New:Socket for Asana Is Now Available.Learn more →
Get Started

webcrypt

Package Overview
Dependencies
Maintainers
1
Versions
21
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

webcrypt - npm Package Compare versions

Comparing version
0.6.4
 to
0.6.5
+68
-181
dist/index.d.cts

@@ -15,3 +15,18 @@ // src/WebCrypt.d.ts

declare class WebCrypt {
static readonly ALGORITHM: "AES-GCM";
static readonly KEY_LENGTH: 256;
static readonly IV_LENGTH: 12;
static readonly SALT_LENGTH: 16;
static readonly PBKDF2_ITERATIONS: number;
static readonly HASH_ALGORITHM: "SHA-256";
static readonly CHUNK_SIZE: number;
static readonly WEBRTC_SALT: Uint8Array;
static readonly DEFAULT_HMAC_SALT: Uint8Array;
/**
* Generates a cryptographically secure random salt for HMAC key derivation.
* @param length Salt length in bytes (default: 16)
*/
static generateHmacSalt(length?: number): Uint8Array;
/**
* Encrypts a string and returns Base64-encoded ciphertext

@@ -738,72 +753,39 @@ * @param text Plain text to encrypt

/**
* Sign a text message with a configurable algorithm
* @param text - Text to sign
* @param privateKey - Private key for signing
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Import a public signing key from base64 (SPKI format)
* @param publicKeyB64 - Base64 encoded SPKI public key
* @param curve - Elliptic curve ('P-256' default, 'P-384')
*/
signTextWithAlgorithm(
text: string,
privateKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<string>;
importPublicSigningKey(publicKeyB64: string, curve?: string): Promise<CryptoKey>;
/**
* Verify a signed text message with a configurable algorithm
* @param text - Text that was signed
* @param signatureB64 - Base64-encoded signature
* @param publicKey - Public key for verification
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Sign a text message or data string with ECDSA
* @param text - Text to sign
* @param privateKey - ECDSA private key
* @returns Base64-encoded detached signature
*/
verifyTextWithAlgorithm(
text: string,
signatureB64: string,
publicKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<boolean>;
signText(text: string, privateKey: CryptoKey): Promise<string>;
/**
* Generate a key with key rotation support
* @param password - Password to derive the key from
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* @param rotationCount - Rotation counter
* Verify a signed text message with ECDSA
* @param text - Text that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateRotatingKey(
password: string,
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2",
rotationCount?: number
): Promise<CryptoKey>;
verifyText(text: string, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Generate a hierarchical key structure from a master password
* @param masterPassword - Master password
* @param path - Path components for child keys
* Create a detached signature for a file or blob
* @param fileOrBlob - File or Blob object to sign
* @param privateKey - ECDSA private key
*/
generateHierarchicalKey(
masterPassword: string,
path: string[]
): Promise<{
masterKey: CryptoKey;
childKeys: { [key: string]: CryptoKey };
}>;
signFile(fileOrBlob: any, privateKey: CryptoKey): Promise<{ signatureB64: string; blob: any }>;
/**
* Generate a key from multiple combined inputs
* @param inputs - Array of input strings to combine
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* Verify a detached signature for a file or blob
* @param fileOrBlob - File or Blob object that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateKeyFromMultipleInputs(
inputs: string[],
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2"
): Promise<CryptoKey>;
verifyFile(fileOrBlob: any, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Secure random number generation
* @param length - Number of bytes to generate
*/
secureRandom(length: number): Promise<Uint8Array>;
// ────────────────────── JSON Web Encryption (JWE) ──────────────────────

@@ -899,4 +881,13 @@

*/
static readonly SUPPORTED_DILITHIUM_LEVELS: string[];
/**
* Returns true if PQC module is running as a placeholder/stub.
*/
static isStub(): boolean;
/**
* Enable or disable stub testing mode for unit tests.
* @param allow Enable stub testing mode if true
*/
static enableStubTesting(allow?: boolean): void;
constructor();

