react-native-quick-crypto 1.0.0-beta.8 → 1.0.0

package/src/keys/signVerify.ts

@@ -1,39 +1,239 @@
-// import { KeyObject, PublicKeyObject, PrivateKeyObject } from '.';
-// import { ed25519 } from '../ed25519';
-// import type {
-//   BinaryLike,
-//   BinaryLikeNode,
-//   SignCallback,
-//   VerifyCallback,
-// } from '../utils';
-
-// export function sign(
-//   algorithm: string | null | undefined,
-//   data: BinaryLike,
-//   key: BinaryLikeNode | KeyObject,
-//   callback: SignCallback,
-// ): ArrayBuffer {
-//   console.log('sign  ', algorithm, data, key, callback);
-//   return new ArrayBuffer(32);
-// }
-
-// export function verify(
-//   algorithm: string | null | undefined,
-//   data: BinaryLike,
-//   key: BinaryLikeNode | KeyObject,
-//   signature: ArrayBuffer,
-//   callback: VerifyCallback,
-// ): boolean {
-//   if (!algorithm) {
-//     if (key instanceof PublicKeyObject) {
-//       switch (key.asymmetricKeyType) {
-//         case 'ed25519':
-//         case 'ed448':
-//         case 'x25519':
-//         case 'x448': {
-//           return ed25519.verify(signature, data, key);
-//         }
-//     }
-//   }
-//   throw new Error('Verify not implemented', algorithm, data, key, signature, callback);
-// }
+import { Buffer } from '@craftzdog/react-native-buffer';
+import { NitroModules } from 'react-native-nitro-modules';
+import type {
+  SignHandle as SignHandleSpec,
+  VerifyHandle as VerifyHandleSpec,
+} from '../specs/sign.nitro';
+import { KeyObject, CryptoKey } from './classes';
+import { isCryptoKey } from './utils';
+import type { BinaryLike } from '../utils';
+import {
+  binaryLikeToArrayBuffer as toAB,
+  isStringOrBuffer,
+  KFormatType,
+  KeyEncoding,
+} from '../utils';
+
+type KeyInput = BinaryLike | KeyObject | CryptoKey | KeyInputObject;
+
+interface KeyInputObject {
+  key: BinaryLike | KeyObject | CryptoKey;
+  format?: 'pem' | 'der';
+  type?: 'pkcs1' | 'pkcs8' | 'spki' | 'sec1';
+  passphrase?: BinaryLike;
+  padding?: number;
+  saltLength?: number;
+  dsaEncoding?: 'der' | 'ieee-p1363';
+}
+
+interface SignOptions {
+  padding?: number;
+  saltLength?: number;
+  dsaEncoding?: 'der' | 'ieee-p1363';
+}
+
+interface PreparedKey {
+  keyObject: KeyObject;
+  options?: SignOptions;
+}
+
+function prepareKey(key: KeyInput, isPublic: boolean): PreparedKey {
+  // Already a KeyObject
+  if (key instanceof KeyObject) {
+    if (isPublic) {
+      if (key.type === 'secret') {
+        throw new Error('Cannot use secret key for signature verification');
+      }
+    } else {
+      if (key.type !== 'private') {
+        throw new Error('Key must be a private key for signing');
+      }
+    }
+    return { keyObject: key };
+  }
+
+  // CryptoKey - extract KeyObject
+  if (isCryptoKey(key)) {
+    const cryptoKey = key as CryptoKey;
+    return prepareKey(cryptoKey.keyObject, isPublic);
+  }
+
+  // Raw string or buffer - create KeyObject
+  if (isStringOrBuffer(key)) {
+    const isPem = typeof key === 'string' && key.includes('-----BEGIN');
+    const format = isPem ? KFormatType.PEM : undefined;
+    const type = isPublic ? 'public' : 'private';
+    const keyData = toAB(key);
+    const keyObject = KeyObject.createKeyObject(type, keyData, format);
+    return { keyObject };
+  }
+
+  // KeyInputObject with options
+  if (typeof key === 'object' && 'key' in key) {
+    const keyObj = key as KeyInputObject;
+    const {
+      key: data,
+      format,
+      type,
+      padding,
+      saltLength,
+      dsaEncoding,
+    } = keyObj;
+
+    // Nested KeyObject
+    if (data instanceof KeyObject) {
+      return {
+        keyObject: data,
+        options: { padding, saltLength, dsaEncoding },
+      };
+    }
+
+    // Nested CryptoKey
+    if (isCryptoKey(data)) {
+      return {
+        keyObject: (data as CryptoKey).keyObject,
+        options: { padding, saltLength, dsaEncoding },
+      };
