shogun-core 6.2.3 → 6.3.0

package/dist/crypto/sframe.js

@@ -1,352 +0,0 @@
-"use strict";
-/**
- * SFrame (Secure Frame) Manager
- * End-to-end encryption for real-time media frames (audio/video)
- * Designed for low overhead and high performance
- *
- * SFrame adds ~10 bytes per frame overhead
- * Compatible with WebRTC Insertable Streams API
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SFrameManager = void 0;
-class SFrameManager {
-    constructor() {
-        this.keys = new Map();
-        this.currentKeyId = 0;
-        this.frameCounter = 0;
-        this.initialized = false;
-        console.log("🎥 [SFrame] Manager created");
-    }
-    /**
-     * Initialize the SFrame manager
-     */
-    async initialize() {
-        if (this.initialized) {
-            console.warn("[SFrame] Already initialized");
-            return;
-        }
-        try {
-            console.log("🔐 [SFrame] Initializing...");
-            // Generate initial key
-            await this.generateKey(0);
-            this.initialized = true;
-            console.log("✅ [SFrame] Initialized successfully");
-        }
-        catch (error) {
-            console.error("❌ [SFrame] Initialization failed:", error);
-            throw new Error(`SFrame initialization failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Generate a new SFrame encryption key
-     */
-    async generateKey(keyId) {
-        try {
-            console.log(`🔑 [SFrame] Generating key ${keyId}...`);
-            // Generate AES-GCM key (128-bit for low overhead)
-            const key = await crypto.subtle.generateKey({
-                name: "AES-GCM",
-                length: 128, // 128-bit for performance, 256-bit for maximum security
-            }, false, // Not extractable for security
-            ["encrypt", "decrypt"]);
-            // Generate salt for key derivation
-            const salt = crypto.getRandomValues(new Uint8Array(16));
-            const sframeKey = {
-                keyId,
-                key,
-                salt,
-            };
-            this.keys.set(keyId, sframeKey);
-            console.log(`✅ [SFrame] Key ${keyId} generated`);
-            return sframeKey;
-        }
-        catch (error) {
-            console.error(`❌ [SFrame] Key generation failed:`, error);
-            throw new Error(`SFrame key generation failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Derive an SFrame key from MLS shared secret
-     * This allows SFrame to use keys derived from MLS for media encryption
-     * RFC 9605 Section 5.2: MLS-based key management
-     */
-    async deriveKeyFromMLSSecret(mlsSecret, keyId, context = "SFrame") {
-        try {
-            console.log(`🔗 [SFrame] Deriving key ${keyId} from MLS secret (RFC 9605 Section 5.2)...`);
-            // RFC 9605 Section 5.2: Use specific labels for MLS-based derivation
-            const secretLabel = new TextEncoder().encode("SFrame 1.0 Secret");
-            const saltLabel = new TextEncoder().encode("SFrame 1.0 Salt");
-            // Import MLS secret as key material
-            const baseKey = await crypto.subtle.importKey("raw", mlsSecret, "HKDF", false, ["deriveKey", "deriveBits"]);
-            // Derive salt using HKDF (RFC 9605)
-            const derivedSaltBits = await crypto.subtle.deriveBits({
-                name: "HKDF",
-                hash: "SHA-256",
-                salt: new Uint8Array(0), // Empty salt for salt derivation
-                info: saltLabel,
-            }, baseKey, 128);
-            const salt = new Uint8Array(derivedSaltBits);
-            // Derive AES-GCM key using HKDF with RFC 9605 label
-            const key = await crypto.subtle.deriveKey({
-                name: "HKDF",
-                hash: "SHA-256",
-                salt: new Uint8Array(0), // Empty salt for key derivation
-                info: secretLabel,
-            }, baseKey, {
-                name: "AES-GCM",
-                length: 128,
-            }, false, ["encrypt", "decrypt"]);
-            const sframeKey = {
-                keyId,
-                key,
-                salt,
-            };
-            this.keys.set(keyId, sframeKey);
-            console.log(`✅ [SFrame] Key ${keyId} derived from MLS (RFC 9605 compliant)`);
-            return sframeKey;
-        }
-        catch (error) {
-            console.error(`❌ [SFrame] Key derivation failed:`, error);
-            throw new Error(`SFrame key derivation failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Set a shared SFrame key (e.g., from another member)
-     */
-    async setSharedKey(sframeKey) {
-        this.keys.set(sframeKey.keyId, sframeKey);
