dsh-vault 1.3.0 → 1.4.0-rc.10

package/lib/argon2.js

@@ -0,0 +1,402 @@
+/**
+ * Argon2 key derivation (RFC 9106) for dsh-vault — used by KDBX4 Argon2-KDF
+ * databases (KeePassXC / KeePass 2.55+ default).
+ *
+ * Pure-JS implementation of Argon2d / Argon2id (version 0x13), closely
+ * following the reference implementation (P-H-C/phc-winner-argon2):
+ * - fill_block / fill_segment / next_addresses
+ * - index_alpha reference-block selection
+ * - fBlaMka mixing with 64-bit multiply via 16-bit limbs
+ * Memory blocks are 1024-byte buffers of 128 little-endian 64-bit words.
+ *
+ * References: RFC 9106; phc-winner-argon2 core.c / blamka-round-ref.h;
+ * KeePassXC src/crypto/kdf/Argon2Kdf.cpp for the KDBX parameter mapping.
+ *
+ * @module dsh-vault/argon2
+ */
+import { blake2b } from "./blake2b.js";
+const BLOCK_SIZE = 1024;
+const SYNC_POINTS = 4;
+const ADDRESSES_IN_BLOCK = 128;
+function le32(buf, offset) {
+    return (buf[offset] | (buf[offset + 1] << 8) | (buf[offset + 2] << 16) | (buf[offset + 3] << 24)) >>> 0;
+}
+function writeLe32(buf, offset, value) {
+    buf.writeUInt32LE(value >>> 0, offset);
+}
+/** 32-bit rotate right. */
+function rotr32(x, n) {
+    return ((x >>> n) | (x << (32 - n))) >>> 0;
+}
+/** 64-bit rotate right of a lo/hi pair. */
+function rotr64(lo, hi, n) {
+    n &= 63;
+    if (n === 0)
+        return [lo >>> 0, hi >>> 0];
+    if (n === 32)
+        return [hi >>> 0, lo >>> 0];
+    if (n < 32) {
+        return [
+            ((lo >>> n) | (hi << (32 - n))) >>> 0,
+            ((hi >>> n) | (lo << (32 - n))) >>> 0,
+        ];
+    }
+    const s = n - 32;
+    return [
+        ((hi >>> s) | (lo << (32 - s))) >>> 0,
+        ((lo >>> s) | (hi << (32 - s))) >>> 0,
+    ];
+}
+/** 64-bit add of (a,b) + (c,d), returns lo/hi. */
+function add64(a, b, c, d) {
+    const sumLo = (a >>> 0) + (c >>> 0);
+    return [sumLo >>> 0, (b + d + Math.floor(sumLo / 0x100000000)) >>> 0];
+}
+/** 64-bit product of two 32-bit words as [lo, hi] (16-bit limbs). */
+function mul64(a, b) {
+    const a0 = a & 0xffff, a1 = a >>> 16;
+    const b0 = b & 0xffff, b1 = b >>> 16;
+    // a*b = P2*2^32 + P1*2^16 + P0, with P0 = a0b0, P1 = a1b0 + a0b1, P2 = a1b1
+    const p0 = a0 * b0;
+    const p1 = a1 * b0 + a0 * b1;
+    const p2 = a1 * b1;
+    const s1 = Math.floor(p0 / 0x10000) + p1; // carry into bits 32..47
+    const lo = (p0 & 0xffff) | ((s1 & 0xffff) << 16);
+    const s2 = Math.floor(s1 / 0x10000) + p2; // carry into bits 48..63
+    const hi = (s2 & 0xffff) | ((Math.floor(s2 / 0x10000) & 0xffff) << 16);
+    return [lo >>> 0, hi >>> 0];
+}
+/** Low 64 bits of a*b where a,b are 32-bit words. */
+function mulLo64(a, b) {
+    return mul64(a, b);
+}
+/** High 32 bits of a*b (a,b 32-bit), i.e. (a*b) >>> 32 exactly. */
+function mulHigh32(a, b) {
+    const a0 = a & 0xffff, a1 = a >>> 16;
+    const b0 = b & 0xffff, b1 = b >>> 16;
+    const p0 = a0 * b0;
+    const p1 = a1 * b0 + a0 * b1;
+    const p2 = a1 * b1;
+    const s1 = Math.floor(p0 / 0x10000) + p1; // bits 16..47 carry
+    const s2 = Math.floor(s1 / 0x10000) + p2; // bits 32..63
+    return s2 >>> 0;
+}
+/** fBlaMka (Lyra PHC team): x + y + 2*((x&0xffffffff)*(y&0xffffffff)) low 64. */
+function fBlaMka(xLo, xHi, yLo, yHi) {
+    const [pLo, pHi] = mulLo64(xLo, yLo);
