libves 2.3.0 → 2.6.0

package/README.md

@@ -1,47 +1,46 @@
-## libVES
+# libVES
 
+### Browser PIN-based e2e encryption at-rest
+## Simple * Safe * Secure
 
-Simple, safe and secure e2e encryption for data at-rest.
 
+[VESvault.com](https://vesvault.com) | [VES.host](https://ves.host) | [VESlocker.com](https://veslocker.com) | [demo.VES.world](https://demo.ves.world)
 
-https://VESvault.com
 
-https://VES.host
+#### Instantiate libVES
 
+    var VES = new libVES({domain: 'x-myapp'});
 
-; Instantiate libVES
 
-var VES = new libVES({domain: 'x-myapp'});
+#### Authorize with VES in the same browser window
 
+    VES.flow(true).then(....)
 
-; Authorize with VES in the same browser window
 
-VES.flow(true).then(....)
+#### Or, authorize with VES via a popup window
 
+    VES.delegate().then(....)
 
-; Or, authorize in a popup window
 
-VES.delegate().then(....)
+#### Store an e2e encrypted value
 
+    VES.putValue('item-id', 'value')
 
-; Store an e2e encrypted value
 
-VES.putValue('item-id', 'value')
+#### Store a value and e2e share with other VES accounts
 
+    VES.putValue('item-id', 'value', [
+        {externalId: 'me@acme.com'},
+        {externalId: 'user1@acme.com'},
+        {externalId: 'user2@acme.com'}
+    ])
 
-; Store a value and e2e share with other VES accounts
 
-VES.putValue('item-id', 'value', [{externalId: 'me@acme.com'}, {externalId: 'user1@acme.com'}, {externalId: 'user2@acme.com'}])
+#### Retrieve a previously stored value
 
+    VES.getValue('item-id').then(function(value) { .... })
 
-; Retrieve a previously stored value
 
-VES.getValue('item-id').then(function(value) { .... })
-
-
-See https://demo.ves.world
-
-
-Full API Docs:
+### Full API Docs:
 
