internxt-crypto 0.0.13 → 1.0.0

package/README.md

@@ -43,16 +43,15 @@ Builds the app for production to the `build` folder.
 
 ### Key Management
 
-- **`derive-key`** - Key derivation functions for deriving cryptographic keys from passwords (ARGON2) and base key (BLAKE3 in KDF mode)
+- **`derive-key`** - Key derivation functions for deriving cryptographic keys from base key (BLAKE3 in KDF mode)
+- **`derive-password`** - Key derivation functions for deriving cryptographic keys from passwords (ARGON2)
 - **`key-wrapper`** - Key wrapping and unwrapping functions for secure symmetric key storage and transport
 - **`keystore-crypto`** - Keystore cryptographic operations for securing user's keys
-- **`keystore-service`** - Keystore management service for communicating with the server
 
 ### Email Security
 
 - **`email-crypto`** - End-to-end email encryption and decryption using hybrid cryptography and password-protection
 - **`email-search`** - Email indexing on the client side to enable search while preserving privacy
-- **`email-service`** - Email management service for communicating with the server
 
 ### Infrastructure
 
@@ -65,109 +64,82 @@ Builds the app for production to the `build` folder.
 
 ```typescript
 import {
-  asymmetric,
-  symmetric,
-  utils,
-  emailCrypto,
-  pq,
-  keystoreService,
-  deriveKey,
-  hash,
+  generateEccKeys,
+  deriveSecretKey,
+  UTF8ToUint8,
+  genSymmetricKey,
+  encryptSymmetrically,
 } from 'internxt-crypto';
 
 // Asymmetric encryption
-const keysAlice = await asymmetric.generateEccKeys();
-const keysBob = await asymmetric.generateEccKeys();
-const resultAlice = await asymmetric.deriveSecretKey(keysBob.publicKey, keysAlice.privateKey);
-const resultBob = await asymmetric.deriveSecretKey(keysAlice.publicKey, keysBob.privateKey);
+const keysAlice = await generateEccKeys();
+const keysBob = await generateEccKeys();
+const resultAlice = await deriveSecretKey(keysBob.publicKey, keysAlice.privateKey);
+const resultBob = await deriveSecretKey(keysAlice.publicKey, keysBob.privateKey);
 expect(resultAlice).toStrictEqual(resultBob);
 
 // Symmetric encryption
-const data = utils.UTF8ToUint8('Sensitive information to encrypt'); // convert to Uint8Array 
+const data = UTF8ToUint8('Sensitive information to encrypt'); // convert to Uint8Array 
 const additionalData = 'Additional non-secret data';
-const key = await symmetric.genSymmetricCryptoKey(); // CryptoKey 
-const ciphertext: Uint8Array = await symmetric.encryptSymmetrically(key, data, additionalData);
-const plainText = await symmetric.decryptSymmetrically(encryptionKey, ciphertext, additionalData);
+const key = genSymmetricKey(); 
+const ciphertext: Uint8Array = await encryptSymmetrically(key, data, additionalData);
+const plainText = await decryptSymmetrically(encryptionKey, ciphertext, additionalData);
 expect(data).toStrictEqual(plainText);
 
 // Post qunatum cryptography
-const keys = pq.generateKyberKeys();
-const { cipherText, sharedSecret } = pq.encapsulateKyber(keys.publicKey);
-const result = pq.decapsulateKyber(cipherText, keys.secretKey);
+const keys = generateKyberKeys();
+const { cipherText, sharedSecret } = encapsulateKyber(keys.publicKey);
+const result = decapsulateKyber(cipherText, keys.secretKey);
 expect(result).toStrictEqual(sharedSecret);
 
 // Hash
-const result = await hash.hashData(['']);
+const result = hashData(['']);
 const expectedResult = 'af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262';
 expect(result).toStrictEqual(expectedResult);
 
 // Key derivation
 const context = 'BLAKE3 2019-12-27 16:29:52 test vectors context';
-const baseKey = symmetric.genSymmetricKey();  // Uint8Array 
-const key = await deriveKey.deriveSymmetricCryptoKeyFromContext(context, baseKey);
-expect(key).instanceOf(CryptoKey);
+const baseKey = genSymmetricKey(); 
+const key = deriveSymmetricKeyFromContext(context, baseKey);
 
+// Key derivation from password
 const password = 'your password';
-const { keyHex, saltHex } = await deriveKey.getKeyFromPasswordHex(password);
-const result = await deriveKey.verifyKeyFromPasswordHex(password, saltHex, keyHex);
-expect(result).toBe(true);
+const { key, salt } = await getKeyFromPassword(password);
 
 // Hybrid email encryption
-
-const emailBody: EmailBody = {
+const email: EmailBody = {
     text: 'email text',
-    createdAt: '2025-06-14T08:11:22.000Z',
-    labels: ['label 1', 'label2'],
-};
-
-const userAlice = {
