react-native-quick-crypto 1.0.11 → 1.0.13

package/src/mlkem.ts

@@ -0,0 +1,350 @@
+import { NitroModules } from 'react-native-nitro-modules';
+import type { MlKemKeyPair } from './specs/mlKemKeyPair.nitro';
+import {
+  CryptoKey,
+  KeyObject,
+  PublicKeyObject,
+  PrivateKeyObject,
+  isCryptoKey,
+} from './keys';
+import type {
+  CryptoKeyPair,
+  KeyUsage,
+  SubtleAlgorithm,
+  EncapsulateResult,
+  BinaryLike,
+} from './utils';
+import {
+  hasAnyNotIn,
+  lazyDOMException,
+  getUsagesUnion,
+  KFormatType,
+  KeyEncoding,
+  isStringOrBuffer,
+  binaryLikeToArrayBuffer as toAB,
+} from './utils';
+
+export type MlKemVariant = 'ML-KEM-512' | 'ML-KEM-768' | 'ML-KEM-1024';
+
+type MlKemKeyType = 'ml-kem-512' | 'ml-kem-768' | 'ml-kem-1024';
+
+type KeyInput = BinaryLike | KeyObject | CryptoKey | KeyInputObject;
+
+export interface KeyInputObject {
+  key: BinaryLike | KeyObject | CryptoKey;
+  format?: 'pem' | 'der';
+  type?: 'pkcs1' | 'pkcs8' | 'spki' | 'sec1';
+}
+
+const ML_KEM_VARIANTS: Record<MlKemKeyType, MlKemVariant> = {
+  'ml-kem-512': 'ML-KEM-512',
+  'ml-kem-768': 'ML-KEM-768',
+  'ml-kem-1024': 'ML-KEM-1024',
+};
+
+function isMlKemKeyType(type: string): type is MlKemKeyType {
+  return type in ML_KEM_VARIANTS;
+}
+
+function unpackEncapsulateResult(packed: ArrayBuffer): EncapsulateResult {
+  const view = new DataView(packed);
+  const ciphertextLen = view.getUint32(0, true);
+  const sharedKeyLen = view.getUint32(4, true);
+  const headerSize = 8;
+  const ciphertext = packed.slice(headerSize, headerSize + ciphertextLen);
+  const sharedKey = packed.slice(
+    headerSize + ciphertextLen,
+    headerSize + ciphertextLen + sharedKeyLen,
+  );
+  return { ciphertext, sharedKey };
+}
+
+export class MlKem {
+  variant: MlKemVariant;
+  native: MlKemKeyPair;
+
+  constructor(variant: MlKemVariant) {
+    this.variant = variant;
+    this.native = NitroModules.createHybridObject<MlKemKeyPair>('MlKemKeyPair');
+    this.native.setVariant(variant);
+  }
+
+  async generateKeyPair(): Promise<void> {
+    await this.native.generateKeyPair(
+      KFormatType.DER,
+      KeyEncoding.SPKI,
+      KFormatType.DER,
+      KeyEncoding.PKCS8,
+    );
+  }
+
+  generateKeyPairSync(): void {
+    this.native.generateKeyPairSync(
+      KFormatType.DER,
+      KeyEncoding.SPKI,
+      KFormatType.DER,
+      KeyEncoding.PKCS8,
+    );
+  }
+
+  getPublicKey(): ArrayBuffer {
+    return this.native.getPublicKey();
+  }
+
+  getPrivateKey(): ArrayBuffer {
+    return this.native.getPrivateKey();
+  }
+
+  setPublicKey(keyData: ArrayBuffer, format: number, type: number): void {
+    this.native.setPublicKey(keyData, format, type);
+  }
+
+  setPrivateKey(keyData: ArrayBuffer, format: number, type: number): void {
+    this.native.setPrivateKey(keyData, format, type);
+  }
+
+  async encapsulate(): Promise<EncapsulateResult> {
+    const packed = await this.native.encapsulate();
+    return unpackEncapsulateResult(packed);
+  }
+
+  encapsulateSync(): EncapsulateResult {
+    const packed = this.native.encapsulateSync();
+    return unpackEncapsulateResult(packed);
+  }
+
+  async decapsulate(ciphertext: ArrayBuffer): Promise<ArrayBuffer> {
+    return this.native.decapsulate(ciphertext);
+  }
+
+  decapsulateSync(ciphertext: ArrayBuffer): ArrayBuffer {
+    return this.native.decapsulateSync(ciphertext);
+  }
+}
+
+function prepareKey(
+  key: KeyInput,
+  isPublic: boolean,
+): { keyObject: KeyObject } {
+  if (key instanceof KeyObject) {
+    if (isPublic) {
+      if (key.type === 'secret') {
+        throw new Error('Cannot use secret key for encapsulation');
+      }
+    } else {
+      if (key.type !== 'private') {
+        throw new Error('Key must be a private key for decapsulation');
+      }
+    }
+    return { keyObject: key };
+  }
+
+  if (isCryptoKey(key)) {
+    const cryptoKey = key as CryptoKey;
+    return prepareKey(cryptoKey.keyObject, isPublic);
+  }
+
+  if (isStringOrBuffer(key)) {
+    const isPem = typeof key === 'string' && key.includes('-----BEGIN');
+    const format = isPem ? KFormatType.PEM : undefined;
+    const keyType = isPublic ? 'public' : 'private';
+    const keyData = toAB(key);
+    const keyObject = KeyObject.createKeyObject(keyType, keyData, format);
+    return { keyObject };
+  }
+
+  if (typeof key === 'object' && 'key' in key) {
+    const keyObj = key as KeyInputObject;
+    const { key: data, format, type } = keyObj;
+
+    if (data instanceof KeyObject) {
+      return { keyObject: data };
+    }
+
+    if (isCryptoKey(data)) {
+      return { keyObject: (data as CryptoKey).keyObject };
+    }
+
+    if (!isStringOrBuffer(data)) {
