expo-device-crypto 0.1.0

package/ios/DeviceCrypto.swift

@@ -0,0 +1,404 @@
+import ExpoModulesCore
+import Security
+import Foundation
+import LocalAuthentication
+
+enum SecureSigningModuleResult: String {
+  case KEY_PAIR_GENERATED = "KEY_PAIR_GENERATED"
+  case KEY_PAIR_ALREADY_EXISTS = "KEY_PAIR_ALREADY_EXISTS"
+  case NOT_AVAILABLE = "NOT_AVAILABLE"
+}
+
+enum AuthCheckResult: String {
+  case AVAILABLE = "AVAILABLE"
+  case NO_HARDWARE = "NO_HARDWARE"
+  case UNAVAILABLE = "UNAVAILABLE"
+}
+
+enum AuthMethod: String {
+  case PASSCODE = "PASSCODE"
+  case PASSCODE_OR_BIOMETRIC = "PASSCODE_OR_BIOMETRIC"
+}
+
+enum AlgorithmType: String {
+  case ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
+  case RSA_2048_PKCS1 = "RSA_2048_PKCS1"
+}
+
+public class DeviceCryptoModule: Module {
+  private func toiOSAlgo(algorithm: AlgorithmType) -> SecKeyAlgorithm {
+    switch algorithm {
+    case .ECDSA_SECP256R1_SHA256:
+      return .ecdsaSignatureMessageX962SHA256
+    case .RSA_2048_PKCS1:
+      return .rsaEncryptionPKCS1
+    }
+  }
+
+  // Converts ANSI x962 EC point to P‑256 SPKI DER format
+  private func x962ECPointToP256SPKI(_ publicKey: SecKey) -> Data? {
+    var error: Unmanaged<CFError>?
+    guard let raw = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {
+      return nil
+    }
+
+    guard raw.count == 65 else { return nil }
+    let prefix = Data([
+      0x30, 0x59,
+      0x30, 0x13,
+      0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
+      0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
+      0x03, 0x42, 0x00
+    ])
+    return prefix + raw
+  }
+
+  // Converts PKCS#1 RSA public key bytes to SPKI DER format.
+  private func rsaPKCS1ToSPKI(_ publicKey: SecKey) -> Data? {
+    guard let pkcs1 = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
+      return nil
+    }
+
+    // rsaEncryption OID: 1.2.840.113549.1.1.1 with NULL params
+    let algorithmIdentifier = Data([
+      0x30, 0x0D,
+      0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01,
+      0x05, 0x00
+    ])
+
+    let bitStringPayload = Data([0x00]) + pkcs1
+    guard let bitString = asn1Wrap(tag: 0x03, content: bitStringPayload) else {
+      return nil
+    }
+
+    return asn1Wrap(tag: 0x30, content: algorithmIdentifier + bitString)
+  }
+
+  private func asn1Wrap(tag: UInt8, content: Data) -> Data? {
+    guard let length = asn1Length(content.count) else {
+      return nil
+    }
+    return Data([tag]) + length + content
+  }
+
+  private func asn1Length(_ length: Int) -> Data? {
+    if length < 0x80 {
+      return Data([UInt8(length)])
+    }
+
+    var value = length
+    var bytes: [UInt8] = []
+    while value > 0 {
+      bytes.insert(UInt8(value & 0xff), at: 0)
+      value >>= 8
+    }
+
+    guard bytes.count <= 4 else {
+      return nil
+    }
+
+    return Data([0x80 | UInt8(bytes.count)]) + Data(bytes)
+  }
+
+  private func isAuthCheckAvailable() -> String {
+    let context = LAContext()
+    let available = context.canEvaluatePolicy(.deviceOwnerAuthentication, error: nil)
+    if available {
+      return AuthCheckResult.AVAILABLE.rawValue
+    } else {
+      return AuthCheckResult.UNAVAILABLE.rawValue
+    }
+  }
+
+  private func getAliases() -> [String] {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassKey,
+      kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
+      kSecMatchLimit as String: kSecMatchLimitAll,
+      kSecReturnAttributes as String: true,
+    ]
+
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &result)
+    guard status == errSecSuccess else { return [] }
+
+    let items = (result as? [[String: Any]]) ?? []
+    return items.compactMap { attrs in
+      let tagKey = kSecAttrApplicationTag as String
+      if let tagString = attrs[tagKey] as? String {
+        return tagString
+      }
+      return nil
+    }
+  }
+
+  private func getSecKeyQuery(_ alias: String, keyClass: CFString, returnRef: Bool = true) -> [String: Any] {
+    var query: [String: Any] = [
+      kSecClass as String: kSecClassKey,
+      kSecAttrApplicationTag as String: alias,
+      kSecAttrKeyClass as String: keyClass,
+    ]
+    if returnRef {
+      query[kSecReturnRef as String] = true
+    }
+    return query
+  }
+
+  private func getSecKeyByAlias(_ alias: String, keyClass: CFString) -> SecKey? {
+    let query: [String: Any] = self.getSecKeyQuery(alias, keyClass: keyClass)
+    var item: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &item)
+    guard status == errSecSuccess else { return nil }
+    return (item as! SecKey)
+  }
+
+  private func retrievePublicKey(_ secKey: SecKey) -> String? {
+    let publicKey = SecKeyCopyPublicKey(secKey)!