 https://ves.host/docs/libVES

package/libVES.node.js

@@ -27,7 +27,7 @@
  *
  * @title libVES
  * @dev A JavaScript end-to-end encryption interface to VESvault REST API
- * @version 2.03
+ * @version 2.06
  *
  * @dev Official source code: https://github.com/vesvault/libVES
  *
@@ -429,7 +429,14 @@ libVES.prototype = {
 	    if (self.e2e && self.e2e.length) usr.e2e = self.getVESkeyE2E(veskey, usr);
 	    key.setField('vaultItems', veskey.then(function(v) {
 		var vi = new libVES.VaultItem({type: 'password'}, self);
-		return Promise.all(self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()]).then(function(sh) {
+		return usr.getActiveVaultKeys().then(function() {
+		    return [self.me(), self.getVaultKey(), usr];
+		}).catch(function(e) {
+		    if (e.code != 'NotFound') throw e;
+		    return self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
+		}).then(function(sh) {
+		    return Promise.all(sh);
+		}).then(function(sh) {
 		    return vi.shareWith(sh, v, false).then(function() {
 			return [vi];
 		    });
@@ -1178,7 +1185,17 @@ libVES.Util = {
 	}
     },
     PKCS8: {
-	encode: function(key,optns) {
+	encode: function(key, optns) {
+	    return crypto.subtle.exportKey('pkcs8',key).catch(function(e) {
+		console.log('PKCS8 failed, trying JWK...');
+		return crypto.subtle.exportKey('jwk', key).then(function(jwk) {
+		    return libVES.Util.PKCS8.fromJWK(jwk);
+		});
+	    }).then(function(pkcs8) {
+		return libVES.Util.PKCS8.encode8(pkcs8, optns);
+	    });
+	},
+	encode8: function(pkcs8, optns) {
 	    var ops = {};
 	    for (var k in optns) ops[k] = optns[k];
 	    if (!ops.members) ops.members = [
@@ -1187,24 +1204,17 @@ libVES.Util = {
 	    ];
 	    return Promise.all(ops.members).then(function(ms) {
 		ops.members = ms;
-		return crypto.subtle.exportKey('pkcs8',key).catch(function(e) {
-		    console.log('PKCS8 failed, trying JWK...');
-		    return crypto.subtle.exportKey('jwk', key).then(function(jwk) {
-			return libVES.Util.PKCS8.fromJWK(jwk);
-		    });
-		}).then(function(der) {
-		    ops.content = der;
-		    var rec = [];
-		    if (ops.password) return libVES.Util.PKCS5.export(function(call,optns) {
-			rec[1] = optns.content;
-			return Promise.resolve();
-		    },ops).then(function(data) {
-			rec[0] = data;
-			return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([rec]),'ENCRYPTED PRIVATE KEY');
-		    });
-		    else if (ops.opentext) return libVES.Util.PEM.encode(der,'PRIVATE KEY');
-		    else throw new libVES.Error('Internal','No password for key export (opentext=true to export without password?)');
+		ops.content = pkcs8;
+		var rec = [];
+		if (ops.password) return libVES.Util.PKCS5.export(function(call,optns) {
+		    rec[1] = optns.content;
+		    return Promise.resolve();
+		},ops).then(function(data) {
+		    rec[0] = data;
+		    return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([rec]),'ENCRYPTED PRIVATE KEY');
 		});
+		else if (ops.opentext) return libVES.Util.PEM.encode(pkcs8,'PRIVATE KEY');
+		else throw new libVES.Error('Internal','No password for key export (opentext=true to export without password?)');
 	    });
 	},
 	fromJWK: function(jwk) {
@@ -1399,6 +1409,7 @@ libVES.Util.OID['1.2.840.113549.2.7'] = libVES.getModuleFunc(libVES, ['Util', 'H
 libVES.Util.OID['1.2.840.113549.2.9'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA256']);
 libVES.Util.OID['1.2.840.113549.2.10'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA384']);
 libVES.Util.OID['1.2.840.113549.2.11'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA512']);
+libVES.Util.OID['1.3.6.1.4.1.53675.3.5'] = libVES.getModuleFunc(libVES, ['Algo', 'OQS', 'Util']);
 
 libVES.Math = {
     pad: function(a,n) {
@@ -2107,7 +2118,7 @@ libVES.VaultKey.prototype = new libVES.Object({
 
 libVES.VaultItem.prototype = new libVES.Object({
     apiUri: 'vaultItems',
-    fieldList: {id: true},
+    fieldList: {id: true, deleted: true, file: true},
     fieldClass: {vaultKey: libVES.VaultKey, file: libVES.File},
     fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true}, algo: true, externals: {id: true}}}},{vaultKey: true, file: true}],
     defaultCipher: 'AES256GCM',
@@ -2164,6 +2175,9 @@ libVES.VaultItem.prototype = new libVES.Object({
     getFile: function() {
 	return this.getField('file');
     },
+    getDeleted: function() {
+	return this.getField('deleted');
+    },
     parse: function(buf) {
 	var self = this;
 	return this.getType().then(function(type) {
@@ -2332,7 +2346,7 @@ libVES.VaultItem.Type.password = libVES.VaultItem.Type.string;
 
 libVES.File.prototype = new libVES.Object({
     apiUri: 'files',
-    fieldList: {id: true},
+    fieldList: {id: true, externals: true},
     fieldClass: {externals: libVES.External, creator: libVES.User},
     getExternals: function() {
 	return this.getField('externals');
@@ -3660,4 +3674,184 @@ libVES.Auth.prototype.verify = function(token, auth) {
     });
 };
 
