@zwave-js/cc 14.2.0 → 14.3.0

package/build/cjs/cc/Security2CC.d.ts

@@ -100,7 +100,9 @@ export declare class Security2CCMessageEncapsulation extends Security2CC {
     getSenderEI(): Uint8Array | undefined;
     /** Returns the multicast group ID if this command contains an MGRP extension */
     getMulticastGroupId(): number | undefined;
-    private maybeAddSPANExtension;
+    /** @deprecated Use {@link maybeAddSPANExtensionAsync} instead */
+    private maybeAddSPANExtensionSync;
+    private maybeAddSPANExtensionAsync;
     /** @deprecated Use {@link serializeAsync} instead */
     serialize(ctx: CCEncodingContext): Bytes;
     serializeAsync(ctx: CCEncodingContext): Promise<Bytes>;

package/build/cjs/cc/Security2CC.js

@@ -99,6 +99,7 @@ function bitMaskToSecurityClass(buffer, offset) {
   (0, import_core.validatePayload)(keys.length === 1);
   return keys[0];
 }
+const SECURITY_S2_AUTH_TAG_LENGTH = 8;
 function getAuthenticationData(sendingNodeId, destination, homeId, commandLength, unencryptedPayload) {
   const nodeIdSize = (0, import_core.isLongRangeNodeId)(sendingNodeId) || (0, import_core.isLongRangeNodeId)(destination) ? 2 : 1;
   const ret = new import_safe2.Bytes(2 * nodeIdSize + 6 + unencryptedPayload.length);
@@ -145,14 +146,15 @@ function assertSecurityTX(ctx, destination) {
   }
   return ret;
 }
-function decryptSinglecast(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
+function decryptSinglecastSync(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
   const decryptWithNonce = (nonce) => {
     const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
     const iv = nonce;
     return {
       key,
       iv,
-      ...(0, import_core.decryptAES128CCM)(key, iv, ciphertext, authData, authTag)
+      // eslint-disable-next-line @typescript-eslint/no-deprecated
+      ...(0, import_core.decryptAES128CCMSync)(key, iv, ciphertext, authData, authTag)
     };
   };
   const getNonceAndDecrypt = () => {
@@ -223,17 +225,150 @@ function decryptSinglecast(ctx, securityManager, sendingNodeId, curSequenceNumbe
     securityClass: void 0
   };
 }
-function decryptMulticast(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
+async function decryptSinglecastAsync(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
+  const decryptWithNonce = async (nonce) => {
+    const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
+    const iv = nonce;
+    return {
+      key,
+      iv,
+      ...await (0, import_core.decryptAES128CCMAsync)(ciphertext, key, iv, authData, authTag)
+    };
+  };
+  const getNonceAndDecrypt = async () => {
+    const iv = await securityManager.nextNonceAsync(sendingNodeId);
+    return decryptWithNonce(iv);
+  };
+  if (spanState.type === import_core.SPANState.SPAN) {
+    if (
+      // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
+      !!spanState.currentSPAN && spanState.currentSPAN.expires > (0, import_core.highResTimestamp)() && prevSequenceNumber != void 0 && curSequenceNumber === (prevSequenceNumber + 1 & 255) && !ctx.__internalIsMockNode
+    ) {
+      const nonce = spanState.currentSPAN.nonce;
+      spanState.currentSPAN = void 0;
+      const result = await decryptWithNonce(nonce);
+      if (result.authOK) {
+        return {
+          ...result,
+          securityClass: spanState.securityClass
+        };
+      }
+    } else {
+      spanState.currentSPAN = void 0;
+    }
+    return {
+      ...await getNonceAndDecrypt(),
+      securityClass: spanState.securityClass
+    };
+  } else if (spanState.type === import_core.SPANState.LocalEI) {
+    const senderEI = getSenderEI(extensions);
+    if (!senderEI)
+      failNoSPAN();
+    const receiverEI = spanState.receiverEI;
+    const isBootstrappingNode = securityManager.tempKeys.has(sendingNodeId);
+    if (isBootstrappingNode) {
+      await securityManager.initializeTempSPANAsync(sendingNodeId, senderEI, receiverEI);
+      const ret = await getNonceAndDecrypt();
