react-native-quick-crypto 1.0.0-beta.20 → 1.0.0-beta.21

package/src/utils/noble.ts

@@ -0,0 +1,85 @@
+import type { Hex } from './types';
+
+/**
+ * Takes hex string or Uint8Array, converts to Uint8Array.
+ * Validates output length.
+ * Will throw error for other types.
+ * @param title descriptive title for an error e.g. 'private key'
+ * @param hex hex string or Uint8Array
+ * @param expectedLength optional, will compare to result array's length
+ * @returns
+ */
+export function ensureBytes(
+  title: string,
+  hex: Hex,
+  expectedLength?: number,
+): Uint8Array {
+  let res: Uint8Array;
+  if (typeof hex === 'string') {
+    try {
+      res = hexToBytes(hex);
+    } catch (e) {
+      throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);
+    }
+  } else if (isBytes(hex)) {
+    // Uint8Array.from() instead of hash.slice() because node.js Buffer
+    // is instance of Uint8Array, and its slice() creates **mutable** copy
+    res = Uint8Array.from(hex);
+  } else {
+    throw new Error(title + ' must be hex string or Uint8Array');
+  }
+  const len = res.length;
+  if (typeof expectedLength === 'number' && len !== expectedLength)
+    throw new Error(
+      title + ' of length ' + expectedLength + ' expected, got ' + len,
+    );
+  return res;
+}
+
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+export function isBytes(a: unknown): a is Uint8Array {
+  return (
+    a instanceof Uint8Array ||
+    (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array')
+  );
+}
+
+// We use optimized technique to convert hex string to byte array
+const asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 } as const;
+function asciiToBase16(ch: number): number | undefined {
+  if (ch >= asciis._0 && ch <= asciis._9) return ch - asciis._0; // '2' => 50-48
+  if (ch >= asciis.A && ch <= asciis.F) return ch - (asciis.A - 10); // 'B' => 66-(65-10)
+  if (ch >= asciis.a && ch <= asciis.f) return ch - (asciis.a - 10); // 'b' => 98-(97-10)
+  return;
+}
+
+/**
+ * Convert hex string to byte array. Uses built-in function, when available.
+ * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])
+ */
+export function hexToBytes(hex: string): Uint8Array {
+  if (typeof hex !== 'string')
+    throw new Error('hex string expected, got ' + typeof hex);
+  // @ts-expect-error Uint8Array.fromHex
+  if (hasHexBuiltin) return Uint8Array.fromHex(hex);
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new Error('hex string expected, got unpadded hex of length ' + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === undefined || n2 === undefined) {
+      const char = hex.substring(hi, hi + 2);
+      throw new Error(
+        'hex string expected, got non-hex character "' +
+          char +
+          '" at index ' +
+          hi,
+      );
+    }
+    array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163
+  }
+  return array;
+}

package/src/utils/types.ts

@@ -1,7 +1,9 @@
 import type { Buffer as CraftzdogBuffer } from '@craftzdog/react-native-buffer';
+import type { Buffer } from 'buffer';
+import type { CipherKey } from 'node:crypto'; // @types/node
 import type { Buffer as SafeBuffer } from 'safe-buffer';
-import type { CipherKey } from 'crypto'; // @types/node
-import type { KeyObjectHandle } from '../specs/keyObjectHandle.nitro';
+import type { KeyObjectHandle as KeyObjectHandleType } from '../specs/keyObjectHandle.nitro';
+import type { KeyObject, CryptoKey } from '../keys';
 
 export type ABV = TypedArray | DataView | ArrayBufferLike | CraftzdogBuffer;
 
@@ -27,6 +29,7 @@ export type BufferLike =
 
 export type BinaryLike =
   | string
+  | Buffer
   | ArrayBuffer
   | ArrayBufferLike
   | CraftzdogBuffer
@@ -34,7 +37,7 @@ export type BinaryLike =
   | TypedArray
   | DataView;
 
