Encryption Module by NodeJS

This library allows you to create key pairs, encrypt, and decrypt data with the same strategy of the Encryption Service.

Adding dependency

npm i @bolttech/encryption

Encryption Service V2

AES Algorithm

Creating key

import {
  HashBasedBufferEncodingAllowed,
  HMACSecretKeyGenerator,
  IHMACKeyGeneratorOptions,
  SHAHashBasedAlgorithmsAllowed,
} from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';

const keyGeneratorOptions: IHMACKeyGeneratorOptions = {
  keySize: 32, // cipher mode bytes divided by 8, example 256 / 8 = 32
  algorithm: SHAHashBasedAlgorithmsAllowed.SHA256,
  encoding: HashBasedBufferEncodingAllowed.BASE64,
};

const keyGenerator = new HMACSecretKeyGenerator(keyGeneratorOptions);
const { secretKey } = await keyGenerator.generateKey({ passphrase });

const oSecretKey = await keyGenerator.loadEncryptedPrivateKey(
  secretKey,
  passphrase,
);

Encrypting data

import {
  AESEncryptor,
  AESCipherModeAllowed,
  HashBasedBufferEncodingAllowed,
  // HMACSigner,
  IAESEncryptorOptions,
  // IHMACSignerOptions,
  // SHAHashBasedAlgorithmsAllowed,
} from '@bolttech/encryption';
import { Readable } from 'stream';

const data = Buffer.from('Confidential data.');
const stream = Readable.from(data);

const encryptorOptions: IAESEncryptorOptions = {
  mode: AESCipherModeAllowed.AES256CBC,
  encoding: HashBasedBufferEncodingAllowed.BASE64,
};

const encryptor = new AESEncryptor(encryptorOptions);
const encryptedStream = await encryptor.encrypt(stream, oSecretKey);

// const signerOptions: IHMACSignerOptions = {
//   algorithm: SHAHashBasedAlgorithmsAllowed.SHA256,
//   encoding: HashBasedBufferEncodingAllowed.BASE64,
// };
// const signer = new HMACSigner(signerOptions);
// const signedStream = await signer.sign(stream, oSigningSecretKey);

Decrypting data

// const verifiedStream = await signer.verifySignature(stream, oSigningSecretKey);
const decryptedStream = await encryptor.decrypt(encryptedStream, oSecretKey);

OpenPGP Algorithm

Creating key pairs

import {
  EllipticCurvesAllowed,
  IOpenPGPKeyPairGeneratorOptions,
  OpenPGPKeyPairGenerator,
  OpenPGPTypesAllowed,
} from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';
const name = 'Joe Doe';
const email = '[email protected]';

const keyGeneratorOptions: IOpenPGPKeyPairGeneratorOptions = {
  type: OpenPGPTypesAllowed.ECC,
  curve: EllipticCurvesAllowed.Curve25519,
};

const keyGenerator = new OpenPGPKeyPairGenerator(keyGeneratorOptions);
const { publicKey, privateKey } = await keyGenerator.generateKey({
  passphrase,
  name,
  email,
});

const oPublicKey = await keyGenerator.loadPublicKey(publicKey);
const oPrivateKey = await keyGenerator.loadEncryptedPrivateKey(
  privateKey,
  passphrase,
);

Encrypting data

import {
  HashBasedBufferEncodingAllowed,
  IOpenPGPEncryptorOptions,
  // IOpenPGPSignerOptions,
  OpenPGPEncryptor,
  // OpenPGPSigner,
} from '@bolttech/encryption';
import { Readable } from 'stream';

const data = Buffer.from('Confidential data.');
const stream = Readable.from(data);

const encryptorOptions: IOpenPGPEncryptorOptions = {
  armored: true,
};

const encryptor = new OpenPGPEncryptor(encryptorOptions);
const encryptedStream = await encryptor.encrypt(stream, oPublicKey);

// const signerOptions: IOpenPGPSignerOptions = {
//   armored: true,
// };
// const signer = new OpenPGPSigner(signerOptions);
// const signedStream = await signer.sign(stream, oSigningPrivateKey);

Decrypting data

// const verifiedStream = await signer.verifySignature(stream, oSigningPublicKey);
const decryptedStream = await encryptor.decrypt(encryptedStream, oPrivateKey);