+      if (ret.authOK) {
+        return {
+          ...ret,
+          securityClass: import_core.SecurityClass.Temporary
+        };
+      }
+      securityManager.setSPANState(sendingNodeId, spanState);
+    }
+    const possibleSecurityClasses = isBootstrappingNode ? [ctx.getHighestSecurityClass(sendingNodeId)] : import_core.securityClassOrder.filter((s) => ctx.hasSecurityClass(sendingNodeId, s) !== false);
+    for (const secClass of possibleSecurityClasses) {
+      if (!securityManager.hasKeysForSecurityClass(secClass)) {
+        continue;
+      }
+      await securityManager.initializeSPANAsync(sendingNodeId, secClass, senderEI, receiverEI);
+      const ret = await getNonceAndDecrypt();
+      if (ret.authOK) {
+        if (ctx.hasSecurityClass(sendingNodeId, secClass) === void 0) {
+          ctx.setSecurityClass(sendingNodeId, secClass, true);
+        }
+        return {
+          ...ret,
+          securityClass: secClass
+        };
+      } else {
+        securityManager.setSPANState(sendingNodeId, spanState);
+      }
+    }
+  }
+  return {
+    plaintext: new Uint8Array(),
+    authOK: false,
+    securityClass: void 0
+  };
+}
+function decryptMulticastSync(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
   const iv = securityManager.nextPeerMPAN(sendingNodeId, groupId);
   const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
   return {
     key,
     iv,
-    ...(0, import_core.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+    // eslint-disable-next-line @typescript-eslint/no-deprecated
+    ...(0, import_core.decryptAES128CCMSync)(key, iv, ciphertext, authData, authTag),
     // The security class is irrelevant when decrypting multicast commands
     securityClass: void 0
   };
 }
+async function decryptMulticastAsync(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
+  const iv = await securityManager.nextPeerMPANAsync(sendingNodeId, groupId);
+  const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
+  return {
+    key,
+    iv,
+    ...await (0, import_core.decryptAES128CCMAsync)(ciphertext, key, iv, authData, authTag),
+    // The security class is irrelevant when decrypting multicast commands
+    securityClass: void 0
+  };
+}
+function parseExtensions(buffer, wasEncrypted) {
+  const extensions = [];
+  let mustDiscardCommand = false;
+  let offset = 0;
+  parsing: while (true) {
+    if (buffer.length < offset + 2) {
+      mustDiscardCommand = true;
+      break parsing;
+    }
+    const { actual: actualLength, expected: expectedLength } = import_Extension.Security2Extension.getExtensionLength(buffer.subarray(offset));
+    const extensionLength = expectedLength ?? actualLength;
+    if (extensionLength < 2) {
+      mustDiscardCommand = true;
+      break parsing;
+    } else if (extensionLength > buffer.length - offset - (wasEncrypted ? 0 : SECURITY_S2_AUTH_TAG_LENGTH)) {
+      mustDiscardCommand = true;
+      break parsing;
+    }
+    const extensionData = buffer.subarray(offset, offset + extensionLength);
+    offset += extensionLength;
+    const ext = import_Extension.Security2Extension.parse(extensionData);
+    switch ((0, import_Extension.validateS2Extension)(ext, wasEncrypted)) {
+      case import_Extension.ValidateS2ExtensionResult.OK:
+        if (expectedLength != void 0 && actualLength !== expectedLength) {
+        } else {
+          extensions.push(ext);
+        }
+        break;
+      case import_Extension.ValidateS2ExtensionResult.DiscardExtension:
+        break;
+      case import_Extension.ValidateS2ExtensionResult.DiscardCommand:
+        mustDiscardCommand = true;
+        break;
+    }
+    if (!ext.moreToFollow)
+      break parsing;
+  }
+  return {
+    extensions,
+    mustDiscardCommand,
+    bytesRead: offset
+  };
+}
 function getDestinationIDTX() {
   if (this.isSinglecast())
     return this.nodeId;
@@ -292,7 +427,7 @@ let Security2CCAPI = (() => {