@@ -1034,144 +1025,40 @@

// src/TimingSafeHelper.d.ts
/**
* WebCrypt Security Helper - Timing Attack Protection
* Provides constant-time comparison and dummy operations to prevent timing oracle attacks
* Timing-safe utilities to prevent side-channel timing attacks.
*/
class TimingSafeHelper {
declare class TimingSafeHelper {
/**
* Constant-time string comparison to prevent timing attacks
* @param {string} a - First string
* @param {string} b - Second string
* @returns {Promise<boolean>} True if strings are equal (in constant time)
* Constant-time string comparison to prevent timing side-channel attacks.
*/
static async constantTimeCompareStrings(a, b) {
const encoder = new TextEncoder();
const bufA = encoder.encode(a);
const bufB = encoder.encode(b);
static constantTimeCompareStrings(a: string, b: string): Promise<boolean>;
// Ensure same length to prevent early termination detection
const len = Math.max(bufA.length, bufB.length);
// XOR all bytes and track differences
let diff = 0;
for (let i = 0; i < len; i++) {
if (i < bufA.length && i < bufB.length) {
diff |= bufA[i] ^ bufB[i];
} else {
// Different lengths contribute to difference
diff |= 1;
}
}
return diff === 0;
}
/**
* Constant-time ArrayBuffer comparison to prevent timing attacks
* @param {ArrayBuffer} a - First buffer
* @param {ArrayBuffer} b - Second buffer
* @returns {Promise<boolean>} True if buffers are equal (in constant time)
* Constant-time Uint8Array comparison to prevent timing side-channel attacks.
*/
static async constantTimeCompareBuffers(a, b) {
const bufA = new Uint8Array(a);
const bufB = new Uint8Array(b);
static constantTimeCompareBuffers(a: Uint8Array, b: Uint8Array): Promise<boolean>;
// Ensure same length to prevent early termination detection
const len = Math.max(bufA.length, bufB.length);
// XOR all bytes and track differences
let diff = 0;
for (let i = 0; i < len; i++) {
if (i < bufA.length && i < bufB.length) {
diff |= bufA[i] ^ bufB[i];
} else {
// Different lengths contribute to difference
diff |= 1;
}
}
return diff === 0;
}
/**
* Execute dummy operations to pad execution time and prevent timing attacks
* Uses non-blocking async timers to prevent CPU thread lockup.
* @param {number} minMs - Minimum milliseconds to delay (e.g., 5-10ms)
* Sleep with dummy operations to add timing noise.
*/
static async sleepWithDummyOps(minMs = 10) {
const startTime = performance.now();
const elapsed = performance.now() - startTime;
const remaining = minMs - elapsed;
static sleepWithDummyOps(minMs?: number): Promise<void>;
if (remaining > 0) {
await new Promise(resolve => setTimeout(resolve, Math.max(1, Math.ceil(remaining))));
}
}
/**
* Timing-safe signature verification wrapper
* Adds constant-time comparison and padding to prevent timing oracle attacks
* @param {any} crypto - Crypto API (subtle)
* @param {Object} algorithmParams - Algorithm parameters
* @param {CryptoKey} key - Verification key
* @param {ArrayBuffer} signature - Signature buffer
* @param {Uint8Array|ArrayBuffer} data - Data to verify
* @returns {Promise<boolean>} True if valid signature (with constant-time comparison)
* Timing-safe signature verification.
*/
static async timingSafeVerify(crypto, algorithmParams, key, signature, data) {
const startTime = performance.now();
static timingSafeVerify(
crypto: any,
algorithmParams: any,
key: CryptoKey,
signature: Uint8Array,
data: Uint8Array
): Promise<boolean>;
// Perform actual verification
let isValid;
try {
isValid = await crypto.subtle.verify(algorithmParams, key, signature, data);
} catch (e) {
isValid = false;
}
// Calculate minimum verification time to prevent timing attacks
const minVerificationTimeMs = 10; // At least 10ms for all verifications
const elapsedMs = performance.now() - startTime;
if (elapsedMs < minVerificationTimeMs) {
await this.sleepWithDummyOps(minVerificationTimeMs - elapsedMs);
}
return isValid;
}
/**
* Timing-safe key derivation verification wrapper
* Ensures consistent timing regardless of password correctness
* @param {Function} deriveFn - Key derivation function
* @param {...any} args - Arguments to pass to derive function
* @returns {Promise<CryptoKey>} Derived key
* Timing-safe wrapper for key derivation functions.
*/
static async timingSafeDerive(deriveFn, ...args) {
const startTime = performance.now();
let key;
try {
key = await deriveFn(...args);
} catch (e) {
// Even on error, wait minimum time to prevent timing attacks
const elapsedMs = performance.now() - startTime;
if (elapsedMs < 50) {
await this.sleepWithDummyOps(50 - elapsedMs);
}
throw e;
}
// Ensure minimum derivation time (e.g., 50ms for strong KDFs)
const minDerivationTimeMs = 50;
const elapsedMs = performance.now() - startTime;
if (elapsedMs < minDerivationTimeMs) {
await this.sleepWithDummyOps(minDerivationTimeMs - elapsedMs);
}
return key;
}
static timingSafeDerive<T>(deriveFn: (...args: any[]) => Promise<T>, ...args: any[]): Promise<T>;
}
export { TimingSafeHelper, WebCrypt, WebCryptAsym, WebCryptPQC };
+68
-181
dist/index.d.ts

