expo-device-crypto 1.0.1 → 1.1.0

package/README.md

@@ -24,44 +24,83 @@ If you want to allow Face ID on iOS, add this to your app config:
 
 ## Supported Algorithms
 
-### ✍️ Signature Algorithms
-
-- `ECDSA_SECP256R1_SHA256`
-
-  **Curve:** P-256 / secp256r1. </br>
-  **Hash:** SHA-256. </br>
-
-- `RSA_SHA256`
-
-  **Key size:** 2048 bits. </br>
-  **Padding:** PKCS#1 v1.5. </br>
-  **Hash:** SHA-256. </br>
-
-- `RSA_SHA256_PSS`
-
-  **Key size:** 2048 bits. </br>
-  **Padding:** RSA-PSS (MGF1). </br>
-  **Hash:** SHA-256. </br>
-
-### 🔐 Encryption Algorithms
-
-- `RSA_2048_PKCS1`
-
-  **Key size:** 2048 bits. </br>
-  **Padding:** PKCS#1 v1.5. </br>
-
-- `RSA_2048_OAEP_SHA1`
-
-  **Key size:** 2048 bits. </br>
-  **Padding:** OAEP with SHA-1 and MGF1. </br>
-
-- `ECIES_P256_AES256_GCM`
-
-  **Curve:** P-256 (secp256r1). </br>
-  **Symmetric cipher:** AES-256-GCM. </br>
-  **Key derivation:** HKDF-SHA256 (32-byte key from ECDH shared secret). </br>
-
-**More coming soon...**
+<table>
+  <thead>
+    <tr>
+      <th width="50%">✍️ Signature Algorithms</th>
+      <th width="50%">🔐 Encryption Algorithms</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>
+        <code>ECDSA_SECP256R1_SHA256</code><br>
+        <strong>Curve:</strong> P-256 / secp256r1<br>
+        <strong>Hash:</strong> SHA-256
+      </td>
+      <td>
+        <code>ECIES_P256_AES256_GCM</code><br>
+        <strong>Curve:</strong> P-256 (secp256r1)<br>
+        <strong>Symmetric cipher:</strong> AES-256-GCM<br>
+        <strong>Key derivation:</strong> HKDF-SHA256 (32-byte key from ECDH shared secret)
+        <a href="https://github.com/piotr-pietras/expo-device-crypto/blob/master/examples/ecies.ts">see simple usage</a>
+      </td>
+    </tr>
+    <tr>
+      <td>
+        <code>RSA_SHA256</code><br>
+        <strong>Key size:</strong> 2048 bits<br>
+        <strong>Padding:</strong> PKCS#1 v1.5<br>
+        <strong>Hash:</strong> SHA-256
+      </td>
+      <td>
+        <code>RSA_2048_OAEP_SHA1</code><br>
+        <strong>Key size:</strong> 2048 bits<br>
+        <strong>Padding:</strong> OAEP with SHA-1 and MGF1
+      </td>
+    </tr>
+    <tr>
+      <td>
+        <code>RSA_SHA256_PSS</code><br>
+        <strong>Key size:</strong> 2048 bits<br>
+        <strong>Padding:</strong> RSA-PSS (MGF1)<br>
+        <strong>Hash:</strong> SHA-256
+      </td>
+      <td>
+        <code>RSA_2048_PKCS1</code><br>
+        <strong>Key size:</strong> 2048 bits<br>
+        <strong>Padding:</strong> PKCS#1 v1.5
+      </td>
+    </tr>
+    <tr>
+      <td>
+        <code>RSA_4096_SHA256</code><br>
+        <strong>Key size:</strong> 4096 bits<br>
+        <strong>Padding:</strong> PKCS#1 v1.5<br>
+        <strong>Hash:</strong> SHA-256
+      </td>
+      <td>
+        <code>RSA_4096_OAEP_SHA1</code><br>
+        <strong>Key size:</strong> 4096 bits<br>
+        <strong>Padding:</strong> OAEP with SHA-1 and MGF1
+      </td>
+    </tr>
+    <tr>
+      <td>
+        <code>RSA_4096_SHA256_PSS</code><br>
+        <strong>Key size:</strong> 4096 bits<br>
+        <strong>Padding:</strong> RSA-PSS (MGF1)<br>
+        <strong>Hash:</strong> SHA-256
+      </td>
+      <td>
+        <code>RSA_4096_PKCS1</code><br>
+        <strong>Key size:</strong> 4096 bits<br>
+        <strong>Padding:</strong> PKCS#1 v1.5
+      </td>
+    </tr>
+
+  </tbody>
+</table>
 
 ## Example
 
@@ -109,11 +148,13 @@ const decrypted = await DeviceCrypto.decrypt(alias, encrypted, {
 });
 ```
 
-> ⚠️ Because iOS Keychain/Secure Enclave binds authentication policy to key creation, `authMethod` must be set in `generateKeyPair`. On Android Keystore, authentication is applied at key usage time, so `authMethod` is provided in operations like `sign` and `decrypt`.
