react-native-quick-crypto 1.0.9 → 1.0.10

package/src/subtle.ts

@@ -14,10 +14,11 @@ import type {
   AesCtrParams,
   AesCbcParams,
   AesGcmParams,
+  AesOcbParams,
   RsaOaepParams,
   ChaCha20Poly1305Params,
 } from './utils';
-import { KFormatType, KeyEncoding } from './utils';
+import { KFormatType, KeyEncoding, KeyType } from './utils';
 import {
   CryptoKey,
   KeyObject,
@@ -90,7 +91,22 @@ function normalizeAlgorithm(
 }
 
 function getAlgorithmName(name: string, length: number): string {
-  return `${name}${length}`;
+  switch (name) {
+    case 'AES-CBC':
+      return `A${length}CBC`;
+    case 'AES-CTR':
+      return `A${length}CTR`;
+    case 'AES-GCM':
+      return `A${length}GCM`;
+    case 'AES-KW':
+      return `A${length}KW`;
+    case 'AES-OCB':
+      return `A${length}OCB`;
+    case 'ChaCha20-Poly1305':
+      return 'C20P';
+    default:
+      return `${name}${length}`;
+  }
 }
 
 // Placeholder implementations for missing functions
@@ -198,6 +214,8 @@ async function aesCipher(
       return aesCbcCipher(mode, key, data, algorithm as AesCbcParams);
     case 'AES-GCM':
       return aesGcmCipher(mode, key, data, algorithm as AesGcmParams);
+    case 'AES-OCB':
+      return aesOcbCipher(mode, key, data, algorithm as AesOcbParams);
     default:
       throw lazyDOMException(
         `Unsupported AES algorithm: ${name}`,
@@ -294,45 +312,45 @@ async function aesCbcCipher(
   return result.buffer;
 }
 
-async function aesGcmCipher(
+interface AeadCipherConfig {
+  algorithmName: string;
+  validTagLengths: number[];
+  cipherSuffix: string;
+  iv: ArrayBuffer;
+}
+
+async function aesAeadCipher(
   mode: CipherOrWrapMode,
   key: CryptoKey,
   data: ArrayBuffer,
-  algorithm: AesGcmParams,
+  config: AeadCipherConfig,
+  additionalData?: BufferLike,
+  tagLength: number = 128,
 ): Promise<ArrayBuffer> {
-  const { tagLength = 128 } = algorithm;
-
-  // Validate tag length
-  const validTagLengths = [32, 64, 96, 104, 112, 120, 128];
-  if (!validTagLengths.includes(tagLength)) {
+  if (!config.validTagLengths.includes(tagLength)) {
     throw lazyDOMException(
-      `${tagLength} is not a valid AES-GCM tag length`,
+      `${tagLength} is not a valid ${config.algorithmName} tag length`,
       'OperationError',
     );
   }
 
   const tagByteLength = tagLength / 8;
-
-  // Get cipher type based on key length
   const keyLength = (key.algorithm as { length: number }).length;
-  const cipherType = `aes-${keyLength}-gcm`;
+  const cipherType = `aes-${keyLength}-${config.cipherSuffix}`;
 
-  // Create cipher
   const factory =
     NitroModules.createHybridObject<CipherFactory>('CipherFactory');
   const cipher = factory.createCipher({
     isCipher: mode === CipherOrWrapMode.kWebCryptoCipherEncrypt,
     cipherType,
     cipherKey: bufferLikeToArrayBuffer(key.keyObject.export()),
-    iv: bufferLikeToArrayBuffer(algorithm.iv),
+    iv: config.iv,
     authTagLen: tagByteLength,
   });
 
   let processData: ArrayBuffer;
-  let authTag: ArrayBuffer | undefined;
 
   if (mode === CipherOrWrapMode.kWebCryptoCipherDecrypt) {
-    // For decryption, extract auth tag from end of data
     const dataView = new Uint8Array(data);
 
     if (dataView.byteLength < tagByteLength) {
@@ -342,28 +360,22 @@ async function aesGcmCipher(
       );
     }
 
