import type { ProfileConfig } from './profiles.js';
export declare function sha3_256(data: Buffer): Buffer;
export declare function zeroBuffer(buf: Buffer): void;
export declare function computeShard(identityHash: Buffer, password: Buffer, shardIndex: number, generation: number, profile: ProfileConfig): Promise<Buffer>;
export declare function processAllShards(identityHash: Buffer, password: Buffer, totalShards: number, generation: number, profileConfig: ProfileConfig, onProgress?: (current: number, total: number) => void): Promise<Buffer[]>;
export declare function mixShards(shards: Buffer[], profileId: string, generation: number, factor: number, totalShards: number): Buffer;
export declare function deriveSLHDSASeed(masterIKM: Buffer): Buffer;
export declare function deriveMnemonicEntropy(masterIKM: Buffer): Buffer;
export declare function derivePasswordEntropy(masterIKM: Buffer): Buffer;
export interface SLHDSAKeypair {
    secretKey: Uint8Array;
    publicKey: Uint8Array;
}
/**
 * Generate SLH-DSA-SHAKE-256s keypair from deterministic seed.
 *
 * The seed must be exactly 96 bytes:
 * - bytes 0-31:  SK.seed (secret seed for WOTS+/FORS)
 * - bytes 32-63: SK.prf (PRF key for randomization)
 * - bytes 64-95: PK.seed (public seed for domain separation)
 */
export declare function generateSLHDSAKeypair(seed: Buffer): SLHDSAKeypair;
export declare function computeFingerprint(masterIKM: Buffer): string;
export declare function entropyToMnemonic(entropy: Buffer): string;
export declare function entropyToBase58Password(entropy: Buffer): string;
export interface FormattedKey {
    pem: string;
    raw: Uint8Array;
}
export declare function formatSecretKey(secretKey: Uint8Array, fingerprint: string, version: string): FormattedKey;
export declare function formatPublicKey(publicKey: Uint8Array, fingerprint: string, version: string): FormattedKey;
export declare function sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
export declare function verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
/**
 * Constant-time comparison for hex-encoded hashes.
 *
 * Prevents timing side channels when comparing fingerprints and public key hashes.
 * The length check is not constant-time but is acceptable because:
 * - timingSafeEqual throws on length mismatch (we need the check anyway)
 * - Attackers already know expected lengths (12 hex chars for fingerprint, 16 for hash)
 * - This is standard practice in cryptographic libraries
 */
export declare function constantTimeHexEquals(a: string, b: string): boolean;
//# sourceMappingURL=crypto.d.ts.map