@gtcx/crypto

Cryptographic primitives for the GTCX protocol: Ed25519 signing, AES-256-GCM encryption, SHA-256 hashing, HSM support, and FIPS compliance.

Installation

pnpm add @gtcx/crypto

API

signPayload(payload, privateKey, provider?, keyId?)

Signs a payload using Ed25519 via the pluggable CryptoProvider interface.

import { signPayload, verifySignature } from '@gtcx/crypto';

const signature = await signPayload('hello', privateKey);
const valid = await verifySignature('hello', signature, publicKey);

encryptPayload(payload, key) / decryptPayload(result, key)

AES-256-GCM authenticated encryption and decryption.

import { encryptPayload, decryptPayload } from '@gtcx/crypto';

const encrypted = await encryptPayload('sensitive data', aes256Key);
const plaintext = await decryptPayload(encrypted, aes256Key);

sha256(payload)

Returns the SHA-256 hash of a string or Uint8Array.

secureWipe(buffer) / withSecureKey(fn)

Zeroes sensitive key material from memory after use.

createEncryptionAtRest(config)

Transparent encryption layer for data-at-rest using key rotation.

InMemoryHsmProvider

Stub HSM provider for testing. Use enforceStubGuard to prevent production use.

isFipsAvailable() / fipsCryptoProvider

FIPS 140-2 compliance detection and provider.

createCoreCryptoProvider(bindings)

Adapter for a gtcx-core backed crypto provider (Rust). Inject bindings from gtcx-core and use the returned CryptoProvider implementation across the protocol stack.

import { createCoreCryptoProvider, signPayload } from '@gtcx/crypto';
import { coreCrypto } from '@gtcx/core'; // gtcx-core bindings

const provider = createCoreCryptoProvider(coreCrypto);
await signPayload('hello', privateKey, provider);

createCoreCryptoProviderFromCore(core)

Convenience helper that accepts either gtcx-core module exports or raw bindings.

import { createCoreCryptoProviderFromCore } from '@gtcx/crypto';
import * as gtcxCore from '@gtcx/core';

const provider = createCoreCryptoProviderFromCore(gtcxCore);

Native bindings

@gtcx/crypto prefers native bindings when available and falls back to the Node.js implementation when they are not.

GTCX_REQUIRE_NATIVE=1

Use getBackend() to inspect which backend is active.

Testing

pnpm vitest run packages/crypto/

License

BSL 1.1 -- converts to Apache 2.0 on January 1, 2030.