multipaz/org.multipaz.crypto/Crypto

Crypto

expect object Crypto

Cryptographic support routines.

This object contains various cryptographic primitives and is a wrapper to a platform-specific crypto library.

For post-quantum cryptography algorithms (ML-DSA and ML-KEM) to work on the JVM or Android, the bcprov package (org.bouncycastle:bcprov-jdk18on) must be present on the classpath. It is consumed via reflection to avoid pulling in a large dependency into the core SDK.

actual object Crypto

Cryptographic support routines.

This object contains various cryptographic primitives and is a wrapper to a platform- specific crypto library.

actual object Crypto

Properties

provider

expect val provider: String

A human-readable description of the underlying library used.

actual val provider: String

secureRandom

expect val secureRandom: Random

A cryptographically secure pseudo-random number generator (CSPRNG).

actual val secureRandom: Random

supportedCurves

expect val supportedCurves: Set<EcCurve>

The Elliptic Curve Cryptography curves supported by the platform.

actual val supportedCurves: Set<EcCurve>

CryptoKit supports the following curves from EcCurve.

actual val supportedCurves: Set<EcCurve>

supportedEncryptionAlgorithms

expect val supportedEncryptionAlgorithms: Set<Algorithm>

The encryption algorithms supported by the platform.

actual val supportedEncryptionAlgorithms: Set<Algorithm>

supportedMlDsaAlgorithms

expect val supportedMlDsaAlgorithms: Set<Algorithm>

The ML-DSA algorithms supported by the platform.

actual val supportedMlDsaAlgorithms: Set<Algorithm>

The ML-DSA algorithms supported by the platform.

actual val supportedMlDsaAlgorithms: Set<Algorithm>

supportedMlKemAlgorithms

expect val supportedMlKemAlgorithms: Set<Algorithm>

The ML-KEM algorithms supported by the platform.

actual val supportedMlKemAlgorithms: Set<Algorithm>

The ML-KEM algorithms supported by the platform.

actual val supportedMlKemAlgorithms: Set<Algorithm>

Functions

checkSignature

expect suspend fun checkSignature(publicKey: EcPublicKey, message: ByteArray, algorithm: Algorithm, signature: EcSignature)

Checks signature validity.

expect suspend fun checkSignature(publicKey: MlDsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: MlDsaSignature)

Checks signature validity for an ML-DSA key.

expect suspend fun checkSignature(publicKey: RsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: RsaSignature)

Checks signature validity for an RSA key.

actual suspend fun checkSignature(publicKey: EcPublicKey, message: ByteArray, algorithm: Algorithm, signature: EcSignature)

actual suspend fun checkSignature(publicKey: MlDsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: MlDsaSignature)

actual suspend fun checkSignature(publicKey: RsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: RsaSignature)

actual suspend fun checkSignature(publicKey: EcPublicKey, message: ByteArray, algorithm: Algorithm, signature: EcSignature)

Checks signature validity.

actual suspend fun checkSignature(publicKey: MlDsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: MlDsaSignature)

actual suspend fun checkSignature(publicKey: RsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: RsaSignature)

actual suspend fun checkSignature(publicKey: EcPublicKey, message: ByteArray, algorithm: Algorithm, signature: EcSignature)

actual suspend fun checkSignature(publicKey: MlDsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: MlDsaSignature)

actual suspend fun checkSignature(publicKey: RsaPublicKey, message: ByteArray, algorithm: Algorithm, signature: RsaSignature)

checkSignature

suspend fun Crypto.checkSignature(publicKey: PublicKey, message: ByteArray, algorithm: Algorithm, signature: Signature)

Checks signature validity for a generic PublicKey and Signature.

createEcPrivateKey

expect suspend fun createEcPrivateKey(curve: EcCurve): EcPrivateKey

Creates an EC private key.

actual suspend fun createEcPrivateKey(curve: EcCurve): EcPrivateKey

Creates an EC private key.

actual suspend fun createEcPrivateKey(curve: EcCurve): EcPrivateKey

createMlDsaPrivateKey

expect suspend fun createMlDsaPrivateKey(algorithm: Algorithm = Algorithm.ML_DSA_65): MlDsaPrivateKey

Creates an ML-DSA private key.

