ts-mls 1.0.1

package/dist/codec/vector.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeVarLenData = encodeVarLenData;
+exports.determineLength = determineLength;
+exports.decodeVarLenData = decodeVarLenData;
+function encodeVarLenData(data) {
+    const len = data.length;
+    let lenBytes;
+    if (len < 64) {
+        // 1-byte length: 00xxxxxx
+        lenBytes = new Uint8Array([len & 0b00111111]);
+    }
+    else if (len < 16384) {
+        // 2-byte length: 01xxxxxx xxxxxxxx
+        lenBytes = new Uint8Array(2);
+        lenBytes[0] = ((len >> 8) & 0b00111111) | 0b01000000;
+        lenBytes[1] = len & 0xff;
+    }
+    else if (len < 0x40000000) {
+        // 4-byte length: 10xxxxxx xxxxxxxx xxxxxxxx xxxxxxxx
+        lenBytes = new Uint8Array(4);
+        lenBytes[0] = ((len >> 24) & 0b00111111) | 0b10000000;
+        lenBytes[1] = (len >> 16) & 0xff;
+        lenBytes[2] = (len >> 8) & 0xff;
+        lenBytes[3] = len & 0xff;
+    }
+    else {
+        throw new Error("Length too large to encode (max is 2^30 - 1)");
+    }
+    const result = new Uint8Array(lenBytes.length + data.length);
+    result.set(lenBytes, 0);
+    result.set(data, lenBytes.length);
+    return result;
+}
+function determineLength(data, offset = 0) {
+    if (offset >= data.length) {
+        throw new Error("Offset beyond buffer");
+    }
+    const firstByte = data[offset];
+    const prefix = firstByte >> 6;
+    if (prefix === 0) {
+        return { length: firstByte & 0b00111111, lengthFieldSize: 1 };
+    }
+    else if (prefix === 1) {
+        if (offset + 2 > data.length)
+            throw new Error("Incomplete 2-byte length");
+        return { length: ((firstByte & 0b00111111) << 8) | data[offset + 1], lengthFieldSize: 2 };
+    }
+    else if (prefix === 2) {
+        if (offset + 4 > data.length)
+            throw new Error("Incomplete 4-byte length");
+        return {
+            length: ((firstByte & 0b00111111) << 24) |
+                (data[offset + 1] << 16) |
+                (data[offset + 2] << 8) |
+                data[offset + 3],
+            lengthFieldSize: 4,
+        };
+    }
+    else {
+        throw new Error("8-byte length not supported in this implementation");
+    }
+}
+function decodeVarLenData(buf, offset = 0) {
+    if (offset >= buf.length) {
+        throw new Error("Offset beyond buffer");
+    }
+    const { length, lengthFieldSize } = determineLength(buf, offset);
+    const totalBytes = lengthFieldSize + length;
+    if (offset + totalBytes > buf.length) {
+        throw new Error("Data length exceeds buffer");
+    }
+    const data = buf.subarray(offset + lengthFieldSize, offset + totalBytes);
+    return { data, length, totalBytesRead: totalBytes };
+}
+//# sourceMappingURL=vector.js.map

package/dist/codec/vector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector.js","sourceRoot":"","sources":["../../src/codec/vector.ts"],"names":[],"mappings":";;AAAA,4CA2BC;AAED,0CA0BC;AAED,4CAqBC;AA9ED,SAAgB,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACvB,IAAI,QAAoB,CAAA;IAExB,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QACb,0BAA0B;QAC1B,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QACvB,mCAAmC;QACnC,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC5B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,UAAU,CAAA;QACpD,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;IAC1B,CAAC;SAAM,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC5B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,UAAU,CAAA;QACrD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;QAChC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC/B,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAgB,eAAe,CAAC,IAAgB,EAAE,MAAM,GAAG,CAAC;IAC1D,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAW,CAAA;IACxC,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,CAAA;IAE7B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,UAAU,EAAE,eAAe,EAAE,CAAC,EAAE,CAAA;IAC/D,CAAC;SAAM,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACzE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAY,EAAE,eAAe,EAAE,CAAC,EAAE,CAAA;IACvG,CAAC;SAAM,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACzE,OAAO;YACL,MAAM,EACJ,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAY,IAAI,EAAE,CAAC;gBACpC,CAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAY,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAY;YAC9B,eAAe,EAAE,CAAC;SACnB,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAC9B,GAAe,EACf,MAAM,GAAG,CAAC;IAMV,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAEhE,MAAM,UAAU,GAAG,eAAe,GAAG,MAAM,CAAA;IAC3C,IAAI,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,eAAe,EAAE,MAAM,GAAG,UAAU,CAAC,CAAA;IACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;AACrD,CAAC"}