@@ -15,3 +15,18 @@ // src/WebCrypt.d.ts

declare class WebCrypt {
static readonly ALGORITHM: "AES-GCM";
static readonly KEY_LENGTH: 256;
static readonly IV_LENGTH: 12;
static readonly SALT_LENGTH: 16;
static readonly PBKDF2_ITERATIONS: number;
static readonly HASH_ALGORITHM: "SHA-256";
static readonly CHUNK_SIZE: number;
static readonly WEBRTC_SALT: Uint8Array;
static readonly DEFAULT_HMAC_SALT: Uint8Array;
/**
* Generates a cryptographically secure random salt for HMAC key derivation.
* @param length Salt length in bytes (default: 16)
*/
static generateHmacSalt(length?: number): Uint8Array;
/**
* Encrypts a string and returns Base64-encoded ciphertext

@@ -738,72 +753,39 @@ * @param text Plain text to encrypt

/**
* Sign a text message with a configurable algorithm
* @param text - Text to sign
* @param privateKey - Private key for signing
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Import a public signing key from base64 (SPKI format)
* @param publicKeyB64 - Base64 encoded SPKI public key
* @param curve - Elliptic curve ('P-256' default, 'P-384')
*/
signTextWithAlgorithm(
text: string,
privateKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<string>;
importPublicSigningKey(publicKeyB64: string, curve?: string): Promise<CryptoKey>;
/**
* Verify a signed text message with a configurable algorithm
* @param text - Text that was signed
* @param signatureB64 - Base64-encoded signature
* @param publicKey - Public key for verification
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Sign a text message or data string with ECDSA
* @param text - Text to sign
* @param privateKey - ECDSA private key
* @returns Base64-encoded detached signature
*/
verifyTextWithAlgorithm(
text: string,
signatureB64: string,
publicKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<boolean>;
signText(text: string, privateKey: CryptoKey): Promise<string>;
/**
* Generate a key with key rotation support
* @param password - Password to derive the key from
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* @param rotationCount - Rotation counter
* Verify a signed text message with ECDSA
* @param text - Text that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateRotatingKey(
password: string,
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2",
rotationCount?: number
): Promise<CryptoKey>;
verifyText(text: string, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Generate a hierarchical key structure from a master password
* @param masterPassword - Master password
* @param path - Path components for child keys
* Create a detached signature for a file or blob
* @param fileOrBlob - File or Blob object to sign
* @param privateKey - ECDSA private key
*/
generateHierarchicalKey(
masterPassword: string,
path: string[]
): Promise<{
masterKey: CryptoKey;
childKeys: { [key: string]: CryptoKey };
}>;
signFile(fileOrBlob: any, privateKey: CryptoKey): Promise<{ signatureB64: string; blob: any }>;
/**
* Generate a key from multiple combined inputs
* @param inputs - Array of input strings to combine
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* Verify a detached signature for a file or blob
* @param fileOrBlob - File or Blob object that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateKeyFromMultipleInputs(
inputs: string[],
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2"
): Promise<CryptoKey>;
verifyFile(fileOrBlob: any, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Secure random number generation
* @param length - Number of bytes to generate
*/
secureRandom(length: number): Promise<Uint8Array>;
// ────────────────────── JSON Web Encryption (JWE) ──────────────────────

@@ -899,4 +881,13 @@

*/
static readonly SUPPORTED_DILITHIUM_LEVELS: string[];
/**
* Returns true if PQC module is running as a placeholder/stub.
*/
static isStub(): boolean;
/**
* Enable or disable stub testing mode for unit tests.
* @param allow Enable stub testing mode if true
*/
static enableStubTesting(allow?: boolean): void;
constructor();

