expo-device-crypto 0.2.3 → 0.3.0

package/README.md

@@ -28,25 +28,28 @@ If you want to allow Face ID on iOS, add this to your app config:
 
 ### Signature Algorithms
 
-- #### `ECDSA_SECP256R1_SHA256`
+- `ECDSA_SECP256R1_SHA256`
 
 **Curve:** P-256 / secp256r1. </br>
 **Hash:** SHA-256. </br>
-**Use it for:** Authentication challenges, message signing, and tamper detection.
 
 ### Encryption Algorithms
 
-- #### `RSA_2048_PKCS1`
+- `RSA_2048_PKCS1`
 
 **Key size:** 2048 bits. </br>
 **Padding:** PKCS#1 v1.5. </br>
-**Use it for:** Encrypting small secrets that only the private key holder should decrypt.
 
-- #### `RSA_2048_OAEP_SHA1`
+- `RSA_2048_OAEP_SHA1`
 
 **Key size:** 2048 bits. </br>
 **Padding:** OAEP with SHA-1 and MGF1. </br>
-**Use it for:** Encrypting small secrets with stronger padding than PKCS#1 v1.5 when interoperating with OAEP SHA-1 systems.
+
+- `ECIES_P256_AES256_GCM`
+
+**Curve:** P-256 (secp256r1). </br>
+**Symmetric cipher:** AES-256-GCM. </br>
+**Key derivation:** HKDF-SHA256 (32-byte key from ECDH shared secret). </br>
 
 **More coming soon...**
 
@@ -171,18 +174,18 @@ const decrypted = await DeviceCrypto.decrypt(alias, encrypted ?? "", {
 - `encrypt(alias: string, data: string, options?: EncryptOptions): Promise<string | null>`
   - Encrypts UTF-8 `data` with public key.
   - Default: `algorithmType = RSA_2048_PKCS1`.
+  - For `algorithmType = ECIES_P256_AES256_GCM`, `peerPublicKey` is required in `options`.
 
 - `decrypt(alias: string, data: string, options?: DecryptOptions): Promise<string | null>`
   - Decrypts Base64 `data` with private key.
   - Defaults: `algorithmType = RSA_2048_PKCS1`, `promptTitle = "Unlock"`, `promptSubtitle = "Enter your PIN to continue"`, `authMethod = PASSCODE_OR_BIOMETRIC`.
+  - For `algorithmType = ECIES_P256_AES256_GCM`, `peerPublicKey` is required in `options`.
 
 **Android only methods**
 
 - `isStrongBoxAvailable(): boolean`
   - Returns `true` if StrongBox Keystore is supported on the device.
 
-> ✅ JSDoc type definitions are available in `./src/DeviceCryptoModule.ts`.
-
 ## Important
 
 ### Enable Strong Box on Android
@@ -205,6 +208,6 @@ await DeviceCrypto.generateKeyPair(alias, {
 
 If StrongBox is not available, Android falls back to the Trusted Execution Environment (TEE).
 
-### RSA algorithms on iOS
+### Secure Enclave support on iOS
 
-Please note that RSA private-key operations are not performed in the [Secure Enclave processor](https://developer.apple.com/documentation/security/ksecattrtokenidsecureenclave?utm_source=chatgpt.com#Discussion). Instead, they are software-backed and handled by Apple’s system cryptographic services, which still provide strong isolation and protection.
+On iOS, only ECDSA keys can use the [Secure Enclave processor](https://developer.apple.com/documentation/security/ksecattrtokenidsecureenclave?utm_source=chatgpt.com#Discussion). RSA private-key operations are software-backed and handled by Apple’s system cryptographic services, which still provide strong isolation and protection.

package/android/build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'com.android.library'
 
 group = 'expo.modules.devicecrypto'
-version = '0.2.3'
+version = '0.3.0'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 apply from: expoModulesCorePlugin
@@ -35,7 +35,7 @@ android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "0.2.3"
+    versionName "0.3.0"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -16,6 +16,7 @@ import android.security.keystore.KeyProperties.PURPOSE_DECRYPT
 import android.security.keystore.KeyProperties.PURPOSE_ENCRYPT
 import android.security.keystore.KeyProperties.PURPOSE_SIGN
 import android.security.keystore.KeyProperties.PURPOSE_VERIFY
+import android.security.keystore.KeyProperties.PURPOSE_AGREE_KEY
 import android.util.Base64
 import androidx.biometric.BiometricManager
 import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
@@ -32,9 +33,14 @@ import java.security.KeyStore
 import java.security.Signature
 import java.security.spec.AlgorithmParameterSpec
 import java.security.spec.MGF1ParameterSpec
+import java.security.spec.X509EncodedKeySpec
 import javax.crypto.Cipher
+import javax.crypto.KeyAgreement
+import javax.crypto.Mac
+import javax.crypto.spec.GCMParameterSpec
 import javax.crypto.spec.OAEPParameterSpec
 import javax.crypto.spec.PSource
+import javax.crypto.spec.SecretKeySpec
 
