@sebastienrousseau/crypto-lib 0.0.2 → 0.0.7

package/dist/high-level/sealedbox.d.ts

@@ -0,0 +1,13 @@
+export interface SealedBoxResult {
+    sealed: string;
+    algorithm: "x25519-xchacha20-poly1305";
+}
+export interface PqSealedBoxResult {
+    sealed: string;
+    algorithm: "x25519-ml-kem-768-xchacha20-poly1305";
+}
+export declare function seal(recipientPublicKey: string | Uint8Array, plaintext: string | Uint8Array): SealedBoxResult;
+export declare function open(recipientSecretKey: string | Uint8Array, sealed: string | Uint8Array): Uint8Array;
+export declare function sealPQ(recipientX25519Public: string | Uint8Array, recipientMlKemPublic: string | Uint8Array, plaintext: string | Uint8Array): PqSealedBoxResult;
+export declare function openPQ(recipientX25519Secret: string | Uint8Array, recipientMlKemSecret: string | Uint8Array, sealed: string | Uint8Array): Uint8Array;
+//# sourceMappingURL=sealedbox.d.ts.map

package/dist/high-level/sealedbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedbox.d.ts","sourceRoot":"","sources":["../../src/high-level/sealedbox.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,2BAA2B,CAAC;CACxC;AAGD,MAAM,WAAW,iBAAiB;IAEhC,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,sCAAsC,CAAC;CACnD;AAQD,wBAAgB,IAAI,CAClB,kBAAkB,EAAE,MAAM,GAAG,UAAU,EACvC,SAAS,EAAE,MAAM,GAAG,UAAU,GAC7B,eAAe,CAsCjB;AAQD,wBAAgB,IAAI,CAClB,kBAAkB,EAAE,MAAM,GAAG,UAAU,EACvC,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,UAAU,CA+BZ;AAmBD,wBAAgB,MAAM,CACpB,qBAAqB,EAAE,MAAM,GAAG,UAAU,EAC1C,oBAAoB,EAAE,MAAM,GAAG,UAAU,EACzC,SAAS,EAAE,MAAM,GAAG,UAAU,GAC7B,iBAAiB,CAoDnB;AAYD,wBAAgB,MAAM,CACpB,qBAAqB,EAAE,MAAM,GAAG,UAAU,EAC1C,oBAAoB,EAAE,MAAM,GAAG,UAAU,EACzC,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,UAAU,CAiDZ"}

