@archonite/archonite-signed-payload

A high-performance, security-hardened library for serializing, encrypting, and transmitting JSON data. It combines Google Protobuf for compact serialization, Argon2id for password-based key derivation, and AES-256-GCM for authenticated encryption.

🛡️ Security Architecture

The library follows a strict cryptographic pipeline to ensure data integrity and confidentiality:

1. Serialization: JSON is converted to a binary Protobuf structure to reduce size and enforce schema consistency.
2. Key Derivation: Uses Argon2id (the winner of the Password Hashing Competition) with a 64MB memory cost to derive a 256-bit key, making brute-force attacks extremely expensive.
3. Encryption: Uses AES-256-GCM (Galois/Counter Mode). This provides Authenticated Encryption, ensuring that if even a single bit of the payload is tampered with, decryption will fail.
4. Binding: The salt is bound to the ciphertext as AAD (Additional Authenticated Data), preventing salt-substitution attacks.

🚀 Features

• Compact Binary Format: Leverages Protobuf for smaller over-the-wire payloads compared to raw JSON.
• Time-Limited Access: Built-in expiration validation. Decryption fails automatically if the payload has expired.
• Hardened KDF: Protects against GPU/ASIC cracking attempts using Argon2id.
• Tamper Proof: Authenticated encryption ensures data has not been modified in transit.
• TypeScript Ready: Full type safety and IDE autocompletion.

📦 Installation

npm install @archonite/archonite-signed-payload

Note: This package requires argon2 as a peer dependency. Ensure your environment supports building native C++ modules.

🛠️ Usage

1. Create and Encrypt a Payload

Use this on the client or the service generating the secure message.

import { createArchonitePayload } from '@archonite/archonite-signed-payload';

// 1 hour from now
const expiration = new Date(Date.now() + 1000 * 60 * 60);

const passphrase = "a-very-strong-secret-phrase";
const data = {
  userId: "user_01HRA",
  action: "SYSTEM_ACCESS",
  permissions: ["read", "write"]
};

const encryptedPayload = await createArchonitePayload(
  passphrase,
  expiration,
  data
);
console.log(encryptedPayload);

2. Decode and Verify a Payload

Use this on the receiving server to validate and read the data.

import { decodeArchonitePayload } from '@archonite/archonite-signed-payload';

try {
  const decryptedData = await decodeArchonitePayload(
    passphrase,
    encryptedPayload
  );

  // "user_01HRA"
  console.log(decryptedData.userId);
} catch (error) {
  // Fails if: wrong passphrase, tampered data, or payload expired
  console.error("Access Denied:", error.message);
}

3. Transmit to an API

A utility function to POST the payload with the correct headers.

import { sendArchonitePayload } from '@archonite/archonite-signed-payload';

const result = await sendArchonitePayload(
  'https://api.example.com/secure-endpoint',
  encryptedPayload
);

📊 Binary Structure

The generated string is a Base64 encoding of the following binary sequence:

| Offset (Bytes) | Length | Component | Description | | --- | --- | --- | --- | | 0 | 7 | Prefix | Magic bytes: ARCHON- | | 7 | 16 | Salt | Random salt for Argon2id | | 23 | 32 | IV | Initialization Vector for AES | | 55 | 16 | Tag | GCM Authentication Tag | | 71 | Variable | Ciphertext | AES-256-GCM Encrypted Protobuf |

⚙️ Configuration Constants

The library uses the following security parameters:

• KDF: Argon2id
• Memory Cost: 64 MB ( KB)
• Time Cost: 3 iterations
• Parallelism: 1
• Cipher: AES-256-GCM
• IV Length: 32 bytes (High entropy)

📄 License

MIT © Archonite Organization