 
 enum class GenerateKeyPairResult {
@@ -58,6 +64,7 @@ enum class AlgorithmType {
   ECDSA_SECP256R1_SHA256,
   RSA_2048_PKCS1,
   RSA_2048_OAEP_SHA1,
+  ECIES_P256_AES256_GCM,
 }
 
 class DeviceCryptoModule : Module() {
@@ -66,9 +73,46 @@ class DeviceCryptoModule : Module() {
       AlgorithmType.ECDSA_SECP256R1_SHA256 -> "SHA256withECDSA"
       AlgorithmType.RSA_2048_PKCS1 -> "RSA/ECB/PKCS1Padding"
       AlgorithmType.RSA_2048_OAEP_SHA1 -> "RSA/ECB/OAEPwithSHA-1AndMGF1Padding"
+      AlgorithmType.ECIES_P256_AES256_GCM -> "AES/GCM/NoPadding"
+      else -> throw Exception("INVALID_ALGORITHM_TYPE")
     }
   }
 
+  private fun hkdfSha256(
+    ikm: ByteArray,
+    length: Int,
+    salt: ByteArray? = null,
+    info: ByteArray? = null): ByteArray {
+    val mac = Mac.getInstance("HmacSHA256")
+    val actualSalt = salt ?: ByteArray(32)
+    mac.init(SecretKeySpec(actualSalt, "HmacSHA256"))
+    val prk = mac.doFinal(ikm)
+
+    val result = ByteArray(length)
+    var t = ByteArray(0)
+    var offset = 0
+    var counter = 1
+
+    while (offset < length) {
+        val macExpand = Mac.getInstance("HmacSHA256")
+        macExpand.init(SecretKeySpec(prk, "HmacSHA256"))
+
+        macExpand.update(t)
+        if (info != null) macExpand.update(info)
+        macExpand.update(counter.toByte())
+
+        t = macExpand.doFinal()
+
+        val toCopy = minOf(t.size, length - offset)
+        System.arraycopy(t, 0, result, offset, toCopy)
+
+        offset += toCopy
+        counter++
+    }
+
+    return result
+  }
+
   private fun getOaepSpec(algoType: AlgorithmType): AlgorithmParameterSpec? {
     return when (algoType) {
       AlgorithmType.RSA_2048_OAEP_SHA1 -> OAEPParameterSpec(
@@ -107,7 +151,7 @@ class DeviceCryptoModule : Module() {
 
   private fun buildECDSA(
     alias: String, 
-    digest: String,
+    digest: String?,
     reqAuth: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
@@ -119,7 +163,9 @@ class DeviceCryptoModule : Module() {
       alias,
       PURPOSE_SIGN or PURPOSE_VERIFY
     ).run {
-      setDigests(digest)
+      if (digest != null) {
+        setDigests(digest)
+      }
       setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
@@ -167,6 +213,37 @@ class DeviceCryptoModule : Module() {
     return kpg
   }
 
+  private fun buildECIES(
+    alias: String,
+    digest: String?,
+    reqAuth: Boolean,
+    strongBox: Boolean): KeyPairGenerator {
+    val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
+      KEY_ALGORITHM_EC,
+      "AndroidKeyStore"
+    )
+
+    val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
+      alias,
+      PURPOSE_AGREE_KEY
+    ).run {
+      if (digest != null) {
+        setDigests(digest)
+      }
+      setIsStrongBoxBacked(strongBox)
+      setUserAuthenticationRequired(reqAuth)
+      if (reqAuth) {
+        setUserAuthenticationParameters(
+          30, // 30 seconds
+          AUTH_BIOMETRIC_STRONG or AUTH_DEVICE_CREDENTIAL
+        )
+      }
+      build()
+    }
+
+    kpg.initialize(parameterSpec)
+    return kpg
+  }
 
   private fun showAuthPrompt(
     onSuccess: () -> Unit,
@@ -249,6 +326,7 @@ class DeviceCryptoModule : Module() {
       AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(alias, DIGEST_SHA256, reqAuth, strongBox)
       AlgorithmType.RSA_2048_PKCS1 -> buildRSA(alias, null, ENCRYPTION_PADDING_RSA_PKCS1, reqAuth, strongBox)
       AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(alias, DIGEST_SHA1, ENCRYPTION_PADDING_RSA_OAEP, reqAuth, strongBox)
+      AlgorithmType.ECIES_P256_AES256_GCM -> buildECIES(alias, null, reqAuth, strongBox)
       else -> throw Exception("INVALID_ALGORITHM_TYPE")
     }
 