package/dist/crypto/aead.d.ts

@@ -0,0 +1,5 @@
+import { AeadInterface } from "hpke-js";
+export type AeadAlgorithm = "AES128GCM" | "CHACHA20POLY1305" | "AES256GCM";
+export declare function makeAead(aeadAlg: AeadAlgorithm): AeadInterface;
+export declare function encryptAead(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array, alg: AeadAlgorithm): Promise<Uint8Array>;
+export declare function decryptAead(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array, alg: AeadAlgorithm): Promise<Uint8Array>;

package/dist/crypto/aead.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeAead = makeAead;
+exports.encryptAead = encryptAead;
+exports.decryptAead = decryptAead;
+const core_1 = require("@hpke/core");
+const chacha20poly1305_1 = require("@hpke/chacha20poly1305");
+const chacha_1 = require("@noble/ciphers/chacha");
+const byteArray_1 = require("../util/byteArray");
+function makeAead(aeadAlg) {
+    switch (aeadAlg) {
+        case "AES128GCM":
+            return new core_1.Aes128Gcm();
+        case "AES256GCM":
+            return new core_1.Aes256Gcm();
+        case "CHACHA20POLY1305":
+            return new chacha20poly1305_1.Chacha20Poly1305();
+    }
+}
+async function encryptAead(key, nonce, aad, plaintext, alg) {
+    switch (alg) {
+        case "AES128GCM":
+        case "AES256GCM": {
+            const cryptoKey = await crypto.subtle.importKey("raw", (0, byteArray_1.bytesToBuffer)(key), { name: "AES-GCM" }, false, [
+                "encrypt",
+            ]);
+            const result = await crypto.subtle.encrypt({
+                name: "AES-GCM",
+                iv: (0, byteArray_1.bytesToBuffer)(nonce),
+                additionalData: aad.length > 0 ? (0, byteArray_1.bytesToBuffer)(aad) : undefined,
+            }, cryptoKey, (0, byteArray_1.bytesToBuffer)(plaintext));
+            return new Uint8Array(result);
+        }
+        case "CHACHA20POLY1305":
+            return (0, chacha_1.chacha20poly1305)(key, nonce, aad).encrypt(plaintext);
+    }
+}
+async function decryptAead(key, nonce, aad, ciphertext, alg) {
+    switch (alg) {
+        case "AES128GCM":
+        case "AES256GCM": {
+            const cryptoKey = await crypto.subtle.importKey("raw", (0, byteArray_1.bytesToBuffer)(key), { name: "AES-GCM" }, false, [
+                "decrypt",
+            ]);
+            const result = await crypto.subtle.decrypt({
+                name: "AES-GCM",
+                iv: (0, byteArray_1.bytesToBuffer)(nonce),
+                additionalData: aad.length > 0 ? (0, byteArray_1.bytesToBuffer)(aad) : undefined,
+            }, cryptoKey, (0, byteArray_1.bytesToBuffer)(ciphertext));
+            return new Uint8Array(result);
+        }
+        case "CHACHA20POLY1305":
+            return (0, chacha_1.chacha20poly1305)(key, nonce, aad).decrypt(ciphertext);
+    }
+}
+//# sourceMappingURL=aead.js.map

package/dist/crypto/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.js","sourceRoot":"","sources":["../../src/crypto/aead.ts"],"names":[],"mappings":";;AAQA,4BASC;AAED,kCA2BC;AAED,kCA2BC;AA3ED,qCAAiD;AAEjD,6DAAyD;AACzD,kDAAwD;AACxD,iDAAiD;AAIjD,SAAgB,QAAQ,CAAC,OAAsB;IAC7C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW;YACd,OAAO,IAAI,gBAAS,EAAE,CAAA;QACxB,KAAK,WAAW;YACd,OAAO,IAAI,gBAAS,EAAE,CAAA;QACxB,KAAK,kBAAkB;YACrB,OAAO,IAAI,mCAAgB,EAAE,CAAA;IACjC,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,KAAiB,EACjB,GAAe,EACf,SAAqB,EACrB,GAAkB;IAElB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;gBACrG,SAAS;aACV,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,IAAA,yBAAa,EAAC,KAAK,CAAC;gBACxB,cAAc,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,EACD,SAAS,EACT,IAAA,yBAAa,EAAC,SAAS,CAAC,CACzB,CAAA;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,KAAiB,EACjB,GAAe,EACf,UAAsB,EACtB,GAAkB;IAElB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;gBACrG,SAAS;aACV,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,IAAA,yBAAa,EAAC,KAAK,CAAC;gBACxB,cAAc,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,EACD,SAAS,EACT,IAAA,yBAAa,EAAC,UAAU,CAAC,CAC1B,CAAA;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAChE,CAAC;AACH,CAAC"}