-    email: 'alice email',
-    name: 'alice',
+    subject: 'email subject',
 };
-
-const userBob = {
+const { secretKey: bobPrivateKeys, publicKey: bobPublicKeys } = await generateEmailKeys();
+const bobWithPublicKeys = {
     email: 'bob email',
-    name: 'bob',
+    publicHybridKey: bobPublicKeys,
 };
-const { privateKeys: alicePrivateKeys, publicKeys: alicePublicKeys } = await emailCrypto.generateEmailKeys();
-const { privateKeys: bobPrivateKeys, publicKeys: bobPublicKeys } = await emailCrypto.generateEmailKeys();
+const encryptedEmail = await encryptEmailHybrid(email, bobWithPublicKeys);
+const decryptedEmail = await decryptEmailHybrid(encryptedEmail, bobPrivateKeys);
 
-const emailBody: EmailBody = {
-  text: 'email body',
-};
-
-const emailParams: EmailPublicParameters = {
-  labels: ['label 1', 'label2'],
-  createdAt: '2025-06-14T08:11:22.000Z',
-  subject: 'email subject',
-  sender: userAlice,
-  recipient: userBob,
-  replyToEmailID: generateUuid(),
-};
-
-const email: Email = {
-  id:  generateUuid(),
-  params: emailParams,
-  body: emailBody,
-};
-const encryptedEmail = await emailCrypto.encryptEmailHybrid(email, bobPublicKeys, alicePrivateKeys);
-const decryptedEmail = await emailCrypto.decryptEmailHybrid(encryptedEmail, alicePublicKeys, bobPrivateKeys);
-expect(decryptedEmail).toStrictEqual(email);
+expect(encryptedEmail.encEmailBody.encSubject).not.toBe(email.subject);
+expect(decryptedEmailBody).toStrictEqual(email);
 
 
 // password-protected email
 const sharedSecret = 'secret shared between Alice and Bob';
-const encryptedEmail = await emailCrypto.createPwdProtectedEmail(email, sharedSecret);
-const decryptedEmail = await emailCrypto.decryptPwdProtectedEmail(encryptedEmail, sharedSecret);
+const encryptedEmail = await createPwdProtectedEmail(email, sharedSecret);
+const decryptedEmail = await decryptPwdProtectedEmail(encryptedEmail, sharedSecret);
 expect(decryptedEmail).toStrictEqual(email);
 
 // keystore
-
-// For this to work, session storage must have UserID and baseKey
-const { encryptionKeystore, recoveryKeystore, recoveryCodes } = await createEncryptionAndRecoveryKeystores();
-const result_enc = await keystoreService.openEncryptionKeystore(encryptionKeystore);
-const result_rec = await keystoreService.openRecoveryKeystore(recoveryCodes, recoveryKeystore); 
-expect(result_enc).toStrictEqual(result_rec);
+const userEmail = 'user email';
+const secretKey = genSymmetricKey();
+const { encryptionKeystore, recoveryKeystore, recoveryCodes } = await createEncryptionAndRecoveryKeystores(
+      userEmail,
+      secretKey,
+    );
+const resultEnc = await openEncryptionKeystore(encryptionKeystore, secretKey);
+const resultRec = await openRecoveryKeystore(recoveryCodes, recoveryKeystore);
+
+expect(resultEnc).toStrictEqual(resultRec);
 
 // Email storage and search
 

package/dist/aes-B8TA-JKq.mjs

@@ -0,0 +1,49 @@
+import { AES_KEY_BYTE_LENGTH, IV_LEN_BYTES } from "./constants.mjs";
+import { concatBytes, randomBytes } from "@noble/hashes/utils.js";
+import { gcm } from "@noble/ciphers/webcrypto.js";
+
+//#region src/symmetric-crypto/aes.ts
+/**
+* Symmetrically encrypts the message
+*
+* @param encryptionKey - The symmetric key used for message encryption
+* @param message - The message to encrypt
+* @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.
+* @returns The resulting ciphertext.
+*/
+async function encryptSymmetrically(encryptionKey, message, aux) {
+	try {
+		const iv = randomBytes(IV_LEN_BYTES);
+		return concatBytes(await gcm(encryptionKey, iv, aux).encrypt(message), iv);
+	} catch (error) {
+		throw new Error("Failed to encrypt symmetrically", { cause: error });
+	}
+}
+/**
+* Decryps symmetrically encrypted message
+*
+* @param encryptionKey - The symmetric key used for message encryption
+* @param encryptedMessage - The ciphertext
+* @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.
+* @returns The resulting ciphertext.
+*/
+async function decryptSymmetrically(encryptionKey, encryptedMessage, aux) {
+	try {
+		const ciphertext = encryptedMessage.slice(0, encryptedMessage.length - IV_LEN_BYTES);
+		return await gcm(encryptionKey, encryptedMessage.slice(encryptedMessage.length - IV_LEN_BYTES), aux).decrypt(ciphertext);
+	} catch (error) {
+		throw new Error("Failed to decrypt symmetrically", { cause: error });
+	}
+}
+/**
+* Generates symmetric key as Uint8Array
+*
+* @returns The generated Uint8Array.
