expo-device-crypto 0.2.0 → 0.2.2

package/README.md

@@ -2,7 +2,7 @@
 
 > ⚠️ This module is currently in beta and is not suitable for production use.
 
-🔒 Hardware-backed cryptography for Expo apps using [Android Keystore](https://developer.android.com/privacy-and-security/keystore) and Apple [Secure Enclave](https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave).
+🔒 Hardware-backed cryptography for Expo apps using [Android Keystore](https://developer.android.com/privacy-and-security/keystore)/[Strong Box](https://developer.android.com/privacy-and-security/keystore#StrongBoxKeyMint) and Apple [Secure Enclave](https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave)/[Keychain](https://developer.apple.com/documentation/security/keychain-services).
 
 ## Installation
 
@@ -48,7 +48,7 @@ If you want to allow Face ID on iOS, add this to your app config:
 **Padding:** OAEP with SHA-1 and MGF1. </br>
 **Use it for:** Encrypting small secrets with stronger padding than PKCS#1 v1.5 when interoperating with OAEP SHA-1 systems.
 
-More coming soon 
+**More coming soon...**
 
 ## Example: ECDSA with Biometric
 
@@ -176,4 +176,35 @@ const decrypted = await DeviceCrypto.decrypt(alias, encrypted ?? "", {
   - Decrypts Base64 `data` with private key.
   - Defaults: `algorithmType = RSA_2048_PKCS1`, `promptTitle = "Unlock"`, `promptSubtitle = "Enter your PIN to continue"`, `authMethod = PASSCODE_OR_BIOMETRIC`.
 
-> ✅ JSDoc type definitions are available in `./src/DeviceCryptoModule.ts`.
+**Android only methods**
+
+- `isStrongBoxAvailable(): boolean`
+  - Returns `true` if StrongBox Keystore is supported on the device.
+
+> ✅ JSDoc type definitions are available in `./src/DeviceCryptoModule.ts`.
+
+## Important
+
+### Enable Strong Box on Android
+
+Use `preferStrongBox: true` when generating a key pair to request [StrongBox-backed](https://developer.android.com/privacy-and-security/keystore#StrongBoxKeyMint) key storage when the device supports it.
+
+```ts
+import DeviceCrypto, { SigningAlgorithm } from "expo-device-crypto";
+
+const alias = "user-signing-key";
+
+// Optional: check availability first.
+const hasStrongBox = DeviceCrypto.isStrongBoxAvailable();
+
+await DeviceCrypto.generateKeyPair(alias, {
+  algorithmType: SigningAlgorithm.ECDSA_SECP256R1_SHA256,
+  preferStrongBox: true,
+});
+```
+
+If StrongBox is not available, Android falls back to the Trusted Execution Environment (TEE).
+
+### RSA algorithms on iOS
+
+Please note that RSA private-key operations are not performed in the [Secure Enclave processor](https://developer.apple.com/documentation/security/ksecattrtokenidsecureenclave?utm_source=chatgpt.com#Discussion). Instead, they are software-backed and handled by Apple’s system cryptographic services, which still provide strong isolation and protection.

package/android/build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'com.android.library'
 
 group = 'expo.modules.devicecrypto'
-version = '0.2.0'
+version = '0.2.2'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 apply from: expoModulesCorePlugin
@@ -35,7 +35,7 @@ android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "0.2.0"
+    versionName "0.2.2"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -81,21 +81,11 @@ class DeviceCryptoModule : Module() {
     }
   }
 
-  private fun isAuthCheckAvailable(): AuthCheckResult {
-    val biometricManager = BiometricManager.from(appContext.reactContext as Context)
-    return when (biometricManager.canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)) {
-      BiometricManager.BIOMETRIC_SUCCESS -> AuthCheckResult.AVAILABLE
-      BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> AuthCheckResult.NO_HARDWARE
-      BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> AuthCheckResult.UNAVAILABLE
-      else -> AuthCheckResult.UNAVAILABLE
-    }
-  }
-
   private fun isKeyStoreAvailable(): Boolean {
     val pm = appContext.reactContext?.packageManager ?: return false
     val appAttestKeystore = pm.hasSystemFeature(PackageManager.FEATURE_KEYSTORE_APP_ATTEST_KEY)
     val hardwareKeystore = pm.hasSystemFeature(PackageManager.FEATURE_HARDWARE_KEYSTORE)
-    return appAttestKeystore && hardwareKeystore
+    return appAttestKeystore || hardwareKeystore
   }
 
   private fun isStrongBoxAvailable(): Boolean {
@@ -104,10 +94,6 @@ class DeviceCryptoModule : Module() {
     return strongboxKeystore
   }
 
-  private fun getAliases() = KeyStore.getInstance("AndroidKeyStore").apply {
-    load(null)
-  }.aliases().toList()
-
   private fun isKeyStoreRequireAuthentication(entry: KeyStore.PrivateKeyEntry): Boolean {
     val keyFactory = KeyFactory.getInstance(entry.privateKey.algorithm, "AndroidKeyStore")
     val keyInfo = keyFactory.getKeySpec(entry.privateKey, KeyInfo::class.java)
@@ -120,27 +106,11 @@ class DeviceCryptoModule : Module() {
     }.getEntry(alias, null)
   }
 