@@ -279,6 +357,20 @@ class DeviceCryptoModule : Module() {
     return Base64.encodeToString(publicKeyBytes, Base64.NO_WRAP)
   }
 
+  private fun deriveSharedSecret(entry: KeyStore.PrivateKeyEntry, publicKey: String): ByteArray {
+    val peerPublicKeyBytes = Base64.decode(publicKey, Base64.NO_WRAP)
+    val peerPublicKeySpec = X509EncodedKeySpec(peerPublicKeyBytes)
+    val peerPublicKey = KeyFactory
+      .getInstance(KEY_ALGORITHM_EC)
+      .generatePublic(peerPublicKeySpec)
+
+    return KeyAgreement.getInstance("ECDH", "AndroidKeyStore").run {
+      init(entry.privateKey)
+      doPhase(peerPublicKey, true)
+      generateSecret()
+    }
+  }
+
   private fun sign(alias: String, data: String, o: Map<String, Any?>, promise: Promise) {
     val entry = getKeyStoreEntry(alias)
     if (entry !is KeyStore.PrivateKeyEntry) {
@@ -294,24 +386,24 @@ class DeviceCryptoModule : Module() {
     val algoType = AlgorithmType.valueOf(o["algoType"] as String)
     val algo = toAndroidAlgo(algoType)
 
-    if (!reqAuth) {
+    fun runSigning() {
       val signature: ByteArray = Signature.getInstance(algo).apply {
         initSign(entry.privateKey)
         update(data.toByteArray(Charsets.UTF_8))
       }.sign()
       promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+    }
+
+    if (!reqAuth) {
+      runSigning()
       return
     } else {
       showAuthPrompt(
         onSuccess = {
-          val signature: ByteArray = Signature.getInstance(algo).apply {
-            initSign(entry.privateKey)
-            update(data.toByteArray(Charsets.UTF_8))
-          }.sign()
-          promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+          runSigning()
         },
         onError = { error ->
-          promise.reject("ERR_AUTH_FAILED", error, null)
+          promise.reject("AUTH_FAILED", error, null)
         },
         title = title,
         subtitle = subtitle,
@@ -341,18 +433,62 @@ class DeviceCryptoModule : Module() {
       return
     }
 
+    val reqAuth = isKeyStoreRequireAuthentication(entry)
+
+    val title = o["title"] as String
+    val subtitle = o["subtitle"] as String
+    val authMethod = AuthMethod.valueOf(o["authMethod"] as String)
     val algoType = AlgorithmType.valueOf(o["algoType"] as String)
     val algo = toAndroidAlgo(algoType)
-    val oaepSpec = getOaepSpec(algoType)
-
     val cipher = Cipher.getInstance(algo)
-    if (oaepSpec != null) {
-      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
+
+    fun runEncryption(cipher: Cipher) {
+      when (algoType) {
+        AlgorithmType.RSA_2048_OAEP_SHA1 -> {
+          val oaepSpec = getOaepSpec(algoType)
+          cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
+          val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
+          promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+        }
+        AlgorithmType.RSA_2048_PKCS1 -> {
+          cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+          val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
+          promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+        }
+        AlgorithmType.ECIES_P256_AES256_GCM -> {
+          val peerPublicKey = o["peerPublicKey"] as String
+          val sharedSecret = deriveSharedSecret(entry, peerPublicKey)
+          val aesKey = SecretKeySpec(hkdfSha256(sharedSecret, 32), "AES")
+          cipher.init(Cipher.ENCRYPT_MODE, aesKey)
+          val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
+          val payload = cipher.iv + encrypted
+          promise.resolve(Base64.encodeToString(payload, Base64.NO_WRAP))
+        }
+        else -> {
+          throw Exception("INVALID_ALGORITHM_TYPE")
+        }
+      }
+    }
+
+    if (algoType != AlgorithmType.ECIES_P256_AES256_GCM) {
+      runEncryption(cipher)
+      return
+    } else if (!reqAuth) {
+      runEncryption(cipher)
+      return
     } else {
-      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+      showAuthPrompt(
+        onSuccess = {
+          runEncryption(cipher)
+        },
+        onError = { error ->
+          promise.reject("AUTH_FAILED", error, null)
+        },
+        title = title,
+        subtitle = subtitle,
+        authMethod = authMethod
+      )
     }
-    val encrypted: ByteArray = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
-    promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
   }
 
   private fun decrypt(alias: String, data: String, o: Map<String, Any?>, promise: Promise) {
@@ -369,33 +505,53 @@ class DeviceCryptoModule : Module() {
     val authMethod = o["authMethod"] as String
     val algoType = AlgorithmType.valueOf(o["algoType"] as String)
     val algo = toAndroidAlgo(algoType)
-    val oaepSpec = getOaepSpec(algoType)
 
     val cipher = Cipher.getInstance(algo)
     val ciphertext = Base64.decode(data, Base64.NO_WRAP)
 