+*/
+function genSymmetricKey() {
+	return randomBytes(AES_KEY_BYTE_LENGTH);
+}
+
+//#endregion
+export { encryptSymmetrically as n, genSymmetricKey as r, decryptSymmetrically as t };
+//# sourceMappingURL=aes-B8TA-JKq.mjs.map

package/dist/aes-B8TA-JKq.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-B8TA-JKq.mjs","names":["aeadCipher"],"sources":["../src/symmetric-crypto/aes.ts"],"sourcesContent":["import { concatBytes, randomBytes } from '@noble/hashes/utils.js';\nimport { IV_LEN_BYTES, AES_KEY_BYTE_LENGTH } from '../constants';\nimport { gcm as aeadCipher } from '@noble/ciphers/webcrypto.js';\n\n/**\n * Symmetrically encrypts the message\n *\n * @param encryptionKey - The symmetric key used for message encryption\n * @param message - The message to encrypt\n * @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.\n * @returns The resulting ciphertext.\n */\nexport async function encryptSymmetrically(\n  encryptionKey: Uint8Array,\n  message: Uint8Array,\n  aux?: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const iv = randomBytes(IV_LEN_BYTES);\n    const ciphertext = await aeadCipher(encryptionKey, iv, aux).encrypt(message);\n    return concatBytes(ciphertext, iv);\n  } catch (error) {\n    throw new Error('Failed to encrypt symmetrically', { cause: error });\n  }\n}\n\n/**\n * Decryps symmetrically encrypted message\n *\n * @param encryptionKey - The symmetric key used for message encryption\n * @param encryptedMessage - The ciphertext\n * @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.\n * @returns The resulting ciphertext.\n */\nexport async function decryptSymmetrically(\n  encryptionKey: Uint8Array,\n  encryptedMessage: Uint8Array,\n  aux?: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const ciphertext = encryptedMessage.slice(0, encryptedMessage.length - IV_LEN_BYTES);\n    const iv = encryptedMessage.slice(encryptedMessage.length - IV_LEN_BYTES);\n    const result = await aeadCipher(encryptionKey, iv, aux).decrypt(ciphertext);\n    return result;\n  } catch (error) {\n    throw new Error('Failed to decrypt symmetrically', { cause: error });\n  }\n}\n\n/**\n * Generates symmetric key as Uint8Array\n *\n * @returns The generated Uint8Array.\n */\nexport function genSymmetricKey(): Uint8Array {\n  return randomBytes(AES_KEY_BYTE_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,eAAsB,qBACpB,eACA,SACA,KACqB;AACrB,KAAI;EACF,MAAM,KAAK,YAAY,aAAa;AAEpC,SAAO,YADY,MAAMA,IAAW,eAAe,IAAI,IAAI,CAAC,QAAQ,QAAQ,EAC7C,GAAG;UAC3B,OAAO;AACd,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYxE,eAAsB,qBACpB,eACA,kBACA,KACqB;AACrB,KAAI;EACF,MAAM,aAAa,iBAAiB,MAAM,GAAG,iBAAiB,SAAS,aAAa;AAGpF,SADe,MAAMA,IAAW,eADrB,iBAAiB,MAAM,iBAAiB,SAAS,aAAa,EACtB,IAAI,CAAC,QAAQ,WAAW;UAEpE,OAAO;AACd,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASxE,SAAgB,kBAA8B;AAC5C,QAAO,YAAY,oBAAoB"}

package/dist/aes-CuW_SPl-.js

@@ -0,0 +1,67 @@
+const require_chunk = require('./chunk-EbLFQX5m.js');
+const require_constants = require('./constants.js');
+let _noble_hashes_utils_js = require("@noble/hashes/utils.js");
+let _noble_ciphers_webcrypto_js = require("@noble/ciphers/webcrypto.js");
+
+//#region src/symmetric-crypto/aes.ts
+/**
+* Symmetrically encrypts the message
+*
+* @param encryptionKey - The symmetric key used for message encryption
+* @param message - The message to encrypt
+* @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.
+* @returns The resulting ciphertext.
+*/
+async function encryptSymmetrically(encryptionKey, message, aux) {
+	try {
+		const iv = (0, _noble_hashes_utils_js.randomBytes)(require_constants.IV_LEN_BYTES);
+		return (0, _noble_hashes_utils_js.concatBytes)(await (0, _noble_ciphers_webcrypto_js.gcm)(encryptionKey, iv, aux).encrypt(message), iv);
+	} catch (error) {
+		throw new Error("Failed to encrypt symmetrically", { cause: error });
+	}
+}
+/**
+* Decryps symmetrically encrypted message
+*
+* @param encryptionKey - The symmetric key used for message encryption
+* @param encryptedMessage - The ciphertext
+* @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.
+* @returns The resulting ciphertext.