       if (!securityManager) {
         throw new import_core.ZWaveError(`Nonces can only be sent if secure communication is set up!`, import_core.ZWaveErrorCodes.Driver_NoSecurity);
       }
-      const receiverEI = securityManager.generateNonce(this.endpoint.nodeId);
+      const receiverEI = await securityManager.generateNonceAsync(this.endpoint.nodeId);
       const cc = new Security2CCNonceReport({
         nodeId: this.endpoint.nodeId,
         endpointIndex: this.endpoint.index,
@@ -843,43 +978,12 @@ let Security2CCMessageEncapsulation = (() => {
       let offset = 2;
       const extensions = [];
       let mustDiscardCommand = false;
-      const parseExtensions = (buffer, wasEncrypted) => {
-        while (true) {
-          if (buffer.length < offset + 2) {
-            mustDiscardCommand = true;
-            return;
-          }
-          const { actual: actualLength, expected: expectedLength } = import_Extension.Security2Extension.getExtensionLength(buffer.subarray(offset));
-          const extensionLength = expectedLength ?? actualLength;
-          if (extensionLength < 2) {
-            mustDiscardCommand = true;
-            return;
-          } else if (extensionLength > buffer.length - offset - (wasEncrypted ? 0 : import_core.SECURITY_S2_AUTH_TAG_LENGTH)) {
-            mustDiscardCommand = true;
-            return;
-          }
-          const extensionData = buffer.subarray(offset, offset + extensionLength);
-          offset += extensionLength;
-          const ext = import_Extension.Security2Extension.parse(extensionData);
-          switch ((0, import_Extension.validateS2Extension)(ext, wasEncrypted)) {
-            case import_Extension.ValidateS2ExtensionResult.OK:
-              if (expectedLength != void 0 && actualLength !== expectedLength) {
-              } else {
-                extensions.push(ext);
-              }
-              break;
-            case import_Extension.ValidateS2ExtensionResult.DiscardExtension:
-              break;
-            case import_Extension.ValidateS2ExtensionResult.DiscardCommand:
-              mustDiscardCommand = true;
-              break;
-          }
-          if (!ext.moreToFollow)
-            break;
-        }
-      };
-      if (hasExtensions)
-        parseExtensions(raw.payload, false);
+      if (hasExtensions) {
+        const parseResult = parseExtensions(raw.payload.subarray(offset), false);
+        extensions.push(...parseResult.extensions);
+        offset += parseResult.bytesRead;
+        mustDiscardCommand = parseResult.mustDiscardCommand;
+      }
       const mcctx = (() => {
         const multicastGroupId = getMulticastGroupId(extensions);
         if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
@@ -913,8 +1017,8 @@ let Security2CCMessageEncapsulation = (() => {
         }
       }
       const unencryptedPayload = raw.payload.subarray(0, offset);
-      const ciphertext = raw.payload.subarray(offset, -import_core.SECURITY_S2_AUTH_TAG_LENGTH);
-      const authTag = raw.payload.subarray(-import_core.SECURITY_S2_AUTH_TAG_LENGTH);
+      const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);
+      const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);
       const messageLength = 2 + raw.payload.length;
       const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
       let decrypt;
@@ -923,7 +1027,10 @@ let Security2CCMessageEncapsulation = (() => {
           securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: import_core.MPANState.OutOfSync });
           failNoMPAN();
         }
-        decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
+        decrypt = () => (
+          // eslint-disable-next-line @typescript-eslint/no-deprecated
+          decryptMulticastSync(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag)
+        );
       } else {
         const spanState = securityManager.getSPANState(ctx.sourceNodeId);
