did-jwt/lib.commonjs/encryption/createEncrypter.js

Library for Signing and Verifying JWTs that use DIDs as issuers and JWEs that use DIDs as recipients

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.createFullEncrypter = createFullEncrypter;
const util_js_1 = require("../util.js");
const utils_js_1 = require("@noble/hashes/utils.js");
function createFullEncrypter(recipientPublicKey, senderSecret, options = {}, kekCreator, keyWrapper, contentEncrypter) {
    async function encryptCek(cek, ephemeralKeyPair) {
        const { epk, kek } = await kekCreator.createKek(recipientPublicKey, senderSecret, `${kekCreator.alg}+${keyWrapper.alg}`, options.apu, options.apv, ephemeralKeyPair);
        const res = await keyWrapper.from(kek).wrap(cek);
        const recipient = {
            encrypted_key: (0, util_js_1.bytesToBase64url)(res.ciphertext),
            header: {},
        };
        if (res.iv)
            recipient.header.iv = (0, util_js_1.bytesToBase64url)(res.iv);
        if (res.tag)
            recipient.header.tag = (0, util_js_1.bytesToBase64url)(res.tag);
        if (options.kid)
            recipient.header.kid = options.kid;
        if (options.apu)
            recipient.header.apu = options.apu;
        if (options.apv)
            recipient.header.apv = options.apv;
        if (!ephemeralKeyPair) {
            recipient.header.alg = `${kekCreator.alg}+${keyWrapper.alg}`;
            recipient.header.epk = epk;
        }
        return recipient;
    }
    async function encrypt(cleartext, protectedHeader = {}, aad, ephemeralKeyPair) {
        // we won't want alg to be set to dir from xc20pDirEncrypter
        Object.assign(protectedHeader, { alg: undefined });
        // Content Encryption Key
        const cek = (0, utils_js_1.randomBytes)(32);
        const recipient = await encryptCek(cek, ephemeralKeyPair);
        // getting an ephemeral key means the epk is set only once per all recipients
        if (ephemeralKeyPair) {
            protectedHeader.alg = `${kekCreator.alg}+${keyWrapper.alg}`;
            protectedHeader.epk = ephemeralKeyPair.publicKeyJWK;
        }
        return {
            ...(await contentEncrypter.from(cek).encrypt(cleartext, protectedHeader, aad)),
            recipient,
            cek,
        };
    }
    return { alg: keyWrapper.alg, enc: contentEncrypter.enc, encrypt, encryptCek, genEpk: util_js_1.genX25519EphemeralKeyPair };
}
//# sourceMappingURL=createEncrypter.js.map