Pinsave/counterstrike
1
1/**2 * The `node:crypto` module provides cryptographic functionality that includes a3 * set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify4 * functions.5 *6 * ```js7 * const { createHmac } = await import('node:crypto');8 *9 * const secret = 'abcdefg';10 * const hash = createHmac('sha256', secret)11 * .update('I love cupcakes')12 * .digest('hex');13 * console.log(hash);14 * // Prints:15 * // c0fa1bc00531bd78ef38c628449c5102aeabd49b5dc3a2a516ea6ea959d6658e16 * ```17 * @see [source](https://github.com/nodejs/node/blob/v24.x/lib/crypto.js)18 */19declare module "crypto" {20 import * as stream from "node:stream";21 import { PeerCertificate } from "node:tls";22 /**23 * SPKAC is a Certificate Signing Request mechanism originally implemented by24 * Netscape and was specified formally as part of HTML5's `keygen` element.25 *26 * `<keygen>` is deprecated since [HTML 5.2](https://www.w3.org/TR/html52/changes.html#features-removed) and new projects27 * should not use this element anymore.28 *29 * The `node:crypto` module provides the `Certificate` class for working with SPKAC30 * data. The most common usage is handling output generated by the HTML5 `<keygen>` element. Node.js uses [OpenSSL's SPKAC31 * implementation](https://www.openssl.org/docs/man3.0/man1/openssl-spkac.html) internally.32 * @since v0.11.833 */34 class Certificate {35 /**36 * ```js37 * const { Certificate } = await import('node:crypto');38 * const spkac = getSpkacSomehow();39 * const challenge = Certificate.exportChallenge(spkac);40 * console.log(challenge.toString('utf8'));41 * // Prints: the challenge as a UTF8 string42 * ```43 * @since v9.0.044 * @param encoding The `encoding` of the `spkac` string.45 * @return The challenge component of the `spkac` data structure, which includes a public key and a challenge.46 */47 static exportChallenge(spkac: BinaryLike): Buffer;48 /**49 * ```js50 * const { Certificate } = await import('node:crypto');51 * const spkac = getSpkacSomehow();52 * const publicKey = Certificate.exportPublicKey(spkac);53 * console.log(publicKey);54 * // Prints: the public key as <Buffer ...>55 * ```56 * @since v9.0.057 * @param encoding The `encoding` of the `spkac` string.58 * @return The public key component of the `spkac` data structure, which includes a public key and a challenge.59 */60 static exportPublicKey(spkac: BinaryLike, encoding?: string): Buffer;61 /**62 * ```js63 * import { Buffer } from 'node:buffer';64 * const { Certificate } = await import('node:crypto');65 *66 * const spkac = getSpkacSomehow();67 * console.log(Certificate.verifySpkac(Buffer.from(spkac)));68 * // Prints: true or false69 * ```70 * @since v9.0.071 * @param encoding The `encoding` of the `spkac` string.72 * @return `true` if the given `spkac` data structure is valid, `false` otherwise.73 */74 static verifySpkac(spkac: NodeJS.ArrayBufferView): boolean;75 /**76 * @deprecated77 * @param spkac78 * @returns The challenge component of the `spkac` data structure,79 * which includes a public key and a challenge.80 */81 exportChallenge(spkac: BinaryLike): Buffer;82 /**83 * @deprecated84 * @param spkac85 * @param encoding The encoding of the spkac string.86 * @returns The public key component of the `spkac` data structure,87 * which includes a public key and a challenge.88 */89 exportPublicKey(spkac: BinaryLike, encoding?: string): Buffer;90 /**91 * @deprecated92 * @param spkac93 * @returns `true` if the given `spkac` data structure is valid,94 * `false` otherwise.95 */96 verifySpkac(spkac: NodeJS.ArrayBufferView): boolean;97 }98 namespace constants {99 // https://nodejs.org/dist/latest-v24.x/docs/api/crypto.html#crypto-constants100 const OPENSSL_VERSION_NUMBER: number;101 /** Applies multiple bug workarounds within OpenSSL. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html for detail. */102 const SSL_OP_ALL: number;103 /** Instructs OpenSSL to allow a non-[EC]DHE-based key exchange mode for TLS v1.3 */104 const SSL_OP_ALLOW_NO_DHE_KEX: number;105 /** Allows legacy insecure renegotiation between OpenSSL and unpatched clients or servers. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */106 const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: number;107 /** Attempts to use the server's preferences instead of the client's when selecting a cipher. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */108 const SSL_OP_CIPHER_SERVER_PREFERENCE: number;109 /** Instructs OpenSSL to use Cisco's version identifier of DTLS_BAD_VER. */110 const SSL_OP_CISCO_ANYCONNECT: number;111 /** Instructs OpenSSL to turn on cookie exchange. */112 const SSL_OP_COOKIE_EXCHANGE: number;113 /** Instructs OpenSSL to add server-hello extension from an early version of the cryptopro draft. */114 const SSL_OP_CRYPTOPRO_TLSEXT_BUG: number;115 /** Instructs OpenSSL to disable a SSL 3.0/TLS 1.0 vulnerability workaround added in OpenSSL 0.9.6d. */116 const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: number;117 /** Allows initial connection to servers that do not support RI. */118 const SSL_OP_LEGACY_SERVER_CONNECT: number;119 /** Instructs OpenSSL to disable support for SSL/TLS compression. */120 const SSL_OP_NO_COMPRESSION: number;121 /** Instructs OpenSSL to disable encrypt-then-MAC. */122 const SSL_OP_NO_ENCRYPT_THEN_MAC: number;123 const SSL_OP_NO_QUERY_MTU: number;124 /** Instructs OpenSSL to disable renegotiation. */125 const SSL_OP_NO_RENEGOTIATION: number;126 /** Instructs OpenSSL to always start a new session when performing renegotiation. */127 const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: number;128 /** Instructs OpenSSL to turn off SSL v2 */129 const SSL_OP_NO_SSLv2: number;130 /** Instructs OpenSSL to