Skip to content
ENC Protocol

identity-aead — identity-aead.js

The single-owner confidentiality plugin: deterministic AEAD for content only its owner reads — no ECDH, no key exchange, no rotation. The content key is HKDF(identity_priv, "enc-personal-private:" + lowercase(enclaveId)).

  • Suite: enc-xchacha-v1 (XChaCha20-Poly1305, 24-byte nonce)
  • Used by: personal for private content
  • Normative spec: identity-aead
import {
  identityAeadEncrypt, identityAeadDecrypt, identityAeadContentKey, identityAeadIsEnvelope,
} from '@enc-protocol/plugin-identity-aead'

API

identityAeadEncrypt(identityPriv, enclaveIdHex, plaintext)

ts
identityAeadEncrypt(identityPriv: Uint8Array, enclaveIdHex: string, plaintext: string)
  → { ciphertext: string, nonce: string }

Derives the owner content key and seals plaintext with a random 24-byte nonce. identityAeadEncryptWithNonce(identityPriv, enclaveIdHex, plaintext, nonce) is the deterministic variant used for the spec's known-answer vectors.

identityAeadDecrypt(identityPriv, enclaveIdHex, envelope)

ts
identityAeadDecrypt(identityPriv: Uint8Array, enclaveIdHex: string, envelope) → string

Validates the envelope shape, then derives the same content key and decrypts. Throws on a malformed envelope.

identityAeadContentKey(identityPriv, enclaveIdHex) / identityAeadIsEnvelope(content)

ts
identityAeadContentKey(identityPriv: Uint8Array, enclaveIdHex: string) → Uint8Array(32)
identityAeadIsEnvelope(content) → boolean

The key-derivation primitive and an envelope type guard. Because the key depends only on the owner's identity and the enclave id, there is nothing to exchange or rotate — the owner can always re-derive it.

Example

import { identityAeadEncrypt, identityAeadDecrypt } from '@enc-protocol/plugin-identity-aead'
 
// seal owner-only content — only this identity can re-derive the key
const env = identityAeadEncrypt(myIdentityPriv, enclaveId, 'private note')
// → { ciphertext, nonce }
 
const plain = identityAeadDecrypt(myIdentityPriv, enclaveId, env)
console.log(plain) // 'private note'

See also