-export type BinaryLikeNode = CipherKey | BinaryLike;
+export type BinaryLikeNode = CipherKey | BinaryLike | KeyObject;
 
 export type DigestAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 
@@ -42,6 +45,20 @@ export type HashAlgorithm = DigestAlgorithm | 'SHA-224' | 'RIPEMD-160';
 
 export type RSAKeyPairAlgorithm = 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' | 'RSA-OAEP';
 
+export interface RsaHashedKeyGenParams {
+  name: RSAKeyPairAlgorithm;
+  modulusLength: number;
+  publicExponent: Uint8Array;
+  hash: string | { name: string };
+}
+
+export interface RsaKeyAlgorithm {
+  name: RSAKeyPairAlgorithm;
+  modulusLength: number;
+  publicExponent: Uint8Array;
+  hash: { name: string };
+}
+
 export type ECKeyPairAlgorithm = 'ECDSA' | 'ECDH';
 
 export type CFRGKeyPairAlgorithm = 'Ed25519' | 'Ed448' | 'X25519' | 'X448';
@@ -77,6 +94,49 @@ export type EncryptDecryptAlgorithm =
   | 'AES-CBC'
   | 'AES-GCM';
 
+export type RsaOaepParams = {
+  name: 'RSA-OAEP';
+  label?: BufferLike;
+};
+
+export type AesCbcParams = {
+  name: 'AES-CBC';
+  iv: BufferLike;
+};
+
+export type AesCtrParams = {
+  name: 'AES-CTR';
+  counter: TypedArray;
+  length: number;
+};
+
+export type AesGcmParams = {
+  name: 'AES-GCM';
+  iv: BufferLike;
+  tagLength?: TagLength;
+  additionalData?: BufferLike;
+};
+
+export type AesKwParams = {
+  name: 'AES-KW';
+  wrappingKey?: BufferLike;
+};
+
+export type AesKeyGenParams = {
+  length: AESLength;
+  name?: AESAlgorithm;
+};
+
+export type TagLength = 32 | 64 | 96 | 104 | 112 | 120 | 128;
+
+export type AESLength = 128 | 192 | 256;
+
+export type EncryptDecryptParams =
+  | AesCbcParams
+  | AesCtrParams
+  | AesGcmParams
+  | RsaOaepParams;
+
 export type AnyAlgorithm =
   | DigestAlgorithm
   | HashAlgorithm
@@ -96,7 +156,7 @@ export type SubtleAlgorithm = {
   name: AnyAlgorithm;
   salt?: string;
   iterations?: number;
-  hash?: HashAlgorithm;
+  hash?: HashAlgorithm | { name: string };
   namedCurve?: NamedCurve;
   length?: number;
   modulusLength?: number;
@@ -112,31 +172,49 @@ export type KeyUsage =
   | 'verify'
   | 'deriveKey'
   | 'deriveBits'
+  | 'encapsulateBits'
+  | 'decapsulateBits'
+  | 'encapsulateKey'
+  | 'decapsulateKey'
   | 'wrapKey'
   | 'unwrapKey';
 
-// On node this value is defined on the native side, for now I'm just creating it here in JS
-// TODO(osp) move this into native side to make sure they always match
+// TODO: These enums need to be defined on the native side
 export enum KFormatType {
-  kKeyFormatDER,
-  kKeyFormatPEM,
-  kKeyFormatJWK,
+  DER,
+  PEM,
+  JWK,
 }
 
-// Same as KFormatType, this enum needs to be defined on the native side
 export enum KeyType {
-  Secret,
-  Public,
-  Private,
+  SECRET,
+  PUBLIC,
+  PRIVATE,
 }
 
 export enum KeyEncoding {
-  kKeyEncodingPKCS1,
-  kKeyEncodingPKCS8,
-  kKeyEncodingSPKI,
-  kKeyEncodingSEC1,
+  PKCS1,
+  PKCS8,
+  SPKI,
+  SEC1,
+}
+
+export enum KeyFormat {
+  RAW,
+  PKCS8,
+  SPKI,
+  JWK,
 }
 