turn off SSL v3 */131 const SSL_OP_NO_SSLv3: number;132 /** Instructs OpenSSL to disable use of RFC4507bis tickets. */133 const SSL_OP_NO_TICKET: number;134 /** Instructs OpenSSL to turn off TLS v1 */135 const SSL_OP_NO_TLSv1: number;136 /** Instructs OpenSSL to turn off TLS v1.1 */137 const SSL_OP_NO_TLSv1_1: number;138 /** Instructs OpenSSL to turn off TLS v1.2 */139 const SSL_OP_NO_TLSv1_2: number;140 /** Instructs OpenSSL to turn off TLS v1.3 */141 const SSL_OP_NO_TLSv1_3: number;142 /** Instructs OpenSSL server to prioritize ChaCha20-Poly1305 when the client does. This option has no effect if `SSL_OP_CIPHER_SERVER_PREFERENCE` is not enabled. */143 const SSL_OP_PRIORITIZE_CHACHA: number;144 /** Instructs OpenSSL to disable version rollback attack detection. */145 const SSL_OP_TLS_ROLLBACK_BUG: number;146 const ENGINE_METHOD_RSA: number;147 const ENGINE_METHOD_DSA: number;148 const ENGINE_METHOD_DH: number;149 const ENGINE_METHOD_RAND: number;150 const ENGINE_METHOD_EC: number;151 const ENGINE_METHOD_CIPHERS: number;152 const ENGINE_METHOD_DIGESTS: number;153 const ENGINE_METHOD_PKEY_METHS: number;154 const ENGINE_METHOD_PKEY_ASN1_METHS: number;155 const ENGINE_METHOD_ALL: number;156 const ENGINE_METHOD_NONE: number;157 const DH_CHECK_P_NOT_SAFE_PRIME: number;158 const DH_CHECK_P_NOT_PRIME: number;159 const DH_UNABLE_TO_CHECK_GENERATOR: number;160 const DH_NOT_SUITABLE_GENERATOR: number;161 const RSA_PKCS1_PADDING: number;162 const RSA_SSLV23_PADDING: number;163 const RSA_NO_PADDING: number;164 const RSA_PKCS1_OAEP_PADDING: number;165 const RSA_X931_PADDING: number;166 const RSA_PKCS1_PSS_PADDING: number;167 /** Sets the salt length for RSA_PKCS1_PSS_PADDING to the digest size when signing or verifying. */168 const RSA_PSS_SALTLEN_DIGEST: number;169 /** Sets the salt length for RSA_PKCS1_PSS_PADDING to the maximum permissible value when signing data. */170 const RSA_PSS_SALTLEN_MAX_SIGN: number;171 /** Causes the salt length for RSA_PKCS1_PSS_PADDING to be determined automatically when verifying a signature. */172 const RSA_PSS_SALTLEN_AUTO: number;173 const POINT_CONVERSION_COMPRESSED: number;174 const POINT_CONVERSION_UNCOMPRESSED: number;175 const POINT_CONVERSION_HYBRID: number;176 /** Specifies the built-in default cipher list used by Node.js (colon-separated values). */177 const defaultCoreCipherList: string;178 /** Specifies the active default cipher list used by the current Node.js process (colon-separated values). */179 const defaultCipherList: string;180 }181 interface HashOptions extends stream.TransformOptions {182 /**183 * For XOF hash functions such as `shake256`, the184 * outputLength option can be used to specify the desired output length in bytes.185 */186 outputLength?: number | undefined;187 }188 /** @deprecated since v10.0.0 */189 const fips: boolean;190 /**191 * Creates and returns a `Hash` object that can be used to generate hash digests192 * using the given `algorithm`. Optional `options` argument controls stream193 * behavior. For XOF hash functions such as `'shake256'`, the `outputLength` option194 * can be used to specify the desired output length in bytes.195 *196 * The `algorithm` is dependent on the available algorithms supported by the197 * version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.198 * On recent releases of OpenSSL, `openssl list -digest-algorithms` will199 * display the available digest algorithms.200 *201 * Example: generating the sha256 sum of a file202 *203 * ```js204 * import {205 * createReadStream,206 * } from 'node:fs';207 * import { argv } from 'node:process';208 * const {209 * createHash,210 * } = await import('node:crypto');211 *212 * const filename = argv[2];213 *214 * const hash = createHash('sha256');215 *216 * const input = createReadStream(filename);217 * input.on('readable', () => {218 * // Only one element is going to be produced by the219 * // hash stream.220 * const data = input.read();221 * if (data)222 * hash.update(data);223 * else {224 * console.log(`${hash.digest('hex')} ${filename}`);225 * }226 * });227 * ```228 * @since v0.1.92229 * @param options `stream.transform` options230 */231 function createHash(algorithm: string, options?: HashOptions): Hash;232 /**233 * Creates and returns an `Hmac` object that uses the given `algorithm` and `key`.234 * Optional `options` argument controls stream behavior.235 *236 * The `algorithm` is dependent on the available algorithms supported by the237 * version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.238 * On recent releases of OpenSSL, `openssl list -digest-algorithms` will239 * display the available digest algorithms.240 *241 * The `key` is the HMAC key used to generate the cryptographic HMAC hash. If it is242 * a `KeyObject`, its type must be `secret`. If it is a string, please consider `caveats when using strings as inputs to cryptographic APIs`. If it was243 * obtained from a cryptographically secure source of entropy, such as {@link randomBytes} or {@link generateKey}, its length should not244 * exceed the block size of `algorithm` (e.g., 512 bits for SHA-256).245 *246 * Example: generating the sha256 HMAC of a file247 *248 * ```js249 * import {250 * createReadStream,251 * } from 'node:fs';252 * import { argv } from 'node:process';253 * const {254 * createHmac,255 * } = await import('node:crypto');256 *257 * const filename = argv[2];258 *259 * const hmac = createHmac('sha256', 'a secret');260 *261 * const input = createReadStream(filename);262 * input.on('readable', () => {263 * // Only one element is going to be produced by the264 * // hash stream.265 * const data = input.read();266 * if (data)267 * hmac.update(data);268 * else {269 * console.log(`${hmac.digest('hex')} ${filename}`);270 * }271 * });272 * ```273 * @since v0.1.94274 * @param options `stream.transform` options275 */276 function createHmac(algorithm: string, key: BinaryLike | KeyObject, options?: stream.TransformOptions): Hmac;277 // https://nodejs.org/api/buffer.html#buffer_buffers_and_character_encodings278 type BinaryToTextEncoding = "base64" | "base64url" | "hex" | "binary";279 type CharacterEncoding = "utf8" | "utf-8" | "utf16le" | "utf-16le" | "latin1";280 type LegacyCharacterEncoding = "ascii" | "binary" | "ucs2" | "ucs-2";281 type Encoding = BinaryToTextEncoding | CharacterEncoding | LegacyCharacterEncoding;282 type ECDHKeyFormat = "compressed" | "uncompressed" | "hybrid";283 /**284 * The `Hash` class is a utility for creating hash digests of data. It can be285 * used in one of two ways:286 *287 * * As a `stream` that is both readable and writable, where data is written288 * to produce a computed hash digest on the readable side, or289 * * Using the `hash.update()` and `hash.digest()` methods to produce the290 * computed hash.291 *292 * The {@link createHash} method is used to create `Hash` instances. `Hash`objects are not to be created directly using the `new` keyword.293 *294 * Example: Using `Hash` objects as streams:295 *296 * ```js297 * const {298 * createHash,299 * } = await import('node:crypto');300 *301 * const hash = createHash('sha256');302 *303 * hash.on('readable', () => {304 * // Only one element is going to be produced by the305 * // hash stream.306 * const data = hash.read();307 * if (data) {308 * console.log(data.toString('hex'));309 * // Prints:310 * // 6a2da20943931e9834fc12cfe5bb47bbd9ae43489a30726962b576f4e3993e50311 * }312 * });313 *314 * hash.write('some data to hash');315 * hash.end();316 * ```317 *318 * Example: Using `Hash` and piped streams:319 *320 * ```js321 * import { createReadStream } from 'node:fs';322 * import { stdout } from 'node:process';323 * const { createHash } = await import('node:crypto');324 *325 * const hash = createHash('sha256');326 *327 * const input = createReadStream('test.js');328 * input.pipe(hash).setEncoding('hex').pipe(stdout);329 * ```330 *331 * Example: Using the `hash.update()` and `hash.digest()` methods:332 *333 * ```js334 * const {335 * createHash,336 * } = await import('node:crypto');337 *338 * const hash = createHash('sha256');339 *340 * hash.update('some data to hash');341 * console.log(hash.digest('hex'));342 * // Prints:343 * // 6a2da20943931e9834fc12cfe5bb47bbd9ae43489a30726962b576f4e3993e50344 * ```345 * @since v0.1.92346 */347 class Hash extends stream.Transform {348 private constructor();349 /**350 * Creates a new `Hash` object that contains a deep copy of the internal state351 * of the current `Hash` object.352 *353 * The optional `options` argument controls stream behavior. For XOF hash354 * functions such as `'shake256'`, the `outputLength` option can be used to355 * specify the desired output length in bytes.356 *357 * An error is thrown when an attempt is made to copy the `Hash` object after358 * its `hash.digest()` method has been called.359 *360 * ```js361 * // Calculate a rolling hash.362 * const {363 * createHash,364 * } = await import('node:crypto');365 *366 * const hash = createHash('sha256');367 *368 * hash.update('one');369 * console.log(hash.copy().digest('hex'));370 *371 * hash.update('two');372 * console.log(hash.copy().digest('hex'));373 *374 * hash.update('three');375 * console.log(hash.copy().digest('hex'));376 *377 * // Etc.378 * ```379 * @since v13.1.0380 * @param options `stream.transform` options381 */382 copy(options?: HashOptions): Hash;383 /**384 * Updates the hash content with the given `data`, the encoding of which385 * is given in `inputEncoding`.386 * If `encoding` is not provided, and the `data` is a string, an387 * encoding of `'utf8'` is enforced. If `data` is a `Buffer`, `TypedArray`, or`DataView`, then `inputEncoding` is ignored.388 *389 * This can be called many times with new data as it is streamed.390 * @since v0.1.92391 * @param inputEncoding The `encoding` of the `data` string.392 */393 update(data: BinaryLike): Hash;394 update(data: string, inputEncoding: Encoding): Hash;395 /**396 * Calculates the digest of all of the data passed to be hashed (using the `hash.update()` method).397 * If `encoding` is provided a string will be returned; otherwise398 * a `Buffer` is returned.399 *400 * The `Hash` object can not be used again after `hash.digest()` method has been401 * called. Multiple calls will cause an error to be thrown.402 * @since v0.1.92403 * @param encoding The `encoding` of the return value.404 */405 digest(): Buffer;406 digest(encoding: BinaryToTextEncoding): string;407 }408 /**409 * The `Hmac` class is a utility for creating cryptographic HMAC digests. It can410 * be used in one of two ways:411 *412 * * As a `stream` that is both readable and writable, where data is written413 * to produce a computed HMAC digest on the readable side, or414 * * Using the `hmac.update()` and `hmac.digest()` methods to produce the415 * computed HMAC digest.416 *417 * The {@link createHmac} method is used to create `Hmac` instances. `Hmac`objects are not to be created directly using the `new` keyword.418 *419 * Example: Using `Hmac` objects as streams:420 *421 * ```js422 * const {423 * createHmac,424 * } = await import('node:crypto');425 *426 * const hmac = createHmac('sha256', 'a secret');427 *428 * hmac.on('readable', () => {429 * // Only one element is going to be produced by the430 * // hash stream.431 * const data = hmac.read();432 * if (data) {433 * console.log(data.toString('hex'));434 * // Prints:435 * // 7fd04df92f636fd450bc841c9418e5825c17f33ad9c87c518115a45971f7f77e436 * }437 * });438 *439 * hmac.write('some data to hash');440 * hmac.end();441 * ```442 *443 * Example: Using `Hmac` and piped streams:444 *445 * ```js446 * import { createReadStream } from 'node:fs';447 * import { stdout } from 'node:process';448 * const {449 * createHmac,450 * } = await import('node:crypto');451 *452 * const hmac = createHmac('sha256', 'a secret');453 *454 * const input = createReadStream('test.js');455 * input.pipe(hmac).pipe(stdout);456 * ```457 *458 * Example: Using the `hmac.update()` and `hmac.digest()` methods:459 *460 * ```js461 * const {462 * createHmac,463 * } = await import('node:crypto');464 *465 * const hmac = createHmac('sha256', 'a secret');466 *467 * hmac.update('some data to hash');468 * console.log(hmac.digest('hex'));469 * // Prints:470 * // 7fd04df92f636fd450bc841c9418e5825c17f33ad9c87c518115a45971f7f77e471 * ```472 * @since v0.1.94473 * @deprecated Since v20.13.0 Calling `Hmac` class directly with `Hmac()` or `new Hmac()` is deprecated due to being internals, not intended for public use. Please use the {@link createHmac} method to create Hmac instances.474 */475 class Hmac extends stream.Transform {476 private constructor();477 /**478 * Updates the `Hmac` content with the given `data`, the encoding of which479 * is given in `inputEncoding`.480 * If `encoding` is not provided, and the `data` is a string, an481 * encoding of `'utf8'` is enforced. If `data` is a `Buffer`, `TypedArray`, or`DataView`, then `inputEncoding` is ignored.482 *483 * This can be called many times with new data as it is streamed.484 * @since v0.1.94485 * @param inputEncoding The `encoding` of the `data` string.486 */487 update(data: BinaryLike): Hmac;488 update(data: string, inputEncoding: Encoding): Hmac;489 /**490 * Calculates the HMAC digest of all of the data passed using `hmac.update()`.491 * If `encoding` is492 * provided a string is returned; otherwise a `Buffer` is returned;493 *494 * The `Hmac` object can not be used again after `hmac.digest()` has been495 * called. Multiple calls to `hmac.digest()` will result in an error being thrown.496 * @since v0.1.94497 * @param encoding The `encoding` of the return value.498 */499 digest(): Buffer;500 digest(encoding: BinaryToTextEncoding): string;501 }502 type KeyObjectType = "secret" | "public" | "private";503 interface KeyExportOptions<T extends KeyFormat> {504 type: "pkcs1" | "spki" | "pkcs8" | "sec1";505 format: T;506 cipher?: string | undefined;507 passphrase?: string | Buffer | undefined;508 }509 interface JwkKeyExportOptions {510 format: "jwk";511 }512 interface JsonWebKey {513 crv?: string | undefined;514 d?: string | undefined;515 dp?: string | undefined;516 dq?: string | undefined;517 e?: string | undefined;518 k?: string | undefined;519 kty?: string | undefined;520 n?: string | undefined;521 p?: string | undefined;522 q?: string | undefined;523 qi?: string | undefined;524 x?: string | undefined;525 y?: string | undefined;526 [key: string]: unknown;527 }528 interface AsymmetricKeyDetails {529 /**530 * Key size in bits (RSA, DSA).531 */532 modulusLength?: number | undefined;533 /**534 * Public exponent (RSA).535 */536 publicExponent?: bigint | undefined;537 /**538 * Name of the message digest (RSA-PSS).539 */540 hashAlgorithm?: string | undefined;541 /**542 * Name of the message digest used by MGF1 (RSA-PSS).543 */544 mgf1HashAlgorithm?: string | undefined;545 /**546 * Minimal salt length in bytes (RSA-PSS).547 */548 saltLength?: number | undefined;549 /**550 * Size of q in bits (DSA).551 */552 divisorLength?: number | undefined;553 /**554 * Name of the curve (EC).555 */556 namedCurve?: string | undefined;557 }558 /**559 * Node.js uses a `KeyObject` class to represent a symmetric or asymmetric key,560 * and each kind of key exposes different functions. The {@link createSecretKey}, {@link createPublicKey} and {@link createPrivateKey} methods are used to create `KeyObject`instances. `KeyObject`561 * objects are not to be created directly using the `new`keyword.562 *563 * Most applications should consider using the new `KeyObject` API instead of564 * passing keys as strings or `Buffer`s due to improved security features.565 *566 * `KeyObject` instances can be passed to other threads via `postMessage()`.567 * The receiver obtains a cloned `KeyObject`, and the `KeyObject` does not need to568 * be listed in the `transferList` argument.569 * @since v11.6.0570 */571 class KeyObject {572 private constructor();573 /**574 * Example: Converting a `CryptoKey` instance to a `KeyObject`:575 *576 * ```js577 * const { KeyObject } = await import('node:crypto');578 * const { subtle } = globalThis.crypto;579 *580 * const key = await subtle.generateKey({581 * name: 'HMAC',582 * hash: 'SHA-256',583 * length: 256,584 * }, true, ['sign', 'verify']);585 *586 * const keyObject = KeyObject.from(key);587 * console.log(keyObject.symmetricKeySize);588 * // Prints: 32 (symmetric key size in bytes)589 * ```590 * @since v15.0.0591 */592 static from(key: webcrypto.CryptoKey): KeyObject;593 /**594 * For asymmetric keys, this property represents the type of the key. Supported key595 * types are:596 *597 * * `'rsa'` (OID 1.2.840.113549.1.1.1)598 * * `'rsa-pss'` (OID 1.2.840.113549.1.1.10)599 * * `'dsa'` (OID 1.2.840.10040.4.1)600 * * `'ec'` (OID 1.2.840.10045.2.1)601 * * `'x25519'` (OID 1.3.101.110)602 * * `'x448'` (OID 1.3.101.111)603 * * `'ed25519'` (OID 1.3.101.112)604 * * `'ed448'` (OID 1.3.101.113)605 * * `'dh'` (OID 1.2.840.113549.1.3.1)606 *607 * This property is `undefined` for unrecognized `KeyObject` types and symmetric608 * keys.609 * @since v11.6.0610 */611 asymmetricKeyType?: KeyType | undefined;612 /**613 * This property exists only on asymmetric keys. Depending