+    // x + y
+    const [s1Lo, s1Hi] = add64(xLo, xHi, yLo, yHi);
+    // + product
+    const [s2Lo, s2Hi] = add64(s1Lo, s1Hi, pLo, pHi);
+    // + product again (2× product)
+    return add64(s2Lo, s2Hi, pLo, pHi);
+}
+/** H' — variable-length hash (RFC 9106 §3.3). */
+function variableHash(data, length) {
+    const prefix = Buffer.alloc(4);
+    prefix.writeUInt32LE(length >>> 0, 0);
+    const prefixed = Buffer.concat([prefix, data]);
+    if (length <= 64)
+        return blake2b(prefixed, length);
+    const r = Math.ceil(length / 32) - 2;
+    const out = Buffer.alloc(length);
+    let current = blake2b(prefixed, 64); // V_1
+    current.copy(out, 0, 0, 32);
+    let position = 32;
+    for (let i = 2; i <= r; i++) {
+        current = blake2b(current, 64);
+        current.copy(out, position, 0, 32);
+        position += 32;
+    }
+    const last = blake2b(current, length - 32 * r);
+    last.copy(out, position);
+    return out;
+}
+/** Initial hash H0 (RFC 9106 §3.2): interleaved length-then-data fields. */
+function initialHash(opts) {
+    const parts = [];
+    const u32 = (v) => {
+        const b = Buffer.alloc(4);
+        b.writeUInt32LE(v >>> 0, 0);
+        return b;
+    };
+    parts.push(u32(opts.parallelism), u32(opts.hashLength), u32(opts.memoryKiB), u32(opts.iterations), u32(opts.version), u32(opts.type), u32(opts.password.length), opts.password, u32(opts.salt.length), opts.salt, u32(opts.secret?.length ?? 0), ...(opts.secret !== undefined ? [opts.secret] : []), u32(opts.associatedData?.length ?? 0), ...(opts.associatedData !== undefined ? [opts.associatedData] : []));
+    return blake2b(Buffer.concat(parts), 64);
+}
+/** G mixing on four 64-bit words (lo/hi pairs at indices 2a..2d+1). */
+function gMix(v, a, b, c, d) {
+    // a = fBlaMka(a, b)
+    const fa = fBlaMka(v[a], v[a + 1], v[b], v[b + 1]);
+    v[a] = fa[0];
+    v[a + 1] = fa[1];
+    // d = rotr64(d ^ a, 32)
+    let lo = v[d] ^ v[a];
+    let hi = v[d + 1] ^ v[a + 1];
+    let r = rotr64(lo, hi, 32);
+    v[d] = r[0];
+    v[d + 1] = r[1];
+    // c = fBlaMka(c, d)
+    const fc = fBlaMka(v[c], v[c + 1], v[d], v[d + 1]);
+    v[c] = fc[0];
+    v[c + 1] = fc[1];
+    // b = rotr64(b ^ c, 24)
+    lo = v[b] ^ v[c];
+    hi = v[b + 1] ^ v[c + 1];
+    r = rotr64(lo, hi, 24);
+    v[b] = r[0];
+    v[b + 1] = r[1];
+    // a = fBlaMka(a, b)
+    const fa2 = fBlaMka(v[a], v[a + 1], v[b], v[b + 1]);
+    v[a] = fa2[0];
+    v[a + 1] = fa2[1];
+    // d = rotr64(d ^ a, 16)
+    lo = v[d] ^ v[a];
+    hi = v[d + 1] ^ v[a + 1];
+    r = rotr64(lo, hi, 16);
+    v[d] = r[0];
+    v[d + 1] = r[1];
+    // c = fBlaMka(c, d)
+    const fc2 = fBlaMka(v[c], v[c + 1], v[d], v[d + 1]);
+    v[c] = fc2[0];
+    v[c + 1] = fc2[1];
+    // b = rotr64(b ^ c, 63)
+    lo = v[b] ^ v[c];
+    hi = v[b + 1] ^ v[c + 1];
+    r = rotr64(lo, hi, 63);
+    v[b] = r[0];
+    v[b + 1] = r[1];
+}
+/** One BLAKE2_ROUND_NOMSG on 16 64-bit words (lo/hi entries). */
+function blake2RoundNoMsg(v, base) {
+    gMix(v, base + 0, base + 8, base + 16, base + 24);
+    gMix(v, base + 2, base + 10, base + 18, base + 26);
+    gMix(v, base + 4, base + 12, base + 20, base + 28);
+    gMix(v, base + 6, base + 14, base + 22, base + 30);
+    gMix(v, base + 0, base + 10, base + 20, base + 30);