actual suspend fun createMlDsaPrivateKey(algorithm: Algorithm): MlDsaPrivateKey

createMlKemPrivateKey

expect suspend fun createMlKemPrivateKey(algorithm: Algorithm = Algorithm.ML_KEM_768): MlKemPrivateKey

Creates an ML-KEM private key.

actual suspend fun createMlKemPrivateKey(algorithm: Algorithm): MlKemPrivateKey

createRsaPrivateKey

expect suspend fun createRsaPrivateKey(keySizeBits: Int = 2048): RsaPrivateKey

Creates an RSA private key.

actual suspend fun createRsaPrivateKey(keySizeBits: Int): RsaPrivateKey

decrypt

expect suspend fun decrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messageCiphertext: ByteArray, aad: ByteArray? = null): ByteArray

Message decryption.

actual suspend fun decrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messageCiphertext: ByteArray, aad: ByteArray?): ByteArray

Message decryption.

actual suspend fun decrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messageCiphertext: ByteArray, aad: ByteArray?): ByteArray

digest

expect suspend fun digest(algorithm: Algorithm, message: ByteArray): ByteArray

Message digest function.

actual suspend fun digest(algorithm: Algorithm, message: ByteArray): ByteArray

Message digest function.

actual suspend fun digest(algorithm: Algorithm, message: ByteArray): ByteArray

encrypt

expect suspend fun encrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messagePlaintext: ByteArray, aad: ByteArray? = null): ByteArray

Message encryption.

actual suspend fun encrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messagePlaintext: ByteArray, aad: ByteArray?): ByteArray

Message encryption.

actual suspend fun encrypt(algorithm: Algorithm, key: SecretKey, nonce: ByteArray, messagePlaintext: ByteArray, aad: ByteArray?): ByteArray

kemDecapsulate

expect suspend fun kemDecapsulate(key: MlKemPrivateKey, ciphertext: ByteArray): SecureByteString

Decapsulates a shared secret using an ML-KEM private key and ciphertext.

actual suspend fun kemDecapsulate(key: MlKemPrivateKey, ciphertext: ByteArray): SecureByteString

kemEncapsulate

expect suspend fun kemEncapsulate(recipientPublicKey: MlKemPublicKey): KemResult

Encapsulates a shared secret using an ML-KEM recipient public key.

actual suspend fun kemEncapsulate(recipientPublicKey: MlKemPublicKey): KemResult

keyAgreement

expect suspend fun keyAgreement(key: EcPrivateKey, otherKey: EcPublicKey): SecureByteString

Performs Key Agreement.

actual suspend fun keyAgreement(key: EcPrivateKey, otherKey: EcPublicKey): SecureByteString

Performs Key Agreement.

actual suspend fun keyAgreement(key: EcPrivateKey, otherKey: EcPublicKey): SecureByteString

mac

expect suspend fun mac(algorithm: Algorithm, key: SecretKey, message: ByteArray): ByteArray

Message authentication code function.

actual suspend fun mac(algorithm: Algorithm, key: SecretKey, message: ByteArray): ByteArray

Message authentication code function.

actual suspend fun mac(algorithm: Algorithm, key: SecretKey, message: ByteArray): ByteArray

sign

expect suspend fun sign(key: EcPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): EcSignature

Signs data with a key.

expect suspend fun sign(key: MlDsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): MlDsaSignature

Signs data with an ML-DSA key.

expect suspend fun sign(key: RsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): RsaSignature

Signs data with an RSA key.

actual suspend fun sign(key: EcPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): EcSignature

actual suspend fun sign(key: MlDsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): MlDsaSignature

actual suspend fun sign(key: RsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): RsaSignature

actual suspend fun sign(key: EcPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): EcSignature

Signs data with a key.

actual suspend fun sign(key: MlDsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): MlDsaSignature

actual suspend fun sign(key: RsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): RsaSignature

actual suspend fun sign(key: EcPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): EcSignature

actual suspend fun sign(key: MlDsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): MlDsaSignature

actual suspend fun sign(key: RsaPrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): RsaSignature

sign

suspend fun Crypto.sign(key: PrivateKey, signatureAlgorithm: Algorithm, message: ByteArray): Signature

Signs data with a private key.