+
+libVES.Algo.OQS = {
+    tag: 'OQS',
+    wasm: function() {
+	if (!this.wasmP) this.wasmP = new Promise(function(resolve, reject) {
+	    if (typeof(WasmOQS) == 'function') return resolve();
+	    var sc = document.createElement('script');
+	    sc.async = false;
+	    sc.src = WasmOQSinit.baseUrl + 'WasmOQS.js';
+	    sc.onload = resolve;
+	    sc.onerror = reject;
+	    document.getElementsByTagName('head')[0].appendChild(sc);
+	}).then(function() {
+	    return WasmOQS(WasmOQSinit);
+	});
+	return this.wasmP;
+    },
+    decrypt: function(k,buf) {
+	return this.wasm().then(function(wasm) {
+	    var b = new Uint8Array(buf);
+	    if (b.byteLength <= k.ctextlen) throw new libVES.Error('InvalidValue', 'Ciphertext is too short');
+	    var secret = wasm.decaps(k, b.slice(0, k.ctextlen));
+	    if (!secret) throw new libVES.Error('InvalidValue', 'OQS decryption error');
+	    return libVES.Algo.OQS.cipher(secret).then(function(ci) {
+		return ci.decrypt(b.slice(k.ctextlen), true).catch(function(e) {
+		    if (e instanceof libVES.Error) throw e;
+		    throw new libVES.Error('InvalidValue', 'Error decrypting ECIES payload: Invalid ciphertext?',{error:e});
+		});
+	    }).catch(function(e) {
+		if (e instanceof libVES.Error) throw e;
+		throw new libVES.Error('InvalidValue', 'Error negotiating ECIES cipher key: Invalid ciphertext?',{error:e});
+	    });
+	})
+    },
+    encrypt: function(k, buf) {
+	return this.wasm().then(function(wasm) {
+	    var ctext = wasm.encaps(k);
+	    if (!ctext) throw new libVES.Error('InvalidValue', 'Error generating OQS secret');
+	    return libVES.Algo.OQS.cipher(wasm.decaps(k)).then(function(ci) {
+		return ci.encrypt(buf, true).then(function(ctext2) {
+		    var buf = new Uint8Array(ctext.byteLength + ctext2.byteLength);
+		    buf.set(new Uint8Array(ctext),0);
+		    buf.set(new Uint8Array(ctext2),ctext.byteLength);
+		    return buf;
+		});
+	    }).catch(function(e) {
+		if (e instanceof libVES.Error) throw e;
+		throw new libVES.Error('InvalidValue', 'Error generating ECIES cipher',{error:e});
+	    });
+	});
+    },
+    cipher: function(secret) {
+	return libVES.getModule(libVES.Cipher,'AES256GCMp').then(function(m) {
+	    return crypto.subtle.digest({name:'SHA-384'}, secret).then(function(buf) {
+		return new m(new Uint8Array(buf).slice(0, m.prototype.keySize + m.prototype.ivSize));
+	    });
+	});
+    },
+    import: function(data,optns) {
+	return libVES.Util.PEM.import(data,optns);
+    },
+    export: function(data, optns) {
+	if (!data || !data.ptr) throw new libVES.Error('Internal', "Unknown type of key object");
+	var pub = new Uint8Array(data.pub.byteLength + 1);
+	pub[0] = 0;
+	pub.set(new Uint8Array(data.pub), 1);
+	pub.ASN1type = 3;
+	var oid = [new libVES.Util.OID(libVES.Algo.OQS.OID), libVES.Util.StringToByteArray(data.algo)];
+	if (data.priv) {
+	    pub = libVES.Util.ASN1.encode([pub]);
+	    pub.ASN1type = 0xa1;
+	    var buf = libVES.Util.ASN1.encode([[1, data.priv, pub]]);
+	    var pkcs8 = libVES.Util.ASN1.encode([[0, oid, buf]]);
+	    return libVES.Util.PKCS8.encode8(pkcs8, optns);
+	}
+	return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([[oid, pub]]), 'PUBLIC KEY');
+    },
+    generate: function(optns) {
+	var algo = optns ? optns.algo : null;
+	if (!algo) algo = this.defaultAlgo;
+	return this.wasm().then(function(wasm) {
+	    var k = wasm.init(algo, true);
+	    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed');
+	    if (!wasm.generate(k)) throw new libVES.Error('Internal', 'OQS generate failed');
+	    var pub = {};
+	    for (var i in k) if (i != 'priv') pub[i] = k[i];
