CKeyManager Class

Static cryptographic key lifecycle management utility for Katlux applications. Provides key generation, JWK import/export, key wrapping (AES-KW and RSA-OAEP), and Key Derivation Functions (PBKDF2 and HKDF) using native browser and Node.js Web Crypto APIs.

🔒 CWebCryptoEncryptionProvider · 🔐 CECDHEncryptionProvider · 🔐 CRSAEncryptionProvider · 🔑 IKeyPair · ⚙️ IKDFOptions

Generate, export, wrap, and derive keys without requiring external libraries or WASM dependencies:

import { CKeyManager } from '@katlux/providers'

// 1. Generate and export AES key
// Security note: exportAESKey exports raw key bytes (plaintext). Never expose raw keys in client code; use wrapKey before transit.
const aesKey = await CKeyManager.generateAESKey(256, 'AES-GCM')
const base64Key = await CKeyManager.exportAESKey(aesKey)

// 2. Derive key from human passphrase using PBKDF2 (310,000 rounds)
const { key, salt } = await CKeyManager.deriveKey('user-passphrase', {
    kdf: 'pbkdf2',
    iterations: 310_000,
    hash: 'SHA-256'
})

// 3. Wrap an Account Symmetric Key with AES-KW
const kek = await CKeyManager.generateAESKey(256, 'AES-KW')
const wrapped = await CKeyManager.wrapKey(aesKey, kek)
const unwrapped = await CKeyManager.unwrapKey(wrapped, kek)

Method	Signature	Description
generateAESKey	`generateAESKey(length?: 128 \| 256, algorithm?: 'AES-GCM' \| 'AES-CBC' \| 'AES-KW', extractable?: boolean): Promise<CryptoKey>`	Generates an AES CryptoKey for encryption or key wrapping.
generateAccountDataKey	`generateAccountDataKey(extractable?: boolean): Promise<CryptoKey>`	Generates a 256-bit AES-GCM Account Data Encryption Key (ADEK) for multi-user tenant storage. Defaults to non-extractable (extractable: false) for defense against exfiltration.
exportAESKey	`exportAESKey(key: CryptoKey): Promise<string>`	Exports an AES key as a raw base64 string.
importAESKey	`importAESKey(base64: string, algorithm?: 'AES-GCM' \| 'AES-CBC' \| 'AES-KW'): Promise<CryptoKey>`	Imports an AES CryptoKey from a raw base64 string.

Method	Signature	Description
generateRSAKeyPair	`generateRSAKeyPair(bits?: 2048 \| 4096, hash?: 'SHA-256' \| 'SHA-512'): Promise<IKeyPair>`	Generates an RSA-OAEP public/private key pair.
generateECDHKeyPair	`generateECDHKeyPair(curve?: 'P-256' \| 'P-384' \| 'P-521'): Promise<IKeyPair>`	Generates an ECDH public/private key pair.
exportPublicKey / exportPrivateKey	`exportPublicKey(key: CryptoKey): Promise<JsonWebKey>`	Exports public or private keys as standard JSON Web Keys (JWK).
importPublicKey / importPrivateKey	`importPublicKey(jwk: JsonWebKey): Promise<CryptoKey>`	Imports keys from JWK format with proper Web Crypto usages.

Method	Signature	Description
wrapKey	`wrapKey(keyToWrap: CryptoKey, wrappingKey: CryptoKey): Promise<string>`	Wraps a target key with AES-KW or RSA-OAEP and returns base64 string.
unwrapKey	`unwrapKey(wrappedBase64: string, unwrappingKey: CryptoKey): Promise<CryptoKey>`	Unwraps a base64 string back into an active CryptoKey.
wrapAccountKeyForUser	`wrapAccountKeyForUser(accountKey: CryptoKey, userPublicKey: CryptoKey): Promise<string>`	Wraps an Account Data Encryption Key (ADEK) using the recipient user's RSA-OAEP public key.
unwrapAccountKeyForUser	`unwrapAccountKeyForUser(wrappedKeyBase64: string, userPrivateKey: CryptoKey, algorithm?: any, extractable?: boolean): Promise<CryptoKey>`	Unwraps an ADEK using a user's private key. Yields a non-extractable (extractable: false default) AES-GCM CryptoKey.
deriveKey	`deriveKey(passphrase: string, options: IKDFOptions): Promise<{ key: CryptoKey; salt: string }>`	Derives an AES-GCM key from a passphrase using PBKDF2 or HKDF.
deriveKeyFromSecret	`deriveKeyFromSecret(secretKey: CryptoKey, options?: Omit<IKDFOptions, 'kdf'>): Promise<CryptoKey>`	Derives an AES-GCM key from high-entropy secrets (e.g. ECDH shared secret) using HKDF.