@@ -1034,144 +1025,40 @@

// src/TimingSafeHelper.d.ts
/**
* WebCrypt Security Helper - Timing Attack Protection
* Provides constant-time comparison and dummy operations to prevent timing oracle attacks
* Timing-safe utilities to prevent side-channel timing attacks.
*/
class TimingSafeHelper {
declare class TimingSafeHelper {
/**
* Constant-time string comparison to prevent timing attacks
* @param {string} a - First string
* @param {string} b - Second string
* @returns {Promise<boolean>} True if strings are equal (in constant time)
* Constant-time string comparison to prevent timing side-channel attacks.
*/
static async constantTimeCompareStrings(a, b) {
const encoder = new TextEncoder();
const bufA = encoder.encode(a);
const bufB = encoder.encode(b);
static constantTimeCompareStrings(a: string, b: string): Promise<boolean>;
// Ensure same length to prevent early termination detection
const len = Math.max(bufA.length, bufB.length);
// XOR all bytes and track differences
let diff = 0;
for (let i = 0; i < len; i++) {
if (i < bufA.length && i < bufB.length) {
diff |= bufA[i] ^ bufB[i];
} else {
// Different lengths contribute to difference
diff |= 1;
}
}
return diff === 0;
}
/**
* Constant-time ArrayBuffer comparison to prevent timing attacks
* @param {ArrayBuffer} a - First buffer
* @param {ArrayBuffer} b - Second buffer
* @returns {Promise<boolean>} True if buffers are equal (in constant time)
* Constant-time Uint8Array comparison to prevent timing side-channel attacks.
*/
static async constantTimeCompareBuffers(a, b) {
const bufA = new Uint8Array(a);
const bufB = new Uint8Array(b);
static constantTimeCompareBuffers(a: Uint8Array, b: Uint8Array): Promise<boolean>;
// Ensure same length to prevent early termination detection
const len = Math.max(bufA.length, bufB.length);
// XOR all bytes and track differences
let diff = 0;
for (let i = 0; i < len; i++) {
if (i < bufA.length && i < bufB.length) {
diff |= bufA[i] ^ bufB[i];
} else {
// Different lengths contribute to difference
diff |= 1;
}
}
return diff === 0;
}
/**
* Execute dummy operations to pad execution time and prevent timing attacks
* Uses non-blocking async timers to prevent CPU thread lockup.
* @param {number} minMs - Minimum milliseconds to delay (e.g., 5-10ms)
* Sleep with dummy operations to add timing noise.
*/
static async sleepWithDummyOps(minMs = 10) {
const startTime = performance.now();
const elapsed = performance.now() - startTime;
const remaining = minMs - elapsed;
static sleepWithDummyOps(minMs?: number): Promise<void>;
if (remaining > 0) {
await new Promise(resolve => setTimeout(resolve, Math.max(1, Math.ceil(remaining))));
}
}
/**
* Timing-safe signature verification wrapper
* Adds constant-time comparison and padding to prevent timing oracle attacks
* @param {any} crypto - Crypto API (subtle)
* @param {Object} algorithmParams - Algorithm parameters
* @param {CryptoKey} key - Verification key
* @param {ArrayBuffer} signature - Signature buffer
* @param {Uint8Array|ArrayBuffer} data - Data to verify
* @returns {Promise<boolean>} True if valid signature (with constant-time comparison)
* Timing-safe signature verification.
*/
static async timingSafeVerify(crypto, algorithmParams, key, signature, data) {
const startTime = performance.now();
static timingSafeVerify(
crypto: any,
algorithmParams: any,
key: CryptoKey,
signature: Uint8Array,
data: Uint8Array
): Promise<boolean>;
// Perform actual verification
let isValid;
try {
isValid = await crypto.subtle.verify(algorithmParams, key, signature, data);
} catch (e) {
isValid = false;
}
// Calculate minimum verification time to prevent timing attacks
const minVerificationTimeMs = 10; // At least 10ms for all verifications
const elapsedMs = performance.now() - startTime;
if (elapsedMs < minVerificationTimeMs) {
await this.sleepWithDummyOps(minVerificationTimeMs - elapsedMs);
}
return isValid;
}
/**
* Timing-safe key derivation verification wrapper
* Ensures consistent timing regardless of password correctness
* @param {Function} deriveFn - Key derivation function
* @param {...any} args - Arguments to pass to derive function
* @returns {Promise<CryptoKey>} Derived key
* Timing-safe wrapper for key derivation functions.
*/
static async timingSafeDerive(deriveFn, ...args) {
const startTime = performance.now();
let key;
try {
key = await deriveFn(...args);
} catch (e) {
// Even on error, wait minimum time to prevent timing attacks
const elapsedMs = performance.now() - startTime;
if (elapsedMs < 50) {
await this.sleepWithDummyOps(50 - elapsedMs);
}
throw e;
}
// Ensure minimum derivation time (e.g., 50ms for strong KDFs)
const minDerivationTimeMs = 50;
const elapsedMs = performance.now() - startTime;
if (elapsedMs < minDerivationTimeMs) {
await this.sleepWithDummyOps(minDerivationTimeMs - elapsedMs);
}
return key;
}
static timingSafeDerive<T>(deriveFn: (...args: any[]) => Promise<T>, ...args: any[]): Promise<T>;
}
export { TimingSafeHelper, WebCrypt, WebCryptAsym, WebCryptPQC };
+8
-1
dist/WebCrypt.cjs