+*/
+async function decryptSymmetrically(encryptionKey, encryptedMessage, aux) {
+	try {
+		const ciphertext = encryptedMessage.slice(0, encryptedMessage.length - require_constants.IV_LEN_BYTES);
+		return await (0, _noble_ciphers_webcrypto_js.gcm)(encryptionKey, encryptedMessage.slice(encryptedMessage.length - require_constants.IV_LEN_BYTES), aux).decrypt(ciphertext);
+	} catch (error) {
+		throw new Error("Failed to decrypt symmetrically", { cause: error });
+	}
+}
+/**
+* Generates symmetric key as Uint8Array
+*
+* @returns The generated Uint8Array.
+*/
+function genSymmetricKey() {
+	return (0, _noble_hashes_utils_js.randomBytes)(require_constants.AES_KEY_BYTE_LENGTH);
+}
+
+//#endregion
+Object.defineProperty(exports, 'decryptSymmetrically', {
+  enumerable: true,
+  get: function () {
+    return decryptSymmetrically;
+  }
+});
+Object.defineProperty(exports, 'encryptSymmetrically', {
+  enumerable: true,
+  get: function () {
+    return encryptSymmetrically;
+  }
+});
+Object.defineProperty(exports, 'genSymmetricKey', {
+  enumerable: true,
+  get: function () {
+    return genSymmetricKey;
+  }
+});
+//# sourceMappingURL=aes-CuW_SPl-.js.map

package/dist/aes-CuW_SPl-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-CuW_SPl-.js","names":["IV_LEN_BYTES","AES_KEY_BYTE_LENGTH"],"sources":["../src/symmetric-crypto/aes.ts"],"sourcesContent":["import { concatBytes, randomBytes } from '@noble/hashes/utils.js';\nimport { IV_LEN_BYTES, AES_KEY_BYTE_LENGTH } from '../constants';\nimport { gcm as aeadCipher } from '@noble/ciphers/webcrypto.js';\n\n/**\n * Symmetrically encrypts the message\n *\n * @param encryptionKey - The symmetric key used for message encryption\n * @param message - The message to encrypt\n * @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.\n * @returns The resulting ciphertext.\n */\nexport async function encryptSymmetrically(\n  encryptionKey: Uint8Array,\n  message: Uint8Array,\n  aux?: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const iv = randomBytes(IV_LEN_BYTES);\n    const ciphertext = await aeadCipher(encryptionKey, iv, aux).encrypt(message);\n    return concatBytes(ciphertext, iv);\n  } catch (error) {\n    throw new Error('Failed to encrypt symmetrically', { cause: error });\n  }\n}\n\n/**\n * Decryps symmetrically encrypted message\n *\n * @param encryptionKey - The symmetric key used for message encryption\n * @param encryptedMessage - The ciphertext\n * @param aux - The auxilary string (e.g., context string or timestamp) for AEAD.\n * @returns The resulting ciphertext.\n */\nexport async function decryptSymmetrically(\n  encryptionKey: Uint8Array,\n  encryptedMessage: Uint8Array,\n  aux?: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const ciphertext = encryptedMessage.slice(0, encryptedMessage.length - IV_LEN_BYTES);\n    const iv = encryptedMessage.slice(encryptedMessage.length - IV_LEN_BYTES);\n    const result = await aeadCipher(encryptionKey, iv, aux).decrypt(ciphertext);\n    return result;\n  } catch (error) {\n    throw new Error('Failed to decrypt symmetrically', { cause: error });\n  }\n}\n\n/**\n * Generates symmetric key as Uint8Array\n *\n * @returns The generated Uint8Array.\n */\nexport function genSymmetricKey(): Uint8Array {\n  return randomBytes(AES_KEY_BYTE_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;;;;AAYA,eAAsB,qBACpB,eACA,SACA,KACqB;AACrB,KAAI;EACF,MAAM,6CAAiBA,+BAAa;AAEpC,iDADmB,2CAAiB,eAAe,IAAI,IAAI,CAAC,QAAQ,QAAQ,EAC7C,GAAG;UAC3B,OAAO;AACd,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYxE,eAAsB,qBACpB,eACA,kBACA,KACqB;AACrB,KAAI;EACF,MAAM,aAAa,iBAAiB,MAAM,GAAG,iBAAiB,SAASA,+BAAa;AAGpF,SADe,2CAAiB,eADrB,iBAAiB,MAAM,iBAAiB,SAASA,+BAAa,EACtB,IAAI,CAAC,QAAQ,WAAW;UAEpE,OAAO;AACd,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASxE,SAAgB,kBAA8B;AAC5C,gDAAmBC,sCAAoB"}

package/dist/asymmetric-crypto.d.mts

@@ -2,43 +2,20 @@
 /**
  * Derives secret key from the other user's public key and own private key
