react-native-quick-crypto 1.0.0-beta.20 → 1.0.0-beta.22

package/cpp/ec/HybridEcKeyPair.hpp

@@ -0,0 +1,48 @@
+#include <memory>
+#include <openssl/ec.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/obj_mac.h>
+#include <string>
+
+#include "HybridEcKeyPairSpec.hpp"
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+class HybridEcKeyPair : public HybridEcKeyPairSpec {
+ public:
+  HybridEcKeyPair() : HybridObject(TAG) {}
+  ~HybridEcKeyPair() {
+    if (pkey != nullptr) {
+      EVP_PKEY_free(pkey);
+      pkey = nullptr;
+    }
+  }
+
+ public:
+  // Methods
+  std::shared_ptr<Promise<void>> generateKeyPair() override;
+  void generateKeyPairSync() override;
+  KeyObject importKey(const std::string& format, const std::shared_ptr<ArrayBuffer>& keyData, const std::string& algorithm,
+                      bool extractable, const std::vector<std::string>& keyUsages) override;
+  std::shared_ptr<ArrayBuffer> exportKey(const KeyObject& key, const std::string& format) override;
+  std::shared_ptr<ArrayBuffer> getPublicKey() override;
+  std::shared_ptr<ArrayBuffer> getPrivateKey() override;
+
+  void setCurve(const std::string& curve) override;
+  std::shared_ptr<ArrayBuffer> sign(const std::shared_ptr<ArrayBuffer>& data, const std::string& hashAlgorithm) override;
+  bool verify(const std::shared_ptr<ArrayBuffer>& data, const std::shared_ptr<ArrayBuffer>& signature,
+              const std::string& hashAlgorithm) override;
+
+ protected:
+  void checkKeyPair();
+
+ private:
+  std::string curve;
+  EVP_PKEY* pkey = nullptr;
+
+  static int GetCurveFromName(const char* name);
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/ed25519/HybridEdKeyPair.cpp

@@ -1,10 +1,64 @@
+#include <NitroModules/ArrayBuffer.hpp>
 #include <memory>
+#include <openssl/evp.h>
 #include <string>
 
 #include "HybridEdKeyPair.hpp"
 