-    // Split data and tag
     const ciphertextLength = dataView.byteLength - tagByteLength;
     processData = dataView.slice(0, ciphertextLength).buffer;
-    authTag = dataView.slice(ciphertextLength).buffer;
-
-    // Set auth tag for verification
+    const authTag = dataView.slice(ciphertextLength).buffer;
     cipher.setAuthTag(authTag);
   } else {
     processData = data;
   }
 
-  // Set additional authenticated data if provided
-  if (algorithm.additionalData) {
-    cipher.setAAD(bufferLikeToArrayBuffer(algorithm.additionalData));
+  if (additionalData) {
+    cipher.setAAD(bufferLikeToArrayBuffer(additionalData));
   }
 
-  // Process data
   const updated = cipher.update(processData);
   const final = cipher.final();
 
   if (mode === CipherOrWrapMode.kWebCryptoCipherEncrypt) {
-    // For encryption, append auth tag to result
     const tag = cipher.getAuthTag();
     const result = new Uint8Array(
       updated.byteLength + final.byteLength + tag.byteLength,
@@ -373,7 +385,6 @@ async function aesGcmCipher(
     result.set(new Uint8Array(tag), updated.byteLength + final.byteLength);
     return result.buffer;
   } else {
-    // For decryption, just concatenate plaintext
     const result = new Uint8Array(updated.byteLength + final.byteLength);
     result.set(new Uint8Array(updated), 0);
     result.set(new Uint8Array(final), updated.byteLength);
@@ -381,6 +392,56 @@ async function aesGcmCipher(
   }
 }
 
+async function aesGcmCipher(
+  mode: CipherOrWrapMode,
+  key: CryptoKey,
+  data: ArrayBuffer,
+  algorithm: AesGcmParams,
+): Promise<ArrayBuffer> {
+  return aesAeadCipher(
+    mode,
+    key,
+    data,
+    {
+      algorithmName: 'AES-GCM',
+      validTagLengths: [32, 64, 96, 104, 112, 120, 128],
+      cipherSuffix: 'gcm',
+      iv: bufferLikeToArrayBuffer(algorithm.iv),
+    },
+    algorithm.additionalData,
+    algorithm.tagLength,
+  );
+}
+
+async function aesOcbCipher(
+  mode: CipherOrWrapMode,
+  key: CryptoKey,
+  data: ArrayBuffer,
+  algorithm: AesOcbParams,
+): Promise<ArrayBuffer> {
+  const ivBuffer = bufferLikeToArrayBuffer(algorithm.iv);
+  if (ivBuffer.byteLength < 1 || ivBuffer.byteLength > 15) {
+    throw lazyDOMException(
+      'AES-OCB algorithm.iv must be between 1 and 15 bytes',
+      'OperationError',
+    );
+  }
+
+  return aesAeadCipher(
+    mode,
+    key,
+    data,
+    {
+      algorithmName: 'AES-OCB',
+      validTagLengths: [64, 96, 128],
+      cipherSuffix: 'ocb',
+      iv: ivBuffer,
+    },
+    algorithm.additionalData,
+    algorithm.tagLength,
+  );
+}
+
 async function aesKwCipher(
   mode: CipherOrWrapMode,
   key: CryptoKey,
@@ -891,7 +952,7 @@ async function aesImportKey(
 
 function edImportKey(
   format: ImportFormat,
-  data: BufferLike,
+  data: BufferLike | JWK,
   algorithm: SubtleAlgorithm,
   extractable: boolean,
   keyUsages: KeyUsage[],
@@ -915,7 +976,7 @@ function edImportKey(
 