+    gMix(v, base + 2, base + 12, base + 22, base + 24);
+    gMix(v, base + 4, base + 14, base + 16, base + 26);
+    gMix(v, base + 6, base + 8, base + 18, base + 28);
+}
+/** One BLAKE2_ROUND_NOMSG over 16 explicit word indices (lo/hi = 2×word). */
+function blake2RoundNoMsgWords(v, w) {
+    const e = w.map(x => x * 2);
+    gMix(v, e[0], e[4], e[8], e[12]);
+    gMix(v, e[1], e[5], e[9], e[13]);
+    gMix(v, e[2], e[6], e[10], e[14]);
+    gMix(v, e[3], e[7], e[11], e[15]);
+    gMix(v, e[0], e[5], e[10], e[15]);
+    gMix(v, e[1], e[6], e[11], e[12]);
+    gMix(v, e[2], e[7], e[8], e[13]);
+    gMix(v, e[3], e[4], e[9], e[14]);
+}
+/** A 1024-byte block viewed as 128 little-endian 64-bit words (lo/hi). */
+class Block {
+    v = new Array(256);
+    raw;
+    constructor(raw) {
+        this.raw = raw ?? Buffer.alloc(BLOCK_SIZE);
+        this.load();
+    }
+    load() {
+        for (let i = 0; i < 128; i++) {
+            this.v[i * 2] = le32(this.raw, i * 8);
+            this.v[i * 2 + 1] = le32(this.raw, i * 8 + 4);
+        }
+    }
+    toBuffer() {
+        for (let i = 0; i < 128; i++) {
+            this.raw.writeUInt32LE(this.v[i * 2] >>> 0, i * 8);
+            this.raw.writeUInt32LE(this.v[i * 2 + 1] >>> 0, i * 8 + 4);
+        }
+        return this.raw;
+    }
+    clear() {
+        this.v.fill(0);
+    }
+    copyFrom(other) {
+        for (let i = 0; i < 256; i++)
+            this.v[i] = other.v[i];
+    }
+    xorAssign(other) {
+        for (let i = 0; i < 256; i++)
+            this.v[i] = (this.v[i] ^ other.v[i]) >>> 0;
+    }
+    /** Permutation P: column rounds then row rounds (reference fill_block). */
+    permute() {
+        for (let i = 0; i < 8; i++)
+            blake2RoundNoMsg(this.v, 32 * i);
+        for (let i = 0; i < 8; i++) {
+            const b = 2 * i;
+            blake2RoundNoMsgWords(this.v, [
+                b, b + 1, b + 16, b + 17, b + 32, b + 33, b + 48, b + 49,
+                b + 64, b + 65, b + 80, b + 81, b + 96, b + 97, b + 112, b + 113,
+            ]);
+        }
+    }
+}
+/** Reference fill_block: next = (prev XOR ref) after P, XORed with next if withXor. */
+function fillBlock(prev, ref, next, withXor) {
+    const blockR = new Block();
+    blockR.copyFrom(ref);
+    blockR.xorAssign(prev);
+    const blockTmp = new Block();
+    blockTmp.copyFrom(blockR);
+    if (withXor)
+        blockTmp.xorAssign(next);
+    blockR.permute();
+    // next = blockTmp XOR blockR
+    blockTmp.xorAssign(blockR);
+    next.copyFrom(blockTmp);
+}
+/** next_addresses: generate the next 128 address words. */
+function nextAddresses(address, input, zero) {
+    input.v[12] = (input.v[12] + 1) >>> 0; // v[6] is the 7th 64-bit word
+    fillBlock(zero, input, address, false);
+    fillBlock(zero, address, address, false);
+}
+/** Reference index_alpha (RFC 9106 §3.4.1.3). */
+function indexAlpha(pass, slice, index, sameLane, segmentLength, laneLength, pseudoRand) {
+    let referenceAreaSize;
+    if (pass === 0) {
+        if (slice === 0) {
+            referenceAreaSize = index - 1;
+        }
+        else if (sameLane) {
+            referenceAreaSize = slice * segmentLength + index - 1;
+        }
+        else {
+            referenceAreaSize = slice * segmentLength + (index === 0 ? -1 : 0);
