@sebastienrousseau/crypto-server 0.0.8 → 0.0.24

package/dist/routes/v2/hpke.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = hpkeRoute;
+const route_helpers_1 = require("../../utils/route-helpers");
+const keys_1 = require("../../utils/keys");
+const loadHpke = async () => await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
+function ensureHex(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex ? text : Buffer.from(text, "utf8").toString("hex");
+}
+const KEYGEN_SCHEMA = {
+    tags: ["HPKE"],
+    summary: "Generate a server-held HPKE key pair (classical or post-quantum hybrid)",
+    body: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            kem: {
+                type: "string",
+                enum: ["x25519", "p256", "x25519-ml-kem-768"],
+                default: "x25519-ml-kem-768",
+            },
+        },
+    },
+};
+const SEAL_SCHEMA = {
+    tags: ["HPKE"],
+    summary: "Encrypt (seal) a message using HPKE (RFC 9180)",
+    body: {
+        type: "object",
+        required: ["recipientPublicKey", "plaintext"],
+        additionalProperties: false,
+        properties: {
+            recipientPublicKey: { type: "string", minLength: 1 },
+            plaintext: { type: "string", minLength: 1 },
+            kem: { type: "string", enum: ["x25519", "p256", "x25519-ml-kem-768"] },
+            aead: { type: "string", enum: ["chacha20-poly1305", "aes-128-gcm"] },
+            info: { type: "string" },
+            aad: { type: "string" },
+            psk: { type: "string" },
+            pskId: { type: "string" },
+        },
+    },
+};
+const OPEN_SCHEMA = {
+    tags: ["HPKE"],
+    summary: "Decrypt (open) an HPKE ciphertext with a server-held key",
+    body: {
+        type: "object",
+        required: ["keyId", "encapsulatedKey", "ciphertext"],
+        additionalProperties: false,
+        properties: {
+            keyId: keys_1.KEY_ID_SCHEMA,
+            encapsulatedKey: { type: "string", minLength: 1 },
+            ciphertext: { type: "string", minLength: 1 },
+            aead: { type: "string", enum: ["chacha20-poly1305", "aes-128-gcm"] },
+            info: { type: "string" },
+            aad: { type: "string" },
+            psk: { type: "string" },
+            pskId: { type: "string" },
+        },
+    },
+};
+function registerKeygen(app) {
+    app.post("/v2/hpke/keygen", { schema: KEYGEN_SCHEMA }, async (request, reply) => {
+        const { hpkeGenerateKeyPair } = await loadHpke();
+        const { kem } = request.body;
+        const kp = hpkeGenerateKeyPair(kem);
+        const stored = await (0, keys_1.storeKey)(request, kem, { publicKey: kp.publicKey }, { privateKey: kp.privateKey });
+        return reply.send({ data: (0, keys_1.publicView)(stored) });
+    });
+}
+function registerSeal(app) {
+    app.post("/v2/hpke/seal", { schema: SEAL_SCHEMA }, async (request, reply) => {
+        try {
+            const { hpkeSeal } = await loadHpke();
+            const b = request.body;
+            const hexPlaintext = ensureHex(b.plaintext);
+            const res = hpkeSeal({
+                recipientPublicKey: b.recipientPublicKey,
+                plaintext: hexPlaintext,
+                suite: {
+                    kem: b.kem ?? "x25519-ml-kem-768",
+                    aead: b.aead ?? "chacha20-poly1305",
+                },
+                ...(b.info ? { info: ensureHex(b.info) } : {}),
+                ...(b.aad ? { aad: ensureHex(b.aad) } : {}),
+                ...(b.psk && b.pskId ? { psk: { psk: b.psk, pskId: b.pskId } } : {}),
+            });
+            return reply.send({ data: res });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
+        }
+    });
+}
+function registerOpen(app) {
+    app.post("/v2/hpke/open", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: OPEN_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        const key = await (0, keys_1.resolveKey)(request, b.keyId, [
+            "x25519-ml-kem-768",
+            "x25519",
+            "p256",
+        ]);
+        try {
+            const { hpkeOpen } = await loadHpke();
+            const res = hpkeOpen({
+                recipientPrivateKey: key.privateParts["privateKey"],
+                encapsulatedKey: b.encapsulatedKey,
+                ciphertext: b.ciphertext,
+                suite: {
+                    kem: key.algorithm,
+                    aead: b.aead ?? "chacha20-poly1305",
+                },
+                ...(b.info ? { info: ensureHex(b.info) } : {}),
+                ...(b.aad ? { aad: ensureHex(b.aad) } : {}),
+                ...(b.psk && b.pskId ? { psk: { psk: b.psk, pskId: b.pskId } } : {}),
+            });
+            const utf8 = Buffer.from(res.plaintext, "hex").toString("utf8");
+            return reply.send({ data: { plaintext: utf8, hex: res.plaintext } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
+        }
+    });
+}
+function hpkeRoute(app) {
+    registerKeygen(app);
+    registerSeal(app);
+    registerOpen(app);
+}
+//# sourceMappingURL=hpke.js.map