RSA Algorithm

Creating key pairs

import {
  AESCipherModeForRSAAllowed,
  IRSAKeyPairGeneratorOptions,
  KeyFormatAllowed,
  RSAKeyPairGenerator,
  RSAModulusLengthAllowed,
  RSAPrivateKeyEncodingTypeAllowed,
  RSAPublicKeyEncodingTypeAllowed,
} from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';

const keyGeneratorOptions: IRSAKeyPairGeneratorOptions = {
  modulusLength: RSAModulusLengthAllowed.ML2048,
  publicExponent: undefined,
  publicKeyEncoding: {
    type: RSAPublicKeyEncodingTypeAllowed.SPKI,
    format: KeyFormatAllowed.PEM,
  },
  privateKeyEncoding: {
    type: RSAPrivateKeyEncodingTypeAllowed.PKCS8,
    format: KeyFormatAllowed.PEM,
    cipher: AESCipherModeForRSAAllowed.AES256CBC,
  },
};

const keyGenerator = new RSAKeyPairGenerator(keyGeneratorOptions);
const { publicKey, privateKey } = await keyGenerator.generateKey({
  passphrase,
});

const oPublicKey = await keyGenerator.loadPublicKey(publicKey);
const oPrivateKey = await keyGenerator.loadEncryptedPrivateKey(
  privateKey,
  passphrase,
);

Encrypting data

import {
  EncryptionPaddingAllowed,
  HashBasedBufferEncodingAllowed,
  IRSAEncryptorOptions,
  // IRSASignerOptions,
  SHAHashBasedAlgorithmsAllowed,
  RSAEncryptor,
  // RSASigner,
  RSAModulusLengthAllowed,
} from '@bolttech/encryption';
import { Readable } from 'stream';

const data = Buffer.from('Confidential data.');
const stream = Readable.from(data);

const encryptorOptions: IRSAEncryptorOptions = {
  modulusLength: RSAModulusLengthAllowed.ML2048, // same of key pairs
  oaepHash: SHAHashBasedAlgorithmsAllowed.SHA384,
  padding: EncryptionPaddingAllowed.RSA_PKCS1_OAEP_PADDING,
  encoding: HashBasedBufferEncodingAllowed.HEX,
};

const encryptor = new RSAEncryptor(encryptorOptions);
const encryptedStream = await encryptor.encrypt(stream, oPublicKey);

// const signerOptions: IRSASignerOptions = {
//   modulusLength: RSAModulusLengthAllowed.ML2048, // same of key pairs
//   algorithm: SHAHashBasedAlgorithmsAllowed.SHA384,
//   encoding: HashBasedBufferEncodingAllowed.HEX,
// };
// const signer = new RSASigner(signerOptions);
// const signedStream = await signer.sign(stream, oSigningPrivateKey);

Decrypting data

// const verifiedStream = await signer.verifySignature(stream, oSigningPublicKey);
const decryptedStream = await encryptor.decrypt(encryptedStream, oPrivateKey);

Encryption Service V1

AES Algorithm

Creating key pairs

import {
  AESCipherModeAllowed,
  HashBasedBufferEncodingAllowed,
  SHAHashBasedAlgorithmsAllowed,
  V1AESEncryption,
} from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';

const encryption = new V1AESEncryption(
  AESCipherModeAllowed.AES256CBC,
  SHAHashBasedAlgorithmsAllowed.SHA512,
  HashBasedBufferEncodingAllowed.HEX,
);
const { secretKey } = await encryption.generateKey(passphrase);

Encrypting data

const data = Buffer.from('Confidential data.');

const encryptedData = encryption.encryptData(data, secretKey, passphrase);
// const encryptedAndSignedData = encryption.encryptAndSignData(
//   data,
//   secretKey,
//   passphrase,
//   rsaSigningPrivateKey,
//   passphraseRsaSigningPrivateKey,
// );
// const signedData = encryption.signData(data, rsaPrivateKey, passphraseRsaPrivateKey);
const iv = encryption.getIV();

Note: Encryption Service v1 does not support manipulation of binary data.

Decrypting data

const decryptedData = encryption.decryptData(
  encryptedData,
  secretKey,
  passphrase,
  iv,
);
// const decryptedAndVerifiedData = encryption.decryptAndVerifyData(
//   encryptedAndSignedData,
//   secretKey,
//   passphrase,
//   rsaVerificationPublicKey,
//   iv,
// );
// const verifiedData = encryption.verifySignatureData(
//   signedData,
//   rsaPublicKey,
// );

Note: Encryption Service v1 does not support manipulation of binary data.

