@sebastienrousseau/crypto-lib 0.0.2 → 0.0.7

package/dist/protocols/pqxdh.d.ts

@@ -0,0 +1,53 @@
+export interface IdentityKeyPair {
+    privateKey: string;
+    publicKey: string;
+    signingPrivateKey: string;
+    signingPublicKey: string;
+}
+export interface SignedPreKey {
+    privateKey: string;
+    publicKey: string;
+    signature: string;
+}
+export interface OneTimePreKey {
+    privateKey: string;
+    publicKey: string;
+}
+export interface PqPreKey {
+    publicKey: string;
+    secretKey: string;
+    signature: string;
+}
+export interface InitiateSessionParams {
+    identityKeyPair: IdentityKeyPair;
+    remoteIdentityPublic: string;
+    remoteSignedPreKeyPublic: string;
+    remoteOneTimePreKeyPublic?: string;
+    remotePqPreKeyPublic: string;
+}
+export interface InitiateSessionResult {
+    sharedSecret: string;
+    ephemeralPublicKey: string;
+    pqCiphertext: string;
+    algorithm: "pqxdh";
+}
+export interface RespondToSessionParams {
+    identityKeyPair: IdentityKeyPair;
+    signedPreKeyPrivate: string;
+    oneTimePreKeyPrivate?: string;
+    pqPreKeySecret: string;
+    remoteIdentityPublic: string;
+    remoteEphemeralPublic: string;
+    pqCiphertext: string;
+}
+export interface RespondToSessionResult {
+    sharedSecret: string;
+    algorithm: "pqxdh";
+}
+export declare function generateIdentityKeyPair(): IdentityKeyPair;
+export declare function generateSignedPreKey(identitySigningPrivate: string): SignedPreKey;
+export declare function generateOneTimePreKey(): OneTimePreKey;
+export declare function generatePqPreKey(identitySigningPrivate: string): PqPreKey;
+export declare function initiateSession(params: InitiateSessionParams): InitiateSessionResult;
+export declare function respondToSession(params: RespondToSessionParams): RespondToSessionResult;
+//# sourceMappingURL=pqxdh.d.ts.map

package/dist/protocols/pqxdh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqxdh.d.ts","sourceRoot":"","sources":["../../src/protocols/pqxdh.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,eAAe;IAE9B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,YAAY;IAE3B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,aAAa;IAE5B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,QAAQ;IAEvB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,qBAAqB;IAEpC,eAAe,EAAE,eAAe,CAAC;IAEjC,oBAAoB,EAAE,MAAM,CAAC;IAE7B,wBAAwB,EAAE,MAAM,CAAC;IAEjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,qBAAqB;IAEpC,YAAY,EAAE,MAAM,CAAC;IAErB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,WAAW,sBAAsB;IAErC,eAAe,EAAE,eAAe,CAAC;IAEjC,mBAAmB,EAAE,MAAM,CAAC;IAE5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,cAAc,EAAE,MAAM,CAAC;IAEvB,oBAAoB,EAAE,MAAM,CAAC;IAE7B,qBAAqB,EAAE,MAAM,CAAC;IAE9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAGD,MAAM,WAAW,sBAAsB;IAErC,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,OAAO,CAAC;CACpB;AA0BD,wBAAgB,uBAAuB,IAAI,eAAe,CAYzD;AAQD,wBAAgB,oBAAoB,CAClC,sBAAsB,EAAE,MAAM,GAC7B,YAAY,CAWd;AAKD,wBAAgB,qBAAqB,IAAI,aAAa,CAQrD;AAKD,wBAAgB,gBAAgB,CAAC,sBAAsB,EAAE,MAAM,GAAG,QAAQ,CAezE;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,qBAAqB,GAC5B,qBAAqB,CAqEvB;AAQD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CA+DxB"}

package/dist/protocols/pqxdh.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateIdentityKeyPair = generateIdentityKeyPair;
+exports.generateSignedPreKey = generateSignedPreKey;
+exports.generateOneTimePreKey = generateOneTimePreKey;
+exports.generatePqPreKey = generatePqPreKey;
+exports.initiateSession = initiateSession;
+exports.respondToSession = respondToSession;
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const ml_kem_js_1 = require("@noble/post-quantum/ml-kem.js");