@@ -42,4 +42,11 @@ var __defProp = Object.defineProperty;

// WEBRTC_SALT: Fixed salt for WebRTC key derivation; ensures consistent keys between peers without transmission
/**
* Default static salt for WebRTC transform convenience.
* @warning For production applications, pass a custom salt per session.
*/
static WEBRTC_SALT = new TextEncoder().encode("WebCrypt-E2EE-v1-2025");
// DEFAULT_HMAC_SALT: Default static salt for deterministic password-derived HMAC key derivation
/**
* Default static salt for deterministic password-derived HMAC key derivation.
* @warning For production security, generate custom salts with WebCrypt.generateHmacSalt().
*/
static DEFAULT_HMAC_SALT = new TextEncoder().encode("WebCrypt-HMAC-DefaultSalt-v0.6");

@@ -46,0 +53,0 @@ /**

+15
-0
dist/WebCrypt.d.cts

@@ -15,3 +15,18 @@ // src/WebCrypt.d.ts

declare class WebCrypt {
static readonly ALGORITHM: "AES-GCM";
static readonly KEY_LENGTH: 256;
static readonly IV_LENGTH: 12;
static readonly SALT_LENGTH: 16;
static readonly PBKDF2_ITERATIONS: number;
static readonly HASH_ALGORITHM: "SHA-256";
static readonly CHUNK_SIZE: number;
static readonly WEBRTC_SALT: Uint8Array;
static readonly DEFAULT_HMAC_SALT: Uint8Array;
/**
* Generates a cryptographically secure random salt for HMAC key derivation.
* @param length Salt length in bytes (default: 16)
*/
static generateHmacSalt(length?: number): Uint8Array;
/**
* Encrypts a string and returns Base64-encoded ciphertext

@@ -18,0 +33,0 @@ * @param text Plain text to encrypt

+15
-0
dist/WebCrypt.d.ts

@@ -15,3 +15,18 @@ // src/WebCrypt.d.ts

declare class WebCrypt {
static readonly ALGORITHM: "AES-GCM";
static readonly KEY_LENGTH: 256;
static readonly IV_LENGTH: 12;
static readonly SALT_LENGTH: 16;
static readonly PBKDF2_ITERATIONS: number;
static readonly HASH_ALGORITHM: "SHA-256";
static readonly CHUNK_SIZE: number;
static readonly WEBRTC_SALT: Uint8Array;
static readonly DEFAULT_HMAC_SALT: Uint8Array;
/**
* Generates a cryptographically secure random salt for HMAC key derivation.
* @param length Salt length in bytes (default: 16)
*/
static generateHmacSalt(length?: number): Uint8Array;
/**
* Encrypts a string and returns Base64-encoded ciphertext

@@ -18,0 +33,0 @@ * @param text Plain text to encrypt

+8
-1
dist/WebCrypt.js

@@ -26,4 +26,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

// WEBRTC_SALT: Fixed salt for WebRTC key derivation; ensures consistent keys between peers without transmission
/**
* Default static salt for WebRTC transform convenience.
* @warning For production applications, pass a custom salt per session.
*/
static WEBRTC_SALT = new TextEncoder().encode("WebCrypt-E2EE-v1-2025");
// DEFAULT_HMAC_SALT: Default static salt for deterministic password-derived HMAC key derivation
/**
* Default static salt for deterministic password-derived HMAC key derivation.
* @warning For production security, generate custom salts with WebCrypt.generateHmacSalt().
*/
static DEFAULT_HMAC_SALT = new TextEncoder().encode("WebCrypt-HMAC-DefaultSalt-v0.6");

