@yielded/crypto 0.0.0-stage → 0.1.0-beta.19

package/src/Portable.ts

@@ -0,0 +1,8 @@
+import { argon2 } from "./internal/argon2";
+import { makeLayer } from "./internal/layer";
+import { xchacha } from "./internal/xchacha";
+import type { Limits } from "./Kdf";
+
+/** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */
+export const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>
+  makeLayer(subtle, limits, { argon2, xchacha });

package/src/Signature.ts

@@ -0,0 +1,87 @@
+import { Context, type Effect, type Redacted, Schema } from "effect";
+
+import type { OperationError } from "./Errors";
+
+export const Algorithm = Schema.Literals([
+  "ECDSA-P256-SHA256",
+  "RSASSA-PKCS1-v1_5-SHA256",
+  "RSA-PSS-SHA256",
+  "Ed25519",
+]);
+
+export type Algorithm = typeof Algorithm.Type;
+
+const coordinate = Schema.Uint8Array.check(Schema.isMinLength(32), Schema.isMaxLength(32));
+const integer = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(1024));
+const ec = { algorithm: Schema.Literal("ECDSA-P256-SHA256"), x: coordinate, y: coordinate };
+const ed = { algorithm: Schema.Literal("Ed25519"), x: coordinate };
+
+const rsa = {
+  algorithm: Schema.Literals(["RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256"]),
+  n: integer,
+  e: integer,
+};
+
+/**
+ * Unsigned big-endian components: 32-byte curve values and RSA components up to
+ * 1024 bytes. Native import validates the actual key, including RSA's minimum.
+ */
+export const PublicKeyParameters = Schema.Union([
+  Schema.Struct(ec),
+  Schema.Struct(ed),
+  Schema.Struct(rsa),
+]);
+
+export type PublicKeyParameters = typeof PublicKeyParameters.Type;
+
+export const PrivateKeyParameters = Schema.Union([
+  Schema.Struct({ ...ec, d: coordinate }),
+  Schema.Struct({ ...ed, d: coordinate }),
+  Schema.Struct({
+    ...rsa,
+    d: integer,
+    p: integer,
+    q: integer,
+    dp: integer,
+    dq: integer,
+    qi: integer,
+  }),
+]);
+
+export type PrivateKeyParameters = typeof PrivateKeyParameters.Type;
+
+export const SignInput = Schema.Struct({
+  algorithm: Algorithm,
+  privateKey: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),
+  data: Schema.Uint8Array,
+});
+
+export type SignInput = typeof SignInput.Type;
+
+export const VerifyInput = Schema.Struct({
+  algorithm: Algorithm,
+  publicKey: Schema.Uint8Array,
+  data: Schema.Uint8Array,
+  signature: Schema.Uint8Array,
+});
+
+export type VerifyInput = typeof VerifyInput.Type;
+
+/**
+ * Private keys are PKCS8 DER; public keys are SPKI DER. ECDSA signatures are
+ * 64-byte IEEE P1363 (r || s), not ASN.1 DER. RSA requires at least 2048 bits;
+ * PSS uses a 32-byte salt. Key serialization/selection and JOSE policy stay outside.
+ */
+export class Signature extends Context.Service<
+  Signature,
+  {
+    readonly encodePublicKey: (
+      input: PublicKeyParameters,
+    ) => Effect.Effect<Uint8Array, OperationError>;
+    readonly encodePrivateKey: (
+      input: Redacted.Redacted<PrivateKeyParameters>,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError>;
+    readonly sign: (input: SignInput) => Effect.Effect<Uint8Array, OperationError>;
+    readonly verify: (input: VerifyInput) => Effect.Effect<boolean, OperationError>;
+  }
+>()("@yielded/crypto/Signature") {}

package/src/WebCrypto.ts

@@ -0,0 +1,46 @@
+import { Crypto, Effect, Layer, PlatformError } from "effect";
+
+import { Hmac } from "./Hmac";
+import { makeHmac } from "./internal/hmac";
+import { makeLayer } from "./internal/layer";
+import type { Limits } from "./Kdf";
+
+/** Supply the host capability explicitly; no implicit global backend selection. */
+export const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>
+  makeLayer(subtle, limits);
+
+/** HMAC alone has no KDF admission requirement. */
+export const layerHmac = (subtle: SubtleCrypto): Layer.Layer<Hmac> =>
+  Layer.sync(Hmac)(() => makeHmac(subtle));
+
+/** Effect entropy and SHA digests from the host's global WebCrypto implementation. */
+export const layerCryptoWeb: Layer.Layer<Crypto.Crypto> = Layer.sync(Crypto.Crypto)(() =>
+  Crypto.make({
+    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),
+    digest: (algorithm, data) =>
+      Effect.tryPromise({
+        try: () => globalThis.crypto.subtle.digest(algorithm, new Uint8Array(data)),
+        catch: (cause) =>
+          PlatformError.systemError({
+            _tag: "Unknown",
+            module: "Crypto",
+            method: "digest",
+            cause,
+          }),
+      }).pipe(Effect.map((bytes) => new Uint8Array(bytes))),
+  }),
+);
+
+/** HMAC from global WebCrypto. Missing WebCrypto is a platform defect at Layer construction. */
+export const layerHmacWeb: Layer.Layer<Hmac> = Layer.effect(Hmac)(
+  Effect.suspend(() => {
+    const subtle = globalThis.crypto?.subtle;
+
+    return subtle === undefined
+      ? Effect.die(new Error("WebCrypto is unavailable in this runtime"))
+      : Effect.succeed(makeHmac(subtle));
+  }),
+);
+
+/** Entropy, SHA digests and HMAC for sessions and proofs, without password derivation. */
+export const layerWebCrypto = Layer.merge(layerCryptoWeb, layerHmacWeb);

