@debkit/crypto

AES-256-CTR encryption with HMAC-SHA256 verification and HKDF key derivation. Uses only Node.js built-in node:crypto.

Install

npm install @debkit/crypto

API

generateBytes(length, prefix?)

Generates random hex bytes with an optional prefix.

import { generateBytes } from '@debkit/crypto';

generateBytes(16);           // 'a1b2c3d4e5f6...'
generateBytes(16, 'token');  // 'token_a1b2c3d4e5f6...'

encrypt(jsonData, secretKey, bytes)

Encrypts data using AES-256-CTR with HMAC-SHA256 authentication and HKDF-derived IV.

import { encrypt } from '@debkit/crypto';

const { encryptedPayload } = encrypt(
  { userId: 123, role: 'admin' },
  'my-secret-key',
  16
);
// encryptedPayload is a base64 string

Parameters:

| Param | Type | Description | |---|---|---| | jsonData | Record<string, any> \| string \| number | Data to encrypt | | secretKey | string | Encryption key | | bytes | number | IV byte length |

decrypt<T>(encryptedPayload, secretKey)

Decrypts and verifies HMAC integrity. Throws on authentication failure.

import { encrypt, decrypt } from '@debkit/crypto';

const { encryptedPayload } = encrypt({ message: 'hello' }, 'key', 16);
const data = decrypt<{ message: string }>(encryptedPayload, 'key');
// { message: 'hello' }

Security

• AES-256-CTR symmetric encryption
• HMAC-SHA256 authentication (encrypt-then-MAC)
• HKDF-SHA256 IV derivation from random bytes
• Separate keys derived for encryption and MAC

License

MIT