Cryptography Deep Dive

async function deriveMasterKey(password: string): Promise<CryptoKey> {
  const encoder = new TextEncoder();
  
  // 1. SHA-256 pre-hash (prevents bcrypt truncation at 72 chars)
  const passwordBuffer = encoder.encode(password);
  const preHash = await crypto.subtle.digest("SHA-256", passwordBuffer);
  
  // 2. Import pre-hashed password as key material
  const keyMaterial = await crypto.subtle.importKey(
    "raw",
    preHash,
    { name: "PBKDF2" },
    false,
    ["deriveKey"]
  );
  
  // 3. Derive 256-bit AES key with PBKDF2
  const salt = encoder.encode("static-salt-CHANGE-ME"); // ⚠️ Should be random per-user
  
  const masterKey = await crypto.subtle.deriveKey(
    {
      name: "PBKDF2",
      salt: salt,
      iterations: 100000,
      hash: "SHA-256"
    },
    keyMaterial,
    { name: "AES-GCM", length: 256 },
    false, // Not extractable
    ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
  );
  
  return masterKey;
}

async function encryptFile(file: File): Promise<EncryptedFile> {
  // 1. Generate random 256-bit AES key (DEK)
  const fileKey = await crypto.subtle.generateKey(
    { name: "AES-GCM", length: 256 },
    true, // Extractable (need to wrap it later)
    ["encrypt", "decrypt"]
  );
  
  // 2. Generate random 96-bit IV (nonce)
  const iv = crypto.getRandomValues(new Uint8Array(12));
  
  // 3. Read file as ArrayBuffer
  const fileBuffer = await file.arrayBuffer();
  
  // 4. Encrypt file with AES-GCM
  const encryptedBuffer = await crypto.subtle.encrypt(
    {
      name: "AES-GCM",
      iv: iv,
      tagLength: 128 // 128-bit authentication tag
    },
    fileKey,
    fileBuffer
  );
  
  // 5. Export file key for wrapping
  const exportedKey = await crypto.subtle.exportKey("raw", fileKey);
  
  return {
    ciphertext: new Uint8Array(encryptedBuffer),
    iv: iv,
    fileKey: new Uint8Array(exportedKey), // Will be wrapped before storage
    authTag: encryptedBuffer.slice(-16) // Last 16 bytes (GCM appends tag)
  };
}

async function generateRSAKeyPair(masterKey: CryptoKey): Promise<KeyPair> {
  // 1. Generate 4096-bit RSA key pair
  const keyPair = await crypto.subtle.generateKey(
    {
      name: "RSA-OAEP",
      modulusLength: 4096,
      publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // 65537
      hash: "SHA-256"
    },
    true, // Extractable
    ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
  );
  
  // 2. Export public key (stored in DB as base64)
  const publicKeyJWK = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
  
  // 3. Wrap (encrypt) private key with master key
  const wrappedPrivateKey = await crypto.subtle.wrapKey(
    "jwk",
    keyPair.privateKey,
    masterKey,
    {
      name: "AES-GCM",
      iv: crypto.getRandomValues(new Uint8Array(12))
    }
  );
  
  return {
    publicKey: JSON.stringify(publicKeyJWK),
    encryptedPrivateKey: new Uint8Array(wrappedPrivateKey)
  };
}

async function wrapFileKeyForRecipient(
  fileKey: Uint8Array,
  recipientPublicKeyJWK: string
): Promise<Uint8Array> {
  // 1. Import recipient's RSA public key
  const publicKey = await crypto.subtle.importKey(
    "jwk",
    JSON.parse(recipientPublicKeyJWK),
    { name: "RSA-OAEP", hash: "SHA-256" },
    false,
    ["wrapKey"]
  );
  
  // 2. Import file key as CryptoKey
  const fileKeyObj = await crypto.subtle.importKey(
    "raw",
    fileKey,
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt", "decrypt"]
  );
  
  // 3. Wrap file key with recipient's RSA public key
  const wrappedKey = await crypto.subtle.wrapKey(
    "raw",
    fileKeyObj,
    publicKey,
    { name: "RSA-OAEP" }
  );
  
  return new Uint8Array(wrappedKey);
}

1. →User enters password
2. →SHA-256 pre-hash → PBKDF2 (100k iterations) → Master Key
3. →Generate RSA-4096 key pair
4. →Wrap private key with master key (AES-GCM)
5. →Send to server: bcrypt(SHA-256(password)), encrypted private key, public key

1. →User enters password
2. →SHA-256 → send to server for bcrypt comparison + JWT issuance
3. →Server returns encrypted private key
4. →Client re-derives master key (PBKDF2 with same password)
5. →Unwrap RSA private key with master key
6. →Store keys in memory for session

1. →Generate random 256-bit AES key (file DEK)
2. →Encrypt file with AES-256-GCM (DEK + random IV)
3. →Wrap DEK with master key (AES-GCM)
4. →Upload encrypted file to S3
5. →Store metadata + wrapped DEK + IV in MongoDB

1. →Unwrap file DEK with owner's master key
2. →Fetch recipient's RSA public key from server
3. →Wrap file DEK with recipient's RSA public key (RSA-OAEP)
4. →Send wrapped DEK to server, server stores in shares collection
5. →Recipient unwraps with their RSA private key when accessing

1. →Request pre-signed S3 URL from server
2. →Fetch encrypted file from S3
3. →Fetch wrapped DEK + IV from MongoDB (via API)
4. →Unwrap DEK (with master key if owner, or RSA private key if shared)
5. →Decrypt file with AES-256-GCM (DEK + IV)
6. →Download plaintext file to user's device