+        }
+    }
+    else if (sameLane) {
+        referenceAreaSize = laneLength - segmentLength + index - 1;
+    }
+    else {
+        referenceAreaSize = laneLength - segmentLength + (index === 0 ? -1 : 0);
+    }
+    let relativePosition = pseudoRand >>> 0;
+    relativePosition = mulHigh32(relativePosition, relativePosition);
+    relativePosition = referenceAreaSize - 1 - mulHigh32(referenceAreaSize, relativePosition);
+    let startPosition = 0;
+    if (pass !== 0) {
+        startPosition = slice === SYNC_POINTS - 1 ? 0 : (slice + 1) * segmentLength;
+    }
+    return (startPosition + relativePosition) % laneLength;
+}
+/**
+ * Argon2 (RFC 9106). `type` 0 = Argon2d, 2 = Argon2id. Returns the tag.
+ */
+export function argon2(opts) {
+    const lanes = opts.parallelism ?? 1;
+    const passes = opts.iterations ?? 3;
+    const memoryKiB = opts.memoryKiB ?? 32;
+    const hashLen = opts.hashLength ?? 32;
+    const type = opts.type ?? 0;
+    const version = opts.version ?? 0x13;
+    if (lanes < 1 || passes < 1)
+        throw new Error('argon2: parallelism and iterations must be >= 1');
+    if (memoryKiB < 8 * lanes)
+        throw new Error(`argon2: memory (${memoryKiB} KiB) too small for ${lanes} lanes (min ${8 * lanes})`);
+    const segmentLength = Math.floor(memoryKiB / (lanes * SYNC_POINTS));
+    const laneLength = segmentLength * SYNC_POINTS;
+    const memoryBlocks = laneLength * lanes;
+    const h0 = initialHash({
+        password: opts.password, salt: opts.salt, parallelism: lanes, iterations: passes,
+        memoryKiB, hashLength: hashLen, type, version,
+        ...(opts.secret !== undefined ? { secret: opts.secret } : {}),
+        ...(opts.associatedData !== undefined ? { associatedData: opts.associatedData } : {}),
+    });
+    // Memory blocks (all allocated), initialized with H'(H0 || le32(idx) || le32(lane)).
+    const blocks = [];
+    for (let i = 0; i < memoryBlocks; i++)
+        blocks.push(new Block());
+    for (let lane = 0; lane < lanes; lane++) {
+        for (let b = 0; b < 2; b++) {
+            const input = Buffer.alloc(72);
+            h0.copy(input, 0, 0, 64);
+            writeLe32(input, 64, b);
+            writeLe32(input, 68, lane);
+            const blk = blocks[lane * laneLength + b];
+            blk.clear();
+            const h = variableHash(input, BLOCK_SIZE);
+            for (let i = 0; i < 128; i++) {
+                blk.v[i * 2] = le32(h, i * 8);
+                blk.v[i * 2 + 1] = le32(h, i * 8 + 4);
+            }
+        }
+    }
+    const zero = new Block();
+    zero.clear();
+    const input = new Block();
+    input.clear();
+    const address = new Block();
+    address.clear();
+    const dataIndependentAddressing = (pass, slice) => type === 1 || (type === 2 && pass === 0 && slice < SYNC_POINTS / 2);
+    for (let pass = 0; pass < passes; pass++) {
+        for (let slice = 0; slice < SYNC_POINTS; slice++) {
+            for (let lane = 0; lane < lanes; lane++) {
+                const dataIndependent = dataIndependentAddressing(pass, slice);
+                if (dataIndependent) {
+                    // input_block.v[0..5] = pass, lane, slice, memory_blocks, passes, type
+                    input.clear();
+                    input.v[0] = pass >>> 0;
