react-native-quick-crypto 1.0.0-beta.8 → 1.0.0

package/src/ed.ts

@@ -1,7 +1,34 @@
 import { NitroModules } from 'react-native-nitro-modules';
-import { binaryLikeToArrayBuffer as toAB } from './utils';
+import { Buffer } from '@craftzdog/react-native-buffer';
+import type { AsymmetricKeyObject, PrivateKeyObject } from './keys';
+import {
+  CryptoKey,
+  KeyObject,
+  PublicKeyObject,
+  PrivateKeyObject as PrivateKeyObjectClass,
+} from './keys';
 import type { EdKeyPair } from './specs/edKeyPair.nitro';
-import type { BinaryLike, CFRGKeyPairType, KeyPairGenConfig } from './utils';
+import type {
+  BinaryLike,
+  CFRGKeyPairType,
+  CryptoKeyPair,
+  DiffieHellmanCallback,
+  DiffieHellmanOptions,
+  GenerateKeyPairCallback,
+  GenerateKeyPairReturn,
+  Hex,
+  KeyPairGenConfig,
+  KeyUsage,
+  SubtleAlgorithm,
+} from './utils';
+import {
+  binaryLikeToArrayBuffer as toAB,
+  hasAnyNotIn,
+  lazyDOMException,
+  getUsagesUnion,
+  KFormatType,
+  KeyEncoding,
+} from './utils';
 
 export class Ed {
   type: CFRGKeyPairType;
@@ -15,24 +42,76 @@ export class Ed {
     this.native.setCurve(type);
   }
 
+  /**
+   * Computes the Diffie-Hellman secret based on a privateKey and a publicKey.
+   * Both keys must have the same asymmetricKeyType, which must be one of 'dh'
+   * (for Diffie-Hellman), 'ec', 'x448', or 'x25519' (for ECDH).
+   *
+   * @api nodejs/node
+   *
+   * @param options `{ privateKey, publicKey }`, both of which are `KeyObject`s
+   * @param callback optional `(err, secret) => void`
+   * @returns `Buffer` if no callback, or `void` if callback is provided
+   */
+  diffieHellman(
+    options: DiffieHellmanOptions,
+    callback?: DiffieHellmanCallback,
+  ): Buffer | void {
+    checkDiffieHellmanOptions(options);
+
+    // key types must be of certain type
+    const keyType = (options.privateKey as AsymmetricKeyObject)
+      .asymmetricKeyType;
+    switch (keyType) {
+      case 'x25519':
+      case 'x448':
+        break;
+      default:
+        throw new Error(`Unsupported or unimplemented curve type: ${keyType}`);
+    }
+
+    // extract the private and public keys as ArrayBuffers
+    const privateKey = toAB(options.privateKey);
+    const publicKey = toAB(options.publicKey);
+
+    try {
+      const ret = this.native.diffieHellman(privateKey, publicKey);
+      if (!ret) {
+        throw new Error('No secret');
+      }
+      if (callback) {
+        callback(null, Buffer.from(ret));
+      } else {
+        return Buffer.from(ret);
+      }
+    } catch (e: unknown) {
+      const err = e as Error;
+      if (callback) {
+        callback(err, undefined);
+      } else {
+        throw err;
+      }
+    }
+  }
+
   async generateKeyPair(): Promise<void> {
-    this.native.generateKeyPair(
-      this.config.publicFormat || (-1 as number),
-      this.config.publicType || (-1 as number),
-      this.config.privateFormat || (-1 as number),
-      this.config.privateType || (-1 as number),
-      this.config.cipher as string,
+    await this.native.generateKeyPair(
+      this.config.publicFormat ?? -1,
+      this.config.publicType ?? -1,
+      this.config.privateFormat ?? -1,
+      this.config.privateType ?? -1,
+      this.config.cipher,
       this.config.passphrase as ArrayBuffer,
     );
   }
 
   generateKeyPairSync(): void {
     this.native.generateKeyPairSync(
-      this.config.publicFormat || (-1 as number),
-      this.config.publicType || (-1 as number),
-      this.config.privateFormat || (-1 as number),
-      this.config.privateType || (-1 as number),
-      this.config.cipher as string,
+      this.config.publicFormat ?? -1,
+      this.config.publicType ?? -1,
+      this.config.privateFormat ?? -1,
+      this.config.privateType ?? -1,
+      this.config.cipher,
       this.config.passphrase as ArrayBuffer,
     );
   }
@@ -45,6 +124,20 @@ export class Ed {
     return this.native.getPrivateKey();
   }
 