on the type of the key,614 * this object contains information about the key. None of the information obtained615 * through this property can be used to uniquely identify a key or to compromise616 * the security of the key.617 *618 * For RSA-PSS keys, if the key material contains a `RSASSA-PSS-params` sequence,619 * the `hashAlgorithm`, `mgf1HashAlgorithm`, and `saltLength` properties will be620 * set.621 *622 * Other key details might be exposed via this API using additional attributes.623 * @since v15.7.0624 */625 asymmetricKeyDetails?: AsymmetricKeyDetails | undefined;626 /**627 * For symmetric keys, the following encoding options can be used:628 *629 * For public keys, the following encoding options can be used:630 *631 * For private keys, the following encoding options can be used:632 *633 * The result type depends on the selected encoding format, when PEM the634 * result is a string, when DER it will be a buffer containing the data635 * encoded as DER, when [JWK](https://tools.ietf.org/html/rfc7517) it will be an object.636 *637 * When [JWK](https://tools.ietf.org/html/rfc7517) encoding format was selected, all other encoding options are638 * ignored.639 *640 * PKCS#1, SEC1, and PKCS#8 type keys can be encrypted by using a combination of641 * the `cipher` and `format` options. The PKCS#8 `type` can be used with any`format` to encrypt any key algorithm (RSA, EC, or DH) by specifying a`cipher`. PKCS#1 and SEC1 can only be642 * encrypted by specifying a `cipher`when the PEM `format` is used. For maximum compatibility, use PKCS#8 for643 * encrypted private keys. Since PKCS#8 defines its own644 * encryption mechanism, PEM-level encryption is not supported when encrypting645 * a PKCS#8 key. See [RFC 5208](https://www.rfc-editor.org/rfc/rfc5208.txt) for PKCS#8 encryption and [RFC 1421](https://www.rfc-editor.org/rfc/rfc1421.txt) for646 * PKCS#1 and SEC1 encryption.647 * @since v11.6.0648 */649 export(options: KeyExportOptions<"pem">): string | Buffer;650 export(options?: KeyExportOptions<"der">): Buffer;651 export(options?: JwkKeyExportOptions): JsonWebKey;652 /**653 * Returns `true` or `false` depending on whether the keys have exactly the same654 * type, value, and parameters. This method is not [constant time](https://en.wikipedia.org/wiki/Timing_attack).655 * @since v17.7.0, v16.15.0656 * @param otherKeyObject A `KeyObject` with which to compare `keyObject`.657 */658 equals(otherKeyObject: KeyObject): boolean;659 /**660 * For secret keys, this property represents the size of the key in bytes. This661 * property is `undefined` for asymmetric keys.662 * @since v11.6.0663 */664 symmetricKeySize?: number | undefined;665 /**666 * Converts a `KeyObject` instance to a `CryptoKey`.667 * @since 22.10.0668 */669 toCryptoKey(670 algorithm:671 | webcrypto.AlgorithmIdentifier672 | webcrypto.RsaHashedImportParams673 | webcrypto.EcKeyImportParams674 | webcrypto.HmacImportParams,675 extractable: boolean,676 keyUsages: readonly webcrypto.KeyUsage[],677 ): webcrypto.CryptoKey;678 /**679 * Depending on the type of this `KeyObject`, this property is either`'secret'` for secret (symmetric) keys, `'public'` for public (asymmetric) keys680 * or `'private'` for private (asymmetric) keys.681 * @since v11.6.0682 */683 type: KeyObjectType;684 }685 type CipherCCMTypes = "aes-128-ccm" | "aes-192-ccm" | "aes-256-ccm";686 type CipherGCMTypes = "aes-128-gcm" | "aes-192-gcm" | "aes-256-gcm";687 type CipherOCBTypes = "aes-128-ocb" | "aes-192-ocb" | "aes-256-ocb";688 type CipherChaCha20Poly1305Types = "chacha20-poly1305";689 type BinaryLike = string | NodeJS.ArrayBufferView;690 type CipherKey = BinaryLike | KeyObject;691 interface CipherCCMOptions extends stream.TransformOptions {692 authTagLength: number;693 }694 interface CipherGCMOptions extends stream.TransformOptions {695 authTagLength?: number | undefined;696 }697 interface CipherOCBOptions extends stream.TransformOptions {698 authTagLength: number;699 }700 interface CipherChaCha20Poly1305Options extends stream.TransformOptions {701 /** @default 16 */702 authTagLength?: number | undefined;703 }704 /**705 * Creates and returns a `Cipher` object, with the given `algorithm`, `key` and706 * initialization vector (`iv`).707 *708 * The `options` argument controls stream behavior and is optional except when a709 * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the`authTagLength` option is required and specifies the length of the710 * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength`option is not required but can be used to set the length of the authentication711 * tag that will be returned by `getAuthTag()` and defaults to 16 bytes.712 * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.713 *714 * The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On715 * recent OpenSSL releases, `openssl list -cipher-algorithms` will716 * display the available cipher algorithms.717 *718 * The `key` is the raw key used by the `algorithm` and `iv` is an [initialization vector](https://en.wikipedia.org/wiki/Initialization_vector). Both arguments must be `'utf8'` encoded719 * strings,`Buffers`, `TypedArray`, or `DataView`s. The `key` may optionally be720 * a `KeyObject` of type `secret`. If the cipher does not need721 * an initialization vector, `iv` may be `null`.722 *723 * When passing strings for `key` or `iv`, please consider `caveats when using strings as inputs to cryptographic APIs`.724 *725 * Initialization vectors should be unpredictable and unique; ideally, they will be726 * cryptographically random. They do not have to be secret: IVs are typically just727 * added to ciphertext messages unencrypted. It may sound contradictory that728 * something has to be unpredictable