+                    input.v[2] = lane >>> 0;
+                    input.v[4] = slice >>> 0;
+                    input.v[6] = memoryBlocks >>> 0;
+                    input.v[8] = passes >>> 0;
+                    input.v[10] = type >>> 0;
+                }
+                let startingIndex = 0;
+                if (pass === 0 && slice === 0) {
+                    startingIndex = 2;
+                    if (dataIndependent)
+                        nextAddresses(address, input, zero);
+                }
+                // current/previous offsets within the lane (wrap at lane boundary)
+                for (let i = startingIndex; i < segmentLength; i++) {
+                    const currPos = lane * laneLength + slice * segmentLength + i;
+                    let prevPos;
+                    if (currPos % laneLength === 0)
+                        prevPos = currPos + laneLength - 1;
+                    else
+                        prevPos = currPos - 1;
+                    if (currPos % laneLength === 1)
+                        prevPos = currPos - 1;
+                    // pseudo-random 64-bit word from previous block or address block
+                    let pseudoLo;
+                    let pseudoHi;
+                    if (dataIndependent) {
+                        if (i % ADDRESSES_IN_BLOCK === 0)
+                            nextAddresses(address, input, zero);
+                        const w = (i % ADDRESSES_IN_BLOCK) * 2;
+                        pseudoLo = address.v[w];
+                        pseudoHi = address.v[w + 1];
+                    }
+                    else {
+                        pseudoLo = blocks[prevPos].v[0];
+                        pseudoHi = blocks[prevPos].v[1];
+                    }
+                    const refLane = pass === 0 && slice === 0
+                        ? lane
+                        : (pseudoHi % lanes);
+                    const sameLane = refLane === lane;
+                    const refIndex = indexAlpha(pass, slice, i, sameLane, segmentLength, laneLength, pseudoLo);
+                    const refPos = refLane * laneLength + refIndex;
+                    if (blocks[prevPos] === undefined || blocks[refPos] === undefined || blocks[currPos] === undefined) {
+                        throw new Error(`argon2: OOB pass=${pass} slice=${slice} lane=${lane} i=${i} curr=${currPos} prev=${prevPos} ref=${refPos} (mem=${memoryBlocks})`);
+                    }
+                    const refBlock = blocks[refPos];
+                    const currBlock = blocks[currPos];
+                    fillBlock(blocks[prevPos], refBlock, currBlock, pass > 0);
+                }
+            }
+        }
+    }
+    // Final block: XOR of each lane's last block, then H'.
+    const final = new Block();
+    final.clear();
+    for (let lane = 0; lane < lanes; lane++) {
+        final.xorAssign(blocks[lane * laneLength + laneLength - 1]);
+    }
+    return variableHash(final.toBuffer(), hashLen);
+}

package/lib/blake2b.js

@@ -0,0 +1,212 @@
+/**
+ * Blake2b hash (RFC 7693) for dsh-vault — used by the Argon2 KDF (RFC 9106).
+ *
+ * Pure-JS implementation. 64-bit words are represented as lo/hi 32-bit halves
+ * to avoid BigInt overhead. Supports digest lengths 1–64 and optional key.
