react-native-quick-crypto 1.0.0-beta.20 → 1.0.0-beta.21

package/cpp/ec/HybridEcKeyPair.cpp

@@ -0,0 +1,428 @@
+#include <NitroModules/ArrayBuffer.hpp>
+#include <NitroModules/Promise.hpp>
+#include <memory>
+#include <openssl/bio.h>
+#include <openssl/buffer.h>
+#include <openssl/ec.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/obj_mac.h>
+#include <openssl/pem.h>
+#include <openssl/sha.h>
+#include <stdexcept>
+#include <string>
+
+// OpenSSL EC parameter encoding constants
+#ifndef OPENSSL_EC_EXPLICIT_CURVE
+#define OPENSSL_EC_EXPLICIT_CURVE 0x000
+#endif
+#ifndef OPENSSL_EC_NAMED_CURVE
+#define OPENSSL_EC_NAMED_CURVE 0x001
+#endif
+
+#include "HybridEcKeyPair.hpp"
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+std::shared_ptr<Promise<void>> HybridEcKeyPair::generateKeyPair() {
+  return Promise<void>::async([this]() { this->generateKeyPairSync(); });
+}
+
+void HybridEcKeyPair::generateKeyPairSync() {
+  if (this->curve.empty()) {
+    throw std::runtime_error("EC curve not set. Call setCurve() first.");
+  }
+
+  // Clean up existing key if any
+  if (this->pkey != nullptr) {
+    EVP_PKEY_free(this->pkey);
+    this->pkey = nullptr;
+  }
+
+  // Get curve NID from curve name
+  int curve_nid = GetCurveFromName(this->curve.c_str());
+  if (curve_nid == NID_undef) {
+    throw std::runtime_error("Invalid or unsupported curve: " + this->curve);
+  }
+
+  std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> key_ctx(nullptr, EVP_PKEY_CTX_free);
+
+  // Handle special curves (Ed25519, X25519, etc.)
+  switch (curve_nid) {
+    case EVP_PKEY_ED25519:
+    case EVP_PKEY_ED448:
+    case EVP_PKEY_X25519:
+    case EVP_PKEY_X448:
+      key_ctx.reset(EVP_PKEY_CTX_new_id(curve_nid, nullptr));
+      break;
+    default: {
+      // Standard EC curves
+      std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> param_ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), EVP_PKEY_CTX_free);
+
+      if (!param_ctx) {
+        throw std::runtime_error("Failed to create parameter context");
+      }
+
+      if (EVP_PKEY_paramgen_init(param_ctx.get()) <= 0) {
+        throw std::runtime_error("Failed to initialize parameter generation");
+      }
+
+      if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(param_ctx.get(), curve_nid) <= 0) {
+        throw std::runtime_error("Failed to set curve NID");
+      }
+
+      if (EVP_PKEY_CTX_set_ec_param_enc(param_ctx.get(), OPENSSL_EC_NAMED_CURVE) <= 0) {
+        throw std::runtime_error("Failed to set parameter encoding");
+      }
+
+      EVP_PKEY* raw_params = nullptr;
+      if (EVP_PKEY_paramgen(param_ctx.get(), &raw_params) <= 0) {
+        throw std::runtime_error("Failed to generate parameters");
+      }
+
+      std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)> key_params(raw_params, EVP_PKEY_free);
+      key_ctx.reset(EVP_PKEY_CTX_new(key_params.get(), nullptr));
+      break;
+    }
+  }
+
+  if (!key_ctx) {
+    throw std::runtime_error("Failed to create key generation context");
+  }
+
+  if (EVP_PKEY_keygen_init(key_ctx.get()) <= 0) {
+    throw std::runtime_error("Failed to initialize key generation");
+  }
+
+  EVP_PKEY* raw_pkey = nullptr;
+  if (EVP_PKEY_keygen(key_ctx.get(), &raw_pkey) <= 0) {
+    throw std::runtime_error("Failed to generate EC key pair");
+  }
+
+  this->pkey = raw_pkey;
+}
+
+KeyObject HybridEcKeyPair::importKey(const std::string& format, const std::shared_ptr<ArrayBuffer>& keyData,
+                                     const std::string& /* algorithm */, bool /* extractable */,
+                                     const std::vector<std::string>& /* keyUsages */) {
+  // Clean up any existing key
+  if (this->pkey != nullptr) {
+    EVP_PKEY_free(this->pkey);
+    this->pkey = nullptr;
+  }
+  // Reset curve state to avoid interference between different uses
+  this->curve.clear();
+
+  // Import key from DER format
+  if (format != "der") {
+    throw std::runtime_error("Only DER format is supported for key import");
+  }
+
+  const unsigned char* keyPtr = static_cast<const unsigned char*>(keyData->data());
+  size_t keyLen = keyData->size();
+
+  // Try to import as public key first (SPKI format)
+  EVP_PKEY* pkey = d2i_PUBKEY(nullptr, &keyPtr, keyLen);
+
+  if (!pkey) {
+    // Reset pointer and try as private key (PKCS8 format)
+    keyPtr = static_cast<const unsigned char*>(keyData->data());
+
+    // Try PKCS8 format for private keys
+    BIO* pkcs8_bio = BIO_new_mem_buf(keyData->data(), static_cast<int>(keyData->size()));
+    if (pkcs8_bio) {
+      PKCS8_PRIV_KEY_INFO* p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(pkcs8_bio, nullptr);
