@attesso/crypto

Cryptographic primitives for the Attesso platform — ES256 key management, JWT tokens, and data signing using the jose library.

Installation

npm install @attesso/crypto

Features

Key Management

Generate and import ES256 (P-256) key pairs, compatible with iOS Secure Enclave.

import { generateKeyPair, exportKeyPair, importPublicKey, importPublicKeyJwk } from '@attesso/crypto'

// Generate a new key pair
const keyPair = await generateKeyPair()

// Export for storage (base64-encoded SPKI/PKCS8)
const exported = await exportKeyPair(keyPair)
// { publicKey: "MFkw...", privateKey: "MIGHAg..." }

// Import from stored format
const publicKey = await importPublicKey(exported.publicKey)

// Import from JWK (e.g., from mobile clients)
const mobileKey = await importPublicKeyJwk(jwk)

JWT Tokens

Create and verify JWT access tokens for authentication.

import { createAccessToken, verifyAccessToken, createChallenge } from '@attesso/crypto'

// Create a challenge for authentication flows
const challenge = createChallenge()

// Create a 24-hour access token
const token = await createAccessToken(privateKey, userId, 'https://api.attesso.com')

// Verify and extract user ID
const userId = await verifyAccessToken(token, publicKey, 'https://api.attesso.com')

Data Signing

Sign and verify arbitrary data with attached or detached JWS signatures.

import { signData, verifySignature, createDetachedSignature, verifyDetachedSignature } from '@attesso/crypto'

// Attached signature (payload included in JWS)
const jws = await signData(privateKey, data)
const payload = await verifySignature(jws, publicKey)

// Detached signature (payload stored separately)
const signature = await createDetachedSignature(privateKey, mandateData)
const isValid = await verifyDetachedSignature(signature, mandateData, publicKey)

API Reference

| Function | Description | |----------|-------------| | generateKeyPair() | Generate ES256 key pair | | exportKeyPair(keys) | Export to base64 SPKI/PKCS8 | | importPublicKey(spki) | Import public key from SPKI | | importPrivateKey(pkcs8) | Import private key from PKCS8 | | importPublicKeyJwk(jwk) | Import public key from JWK | | createChallenge() | Generate 32-byte random challenge | | createAccessToken(key, sub, iss) | Create 24h JWT | | verifyAccessToken(token, key, iss) | Verify JWT, return subject | | signData(key, data) | Create attached JWS | | verifySignature(jws, key) | Verify attached JWS | | verifySignatureString(jws, key) | Verify and return string payload | | createDetachedSignature(key, data) | Create detached JWS | | verifyDetachedSignature(sig, data, key) | Verify detached JWS |

License

MIT