package/dist/crypto/ciphersuite.d.ts

@@ -0,0 +1,47 @@
+import { Signature, SignatureAlgorithm } from "./signature";
+import { Hash, HashAlgorithm } from "./hash";
+import { Kdf } from "./kdf";
+import { Hpke, HpkeAlgorithm } from "./hpke";
+import { Encoder } from "../codec/tlsEncoder";
+import { Decoder } from "../codec/tlsDecoder";
+import { Rng } from "./rng";
+export type CiphersuiteImpl = {
+    hash: Hash;
+    hpke: Hpke;
+    signature: Signature;
+    kdf: Kdf;
+    rng: Rng;
+    name: CiphersuiteName;
+};
+declare const ciphersuites: {
+    readonly MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519: 1;
+    readonly MLS_128_DHKEMP256_AES128GCM_SHA256_P256: 2;
+    readonly MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519: 3;
+    readonly MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448: 4;
+    readonly MLS_256_DHKEMP521_AES256GCM_SHA512_P521: 5;
+    readonly MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448: 6;
+    readonly MLS_256_DHKEMP384_AES256GCM_SHA384_P384: 7;
+    readonly MLS_128_MLKEM512_AES128GCM_SHA256_Ed25519: 77;
+    readonly MLS_128_MLKEM512_CHACHA20POLY1305_SHA256_Ed25519: 78;
+    readonly MLS_256_MLKEM768_AES256GCM_SHA384_Ed25519: 79;
+    readonly MLS_256_MLKEM768_CHACHA20POLY1305_SHA384_Ed25519: 80;
+    readonly MLS_256_MLKEM1024_AES256GCM_SHA512_Ed25519: 81;
+    readonly MLS_256_MLKEM1024_CHACHA20POLY1305_SHA512_Ed25519: 82;
+    readonly MLS_256_XWING_AES256GCM_SHA512_Ed25519: 83;
+    readonly MLS_256_XWING_CHACHA20POLY1305_SHA512_Ed25519: 84;
+};
+export type CiphersuiteName = keyof typeof ciphersuites;
+export type CiphersuiteId = (typeof ciphersuites)[CiphersuiteName];
+export declare const encodeCiphersuite: Encoder<CiphersuiteName>;
+export declare const decodeCiphersuite: Decoder<CiphersuiteName>;
+export declare function getCiphersuite(name: CiphersuiteName): Ciphersuite;
+export declare function getCiphersuiteNameFromId(id: CiphersuiteId): CiphersuiteName;
+export declare function getCiphersuiteFromId(id: CiphersuiteId): Ciphersuite;
+export declare function getCiphersuiteImpl(cs: Ciphersuite): CiphersuiteImpl;
+type Ciphersuite = {
+    hash: HashAlgorithm;
+    hpke: HpkeAlgorithm;
+    signature: SignatureAlgorithm;
+    name: CiphersuiteName;
+};
+export {};