-
-### 📚 More examples
+> [!WARNING]
+> Because iOS Keychain/Secure Enclave binds authentication policy to key creation, `authMethod` must be set in `generateKeyPair`. On Android Keystore, authentication is applied at key usage time, so `authMethod` is provided in operations like `sign` and `decrypt`.
 
-**You can find additional usage examples in the [`examples` directory](https://github.com/piotr-pietras/expo-device-crypto/tree/master/examples) of the main repository.**
+> [!TIP]
+> ### 📚💡📦  More examples
+>
+> Looking for more examples? Browse the **[`examples` directory](https://github.com/piotr-pietras/expo-device-crypto/tree/master/examples)** for additional usage patterns (ECIES, signing, encryption, and more).
 
 ## Methods
 

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.devicecrypto'
-version = '1.0.1'
+version = '1.1.0'
 
 android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "1.0.1"
+    versionName "1.1.0"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -67,9 +67,13 @@ enum class AlgorithmType {
   ECDSA_SECP256R1_SHA256,
   RSA_2048_PKCS1,
   RSA_2048_OAEP_SHA1,
+  RSA_4096_PKCS1,
+  RSA_4096_OAEP_SHA1,
   ECIES_P256_AES256_GCM,
   RSA_SHA256,
-  RSA_SHA256_PSS
+  RSA_SHA256_PSS,
+  RSA_4096_SHA256,
+  RSA_4096_SHA256_PSS
 }
 
 enum class Purpose {
@@ -82,52 +86,22 @@ class DeviceCryptoModule : Module() {
     return when (algorithm) {
       AlgorithmType.ECDSA_SECP256R1_SHA256 -> "SHA256withECDSA"
       AlgorithmType.RSA_2048_PKCS1 -> "RSA/ECB/PKCS1Padding"
+      AlgorithmType.RSA_4096_PKCS1 -> "RSA/ECB/PKCS1Padding"
       AlgorithmType.RSA_2048_OAEP_SHA1 -> "RSA/ECB/OAEPwithSHA-1AndMGF1Padding"
+      AlgorithmType.RSA_4096_OAEP_SHA1 -> "RSA/ECB/OAEPwithSHA-1AndMGF1Padding"
       AlgorithmType.ECIES_P256_AES256_GCM -> "AES/GCM/NoPadding"
       AlgorithmType.RSA_SHA256 -> "SHA256withRSA"
+      AlgorithmType.RSA_4096_SHA256 -> "SHA256withRSA"
       AlgorithmType.RSA_SHA256_PSS -> "SHA256withRSA/PSS"
+      AlgorithmType.RSA_4096_SHA256_PSS -> "SHA256withRSA/PSS"
       else -> throw Exception("INVALID_ALGORITHM_TYPE")
     }
   }
 
-  private fun hkdfSha256(
-    ikm: ByteArray,
-    length: Int,
-    salt: ByteArray? = null,
-    info: ByteArray? = null): ByteArray {
-    val mac = Mac.getInstance("HmacSHA256")
-    val actualSalt = salt ?: ByteArray(32)
-    mac.init(SecretKeySpec(actualSalt, "HmacSHA256"))
-    val prk = mac.doFinal(ikm)
-
-    val result = ByteArray(length)
-    var t = ByteArray(0)
-    var offset = 0
-    var counter = 1
-
-    while (offset < length) {
-        val macExpand = Mac.getInstance("HmacSHA256")
-        macExpand.init(SecretKeySpec(prk, "HmacSHA256"))
-
-        macExpand.update(t)
-        if (info != null) macExpand.update(info)
-        macExpand.update(counter.toByte())
-
-        t = macExpand.doFinal()
-
-        val toCopy = minOf(t.size, length - offset)
-        System.arraycopy(t, 0, result, offset, toCopy)
-
-        offset += toCopy
-        counter++
-    }
-
-    return result
-  }
-
   private fun getOaepSpec(algoType: AlgorithmType): AlgorithmParameterSpec? {
     return when (algoType) {
-      AlgorithmType.RSA_2048_OAEP_SHA1 -> OAEPParameterSpec(
+      AlgorithmType.RSA_2048_OAEP_SHA1,
