/**
 * Cryptographic utilities for WiFi Upload configuration
 *
 * NOTE: This module requires react-native-quick-crypto to be installed.
 * Add to your app: npm install react-native-quick-crypto
 */
import { Buffer } from 'buffer';
/**
 * Derive K_session from WiFi config grant.
 * K_session is used by device and app to encrypt/decrypt WiFi credentials in transit.
 *
 * Derivation: K_session = HMAC-SHA256(grant_blob, "BOTA_WIFI_SESSION_V1")
 *
 * @param grantBlob - Base64-encoded JWT grant from backend
 * @returns 32-byte K_session as hex string
 */
export declare function deriveSessionKey(grantBlob: string): string;
/**
 * Encrypt WiFi credentials for Bluetooth transmission using ChaCha20-Poly1305.
 *
 * Format sent to device:
 * - 12 bytes: nonce (random)
 * - N bytes: encrypted SSID
 * - 16 bytes: auth tag for SSID
 * - M bytes: encrypted password
 * - 16 bytes: auth tag for password
 *
 * @param ssid - WiFi network SSID
 * @param password - WiFi password
 * @param sessionKey - K_session derived from grant (hex string)
 * @returns Encrypted payload ready for Bluetooth transmission
 */
export declare function encryptWiFiCredentials(ssid: string, password: string, sessionKey: string): {
    nonce: Buffer;
    ssidEncrypted: Buffer;
    ssidAuthTag: Buffer;
    passwordEncrypted: Buffer;
    passwordAuthTag: Buffer;
};
/**
 * Decrypt WiFi credentials received from device (if needed for verification).
 *
 * @param encrypted - Encrypted SSID or password
 * @param nonce - 12-byte nonce
 * @param authTag - 16-byte authentication tag
 * @param sessionKey - K_session derived from grant (hex string)
 * @param aad - Additional authenticated data (optional, use 'password' for password field)
 * @returns Decrypted plaintext
 */
export declare function decryptWiFiCredential(encrypted: Buffer, nonce: Buffer, authTag: Buffer, sessionKey: string, aad?: string): string;
/**
 * Format encrypted WiFi credentials for Bluetooth transmission.
 *
 * Packet format:
 * [nonce (12 bytes)][ssid_encrypted (N bytes)][ssid_tag (16 bytes)]
 * [password_encrypted (M bytes)][password_tag (16 bytes)]
 *
 * @param encrypted - Result from encryptWiFiCredentials
 * @returns Single buffer ready for Bluetooth write
 */
export declare function formatWiFiCredentialPacket(encrypted: {
    nonce: Buffer;
    ssidEncrypted: Buffer;
    ssidAuthTag: Buffer;
    passwordEncrypted: Buffer;
    passwordAuthTag: Buffer;
}): Buffer;
/**
 * Parse encrypted WiFi credential packet received from device.
 *
 * @param packet - Buffer received from BLE
 * @param ssidLength - Expected SSID encrypted length
 * @param passwordLength - Expected password encrypted length
 * @returns Parsed components
 */
export declare function parseWiFiCredentialPacket(packet: Buffer, ssidLength: number, passwordLength: number): {
    nonce: Buffer;
    ssidEncrypted: Buffer;
    ssidAuthTag: Buffer;
    passwordEncrypted: Buffer;
    passwordAuthTag: Buffer;
};
//# sourceMappingURL=crypto.d.ts.map