package/dist/crypto/ciphersuite.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeCiphersuite = exports.encodeCiphersuite = void 0;
+exports.getCiphersuite = getCiphersuite;
+exports.getCiphersuiteNameFromId = getCiphersuiteNameFromId;
+exports.getCiphersuiteFromId = getCiphersuiteFromId;
+exports.getCiphersuiteImpl = getCiphersuiteImpl;
+const signature_1 = require("./signature");
+const hash_1 = require("./hash");
+const kdf_1 = require("./kdf");
+const hpke_1 = require("./hpke");
+const tlsEncoder_1 = require("../codec/tlsEncoder");
+const number_1 = require("../codec/number");
+const tlsDecoder_1 = require("../codec/tlsDecoder");
+const enumHelpers_1 = require("../util/enumHelpers");
+const rng_1 = require("./rng");
+const ciphersuites = {
+    MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519: 1,
+    MLS_128_DHKEMP256_AES128GCM_SHA256_P256: 2,
+    MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519: 3,
+    MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448: 4,
+    MLS_256_DHKEMP521_AES256GCM_SHA512_P521: 5,
+    MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448: 6,
+    MLS_256_DHKEMP384_AES256GCM_SHA384_P384: 7,
+    MLS_128_MLKEM512_AES128GCM_SHA256_Ed25519: 77,
+    MLS_128_MLKEM512_CHACHA20POLY1305_SHA256_Ed25519: 78,
+    MLS_256_MLKEM768_AES256GCM_SHA384_Ed25519: 79,
+    MLS_256_MLKEM768_CHACHA20POLY1305_SHA384_Ed25519: 80,
+    MLS_256_MLKEM1024_AES256GCM_SHA512_Ed25519: 81,
+    MLS_256_MLKEM1024_CHACHA20POLY1305_SHA512_Ed25519: 82,
+    MLS_256_XWING_AES256GCM_SHA512_Ed25519: 83,
+    MLS_256_XWING_CHACHA20POLY1305_SHA512_Ed25519: 84,
+};
+exports.encodeCiphersuite = (0, tlsEncoder_1.contramapEncoder)(number_1.encodeUint16, (0, enumHelpers_1.openEnumNumberEncoder)(ciphersuites));
+exports.decodeCiphersuite = (0, tlsDecoder_1.mapDecoderOption)(number_1.decodeUint16, (0, enumHelpers_1.openEnumNumberToKey)(ciphersuites));
+function getCiphersuite(name) {
+    return ciphersuiteValues[ciphersuites[name]];
+}
+function getCiphersuiteNameFromId(id) {
+    return (0, enumHelpers_1.reverseMap)(ciphersuites)[id];
+}
+function getCiphersuiteFromId(id) {
+    return ciphersuiteValues[id];
+}
+function getCiphersuiteImpl(cs) {
+    const sc = crypto.subtle;
+    return {
+        kdf: (0, kdf_1.makeKdfImpl)((0, kdf_1.makeKdf)(cs.hpke.kdf)),
+        hash: (0, hash_1.makeHashImpl)(sc, cs.hash),
+        signature: (0, signature_1.makeNobleSignatureImpl)(cs.signature),
+        hpke: (0, hpke_1.makeHpke)(cs.hpke),
+        rng: rng_1.webCryptoRng,
+        name: cs.name
+    };
+}
+const ciphersuiteValues = {
+    1: {
+        hash: "SHA-256",
+        hpke: {
+            kem: "DHKEM-X25519-HKDF-SHA256",
+            aead: "AES128GCM",
+            kdf: "HKDF-SHA256",
+        },
+        signature: "Ed25519",
+        name: "MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519"
+    },
+    2: {
+        hash: "SHA-256",
+        hpke: {
+            kem: "DHKEM-P256-HKDF-SHA256",
+            aead: "AES128GCM",
+            kdf: "HKDF-SHA256",
+        },
+        signature: "P256",
+        name: "MLS_128_DHKEMP256_AES128GCM_SHA256_P256"
+    },
+    3: {
+        hash: "SHA-256",
+        hpke: {
+            kem: "DHKEM-X25519-HKDF-SHA256",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA256",
+        },
+        signature: "Ed25519",
+        name: "MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519"
+    },
+    4: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "DHKEM-X448-HKDF-SHA512",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed448",
+        name: "MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448"
+    },
+    5: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "DHKEM-P521-HKDF-SHA512",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "P521",
+        name: "MLS_256_DHKEMP521_AES256GCM_SHA512_P521"
+    },
+    6: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "DHKEM-X448-HKDF-SHA512",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed448",
+        name: "MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448"
+    },
+    7: {
+        hash: "SHA-384",
+        hpke: {
+            kem: "DHKEM-P384-HKDF-SHA384",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA384",
+        },
+        signature: "P384",
+        name: "MLS_256_DHKEMP384_AES256GCM_SHA384_P384"
+    },
+    77: {
+        hash: "SHA-256",
+        hpke: {
+            kem: "ML-KEM-512",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA256",
+        },
+        signature: "Ed25519",
+        name: "MLS_128_MLKEM512_AES128GCM_SHA256_Ed25519"
+    },
+    78: {
+        hash: "SHA-256",
+        hpke: {
+            kem: "ML-KEM-512",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA256",
+        },
+        signature: "Ed25519",
+        name: "MLS_128_MLKEM512_CHACHA20POLY1305_SHA256_Ed25519"
+    },
+    79: {
+        hash: "SHA-384",
+        hpke: {
+            kem: "ML-KEM-768",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA384",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_MLKEM768_AES256GCM_SHA384_Ed25519"
+    },
+    80: {
+        hash: "SHA-384",
+        hpke: {
+            kem: "ML-KEM-768",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA384",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_MLKEM768_CHACHA20POLY1305_SHA384_Ed25519"
+    },
+    81: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "ML-KEM-1024",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_MLKEM1024_AES256GCM_SHA512_Ed25519"
+    },
+    82: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "ML-KEM-1024",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_MLKEM1024_CHACHA20POLY1305_SHA512_Ed25519"
+    },
+    83: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "X-Wing",
+            aead: "AES256GCM",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_XWING_AES256GCM_SHA512_Ed25519"
+    },
+    84: {
+        hash: "SHA-512",
+        hpke: {
+            kem: "X-Wing",
+            aead: "CHACHA20POLY1305",
+            kdf: "HKDF-SHA512",
+        },
+        signature: "Ed25519",
+        name: "MLS_256_XWING_CHACHA20POLY1305_SHA512_Ed25519"
+    },
+};
+//# sourceMappingURL=ciphersuite.js.map

