CRSAEncryptionProvider Class

Asymmetric / Hybrid encryption provider combining RSA-OAEP (2048 or 4096-bit) with AES-GCM-256. Enables encrypting payloads of arbitrary size using a recipient's public key, where only the recipient holding the private key can decrypt.

🏛️ AEncryptionProvider (Base Class) · 🔐 CECDHEncryptionProvider (ECDH) · 🧰 CKeyManager (Key Utilities) · 🔑 IKeyPair Interface

Hybrid RSA-OAEP Encryption

Direct RSA encryption cannot encrypt data larger than ~446 bytes (RSA-4096). CRSAEncryptionProvider solves this by generating an ephemeral 256-bit AES-GCM data key, encrypting the payload with AES-GCM, and wrapping the AES key with the recipient's RSA-OAEP public key:

import { CRSAEncryptionProvider } from '@katlux/providers'

// 1. Generate an RSA-4096 key pair
const keyPair = await CRSAEncryptionProvider.generateKeyPair(4096)

// 2. Encrypt using the recipient's public key
const encryptor = new CRSAEncryptionProvider(keyPair.publicKey)
const envelope = await encryptor.encrypt({
    accountLedger: 'LEDGER-MAIN',
    secretData: 'Sensitive financial statement'
})

console.log(envelope)
// {
//   __encrypted: true,
//   ciphertext: "x7Km...",
//   iv: "9zLp...",
//   wrappedKey: "rsa-wrapped-aes-key...",
//   alg: "RSA-OAEP-4096+AES-GCM-256"
// }

// 3. Decrypt using the recipient's private key
const decryptor = new CRSAEncryptionProvider(undefined, keyPair.privateKey)
const decrypted = await decryptor.decrypt(envelope)
console.log(decrypted.accountLedger) // "LEDGER-MAIN"