crypto API

pub fn sha256(data: text) -> text

SHA-256 hash of a string. Returns 64-char hex string.

pub fn sha256_b64(data_b64: text) -> text

SHA-256 of the RAW BYTES decoded from base64 data_b64. Returns base64 of the 32-byte digest, or "" when data_b64 is not base64. Use this to hash arbitrary byte strings (ciphertext, canonical CBOR) that are not valid UTF-8 and so cannot be passed to sha256 as text.

pub fn hmac_sha256(key: text, data: text) -> text

HMAC-SHA256 of data with key. Returns 64-char hex string.

pub fn base64_encode(data: text) -> text

Base64 encode a string.

pub fn base64_decode(data: text) -> text

Base64 decode to text. "" when data is not base64, or when its bytes are not UTF-8 — those are not text; base64_to_bytes reads them.

pub fn base64url_encode(data: text) -> text

Base64url encode (JWT-safe, no padding).

pub fn ed25519_public_key(secret_key_b64: text) -> text

Derive the 32-byte public key (base64) from a 32-byte secret seed (base64).

pub fn ed25519_sign(secret_key_b64: text, message_b64: text) -> text

Sign the base64 message bytes with the 32-byte secret seed (base64). Returns the 64-byte signature, base64.

pub fn ed25519_verify(public_key_b64: text, message_b64: text, signature_b64: text) -> boolean

Verify a signature over the base64 message bytes under a public key. Returns true iff the signature is valid.

pub fn ecdsa_p256_keygen() -> text

Generate a fresh 32-byte P-256 secret scalar (base64) from the OS CSPRNG.

pub fn ecdsa_p256_public_key(secret_key_b64: text) -> text

Derive the 64-byte public key x || y (base64) from a 32-byte secret scalar (base64).

pub fn ecdsa_p256_sign(secret_key_b64: text, message_b64: text) -> text

Sign the base64 message bytes with the 32-byte secret scalar (base64). Returns the 64-byte r || s signature (base64), deterministic per RFC 6979.

pub fn ecdsa_p256_verify(public_key_b64: text, message_b64: text, signature_b64: text) -> boolean

Verify an ES256 signature (64-byte r || s) over the base64 message bytes under a 64-byte x || y public key. Returns true iff the signature is valid.

pub fn x25519_dh(secret_key_b64: text, public_key_b64: text) -> text

A secret key is a 32-byte X25519 scalar (base64); a public key is the 32-byte u-coordinate (base64). Returns the raw 32-byte shared secret (base64), or "" if either input is the wrong length. Run the result through hkdf_sha256 before using it as a key (RFC 7748 §6.1).

pub fn hkdf_sha256(salt_b64: text, ikm_b64: text, info_b64: text, length: integer) -> text

Derive length bytes of output keying material from ikm, salt, and info (each base64). An empty base64 salt selects the all-zero salt. Returns the base64 OKM, or "" if length exceeds 255*32 or is <= 0, or an argument is not base64.

pub fn hkdf_extract(salt_b64: text, ikm_b64: text) -> text

HKDF-Extract (RFC 5869 §2.2): the 32-byte PRK (base64) HMAC-SHA256(salt, ikm). An empty base64 salt selects the all-zero salt; "" when an argument is not base64. Use the Extract/Expand halves directly (rather than hkdf_sha256) when a PRK is reused for several Expands or when an Extract output is itself the value you want (e.g. HPKE).

pub fn hkdf_expand(prk_b64: text, info_b64: text, length: integer) -> text

HKDF-Expand (RFC 5869 §2.3) from an existing 32-byte PRK. Returns length bytes of OKM (base64), or "" on a short PRK, length > 255*32, length <= 0, or an argument that is not base64.

pub fn bytes_to_base64(bytes: vector<u8>) -> text

Standard base64 of a raw byte vector. Empty vector -> "".

pub fn base64_to_bytes(b64: text) -> vector<u8>

Raw bytes from standard base64. Input that is not base64, or empty, -> empty vector.

pub fn aes256gcm_seal(key_b64: text, nonce_b64: text, aad_b64: text, plaintext_b64: text) -> text

Encrypt + authenticate plaintext under key/nonce, binding aad. Returns base64 of ciphertext WITH the 16-byte tag appended, or "" on bad key/nonce length or an argument that is not base64.

pub fn aes256gcm_open(key_b64: text, nonce_b64: text, aad_b64: text, ciphertext_b64: text) -> text

Verify + decrypt ciphertext (ciphertext||tag, base64) under key/nonce, binding aad. Returns the base64 plaintext, or "" on ANY authentication failure — an empty result means the ciphertext/tag/aad did not verify.

pub fn random_bytes(length: integer) -> text

Return length cryptographically secure random bytes (base64) from the OS RNG. Returns "" for length <= 0. Use for keys (32), nonces (12), salts.

pub struct HpkeSealed { const enc: text, const ciphertext: text }

The result of hpke_seal_base: the KEM-encapsulated key enc and the AEAD ciphertext (ciphertext||16-byte-tag), both base64.

pub fn hpke_seal_base(pk_r_b64: text, info_b64: text, aad_b64: text, pt_b64: text) -> HpkeSealed

HPKE SealBase (RFC 9180 §6.1): encrypt pt to recipient public key pk_r, binding info (key-schedule context) and aad (per-message AAD). Generates a fresh ephemeral key, so each call's output differs. All args/fields base64. Returns HpkeSealed { enc, ciphertext }; both "" on failure.

pub fn hpke_seal_base_deterministic(pk_r_b64: text, sk_e_b64: text, info_b64: text, aad_b64: text, pt_b64: text) -> HpkeSealed

Deterministic SealBase — TEST ONLY. Uses the caller-supplied ephemeral secret sk_e_b64 instead of a random one, so the output is reproducible against an RFC 9180 known-answer vector. Never use in production.

pub fn hpke_open_base(sk_r_b64: text, enc_b64: text, info_b64: text, aad_b64: text, ct_b64: text) -> text

HPKE OpenBase (RFC 9180 §6.1): decrypt ct for recipient secret key sk_r using the sender's enc, binding info and aad. All args base64. Returns the base64 plaintext, or "" on ANY failure (bad enc/key or AEAD auth failure).

pub fn hpke_key_schedule_base_for_test(shared_secret_b64: text, info_b64: text) -> (text, text)

Expose the key-schedule outputs for KAT assertions — TEST ONLY. Given a shared secret and base64 info, returns (key_b64, base_nonce_b64).

pub fn hpke_encap_deterministic_for_test(pk_r_b64: text, sk_e_b64: text) -> (text, text)

Expose deterministic Encap for KAT assertions — TEST ONLY. Returns (shared_secret_b64, enc_b64).