micro509/keys

Generate keys and move them between WebCrypto, PEM, DER, and JWK formats.

Start with generateKeyPair. Load a private key with importPkcs8Pem, or protect an exported key with exportEncryptedPkcs8Pem.

Functions

• decryptRsaOaep — Decrypt an RSA-OAEP ciphertext with the matching private key.
• decryptRsaOaepOrThrow — Decrypt an RSA-OAEP ciphertext with the matching private key.
• derivePublicKey — Derive the matching public key from an imported (or generated) private key.
• encryptRsaOaep — Encrypt a small message with an RSA-OAEP public key.
• encryptRsaOaepOrThrow — Encrypt a small message with an RSA-OAEP public key.
• exportBinaryBase64 — Export a key as raw base64 (no PEM headers).
• exportEncryptedPkcs1Pem — Export an RSA private key as legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• exportEncryptedPkcs8Der — Export a private key as DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• exportEncryptedPkcs8Pem — Export a private key as PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• exportEncryptedSec1Pem — Export an EC private key as legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• exportPkcs1Der — Export an RSA private key as DER-encoded PKCS#1 RSAPrivateKey.
• exportPkcs1Pem — Export an RSA private key as PEM-encoded PKCS#1 RSAPrivateKey.
• exportPkcs8Der — Export a private key as DER-encoded PKCS#8 PrivateKeyInfo.
• exportPkcs8Pem — Export a private key as PEM-encoded PKCS#8 PrivateKeyInfo.
• exportPrivateJwk — Export a private key as a JSON Web Key.
• exportPublicJwk — Export a public key as a JSON Web Key.
• exportSec1Der — Export an EC private key as DER-encoded SEC 1 ECPrivateKey.
• exportSec1Pem — Export an EC private key as PEM-encoded SEC 1 ECPrivateKey.
• exportSpkiDer — Export a public key as DER-encoded SubjectPublicKeyInfo.
• exportSpkiPem — Export a public key as PEM-encoded SubjectPublicKeyInfo.
• generateKeyPair — Generate an asymmetric key pair for signing and verification, or — with
• importEncryptedPkcs1Pem — Import an RSA private key from legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• importEncryptedPkcs1PemOrThrow — Import an RSA private key from legacy Proc-Type: 4,ENCRYPTED PEM (PKCS#1).
• importEncryptedPkcs8Der — Import a private key from DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8DerOrThrow — Import a private key from DER-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8Pem — Import a private key from PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedPkcs8PemOrThrow — Import a private key from PEM-encoded PBES2-encrypted PKCS#8 EncryptedPrivateKeyInfo.
• importEncryptedSec1Pem — Import an EC private key from legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• importEncryptedSec1PemOrThrow — Import an EC private key from legacy Proc-Type: 4,ENCRYPTED PEM (SEC 1).
• importPkcs1Der — Import an RSA private key from DER-encoded PKCS#1 RSAPrivateKey.
• importPkcs1DerOrThrow — Import an RSA private key from DER-encoded PKCS#1 RSAPrivateKey.
• importPkcs1Pem — Import an RSA private key from PEM-encoded PKCS#1 RSAPrivateKey.
• importPkcs1PemOrThrow — Import an RSA private key from PEM-encoded PKCS#1 RSAPrivateKey.
• importPkcs8Base64 — Import a private key from base64-encoded PKCS#8 PrivateKeyInfo (no PEM headers).
• importPkcs8Base64OrThrow — Import a private key from base64-encoded PKCS#8 PrivateKeyInfo (no PEM headers).
• importPkcs8Der — Import a private key from DER-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8DerOrThrow — Import a private key from DER-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8Pem — Import a private key from PEM-encoded PKCS#8 PrivateKeyInfo.
• importPkcs8PemOrThrow — Import a private key from PEM-encoded PKCS#8 PrivateKeyInfo.
• importPrivateJwk — Import a private signing key from a JSON Web Key.
• importPrivateJwkOrThrow — Import a private signing key from a JSON Web Key.
• importPublicJwk — Import a public verification key from a JSON Web Key.
• importPublicJwkOrThrow — Import a public verification key from a JSON Web Key.
• importSec1Der — Import an EC private key from DER-encoded SEC 1 ECPrivateKey.
• importSec1DerOrThrow — Import an EC private key from DER-encoded SEC 1 ECPrivateKey.
• importSec1Pem — Import an EC private key from PEM-encoded SEC 1 ECPrivateKey.
• importSec1PemOrThrow — Import an EC private key from PEM-encoded SEC 1 ECPrivateKey.
• importSpkiBase64 — Import a public key from base64-encoded SubjectPublicKeyInfo (no PEM headers).
• importSpkiBase64OrThrow — Import a public key from base64-encoded SubjectPublicKeyInfo (no PEM headers).
• importSpkiDer — Import a public key from DER-encoded SubjectPublicKeyInfo.
• importSpkiDerOrThrow — Import a public key from DER-encoded SubjectPublicKeyInfo.
• importSpkiPem — Import a public key from PEM-encoded SubjectPublicKeyInfo.
• importSpkiPemOrThrow — Import a public key from PEM-encoded SubjectPublicKeyInfo.
• inspectEncryptedPkcs8Der — Reads the PBES2 encryption parameters of a DER PKCS#8
• parsePbes2AlgorithmIdentifier — Decodes a DER-encoded PBES2 AlgorithmIdentifier into structured Pbes2Parameters.