+      throw new Error('Invalid key data type');
+    }
+
+    const isPem =
+      format === 'pem' ||
+      (typeof data === 'string' && data.includes('-----BEGIN'));
+    const kFormat = isPem
+      ? KFormatType.PEM
+      : format === 'der'
+        ? KFormatType.DER
+        : undefined;
+
+    let kType: KeyEncoding | undefined;
+    if (type === 'pkcs8') kType = KeyEncoding.PKCS8;
+    else if (type === 'pkcs1') kType = KeyEncoding.PKCS1;
+    else if (type === 'sec1') kType = KeyEncoding.SEC1;
+    else if (type === 'spki') kType = KeyEncoding.SPKI;
+
+    const keyType = isPublic ? 'public' : 'private';
+    const keyData = toAB(data);
+    const keyObject = KeyObject.createKeyObject(
+      keyType,
+      keyData,
+      kFormat,
+      kType,
+    );
+    return { keyObject };
+  }
+
+  throw new Error('Invalid key input');
+}
+
+function getVariantFromKey(keyObject: KeyObject): MlKemVariant {
+  const keyType = keyObject.handle.getAsymmetricKeyType();
+  if (!isMlKemKeyType(keyType)) {
+    throw new Error(
+      `Key is not an ML-KEM key. Got asymmetricKeyType: ${keyType}`,
+    );
+  }
+  return ML_KEM_VARIANTS[keyType];
+}
+
+export function encapsulate(
+  key: KeyInput,
+  callback?: (err: Error | null, result?: EncapsulateResult) => void,
+): EncapsulateResult | void {
+  const doEncapsulate = (): EncapsulateResult => {
+    if (key === null || key === undefined) {
+      throw new Error('Public key is required for encapsulation');
+    }
+
+    const { keyObject } = prepareKey(key, true);
+    const variant = getVariantFromKey(keyObject);
+    const mlkem = new MlKem(variant);
+
+    const keyData = keyObject.handle.exportKey(
+      KFormatType.DER,
+      KeyEncoding.SPKI,
+    );
+    mlkem.setPublicKey(keyData, KFormatType.DER, KeyEncoding.SPKI);
+
+    return mlkem.encapsulateSync();
+  };
+
+  if (callback) {
+    try {
+      const result = doEncapsulate();
+      process.nextTick(callback, null, result);
+    } catch (err) {
+      process.nextTick(callback, err as Error);
+    }
+    return;
+  }
+
+  return doEncapsulate();
+}
+
+export function decapsulate(
+  key: KeyInput,
+  ciphertext: BinaryLike,
+  callback?: (err: Error | null, result?: ArrayBuffer) => void,
+): ArrayBuffer | void {
+  const doDecapsulate = (): ArrayBuffer => {
+    if (key === null || key === undefined) {
+      throw new Error('Private key is required for decapsulation');
+    }
+
+    const { keyObject } = prepareKey(key, false);
+    const variant = getVariantFromKey(keyObject);
+    const mlkem = new MlKem(variant);
+
+    const keyData = keyObject.handle.exportKey(
+      KFormatType.DER,
+      KeyEncoding.PKCS8,
+    );
+    mlkem.setPrivateKey(keyData, KFormatType.DER, KeyEncoding.PKCS8);
+
+    const ciphertextBuffer = toAB(ciphertext) as ArrayBuffer;
+    return mlkem.decapsulateSync(ciphertextBuffer);
+  };
+
+  if (callback) {
+    try {
+      const result = doDecapsulate();
+      process.nextTick(callback, null, result);
+    } catch (err) {
+      process.nextTick(callback, err as Error);
+    }
+    return;
+  }
+
+  return doDecapsulate();
+}
+
+export async function mlkem_generateKeyPairWebCrypto(
+  variant: MlKemVariant,
+  extractable: boolean,
+  keyUsages: KeyUsage[],
+): Promise<CryptoKeyPair> {
+  if (
+    hasAnyNotIn(keyUsages, [
+      'encapsulateBits',
+      'encapsulateKey',
+      'decapsulateBits',
+      'decapsulateKey',
+    ])
+  ) {
+    throw lazyDOMException(
+      `Unsupported key usage for ${variant}`,
+      'SyntaxError',
+    );
+  }
+
+  const publicUsages = getUsagesUnion(
+    keyUsages,
+    'encapsulateBits',
+    'encapsulateKey',
+  );
+  const privateUsages = getUsagesUnion(
+    keyUsages,
+    'decapsulateBits',
+    'decapsulateKey',
+  );
+
+  if (privateUsages.length === 0) {
+    throw lazyDOMException('Usages cannot be empty', 'SyntaxError');
+  }
+
+  const mlkem = new MlKem(variant);
+  await mlkem.generateKeyPair();
+
+  const publicKeyData = mlkem.getPublicKey();
+  const privateKeyData = mlkem.getPrivateKey();
+
+  const pub = KeyObject.createKeyObject(
+    'public',
+    publicKeyData,
+    KFormatType.DER,
+    KeyEncoding.SPKI,
+  ) as PublicKeyObject;
+  const publicKey = new CryptoKey(
+    pub,
+    { name: variant } as SubtleAlgorithm,
+    publicUsages,
+    true,
+  );
+
+  const priv = KeyObject.createKeyObject(
+    'private',
+    privateKeyData,
+    KFormatType.DER,
+    KeyEncoding.PKCS8,
+  ) as PrivateKeyObject;
+  const privateKey = new CryptoKey(
+    priv,
+    { name: variant } as SubtleAlgorithm,
+    privateUsages,
+    extractable,
+  );
+
+  return { publicKey, privateKey };
+}