package/dist/crypto/ciphersuite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciphersuite.js","sourceRoot":"","sources":["../../src/crypto/ciphersuite.ts"],"names":[],"mappings":";;;AAkDA,wCAEC;AAED,4DAEC;AAED,oDAEC;AAED,gDAUC;AAxED,2CAAmF;AACnF,iCAA0D;AAC1D,+BAAiD;AACjD,iCAAsD;AACtD,oDAA+D;AAC/D,4CAA4D;AAC5D,oDAA+D;AAC/D,qDAA4F;AAC5F,+BAAyC;AAWzC,MAAM,YAAY,GAAG;IACnB,4CAA4C,EAAE,CAAC;IAC/C,uCAAuC,EAAE,CAAC;IAC1C,mDAAmD,EAAE,CAAC;IACtD,wCAAwC,EAAE,CAAC;IAC3C,uCAAuC,EAAE,CAAC;IAC1C,+CAA+C,EAAE,CAAC;IAClD,uCAAuC,EAAE,CAAC;IAC1C,yCAAyC,EAAE,EAAE;IAC7C,gDAAgD,EAAE,EAAE;IACpD,yCAAyC,EAAE,EAAE;IAC7C,gDAAgD,EAAE,EAAE;IACpD,0CAA0C,EAAE,EAAE;IAC9C,iDAAiD,EAAE,EAAE;IACrD,sCAAsC,EAAE,EAAE;IAC1C,6CAA6C,EAAE,EAAE;CACzC,CAAA;AAKG,QAAA,iBAAiB,GAA6B,IAAA,6BAAgB,EACzE,qBAAY,EACZ,IAAA,mCAAqB,EAAC,YAAY,CAAC,CACpC,CAAA;AAEY,QAAA,iBAAiB,GAA6B,IAAA,6BAAgB,EACzE,qBAAY,EACZ,IAAA,iCAAmB,EAAC,YAAY,CAAC,CAClC,CAAA;AAED,SAAgB,cAAc,CAAC,IAAqB;IAClD,OAAO,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAiB;IACxD,OAAO,IAAA,wBAAU,EAAC,YAAY,CAAC,CAAC,EAAE,CAAoB,CAAA;AACxD,CAAC;AAED,SAAgB,oBAAoB,CAAC,EAAiB;IACpD,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,SAAgB,kBAAkB,CAAC,EAAe;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAA;IACxB,OAAO;QACL,GAAG,EAAE,IAAA,iBAAW,EAAC,IAAA,aAAO,EAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,IAAA,mBAAY,EAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;QAC/B,SAAS,EAAE,IAAA,kCAAsB,EAAC,EAAE,CAAC,SAAS,CAAC;QAC/C,IAAI,EAAE,IAAA,eAAQ,EAAC,EAAE,CAAC,IAAI,CAAC;QACvB,GAAG,EAAE,kBAAY;QACjB,IAAI,EAAE,EAAE,CAAC,IAAI;KACd,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAuC;IAC5D,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,8CAA8C;KACrD;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,yCAAyC;KAChD;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,qDAAqD;KAC5D;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,0CAA0C;KACjD;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,yCAAyC;KAChD;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,iDAAiD;KACxD;IACD,CAAC,EAAE;QACD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,yCAAyC;KAChD;IAED,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,2CAA2C;KAClD;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,kDAAkD;KACzD;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,2CAA2C;KAClD;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,kDAAkD;KACzD;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,aAAa;YAClB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,4CAA4C;KACnD;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,aAAa;YAClB,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,mDAAmD;KAC1D;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,wCAAwC;KAC/C;IACD,EAAE,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,aAAa;SACnB;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,+CAA+C;KACtD;CACO,CAAA"}

package/dist/crypto/hash.d.ts

@@ -0,0 +1,8 @@
+export type HashAlgorithm = "SHA-512" | "SHA-384" | "SHA-256";
+export declare function makeHashImpl(sc: SubtleCrypto, h: HashAlgorithm): Hash;
+export interface Hash {
+    digest(data: Uint8Array): Promise<Uint8Array>;
+    mac(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+    verifyMac(key: Uint8Array, mac: Uint8Array, data: Uint8Array): Promise<boolean>;
+}
+export declare function refhash(label: string, value: Uint8Array, h: Hash): Promise<Uint8Array<ArrayBufferLike>>;

