Encrypt/sign and decrypt/verify string or binary data using keys

To parse and decrypt the keys

1const recipientPublicKey = await readKey({ armoredKey: '...' }); // or `binaryKey`
2const senderPrivateKey = await decryptKey({
3  privateKey: await readPrivateKey({ armoredKey: '...' }),
4  passphrase: 'personal key passphrase'
5});

To encrypt and sign:

1const { 
2  message: armoredMessage,
3  encryptedSignature: armoredEncryptedSignature
4} = await encryptMessage({
5  textData: 'text data to encrypt', // or `binaryData` for Uint8Arrays
6  encryptionKeys: recipientPublicKey, // and/or `passwords`
7  signingKeys: senderPrivateKey,
8  detached: true,
9  format: 'armored' // or 'binary' to output a binary message and signature
10});
11
12// share `armoredMessage`

To decrypt and verify (non-streamed input):

1// load the required keys
2const senderPublicKey = await readKey(...);
3const recipientPrivateKey = await decryptKey(...);
4
5const { data: decryptedData, verificationStatus } = await decryptMessage({
6  message: await readMessage({ armoredMessage }), // or `binaryMessage`
7  encryptedSignature: await readMessage({ armoredMessage: armoredEncryptedSignature })
8  decryptionKeys: recipientPrivateKey // and/or 'passwords'
9  verificationKeys: senderPublicKey
10});

For streamed inputs: to encrypt (and/or sign), pass the stream to textData or binaryData based on the streamed data type. Similarly, to decrypt and verify, the input options are the same as the non-streaming case. However, if armoredMessage (or binaryMessage) is a stream, the decryption result needs to be handled differently:

1// explicitly loading stream polyfills for legacy browsers is required since v7.2.2
2if (!globalThis.TransformStream) {
3  await import('web-streams-polyfill/es6');
4}
5
6const { data: dataStream, verificationStatus: verifiedPromise } = await decryptMessage({
7  message: await readMessage({ armoredMessage: streamedArmoredMessage }),
8  ... // other options
9});
10
11// you need to read `dataStream` before resolving `verifiedPromise`, even if you do not need the decrypted data
12const decryptedData = await readToEnd(dataStream);
13const verificationStatus = await verificationStatus;

Encrypt/decrypt using the session key directly

In v6, encryptMessage would return the generated session key if options.returnSessionKey: true was given. This option is no longer supported. Instead:

1// First generate the session key
2const sessionKey = await generateSessionKey({ recipientKeys: recipientPublicKey });
3
4// Then encrypt the data with it
5const { message: armoredMessage } = await encryptMessage({
6  textData: 'text data to encrypt', // or `binaryData` for Uint8Arrays
7  sessionKey,
8  encryptionKeys: recipientPublicKey, // and/or `passwords`, used to encrypt the session key
9  signingKeys: senderPrivateKey,
10});

To decrypt, you can again provide the session key directly:

1
2// Then encrypt the data with it
3const { data } = await decryptMessage({
4  message: await readMessage({ armoredMessage }),
5  sessionKeys: sessionKey,
6  verificationKeys: senderPublicKey,
7});

You can also encrypt the session key on its own:

1const armoredEncryptedSessionKey = await encryptSessionKey({
2  sessionKey,
3  encryptionKeys, // and/or passwords
4  format: 'armored'
5});
6
7// And decrypt it with:
8const sessionKey = await decryptSessionKey({
9  message: await readMessage({ armoredMessage: armoredEncryptedSessionKey }),
10  decryptionsKeys // and/or passwords
11});
12