-  private fun retrievePublicKey(ks: KeyStore.Entry?): String? {
-    if (ks !is KeyStore.PrivateKeyEntry) return null
-    
-    val publicKeyBytes: ByteArray = ks.certificate?.publicKey?.encoded ?: return null
-    return Base64.encodeToString(publicKeyBytes, Base64.NO_WRAP)
-  }
-
-  private fun removeKeyStoreEntry(alias: String): Boolean {
-    val ks = KeyStore.getInstance("AndroidKeyStore").apply {
-      load(null)
-    }
-    if (ks.getEntry(alias, null) == null) return false
-
-    ks.deleteEntry(alias)
-    return true
-  }
-
   private fun buildECDSA(
     alias: String, 
     digest: String,
-    reqAuth: Boolean): KeyPairGenerator {
+    reqAuth: Boolean,
+    strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
       KEY_ALGORITHM_EC,
       "AndroidKeyStore"
@@ -151,7 +121,7 @@ class DeviceCryptoModule : Module() {
       PURPOSE_SIGN or PURPOSE_VERIFY
     ).run {
       setDigests(digest)
-      setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
+      setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
         setUserAuthenticationParameters(
@@ -169,7 +139,8 @@ class DeviceCryptoModule : Module() {
     alias: String, 
     digest: String?,
     padding: String,
-    reqAuth: Boolean): KeyPairGenerator {
+    reqAuth: Boolean,
+    strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
       KEY_ALGORITHM_RSA,
       "AndroidKeyStore"
@@ -183,7 +154,7 @@ class DeviceCryptoModule : Module() {
         setDigests(digest)
       }
       setEncryptionPaddings(padding)
-      setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
+      setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
         setUserAuthenticationParameters(
@@ -249,191 +220,236 @@ class DeviceCryptoModule : Module() {
     }
   }
 
-  override fun definition() = ModuleDefinition {
-    Name("DeviceCrypto")
+  private fun isAuthCheckAvailable(): AuthCheckResult {
+    val biometricManager = BiometricManager.from(appContext.reactContext as Context)
+    return when (biometricManager.canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)) {
+      BiometricManager.BIOMETRIC_SUCCESS -> AuthCheckResult.AVAILABLE
+      BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> AuthCheckResult.NO_HARDWARE
+      BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> AuthCheckResult.UNAVAILABLE
+      else -> AuthCheckResult.UNAVAILABLE
+    }
+  }
 
-    Function("isAuthCheckAvailable") { ->
-      return@Function isAuthCheckAvailable()
+  private fun generateKeyPair(alias: String, o: Map<String, Any?>): GenerateKeyPairResult {
+    val reqAuth = o["reqAuth"] as Boolean
+    if (reqAuth && isAuthCheckAvailable() != AuthCheckResult.AVAILABLE) {
+      throw Exception("NO_AUTH_AVAILABLE")
+    }
+    if (!isKeyStoreAvailable()) {
+      return GenerateKeyPairResult.NOT_AVAILABLE
+    }
+    if (getKeyStoreEntry(alias) != null) {
+      return GenerateKeyPairResult.KEY_PAIR_ALREADY_EXISTS
     }
 
-    Function("generateKeyPair") { alias: String, o: Map<String, Any?> ->
-      val reqAuth = o["reqAuth"] as Boolean
-      if (reqAuth && isAuthCheckAvailable() != AuthCheckResult.AVAILABLE) {
-        throw Exception("NO_AUTH_AVAILABLE")
-      }
-      if (!isKeyStoreAvailable()) {
-        return@Function GenerateKeyPairResult.NOT_AVAILABLE
-      }
-      if (getKeyStoreEntry(alias) != null) {
-        return@Function GenerateKeyPairResult.KEY_PAIR_ALREADY_EXISTS
-      }
+    val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+    val preferStrongBox = o["preferStrongBox"] as Boolean
+    val strongBox = preferStrongBox && isStrongBoxAvailable()
 
-      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
-      val kpg = when (algoType) {
-        AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(alias, DIGEST_SHA256, reqAuth)
-        AlgorithmType.RSA_2048_PKCS1 -> buildRSA(alias, null, ENCRYPTION_PADDING_RSA_PKCS1, reqAuth)
-        AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(alias, DIGEST_SHA1, ENCRYPTION_PADDING_RSA_OAEP, reqAuth)
-        else -> throw Exception("INVALID_ALGORITHM_TYPE")
-      }
+    val kpg = when (algoType) {
+      AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(alias, DIGEST_SHA256, reqAuth, strongBox)
+      AlgorithmType.RSA_2048_PKCS1 -> buildRSA(alias, null, ENCRYPTION_PADDING_RSA_PKCS1, reqAuth, strongBox)
+      AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(alias, DIGEST_SHA1, ENCRYPTION_PADDING_RSA_OAEP, reqAuth, strongBox)
+      else -> throw Exception("INVALID_ALGORITHM_TYPE")
+    }
+
+    kpg.generateKeyPair()
 
-      kpg.generateKeyPair()
+    return GenerateKeyPairResult.KEY_PAIR_GENERATED
+  }
 
-      return@Function GenerateKeyPairResult.KEY_PAIR_GENERATED
+  private fun removeKeyStoreEntry(alias: String): Boolean {
+    val ks = KeyStore.getInstance("AndroidKeyStore").apply {
+      load(null)
     }
+    if (ks.getEntry(alias, null) == null) return false
 
-    Function("removeKeyPair") { alias: String ->
-      return@Function removeKeyStoreEntry(alias)
+    ks.deleteEntry(alias)
+    return true
+  }
+
+  private fun getAliases() = KeyStore.getInstance("AndroidKeyStore").apply {
+    load(null)
+  }.aliases().toList()
+
+  private fun getPublicKey(alias: String): String? {
+    val ks = getKeyStoreEntry(alias)
+    if (ks !is KeyStore.PrivateKeyEntry) return null
+    
+    val publicKeyBytes: ByteArray = ks.certificate?.publicKey?.encoded ?: return null
+    return Base64.encodeToString(publicKeyBytes, Base64.NO_WRAP)
+  }
+
+  private fun sign(alias: String, data: String, o: Map<String, Any?>, promise: Promise) {
+    val entry = getKeyStoreEntry(alias)
+    if (entry !is KeyStore.PrivateKeyEntry) {
+      promise.resolve(null)
+      return
     }
 
