Web Push🔗ℹ

This library provides implementations of RFC 8188 and RFC 8291.

1 Reference🔗ℹ

1.1 Encrypted Content-Encoding for HTTP🔗ℹ

procedure
(http-ece-decrypt in
out
secret
[ #:factories factories]) → void?
  in : input-port?
  out : output-port?
  secret : (or/c bytes? (-> bytes? bytes?))
   factories : (or/c crypto-factory? (listof crypto-factory?))
= (crypto-factories)

Decrypts the contents of in to out using secret and the provided factories. When secret is a procedure, it receives the key id read from the input header. It must then provide a secret based on that key id.

procedure
(http-ece-encrypt in
out
secret
[ #:salt salt
#:key-id key-id
#:record-size record-size
#:factories factories]) → void?
  in : input-port?
  out : input-port?
  secret : bytes?
  salt : bytes? = (crypto-random-bytes 16)
  key-id : bytes? = #""
  record-size : (integer-in 18 (sub1 (expt 2 31))) = 4096
   factories : (or/c crypto-factory? (listof crypto-factory?))
= (crypto-factories)

Encrypts the contents of in and writes the output to out using secret and the provided factories. The content is split into #:record-size chunks. The #:key-id argument can be used to signal to the recipient what key they should use to decrypt the data. The key id may be at most 255 bytes long.

1.2 Message Encryption for Web Push🔗ℹ

(require crypto/web-push)

package: web-push-lib

procedure
(web-push-encrypt in
out
[ #:salt salt]
#:auth-secret auth-secret
[ #:private-key as-private]
#:user-agent-key ua-public
[ #:factories factories]) → void?
  in : input-port?
  out : output-port?
  salt : bytes? = (crypto-random-bytes 16)
  auth-secret : bytes?
  as-private : pk-key? = (generate-ecdh-private-key)
  ua-public : bytes?
   factories : (or/c crypto-factory? (listof crypto-factory?))
= (crypto-factories)

Encrypts the contents of in and writes the output to out after exchanging the as-private and ua-public keys in order to generate a shared encryption secret.

If #:private-key is not provided, a key is generated automatically on every invocation. This is the normal use case. Do not reuse keys outside of testing scenarios.