expo-device-crypto 0.1.0 → 0.2.0

package/README.md

@@ -2,7 +2,7 @@
 
 > ⚠️ This module is currently in beta and is not suitable for production use.
 
-Hardware-backed cryptography for Expo apps using Android Keystore and Apple Secure Enclave/Keychain where available.
+🔒 Hardware-backed cryptography for Expo apps using [Android Keystore](https://developer.android.com/privacy-and-security/keystore) and Apple [Secure Enclave](https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave).
 
 ## Installation
 
@@ -26,42 +26,35 @@ If you want to allow Face ID on iOS, add this to your app config:
 
 ## Supported Algorithms
 
-### ECDSA (`ECDSA_SECP256R1_SHA256`)
+### Signature Algorithms
 
-- **Type:** Digital signature algorithm (asymmetric).
-- **Curve:** P-256 / secp256r1.
-- **Hash:** SHA-256.
-- **Use it for:** Authentication challenges, message signing, and tamper detection.
+- #### `ECDSA_SECP256R1_SHA256`
 
-### RSA (`RSA_2048_PKCS1`)
+**Curve:** P-256 / secp256r1. </br>
+**Hash:** SHA-256. </br>
+**Use it for:** Authentication challenges, message signing, and tamper detection.
 
-- **Type:** Asymmetric encryption algorithm.
-- **Key size:** 2048 bits.
-- **Padding:** PKCS#1 v1.5.
-- **Use it for:** Encrypting small secrets that only the private key holder should decrypt.
+### Encryption Algorithms
 
-## Biometric and Passcode Protection
+- #### `RSA_2048_PKCS1`
 
-You can bind private key usage to user authentication with:
+**Key size:** 2048 bits. </br>
+**Padding:** PKCS#1 v1.5. </br>
+**Use it for:** Encrypting small secrets that only the private key holder should decrypt.
 
-- `requireAuthentication: true` when creating a key pair. (set to `false` to allow signing and decryption without authentication prompts)
-- Use `AuthMethod.PASSCODE` or `AuthMethod.PASSCODE_OR_BIOMETRIC` to specify whether authentication should require only a passcode or allow biometrics when available.
+- #### `RSA_2048_OAEP_SHA1`
 
-Before using authentication-protected keys, verify that device authentication is available. If the user has not enabled at least a passcode, this function returns `AuthCheckResult.UNAVAILABLE`.
+**Key size:** 2048 bits. </br>
+**Padding:** OAEP with SHA-1 and MGF1. </br>
+**Use it for:** Encrypting small secrets with stronger padding than PKCS#1 v1.5 when interoperating with OAEP SHA-1 systems.
 
-```ts
-import DeviceCrypto, { AuthCheckResult } from "expo-device-crypto";
-
-const authStatus = DeviceCrypto.isAuthCheckAvailable();
-if (authStatus !== AuthCheckResult.AVAILABLE) {
-  throw new Error(`Authentication unavailable: ${authStatus}`);
-}
-```
+More coming soon 
 
 ## Example: ECDSA with Biometric
 
 ```ts
 import DeviceCrypto, {
+  AuthCheckResult,
   AuthMethod,
   SigningAlgorithm,
 } from "expo-device-crypto";
@@ -71,24 +64,31 @@ const payload = "Sign this challenge payload";
 const algorithmType = SigningAlgorithm.ECDSA_SECP256R1_SHA256;
 const authMethod = AuthMethod.PASSCODE_OR_BIOMETRIC;
 
-// 1) Generate an auth-protected ECDSA key pair
+// 1) Ensure device authentication is configured (passcode at minimum)
+const authStatus = DeviceCrypto.isAuthCheckAvailable();
+if (authStatus !== AuthCheckResult.AVAILABLE) {
+  throw new Error(`Authentication unavailable: ${authStatus}`);
+}
+
+// 2) Generate an auth-protected ECDSA key pair
 await DeviceCrypto.generateKeyPair(alias, {
   requireAuthentication: true,
   authMethod, // iOS: defined at key generation;
   algorithmType,
 });
 
-// 2) Optional: share public key with backend
+// 3) Optional: share public key with backend
 const publicKeyPem = DeviceCrypto.getPublicKey(alias, { format: "PEM" });
 
-// 3) Sign with private key (prompts biometric/passcode on protected keys)
+// 4) Sign with private key (prompts biometric/passcode on protected keys)
 // Note: The data to sign must be in UTF-8 format.
+// Note: This function should display the system user authentication prompt.
 const signature = await DeviceCrypto.sign(alias, payload, {
   algorithmType,
   authMethod, // Android: defined when signing
 });
 
-// 4) Verify locally (usually done server-side with stored public key)
+// 5) Verify locally (usually done server-side with stored public key)
 const isValid = await DeviceCrypto.verify(alias, payload, signature ?? "", {
   algorithmType,
 });
@@ -98,6 +98,7 @@ const isValid = await DeviceCrypto.verify(alias, payload, signature ?? "", {
 