package/dist/high-level/sealedbox.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seal = seal;
+exports.open = open;
+exports.sealPQ = sealPQ;
+exports.openPQ = openPQ;
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const ml_kem_js_1 = require("@noble/post-quantum/ml-kem.js");
+const hkdf_js_1 = require("@noble/hashes/hkdf.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const EPHEMERAL_LEN = 32;
+const NONCE_LEN = 24;
+const TAG_LEN = 16;
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function hexToBytes(hex) {
+    if (!HEX_RE.test(hex))
+        throw new Error("Invalid hex string");
+    return Buffer.from(hex, "hex");
+}
+function toData(input) {
+    return input instanceof Uint8Array ? input : Buffer.from(input, "utf8");
+}
+function seal(recipientPublicKey, plaintext) {
+    const recipPub = typeof recipientPublicKey === "string"
+        ? hexToBytes(recipientPublicKey)
+        : recipientPublicKey;
+    const ephPriv = (0, utils_js_1.randomBytes)(32);
+    const ephPub = ed25519_js_1.x25519.getPublicKey(ephPriv);
+    const raw = ed25519_js_1.x25519.getSharedSecret(ephPriv, recipPub);
+    const encKey = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, raw, ephPub, new TextEncoder().encode("sealedbox-v1"), 32);
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LEN);
+    const pt = toData(plaintext);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(encKey, nonce);
+    const ct = cipher.encrypt(pt);
+    const out = new Uint8Array(EPHEMERAL_LEN + NONCE_LEN + ct.length);
+    out.set(ephPub);
+    out.set(nonce, EPHEMERAL_LEN);
+    out.set(ct, EPHEMERAL_LEN + NONCE_LEN);
+    return {
+        sealed: Buffer.from(out).toString("base64"),
+        algorithm: "x25519-xchacha20-poly1305",
+    };
+}
+function open(recipientSecretKey, sealed) {
+    const secKey = typeof recipientSecretKey === "string"
+        ? hexToBytes(recipientSecretKey)
+        : recipientSecretKey;
+    const raw = sealed instanceof Uint8Array ? sealed : Buffer.from(sealed, "base64");
+    const minLen = EPHEMERAL_LEN + NONCE_LEN + TAG_LEN;
+    if (raw.length < minLen) {
+        throw new Error(`Sealed box too short: expected >= ${minLen} bytes, got ${raw.length}`);
+    }
+    const ephPub = raw.subarray(0, EPHEMERAL_LEN);
+    const nonce = raw.subarray(EPHEMERAL_LEN, EPHEMERAL_LEN + NONCE_LEN);
+    const ct = raw.subarray(EPHEMERAL_LEN + NONCE_LEN);
+    const shared = ed25519_js_1.x25519.getSharedSecret(secKey, ephPub);
+    const encKey = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, shared, ephPub, new TextEncoder().encode("sealedbox-v1"), 32);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(encKey, nonce);
+    return cipher.decrypt(ct);
+}
+function sealPQ(recipientX25519Public, recipientMlKemPublic, plaintext) {
+    const x25519Pub = typeof recipientX25519Public === "string"
+        ? hexToBytes(recipientX25519Public)
+        : recipientX25519Public;
+    const mlKemPub = typeof recipientMlKemPublic === "string"
+        ? hexToBytes(recipientMlKemPublic)
+        : recipientMlKemPublic;
+    const ephPriv = (0, utils_js_1.randomBytes)(32);
+    const ephPub = ed25519_js_1.x25519.getPublicKey(ephPriv);
+    const x25519Shared = ed25519_js_1.x25519.getSharedSecret(ephPriv, x25519Pub);
+    const { cipherText: mlKemCt, sharedSecret: mlKemShared } = ml_kem_js_1.ml_kem768.encapsulate(mlKemPub);
+    const combined = new Uint8Array(x25519Shared.length + mlKemShared.length);
+    combined.set(x25519Shared);
+    combined.set(mlKemShared, x25519Shared.length);
+    const encKey = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, combined, ephPub, new TextEncoder().encode("pq-sealedbox-v1"), 32);
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LEN);
+    const pt = toData(plaintext);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(encKey, nonce);
+    const ct = cipher.encrypt(pt);
+    const mlKemCtLen = mlKemCt.length;
+    const out = new Uint8Array(EPHEMERAL_LEN + mlKemCtLen + NONCE_LEN + ct.length);
+    out.set(ephPub);
+    out.set(mlKemCt, EPHEMERAL_LEN);
+    out.set(nonce, EPHEMERAL_LEN + mlKemCtLen);
+    out.set(ct, EPHEMERAL_LEN + mlKemCtLen + NONCE_LEN);
+    return {
+        sealed: Buffer.from(out).toString("base64"),
+        algorithm: "x25519-ml-kem-768-xchacha20-poly1305",
+    };
+}
+const ML_KEM_768_CT_LEN = 1088;
+function openPQ(recipientX25519Secret, recipientMlKemSecret, sealed) {
+    const x25519Sec = typeof recipientX25519Secret === "string"
+        ? hexToBytes(recipientX25519Secret)
+        : recipientX25519Secret;
+    const mlKemSec = typeof recipientMlKemSecret === "string"
+        ? hexToBytes(recipientMlKemSecret)
+        : recipientMlKemSecret;
+    const raw = sealed instanceof Uint8Array ? sealed : Buffer.from(sealed, "base64");
+    const minLen = EPHEMERAL_LEN + ML_KEM_768_CT_LEN + NONCE_LEN + TAG_LEN;
+    if (raw.length < minLen) {
+        throw new Error(`PQ sealed box too short: expected >= ${minLen} bytes, got ${raw.length}`);
+    }
+    const ephPub = raw.subarray(0, EPHEMERAL_LEN);
+    const mlKemCt = raw.subarray(EPHEMERAL_LEN, EPHEMERAL_LEN + ML_KEM_768_CT_LEN);
+    const nonce = raw.subarray(EPHEMERAL_LEN + ML_KEM_768_CT_LEN, EPHEMERAL_LEN + ML_KEM_768_CT_LEN + NONCE_LEN);
+    const ct = raw.subarray(EPHEMERAL_LEN + ML_KEM_768_CT_LEN + NONCE_LEN);
+    const x25519Shared = ed25519_js_1.x25519.getSharedSecret(x25519Sec, ephPub);
+    const mlKemShared = ml_kem_js_1.ml_kem768.decapsulate(mlKemCt, mlKemSec);
+    const combined = new Uint8Array(x25519Shared.length + mlKemShared.length);
+    combined.set(x25519Shared);
+    combined.set(mlKemShared, x25519Shared.length);
+    const encKey = (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, combined, ephPub, new TextEncoder().encode("pq-sealedbox-v1"), 32);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(encKey, nonce);
+    return cipher.decrypt(ct);
+}
+//# sourceMappingURL=sealedbox.js.map

