@lightninglabs/lnc-web/dist/sessions/crypto/KeyWrapper.d.ts

Lightning Node Connect npm module for web

import CryptoService from '../cryptoService';
import { WrappedKey } from '../types';
export interface WrappedKeys {
    deviceWrap: WrappedKey;
    originWrap: WrappedKey;
}
/**
 * Wraps and unwraps credential keys with both device and origin key material.
 *
 * Why this exists: SessionManager should orchestrate flow, not contain crypto
 * verification details. This class centralizes "double-wrap + consistency check"
 * rules so they stay testable and hard to bypass accidentally.
 */
export declare class KeyWrapper {
    private cryptoService;
    constructor(cryptoService: CryptoService);
    /**
     * Store two independently wrapped copies of the same credentials key.
     *
     * Why double-wrap: the key must be recoverable only when both device-bound
     * and origin-bound protections are satisfied.
     */
    wrapCredentialsKey(credentialsKey: CryptoKey, deviceKey: CryptoKey, originKey: CryptoKey): Promise<WrappedKeys>;
    /**
     * Recover the credentials key from both wrapped forms and ensure both paths
     * resolve to the same underlying key material.
     */
    unwrapCredentialsKey(wrappedKeys: WrappedKeys, deviceKey: CryptoKey, originKey: CryptoKey): Promise<CryptoKey>;
    /**
     * Compare keys by behavior rather than by extraction.
     *
     * Why behavioral comparison: WebCrypto keys are non-extractable in this flow,
     * so encrypting fixed data with fixed IV provides a practical equality check.
     */
    private keysMatch;
    /**
     * Constant-time byte comparison to avoid leaking which position differs.
     *
     * We deliberately avoid returning early on the first mismatch so the
     * execution time is the same regardless of where the arrays diverge.
     */
    private arraysEqual;
}
//# sourceMappingURL=KeyWrapper.d.ts.map