   if (format === 'spki') {
     // Import public key
-    const keyData = bufferLikeToArrayBuffer(data);
+    const keyData = bufferLikeToArrayBuffer(data as BufferLike);
     keyObject = KeyObject.createKeyObject(
       'public',
       keyData,
@@ -924,7 +985,7 @@ function edImportKey(
     );
   } else if (format === 'pkcs8') {
     // Import private key
-    const keyData = bufferLikeToArrayBuffer(data);
+    const keyData = bufferLikeToArrayBuffer(data as BufferLike);
     keyObject = KeyObject.createKeyObject(
       'private',
       keyData,
@@ -933,13 +994,26 @@ function edImportKey(
     );
   } else if (format === 'raw') {
     // Raw format - public key only for Ed keys
-    const keyData = bufferLikeToArrayBuffer(data);
+    const keyData = bufferLikeToArrayBuffer(data as BufferLike);
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
     // For raw Ed keys, we need to create them differently
     // Raw public keys are just the key bytes
     handle.init(1, keyData); // 1 = public key type
     keyObject = new PublicKeyObject(handle);
+  } else if (format === 'jwk') {
+    const jwkData = data as JWK;
+    const handle =
+      NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
+    const keyType = handle.initJwk(jwkData);
+    if (keyType === undefined) {
+      throw lazyDOMException('Invalid JWK data', 'DataError');
+    }
+    if (keyType === KeyType.PRIVATE) {
+      keyObject = new PrivateKeyObject(handle);
+    } else {
+      keyObject = new PublicKeyObject(handle);
+    }
   } else {
     throw lazyDOMException(
       `Unsupported format for ${name} import: ${format}`,
@@ -1133,6 +1207,8 @@ const exportKeyRaw = (key: CryptoKey): ArrayBuffer | unknown => {
     // Fall through
     case 'AES-KW':
     // Fall through
+    case 'AES-OCB':
+    // Fall through
     case 'ChaCha20-Poly1305':
     // Fall through
     case 'HMAC': {
@@ -1177,6 +1253,14 @@ const exportKeyJWK = (key: CryptoKey): ArrayBuffer | unknown => {
     case 'ECDH':
       jwk.crv ||= key.algorithm.namedCurve;
       return jwk;
+    case 'Ed25519':
+    // Fall through
+    case 'Ed448':
+    // Fall through
+    case 'X25519':
+    // Fall through
+    case 'X448':
+      return jwk;
     case 'AES-CTR':
     // Fall through
     case 'AES-CBC':
@@ -1185,6 +1269,8 @@ const exportKeyJWK = (key: CryptoKey): ArrayBuffer | unknown => {
     // Fall through
     case 'AES-KW':
     // Fall through
+    case 'AES-OCB':
+    // Fall through
     case 'ChaCha20-Poly1305':
       if (key.algorithm.length === undefined) {
         throw lazyDOMException(
@@ -1503,6 +1589,8 @@ const cipherOrWrap = async (
     case 'AES-CBC':
     // Fall through
     case 'AES-GCM':
+    // Fall through
+    case 'AES-OCB':
       return aesCipher(mode, key, data, algorithm);
     case 'AES-KW':
       return aesKwCipher(mode, key, data);
@@ -1613,6 +1701,9 @@ export class Subtle {
       case 'X448':
         derivedBits = await xDeriveBits(algorithm, baseKey, length);
         break;
+      case 'ECDH':
+        derivedBits = await ecDeriveBits(algorithm, baseKey, length);
+        break;
       case 'HKDF':
         derivedBits = hkdfDeriveBits(
           algorithm as unknown as HkdfAlgorithm,
@@ -1657,6 +1748,8 @@ export class Subtle {
   ): Promise<ArrayBuffer | JWK> {
     if (!key.extractable) throw new Error('key is not extractable');
 
+    if (format === 'raw-secret') format = 'raw';
+
     switch (format) {
       case 'spki':
         return (await exportKeySpki(key)) as ArrayBuffer;
@@ -1811,6 +1904,8 @@ export class Subtle {
       case 'AES-GCM':
       // Fall through
       case 'AES-KW':
+      // Fall through
+      case 'AES-OCB':
         result = await aesGenerateKey(
           algorithm as AesKeyGenParams,
           extractable,
@@ -1889,6 +1984,7 @@ export class Subtle {
     extractable: boolean,
     keyUsages: KeyUsage[],
   ): Promise<CryptoKey> {
+    if (format === 'raw-secret') format = 'raw';
     const normalizedAlgorithm = normalizeAlgorithm(algorithm, 'importKey');
     let result: CryptoKey;
     switch (normalizedAlgorithm.name) {
@@ -1933,6 +2029,8 @@ export class Subtle {
       // Fall through
       case 'AES-KW':
       // Fall through
+      case 'AES-OCB':
+      // Fall through
       case 'ChaCha20-Poly1305':
         result = await aesImportKey(
           normalizedAlgorithm,
@@ -1969,7 +2067,7 @@ export class Subtle {
       case 'Ed448':
         result = edImportKey(
           format,
-          data as BufferLike,
+          data as BufferLike | JWK,
           normalizedAlgorithm,
           extractable,
           keyUsages,
@@ -2121,6 +2219,7 @@ function getKeyLength(algorithm: SubtleAlgorithm): number {
     case 'AES-CBC':
     case 'AES-GCM':
     case 'AES-KW':
+    case 'AES-OCB':
     case 'ChaCha20-Poly1305':
       return (algorithm as AesKeyGenParams).length || 256;
 