+const hkdf_js_1 = require("@noble/hashes/hkdf.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function hexToBytes(hex, label) {
+    if (!HEX_RE.test(hex)) {
+        throw new Error(`Invalid hex string for ${label}`);
+    }
+    return Buffer.from(hex, "hex");
+}
+const PQXDH_INFO = new TextEncoder().encode("pqxdh-v1");
+function generateIdentityKeyPair() {
+    const x25519Priv = (0, utils_js_1.randomBytes)(32);
+    const x25519Pub = ed25519_js_1.x25519.getPublicKey(x25519Priv);
+    const signingPriv = (0, utils_js_1.randomBytes)(32);
+    const signingPub = ed25519_js_1.ed25519.getPublicKey(signingPriv);
+    return {
+        privateKey: Buffer.from(x25519Priv).toString("hex"),
+        publicKey: Buffer.from(x25519Pub).toString("hex"),
+        signingPrivateKey: Buffer.from(signingPriv).toString("hex"),
+        signingPublicKey: Buffer.from(signingPub).toString("hex"),
+    };
+}
+function generateSignedPreKey(identitySigningPrivate) {
+    const sigKey = hexToBytes(identitySigningPrivate, "identitySigningPrivate");
+    const prePriv = (0, utils_js_1.randomBytes)(32);
+    const prePub = ed25519_js_1.x25519.getPublicKey(prePriv);
+    const signature = ed25519_js_1.ed25519.sign(prePub, sigKey);
+    return {
+        privateKey: Buffer.from(prePriv).toString("hex"),
+        publicKey: Buffer.from(prePub).toString("hex"),
+        signature: Buffer.from(signature).toString("hex"),
+    };
+}
+function generateOneTimePreKey() {
+    const priv = (0, utils_js_1.randomBytes)(32);
+    const pub = ed25519_js_1.x25519.getPublicKey(priv);
+    return {
+        privateKey: Buffer.from(priv).toString("hex"),
+        publicKey: Buffer.from(pub).toString("hex"),
+    };
+}
+function generatePqPreKey(identitySigningPrivate) {
+    const sigKey = hexToBytes(identitySigningPrivate, "identitySigningPrivate");
+    const { publicKey, secretKey } = ml_kem_js_1.ml_kem768.keygen();
+    const signature = ed25519_js_1.ed25519.sign((0, sha2_js_1.sha256)(publicKey), sigKey);
+    return {
+        publicKey: Buffer.from(publicKey).toString("hex"),
+        secretKey: Buffer.from(secretKey).toString("hex"),
+        signature: Buffer.from(signature).toString("hex"),
+    };
+}
+function initiateSession(params) {
+    const { identityKeyPair, remoteIdentityPublic, remoteSignedPreKeyPublic, remoteOneTimePreKeyPublic, remotePqPreKeyPublic, } = params;
+    const ikPriv = hexToBytes(identityKeyPair.privateKey, "identityPrivateKey");
+    const remoteIkPub = hexToBytes(remoteIdentityPublic, "remoteIdentityPublic");
+    const remoteSPKPub = hexToBytes(remoteSignedPreKeyPublic, "remoteSignedPreKeyPublic");
+    const remotePqPub = hexToBytes(remotePqPreKeyPublic, "remotePqPreKeyPublic");
+    const ephPriv = (0, utils_js_1.randomBytes)(32);
+    const ephPub = ed25519_js_1.x25519.getPublicKey(ephPriv);
+    const dh1 = ed25519_js_1.x25519.getSharedSecret(ikPriv, remoteSPKPub);
+    const dh2 = ed25519_js_1.x25519.getSharedSecret(ephPriv, remoteIkPub);
+    const dh3 = ed25519_js_1.x25519.getSharedSecret(ephPriv, remoteSPKPub);
+    let dh4 = null;
+    if (remoteOneTimePreKeyPublic) {
+        const remoteOPKPub = hexToBytes(remoteOneTimePreKeyPublic, "remoteOneTimePreKeyPublic");
+        dh4 = ed25519_js_1.x25519.getSharedSecret(ephPriv, remoteOPKPub);
+    }
+    const { cipherText: pqCt, sharedSecret: pqShared } = ml_kem_js_1.ml_kem768.encapsulate(remotePqPub);
+    const dhLen = dh1.length + dh2.length + dh3.length;
+    const dh4Len = dh4 ? dh4.length : 0;
+    const totalLen = dhLen + dh4Len + pqShared.length;
+    const combined = new Uint8Array(totalLen);
+    let offset = 0;
+    combined.set(dh1, offset);
+    offset += dh1.length;
+    combined.set(dh2, offset);