-    Function("aliases") {
-      return@Function getAliases()
+    val reqAuth = isKeyStoreRequireAuthentication(entry)
+
+    val title = o["title"] as String
+    val subtitle = o["subtitle"] as String
+    val authMethod = AuthMethod.valueOf(o["authMethod"] as String)
+    val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+    val algo = toAndroidAlgo(algoType)
+
+    if (!reqAuth) {
+      val signature: ByteArray = Signature.getInstance(algo).apply {
+        initSign(entry.privateKey)
+        update(data.toByteArray(Charsets.UTF_8))
+      }.sign()
+      promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+      return
+    } else {
+      showAuthPrompt(
+        onSuccess = {
+          val signature: ByteArray = Signature.getInstance(algo).apply {
+            initSign(entry.privateKey)
+            update(data.toByteArray(Charsets.UTF_8))
+          }.sign()
+          promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+        },
+        onError = { error ->
+          promise.reject("ERR_AUTH_FAILED", error, null)
+        },
+        title = title,
+        subtitle = subtitle,
+        authMethod = authMethod
+      )
     }
+  }
 
-    Function("getPublicKey") { alias: String ->
-      val entry = getKeyStoreEntry(alias)
-      return@Function retrievePublicKey(entry)
+  private fun verify(alias: String, data: String, signature: String, o: Map<String, Any?>): Boolean? {
+    val entry = getKeyStoreEntry(alias)
+    if (entry !is KeyStore.PrivateKeyEntry) return null
+
+    val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+    val algo = toAndroidAlgo(algoType)
+
+    val valid: Boolean = Signature.getInstance(algo).apply {
+      initVerify(entry.certificate)
+      update(data.toByteArray(Charsets.UTF_8))
+    }.verify(Base64.decode(signature, Base64.NO_WRAP))
+    return valid
+  }
+
+  private fun encrypt(alias: String, data: String, o: Map<String, Any?>, promise: Promise) {
+    val entry = getKeyStoreEntry(alias)
+    if (entry !is KeyStore.PrivateKeyEntry) {
+      promise.resolve(null)
+      return
     }
 
-    AsyncFunction("sign") { alias: String,
-      data: String,
-      o:  Map<String, Any?>,
-      promise: Promise ->
-      val entry = getKeyStoreEntry(alias)
-      if (entry !is KeyStore.PrivateKeyEntry) {
-        promise.resolve(null)
-        return@AsyncFunction
-      }
+    val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+    val algo = toAndroidAlgo(algoType)
+    val oaepSpec = getOaepSpec(algoType)
 
-      val reqAuth = isKeyStoreRequireAuthentication(entry);
-
-      val title = o["title"] as String
-      val subtitle = o["subtitle"] as String
-      val authMethod = AuthMethod.valueOf(o["authMethod"] as String)
-      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
-      val algo = toAndroidAlgo(algoType)
-
-      if (!reqAuth) {
-        val signature: ByteArray = Signature.getInstance(algo).apply {
-          initSign(entry.privateKey)
-          update(data.toByteArray(Charsets.UTF_8))
-        }.sign()
-        promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
-        return@AsyncFunction
-      } else {
-        showAuthPrompt(
-          onSuccess = {
-            val signature: ByteArray = Signature.getInstance(algo).apply {
-              initSign(entry.privateKey)
-              update(data.toByteArray(Charsets.UTF_8))
-            }.sign()
-            promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
-          },
-          onError = { error ->
-            promise.reject("ERR_AUTH_FAILED", error, null)
-          },
-          title = title,
-          subtitle = subtitle,
-          authMethod = authMethod
-        )
-      }
+    val cipher = Cipher.getInstance(algo)
+    if (oaepSpec != null) {
+      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
+    } else {
+      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
     }
+    val encrypted: ByteArray = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
+    promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+  }
 
-    Function("verify") { alias: String, 
-      data: String, 
-      signature: String, 
-      o: Map<String, Any?> ->
-      val entry = getKeyStoreEntry(alias)
-      if (entry !is KeyStore.PrivateKeyEntry) return@Function null
-
-      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
-      val algo = toAndroidAlgo(algoType)
-      
-      val valid: Boolean = Signature.getInstance(algo).apply {
-        initVerify(entry.certificate)
-        update(data.toByteArray(Charsets.UTF_8))
-      }.verify(Base64.decode(signature, Base64.NO_WRAP))
-      return@Function true
+  private fun decrypt(alias: String, data: String, o: Map<String, Any?>, promise: Promise) {
+    val entry = getKeyStoreEntry(alias)
+    if (entry !is KeyStore.PrivateKeyEntry) {
+      promise.resolve(null)
+      return
     }
 
+    val reqAuth = isKeyStoreRequireAuthentication(entry)
 
-    AsyncFunction("encrypt") { alias: String, 
-      data: String, 
-      o: Map<String, Any?>,
-      promise: Promise ->
-      val entry = getKeyStoreEntry(alias)
-      if (entry !is KeyStore.PrivateKeyEntry) {
-        promise.resolve(null)
-        return@AsyncFunction
-      }
+    val title = o["title"] as String
+    val subtitle = o["subtitle"] as String
+    val authMethod = o["authMethod"] as String
+    val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+    val algo = toAndroidAlgo(algoType)
+    val oaepSpec = getOaepSpec(algoType)
 
-      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
-      val algo = toAndroidAlgo(algoType)
-      val oaepSpec = getOaepSpec(algoType)
+    val cipher = Cipher.getInstance(algo)
+    val ciphertext = Base64.decode(data, Base64.NO_WRAP)
 