package/src/utils/types.ts

@@ -80,7 +80,12 @@ export type KeyPairAlgorithm =
   | CFRGKeyPairAlgorithm
   | PQCKeyPairAlgorithm;
 
-export type AESAlgorithm = 'AES-CTR' | 'AES-CBC' | 'AES-GCM' | 'AES-KW';
+export type AESAlgorithm =
+  | 'AES-CTR'
+  | 'AES-CBC'
+  | 'AES-GCM'
+  | 'AES-KW'
+  | 'AES-OCB';
 
 export type SecretKeyAlgorithm = 'HMAC' | AESAlgorithm;
 
@@ -108,6 +113,7 @@ export type EncryptDecryptAlgorithm =
   | 'AES-CBC'
   | 'AES-GCM'
   | 'AES-KW'
+  | 'AES-OCB'
   | 'ChaCha20-Poly1305';
 
 export type RsaOaepParams = {
@@ -140,6 +146,13 @@ export type ChaCha20Poly1305Params = {
   additionalData?: BufferLike;
 };
 
+export type AesOcbParams = {
+  name: 'AES-OCB';
+  iv: BufferLike;
+  tagLength?: 64 | 96 | 128;
+  additionalData?: BufferLike;
+};
+
 export type AesKwParams = {
   name: 'AES-KW';
   wrappingKey?: BufferLike;
@@ -158,6 +171,7 @@ export type EncryptDecryptParams =
   | AesCbcParams
   | AesCtrParams
   | AesGcmParams
+  | AesOcbParams
   | AesKwParams
   | RsaOaepParams
   | ChaCha20Poly1305Params;
@@ -187,6 +201,7 @@ export type SubtleAlgorithm = {
   modulusLength?: number;
   publicExponent?: number | Uint8Array;
   saltLength?: number;
+  public?: CryptoKey;
 };
 
 export type KeyPairType =
@@ -264,7 +279,7 @@ export type AsymmetricKeyType =
   | CFRGKeyPairType
   | PQCKeyPairType;
 
-type JWKkty = 'AES' | 'RSA' | 'EC' | 'oct';
+type JWKkty = 'AES' | 'RSA' | 'EC' | 'oct' | 'OKP';
 type JWKuse = 'sig' | 'enc';
 
 export interface JWK {
@@ -447,7 +462,7 @@ export type DiffieHellmanCallback = (
 // from @paulmillr/noble-curves
 export type Hex = string | Uint8Array;
 
-export type ImportFormat = 'raw' | 'pkcs8' | 'spki' | 'jwk';
+export type ImportFormat = 'raw' | 'raw-secret' | 'pkcs8' | 'spki' | 'jwk';
 
 export type Operation =
   | 'encrypt'

package/deps/ncrypto/WORKSPACE

@@ -1,15 +0,0 @@
-workspace(name = "ncrypto")
-
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-http_archive(
-    name = "ssl",
-    sha256 = "64529449ef458381346b163302523a1fb876e5b667bec4a4bd38d0d2fff8b42b",
-    strip_prefix = "boringssl-0.20250818.0",
-    type = "tgz",
-    urls = ["https://github.com/google/boringssl/archive/refs/tags/0.20250818.0.tar.gz"],
-    patches = [
-         "@ncrypto//:patches/0001-Expose-libdecrepit-so-NodeJS-can-use-it-for-ncrypto.patch"
-    ],
-    patch_strip = 1
-)