-        console.log(`✅ [SFrame] Shared key ${sframeKey.keyId} set.`);
-    }
-    /**
-     * Set the active encryption key
-     */
-    setActiveKey(keyId) {
-        if (!this.keys.has(keyId)) {
-            throw new Error(`SFrame key ${keyId} not found`);
-        }
-        this.currentKeyId = keyId;
-        console.log(`🔄 [SFrame] Active key set to ${keyId}`);
-    }
-    /**
-     * Encrypt a media frame using SFrame
-     */
-    async encryptFrame(frameData) {
-        this.ensureInitialized();
-        try {
-            const sframeKey = this.keys.get(this.currentKeyId);
-            if (!sframeKey) {
-                throw new Error(`SFrame key ${this.currentKeyId} not found`);
-            }
-            // RFC 9605: IV = salt XOR counter
-            // Generate counter bytes (96-bit/12-byte)
-            const counterBytes = new Uint8Array(12);
-            const counterView = new DataView(counterBytes.buffer);
-            // Store frame counter in last 8 bytes (big-endian uint64-like)
-            counterView.setUint32(4, Math.floor(this.frameCounter / 0x100000000), false);
-            counterView.setUint32(8, this.frameCounter & 0xffffffff, false);
-            // SFrame header: 1 byte for key ID + frame counter encoding
-            // Simplified header: 1 byte key ID + 4 bytes frame counter
-            const header = new Uint8Array(5);
-            header[0] = this.currentKeyId;
-            new DataView(header.buffer).setUint32(1, this.frameCounter, false);
-            // XOR salt with counter to create IV (RFC 9605 Section 4.3)
-            const iv = new Uint8Array(12);
-            for (let i = 0; i < 12; i++) {
-                iv[i] = sframeKey.salt[i] ^ counterBytes[i];
-            }
-            // Encrypt the frame with header authentication (RFC 9605 Section 4.3)
-            const ciphertext = await crypto.subtle.encrypt({
-                name: "AES-GCM",
-                iv,
-                additionalData: header, // RFC 9605: Header included in AAD
-                tagLength: 128, // 128-bit authentication tag
-            }, sframeKey.key, frameData);
-            // RFC 9605: SFrame format = header + ciphertext (IV is derived, not transmitted)
-            const encrypted = new Uint8Array(header.length + ciphertext.byteLength);
-            encrypted.set(header, 0);
-            encrypted.set(new Uint8Array(ciphertext), header.length);
-            // Increment frame counter
-            this.frameCounter++;
-            return encrypted;
-        }
-        catch (error) {
-            console.error("❌ [SFrame] Frame encryption failed:", error);
-            throw new Error(`SFrame encryption failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Decrypt a media frame using SFrame
-     */
-    async decryptFrame(encryptedFrame) {
-        this.ensureInitialized();
-        try {
-            // Parse SFrame header (5 bytes: 1 byte key ID + 4 bytes frame counter)
-            const header = encryptedFrame.slice(0, 5);
-            const keyId = header[0];
-            const frameCount = new DataView(header.buffer, header.byteOffset).getUint32(1, false);
-            // Get the key
-            const sframeKey = this.keys.get(keyId);
-            if (!sframeKey) {
-                throw new Error(`SFrame key ${keyId} not found`);
-            }
-            // RFC 9605: IV is derived from frame count and salt (not transmitted)
-            const counterBytes = new Uint8Array(12);
-            const counterView = new DataView(counterBytes.buffer);
-            counterView.setUint32(4, Math.floor(frameCount / 0x100000000), false);
-            counterView.setUint32(8, frameCount & 0xffffffff, false);
-            const iv = new Uint8Array(12);
-            for (let i = 0; i < 12; i++) {
-                iv[i] = sframeKey.salt[i] ^ counterBytes[i];
-            }
-            // Extract ciphertext (rest of the data)
-            const ciphertext = encryptedFrame.slice(header.length);
-            // Decrypt the frame with header authentication (RFC 9605 Section 4.3)
-            const plaintext = await crypto.subtle.decrypt({
-                name: "AES-GCM",
-                iv,
-                additionalData: header, // RFC 9605: Header included in AAD
-                tagLength: 128,
-            }, sframeKey.key, ciphertext);
-            return plaintext;
-        }
-        catch (error) {
-            console.error("❌ [SFrame] Frame decryption failed:", error);
-            throw new Error(`SFrame decryption failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Encrypt transform function for Insertable Streams
