blind-encryption-sodium 1.0.0 → 2.0.0

package/README.md

@@ -8,17 +8,24 @@ Implemention of encryption encoding for Autobase blind encryption using sodium e
 const BlindEncryptionSodium = require('blind-encryption-sodium')
 const b4a = require('b4a')
 
-const entropy = b4a.alloc(32) // 32-byte key
-// ... fill entropy
+const key = b4a.alloc(32) // 32-byte key
 
-const encryption = new BlindEncryptionSodium(entropy)
+const encryption = new BlindEncryptionSodium([{ key, type: 0 }])
 
 const encrypted = await encryption.encrypt(plaintext)
 // { value: <Buffer>, type: 1 }
 
-const decrypted = await encryption.decrypt(encrypted)
+const { value, rotated } = await encryption.decrypt(encrypted)
+
+// if rotated, it was decrypted with a newer type, and you should encrypt and store
 ```
 
+Multiple values can be passed in. This enables you to "rotate" keys.
+* Value encrypted with an old `type` will be upgraded to the latest `type`
+* Cannot be downgraded
+* Old types are no longer needed after upgrade
+* Returns if rotated when decrypting. Note: if it was decrypted with a newer type, you should encrypt and store to ensure it uses your latest key/entropy
+
 ### Usage with Autobase:
 
 ```js
@@ -26,10 +33,25 @@ const base = new Autobase(store, {
   apply,
   open,
   encryptionKey,
-  blindEncryption: new BlindEncryptionSodium(entropy)
+  blindEncryption: new BlindEncryptionSodium([
+    { key: oldKey, type: 0 },
+    { key: newKey, type: 1 },
+  ])
 })
 ```
 
+### Usage with encryption-encoding
+
+Internally, Autobase uses this with encryption-encoding
+
+```js
+const { encrypt, decrypt } = require('encryption-encoding')
+const BlindEncryptionSodium = require('blind-encryption-sodium')
+
+const encryptedAndEncoded = await encrypt(encryptionKey, bes.encrypt.bind(bes))
+const decrypted = await decrypt(encryptedAndEncoded, bes.decrypt.bind(bes))
+```
+
 ## License
 
 Apache-2.0

package/index.js

@@ -2,34 +2,55 @@ const b4a = require('b4a')
 const sodium = require('sodium-universal')
 
 class BlindEncryptionSodium {
-  constructor(entropy) {
-    this._entropy = entropy || null
-    this._type = 1
+  constructor(entropies) {
+    this._entropies = entropies.sort((a, b) => b.type - a.type)
+
+    this.encrypt = async (value) => {
+      // use latest
+      const entropy = this._entropies[0]
+      const buffer = this._encrypt(value, entropy.key)
+
+      return { value: buffer, type: entropy.type }
+    }
+
+    this.decrypt = async ({ value, type }) => {
+      let entropy = this._entropies[0]
+
+      // no backward compat
+      if (type > entropy.type) throw new Error('Encrypted using new type: ' + type)
+
+      let rotated = false
+
+      // auto upgrade
+      if (type < entropy.type) {
+        entropy = this._entropies.find((e) => e.type === type)
+        if (!entropy) throw new Error('Missing type: ' + type)
+        rotated = true
+      }
+
+      return { value: this._decrypt(value, entropy.key), rotated }
+    }
   }
 
-  async encrypt(key) {
+  _encrypt(value, entropy) {
     const buffer = b4a.allocUnsafe(
-      key.byteLength + sodium.crypto_secretbox_MACBYTES + sodium.crypto_secretbox_NONCEBYTES
+      value.byteLength + sodium.crypto_secretbox_MACBYTES + sodium.crypto_secretbox_NONCEBYTES
     )
     const nonce = buffer.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
     const box = buffer.subarray(nonce.byteLength)
 
     sodium.randombytes_buf(nonce)
-    sodium.crypto_secretbox_easy(box, key, nonce, this._entropy)
+    sodium.crypto_secretbox_easy(box, value, nonce, entropy)
 
-    return { value: buffer, type: 1 }
+    return buffer
   }
 
-  async decrypt({ value, type }) {
-    if (type !== this._type) {
-      throw new Error('Not encrypted using BlindEncryptionSodium')
-    }
-
+  _decrypt(value, entropy) {
     const nonce = value.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
     const box = value.subarray(nonce.byteLength)
     const output = b4a.allocUnsafe(box.byteLength - sodium.crypto_secretbox_MACBYTES)
 
-    sodium.crypto_secretbox_open_easy(output, box, nonce, this._entropy)
+    sodium.crypto_secretbox_open_easy(output, box, nonce, entropy)
     return output
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blind-encryption-sodium",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Implemention of encryption encoding for Autobase blind encryption using sodium easy box",
   "main": "index.js",
   "exports": {