/**
 * Cryptographic Utilities Module
 *
 * Provides Post-Quantum Cryptography (PQC) ready encryption utilities
 * for securing sensitive data at rest. Implements AES-256-GCM with
 * proper key derivation and authentication.
 *
 * Note: For true PQC, this would be replaced with CRYSTALS-Kyber or
 * similar post-quantum resistant algorithms when available in Node.js.
 * This implementation provides a strong foundation that can be upgraded.
 *
 * Follows golden-standard security practices:
 * - Uses authenticated encryption (GCM mode)
 * - Proper key derivation with PBKDF2
 * - Random IV generation for each encryption
 * - Authentication tag verification
 * - Constant-time comparison for MAC verification
 */
import { Buffer } from 'node:buffer';
/**
 * Encryption algorithm constants
 */
declare const ALGORITHM = "aes-256-gcm";
declare const IV_LENGTH = 16;
declare const AUTH_TAG_LENGTH = 16;
declare const SALT_LENGTH = 32;
declare const KEY_LENGTH = 32;
/**
 * Key derivation constants
 */
declare const KDF_ITERATIONS = 100000;
declare const KDF_MEMORY_COST: number;
/**
 * Custom error for encryption-related failures
 */
export declare class EncryptionError extends Error {
    readonly cause?: Error | undefined;
    constructor(message: string, cause?: Error | undefined);
}
/**
 * Custom error for decryption failures
 */
export declare class DecryptionError extends Error {
    readonly cause?: Error | undefined;
    constructor(message: string, cause?: Error | undefined);
}
/**
 * Custom error for invalid key material
 */
export declare class InvalidKeyError extends Error {
    constructor(message?: string);
}
/**
 * Generate a cryptographically secure random key
 */
export declare function generateKey(): Buffer;
/**
 * Generate a secure random key as a hex string
 */
export declare function generateKeyHex(): string;
/**
 * Derive a key from a password using scrypt (memory-hard KDF)
 */
export declare function deriveKeyFromPassword(password: string, salt?: Buffer): {
    key: Buffer;
    salt: Buffer;
};
/**
 * Derive a key from a password with existing salt
 */
export declare function deriveKeyFromPasswordWithSalt(password: string, salt: Buffer): Buffer;
/**
 * Validate that a key has sufficient entropy
 */
export declare function validateKey(key: string | Buffer): boolean;
/**
 * Encrypt data using AES-256-GCM
 *
 * @param plaintext - Data to encrypt (string or Buffer)
 * @param key - Encryption key (string or Buffer)
 * @returns Encrypted data with IV and authentication tag prepended
 */
export declare function encrypt(plaintext: string | Buffer, key: string | Buffer): Buffer;
/**
 * Encrypt string data and return as hex string
 */
export declare function encryptToHex(plaintext: string, key: string | Buffer): string;
/**
 * Encrypt string data and return as base64 string
 */
export declare function encryptToBase64(plaintext: string, key: string | Buffer): string;
/**
 * Decrypt data using AES-256-GCM
 *
 * @param ciphertext - Encrypted data with IV and auth tag prepended
 * @param key - Encryption key
 * @returns Decrypted data as Buffer
 * @throws DecryptionError if authentication fails
 */
export declare function decrypt(ciphertext: Buffer | string, key: string | Buffer): Buffer;
/**
 * Decrypt hex-encoded data to string
 */
export declare function decryptFromHex(ciphertextHex: string, key: string | Buffer): string;
/**
 * Decrypt base64-encoded data to string
 */
export declare function decryptFromBase64(ciphertextBase64: string, key: string | Buffer): string;
/**
 * Decrypt with constant-time comparison for authentication tag
 *
 * This provides additional protection against timing attacks
 * by using constant-time comparison for the authentication tag.
 */
export declare function decryptWithTimingSafe(ciphertext: Buffer | string, key: string | Buffer, expectedAuthTag?: Buffer): Buffer;
/**
 * Encrypt an object to a hex string
 */
export declare function encryptObjectToHex<T>(obj: T, key: string | Buffer): string;
/**
 * Decrypt a hex string to an object
 */
export declare function decryptHexToObject<T>(hexString: string, key: string | Buffer): T;
/**
 * Encrypt an object to a base64 string
 */
export declare function encryptObjectToBase64<T>(obj: T, key: string | Buffer): string;
/**
 * Decrypt a base64 string to an object
 */
export declare function decryptBase64ToObject<T>(base64String: string, key: string | Buffer): T;
/**
 * Generate a secure random salt
 */
export declare function generateSalt(length?: number): Buffer;
/**
 * Generate a secure random nonce
 */
export declare function generateNonce(length?: number): Buffer;
/**
 * Securely compare two strings in constant time
 */
export declare function secureCompare(a: string, b: string): boolean;
/**
 * Securely hash a string using SHA-256
 */
export declare function hashString(input: string): Promise<string>;
/**
 * Securely hash a buffer using SHA-256
 */
export declare function hashBuffer(input: Buffer): Promise<string>;
/**
 * Password-based encryption with salt generation
 */
export declare function encryptWithPassword(plaintext: string | Buffer, password: string): {
    ciphertext: Buffer;
    salt: Buffer;
};
/**
 * Password-based decryption with salt
 */
export declare function decryptWithPassword(ciphertext: Buffer, password: string, salt: Buffer): Buffer;
/**
 * Combined password-based encryption to hex
 */
export declare function encryptWithPasswordToHex(plaintext: string, password: string): {
    ciphertextHex: string;
    saltHex: string;
};
/**
 * Combined password-based decryption from hex
 */
export declare function decryptWithPasswordFromHex(ciphertextHex: string, password: string, saltHex: string): string;
export { ALGORITHM, IV_LENGTH, AUTH_TAG_LENGTH, KEY_LENGTH, KDF_ITERATIONS, KDF_MEMORY_COST, SALT_LENGTH, };
declare const _default: {
    generateKey: typeof generateKey;
    generateKeyHex: typeof generateKeyHex;
    deriveKeyFromPassword: typeof deriveKeyFromPassword;
    deriveKeyFromPasswordWithSalt: typeof deriveKeyFromPasswordWithSalt;
    validateKey: typeof validateKey;
    encrypt: typeof encrypt;
    encryptToHex: typeof encryptToHex;
    encryptToBase64: typeof encryptToBase64;
    decrypt: typeof decrypt;
    decryptFromHex: typeof decryptFromHex;
    decryptFromBase64: typeof decryptFromBase64;
    decryptWithTimingSafe: typeof decryptWithTimingSafe;
    encryptObjectToHex: typeof encryptObjectToHex;
    decryptHexToObject: typeof decryptHexToObject;
    encryptObjectToBase64: typeof encryptObjectToBase64;
    decryptBase64ToObject: typeof decryptBase64ToObject;
    generateSalt: typeof generateSalt;
    generateNonce: typeof generateNonce;
    secureCompare: typeof secureCompare;
    hashString: typeof hashString;
    hashBuffer: typeof hashBuffer;
    encryptWithPassword: typeof encryptWithPassword;
    decryptWithPassword: typeof decryptWithPassword;
    encryptWithPasswordToHex: typeof encryptWithPasswordToHex;
    decryptWithPasswordFromHex: typeof decryptWithPasswordFromHex;
    EncryptionError: typeof EncryptionError;
    DecryptionError: typeof DecryptionError;
    InvalidKeyError: typeof InvalidKeyError;
};
export default _default;
//# sourceMappingURL=crypto.d.ts.map