Function encryptMessage

samples/15-encryption.ts:1091–1107

(password: string, plaintext: string)

    // Envelope format: [salt:16][iv:12][ciphertext:n][authTag:16]

    async function encryptMessage(password: string, plaintext: string): Promise<Uint8Array> {
      const salt = crypto.randomBytes(16);
      const key = await deriveKey(password, salt);

      const { transform, getParams } = createAes256GcmEncryptTransform(key);
      const ciphertext = await Stream.bytes(Stream.pull(Stream.from(plaintext), transform));
      const params = getParams();

      // Build envelope
      const envelope = new Uint8Array(16 + 12 + ciphertext.length + 16);
      envelope.set(salt, 0);
      envelope.set(params.iv, 16);
      envelope.set(ciphertext, 28);
      envelope.set(params.authTag!, 28 + ciphertext.length);

      return envelope;
    }

    async function decryptMessage(password: string, envelope: Uint8Array): Promise<string> {
      const salt = envelope.slice(0, 16);