JavaScript HSM API Dinamo
    Preparing search index...

    Cryptography Interface

    interface Cryptography {
        createCipherStream(options: HsmCipherOptions): HsmCipherStream;
        createHashStream(options: HsmHashOptions): HsmHashStream;
        hash(
            algorithm: HASH_ALGORITHMS,
            data: Buffer,
            keyName?: string | null,
        ): Promise<Buffer<ArrayBufferLike>>;
        cipher(
            options: HsmCipherOptions,
            data: Buffer,
        ): Promise<Buffer<ArrayBufferLike>>;
        encrypt(
            options: HsmCipherOptions,
            data: Buffer,
        ): Promise<Buffer<ArrayBufferLike>>;
        decrypt(
            options: HsmCipherOptions,
            data: Buffer,
        ): Promise<Buffer<ArrayBufferLike>>;
        mOfnSplit(
            m: number,
            n: number,
            secret?: string | null,
        ): Promise<hsm.interfaces.cryptography.MofNSplit>;
        mOfNRecover(
            parts: Buffer<ArrayBufferLike>[],
        ): Promise<Buffer<ArrayBufferLike>>;
        rsaSign(
            keyName: string,
            hashAlgorithm: HASH_ALGORITHMS,
            hash: Buffer,
            pad: PAD_TYPE,
        ): Promise<Buffer<ArrayBufferLike>>;
        rsaVerify(
            keyName: string,
            hashAlgorithm: HASH_ALGORITHMS,
            pad: PAD_TYPE,
            hash: Buffer,
            signature: Buffer,
        ): Promise<boolean>;
        eccSign(
            keyName: string,
            hashAlgorithm: HASH_ALGORITHMS,
            hash: Buffer,
        ): Promise<Buffer<ArrayBufferLike>>;
        eccVerify(
            keyName: string,
            hashAlgorithm: HASH_ALGORITHMS,
            hash: Buffer,
            signature: Buffer,
        ): Promise<boolean>;
        eddsaSign(keyName: string, hash: Buffer): Promise<Buffer<ArrayBufferLike>>;
        eddsaVerify(
            keyName: string,
            hash: Buffer,
            signature: Buffer,
        ): Promise<boolean>;
        dataUnenvelop(
            keyName: string,
            data: Buffer,
            paddingOption: ENC_DEC_PADDING,
        ): Promise<Buffer<ArrayBufferLike>>;
        dataEnvelop(
            pubKey: Buffer,
            keyLength: RSA_LENGTH_KEYS,
            data: Buffer,
            paddingOption: ENC_DEC_PADDING,
        ): Promise<Buffer<ArrayBufferLike>>;
        genRand(len: number): Promise<Buffer<ArrayBufferLike>>;
        mldsaSign(
            keyName: string,
            data: Buffer,
            deterministic?: boolean,
            preHash?: boolean,
            context?: Buffer<ArrayBufferLike>,
        ): Promise<Buffer<ArrayBufferLike>>;
        mldsaVerify(
            keyName: string,
            data: Buffer,
            signature: Buffer,
            deterministic?: boolean,
            preHash?: boolean,
            context?: Buffer<ArrayBufferLike>,
        ): Promise<boolean>;
    }
    Index

    Methods

    createCipherStream createHashStream hash cipher encrypt decrypt mOfnSplit mOfNRecover rsaSign rsaVerify eccSign eccVerify eddsaSign eddsaVerify dataUnenvelop dataEnvelop genRand mldsaSign mldsaVerify

    Methods

    • Performs an atomic (one-shot) hash operation. Processes all the data in a single call to the HSM.

      Parameters

      • algorithm: HASH_ALGORITHMS

        Hash algorithm to be used.

      • date: Buffer

        Data to process.

      • OptionalKeyName: string | null

        Key name in the HSM (optional; required for HMAC or CMAC).

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns the final digest generated by HSM.

      exceptions.HsmError If an error occurs during the hashing operation in the HSM.

      Sample code: Example of hash generation (one-shot)

    • Performs a generic symmetric encryption/decryption operation. Automatically selects between FAST mode (one-shot) and Stream mode based on the data size (1200-byte limit for FAST).

      Parameters

      • options: HsmCipherOptions

        Operation parameters (key, mode, IV). The "mode" field must include the direction (ENCRYPT/DECRYPT).

      • date: Buffer

        Data to process.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns the processed data (encrypted or decrypted).

      exceptions.HsmError If an error occurs during the HSM operation.

      Sample code: Example of symmetric encryption/decryption (one-shot)

    • Reconstructs the secret M of N from the parts of the custodians. According to Shamir's secret-sharing pattern.

      Parameters

      • parts: Buffer<ArrayBufferLike>[]

        Array of buffers with the parts of the secret generated by the Cryptography.mOfnSplit function.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer with the reconstructed secret.

      This method is legacy. Use interfaces.management.Management.recoverSVMK instead.

      exceptions.HsmError If the secret cannot be reconstructed or an error occurs in the operation.

      Example code: Reconstructing a secret in M from N

    • Signs data using an RSA private key.

      Parameters

      • keyName: string

        Key name.

      • hashAlgorithm: HASH_ALGORITHMS

        Algorithm used to generate the hash of the data.