+
+    guard
+      let attrs = SecKeyCopyAttributes(publicKey) as? [String: Any],
+      let keyType = attrs[kSecAttrKeyType as String] as? String
+    else {
+      return nil
+    }
+
+    if keyType == (kSecAttrKeyTypeECSECPrimeRandom as String) {
+      return x962ECPointToP256SPKI(publicKey)?.base64EncodedString()
+    }
+
+    if keyType == (kSecAttrKeyTypeRSA as String) {
+      return rsaPKCS1ToSPKI(publicKey)?.base64EncodedString()
+    }
+
+    guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
+      return nil
+    }
+    return publicKeyData.base64EncodedString()
+  }
+
+  private func removeKeyStoreEntry(_ alias: String) -> Bool {
+    let privateQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPrivate, returnRef: false)
+    let privateStatus = SecItemDelete(privateQuery as CFDictionary)
+
+    let publicQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPublic, returnRef: false)
+    let publicStatus = SecItemDelete(publicQuery as CFDictionary)
+
+    return privateStatus == errSecSuccess || publicStatus == errSecSuccess
+  }
+
+  private func buildECDSA_SECP256R1_SHA256(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+    let accessFlags: SecAccessControlCreateFlags
+    if reqAuth {
+      switch authMethod {
+        case .PASSCODE:
+          accessFlags = [.privateKeyUsage, .devicePasscode]
+        case .PASSCODE_OR_BIOMETRIC:
+          accessFlags = [.privateKeyUsage, .userPresence]
+      }
+    } else {
+      accessFlags = .privateKeyUsage
+    }
+
+    let access = SecAccessControlCreateWithFlags(
+      kCFAllocatorDefault,
+      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      accessFlags,
+      nil
+    ) 
+
+    let attributes: NSDictionary = [
+      kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+      kSecAttrKeySizeInBits: 256,
+      kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+      kSecPrivateKeyAttrs: [
+          kSecAttrIsPermanent: true,
+          kSecAttrApplicationTag: alias,
+          kSecAttrAccessControl: access
+      ],
+      kSecPublicKeyAttrs: [
+          kSecAttrIsPermanent: true,
+          kSecAttrApplicationTag: alias
+      ]
+    ]
+
+    return SecKeyCreateRandomKey(attributes, nil)
+  }
+
+  private func buildRSA_2048_PKCS1(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+    let accessFlags: SecAccessControlCreateFlags
+    if reqAuth {
+      switch authMethod {
+        case .PASSCODE:
+          accessFlags = [.devicePasscode]
+        case .PASSCODE_OR_BIOMETRIC:
+          accessFlags = [.userPresence]
+      }
+    } else {
+      accessFlags = []
+    }
+
+    let access = SecAccessControlCreateWithFlags(
+      kCFAllocatorDefault,
+      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      accessFlags,
+      nil
+    ) 
+
+    let attributes: NSDictionary = [
+      kSecAttrKeyType: kSecAttrKeyTypeRSA,
+      kSecAttrKeySizeInBits: 2048,
+      kSecPrivateKeyAttrs: [
+          kSecAttrIsPermanent: true,
+          kSecAttrApplicationTag: alias,
+          kSecAttrAccessControl: access
+      ],
+      kSecPublicKeyAttrs: [
+          kSecAttrIsPermanent: true,
+          kSecAttrApplicationTag: alias
+      ]
+    ]
+
+    return SecKeyCreateRandomKey(attributes, nil)
+  }
+
+  public func definition() -> ModuleDefinition {
+
+    Name("DeviceCrypto")
+
+    Function("isAuthCheckAvailable") { () -> String in
+      return self.isAuthCheckAvailable()
+    }
+
+    Function("generateKeyPair") { (alias: String, o: [String: Any]) -> String in
+      let reqAuth = o["reqAuth"] as! Bool
+      let authMethod = AuthMethod(rawValue: o["authMethod"] as! String)
+      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+