-      val cipher = Cipher.getInstance(algo)
+    if (!reqAuth) {
       if (oaepSpec != null) {
-        cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
+        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
       } else {
-        cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
       }
-      val encrypted: ByteArray = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
-      promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+      val decrypted: ByteArray = cipher.doFinal(ciphertext)
+      promise.resolve(String(decrypted, Charsets.UTF_8))
+      return
+    } else {
+      showAuthPrompt(
+        onSuccess = {
+          if (oaepSpec != null) {
+            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
+          } else {
+            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+          }
+          val decrypted: ByteArray = cipher.doFinal(ciphertext)
+          promise.resolve(String(decrypted, Charsets.UTF_8))
+        },
+        onError = { error ->
+          promise.reject("ERR_AUTH_FAILED", error, null)
+        },
+        title = title,
+        subtitle = subtitle,
+        authMethod = when (authMethod) {
+          "PASSCODE" -> AuthMethod.PASSCODE
+          "PASSCODE_OR_BIOMETRIC" -> AuthMethod.PASSCODE_OR_BIOMETRIC
+          else -> AuthMethod.PASSCODE_OR_BIOMETRIC
+        }
+      )
     }
+  }
 
-    AsyncFunction("decrypt") { alias: String, 
-      data: String, 
-      o: Map<String, Any?>, 
-      promise: Promise ->
-      val entry = getKeyStoreEntry(alias)
-      if (entry !is KeyStore.PrivateKeyEntry) {
-        promise.resolve(null)
-        return@AsyncFunction
-      }
+  override fun definition() = ModuleDefinition {
+    Name("DeviceCrypto")
 
-      val reqAuth = isKeyStoreRequireAuthentication(entry)
+    Function("isAuthCheckAvailable") { ->
+      return@Function isAuthCheckAvailable()
+    }
 
-      val title = o["title"] as String
-      val subtitle = o["subtitle"] as String
-      val authMethod = o["authMethod"] as String
-      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
-      val algo = toAndroidAlgo(algoType)
-      val oaepSpec = getOaepSpec(algoType)
+    Function("isStrongBoxAvailable") { ->
+      return@Function isStrongBoxAvailable()
+    }
 
-      val cipher = Cipher.getInstance(algo)
-      val ciphertext = Base64.decode(data, Base64.NO_WRAP)
+    Function("generateKeyPair") { alias: String, o: Map<String, Any?> ->
+      return@Function generateKeyPair(alias, o)
+    }
 
-      if (!reqAuth) {
-        if (oaepSpec != null) {
-          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
-        } else {
-          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
-        }
-        val decrypted: ByteArray = cipher.doFinal(ciphertext)
-        promise.resolve(String(decrypted, Charsets.UTF_8))
-        return@AsyncFunction
-      } else {
-        showAuthPrompt(
-          onSuccess = {
-            if (oaepSpec != null) {
-              cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
-            } else {
-              cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
-            }
-            val decrypted: ByteArray = cipher.doFinal(ciphertext)
-            promise.resolve(String(decrypted, Charsets.UTF_8))
-          },
-          onError = { error ->
-            promise.reject("ERR_AUTH_FAILED", error, null)
-          },
-          title = title,
-          subtitle = subtitle,
-          authMethod = when (authMethod) {
-            "PASSCODE" -> AuthMethod.PASSCODE
-            "PASSCODE_OR_BIOMETRIC" -> AuthMethod.PASSCODE_OR_BIOMETRIC
-            else -> AuthMethod.PASSCODE_OR_BIOMETRIC
-          }
-        )
-      }
+    Function("removeKeyPair") { alias: String ->
+      return@Function removeKeyStoreEntry(alias)
+    }
+
+    Function("aliases") {
+      return@Function getAliases()
+    }
+
+    Function("getPublicKey") { alias: String ->
+      return@Function getPublicKey(alias)
+    }
+
+    AsyncFunction("sign") { alias: String, data: String, o: Map<String, Any?>, promise: Promise ->
+      return@AsyncFunction sign(alias, data, o, promise)
+    }
+
+    Function("verify") { alias: String, data: String, signature: String, o: Map<String, Any?> ->
+      return@Function verify(alias, data, signature, o)
+    }
+
+    AsyncFunction("encrypt") { alias: String, data: String, o: Map<String, Any?>, promise: Promise ->
+      return@AsyncFunction encrypt(alias, data, o, promise)
+    }
+
+    AsyncFunction("decrypt") { alias: String, data: String, o: Map<String, Any?>, promise: Promise ->
+      return@AsyncFunction decrypt(alias, data, o, promise)
     }
   }
 }

package/build/DeviceCrypto.types.d.ts

@@ -46,28 +46,34 @@ export interface GenerateKeyPairOptions {
      * }
      * ```
      * @default AuthMethod.PASSCODE_OR_BIOMETRIC
-     * @platform ios
+     * @platform ios 🍏
      */
     authMethod?: AuthMethod;
+    /**
+     * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).
+     * @default false
+     * @platform android 🤖
+     */
+    preferStrongBox?: boolean;
 }
 interface BaseSignDecryptOptions {
     /**
      * The title of the prompt to show when authentication is required.
      * @default "Unlock"
-     * @platform android
+     * @platform android 🤖
      */
     promptTitle?: string;
     /**
      * The subtitle of the prompt to show when authentication is required.
      * @default "Enter your PIN to continue"
-     * @platform android
+     * @platform android 🤖
      */
     promptSubtitle?: string;
     /**
      * The method of authentication to use.
      * Note that on iOS you have to define it when generating the key pair.
      * @default AuthMethod.PASSCODE_OR_BIOMETRIC
-     * @platform android
+     * @platform android 🤖
      */
     authMethod?: AuthMethod;
 }

