암호 키 생성 및 등록시 최초 MEK도 함께 생성 및 등록하도록 구현

src/lib/hooks/gotoStateful.ts

@@ -6,6 +6,7 @@ interface KeyExportState {
   redirectPath: string;
   pubKeyBase64: string;
   privKeyBase64: string;
+  mekDraft: ArrayBuffer;
 }
 
 const useAutoNull = <T>(value: T | null) => {

src/lib/modules/crypto.ts

@@ -1,5 +1,13 @@
 export type RSAKeyType = "public" | "private";
 
+export const encodeToBase64 = (data: ArrayBuffer) => {
+  return btoa(String.fromCharCode(...new Uint8Array(data)));
+};
+
+export const decodeFromBase64 = (data: string) => {
+  return Uint8Array.from(atob(data), (c) => c.charCodeAt(0)).buffer;
+};
+
 export const generateRSAKeyPair = async () => {
   const keyPair = await window.crypto.subtle.generateKey(
     {
@@ -15,36 +23,71 @@ export const generateRSAKeyPair = async () => {
 };
 
 export const makeRSAKeyNonextractable = async (key: CryptoKey, type: RSAKeyType) => {
-  const format = type === "public" ? "spki" : "pkcs8";
-  const keyUsage = type === "public" ? "encrypt" : "decrypt";
+  const { format, key: exportedKey } = await exportRSAKey(key, type);
   return await window.crypto.subtle.importKey(
     format,
-    await window.crypto.subtle.exportKey(format, key),
+    exportedKey,
     {
       name: "RSA-OAEP",
       hash: "SHA-256",
     } satisfies RsaHashedImportParams,
     false,
-    [keyUsage],
+    [type === "public" ? "encrypt" : "decrypt"],
   );
 };
 
-export const exportRSAKeyToBase64 = async (key: CryptoKey, type: RSAKeyType) => {
-  const exportedKey = await window.crypto.subtle.exportKey(
-    type === "public" ? "spki" : "pkcs8",
-    key,
-  );
-  return btoa(String.fromCharCode(...new Uint8Array(exportedKey)));
+export const exportRSAKey = async (key: CryptoKey, type: RSAKeyType) => {
+  const format = type === "public" ? ("spki" as const) : ("pkcs8" as const);
+  return {
+    format,
+    key: await window.crypto.subtle.exportKey(format, key),
+  };
 };
 
-export const decryptRSACiphertext = async (ciphertext: string, privateKey: CryptoKey) => {
-  const ciphertextBuffer = Uint8Array.from(atob(ciphertext), (c) => c.charCodeAt(0));
-  const plaintext = await window.crypto.subtle.decrypt(
+export const encryptRSAPlaintext = async (plaintext: ArrayBuffer, publicKey: CryptoKey) => {
+  return await window.crypto.subtle.encrypt(
+    {
+      name: "RSA-OAEP",
+    } satisfies RsaOaepParams,
+    publicKey,
+    plaintext,
+  );
+};
+
+export const decryptRSACiphertext = async (ciphertext: ArrayBuffer, privateKey: CryptoKey) => {
+  return await window.crypto.subtle.decrypt(
     {
       name: "RSA-OAEP",
     } satisfies RsaOaepParams,
     privateKey,
-    ciphertextBuffer,
+    ciphertext,
   );
-  return btoa(String.fromCharCode(...new Uint8Array(plaintext)));
+};
+
+export const generateAESKey = async () => {
+  return await window.crypto.subtle.generateKey(
+    {
+      name: "AES-GCM",
+      length: 256,
+    } satisfies AesKeyGenParams,
+    true,
+    ["encrypt", "decrypt"],
+  );
+};
+
+export const makeAESKeyNonextractable = async (key: CryptoKey) => {
+  return await window.crypto.subtle.importKey(
+    "raw",
+    await exportAESKey(key),
+    {
+      name: "AES-GCM",
+      length: 256,
+    } satisfies AesKeyAlgorithm,
+    false,
+    ["encrypt", "decrypt"],
+  );
+};
+
+export const exportAESKey = async (key: CryptoKey) => {
+  return await window.crypto.subtle.exportKey("raw", key);
 };

src/lib/server/db/client.ts

@@ -1,4 +1,4 @@
-import { and, eq, gt, lte, count } from "drizzle-orm";
+import { and, eq, gt, lte } from "drizzle-orm";
 import db from "./drizzle";
 import { client, userClient, userClientChallenge } from "./schema";
 

src/lib/stores/key.ts

@@ -1,3 +1,4 @@
 import { writable } from "svelte/store";
 
 export const keyPairStore = writable<CryptoKeyPair | null>(null);
+export const mekStore = writable<Map<number, CryptoKey>>(new Map());