secretkey-encryption

Encryption for secret keys that are generated by NaCl.

The secret key is encrypted by deriving a key from the supplied password using scrypt-async and then using that derived key to encrypt the secret key with TweetNaCl.js's secretbox function.

API

All arrays of bytes are Uint8Arrays.

encryptSecretKey (password, secretKey, [logN], [r])

Arguments

• password - string or array of bytes
• secretKey - array of bytes
• logN (optional) - CPU/memory cost parameter (1 to 31). Defaults to 16.
• r (optional) - block size parameter. Defaults to 8.
• callback

Returns a promise, which when successful, resolves with an object containing the following properties

• encryptedSecretKey - array of bytes
• salt - 32 random bytes
• nonce - 24 random bytes
• logN
• blockSize

decryptEncryptedSecretKey (password, encryptedSecretKeyBundle)

Arguments

• password - string or array of bytes
• encryptedSecretKeyBundle - an object with parameters { encryptedSecretKey, salt, nonce, logN, blockSize }

Returns a promise

• that on successful decryption of the encrypted key, resolves with the secretKey (as an array of bytes)
• otherwise is rejected with a message (string)