+      if (p8inf != nullptr) {
+        EVP_PKEY* pkcs8_pkey = EVP_PKCS82PKEY(p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        BIO_free(pkcs8_bio);
+        if (pkcs8_pkey != nullptr) {
+          this->pkey = pkcs8_pkey;
+          KeyObject keyObj;
+          return keyObj;
+        }
+      }
+      BIO_free(pkcs8_bio);
+    }
+
+    // Try to parse as SPKI (public key) with BIO
+    BIO* spki_bio = BIO_new_mem_buf(keyData->data(), static_cast<int>(keyData->size()));
+    if (spki_bio) {
+      EVP_PKEY* spki_pkey = d2i_PUBKEY_bio(spki_bio, nullptr);
+      BIO_free(spki_bio);
+      if (spki_pkey != nullptr) {
+        this->pkey = spki_pkey;
+        KeyObject keyObj;
+        return keyObj;
+      }
+    }
+
+    throw std::runtime_error("Failed to import EC key from DER data");
+  }
+
+  this->pkey = pkey;
+
+  // Return a placeholder KeyObject - this would need proper implementation
+  // For now, we just need the key imported into this->pkey for sign/verify
+  KeyObject keyObj;
+  return keyObj;
+}
+
+std::shared_ptr<ArrayBuffer> HybridEcKeyPair::exportKey(const KeyObject& key, const std::string& format) {
+  // Suppress unused parameter warning
+  (void)key;
+
+  if (!this->pkey) {
+    throw std::runtime_error("No key pair generated");
+  }
+
+  if (format == "der-spki") {
+    // Export public key in DER SPKI format
+    int len = i2d_PUBKEY(this->pkey, nullptr);
+    if (len <= 0) {
+      throw std::runtime_error("Failed to get public key DER length");
+    }
+
+    std::vector<unsigned char> derData(len);
+    unsigned char* ptr = derData.data();
+    i2d_PUBKEY(this->pkey, &ptr);
+    return ToNativeArrayBuffer(std::string(derData.begin(), derData.end()));
+  } else if (format == "der-pkcs8") {
+    // Export private key in DER PKCS8 format
+    BIO* bio = BIO_new(BIO_s_mem());
+    if (!bio) {
+      throw std::runtime_error("Failed to create BIO for private key export");
+    }
+
+    if (i2d_PKCS8PrivateKey_bio(bio, this->pkey, nullptr, nullptr, 0, nullptr, nullptr) != 1) {
+      BIO_free(bio);
+      throw std::runtime_error("Failed to export private key to DER PKCS8 format");
+    }
+
+    BUF_MEM* mem;
+    BIO_get_mem_ptr(bio, &mem);
+    std::string derData(mem->data, mem->length);
+    BIO_free(bio);
+
+    return ToNativeArrayBuffer(derData);
+  } else if (format == "pem-spki") {
+    // Export public key in PEM SPKI format
+    BIO* bio = BIO_new(BIO_s_mem());
+    if (!bio) {
+      throw std::runtime_error("Failed to create BIO for public key export");
+    }
+
+    if (PEM_write_bio_PUBKEY(bio, this->pkey) != 1) {
+      BIO_free(bio);
+      throw std::runtime_error("Failed to export public key to PEM SPKI format");
+    }
+
+    BUF_MEM* mem;
+    BIO_get_mem_ptr(bio, &mem);
+    std::string pemData(mem->data, mem->length);
+    BIO_free(bio);
+
+    return ToNativeArrayBuffer(pemData);
+  } else if (format == "pem-pkcs8") {
+    // Export private key in PEM PKCS8 format
+    BIO* bio = BIO_new(BIO_s_mem());
+    if (!bio) {
+      throw std::runtime_error("Failed to create BIO for private key export");
+    }
+
+    if (PEM_write_bio_PKCS8PrivateKey(bio, this->pkey, nullptr, nullptr, 0, nullptr, nullptr) != 1) {
+      BIO_free(bio);
+      throw std::runtime_error("Failed to export private key to PEM PKCS8 format");
+    }
+
+    BUF_MEM* mem;
+    BIO_get_mem_ptr(bio, &mem);
+    std::string pemData(mem->data, mem->length);
+    BIO_free(bio);
+
+    return ToNativeArrayBuffer(pemData);
+  }
+
+  throw std::runtime_error("Unsupported export format: " + format);
+}
+
+std::shared_ptr<ArrayBuffer> HybridEcKeyPair::getPublicKey() {
+  this->checkKeyPair();
+
+  // Export as DER format using direct OpenSSL calls
+  BIO* bio = BIO_new(BIO_s_mem());
+  if (!bio) {
+    throw std::runtime_error("Failed to create BIO for public key export");
+  }
+
+  if (i2d_PUBKEY_bio(bio, this->pkey) != 1) {
+    BIO_free(bio);
+    throw std::runtime_error("Failed to export public key to DER format");
+  }
+
+  BUF_MEM* mem;
+  BIO_get_mem_ptr(bio, &mem);
+
+  // Create a string from the DER data and use ToNativeArrayBuffer utility
+  std::string derData(mem->data, mem->length);
+  BIO_free(bio);
+
+  return ToNativeArrayBuffer(derData);
+}
+
+std::shared_ptr<ArrayBuffer> HybridEcKeyPair::getPrivateKey() {
+  if (this->pkey == nullptr) {
+    throw std::runtime_error("No private key available");
+  }
+
+  // Export private key in PKCS8 DER format
+  BIO* bio = BIO_new(BIO_s_mem());
+  if (i2d_PKCS8PrivateKey_bio(bio, this->pkey, nullptr, nullptr, 0, nullptr, nullptr) != 1) {