and unique, but does not have to be secret;729 * remember that an attacker must not be able to predict ahead of time what a730 * given IV will be.731 * @since v0.1.94732 * @param options `stream.transform` options733 */734 function createCipheriv(735 algorithm: CipherCCMTypes,736 key: CipherKey,737 iv: BinaryLike,738 options: CipherCCMOptions,739 ): CipherCCM;740 function createCipheriv(741 algorithm: CipherOCBTypes,742 key: CipherKey,743 iv: BinaryLike,744 options: CipherOCBOptions,745 ): CipherOCB;746 function createCipheriv(747 algorithm: CipherGCMTypes,748 key: CipherKey,749 iv: BinaryLike,750 options?: CipherGCMOptions,751 ): CipherGCM;752 function createCipheriv(753 algorithm: CipherChaCha20Poly1305Types,754 key: CipherKey,755 iv: BinaryLike,756 options?: CipherChaCha20Poly1305Options,757 ): CipherChaCha20Poly1305;758 function createCipheriv(759 algorithm: string,760 key: CipherKey,761 iv: BinaryLike | null,762 options?: stream.TransformOptions,763 ): Cipheriv;764 /**765 * Instances of the `Cipheriv` class are used to encrypt data. The class can be766 * used in one of two ways:767 *768 * * As a `stream` that is both readable and writable, where plain unencrypted769 * data is written to produce encrypted data on the readable side, or770 * * Using the `cipher.update()` and `cipher.final()` methods to produce771 * the encrypted data.772 *773 * The {@link createCipheriv} method is774 * used to create `Cipheriv` instances. `Cipheriv` objects are not to be created775 * directly using the `new` keyword.776 *777 * Example: Using `Cipheriv` objects as streams:778 *779 * ```js780 * const {781 * scrypt,782 * randomFill,783 * createCipheriv,784 * } = await import('node:crypto');785 *786 * const algorithm = 'aes-192-cbc';787 * const password = 'Password used to generate key';788 *789 * // First, we'll generate the key. The key length is dependent on the algorithm.790 * // In this case for aes192, it is 24 bytes (192 bits).791 * scrypt(password, 'salt', 24, (err, key) => {792 * if (err) throw err;793 * // Then, we'll generate a random initialization vector794 * randomFill(new Uint8Array(16), (err, iv) => {795 * if (err) throw err;796 *797 * // Once we have the key and iv, we can create and use the cipher...798 * const cipher = createCipheriv(algorithm, key, iv);799 *800 * let encrypted = '';801 * cipher.setEncoding('hex');802 *803 * cipher.on('data', (chunk) => encrypted += chunk);804 * cipher.on('end', () => console.log(encrypted));805 *806 * cipher.write('some clear text data');807 * cipher.end();808 * });809 * });810 * ```811 *812 * Example: Using `Cipheriv` and piped streams:813 *814 * ```js815 * import {816 * createReadStream,817 * createWriteStream,818 * } from 'node:fs';819 *820 * import {821 * pipeline,822 * } from 'node:stream';823 *824 * const {825 * scrypt,826 * randomFill,827 * createCipheriv,828 * } = await import('node:crypto');829 *830 * const algorithm = 'aes-192-cbc';831 * const password = 'Password used to generate key';832 *833 * // First, we'll generate the key. The key length is dependent on the algorithm.834 * // In this case for aes192, it is 24 bytes (192 bits).835 * scrypt(password, 'salt', 24, (err, key) => {836 * if (err) throw err;837 * // Then, we'll generate a random initialization vector838 * randomFill(new Uint8Array(16), (err, iv) => {839 * if (err) throw err;840 *841 * const cipher = createCipheriv(algorithm, key, iv);842 *843 * const input = createReadStream('test.js');844 * const output = createWriteStream('test.enc');845 *846 * pipeline(input, cipher, output, (err) => {847 * if (err) throw err;848 * });849 * });850 * });851 * ```852 *853 * Example: Using the `cipher.update()` and `cipher.final()` methods:854 *855 * ```js856 * const {857 * scrypt,858 * randomFill,859 * createCipheriv,860 * } = await import('node:crypto');861 *862 * const algorithm = 'aes-192-cbc';863 * const password = 'Password used to generate key';864 *865 * // First, we'll generate the key. The key length is dependent on the algorithm.866 * // In this case for aes192, it is 24 bytes (192 bits).867 * scrypt(password, 'salt', 24, (err, key) => {868 * if (err) throw err;869 * // Then, we'll generate a random initialization vector870 * randomFill(new Uint8Array(16), (err, iv) => {871 * if (err) throw err;872 *873 * const cipher = createCipheriv(algorithm, key, iv);874 *875 * let encrypted = cipher.update('some clear text data', 'utf8', 'hex');876 * encrypted += cipher.final('hex');877 * console.log(encrypted);878 * });879 * });880 * ```881 * @since v0.1.94882 */883 class Cipheriv extends stream.Transform {884 private constructor();885 /**886 * Updates the cipher with `data`. If the `inputEncoding` argument is given,887 * the `data`argument is a string using the specified encoding. If the `inputEncoding`argument is not given, `data` must be a `Buffer`, `TypedArray`, or `DataView`. If `data` is a `Buffer`,888 * `TypedArray`, or `DataView`, then `inputEncoding` is ignored.889 *890 * The `outputEncoding` specifies the output format of the enciphered891 * data. If the `outputEncoding`is specified, a string using the specified encoding is returned. If no`outputEncoding` is provided, a `Buffer` is returned.892 *893 * The `cipher.update()` method can be called multiple times with new data until `cipher.final()` is called. Calling `cipher.update()` after `cipher.final()` will result in an error being894 * thrown.895 * @since v0.1.94896 * @param inputEncoding The `encoding` of the data.897 * @param outputEncoding The `encoding` of the return value.898 */899 update(data: BinaryLike): Buffer;900 update(data: string, inputEncoding: Encoding): Buffer;901 update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;902 