hd-wallet-wasm 0.1.9 → 0.2.1

package/dist/index.d.ts

@@ -24,6 +24,14 @@ export interface HDWalletModule {
   getSupportedCoins(): string[];
   getSupportedCurves(): string[];
 
+  // OpenSSL FIPS support (when built with HD_WALLET_USE_OPENSSL)
+  /** Initialize OpenSSL in FIPS mode. Returns true if FIPS mode activated, false if using fallback. */
+  initFips(): boolean;
+  /** Check if OpenSSL backend is being used for FIPS algorithms */
+  isOpenSSL(): boolean;
+  /** Check if running in FIPS mode (OpenSSL FIPS provider active) */
+  isOpenSSLFips(): boolean;
+
   // WASI bridge
   wasiHasFeature(feature: WasiFeature): boolean;
   wasiGetWarning(feature: WasiFeature): WasiWarning;
@@ -570,7 +578,7 @@ export interface Keyring {
 // =============================================================================
 
 export interface UtilsAPI {
-  // Hashing
+  // Hashing (sync - Crypto++)
   sha256(data: Uint8Array): Uint8Array;
   sha512(data: Uint8Array): Uint8Array;
   keccak256(data: Uint8Array): Uint8Array;
@@ -584,6 +592,17 @@ export interface UtilsAPI {
   pbkdf2(password: Uint8Array, salt: Uint8Array, iterations: number, length: number): Uint8Array;
   scrypt(password: Uint8Array, salt: Uint8Array, n: number, r: number, p: number, length: number): Uint8Array;
 
+  // AES-GCM encryption/decryption (WASM/OpenSSL)
+  aesGcm: {
+    encrypt(key: Uint8Array, plaintext: Uint8Array, iv: Uint8Array, aad?: Uint8Array): { ciphertext: Uint8Array; tag: Uint8Array };
+    decrypt(key: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, iv: Uint8Array, aad?: Uint8Array): Uint8Array;
+  };
+
+  // Random number generation
+  getRandomBytes(length: number): Uint8Array;
+  generateIv(): Uint8Array;
+  generateAesKey(bits?: number): Uint8Array;
+
   // Encoding
   encodeBase58(data: Uint8Array): string;
   decodeBase58(str: string): Uint8Array;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hd-wallet-wasm",
-  "version": "0.1.9",
+  "version": "0.2.1",
   "description": "Comprehensive HD Wallet implementation in WebAssembly - BIP-32/39/44, multi-curve, multi-chain support",
   "type": "module",
   "main": "src/index.mjs",

package/src/index.d.ts

@@ -24,6 +24,14 @@ export interface HDWalletModule {
   getSupportedCoins(): string[];
   getSupportedCurves(): string[];
 
+  // OpenSSL FIPS support (when built with HD_WALLET_USE_OPENSSL)
+  /** Initialize OpenSSL in FIPS mode. Returns true if FIPS mode activated, false if using fallback. */
+  initFips(): boolean;
+  /** Check if OpenSSL backend is being used for FIPS algorithms */
+  isOpenSSL(): boolean;
+  /** Check if running in FIPS mode (OpenSSL FIPS provider active) */
+  isOpenSSLFips(): boolean;
+
   // WASI bridge
   wasiHasFeature(feature: WasiFeature): boolean;
   wasiGetWarning(feature: WasiFeature): WasiWarning;
@@ -570,7 +578,7 @@ export interface Keyring {
 // =============================================================================
 
 export interface UtilsAPI {
-  // Hashing
+  // Hashing (sync - Crypto++)
   sha256(data: Uint8Array): Uint8Array;
   sha512(data: Uint8Array): Uint8Array;
   keccak256(data: Uint8Array): Uint8Array;
@@ -584,6 +592,17 @@ export interface UtilsAPI {
   pbkdf2(password: Uint8Array, salt: Uint8Array, iterations: number, length: number): Uint8Array;
   scrypt(password: Uint8Array, salt: Uint8Array, n: number, r: number, p: number, length: number): Uint8Array;
 