+    offset += dh2.length;
+    combined.set(dh3, offset);
+    offset += dh3.length;
+    if (dh4) {
+        combined.set(dh4, offset);
+        offset += dh4.length;
+    }
+    combined.set(pqShared, offset);
+    const sharedSecret = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, combined, undefined, PQXDH_INFO, 32);
+    return {
+        sharedSecret: Buffer.from(sharedSecret).toString("hex"),
+        ephemeralPublicKey: Buffer.from(ephPub).toString("hex"),
+        pqCiphertext: Buffer.from(pqCt).toString("hex"),
+        algorithm: "pqxdh",
+    };
+}
+function respondToSession(params) {
+    const { identityKeyPair, signedPreKeyPrivate, oneTimePreKeyPrivate, pqPreKeySecret, remoteIdentityPublic, remoteEphemeralPublic, pqCiphertext, } = params;
+    const ikPriv = hexToBytes(identityKeyPair.privateKey, "identityPrivateKey");
+    const spkPriv = hexToBytes(signedPreKeyPrivate, "signedPreKeyPrivate");
+    const pqSecret = hexToBytes(pqPreKeySecret, "pqPreKeySecret");
+    const remoteIkPub = hexToBytes(remoteIdentityPublic, "remoteIdentityPublic");
+    const remoteEphPub = hexToBytes(remoteEphemeralPublic, "remoteEphemeralPublic");
+    const pqCt = hexToBytes(pqCiphertext, "pqCiphertext");
+    const dh1 = ed25519_js_1.x25519.getSharedSecret(spkPriv, remoteIkPub);
+    const dh2 = ed25519_js_1.x25519.getSharedSecret(ikPriv, remoteEphPub);
+    const dh3 = ed25519_js_1.x25519.getSharedSecret(spkPriv, remoteEphPub);
+    let dh4 = null;
+    if (oneTimePreKeyPrivate) {
+        const opkPriv = hexToBytes(oneTimePreKeyPrivate, "oneTimePreKeyPrivate");
+        dh4 = ed25519_js_1.x25519.getSharedSecret(opkPriv, remoteEphPub);
+    }
+    const pqShared = ml_kem_js_1.ml_kem768.decapsulate(pqCt, pqSecret);
+    const dhLen = dh1.length + dh2.length + dh3.length;
+    const dh4Len = dh4 ? dh4.length : 0;
+    const totalLen = dhLen + dh4Len + pqShared.length;
+    const combined = new Uint8Array(totalLen);
+    let offset = 0;
+    combined.set(dh1, offset);
+    offset += dh1.length;
+    combined.set(dh2, offset);
+    offset += dh2.length;
+    combined.set(dh3, offset);
+    offset += dh3.length;
+    if (dh4) {
+        combined.set(dh4, offset);
+        offset += dh4.length;
+    }
+    combined.set(pqShared, offset);
+    const sharedSecret = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, combined, undefined, PQXDH_INFO, 32);
+    return {
+        sharedSecret: Buffer.from(sharedSecret).toString("hex"),
+        algorithm: "pqxdh",
+    };
+}
+//# sourceMappingURL=pqxdh.js.map

package/dist/protocols/ratchet.d.ts

@@ -0,0 +1,52 @@
+export interface MessageHeader {
+    publicKey: string;
+    previousChainLength: number;
+    messageNumber: number;
+}
+export interface EncryptedMessage {
+    header: MessageHeader;
+    ciphertext: string;
+}
+export interface SymmetricRatchetState {
+    chainKey: string;
+    index: number;
+}
+export interface DoubleRatchetState {
+    sendingRatchetPrivate: string;
+    sendingRatchetPublic: string;
+    receivingRatchetPublic: string | null;
+    rootKey: string;
+    sendingChainKey: string | null;
+    receivingChainKey: string | null;
+    sendingMessageNumber: number;
+    receivingMessageNumber: number;
+    previousChainLength: number;
+    skippedKeys: Record<string, string>;
+}
+export declare class SymmetricRatchet {
+    private _chainKey;
+    private _index;
+    constructor(chainKey: string | Uint8Array, index?: number);
+    get state(): SymmetricRatchetState;
+    next(): {
+        messageKey: Uint8Array;
+        index: number;
+    };
+}
+export declare class DoubleRatchet {
+    private _state;
+    private constructor();
+    get state(): DoubleRatchetState;
