react-native-quick-crypto 1.1.0 → 1.1.2

package/nitrogen/generated/shared/c++/TurboShakeVariant.hpp

@@ -0,0 +1,76 @@
+///
+/// TurboShakeVariant.hpp
+/// This file was generated by nitrogen. DO NOT MODIFY THIS FILE.
+/// https://github.com/mrousavy/nitro
+/// Copyright © Marc Rousavy @ Margelo
+///
+
+#pragma once
+
+#if __has_include(<NitroModules/NitroHash.hpp>)
+#include <NitroModules/NitroHash.hpp>
+#else
+#error NitroModules cannot be found! Are you sure you installed NitroModules properly?
+#endif
+#if __has_include(<NitroModules/JSIConverter.hpp>)
+#include <NitroModules/JSIConverter.hpp>
+#else
+#error NitroModules cannot be found! Are you sure you installed NitroModules properly?
+#endif
+#if __has_include(<NitroModules/NitroDefines.hpp>)
+#include <NitroModules/NitroDefines.hpp>
+#else
+#error NitroModules cannot be found! Are you sure you installed NitroModules properly?
+#endif
+
+namespace margelo::nitro::crypto {
+
+  /**
+   * An enum which can be represented as a JavaScript union (TurboShakeVariant).
+   */
+  enum class TurboShakeVariant {
+    TURBOSHAKE128      SWIFT_NAME(turboshake128) = 0,
+    TURBOSHAKE256      SWIFT_NAME(turboshake256) = 1,
+  } CLOSED_ENUM;
+
+} // namespace margelo::nitro::crypto
+
+namespace margelo::nitro {
+
+  // C++ TurboShakeVariant <> JS TurboShakeVariant (union)
+  template <>
+  struct JSIConverter<margelo::nitro::crypto::TurboShakeVariant> final {
+    static inline margelo::nitro::crypto::TurboShakeVariant fromJSI(jsi::Runtime& runtime, const jsi::Value& arg) {
+      std::string unionValue = JSIConverter<std::string>::fromJSI(runtime, arg);
+      switch (hashString(unionValue.c_str(), unionValue.size())) {
+        case hashString("TurboSHAKE128"): return margelo::nitro::crypto::TurboShakeVariant::TURBOSHAKE128;
+        case hashString("TurboSHAKE256"): return margelo::nitro::crypto::TurboShakeVariant::TURBOSHAKE256;
+        default: [[unlikely]]
+          throw std::invalid_argument("Cannot convert \"" + unionValue + "\" to enum TurboShakeVariant - invalid value!");
+      }
+    }
+    static inline jsi::Value toJSI(jsi::Runtime& runtime, margelo::nitro::crypto::TurboShakeVariant arg) {
+      switch (arg) {
+        case margelo::nitro::crypto::TurboShakeVariant::TURBOSHAKE128: return JSIConverter<std::string>::toJSI(runtime, "TurboSHAKE128");
+        case margelo::nitro::crypto::TurboShakeVariant::TURBOSHAKE256: return JSIConverter<std::string>::toJSI(runtime, "TurboSHAKE256");
+        default: [[unlikely]]
+          throw std::invalid_argument("Cannot convert TurboShakeVariant to JS - invalid value: "
+                                    + std::to_string(static_cast<int>(arg)) + "!");
+      }
+    }
+    static inline bool canConvert(jsi::Runtime& runtime, const jsi::Value& value) {
+      if (!value.isString()) {
+        return false;
+      }
+      std::string unionValue = JSIConverter<std::string>::fromJSI(runtime, value);
+      switch (hashString(unionValue.c_str(), unionValue.size())) {
+        case hashString("TurboSHAKE128"):
+        case hashString("TurboSHAKE256"):
+          return true;
+        default:
+          return false;
+      }
+    }
+  };
+
+} // namespace margelo::nitro