+    BIO_free(bio);
+    throw std::runtime_error("Failed to export private key");
+  }
+
+  BUF_MEM* mem;
+  BIO_get_mem_ptr(bio, &mem);
+  std::string derData(mem->data, mem->length);
+  BIO_free(bio);
+
+  return ToNativeArrayBuffer(derData);
+}
+
+void HybridEcKeyPair::setCurve(const std::string& curve) {
+  this->curve = curve;
+}
+
+int HybridEcKeyPair::GetCurveFromName(const char* name) {
+  // Handle NIST curve name mappings first
+  std::string curve_name(name);
+  if (curve_name == "P-256") {
+    return NID_X9_62_prime256v1;
+  } else if (curve_name == "P-384") {
+    return NID_secp384r1;
+  } else if (curve_name == "P-521") {
+    return NID_secp521r1;
+  } else if (curve_name == "secp256k1") {
+    return NID_secp256k1;
+  }
+
+  // Try standard OpenSSL name resolution
+  int nid = OBJ_txt2nid(name);
+  if (nid == NID_undef) {
+    // Try short names
+    nid = OBJ_sn2nid(name);
+  }
+  if (nid == NID_undef) {
+    // Try long names
+    nid = OBJ_ln2nid(name);
+  }
+  return nid;
+}
+
+std::shared_ptr<ArrayBuffer> HybridEcKeyPair::sign(const std::shared_ptr<ArrayBuffer>& data, const std::string& hashAlgorithm) {
+  this->checkKeyPair();
+
+  // Get the hash algorithm EVP_MD
+  const EVP_MD* md = nullptr;
+  if (hashAlgorithm == "SHA-256") {
+    md = EVP_sha256();
+  } else if (hashAlgorithm == "SHA-384") {
+    md = EVP_sha384();
+  } else if (hashAlgorithm == "SHA-512") {
+    md = EVP_sha512();
+  } else if (hashAlgorithm == "SHA-1") {
+    md = EVP_sha1();
+  } else {
+    throw std::runtime_error("Unsupported hash algorithm: " + hashAlgorithm);
+  }
+
+  // Create signing context
+  std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)> md_ctx(EVP_MD_CTX_new(), EVP_MD_CTX_free);
+  if (!md_ctx) {
+    throw std::runtime_error("Failed to create message digest context");
+  }
+
+  // Initialize signing
+  if (EVP_DigestSignInit(md_ctx.get(), nullptr, md, nullptr, this->pkey) <= 0) {
+    throw std::runtime_error("Failed to initialize ECDSA signing");
+  }
+
+  // Update with data
+  if (EVP_DigestSignUpdate(md_ctx.get(), data->data(), data->size()) <= 0) {
+    throw std::runtime_error("Failed to update ECDSA signing with data");
+  }
+
+  // Get signature length
+  size_t sig_len = 0;
+  if (EVP_DigestSignFinal(md_ctx.get(), nullptr, &sig_len) <= 0) {
+    throw std::runtime_error("Failed to get ECDSA signature length");
+  }
+
+  // Allocate signature buffer
+  std::vector<uint8_t> signature(sig_len);
+
+  // Get the actual signature
+  if (EVP_DigestSignFinal(md_ctx.get(), signature.data(), &sig_len) <= 0) {
+    throw std::runtime_error("Failed to generate ECDSA signature");
+  }
+
+  // Resize to actual signature length
+  signature.resize(sig_len);
+
+  // Convert to ArrayBuffer
+  return ToNativeArrayBuffer(std::string(signature.begin(), signature.end()));
+}
+
+bool HybridEcKeyPair::verify(const std::shared_ptr<ArrayBuffer>& data, const std::shared_ptr<ArrayBuffer>& signature,
+                             const std::string& hashAlgorithm) {
+  this->checkKeyPair();
+
+  // Get the hash algorithm EVP_MD
+  const EVP_MD* md = nullptr;
+  if (hashAlgorithm == "SHA-256") {
+    md = EVP_sha256();
+  } else if (hashAlgorithm == "SHA-384") {
+    md = EVP_sha384();
+  } else if (hashAlgorithm == "SHA-512") {
+    md = EVP_sha512();
+  } else if (hashAlgorithm == "SHA-1") {
+    md = EVP_sha1();
+  } else {
+    throw std::runtime_error("Unsupported hash algorithm: " + hashAlgorithm);
+  }
+
+  // Create verification context
+  std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)> md_ctx(EVP_MD_CTX_new(), EVP_MD_CTX_free);
+  if (!md_ctx) {
+    throw std::runtime_error("Failed to create message digest context");
+  }
+
+  // Initialize verification
+  if (EVP_DigestVerifyInit(md_ctx.get(), nullptr, md, nullptr, this->pkey) <= 0) {
+    throw std::runtime_error("Failed to initialize ECDSA verification");
+  }
+
+  // Update with data
+  if (EVP_DigestVerifyUpdate(md_ctx.get(), data->data(), data->size()) <= 0) {
+    throw std::runtime_error("Failed to update ECDSA verification with data");
+  }
+
+  // Verify signature
+  int result = EVP_DigestVerifyFinal(md_ctx.get(), static_cast<const unsigned char*>(signature->data()), signature->size());
+
+  if (result < 0) {
+    throw std::runtime_error("ECDSA verification failed with error");
+  }
+
+  return result == 1;
+}
+
+void HybridEcKeyPair::checkKeyPair() {
+  if (this->pkey == nullptr) {
+    throw std::runtime_error("EC KeyPair not initialized");
+  }
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/ec/HybridEcKeyPair.hpp