+    static initAlice(sharedSecret: string, remoteRatchetPublic: string): DoubleRatchet;
+    static initBob(sharedSecret: string, ourRatchetKeyPair: {
+        privateKey: string;
+        publicKey: string;
+    }): DoubleRatchet;
+    static fromState(state: DoubleRatchetState): DoubleRatchet;
+    encrypt(plaintext: string | Uint8Array): EncryptedMessage;
+    decrypt(header: MessageHeader, ciphertext: string): Uint8Array;
+    private _decryptWithKey;
+    private _dhRatchetStep;
+    private _skipMessages;
+}
+//# sourceMappingURL=ratchet.d.ts.map

package/dist/protocols/ratchet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ratchet.d.ts","sourceRoot":"","sources":["../../src/protocols/ratchet.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,aAAa,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,gBAAgB;IAE/B,MAAM,EAAE,aAAa,CAAC;IAEtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,kBAAkB;IAEjC,qBAAqB,EAAE,MAAM,CAAC;IAE9B,oBAAoB,EAAE,MAAM,CAAC;IAE7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC,OAAO,EAAE,MAAM,CAAC;IAEhB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,oBAAoB,EAAE,MAAM,CAAC;IAE7B,sBAAsB,EAAE,MAAM,CAAC;IAE/B,mBAAmB,EAAE,MAAM,CAAC;IAE5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAkCD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,MAAM,CAAS;gBAGX,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,SAAI;IAOpD,IAAI,KAAK,IAAI,qBAAqB,CAKjC;IAQD,IAAI,IAAI;QAEN,UAAU,EAAE,UAAU,CAAC;QAEvB,KAAK,EAAE,MAAM,CAAC;KACf;CASF;AAYD,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAqB;IAEnC,OAAO;IAKP,IAAI,KAAK,IAAI,kBAAkB,CAE9B;IAQD,MAAM,CAAC,SAAS,CACd,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,GAC1B,aAAa;IAwChB,MAAM,CAAC,OAAO,CACZ,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC3D,aAAa;IAkBhB,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa;IAU1D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB;IAgDzD,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAwC9D,OAAO,CAAC,eAAe;IAiBvB,OAAO,CAAC,cAAc;IA4CtB,OAAO,CAAC,aAAa;CAiBtB"}

package/dist/protocols/ratchet.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DoubleRatchet = exports.SymmetricRatchet = void 0;
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const hkdf_js_1 = require("@noble/hashes/hkdf.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const hmac_js_1 = require("@noble/hashes/hmac.js");
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const NONCE_LEN = 24;
+const HEX_RE = /^[0-9a-fA-F]*$/;
+const MAX_SKIP = 256;
+function hexToBytes(hex) {
+    if (!HEX_RE.test(hex)) {
+        throw new Error("Invalid hex string");
+    }
+    return Buffer.from(hex, "hex");
+}
+function bytesToHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+class SymmetricRatchet {
+    _chainKey;
+    _index;
+    constructor(chainKey, index = 0) {
+        this._chainKey =
+            typeof chainKey === "string" ? hexToBytes(chainKey) : chainKey;
+        this._index = index;
+    }
+    get state() {
+        return {
+            chainKey: bytesToHex(this._chainKey),
+            index: this._index,
+        };
+    }
+    next() {
+        const messageKey = (0, hmac_js_1.hmac)(sha2_js_1.sha256, this._chainKey, new Uint8Array([0x01]));
+        this._chainKey = (0, hmac_js_1.hmac)(sha2_js_1.sha256, this._chainKey, new Uint8Array([0x02]));
+        const index = this._index;
+        this._index++;
+        return { messageKey, index };
+    }
+}
+exports.SymmetricRatchet = SymmetricRatchet;
+class DoubleRatchet {
+    _state;
+    constructor(state) {
+        this._state = state;
+    }
+    get state() {
+        return { ...this._state };
+    }
+    static initAlice(sharedSecret, remoteRatchetPublic) {
+        const sk = hexToBytes(sharedSecret);
