blind-encryption-sodium 1.0.2 → 2.0.0

package/README.md

@@ -8,17 +8,24 @@ Implemention of encryption encoding for Autobase blind encryption using sodium e
 const BlindEncryptionSodium = require('blind-encryption-sodium')
 const b4a = require('b4a')
 
-const entropy = b4a.alloc(32) // 32-byte key
-// ... fill entropy
+const key = b4a.alloc(32) // 32-byte key
 
-const encryption = new BlindEncryptionSodium(entropy)
+const encryption = new BlindEncryptionSodium([{ key, type: 0 }])
 
 const encrypted = await encryption.encrypt(plaintext)
 // { value: <Buffer>, type: 1 }
 
-const decrypted = await encryption.decrypt(encrypted)
+const { value, rotated } = await encryption.decrypt(encrypted)
+
+// if rotated, it was decrypted with a newer type, and you should encrypt and store
 ```
 
+Multiple values can be passed in. This enables you to "rotate" keys.
+* Value encrypted with an old `type` will be upgraded to the latest `type`
+* Cannot be downgraded
+* Old types are no longer needed after upgrade
+* Returns if rotated when decrypting. Note: if it was decrypted with a newer type, you should encrypt and store to ensure it uses your latest key/entropy
+
 ### Usage with Autobase:
 
 ```js
@@ -26,7 +33,10 @@ const base = new Autobase(store, {
   apply,
   open,
   encryptionKey,
-  blindEncryption: new BlindEncryptionSodium(entropy)
+  blindEncryption: new BlindEncryptionSodium([
+    { key: oldKey, type: 0 },
+    { key: newKey, type: 1 },
+  ])
 })
 ```
 

package/index.js

@@ -2,36 +2,57 @@ const b4a = require('b4a')
 const sodium = require('sodium-universal')
 
 class BlindEncryptionSodium {
-  constructor(entropy) {
-    this._entropy = entropy || null
-    this._type = 1
+  constructor(entropies) {
+    this._entropies = entropies.sort((a, b) => b.type - a.type)
 
-    this.encrypt = async (key) => {
-      const buffer = b4a.allocUnsafe(
-        key.byteLength + sodium.crypto_secretbox_MACBYTES + sodium.crypto_secretbox_NONCEBYTES
-      )
-      const nonce = buffer.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
-      const box = buffer.subarray(nonce.byteLength)
+    this.encrypt = async (value) => {
+      // use latest
+      const entropy = this._entropies[0]
+      const buffer = this._encrypt(value, entropy.key)
 
-      sodium.randombytes_buf(nonce)
-      sodium.crypto_secretbox_easy(box, key, nonce, this._entropy)
-
-      return { value: buffer, type: 1 }
+      return { value: buffer, type: entropy.type }
     }
 
     this.decrypt = async ({ value, type }) => {
-      if (type !== this._type) {
-        throw new Error('Not encrypted using BlindEncryptionSodium')
-      }
+      let entropy = this._entropies[0]
+
+      // no backward compat
+      if (type > entropy.type) throw new Error('Encrypted using new type: ' + type)
 
-      const nonce = value.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
-      const box = value.subarray(nonce.byteLength)
-      const output = b4a.allocUnsafe(box.byteLength - sodium.crypto_secretbox_MACBYTES)
+      let rotated = false
 
-      sodium.crypto_secretbox_open_easy(output, box, nonce, this._entropy)
-      return output
+      // auto upgrade
+      if (type < entropy.type) {
+        entropy = this._entropies.find((e) => e.type === type)
+        if (!entropy) throw new Error('Missing type: ' + type)
+        rotated = true
+      }
+
+      return { value: this._decrypt(value, entropy.key), rotated }
     }
   }
+
+  _encrypt(value, entropy) {
+    const buffer = b4a.allocUnsafe(
+      value.byteLength + sodium.crypto_secretbox_MACBYTES + sodium.crypto_secretbox_NONCEBYTES
+    )
+    const nonce = buffer.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
+    const box = buffer.subarray(nonce.byteLength)
+
+    sodium.randombytes_buf(nonce)
+    sodium.crypto_secretbox_easy(box, value, nonce, entropy)
+
+    return buffer
+  }
+
+  _decrypt(value, entropy) {
+    const nonce = value.subarray(0, sodium.crypto_secretbox_NONCEBYTES)
+    const box = value.subarray(nonce.byteLength)
+    const output = b4a.allocUnsafe(box.byteLength - sodium.crypto_secretbox_MACBYTES)
+
+    sodium.crypto_secretbox_open_easy(output, box, nonce, entropy)
+    return output
+  }
 }
 
 module.exports = BlindEncryptionSodium

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blind-encryption-sodium",
-  "version": "1.0.2",
+  "version": "2.0.0",
   "description": "Implemention of encryption encoding for Autobase blind encryption using sodium easy box",
   "main": "index.js",
   "exports": {