expo-device-crypto 0.3.2 → 0.4.0

package/README.md

@@ -33,6 +33,18 @@ If you want to allow Face ID on iOS, add this to your app config:
   **Curve:** P-256 / secp256r1. </br>
   **Hash:** SHA-256. </br>
 
+- `RSA_SHA256`
+
+  **Key size:** 2048 bits. </br>
+  **Padding:** PKCS#1 v1.5. </br>
+  **Hash:** SHA-256. </br>
+
+- `RSA_SHA256_PSS`
+
+  **Key size:** 2048 bits. </br>
+  **Padding:** RSA-PSS (MGF1). </br>
+  **Hash:** SHA-256. </br>
+
 ### 🔐 Encryption Algorithms
 
 - `RSA_2048_PKCS1`

package/android/build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'com.android.library'
 
 group = 'expo.modules.devicecrypto'
-version = '0.3.2'
+version = '0.4.0'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 apply from: expoModulesCorePlugin
@@ -35,7 +35,7 @@ android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "0.3.2"
+    versionName "0.4.0"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -10,6 +10,8 @@ import android.security.keystore.KeyProperties.DIGEST_SHA1
 import android.security.keystore.KeyProperties.DIGEST_SHA256
 import android.security.keystore.KeyProperties.ENCRYPTION_PADDING_RSA_OAEP
 import android.security.keystore.KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1
+import android.security.keystore.KeyProperties.SIGNATURE_PADDING_RSA_PKCS1
+import android.security.keystore.KeyProperties.SIGNATURE_PADDING_RSA_PSS
 import android.security.keystore.KeyProperties.KEY_ALGORITHM_EC
 import android.security.keystore.KeyProperties.KEY_ALGORITHM_RSA
 import android.security.keystore.KeyProperties.PURPOSE_DECRYPT
@@ -65,6 +67,13 @@ enum class AlgorithmType {
   RSA_2048_PKCS1,
   RSA_2048_OAEP_SHA1,
   ECIES_P256_AES256_GCM,
+  RSA_SHA256,
+  RSA_SHA256_PSS
+}
+
+enum class Purpose {
+  ENCRYPT,
+  SIGN,
 }
 
 class DeviceCryptoModule : Module() {
@@ -74,6 +83,8 @@ class DeviceCryptoModule : Module() {
       AlgorithmType.RSA_2048_PKCS1 -> "RSA/ECB/PKCS1Padding"
       AlgorithmType.RSA_2048_OAEP_SHA1 -> "RSA/ECB/OAEPwithSHA-1AndMGF1Padding"
       AlgorithmType.ECIES_P256_AES256_GCM -> "AES/GCM/NoPadding"
+      AlgorithmType.RSA_SHA256 -> "SHA256withRSA"
+      AlgorithmType.RSA_SHA256_PSS -> "SHA256withRSA/PSS"
       else -> throw Exception("INVALID_ALGORITHM_TYPE")
     }
   }
@@ -183,7 +194,8 @@ class DeviceCryptoModule : Module() {
   private fun buildRSA(
     alias: String, 
     digest: String?,
-    padding: String,
+    purpose: Purpose,
+    padding: String?,
     reqAuth: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
@@ -193,12 +205,20 @@ class DeviceCryptoModule : Module() {
 
     val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
       alias,
-      PURPOSE_ENCRYPT or PURPOSE_DECRYPT
+      when (purpose) {
+        Purpose.ENCRYPT -> PURPOSE_ENCRYPT or PURPOSE_DECRYPT
+        Purpose.SIGN -> PURPOSE_SIGN or PURPOSE_VERIFY
+      }
     ).run {
       if (digest != null) {
         setDigests(digest)
       }
-      setEncryptionPaddings(padding)
+      if (padding != null && purpose == Purpose.ENCRYPT) {
+        setEncryptionPaddings(padding)
+      }
+      if (padding != null && purpose == Purpose.SIGN) {
+        setSignaturePaddings(padding)
+      }
       setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
@@ -323,10 +343,50 @@ class DeviceCryptoModule : Module() {
     val strongBox = preferStrongBox && isStrongBoxAvailable()
 
     val kpg = when (algoType) {
-      AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(alias, DIGEST_SHA256, reqAuth, strongBox)
-      AlgorithmType.RSA_2048_PKCS1 -> buildRSA(alias, null, ENCRYPTION_PADDING_RSA_PKCS1, reqAuth, strongBox)
-      AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(alias, DIGEST_SHA1, ENCRYPTION_PADDING_RSA_OAEP, reqAuth, strongBox)
-      AlgorithmType.ECIES_P256_AES256_GCM -> buildECIES(alias, null, reqAuth, strongBox)
+      AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA(
+        alias = alias,
+        digest = DIGEST_SHA256,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_2048_PKCS1 -> buildRSA(
+        alias = alias,
+        digest = null,
+        purpose = Purpose.ENCRYPT,
+        padding = ENCRYPTION_PADDING_RSA_PKCS1,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA1,
+        purpose = Purpose.ENCRYPT,
+        padding = ENCRYPTION_PADDING_RSA_OAEP,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.ECIES_P256_AES256_GCM -> buildECIES(
+        alias = alias,
+        digest = null,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_SHA256 -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA256,
+        purpose = Purpose.SIGN,
+        padding = SIGNATURE_PADDING_RSA_PKCS1,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_SHA256_PSS -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA256,
+        purpose = Purpose.SIGN,
+        padding = SIGNATURE_PADDING_RSA_PSS,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
       else -> throw Exception("INVALID_ALGORITHM_TYPE")
     }
 