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAED,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n}\n\nexport interface GenerateKeyPairOptions {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSignDecryptOptions {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSigningOptions {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType?: SigningAlgorithm;\n}\n\ninterface BaseEncryptionOptions {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType?: EncryptionAlgorithm;\n}\n\nexport interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}\nexport interface VerifyOptions extends BaseSigningOptions {}\n\nexport interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}\nexport interface EncryptOptions extends BaseEncryptionOptions {}\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAED,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n}\n\nexport interface GenerateKeyPairOptions {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ninterface BaseSignDecryptOptions {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSigningOptions {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType?: SigningAlgorithm;\n}\n\ninterface BaseEncryptionOptions {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType?: EncryptionAlgorithm;\n}\n\nexport interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}\nexport interface VerifyOptions extends BaseSigningOptions {}\n\nexport interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}\nexport interface EncryptOptions extends BaseEncryptionOptions {}\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\";\n}\n"]}

package/build/DeviceCryptoModule.d.ts

@@ -5,6 +5,12 @@ declare const _default: {
      * @returns The result of the operation.
      */
     isAuthCheckAvailable: () => AuthCheckResult;
+    /**
+     * Checks if the strong box is available .
+     * @returns The result of the operation.
+     * @platform android 🤖
+     */
+    isStrongBoxAvailable: () => boolean;
     /**
      * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.
      * @param alias - The alias to use for the key pair.
@@ -34,12 +40,6 @@ declare const _default: {
      * @param alias - The alias to use for the key pair.
      * @param data - The data to sign.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: SigningAlgorithm.ECDSA_SHA256,
-     *  promptTitle: "Unlock",
-     *  promptSubtitle: "Enter your PIN to continue",
-     *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC
-     * }
      * @returns The signature.
      */
     sign: (alias: string, data: string, options?: SignOptions) => Promise<string | null>;
@@ -49,9 +49,6 @@ declare const _default: {
      * @param data - The data to verify in UTF-8 format.
      * @param signature - The signature to verify in Base64 format.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: SigningAlgorithm.ECDSA_SHA256,
-     * }
      * @returns True if the signature is valid, false otherwise.
      */
     verify: (alias: string, data: string, signature: string, options?: VerifyOptions) => Promise<boolean | null>;
@@ -71,12 +68,6 @@ declare const _default: {
      * @param alias - The alias to use for the key pair.
      * @param data - The data to decrypt in Base64 format.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,
-     *  promptTitle: "Unlock",
-     *  promptSubtitle: "Enter your PIN to continue",
-     *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC
-     * }
      * @returns The decrypted data.
      */
     decrypt: (alias: string, data: string, options?: DecryptOptions) => Promise<string | null>;

package/build/DeviceCryptoModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA6B5B;;;OAGG;gCAtBqB,eAAe;IAwBvC;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IAQvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAQ3D;;;;OAIG;2BApDkB,MAAM,KAAG,OAAO;IAsDrC;;;OAGG;mBAxDQ,MAAM,EAAE;IA0DnB;;;;;;;;;;;;OAYG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAS/D;;;;;;;;;;OAUG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAOzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAMrE;;;;;;;;;;;;OAYG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AArHvE,wBA8HE"}
+{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA8B5B;;;OAGG;gCAvBqB,eAAe;IAyBvC;;;;OAIG;gCA5BqB,OAAO;IA8B/B;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IASvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAQ3D;;;;OAIG;2BA3DkB,MAAM,KAAG,OAAO;IA6DrC;;;OAGG;mBA/DQ,MAAM,EAAE;IAiEnB;;;;;;OAMG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAS/D;;;;;;;OAOG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAOzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAMrE;;;;;;OAMG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AA7GvE,wBAsHE"}

package/build/DeviceCryptoModule.js

@@ -12,6 +12,12 @@ export default {
      * @returns The result of the operation.
      */
     isAuthCheckAvailable: module.isAuthCheckAvailable,
+    /**
+     * Checks if the strong box is available .
+     * @returns The result of the operation.
+     * @platform android 🤖
+     */
+    isStrongBoxAvailable: module.isStrongBoxAvailable,
     /**
      * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.
      * @param alias - The alias to use for the key pair.
@@ -22,6 +28,7 @@ export default {
             algoType: options?.algorithmType,
             reqAuth: options?.requireAuthentication ?? false,
             authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
+            preferStrongBox: options?.preferStrongBox ?? false,
         };
         return module.generateKeyPair(alias, o);
     },
@@ -56,12 +63,6 @@ export default {
      * @param alias - The alias to use for the key pair.
      * @param data - The data to sign.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: SigningAlgorithm.ECDSA_SHA256,
-     *  promptTitle: "Unlock",
-     *  promptSubtitle: "Enter your PIN to continue",
-     *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC
-     * }
      * @returns The signature.
      */
     sign: async (alias, data, options) => {
@@ -79,9 +80,6 @@ export default {
      * @param data - The data to verify in UTF-8 format.
      * @param signature - The signature to verify in Base64 format.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: SigningAlgorithm.ECDSA_SHA256,
-     * }
      * @returns True if the signature is valid, false otherwise.
      */
     verify: async (alias, data, signature, options) => {
@@ -111,12 +109,6 @@ export default {
      * @param alias - The alias to use for the key pair.
      * @param data - The data to decrypt in Base64 format.
      * @param options - The options for the operation.
-     * @default {
-     *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,
-     *  promptTitle: "Unlock",
-     *  promptSubtitle: "Enter your PIN to continue",
-     *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC
-     * }
      * @returns The decrypted data.
      */
     decrypt: async (alias, data, options) => {

package/build/DeviceCryptoModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAmBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;;;;OAUG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    }\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: SigningAlgorithm.ECDSA_SHA256, \n   * }\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   *  promptTitle: \"Unlock\", \n   *  promptSubtitle: \"Enter your PIN to continue\", \n   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC \n   * }\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.decrypt(alias, data, o);\n  },\n};"]}
+{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAoBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK;SACnD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;OAMG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;OAOG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  isStrongBoxAvailable(): boolean;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Checks if the strong box is available .\n   * @returns The result of the operation.\n   * @platform android 🤖\n   */\n  isStrongBoxAvailable: module.isStrongBoxAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      preferStrongBox: options?.preferStrongBox ?? false,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    }\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.decrypt(alias, data, o);\n  },\n};"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '0.2.0'
+  s.version        = '0.2.2'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -103,38 +103,6 @@ public class DeviceCryptoModule: Module {
     return Data([0x80 | UInt8(bytes.count)]) + Data(bytes)
   }
 