+  // AES-GCM encryption/decryption (WASM/OpenSSL)
+  aesGcm: {
+    encrypt(key: Uint8Array, plaintext: Uint8Array, iv: Uint8Array, aad?: Uint8Array): { ciphertext: Uint8Array; tag: Uint8Array };
+    decrypt(key: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, iv: Uint8Array, aad?: Uint8Array): Uint8Array;
+  };
+
+  // Random number generation
+  getRandomBytes(length: number): Uint8Array;
+  generateIv(): Uint8Array;
+  generateAesKey(bits?: number): Uint8Array;
+
   // Encoding
   encodeBase58(data: Uint8Array): string;
   decodeBase58(str: string): Uint8Array;

package/src/index.mjs

@@ -9,7 +9,7 @@
  * - Transaction building and signing
  *
  * @module hd-wallet-wasm
- * @version 0.1.0
+ * @version 0.2.0
  */
 
 // Import aligned API for batch operations
@@ -2219,7 +2219,7 @@ function createModule(wasm) {
       }
     },
 
-    // Key derivation
+    // Key derivation (sync - uses Crypto++ in WASM)
     hkdf(ikm, salt, info, length) {
       const ikmPtr = allocAndCopy(wasm, ikm);
       const saltPtr = allocAndCopy(wasm, salt);
@@ -2238,6 +2238,126 @@ function createModule(wasm) {
       }
     },
 
+    // AES-GCM encryption/decryption (uses WASM/Crypto++ or OpenSSL)
+    aesGcm: {
+      /**
+       * Encrypt data with AES-GCM (synchronous WASM)
+       * @param {Uint8Array} key - AES-256 key (32 bytes)
+       * @param {Uint8Array} plaintext - Data to encrypt
+       * @param {Uint8Array} iv - Initialization vector (12 bytes)
+       * @param {Uint8Array} [aad] - Additional authenticated data
+       * @returns {{ciphertext: Uint8Array, tag: Uint8Array}}
+       */
+      encrypt(key, plaintext, iv, aad = new Uint8Array(0)) {
+        if (key.length !== 32) throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Key must be 32 bytes');
+        if (iv.length !== 12) throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'IV must be 12 bytes');
+
+        const keyPtr = allocAndCopy(wasm, key);
+        const ptPtr = allocAndCopy(wasm, plaintext);
+        const ivPtr = allocAndCopy(wasm, iv);
+        const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
+        const ctPtr = wasm._hd_alloc(plaintext.length);
+        const tagPtr = wasm._hd_alloc(16);
+
+        try {
+          const result = wasm._hd_aes_gcm_encrypt(
+            keyPtr, key.length,
+            ptPtr, plaintext.length,
+            ivPtr, iv.length,
+            aadPtr, aad.length,
+            ctPtr, tagPtr
+          );
+          if (result < 0) throw new HDWalletError(-result);
+
+          return {
+            ciphertext: readBytes(wasm, ctPtr, plaintext.length),
+            tag: readBytes(wasm, tagPtr, 16)
+          };
+        } finally {
+          wasm._hd_secure_wipe(keyPtr, key.length);
+          wasm._hd_dealloc(keyPtr);
+          wasm._hd_dealloc(ptPtr);
+          wasm._hd_dealloc(ivPtr);
+          if (aadPtr) wasm._hd_dealloc(aadPtr);
+          wasm._hd_dealloc(ctPtr);
+          wasm._hd_dealloc(tagPtr);
+        }
+      },
+
+      /**
+       * Decrypt data with AES-GCM (synchronous WASM)
+       * @param {Uint8Array} key - AES-256 key (32 bytes)
+       * @param {Uint8Array} ciphertext - Encrypted data
+       * @param {Uint8Array} tag - Authentication tag (16 bytes)
+       * @param {Uint8Array} iv - Initialization vector (12 bytes)
+       * @param {Uint8Array} [aad] - Additional authenticated data
+       * @returns {Uint8Array} Decrypted plaintext
+       * @throws {HDWalletError} If authentication fails
+       */
+      decrypt(key, ciphertext, tag, iv, aad = new Uint8Array(0)) {
+        if (key.length !== 32) throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Key must be 32 bytes');
+        if (iv.length !== 12) throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'IV must be 12 bytes');
+        if (tag.length !== 16) throw new HDWalletError(ErrorCode.INVALID_ARGUMENT, 'Tag must be 16 bytes');
+
+        const keyPtr = allocAndCopy(wasm, key);
+        const ctPtr = allocAndCopy(wasm, ciphertext);
+        const ivPtr = allocAndCopy(wasm, iv);
+        const tagPtr = allocAndCopy(wasm, tag);
+        const aadPtr = aad.length > 0 ? allocAndCopy(wasm, aad) : 0;
+        const ptPtr = wasm._hd_alloc(ciphertext.length);
+
+        try {
+          const result = wasm._hd_aes_gcm_decrypt(
+            keyPtr, key.length,
+            ctPtr, ciphertext.length,
+            ivPtr, iv.length,
+            aadPtr, aad.length,
+            tagPtr, ptPtr
+          );
+          if (result < 0) {
+            throw new HDWalletError(
+              result === -2 ? ErrorCode.VERIFICATION_FAILED : -result,
+              result === -2 ? 'AES-GCM authentication failed' : undefined
+            );
+          }
+
+          return readBytes(wasm, ptPtr, ciphertext.length);
+        } finally {
+          wasm._hd_secure_wipe(keyPtr, key.length);
+          wasm._hd_dealloc(keyPtr);
+          wasm._hd_dealloc(ctPtr);
+          wasm._hd_dealloc(ivPtr);
+          wasm._hd_dealloc(tagPtr);
+          if (aadPtr) wasm._hd_dealloc(aadPtr);
+          wasm._hd_dealloc(ptPtr);
+        }
+      }
+    },
+
+    /** Generate cryptographically secure random bytes */
+    getRandomBytes(length) {
+      const bytes = new Uint8Array(length);
+      if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.getRandomValues) {
+        globalThis.crypto.getRandomValues(bytes);
+      } else {
+        throw new Error('No cryptographic random source available');
+      }
+      return bytes;
+    },
+
+    /** Generate a random IV for AES-GCM (12 bytes) */
+    generateIv() {
+      return this.getRandomBytes(12);
+    },
+
+    /** Generate a random AES key (default 256 bits) */
+    generateAesKey(bits = 256) {
+      if (![128, 192, 256].includes(bits)) {
+        throw new Error('AES key size must be 128, 192, or 256 bits');
+      }
+      return this.getRandomBytes(bits / 8);
+    },
+
     pbkdf2(password, salt, iterations, length) {
       const pwdPtr = allocAndCopy(wasm, password);
       const saltPtr = allocAndCopy(wasm, salt);
@@ -2482,6 +2602,50 @@ function createModule(wasm) {
       return wasm._hd_get_entropy_status();
     },
 