+    }
+
+    if (!isStringOrBuffer(data)) {
+      throw new Error('Invalid key data type');
+    }
+
+    // Determine format
+    const isPem =
+      format === 'pem' ||
+      (typeof data === 'string' && data.includes('-----BEGIN'));
+    const kFormat = isPem
+      ? KFormatType.PEM
+      : format === 'der'
+        ? KFormatType.DER
+        : undefined;
+
+    // Determine encoding type
+    let kType: KeyEncoding | undefined;
+    if (type === 'pkcs8') kType = KeyEncoding.PKCS8;
+    else if (type === 'pkcs1') kType = KeyEncoding.PKCS1;
+    else if (type === 'sec1') kType = KeyEncoding.SEC1;
+    else if (type === 'spki') kType = KeyEncoding.SPKI;
+
+    const keyType = isPublic ? 'public' : 'private';
+    // Always convert to ArrayBuffer to avoid Nitro bridge string truncation bug
+    const originalLength =
+      typeof data === 'string' ? data.length : data.byteLength;
+    const keyData = toAB(data);
+    console.log(
+      `[prepareKey KeyInputObject] ${keyType} key, original length: ${originalLength}, ArrayBuffer size: ${keyData.byteLength}`,
+    );
+    const keyObject = KeyObject.createKeyObject(
+      keyType,
+      keyData,
+      kFormat,
+      kType,
+    );
+
+    return {
+      keyObject,
+      options: { padding, saltLength, dsaEncoding },
+    };
+  }
+
+  throw new Error('Invalid key input');
+}
+
+function dsaEncodingToNumber(
+  dsaEncoding?: 'der' | 'ieee-p1363',
+): number | undefined {
+  if (dsaEncoding === 'der') return 0;
+  if (dsaEncoding === 'ieee-p1363') return 1;
+  return undefined;
+}
+
+export class Sign {
+  private handle: SignHandleSpec;
+
+  constructor(algorithm: string) {
+    this.handle = NitroModules.createHybridObject<SignHandleSpec>('SignHandle');
+    this.handle.init(algorithm);
+  }
+
+  update(data: BinaryLike): this {
+    const dataBuffer = toAB(data);
+    this.handle.update(dataBuffer);
+    return this;
+  }
+
+  sign(privateKey: KeyInput, outputEncoding?: BufferEncoding): Buffer;
+  sign(privateKey: KeyInput, outputEncoding?: BufferEncoding): Buffer | string {
+    if (privateKey === null || privateKey === undefined) {
+      throw new Error('Private key is required');
+    }
+
+    const { keyObject, options } = prepareKey(privateKey, false);
+
+    const signature = this.handle.sign(
+      keyObject.handle,
+      options?.padding,
+      options?.saltLength,
+      dsaEncodingToNumber(options?.dsaEncoding),
+    );
+
+    const buf = Buffer.from(signature);
+    if (outputEncoding) {
+      return buf.toString(outputEncoding);
+    }
+    return buf;
+  }
+}
+
+export class Verify {
+  private handle: VerifyHandleSpec;
+
+  constructor(algorithm: string) {
+    this.handle =
+      NitroModules.createHybridObject<VerifyHandleSpec>('VerifyHandle');
+    this.handle.init(algorithm);
+  }
+
+  update(data: BinaryLike): this {
+    const dataBuffer = toAB(data);
+    this.handle.update(dataBuffer);
+    return this;
+  }
+
+  verify(
+    publicKey: KeyInput,
+    signature: BinaryLike,
+    signatureEncoding?: BufferEncoding,
+  ): boolean {
+    if (publicKey === null || publicKey === undefined) {
+      throw new Error('Public key is required');
+    }
+
+    const { keyObject, options } = prepareKey(publicKey, true);
+
+    // Convert signature to ArrayBuffer
+    let sigBuffer: ArrayBuffer;
+    if (signatureEncoding && typeof signature === 'string') {
+      sigBuffer = toAB(Buffer.from(signature, signatureEncoding));
+    } else {
+      sigBuffer = toAB(signature);
+    }
+
+    return this.handle.verify(
+      keyObject.handle,
+      sigBuffer,
+      options?.padding,
+      options?.saltLength,
+      dsaEncodingToNumber(options?.dsaEncoding),
+    );
+  }
+}
+
+export function createSign(algorithm: string): Sign {
+  return new Sign(algorithm);
+}
+
+export function createVerify(algorithm: string): Verify {
+  return new Verify(algorithm);
+}