package/dist/high-level/secretbox.d.ts

@@ -0,0 +1,7 @@
+export interface SecretboxResult {
+    sealed: string;
+    algorithm: "xchacha20-poly1305";
+}
+export declare function seal(key: string | Uint8Array, plaintext: string | Uint8Array, aad?: Uint8Array): SecretboxResult;
+export declare function open(key: string | Uint8Array, sealed: string | Uint8Array, aad?: Uint8Array): Uint8Array;
+//# sourceMappingURL=secretbox.d.ts.map

package/dist/high-level/secretbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretbox.d.ts","sourceRoot":"","sources":["../../src/high-level/secretbox.ts"],"names":[],"mappings":"AAoDA,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAQD,wBAAgB,IAAI,CAClB,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,SAAS,EAAE,MAAM,GAAG,UAAU,EAC9B,GAAG,CAAC,EAAE,UAAU,GACf,eAAe,CAajB;AAOD,wBAAgB,IAAI,CAClB,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,GAAG,CAAC,EAAE,UAAU,GACf,UAAU,CAWZ"}

package/dist/high-level/secretbox.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seal = seal;
+exports.open = open;
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const NONCE_LEN = 24;
+const KEY_LEN = 32;
+const TAG_LEN = 16;
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function toKey(key) {
+    if (key instanceof Uint8Array) {
+        if (key.length !== KEY_LEN) {
+            throw new Error(`Key must be ${KEY_LEN} bytes, got ${key.length}`);
+        }
+        return key;
+    }
+    if (!HEX_RE.test(key))
+        throw new Error("Invalid hex key");
+    const buf = Buffer.from(key, "hex");
+    if (buf.length !== KEY_LEN) {
+        throw new Error(`Key must be ${KEY_LEN} bytes (${KEY_LEN * 8} bits), got ${buf.length}`);
+    }
+    return buf;
+}
+function toData(input) {
+    return input instanceof Uint8Array ? input : Buffer.from(input, "utf8");
+}
+function seal(key, plaintext, aad) {
+    const k = toKey(key);
+    const pt = toData(plaintext);
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LEN);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(k, nonce, aad);
+    const ct = cipher.encrypt(pt);
+    const out = new Uint8Array(NONCE_LEN + ct.length);
+    out.set(nonce);
+    out.set(ct, NONCE_LEN);
+    return {
+        sealed: Buffer.from(out).toString("base64"),
+        algorithm: "xchacha20-poly1305",
+    };
+}
+function open(key, sealed, aad) {
+    const k = toKey(key);
+    const raw = sealed instanceof Uint8Array ? sealed : Buffer.from(sealed, "base64");
+    if (raw.length < NONCE_LEN + TAG_LEN) {
+        throw new Error("Sealed box too short — missing nonce or auth tag");
+    }
+    const nonce = raw.subarray(0, NONCE_LEN);
+    const ct = raw.subarray(NONCE_LEN);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(k, nonce, aad);
+    return cipher.decrypt(ct);
+}
+//# sourceMappingURL=secretbox.js.map

