import type CryptoLib from '../../interfaces/CryptoLib.mjs';
import type { DeviceSecretKeys, Encrypted, EncryptedSecretKeys, EncryptedSymmetricKey, KdfParameters, MacKey, Password, PasswordHash, PrivateKey, PublicKey, Salt, Signature, SigningPublicKey, SigningSecretKey, SymmetricKey, SyncKey } from '../../interfaces/CryptoLib.mjs';
/**
 * @inheritdoc
 */
declare class NodeCryptoLib implements CryptoLib {
    /**
     * @inheritdoc
     */
    getRandomBytes(count: number): Promise<Uint8Array<ArrayBufferLike>>;
    /**
     * @inheritdoc
     */
    sha256(data: string): Promise<string>;
    /**
     * @inheritdoc
     */
    createKeys(password: Password): Promise<{
        macKey: MacKey;
        kdf: KdfParameters;
        encryptedSecretKeys: EncryptedSecretKeys;
        encryptedSymmetricKey: EncryptedSymmetricKey;
        privateKey: PrivateKey;
        signingSecretKey: SigningSecretKey;
        symmetricKey: SymmetricKey;
        publicKey: PublicKey;
        signingPublicKey: SigningPublicKey;
        salt: Salt;
    }>;
    /**
     * @inheritdoc
     */
    encryptKeys(secretKeys: DeviceSecretKeys, symmetricKey: SymmetricKey, salt: Salt, password: Password, kdf?: KdfParameters): Promise<{
        macKey: MacKey;
        encryptedSecretKeys: EncryptedSecretKeys;
        encryptedSymmetricKey: EncryptedSymmetricKey;
    }>;
    /**
     * @inheritdoc
     */
    decryptKeys(encryptedSecretKeys: EncryptedSecretKeys, encryptedSymmetricKey: EncryptedSymmetricKey, salt: Salt, password: Password, kdf?: KdfParameters): Promise<{
        privateKey: PrivateKey;
        signingSecretKey: SigningSecretKey;
        symmetricKey: SymmetricKey;
        publicKey: PublicKey;
        signingPublicKey: SigningPublicKey;
        macKey: MacKey;
    }>;
    /**
     * @inheritdoc
     */
    deriveEnvelopeMacKey(passwordHash: PasswordHash, salt: Salt): Promise<MacKey>;
    /**
     * Derives one of the three keys the password hash feeds: the two at-rest
     * wrapping keys and the envelope MAC key.
     *
     * They differ only in the HKDF info, which is what keeps them independent --
     * a seal made under one can never be opened with another, whatever a caller
     * confuses.
     * @param passwordHash - The argon2id password hash (hex).
     * @param salt - The vault salt, used as the HKDF salt.
     * @param info - The domain separator for this key's purpose.
     * @returns A promise resolving to the derived key, base64 encoded.
     */
    private deriveWrappingKey;
    /**
     * Seals a device's secret keys and its symmetric key under the password.
     *
     * Two seals under two separately derived keys, rather than one blob holding
     * everything: `changePassword` rewrites both, but a resilver and an unlock
     * need only one of them, and keeping them apart means neither path can be
     * made to read the other's bytes.
     * @param secretKeys - The device's two secret keys.
     * @param symmetricKey - The key the vault state is encrypted under.
     * @param passwordHash - The argon2id password hash (hex).
     * @param salt - The vault salt.
     * @param kdf - The parameters the hash was produced with.
     * @returns A promise resolving to both sealed forms.
     */
    private sealKeyMaterial;
    /**
     * Opens the seal around a device's secret keys.
     *
     * A failure here is reported as an invalid password, which is what it almost
     * always is: at rest the password is the only variable, and the alternative
     * -- a modified vault -- is what the envelope MAC is checked for immediately
     * afterwards, with a message that says so.
     * @param encryptedSecretKeys - The sealed secret keys.
     * @param passwordHash - The argon2id password hash (hex).
     * @param salt - The vault salt.
     * @param kdf - The parameters the hash was produced with.
     * @returns A promise resolving to the two secret keys.
     * @throws {CryptoError} If the seal does not open.
     */
    private openSecretKeys;
    /**
     * @inheritdoc
     */
    createEnvelopeMac(macKey: MacKey, message: string): Promise<string>;
    /**
     * @inheritdoc
     */
    verifyEnvelopeMac(macKey: MacKey, message: string, mac: string): Promise<boolean>;
    /**
     * @inheritdoc
     */
    encrypt<T extends string>(publicKey: PublicKey, plainText: T): Promise<Encrypted<T>>;
    /**
     * @inheritdoc
     */
    decrypt<T extends string>(privateKey: PrivateKey, encryptedText: Encrypted<T>): Promise<T>;
    /**
     * @inheritdoc
     */
    sign(signingSecretKey: SigningSecretKey, message: string): Promise<Signature>;
    /**
     * @inheritdoc
     */
    verify(signingPublicKey: SigningPublicKey, message: string, signature: Signature): Promise<boolean>;
    /**
     * @inheritdoc
     */
    encryptSymmetric<T extends string>(symmetricKey: SymmetricKey, plainText: T, aad: string): Promise<Encrypted<T>>;
    /**
     * @inheritdoc
     */
    decryptSymmetric<T extends string>(symmetricKey: SymmetricKey, encryptedText: Encrypted<T>, aad: string): Promise<T>;
    /**
     * @inheritdoc
     */
    createSymmetricKey(): Promise<SymmetricKey>;
    /**
     * @inheritdoc
     */
    createSyncKey(sharedKey: Uint8Array, responderDeviceId: string): Promise<SyncKey>;
}
export default NodeCryptoLib;