Skip to main content

PkiEncrypter

@webda/core

Class: PkiEncrypter

Defined in: packages/core/src/services/pki.encrypter.ts:316

Asymmetric encrypter: hybrid RSA-OAEP-256 + AES-256-GCM

The public keys are committed with the application, so anyone can encrypt a value. The private keys only live in the runtime (a Kubernetes Secret mount or environment variables), so only the application can decrypt.

Format: v1:<kid>:<base64(wrappedKey)>:<base64(iv | tag | ciphertext)>, the kid is authenticated.

Implements​

Constructors​

Constructor​

new PkiEncrypter(): PkiEncrypter

Returns​

PkiEncrypter

Properties​

configuration​

protected configuration: string

Defined in: packages/core/src/services/pki.encrypter.ts:321

Serialized configuration of the keyring, to keep its cache when unchanged

keyring​

protected keyring: PkiKeyring

Defined in: packages/core/src/services/pki.encrypter.ts:317

Methods​

configure()​

configure(options?, context?): void

Defined in: packages/core/src/services/pki.encrypter.ts:328

Configure the keyring

Parameters​

options?​

PkiEncrypterOptions = {}

the encrypter options

context?​

EncrypterContext

the encryption context

Returns​

void

Implementation of​

StringEncrypter.configure

decrypt()​

decrypt(data): Promise<string>

Defined in: packages/core/src/services/pki.encrypter.ts:384

Decrypt with the private key of the value kid

Parameters​

data​

string

the encrypted value

Returns​

Promise<string>

the plain value

Implementation of​

StringEncrypter.decrypt

encrypt()​

encrypt(data): Promise<string>

Defined in: packages/core/src/services/pki.encrypter.ts:363

Encrypt with the public key of the active key

Parameters​

data​

string

the plain value

Returns​

Promise<string>

the encrypted value

Implementation of​

StringEncrypter.encrypt

getKeyring()​

getKeyring(): PkiKeyring

Defined in: packages/core/src/services/pki.encrypter.ts:342

Get the keyring, with the default options when not configured

Returns​

PkiKeyring

the keyring

needsUpgrade()​

needsUpgrade(data): boolean

Defined in: packages/core/src/services/pki.encrypter.ts:409

A value needs an upgrade when it was not encrypted with the active key

Parameters​

data​

string

the encrypted value

Returns​

boolean

true to re-encrypt it

Implementation of​

StringEncrypter.needsUpgrade

aad()​

protected static aad(kid): Uint8Array

Defined in: packages/core/src/services/pki.encrypter.ts:354

Additional authenticated data binding the format and the kid

Parameters​

kid​

string

the key id

Returns​

Uint8Array

the AAD