-    if (!reqAuth) {
-      if (oaepSpec != null) {
-        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
-      } else {
-        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+    fun runDecryption(cipher: Cipher) {
+      when (algoType) {
+        AlgorithmType.RSA_2048_OAEP_SHA1 -> {
+          val oaepSpec = getOaepSpec(algoType)
+          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
+          val decrypted = cipher.doFinal(ciphertext)
+          promise.resolve(String(decrypted, Charsets.UTF_8))
+          return
+        }
+        AlgorithmType.RSA_2048_PKCS1 -> {
+          cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+          val decrypted = cipher.doFinal(ciphertext)
+          promise.resolve(String(decrypted, Charsets.UTF_8))
+          return
+        }
+        AlgorithmType.ECIES_P256_AES256_GCM -> {
+          val peerPublicKey = o["peerPublicKey"] as String
+          val sharedSecret = deriveSharedSecret(entry, peerPublicKey)
+          val aesKey = SecretKeySpec(hkdfSha256(sharedSecret, 32), "AES")
+          val iv = ciphertext.copyOfRange(0, 12)
+          val encryptedPayload = ciphertext.copyOfRange(12, ciphertext.size)
+          val gcmSpec = GCMParameterSpec(128, iv)
+          cipher.init(Cipher.DECRYPT_MODE, aesKey, gcmSpec)
+          val decrypted = cipher.doFinal(encryptedPayload)
+          promise.resolve(String(decrypted, Charsets.UTF_8))
+          return
+        }
+        else -> {
+          throw Exception("INVALID_ALGORITHM_TYPE")
+        }
       }
-      val decrypted: ByteArray = cipher.doFinal(ciphertext)
-      promise.resolve(String(decrypted, Charsets.UTF_8))
+    }
+    
+    if (!reqAuth) {
+      runDecryption(cipher)
       return
     } else {
       showAuthPrompt(
         onSuccess = {
-          if (oaepSpec != null) {
-            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
-          } else {
-            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
-          }
-          val decrypted: ByteArray = cipher.doFinal(ciphertext)
-          promise.resolve(String(decrypted, Charsets.UTF_8))
+          runDecryption(cipher)
         },
         onError = { error ->
-          promise.reject("ERR_AUTH_FAILED", error, null)
+          promise.reject("AUTH_FAILED", error, null)
         },
         title = title,
         subtitle = subtitle,

package/build/DeviceCrypto.types.d.ts

@@ -15,11 +15,14 @@ export declare enum AuthMethod {
 export declare enum SigningAlgorithm {
     ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
 }
+type EciesAlgorithm = "ECIES_P256_AES256_GCM";
+type RsaAlgorithm = "RSA_2048_PKCS1" | "RSA_2048_OAEP_SHA1";
 export declare enum EncryptionAlgorithm {
     RSA_2048_PKCS1 = "RSA_2048_PKCS1",
-    RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
+    RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1",
+    ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM"
 }
-export interface GenerateKeyPairOptions {
+export type GenerateKeyPairOptions = {
     /**
      * The algorithm type of the key to generate.
      */
@@ -55,8 +58,8 @@ export interface GenerateKeyPairOptions {
      * @platform android 🤖
      */
     preferStrongBox?: boolean;
-}
-interface BaseSignDecryptOptions {
+};
+type BaseAuthOptions = {
     /**
      * The title of the prompt to show when authentication is required.
      * @default "Unlock"
@@ -76,33 +79,42 @@ interface BaseSignDecryptOptions {
      * @platform android 🤖
      */
     authMethod?: AuthMethod;
-}
-interface BaseSigningOptions {
+};
+type BaseSigningOptions = {
     /**
      * The algorithm type of the key to use for signing.
      */
-    algorithmType?: SigningAlgorithm;
-}
-interface BaseEncryptionOptions {
+    algorithmType: SigningAlgorithm;
+};
+type BaseVerifyOptions = BaseSigningOptions;
+type BaseRsaEncryptionOptions = {
     /**
      * The algorithm type of the key to use for encrypting.
      */
-    algorithmType?: EncryptionAlgorithm;
-}
-export interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {
-}
-export interface VerifyOptions extends BaseSigningOptions {
-}
-export interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {
-}
-export interface EncryptOptions extends BaseEncryptionOptions {
-}
+    algorithmType: RsaAlgorithm;
+};
+type BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;
+type BaseEciesEncryptionOptions = {
+    /**
+     * The algorithm type of the key to use for encrypting.
+     */
+    algorithmType: EciesAlgorithm;
+    /**
+     * The peer public key to use for ECIES.
+     */
+    peerPublicKey: string;
+};
+type BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;
+export type SignOptions = BaseAuthOptions & BaseSigningOptions;
+export type VerifyOptions = BaseVerifyOptions;
+export type DecryptOptions = (BaseAuthOptions & BaseEciesDecryptionOptions) | (BaseAuthOptions & BaseRsaDecryptionOptions);
+export type EncryptOptions = (BaseAuthOptions & BaseEciesEncryptionOptions) | BaseRsaEncryptionOptions;
 export interface GetPublicKeyOptions {
     /**
      * The format of the public key to return.
      * @default "PEM" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)
      */
-    format?: "PEM";
+    format?: "PEM" | "BASE64";
 }
 export {};
 //# sourceMappingURL=DeviceCrypto.types.d.ts.map

