decryptSecretVaultWithPasskey

Performs the passkey assertion for a parsed vault and decrypts its secret. Runs one navigator.credentials.get() ceremony.

Import

import { decryptSecretVaultWithPasskey } from "@category-labs/mera";

Usage

import {
  decryptSecretVaultWithPasskey,
  parseSecretVault,
} from "@category-labs/mera";

const vault = parseSecretVault(localStorage.getItem("vault"));
const secret = await decryptSecretVaultWithPasskey({
  rpId: "account.example.com",
  vault,
});
try {
  // use the secret bytes
} finally {
  secret.fill(0);
}

Parameters

options is a DecryptSecretVaultWithPasskeyOptions.

options.rpId

Type: string
Required

Relying party ID for the WebAuthn assertion. It must match the ID under which the vault’s passkey was created.

options.vault

Type: PasskeySecretVault
Required

A parsed secret vault; parseSecretVault produces one from untrusted stored data. The assertion is restricted to the credential stored in the vault.

options.timeout

Type: number
Optional; browser defaults apply when omitted

WebAuthn timeout in milliseconds.

Returns

Promise<Uint8Array>: the decrypted secret bytes as a fresh allocation.

Errors

VAULT_FORMAT_INVALID: the vault’s required structure, version, or encoded data is invalid.
PRF_UNAVAILABLE: the authenticator did not return a usable 32-byte PRF output.
DECRYPT_FAILED: AES-GCM authentication failed because the PRF output was wrong or the vault was modified.
CRYPTO_UNAVAILABLE: the page is not in a secure context, or the runtime lacks Web Crypto.
PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

Notes

The WebAuthn challenge is generated internally.