         if (spanState.type === import_core.SPANState.None) {
@@ -931,7 +1038,10 @@ let Security2CCMessageEncapsulation = (() => {
         } else if (spanState.type === import_core.SPANState.RemoteEI) {
           failNoSPAN();
         }
-        decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
+        decrypt = () => (
+          // eslint-disable-next-line @typescript-eslint/no-deprecated
+          decryptSinglecastSync(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions)
+        );
       }
       let plaintext;
       let authOK = false;
@@ -964,8 +1074,12 @@ let Security2CCMessageEncapsulation = (() => {
       }
       const securityClass = decryptionSecurityClass;
       offset = 0;
-      if (hasEncryptedExtensions)
-        parseExtensions(plaintext, true);
+      if (hasEncryptedExtensions) {
+        const parseResult = parseExtensions(plaintext, true);
+        extensions.push(...parseResult.extensions);
+        offset += parseResult.bytesRead;
+        mustDiscardCommand = parseResult.mustDiscardCommand;
+      }
       if (mustDiscardCommand) {
         import_core.validatePayload.fail("Invalid extension");
       }
@@ -1008,43 +1122,12 @@ let Security2CCMessageEncapsulation = (() => {
       let offset = 2;
       const extensions = [];
       let mustDiscardCommand = false;
-      const parseExtensions = (buffer, wasEncrypted) => {
-        while (true) {
-          if (buffer.length < offset + 2) {
-            mustDiscardCommand = true;
-            return;
-          }
-          const { actual: actualLength, expected: expectedLength } = import_Extension.Security2Extension.getExtensionLength(buffer.subarray(offset));
-          const extensionLength = expectedLength ?? actualLength;
-          if (extensionLength < 2) {
-            mustDiscardCommand = true;
-            return;
-          } else if (extensionLength > buffer.length - offset - (wasEncrypted ? 0 : import_core.SECURITY_S2_AUTH_TAG_LENGTH)) {
-            mustDiscardCommand = true;
-            return;
-          }
-          const extensionData = buffer.subarray(offset, offset + extensionLength);
-          offset += extensionLength;
-          const ext = import_Extension.Security2Extension.parse(extensionData);
-          switch ((0, import_Extension.validateS2Extension)(ext, wasEncrypted)) {
-            case import_Extension.ValidateS2ExtensionResult.OK:
-              if (expectedLength != void 0 && actualLength !== expectedLength) {
-              } else {
-                extensions.push(ext);
-              }
-              break;
-            case import_Extension.ValidateS2ExtensionResult.DiscardExtension:
-              break;
-            case import_Extension.ValidateS2ExtensionResult.DiscardCommand:
-              mustDiscardCommand = true;
-              break;
-          }
-          if (!ext.moreToFollow)
-            break;
-        }
-      };
-      if (hasExtensions)
-        parseExtensions(raw.payload, false);
+      if (hasExtensions) {
+        const parseResult = parseExtensions(raw.payload.subarray(offset), false);
+        extensions.push(...parseResult.extensions);
+        offset += parseResult.bytesRead;
+        mustDiscardCommand = parseResult.mustDiscardCommand;
+      }
       const mcctx = (() => {
         const multicastGroupId = getMulticastGroupId(extensions);
         if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
@@ -1061,9 +1144,9 @@ let Security2CCMessageEncapsulation = (() => {
       })();
       if (mustDiscardCommand) {
         if (mcctx.isMulticast) {
-          securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
+          await securityManager.nextPeerMPANAsync(ctx.sourceNodeId, mcctx.groupId);
         } else {
-          securityManager.nextNonce(ctx.sourceNodeId);
+          await securityManager.nextNonceAsync(ctx.sourceNodeId);
         }
         import_core.validatePayload.fail("Invalid S2 extension");
       }