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAC9C,KAAK,YAAY,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAC5D,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}

package/build/DeviceCrypto.types.js

@@ -23,5 +23,6 @@ export var EncryptionAlgorithm;
 (function (EncryptionAlgorithm) {
     EncryptionAlgorithm["RSA_2048_PKCS1"] = "RSA_2048_PKCS1";
     EncryptionAlgorithm["RSA_2048_OAEP_SHA1"] = "RSA_2048_OAEP_SHA1";
+    EncryptionAlgorithm["ECIES_P256_AES256_GCM"] = "ECIES_P256_AES256_GCM";
 })(EncryptionAlgorithm || (EncryptionAlgorithm = {}));
 //# sourceMappingURL=DeviceCrypto.types.js.map

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAED,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n}\n\nexport interface GenerateKeyPairOptions {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ninterface BaseSignDecryptOptions {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ninterface BaseSigningOptions {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType?: SigningAlgorithm;\n}\n\ninterface BaseEncryptionOptions {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType?: EncryptionAlgorithm;\n}\n\nexport interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}\nexport interface VerifyOptions extends BaseSigningOptions {}\n\nexport interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}\nexport interface EncryptOptions extends BaseEncryptionOptions {}\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAID,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\ntype EciesAlgorithm = \"ECIES_P256_AES256_GCM\";\ntype RsaAlgorithm = \"RSA_2048_PKCS1\" | \"RSA_2048_OAEP_SHA1\";\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}

package/build/DeviceCryptoModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA8B5B;;;OAGG;gCAvBqB,eAAe;IAyBvC;;;;OAIG;gCA5BqB,OAAO;IA8B/B;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IASvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAQ3D;;;;OAIG;2BA3DkB,MAAM,KAAG,OAAO;IA6DrC;;;OAGG;mBA/DQ,MAAM,EAAE;IAiEnB;;;;;;OAMG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAS/D;;;;;;;OAOG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAOzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAMrE;;;;;;OAMG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AA7GvE,wBAsHE"}
+{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA8B5B;;;OAGG;gCAvBqB,eAAe;IAyBvC;;;;OAIG;gCA5BqB,OAAO;IA8B/B;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IASvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAW3D;;;;OAIG;2BA9DkB,MAAM,KAAG,OAAO;IAgErC;;;OAGG;mBAlEQ,MAAM,EAAE;IAoEnB;;;;;;OAMG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAU/D;;;;;;;OAOG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAQzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAcrE;;;;;;OAMG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AA1HvE,wBAqIE"}

package/build/DeviceCryptoModule.js

@@ -45,6 +45,9 @@ export default {
         if (options?.format === "PEM") {
             return base64ToPem(publicKey, "PUBLIC KEY");
         }
+        else if (options?.format === "BASE64") {
+            return publicKey;
+        }
         return base64ToPem(publicKey, "PUBLIC KEY");
     },
     /**
@@ -101,6 +104,14 @@ export default {
     encrypt: async (alias, data, options) => {
         const o = {
             algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,
+            // @ts-ignore
+            title: options?.promptTitle ?? "Unlock",
+            // @ts-ignore
+            subtitle: options?.promptSubtitle ?? "Enter your PIN to continue",
+            // @ts-ignore
+            authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
+            // @ts-ignore
+            peerPublicKey: options?.peerPublicKey ?? "",
         };
         return module.encrypt(alias, data, o);
     },
@@ -117,6 +128,8 @@ export default {
             subtitle: options?.promptSubtitle ?? "Enter your PIN to continue",
             authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
             algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,
+            // @ts-ignore
+            peerPublicKey: options?.peerPublicKey ?? "",
         };
         return module.decrypt(alias, data, o);
     },