package/dist/crypto/hash.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeHashImpl = makeHashImpl;
+exports.refhash = refhash;
+const utils_1 = require("@noble/ciphers/utils");
+const variableLength_1 = require("../codec/variableLength");
+const byteArray_1 = require("../util/byteArray");
+function makeHashImpl(sc, h) {
+    return {
+        async digest(data) {
+            const result = await sc.digest(h, (0, byteArray_1.bytesToBuffer)(data));
+            return new Uint8Array(result);
+        },
+        async mac(key, data) {
+            const result = await sc.sign("HMAC", await importMacKey(key, h), (0, byteArray_1.bytesToBuffer)(data));
+            return new Uint8Array(result);
+        },
+        async verifyMac(key, mac, data) {
+            return sc.verify("HMAC", await importMacKey(key, h), (0, byteArray_1.bytesToBuffer)(mac), (0, byteArray_1.bytesToBuffer)(data));
+        },
+    };
+}
+function importMacKey(rawKey, h) {
+    return crypto.subtle.importKey("raw", (0, byteArray_1.bytesToBuffer)(rawKey), {
+        name: "HMAC",
+        hash: { name: h },
+    }, false, ["sign", "verify"]);
+}
+function refhash(label, value, h) {
+    return h.digest(encodeRefHash(label, value));
+}
+function encodeRefHash(label, value) {
+    const labelBytes = (0, utils_1.utf8ToBytes)(label);
+    return new Uint8Array([...(0, variableLength_1.encodeVarLenData)(labelBytes), ...(0, variableLength_1.encodeVarLenData)(value)]);
+}
+//# sourceMappingURL=hash.js.map

package/dist/crypto/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":";;AAMA,oCAcC;AAqBD,0BAEC;AA3CD,gDAAkD;AAClD,4DAA0D;AAC1D,iDAAiD;AAIjD,SAAgB,YAAY,CAAC,EAAgB,EAAE,CAAgB;IAC7D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAA,yBAAa,EAAC,IAAI,CAAC,CAAC,CAAA;YACtD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAA,yBAAa,EAAC,IAAI,CAAC,CAAC,CAAA;YACrF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;YAC5B,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,IAAA,yBAAa,EAAC,IAAI,CAAC,CAAC,CAAA;QAC/F,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,CAAgB;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAA,yBAAa,EAAC,MAAM,CAAC,EACrB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KAClB,EACD,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAQD,SAAgB,OAAO,CAAC,KAAa,EAAE,KAAiB,EAAE,CAAO;IAC/D,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAiB;IACrD,MAAM,UAAU,GAAG,IAAA,mBAAW,EAAC,KAAK,CAAC,CAAA;IACrC,OAAO,IAAI,UAAU,CAAC,CAAC,GAAG,IAAA,iCAAgB,EAAC,UAAU,CAAC,EAAE,GAAG,IAAA,iCAAgB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC"}

package/dist/crypto/hpke.d.ts

@@ -0,0 +1,46 @@
+import { AeadAlgorithm } from "./aead";
+import { KdfAlgorithm } from "./kdf";
+import { KemAlgorithm } from "./kem";
+export type PublicKey = CryptoKey & {
+    type: "public";
+};
+export type SecretKey = CryptoKey & {
+    type: "secret";
+};
+export type PrivateKey = CryptoKey & {
+    type: "private";
+};
+export type HpkeAlgorithm = {
+    kem: KemAlgorithm;
+    kdf: KdfAlgorithm;
+    aead: AeadAlgorithm;
+};
+export declare function encryptWithLabel(publicKey: PublicKey, label: string, context: Uint8Array, plaintext: Uint8Array, hpke: Hpke): Promise<{
+    ct: Uint8Array;
+    enc: Uint8Array;
+}>;
+export declare function decryptWithLabel(privateKey: PrivateKey, label: string, context: Uint8Array, kemOutput: Uint8Array, ciphertext: Uint8Array, hpke: Hpke): Promise<Uint8Array>;
+export declare function makeHpke(hpkealg: HpkeAlgorithm): Hpke;
+export interface Hpke {
+    open(privateKey: PrivateKey, kemOutput: Uint8Array, ciphertext: Uint8Array, info: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+    seal(publicKey: PublicKey, plaintext: Uint8Array, info: Uint8Array, aad?: Uint8Array): Promise<{
+        ct: Uint8Array;
+        enc: Uint8Array;
+    }>;
+    importPrivateKey(k: Uint8Array): Promise<PrivateKey>;
+    importPublicKey(k: Uint8Array): Promise<PublicKey>;
+    exportPublicKey(k: PublicKey): Promise<Uint8Array>;
+    exportPrivateKey(k: PrivateKey): Promise<Uint8Array>;
+    encryptAead(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array | undefined, plaintext: Uint8Array): Promise<Uint8Array>;
+    decryptAead(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array | undefined, ciphertext: Uint8Array): Promise<Uint8Array>;
+    deriveKeyPair(ikm: Uint8Array): Promise<{
+        privateKey: PrivateKey;
+        publicKey: PublicKey;
+    }>;
+    generateKeyPair(): Promise<{
+        privateKey: PrivateKey;
+        publicKey: PublicKey;
+    }>;
+    keyLength: number;
+    nonceLength: number;
+}