+export type KeyData = BufferLike | BinaryLike | JWK;
+
+export const kNamedCurveAliases = {
+  'P-256': 'prime256v1',
+  'P-384': 'secp384r1',
+  'P-521': 'secp521r1',
+} as const;
+// end TODO
+
 export type KeyPairGenConfig = {
   publicFormat?: KFormatType;
   publicType?: KeyEncoding;
@@ -234,9 +312,12 @@ export type GenerateKeyPairOptions = {
   mgf1Hash?: string;
 };
 
-// Note: removed CryptoKey class from this type (from 0.x) because Nitro doesn't
-//       handle custom JS objects.  We might need to make it a JS object.
-export type KeyPairKey = ArrayBuffer | KeyObjectHandle | undefined;
+export type KeyPairKey =
+  | ArrayBuffer
+  | KeyObject
+  | KeyObjectHandle
+  | CryptoKey
+  | undefined;
 
 export type GenerateKeyPairReturn = [
   error?: Error,
@@ -311,3 +392,44 @@ export type CipherDESType =
 export type CipherECBType = 'aes-128-ecb' | 'aes-192-ecb' | 'aes-256-ecb';
 export type CipherGCMType = 'aes-128-gcm' | 'aes-192-gcm' | 'aes-256-gcm';
 export type CipherOFBType = 'aes-128-ofb' | 'aes-192-ofb' | 'aes-256-ofb';
+
+export type KeyObjectHandle = KeyObjectHandleType;
+
+export type DiffieHellmanOptions = {
+  privateKey: KeyObject;
+  publicKey: KeyObject;
+};
+
+export type DiffieHellmanCallback = (
+  err: Error | null,
+  secret?: CraftzdogBuffer,
+) => CraftzdogBuffer | void;
+
+// from @paulmillr/noble-curves
+export type Hex = string | Uint8Array;
+
+export type ImportFormat = 'raw' | 'pkcs8' | 'spki' | 'jwk';
+
+export type Operation =
+  | 'encrypt'
+  | 'decrypt'
+  | 'sign'
+  | 'verify'
+  | 'generateKey'
+  | 'importKey'
+  | 'exportKey'
+  | 'deriveBits';
+
+export interface KeyPairOptions {
+  namedCurve: string;
+  publicKeyEncoding?: {
+    type: 'spki';
+    format: 'pem' | 'der';
+  };
+  privateKeyEncoding?: {
+    type: 'pkcs8';
+    format: 'pem' | 'der';
+    cipher?: string;
+    passphrase?: string;
+  };
+}