 ```ts
 import DeviceCrypto, {
+  AuthCheckResult,
   AuthMethod,
   EncryptionAlgorithm,
 } from "expo-device-crypto";
@@ -107,26 +108,72 @@ const secret = "Sensitive token";
 const algorithmType = EncryptionAlgorithm.RSA_2048_PKCS1;
 const authMethod = AuthMethod.PASSCODE_OR_BIOMETRIC;
 
-// 1) Generate an auth-protected RSA key pair
+// 1) Ensure device authentication is configured (passcode at minimum)
+const authStatus = DeviceCrypto.isAuthCheckAvailable();
+if (authStatus !== AuthCheckResult.AVAILABLE) {
+  throw new Error(`Authentication unavailable: ${authStatus}`);
+}
+
+// 2) Generate an auth-protected RSA key pair
 await DeviceCrypto.generateKeyPair(alias, {
   algorithmType,
   requireAuthentication: true,
   authMethod, // iOS: defined at key generation;
 });
 
-// 2) Optional: retrieve/share public key with backend
+// 3) Optional: retrieve/share public key with backend
 const publicKeyPem = DeviceCrypto.getPublicKey(alias, { format: "PEM" });
 
-// 3) Encrypt with public key
+// 4) Encrypt with public key
 const encrypted = await DeviceCrypto.encrypt(alias, secret, {
   algorithmType,
 });
 