  *
- * @param otherUserPublicKey - The public key of the other user
- * @param ownPrivateKey - The private key
+ * @param aliceSecretKey - The secret key of the user deriving the shared secret key
+ * @param bobPublicKey - The public key of the other user
  * @returns The derived secret key bits
  */
-declare function deriveSecretKey(otherUserPublicKey: CryptoKey, ownPrivateKey: CryptoKey): Promise<Uint8Array>;
-//#endregion
-//#region src/asymmetric-crypto/keys.d.ts
+declare function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array>;
 /**
  * Generates elliptic curve key pair
  *
  * @returns The generated key pair
  */
-declare function generateEccKeys(): Promise<CryptoKeyPair>;
-/**
- * Converts public CryptoKey into Uint8Array using SubjectPublicKeyInfo format (RFC 5280)
- *
- * @returns The Uint8Array representation of the public key
- */
-declare function exportPublicKey(key: CryptoKey): Promise<Uint8Array>;
-/**
- * Converts public key in SubjectPublicKeyInfo format (RFC 5280) to CryptoKey
- *
- * @returns The CryptoKey representation of the public key
- */
-declare function importPublicKey(spkiKeyData: Uint8Array): Promise<CryptoKey>;
-/**
- * Converts private key in CryptoKey to PKCS #8 format (RFC 5208)
- *
- * @returns The Uint8Array representation of the private key
- */
-declare function exportPrivateKey(key: CryptoKey): Promise<Uint8Array>;
-/**
- * Converts private key in PKCS #8 format (RFC 5208) to CryptoKey
- *
- * @returns The CryptoKey representation of the private key
- */
-declare function importPrivateKey(pkcs8KeyData: Uint8Array): Promise<CryptoKey>;
+declare function generateEccKeys(): Promise<{
+  secretKey: Uint8Array;
+  publicKey: Uint8Array;
+}>;
 //#endregion
-export { deriveSecretKey, exportPrivateKey, exportPublicKey, generateEccKeys, importPrivateKey, importPublicKey };
+export { deriveSecretKey, generateEccKeys };
 //# sourceMappingURL=asymmetric-crypto.d.mts.map

package/dist/asymmetric-crypto.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"asymmetric-crypto.d.mts","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts","../src/asymmetric-crypto/keys.ts"],"mappings":";;AASA;;;;;;iBAAsB,eAAA,CAAgB,kBAAA,EAAoB,SAAA,EAAW,aAAA,EAAe,SAAA,GAAY,OAAA,CAAQ,UAAA;;;;AAAxG;;;;iBCFsB,eAAA,CAAA,GAAmB,OAAA,CAAQ,aAAA;;;;;;iBAmB3B,eAAA,CAAgB,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,UAAA;;;;;;iBAczC,eAAA,CAAgB,WAAA,EAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;;;;AAjCxE;;iBAsDsB,gBAAA,CAAiB,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,UAAA;;;AAnChE;;;iBAiDsB,gBAAA,CAAiB,YAAA,EAAc,UAAA,GAAa,OAAA,CAAQ,SAAA"}
+{"version":3,"file":"asymmetric-crypto.d.mts","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"mappings":";;AASA;;;;;;iBAAsB,eAAA,CAAgB,cAAA,EAAgB,UAAA,EAAY,YAAA,EAAc,UAAA,GAAa,OAAA,CAAQ,UAAA;;;;;;iBAa/E,eAAA,CAAA,GAAmB,OAAA;EAAU,SAAA,EAAW,UAAA;EAAY,SAAA,EAAW,UAAA;AAAA"}

package/dist/asymmetric-crypto.d.ts

@@ -2,43 +2,20 @@
 /**
  * Derives secret key from the other user's public key and own private key
  *
- * @param otherUserPublicKey - The public key of the other user
- * @param ownPrivateKey - The private key
+ * @param aliceSecretKey - The secret key of the user deriving the shared secret key
+ * @param bobPublicKey - The public key of the other user
  * @returns The derived secret key bits
  */
-declare function deriveSecretKey(otherUserPublicKey: CryptoKey, ownPrivateKey: CryptoKey): Promise<Uint8Array>;
-//#endregion
-//#region src/asymmetric-crypto/keys.d.ts
+declare function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array>;
 /**
  * Generates elliptic curve key pair
  *
  * @returns The generated key pair
  */
-declare function generateEccKeys(): Promise<CryptoKeyPair>;
-/**
- * Converts public CryptoKey into Uint8Array using SubjectPublicKeyInfo format (RFC 5280)
- *
- * @returns The Uint8Array representation of the public key
- */
-declare function exportPublicKey(key: CryptoKey): Promise<Uint8Array>;