package/dist/index.d.ts

@@ -1,3 +1,17 @@
-import cryptoLib from "./bin/crypto-lib";
-export default cryptoLib;
+import CryptoLib from "./bin/cryptolib";
+export default CryptoLib;
+export * from "./modern";
+export * from "./high-level";
+export * from "./keys";
+export * from "./streaming";
+export * as protocols from "./protocols";
+export * from "./protocols/iso20022";
+export * as tokens from "./tokens";
+export * from "./accel";
+export { crypto } from "./crypto";
+export type { SignAlgorithm, VerifyPasswordOptions, HmacVerifyOptions, } from "./crypto";
+export { getAlgorithm, listAlgorithms, recommended, isDeprecated, } from "./registry";
+export type { AlgorithmInfo, AlgorithmCategory, AlgorithmStatus, SecurityLevel, } from "./registry";
+export { CryptoError, CryptoErrorCode } from "./errors";
+export { timingSafeEqual, SecureBuffer, wipeMemory } from "./utils";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,kBAAkB,CAAC;AAEzC,eAAe,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAGxC,eAAe,SAAS,CAAC;AAGzB,cAAc,UAAU,CAAC;AAGzB,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,aAAa,CAAC;AAG5B,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,cAAc,sBAAsB,CAAC;AAGrC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAGnC,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,8 +1,67 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_lib_1 = __importDefault(require("./bin/crypto-lib"));
-exports.default = crypto_lib_1.default;
+exports.wipeMemory = exports.SecureBuffer = exports.timingSafeEqual = exports.CryptoErrorCode = exports.CryptoError = exports.isDeprecated = exports.recommended = exports.listAlgorithms = exports.getAlgorithm = exports.crypto = exports.tokens = exports.protocols = void 0;
+const cryptolib_1 = __importDefault(require("./bin/cryptolib"));
+exports.default = cryptolib_1.default;
+__exportStar(require("./modern"), exports);
+__exportStar(require("./high-level"), exports);
+__exportStar(require("./keys"), exports);
+__exportStar(require("./streaming"), exports);
+exports.protocols = __importStar(require("./protocols"));
+__exportStar(require("./protocols/iso20022"), exports);
+exports.tokens = __importStar(require("./tokens"));
+__exportStar(require("./accel"), exports);
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "crypto", { enumerable: true, get: function () { return crypto_1.crypto; } });
+var registry_1 = require("./registry");
+Object.defineProperty(exports, "getAlgorithm", { enumerable: true, get: function () { return registry_1.getAlgorithm; } });
+Object.defineProperty(exports, "listAlgorithms", { enumerable: true, get: function () { return registry_1.listAlgorithms; } });
+Object.defineProperty(exports, "recommended", { enumerable: true, get: function () { return registry_1.recommended; } });
+Object.defineProperty(exports, "isDeprecated", { enumerable: true, get: function () { return registry_1.isDeprecated; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "CryptoError", { enumerable: true, get: function () { return errors_1.CryptoError; } });
+Object.defineProperty(exports, "CryptoErrorCode", { enumerable: true, get: function () { return errors_1.CryptoErrorCode; } });
+var utils_1 = require("./utils");
+Object.defineProperty(exports, "timingSafeEqual", { enumerable: true, get: function () { return utils_1.timingSafeEqual; } });
+Object.defineProperty(exports, "SecureBuffer", { enumerable: true, get: function () { return utils_1.SecureBuffer; } });
+Object.defineProperty(exports, "wipeMemory", { enumerable: true, get: function () { return utils_1.wipeMemory; } });
 //# sourceMappingURL=index.js.map

package/dist/key/key.d.ts

@@ -0,0 +1,10 @@
+export declare const getPrivateKey: () => Promise<string>;
+export declare const getPublicKey: () => Promise<string>;
+export declare const getRevocationCertificate: () => Promise<string>;
+declare const _default: {
+    getPrivateKey: () => Promise<string>;
+    getPublicKey: () => Promise<string>;
+    getRevocationCertificate: () => Promise<string>;
+};
+export default _default;
+//# sourceMappingURL=key.d.ts.map