-// 4) Decrypt with private key (prompts biometric/passcode on protected keys)
-// Note: Data to encrypt must be in Base64 format.
+// 5) Decrypt with private key (prompts biometric/passcode on protected keys)
+// Note: Data to decrypt must be in Base64 format.
+// Note: This function should display the system user authentication prompt.
 const decrypted = await DeviceCrypto.decrypt(alias, encrypted ?? "", {
   algorithmType,
   authMethod, // Android: defined when decrypting
 });
 ```
 
+> ⚠️ Because iOS Keychain/Secure Enclave binds authentication policy to key creation, `authMethod` must be set in `generateKeyPair`. On Android Keystore, authentication is applied at key usage time, so `authMethod` is provided in operations like `sign` and `decrypt`.
+
+### Methods
+
+- `isAuthCheckAvailable(): AuthCheckResult`
+  - Returns device authentication availability (`AVAILABLE`, `NO_HARDWARE`, `UNAVAILABLE`).
+
+- `generateKeyPair(alias: string, options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult>`
+  - Creates a key pair for `alias` if it does not exist.
+  - Defaults: `requireAuthentication = false`, `authMethod = PASSCODE_OR_BIOMETRIC`.
+
+- `getPublicKey(alias: string, options?: GetPublicKeyOptions): string | null`
+  - Returns public key in PEM format (or `null` if alias not found).
+  - Defaults: `format = "PEM"`.
+
+- `removeKeyPair(alias: string): boolean`
+  - Removes the key pair for the alias.
+
+- `aliases(): string[]`
+  - Lists stored key aliases.
+
+- `sign(alias: string, data: string, options?: SignOptions): Promise<string | null>`
+  - Signs UTF-8 `data` with private key.
+  - Defaults: `algorithmType = ECDSA_SECP256R1_SHA256`, `promptTitle = "Unlock"`, `promptSubtitle = "Enter your PIN to continue"`, `authMethod = PASSCODE_OR_BIOMETRIC`.
+
+- `verify(alias: string, data: string, signature: string, options?: VerifyOptions): Promise<boolean | null>`
+  - Verifies signature for UTF-8 `data`.
+  - Signature must be in Base64 format.
+  - Default: `algorithmType = ECDSA_SECP256R1_SHA256`.
+
+- `encrypt(alias: string, data: string, options?: EncryptOptions): Promise<string | null>`
+  - Encrypts UTF-8 `data` with public key.
+  - Default: `algorithmType = RSA_2048_PKCS1`.
+
+- `decrypt(alias: string, data: string, options?: DecryptOptions): Promise<string | null>`
+  - Decrypts Base64 `data` with private key.
+  - Defaults: `algorithmType = RSA_2048_PKCS1`, `promptTitle = "Unlock"`, `promptSubtitle = "Enter your PIN to continue"`, `authMethod = PASSCODE_OR_BIOMETRIC`.
+
+> ✅ JSDoc type definitions are available in `./src/DeviceCryptoModule.ts`.

package/android/build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'com.android.library'
 
 group = 'expo.modules.devicecrypto'
-version = '0.1.0'
+version = '0.2.0'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 apply from: expoModulesCorePlugin
@@ -35,7 +35,7 @@ android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "0.1.0"
+    versionName "0.2.0"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -1,26 +1,41 @@
 package expo.modules.devicecrypto
 
+import android.content.Context
 import android.content.pm.PackageManager
 import android.security.keystore.KeyGenParameterSpec
 import android.security.keystore.KeyInfo
-import android.security.keystore.KeyProperties
-import expo.modules.kotlin.modules.Module
-import expo.modules.kotlin.modules.ModuleDefinition
-import java.security.KeyPairGenerator
-import java.security.KeyStore
+import android.security.keystore.KeyProperties.AUTH_BIOMETRIC_STRONG
+import android.security.keystore.KeyProperties.AUTH_DEVICE_CREDENTIAL
+import android.security.keystore.KeyProperties.DIGEST_SHA1
+import android.security.keystore.KeyProperties.DIGEST_SHA256
+import android.security.keystore.KeyProperties.ENCRYPTION_PADDING_RSA_OAEP
+import android.security.keystore.KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1
+import android.security.keystore.KeyProperties.KEY_ALGORITHM_EC
+import android.security.keystore.KeyProperties.KEY_ALGORITHM_RSA
+import android.security.keystore.KeyProperties.PURPOSE_DECRYPT
+import android.security.keystore.KeyProperties.PURPOSE_ENCRYPT
+import android.security.keystore.KeyProperties.PURPOSE_SIGN
+import android.security.keystore.KeyProperties.PURPOSE_VERIFY
 import android.util.Base64
 import androidx.biometric.BiometricManager
-import androidx.biometric.BiometricPrompt
 import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
 import androidx.biometric.BiometricManager.Authenticators.DEVICE_CREDENTIAL
+import androidx.biometric.BiometricPrompt
 import androidx.core.content.ContextCompat
 import androidx.fragment.app.FragmentActivity
 import expo.modules.kotlin.Promise
-import java.security.Signature
-import android.widget.Toast
-import android.content.Context
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
 import java.security.KeyFactory
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.Signature
+import java.security.spec.AlgorithmParameterSpec
+import java.security.spec.MGF1ParameterSpec
