mask-privacy 4.2.0 → 4.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mask-privacy",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Enterprise-grade AI Data Loss Prevention (DLP) SDK for TypeScript",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/core/fpe.ts

@@ -91,39 +91,44 @@ async function _getBijectiveTweak(): Promise<Buffer> {
 async function _encryptBijectiveFF1(text: string): Promise<bigint> {
   const canonical = text.toLowerCase().trim();
   const hash = crypto.createHash('sha256').update(canonical, 'utf-8').digest();
-  // Hash to 64-bit int, then to 20-digit string
-  const inputInt = hash.readBigUInt64BE(0);
-  const inputStr = inputInt.toString().padStart(20, '0');
+  
+  // Upgrade to 128-bit entropy (16 bytes) to prevent collisions in enterprise datasets.
+  const hash128 = hash.subarray(0, 16);
+  // BigInt in JS handles 128-bit integers natively.
+  const inputInt = hash128.readBigUInt64BE(0) << 64n | hash128.readBigUInt64BE(8);
+  const inputStr = inputInt.toString().padStart(40, '0');
   
   const aesKey = await _getAesKey();
   const tweak = await _getBijectiveTweak();
   const engine = new FF1(aesKey, tweak, 10);
   
   const cipherStr = engine.encrypt(inputStr);
-  return BigInt(cipherStr) % (2n ** 64n);
+  return BigInt(cipherStr);
 }
 
 function _renderBijectivePerson(bits: bigint): string {
-  const firstIdx = Number(bits & 0x7FFn);          // 11 bits (2048)
-  const connIdx = Number((bits >> 11n) & 0x3Fn);    // 6 bits (64)
-  const rootIdx = Number((bits >> 17n) & 0xFFFn);    // 12 bits (4096)
-  const suffixIdx = Number((bits >> 29n) & 0x1FFn); // 9 bits (512)
-  const tag = Number((bits >> 38n) & 0x3FFFn);      // 14 bits (16384)
-  const formatIdx = Number((bits >> 52n) & 0xFn);   // 4 bits (16)
+  // Bit allocation (128-bit space): 
+  // First(11) + Conn(6) + Root(12) + Suffix(9) + Tag(40) + Format(4) = 82 bits
+  const firstIdx = Number(bits & 0x7FFn);
+  const connIdx = Number((bits >> 11n) & 0x3Fn);
+  const rootIdx = Number((bits >> 17n) & 0xFFFn);
+  const suffixIdx = Number((bits >> 29n) & 0x1FFn);
+  const tag = bits >> 38n & 0xFFFFFFFFFFn;
+  const formatIdx = Number((bits >> 78n) & 0xFn);
 
   const first = _BIJECTIVE_NAMES[firstIdx % _BIJECTIVE_NAMES.length];
   const conn = _BIJECTIVE_CONNECTORS[connIdx % _BIJECTIVE_CONNECTORS.length];
   const root = _BIJECTIVE_ROOTS[rootIdx % _BIJECTIVE_ROOTS.length];
   const suffix = _BIJECTIVE_SUFFIXES[suffixIdx % _BIJECTIVE_SUFFIXES.length];
   const surname = `${root}${suffix}`;
-  const numeric = tag % 10000;
-
-  const paddedNumeric = numeric.toString().padStart(4, '0');
+  
+  // Expanded 10-digit tag (33 bits of entropy) ensures enterprise-grade collision avoidance.
+  const numeric = Number(tag % 10000000000n);
+  const paddedNumeric = numeric.toString().padStart(10, '0');
 
   if (formatIdx === 0) return `${first} ${conn} ${surname}-${paddedNumeric}`;
   if (formatIdx === 1) return `${surname}, ${first}-${paddedNumeric}`;
   if (formatIdx === 2) return `${first[0]}. ${surname}-${paddedNumeric}`;
-  if (formatIdx === 3) return `${first} ${surname}-${paddedNumeric}`;
   
   return `${first} ${surname}-${paddedNumeric}`;
 }
@@ -132,10 +137,10 @@ function _renderBijectiveLocation(bits: bigint): string {
   const s1 = Number(bits & 0x3FFn);
   const s2 = Number((bits >> 10n) & 0x3FFn);
   const s3 = Number((bits >> 20n) & 0x3FFn);
-  const tag = Number((bits >> 30n) & 0xFFFn);
+  const tag = bits >> 30n & 0xFFFFFFFFFFn;
 
