sattle/src/lnurlcash/passwordWrap.ts

// Password wraps protect serialized wallet secrets with authenticated AES-GCM.
// PBKDF2 parameters and wire fields stay centralized so legacy linking-key and
// v2 wallet-material records remain interoperable with their own readers.

import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';

const PBKDF2_ITERATIONS = 210_000;

const deriveAesKeyFromPassword = (password: string, salt: Uint8Array): Promise<CryptoKey> =>
  crypto.subtle
    .importKey('raw', utf8ToBytes(password), 'PBKDF2', false, ['deriveKey'])
    .then((baseKey) =>
      crypto.subtle.deriveKey(
        {
          name: 'PBKDF2',
          salt: new Uint8Array(salt),
          iterations: PBKDF2_ITERATIONS,
          hash: 'SHA-256',
        },
        baseKey,
        { name: 'AES-GCM', length: 256 },
        false,
        ['encrypt', 'decrypt'],
      ),
    );

export type EncryptedSecretParts = {
  readonly salt: string;
  readonly iv: string;
  readonly ciphertext: string;
};

export const encryptSecretParts = async (
  value: string,
  password: string,
): Promise<EncryptedSecretParts> => {
  const salt = crypto.getRandomValues(new Uint8Array(16));
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const aesKey = await deriveAesKeyFromPassword(password, salt);
  const ciphertext = new Uint8Array(
    await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, aesKey, utf8ToBytes(value)),
  );
  return {
    salt: bytesToHex(salt),
    iv: bytesToHex(iv),
    ciphertext: bytesToHex(ciphertext),
  };
};

export const decryptSecretParts = async (
  parts: EncryptedSecretParts,
  password: string,
): Promise<string> => {
  const salt = hexToBytes(parts.salt);
  const iv = hexToBytes(parts.iv);
  const aesKey = await deriveAesKeyFromPassword(password, salt);
  const plaintext = await crypto.subtle.decrypt(
    { name: 'AES-GCM', iv },
    aesKey,
    hexToBytes(parts.ciphertext),
  );
  return new TextDecoder().decode(plaintext);
};