+ *
+ * @module dsh-vault/blake2b
+ */
+const IV = [
+    0xf3bcc908, 0x6a09e667, 0x84caa73b, 0xbb67ae85, // lo, hi
+    0xfe94f82b, 0x3c6ef372, 0x5f1d36f1, 0xa54ff53a,
+    0xade682d1, 0x510e527f, 0x2b3e6c1f, 0x9b05688c,
+    0xfb41bd6b, 0x1f83d9ab, 0x137e2179, 0x5be0cd19,
+];
+const SIGMA = [
+    [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+    [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+    [11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4],
+    [7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8],
+    [9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13],
+    [2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9],
+    [12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11],
+    [13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10],
+    [6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5],
+    [10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0],
+];
+/** 64-bit rotate right of a lo/hi word pair. */
+function rotr64(lo, hi, n) {
+    n &= 63;
+    if (n === 0)
+        return [lo >>> 0, hi >>> 0];
+    if (n === 32)
+        return [hi >>> 0, lo >>> 0];
+    if (n < 32) {
+        return [
+            ((lo >>> n) | (hi << (32 - n))) >>> 0,
+            ((hi >>> n) | (lo << (32 - n))) >>> 0,
+        ];
+    }
+    const shift = n - 32;
+    return [
+        ((hi >>> shift) | (lo << (32 - shift))) >>> 0,
+        ((lo >>> shift) | (hi << (32 - shift))) >>> 0,
+    ];
+}
+/** 64-bit add of (a,b) + (c,d), returns lo/hi. */
+function add64(a, b, c, d) {
+    const sumLo = (a >>> 0) + (c >>> 0);
+    const carry = Math.floor(sumLo / 0x100000000);
+    return [sumLo >>> 0, (b + d + carry) >>> 0];
+}
+/** G mixing function operating on 64-bit words in `v` (lo at even index). */
+function g(v, a, b, c, d, xLo, xHi, yLo, yHi) {
+    // a = a + b + x
+    const a1 = add64(v[a], v[a + 1], v[b], v[b + 1]);
+    const a2 = add64(a1[0], a1[1], xLo, xHi);
+    v[a] = a2[0];
+    v[a + 1] = a2[1];
+    // d = rotr64(d ^ a, 32)
+    let lo = v[d] ^ v[a];
+    let hi = v[d + 1] ^ v[a + 1];
+    let r = rotr64(lo, hi, 32);
+    v[d] = r[0];
+    v[d + 1] = r[1];
+    // c = c + d
+    const c1 = add64(v[c], v[c + 1], v[d], v[d + 1]);
+    v[c] = c1[0];
+    v[c + 1] = c1[1];
+    // b = rotr64(b ^ c, 24)
+    lo = v[b] ^ v[c];
+    hi = v[b + 1] ^ v[c + 1];
+    r = rotr64(lo, hi, 24);
+    v[b] = r[0];
+    v[b + 1] = r[1];
+    // a = a + b + y
+    const a3 = add64(v[a], v[a + 1], v[b], v[b + 1]);
+    const a4 = add64(a3[0], a3[1], yLo, yHi);
+    v[a] = a4[0];
+    v[a + 1] = a4[1];
+    // d = rotr64(d ^ a, 16)
+    lo = v[d] ^ v[a];
+    hi = v[d + 1] ^ v[a + 1];
+    r = rotr64(lo, hi, 16);
+    v[d] = r[0];
+    v[d + 1] = r[1];
+    // c = c + d
+    const c2 = add64(v[c], v[c + 1], v[d], v[d + 1]);
+    v[c] = c2[0];
+    v[c + 1] = c2[1];
+    // b = rotr64(b ^ c, 63)
+    lo = v[b] ^ v[c];
+    hi = v[b + 1] ^ v[c + 1];
+    r = rotr64(lo, hi, 63);
+    v[b] = r[0];
+    v[b + 1] = r[1];
+}
+/** Create a Blake2b state (supports keying and custom digest length). */
+export function blake2bInit(outlen, key) {
+    if (outlen < 1 || outlen > 64)
+        throw new Error('blake2b: digest length must be 1–64');
+    // Parameter block (little-endian 64-bit): digest_length | key_length<<8 |
+    // fanout<<16 | depth<<24; the rest of the block is zero.
+    const paramLo = (outlen & 0xff) | ((key?.length ?? 0) << 8) | 0x01010000;
+    const h = [...IV];
+    h[0] = (h[0] ^ paramLo) >>> 0;
+    const st = { h, t0: 0, t1: 0, buf: Buffer.alloc(128), buflen: 0, outlen };
+    if (key !== undefined && key.length > 0) {
+        if (key.length > 128)
+            throw new Error('blake2b: key too long');
+        // RFC 7693 §3.4: the key is padded to the block size and processed as a
+        // block. Buffer it (buflen=128) so an empty message compresses it as the
+        // final block, while any following message flushes it first.
+        const block = Buffer.alloc(128);
+        key.copy(block);
+        block.copy(st.buf);
+        st.buflen = 128;
+    }
+    return st;
+}
+/** Incremental update with `data`. */
+export function blake2bUpdate(st, data) {
+    if (data.length === 0)
+        return;
+    let pos = 0;
+    // A full buffered block (e.g. the padded key block) must be flushed first.