@@ -0,0 +1,48 @@
+#include <memory>
+#include <openssl/ec.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/obj_mac.h>
+#include <string>
+
+#include "HybridEcKeyPairSpec.hpp"
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+class HybridEcKeyPair : public HybridEcKeyPairSpec {
+ public:
+  HybridEcKeyPair() : HybridObject(TAG) {}
+  ~HybridEcKeyPair() {
+    if (pkey != nullptr) {
+      EVP_PKEY_free(pkey);
+      pkey = nullptr;
+    }
+  }
+
+ public:
+  // Methods
+  std::shared_ptr<Promise<void>> generateKeyPair() override;
+  void generateKeyPairSync() override;
+  KeyObject importKey(const std::string& format, const std::shared_ptr<ArrayBuffer>& keyData, const std::string& algorithm,
+                      bool extractable, const std::vector<std::string>& keyUsages) override;
+  std::shared_ptr<ArrayBuffer> exportKey(const KeyObject& key, const std::string& format) override;
+  std::shared_ptr<ArrayBuffer> getPublicKey() override;
+  std::shared_ptr<ArrayBuffer> getPrivateKey() override;
+
+  void setCurve(const std::string& curve) override;
+  std::shared_ptr<ArrayBuffer> sign(const std::shared_ptr<ArrayBuffer>& data, const std::string& hashAlgorithm) override;
+  bool verify(const std::shared_ptr<ArrayBuffer>& data, const std::shared_ptr<ArrayBuffer>& signature,
+              const std::string& hashAlgorithm) override;
+
+ protected:
+  void checkKeyPair();
+
+ private:
+  std::string curve;
+  EVP_PKEY* pkey = nullptr;
+
+  static int GetCurveFromName(const char* name);
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/ed25519/HybridEdKeyPair.cpp