package/build/DeviceCryptoModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAoBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK;SACnD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;OAMG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;OAOG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SAC5E,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;SACvE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  isStrongBoxAvailable(): boolean;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Checks if the strong box is available .\n   * @returns The result of the operation.\n   * @platform android 🤖\n   */\n  isStrongBoxAvailable: module.isStrongBoxAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      preferStrongBox: options?.preferStrongBox ?? false,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    }\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default { \n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, \n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n    };\n    return module.decrypt(alias, data, o);\n  },\n};"]}
+{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAoBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK;SACnD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;OAMG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;OAOG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,aAAa;YACb,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,aAAa;YACb,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  isStrongBoxAvailable(): boolean;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Checks if the strong box is available .\n   * @returns The result of the operation.\n   * @platform android 🤖\n   */\n  isStrongBoxAvailable: module.isStrongBoxAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      preferStrongBox: options?.preferStrongBox ?? false,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    } else if (options?.format === \"BASE64\") {\n      return publicKey;\n    }\n\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default {\n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,\n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      title: options?.promptTitle ?? \"Unlock\",\n      // @ts-ignore\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      // @ts-ignore\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.decrypt(alias, data, o);\n  },\n};\n"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '0.2.3'
+  s.version        = '0.3.0'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -2,6 +2,7 @@ import ExpoModulesCore
 import Security
 import Foundation
 import LocalAuthentication
+import CryptoKit
 
 enum SecureSigningModuleResult: String {
   case KEY_PAIR_GENERATED = "KEY_PAIR_GENERATED"
@@ -24,6 +25,7 @@ enum AlgorithmType: String {
   case ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
   case RSA_2048_PKCS1 = "RSA_2048_PKCS1"
   case RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
+  case ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM"
 }
 
 public class DeviceCryptoModule: Module {
@@ -35,6 +37,8 @@ public class DeviceCryptoModule: Module {
       return .rsaEncryptionPKCS1
     case .RSA_2048_OAEP_SHA1:
       return .rsaEncryptionOAEPSHA1
+    case .ECIES_P256_AES256_GCM:
+      return .eciesEncryptionCofactorX963SHA256AESGCM
     }
   }
 
@@ -103,6 +107,20 @@ public class DeviceCryptoModule: Module {
     return Data([0x80 | UInt8(bytes.count)]) + Data(bytes)
   }
 
+  // Converts P‑256 SPKI DER format to ANSI x962 EC point format.
+  private func spkiP256ToX962(_ spki: Data) -> Data? {
+    let prefix = Data([
+      0x30, 0x59,
+      0x30, 0x13,
+      0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
+      0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
+      0x03, 0x42, 0x00
+    ])
+    guard spki.count == prefix.count + 65 else { return nil }
+    guard spki.starts(with: prefix) else { return nil }
+    return spki.suffix(65)
+  }
+
   private func getSecKeyQuery(_ alias: String, keyClass: CFString, returnRef: Bool = true) -> [String: Any] {
     var query: [String: Any] = [
       kSecClass as String: kSecClassKey,
@@ -198,6 +216,76 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
+  private func buildECIES(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+    let accessFlags: SecAccessControlCreateFlags
+    if reqAuth {
+      switch authMethod {
+        case .PASSCODE:
+          accessFlags = [.privateKeyUsage, .devicePasscode]
+        case .PASSCODE_OR_BIOMETRIC:
+          accessFlags = [.privateKeyUsage, .userPresence]
+      }
+    } else {
+      accessFlags = .privateKeyUsage
+    }
+
+    let access = SecAccessControlCreateWithFlags(
+      kCFAllocatorDefault,
+      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      accessFlags,
+      nil
+    )
+
+    let attributes: NSDictionary = [
+      kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+      kSecAttrKeySizeInBits: 256,
+      kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+      kSecPrivateKeyAttrs: [
+        kSecAttrIsPermanent: true,
+        kSecAttrApplicationTag: alias,
+        kSecAttrAccessControl: access
+      ],
+      kSecPublicKeyAttrs: [
+        kSecAttrIsPermanent: true,
+        kSecAttrApplicationTag: alias
+      ]
+    ]
+
+    return SecKeyCreateRandomKey(attributes, nil)
+  }
+
+  private func secKeyFromPeerPublicKey(_ peerPublicKey: String) -> SecKey? {
+    guard
+      let peerPublicKeyData = Data(base64Encoded: peerPublicKey),
+      let x962 = spkiP256ToX962(peerPublicKeyData)
+    else {
+      return nil
+    }
+
+    let attrs: [String: Any] = [
+      kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+      kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
+      kSecAttrKeySizeInBits as String: 256
+    ]
+
+    return SecKeyCreateWithData(x962 as CFData, attrs as CFDictionary, nil)
+  }
+
+  private func deriveSharedSecret(privateKey: SecKey, peerPublicKey: String) -> Data? {
+    guard let peerSecKey = secKeyFromPeerPublicKey(peerPublicKey) else { return nil }
+    let algorithm = SecKeyAlgorithm.ecdhKeyExchangeStandard
+    guard SecKeyIsAlgorithmSupported(privateKey, .keyExchange, algorithm) else { return nil }
+
+    let params: [String: Any] = [:]
+    return SecKeyCopyKeyExchangeResult(
+      privateKey,
+      algorithm,
+      peerSecKey,
+      params as CFDictionary,
+      nil
+    ) as Data?
+  }
+
   private func isAuthCheckAvailable() -> String {
     let context = LAContext()
     let available = context.canEvaluatePolicy(.deviceOwnerAuthentication, error: nil)
@@ -233,6 +321,8 @@ public class DeviceCryptoModule: Module {
         self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       case .RSA_2048_OAEP_SHA1:
         self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      case .ECIES_P256_AES256_GCM:
+        self.buildECIES(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       default:
         throw NSError(
           domain: "DeviceCrypto",
@@ -347,12 +437,27 @@ public class DeviceCryptoModule: Module {
     return valid
   }
 