package/src/keys/utils.ts

@@ -4,13 +4,21 @@ import {
   KeyEncoding,
   KFormatType,
 } from '../utils';
-import type { EncodingOptions } from '../utils';
+import type { CryptoKeyPair, EncodingOptions } from '../utils';
+import type { CryptoKey } from './classes';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const isCryptoKey = (obj: any): boolean => {
   return obj !== null && obj?.keyObject !== undefined;
 };
 
+export function getCryptoKeyPair(
+  key: CryptoKey | CryptoKeyPair,
+): CryptoKeyPair {
+  if ('publicKey' in key && 'privateKey' in key) return key;
+  throw new Error('Invalid CryptoKeyPair');
+}
+
 /**
  * Parses the public key encoding based on an object. keyType must be undefined
  * when this is used to parse an input encoding and must be a valid key type if
@@ -65,9 +73,8 @@ export function parseKeyEncoding(
             `Invalid argument ${option('cipher', objName)}: ${cipher}`,
           );
         if (
-          format === KFormatType.kKeyFormatDER &&
-          (type === KeyEncoding.kKeyEncodingPKCS1 ||
-            type === KeyEncoding.kKeyEncodingSEC1)
+          format === KFormatType.DER &&
+          (type === KeyEncoding.PKCS1 || type === KeyEncoding.SEC1)
         ) {
           throw new Error(
             `Incompatible key options ${encodingNames[type]} does not support encryption`,
@@ -97,10 +104,10 @@ export function parseKeyEncoding(
 }
 
 const encodingNames = {
-  [KeyEncoding.kKeyEncodingPKCS1]: 'pkcs1',
-  [KeyEncoding.kKeyEncodingPKCS8]: 'pkcs8',
-  [KeyEncoding.kKeyEncodingSPKI]: 'spki',
-  [KeyEncoding.kKeyEncodingSEC1]: 'sec1',
+  [KeyEncoding.PKCS1]: 'pkcs1',
+  [KeyEncoding.PKCS8]: 'pkcs8',
+  [KeyEncoding.SPKI]: 'spki',
+  [KeyEncoding.SEC1]: 'sec1',
 };
 
 function option(name: string, objName?: string) {
@@ -116,9 +123,9 @@ function parseKeyFormat(
 ) {
   if (formatStr === undefined && defaultFormat !== undefined)
     return defaultFormat;
-  else if (formatStr === 'pem') return KFormatType.kKeyFormatPEM;
-  else if (formatStr === 'der') return KFormatType.kKeyFormatDER;
-  else if (formatStr === 'jwk') return KFormatType.kKeyFormatJWK;
+  else if (formatStr === 'pem') return KFormatType.PEM;
+  else if (formatStr === 'der') return KFormatType.DER;
+  else if (formatStr === 'jwk') return KFormatType.JWK;
   throw new Error(`Invalid key format str: ${optionName}`);
 }
 
@@ -137,18 +144,18 @@ function parseKeyType(
         `Crypto incompatible key options: ${typeStr} can only be used for RSA keys`,
       );
     }
-    return KeyEncoding.kKeyEncodingPKCS1;
+    return KeyEncoding.PKCS1;
   } else if (typeStr === 'spki' && isPublic !== false) {
-    return KeyEncoding.kKeyEncodingSPKI;
+    return KeyEncoding.SPKI;
   } else if (typeStr === 'pkcs8' && isPublic !== true) {
-    return KeyEncoding.kKeyEncodingPKCS8;
+    return KeyEncoding.PKCS8;
   } else if (typeStr === 'sec1' && isPublic !== true) {
     if (keyType !== undefined && keyType !== 'ec') {
       throw new Error(
         `Incompatible key options ${typeStr} can only be used for EC keys`,
       );
     }
-    return KeyEncoding.kKeyEncodingSEC1;
+    return KeyEncoding.SEC1;
   }
 
   throw new Error(`Invalid option ${optionName} - ${typeStr}`);
@@ -165,13 +172,12 @@ function parseKeyFormatAndType(
   const isInput = keyType === undefined;
   const format = parseKeyFormat(
     formatStr,
-    isInput ? KFormatType.kKeyFormatPEM : undefined,
+    isInput ? KFormatType.PEM : undefined,
     option('format', objName),
   );
 
   const isRequired =
-    (!isInput || format === KFormatType.kKeyFormatDER) &&
-    format !== KFormatType.kKeyFormatJWK;
+    (!isInput || format === KFormatType.DER) && format !== KFormatType.JWK;
 
   const type = parseKeyType(
     typeStr,

package/src/pbkdf2.ts

@@ -80,7 +80,7 @@ export function pbkdf2Sync(
   iterations: number,
   keylen: number,
   digest?: HashAlgorithm,
-): ArrayBuffer {
+): Buffer {
   const sanitizedPassword = sanitizeInput(password, WRONG_PASS);
   const sanitizedSalt = sanitizeInput(salt, WRONG_SALT);
 

package/src/random.ts

@@ -269,6 +269,13 @@ export type RandomTypedArrays =
   | Uint8Array
   | Uint16Array
   | Uint32Array;
+
+/**
+ * Fills the provided typed array with cryptographically strong random values.
+ *
+ * @param data The data to fill with random values
+ * @returns The filled data
+ */
 export function getRandomValues(data: RandomTypedArrays) {
   if (data.byteLength > 65536) {
     throw new Error('The requested length exceeds 65,536 bytes');