update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;903 /**904 * Once the `cipher.final()` method has been called, the `Cipheriv` object can no905 * longer be used to encrypt data. Attempts to call `cipher.final()` more than906 * once will result in an error being thrown.907 * @since v0.1.94908 * @param outputEncoding The `encoding` of the return value.909 * @return Any remaining enciphered contents. If `outputEncoding` is specified, a string is returned. If an `outputEncoding` is not provided, a {@link Buffer} is returned.910 */911 final(): Buffer;912 final(outputEncoding: BufferEncoding): string;913 /**914 * When using block encryption algorithms, the `Cipheriv` class will automatically915 * add padding to the input data to the appropriate block size. To disable the916 * default padding call `cipher.setAutoPadding(false)`.917 *918 * When `autoPadding` is `false`, the length of the entire input data must be a919 * multiple of the cipher's block size or `cipher.final()` will throw an error.920 * Disabling automatic padding is useful for non-standard padding, for instance921 * using `0x0` instead of PKCS padding.922 *923 * The `cipher.setAutoPadding()` method must be called before `cipher.final()`.924 * @since v0.7.1925 * @param [autoPadding=true]926 * @return for method chaining.927 */928 setAutoPadding(autoPadding?: boolean): this;929 }930 interface CipherCCM extends Cipheriv {931 setAAD(932 buffer: NodeJS.ArrayBufferView,933 options: {934 plaintextLength: number;935 },936 ): this;937 getAuthTag(): Buffer;938 }939 interface CipherGCM extends Cipheriv {940 setAAD(941 buffer: NodeJS.ArrayBufferView,942 options?: {943 plaintextLength: number;944 },945 ): this;946 getAuthTag(): Buffer;947 }948 interface CipherOCB extends Cipheriv {949 setAAD(950 buffer: NodeJS.ArrayBufferView,951 options?: {952 plaintextLength: number;953 },954 ): this;955 getAuthTag(): Buffer;956 }957 interface CipherChaCha20Poly1305 extends Cipheriv {958 setAAD(959 buffer: NodeJS.ArrayBufferView,960 options: {961 plaintextLength: number;962 },963 ): this;964 getAuthTag(): Buffer;965 }966 /**967 * Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key` and initialization vector (`iv`).968 *969 * The `options` argument controls stream behavior and is optional except when a970 * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the `authTagLength` option is required and specifies the length of the971 * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength` option is not required but can be used to restrict accepted authentication tags972 * to those with the specified length.973 * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.974 *975 * The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On976 * recent OpenSSL releases, `openssl list -cipher-algorithms` will977 * display the available cipher algorithms.978 *979 * The `key` is the raw key used by the `algorithm` and `iv` is an [initialization vector](https://en.wikipedia.org/wiki/Initialization_vector). Both arguments must be `'utf8'` encoded980 * strings,`Buffers`, `TypedArray`, or `DataView`s. The `key` may optionally be981 * a `KeyObject` of type `secret`. If the cipher does not need982 * an initialization vector, `iv` may be `null`.983 *984 * When passing strings for `key` or `iv`, please consider `caveats when using strings as inputs to cryptographic APIs`.985 *986 * Initialization vectors should be unpredictable and unique; ideally, they will be987 * cryptographically random. They do not have to be secret: IVs are typically just988 * added to ciphertext messages unencrypted. It may sound contradictory that989 * something has to be unpredictable and unique, but does not have to be secret;990 * remember that an attacker must not be able to predict ahead of time what a given991 * IV will be.992 * @since v0.1.94993 * @param options `stream.transform` options994 */995 function createDecipheriv(996 algorithm: CipherCCMTypes,997 key: CipherKey,998 iv: BinaryLike,999 options: CipherCCMOptions,1000 ): DecipherCCM;1001 function createDecipheriv(1002 algorithm: CipherOCBTypes,1003 key: CipherKey,1004 iv: BinaryLike,1005 options: CipherOCBOptions,1006 ): DecipherOCB;1007 function createDecipheriv(1008 algorithm: CipherGCMTypes,1009 key: CipherKey,1010 iv: BinaryLike,1011 options?: CipherGCMOptions,1012 ): DecipherGCM;1013 function createDecipheriv(1014 algorithm: CipherChaCha20Poly1305Types,1015 key: CipherKey,1016 iv: BinaryLike,1017 options?: CipherChaCha20Poly1305Options,1018 ): DecipherChaCha20Poly1305;1019 function createDecipheriv(1020 algorithm: string,1021 key: CipherKey,1022 iv: BinaryLike | null,1023 options?: stream.TransformOptions,1024 ): Decipheriv;1025 /**1026 * Instances of the `Decipheriv` class are used to decrypt data. The class can be1027 * used in one of two ways:1028 *1029 * * As a `stream` that is both readable and writable, where plain encrypted1030 * data is written to produce unencrypted data on the readable side, or1031 * * Using the `decipher.update()` and `decipher.final()` methods to1032 * produce the unencrypted data.1033 *1034 * The {@link createDecipheriv} method is1035 * used to create `Decipheriv` instances. `Decipheriv` objects are not to be created1036 * directly using the `new` keyword.1037 *1038 * Example: Using `Decipheriv` objects as streams:1039 *1040 * ```js1041 * import { Buffer } from 'node:buffer';1042 * const {1043 * scryptSync,1044 * createDecipheriv,1045 * } = await import('node:crypto');1046 *1047 * const algorithm = 'aes-192-cbc';1048 * const password = 'Password used to generate key';1049 * // Key length is dependent on the algorithm. In this case for aes192, it is1050 * // 24 bytes (192 bits).1051 * // Use the async `crypto.scrypt()` instead.1052 * const key = scryptSync(password, 'salt', 24);1053 * // The IV is usually passed along with the ciphertext.1054 * const iv = Buffer.alloc(16, 0); // Initialization vector.1055 *1056 * const decipher = createDecipheriv(algorithm, key, iv);1057 *1058 * let decrypted = '';1059 * decipher.on('readable', () => {1060 * let chunk;1061 * while (null !