package/src/pbkdf2.ts

@@ -8,7 +8,7 @@ import {
   lazyDOMException,
   normalizeHashName,
 } from './utils';
-import type { HashAlgorithm, SubtleAlgorithm } from './utils';
+import type { SubtleAlgorithm } from './utils';
 import type { Pbkdf2 } from './specs/pbkdf2.nitro';
 import { promisify } from 'util';
 import type { CryptoKey } from './keys';
@@ -31,6 +31,33 @@ function getNative(): Pbkdf2 {
   return native;
 }
 
+const MAX_INT32 = 2147483647;
+
+function validateParameters(iterations: number, keylen: number): void {
+  if (typeof iterations !== 'number') {
+    throw new TypeError('Iterations not a number');
+  }
+  if (typeof keylen !== 'number') {
+    throw new TypeError('Key length not a number');
+  }
+  if (
+    iterations < 1 ||
+    !Number.isFinite(iterations) ||
+    !Number.isInteger(iterations) ||
+    iterations > MAX_INT32
+  ) {
+    throw new TypeError('Bad iterations');
+  }
+  if (
+    keylen < 0 ||
+    !Number.isFinite(keylen) ||
+    !Number.isInteger(keylen) ||
+    keylen > MAX_INT32
+  ) {
+    throw new TypeError('Bad key length');
+  }
+}
+
 function sanitizeInput(input: BinaryLike, errorMsg: string): ArrayBuffer {
   try {
     return binaryLikeToArrayBuffer(input);
@@ -51,6 +78,7 @@ export function pbkdf2(
   if (callback === undefined || typeof callback !== 'function') {
     throw new Error('No callback provided to pbkdf2');
   }
+  validateParameters(iterations, keylen);
   const sanitizedPassword = sanitizeInput(password, WRONG_PASS);
   const sanitizedSalt = sanitizeInput(salt, WRONG_SALT);
   const normalizedDigest = normalizeHashName(digest, HashContext.Node);
@@ -79,12 +107,13 @@ export function pbkdf2Sync(
   salt: Salt,
   iterations: number,
   keylen: number,
-  digest?: HashAlgorithm,
+  digest: string,
 ): Buffer {
+  validateParameters(iterations, keylen);
   const sanitizedPassword = sanitizeInput(password, WRONG_PASS);
   const sanitizedSalt = sanitizeInput(salt, WRONG_SALT);
 