@@ -30,0 +37,0 @@ /**

+23
-56
dist/WebCryptAsym.d.cts

@@ -563,72 +563,39 @@ // WebCryptAsym.d.ts

/**
* Sign a text message with a configurable algorithm
* @param text - Text to sign
* @param privateKey - Private key for signing
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Import a public signing key from base64 (SPKI format)
* @param publicKeyB64 - Base64 encoded SPKI public key
* @param curve - Elliptic curve ('P-256' default, 'P-384')
*/
signTextWithAlgorithm(
text: string,
privateKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<string>;
importPublicSigningKey(publicKeyB64: string, curve?: string): Promise<CryptoKey>;
/**
* Verify a signed text message with a configurable algorithm
* @param text - Text that was signed
* @param signatureB64 - Base64-encoded signature
* @param publicKey - Public key for verification
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Sign a text message or data string with ECDSA
* @param text - Text to sign
* @param privateKey - ECDSA private key
* @returns Base64-encoded detached signature
*/
verifyTextWithAlgorithm(
text: string,
signatureB64: string,
publicKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<boolean>;
signText(text: string, privateKey: CryptoKey): Promise<string>;
/**
* Generate a key with key rotation support
* @param password - Password to derive the key from
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* @param rotationCount - Rotation counter
* Verify a signed text message with ECDSA
* @param text - Text that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateRotatingKey(
password: string,
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2",
rotationCount?: number
): Promise<CryptoKey>;
verifyText(text: string, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Generate a hierarchical key structure from a master password
* @param masterPassword - Master password
* @param path - Path components for child keys
* Create a detached signature for a file or blob
* @param fileOrBlob - File or Blob object to sign
* @param privateKey - ECDSA private key
*/
generateHierarchicalKey(
masterPassword: string,
path: string[]
): Promise<{
masterKey: CryptoKey;
childKeys: { [key: string]: CryptoKey };
}>;
signFile(fileOrBlob: any, privateKey: CryptoKey): Promise<{ signatureB64: string; blob: any }>;
/**
* Generate a key from multiple combined inputs
* @param inputs - Array of input strings to combine
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* Verify a detached signature for a file or blob
* @param fileOrBlob - File or Blob object that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateKeyFromMultipleInputs(
inputs: string[],
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2"
): Promise<CryptoKey>;
verifyFile(fileOrBlob: any, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Secure random number generation
* @param length - Number of bytes to generate
*/
secureRandom(length: number): Promise<Uint8Array>;
// ────────────────────── JSON Web Encryption (JWE) ──────────────────────

@@ -635,0 +602,0 @@ 

+23
-56
dist/WebCryptAsym.d.ts

@@ -563,72 +563,39 @@ // WebCryptAsym.d.ts

/**
* Sign a text message with a configurable algorithm
* @param text - Text to sign
* @param privateKey - Private key for signing
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Import a public signing key from base64 (SPKI format)
* @param publicKeyB64 - Base64 encoded SPKI public key
* @param curve - Elliptic curve ('P-256' default, 'P-384')
*/
signTextWithAlgorithm(
text: string,
privateKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<string>;
importPublicSigningKey(publicKeyB64: string, curve?: string): Promise<CryptoKey>;
/**
* Verify a signed text message with a configurable algorithm
* @param text - Text that was signed
* @param signatureB64 - Base64-encoded signature
* @param publicKey - Public key for verification
* @param algorithm - Signature algorithm: 'ECDSA' (default), 'RSA-PSS'
* Sign a text message or data string with ECDSA
* @param text - Text to sign
* @param privateKey - ECDSA private key
* @returns Base64-encoded detached signature
*/
verifyTextWithAlgorithm(
text: string,
signatureB64: string,
publicKey: CryptoKey,
algorithm?: "ECDSA" | "RSA-PSS"
): Promise<boolean>;
signText(text: string, privateKey: CryptoKey): Promise<string>;
/**
* Generate a key with key rotation support
* @param password - Password to derive the key from
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* @param rotationCount - Rotation counter
* Verify a signed text message with ECDSA
* @param text - Text that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateRotatingKey(
password: string,
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2",
rotationCount?: number
): Promise<CryptoKey>;
verifyText(text: string, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Generate a hierarchical key structure from a master password
* @param masterPassword - Master password
* @param path - Path components for child keys
* Create a detached signature for a file or blob
* @param fileOrBlob - File or Blob object to sign
* @param privateKey - ECDSA private key
*/
generateHierarchicalKey(
masterPassword: string,
path: string[]
): Promise<{
masterKey: CryptoKey;
childKeys: { [key: string]: CryptoKey };
}>;
signFile(fileOrBlob: any, privateKey: CryptoKey): Promise<{ signatureB64: string; blob: any }>;
/**
* Generate a key from multiple combined inputs
* @param inputs - Array of input strings to combine
* @param salt - Salt for key derivation
* @param algorithm - Key derivation algorithm
* Verify a detached signature for a file or blob
* @param fileOrBlob - File or Blob object that was signed
* @param signatureB64 - Base64 signature
* @param publicKey - ECDSA public key
*/
generateKeyFromMultipleInputs(
inputs: string[],
salt: Uint8Array,
algorithm?: "PBKDF2" | "Argon2"
): Promise<CryptoKey>;
verifyFile(fileOrBlob: any, signatureB64: string, publicKey: CryptoKey): Promise<boolean>;
/**
* Secure random number generation
* @param length - Number of bytes to generate
*/
secureRandom(length: number): Promise<Uint8Array>;
// ────────────────────── JSON Web Encryption (JWE) ──────────────────────