== (chunk = decipher.read())) {1062 * decrypted += chunk.toString('utf8');1063 * }1064 * });1065 * decipher.on('end', () => {1066 * console.log(decrypted);1067 * // Prints: some clear text data1068 * });1069 *1070 * // Encrypted with same algorithm, key and iv.1071 * const encrypted =1072 * 'e5f79c5915c02171eec6b212d5520d44480993d7d622a7c4c2da32f6efda0ffa';1073 * decipher.write(encrypted, 'hex');1074 * decipher.end();1075 * ```1076 *1077 * Example: Using `Decipheriv` and piped streams:1078 *1079 * ```js1080 * import {1081 * createReadStream,1082 * createWriteStream,1083 * } from 'node:fs';1084 * import { Buffer } from 'node:buffer';1085 * const {1086 * scryptSync,1087 * createDecipheriv,1088 * } = await import('node:crypto');1089 *1090 * const algorithm = 'aes-192-cbc';1091 * const password = 'Password used to generate key';1092 * // Use the async `crypto.scrypt()` instead.1093 * const key = scryptSync(password, 'salt', 24);1094 * // The IV is usually passed along with the ciphertext.1095 * const iv = Buffer.alloc(16, 0); // Initialization vector.1096 *1097 * const decipher = createDecipheriv(algorithm, key, iv);1098 *1099 * const input = createReadStream('test.enc');1100 * const output = createWriteStream('test.js');1101 *1102 * input.pipe(decipher).pipe(output);1103 * ```1104 *1105 * Example: Using the `decipher.update()` and `decipher.final()` methods:1106 *1107 * ```js1108 * import { Buffer } from 'node:buffer';1109 * const {1110 * scryptSync,1111 * createDecipheriv,1112 * } = await import('node:crypto');1113 *1114 * const algorithm = 'aes-192-cbc';1115 * const password = 'Password used to generate key';1116 * // Use the async `crypto.scrypt()` instead.1117 * const key = scryptSync(password, 'salt', 24);1118 * // The IV is usually passed along with the ciphertext.1119 * const iv = Buffer.alloc(16, 0); // Initialization vector.1120 *1121 * const decipher = createDecipheriv(algorithm, key, iv);1122 *1123 * // Encrypted using same algorithm, key and iv.1124 * const encrypted =1125 * 'e5f79c5915c02171eec6b212d5520d44480993d7d622a7c4c2da32f6efda0ffa';1126 * let decrypted = decipher.update(encrypted, 'hex', 'utf8');1127 * decrypted += decipher.final('utf8');1128 * console.log(decrypted);1129 * // Prints: some clear text data1130 * ```1131 * @since v0.1.941132 */1133 class Decipheriv extends stream.Transform {1134 private constructor();1135 /**1136 * Updates the decipher with `data`. If the `inputEncoding` argument is given,1137 * the `data` argument is a string using the specified encoding. If the `inputEncoding` argument is not given, `data` must be a `Buffer`. If `data` is a `Buffer` then `inputEncoding` is1138 * ignored.1139 *1140 * The `outputEncoding` specifies the output format of the enciphered1141 * data. If the `outputEncoding` is specified, a string using the specified encoding is returned. If no `outputEncoding` is provided, a `Buffer` is returned.1142 *1143 * The `decipher.update()` method can be called multiple times with new data until `decipher.final()` is called. Calling `decipher.update()` after `decipher.final()` will result in an error1144 * being thrown.1145 * @since v0.1.941146 * @param inputEncoding The `encoding` of the `data` string.1147 * @param outputEncoding The `encoding` of the return value.1148 */1149 update(data: NodeJS.ArrayBufferView): Buffer;1150 update(data: string, inputEncoding: Encoding): Buffer;1151 update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;1152 update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;1153 /**1154 * Once the `decipher.final()` method has been called, the `Decipheriv` object can1155 * no longer be used to decrypt data. Attempts to call `decipher.final()` more1156 * than once will result in an error being thrown.1157 * @since v0.1.941158 * @param outputEncoding The `encoding` of the return value.1159 * @return Any remaining deciphered contents. If `outputEncoding` is specified, a string is returned. If an `outputEncoding` is not provided, a {@link Buffer} is returned.1160 */1161 final(): Buffer;1162 final(outputEncoding: BufferEncoding): string;1163 /**1164 * When data has been encrypted without standard block padding, calling `decipher.setAutoPadding(false)` will disable automatic padding to prevent `decipher.final()` from checking for and1165 * removing padding.1166 *1167 * Turning auto padding off will only work if the input data's length is a1168 * multiple of the ciphers block size.1169 *1170 * The `decipher.setAutoPadding()` method must be called before `decipher.final()`.1171 * @since v0.7.11172 * @param [autoPadding=true]1173 * @return for method chaining.1174 */1175 setAutoPadding(auto_padding?: boolean): this;1176 }1177 interface DecipherCCM extends Decipheriv {1178 setAuthTag(buffer: NodeJS.ArrayBufferView): this;1179 setAAD(1180 buffer: NodeJS.ArrayBufferView,1181 options: {1182 plaintextLength: number;1183 },1184 ): this;1185 }1186 interface DecipherGCM extends Decipheriv {1187 setAuthTag(buffer: NodeJS.ArrayBufferView): this;1188 setAAD(1189 buffer: NodeJS.ArrayBufferView,1190 options?: {1191 plaintextLength: number;1192 },1193 ): this;1194 }1195 interface DecipherOCB extends Decipheriv {1196 setAuthTag(buffer: NodeJS.ArrayBufferView): this;1197 setAAD(1198 buffer: NodeJS.ArrayBufferView,1199 options?: {1200 plaintextLength: number;