 namespace margelo::nitro::crypto {
 
+std::shared_ptr<ArrayBuffer> HybridEdKeyPair::diffieHellman(const std::shared_ptr<ArrayBuffer>& privateKey,
+                                                            const std::shared_ptr<ArrayBuffer>& publicKey) {
+  using EVP_PKEY_ptr = std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>;
+  using EVP_PKEY_CTX_ptr = std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)>;
+
+  // 1. Create EVP_PKEY for private key (our key)
+  EVP_PKEY_ptr pkey_priv(EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, privateKey->data(), privateKey->size()), EVP_PKEY_free);
+  if (!pkey_priv) {
+    throw std::runtime_error("Failed to create private key: " + getOpenSSLError());
+  }
+
+  // 2. Create EVP_PKEY for public key (peer's key)
+  EVP_PKEY_ptr pkey_pub(EVP_PKEY_new_raw_public_key(EVP_PKEY_X25519, NULL, publicKey->data(), publicKey->size()), EVP_PKEY_free);
+  if (!pkey_pub) {
+    throw std::runtime_error("Failed to create public key: " + getOpenSSLError());
+  }
+
+  // 3. Create the context for the key exchange
+  EVP_PKEY_CTX_ptr ctx(EVP_PKEY_CTX_new_from_pkey(NULL, pkey_priv.get(), NULL), EVP_PKEY_CTX_free);
+  if (!ctx) {
+    throw std::runtime_error("Failed to create key exchange context: " + getOpenSSLError());
+  }
+
+  // 4. Initialize the context
+  if (EVP_PKEY_derive_init(ctx.get()) <= 0) {
+    throw std::runtime_error("Failed to initialize key exchange: " + getOpenSSLError());
+  }
+
+  // 5. Provide the peer's public key
+  if (EVP_PKEY_derive_set_peer(ctx.get(), pkey_pub.get()) <= 0) {
+    throw std::runtime_error("Failed to set peer key: " + getOpenSSLError());
+  }
+
+  // 6. Determine the size of the shared secret
+  size_t shared_secret_len;
+  if (EVP_PKEY_derive(ctx.get(), NULL, &shared_secret_len) <= 0) {
+    throw std::runtime_error("Failed to determine shared secret length: " + getOpenSSLError());
+  }
+
+  // 7. Allocate memory for the shared secret
+  auto shared_secret = new uint8_t[shared_secret_len];
+
+  // 8. Derive the shared secret
+  if (EVP_PKEY_derive(ctx.get(), shared_secret, &shared_secret_len) <= 0) {
+    delete[] shared_secret;
+    throw std::runtime_error("Failed to derive shared secret: " + getOpenSSLError());
+  }
+
+  // 9. Return a newly-created ArrayBuffer from the raw buffer w/ cleanup
+  return std::make_shared<NativeArrayBuffer>(shared_secret, shared_secret_len, [=]() { delete[] shared_secret; });
+}
+
 std::shared_ptr<Promise<void>> HybridEdKeyPair::generateKeyPair(double publicFormat, double publicType, double privateFormat,
                                                                 double privateType, const std::optional<std::string>& cipher,
                                                                 const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
@@ -22,6 +76,19 @@ std::shared_ptr<Promise<void>> HybridEdKeyPair::generateKeyPair(double publicFor
 void HybridEdKeyPair::generateKeyPairSync(double publicFormat, double publicType, double privateFormat, double privateType,
                                           const std::optional<std::string>& cipher,
                                           const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
+
+  if (this->curve.empty()) {
+    throw std::runtime_error("EC curve not set. Call setCurve() first.");
+  }
+
+  // Clean up existing key if any
+  if (this->pkey != nullptr) {
+    EVP_PKEY_free(this->pkey);
+    this->pkey = nullptr;
+  }
+
   EVP_PKEY_CTX* pctx;
 
   // key context
@@ -62,6 +129,8 @@ std::shared_ptr<Promise<std::shared_ptr<ArrayBuffer>>> HybridEdKeyPair::sign(con
 
 std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<ArrayBuffer>& message,
                                                        const std::optional<std::shared_ptr<ArrayBuffer>>& key) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
 
   size_t sig_len = 0;
   uint8_t* sig = NULL;
@@ -74,18 +143,18 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
   // key context
   md_ctx = EVP_MD_CTX_new();
   if (md_ctx == nullptr) {
-    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating signing context");
   }
 
   pkey_ctx = EVP_PKEY_CTX_new_from_name(nullptr, this->curve.c_str(), nullptr);
   if (pkey_ctx == nullptr) {
-    EVP_PKEY_CTX_free(pkey_ctx);
+    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating signing context: " + this->curve);
   }
 
   if (EVP_DigestSignInit(md_ctx, &pkey_ctx, NULL, NULL, pkey) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    EVP_PKEY_CTX_free(pkey_ctx);
     char* err = ERR_error_string(ERR_get_error(), NULL);
     throw std::runtime_error("Failed to initialize signing: " + std::string(err));
   }
@@ -100,6 +169,7 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
   // Actually calculate the signature
   if (EVP_DigestSign(md_ctx, sig, &sig_len, message.get()->data(), message.get()->size()) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    delete[] sig;
     throw std::runtime_error("Failed to calculate signature");
   }
 
@@ -108,6 +178,7 @@ std::shared_ptr<ArrayBuffer> HybridEdKeyPair::signSync(const std::shared_ptr<Arr
 