+  /**
+   * Computes the Diffie-Hellman shared secret based on a privateKey and a
+   * publicKey for key exchange
+   *
+   * @api \@paulmillr/noble-curves/ed25519
+   *
+   * @param privateKey
+   * @param publicKey
+   * @returns shared secret key
+   */
+  getSharedSecret(privateKey: Hex, publicKey: Hex): ArrayBuffer {
+    return this.native.diffieHellman(toAB(privateKey), toAB(publicKey));
+  }
+
   async sign(message: BinaryLike, key?: BinaryLike): Promise<ArrayBuffer> {
     return key
       ? this.native.sign(toAB(message), toAB(key))
@@ -77,3 +170,194 @@ export class Ed {
       : this.native.verifySync(toAB(signature), toAB(message));
   }
 }
+
+// Node API
+export function diffieHellman(
+  options: DiffieHellmanOptions,
+  callback?: DiffieHellmanCallback,
+): Buffer | void {
+  const privateKey = options.privateKey as PrivateKeyObject;
+  const type = privateKey.asymmetricKeyType as CFRGKeyPairType;
+  const ed = new Ed(type, {});
+  return ed.diffieHellman(options, callback);
+}
+
+// Node API
+export function ed_generateKeyPair(
+  isAsync: boolean,
+  type: CFRGKeyPairType,
+  encoding: KeyPairGenConfig,
+  callback: GenerateKeyPairCallback | undefined,
+): GenerateKeyPairReturn | void {
+  const ed = new Ed(type, encoding);
+
+  // Helper to convert keys to proper output format
+  const formatKeys = (): {
+    publicKey: string | ArrayBuffer;
+    privateKey: string | ArrayBuffer;
+  } => {
+    const publicKeyRaw = ed.getPublicKey();
+    const privateKeyRaw = ed.getPrivateKey();
+
+    // Check if PEM format was requested (KFormatType.PEM = 1)
+    const isPemPublic = encoding.publicFormat === KFormatType.PEM;
+    const isPemPrivate = encoding.privateFormat === KFormatType.PEM;
+
+    // Convert ArrayBuffer to string for PEM format
+    const arrayBufferToString = (ab: ArrayBuffer): string => {
+      return Buffer.from(new Uint8Array(ab)).toString('utf-8');
+    };
+
+    const publicKey = isPemPublic
+      ? arrayBufferToString(publicKeyRaw)
+      : publicKeyRaw;
+    const privateKey = isPemPrivate
+      ? arrayBufferToString(privateKeyRaw)
+      : privateKeyRaw;
+
+    return { publicKey, privateKey };
+  };
+
+  // Async path
+  if (isAsync) {
+    if (!callback) {
+      // This should not happen if called from public API
+      throw new Error('A callback is required for async key generation.');
+    }
+    ed.generateKeyPair()
+      .then(() => {
+        const { publicKey, privateKey } = formatKeys();
+        callback(undefined, publicKey, privateKey);
+      })
+      .catch(err => {
+        callback(err, undefined, undefined);
+      });
+    return;
+  }
+
+  // Sync path
+  let err: Error | undefined;
+  try {
+    ed.generateKeyPairSync();
+  } catch (e) {
+    err = e instanceof Error ? e : new Error(String(e));
+  }
+
+  const { publicKey, privateKey } = err
+    ? { publicKey: undefined, privateKey: undefined }
+    : formatKeys();
+
+  if (callback) {
+    callback(err, publicKey, privateKey);
+    return;
+  }
+  return [err, publicKey, privateKey];
+}
+