-  private func isAuthCheckAvailable() -> String {
-    let context = LAContext()
-    let available = context.canEvaluatePolicy(.deviceOwnerAuthentication, error: nil)
-    if available {
-      return AuthCheckResult.AVAILABLE.rawValue
-    } else {
-      return AuthCheckResult.UNAVAILABLE.rawValue
-    }
-  }
-
-  private func getAliases() -> [String] {
-    let query: [String: Any] = [
-      kSecClass as String: kSecClassKey,
-      kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
-      kSecMatchLimit as String: kSecMatchLimitAll,
-      kSecReturnAttributes as String: true,
-    ]
-
-    var result: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &result)
-    guard status == errSecSuccess else { return [] }
-
-    let items = (result as? [[String: Any]]) ?? []
-    return items.compactMap { attrs in
-      let tagKey = kSecAttrApplicationTag as String
-      if let tagString = attrs[tagKey] as? String {
-        return tagString
-      }
-      return nil
-    }
-  }
-
   private func getSecKeyQuery(_ alias: String, keyClass: CFString, returnRef: Bool = true) -> [String: Any] {
     var query: [String: Any] = [
       kSecClass as String: kSecClassKey,
@@ -155,40 +123,6 @@ public class DeviceCryptoModule: Module {
     return (item as! SecKey)
   }
 
-  private func retrievePublicKey(_ secKey: SecKey) -> String? {
-    let publicKey = SecKeyCopyPublicKey(secKey)!
-
-    guard
-      let attrs = SecKeyCopyAttributes(publicKey) as? [String: Any],
-      let keyType = attrs[kSecAttrKeyType as String] as? String
-    else {
-      return nil
-    }
-
-    if keyType == (kSecAttrKeyTypeECSECPrimeRandom as String) {
-      return x962ECPointToP256SPKI(publicKey)?.base64EncodedString()
-    }
-
-    if keyType == (kSecAttrKeyTypeRSA as String) {
-      return rsaPKCS1ToSPKI(publicKey)?.base64EncodedString()
-    }
-
-    guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
-      return nil
-    }
-    return publicKeyData.base64EncodedString()
-  }
-
-  private func removeKeyStoreEntry(_ alias: String) -> Bool {
-    let privateQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPrivate, returnRef: false)
-    let privateStatus = SecItemDelete(privateQuery as CFDictionary)
-
-    let publicQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPublic, returnRef: false)
-    let publicStatus = SecItemDelete(publicQuery as CFDictionary)
-
-    return privateStatus == errSecSuccess || publicStatus == errSecSuccess
-  }
-
   private func buildECDSA(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
@@ -264,48 +198,205 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
-  public func definition() -> ModuleDefinition {
+  private func isAuthCheckAvailable() -> String {
+    let context = LAContext()
+    let available = context.canEvaluatePolicy(.deviceOwnerAuthentication, error: nil)
+    if available {
+      return AuthCheckResult.AVAILABLE.rawValue
+    } else {
+      return AuthCheckResult.UNAVAILABLE.rawValue
+    }
+  }
 
-    Name("DeviceCrypto")
+  private func generateKeyPair(alias: String, o: [String: Any]) throws -> String {
+    let reqAuth = o["reqAuth"] as! Bool
+    let authMethod = AuthMethod(rawValue: o["authMethod"] as! String)
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
 
-    Function("isAuthCheckAvailable") { () -> String in
-      return self.isAuthCheckAvailable()
+    if reqAuth && self.isAuthCheckAvailable() != AuthCheckResult.AVAILABLE.rawValue {
+      throw NSError(
+        domain: "DeviceCrypto",
+        code: 1,
+        userInfo: [NSLocalizedDescriptionKey: "NO_AUTH_AVAILABLE"]
+      )
     }
 
-    Function("generateKeyPair") { (alias: String, o: [String: Any]) -> String in
-      let reqAuth = o["reqAuth"] as! Bool
-      let authMethod = AuthMethod(rawValue: o["authMethod"] as! String)
-      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    if secKey != nil {
+      return SecureSigningModuleResult.KEY_PAIR_ALREADY_EXISTS.rawValue
+    }
 
-      if reqAuth && self.isAuthCheckAvailable() != AuthCheckResult.AVAILABLE.rawValue {
+    switch algoType {
+      case .ECDSA_SECP256R1_SHA256:
+        self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_2048_PKCS1:
+        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_2048_OAEP_SHA1:
+        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      default:
         throw NSError(
           domain: "DeviceCrypto",
           code: 1,
-          userInfo: [NSLocalizedDescriptionKey: "NO_AUTH_AVAILABLE"]
+          userInfo: [NSLocalizedDescriptionKey: "INVALID_ALGORITHM_TYPE"]
         )
-      }
+    }
 
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
-      if secKey != nil {
-        return SecureSigningModuleResult.KEY_PAIR_ALREADY_EXISTS.rawValue
-      }
+    return SecureSigningModuleResult.KEY_PAIR_GENERATED.rawValue
+  }
+
+  private func removeKeyStoreEntry(_ alias: String) -> Bool {
+    let privateQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPrivate, returnRef: false)
+    let privateStatus = SecItemDelete(privateQuery as CFDictionary)
+
+    let publicQuery = self.getSecKeyQuery(alias, keyClass: kSecAttrKeyClassPublic, returnRef: false)
+    let publicStatus = SecItemDelete(publicQuery as CFDictionary)
+
+    return privateStatus == errSecSuccess || publicStatus == errSecSuccess
+  }
 