   // Clean up
   EVP_MD_CTX_free(md_ctx);
+  // Note: pkey_ctx is freed automatically by EVP_MD_CTX_free when using EVP_DigestSignInit
 
   return signature;
 }
@@ -129,6 +200,9 @@ std::shared_ptr<Promise<bool>> HybridEdKeyPair::verify(const std::shared_ptr<Arr
 
 bool HybridEdKeyPair::verifySync(const std::shared_ptr<ArrayBuffer>& signature, const std::shared_ptr<ArrayBuffer>& message,
                                  const std::optional<std::shared_ptr<ArrayBuffer>>& key) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
+
   // get key to use for verifying
   EVP_PKEY* pkey = this->importPublicKey(key);
 
@@ -138,18 +212,18 @@ bool HybridEdKeyPair::verifySync(const std::shared_ptr<ArrayBuffer>& signature,
   // key context
   md_ctx = EVP_MD_CTX_new();
   if (md_ctx == nullptr) {
-    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating verify context");
   }
 
   pkey_ctx = EVP_PKEY_CTX_new_from_name(nullptr, this->curve.c_str(), nullptr);
   if (pkey_ctx == nullptr) {
-    EVP_PKEY_CTX_free(pkey_ctx);
+    EVP_MD_CTX_free(md_ctx);
     throw std::runtime_error("Error creating verify context: " + this->curve);
   }
 
   if (EVP_DigestVerifyInit(md_ctx, &pkey_ctx, NULL, NULL, pkey) <= 0) {
     EVP_MD_CTX_free(md_ctx);
+    EVP_PKEY_CTX_free(pkey_ctx);
     char* err = ERR_error_string(ERR_get_error(), NULL);
     throw std::runtime_error("Failed to initialize verify: " + std::string(err));
   }

package/cpp/ed25519/HybridEdKeyPair.hpp

@@ -8,14 +8,21 @@
 
 namespace margelo::nitro::crypto {
 
-using namespace facebook;
-
 class HybridEdKeyPair : public HybridEdKeyPairSpec {
  public:
   HybridEdKeyPair() : HybridObject(TAG) {}
+  ~HybridEdKeyPair() {
+    if (pkey != nullptr) {
+      EVP_PKEY_free(pkey);
+      pkey = nullptr;
+    }
+  }
 
  public:
   // Methods
+  std::shared_ptr<ArrayBuffer> diffieHellman(const std::shared_ptr<ArrayBuffer>& privateKey,
+                                             const std::shared_ptr<ArrayBuffer>& publicKey) override;
+
   std::shared_ptr<Promise<void>> generateKeyPair(double publicFormat, double publicType, double privateFormat, double privateType,
                                                  const std::optional<std::string>& cipher,
                                                  const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) override;

package/cpp/hash/HybridHash.cpp

@@ -7,6 +7,7 @@
 #include <vector>
 
 #include "HybridHash.hpp"
+#include "Utils.hpp"
 
 namespace margelo::nitro::crypto {
 
@@ -15,9 +16,27 @@ HybridHash::~HybridHash() {
     EVP_MD_CTX_free(ctx);
     ctx = nullptr;
   }
+  if (md && md_fetched) {
+    EVP_MD_free(md);
+    md = nullptr;
+  }
 }
 
 void HybridHash::createHash(const std::string& hashAlgorithmArg, const std::optional<double> outputLengthArg) {
+  // Clear any previous OpenSSL errors to prevent pollution
+  clearOpenSSLErrors();
+
+  // Clean up existing resources before creating new ones
+  if (ctx) {
+    EVP_MD_CTX_free(ctx);
+    ctx = nullptr;
+  }
+  if (md && md_fetched) {
+    EVP_MD_free(md);
+    md = nullptr;
+    md_fetched = false;
+  }
+
   algorithm = hashAlgorithmArg;
   outputLength = outputLengthArg;
 
@@ -27,18 +46,24 @@ void HybridHash::createHash(const std::string& hashAlgorithmArg, const std::opti
     throw std::runtime_error("Failed to create hash context: " + std::to_string(ERR_get_error()));
   }
 
