Function wrapCryptoKey

backend/src/utils/key-ops.ts:52–71

(
	keyToWrap: CryptoKey,
	userKEK: string
)

Wrap the given key.
*/
async function wrapCryptoKey(
	keyToWrap: CryptoKey,
	userKEK: string
): Promise<{ wrappedPrivKey: ArrayBuffer; salt: Uint8Array }> {
	// get the key encryption key
	const keyMaterial = await getKeyMaterial(userKEK)
	const salt = crypto.getRandomValues(new Uint8Array(16))
	const wrappingKey = await getKey(keyMaterial, salt)
	const bytesToWrap = await crypto.subtle.exportKey('pkcs8', keyToWrap)
	const wrappedPrivKey = await crypto.subtle.encrypt(
		{
			name: 'AES-GCM',
			iv: salt,
		},
		wrappingKey,
		bytesToWrap as ArrayBuffer
	)

	return { wrappedPrivKey, salt }
}

/*
Generate a new wrapped user key