1305")
+  --info <info>                 application-supplied info string
+  --aad <aad>                   additional authenticated data
+  --json                        print plaintext and hex as JSON
+  -h, --help                    print help
+```
+
+#### `crypto-cli kms`
+
+```text
+Usage: crypto-cli kms [options] [command]
+
+Key Management Service (KMS) operations across native cloud providers
+
+Options:
+  -h, --help                   print help
+
+Commands:
+  create-key [options]         Create a new managed key in KMS
+  generate-data-key [options]  Generate a Data Encryption Key (DEK) via KMS
+  wrap [options] [file]        Wrap (encrypt) a key using a KMS key
+  unwrap [options] [file]      Unwrap a wrapped key using a KMS key
+  encrypt [options] [file]     Encrypt data using a KMS key
+  decrypt [options] [file]     Decrypt ciphertext using a KMS key
+  help [command]               display help for command
+```
+
+#### `crypto-cli kms create-key`
+
+```text
+Usage: crypto-cli kms create-key [options]
+
+Create a new managed key in KMS
+
+Options:
+  -a, --algorithm <alg>  Key algorithm (default: "aes-256-gcm")
+  -u, --usage <usage>    Key usage (choices: "encrypt", "sign", "wrap", default:
+                         "encrypt")
+  -p, --provider <name>  KMS provider (local, aws, gcp, vault, azure) (default:
+                         "local")
+  --json                 Emit output as JSON
+  -h, --help             print help
+```
+
+#### `crypto-cli kms generate-data-key`
+
+```text
+Usage: crypto-cli kms generate-data-key [options]
+
+Generate a Data Encryption Key (DEK) via KMS
+
+Options:
+  -k, --key-id <id>      Key ID
+  -s, --key-spec <spec>  Key spec (e.g. AES_256) (default: "AES_256")
+  -p, --provider <name>  KMS provider (default: "local")
+  --json                 Emit output as JSON
+  -h, --help             print help
+```
+
+#### `crypto-cli kms wrap`
+
+```text
+Usage: crypto-cli kms wrap [options] [file]
+
+Wrap (encrypt) a key using a KMS key
+
+Options:
+  -k, --key-id <id>      Wrapping Key ID
+  -w, --key <hex>        Raw key material to wrap
+  -p, --provider <name>  KMS provider (default: "local")
+  --json                 Emit output as JSON
+  -h, --help             print help
+```
+
+#### `crypto-cli kms unwrap`
+
+```text
+Usage: crypto-cli kms unwrap [options] [file]
+
+Unwrap a wrapped key using a KMS key
+
+Options:
+  -k, --key-id <id>        Wrapping Key ID
+  -w, --wrapped-key <str>  Wrapped key string
+  -p, --provider <name>    KMS provider (default: "local")
+  --json                   Emit output as JSON
+  -h, --help               print help
+```
+
+#### `crypto-cli kms encrypt`
+
+```text
+Usage: crypto-cli kms encrypt [options] [file]
+
+Encrypt data using a KMS key
+
+Options:
+  -k, --key-id <id>      Key ID
+  -d, --data <text>      Plaintext data to encrypt
+  -p, --provider <name>  KMS provider (default: "local")
+  --json                 Emit output as JSON
+  -h, --help             print help
+```
+
+#### `crypto-cli kms decrypt`
+
+```text
+Usage: crypto-cli kms decrypt [options] [file]
+
+Decrypt ciphertext using a KMS key
+
+Options:
+  -k, --key-id <id>       Key ID
+  -c, --ciphertext <str>  Ciphertext to decrypt
+  -p, --provider <name>   KMS provider (default: "local")
+  --json                  Emit output as JSON
+  -h, --help              print help
+```
+
 <!-- cli-usage:end -->
 