package/build/DeviceCrypto.types.d.ts

@@ -13,7 +13,9 @@ export declare enum AuthMethod {
     PASSCODE_OR_BIOMETRIC = "PASSCODE_OR_BIOMETRIC"
 }
 export declare enum SigningAlgorithm {
-    ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
+    ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
+    RSA_SHA256 = "RSA_SHA256",
+    RSA_SHA256_PSS = "RSA_SHA256_PSS"
 }
 type EciesAlgorithm = "ECIES_P256_AES256_GCM";
 type RsaAlgorithm = "RSA_2048_PKCS1" | "RSA_2048_OAEP_SHA1";

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAC9C,KAAK,YAAY,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAC5D,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;IACjD,UAAU,eAAe;IACzB,cAAc,mBAAmB;CAClC;AAED,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAC9C,KAAK,YAAY,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAC5D,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}

package/build/DeviceCrypto.types.js

@@ -18,6 +18,8 @@ export var AuthMethod;
 export var SigningAlgorithm;
 (function (SigningAlgorithm) {
     SigningAlgorithm["ECDSA_SECP256R1_SHA256"] = "ECDSA_SECP256R1_SHA256";
+    SigningAlgorithm["RSA_SHA256"] = "RSA_SHA256";
+    SigningAlgorithm["RSA_SHA256_PSS"] = "RSA_SHA256_PSS";
 })(SigningAlgorithm || (SigningAlgorithm = {}));
 export var EncryptionAlgorithm;
 (function (EncryptionAlgorithm) {

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAEX;AAFD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;AACnD,CAAC,EAFW,gBAAgB,KAAhB,gBAAgB,QAE3B;AAID,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n}\n\ntype EciesAlgorithm = \"ECIES_P256_AES256_GCM\";\ntype RsaAlgorithm = \"RSA_2048_PKCS1\" | \"RSA_2048_OAEP_SHA1\";\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;IACjD,6CAAyB,CAAA;IACzB,qDAAiC,CAAA;AACnC,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAID,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n  RSA_SHA256 = \"RSA_SHA256\",\n  RSA_SHA256_PSS = \"RSA_SHA256_PSS\",\n}\n\ntype EciesAlgorithm = \"ECIES_P256_AES256_GCM\";\ntype RsaAlgorithm = \"RSA_2048_PKCS1\" | \"RSA_2048_OAEP_SHA1\";\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '0.3.2'
+  s.version        = '0.4.0'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -26,6 +26,8 @@ enum AlgorithmType: String {
   case RSA_2048_PKCS1 = "RSA_2048_PKCS1"
   case RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
   case ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM"
+  case RSA_SHA256 = "RSA_SHA256"
+  case RSA_SHA256_PSS = "RSA_SHA256_PSS"
 }
 
 public class DeviceCryptoModule: Module {
@@ -39,6 +41,10 @@ public class DeviceCryptoModule: Module {
       return .rsaEncryptionOAEPSHA1
     case .ECIES_P256_AES256_GCM:
       return .eciesEncryptionCofactorX963SHA256AESGCM
+    case .RSA_SHA256:
+      return .rsaSignatureMessagePKCS1v15SHA256
+    case .RSA_SHA256_PSS:
+      return .rsaSignatureMessagePSSSHA256
     }
   }
 
@@ -309,7 +315,7 @@ public class DeviceCryptoModule: Module {
       )
     }
 
-    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
     if secKey != nil {
       return SecureSigningModuleResult.KEY_PAIR_ALREADY_EXISTS.rawValue
     }
@@ -323,6 +329,10 @@ public class DeviceCryptoModule: Module {
         self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       case .ECIES_P256_AES256_GCM:
         self.buildECIES(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_SHA256:
+        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_SHA256_PSS:
+        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       default:
         throw NSError(
           domain: "DeviceCrypto",
@@ -418,7 +428,7 @@ public class DeviceCryptoModule: Module {
   }
 
   private func verify(alias: String, data: String, signature: String, o: [String: Any]) -> Bool? {
-    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPrivate)
+    let secKey = self.getSecKeyByAlias(alias, keyClass: kSecAttrKeyClassPublic)
     guard let secKey else { return nil }
 
     guard let publicKey = SecKeyCopyPublicKey(secKey) else { return nil }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -19,8 +19,8 @@
     "expo",
     "expo-module",
     "react-native",
-    "crypto",
-    "cryptography",
+    "encrypt",
+    "signature",
     "device-crypto",
     "hardware-backed",
     "secure-enclave",

package/src/DeviceCrypto.types.ts

@@ -17,6 +17,8 @@ export enum AuthMethod {
 
 export enum SigningAlgorithm {
   ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
+  RSA_SHA256 = "RSA_SHA256",
+  RSA_SHA256_PSS = "RSA_SHA256_PSS",
 }
 
 type EciesAlgorithm = "ECIES_P256_AES256_GCM";