+        const remotePub = hexToBytes(remoteRatchetPublic);
+        const ratchetPriv = (0, utils_js_1.randomBytes)(32);
+        const ratchetPub = ed25519_js_1.x25519.getPublicKey(ratchetPriv);
+        const dhOut = ed25519_js_1.x25519.getSharedSecret(ratchetPriv, remotePub);
+        const derived = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, dhOut, sk, new TextEncoder().encode("double-ratchet-root"), 64);
+        const rootKey = derived.subarray(0, 32);
+        const sendingChainKey = derived.subarray(32, 64);
+        return new DoubleRatchet({
+            sendingRatchetPrivate: bytesToHex(ratchetPriv),
+            sendingRatchetPublic: bytesToHex(ratchetPub),
+            receivingRatchetPublic: remoteRatchetPublic,
+            rootKey: bytesToHex(rootKey),
+            sendingChainKey: bytesToHex(sendingChainKey),
+            receivingChainKey: null,
+            sendingMessageNumber: 0,
+            receivingMessageNumber: 0,
+            previousChainLength: 0,
+            skippedKeys: {},
+        });
+    }
+    static initBob(sharedSecret, ourRatchetKeyPair) {
+        return new DoubleRatchet({
+            sendingRatchetPrivate: ourRatchetKeyPair.privateKey,
+            sendingRatchetPublic: ourRatchetKeyPair.publicKey,
+            receivingRatchetPublic: null,
+            rootKey: sharedSecret,
+            sendingChainKey: null,
+            receivingChainKey: null,
+            sendingMessageNumber: 0,
+            receivingMessageNumber: 0,
+            previousChainLength: 0,
+            skippedKeys: {},
+        });
+    }
+    static fromState(state) {
+        return new DoubleRatchet({ ...state });
+    }
+    encrypt(plaintext) {
+        if (!this._state.sendingChainKey) {
+            throw new Error("Sending chain not initialized — cannot encrypt");
+        }
+        const chain = new SymmetricRatchet(this._state.sendingChainKey);
+        const { messageKey } = chain.next();
+        this._state.sendingChainKey = chain.state.chainKey;
+        const header = {
+            publicKey: this._state.sendingRatchetPublic,
+            previousChainLength: this._state.previousChainLength,
+            messageNumber: this._state.sendingMessageNumber,
+        };
+        this._state.sendingMessageNumber++;
+        const nonce = (0, utils_js_1.randomBytes)(NONCE_LEN);
+        const pt = plaintext instanceof Uint8Array
+            ? plaintext
+            : Buffer.from(plaintext, "utf8");
+        const aad = Buffer.from(JSON.stringify(header), "utf8");
+        const cipher = (0, chacha_js_1.xchacha20poly1305)(messageKey, nonce, aad);
+        const ct = cipher.encrypt(pt);
+        const packed = new Uint8Array(NONCE_LEN + ct.length);
+        packed.set(nonce);
+        packed.set(ct, NONCE_LEN);
+        return {
+            header,
+            ciphertext: Buffer.from(packed).toString("base64"),
+        };
+    }
+    decrypt(header, ciphertext) {
+        const skipKey = `${header.publicKey}:${header.messageNumber}`;
+        if (this._state.skippedKeys[skipKey]) {
+            const mk = hexToBytes(this._state.skippedKeys[skipKey]);
+            delete this._state.skippedKeys[skipKey];
+            return this._decryptWithKey(mk, header, ciphertext);
+        }
+        if (header.publicKey !== this._state.receivingRatchetPublic) {
+            if (this._state.receivingChainKey !== null) {
+                this._skipMessages(this._state.receivingRatchetPublic, this._state.receivingMessageNumber, header.previousChainLength);
+            }
+            this._dhRatchetStep(header.publicKey);
+        }
+        this._skipMessages(header.publicKey, this._state.receivingMessageNumber, header.messageNumber);