package/dist/crypto/hpke.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptWithLabel = encryptWithLabel;
+exports.decryptWithLabel = decryptWithLabel;
+exports.makeHpke = makeHpke;
+const hpke_js_1 = require("hpke-js");
+const aead_1 = require("./aead");
+const kdf_1 = require("./kdf");
+const kem_1 = require("./kem");
+const utils_1 = require("@noble/ciphers/utils");
+const variableLength_1 = require("../codec/variableLength");
+const byteArray_1 = require("../util/byteArray");
+function encryptWithLabel(publicKey, label, context, plaintext, hpke) {
+    return hpke.seal(publicKey, plaintext, new Uint8Array([...(0, variableLength_1.encodeVarLenData)((0, utils_1.utf8ToBytes)(`MLS 1.0 ${label}`)), ...(0, variableLength_1.encodeVarLenData)(context)]), new Uint8Array());
+}
+function decryptWithLabel(privateKey, label, context, kemOutput, ciphertext, hpke) {
+    return hpke.open(privateKey, kemOutput, ciphertext, new Uint8Array([...(0, variableLength_1.encodeVarLenData)((0, utils_1.utf8ToBytes)(`MLS 1.0 ${label}`)), ...(0, variableLength_1.encodeVarLenData)(context)]));
+}
+function makeHpke(hpkealg) {
+    const cs = new hpke_js_1.CipherSuite({
+        kem: (0, kem_1.makeDhKem)(hpkealg.kem),
+        kdf: (0, kdf_1.makeKdf)(hpkealg.kdf),
+        aead: (0, aead_1.makeAead)(hpkealg.aead),
+    });
+    return {
+        async open(privateKey, kemOutput, ciphertext, info, aad) {
+            const result = await cs.open({ recipientKey: privateKey, enc: (0, byteArray_1.bytesToBuffer)(kemOutput), info: (0, byteArray_1.bytesToBuffer)(info) }, (0, byteArray_1.bytesToBuffer)(ciphertext), aad ? (0, byteArray_1.bytesToBuffer)(aad) : new ArrayBuffer());
+            return new Uint8Array(result);
+        },
+        async seal(publicKey, plaintext, info, aad) {
+            const result = await cs.seal({ recipientPublicKey: publicKey, info: (0, byteArray_1.bytesToBuffer)(info) }, (0, byteArray_1.bytesToBuffer)(plaintext), aad ? (0, byteArray_1.bytesToBuffer)(aad) : new ArrayBuffer());
+            return {
+                ct: new Uint8Array(result.ct),
+                enc: new Uint8Array(result.enc),
+            };
+        },
+        async importPrivateKey(k) {
+            // See https://github.com/mlswg/mls-implementations/issues/176#issuecomment-1817043142
+            const key = hpkealg.kem === "DHKEM-P521-HKDF-SHA512" ? prepadPrivateKeyP521(k) : k;
+            return (await cs.kem.deserializePrivateKey((0, byteArray_1.bytesToBuffer)(key)));
+        },
+        async importPublicKey(k) {
+            return (await cs.kem.deserializePublicKey((0, byteArray_1.bytesToBuffer)(k)));
+        },
+        async exportPublicKey(k) {
+            return new Uint8Array(await cs.kem.serializePublicKey(k));
+        },
+        async exportPrivateKey(k) {
+            return new Uint8Array(await cs.kem.serializePrivateKey(k));
+        },
+        async encryptAead(key, nonce, aad, plaintext) {
+            return (0, aead_1.encryptAead)(key, nonce, aad ? aad : new Uint8Array(), plaintext, hpkealg.aead);
+        },
+        async decryptAead(key, nonce, aad, ciphertext) {
+            return (0, aead_1.decryptAead)(key, nonce, aad ? aad : new Uint8Array(), ciphertext, hpkealg.aead);
+        },
+        async deriveKeyPair(ikm) {
+            const kp = await cs.kem.deriveKeyPair((0, byteArray_1.bytesToBuffer)(ikm));
+            return { privateKey: kp.privateKey, publicKey: kp.publicKey };
+        },
+        async generateKeyPair() {
+            const kp = await cs.kem.generateKeyPair();
+            return { privateKey: kp.privateKey, publicKey: kp.publicKey };
+        },
+        keyLength: cs.aead.keySize,
+        nonceLength: cs.aead.nonceSize,
+    };
+}
+function prepadPrivateKeyP521(k) {
+    const lengthDifference = 66 - k.byteLength;
+    return new Uint8Array([...new Uint8Array(lengthDifference), ...k]);
+}
+//# sourceMappingURL=hpke.js.map