@@ -1078,8 +1161,8 @@ let Security2CCMessageEncapsulation = (() => {
         }
       }
       const unencryptedPayload = raw.payload.subarray(0, offset);
-      const ciphertext = raw.payload.subarray(offset, -import_core.SECURITY_S2_AUTH_TAG_LENGTH);
-      const authTag = raw.payload.subarray(-import_core.SECURITY_S2_AUTH_TAG_LENGTH);
+      const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);
+      const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);
       const messageLength = 2 + raw.payload.length;
       const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
       let decrypt;
@@ -1088,7 +1171,7 @@ let Security2CCMessageEncapsulation = (() => {
           securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: import_core.MPANState.OutOfSync });
           failNoMPAN();
         }
-        decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
+        decrypt = () => decryptMulticastAsync(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
       } else {
         const spanState = securityManager.getSPANState(ctx.sourceNodeId);
         if (spanState.type === import_core.SPANState.None) {
@@ -1096,7 +1179,7 @@ let Security2CCMessageEncapsulation = (() => {
         } else if (spanState.type === import_core.SPANState.RemoteEI) {
           failNoSPAN();
         }
-        decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
+        decrypt = () => decryptSinglecastAsync(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
       }
       let plaintext;
       let authOK = false;
@@ -1111,7 +1194,7 @@ let Security2CCMessageEncapsulation = (() => {
           key,
           iv,
           securityClass: decryptionSecurityClass
-        } = decrypt());
+        } = await decrypt());
         if (!!authOK && !!plaintext)
           break;
         if (!!getSenderEI(extensions))
@@ -1129,8 +1212,12 @@ let Security2CCMessageEncapsulation = (() => {
       }
       const securityClass = decryptionSecurityClass;
       offset = 0;
-      if (hasEncryptedExtensions)
-        parseExtensions(plaintext, true);
+      if (hasEncryptedExtensions) {
+        const parseResult = parseExtensions(plaintext, true);
+        extensions.push(...parseResult.extensions);
+        offset += parseResult.bytesRead;
+        mustDiscardCommand = parseResult.mustDiscardCommand;
+      }
       if (mustDiscardCommand) {
         import_core.validatePayload.fail("Invalid extension");
       }
@@ -1200,7 +1287,8 @@ let Security2CCMessageEncapsulation = (() => {
     getMulticastGroupId() {
       return getMulticastGroupId(this.extensions);
     }
-    maybeAddSPANExtension(ctx, securityManager) {
+    /** @deprecated Use {@link maybeAddSPANExtensionAsync} instead */
+    maybeAddSPANExtensionSync(ctx, securityManager) {
       if (!this.isSinglecast())
         return;
       const receiverNodeId = this.nodeId;
@@ -1228,11 +1316,39 @@ let Security2CCMessageEncapsulation = (() => {
         }
       }
     }
+    async maybeAddSPANExtensionAsync(ctx, securityManager) {
+      if (!this.isSinglecast())
+        return;
+      const receiverNodeId = this.nodeId;
+      const spanState = securityManager.getSPANState(receiverNodeId);
+      if (spanState.type === import_core.SPANState.None || spanState.type === import_core.SPANState.LocalEI) {
+        throw new import_core.ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
+      } else if (spanState.type === import_core.SPANState.RemoteEI) {
+        const senderEI = await securityManager.generateNonceAsync(void 0);
+        const receiverEI = spanState.receiverEI;
+        if (this.securityClass == void 0 && securityManager.tempKeys.has(receiverNodeId)) {
+          await securityManager.initializeTempSPANAsync(receiverNodeId, senderEI, receiverEI);
+        } else {
+          const securityClass = this.securityClass ?? ctx.getHighestSecurityClass(receiverNodeId);
+          if (securityClass == void 0) {
