{"id":21721044,"url":"https://github.com/SocialGouv/aes-gcm-rsa-oaep","last_synced_at":"2025-07-18T17:30:37.842Z","repository":{"id":51022620,"uuid":"338122717","full_name":"SocialGouv/aes-gcm-rsa-oaep","owner":"SocialGouv","description":"Kubeseal aes-gcm-rsa-oaep encryption implementaton in TypeScript","archived":false,"fork":true,"pushed_at":"2024-11-12T10:21:21.000Z","size":311,"stargazers_count":12,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-25T09:02:07.728Z","etag":null,"topics":["cryptography","kubernetes","sealed-secrets"],"latest_commit_sha":null,"homepage":"http://socialgouv.github.io/webseal","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"cberthou/aes-gcm-rsa-oaep","license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SocialGouv.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-02-11T18:55:33.000Z","updated_at":"2025-04-17T15:43:46.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SocialGouv/aes-gcm-rsa-oaep","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/SocialGouv/aes-gcm-rsa-oaep","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SocialGouv%2Faes-gcm-rsa-oaep","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SocialGouv%2Faes-gcm-rsa-oaep/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SocialGouv%2Faes-gcm-rsa-oaep/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SocialGouv%2Faes-gcm-rsa-oaep/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SocialGouv","download_url":"https://codeload.github.com/SocialGouv/aes-gcm-rsa-oaep/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SocialGouv%2Faes-gcm-rsa-oaep/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265801584,"owners_count":23830438,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cryptography","kubernetes","sealed-secrets"],"created_at":"2024-11-26T02:03:27.676Z","updated_at":"2025-07-18T17:30:37.428Z","avatar_url":"https://github.com/SocialGouv.png","language":"TypeScript","funding_links":[],"categories":["TypeScript"],"sub_categories":[],"readme":"# AES-GCM + RSA OAEP encryption \u003ca href=\"https://www.npmjs.com/package/@socialgouv/aes-gcm-rsa-oaep\"\u003e\u003cimg src=\"https://img.shields.io/npm/v/@socialgouv/aes-gcm-rsa-oaep.svg\" alt=\"Npm version\"\u003e\u003c/a\u003e \n\n\nAES-GCM + RSA-OAEP encryption/decryption using WebCrypto API in NodeJS or in the browser\n\nTests uses `@peculiar/webcrypto` for polyfilling browser crypto api.\n\nThis can be used to replace [kubeseal](https://github.com/bitnami-labs/sealed-secrets) encryption in JavaScript environments.\n\nSee demo : http://socialgouv.github.io/webseal\n\n## Usage\n\n### High level\n\n```js\nimport { encryptValue, encryptValues, getSealedSecret } from \"@socialgouv/aes-gcm-rsa-oaep\"\n\n// encrypt single value\nconst encryptedValue =  encryptValue({\n  pemKey: \"somekey\",\n  scope: \"cluster\",\n  namespace: \"dev\",\n  name: \"my-secret\",\n  value: \"plain-value\";\n});\n\n// encrypt multiple values\nconst encryptedValue =  encryptValues({\n  pemKey: \"somekey\",\n  scope: \"cluster\",\n  namespace: \"dev\",\n  name: \"my-secret\",\n  values: {\n    value1: \"plain1\",\n    value2: \"plain2\"\n  }\n});\n\n// get sealed-secret\nconst sealedSecret =  getSealedSecret({\n  pemKey: \"somekey\",\n  scope: \"cluster\",\n  namespace: \"dev\",\n  name: \"my-secret\",\n  values: {\n    value1: \"plain1\",\n    value2: \"plain2\"\n  }\n});\n```\n\n## Low level\n\n```js\nimport { pki } from 'node-forge';\nimport { HybridEncrypt, pemPublicKeyToCryptoKey } from '@socialgouv/aes-gcm-rsa-oaep';\n\nconst publicKeyPem = pki.publicKeyToPem(cert.publicKey);\nconst publicKey = await pemPublicKeyToCryptoKey(publicKeyPem);\n\nconst plainText = 'Bonjour le monde';\nconst label = Buffer.from('');\n\nconst result = await HybridEncrypt(publicKey, plainText, label);\n\nconst sealedText = Buffer.from(result).toString('base64');\n```\n\n## Encryption Algorithm\n\nTo encrypt content, we go through the following steps :\n\n-   Generate a 128 bits AES key\n\n-   Encrypt the payload using the AES-GCM algorithm (with the previously generated key). We use a 12 bits of 0 as IV, because the key is only used once.\n\n-   Encrypt the AES key using the RSA-OAEP algorithm (using the provided public key).\n\n-   Generate the output payload this way :\n  (RSA payload length as 2 bytes integer) || (RSA encrypted aes key) || (AES encrypted payload)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSocialGouv%2Faes-gcm-rsa-oaep","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FSocialGouv%2Faes-gcm-rsa-oaep","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSocialGouv%2Faes-gcm-rsa-oaep/lists"}