+      if reqAuth && self.isAuthCheckAvailable() != AuthCheckResult.AVAILABLE.rawValue {
+        throw NSError(
+          domain: "DeviceCrypto",
+          code: 1,
+          userInfo: [NSLocalizedDescriptionKey: "NO_AUTH_AVAILABLE"]
+        )
+      }
+
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+      if secKey != nil {
+        return SecureSigningModuleResult.KEY_PAIR_ALREADY_EXISTS.rawValue
+      }
+
+      switch algoType {
+        case .ECDSA_SECP256R1_SHA256:
+          self.buildECDSA_SECP256R1_SHA256(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        case .RSA_2048_PKCS1:
+          self.buildRSA_2048_PKCS1(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        default:
+          throw NSError(
+            domain: "DeviceCrypto",
+            code: 1,
+            userInfo: [NSLocalizedDescriptionKey: "INVALID_ALGORITHM_TYPE"]
+          )
+      }
+
+      return SecureSigningModuleResult.KEY_PAIR_GENERATED.rawValue
+    }
+
+    Function("removeKeyPair") { (alias: String) -> Bool in
+      return self.removeKeyStoreEntry(alias)
+    }
+
+    Function("aliases") { () -> [String] in
+      return self.getAliases()
+    }
+
+    Function("getPublicKey") { (alias: String) -> String? in
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
+      guard let secKey else { return nil }
+      return self.retrievePublicKey(secKey)
+    }
+
+    AsyncFunction("sign") { (alias: String, data: String, o: [String: Any]) -> String? in
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+      guard let secKey else { return nil }
+
+      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+      let algo = self.toiOSAlgo(algorithm: algoType!)
+
+      var signingError: Unmanaged<CFError>?
+      let signatureCF = SecKeyCreateSignature(
+        secKey,
+        algo,
+        Data(data.utf8) as CFData,
+        &signingError
+      )
+
+      if let error = signingError?.takeRetainedValue() {
+        throw error as Error
+      }
+
+      guard let signatureCF else { return nil }
+      let signature = signatureCF as Data
+      return signature.base64EncodedString()
+    }
+
+    Function("verify") { (alias: String, data: String, signature: String, o: [String: Any]) -> Bool? in
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+      guard let secKey else { return nil }
+
+      guard let publicKey = SecKeyCopyPublicKey(secKey) else { return nil }
+      guard let signatureData = Data(base64Encoded: signature) else { return nil }
+
+      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+      let algo = self.toiOSAlgo(algorithm: algoType!)
+
+      let valid = SecKeyVerifySignature(
+        publicKey,
+        algo,
+        Data(data.utf8) as CFData,
+        signatureData as CFData,
+        nil
+      )
+      return valid
+    }
+
+    AsyncFunction("encrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
+      guard let secKey else { return nil }
+      let publicKey = SecKeyCopyPublicKey(secKey)!
+
+      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+      let algo = self.toiOSAlgo(algorithm: algoType!)
+
+      guard let encrypted = SecKeyCreateEncryptedData(
+        publicKey,
+        algo,
+        Data(data.utf8) as CFData,
+        nil
+      ) as Data? else {
+        return nil
+      }
+
+      return encrypted.base64EncodedString()
+    }
+
+    AsyncFunction("decrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+      guard let secKey else { return nil }
+      guard let encryptedData = Data(base64Encoded: data) else { return nil }
+
+      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+      let algo = self.toiOSAlgo(algorithm: algoType!)
