react-native-quick-crypto 1.1.4 → 1.1.6

package/src/hkdf.ts

@@ -62,6 +62,14 @@ const HKDF_HASH_BYTES: Readonly<Record<string, number>> = {
   ripemd160: 20,
 };
 
+function hkdfHashLen(digest: string): number {
+  const hashLen = HKDF_HASH_BYTES[digest.toLowerCase()];
+  if (hashLen === undefined) {
+    throw new TypeError(`Unsupported HKDF digest: ${digest}`);
+  }
+  return hashLen;
+}
+
 function validateHkdfKeylen(digest: string, keylen: number): void {
   if (
     typeof keylen !== 'number' ||
@@ -111,6 +119,7 @@ export function hkdf(
         sanitizedSalt,
         sanitizedInfo,
         keylen,
+        'full',
       )
       .then(
         res => {
@@ -146,11 +155,143 @@ export function hkdfSync(
     sanitizedSalt,
     sanitizedInfo,
     keylen,
+    'full',
+  );
+
+  return Buffer.from(result);
+}
+
+// RFC 5869 §2.2 HKDF-Extract (sync): PRK = HMAC(salt, IKM). Salt defaults to
+// a string of HashLen zeros when omitted. Returns a PRK of HashLen bytes.
+export function hkdfExtractSync(
+  digest: string,
+  ikm: KeyMaterial,
+  salt: Salt = new Uint8Array(0),
+): Buffer {
+  const normalizedDigest = normalizeHashName(digest);
+  const hashLen = hkdfHashLen(normalizedDigest);
+  const sanitizedIkm = sanitizeInput(ikm, 'IKM');
+  const sanitizedSalt = sanitizeInput(salt, 'Salt');
+
+  const result = getNative().deriveKeySync(
+    normalizedDigest,
+    sanitizedIkm,
+    sanitizedSalt,
+    new ArrayBuffer(0),
+    hashLen,
+    'extract',
   );
 
   return Buffer.from(result);
 }
 
+// Async HKDF-Extract, mirroring `hkdf`. Unlike the sync form, `salt` is
+// required here because the callback occupies the trailing argument.
+export function hkdfExtract(
+  digest: string,
+  ikm: KeyMaterial,
+  salt: Salt,
+  callback: HkdfCallback,
+): void {
+  validateCallback(callback);
+
+  try {
+    const normalizedDigest = normalizeHashName(digest);
+    const hashLen = hkdfHashLen(normalizedDigest);
+    const sanitizedIkm = sanitizeInput(ikm, 'IKM');
+    const sanitizedSalt = sanitizeInput(salt, 'Salt');
+
+    getNative()
+      .deriveKey(
+        normalizedDigest,
+        sanitizedIkm,
+        sanitizedSalt,
+        new ArrayBuffer(0),
+        hashLen,
+        'extract',
+      )
+      .then(
+        res => callback(null, Buffer.from(res)),
+        err => callback(err),
+      );
+  } catch (err) {
+    callback(err as Error);
+  }
+}
+
+// RFC 5869 §2.3 HKDF-Expand (sync): OKM = expand(PRK, info, L). `prk` must be
+// at least HashLen bytes (a pseudorandom key, e.g. from hkdfExtract).
+export function hkdfExpandSync(
+  digest: string,
+  prk: KeyMaterial,
+  info: Info,
+  keylen: number,
+): Buffer {
+  const normalizedDigest = normalizeHashName(digest);
+  const hashLen = hkdfHashLen(normalizedDigest);
+  const sanitizedPrk = sanitizeInput(prk, 'PRK');
+  if (sanitizedPrk.byteLength < hashLen) {
+    throw new RangeError(
+      `HKDF-Expand PRK must be at least HashLen (${hashLen}) bytes for ${digest}`,
+    );
+  }
+  const sanitizedInfo = sanitizeInput(info, 'Info');
+
+  validateHkdfKeylen(normalizedDigest, keylen);
+
+  const result = getNative().deriveKeySync(
+    normalizedDigest,
+    sanitizedPrk,
+    new ArrayBuffer(0),
+    sanitizedInfo,
+    keylen,
+    'expand',
+  );
+
+  return Buffer.from(result);
+}
+
+// Async HKDF-Expand, mirroring `hkdf`.
+export function hkdfExpand(
+  digest: string,
+  prk: KeyMaterial,
+  info: Info,
+  keylen: number,
+  callback: HkdfCallback,
+): void {
+  validateCallback(callback);
+
+  try {
+    const normalizedDigest = normalizeHashName(digest);
+    const hashLen = hkdfHashLen(normalizedDigest);
+    const sanitizedPrk = sanitizeInput(prk, 'PRK');
+    if (sanitizedPrk.byteLength < hashLen) {
+      throw new RangeError(
+        `HKDF-Expand PRK must be at least HashLen (${hashLen}) bytes for ${digest}`,
+      );
+    }
+    const sanitizedInfo = sanitizeInput(info, 'Info');
+
+    validateHkdfKeylen(normalizedDigest, keylen);
+
+    getNative()
+      .deriveKey(
+        normalizedDigest,
+        sanitizedPrk,
+        new ArrayBuffer(0),
+        sanitizedInfo,
+        keylen,
+        'expand',
+      )
+      .then(
+        res => callback(null, Buffer.from(res)),
+        err => callback(err),
+      );
+  } catch (err) {
+    callback(err as Error);
+  }
+}
+
 export function hkdfDeriveBits(
   algorithm: HkdfAlgorithm,
   baseKey: CryptoKey,
@@ -179,6 +320,7 @@ export function hkdfDeriveBits(
     binaryLikeToArrayBuffer(salt),
     binaryLikeToArrayBuffer(info),
     keylen,
+    'full',
   );
 
