export type EncryptionAlgorithm = 'AES-256-GCM' | 'AES-256-CBC' | 'AES-256-CTR' | 'Kyber-768-AES' | 'Kyber-1024-AES' | 'none';
export interface EncryptionResult {
    encryptedBlob: Blob;
    iv: string;
    algorithm: EncryptionAlgorithm;
    salt: string;
}
export interface DecryptionParams {
    encryptedBlob: Blob;
    password: string;
    iv: string;
    algorithm: EncryptionAlgorithm;
    salt: string;
}
/**
 * Zero-Knowledge Encryption Service
 *
 * Provides client-side encryption/decryption using multiple algorithms.
 * Server NEVER sees decrypted content or encryption keys.
 *
 * Supported Algorithms:
 * - AES-256-GCM (recommended, fast, authenticated)
 * - AES-256-CBC (legacy compatibility)
 * - AES-256-CTR (streaming)
 * - Kyber-768-AES (post-quantum hybrid, ~AES-192 security)
 * - Kyber-1024-AES (post-quantum hybrid, ~AES-256 security)
 *
 * DEPENDENCIES:
 *   pnpm install mlkem
 */
export declare class EncryptionService {
    private readonly PBKDF2_ITERATIONS;
    private readonly KEY_LENGTH;
    /**
     * Encrypt a file using the specified algorithm
     */
    encryptFile(params: {
        file: Blob;
        password: string;
        algorithm: EncryptionAlgorithm;
        salt: string;
        iv: string;
    }): Promise<EncryptionResult>;
    /**
     * Byte size for resumable upload chunks (5MB)
     * Must match VaultUploadService.CHUNK_SIZE
     */
    private readonly CHUNK_SIZE;
    /**
     * Decrypt a file using the specified algorithm with progress reporting
     */
    decryptFile(params: DecryptionParams, onProgress?: (progress: number) => void): Promise<Blob>;
    /**
     * Internal helper to decrypt a single chunk of data
     */
    private decryptSingleChunk;
    /**
     * Increments an IV based on a byte offset.
     * Ensures different chunks use different nonces to avoid security vulnerabilities.
     */
    incrementIv(ivHex: string, offset: number): string;
    /**
     * Get the required IV/nonce size for each algorithm
     */
    getIvSizeForAlgorithm(algorithm: EncryptionAlgorithm): number;
    /**
     * Get the byte overhead added by the encryption algorithm
     */
    getEncryptionOverhead(algorithm: EncryptionAlgorithm): number;
    private validateIvLength;
    validatePassword(password: string): {
        valid: boolean;
        message?: string;
    };
    calculatePasswordStrength(password: string): number;
    private loadMlKem;
    private encryptAESGCM;
    private decryptAESGCM;
    private encryptAESCBC;
    private decryptAESCBC;
    private encryptAESCTR;
    private decryptAESCTR;
    private encryptKyberHybrid;
    private decryptKyberHybrid;
    private deriveKey;
    /**
     * Derive a 64-byte seed for ML-KEM deterministic keypair generation.
     * Same password + salt always produces the same seed → same keypair.
     */
    private deriveKyberSeed;
    private uint8ArrayToArrayBuffer;
    private arrayBufferToHex;
    private hexToArrayBuffer;
    private hexToUint8Array;
}
//# sourceMappingURL=encryption.service.d.ts.map