+      AlgorithmType.RSA_4096_OAEP_SHA1 -> OAEPParameterSpec(
         "SHA-1",
         "MGF1",
         MGF1ParameterSpec.SHA1,
@@ -197,6 +171,7 @@ class DeviceCryptoModule : Module() {
     digest: String?,
     purpose: Purpose,
     padding: String?,
+    keySize: Int,
     reqAuth: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
@@ -221,6 +196,7 @@ class DeviceCryptoModule : Module() {
         setSignaturePaddings(padding)
       }
       setIsStrongBoxBacked(strongBox)
+      setKeySize(keySize)
       setUserAuthenticationRequired(reqAuth)
       if (reqAuth) {
         setUserAuthenticationParameters(
@@ -355,6 +331,7 @@ class DeviceCryptoModule : Module() {
         digest = null,
         purpose = Purpose.ENCRYPT,
         padding = ENCRYPTION_PADDING_RSA_PKCS1,
+        keySize = 2048,
         reqAuth = reqAuth,
         strongBox = strongBox
       )
@@ -363,6 +340,25 @@ class DeviceCryptoModule : Module() {
         digest = DIGEST_SHA1,
         purpose = Purpose.ENCRYPT,
         padding = ENCRYPTION_PADDING_RSA_OAEP,
+        keySize = 2048,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_4096_PKCS1 -> buildRSA(
+        alias = alias,
+        digest = null,
+        purpose = Purpose.ENCRYPT,
+        padding = ENCRYPTION_PADDING_RSA_PKCS1,
+        keySize = 4096,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_4096_OAEP_SHA1 -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA1,
+        purpose = Purpose.ENCRYPT,
+        padding = ENCRYPTION_PADDING_RSA_OAEP,
+        keySize = 4096,
         reqAuth = reqAuth,
         strongBox = strongBox
       )
@@ -377,6 +373,7 @@ class DeviceCryptoModule : Module() {
         digest = DIGEST_SHA256,
         purpose = Purpose.SIGN,
         padding = SIGNATURE_PADDING_RSA_PKCS1,
+        keySize = 2048,
         reqAuth = reqAuth,
         strongBox = strongBox
       )
@@ -385,6 +382,25 @@ class DeviceCryptoModule : Module() {
         digest = DIGEST_SHA256,
         purpose = Purpose.SIGN,
         padding = SIGNATURE_PADDING_RSA_PSS,
+        keySize = 2048,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_4096_SHA256 -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA256,
+        purpose = Purpose.SIGN,
+        padding = SIGNATURE_PADDING_RSA_PKCS1,
+        keySize = 4096,
+        reqAuth = reqAuth,
+        strongBox = strongBox
+      )
+      AlgorithmType.RSA_4096_SHA256_PSS -> buildRSA(
+        alias = alias,
+        digest = DIGEST_SHA256,
+        purpose = Purpose.SIGN,
+        padding = SIGNATURE_PADDING_RSA_PSS,
+        keySize = 4096,
         reqAuth = reqAuth,
         strongBox = strongBox
       )
@@ -505,13 +521,15 @@ class DeviceCryptoModule : Module() {
 
     fun runEncryption(cipher: Cipher) {
       when (algoType) {
-        AlgorithmType.RSA_2048_OAEP_SHA1 -> {
+        AlgorithmType.RSA_2048_OAEP_SHA1,
+        AlgorithmType.RSA_4096_OAEP_SHA1 -> {
           val oaepSpec = getOaepSpec(algoType)
           cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey, oaepSpec)
           val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
           promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
         }
-        AlgorithmType.RSA_2048_PKCS1 -> {
+        AlgorithmType.RSA_2048_PKCS1,