-/**
- * Converts public key in SubjectPublicKeyInfo format (RFC 5280) to CryptoKey
- *
- * @returns The CryptoKey representation of the public key
- */
-declare function importPublicKey(spkiKeyData: Uint8Array): Promise<CryptoKey>;
-/**
- * Converts private key in CryptoKey to PKCS #8 format (RFC 5208)
- *
- * @returns The Uint8Array representation of the private key
- */
-declare function exportPrivateKey(key: CryptoKey): Promise<Uint8Array>;
-/**
- * Converts private key in PKCS #8 format (RFC 5208) to CryptoKey
- *
- * @returns The CryptoKey representation of the private key
- */
-declare function importPrivateKey(pkcs8KeyData: Uint8Array): Promise<CryptoKey>;
+declare function generateEccKeys(): Promise<{
+  secretKey: Uint8Array;
+  publicKey: Uint8Array;
+}>;
 //#endregion
-export { deriveSecretKey, exportPrivateKey, exportPublicKey, generateEccKeys, importPrivateKey, importPublicKey };
+export { deriveSecretKey, generateEccKeys };
 //# sourceMappingURL=asymmetric-crypto.d.ts.map

package/dist/asymmetric-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asymmetric-crypto.d.ts","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts","../src/asymmetric-crypto/keys.ts"],"mappings":";;AASA;;;;;;iBAAsB,eAAA,CAAgB,kBAAA,EAAoB,SAAA,EAAW,aAAA,EAAe,SAAA,GAAY,OAAA,CAAQ,UAAA;;;;AAAxG;;;;iBCFsB,eAAA,CAAA,GAAmB,OAAA,CAAQ,aAAA;;;;;;iBAmB3B,eAAA,CAAgB,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,UAAA;;;;;;iBAczC,eAAA,CAAgB,WAAA,EAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;;;;AAjCxE;;iBAsDsB,gBAAA,CAAiB,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,UAAA;;;AAnChE;;;iBAiDsB,gBAAA,CAAiB,YAAA,EAAc,UAAA,GAAa,OAAA,CAAQ,SAAA"}
+{"version":3,"file":"asymmetric-crypto.d.ts","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"mappings":";;AASA;;;;;;iBAAsB,eAAA,CAAgB,cAAA,EAAgB,UAAA,EAAY,YAAA,EAAc,UAAA,GAAa,OAAA,CAAQ,UAAA;;;;;;iBAa/E,eAAA,CAAA,GAAmB,OAAA;EAAU,SAAA,EAAW,UAAA;EAAY,SAAA,EAAW,UAAA;AAAA"}

package/dist/asymmetric-crypto.js

@@ -1,9 +1,32 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_keys = require('./keys-CinT7kEY.js');
+const require_chunk = require('./chunk-EbLFQX5m.js');
+let _noble_curves_webcrypto_js = require("@noble/curves/webcrypto.js");
 
-exports.deriveSecretKey = require_keys.deriveSecretKey;
-exports.exportPrivateKey = require_keys.exportPrivateKey;
-exports.exportPublicKey = require_keys.exportPublicKey;
-exports.generateEccKeys = require_keys.generateEccKeys;
-exports.importPrivateKey = require_keys.importPrivateKey;
-exports.importPublicKey = require_keys.importPublicKey;
+//#region src/asymmetric-crypto/ellipticCurve.ts
+/**
+* Derives secret key from the other user's public key and own private key
+*
+* @param aliceSecretKey - The secret key of the user deriving the shared secret key
+* @param bobPublicKey - The public key of the other user
+* @returns The derived secret key bits
+*/
+async function deriveSecretKey(aliceSecretKey, bobPublicKey) {
+	try {
+		return await _noble_curves_webcrypto_js.x25519.getSharedSecret(aliceSecretKey, bobPublicKey);
+	} catch (error) {
+		throw new Error("Failed to derive elliptic curve secret key", { cause: error });
+	}
+}
+/**
+* Generates elliptic curve key pair
+*
+* @returns The generated key pair
+*/
+async function generateEccKeys() {
+	return _noble_curves_webcrypto_js.x25519.keygen();
+}
+
+//#endregion
+exports.deriveSecretKey = deriveSecretKey;
+exports.generateEccKeys = generateEccKeys;
+//# sourceMappingURL=asymmetric-crypto.js.map

package/dist/asymmetric-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asymmetric-crypto.js","names":["x25519"],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAMA,kCAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAOA,kCAAO,QAAQ"}

package/dist/asymmetric-crypto.mjs

@@ -1,3 +1,29 @@
-import { a as importPublicKey, i as importPrivateKey, n as exportPublicKey, o as deriveSecretKey, r as generateEccKeys, t as exportPrivateKey } from "./keys-BfcaiAOv.mjs";