OpenPGP Algorithm

import { V1OpenPGPEncryption } from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';
const name = 'Joe Doe';
const email = '[email protected]';

const encryption = new V1OpenPGPEncryption(2048);
const { publicKey, privateKey } = await encryption.generateKeyPair(
  passphrase,
  name,
  email,
);

// Save publicKey and privateKey content in a file with extension .pem

Encrypting data

const data = Buffer.from('Confidential data.');

const encryptedData = encryption.encryptData(data, publicKey);
// const encryptedAndSignedData = encryption.encryptAndSignData(
//   data,
//   publicKey,
//   rsaSigningPrivateKey,
//   passphraseRsaSigningPrivateKey,
// );
// const signedData = encryption.signData(data, rsaPrivateKey, passphraseRsaPrivateKey);

Note: Encryption Service v1 does not support manipulation of binary data.

Decrypting data

const decryptedData = encryption.decryptData(
  encryptedData,
  privateKey,
  passphrase,
);
// const decryptedAndVerifiedData = encryption.decryptAndVerifyData(
//   encryptedAndSignedData,
//   privateKey,
//   passphrase,
//   rsaVerificationPublicKey,
// );
// const verifiedData = encryption.verifySignatureData(
//   signedData,
//   rsaPublicKey,
// );

Note: Encryption Service v1 does not support manipulation of binary data.

RSA Algorithm

Creating key pairs

import { V1RSAEncryption } from '@bolttech/encryption';

const passphrase = 'yourStrongPassphrase';

const encryption = new V1RSAEncryption(2048);
const { publicKey, privateKey } = await encryption.generateKeyPair(passphrase);

// Save publicKey and privateKey content in a file with extension .pem

Encrypting data

const data = Buffer.from('Confidential data.');

const encryptedData = encryption.encryptData(data, publicKey);
// const encryptedAndSignedData = encryption.encryptAndSignData(
//   data,
//   publicKey,
//   rsaSigningPrivateKey,
//   passphraseRsaSigningPrivateKey,
// );
// const signedData = encryption.signData(data, rsaPrivateKey, passphraseRsaPrivateKey);

Note: Encryption Service v1 does not support manipulation of binary data.

Decrypting data

const decryptedData = encryption.decryptData(
  encryptedData,
  privateKey,
  passphrase,
);
// const decryptedAndVerifiedData = encryption.decryptAndVerifyData(
//   encryptedAndSignedData,
//   privateKey,
//   passphrase,
//   rsaVerificationPublicKey,
// );
// const verifiedData = encryption.verifySignatureData(
//   signedData,
//   rsaPublicKey,
// );

Note: Encryption Service v1 does not support manipulation of binary data.

Common

OpenPGP

Generating your key pair with command line

# Pending

Checking your key pair with command line

# Pending

RSA

Generating your key pair with command line

# Generating the private key
openssl genpkey -algorithm RSA -out private_key.pem -aes-256-cbc -pass pass:"yourStrongPassphrase" -pkeyopt rsa_keygen_bits:4096 -outform PEM

# Generating the public key for the private key
openssl pkey -in private_key.pem -passin pass:"yourStrongPassphrase" -pubout -out public_key.pem

Checking your key pair with command line

If you generated your key pairs another way, you can check if it is compatible with the commands below.

# Checking if the algorithm used was RSA
openssl rsa -in private_key.pem -passin pass:"yourStrongPassphrase" -check

# Checking private key size in bits and the format is in PKCS#8
openssl pkey -in private_key.pem -passin pass:"yourStrongPassphrase" -text -noout

# Checking public key size in bits and the format is in SPKI
openssl pkey -in public_key.pem -pubin -text -noout

# Checking private key compatibility with public key (Note: It will be fully compatible if there is no output in the result of this command)
openssl pkey -in private_key.pem -passin pass:"yourStrongPassphrase" -pubout -out public_key_from_private.pem && diff public_key.pem public_key_from_private.pem && rm public_key_from_private.pem

TO DO

• Encryption Service v1

  • Encryption:
    • [x] Support for RSA;
    • [x] Support for OpenPGP;
    • [x] Support for AES;
  • Signature
    • [x] Support for JWT;

• Encryption Service v2

  • Encryption:
    • [x] Support for RSA;
    • [x] Support for OpenPGP;
    • [x] Support for AES;
  • Signature:
    • [x] Support for RSA;
    • [x] Support for DSA;
    • [x] Support for ECDSA;
    • [x] Support for OpenPGP;
    • [x] Support for HMAC;