+        AlgorithmType.RSA_4096_PKCS1 -> {
           cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
           val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
           promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
@@ -572,14 +590,16 @@ class DeviceCryptoModule : Module() {
 
     fun runDecryption(cipher: Cipher) {
       when (algoType) {
-        AlgorithmType.RSA_2048_OAEP_SHA1 -> {
+        AlgorithmType.RSA_2048_OAEP_SHA1,
+        AlgorithmType.RSA_4096_OAEP_SHA1 -> {
           val oaepSpec = getOaepSpec(algoType)
           cipher.init(Cipher.DECRYPT_MODE, entry.privateKey, oaepSpec)
           val decrypted = cipher.doFinal(ciphertext)
           promise.resolve(String(decrypted, Charsets.UTF_8))
           return
         }
-        AlgorithmType.RSA_2048_PKCS1 -> {
+        AlgorithmType.RSA_2048_PKCS1,
+        AlgorithmType.RSA_4096_PKCS1 -> {
           cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
           val decrypted = cipher.doFinal(ciphertext)
           promise.resolve(String(decrypted, Charsets.UTF_8))

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoUtils.kt

@@ -0,0 +1,40 @@
+package expo.modules.devicecrypto
+
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+fun hkdfSha256(
+  ikm: ByteArray,
+  length: Int,
+  salt: ByteArray? = null,
+  info: ByteArray? = null
+): ByteArray {
+  val mac = Mac.getInstance("HmacSHA256")
+  val actualSalt = salt ?: ByteArray(32)
+  mac.init(SecretKeySpec(actualSalt, "HmacSHA256"))
+  val prk = mac.doFinal(ikm)
+
+  val result = ByteArray(length)
+  var t = ByteArray(0)
+  var offset = 0
+  var counter = 1
+
+  while (offset < length) {
+    val macExpand = Mac.getInstance("HmacSHA256")
+    macExpand.init(SecretKeySpec(prk, "HmacSHA256"))
+
+    macExpand.update(t)
+    if (info != null) macExpand.update(info)
+    macExpand.update(counter.toByte())
+
+    t = macExpand.doFinal()
+
+    val toCopy = minOf(t.size, length - offset)
+    System.arraycopy(t, 0, result, offset, toCopy)
+
+    offset += toCopy
+    counter++
+  }
+
+  return result
+}

package/build/DeviceCrypto.types.d.ts

@@ -15,15 +15,19 @@ export declare enum AuthMethod {
 export declare enum SigningAlgorithm {
     ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
     RSA_SHA256 = "RSA_SHA256",
-    RSA_SHA256_PSS = "RSA_SHA256_PSS"
+    RSA_SHA256_PSS = "RSA_SHA256_PSS",
+    RSA_4096_SHA256 = "RSA_4096_SHA256",
+    RSA_4096_SHA256_PSS = "RSA_4096_SHA256_PSS"
 }
-type EciesAlgorithm = "ECIES_P256_AES256_GCM";
-type RsaAlgorithm = "RSA_2048_PKCS1" | "RSA_2048_OAEP_SHA1";
 export declare enum EncryptionAlgorithm {
     RSA_2048_PKCS1 = "RSA_2048_PKCS1",
     RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1",
+    RSA_4096_PKCS1 = "RSA_4096_PKCS1",
+    RSA_4096_OAEP_SHA1 = "RSA_4096_OAEP_SHA1",
     ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM"
 }
+type EciesAlgorithm = EncryptionAlgorithm.ECIES_P256_AES256_GCM;
+type RsaAlgorithm = EncryptionAlgorithm.RSA_2048_PKCS1 | EncryptionAlgorithm.RSA_2048_OAEP_SHA1 | EncryptionAlgorithm.RSA_4096_PKCS1 | EncryptionAlgorithm.RSA_4096_OAEP_SHA1;
 export type GenerateKeyPairOptions = {
     /**
      * The algorithm type of the key to generate.