+import { x25519 } from "@noble/curves/webcrypto.js";
 
-export { deriveSecretKey, exportPrivateKey, exportPublicKey, generateEccKeys, importPrivateKey, importPublicKey };
+//#region src/asymmetric-crypto/ellipticCurve.ts
+/**
+* Derives secret key from the other user's public key and own private key
+*
+* @param aliceSecretKey - The secret key of the user deriving the shared secret key
+* @param bobPublicKey - The public key of the other user
+* @returns The derived secret key bits
+*/
+async function deriveSecretKey(aliceSecretKey, bobPublicKey) {
+	try {
+		return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);
+	} catch (error) {
+		throw new Error("Failed to derive elliptic curve secret key", { cause: error });
+	}
+}
+/**
+* Generates elliptic curve key pair
+*
+* @returns The generated key pair
+*/
+async function generateEccKeys() {
+	return x25519.keygen();
+}
+
+//#endregion
+export { deriveSecretKey, generateEccKeys };
+//# sourceMappingURL=asymmetric-crypto.mjs.map

package/dist/asymmetric-crypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"asymmetric-crypto.mjs","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAM,OAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAO,OAAO,QAAQ"}

package/dist/constants.d.mts

@@ -1,12 +1,6 @@
 //#region src/constants.d.ts
-declare const AES_ALGORITHM = "AES-GCM";
-declare const AES_KEY_BIT_LENGTH = 256;
-declare const AUX_BYTE_LEN = 16;
-declare const IV_LEN_BYTES = 16;
-declare const KEY_WRAPPING_ALGORITHM = "AES-KW";
-declare const KEY_FORMAT = "raw";
-declare const CONTEXT_WRAPPING = "CRYPTO library 2025-08-22 18:10:00 key derived from ecc and kyber secrets";
-declare const ECC_ALGORITHM = "X25519";
+declare const AES_KEY_BYTE_LENGTH = 32;
+declare const IV_LEN_BYTES = 12;
 declare const CONTEXT_ENC_KEYSTORE = "CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore";
 declare const CONTEXT_RECOVERY = "CRYPTO library 2025-07-30 16:20:00 key for account recovery";
 declare const CONTEXT_INDEX = "CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices";
@@ -16,18 +10,17 @@ declare const ARGON2ID_ITERATIONS = 4;
 declare const ARGON2ID_MEMORY_SIZE = 65536;
 declare const ARGON2ID_SALT_BYTE_LENGTH = 16;
 declare const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;
-declare const KYBER512_PUBLIC_KEY_LENGTH = 800;
-declare const KYBER512_SECRET_KEY_LENGTH = 1632;
 declare const KYBER768_PUBLIC_KEY_LENGTH = 1184;
 declare const KYBER768_SECRET_KEY_LENGTH = 2400;
-declare const KYBER1024_PUBLIC_KEY_LENGTH = 1568;
-declare const KYBER1024_SECRET_KEY_LENGTH = 3168;
 declare const KYBER_SEED_LENGTH = 64;
-declare const HASH_BIT_LEN = 256;
 declare const MAX_CACHE_SIZE = 600000000;
 declare const MAX_EMAIL_PER_BATCH = 100;
 declare const DB_LABEL = "email";
 declare const DB_VERSION = 1;
+declare const XWING_PUBLIC_KEY_LENGTH = 1216;
+declare const XWING_SECRET_KEY_LENGTH = 32;
+declare const XWING_SEED_BYTE_LENGTH = 32;
+declare const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;
 //#endregion
-export { AES_ALGORITHM, AES_KEY_BIT_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, AUX_BYTE_LEN, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, CONTEXT_WRAPPING, DB_LABEL, DB_VERSION, ECC_ALGORITHM, HASH_BIT_LEN, IV_LEN_BYTES, KEY_FORMAT, KEY_WRAPPING_ALGORITHM, KYBER1024_PUBLIC_KEY_LENGTH, KYBER1024_SECRET_KEY_LENGTH, KYBER512_PUBLIC_KEY_LENGTH, KYBER512_SECRET_KEY_LENGTH, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, DB_LABEL, DB_VERSION, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH };
 //# sourceMappingURL=constants.d.mts.map

package/dist/constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.mts","names":[],"sources":["../src/constants.ts"],"mappings":";cAAa,aAAA;AAAA,cACA,kBAAA;AAAA,cACA,YAAA;AAAA,cACA,YAAA;AAAA,cAEA,sBAAA;AAAA,cACA,UAAA;AAAA,cACA,gBAAA;AAAA,cAEA,aAAA;AAAA,cAEA,oBAAA;AAAA,cACA,gBAAA;AAAA,cACA,aAAA;AAAA,cACA,cAAA;AAAA,cAGA,oBAAA;AAAA,cACA,mBAAA;AAAA,cACA,oBAAA;AAAA,cACA,yBAAA;AAAA,cACA,2BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cAEA,2BAAA;AAAA,cACA,2BAAA;AAAA,cAEA,iBAAA;AAAA,cAEA,YAAA;AAAA,cAEA,cAAA;AAAA,cACA,mBAAA;AAAA,cACA,QAAA;AAAA,cACA,UAAA"}