 import javax.crypto.Cipher
+import javax.crypto.spec.OAEPParameterSpec
+import javax.crypto.spec.PSource
+
 
 enum class GenerateKeyPairResult {
   KEY_PAIR_GENERATED,
@@ -42,6 +57,7 @@ enum class AuthMethod {
 enum class AlgorithmType {
   ECDSA_SECP256R1_SHA256,
   RSA_2048_PKCS1,
+  RSA_2048_OAEP_SHA1,
 }
 
 class DeviceCryptoModule : Module() {
@@ -49,6 +65,19 @@ class DeviceCryptoModule : Module() {
     return when (algorithm) {
       AlgorithmType.ECDSA_SECP256R1_SHA256 -> "SHA256withECDSA"
       AlgorithmType.RSA_2048_PKCS1 -> "RSA/ECB/PKCS1Padding"
+      AlgorithmType.RSA_2048_OAEP_SHA1 -> "RSA/ECB/OAEPwithSHA-1AndMGF1Padding"
+    }
+  }
+
+  private fun getOaepSpec(algoType: AlgorithmType): AlgorithmParameterSpec? {
+    return when (algoType) {
+      AlgorithmType.RSA_2048_OAEP_SHA1 -> OAEPParameterSpec(
+        "SHA-1",
+        "MGF1",
+        MGF1ParameterSpec.SHA1,
+        PSource.PSpecified.DEFAULT
+      )
+      else -> null
     }
   }
 
@@ -108,23 +137,26 @@ class DeviceCryptoModule : Module() {
     return true
   }
 
-  private fun buildECDSA_SECP256R1_SHA256(alias: String, reqAuth: Boolean): KeyPairGenerator {
+  private fun buildECDSA(
+    alias: String, 
+    digest: String,
+    reqAuth: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
-      KeyProperties.KEY_ALGORITHM_EC,
+      KEY_ALGORITHM_EC,
       "AndroidKeyStore"
     )
 
     val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
       alias,
-      KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
+      PURPOSE_SIGN or PURPOSE_VERIFY
     ).run {
-      setDigests(KeyProperties.DIGEST_SHA256)
+      setDigests(digest)
       setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
         setUserAuthenticationParameters(
           30, // 30 seconds
-          KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
+          AUTH_BIOMETRIC_STRONG or AUTH_DEVICE_CREDENTIAL
         )
       }
       build()
@@ -133,23 +165,30 @@ class DeviceCryptoModule : Module() {
     return kpg
   }
 
-  private fun buildRSA_2048_PKCS1(alias: String, reqAuth: Boolean): KeyPairGenerator {
+  private fun buildRSA(
+    alias: String, 
+    digest: String?,
+    padding: String,
+    reqAuth: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
-      KeyProperties.KEY_ALGORITHM_RSA,
+      KEY_ALGORITHM_RSA,
       "AndroidKeyStore"
     )
 
     val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
       alias,
-      KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+      PURPOSE_ENCRYPT or PURPOSE_DECRYPT
     ).run {
-      setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
+      if (digest != null) {
+        setDigests(digest)
+      }
+      setEncryptionPaddings(padding)
       setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
         setUserAuthenticationParameters(
           30, // 30 seconds
-          KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
+          AUTH_BIOMETRIC_STRONG or AUTH_DEVICE_CREDENTIAL
         )
       }
       build()
@@ -200,8 +239,8 @@ class DeviceCryptoModule : Module() {
         .setSubtitle(subtitle)
         .setAllowedAuthenticators(
           when (authMethod) {
-            AuthMethod.PASSCODE -> BiometricManager.Authenticators.DEVICE_CREDENTIAL
-            AuthMethod.PASSCODE_OR_BIOMETRIC -> BiometricManager.Authenticators.BIOMETRIC_STRONG or BiometricManager.Authenticators.DEVICE_CREDENTIAL
+            AuthMethod.PASSCODE -> DEVICE_CREDENTIAL
+            AuthMethod.PASSCODE_OR_BIOMETRIC -> BIOMETRIC_STRONG or DEVICE_CREDENTIAL
           }
         )
         .build()
@@ -231,8 +270,9 @@ class DeviceCryptoModule : Module() {
 
       val algoType = AlgorithmType.valueOf(o["algoType"] as String)
       val kpg = when (algoType) {
-        AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA_SECP256R1_SHA256(alias, reqAuth)
-        AlgorithmType.RSA_2048_PKCS1 -> buildRSA_2048_PKCS1(alias, reqAuth)
+        AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(alias, DIGEST_SHA256, reqAuth)
+        AlgorithmType.RSA_2048_PKCS1 -> buildRSA(alias, null, ENCRYPTION_PADDING_RSA_PKCS1, reqAuth)
+        AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(alias, DIGEST_SHA1, ENCRYPTION_PADDING_RSA_OAEP, reqAuth)
         else -> throw Exception("INVALID_ALGORITHM_TYPE")
       }
 
@@ -328,9 +368,14 @@ class DeviceCryptoModule : Module() {
 
       val algoType = AlgorithmType.valueOf(o["algoType"] as String)
       val algo = toAndroidAlgo(algoType)
+      val oaepSpec = getOaepSpec(algoType)
 
       val cipher = Cipher.getInstance(algo)
-      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+      if (oaepSpec != null) {
+        cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
+      } else {
+        cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+      }
       val encrypted: ByteArray = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
       promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
     }