+function checkDiffieHellmanOptions(options: DiffieHellmanOptions): void {
+  const { privateKey, publicKey } = options;
+
+  // Check if keys are KeyObject instances
+  if (
+    !privateKey ||
+    typeof privateKey !== 'object' ||
+    !('type' in privateKey)
+  ) {
+    throw new Error('privateKey must be a KeyObject');
+  }
+  if (!publicKey || typeof publicKey !== 'object' || !('type' in publicKey)) {
+    throw new Error('publicKey must be a KeyObject');
+  }
+
+  // type checks
+  if (privateKey.type !== 'private') {
+    throw new Error('privateKey must be a private KeyObject');
+  }
+  if (publicKey.type !== 'public') {
+    throw new Error('publicKey must be a public KeyObject');
+  }
+
+  // For asymmetric keys, check if they have the asymmetricKeyType property
+  const privateKeyAsym = privateKey as AsymmetricKeyObject;
+  const publicKeyAsym = publicKey as AsymmetricKeyObject;
+
+  // key types must match
+  if (
+    privateKeyAsym.asymmetricKeyType &&
+    publicKeyAsym.asymmetricKeyType &&
+    privateKeyAsym.asymmetricKeyType !== publicKeyAsym.asymmetricKeyType
+  ) {
+    throw new Error('Keys must be asymmetric and their types must match');
+  }
+
+  switch (privateKeyAsym.asymmetricKeyType) {
+    // case 'dh': // TODO: uncomment when implemented
+    case 'x25519':
+    case 'x448':
+      break;
+    default:
+      throw new Error(
+        `Unknown curve type: ${privateKeyAsym.asymmetricKeyType}`,
+      );
+  }
+}
+
+export async function ed_generateKeyPairWebCrypto(
+  type: 'ed25519' | 'ed448',
+  extractable: boolean,
+  keyUsages: KeyUsage[],
+): Promise<CryptoKeyPair> {
+  if (hasAnyNotIn(keyUsages, ['sign', 'verify'])) {
+    throw lazyDOMException(`Unsupported key usage for ${type}`, 'SyntaxError');
+  }
+
+  const publicUsages = getUsagesUnion(keyUsages, 'verify');
+  const privateUsages = getUsagesUnion(keyUsages, 'sign');
+
+  if (privateUsages.length === 0) {
+    throw lazyDOMException('Usages cannot be empty', 'SyntaxError');
+  }
+
+  // Request DER-encoded SPKI for public key, PKCS8 for private key
+  const config = {
+    publicFormat: KFormatType.DER,
+    publicType: KeyEncoding.SPKI,
+    privateFormat: KFormatType.DER,
+    privateType: KeyEncoding.PKCS8,
+  };
+  const ed = new Ed(type, config);
+  await ed.generateKeyPair();
+
+  const algorithmName = type === 'ed25519' ? 'Ed25519' : 'Ed448';
+
+  const publicKeyData = ed.getPublicKey();
+  const privateKeyData = ed.getPrivateKey();
+
+  const pub = KeyObject.createKeyObject(
+    'public',
+    publicKeyData,
+    KFormatType.DER,
+    KeyEncoding.SPKI,
+  ) as PublicKeyObject;
+  const publicKey = new CryptoKey(
+    pub,
+    { name: algorithmName } as SubtleAlgorithm,
+    publicUsages,
+    true,
+  );
+
+  const priv = KeyObject.createKeyObject(
+    'private',
+    privateKeyData,
+    KFormatType.DER,
+    KeyEncoding.PKCS8,
+  ) as PrivateKeyObjectClass;
+  const privateKey = new CryptoKey(
+    priv,
+    { name: algorithmName } as SubtleAlgorithm,
+    privateUsages,
+    extractable,
+  );
+
+  return { publicKey, privateKey };
+}