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;IACjD,UAAU,eAAe;IACzB,cAAc,mBAAmB;CAClC;AAED,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAC9C,KAAK,YAAY,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAC5D,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;IACjD,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;CAC5C;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,KAAK,cAAc,GAAG,mBAAmB,CAAC,qBAAqB,CAAC;AAChE,KAAK,YAAY,GACb,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,GACtC,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,CAAC;AAE3C,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}

package/build/DeviceCrypto.types.js

@@ -20,11 +20,15 @@ export var SigningAlgorithm;
     SigningAlgorithm["ECDSA_SECP256R1_SHA256"] = "ECDSA_SECP256R1_SHA256";
     SigningAlgorithm["RSA_SHA256"] = "RSA_SHA256";
     SigningAlgorithm["RSA_SHA256_PSS"] = "RSA_SHA256_PSS";
+    SigningAlgorithm["RSA_4096_SHA256"] = "RSA_4096_SHA256";
+    SigningAlgorithm["RSA_4096_SHA256_PSS"] = "RSA_4096_SHA256_PSS";
 })(SigningAlgorithm || (SigningAlgorithm = {}));
 export var EncryptionAlgorithm;
 (function (EncryptionAlgorithm) {
     EncryptionAlgorithm["RSA_2048_PKCS1"] = "RSA_2048_PKCS1";
     EncryptionAlgorithm["RSA_2048_OAEP_SHA1"] = "RSA_2048_OAEP_SHA1";
+    EncryptionAlgorithm["RSA_4096_PKCS1"] = "RSA_4096_PKCS1";
+    EncryptionAlgorithm["RSA_4096_OAEP_SHA1"] = "RSA_4096_OAEP_SHA1";
     EncryptionAlgorithm["ECIES_P256_AES256_GCM"] = "ECIES_P256_AES256_GCM";
 })(EncryptionAlgorithm || (EncryptionAlgorithm = {}));
 //# sourceMappingURL=DeviceCrypto.types.js.map

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;IACjD,6CAAyB,CAAA;IACzB,qDAAiC,CAAA;AACnC,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAID,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n  RSA_SHA256 = \"RSA_SHA256\",\n  RSA_SHA256_PSS = \"RSA_SHA256_PSS\",\n}\n\ntype EciesAlgorithm = \"ECIES_P256_AES256_GCM\";\ntype RsaAlgorithm = \"RSA_2048_PKCS1\" | \"RSA_2048_OAEP_SHA1\";\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n}\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n}\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;IACjD,6CAAyB,CAAA;IACzB,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,+DAA2C,CAAA;AAC7C,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAED,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n  RSA_SHA256 = \"RSA_SHA256\",\n  RSA_SHA256_PSS = \"RSA_SHA256_PSS\",\n  RSA_4096_SHA256 = \"RSA_4096_SHA256\",\n  RSA_4096_SHA256_PSS = \"RSA_4096_SHA256_PSS\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  RSA_4096_PKCS1 = \"RSA_4096_PKCS1\",\n  RSA_4096_OAEP_SHA1 = \"RSA_4096_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\ntype EciesAlgorithm = EncryptionAlgorithm.ECIES_P256_AES256_GCM;\ntype RsaAlgorithm =\n  | EncryptionAlgorithm.RSA_2048_PKCS1\n  | EncryptionAlgorithm.RSA_2048_OAEP_SHA1\n  | EncryptionAlgorithm.RSA_4096_PKCS1\n  | EncryptionAlgorithm.RSA_4096_OAEP_SHA1;\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n};\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n};\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '1.0.1'
+  s.version        = '1.1.0'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -25,9 +25,13 @@ enum AlgorithmType: String {
   case ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
   case RSA_2048_PKCS1 = "RSA_2048_PKCS1"
   case RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1"
+  case RSA_4096_PKCS1 = "RSA_4096_PKCS1"
+  case RSA_4096_OAEP_SHA1 = "RSA_4096_OAEP_SHA1"
   case ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM"
   case RSA_SHA256 = "RSA_SHA256"
   case RSA_SHA256_PSS = "RSA_SHA256_PSS"
+  case RSA_4096_SHA256 = "RSA_4096_SHA256"
+  case RSA_4096_SHA256_PSS = "RSA_4096_SHA256_PSS"
 }
 
 public class DeviceCryptoModule: Module {
@@ -39,94 +43,23 @@ public class DeviceCryptoModule: Module {
       return .rsaEncryptionPKCS1
     case .RSA_2048_OAEP_SHA1:
       return .rsaEncryptionOAEPSHA1
+    case .RSA_4096_PKCS1:
+      return .rsaEncryptionPKCS1
+    case .RSA_4096_OAEP_SHA1:
+      return .rsaEncryptionOAEPSHA1
     case .ECIES_P256_AES256_GCM:
       return .eciesEncryptionCofactorX963SHA256AESGCM
     case .RSA_SHA256:
       return .rsaSignatureMessagePKCS1v15SHA256
     case .RSA_SHA256_PSS:
       return .rsaSignatureMessagePSSSHA256
+    case .RSA_4096_SHA256:
+      return .rsaSignatureMessagePKCS1v15SHA256
+    case .RSA_4096_SHA256_PSS:
+      return .rsaSignatureMessagePSSSHA256
     }
   }
 
-  // Converts ANSI x962 EC point to P‑256 SPKI DER format
-  private func x962ECPointToP256SPKI(_ publicKey: SecKey) -> Data? {
-    var error: Unmanaged<CFError>?