package/dist/key/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/key/key.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,MAAM,CAGpD,CAAC;AAKF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,MAAM,CAGnD,CAAC;AAMF,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,MAAM,CAG/D,CAAC;;yBApBqC,OAAO,CAAC,MAAM,CAAC;wBAQhB,OAAO,CAAC,MAAM,CAAC;oCASH,OAAO,CAAC,MAAM,CAAC;;AAMjE,wBAOE"}

package/dist/key/key.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRevocationCertificate = exports.getPublicKey = exports.getPrivateKey = void 0;
+const keystore_1 = require("./keystore");
+const getPrivateKey = async () => {
+    const ks = await (0, keystore_1.loadKeystore)();
+    return ks.privateKeyArmored;
+};
+exports.getPrivateKey = getPrivateKey;
+const getPublicKey = async () => {
+    const ks = await (0, keystore_1.loadKeystore)();
+    return ks.publicKeyArmored;
+};
+exports.getPublicKey = getPublicKey;
+const getRevocationCertificate = async () => {
+    const ks = await (0, keystore_1.loadKeystore)();
+    return ks.revocationArmored;
+};
+exports.getRevocationCertificate = getRevocationCertificate;
+exports.default = {
+    getPrivateKey: exports.getPrivateKey,
+    getPublicKey: exports.getPublicKey,
+    getRevocationCertificate: exports.getRevocationCertificate,
+};
+//# sourceMappingURL=key.js.map

package/dist/key/keystore.d.ts

@@ -0,0 +1,11 @@
+import * as openpgp from "openpgp";
+export interface Keystore {
+    readonly privateKeyArmored: string;
+    readonly publicKeyArmored: string;
+    readonly revocationArmored: string;
+}
+export declare function decodeArmor(raw: Buffer): string;
+export declare function loadKeystore(dir?: string): Promise<Keystore>;
+export declare function _resetKeystoreForTests(): void;
+export declare function unlockPrivateKey(armoredKey: string, passphrase: string): Promise<openpgp.PrivateKey>;
+//# sourceMappingURL=keystore.d.ts.map

package/dist/key/keystore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/key/keystore.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,MAAM,WAAW,QAAQ;IAEvB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU/C;AAyBD,wBAAgB,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgB5D;AAKD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAaD,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAG7B"}

package/dist/key/keystore.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeArmor = decodeArmor;
+exports.loadKeystore = loadKeystore;
+exports._resetKeystoreForTests = _resetKeystoreForTests;
+exports.unlockPrivateKey = unlockPrivateKey;
+const promises_1 = require("fs/promises");
+const path = __importStar(require("path"));
+const openpgp = __importStar(require("openpgp"));
+const ARMOR_BEGIN = Buffer.from("-----", "ascii");
+function decodeArmor(raw) {
+    if (raw.length >= ARMOR_BEGIN.length &&
+        raw.subarray(0, ARMOR_BEGIN.length).equals(ARMOR_BEGIN)) {
+        return raw.toString("latin1");
+    }
+    return Buffer.from(raw.toString("latin1"), "base64").toString("latin1");
+}
+let cache;
+function resolveKeyDir(dir) {
+    if (dir)
+        return dir;
+    if (process.env["CRYPTO_KEY_DIR"])
+        return process.env["CRYPTO_KEY_DIR"];
+    if (process.env["NODE_ENV"] === "production") {
+        throw new Error("CRYPTO_KEY_DIR is not set; refusing to use the bundled test keys in production");
+    }
+    return path.resolve(__dirname, "..", "key");
+}
+function loadKeystore(dir) {
+    if (cache)
+        return cache;
+    const keyDir = resolveKeyDir(dir);
+    cache = (async () => {
+        const [priv, pub, cert] = await Promise.all([
+            (0, promises_1.readFile)(path.join(keyDir, "rsa.key")),
+            (0, promises_1.readFile)(path.join(keyDir, "rsa.pub")),
+            (0, promises_1.readFile)(path.join(keyDir, "rsa.cert")),
+        ]);
+        return Object.freeze({
+            privateKeyArmored: decodeArmor(priv),
+            publicKeyArmored: decodeArmor(pub),
+            revocationArmored: decodeArmor(cert),
+        });
+    })();
+    return cache;
+}
+function _resetKeystoreForTests() {
+    cache = undefined;
+}
+async function unlockPrivateKey(armoredKey, passphrase) {
+    const read = await openpgp.readPrivateKey({ armoredKey });
+    return openpgp.decryptKey({ privateKey: read, passphrase });
+}
+//# sourceMappingURL=keystore.js.map