 <p align="right"><a href="#contents">Back to Top</a></p>

package/dist/program/hpke.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare function registerHpke(program: Command, ctx: RunContext): void;
+//# sourceMappingURL=hpke.d.ts.map

package/dist/program/hpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.d.ts","sourceRoot":"","sources":["../../src/program/hpke.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAM5C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAyG1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CA0DpE"}

package/dist/program/hpke.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerHpke = registerHpke;
+const commander_1 = require("commander");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const KEM_CHOICES = [
+    "x25519-ml-kem-768",
+    "x25519",
+    "p256",
+];
+const AEAD_CHOICES = [
+    "chacha20-poly1305",
+    "aes-128-gcm",
+];
+function stringToHex(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex ? text : Buffer.from(text, "utf8").toString("hex");
+}
+function executeKeygen(opts, ctx) {
+    const kp = (0, modern_1.hpkeGenerateKeyPair)(opts.kem);
+    const data = {
+        kem: opts.kem,
+        publicKey: kp.publicKey,
+        privateKey: kp.privateKey,
+    };
+    const desc = [
+        `Algorithm:   ${opts.kem}`,
+        `Public Key:  ${kp.publicKey}`,
+        `Private Key: ${kp.privateKey}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeSeal(file, opts, ctx) {
+    const raw = await (0, io_1.readInput)(file, ctx.io);
+    const plaintextHex = raw.toString("hex");
+    const res = (0, modern_1.hpkeSeal)({
+        recipientPublicKey: opts.publicKey,
+        plaintext: plaintextHex,
+        suite: { kem: opts.kem, aead: opts.aead },
+        ...(opts.info !== undefined ? { info: stringToHex(opts.info) } : {}),
+        ...(opts.aad !== undefined ? { aad: stringToHex(opts.aad) } : {}),
+    });
+    const data = {
+        encapsulatedKey: res.encapsulatedKey,
+        ciphertext: res.ciphertext,
+    };
+    const desc = [
+        `Encapsulated: ${res.encapsulatedKey}`,
+        `Ciphertext:   ${res.ciphertext}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeOpen(file, opts, ctx) {
+    const raw = await (0, io_1.readInput)(file, ctx.io);
+    const ciphertext = (0, io_1.valueOrJsonField)(raw, "ciphertext").trim();
+    const res = (0, modern_1.hpkeOpen)({
+        recipientPrivateKey: opts.secretKey,
+        encapsulatedKey: opts.encapsulatedKey,
+        ciphertext,
+        suite: { kem: opts.kem, aead: opts.aead },
+        ...(opts.info !== undefined ? { info: stringToHex(opts.info) } : {}),
+        ...(opts.aad !== undefined ? { aad: stringToHex(opts.aad) } : {}),
+    });
+    const plaintext = Buffer.from(res.plaintext, "hex").toString("utf8");
+    const data = { plaintext, hex: res.plaintext };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, plaintext);
+}
+function registerHpke(program, ctx) {
+    const hpke = program
+        .command("hpke")
+        .description("Hybrid Public Key Encryption (HPKE RFC 9180 and PQ hybrid)");
+    hpke
+        .command("keygen")
+        .description("Generate an HPKE key pair")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .option("--json", "print key pair as JSON")
+        .action((opts) => executeKeygen(opts, ctx));
+    hpke
+        .command("seal [file]")
+        .description("Encrypt a message using HPKE")
+        .requiredOption("-p, --public-key <hex>", "recipient public key (hex)")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .addOption(new commander_1.Option("-a, --aead <aead>", "authenticated encryption algorithm")
+        .choices(AEAD_CHOICES)
+        .default("chacha20-poly1305"))
+        .option("--info <info>", "application-supplied info string")
+        .option("--aad <aad>", "additional authenticated data")
+        .option("--json", "print ciphertext and encapsulated key as JSON")
+        .action((file, opts) => executeSeal(file, opts, ctx));
+    hpke
+        .command("open [file]")
+        .description("Decrypt an HPKE ciphertext")
+        .requiredOption("-s, --secret-key <hex>", "recipient private key (hex)")
+        .requiredOption("-e, --encapsulated-key <hex>", "encapsulated key (hex)")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .addOption(new commander_1.Option("-a, --aead <aead>", "authenticated encryption algorithm")
+        .choices(AEAD_CHOICES)
+        .default("chacha20-poly1305"))
+        .option("--info <info>", "application-supplied info string")
+        .option("--aad <aad>", "additional authenticated data")
+        .option("--json", "print plaintext and hex as JSON")
+        .action((file, opts) => executeOpen(file, opts, ctx));
+}
+//# sourceMappingURL=hpke.js.map

