Function encryptWithPublicKey

packages/encryption/src/encryption.ts:44–97

(
  value: string,
  publicKeyPem: string | Buffer,
  aad?: string
)

 * 4. Return both encrypted data and encrypted DEK
 */
export function encryptWithPublicKey(
  value: string,
  publicKeyPem: string | Buffer,
  aad?: string
): EncryptedEnvelope {
  if (!publicKeyPem) {
    throw new EncryptionConfigurationError('Public key parameter is required');
  }

  try {
    const dek = generateKeySync('aes', { length: 256 });
    const dekBuffer = dek.export();

    const iv = randomBytes(16);
    const cipher = createCipheriv('aes-256-gcm', dekBuffer, iv);
    if (aad !== undefined) {
      cipher.setAAD(Buffer.from(aad, 'utf8'));
    }

    let encrypted = cipher.update(value, 'utf8');
    encrypted = Buffer.concat([encrypted, cipher.final()]);

    const authTag = cipher.getAuthTag();

    // Combine iv, encrypted data, and authTag for storage
    const encryptedDataBuffer = Buffer.concat([iv, encrypted, authTag]);
    const encryptedData = encryptedDataBuffer.toString('base64');

    // Encrypt DEK with RSA public key
    const encryptedDEKBuffer = publicEncrypt(
      {
        key: publicKeyPem,
        padding: constants.RSA_PKCS1_OAEP_PADDING,
        oaepHash: 'sha256',
      },
      dekBuffer
    );
    const encryptedDEK = encryptedDEKBuffer.toString('base64');

    return {
      encryptedData,
      encryptedDEK,
      algorithm: 'rsa-aes-256-gcm',
      version: 1,
    };
  } catch (error) {
    if (error instanceof Error) {
      throw new EncryptionConfigurationError(`Encryption failed: ${error.message}`, {
        cause: error,
      });
    }
    throw new EncryptionConfigurationError('Encryption failed with unknown error');
  }
}

/**
 * Decrypts envelope-encrypted data using RSA private key