@@ -1,10 +1,64 @@
+#include <NitroModules/ArrayBuffer.hpp>
 #include <memory>
+#include <openssl/evp.h>
 #include <string>
 
 #include "HybridEdKeyPair.hpp"
 
 namespace margelo::nitro::crypto {
 
+std::shared_ptr<ArrayBuffer> HybridEdKeyPair::diffieHellman(const std::shared_ptr<ArrayBuffer>& privateKey,
+                                                            const std::shared_ptr<ArrayBuffer>& publicKey) {
+  using EVP_PKEY_ptr = std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>;
+  using EVP_PKEY_CTX_ptr = std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)>;
+
+  // 1. Create EVP_PKEY for private key (our key)
+  EVP_PKEY_ptr pkey_priv(EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, privateKey->data(), privateKey->size()), EVP_PKEY_free);
+  if (!pkey_priv) {
+    throw std::runtime_error("Failed to create private key: " + getOpenSSLError());
+  }
+
+  // 2. Create EVP_PKEY for public key (peer's key)
+  EVP_PKEY_ptr pkey_pub(EVP_PKEY_new_raw_public_key(EVP_PKEY_X25519, NULL, publicKey->data(), publicKey->size()), EVP_PKEY_free);
+  if (!pkey_pub) {
+    throw std::runtime_error("Failed to create public key: " + getOpenSSLError());
+  }
+
+  // 3. Create the context for the key exchange
+  EVP_PKEY_CTX_ptr ctx(EVP_PKEY_CTX_new_from_pkey(NULL, pkey_priv.get(), NULL), EVP_PKEY_CTX_free);
+  if (!ctx) {
+    throw std::runtime_error("Failed to create key exchange context: " + getOpenSSLError());
+  }
+
+  // 4. Initialize the context
+  if (EVP_PKEY_derive_init(ctx.get()) <= 0) {
+    throw std::runtime_error("Failed to initialize key exchange: " + getOpenSSLError());
+  }
+
+  // 5. Provide the peer's public key
+  if (EVP_PKEY_derive_set_peer(ctx.get(), pkey_pub.get()) <= 0) {
+    throw std::runtime_error("Failed to set peer key: " + getOpenSSLError());
+  }
+
+  // 6. Determine the size of the shared secret
+  size_t shared_secret_len;
+  if (EVP_PKEY_derive(ctx.get(), NULL, &shared_secret_len) <= 0) {
+    throw std::runtime_error("Failed to determine shared secret length: " + getOpenSSLError());
+  }
+
+  // 7. Allocate memory for the shared secret
+  auto shared_secret = new uint8_t[shared_secret_len];
+
+  // 8. Derive the shared secret
+  if (EVP_PKEY_derive(ctx.get(), shared_secret, &shared_secret_len) <= 0) {
+    delete[] shared_secret;
+    throw std::runtime_error("Failed to derive shared secret: " + getOpenSSLError());
+  }
+
+  // 9. Return a newly-created ArrayBuffer from the raw buffer w/ cleanup
+  return std::make_shared<NativeArrayBuffer>(shared_secret, shared_secret_len, [=]() { delete[] shared_secret; });
+}
+
 std::shared_ptr<Promise<void>> HybridEdKeyPair::generateKeyPair(double publicFormat, double publicType, double privateFormat,
                                                                 double privateType, const std::optional<std::string>& cipher,
                                                                 const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
@@ -22,6 +76,19 @@ std::shared_ptr<Promise<void>> HybridEdKeyPair::generateKeyPair(double publicFor
 void HybridEdKeyPair::generateKeyPairSync(double publicFormat, double publicType, double privateFormat, double privateType,
                                           const std::optional<std::string>& cipher,
                                           const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
+
+  if (this->curve.empty()) {
+    throw std::runtime_error("EC curve not set. Call setCurve() first.");
+  }
+
+  // Clean up existing key if any
+  if (this->pkey != nullptr) {
+    EVP_PKEY_free(this->pkey);
+    this->pkey = nullptr;
+  }
+
   EVP_PKEY_CTX* pctx;
 
