Encryption examples

Advanced Examples

Lazy Keystream Generation

import { QuarkDashChaCha, QuarkDashGimli } from "quarkdash";

const key = QuarkDashUtils.randomBytes(32);
const nonce = QuarkDashUtils.randomBytes(12);

// For example, using ChaCha20: seekable, cached, lazy
const chacha = new QuarkDashChaCha(key, nonce);
const ks = chacha.createKeystream(); // ChaChaKeystream extends LazyKeystream
const chunk = ks.getBytes(1024, 512); // custom offset without generation from scratch
const out = ks.xor(plain, 1024); // XOR with offset
ks.seek(0);
const stream = ks.blocks(0); // 64B block generator
const block0 = stream.next().value;

// Gimli is similar with 48B block
const gimli = new QuarkDashGimli(key, nonce);
const gks = gimli.createKeystream();
const enc = gks.xor(plain, 0);

// Integrate with QuarkDash with per-message nonce = metadata (12B), keystream is not resuable
const qd = new QuarkDash({
  cipher: CipherType.ChaCha20,
  usePerMessageNonce: true,
});

Re-keying / Key Rotation

const alice = new QuarkDash({
  cipher: CipherType.ChaCha20,
  rekey: {
    policy: { afterBytes: 64 * 1024 * 1024, afterMessages: 10_000 },
    autoRekey: false,
  },
});
const bob = new QuarkDash({ cipher: CipherType.ChaCha20 });
// ... handshake ...
// Can be used by request
const token = await alice.rekey(); // generates salt, with local rotation and returns encrypted message
await bob.applyRekey(token); // peer applys same salt

// sync-mode variant
const tokenSync = alice.rekeySync();
bob.applyRekeySync(tokenSync);

// Local rotation without exchange (deterministic, for tests)
alice.rotateKeysLocal(salt); // or async variant with await alice.rotateKeysLocalAsync()

// Policy and stats
if (alice.needsRekey()) await alice.rekey();
console.log(alice.getRekeyStats()); // { counter, bytesEncrypted, messagesEncrypted, lastRekeyTime }
alice.setRekeyPolicy({ afterMessages: 5000 });
console.log(alice.getRekeyCounter());

Passphrase (in PBKDF2 / Argon2id-lite mode)

import { QuarkDashPassphrase, QuarkDashUtils } from "quarkdash";

// PBKDF2-HMAC-SHA256: RFC 6070 compatible (SHA256)
const salt = QuarkDashPassphrase.generateSalt(32);
const key1 = QuarkDashPassphrase.pbkdf2Sync("password", salt, 100_000, 32);
const key1a = await QuarkDashPassphrase.pbkdf2("password", salt, 100_000, 32); // uses Node crypto if available

// Argon2id-lite (memory-hard, using SHAKE256)
const key2 = QuarkDashPassphrase.argon2idSync("password", salt, 32, 3, 32); // memoryCost KB, timeCost
const { key, salt: newSalt } = await QuarkDashPassphrase.derive("my secret", {
  algorithm: "argon2id",
  memoryCost: 64,
});

// For QuarkDash: 64B for session+mac
const { sessionKey, macKey } = await QuarkDashPassphrase.deriveKeyForQuarkDash(
  "password",
  salt,
  { algorithm: "pbkdf2", iterations: 200_000 },
);

Hardened Secured NTT

import { BaseRingLWE } from "quarkdash";

const lwe = new BaseRingLWE();
lwe.setNTTProtection({
  enabled: true, // enable / disable all security methods
  blinding: true, // random blinding factor (a* r, b* r^{-1})
  doubleCheck: true, // compute again and compare
  validateInputs: true, // validate polynome length / range
});
console.log(lwe.getNTTProtection());
// Automatically apply in generateKeyPair / encapsulate / decapsulate,
// serialization is normalize coefficient ((v%Q)+Q)%Q, deserialization skip >=Q

Transports — WebSocket / HTTP / gRPC

import { QuarkDashWebSocket, QuarkDashHTTP, QuarkDashGRPC } from "quarkdash";

// WebSocket: wrapper works with any WSLike (ws / browser WebSocket)
const qdWsAlice = QuarkDashWebSocket.wrap(aliceQD, rawWs);
await qdWsAlice.send("hello ws");
await qdWsAlice.sendJSON({ type: "msg", data: 123 });
qdWsAlice.onDecrypted((plain: Uint8Array) =>
  console.log(QuarkDashUtils.bytesToText(plain)),
);

// HTTP: body encryption + header x-qd-encrypted
const httpAlice = new QuarkDashHTTP(aliceQD);
const httpBob = new QuarkDashHTTP(bobQD);
const { body, headers } = await httpAlice.encryptBody({ hello: "world" });
const obj = await httpBob.decryptToJSON(body);
// as Express middleware
app.use(new QuarkDashHTTP(qd).expressMiddleware());
// as fetch wrapper
const secureFetch = new QuarkDashHTTP(qd).createFetchWrapper(fetch);
await secureFetch("https://api.example.com/data", {
  method: "POST",
  body: JSON.stringify(payload),
});

// gRPC: interceptor / wrapper
const grpcAlice = new QuarkDashGRPC(aliceQD);
const grpcBob = new QuarkDashGRPC(bobQD);
const enc = await grpcAlice.encryptMessage(payload);
const dec = await grpcBob.decryptMessage(enc);
const wrappedClient = grpcAlice.wrapClient(originalGrpcClient);
const serverHandler = grpcBob.serverInterceptor();