@@ -635,0 +602,0 @@ 

+10
-1
dist/WebCryptPQC.d.cts

@@ -68,4 +68,13 @@ // src/WebCryptPQC.d.ts

*/
static readonly SUPPORTED_DILITHIUM_LEVELS: string[];
/**
* Returns true if PQC module is running as a placeholder/stub.
*/
static isStub(): boolean;
/**
* Enable or disable stub testing mode for unit tests.
* @param allow Enable stub testing mode if true
*/
static enableStubTesting(allow?: boolean): void;
constructor();

@@ -72,0 +81,0 @@ 

+10
-1
dist/WebCryptPQC.d.ts

@@ -68,4 +68,13 @@ // src/WebCryptPQC.d.ts

*/
static readonly SUPPORTED_DILITHIUM_LEVELS: string[];
/**
* Returns true if PQC module is running as a placeholder/stub.
*/
static isStub(): boolean;
/**
* Enable or disable stub testing mode for unit tests.
* @param allow Enable stub testing mode if true
*/
static enableStubTesting(allow?: boolean): void;
constructor();

@@ -72,0 +81,0 @@ 

+1
-1
package.json
{
"name": "webcrypt",
"version": "0.6.4",
"version": "0.6.5",
"description": "Zero-dependency JavaScript AES-256-GCM encryption suite for text, files & WebRTC E2EE. Supports symmetric password derivation, RSA-4096 hybrid encryption, and post-quantum cryptography via pure Web Crypto API.",

@@ -5,0 +5,0 @@ "license": "MIT",

+27
-13
README.md

@@ -357,3 +357,4 @@ # WebCrypt

// HMAC
wc.generateHmacKey(password?: string, hash?: string): Promise<CryptoKey>
wc.generateHmacSalt(length?: number): Uint8Array
wc.generateHmacKey(password?: string, hash?: string, salt?: Uint8Array | string): Promise<CryptoKey>
wc.computeHmac(data: string | ArrayBuffer, key: CryptoKey): Promise<string>

@@ -363,3 +364,3 @@ wc.verifyHmac(data: string | ArrayBuffer, hmac: string, key: CryptoKey): Promise<boolean>

// HMAC-SHA3
wc.generateHmacKeySHA3(password?: string, hash?: string): Promise<CryptoKey>
wc.generateHmacKeySHA3(password?: string, hash?: string, salt?: Uint8Array | string): Promise<CryptoKey>
wc.computeHmacSHA3(data: string | ArrayBuffer, key: CryptoKey): Promise<string>

@@ -380,3 +381,3 @@ wc.verifyHmacSHA3(data: string | ArrayBuffer, hmac: string, key: CryptoKey): Promise<boolean>

// Key management
crypt.generateKeyPair(): Promise<CryptoKeyPair>
crypt.generateKeyPair(modulusLength?: number): Promise<CryptoKeyPair>
crypt.exportPublicKey(key: CryptoKey): Promise<string>