   return result;

package/src/keys/classes.ts

@@ -150,6 +150,7 @@ export class KeyObject {
     key: ArrayBuffer,
     format?: KFormatType,
     encoding?: KeyEncoding,
+    passphrase?: ArrayBuffer,
   ): KeyObject {
     if (type !== 'secret' && type !== 'public' && type !== 'private')
       throw new Error(`invalid KeyObject type: ${type}`);
@@ -172,12 +173,7 @@ export class KeyObject {
         throw new Error('invalid key type');
     }
 
-    // If format is provided, use it (encoding is optional)
-    if (format !== undefined) {
-      handle.init(keyType, key, format, encoding);
-    } else {
-      handle.init(keyType, key);
-    }
+    handle.init(keyType, key, format, encoding, passphrase);
 
     // For asymmetric keys, return the appropriate subclass
     if (type === 'public' || type === 'private') {

package/src/keys/index.ts

@@ -114,6 +114,7 @@ function prepareAsymmetricKey(
   data: ArrayBuffer;
   format?: 'pem' | 'der';
   type?: 'pkcs1' | 'pkcs8' | 'spki' | 'sec1';
+  passphrase?: ArrayBuffer;
 } {
   if (key instanceof KeyObject) {
     if (isPublic) {
@@ -147,7 +148,9 @@ function prepareAsymmetricKey(
 
   if (typeof key === 'object' && 'key' in key) {
     const keyObj = key as KeyInputObject;
-    const { key: data, format, type } = keyObj;
+    const { key: data, format, type, passphrase } = keyObj;
+    const passphraseAB =
+      passphrase !== undefined ? toAB(passphrase) : undefined;
 
     if (data instanceof KeyObject) {
       return prepareAsymmetricKey(data, isPublic);
@@ -167,14 +170,24 @@ function prepareAsymmetricKey(
         (typeof data === 'string' && data.includes('-----BEGIN'))) &&
       typeof data === 'string'
     ) {
-      return { data: toAB(data), format: 'pem', type };
+      return {
+        data: toAB(data),
+        format: 'pem',
+        type,
+        passphrase: passphraseAB,
+      };
     }
 
     // Filter to only 'pem' or 'der' — JWK and raw formats are handled
     // separately via dedicated paths.
     const filteredFormat: 'pem' | 'der' | undefined =
       format === 'pem' || format === 'der' ? format : undefined;
-    return { data: toAB(data), format: filteredFormat, type };
+    return {
+      data: toAB(data),
+      format: filteredFormat,
+      type,
+      passphrase: passphraseAB,
+    };
   }
 
   throw new Error('Invalid key input');
@@ -212,7 +225,7 @@ function createPublicKey(key: KeyInput): PublicKeyObject {
     return new PublicKeyObject(handle);
   }
 
-  const { data, format, type } = prepareAsymmetricKey(key, true);
+  const { data, format, type, passphrase } = prepareAsymmetricKey(key, true);
 
   // Map format string to KFormatType enum
   let kFormat: KFormatType | undefined;
@@ -229,6 +242,7 @@ function createPublicKey(key: KeyInput): PublicKeyObject {
     data,
     kFormat,
     kType,
+    passphrase,
   ) as PublicKeyObject;
 }
 
@@ -249,7 +263,7 @@ function createPrivateKey(key: KeyInput): PrivateKeyObject {
     return new PrivateKeyObject(handle);
   }
 
-  const { data, format, type } = prepareAsymmetricKey(key, false);
+  const { data, format, type, passphrase } = prepareAsymmetricKey(key, false);
 
   // Map format string to KFormatType enum
   let kFormat: KFormatType | undefined;
@@ -267,6 +281,7 @@ function createPrivateKey(key: KeyInput): PrivateKeyObject {
     data,
     kFormat,
     kType,
+    passphrase,
   ) as PrivateKeyObject;
 }
 

package/src/specs/hkdf.nitro.ts

@@ -1,5 +1,9 @@
 import type { HybridObject } from 'react-native-nitro-modules';
 
+// RFC 5869 stage: 'full' (extract+expand), 'extract' (PRK only), or
+// 'expand' (from an existing PRK).
+export type HkdfMode = 'full' | 'extract' | 'expand';
+
 export interface Hkdf extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
   deriveKeySync(
     algorithm: string,
@@ -7,6 +11,7 @@ export interface Hkdf extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
     salt: ArrayBuffer,
     info: ArrayBuffer,
     length: number,
+    mode: HkdfMode,
   ): ArrayBuffer;
 
   deriveKey(
@@ -15,5 +20,6 @@ export interface Hkdf extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
     salt: ArrayBuffer,
     info: ArrayBuffer,
     length: number,
+    mode: HkdfMode,
   ): Promise<ArrayBuffer>;
 }