+        const chain = new SymmetricRatchet(this._state.receivingChainKey);
+        const { messageKey } = chain.next();
+        this._state.receivingChainKey = chain.state.chainKey;
+        this._state.receivingMessageNumber++;
+        return this._decryptWithKey(messageKey, header, ciphertext);
+    }
+    _decryptWithKey(messageKey, header, ciphertext) {
+        const raw = Buffer.from(ciphertext, "base64");
+        if (raw.length < NONCE_LEN + 16) {
+            throw new Error("Ciphertext too short");
+        }
+        const nonce = raw.subarray(0, NONCE_LEN);
+        const ct = raw.subarray(NONCE_LEN);
+        const aad = Buffer.from(JSON.stringify(header), "utf8");
+        const cipher = (0, chacha_js_1.xchacha20poly1305)(messageKey, nonce, aad);
+        return cipher.decrypt(ct);
+    }
+    _dhRatchetStep(newRemotePublic) {
+        const remotePub = hexToBytes(newRemotePublic);
+        const rootKey = hexToBytes(this._state.rootKey);
+        this._state.previousChainLength = this._state.sendingMessageNumber;
+        this._state.sendingMessageNumber = 0;
+        this._state.receivingMessageNumber = 0;
+        this._state.receivingRatchetPublic = newRemotePublic;
+        const dhRecv = ed25519_js_1.x25519.getSharedSecret(hexToBytes(this._state.sendingRatchetPrivate), remotePub);
+        const derivedRecv = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, dhRecv, rootKey, new TextEncoder().encode("double-ratchet-root"), 64);
+        const newRootKey = derivedRecv.subarray(0, 32);
+        this._state.receivingChainKey = bytesToHex(derivedRecv.subarray(32, 64));
+        const newPriv = (0, utils_js_1.randomBytes)(32);
+        const newPub = ed25519_js_1.x25519.getPublicKey(newPriv);
+        this._state.sendingRatchetPrivate = bytesToHex(newPriv);
+        this._state.sendingRatchetPublic = bytesToHex(newPub);
+        const dhSend = ed25519_js_1.x25519.getSharedSecret(newPriv, remotePub);
+        const derivedSend = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, dhSend, newRootKey, new TextEncoder().encode("double-ratchet-root"), 64);
+        this._state.rootKey = bytesToHex(derivedSend.subarray(0, 32));
+        this._state.sendingChainKey = bytesToHex(derivedSend.subarray(32, 64));
+    }
+    _skipMessages(publicKey, start, until) {
+        if (until - start > MAX_SKIP) {
+            throw new Error(`Too many skipped messages: ${until - start} exceeds max ${MAX_SKIP}`);
+        }
+        if (!this._state.receivingChainKey)
+            return;
+        const chain = new SymmetricRatchet(this._state.receivingChainKey, start);
+        for (let i = start; i < until; i++) {
+            const { messageKey, index } = chain.next();
+            const key = `${publicKey}:${index}`;
+            this._state.skippedKeys[key] = bytesToHex(messageKey);
+        }
+        this._state.receivingChainKey = chain.state.chainKey;
+    }
+}
+exports.DoubleRatchet = DoubleRatchet;
+//# sourceMappingURL=ratchet.js.map

package/dist/protocols/threshold.d.ts

@@ -0,0 +1,23 @@
+export interface Share {
+    index: number;
+    value: string;
+}
+export interface SplitResult {
+    shares: Share[];
+    threshold: number;
+    algorithm: "shamir-ed25519";
+}
+export interface FeldmanCommitments {
+    commitments: string[];
+    algorithm: "feldman-vss-ed25519";
+}
+export declare function splitSecret(secret: string, n: number, threshold: number): SplitResult;
+export declare function combineShares(shares: Share[]): string;
+export declare function generateFeldmanCommitments(coefficients: string[]): FeldmanCommitments;
+export declare function verifyFeldmanShare(share: Share, commitments: FeldmanCommitments): boolean;