package/dist/routes/v2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAmBE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAwB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAsBE"}

package/dist/routes/v2/index.js

@@ -21,6 +21,9 @@ const keys_1 = __importDefault(require("./keys"));
 const multi_recipient_1 = __importDefault(require("./multi-recipient"));
 const compliance_1 = __importDefault(require("./compliance"));
 const stream_1 = __importDefault(require("./stream"));
+const opaque_1 = __importDefault(require("./opaque"));
+const hpke_1 = __importDefault(require("./hpke"));
+const kms_1 = __importDefault(require("./kms"));
 exports.default = (app) => {
     (0, algorithms_1.default)(app);
     (0, compliance_1.default)(app);
@@ -40,5 +43,8 @@ exports.default = (app) => {
     (0, key_wrap_1.default)(app);
     (0, keys_1.default)(app);
     (0, multi_recipient_1.default)(app);
+    (0, opaque_1.default)(app);
+    (0, hpke_1.default)(app);
+    (0, kms_1.default)(app);
 };
 //# sourceMappingURL=index.js.map

package/dist/routes/v2/kdf.d.ts

@@ -1,4 +1,9 @@
 import type { FastifyInstance } from "fastify";
+export declare const KDF_FLOORS: Readonly<{
+    scryptN: 131072;
+    scryptR: 8;
+    pbkdf2Iterations: 600000;
+}>;
 declare const _default: (app: FastifyInstance) => void;
 export default _default;
 //# sourceMappingURL=kdf.d.ts.map

package/dist/routes/v2/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kdf.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kdf.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAc/C,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;yBA+Ca,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAqBE"}

package/dist/routes/v2/kdf.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+exports.KDF_FLOORS = void 0;
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
+exports.KDF_FLOORS = Object.freeze({
+    scryptN: 131072,
+    scryptR: 8,
+    pbkdf2Iterations: 600_000,
+});
 const kdfSchema = {
     tags: ["Key Derivation"],
     summary: "Derive a key from a password",
-    description: "Key derivation using scrypt, HKDF-SHA256, or PBKDF2-SHA256.",
+    description: "Key derivation using scrypt (N = 2^17, r = 8), HKDF-SHA256, or PBKDF2-SHA256 (>= 600,000 iterations). Runs on a worker thread.",
     body: {
         type: "object",
         required: ["algorithm", "password"],
@@ -19,10 +25,22 @@ const kdfSchema = {
                 type: "object",
                 additionalProperties: false,
                 properties: {
-                    N: { type: "integer", minimum: 2, maximum: 131072 },
-                    r: { type: "integer", minimum: 1, maximum: 8 },
+                    N: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.scryptN,
+                        maximum: exports.KDF_FLOORS.scryptN,
+                    },
+                    r: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.scryptR,
+                        maximum: exports.KDF_FLOORS.scryptR,
+                    },
                     p: { type: "integer", minimum: 1, maximum: 4 },
-                    iterations: { type: "integer", minimum: 1, maximum: 1000000 },
+                    iterations: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.pbkdf2Iterations,
+                        maximum: 1000000,
+                    },
                     info: { type: "string", maxLength: 1024 },
                 },
             },
@@ -33,17 +51,14 @@ exports.default = (app) => {
     app.post("/v2/kdf", { schema: kdfSchema }, async (request, reply) => {
         try {
             const body = request.body;
-            const result = (0, modern_1.kdfDerive)({
+            const options = {
                 algorithm: body.algorithm,
                 password: body.password,
                 ...(body.salt ? { salt: body.salt } : {}),
                 ...(body.keyLength ? { keyLength: body.keyLength } : {}),
-                ...(body.params
-                    ? {
-                        params: body.params,
-                    }
-                    : {}),
-            });
+                ...(body.params ? { params: body.params } : {}),
+            };
+            const result = await request.server.kdf.run("modern", "kdfDerive", options);
             return reply.send({ data: result });
         }
         catch (error) {