+    // OpenSSL FIPS support
+    /**
+     * Initialize OpenSSL in FIPS mode
+     * @returns {boolean} True if FIPS mode activated, false if using default provider
+     */
+    initFips() {
+      // Check if the function exists (only when built with HD_WALLET_USE_OPENSSL)
+      if (typeof wasm._hd_openssl_init_fips !== 'function') {
+        console.warn('[HD Wallet] OpenSSL not compiled in, skipping FIPS init');
+        return false;
+      }
+      const result = wasm._hd_openssl_init_fips();
+      if (result === 1) {
+        console.log('[HD Wallet] OpenSSL FIPS mode activated');
+        return true;
+      } else if (result === -1) {
+        console.warn('[HD Wallet] FIPS provider not available, using default OpenSSL');
+        wasm._hd_openssl_init_default();
+        return false;
+      } else {
+        console.error('[HD Wallet] Failed to initialize OpenSSL');
+        return false;
+      }
+    },
+
+    /**
+     * Check if OpenSSL backend is being used
+     * @returns {boolean}
+     */
+    isOpenSSL() {
+      return typeof wasm._hd_openssl_init_fips === 'function';
+    },
+
+    /**
+     * Check if running in FIPS mode (OpenSSL FIPS provider active)
+     * @returns {boolean}
+     */
+    isOpenSSLFips() {
+      if (typeof wasm._hd_openssl_is_fips !== 'function') {
+        return false;
+      }
+      return wasm._hd_openssl_is_fips() !== 0;
+    },
+
     // APIs
     mnemonic,
     hdkey,