ExtKey

Called by EndpointFactory during WASM initialisation.

Params

Builds the root extended key of a BIP-32 tree from a binary seed. Runs the standard BIP-32 master-key derivation (HMAC-SHA512 over the seed) locally in the WASM core, yielding the private key and chain code. Use it to recreate a deterministic key hierarchy from stored entropy - typically a 64-byte seed produced by CryptoApi.mnemonicToSeed - then derive children with derive or deriveHardened.

Params

Reconstructs an extended key from its Base58 serialisation. Decodes the standard BIP-32 Base58 string (key material + chain code) locally in the WASM core; whether the result is private or public depends on which part was serialised. Use it to restore a key previously exported with getPrivatePartAsBase58 or getPublicPartAsBase58 - e.g. one persisted by the application or received from another device.

Params

Creates a brand-new random extended key. Draws fresh entropy from the WASM core's CSPRNG and derives a BIP-32 private key with chain code - locally, with no server involvement. Use it as the root of a new key hierarchy when no mnemonic backup is needed; otherwise prefer CryptoApi.generateBip39, which also yields a recovery phrase. Persist the key with getPrivatePartAsBase58.

Derives the normal (non-hardened) child key at the given index. Runs BIP-32 child derivation (HMAC-SHA512 over the parent chain code and key) locally in the WASM core; the same parent and index always yield the same child. Use it to give each purpose (device, sub-account, Context) its own key under one root. Note that normal derivation also works from a public-only key, so a leaked parent public key plus any child private key exposes siblings - use deriveHardened where that matters.

Params

Derives the hardened child key at the given index. Runs BIP-32 hardened derivation locally in the WASM core - the parent private key (not just the public part) enters the HMAC, so hardened children cannot be linked to or derived from the parent public key. Prefer it over derive for identity keys, where a compromised child must not endanger its siblings; it requires a private parent (see isPrivate).

Params

Serialises the full private extended key (private key + chain code) to Base58. Encodes the standard BIP-32 serialisation locally in the WASM core - the resulting string contains secret material capable of deriving the whole subtree. Use it to persist or transfer the key; restore later with fromBase58. Treat the string like a password.

Serialises the public part of the extended key (public key + chain code) to Base58. Encodes the standard BIP-32 public serialisation locally in the WASM core; it contains no secret material but still allows deriving the subtree's non-hardened public keys. Share it where another party needs to derive or verify child public keys without being able to sign; restore with fromBase58.

Extracts this node's plain ECC private key in WIF format. Strips the BIP-32 wrapping locally in the WASM core, leaving just the secp256k1 private key - the format the rest of the SDK works with. Use the result as the user's identity key for EndpointFactory.connect or for CryptoApi.signData.

Extracts this node's plain ECC public key in BASE58DER format. Strips the BIP-32 wrapping locally in the WASM core, leaving just the secp256k1 public key - the counterpart of getPrivateKey. Use it wherever PrivMX expects a user's public key: Context ACLs, UserWithPubKey arrays, or CryptoApi.verifySignature.

Extracts the raw 32-byte private key, suitable for symmetric-style use. Returns the unencoded secp256k1 scalar from the WASM core - no WIF or Base58 wrapping, just the bytes. Use it when a derived key should serve as raw secret material for a custom scheme (e.g. as input to CryptoFacade.importKeyAndWipeMaterial); for PrivMX APIs prefer the WIF form from getPrivateKey.

Computes the Bitcoin-style Base58 address of this node's public key. Hashes the secp256k1 public key (SHA-256 then RIPEMD-160) and Base58Check-encodes the result locally in the WASM core. Use it as a short, human-comparable fingerprint of the public key - e.g. for display or out-of-band identity verification.

Returns the BIP-32 chain code of this extended key. Reads the 32-byte chain code (the non-key half of the extended key that makes child derivation possible) from the WASM core. Use it for interoperability with external BIP-32 implementations that accept key and chain code separately. The chain code alone is not secret, but combined with a child private key it can expose siblings.

Verifies a compact ECDSA signature against this key's public part. Hashes the message and checks the compact (r‖s with recovery byte) secp256k1 signature locally in the WASM core. Use it to authenticate messages signed by the holder of this key's private part - e.g. signatures produced with CryptoApi.signData by the key from getPrivateKey.

Params

Tells whether this extended key contains the private part. Inspects the key material held in the WASM core - a purely local check with no derivation involved. Check it before calling private-only operations (getPrivateKey, getPrivatePartAsBase58, deriveHardened) on keys restored with fromBase58, which may be public-only.