+            throw new import_core.ZWaveError("No security class defined for this command!", import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
+          }
+          await securityManager.initializeSPANAsync(receiverNodeId, securityClass, senderEI, receiverEI);
+        }
+        let spanExtension = this.extensions.find((e) => e instanceof import_Extension.SPANExtension);
+        if (spanExtension) {
+          spanExtension.senderEI = senderEI;
+        } else {
+          spanExtension = new import_Extension.SPANExtension({ senderEI });
+          this.extensions.push(spanExtension);
+        }
+      }
+    }
     /** @deprecated Use {@link serializeAsync} instead */
     serialize(ctx) {
       const securityManager = assertSecurityTX(ctx, this.nodeId);
       this.ensureSequenceNumber(securityManager);
-      this.maybeAddSPANExtension(ctx, securityManager);
+      this.maybeAddSPANExtensionSync(ctx, securityManager);
       const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
       const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
       const unencryptedPayload = import_safe2.Bytes.concat([
@@ -1264,7 +1380,7 @@ let Security2CCMessageEncapsulation = (() => {
         key = keyAndIV.key;
         iv = keyAndIV.iv;
       }
-      const { ciphertext: ciphertextPayload, authTag } = (0, import_core.encryptAES128CCM)(key, iv, plaintextPayload, authData, import_core.SECURITY_S2_AUTH_TAG_LENGTH);
+      const { ciphertext: ciphertextPayload, authTag } = (0, import_core.encryptAES128CCMSync)(key, iv, plaintextPayload, authData, SECURITY_S2_AUTH_TAG_LENGTH);
       this.key = key;
       this.iv = iv;
       this.authData = authData;
@@ -1280,7 +1396,7 @@ let Security2CCMessageEncapsulation = (() => {
     async serializeAsync(ctx) {
       const securityManager = assertSecurityTX(ctx, this.nodeId);
       this.ensureSequenceNumber(securityManager);
-      this.maybeAddSPANExtension(ctx, securityManager);
+      await this.maybeAddSPANExtensionAsync(ctx, securityManager);
       const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
       const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
       const unencryptedPayload = import_safe2.Bytes.concat([
@@ -1301,18 +1417,18 @@ let Security2CCMessageEncapsulation = (() => {
       let key;
       let iv;
       if (this.isSinglecast()) {
-        iv = securityManager.nextNonce(this.nodeId, true);
+        iv = await securityManager.nextNonceAsync(this.nodeId, true);
         const { keyCCM } = (
           // Prefer the overridden security class if it was given
           this.securityClass != void 0 ? securityManager.getKeysForSecurityClass(this.securityClass) : securityManager.getKeysForNode(this.nodeId)
         );
         key = keyCCM;
       } else {
-        const keyAndIV = securityManager.getMulticastKeyAndIV(destinationTag);
+        const keyAndIV = await securityManager.getMulticastKeyAndIVAsync(destinationTag);
         key = keyAndIV.key;
         iv = keyAndIV.iv;
       }
-      const { ciphertext: ciphertextPayload, authTag } = (0, import_core.encryptAES128CCM)(key, iv, plaintextPayload, authData, import_core.SECURITY_S2_AUTH_TAG_LENGTH);
+      const { ciphertext: ciphertextPayload, authTag } = await (0, import_core.encryptAES128CCMAsync)(plaintextPayload, key, iv, authData, SECURITY_S2_AUTH_TAG_LENGTH);
       this.key = key;
       this.iv = iv;
       this.authData = authData;
@@ -1327,7 +1443,7 @@ let Security2CCMessageEncapsulation = (() => {
     }
     computeEncapsulationOverhead() {
       const extensionBytes = this.extensions.map((e) => e.computeLength()).reduce((a, b) => a + b, 0);
-      return super.computeEncapsulationOverhead() + 2 + import_core.SECURITY_S2_AUTH_TAG_LENGTH + extensionBytes;
+      return super.computeEncapsulationOverhead() + 2 + SECURITY_S2_AUTH_TAG_LENGTH + extensionBytes;
     }
     toLogEntry(ctx) {
       const message = {