package/src/index.ts

@@ -0,0 +1,6 @@
+export * as Aead from "./Aead.ts";
+export * as Errors from "./Errors.ts";
+export * as Hmac from "./Hmac.ts";
+export * as Kdf from "./Kdf.ts";
+export * as KdfAdmission from "./KdfAdmission.ts";
+export * as Signature from "./Signature.ts";

package/src/internal/aead.ts

@@ -0,0 +1,119 @@
+import { Effect, Redacted, Schema } from "effect";
+
+import { Aead, DecryptInput, EncryptInput } from "../Aead";
+import { AuthenticationFailed, type OperationError, UnsupportedAlgorithm } from "../Errors";
+import { copy, decode, importError, nativeError, nativeErrorName, withSecret } from "./common";
+
+interface CipherInput {
+  readonly key: Uint8Array<ArrayBuffer>;
+  readonly nonce: Uint8Array<ArrayBuffer>;
+  readonly additionalData: Uint8Array<ArrayBuffer>;
+  readonly data: Uint8Array<ArrayBuffer>;
+}
+
+export interface XChaCha {
+  readonly encrypt: (input: CipherInput) => Effect.Effect<Uint8Array, OperationError>;
+  readonly decrypt: (
+    input: CipherInput,
+  ) => Effect.Effect<Uint8Array, OperationError | AuthenticationFailed>;
+}
+
+const keyBytes = Schema.Uint8Array.check(Schema.isBetweenLength(32, 32));
+
+export const makeAead = (subtle: SubtleCrypto, xchacha?: XChaCha): Aead["Service"] =>
+  Aead.of({
+    encrypt: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(EncryptInput, input, "data");
+      const nonceLength = value.algorithm === "AES-256-GCM" ? 12 : 24;
+
+      yield* decode(keyBytes, Redacted.value(value.key), "key");
+      yield* decode(
+        Schema.Uint8Array.check(Schema.isBetweenLength(nonceLength, nonceLength)),
+        value.nonce,
+        "nonce",
+      );
+      if (value.algorithm === "XChaCha20-Poly1305" && xchacha === undefined)
+        return yield* UnsupportedAlgorithm.make({});
+      const nonce = yield* copy(value.nonce);
+      const additionalData = yield* copy(value.additionalData ?? new Uint8Array());
+
+      return yield* withSecret(value.key, (key) =>
+        withSecret(value.plaintext, (data) => {
+          if (value.algorithm === "XChaCha20-Poly1305") {
+            return xchacha === undefined
+              ? Effect.fail(UnsupportedAlgorithm.make({}))
+              : xchacha.encrypt({ key, nonce, additionalData, data });
+          }
+
+          return Effect.gen(function* () {
+            const imported = yield* Effect.tryPromise({
+              try: () => subtle.importKey("raw", key, "AES-GCM", false, ["encrypt"]),
+              catch: importError,
+            });
+
+            const encrypted = yield* Effect.tryPromise({
+              try: () =>
+                subtle.encrypt(
+                  { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
+                  imported,
+                  data,
+                ),
+              catch: nativeError,
+            });
+
+            return new Uint8Array(encrypted);
+          }).pipe(Effect.uninterruptible);
+        }),
+      );
+    }),
+    decrypt: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(DecryptInput, input, "data");
+      const nonceLength = value.algorithm === "AES-256-GCM" ? 12 : 24;
+
+      yield* decode(keyBytes, Redacted.value(value.key), "key");
+      yield* decode(
+        Schema.Uint8Array.check(Schema.isBetweenLength(nonceLength, nonceLength)),
+        value.nonce,
+        "nonce",
+      );
+      if (value.algorithm === "XChaCha20-Poly1305" && xchacha === undefined)
+        return yield* UnsupportedAlgorithm.make({});
+      if (value.ciphertext.length < 16) return yield* AuthenticationFailed.make({});
+      const nonce = yield* copy(value.nonce);
+      const additionalData = yield* copy(value.additionalData ?? new Uint8Array());
+      const data = yield* copy(value.ciphertext);
+
+      const plaintext = yield* withSecret(value.key, (key) => {
+        if (value.algorithm === "XChaCha20-Poly1305") {
+          return xchacha === undefined
+            ? Effect.fail(UnsupportedAlgorithm.make({}))
+            : xchacha.decrypt({ key, nonce, additionalData, data });
+        }
+
+        return Effect.gen(function* () {
+          const imported = yield* Effect.tryPromise({
+            try: () => subtle.importKey("raw", key, "AES-GCM", false, ["decrypt"]),
+            catch: importError,
+          });
+
+          const decrypted = yield* Effect.tryPromise({
+            try: () =>
+              subtle.decrypt(
+                { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
+                imported,
+                data,
+              ),
+            // WebCrypto specifies OperationError for a rejected GCM tag.
+            catch: (cause) =>
+              nativeErrorName(cause) === "OperationError"
+                ? AuthenticationFailed.make({})
+                : nativeError(cause),
+          });
+
+          return new Uint8Array(decrypted);
+        }).pipe(Effect.uninterruptible);
+      });
+
+      return Redacted.make(plaintext);
+    }),
+  });