-  private func encrypt(alias: String, data: String, o: [String: Any]) -> String? {
+  private func encrypt(alias: String, data: String, o: [String: Any]) throws -> String? {
+    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+
+    if algoType == .ECIES_P256_AES256_GCM {
+      let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+      guard let secKey else { return nil }
+      let peerPublicKey = o["peerPublicKey"] as! String
+      let sharedSecret = deriveSharedSecret(privateKey: secKey, peerPublicKey: peerPublicKey)
+      guard let sharedSecret else { return nil }
+
+      let symmetricKey = HKDF<SHA256>.deriveKey(
+        inputKeyMaterial: SymmetricKey(data: sharedSecret),
+        outputByteCount: 32
+      )
+      let sealed = try AES.GCM.seal(Data(data.utf8), using: symmetricKey)
+      return sealed.combined!.base64EncodedString()
+    }
+
     let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
     guard let secKey else { return nil }
     let publicKey = SecKeyCopyPublicKey(secKey)!
-
-    let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
     let algo = self.toiOSAlgo(algorithm: algoType!)
 
     guard let encrypted = SecKeyCreateEncryptedData(
@@ -367,12 +472,27 @@ public class DeviceCryptoModule: Module {
     return encrypted.base64EncodedString()
   }
 
-  private func decrypt(alias: String, data: String, o: [String: Any]) -> String? {
+  private func decrypt(alias: String, data: String, o: [String: Any]) throws -> String? {
     let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
     guard let secKey else { return nil }
     guard let encryptedData = Data(base64Encoded: data) else { return nil }
 
     let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
+
+    if algoType == .ECIES_P256_AES256_GCM {
+      let peerPublicKey = o["peerPublicKey"] as! String
+      let sharedSecret = deriveSharedSecret(privateKey: secKey, peerPublicKey: peerPublicKey)
+      guard let sharedSecret else { return nil }
+
+      let symmetricKey = HKDF<SHA256>.deriveKey(
+        inputKeyMaterial: SymmetricKey(data: sharedSecret),
+        outputByteCount: 32
+      )
+      let sealedBox = try AES.GCM.SealedBox(combined: encryptedData)
+      let decrypted = try AES.GCM.open(sealedBox, using: symmetricKey)
+      return String(data: decrypted, encoding: .utf8)
+    }
+
     let algo = self.toiOSAlgo(algorithm: algoType!)
 
     guard let decrypted = SecKeyCreateDecryptedData(
@@ -420,11 +540,11 @@ public class DeviceCryptoModule: Module {
     }
 
     AsyncFunction("encrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
-      return self.encrypt(alias: alias, data: data, o: o)
+      return try self.encrypt(alias: alias, data: data, o: o)
     }
 
     AsyncFunction("decrypt") { (alias: String, data: String, o: [String: Any]) -> String? in
-      return self.decrypt(alias: alias, data: data, o: o)
+      return try self.decrypt(alias: alias, data: data, o: o)
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -19,17 +19,14 @@
     "expo",
     "expo-module",
     "react-native",
-    "native-module",
     "crypto",
     "cryptography",
     "device-crypto",
     "hardware-backed",
     "secure-enclave",
     "android-keystore",
-    "ios-keychain",
-    "key-management",
-    "secure-key-storage",
     "digital-signature",
+    "ecies",
     "ecdsa",
     "secp256r1",
     "rsa",

package/src/DeviceCrypto.types.ts

@@ -19,12 +19,15 @@ export enum SigningAlgorithm {
   ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
 }
 