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-quick-crypto",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "A fast implementation of Node's `crypto` module written in C/C++ JSI",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -31,16 +31,48 @@
     "android/src",
     "ios",
     "cpp",
-    "deps",
+    "deps/blake3/c",
+    "deps/blake3/LICENSE_A2",
+    "deps/blake3/LICENSE_A2LLVM",
+    "deps/blake3/LICENSE_CC0",
+    "deps/fastpbkdf2",
+    "deps/ncrypto/include",
+    "deps/ncrypto/src/aead.cpp",
+    "deps/ncrypto/src/engine.cpp",
+    "deps/ncrypto/src/ncrypto.cpp",
+    "deps/ncrypto/LICENSE",
+    "deps/simdutf/include",
+    "deps/simdutf/src",
+    "deps/simdutf/LICENSE-MIT",
+    "deps/simdutf/LICENSE-APACHE",
     "nitrogen",
-    "react-native.config.js",
     "*.podspec",
     "README.md",
     "app.plugin.js",
-    "scripts",
     "!**/__tests__",
     "!**/__fixtures__",
-    "!**/__mocks__"
+    "!**/__mocks__",
+    "!**/*.tsbuildinfo",
+    "!ios/libsodium-stable",
+    "!deps/simdutf/src/CMakeLists.txt",
+    "!deps/blake3/c/blake3_c_rust_bindings",
+    "!deps/blake3/c/dependencies",
+    "!deps/blake3/c/*_x86-64_*.S",
+    "!deps/blake3/c/*_x86-64_*.asm",
+    "!deps/blake3/c/blake3_avx2.c",
+    "!deps/blake3/c/blake3_avx512.c",
+    "!deps/blake3/c/blake3_sse2.c",
+    "!deps/blake3/c/blake3_sse41.c",
+    "!deps/blake3/c/blake3_tbb.cpp",
+    "!deps/blake3/c/main.c",
+    "!deps/blake3/c/example.c",
+    "!deps/blake3/c/example_tbb.c",
+    "!deps/blake3/c/test.py",
+    "!deps/blake3/c/Makefile.testing",
+    "!deps/blake3/c/CMakeLists.txt",
+    "!deps/blake3/c/CMakePresets.json",
+    "!deps/blake3/c/blake3-config.cmake.in",
+    "!deps/blake3/c/libblake3.pc.in"
   ],
   "keywords": [
     "react-native",
@@ -132,8 +164,7 @@
           {
             "file": "../../example/package.json",
             "path": [
-              "version",
-              "dependencies.react-native-quick-crypto"
+              "version"
             ]
           }
         ]

package/src/argon2.ts

@@ -26,6 +26,26 @@ export interface Argon2Params {
 
 const ARGON2_VERSION = 0x13; // v1.3
 
+// RFC 9106 § 3.1: Argon2 input/parameter constraints.
+//   p (parallelism)   1   ≤ p ≤ 2^24 - 1
+//   T (tag length)    4   ≤ T ≤ 2^32 - 1
+//   m (memory in KiB) 8*p ≤ m ≤ 2^32 - 1
+//   t (passes)        1   ≤ t ≤ 2^32 - 1
+//   |salt| (nonce)    8   ≤ |s| ≤ 2^32 - 1
+//   v (version)       0x10 (v1.0) or 0x13 (v1.3)
+const ARGON2_MAX_U24 = 0xff_ffff;
+const ARGON2_MAX_U32 = 0xffff_ffff;
+
+function isUInt(value: unknown, max: number): value is number {
+  return (
+    typeof value === 'number' &&
+    Number.isFinite(value) &&
+    Number.isInteger(value) &&
+    value >= 0 &&
+    value <= max
+  );
+}
+
 function validateAlgorithm(algorithm: string): void {
   if (
     algorithm !== 'argon2d' &&
@@ -36,6 +56,56 @@ function validateAlgorithm(algorithm: string): void {
   }
 }
 