package/src/utils/validation.ts

@@ -1,3 +1,10 @@
+import { Buffer as SBuffer } from 'safe-buffer';
+import type { BinaryLike, BufferLike, KeyUsage } from './types';
+import { lazyDOMException } from './errors';
+
+// The maximum buffer size that we'll support in the WebCrypto impl
+const kMaxBufferLength = 2 ** 31 - 1;
+
 export function validateFunction(f: unknown): boolean {
   return f !== null && typeof f === 'function';
 }
@@ -29,7 +36,95 @@ export function validateObject<T>(
     (typeof value !== 'object' &&
       (!allowFunction || typeof value !== 'function'))
   ) {
-    throw new Error(`${name} is not a valid object $${value}`);
+    throw new Error(`${name} is not a valid object ${value}`);
   }
   return true;
 }
+
+export const validateMaxBufferLength = (
+  data: BinaryLike | BufferLike,
+  name: string,
+): void => {
+  const length =
+    typeof data === 'string' || data instanceof SBuffer
+      ? data.length
+      : data.byteLength;
+  if (length > kMaxBufferLength) {
+    throw lazyDOMException(
+      `${name} must be less than ${kMaxBufferLength + 1} bits`,
+      'OperationError',
+    );
+  }
+};
+
+export const getUsagesUnion = (usageSet: KeyUsage[], ...usages: KeyUsage[]) => {
+  const newset: KeyUsage[] = [];
+  for (let n = 0; n < usages.length; n++) {
+    if (!usages[n] || usages[n] === undefined) continue;
+    if (usageSet.includes(usages[n] as KeyUsage))
+      newset.push(usages[n] as KeyUsage);
+  }
+  return newset;
+};
+
+const kKeyOps: {
+  [key in KeyUsage]: number;
+} = {
+  sign: 1,
+  verify: 2,
+  encrypt: 3,
+  decrypt: 4,
+  wrapKey: 5,
+  unwrapKey: 6,
+  deriveKey: 7,
+  deriveBits: 8,
+  encapsulateBits: 9,
+  decapsulateBits: 10,
+  encapsulateKey: 11,
+  decapsulateKey: 12,
+};
+
+export const validateKeyOps = (
+  keyOps: KeyUsage[] | undefined,
+  usagesSet: KeyUsage[],
+) => {
+  if (keyOps === undefined) return;
+  if (!Array.isArray(keyOps)) {
+    throw lazyDOMException('keyData.key_ops', 'InvalidArgument');
+  }
+  let flags = 0;
+  for (let n = 0; n < keyOps.length; n++) {
+    const op: KeyUsage = keyOps[n] as KeyUsage;
+    const op_flag = kKeyOps[op];
+    // Skipping unknown key ops
+    if (op_flag === undefined) continue;
+    // Have we seen it already? if so, error
+    if (flags & (1 << op_flag))
+      throw lazyDOMException('Duplicate key operation', 'DataError');
+    flags |= 1 << op_flag;
+
+    // TODO(@jasnell): RFC7517 section 4.3 strong recommends validating
+    // key usage combinations. Specifically, it says that unrelated key
+    // ops SHOULD NOT be used together. We're not yet validating that here.
+  }
+
+  if (usagesSet !== undefined) {
+    for (const use of usagesSet) {
+      if (!keyOps.includes(use)) {
+        throw lazyDOMException(
+          'Key operations and usage mismatch',
+          'DataError',
+        );
+      }
+    }
+  }
+};
+
+export function hasAnyNotIn(set: string[], checks: string[]) {
+  for (const s of set) {
+    if (!checks.includes(s)) {
+      return true;
+    }
+  }
+  return false;
+}

package/ios/libsodium-stable/.github/workflows/autocloser.yml

@@ -1,12 +0,0 @@
-name: Autocloser
-on: [issues]
-jobs:
-  autoclose:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Autoclose issues that did not follow issue template
-      uses: roots/issue-closer@v1.2
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-close-message: "This issue was automatically closed because it did not follow the issue template. We use the issue tracker exclusively for bug reports and feature additions that have been previously discussed. However, this issue appears to be a support request. Please use the discussion forums for support requests."
-        issue-pattern: ".*(do we replicate the issue|Expected behavior|raised as discussion|# Impact).*"

