CECDHEncryptionProvider Class

Modern Asymmetric / Hybrid encryption provider using Elliptic Curve Diffie-Hellman (ECDH) with HKDF key derivation and AES-GCM-256 authenticated encryption. Offers fast key agreement, compact key sizes, and sender-side freshness via ephemeral key pairs.

🏛️ AEncryptionProvider (Base Class) · 🔐 CRSAEncryptionProvider (RSA) · 🧰 CKeyManager (Key Utilities) · 🔑 IKeyPair Interface

Ephemeral-Static ECDH Key Agreement

For every encryption call, CECDHEncryptionProvider generates a one-time ephemeral ECDH key pair. It performs key agreement with the recipient's static public key, derives an AES-GCM key via HKDF, and embeds the ephemeral public key (epk) in the envelope. Note: Because the recipient uses a persistent static keypair, sender freshness is guaranteed, but prospective compromise of the recipient private key allows retrospective decryption of past ciphertexts.

import { CECDHEncryptionProvider } from '@katlux/providers'

// 1. Generate recipient's persistent ECDH keypair (e.g. NIST P-256)
const recipientKeys = await CECDHEncryptionProvider.generateKeyPair('P-256')

// 2. Sender encrypts with recipient's public key
const sender = new CECDHEncryptionProvider(recipientKeys.publicKey)
const envelope = await sender.encrypt({
    ledgerAccount: 'ACC-MAIN',
    secretBalance: 154000
})

console.log(envelope)
// {
//   __encrypted: true,
//   ciphertext: "y9Jq...",
//   iv: "12-byte-iv...",
//   epk: { kty: "EC", crv: "P-256", x: "...", y: "..." },
//   alg: "ECDH-P-256+AES-GCM-256"
// }

// 3. Recipient decrypts with private key
const recipient = new CECDHEncryptionProvider(undefined, recipientKeys.privateKey)
const decrypted = await recipient.decrypt(envelope)
console.log(decrypted.ledgerAccount) // "ACC-MAIN"