   const city = `${_BIJECTIVE_SYLLABLES[s1 % 1000]}${_BIJECTIVE_SYLLABLES[s2 % 1000].toLowerCase()}${_BIJECTIVE_SYLLABLES[s3 % 1000].toLowerCase()}`;
-  return `${city}-${tag.toString().padStart(3, '0')}`;
+  return `${city}-${(Number(tag % 10000000000n)).toString().padStart(10, '0')}`;
 }
 
 function _computeLuhnDigit(partialNum: string): string {
@@ -154,6 +159,22 @@ function _computeLuhnDigit(partialNum: string): string {
     return ((10 - (sum % 10)) % 10).toString();
 }
 
+export function _getLuhnSum(numStr: string): number {
+    const digits = numStr.split("").map(Number);
+    let sum = 0;
+    let shouldDouble = false; // Index 15 is W1
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let digit = digits[i];
+        if (shouldDouble) {
+            digit *= 2;
+            if (digit > 9) digit -= 9;
+        }
+        sum += digit;
+        shouldDouble = !shouldDouble;
+    }
+    return sum;
+}
+
 function _computeEsIdCheck(num: number): string {
   return "TRWAGMYFPDXBNJZSQVHLCKE"[num % 23];
 }
@@ -206,16 +227,20 @@ export async function generateDPToken(rawText: string, entityType: string = 'UNK
   if (type === "CREDIT_CARD" || type === "CREDIT_CARD_NUMBER") {
     const digits = _stripCcSeparators(text);
     if (digits.length === 16) {
-      const bin6 = digits.slice(0, 6);
-      const last4 = digits.slice(12, 16);
-      const middle6 = digits.slice(6, 12);
+      // PCI DSS v4.0.3.3 Compliance: Reveal First 6 and Last 4 ONLY.
+      // Luhn-sum correction ensures downstream validity without disclosing middle data.
+      const prefix6 = digits.slice(0, 6);
+      const suffix4 = digits.slice(12, 16);
+      const middle5 = digits.slice(6, 11);
       
       const engine = new FF1(await _getAesKey(), Buffer.from("CREDIT_CARD"), 10);
-      const encMiddle = engine.encrypt(middle6);
+      const encMiddle5 = engine.encrypt(middle5);
+      
+      const draft = prefix6 + encMiddle5 + '0' + suffix4;
+      const sum = _getLuhnSum(draft);
+      const correction = (10 - (sum % 10)) % 10;
       
-      const base15 = bin6 + encMiddle + last4.slice(0, 3);
-      const checkDig = _computeLuhnDigit(base15);
-      const full = bin6 + encMiddle + last4.slice(0, 3) + checkDig;
+      const full = prefix6 + encMiddle5 + correction.toString() + suffix4;
       return `${full.slice(0, 4)}-${full.slice(4, 8)}-${full.slice(8, 12)}-${full.slice(12, 16)}`;
     } else {
       const fallbackDigits = digits.padEnd(16, '0').slice(0, 16);

package/src/core/fpe_utils.ts

@@ -18,7 +18,7 @@ export const TOKEN_PATTERN = new RegExp(
   "|\\b000\\d{5}[A-Z]\\b" +                                        // Spanish DNI token
   "|[A-Z]{2}00[A-F0-9]{4,16}" +                                    // IBAN token
   "|<(?:PER|LOC|ORG):[^>]+>" +                                     // NLP Semantic tokens V4
-  "|\\b[A-Z][a-zA-Z, ]+-[0-9]{3,4}\\b" +                           // Bijective Name/Loc
+  "|\\b[A-Z][a-zA-Z, ]+-[0-9]{3,10}\\b" +                          // Bijective Name/Loc
   "|\\[TKN-[^\\]]+\\]",                                            // Opaque
   "g"
 );
@@ -84,7 +84,7 @@ export function looksLikeToken(value: string | any): boolean {
   if (v.includes("-") && v.length >= 6) {
     const parts = v.split("-");
     const tag = parts[parts.length - 1];
-    if (tag.length === 4 && /^\d+$/.test(tag)) {
+    if (tag.length >= 3 && tag.length <= 10 && /^\d+$/.test(tag)) {
         return true;
     }
   }
@@ -130,8 +130,8 @@ export function isUnambiguouslySafeToken(value: string | any): boolean {
   // Opaque fallback tokens: [TKN-...]
   if (v.startsWith("[TKN-") && v.endsWith("]")) return true;
 