package/dist/routes/v2/key-wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-wrap.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/key-wrap.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA8EE"}
+{"version":3,"file":"key-wrap.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/key-wrap.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAwF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/key-wrap.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+function registerKeysWrap(app) {
     app.post("/v2/keys/wrap", {
         schema: {
             tags: ["Key Wrapping"],
@@ -52,7 +52,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { aesKwWrap, aesKwpWrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/key-wrap")));
+            const { aesKwWrap, aesKwpWrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { kek, keyToWrap, algorithm } = request.body;
             const result = algorithm === "aes-kwp"
                 ? aesKwpWrap(kek, keyToWrap)
@@ -63,6 +63,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key wrapping");
         }
     });
+}
+function registerKeysUnwrap(app) {
     app.post("/v2/keys/unwrap", {
         schema: {
             tags: ["Key Wrapping"],
@@ -80,7 +82,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { aesKwUnwrap, aesKwpUnwrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/key-wrap")));
+            const { aesKwUnwrap, aesKwpUnwrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { kek, wrappedKey, algorithm } = request.body;
             const result = algorithm === "aes-kwp"
                 ? aesKwpUnwrap(kek, wrappedKey)
@@ -93,5 +95,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key unwrapping");
         }
     });
+}
+exports.default = (app) => {
+    registerKeysWrap(app);
+    registerKeysUnwrap(app);
 };
 //# sourceMappingURL=key-wrap.js.map

package/dist/routes/v2/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/keys.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA0DE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/keys.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAiG/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/keys.js

@@ -33,12 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("@sebastienrousseau/crypto-lib/keys");
+const keys_2 = require("../../utils/keys");
+function registerGenerate(app) {
     app.post("/v2/keys/generate", {
         schema: {
             tags: ["Key Management"],
-            summary: "Generate a key pair for any supported algorithm",
+            summary: "Generate a server-held key pair for any supported algorithm",
+            description: "Generates a key pair, keeps the private key on the server and returns its keyId with the public key. Use the keyId with the signing, decryption and decapsulation routes.",
             body: {
                 type: "object",
                 additionalProperties: false,
@@ -46,20 +48,7 @@ exports.default = (app) => {
                     algorithm: {
                         default: "ed25519",
                         type: "string",
-                        enum: [
-                            "ed25519",
-                            "x25519",
-                            "ed448",
-                            "x448",
-                            "p256",
-                            "p384",
-                            "ml-kem-512",
-                            "ml-kem-768",
-                            "ml-kem-1024",
-                            "ml-dsa-44",
-                            "ml-dsa-65",
-                            "ml-dsa-87",
-                        ],
+                        enum: [...keys_1.KEY_ALGORITHMS],
                     },
                     metadata: {
                         type: "object",
@@ -74,15 +63,39 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { generateKeyPair } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/keys/keygen")));
-            const { algorithm, metadata } = request.body;
-            const result = generateKeyPair(algorithm, metadata);
-            return reply.send({ data: result });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const { generateKeyPair } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/keys")));
+        const { algorithm, metadata } = request.body;
+        const pair = generateKeyPair(algorithm, metadata);
+        const stored = await (0, keys_2.storeKey)(request, pair.algorithm, { publicKey: pair.publicKey }, { privateKey: pair.privateKey });
+        return reply.send({
+            data: { ...(0, keys_2.publicView)(stored), kid: pair.kid, metadata: pair.metadata },
+        });
     });
+}
+function registerExport(app) {
+    app.post("/v2/keys/export", {
+        schema: {
+            tags: ["Key Management"],
+            summary: "Export a server-held private key",
+            description: "Returns the private key of a key pair this principal generated. Requires the crypto:keys:export scope, granted explicitly (crypto:admin does not include it).",
+            body: {
+                type: "object",
+                required: ["keyId"],
+                additionalProperties: false,
+                properties: { keyId: keys_2.KEY_ID_SCHEMA },
+            },
+        },
+    }, async (request, reply) => {
+        const { keyId } = request.body;
+        const key = await (0, keys_2.resolveKey)(request, keyId);
+        request.log.warn({ keyId }, "Private key exported");
+        return reply.send({
+            data: { ...(0, keys_2.publicView)(key), ...key.privateParts },
+        });
+    });
+}
+exports.default = (app) => {
+    registerGenerate(app);
+    registerExport(app);
 };
 //# sourceMappingURL=keys.js.map

package/dist/routes/v2/kms.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyInstance } from "fastify";
+import { type KmsProvider } from "@sebastienrousseau/crypto-kms";
+export declare function registerKmsProvider(name: string, provider: KmsProvider): void;
+export declare function resetKmsProviders(): void;
+export declare function resolveKmsProvider(name?: string): KmsProvider;
+export default function kmsRoute(app: FastifyInstance): void;
+//# sourceMappingURL=kms.d.ts.map

package/dist/routes/v2/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kms.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,KAAK,WAAW,EAMjB,MAAM,+BAA+B,CAAC;AAOvC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,CAE7E;AAGD,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AA+CD,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAQ7D;AA2SD,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAO3D"}