+type EciesAlgorithm = "ECIES_P256_AES256_GCM";
+type RsaAlgorithm = "RSA_2048_PKCS1" | "RSA_2048_OAEP_SHA1";
 export enum EncryptionAlgorithm {
   RSA_2048_PKCS1 = "RSA_2048_PKCS1",
   RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1",
+  ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM",
 }
 
-export interface GenerateKeyPairOptions {
+export type GenerateKeyPairOptions = {
   /**
    * The algorithm type of the key to generate.
    */
@@ -62,7 +65,7 @@ export interface GenerateKeyPairOptions {
   preferStrongBox?: boolean;
 }
 
-interface BaseSignDecryptOptions {
+type BaseAuthOptions = {
   /**
    * The title of the prompt to show when authentication is required.
    * @default "Unlock"
@@ -84,30 +87,48 @@ interface BaseSignDecryptOptions {
   authMethod?: AuthMethod;
 }
 
-interface BaseSigningOptions {
+type BaseSigningOptions = {
   /**
    * The algorithm type of the key to use for signing.
    */
-  algorithmType?: SigningAlgorithm;
-}
+  algorithmType: SigningAlgorithm;
+};
+type BaseVerifyOptions = BaseSigningOptions;
 
-interface BaseEncryptionOptions {
+type BaseRsaEncryptionOptions = {
   /**
    * The algorithm type of the key to use for encrypting.
    */
-  algorithmType?: EncryptionAlgorithm;
-}
+  algorithmType: RsaAlgorithm;
+};
+type BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;
+
+type BaseEciesEncryptionOptions = {
+  /**
+   * The algorithm type of the key to use for encrypting.
+   */
+  algorithmType: EciesAlgorithm;
+  /**
+   * The peer public key to use for ECIES.
+   */
+  peerPublicKey: string;
+};
+type BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;
 
-export interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {}
-export interface VerifyOptions extends BaseSigningOptions {}
+export type SignOptions = BaseAuthOptions & BaseSigningOptions;
+export type VerifyOptions = BaseVerifyOptions;
 
-export interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {}
-export interface EncryptOptions extends BaseEncryptionOptions {}
+export type DecryptOptions =
+  | (BaseAuthOptions & BaseEciesDecryptionOptions)
+  | (BaseAuthOptions & BaseRsaDecryptionOptions);
+export type EncryptOptions =
+  | (BaseAuthOptions & BaseEciesEncryptionOptions)
+  | BaseRsaEncryptionOptions;
 
 export interface GetPublicKeyOptions {
   /**
    * The format of the public key to return.
    * @default "PEM" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)
    */
-  format?: "PEM";
+  format?: "PEM" | "BASE64";
 }

package/src/DeviceCryptoModule.ts

@@ -78,7 +78,10 @@ export default {
     if (!publicKey) return null;
     if (options?.format === "PEM") {
       return base64ToPem(publicKey, "PUBLIC KEY");
+    } else if (options?.format === "BASE64") {
+      return publicKey;
     }
+
     return base64ToPem(publicKey, "PUBLIC KEY");
   },
   /**
@@ -104,7 +107,8 @@ export default {
       title: options?.promptTitle ?? "Unlock",
       subtitle: options?.promptSubtitle ?? "Enter your PIN to continue",
       authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
-      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,
+      algoType:
+        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,
     };
     return module.sign(alias, data, o);
   },
@@ -123,7 +127,8 @@ export default {
     options?: VerifyOptions
   ) => {
     const o = {
-      algoType: options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,
+      algoType:
+        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,
     };
     return module.verify(alias, data, signature, o);
   },
@@ -132,14 +137,22 @@ export default {
    * @param alias - The alias to use for the key pair.
    * @param data - The data to sign in UTF-8 format.
    * @param options - The options for the operation.
-   * @default { 
-   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1, 
+   * @default {
+   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,
    * }
    * @returns The signature.
    */
   encrypt: async (alias: string, data: string, options?: EncryptOptions) => {
     const o = {
       algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,
+      // @ts-ignore
+      title: options?.promptTitle ?? "Unlock",
+      // @ts-ignore
+      subtitle: options?.promptSubtitle ?? "Enter your PIN to continue",
+      // @ts-ignore
+      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
+      // @ts-ignore
+      peerPublicKey: options?.peerPublicKey ?? "",
     };
     return module.encrypt(alias, data, o);
   },
@@ -156,7 +169,9 @@ export default {
       subtitle: options?.promptSubtitle ?? "Enter your PIN to continue",
       authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
       algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,
+      // @ts-ignore
+      peerPublicKey: options?.peerPublicKey ?? "",
     };
     return module.decrypt(alias, data, o);
   },
-};
+};