+// Returns the resolved nonce ArrayBuffer so the caller can pass it
+// straight to native without re-resolving `params.nonce`.
+function validateArgon2Params(
+  params: Argon2Params,
+  version: number,
+): ArrayBuffer {
+  if (!isUInt(params.parallelism, ARGON2_MAX_U24) || params.parallelism < 1) {
+    throw new RangeError(
+      `Invalid Argon2 parallelism: ${params.parallelism} ` +
+        `(RFC 9106: 1 ≤ p ≤ 2^24 - 1)`,
+    );
+  }
+  if (!isUInt(params.tagLength, ARGON2_MAX_U32) || params.tagLength < 4) {
+    throw new RangeError(
+      `Invalid Argon2 tagLength: ${params.tagLength} ` +
+        `(RFC 9106: 4 ≤ T ≤ 2^32 - 1)`,
+    );
+  }
+  const minMemory = 8 * params.parallelism;
+  if (!isUInt(params.memory, ARGON2_MAX_U32) || params.memory < minMemory) {
+    throw new RangeError(
+      `Invalid Argon2 memory: ${params.memory} KiB ` +
+        `(RFC 9106: 8 * p (= ${minMemory}) ≤ m ≤ 2^32 - 1)`,
+    );
+  }
+  if (!isUInt(params.passes, ARGON2_MAX_U32) || params.passes < 1) {
+    throw new RangeError(
+      `Invalid Argon2 passes: ${params.passes} ` +
+        `(RFC 9106: 1 ≤ t ≤ 2^32 - 1)`,
+    );
+  }
+  if (version !== 0x10 && version !== 0x13) {
+    throw new RangeError(
+      `Invalid Argon2 version: 0x${version.toString(16)} ` +
+        `(RFC 9106: 0x10 or 0x13)`,
+    );
+  }
+  // Salt (nonce) must be 8..2^32 - 1 bytes — measured against the resolved
+  // ArrayBuffer because BinaryLike accepts strings whose UTF-8 length is
+  // what actually reaches OpenSSL.
+  const nonceAB = binaryLikeToArrayBuffer(params.nonce);
+  if (nonceAB.byteLength < 8 || nonceAB.byteLength > ARGON2_MAX_U32) {
+    throw new RangeError(
+      `Invalid Argon2 nonce length: ${nonceAB.byteLength} bytes ` +
+        `(RFC 9106: 8 ≤ |s| ≤ 2^32 - 1)`,
+    );
+  }
+  return nonceAB;
+}
+
 function toAB(value: BinaryLike): ArrayBuffer {
   return binaryLikeToArrayBuffer(value);
 }
@@ -43,10 +113,11 @@ function toAB(value: BinaryLike): ArrayBuffer {
 export function argon2Sync(algorithm: string, params: Argon2Params): Buffer {
   validateAlgorithm(algorithm);
   const version = params.version ?? ARGON2_VERSION;
+  const nonceAB = validateArgon2Params(params, version);
   const result = getNative().hashSync(
     algorithm,
     toAB(params.message),
-    toAB(params.nonce),
+    nonceAB,
     params.parallelism,
     params.tagLength,
     params.memory,
@@ -65,11 +136,18 @@ export function argon2(
 ): void {
   validateAlgorithm(algorithm);
   const version = params.version ?? ARGON2_VERSION;
+  let nonceAB: ArrayBuffer;
+  try {
+    nonceAB = validateArgon2Params(params, version);
+  } catch (err) {
+    callback(err as Error, Buffer.alloc(0));
+    return;
+  }
   getNative()
     .hash(
       algorithm,
       toAB(params.message),
-      toAB(params.nonce),
+      nonceAB,
       params.parallelism,
       params.tagLength,
       params.memory,

package/src/cipher.ts

@@ -65,6 +65,100 @@ export function getCipherInfo(
   return CipherUtils.getCipherInfo(name, options?.keyLength, options?.ivLength);
 }
 