@@ -352,19 +397,28 @@ class DeviceCryptoModule : Module() {
       val authMethod = o["authMethod"] as String
       val algoType = AlgorithmType.valueOf(o["algoType"] as String)
       val algo = toAndroidAlgo(algoType)
+      val oaepSpec = getOaepSpec(algoType)
 
       val cipher = Cipher.getInstance(algo)
       val ciphertext = Base64.decode(data, Base64.NO_WRAP)
 
       if (!reqAuth) {
-        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+        if (oaepSpec != null) {
+          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
+        } else {
+          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+        }
         val decrypted: ByteArray = cipher.doFinal(ciphertext)
         promise.resolve(String(decrypted, Charsets.UTF_8))
         return@AsyncFunction
       } else {
         showAuthPrompt(
           onSuccess = {
-            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+            if (oaepSpec != null) {
+              cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
+            } else {
+              cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+            }
             val decrypted: ByteArray = cipher.doFinal(ciphertext)
             promise.resolve(String(decrypted, Charsets.UTF_8))
           },

package/build/DeviceCrypto.types.d.ts

@@ -16,7 +16,8 @@ export declare enum SigningAlgorithm {
     ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
 }
 export declare enum EncryptionAlgorithm {
-    RSA_2048_PKCS1 = "RSA_2048_PKCS1"
+    RSA_2048_PKCS1 = "RSA_2048_PKCS1",
+    RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
 }
 export interface GenerateKeyPairOptions {
     /**

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}

package/build/DeviceCrypto.types.js

@@ -22,5 +22,6 @@ export var SigningAlgorithm;
 export var EncryptionAlgorithm;
 (function (EncryptionAlgorithm) {
     EncryptionAlgorithm["RSA_2048_PKCS1"] = "RSA_2048_PKCS1";
+    EncryptionAlgorithm["RSA_2048_OAEP_SHA1"] = "RSA_2048_OAEP_SHA1";
 })(EncryptionAlgorithm || (EncryptionAlgorithm = {}));
 //# sourceMappingURL=DeviceCrypto.types.js.map

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAED,MAAM,CAAN,IAAY,mBAEX;AAFD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;AACnC,CAAC,EAFW,mBAAmB,KAAnB,mBAAmB,QAE9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n}\n\nexport interface GenerateKeyPairOptions {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSignDecryptOptions {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSigningOptions {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType?: SigningAlgorithm;\n}\n\ninterface BaseEncryptionOptions {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType?: EncryptionAlgorithm;\n}\n\nexport interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}\nexport interface VerifyOptions extends BaseSigningOptions {}\n\nexport interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}\nexport interface EncryptOptions extends BaseEncryptionOptions {}\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAED,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n}\n\nexport interface GenerateKeyPairOptions {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSignDecryptOptions {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSigningOptions {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType?: SigningAlgorithm;\n}\n\ninterface BaseEncryptionOptions {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType?: EncryptionAlgorithm;\n}\n\nexport interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}\nexport interface VerifyOptions extends BaseSigningOptions {}\n\nexport interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}\nexport interface EncryptOptions extends BaseEncryptionOptions {}\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\";\n}\n"]}

package/build/DeviceCryptoModule.d.ts

@@ -46,8 +46,8 @@ declare const _default: {
     /**
      * Verifies the given data with the signature for the given alias.
      * @param alias - The alias to use for the key pair.
-     * @param data - The data to verify.
-     * @param signature - The signature to verify.
+     * @param data - The data to verify in UTF-8 format.
+     * @param signature - The signature to verify in Base64 format.
      * @param options - The options for the operation.
      * @default {
      *  algoType: SigningAlgorithm.ECDSA_SHA256,
@@ -82,5 +82,4 @@ declare const _default: {
     decrypt: (alias: string, data: string, options?: DecryptOptions) => Promise<string | null>;
 };
 export default _default;
-export type { GenerateKeyPairResult };
 //# sourceMappingURL=DeviceCryptoModule.d.ts.map

