Store Crypto KeyPairs securely in the browser

A tiny library with no third party dependencies other than browser APIs that allows generating and storing CryptoKeyPairs without the private key material ever being exposed directly to the browser.

Key pairs are generated and then stored as objects within IndexedDb with optional TTLs.

All this library does is wrap the integration between the Web Crypto API and IndexedDb to make it easier to store and retrieve non-extractable keys for signing/encryption in the browser.

It also provides a ttl option to automatically remove keys after a certain amount of time.

Supports ESM, UMD and the browser directly.

** PRs and contributions are welcome! **

Usage

npm install browser-crypto-secure-store

import { SecureStore } from 'browser-crypto-secure-store';

// Create a new instance of the SecureStore
const secureStore = new SecureStore();

// this creates and stores a non extractable keypair in indexedDB. RS256 is used by default 
const keyPair = await secureStore.setKey({ key: "key" } );

// create a new keypair with a TTL of 1 hour
const keyPair = await secureStore.setKey({ ley: "key", ttl: 3600 * 1000});

// create a new keypair with custom crypto configuration options
const options = {
    algorithm: {
        name: "RSA-OAEP",
        modulusLength: 2048,
        publicExponent: new Uint8Array([1, 0, 1]),
        hash: "SHA-256",
    },
    extractable: false,
    keyUsages: ["encrypt", "decrypt"],
}

const keyPair = await secureStore.setKey({ key: "key", options: options });

// Retreive the keyPair object
const keyPair = await secureStore.getKey("key");
const message = "Hello, World!";

// sign the message with our new private key
const signature = await window.crypto.subtle.sign(
    {
        name: "ECDSA",
        hash: { name: "SHA-256" },
    },
    keyPair.privateKey,
    new TextEncoder().encode(message),
);

// Remove the key from persistent storage

await removeKey("key");