/**
 * Cryptographic primitives — Node.js version.
 *
 * Uses `node:crypto` for maximum performance where possible.
 * Pure JS fallbacks for operations where `node:crypto` would be inconvenient
 * (e.g., AES-CBC with specific PDF padding semantics).
 *
 * The browser counterpart (`crypto.browser.ts`) provides the same API using
 * pure JS implementations for synchronous ops and Web Crypto for async ops.
 *
 * Shared by: PDF (encryption/decryption), Archive (via re-export if needed),
 * and digital signature infrastructure.
 *
 * @see FIPS 197 — AES
 * @see FIPS 180-4 — SHA-256
 * @see RFC 1321 — MD5
 * @see RFC 2104 — HMAC
 */
/**
 * SHA-256 hash function (FIPS 180-4).
 * @returns 32-byte digest
 */
export declare function sha256(input: Uint8Array): Uint8Array;
/**
 * HMAC-SHA256 (RFC 2104).
 * @returns 32-byte MAC
 */
export declare function hmacSha256(key: Uint8Array, message: Uint8Array): Uint8Array;
/**
 * MD5 hash function (RFC 1321).
 *
 * **Security note:** MD5 is cryptographically broken for password hashing.
 * This function exists solely for PDF specification compliance — ISO 32000
 * mandates MD5 in its key derivation algorithms for RC4 and AES-128
 * encryption (Algorithm 2, Algorithm 3 in PDF 1.7 Reference). It cannot
 * be replaced with a stronger hash without breaking compatibility with
 * every existing encrypted PDF file.
 *
 * @returns 16-byte digest
 */
export declare function md5(input: Uint8Array): Uint8Array;
/**
 * AES-CBC encryption with PKCS#7 padding.
 * Supports AES-128 (16-byte key) and AES-256 (32-byte key).
 */
export declare function aesCbcEncrypt(plaintext: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
/**
 * AES-CBC decryption with PKCS#7 padding removal.
 * Supports AES-128 (16-byte key) and AES-256 (32-byte key).
 */
export declare function aesCbcDecrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
/**
 * AES-CBC decryption WITHOUT PKCS#7 padding removal.
 * Used for key derivation where the output length is known.
 */
export declare function aesCbcDecryptRaw(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
/**
 * AES-CBC encryption WITHOUT PKCS#7 padding.
 * Used when the plaintext is already block-aligned.
 *
 * @throws if plaintext length is not a multiple of 16.
 */
export declare function aesCbcEncryptRaw(plaintext: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
/**
 * AES-ECB encryption of a single 16-byte block (no padding, no IV).
 */
export declare function aesEcbEncrypt(block: Uint8Array, key: Uint8Array): Uint8Array;
/**
 * RC4 stream cipher.
 *
 * Required by ISO 32000 for reading PDFs encrypted with the RC4 algorithm
 * (PDF 1.4 standard handler V=1/V=2). Modern Node `crypto` no longer
 * exposes RC4, so this is a pure-JS implementation.
 */
export declare function rc4(key: Uint8Array, data: Uint8Array): Uint8Array;
/**
 * Generate cryptographically secure random bytes.
 */
export declare function randomBytes(length: number): Uint8Array;
/**
 * Compute a hash digest using any algorithm supported by the platform.
 *
 * @param algorithm - Hash algorithm name (e.g., "SHA-256", "SHA-512", "SHA-1", "MD5").
 *   Normalized internally: hyphens removed, lowercased.
 * @param data - Data to hash
 * @returns The digest bytes
 */
export declare function hash(algorithm: string, data: Uint8Array): Uint8Array;
/**
 * Async version of `hash()` — same behavior, but returns a Promise for API
 * parity with the browser version.
 */
export declare function hashAsync(algorithm: string, data: Uint8Array): Promise<Uint8Array>;
/**
 * Verify an RSA PKCS#1 v1.5 signature.
 *
 * @param publicKeyDer - DER-encoded SubjectPublicKeyInfo
 * @param signature - The signature bytes
 * @param data - The signed data (will be hashed with SHA-256)
 */
export declare function rsaVerify(publicKeyDer: Uint8Array, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
/**
 * Create an RSA PKCS#1 v1.5 signature.
 *
 * @param privateKeyDer - DER-encoded PKCS#8 private key
 * @param data - The data to sign (will be hashed with SHA-256)
 */
export declare function rsaSign(privateKeyDer: Uint8Array, data: Uint8Array): Promise<Uint8Array>;