+export declare function splitSecretWithCommitments(secret: string, n: number, threshold: number): {
+    shares: Share[];
+    commitments: FeldmanCommitments;
+    threshold: number;
+};
+//# sourceMappingURL=threshold.d.ts.map

package/dist/protocols/threshold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threshold.d.ts","sourceRoot":"","sources":["../../src/protocols/threshold.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,KAAK;IAEpB,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,WAAW;IAE1B,MAAM,EAAE,KAAK,EAAE,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAGD,MAAM,WAAW,kBAAkB;IAEjC,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAgID,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,CAAC,EAAE,MAAM,EACT,SAAS,EAAE,MAAM,GAChB,WAAW,CA0Cb;AAQD,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAiCrD;AAaD,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EAAE,GACrB,kBAAkB,CAiBpB;AAYD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAsBT;AAUD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,CAAC,EAAE,MAAM,EACT,SAAS,EAAE,MAAM,GAChB;IAED,MAAM,EAAE,KAAK,EAAE,CAAC;IAEhB,WAAW,EAAE,kBAAkB,CAAC;IAEhC,SAAS,EAAE,MAAM,CAAC;CACnB,CA0CA"}

package/dist/protocols/threshold.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitSecret = splitSecret;
+exports.combineShares = combineShares;
+exports.generateFeldmanCommitments = generateFeldmanCommitments;
+exports.verifyFeldmanShare = verifyFeldmanShare;
+exports.splitSecretWithCommitments = splitSecretWithCommitments;
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const P = BigInt("7237005577332262213973186563042994240857116359379907606001950938285454250989");
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function bytesToHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function scalarToHex(scalar) {
+    const hex = scalar.toString(16).padStart(64, "0");
+    return hex;
+}
+function hexToScalar(hex) {
+    if (!HEX_RE.test(hex)) {
+        throw new Error("Invalid hex string");
+    }
+    return BigInt("0x" + hex);
+}
+function randomFieldElement() {
+    const raw = (0, utils_js_1.randomBytes)(48);
+    let value = BigInt(0);
+    for (let i = 0; i < raw.length; i++) {
+        value = (value * BigInt(256) + BigInt(raw[i])) % P;
+    }
+    if (value === BigInt(0))
+        value = BigInt(1);
+    return value;
+}
+function mod(a, m = P) {
+    return ((a % m) + m) % m;
+}
+function modAdd(a, b) {
+    return mod(a + b);
+}
+function modMul(a, b) {
+    return mod(a * b);
+}
+function modSub(a, b) {
+    return mod(a - b);
+}
+function modInverse(a) {
+    return modPow(a, P - BigInt(2));
+}
+function modPow(base, exp) {
+    let result = BigInt(1);
+    base = mod(base);
+    while (exp > BigInt(0)) {
+        if (exp & BigInt(1)) {
+            result = modMul(result, base);
+        }
+        exp >>= BigInt(1);
+        base = modMul(base, base);
+    }
+    return result;
+}
+function evaluatePolynomial(coefficients, x) {
+    let result = BigInt(0);
+    let power = BigInt(1);
+    for (const coeff of coefficients) {
+        result = modAdd(result, modMul(coeff, power));
+        power = modMul(power, x);
+    }
+    return result;
+}
+function splitSecret(secret, n, threshold) {
+    if (threshold < 2) {
+        throw new Error("Threshold must be at least 2");
+    }
+    if (n < threshold) {
+        throw new Error("Number of shares must be >= threshold");
+    }
+    if (n > 255) {
+        throw new Error("Maximum 255 shares supported");
+    }
+    const secretScalar = hexToScalar(secret);
+    if (secretScalar >= P) {
+        throw new Error("Secret must be less than the Ed25519 group order; reduce or derive it first");
+    }
