Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const _wrapKey = async (material: NodeEncryptionMaterial) => {
/* Precondition: Public key must be defined to support encrypt. */
if (!publicKey) throw new Error('No public key defined in constructor. Encrypt disabled.')
const { buffer, byteOffset, byteLength } = unwrapDataKey(material.getUnencryptedDataKey())
const encryptedDataKey = publicEncrypt(
{ key: publicKey, padding },
Buffer.from(buffer, byteOffset, byteLength))
const providerInfo = this.keyName
const providerId = this.keyNamespace
const flag = KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY
const edk = new EncryptedDataKey({ encryptedDataKey, providerInfo, providerId })
return material.addEncryptedDataKey(edk, flag)
}
function aesGcmWrapKey (
keyNamespace: string,
keyName: string,
material: NodeEncryptionMaterial,
aad: Buffer,
wrappingMaterial: NodeRawAesMaterial
): NodeEncryptionMaterial {
const { encryption, ivLength } = wrappingMaterial.suite
const iv = randomBytes(ivLength)
const wrappingDataKey = wrappingMaterial.getUnencryptedDataKey()
const dataKey = unwrapDataKey(material.getUnencryptedDataKey())
const cipher = createCipheriv(encryption, wrappingDataKey, iv)
.setAAD(aad)
// Buffer.concat will use the shared buffer space, and the resultant buffer will have a byteOffset...
const ciphertext = concatBuffers(cipher.update(dataKey), cipher.final())
const authTag = cipher.getAuthTag()
const edk = rawAesEncryptedDataKey(
keyNamespace,
keyName,
iv,
ciphertext,
authTag
)
return material.addEncryptedDataKey(edk, encryptFlags)