Asymmetric Cryptography

RSA and elliptic-curve primitives, exposed both as EncryptixClient methods and standalone functions. Keys are PEM strings.

RSA-OAEP (encryption)

import { generateRSAKeyPair } from '@ppabari/encryptix';

const { publicKey, privateKey } = await generateRSAKeyPair(2048);

const ciphertext = await enc.encryptRSA('short-secret', publicKey);
const plaintext  = await enc.decryptRSA(ciphertext, privateKey);

generateRSAKeyPair(modulusLength?: 2048 | 4096): Promise<RSAKeyPair>
encryptRSA(plaintext: string, publicKeyPEM: string, encoding?: Encoding): Promise<string>
decryptRSA(ciphertext: string, privateKeyPEM: string, encoding?: Encoding): Promise<string>

ℹ️

RSA-OAEP encrypts short payloads (e.g. a key). To protect large data, use it to wrap a symmetric key — see Envelope & Multi-Recipient.

RSA-PSS (signatures)

const { publicKey, privateKey } = await enc.generateRSAPSSKeyPair(2048);

const signature = await enc.signRSA(data, privateKey);
const valid     = await enc.verifyRSA(data, signature, publicKey); // → boolean

generateRSAPSSKeyPair(modulusLength?: 2048 | 4096): Promise<RSAKeyPair>
signRSA(data: string | Uint8Array, privateKeyPEM: string, encoding?: Encoding): Promise<string>
verifyRSA(data: string | Uint8Array, signature: string, publicKeyPEM: string, encoding?: Encoding): Promise<boolean>

ECDSA (signatures)

Curves: P-256 (default), P-384, P-521.

const { publicKey, privateKey } = await enc.generateECDSAKeyPair('P-256');

const signature = await enc.signECDSA(data, privateKey);
const valid     = await enc.verifyECDSA(data, signature, publicKey); // → boolean

generateECDSAKeyPair(curve?: ECCurve): Promise<ECKeyPair>
signECDSA(data: string | Uint8Array, privateKeyPEM: string, curve?: ECCurve, encoding?: Encoding): Promise<string>
verifyECDSA(data: string | Uint8Array, signature: string, publicKeyPEM: string, curve?: ECCurve, encoding?: Encoding): Promise<boolean>

ECDH (key agreement)

Derive a shared secret between two parties from one side’s private key and the other’s public key.

const alice = await enc.generateECDHKeyPair('P-256');
const bob   = await enc.generateECDHKeyPair('P-256');

const aliceSecret = await enc.deriveSharedSecret(alice.privateKey, bob.publicKey);
const bobSecret   = await enc.deriveSharedSecret(bob.privateKey, alice.publicKey);
// aliceSecret === bobSecret ✓ — feed into HKDF / an EncryptixClient key

generateECDHKeyPair(curve?: ECCurve): Promise<ECKeyPair>
deriveSharedSecret(privateKeyPEM: string, peerPublicKeyPEM: string, curve?: ECCurve): Promise<string>

🧩

The same functions are exported standalone — rsaEncrypt, rsaDecrypt, rsaPssSign, rsaPssVerify, ecdsaSign, ecdsaVerify, deriveSharedSecret — for use without a client instance.