CryptoApi

Signs arbitrary data with the user's private key. Computes an ECDSA signature over the SHA-256 hash of data using the secp256k1 key decoded from WIF - entirely inside the WASM core, locally. Use it to prove authorship of application-level payloads; the counterpart verifySignature checks the result against the signer's public key.

Params

Checks whether a signature was produced over the given data by the owner of the given public key. Verifies the compact ECDSA (secp256k1, SHA-256) signature locally in the WASM core - no server involvement. Use it to authenticate payloads signed with signData; obtain the signer's public key from Connection.listContextUsers or derivePublicKey.

Params

Generates a new private ECC (secp256k1) key - the user's identity in PrivMX. Runs locally in the WASM core: the seed (or secure random bytes) is stretched with PBKDF2 (200 000 rounds, SHA-512) over a random salt into a BIP-32 extended key, whose private part is returned in WIF format. The random salt makes the result non-deterministic even for the same seed - for repeatable derivation use derivePrivateKey2. Generate one key per user at registration, derive its public part with derivePublicKey for the Context ACL, and pass the private key to EndpointFactory.connect.

Params

Deterministically derives a private ECC key from a password (legacy variant). Stretches the password with PBKDF2 locally in the WASM core, using an older derivation scheme kept only so keys created by previous SDK versions remain reachable. Use it exclusively to recover keys originally derived with this method; for anything new call derivePrivateKey2.

Params

Deterministically derives a private ECC (secp256k1) key from a password - the recommended path for password-based login. Runs PBKDF2 (200 000 rounds, SHA-512) over the password and salt locally in the WASM core and converts the result to a WIF private key. The same password and salt always produce the same key, and the password never leaves the browser. Use it so users can log in with familiar credentials: derive the key on every login and pass it to EndpointFactory.connect - no key storage needed.

Params

Computes the public key matching a private key. Multiplies the secp256k1 base point by the decoded WIF key locally in the WASM core - a pure, deterministic EC operation. The public key is what other users (and the Bridge) see: register it in the Context ACL, list it in UserWithPubKey arrays when creating containers, and hand it to verifySignature.

Params

Generates a fresh random symmetric encryption key. Draws 32 random bytes (a 256-bit AES key) from the WASM core's CSPRNG - locally, with no server involvement. Use it as the key for encryptDataSymmetric / decryptDataSymmetric when the application needs to encrypt data outside of PrivMX containers.

Encrypts a buffer with a symmetric key. Applies the core's authenticated AES-256 scheme locally in the WASM module, embedding an integrity tag so tampering is detected on decryption. Use it for application-level encryption of data you store outside PrivMX containers; reverse with decryptDataSymmetric using the same key.

Params

Decrypts a buffer produced by encryptDataSymmetric. Runs the core's authenticated AES-256 decryption locally in the WASM module and verifies the embedded integrity tag before returning any plaintext. Use it with the same 32-byte key the data was encrypted with; a wrong key or modified ciphertext is rejected rather than yielding garbage.

Params

Converts a private key from PEM encoding to the WIF format used across PrivMX. Re-encodes the key material locally in the WASM core - no cryptographic transformation, only a format change. Use it to import keys generated by external tools (e.g. OpenSSL) so they can be passed to EndpointFactory.connect or signData.

Params

Generates a fresh BIP-39 mnemonic together with the BIP-32 key it encodes. Draws strength bits of entropy locally in the WASM core, encodes them as a standard 12/24-word English mnemonic, and derives the matching BIP-32 extended key (optionally hardened with a password). Use it to give users a human-writable backup phrase: show result.mnemonic once, then use result.extKey (an ExtKey) - e.g. extKey.getPrivateKey() - for EndpointFactory.connect. Restore later with fromMnemonic.

Params

Restores a BIP-32 key from a previously issued BIP-39 mnemonic. Validates the word list and recomputes the extended key locally in the WASM core - deterministic, so the same mnemonic and password always reproduce the same key. Use it for account recovery: ask the user for the phrase generated by generateBip39, then connect with the restored key's private part.

Params

Builds a BIP-39 mnemonic and BIP-32 key directly from raw entropy bytes. Encodes the entropy as a standard mnemonic and derives the extended key locally in the WASM core - the byte-level equivalent of fromMnemonic. Use it when the application stores raw entropy (e.g. from mnemonicToEntropy) instead of the word list.

Params

Encodes raw BIP-39 entropy as its mnemonic word list. Pure local conversion in the WASM core (entropy + checksum → words) - no key derivation happens. Use it to display a backup phrase for entropy the application already holds; mnemonicToEntropy performs the inverse.

Params

Decodes a BIP-39 mnemonic back into its raw entropy bytes. Pure local conversion in the WASM core (words → entropy, checksum verified) - the inverse of entropyToMnemonic. Use it when the application prefers to persist compact entropy bytes rather than the word list; restore the key later with fromEntropy.

Params

Stretches a BIP-39 mnemonic into the 64-byte seed defined by the BIP-39 standard. Runs PBKDF2 over the mnemonic and optional password locally in the WASM core, exactly as BIP-39 specifies - deterministic for the same inputs. Use the seed for interoperability with other BIP-32 wallets/tools, or feed it to ExtKey.fromSeed to build an extended key directly.

Params