package/dist/crypto/hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.js","sourceRoot":"","sources":["../../src/crypto/hpke.ts"],"names":[],"mappings":";;AAkBA,4CAaC;AAED,4CAcC;AAED,4BA0DC;AA3GD,qCAAqC;AACrC,iCAA0E;AAC1E,+BAA6C;AAC7C,+BAA+C;AAC/C,gDAAkD;AAClD,4DAA0D;AAC1D,iDAAiD;AAYjD,SAAgB,gBAAgB,CAC9B,SAAoB,EACpB,KAAa,EACb,OAAmB,EACnB,SAAqB,EACrB,IAAU;IAEV,OAAO,IAAI,CAAC,IAAI,CACd,SAAS,EACT,SAAS,EACT,IAAI,UAAU,CAAC,CAAC,GAAG,IAAA,iCAAgB,EAAC,IAAA,mBAAW,EAAC,WAAW,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,IAAA,iCAAgB,EAAC,OAAO,CAAC,CAAC,CAAC,EACpG,IAAI,UAAU,EAAE,CACjB,CAAA;AACH,CAAC;AAED,SAAgB,gBAAgB,CAC9B,UAAsB,EACtB,KAAa,EACb,OAAmB,EACnB,SAAqB,EACrB,UAAsB,EACtB,IAAU;IAEV,OAAO,IAAI,CAAC,IAAI,CACd,UAAU,EACV,SAAS,EACT,UAAU,EACV,IAAI,UAAU,CAAC,CAAC,GAAG,IAAA,iCAAgB,EAAC,IAAA,mBAAW,EAAC,WAAW,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,IAAA,iCAAgB,EAAC,OAAO,CAAC,CAAC,CAAC,CACrG,CAAA;AACH,CAAC;AAED,SAAgB,QAAQ,CAAC,OAAsB;IAC7C,MAAM,EAAE,GAAG,IAAI,qBAAW,CAAC;QACzB,GAAG,EAAE,IAAA,eAAS,EAAC,OAAO,CAAC,GAAG,CAAC;QAC3B,GAAG,EAAE,IAAA,aAAO,EAAC,OAAO,CAAC,GAAG,CAAC;QACzB,IAAI,EAAE,IAAA,eAAQ,EAAC,OAAO,CAAC,IAAI,CAAC;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAC1B,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,IAAA,yBAAa,EAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,EACtF,IAAA,yBAAa,EAAC,UAAU,CAAC,EACzB,GAAG,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAC7C,CAAA;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG;YACxC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAC1B,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,EAC5D,IAAA,yBAAa,EAAC,SAAS,CAAC,EACxB,GAAG,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAC7C,CAAA;YACD,OAAO;gBACL,EAAE,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aAChC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtB,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAClF,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAe,CAAA;QAC/E,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,CAAC;YACrB,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAA,yBAAa,EAAC,CAAC,CAAC,CAAC,CAAc,CAAA;QAC3E,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,CAAC;YACrB,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtB,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS;YAC1C,OAAO,IAAA,kBAAW,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvF,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU;YAC3C,OAAO,IAAA,kBAAW,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACxF,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,CAAA;YACzD,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,UAAwB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAsB,EAAE,CAAA;QAC1F,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,CAAA;YACzC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,UAAwB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAsB,EAAE,CAAA;QAC1F,CAAC;QACD,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO;QAC1B,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS;KAC/B,CAAA;AACH,CAAC;AAqCD,SAAS,oBAAoB,CAAC,CAAa;IACzC,MAAM,gBAAgB,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAA;IAC1C,OAAO,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC"}

package/dist/crypto/kdf.d.ts

@@ -0,0 +1,12 @@
+import { KdfInterface } from "hpke-js";
+export interface Kdf {
+    extract(salt: Uint8Array, ikm: Uint8Array): Promise<Uint8Array>;
+    expand(prk: Uint8Array, info: Uint8Array, len: number): Promise<Uint8Array>;
+    size: number;
+}
+export type KdfAlgorithm = "HKDF-SHA256" | "HKDF-SHA384" | "HKDF-SHA512";
+export declare function makeKdfImpl(k: KdfInterface): Kdf;
+export declare function makeKdf(kdfAlg: KdfAlgorithm): KdfInterface;
+export declare function expandWithLabel(secret: Uint8Array, label: string, context: Uint8Array, length: number, kdf: Kdf): Promise<Uint8Array>;
+export declare function deriveSecret(secret: Uint8Array, label: string, kdf: Kdf): Promise<Uint8Array>;
+export declare function deriveTreeSecret(secret: Uint8Array, label: string, generation: number, length: number, kdf: Kdf): Promise<Uint8Array>;