-  const algo = digest ? normalizeHashName(digest, HashContext.Node) : 'sha1';
+  const algo = normalizeHashName(digest, HashContext.Node);
   getNative();
   const result: ArrayBuffer = native.pbkdf2Sync(
     sanitizedPassword,
@@ -104,7 +133,7 @@ const pbkdf2WithDigest = (
   salt: Salt,
   iterations: number,
   keylen: number,
-  digest: HashAlgorithm,
+  digest: string,
   callback: Pbkdf2Callback,
 ) => pbkdf2(password, salt, iterations, keylen, digest, callback);
 
@@ -142,7 +171,7 @@ export async function pbkdf2DeriveBits(
     sanitizedSalt,
     iterations,
     length / 8,
-    normalizedHash as HashAlgorithm,
+    normalizedHash,
   );
   if (!result) {
     throw lazyDOMException(

package/src/rsa.ts

@@ -4,7 +4,7 @@ import {
   KeyObject,
   PrivateKeyObject,
   PublicKeyObject,
-} from './keys';
+} from './keys/classes';
 import {
   getUsagesUnion,
   hasAnyNotIn,

package/src/specs/keyObjectHandle.nitro.ts

@@ -27,6 +27,11 @@ export interface KeyObjectHandle
     passphrase?: ArrayBuffer,
   ): boolean;
   initECRaw(namedCurve: string, keyData: ArrayBuffer): boolean;
+  initPqcRaw(
+    algorithmName: string,
+    keyData: ArrayBuffer,
+    isPublic: boolean,
+  ): boolean;
   initJwk(keyData: JWK, namedCurve?: NamedCurve): KeyType | undefined;
   keyDetail(): KeyDetail;
   keyEquals(other: KeyObjectHandle): boolean;

package/src/specs/kmac.nitro.ts

@@ -0,0 +1,12 @@
+import type { HybridObject } from 'react-native-nitro-modules';
+
+export interface Kmac extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
+  createKmac(
+    algorithm: string,
+    key: ArrayBuffer,
+    outputLength: number,
+    customization?: ArrayBuffer,
+  ): void;
+  update(data: ArrayBuffer): void;
+  digest(): ArrayBuffer;
+}

package/src/specs/mlKemKeyPair.nitro.ts

@@ -0,0 +1,32 @@
+import type { HybridObject } from 'react-native-nitro-modules';
+
+export interface MlKemKeyPair
+  extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
+  setVariant(variant: string): void;
+
+  generateKeyPair(
+    publicFormat: number,
+    publicType: number,
+    privateFormat: number,
+    privateType: number,
+  ): Promise<void>;
+
+  generateKeyPairSync(
+    publicFormat: number,
+    publicType: number,
+    privateFormat: number,
+    privateType: number,
+  ): void;
+
+  getPublicKey(): ArrayBuffer;
+  getPrivateKey(): ArrayBuffer;
+
+  setPublicKey(keyData: ArrayBuffer, format: number, type: number): void;
+  setPrivateKey(keyData: ArrayBuffer, format: number, type: number): void;
+
+  encapsulate(): Promise<ArrayBuffer>;
+  encapsulateSync(): ArrayBuffer;
+
+  decapsulate(ciphertext: ArrayBuffer): Promise<ArrayBuffer>;
+  decapsulateSync(ciphertext: ArrayBuffer): ArrayBuffer;
+}

package/src/specs/x509certificate.nitro.ts

@@ -0,0 +1,38 @@
+import type { HybridObject } from 'react-native-nitro-modules';
+import type { KeyObjectHandle } from './keyObjectHandle.nitro';
+
+export interface X509CertificateHandle
+  extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
+  init(buffer: ArrayBuffer): void;
+
+  subject(): string;
+  subjectAltName(): string;
+  issuer(): string;
+  infoAccess(): string;
+  validFrom(): string;
+  validTo(): string;
+  validFromDate(): number;
+  validToDate(): number;
+  signatureAlgorithm(): string;
+  signatureAlgorithmOid(): string;
+  serialNumber(): string;
+
+  fingerprint(): string;
+  fingerprint256(): string;
+  fingerprint512(): string;
+
+  raw(): ArrayBuffer;
+  pem(): string;
+
+  publicKey(): KeyObjectHandle;
+  keyUsage(): string[];
+
+  ca(): boolean;
+  checkIssued(other: X509CertificateHandle): boolean;
+  checkPrivateKey(key: KeyObjectHandle): boolean;
+  verify(key: KeyObjectHandle): boolean;
+
+  checkHost(name: string, flags: number): string | undefined;
+  checkEmail(email: string, flags: number): string | undefined;
+  checkIP(ip: string): string | undefined;
+}