package/dist/keys/index.d.ts

@@ -0,0 +1,7 @@
+export { hexToBytes, bytesToHex, bytesToBase64, base64ToBytes, bytesToBase64url, base64urlToBytes, encodePem, decodePem, ed25519ToJwk, x25519ToJwk, jwkToHex, jwkThumbprint, } from "./serialize";
+export type { PemLabel, Jwk } from "./serialize";
+export { generateKeyPair, KEY_ALGORITHMS } from "./keygen";
+export type { KeyAlgorithm, KeyMetadata, GeneratedKeyPair } from "./keygen";
+export { Keyring } from "./keyring";
+export type { KeyEntry, Jwks } from "./keyring";
+//# sourceMappingURL=index.d.ts.map

package/dist/keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE3D,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/keys/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Keyring = exports.KEY_ALGORITHMS = exports.generateKeyPair = exports.jwkThumbprint = exports.jwkToHex = exports.x25519ToJwk = exports.ed25519ToJwk = exports.decodePem = exports.encodePem = exports.base64urlToBytes = exports.bytesToBase64url = exports.base64ToBytes = exports.bytesToBase64 = exports.bytesToHex = exports.hexToBytes = void 0;
+var serialize_1 = require("./serialize");
+Object.defineProperty(exports, "hexToBytes", { enumerable: true, get: function () { return serialize_1.hexToBytes; } });
+Object.defineProperty(exports, "bytesToHex", { enumerable: true, get: function () { return serialize_1.bytesToHex; } });
+Object.defineProperty(exports, "bytesToBase64", { enumerable: true, get: function () { return serialize_1.bytesToBase64; } });
+Object.defineProperty(exports, "base64ToBytes", { enumerable: true, get: function () { return serialize_1.base64ToBytes; } });
+Object.defineProperty(exports, "bytesToBase64url", { enumerable: true, get: function () { return serialize_1.bytesToBase64url; } });
+Object.defineProperty(exports, "base64urlToBytes", { enumerable: true, get: function () { return serialize_1.base64urlToBytes; } });
+Object.defineProperty(exports, "encodePem", { enumerable: true, get: function () { return serialize_1.encodePem; } });
+Object.defineProperty(exports, "decodePem", { enumerable: true, get: function () { return serialize_1.decodePem; } });
+Object.defineProperty(exports, "ed25519ToJwk", { enumerable: true, get: function () { return serialize_1.ed25519ToJwk; } });
+Object.defineProperty(exports, "x25519ToJwk", { enumerable: true, get: function () { return serialize_1.x25519ToJwk; } });
+Object.defineProperty(exports, "jwkToHex", { enumerable: true, get: function () { return serialize_1.jwkToHex; } });
+Object.defineProperty(exports, "jwkThumbprint", { enumerable: true, get: function () { return serialize_1.jwkThumbprint; } });
+var keygen_1 = require("./keygen");
+Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return keygen_1.generateKeyPair; } });
+Object.defineProperty(exports, "KEY_ALGORITHMS", { enumerable: true, get: function () { return keygen_1.KEY_ALGORITHMS; } });
+var keyring_1 = require("./keyring");
+Object.defineProperty(exports, "Keyring", { enumerable: true, get: function () { return keyring_1.Keyring; } });
+//# sourceMappingURL=index.js.map