-      switch algoType {
-        case .ECDSA_SECP256R1_SHA256:
-          self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
-        case .RSA_2048_PKCS1:
-          self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
-        case .RSA_2048_OAEP_SHA1:
-          self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
-        default:
-          throw NSError(
-            domain: "DeviceCrypto",
-            code: 1,
-            userInfo: [NSLocalizedDescriptionKey: "INVALID_ALGORITHM_TYPE"]
-          )
+  private func getAliases() -> [String] {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassKey,
+      kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
+      kSecMatchLimit as String: kSecMatchLimitAll,
+      kSecReturnAttributes as String: true,
+    ]
+
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &result)
+    guard status == errSecSuccess else { return [] }
+
+    let items = (result as? [[String: Any]]) ?? []
+    return items.compactMap { attrs in
+      let tagKey = kSecAttrApplicationTag as String
+      if let tagString = attrs[tagKey] as? String {
+        return tagString
       }
+      return nil
+    }
+  }
+
+  private func getPublicKey(alias: String) -> String? {
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
+    guard let secKey else { return nil }
+
+    let publicKey = SecKeyCopyPublicKey(secKey)!
+
+    guard
+      let attrs = SecKeyCopyAttributes(publicKey) as? [String: Any],
+      let keyType = attrs[kSecAttrKeyType as String] as? String
+    else {
+      return nil
+    }
+
+    if keyType == (kSecAttrKeyTypeECSECPrimeRandom as String) {
+      return x962ECPointToP256SPKI(publicKey)?.base64EncodedString()
+    }
+
+    if keyType == (kSecAttrKeyTypeRSA as String) {
+      return rsaPKCS1ToSPKI(publicKey)?.base64EncodedString()
+    }
+
+    guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
+      return nil
+    }
+    return publicKeyData.base64EncodedString()
+  }
+
+  private func sign(alias: String, data: String, o: [String: Any]) throws -> String? {
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    guard let secKey else { return nil }
 
-      return SecureSigningModuleResult.KEY_PAIR_GENERATED.rawValue
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+    let algo = self.toiOSAlgo(algorithm: algoType!)
+
+    var signingError: Unmanaged<CFError>?
+    let signatureCF = SecKeyCreateSignature(
+      secKey,
+      algo,
+      Data(data.utf8) as CFData,
+      &signingError
+    )
+
+    if let error = signingError?.takeRetainedValue() {
+      throw error as Error
+    }
+
+    guard let signatureCF else { return nil }
+    let signature = signatureCF as Data
+    return signature.base64EncodedString()
+  }
+
+  private func verify(alias: String, data: String, signature: String, o: [String: Any]) -> Bool? {
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    guard let secKey else { return nil }
+
+    guard let publicKey = SecKeyCopyPublicKey(secKey) else { return nil }
+    guard let signatureData = Data(base64Encoded: signature) else { return nil }
+
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+    let algo = self.toiOSAlgo(algorithm: algoType!)
+
+    let valid = SecKeyVerifySignature(
+      publicKey,
+      algo,
+      Data(data.utf8) as CFData,
+      signatureData as CFData,
+      nil
+    )
+    return valid
+  }
+
+  private func encrypt(alias: String, data: String, o: [String: Any]) -> String? {
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
+    guard let secKey else { return nil }
+    let publicKey = SecKeyCopyPublicKey(secKey)!
+
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+    let algo = self.toiOSAlgo(algorithm: algoType!)
+
+    guard let encrypted = SecKeyCreateEncryptedData(
+      publicKey,
+      algo,
+      Data(data.utf8) as CFData,
+      nil
+    ) as Data? else {
+      return nil
+    }
+
+    return encrypted.base64EncodedString()
+  }
+
+  private func decrypt(alias: String, data: String, o: [String: Any]) -> String? {
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    guard let secKey else { return nil }
+    guard let encryptedData = Data(base64Encoded: data) else { return nil }
+
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+    let algo = self.toiOSAlgo(algorithm: algoType!)
+
+    guard let decrypted = SecKeyCreateDecryptedData(
+      secKey,
+      algo,
+      encryptedData as CFData,
+      nil
+    ) as Data? else {
+      return nil
+    }
+
+    return String(data: decrypted, encoding: .utf8)
+  }
+
+  public func definition() -> ModuleDefinition {
+
+    Name("DeviceCrypto")
+
+    Function("isAuthCheckAvailable") { () -> String in
+      return self.isAuthCheckAvailable()
+    }
+
+    Function("generateKeyPair") { (alias: String, o: [String: Any]) -> String in
+      return try self.generateKeyPair(alias: alias, o: o)
     }
 
     Function("removeKeyPair") { (alias: String) -> Bool in
@@ -317,93 +408,23 @@ public class DeviceCryptoModule: Module {
     }
 
     Function("getPublicKey") { (alias: String) -> String? in
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
-      guard let secKey else { return nil }
-      return self.retrievePublicKey(secKey)
+      return self.getPublicKey(alias:alias)
     }
 
     AsyncFunction("sign") { (alias: String, data: String, o: [String: Any]) -> String? in
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
-      guard let secKey else { return nil }
-
-      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
-      let algo = self.toiOSAlgo(algorithm: algoType!)
-
-      var signingError: Unmanaged<CFError>?
-      let signatureCF = SecKeyCreateSignature(
-        secKey,
-        algo,
-        Data(data.utf8) as CFData,
-        &signingError
-      )
-
-      if let error = signingError?.takeRetainedValue() {
-        throw error as Error
-      }
-
-      guard let signatureCF else { return nil }
-      let signature = signatureCF as Data
-      return signature.base64EncodedString()
+      return try self.sign(alias: alias, data: data, o: o)
     }
 