Types

• DecryptRsaOaepErrorCode — Machine-readable failure reason for decryptRsaOaep.
• DecryptRsaOaepFailure — Structured failure payload for decryptRsaOaep.
• DecryptRsaOaepResult — Success-or-failure result returned by decryptRsaOaep.
• EcKeyAlgorithmInput — ECDSA variant of KeyAlgorithmInput.
• EcNamedCurve — NIST elliptic curve for ECDSA keys.
• Ed25519KeyAlgorithmInput — Ed25519 variant of KeyAlgorithmInput.
• EncryptedPkcs8Options — PBES2 encryption options for the encrypted PKCS#8 export/import functions.
• EncryptRsaOaepErrorCode — Machine-readable failure reason for encryptRsaOaep.
• EncryptRsaOaepFailure — Structured failure payload for encryptRsaOaep.
• EncryptRsaOaepResult — Success-or-failure result returned by encryptRsaOaep.
• ImportEcKeyInput — ECDSA variant of PublicKeyImportInput / PrivateKeyImportInput.
• ImportEd25519KeyInput — Ed25519 variant of PublicKeyImportInput / PrivateKeyImportInput.
• ImportEncryptedKeyErrorCode — Machine-readable failure reason for the importEncrypted* key functions.
• ImportEncryptedKeyFailure — Structured failure payload for encrypted key import.
• ImportEncryptedKeyOptions — Options for the encrypted PKCS#8 import functions.
• ImportEncryptedKeyResult — Success-or-failure result returned by the public importEncrypted* key functions.
• ImportKeyErrorCode — Machine-readable failure reason for the import* key functions.
• ImportKeyFailure — Structured failure payload for key import.
• ImportKeyResult — Success-or-failure result returned by the public import* key functions.
• ImportRsaKeyInput — RSA variant of PublicKeyImportInput / PrivateKeyImportInput.
• KdfLimitOptions — Caller-supplied bound on password-based KDF work.
• KeyAlgorithmInput — Input for generateKeyPair. Selects algorithm family and parameters.
• KeyPairMaterial — Key pair with convenience export helpers. Returned by generateKeyPair.
• LegacyPemEncryptionOptions — Options for OpenSSL-style Proc-Type: 4,ENCRYPTED PEM encryption (PKCS#1/SEC1).
• Pbes2EncryptionOptions — Input for encryptPbes2.
• Pbes2EncryptionScheme — AES-CBC key sizes supported by this PBES2 implementation.
• Pbes2Parameters — Resolved PBES2 algorithm parameters, either parsed from DER or built by encryptPbes2.
• Pbes2Prf — PBKDF2 pseudo-random function choices. HMAC-SHA-1 is the RFC default; HMAC-SHA-256 is preferred.
• PrivateKeyImportInput — Algorithm descriptor for private key import functions. Same shape as PublicKeyImportInput.
• PublicKeyImportInput — Algorithm descriptor for public key import functions.
• RsaHash — Hash algorithm paired with an RSA key.
• RsaKeyAlgorithmInput — RSA variant of KeyAlgorithmInput.
• RsaOaepOptions — Options shared by encryptRsaOaep and decryptRsaOaep.
• RsaScheme — RSA padding scheme: a signature scheme, or 'oaep' for RSA-OAEP encryption
• RsaSignatureScheme — RSA signature padding scheme.