@@ -403,8 +404,13 @@ crypt.exportPrivateKey(key: CryptoKey): Promise<string>

crypt.generateECDHKeyPair(curve?: string): Promise<{ publicKey, privateKey, publicKeyB64 }>
crypt.exportECDHPublicKey(key: CryptoKey): Promise<string>
crypt.importECDHPublicKey(b64: string, curve?: string): Promise<CryptoKey>
crypt.deriveECDHSharedSecret(privateKey: CryptoKey, peerPublicKey: CryptoKey): Promise<CryptoKey>
crypt.encryptWithECDH(data: any, privateKey, recipientPublicKey): Promise<string>
crypt.decryptWithECDH(b64: string, privateKey, senderPublicKey): Promise<any>
// Signing (ECDSA)
// Digital Signatures (ECDSA / RSA-PSS)
crypt.generateSigningKeyPair(curve?: string): Promise<{ publicKey, privateKey, publicKeyB64 }>
crypt.generateEdDSASigningKeyPair(): Promise<{ publicKey, privateKey, publicKeyB64 }>
crypt.generateRSAPSSigningKeyPair(modulusLength?: number): Promise<{ publicKey, privateKey, publicKeyB64 }>
crypt.importPublicSigningKey(b64: string, curve?: string): Promise<CryptoKey>
crypt.signText(text: string, privateKey: CryptoKey): Promise<string>

@@ -414,26 +420,34 @@ crypt.verifyText(text: string, sig: string, publicKey: CryptoKey): Promise<boolean>

crypt.verifyFile(file: File | Blob, sig: string, publicKey: CryptoKey): Promise<boolean>
// Additional signing algorithms
crypt.signTextWithAlgorithm(text, privateKey, algorithm?: 'ECDSA' | 'RSA-PSS'): Promise<string>
crypt.verifyTextWithAlgorithm(text, sig, publicKey, algorithm?): Promise<boolean>
crypt.verifyTextWithAlgorithm(text, sig, publicKey, algorithm?: 'ECDSA' | 'RSA-PSS'): Promise<boolean>
// JWE
// JWE (JSON Web Encryption)
crypt.encryptJWE(payload: any, publicKey: CryptoKey, headers?: object): Promise<string>
crypt.decryptJWE(jweToken: string, privateKey: CryptoKey): Promise<any>
// MAC
// MAC & Poly1305
crypt.signHMAC(data: string, key: CryptoKey, hash?: string): Promise<string>
crypt.verifyHMAC(data: string, sig: string, key: CryptoKey, hash?: string): Promise<boolean>
crypt.authenticatePoly1305(data: string | Uint8Array, key: Uint8Array): Promise<string>
// Key derivation
crypt.deriveKeyPBKDF2(password, salt, iterations?): Promise<CryptoKey>
// Key derivation & rotation
crypt.deriveKeyPBKDF2(password, salt, iterations?, hash?, keyLength?): Promise<CryptoKey>
crypt.deriveKeyArgon2(password, salt, options?): Promise<CryptoKey>
crypt.deriveKeySHA3(password, iterations?, algorithm?): Promise<CryptoKey>
crypt.deriveKeyHKDFSHA2(secret, salt?, info?, keyLength?): Promise<CryptoKey>
crypt.deriveKeyHKDFSHA3(secret, salt?, info?, keyLength?): Promise<CryptoKey>
crypt.generateKeyFromPassword(password, salt, algorithm?): Promise<CryptoKey>
crypt.generateRotatingKey(password, salt, algorithm?, rotationCount?): Promise<CryptoKey>
crypt.generateHierarchicalKey(masterPassword, path: string[]): Promise<{ masterKey, childKeys }>
crypt.generateKeyFromMultipleInputs(inputs: string[], salt, algorithm?): Promise<CryptoKey>
crypt.rotateKeyNew(password, newSalt, method?): Promise<CryptoKey>
crypt.deriveChildKeyHierarchical(parentKey, childSalt, purpose?): Promise<CryptoKey>
crypt.secureRandom(length: number): Promise<Uint8Array>
crypt.secureKeyErase(key: Uint8Array): void
// WebRTC
// WebRTC Insertable Streams
crypt.createEncryptTransform(publicKey: CryptoKey): Promise<TransformFunction>
crypt.createDecryptTransform(privateKey: CryptoKey): Promise<TransformFunction>
crypt.createHybridEncryptTransform(publicKey, kyberPublicKey, level?): Promise<TransformFunction>
crypt.createEncryptTransformWithProgress(publicKey, onProgress?): Promise<TransformFunction>
```

@@ -460,3 +474,3 @@

### Security hardening (v0.6.4)
### Security hardening (v0.6.5)

@@ -463,0 +477,0 @@ - **PBKDF2 Iterations**: **600,000** (OWASP 2025+ compliant).

dist/index.cjs

Sorry, the diff of this file is too big to display

dist/index.js

Sorry, the diff of this file is too big to display

dist/WebCryptAsym.cjs

Sorry, the diff of this file is too big to display

dist/WebCryptAsym.js

Sorry, the diff of this file is too big to display