     Function("verify") { (alias: String, data: String, signature: String, o: [String: Any]) -> Bool? in
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
-      guard let secKey else { return nil }
-
-      guard let publicKey = SecKeyCopyPublicKey(secKey) else { return nil }
-      guard let signatureData = Data(base64Encoded: signature) else { return nil }
-
-      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
-      let algo = self.toiOSAlgo(algorithm: algoType!)
-
-      let valid = SecKeyVerifySignature(
-        publicKey,
-        algo,
-        Data(data.utf8) as CFData,
-        signatureData as CFData,
-        nil
-      )
-      return valid
+      return self.verify(alias: alias, data: data, signature: signature, o: o)
     }
 
     AsyncFunction("encrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
-      guard let secKey else { return nil }
-      let publicKey = SecKeyCopyPublicKey(secKey)!
-
-      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
-      let algo = self.toiOSAlgo(algorithm: algoType!)
-
-      guard let encrypted = SecKeyCreateEncryptedData(
-        publicKey,
-        algo,
-        Data(data.utf8) as CFData,
-        nil
-      ) as Data? else {
-        return nil
-      }
-
-      return encrypted.base64EncodedString()
+      return self.encrypt(alias: alias, data: data, o: o)
     }
 
     AsyncFunction("decrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
-      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
-      guard let secKey else { return nil }
-      guard let encryptedData = Data(base64Encoded: data) else { return nil }
-
-      let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
-      let algo = self.toiOSAlgo(algorithm: algoType!)
-
-      guard let decrypted = SecKeyCreateDecryptedData(
-        secKey,
-        algo,
-        encryptedData as CFData,
-        nil
-      ) as Data? else {
-        return nil
-      }
-
-      return String(data: decrypted, encoding: .utf8)
+      return self.decrypt(alias: alias, data: data, o: o)
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",

package/src/DeviceCrypto.types.ts

@@ -51,29 +51,35 @@ export interface GenerateKeyPairOptions {
    * }
    * ```
    * @default AuthMethod.PASSCODE_OR_BIOMETRIC
-   * @platform ios
+   * @platform ios 🍏
    */
   authMethod?: AuthMethod;
+  /**
+   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).
+   * @default false
+   * @platform android 🤖
+   */
+  preferStrongBox?: boolean;
 }
 
 interface BaseSignDecryptOptions {
   /**
    * The title of the prompt to show when authentication is required.
    * @default "Unlock"
-   * @platform android
+   * @platform android 🤖
    */
   promptTitle?: string;
   /**
    * The subtitle of the prompt to show when authentication is required.
    * @default "Enter your PIN to continue"
-   * @platform android
+   * @platform android 🤖
    */
   promptSubtitle?: string;
   /**
    * The method of authentication to use.
    * Note that on iOS you have to define it when generating the key pair.
    * @default AuthMethod.PASSCODE_OR_BIOMETRIC
-   * @platform android
+   * @platform android 🤖
    */
   authMethod?: AuthMethod;
 }

package/src/DeviceCryptoModule.ts

@@ -23,6 +23,7 @@ function base64ToPem(base64: string, label = "DATA") {
 
 declare class DeviceCryptoModule extends NativeModule {
   isAuthCheckAvailable(): AuthCheckResult;
+  isStrongBoxAvailable(): boolean;
   generateKeyPair(alias: string, o: any): GenerateKeyPairResult;
   getPublicKey(alias: string): string | null;
   removeKeyPair(alias: string): boolean;
@@ -46,6 +47,12 @@ export default {
    * @returns The result of the operation.
    */
   isAuthCheckAvailable: module.isAuthCheckAvailable,
+  /**
+   * Checks if the strong box is available .
+   * @returns The result of the operation.
+   * @platform android 🤖
+   */
+  isStrongBoxAvailable: module.isStrongBoxAvailable,
   /**
    * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.
    * @param alias - The alias to use for the key pair.
@@ -56,6 +63,7 @@ export default {
       algoType: options?.algorithmType,
       reqAuth: options?.requireAuthentication ?? false,
       authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
+      preferStrongBox: options?.preferStrongBox ?? false,
     };
     return module.generateKeyPair(alias, o);
   },
@@ -89,12 +97,6 @@ export default {
    * @param alias - The alias to use for the key pair.
    * @param data - The data to sign.
    * @param options - The options for the operation.
-   * @default { 
-   *  algoType: SigningAlgorithm.ECDSA_SHA256, 
-   *  promptTitle: "Unlock", 
-   *  promptSubtitle: "Enter your PIN to continue", 
-   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC 
-   * }
    * @returns The signature.
    */
   sign: async (alias: string, data: string, options?: SignOptions) => {
@@ -112,9 +114,6 @@ export default {
    * @param data - The data to verify in UTF-8 format.
    * @param signature - The signature to verify in Base64 format.
    * @param options - The options for the operation.
-   * @default { 
-   *  algoType: SigningAlgorithm.ECDSA_SHA256, 
-   * }
    * @returns True if the signature is valid, false otherwise.
    */
   verify: async (
@@ -149,12 +148,6 @@ export default {
    * @param alias - The alias to use for the key pair.
    * @param data - The data to decrypt in Base64 format.
    * @param options - The options for the operation.
-   * @default { 
-   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, 
-   *  promptTitle: "Unlock", 
-   *  promptSubtitle: "Enter your PIN to continue", 
-   *  authMethod: AuthMethod.PASSCODE_OR_BIOMETRIC 
-   * }
    * @returns The decrypted data.
    */
   decrypt: async (alias: string, data: string, options?: DecryptOptions) => {