-  // Bijective Name/Location tokens: always end -DDDD (synthetic pattern)
-  if (/^[A-Z][a-zA-Z, ]+-[0-9]{3,4}$/.test(v)) return true;
+  // Bijective Name/Location tokens: end with synthetic numeric tag
+  if (/^[A-Z][a-zA-Z, ]+-[0-9]{3,10}$/.test(v)) return true;
 
   // NOTE: Raw SSN (\d{3}-\d{2}-\d{4}), CC (\d{4}-\d{4}-\d{4}-\d{4}),
   // and routing (\d{9}) patterns are intentionally EXCLUDED because real

package/tests/bijective_fpe.test.ts

@@ -93,7 +93,7 @@ describe('BijectiveFPEIntegration', () => {
     // Pattern: Name Surname-Tag (4 digits)
     expect(res).toContain("-");
     const parts = res.split("-");
-    expect(parts[parts.length - 1].length).toBe(4);
+    expect(parts[parts.length - 1].length).toBe(10);
   });
 
   test('test_location_synthesis', async () => {
@@ -102,6 +102,6 @@ describe('BijectiveFPEIntegration', () => {
     // Pattern: CityName-Tag (12 bits -> 3-4 digits)
     expect(res).toContain("-");
     const tag = res.split("-").pop()!;
-    expect(tag.length).toBeGreaterThanOrEqual(3);
+    expect(tag.length).toBe(10);
   });
 });

package/tests/compliance_pci.test.ts

@@ -0,0 +1,53 @@
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { generateDPToken, resetMasterKey, _getLuhnSum } from '../src/core/fpe';
+
+describe('CompliancePCIChecks', () => {
+  beforeEach(() => {
+    resetMasterKey();
+    process.env.MASK_MASTER_KEY = "compliance-remediation-test-key";
+    process.env.MASK_TENANT_ID = "pci-auditor";
+    process.env.MASK_BIJECTIVE_MODE = "true";
+  });
+
+  afterEach(() => {
+    resetMasterKey();
+  });
+
+  test('test_pci_dss_v4_6_plus_4_compliance', async () => {
+    /** Verify that CC tokenization reveals exactly the first 6 and last 4 digits. */
+    const rawCc = "4111-2222-3333-4444";
+    const token = await generateDPToken(rawCc);
+    
+    const digits = token.replace(/-/g, "");
+    // BIN (First 6)
+    expect(digits.slice(0, 6)).toBe("411122");
+    // Identity (Last 4)
+    expect(digits.slice(12)).toBe("4444");
+    
+    // Middle 6 must be masked/encrypted
+    expect(digits.slice(6, 12)).not.toBe("223333");
+  });
+
+  test('test_luhn_preservation', async () => {
+    /** Verify that the generated CC tokens are Luhn-valid identifiers. */
+    const rawCc = "4111-2222-3333-4444";
+    const token = await generateDPToken(rawCc);
+    const digits = token.replace(/-/g, "");
+    
+    // Standard Luhn check
+    const sum = _getLuhnSum(digits);
+    expect(sum % 10).toBe(0);
+  });
+
+  test('test_bijective_entropy_expansion', async () => {
+    /** Verify that bijective names use 10-digit tags (128-bit entropy). */
+    const name = "Robert Oppenheimer";
+    const token = await generateDPToken(name, "PERSON");
+    
+    const parts = token.split("-");
+    const tag = parts[parts.length - 1];
+    
+    expect(tag.length).toBe(10);
+    expect(/^\d+$/.test(tag)).toBe(true);
+  });
+});

package/tests/fpe.test.ts

@@ -44,8 +44,8 @@ describe('TestFPETokenGeneration', () => {
     const digits = token.replace(/-/g, '');
     // BIN (first 6) must be preserved.
     expect(digits.slice(0, 6)).toBe('411111');
-    // Last 3 digits of the last 4 must be preserved (the last digit is the Luhn check).
-    expect(digits.slice(12, 15)).toBe('111');
+    // Last 4 digits (1111) must be preserved from original.
+    expect(digits.slice(12, 16)).toBe('1111');
     // Middle 6 must be randomized.
     expect(digits.slice(6, 12)).not.toBe('111111');
   });