+    if (st.buflen === 128) {
+        incrementCounter(st, 128);
+        compress(st, st.buf, false);
+        st.buflen = 0;
+    }
+    if (st.buflen > 0) {
+        const take = Math.min(128 - st.buflen, data.length);
+        data.copy(st.buf, st.buflen, 0, take);
+        st.buflen += take;
+        pos += take;
+        if (st.buflen === 128) {
+            incrementCounter(st, 128);
+            compress(st, st.buf, false);
+            st.buflen = 0;
+        }
+    }
+    while (pos + 128 <= data.length) {
+        incrementCounter(st, 128);
+        compress(st, data.subarray(pos, pos + 128), false);
+        pos += 128;
+    }
+    if (pos < data.length) {
+        data.copy(st.buf, 0, pos);
+        st.buflen = data.length - pos;
+    }
+}
+/** Finalize and return the digest. */
+export function blake2bFinal(st) {
+    incrementCounter(st, st.buflen);
+    const block = Buffer.alloc(128);
+    st.buf.copy(block, 0, 0, st.buflen);
+    compress(st, block, true);
+    const out = Buffer.alloc(st.outlen);
+    for (let i = 0; i < st.outlen; i++) {
+        // The state is 16 words of 64 bits stored as [lo, hi]; little-endian
+        // byte order is lo's 4 bytes then hi's 4 bytes per word.
+        const word = i >>> 3;
+        const isLo = (i & 4) === 0;
+        const shift = (i & 3) * 8;
+        out[i] = ((isLo ? st.h[word * 2] : st.h[word * 2 + 1]) >>> shift) & 0xff;
+    }
+    return out;
+}
+/** One-shot Blake2b digest. */
+export function blake2b(data, outlen = 64, key) {
+    const st = blake2bInit(outlen, key);
+    blake2bUpdate(st, data);
+    return blake2bFinal(st);
+}
+function incrementCounter(st, amount) {
+    st.t0 = (st.t0 + amount) >>> 0;
+    if (st.t0 < amount)
+        st.t1 = (st.t1 + 1) >>> 0;
+}
+/** Compress one 128-byte block (mix the state). */
+function compress(st, block, last) {
+    const v = new Array(32);
+    for (let i = 0; i < 16; i++) {
+        v[i] = st.h[i];
+        v[16 + i] = IV[i];
+    }
+    v[24] = (v[24] ^ st.t0) >>> 0;
+    v[25] = (v[25] ^ st.t1) >>> 0;
+    if (last) {
+        v[28] = (v[28] ^ 0xffffffff) >>> 0;
+        v[29] = (v[29] ^ 0xffffffff) >>> 0;
+    }
+    const m = new Array(32);
+    for (let i = 0; i < 16; i++) {
+        m[i * 2] = block.readUInt32LE(i * 8);
+        m[i * 2 + 1] = block.readUInt32LE(i * 8 + 4);
+    }
+    for (let round = 0; round < 12; round++) {
+        const s = SIGMA[round % 10];
+        g(v, 0, 8, 16, 24, m[s[0] * 2], m[s[0] * 2 + 1], m[s[1] * 2], m[s[1] * 2 + 1]);
+        g(v, 2, 10, 18, 26, m[s[2] * 2], m[s[2] * 2 + 1], m[s[3] * 2], m[s[3] * 2 + 1]);
+        g(v, 4, 12, 20, 28, m[s[4] * 2], m[s[4] * 2 + 1], m[s[5] * 2], m[s[5] * 2 + 1]);
+        g(v, 6, 14, 22, 30, m[s[6] * 2], m[s[6] * 2 + 1], m[s[7] * 2], m[s[7] * 2 + 1]);
+        g(v, 0, 10, 20, 30, m[s[8] * 2], m[s[8] * 2 + 1], m[s[9] * 2], m[s[9] * 2 + 1]);
+        g(v, 2, 12, 22, 24, m[s[10] * 2], m[s[10] * 2 + 1], m[s[11] * 2], m[s[11] * 2 + 1]);
+        g(v, 4, 14, 16, 26, m[s[12] * 2], m[s[12] * 2 + 1], m[s[13] * 2], m[s[13] * 2 + 1]);
+        g(v, 6, 8, 18, 28, m[s[14] * 2], m[s[14] * 2 + 1], m[s[15] * 2], m[s[15] * 2 + 1]);
+    }
+    for (let i = 0; i < 16; i++) {
+        st.h[i] = (st.h[i] ^ v[i] ^ v[16 + i]) >>> 0;
+    }
+}

package/lib/chacha20.js

@@ -0,0 +1,79 @@
+/**
+ * ChaCha20 stream cipher (IETF variant, 96-bit nonce) for dsh-vault.