+// libsodium ciphers aren't visible to OpenSSL's EVP_CIPHER_fetch, so
+// getCipherInfo() returns undefined for them. Hard-code the (key, iv)
+// byte-lengths the C++ factory will accept.
+const LIBSODIUM_CIPHER_PARAMS: Readonly<
+  Record<string, { keyLength: number; ivLength: number }>
+> = {
+  xsalsa20: { keyLength: 32, ivLength: 24 },
+  'xsalsa20-poly1305': { keyLength: 32, ivLength: 24 },
+  'xchacha20-poly1305': { keyLength: 32, ivLength: 24 },
+};
+
+function validateCipherParams(
+  cipherType: string,
+  keyByteLength: number,
+  ivByteLength: number,
+): void {
+  if (typeof cipherType !== 'string' || cipherType.length === 0) {
+    throw new TypeError('cipher algorithm must be a non-empty string');
+  }
+  // ArrayBuffer.byteLength is always a non-negative integer, so the only
+  // out-of-range value we need to guard is 0 — empty key buffers must not
+  // reach OpenSSL's EVP_CipherInit_ex.
+  if (keyByteLength === 0) {
+    throw new RangeError(`Invalid key length 0 for cipher ${cipherType}`);
+  }
+
+  const lower = cipherType.toLowerCase();
+  const sodium = LIBSODIUM_CIPHER_PARAMS[lower];
+  if (sodium) {
+    // libsodium parlance: "nonce" rather than "iv". Phrase the expected
+    // size as a natural-language clause so callers asserting on either
+    // `key must be N bytes` or `Invalid key length N` both match.
+    if (keyByteLength !== sodium.keyLength) {
+      throw new RangeError(
+        `Invalid key length ${keyByteLength} for cipher ${cipherType} ` +
+          `(key must be ${sodium.keyLength} bytes)`,
+      );
+    }
+    if (ivByteLength !== sodium.ivLength) {
+      throw new RangeError(
+        `Invalid nonce length ${ivByteLength} for cipher ${cipherType} ` +
+          `(nonce must be ${sodium.ivLength} bytes)`,
+      );
+    }
+    return;
+  }
+
+  // OpenSSL path. Look up the cipher's defaults once. Most callers pass
+  // exactly the cipher's default key/iv lengths (e.g. AES-128-CBC always
+  // wants 16/16) — short-circuit those to a single native round-trip.
+  // Variable-length ciphers (GCM, CCM, OCB, ChaCha20-Poly1305) fall through
+  // to per-parameter validation calls so the error message can name which
+  // of {key, iv} is wrong.
+  const info = CipherUtils.getCipherInfo(cipherType);
+  if (info === undefined) {
+    throw new TypeError(`Unsupported or unknown cipher type: ${cipherType}`);
+  }
+
+  const expectedIv = info.ivLength ?? 0;
+  if (expectedIv === 0 && ivByteLength > 0) {
+    throw new RangeError(
+      `Cipher ${cipherType} does not use an iv (got ${ivByteLength} bytes)`,
+    );
+  }
+  if (expectedIv > 0 && ivByteLength === 0) {
+    throw new RangeError(
+      `Cipher ${cipherType} requires an iv but none was provided`,
+    );
+  }
+
+  // Fast path: lengths match the cipher's defaults exactly.
+  if (info.keyLength === keyByteLength && expectedIv === ivByteLength) {
+    return;
+  }
+
+  // Variable-length: verify against native one parameter at a time.
+  if (
+    CipherUtils.getCipherInfo(cipherType, keyByteLength, undefined) ===
+    undefined
+  ) {
+    throw new RangeError(
+      `Invalid key length ${keyByteLength} for cipher ${cipherType}`,
+    );
+  }
+  if (
+    expectedIv > 0 &&
+    CipherUtils.getCipherInfo(cipherType, undefined, ivByteLength) === undefined
+  ) {
+    throw new RangeError(
+      `Invalid iv length ${ivByteLength} for cipher ${cipherType}`,
+    );
+  }
+}
+
 interface CipherArgs {
   isCipher: boolean;
   cipherType: string;
@@ -107,18 +201,24 @@ class CipherCommon extends Stream.Transform {
     }
     super(streamOptions); // Pass filtered options
 
-    const authTagLen: number =
-      getUIntOption(options ?? {}, 'authTagLength') !== -1
-        ? getUIntOption(options ?? {}, 'authTagLength')
-        : 16; // defaults to 16 bytes
+    // defaults to 16 bytes for AEAD modes; non-AEAD callers ignore it.
+    const authTagLen =
+      getUIntOption(
+        options as Readonly<Record<string, unknown>> | undefined,
+        'authTagLength',
+      ) ?? 16;
+
+    const cipherKeyAB = binaryLikeToArrayBuffer(cipherKey);
+    const ivAB = binaryLikeToArrayBuffer(iv);
+    validateCipherParams(cipherType, cipherKeyAB.byteLength, ivAB.byteLength);
 
     const factory =
       NitroModules.createHybridObject<CipherFactory>('CipherFactory');
     this.native = factory.createCipher({
       isCipher,
       cipherType,
-      cipherKey: binaryLikeToArrayBuffer(cipherKey),
-      iv: binaryLikeToArrayBuffer(iv),
+      cipherKey: cipherKeyAB,
+      iv: ivAB,
       authTagLen,
     });
   }
@@ -179,18 +279,31 @@ class CipherCommon extends Stream.Transform {
     return Buffer.from(ret);
   }
 
+  // Stream interface — surface synchronous errors (bad encoding,
+  // OpenSSL EVP failures, AEAD tag mismatch in `final()`, etc.) via
+  // the callback so they emit as stream 'error' events instead of
+  // throwing out of the Transform plumbing and crashing the host
+  // pipeline.
   _transform(
     chunk: BinaryLike,
     encoding: BufferEncoding,
-    callback: () => void,
+    callback: (err?: Error | null) => void,
   ) {
-    this.push(this.update(chunk, normalizeEncoding(encoding)));
-    callback();
+    try {
+      this.push(this.update(chunk, normalizeEncoding(encoding)));
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
 