package/src/expo-plugin/@types.ts

@@ -0,0 +1,7 @@
+export type ConfigProps = {
+  /**
+   * Enable libsodium support
+   * @default false
+   */
+  sodiumEnabled?: boolean;
+};

package/src/expo-plugin/withRNQC.ts

@@ -0,0 +1,23 @@
+import { createRunOncePlugin } from 'expo/config-plugins';
+import type { ConfigPlugin } from 'expo/config-plugins';
+import type { ConfigProps } from './@types';
+import { withSodiumIos } from './withSodiumIos';
+import { withSodiumAndroid } from './withSodiumAndroid';
+import { withXCode } from './withXCode';
+
+const withRNQCInternal: ConfigPlugin<ConfigProps> = (config, props = {}) => {
+  // add XCode workarounds for some 16.x releases that are not RN-friendly
+  config = withXCode(config, props);
+
+  // enable libsodium algorithms
+  if (props.sodiumEnabled) {
+    config = withSodiumIos(config, props);
+    config = withSodiumAndroid(config, props);
+  }
+
+  return config;
+};
+
+export function createRNQCPlugin(name: string, version: string) {
+  return createRunOncePlugin(withRNQCInternal, name, version);
+}

package/src/expo-plugin/withSodiumAndroid.ts

@@ -0,0 +1,24 @@
+import type { ConfigPlugin } from 'expo/config-plugins';
+import { withGradleProperties } from 'expo/config-plugins';
+import type { ConfigProps } from './@types';
+
+export const withSodiumAndroid: ConfigPlugin<ConfigProps> = config => {
+  return withGradleProperties(config, config => {
+    config.modResults = config.modResults || [];
+
+    // Check if the property already exists
+    const existingProperty = config.modResults.find(
+      item => item.type === 'property' && item.key === 'sodiumEnabled',
+    );
+
+    if (!existingProperty) {
+      config.modResults.push({
+        type: 'property',
+        key: 'sodiumEnabled',
+        value: 'true',
+      });
+    }
+
+    return config;
+  });
+};

package/src/expo-plugin/withSodiumIos.ts

@@ -0,0 +1,30 @@
+import type { ConfigPlugin } from 'expo/config-plugins';
+import { withDangerousMod } from 'expo/config-plugins';
+import fs from 'fs';
+import path from 'path';
+import type { ConfigProps } from './@types';
+
+export const withSodiumIos: ConfigPlugin<ConfigProps> = config => {
+  return withDangerousMod(config, [
+    'ios',
+    config => {
+      const podfilePath = path.join(
+        config.modRequest.platformProjectRoot,
+        'Podfile',
+      );
+      let contents = fs.readFileSync(podfilePath, 'utf-8');
+
+      // Check if SODIUM_ENABLED is already set
+      if (!contents.includes("ENV['SODIUM_ENABLED']")) {
+        // Add it right after the RCT_NEW_ARCH_ENABLED ENV variable
+        contents = contents.replace(
+          /^(ENV\['RCT_NEW_ARCH_ENABLED'\].*$)/m,
+          `$1\nENV['SODIUM_ENABLED'] = '1'`,
+        );
+        fs.writeFileSync(podfilePath, contents);
+      }
+
+      return config;
+    },
+  ]);
+};

package/src/expo-plugin/withXCode.ts

@@ -0,0 +1,55 @@
+import type { ConfigPlugin } from 'expo/config-plugins';
+import type { ConfigProps } from './@types';
+import { withBuildProperties } from 'expo-build-properties';
+import { withDangerousMod } from 'expo/config-plugins';
+import fs from 'fs';
+import path from 'path';
+
+/**
+ *  Workaround for some jank XCode releases that break React Native native modules
+ *
+ *  see: https://github.com/mrousavy/nitro/issues/422#issuecomment-2545988256
+ */
+export const withXCode: ConfigPlugin<ConfigProps> = config => {
+  // Use expo-build-properties to bump iOS deployment target
+  config = withBuildProperties(config, { ios: { deploymentTarget: '16.1' } });
+  // Patch the generated Podfile fallback to ensure platform is always 16.1
+  config = withDangerousMod(config, [
+    'ios',
+    modConfig => {
+      const podfilePath = path.join(
+        modConfig.modRequest.platformProjectRoot,
+        'Podfile',
+      );
+      let contents = fs.readFileSync(podfilePath, 'utf-8');
+
+      // Check if the IPHONEOS_DEPLOYMENT_TARGET setting is already present
+      // We search for the key being assigned, e.g., config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] =
+      const deploymentTargetSettingExists =
+        /\.build_settings\s*\[\s*['"]IPHONEOS_DEPLOYMENT_TARGET['"]\s*\]\s*=/.test(
+          contents,
+        );
+
+      if (!deploymentTargetSettingExists) {
+        // IPHONEOS_DEPLOYMENT_TARGET setting not found, proceed to add it.
+        contents = contents.replace(
+          /(post_install\s+do\s+\|installer\|[\s\S]*?)(\r?\n\s\send\s*)$/m,
+          `$1
+
+    # Expo Build Properties: force deployment target
+    # https://github.com/mrousavy/nitro/issues/422#issuecomment-2545988256
+    installer.pods_project.targets.each do |target|
+      target.build_configurations.each do |config|
+        config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '16.1'
+      end
+    end
+$2`,
+        );
+      }
+
+      fs.writeFileSync(podfilePath, contents);
+      return modConfig;
+    },
+  ]);
+  return config;
+};