+ *
+ * Node's crypto module has no ChaCha20 primitive, so this implements the
+ * standard 20-round construction needed to decrypt KeePass KDBX protected
+ * fields (inner random stream id 2) and other plaintext streams.
+ *
+ * @module dsh-vault/chacha20
+ */
+const ROUNDS = 20;
+const STATE_SIZE = 16;
+function rotl(x, n) {
+    return ((x << n) | (x >>> (32 - n))) >>> 0;
+}
+function quarterRound(state, a, b, c, d) {
+    state[a] = (state[a] + state[b]) >>> 0;
+    state[d] = rotl(state[d] ^ state[a], 16);
+    state[c] = (state[c] + state[d]) >>> 0;
+    state[b] = rotl(state[b] ^ state[c], 12);
+    state[a] = (state[a] + state[b]) >>> 0;
+    state[d] = rotl(state[d] ^ state[a], 8);
+    state[c] = (state[c] + state[d]) >>> 0;
+    state[b] = rotl(state[b] ^ state[c], 7);
+}
+function littleEndian(buf, offset) {
+    return (buf[offset] |
+        (buf[offset + 1] << 8) |
+        (buf[offset + 2] << 16) |
+        (buf[offset + 3] << 24)) >>> 0;
+}
+function toBytes(word, out, offset) {
+    out[offset] = word & 0xff;
+    out[offset + 1] = (word >>> 8) & 0xff;
+    out[offset + 2] = (word >>> 16) & 0xff;
+    out[offset + 3] = (word >>> 24) & 0xff;
+}
+const CONSTANTS = [0x61707865, 0x3320646e, 0x79622d32, 0x6b206574];
+/** XOR `input` with the ChaCha20 keystream. `key` is 32 bytes, `nonce` 12 bytes. */
+export function chacha20Xor(input, key, nonce, counter = 0) {
+    if (key.length !== 32)
+        throw new Error('chacha20: key must be 32 bytes');
+    if (nonce.length !== 12)
+        throw new Error('chacha20: nonce must be 12 bytes');
+    const out = Buffer.alloc(input.length);
+    const keyWords = [
+        littleEndian(key, 0), littleEndian(key, 4), littleEndian(key, 8), littleEndian(key, 12),
+        littleEndian(key, 16), littleEndian(key, 20), littleEndian(key, 24), littleEndian(key, 28),
+    ];
+    const nonceWords = [
+        littleEndian(nonce, 0), littleEndian(nonce, 4), littleEndian(nonce, 8),
+    ];
+    const block = Buffer.alloc(64);
+    let pos = 0;
+    let blockCounter = counter;
+    while (pos < input.length) {
+        const state = [...CONSTANTS, ...keyWords, blockCounter >>> 0, ...nonceWords];
+        const working = [...state];
+        for (let i = 0; i < ROUNDS / 2; i++) {
+            quarterRound(working, 0, 4, 8, 12);
+            quarterRound(working, 1, 5, 9, 13);
+            quarterRound(working, 2, 6, 10, 14);
+            quarterRound(working, 3, 7, 11, 15);
+            quarterRound(working, 0, 5, 10, 15);
+            quarterRound(working, 1, 6, 11, 12);
+            quarterRound(working, 2, 7, 8, 13);
+            quarterRound(working, 3, 4, 9, 14);
+        }
+        for (let i = 0; i < STATE_SIZE; i++) {
+            toBytes((working[i] + state[i]) >>> 0, block, i * 4);
+        }
+        const chunk = input.length - pos;
+        const take = Math.min(64, chunk);
+        for (let i = 0; i < take; i++)
+            out[pos + i] = input[pos + i] ^ block[i];
+        pos += take;
+        blockCounter = (blockCounter + 1) >>> 0;
+    }
+    return out;
+}