-    guard let raw = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {
-      return nil
-    }
-
-    guard raw.count == 65 else { return nil }
-    let prefix = Data([
-      0x30, 0x59,
-      0x30, 0x13,
-      0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
-      0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
-      0x03, 0x42, 0x00
-    ])
-    return prefix + raw
-  }
-
-  // Converts PKCS#1 RSA public key bytes to SPKI DER format.
-  private func rsaPKCS1ToSPKI(_ publicKey: SecKey) -> Data? {
-    guard let pkcs1 = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
-      return nil
-    }
-
-    // rsaEncryption OID: 1.2.840.113549.1.1.1 with NULL params
-    let algorithmIdentifier = Data([
-      0x30, 0x0D,
-      0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01,
-      0x05, 0x00
-    ])
-
-    let bitStringPayload = Data([0x00]) + pkcs1
-    guard let bitString = asn1Wrap(tag: 0x03, content: bitStringPayload) else {
-      return nil
-    }
-
-    return asn1Wrap(tag: 0x30, content: algorithmIdentifier + bitString)
-  }
-
-  private func asn1Wrap(tag: UInt8, content: Data) -> Data? {
-    guard let length = asn1Length(content.count) else {
-      return nil
-    }
-    return Data([tag]) + length + content
-  }
-
-  private func asn1Length(_ length: Int) -> Data? {
-    if length < 0x80 {
-      return Data([UInt8(length)])
-    }
-
-    var value = length
-    var bytes: [UInt8] = []
-    while value > 0 {
-      bytes.insert(UInt8(value & 0xff), at: 0)
-      value >>= 8
-    }
-
-    guard bytes.count <= 4 else {
-      return nil
-    }
-
-    return Data([0x80 | UInt8(bytes.count)]) + Data(bytes)
-  }
-
-  // Converts P‑256 SPKI DER format to ANSI x962 EC point format.
-  private func spkiP256ToX962(_ spki: Data) -> Data? {
-    let prefix = Data([
-      0x30, 0x59,
-      0x30, 0x13,
-      0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
-      0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
-      0x03, 0x42, 0x00
-    ])
-    guard spki.count == prefix.count + 65 else { return nil }
-    guard spki.starts(with: prefix) else { return nil }
-    return spki.suffix(65)
-  }
-
   private func getSecKeyQuery(_ alias: String, keyClass: CFString, returnRef: Bool = true) -> [String: Any] {
     var query: [String: Any] = [
       kSecClass as String: kSecClassKey,
@@ -185,7 +118,7 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
-  private func buildRSA(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildRSA(alias: String, keySize: Int, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -207,7 +140,7 @@ public class DeviceCryptoModule: Module {
 
     let attributes: NSDictionary = [
       kSecAttrKeyType: kSecAttrKeyTypeRSA,
-      kSecAttrKeySizeInBits: 2048,
+      kSecAttrKeySizeInBits: keySize,
       kSecPrivateKeyAttrs: [
           kSecAttrIsPermanent: true,
           kSecAttrApplicationTag: alias,
@@ -324,15 +257,23 @@ public class DeviceCryptoModule: Module {
       case .ECDSA_SECP256R1_SHA256:
         self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       case .RSA_2048_PKCS1:
-        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
       case .RSA_2048_OAEP_SHA1:
-        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_4096_PKCS1:
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_4096_OAEP_SHA1:
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
       case .ECIES_P256_AES256_GCM:
         self.buildECIES(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
       case .RSA_SHA256:
-        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
       case .RSA_SHA256_PSS:
-        self.buildRSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_4096_SHA256:
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+      case .RSA_4096_SHA256_PSS:
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
       default:
         throw NSError(
           domain: "DeviceCrypto",

package/ios/DeviceCryptoUtils.swift

@@ -0,0 +1,84 @@
+import Foundation
+import Security
+
+/// Converts ANSI x9.62 EC point to P-256 SPKI DER format.
+func x962ECPointToP256SPKI(_ publicKey: SecKey) -> Data? {
+  var error: Unmanaged<CFError>?