package/dist/keys/keygen.d.ts

@@ -0,0 +1,16 @@
+export declare const KEY_ALGORITHMS: readonly ["ed25519", "x25519", "ed448", "x448", "p256", "p384", "ml-kem-512", "ml-kem-768", "ml-kem-1024", "ml-dsa-44", "ml-dsa-65", "ml-dsa-87"];
+export type KeyAlgorithm = (typeof KEY_ALGORITHMS)[number];
+export interface KeyMetadata {
+    kid?: string | undefined;
+    use?: "sig" | "enc" | undefined;
+    exp?: string | undefined;
+}
+export interface GeneratedKeyPair {
+    publicKey: string;
+    privateKey: string;
+    algorithm: KeyAlgorithm;
+    kid: string;
+    metadata: KeyMetadata;
+}
+export declare function generateKeyPair(algorithm: KeyAlgorithm, metadata?: KeyMetadata): GeneratedKeyPair;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/keys/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/keys/keygen.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,cAAc,mJAajB,CAAC;AAGX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAG3D,MAAM,WAAW,WAAW;IAE1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAEhC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,YAAY,CAAC;IAExB,GAAG,EAAE,MAAM,CAAC;IAEZ,QAAQ,EAAE,WAAW,CAAC;CACvB;AAuBD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,YAAY,EACvB,QAAQ,GAAE,WAAgB,GACzB,gBAAgB,CAkGlB"}

package/dist/keys/keygen.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ALGORITHMS = void 0;
+exports.generateKeyPair = generateKeyPair;
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const ed448_js_1 = require("@noble/curves/ed448.js");
+const nist_js_1 = require("@noble/curves/nist.js");
+const ml_kem_js_1 = require("@noble/post-quantum/ml-kem.js");
+const ml_dsa_js_1 = require("@noble/post-quantum/ml-dsa.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const serialize_1 = require("./serialize");
+exports.KEY_ALGORITHMS = [
+    "ed25519",
+    "x25519",
+    "ed448",
+    "x448",
+    "p256",
+    "p384",
+    "ml-kem-512",
+    "ml-kem-768",
+    "ml-kem-1024",
+    "ml-dsa-44",
+    "ml-dsa-65",
+    "ml-dsa-87",
+];
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function generateKid(publicKey) {
+    const digest = (0, sha2_js_1.sha256)(publicKey);
+    return (0, serialize_1.bytesToBase64url)(digest.subarray(0, 16));
+}
+function generateKeyPair(algorithm, metadata = {}) {
+    let publicKey;
+    let privateKey;
+    switch (algorithm) {
+        case "ed25519": {
+            const priv = ed25519_js_1.ed25519.utils.randomSecretKey();
+            const pub = ed25519_js_1.ed25519.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "x25519": {
+            const priv = (0, utils_js_1.randomBytes)(32);
+            const pub = ed25519_js_1.x25519.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "ed448": {
+            const priv = ed448_js_1.ed448.utils.randomSecretKey();
+            const pub = ed448_js_1.ed448.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "x448": {
+            const priv = (0, utils_js_1.randomBytes)(56);
+            const pub = ed448_js_1.x448.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "p256": {
+            const priv = nist_js_1.p256.utils.randomSecretKey();
+            const pub = nist_js_1.p256.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "p384": {
+            const priv = nist_js_1.p384.utils.randomSecretKey();
+            const pub = nist_js_1.p384.getPublicKey(priv);
+            privateKey = priv;
+            publicKey = pub;
+            break;
+        }
+        case "ml-kem-512": {
+            const kp = ml_kem_js_1.ml_kem512.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        case "ml-kem-768": {
+            const kp = ml_kem_js_1.ml_kem768.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        case "ml-kem-1024": {
+            const kp = ml_kem_js_1.ml_kem1024.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        case "ml-dsa-44": {
+            const kp = ml_dsa_js_1.ml_dsa44.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        case "ml-dsa-65": {
+            const kp = ml_dsa_js_1.ml_dsa65.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        case "ml-dsa-87": {
+            const kp = ml_dsa_js_1.ml_dsa87.keygen();
+            publicKey = kp.publicKey;
+            privateKey = kp.secretKey;
+            break;
+        }
+        default:
+            throw new Error(`Unsupported algorithm: ${algorithm}. Supported: ${exports.KEY_ALGORITHMS.join(", ")}`);
+    }
+    const kid = metadata.kid ?? generateKid(publicKey);
+    return {
+        publicKey: toHex(publicKey),
+        privateKey: toHex(privateKey),
+        algorithm,
+        kid,
+        metadata: { ...metadata, kid },
+    };
+}
+//# sourceMappingURL=keygen.js.map