-  _flush(callback: () => void) {
-    this.push(this.final());
-    callback();
+  _flush(callback: (err?: Error | null) => void) {
+    try {
+      this.push(this.final());
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
 
   public setAutoPadding(autoPadding?: boolean): this {
@@ -211,7 +324,14 @@ class CipherCommon extends Stream.Transform {
     if (!this.native || typeof this.native.setAAD !== 'function') {
       throw new Error('Cipher native object or setAAD method not initialized.');
     }
-    const res = this.native.setAAD(buffer.buffer, options?.plaintextLength);
+    // Use binaryLikeToArrayBuffer (not `buffer.buffer`) so that sliced /
+    // offset views send only the AAD bytes the caller intended. Passing the
+    // raw backing ArrayBuffer authenticates the wrong data and silently
+    // breaks the AEAD integrity guarantee.
+    const res = this.native.setAAD(
+      binaryLikeToArrayBuffer(buffer),
+      options?.plaintextLength,
+    );
     if (!res) {
       throw new Error('setAAD failed (native call returned false)');
     }
@@ -360,13 +480,17 @@ export function xsalsa20(
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   counter?: number,
 ): Uint8Array {
+  const cipherKeyAB = binaryLikeToArrayBuffer(key);
+  const ivAB = binaryLikeToArrayBuffer(nonce);
+  validateCipherParams('xsalsa20', cipherKeyAB.byteLength, ivAB.byteLength);
+
   const factory =
     NitroModules.createHybridObject<CipherFactory>('CipherFactory');
   const native = factory.createCipher({
     isCipher: true,
     cipherType: 'xsalsa20',
-    cipherKey: binaryLikeToArrayBuffer(key),
-    iv: binaryLikeToArrayBuffer(nonce),
+    cipherKey: cipherKeyAB,
+    iv: ivAB,
   });
   const result = native.update(binaryLikeToArrayBuffer(data));
   return new Uint8Array(result);

package/src/dhKeyPair.ts

@@ -97,6 +97,14 @@ function dh_formatKeyPairOutput(
   let publicKey: PublicKeyObject | Buffer | string | ArrayBuffer;
   let privateKey: PrivateKeyObject | Buffer | string | ArrayBuffer;
 
+  if (
+    publicFormat === 'raw-public' ||
+    privateFormat === 'raw-private' ||
+    privateFormat === 'raw-seed'
+  ) {
+    throw new Error('Raw key formats are not supported for DH keys');
+  }
+
   if (publicFormat === -1) {
     publicKey = pub;
   } else {

package/src/dsa.ts

@@ -25,6 +25,12 @@ export class Dsa {
   }
 }
 
+// FIPS 186-4 §4.2: only L = 1024, 2048, 3072 are sanctioned. NIST has
+// deprecated DSA-1024 for new applications, but we retain it for
+// interop with legacy systems and match Node's permissive default. We
+// reject anything below 1024 outright.
+const DSA_MIN_MODULUS_LENGTH = 1024;
+
 function dsa_prepareKeyGenParams(
   options: GenerateKeyPairOptions | undefined,
 ): Dsa {
@@ -34,8 +40,11 @@ function dsa_prepareKeyGenParams(
 
   const { modulusLength, divisorLength } = options;
 
-  if (!modulusLength || modulusLength <= 0) {
-    throw new Error('Invalid or missing modulusLength for DSA key generation');
+  if (!modulusLength || modulusLength < DSA_MIN_MODULUS_LENGTH) {
+    throw new RangeError(
+      `DSA modulusLength must be at least ${DSA_MIN_MODULUS_LENGTH} bits ` +
+        `(got ${modulusLength ?? 0})`,
+    );
   }
 
   return new Dsa(modulusLength, divisorLength);
@@ -70,6 +79,14 @@ function dsa_formatKeyPairOutput(
   let publicKey: PublicKeyObject | Buffer | string | ArrayBuffer;
   let privateKey: PrivateKeyObject | Buffer | string | ArrayBuffer;
 
+  if (
+    publicFormat === 'raw-public' ||
+    privateFormat === 'raw-private' ||
+    privateFormat === 'raw-seed'
+  ) {
+    throw new Error('Raw key formats are not supported for DSA keys');
+  }
+
   if (publicFormat === -1) {
     publicKey = pub;
   } else {