+{"version":3,"file":"constants.d.mts","names":[],"sources":["../src/constants.ts"],"mappings":";cAAa,mBAAA;AAAA,cACA,YAAA;AAAA,cAEA,oBAAA;AAAA,cACA,gBAAA;AAAA,cACA,aAAA;AAAA,cACA,cAAA;AAAA,cAGA,oBAAA;AAAA,cACA,mBAAA;AAAA,cACA,oBAAA;AAAA,cACA,yBAAA;AAAA,cACA,2BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cACA,iBAAA;AAAA,cAEA,cAAA;AAAA,cACA,mBAAA;AAAA,cACA,QAAA;AAAA,cACA,UAAA;AAAA,cAEA,uBAAA;AAAA,cACA,uBAAA;AAAA,cACA,sBAAA;AAAA,cACA,4BAAA"}

package/dist/constants.d.ts

@@ -1,12 +1,6 @@
 //#region src/constants.d.ts
-declare const AES_ALGORITHM = "AES-GCM";
-declare const AES_KEY_BIT_LENGTH = 256;
-declare const AUX_BYTE_LEN = 16;
-declare const IV_LEN_BYTES = 16;
-declare const KEY_WRAPPING_ALGORITHM = "AES-KW";
-declare const KEY_FORMAT = "raw";
-declare const CONTEXT_WRAPPING = "CRYPTO library 2025-08-22 18:10:00 key derived from ecc and kyber secrets";
-declare const ECC_ALGORITHM = "X25519";
+declare const AES_KEY_BYTE_LENGTH = 32;
+declare const IV_LEN_BYTES = 12;
 declare const CONTEXT_ENC_KEYSTORE = "CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore";
 declare const CONTEXT_RECOVERY = "CRYPTO library 2025-07-30 16:20:00 key for account recovery";
 declare const CONTEXT_INDEX = "CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices";
@@ -16,18 +10,17 @@ declare const ARGON2ID_ITERATIONS = 4;
 declare const ARGON2ID_MEMORY_SIZE = 65536;
 declare const ARGON2ID_SALT_BYTE_LENGTH = 16;
 declare const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;
-declare const KYBER512_PUBLIC_KEY_LENGTH = 800;
-declare const KYBER512_SECRET_KEY_LENGTH = 1632;
 declare const KYBER768_PUBLIC_KEY_LENGTH = 1184;
 declare const KYBER768_SECRET_KEY_LENGTH = 2400;
-declare const KYBER1024_PUBLIC_KEY_LENGTH = 1568;
-declare const KYBER1024_SECRET_KEY_LENGTH = 3168;
 declare const KYBER_SEED_LENGTH = 64;
-declare const HASH_BIT_LEN = 256;
 declare const MAX_CACHE_SIZE = 600000000;
 declare const MAX_EMAIL_PER_BATCH = 100;
 declare const DB_LABEL = "email";
 declare const DB_VERSION = 1;
+declare const XWING_PUBLIC_KEY_LENGTH = 1216;
+declare const XWING_SECRET_KEY_LENGTH = 32;
+declare const XWING_SEED_BYTE_LENGTH = 32;
+declare const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;
 //#endregion
-export { AES_ALGORITHM, AES_KEY_BIT_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, AUX_BYTE_LEN, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, CONTEXT_WRAPPING, DB_LABEL, DB_VERSION, ECC_ALGORITHM, HASH_BIT_LEN, IV_LEN_BYTES, KEY_FORMAT, KEY_WRAPPING_ALGORITHM, KYBER1024_PUBLIC_KEY_LENGTH, KYBER1024_SECRET_KEY_LENGTH, KYBER512_PUBLIC_KEY_LENGTH, KYBER512_SECRET_KEY_LENGTH, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, DB_LABEL, DB_VERSION, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH };
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","names":[],"sources":["../src/constants.ts"],"mappings":";cAAa,aAAA;AAAA,cACA,kBAAA;AAAA,cACA,YAAA;AAAA,cACA,YAAA;AAAA,cAEA,sBAAA;AAAA,cACA,UAAA;AAAA,cACA,gBAAA;AAAA,cAEA,aAAA;AAAA,cAEA,oBAAA;AAAA,cACA,gBAAA;AAAA,cACA,aAAA;AAAA,cACA,cAAA;AAAA,cAGA,oBAAA;AAAA,cACA,mBAAA;AAAA,cACA,oBAAA;AAAA,cACA,yBAAA;AAAA,cACA,2BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cAEA,2BAAA;AAAA,cACA,2BAAA;AAAA,cAEA,iBAAA;AAAA,cAEA,YAAA;AAAA,cAEA,cAAA;AAAA,cACA,mBAAA;AAAA,cACA,QAAA;AAAA,cACA,UAAA"}
+{"version":3,"file":"constants.d.ts","names":[],"sources":["../src/constants.ts"],"mappings":";cAAa,mBAAA;AAAA,cACA,YAAA;AAAA,cAEA,oBAAA;AAAA,cACA,gBAAA;AAAA,cACA,aAAA;AAAA,cACA,cAAA;AAAA,cAGA,oBAAA;AAAA,cACA,mBAAA;AAAA,cACA,oBAAA;AAAA,cACA,yBAAA;AAAA,cACA,2BAAA;AAAA,cAEA,0BAAA;AAAA,cACA,0BAAA;AAAA,cACA,iBAAA;AAAA,cAEA,cAAA;AAAA,cACA,mBAAA;AAAA,cACA,QAAA;AAAA,cACA,UAAA;AAAA,cAEA,uBAAA;AAAA,cACA,uBAAA;AAAA,cACA,sBAAA;AAAA,cACA,4BAAA"}