+
+      guard let decrypted = SecKeyCreateDecryptedData(
+        secKey,
+        algo,
+        encryptedData as CFData,
+        nil
+      ) as Data? else {
+        return nil
+      }
+
+      return String(data: decrypted, encoding: .utf8)
+    }
+  }
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "expo-device-crypto",
+  "version": "0.1.0",
+  "description": "Crypto for Expo using device hardware capabilities",
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "scripts": {
+    "build": "expo-module build",
+    "clean": "expo-module clean",
+    "lint": "expo-module lint",
+    "test": "expo-module test",
+    "prepare": "expo-module prepare",
+    "prepublishOnly": "expo-module prepublishOnly",
+    "expo-module": "expo-module",
+    "open:ios": "xed example/ios",
+    "open:android": "open -a \"Android Studio\" example/android"
+  },
+  "keywords": [
+    "expo",
+    "expo-module",
+    "react-native",
+    "native-module",
+    "crypto",
+    "cryptography",
+    "device-crypto",
+    "hardware-backed",
+    "secure-enclave",
+    "android-keystore",
+    "ios-keychain",
+    "key-management",
+    "secure-key-storage",
+    "digital-signature",
+    "ecdsa",
+    "secp256r1",
+    "rsa",
+    "rsa-pkcs1"
+  ],
+  "repository": "https://github.com/piotr-pietras/expo-device-crypto",
+  "bugs": {
+    "url": "https://github.com/piotr-pietras/expo-device-crypto/issues"
+  },
+  "author": "Piotr <pietraspiotr94@gmail.com> (https://github.com/piotr-pietras)",
+  "license": "MIT",
+  "homepage": "https://github.com/piotr-pietras/expo-device-crypto#readme",
+  "dependencies": {},
+  "devDependencies": {
+    "expo-module-scripts": "55.0.2"
+  },
+  "overrides": {
+    "@react-native/dev-middleware": "0.84.1"
+  },
+  "peerDependencies": {
+    "expo": "*"
+  }
+}

package/src/DeviceCrypto.types.ts

@@ -0,0 +1,106 @@
+export enum GenerateKeyPairResult {
+  KEY_PAIR_GENERATED = "KEY_PAIR_GENERATED",
+  KEY_PAIR_ALREADY_EXISTS = "KEY_PAIR_ALREADY_EXISTS",
+  NOT_AVAILABLE = "NOT_AVAILABLE",
+}
+
+export enum AuthCheckResult {
+  AVAILABLE = "AVAILABLE",
+  NO_HARDWARE = "NO_HARDWARE",
+  UNAVAILABLE = "UNAVAILABLE",
+}
+
+export enum AuthMethod {
+  PASSCODE = "PASSCODE",
+  PASSCODE_OR_BIOMETRIC = "PASSCODE_OR_BIOMETRIC",
+}
+
+export enum SigningAlgorithm {
+  ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
+}
+
+export enum EncryptionAlgorithm {
+  RSA_2048_PKCS1 = "RSA_2048_PKCS1",
+}
+
+export interface GenerateKeyPairOptions {
+  /**
+   * The algorithm type of the key to generate.
+   */
+  algorithmType: SigningAlgorithm | EncryptionAlgorithm;
+  /**
+   * Whether to require authentication to sign.
+   * Setting this to true will prompt biometric or passcode authentication before signing.
+   *
+   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.
+   * If authentication is not available, generating a key pair will throw an error.
+   * @default false
+   */
+  requireAuthentication?: boolean;
+  /**
+   * The method of authentication to use.
+   * Note that on Android you have to define it when signing.
+   *
+   * If you want to allow to use Face ID, you need to add the following to your app.json config file:
+   * ```json
+   * "ios": {
+   *   "infoPlist": {
+   *     "NSFaceIDUsageDescription": "We use Face ID to secure your data.",
+   *   }
+   * }
+   * ```
+   * @default AuthMethod.PASSCODE_OR_BIOMETRIC
+   * @platform ios
+   */
+  authMethod?: AuthMethod;
+}
+
+interface BaseSignDecryptOptions {
+  /**
+   * The title of the prompt to show when authentication is required.
+   * @default "Unlock"
+   * @platform android
+   */
+  promptTitle?: string;
+  /**
+   * The subtitle of the prompt to show when authentication is required.
+   * @default "Enter your PIN to continue"
+   * @platform android
+   */
+  promptSubtitle?: string;
+  /**
+   * The method of authentication to use.
+   * Note that on iOS you have to define it when generating the key pair.
+   * @default AuthMethod.PASSCODE_OR_BIOMETRIC
+   * @platform android
+   */
+  authMethod?: AuthMethod;
+}
+
+interface BaseSigningOptions {
+  /**
+   * The algorithm type of the key to use for signing.
+   */
+  algorithmType?: SigningAlgorithm;
+}
+
+interface BaseEncryptionOptions {
+  /**
+   * The algorithm type of the key to use for encrypting.
+   */
+  algorithmType?: EncryptionAlgorithm;
+}
+
+export interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}
+export interface VerifyOptions extends BaseSigningOptions {}
+
+export interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}
+export interface EncryptOptions extends BaseEncryptionOptions {}
+
+export interface GetPublicKeyOptions {
+  /**
+   * The format of the public key to return.
+   * @default "PEM" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)
+   */
+  format?: "PEM";
+}