+	    return {privateKey: k, publicKey: pub};
+	});
+    },
+    Util: {
+	import: function(args,chain,optns) {
+	    var algo = libVES.Util.ByteArrayToString(args);
+	    return chain('container').then(function(der) {
+		var asn = libVES.Util.ASN1.decode(der)[0];
+		var pkey = null;
+		var pub = null;
+		if (typeof(asn[0]) == 'number') {
+		    var asn2 = libVES.Util.ASN1.decode(asn[2])[0];
+		    pkey = asn2[1];
+		    pub = libVES.Util.ASN1.decode(asn2[2])[0];
+		} else pkey = asn[1];
+		return libVES.Algo.OQS.wasm().then(function(wasm) {
+		    var k = wasm.init(algo, !!pub);
+		    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed (bad algo?)');
+		    var s = function(dst, src, dif) {
+			if (!dst || !src || dst.byteLength != src.byteLength - dif) throw new libVES.Error('InvalidValue', 'Incorrect OQS key size');
+			dst.set(src.slice(dif), 0);
+		    };
+		    if (pub) {
+			s(k.priv, pkey, 0);
+			s(k.pub, pub, 1);
+		    } else s(k.pub, pkey, 1);
+		    return k;
+		});
+	    });
+	}
+    },
+    OID: '1.3.6.1.4.1.53675.3.5',
+    defaultAlgo: 'Kyber768'
+};
+
+var WasmOQSinit = {
+    init: function(algo, priv) {
+        var a = new Uint8Array(libVES.Util.StringToByteArray(algo));
+        var arg1 = new Uint8Array(this.asm.memory.buffer, 16, 48);
+        arg1.set(a);
+        arg1.set([0], a.byteLength);
+        var ptr = this._WasmOQS_new(arg1.byteOffset, priv);
+        if (!ptr) return null;
+        var key = { ptr: ptr };
+        var priv = this._WasmOQS_priv(ptr);
+        if (priv) key.priv = new Uint8Array(this.asm.memory.buffer, priv, this._WasmOQS_privlen(ptr));
+        key.pub = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_pub(ptr), this._WasmOQS_publen(ptr));
+        key.secretlen = this._WasmOQS_decaps(key.ptr, null, null);
+        key.ctextlen = this._WasmOQS_encaps(key.ptr, null, null);
+        key.algo = algo;
+        return key;
+    },
+    generate: function(key) {
+        return this._WasmOQS_generate(key.ptr) >= 0;
+    },
+    encaps: function(key) {
+        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, this._WasmOQS_encaps(key.ptr, null, null));
+        if (this._WasmOQS_encaps(key.ptr, arg2.byteOffset, arg1.byteOffset) <= 0) return null;
+        key.secret = new Uint8Array(arg1.byteLength);
+        key.secret.set(arg1);
+        var ctext = new Uint8Array(arg2.byteLength);
+        ctext.set(arg2);
+        return ctext;
+    },
+    decaps: function(key, ctext) {
+        if (!ctext) return key.secret;
+        if (ctext.byteLength != this._WasmOQS_encaps(key.ptr, null, null)) return null;
+        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, ctext.byteLength);
+        arg2.set(ctext);
+        if (this._WasmOQS_decaps(key.ptr, arg1.byteOffset, arg2.byteOffset) <= 0) return null;
+        key.secret = new Uint8Array(arg1.byteLength);
+        key.secret.set(arg1);
+        return key.secret;
+    },
+    free: function(key) {
+        this._WasmOQS_free(key.ptr);
+    },
+    test: function(algo) {
+        var k = this.init(algo, 1);
+        this.generate(k);
+        console.log(k);
+        var ctext = this.encaps(k);
+        console.log(k.secret, ctext);
+        var secret = this.decaps(k);
+        console.log(secret);
+    },
+    locateFile: function(file) {
+	return this.baseUrl + file;
+    },
+    baseUrl: 'https://ves.host/pub/'
+};
+
 module.exports = libVES;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libves",
-  "version": "2.3.0",
+  "version": "2.6.0",
   "description": "Simple, safe and secure end-to-end encryption at-rest",
   "main": "libVES.node.js",
   "scripts": {