-     * Use this with RTCRtpSender.createEncodedStreams()
-     */
-    createEncryptTransform() {
-        const manager = this;
-        return new TransformStream({
-            async transform(encodedFrame, controller) {
-                try {
-                    // Get frame data
-                    const frameData = encodedFrame.data;
-                    // Encrypt the frame
-                    const encrypted = await manager.encryptFrame(frameData);
-                    // Create new encoded frame with encrypted data
-                    encodedFrame.data = encrypted.buffer;
-                    // Forward the encrypted frame
-                    controller.enqueue(encodedFrame);
-                }
-                catch (error) {
-                    console.error("[SFrame] Encrypt transform error:", error);
-                    // Forward unencrypted frame on error (fallback)
-                    controller.enqueue(encodedFrame);
-                }
-            },
-        });
-    }
-    /**
-     * Decrypt transform function for Insertable Streams
-     * Use this with RTCRtpReceiver.createEncodedStreams()
-     */
-    createDecryptTransform() {
-        const manager = this;
-        return new TransformStream({
-            async transform(encodedFrame, controller) {
-                try {
-                    // Get encrypted frame data
-                    const encryptedData = new Uint8Array(encodedFrame.data);
-                    // Decrypt the frame
-                    const decrypted = await manager.decryptFrame(encryptedData);
-                    // Create new encoded frame with decrypted data
-                    encodedFrame.data = decrypted;
-                    // Forward the decrypted frame
-                    controller.enqueue(encodedFrame);
-                }
-                catch (error) {
-                    console.error("[SFrame] Decrypt transform error:", error);
-                    // Skip frame on decryption error
-                    // (better to drop frame than show corrupted video)
-                }
-            },
-        });
-    }
-    /**
-     * Rotate encryption keys
-     * RFC 9605: Frame counter should be reset on key rotation to prevent exhaustion
-     */
-    async rotateKey() {
-        try {
-            const newKeyId = this.currentKeyId + 1;
-            console.log(`🔄 [SFrame] Rotating to key ${newKeyId}...`);
-            await this.generateKey(newKeyId);
-            this.setActiveKey(newKeyId);
-            // RFC 9605: Reset frame counter on key rotation
-            this.resetFrameCounter();
-            console.log(`🔄 [SFrame] Frame counter reset to 0 for new key`);
-            console.log(`✅ [SFrame] Key rotated to ${newKeyId}`);
-            return newKeyId;
-        }
-        catch (error) {
-            console.error("❌ [SFrame] Key rotation failed:", error);
-            throw new Error(`SFrame key rotation failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Get current key ID
-     */
-    getCurrentKeyId() {
-        return this.currentKeyId;
-    }
-    /**
-     * Get frame counter (for debugging)
-     */
-    getFrameCounter() {
-        return this.frameCounter;
-    }
-    /**
-     * Reset frame counter (use when rotating keys)
-     */
-    resetFrameCounter() {
-        this.frameCounter = 0;
-        console.log("🔄 [SFrame] Frame counter reset");
-    }
-    /**
-     * Remove old keys to prevent memory bloat
-     */
-    cleanupOldKeys(keepLast = 2) {
-        const keyIds = Array.from(this.keys.keys()).sort((a, b) => b - a);
-        if (keyIds.length > keepLast) {
-            const toDelete = keyIds.slice(keepLast);
-            toDelete.forEach((keyId) => {
-                this.keys.delete(keyId);
-                console.log(`🧹 [SFrame] Deleted old key ${keyId}`);
-            });
-        }
-    }
-    /**
-     * Get statistics
-     */
-    getStats() {
-        return {
-            keyCount: this.keys.size,
-            currentKeyId: this.currentKeyId,
-            frameCounter: this.frameCounter,
-            initialized: this.initialized,
-        };
-    }
-    /**
-     * Clean up resources
-     */
-    destroy() {
-        this.keys.clear();
-        this.initialized = false;
-        this.frameCounter = 0;
-        console.log("✅ [SFrame] Manager destroyed");
-    }
-    /**
-     * Ensure the manager is initialized
-     */
-    ensureInitialized() {
-        if (!this.initialized) {
-            throw new Error("SFrame Manager not initialized. Call initialize() first.");
-        }
-    }
-}
-exports.SFrameManager = SFrameManager;
-exports.default = SFrameManager;