   // key context
@@ -62,6 +129,8 @@ std::shared_ptr<Promise<std::shared_ptr<ArrayBuffer>>> HybridEdKeyPair::sign(con
 
 std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<ArrayBuffer>& message,
                                                        const std::optional<std::shared_ptr<ArrayBuffer>>& key) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
 
   size_t sig_len = 0;
   uint8_t* sig = NULL;
@@ -74,18 +143,18 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
   // key context
   md_ctx = EVP_MD_CTX_new();
   if (md_ctx == nullptr) {
-    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating signing context");
   }
 
   pkey_ctx = EVP_PKEY_CTX_new_from_name(nullptr, this->curve.c_str(), nullptr);
   if (pkey_ctx == nullptr) {
-    EVP_PKEY_CTX_free(pkey_ctx);
+    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating signing context: " + this->curve);
   }
 
   if (EVP_DigestSignInit(md_ctx, &pkey_ctx, NULL, NULL, pkey) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    EVP_PKEY_CTX_free(pkey_ctx);
     char* err = ERR_error_string(ERR_get_error(), NULL);
     throw std::runtime_error("Failed to initialize signing: " + std::string(err));
   }
@@ -100,6 +169,7 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
   // Actually calculate the signature
   if (EVP_DigestSign(md_ctx, sig, &sig_len, message.get()->data(), message.get()->size()) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    delete[] sig;
     throw std::runtime_error("Failed to calculate signature");
   }
 
@@ -108,6 +178,7 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
 
   // Clean up
   EVP_MD_CTX_free(md_ctx);
+  // Note: pkey_ctx is freed automatically by EVP_MD_CTX_free when using EVP_DigestSignInit
 
   return signature;
 }
@@ -129,6 +200,9 @@ std::shared_ptr<Promise<bool>> HybridEdKeyPair::verify(const std::shared_ptr<Arr
 
 bool HybridEdKeyPair::verifySync(const std::shared_ptr<ArrayBuffer>& signature, const std::shared_ptr<ArrayBuffer>& message,
                                  const std::optional<std::shared_ptr<ArrayBuffer>>& key) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
+
   // get key to use for verifying
   EVP_PKEY* pkey = this->importPublicKey(key);
 
@@ -138,18 +212,18 @@ bool HybridEdKeyPair::verifySync(const std::shared_ptr<ArrayBuffer>& signature,
   // key context
   md_ctx = EVP_MD_CTX_new();
   if (md_ctx == nullptr) {
-    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating verify context");
   }
 
   pkey_ctx = EVP_PKEY_CTX_new_from_name(nullptr, this->curve.c_str(), nullptr);
   if (pkey_ctx == nullptr) {
-    EVP_PKEY_CTX_free(pkey_ctx);
+    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating verify context: " + this->curve);
   }
 
   if (EVP_DigestVerifyInit(md_ctx, &pkey_ctx, NULL, NULL, pkey) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    EVP_PKEY_CTX_free(pkey_ctx);
     char* err = ERR_error_string(ERR_get_error(), NULL);
     throw std::runtime_error("Failed to initialize verify: " + std::string(err));
   }

package/cpp/ed25519/HybridEdKeyPair.hpp

@@ -8,14 +8,21 @@
 
 namespace margelo::nitro::crypto {
 
-using namespace facebook;
-
 class HybridEdKeyPair : public HybridEdKeyPairSpec {
  public:
   HybridEdKeyPair() : HybridObject(TAG) {}
+  ~HybridEdKeyPair() {
+    if (pkey != nullptr) {
+      EVP_PKEY_free(pkey);
+      pkey = nullptr;
+    }
+  }
 
  public:
   // Methods
+  std::shared_ptr<ArrayBuffer> diffieHellman(const std::shared_ptr<ArrayBuffer>& privateKey,
+                                             const std::shared_ptr<ArrayBuffer>& publicKey) override;
+
   std::shared_ptr<Promise<void>> generateKeyPair(double publicFormat, double publicType, double privateFormat, double privateType,
                                                  const std::optional<std::string>& cipher,
                                                  const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) override;