+    const coefficients = [secretScalar];
+    for (let i = 1; i < threshold; i++) {
+        coefficients.push(randomFieldElement());
+    }
+    const shares = [];
+    for (let i = 1; i <= n; i++) {
+        const x = BigInt(i);
+        const y = evaluatePolynomial(coefficients, x);
+        shares.push({
+            index: i,
+            value: scalarToHex(y),
+        });
+    }
+    return {
+        shares,
+        threshold,
+        algorithm: "shamir-ed25519",
+    };
+}
+function combineShares(shares) {
+    if (shares.length < 2) {
+        throw new Error("Need at least 2 shares to reconstruct");
+    }
+    const indices = new Set(shares.map((s) => s.index));
+    if (indices.size !== shares.length) {
+        throw new Error("Duplicate share indices detected");
+    }
+    let secret = BigInt(0);
+    for (let i = 0; i < shares.length; i++) {
+        const xi = BigInt(shares[i].index);
+        const yi = hexToScalar(shares[i].value);
+        let numerator = BigInt(1);
+        let denominator = BigInt(1);
+        for (let j = 0; j < shares.length; j++) {
+            if (i === j)
+                continue;
+            const xj = BigInt(shares[j].index);
+            numerator = modMul(numerator, mod(-xj));
+            denominator = modMul(denominator, modSub(xi, xj));
+        }
+        const lagrangeCoeff = modMul(numerator, modInverse(denominator));
+        secret = modAdd(secret, modMul(yi, lagrangeCoeff));
+    }
+    return scalarToHex(secret);
+}
+function generateFeldmanCommitments(coefficients) {
+    if (coefficients.length < 2) {
+        throw new Error("Need at least 2 coefficients (threshold >= 2)");
+    }
+    const commitments = [];
+    for (const coeff of coefficients) {
+        const scalar = hexToScalar(coeff);
+        const point = ed25519_js_1.ed25519.Point.BASE.multiply(mod(scalar));
+        commitments.push(bytesToHex(point.toBytes()));
+    }
+    return {
+        commitments,
+        algorithm: "feldman-vss-ed25519",
+    };
+}
+function verifyFeldmanShare(share, commitments) {
+    const { index, value } = share;
+    const shareScalar = hexToScalar(value);
+    const lhs = ed25519_js_1.ed25519.Point.BASE.multiply(mod(shareScalar));
+    const x = BigInt(index);
+    let rhs = ed25519_js_1.ed25519.Point.ZERO;
+    let power = BigInt(1);
+    for (const commitHex of commitments.commitments) {
+        const commitPoint = ed25519_js_1.ed25519.Point.fromHex(commitHex);
+        const term = commitPoint.multiply(power);
+        rhs = rhs.add(term);
+        power = modMul(power, x);
+    }
+    return lhs.equals(rhs);
+}
+function splitSecretWithCommitments(secret, n, threshold) {
+    if (threshold < 2) {
+        throw new Error("Threshold must be at least 2");
+    }
+    if (n < threshold) {
+        throw new Error("Number of shares must be >= threshold");
+    }
+    if (n > 255) {
+        throw new Error("Maximum 255 shares supported");
+    }
+    const secretScalar = hexToScalar(secret);
+    if (secretScalar >= P) {
+        throw new Error("Secret must be less than the Ed25519 group order; reduce or derive it first");
+    }
+    const coefficients = [secretScalar];
+    for (let i = 1; i < threshold; i++) {
+        coefficients.push(randomFieldElement());
+    }
+    const shares = [];
+    for (let i = 1; i <= n; i++) {
+        const x = BigInt(i);
+        const y = evaluatePolynomial(coefficients, x);
+        shares.push({
+            index: i,
+            value: scalarToHex(y),
+        });
+    }
+    const coeffHexes = coefficients.map(scalarToHex);
+    const commitments = generateFeldmanCommitments(coeffHexes);
+    return { shares, commitments, threshold };
+}
+//# sourceMappingURL=threshold.js.map