      • hash: Buffer

        Hash of the data to be signed.

      • pad: PAD_TYPE

        Type of padding to be used in the signature.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer with the data signature.

      exceptions.HsmError If it is not possible to sign the data or there is an error in the operation.

      Example code: Signing hash with RSA

    • Verifies a data signature using an RSA key.

      Parameters

      • keyName: string

        Key name.

      • hashAlgorithm: HASH_ALGORITHMS

        Algorithm used to generate the hash of the data.

      • pad: PAD_TYPE

        Type of padding to be used in the signature.

      • hash: Buffer

        Hash of the data to be verified.

      • signature: Buffer

        Signature of the data to be verified.

      Returns Promise<boolean>

      Returns true if the signature is valid and false otherwise.

      exceptions.HsmError If it is not possible to verify the signature or an error occurs in the operation.

      Example code: Verifying hash signatures with RSA

    • Signs data using an ECC private key.

      Parameters

      • keyName: string

        Key name.

      • hashAlgorithm: HASH_ALGORITHMS

        Algorithm used to generate the hash of the data.

      • hash: Buffer

        Hash of the data to be signed.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer with the data signature.

      exceptions.HsmError If it is not possible to sign the data or there is an error in the operation.

      Example code: Signing hash with ECC

    • Verifies a data signature using an ECC key.

      Parameters

      • keyName: string

        Key name.

      • hashAlgorithm: HASH_ALGORITHMS

        Algorithm used to generate the hash of the data.

      • hash: Buffer

        Hash of the data to be verified.

      • signature: Buffer

        Signature of the data to be verified.

      Returns Promise<boolean>

      Returns true if the signature is valid and false otherwise.

      exceptions.HsmError If it is not possible to verify the signature or an error occurs in the operation.

      Example code: Verifying hash signatures with ECC

    • Signs data using an EdDSA private key.

      Parameters

      • keyName: string

        Key name.

      • hash: Buffer

        Hash of the data to be signed.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer with the data signature.

      exceptions.HsmError If it is not possible to sign the data or there is an error in the operation.

      Example code: Signing hash with EdDSA

    • Verifies a data signature using an EdDSA key.

      Parameters

      • keyName: string

        Key name.

      • hash: Buffer

        Hash of the data to be verified.

      • signature: Buffer

        Signature of the data to be verified.

      Returns Promise<boolean>

      Returns true if the signature is valid and false otherwise.

      exceptions.HsmError If it is not possible to verify the signature or an error occurs in the operation.

      Example code: Verifying hash signatures with EdDSA

    • Unwrap data using an RSA key.

      Parameters

      • keyName: string

        Name of the RSA private key.

      • date: Buffer

        Given that it will be de-enveloped.

      • paddingOption: ENC_DEC_PADDING

        Filling option used in data encryption.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns the de-enveloped data.

      exceptions.HsmError If it is not possible to de-envelope the data or an error occurs in the operation.

    • Envelopes data using an RSA public key.

      Parameters

      • pubKey: Buffer

        RSA public key that will be used to envelop the data.

      • keyLength: RSA_LENGTH_KEYS

        RSA key size.

      • date: Buffer

        Given that it will be enveloped.

      • paddingOption: ENC_DEC_PADDING

        Filling option used in data encryption.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns the enveloped data.

      exceptions.HsmError If the data cannot be enveloped or an error occurs in the operation.

    • Returns a set of pseudo-random bytes of size len for use in cryptography.

      Parameters

      • len: number

        Number of bytes to be generated. The value must be between 0 and 4294967295.

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer containing a set of pseudo-random bytes of size len.

      exceptions.HsmError If it is not possible to retrieve the bytes or there is an error in the operation.

      Example code: Generating a set of random bytes

    • Sign a message using an ML-DSA private key.

      Parameters

      • keyName: string

        Key name.

      • date: Buffer

        Data to be signed (maximum 4 MB).

      • Optionaldeterministic: boolean

        Whether the signature should be deterministic.

      • OptionalpreHash: boolean

        If the data passed is already the hash.

      • Optionalcontext: Buffer<ArrayBufferLike>

        Optional context for the signature (maximum 255 bytes).

      Returns Promise<Buffer<ArrayBufferLike>>

      Returns a buffer with the data signature.

      exceptions.HsmError If it is not possible to sign the data or there is an error in the operation.

      Sample code: Signing a message with ML-DSA

    • Verifies a signature on a piece of data using an ML-DSA key.

      Parameters

      • keyName: string

        Key name.

      • date: Buffer

        Signed data (maximum 4 MB).

      • signature: Buffer

        Signature to be verified.

      • Optionaldeterministic: boolean

        If the signature was generated deterministically.

      • OptionalpreHash: boolean

        If the data passed is already the hash.

      • Optionalcontext: Buffer<ArrayBufferLike>

        Optional context used in the signature (maximum 255 bytes).

      Returns Promise<boolean>

      Returns true if the signature is valid and false otherwise.

      exceptions.HsmError If it is not possible to verify the signature or an error occurs in the operation.

      Sample code: Verifying an ML-DSA signature

    Settings

    On This Page

    Methods