package/dist/program/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/program/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AAKpD,OAAO,EAAoB,KAAK,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAKrE,OAAO,EACL,IAAI,EACJ,gBAAgB,EAChB,SAAS,EACT,KAAK,KAAK,EACV,KAAK,UAAU,GAChB,MAAM,MAAM,CAAC;AASd,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,EAAE,SAAS,MAAM,KAAG,OAqB/D,CAAC;AAmBF,eAAO,MAAM,GAAG,GAAU,MAAM,MAAM,EAAE,EAAE,IAAI,KAAK,KAAG,OAAO,CAAC,MAAM,CASnE,CAAC;AAWF,eAAO,MAAM,IAAI,GACf,MAAM,MAAM,EAAE,EACd,IAAI,KAAK,EACT,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,MAAM,CAShB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/program/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AAKpD,OAAO,EAAoB,KAAK,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AASrE,OAAO,EACL,IAAI,EACJ,gBAAgB,EAChB,SAAS,EACT,KAAK,KAAK,EACV,KAAK,UAAU,GAChB,MAAM,MAAM,CAAC;AASd,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,EAAE,SAAS,MAAM,KAAG,OAyB/D,CAAC;AAmBF,eAAO,MAAM,GAAG,GAAU,MAAM,MAAM,EAAE,EAAE,IAAI,KAAK,KAAG,OAAO,CAAC,MAAM,CASnE,CAAC;AAWF,eAAO,MAAM,IAAI,GACf,MAAM,MAAM,EAAE,EACd,IAAI,KAAK,EACT,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,MAAM,CAShB,CAAC"}

package/dist/program/index.js

@@ -10,6 +10,10 @@ const io_1 = require("./io");
 const keygen_1 = require("./keygen");
 const password_1 = require("./password");
 const sign_1 = require("./sign");
+const stream_1 = require("./stream");
+const opaque_1 = require("./opaque");
+const hpke_1 = require("./hpke");
+const kms_1 = require("./kms");
 var io_2 = require("./io");
 Object.defineProperty(exports, "EXIT", { enumerable: true, get: function () { return io_2.EXIT; } });
 Object.defineProperty(exports, "exitOnClosedPipe", { enumerable: true, get: function () { return io_2.exitOnClosedPipe; } });
@@ -32,6 +36,10 @@ const buildProgram = (ctx, version) => {
     (0, sign_1.registerVerify)(program, ctx);
     (0, password_1.registerPassword)(program, ctx);
     (0, cbom_1.registerCbom)(program, ctx);
+    (0, stream_1.registerStream)(program, ctx);
+    (0, opaque_1.registerOpaque)(program, ctx);
+    (0, hpke_1.registerHpke)(program, ctx);
+    (0, kms_1.registerKms)(program, ctx);
     return program;
 };
 exports.buildProgram = buildProgram;

package/dist/program/kms.d.ts

@@ -0,0 +1,8 @@
+import { Command } from "commander";
+import { type KmsProvider } from "@sebastienrousseau/crypto-kms";
+import { type RunContext } from "./io";
+export declare function registerCliKmsProvider(name: string, provider: KmsProvider): void;
+export declare function resetCliKmsProviders(): void;
+export declare function resolveCliKmsProvider(name?: string): KmsProvider;
+export declare function registerKms(program: Command, ctx: RunContext): void;
+//# sourceMappingURL=kms.d.ts.map

package/dist/program/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/program/kms.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,KAAK,WAAW,EAMjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAM1E,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,GACpB,IAAI,CAEN;AAGD,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AA+CD,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAQhE;AAkQD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CASnE"}