package/build/DeviceCryptoModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA6B5B;;;OAGG;gCAtBqB,eAAe;IAwBvC;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IAQvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAQ3D;;;;OAIG;2BApDkB,MAAM,KAAG,OAAO;IAsDrC;;;OAGG;mBAxDQ,MAAM,EAAE;IA0DnB;;;;;;;;;;;;OAYG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAS/D;;;;;;;;;;OAUG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAOzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAMrE;;;;;;;;;;;;OAYG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AArHvE,wBA8HE;AAEF,YAAY,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA6B5B;;;OAGG;gCAtBqB,eAAe;IAwBvC;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IAQvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAQ3D;;;;OAIG;2BApDkB,MAAM,KAAG,OAAO;IAsDrC;;;OAGG;mBAxDQ,MAAM,EAAE;IA0DnB;;;;;;;;;;;;OAYG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAS/D;;;;;;;;;;OAUG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAOzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAMrE;;;;;;;;;;;;OAYG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AArHvE,wBA8HE"}

package/build/DeviceCryptoModule.js

@@ -76,8 +76,8 @@ export default {
     /**
      * Verifies the given data with the signature for the given alias.
      * @param alias - The alias to use for the key pair.
-     * @param data - The data to verify.
-     * @param signature - The signature to verify.
+     * @param data - The data to verify in UTF-8 format.
+     * @param signature - The signature to verify in Base64 format.
      * @param options - The options for the operation.
      * @default {
      *  algoType: SigningAlgorithm.ECDSA_SHA256,

package/build/DeviceCryptoModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAmBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;;;;OAUG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    }\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify.\n   * @param signature - The signature to verify.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   * }\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.decrypt(alias, data, o);\n  },\n};\n\nexport type { GenerateKeyPairResult };\n"]}
+{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAmBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;;;;OAUG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    }\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   * }\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.decrypt(alias, data, o);\n  },\n};"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '0.1.0'
+  s.version        = '0.2.0'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -23,6 +23,7 @@ enum AuthMethod: String {
 enum AlgorithmType: String {
   case ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
   case RSA_2048_PKCS1 = "RSA_2048_PKCS1"
+  case RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
 }
 
 public class DeviceCryptoModule: Module {
@@ -32,6 +33,8 @@ public class DeviceCryptoModule: Module {
       return .ecdsaSignatureMessageX962SHA256
     case .RSA_2048_PKCS1:
       return .rsaEncryptionPKCS1
+    case .RSA_2048_OAEP_SHA1:
+      return .rsaEncryptionOAEPSHA1
     }
   }
 
@@ -186,7 +189,7 @@ public class DeviceCryptoModule: Module {
     return privateStatus == errSecSuccess || publicStatus == errSecSuccess
   }
 
-  private func buildECDSA_SECP256R1_SHA256(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildECDSA(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -224,7 +227,7 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
-  private func buildRSA_2048_PKCS1(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildRSA(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -289,9 +292,11 @@ public class DeviceCryptoModule: Module {
 
       switch algoType {
         case .ECDSA_SECP256R1_SHA256:
-          self.buildECDSA_SECP256R1_SHA256(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+          self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
         case .RSA_2048_PKCS1:
-          self.buildRSA_2048_PKCS1(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+          self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        case .RSA_2048_OAEP_SHA1:
+          self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
         default:
           throw NSError(
             domain: "DeviceCrypto",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",

package/src/DeviceCrypto.types.ts

@@ -21,6 +21,7 @@ export enum SigningAlgorithm {
 
 export enum EncryptionAlgorithm {
   RSA_2048_PKCS1 = "RSA_2048_PKCS1",
+  RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1",
 }
 
 export interface GenerateKeyPairOptions {

package/src/DeviceCryptoModule.ts

@@ -109,8 +109,8 @@ export default {
   /**
    * Verifies the given data with the signature for the given alias.
    * @param alias - The alias to use for the key pair.
-   * @param data - The data to verify.
-   * @param signature - The signature to verify.
+   * @param data - The data to verify in UTF-8 format.
+   * @param signature - The signature to verify in Base64 format.
    * @param options - The options for the operation.
    * @default { 
    *  algoType: SigningAlgorithm.ECDSA_SHA256, 
@@ -166,6 +166,4 @@ export default {
     };
     return module.decrypt(alias, data, o);
   },
-};
-
-export type { GenerateKeyPairResult };
+};