package/ios/libsodium-stable/.github/workflows/ci.yml

@@ -1,180 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [master, stable, next]
-  pull_request:
-    branches: [master, stable, next]
-
-  workflow_dispatch:
-
-jobs:
-  tcc:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get install -y build-essential libtool autoconf automake tcc
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Compilation with tcc
-        run: |
-          env CC=tcc CFLAGS='-w' CPPFLAGS="-DDEV_MODE=1" ./configure --prefix=/tmp --disable-dependency-tracking --disable-shared || cat config.log
-          make -j $(nproc) && make check && make install
-          env CC=tcc CPPFLAGS='-I/tmp/include' LDFLAGS='-L/tmp/lib' LD_LIBRARY_PATH='/tmp/lib' ./test/constcheck.sh
-          make uninstall
-          make distclean
-
-  zig:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install Zig
-        uses: mlugg/setup-zig@v2
-        with:
-          version: 0.14.0
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Compilation with zig
-        run: |
-          zig build
-          zig build -Dtarget=x86_64-linux
-          zig build -Dtarget=aarch64-linux
-          zig build -Dtarget=x86-windows
-          zig build -Dtarget=x86_64-windows
-          zig build -Dtarget=aarch64-windows
-          zig build -Dtarget=x86_64-macos
-          zig build -Dtarget=aarch64-macos
-          zig build -Dtarget=wasm32-wasi
-          zig build -Doptimize=ReleaseFast
-          rm -fr zig-cache zig-out
-
-  regular:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: C99 compat check
-        run: |
-          env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
-          make -j $(nproc) CFLAGS='-g0' > /dev/null && cp src/libsodium/.libs/libsodium.so lib.so && make clean > /dev/null && make CFLAGS='-g0' CPPFLAGS='-DDEV_MODE=1 -DSODIUM_C99\(X\)=' > /dev/null && cp src/libsodium/.libs/libsodium.so lib-oldc.so && cmp lib.so lib-oldc.so && echo No binary changes && make clean > /dev/null
-          make distcheck
-          make distclean > /dev/null
-
-      - name: Regular compilation
-        run: |
-          env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking --enable-minimal
-          make -j $(nproc)
-          make check
-          ( echo '#include <sodium.h>' ; echo 'int main(void) { return sodium_init(); }' ) > /tmp/main.c && gcc -DDEV_MODE=1 -Isrc/libsodium/include -Isrc/libsodium/include/sodium $(find src -name '*.c' -o -name '*.S') /tmp/main.c
-          make distclean > /dev/null
-
-  check-globals:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Check globals
-        run: |
-          if [ -x test/rename-globals.sh ]; then test/rename-globals.sh; fi
-
-  other-comp:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake clang
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Compilation with g++
-        run: |
-          env CC=g++ CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
-          make -j $(nproc) check
-          make clean > /dev/null
-
-      - name: Compilation with clang
-        run: |
-          env CC=clang CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
-          make -j $(nproc) check
-          make clean > /dev/null
-
-  other-arch:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake gcc-powerpc-linux-gnu
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Big-Endian PowerPC compilation
-        run: |
-          env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking --host=powerpc-linux-gnu
-          make -j $(nproc)
-          make clean > /dev/null
-
-  android:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update packages list
-        run: sudo apt-get update
-
-      - name: Install base dependencies
-        run: sudo apt-get install -y libtool autoconf automake unzip
-
-      - name: Autogen
-        run: ./autogen.sh -s
-
-      - name: Install Android NDK
-        run: |
-          mkdir /tmp/android && cd /tmp/android
-          curl -o ndk.zip -L https://dl.google.com/android/repository/android-ndk-r27c-linux.zip
-          unzip ndk.zip && rm -f *.zip && mv android-ndk* ndk
-
-      - name: Android compilation
-        run: |
-          env ANDROID_NDK_HOME=/tmp/android/ndk ./dist-build/android-aar.sh

package/ios/libsodium-stable/.github/workflows/cifuzz.yml

@@ -1,32 +0,0 @@
-name: CIFuzz
-
-on:
-  push:
-    branches: [stable, next]
-  pull_request:
-    branches: [stable, next]
-
-jobs:
-  Fuzzing:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Build Fuzzers
-        id: build
-        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-        with:
-          oss-fuzz-project-name: "libsodium"
-          dry-run: false
-          language: c++
-      - name: Run Fuzzers
-        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
-        with:
-          oss-fuzz-project-name: "libsodium"
-          fuzz-seconds: 300
-          dry-run: false
-          language: c++
-      - name: Upload Crash
-        uses: actions/upload-artifact@v4
-        if: failure() && steps.build.outcome == 'success'
-        with:
-          name: artifacts
-          path: ./out/artifacts

package/ios/libsodium-stable/.github/workflows/codeql-analysis.yml

@@ -1,48 +0,0 @@
-name: "CodeQL scan"
-
-on:
-  push:
-    branches: [ "master stable next" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "master stable next" ]
-  schedule:
-    - cron: '0 17 * * 2'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'c-cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 2
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - run: |
-        echo "Run, Build Application using script"
-        ./autogen.sh -s
-        env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
-        make -j $(nproc) check
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"