-  // Get the message digest by name
-  md = EVP_get_digestbyname(algorithm.c_str());
+  // Fetch the message digest using modern provider-based API
+  md = EVP_MD_fetch(nullptr, algorithm.c_str(), nullptr);
   if (!md) {
     EVP_MD_CTX_free(ctx);
     ctx = nullptr;
     throw std::runtime_error("Unknown hash algorithm: " + algorithm);
   }
+  md_fetched = true;
 
   // Initialize the digest
   if (EVP_DigestInit_ex(ctx, md, nullptr) != 1) {
     EVP_MD_CTX_free(ctx);
     ctx = nullptr;
+    if (md_fetched) {
+      EVP_MD_free(md);
+      md = nullptr;
+      md_fetched = false;
+    }
     throw std::runtime_error("Failed to initialize hash digest: " + std::to_string(ERR_get_error()));
   }
 }
@@ -106,7 +131,7 @@ std::shared_ptr<margelo::nitro::crypto::HybridHashSpec> HybridHash::copy(const s
     throw std::runtime_error("Failed to copy hash context: " + std::to_string(ERR_get_error()));
   }
 
-  return std::make_shared<HybridHash>(newCtx, md, algorithm, outputLengthArg);
+  return std::make_shared<HybridHash>(newCtx, md, algorithm, outputLengthArg, false);
 }
 
 std::vector<std::string> HybridHash::getSupportedHashAlgorithms() {
@@ -143,9 +168,18 @@ void HybridHash::setParams() {
     if (EVP_MD_CTX_set_params(ctx, params) != 1) {
       EVP_MD_CTX_free(ctx);
       ctx = nullptr;
+      if (md && md_fetched) {
+        EVP_MD_free(md);
+        md = nullptr;
+        md_fetched = false;
+      }
       throw std::runtime_error("Failed to set XOF length (outputLength) parameter: " + std::to_string(ERR_get_error()));
     }
   }
 }
 
+std::string HybridHash::getOpenSSLVersion() {
+  return OpenSSL_version(OPENSSL_VERSION);
+}
+
 } // namespace margelo::nitro::crypto

package/cpp/hash/HybridHash.hpp

@@ -14,8 +14,8 @@ using namespace facebook;
 class HybridHash : public HybridHashSpec {
  public:
   HybridHash() : HybridObject(TAG) {}
-  HybridHash(EVP_MD_CTX* ctx, const EVP_MD* md, const std::string& algorithm, const std::optional<double> outputLength)
-      : HybridObject(TAG), ctx(ctx), md(md), algorithm(algorithm), outputLength(outputLength) {}
+  HybridHash(EVP_MD_CTX* ctx, EVP_MD* md, const std::string& algorithm, const std::optional<double> outputLength, bool md_fetched = false)
+      : HybridObject(TAG), ctx(ctx), md(md), md_fetched(md_fetched), algorithm(algorithm), outputLength(outputLength) {}
   ~HybridHash();
 
  public:
@@ -25,6 +25,7 @@ class HybridHash : public HybridHashSpec {
   std::shared_ptr<ArrayBuffer> digest(const std::optional<std::string>& encoding = std::nullopt) override;
   std::shared_ptr<margelo::nitro::crypto::HybridHashSpec> copy(const std::optional<double> outputLength) override;
   std::vector<std::string> getSupportedHashAlgorithms() override;
+  std::string getOpenSSLVersion() override;
 
  private:
   // Methods
@@ -33,7 +34,8 @@ class HybridHash : public HybridHashSpec {
  private:
   // Properties
   EVP_MD_CTX* ctx = nullptr;
-  const EVP_MD* md = nullptr;
+  EVP_MD* md = nullptr;
+  bool md_fetched = false;
   std::string algorithm = "";
   std::optional<double> outputLength = std::nullopt;
 };