diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/static/crypto.js')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/static/crypto.js | 73 |
1 files changed, 12 insertions, 61 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js index 1ddaa50..69b8c7a 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js @@ -8,7 +8,7 @@ * * Usage: * const gek = await importGEK(gekB64); - * const plaintext = await decryptChunk(gek, fileHashHex, chunkIndex, nonceB64, ctB64); + * const plaintext = await decryptChunkBin(gek, fileHashHex, chunkIndex, nonce, ct); */ const CIPHER_INFO_PREFIX = new TextEncoder().encode('file:'); @@ -63,65 +63,16 @@ async function deriveChunkKey(gek, fileHashHex, chunkIndex) { // ── Decryption ──────────────────────────────────────────────────────────────── -/** - * Decrypt one chunk of a private group file. - * @param {CryptoKey} gek - from importGEK() - * @param {string} fileHashHex - * @param {number} chunkIndex - * @param {string} nonceB64 - 12-byte nonce, base64 - * @param {string} ctB64 - ciphertext + GCM tag, base64 - * @returns {Promise<Uint8Array>} plaintext - */ -async function decryptChunk(gek, fileHashHex, chunkIndex, nonceB64, ctB64) { - const chunkKey = await deriveChunkKey(gek, fileHashHex, chunkIndex); - const nonce = b64decode(nonceB64); - const ct = b64decode(ctB64); - const plaintext = await crypto.subtle.decrypt( - { name: 'AES-GCM', iv: nonce }, - chunkKey, - ct, - ); - return new Uint8Array(plaintext); -} - -/** - * Decrypt a full file by fetching and decrypting all chunks in order. - * @param {CryptoKey} gek - * @param {string} nodeUrl - base URL of node HTTP API - * @param {string} fileId - blake3 hex hash (= file_id in index) - * @param {string} fileHashHex - same as fileId (blake3 of file content) - * @param {string} jwtToken - * @returns {Promise<Blob>} decrypted file as Blob - */ -async function decryptFile(gek, nodeUrl, fileId, fileHashHex, jwtToken) { - const chunks = []; - let chunkIdx = 0; - - while (true) { - const sep = nodeUrl.includes('?') ? '&' : '?'; - const url = `${nodeUrl}/file/${fileId}/${chunkIdx}${sep}token=${jwtToken}`; - const resp = await fetch(url); - if (!resp.ok) break; - - const data = await resp.json(); - if (data.encrypted === false) { - // Public group: data_b64 is plaintext - chunks.push(b64decode(data.data_b64)); - } else { - // Private group with AES-256-GCM - const plain = await decryptChunk( - gek, fileHashHex, chunkIdx, - data.nonce_b64, data.ct_b64, - ); - chunks.push(plain); - } - - if (data.plaintext_size < 1024 * 1024) break; // last chunk (< 1MB) - chunkIdx++; - } - - return new Blob(chunks); -} +// `decryptChunk` (base64) and `decryptFile` were removed on 2026-09-03. +// +// `decryptChunk` was the real path until Phase 9.15 moved chunks to a binary wire +// format; `decryptChunkBin` below replaced it, and MNP 0.15 removed the last node +// that could still emit the base64 shape (the QUIC encoder, left behind by 9.15). +// +// `decryptFile` was never called by anything, in any commit: it fetched +// `${nodeUrl}/file/${id}/${chunk}?token=` in a loop — the node's unauthenticated +// HTTP file API, which is finding C1 and was deleted in Phase 11.5. A client for an +// endpoint that no longer exists, kept alive only by being exported. // ── Helpers ─────────────────────────────────────────────────────────────────── @@ -420,7 +371,7 @@ async function verifyNodeSignature(nodePkB64, sigB64, transcript) { // Export for use in app.js window.MeshBayCrypto = { - importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile, + importGEK, deriveChunkKey, decryptChunkBin, generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode, adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding, joinTranscript, verifyNodeSignature, constantTimeEqual, |