@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
40 lines (39 loc) • 1.92 kB
JavaScript
import { TypedArrayEncoder } from "../../../../utils/TypedArrayEncoder.mjs";
import "../../../../utils/index.mjs";
import { KeyManagementError } from "../../error/KeyManagementError.mjs";
import { getJwkHumanDescription } from "../humanDescription.mjs";
//#region src/modules/kms/jwk/alg/encryption.ts
function supportedEncryptionAlgsForKey(jwk) {
const algs = [];
if (jwk.kty === "oct") {
const keyBits = TypedArrayEncoder.fromBase64Url(jwk.k).length * 8;
if (keyBits === 256) algs.push("A128CBC-HS256");
if (keyBits === 384) algs.push("A192CBC-HS384");
if (keyBits === 512) algs.push("A256CBC-HS512");
if (keyBits === 128) algs.push("A128GCM", "A128CBC", "A128KW");
if (keyBits === 192) algs.push("A192GCM", "A192KW");
if (keyBits === 256) algs.push("A256GCM", "A256CBC", "A256KW", "C20P", "XC20P");
}
return algs;
}
/**
* Get the allowed content encryption algs for a key. If takes all the known supported
* algs and will filter these based on the optional `alg` key in the JWK.
*
* This does not handle the intended key `use` and `key_ops`.
*/
function allowedEncryptionAlgsForKey(jwk) {
const supportedAlgs = supportedEncryptionAlgsForKey(jwk);
const allowedAlg = jwk.alg;
return !allowedAlg ? supportedAlgs : allowedAlg && supportedAlgs.includes(allowedAlg) ? [allowedAlg] : [];
}
function assertAllowedEncryptionAlgForKey(jwk, algorithm) {
const allowedAlgs = allowedEncryptionAlgsForKey(jwk);
if (!allowedAlgs.includes(algorithm)) {
const allowedAlgsText = allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(", ")}` : "";
throw new KeyManagementError(`${getJwkHumanDescription(jwk)} cannot be used with algorithm '${algorithm}' for content encryption or decryption.${allowedAlgsText}`);
}
}
//#endregion
export { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey };
//# sourceMappingURL=encryption.mjs.map