+  guard let raw = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {
+    return nil
+  }
+
+  guard raw.count == 65 else { return nil }
+  let prefix = Data([
+    0x30, 0x59,
+    0x30, 0x13,
+    0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
+    0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
+    0x03, 0x42, 0x00,
+  ])
+  return prefix + raw
+}
+
+/// Converts PKCS#1 RSA public key bytes to SPKI DER format.
+func rsaPKCS1ToSPKI(_ publicKey: SecKey) -> Data? {
+  guard let pkcs1 = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
+    return nil
+  }
+
+  // rsaEncryption OID: 1.2.840.113549.1.1.1 with NULL params
+  let algorithmIdentifier = Data([
+    0x30, 0x0D,
+    0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01,
+    0x05, 0x00,
+  ])
+
+  let bitStringPayload = Data([0x00]) + pkcs1
+  guard let bitString = asn1Wrap(tag: 0x03, content: bitStringPayload) else {
+    return nil
+  }
+
+  return asn1Wrap(tag: 0x30, content: algorithmIdentifier + bitString)
+}
+
+/// Wraps ASN.1 content with a tag and length.
+func asn1Wrap(tag: UInt8, content: Data) -> Data? {
+  guard let length = asn1Length(content.count) else {
+    return nil
+  }
+  return Data([tag]) + length + content
+}
+
+/// Converts a length to ASN.1 length format.
+func asn1Length(_ length: Int) -> Data? {
+  if length < 0x80 {
+    return Data([UInt8(length)])
+  }
+
+  var value = length
+  var bytes: [UInt8] = []
+  while value > 0 {
+    bytes.insert(UInt8(value & 0xff), at: 0)
+    value >>= 8
+  }
+
+  guard bytes.count <= 4 else {
+    return nil
+  }
+
+  return Data([0x80 | UInt8(bytes.count)]) + Data(bytes)
+}
+
+/// Converts P-256 SPKI DER format to ANSI x9.62 EC point format.
+func spkiP256ToX962(_ spki: Data) -> Data? {
+  let prefix = Data([
+    0x30, 0x59,
+    0x30, 0x13,
+    0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
+    0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
+    0x03, 0x42, 0x00,
+  ])
+  guard spki.count == prefix.count + 65 else { return nil }
+  guard spki.starts(with: prefix) else { return nil }
+  return spki.suffix(65)
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",

package/src/DeviceCrypto.types.ts

@@ -19,16 +19,25 @@ export enum SigningAlgorithm {
   ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256",
   RSA_SHA256 = "RSA_SHA256",
   RSA_SHA256_PSS = "RSA_SHA256_PSS",
+  RSA_4096_SHA256 = "RSA_4096_SHA256",
+  RSA_4096_SHA256_PSS = "RSA_4096_SHA256_PSS",
 }
 
-type EciesAlgorithm = "ECIES_P256_AES256_GCM";
-type RsaAlgorithm = "RSA_2048_PKCS1" | "RSA_2048_OAEP_SHA1";
 export enum EncryptionAlgorithm {
   RSA_2048_PKCS1 = "RSA_2048_PKCS1",
   RSA_2048_OAEP_SHA1 = "RSA_2048_OAEP_SHA1",
+  RSA_4096_PKCS1 = "RSA_4096_PKCS1",
+  RSA_4096_OAEP_SHA1 = "RSA_4096_OAEP_SHA1",
   ECIES_P256_AES256_GCM = "ECIES_P256_AES256_GCM",
 }
 
+type EciesAlgorithm = EncryptionAlgorithm.ECIES_P256_AES256_GCM;
+type RsaAlgorithm =
+  | EncryptionAlgorithm.RSA_2048_PKCS1
+  | EncryptionAlgorithm.RSA_2048_OAEP_SHA1
+  | EncryptionAlgorithm.RSA_4096_PKCS1
+  | EncryptionAlgorithm.RSA_4096_OAEP_SHA1;
+
 export type GenerateKeyPairOptions = {
   /**
    * The algorithm type of the key to generate.
@@ -65,7 +74,7 @@ export type GenerateKeyPairOptions = {
    * @platform android 🤖
    */
   preferStrongBox?: boolean;
-}
+};
 
 type BaseAuthOptions = {
   /**
@@ -87,7 +96,7 @@ type BaseAuthOptions = {
    * @platform android 🤖
    */
   authMethod?: AuthMethod;
-}
+};
 
 type BaseSigningOptions = {
   /**