/**
 * kMOSAIC Key Encapsulation Mechanism (KEM)
 *
 * Combines three heterogeneous hard problems with cryptographic entanglement
 * for post-quantum security with defense in depth.
 *
 * Security Properties:
 * - IND-CCA2 security via Fujisaki-Okamoto transform
 * - Implicit rejection on decapsulation failure
 * - Three independent hard problems for defense-in-depth
 * - Cryptographic entanglement prevents partial breaks
 *
 * Performance Considerations:
 * - TDD operations are O(n³) - most expensive component
 * - EGRW operations are O(k) - fastest component
 * - Parallelization opportunities in encapsulation
 */
import { SecurityLevel, type MOSAICParams, type MOSAICPublicKey, type MOSAICSecretKey, type MOSAICKeyPair, type MOSAICCiphertext, type EncapsulationResult, type SecurityAnalysis } from '../types.js';
/**
 * Generate kMOSAIC key pair
 *
 * Uses cryptographically secure randomness to generate keys for all three
 * underlying problems (SLSS, TDD, EGRW).
 *
 * Security:
 * - Uses secure random number generator for master seed
 * - Ensures full entropy for all component keys
 *
 * Performance:
 * - Key generation is dominated by TDD tensor operations (O(n³))
 * - SLSS and EGRW generation are relatively fast
 *
 * @param level - Security level (default: MOS_128)
 * @returns Promise resolving to the generated key pair
 * @throws Error if parameter validation fails
 */
export declare function generateKeyPair(level?: SecurityLevel): Promise<MOSAICKeyPair>;
/**
 * Generate key pair from seed (deterministic)
 *
 * Security notes:
 * - Domain-separated key derivation prevents related-key attacks
 * - This function is DETERMINISTIC: same seed produces same key pair
 * - Caller is responsible for ensuring seed has sufficient entropy (32+ bytes of randomness)
 * - For production use, prefer generateKeyPair() which uses secure system randomness
 * - For testing/reproducibility, this function enables deterministic key generation
 *
 * WARNING: Using a low-entropy seed (e.g., derived from password, predictable values)
 * will result in weak keys. Only use seeds from cryptographically secure sources.
 *
 * @param params - System parameters
 * @param seed - Master seed (must be at least 32 bytes)
 * @returns Generated key pair
 * @throws Error if seed is too short
 */
export declare function generateKeyPairFromSeed(params: MOSAICParams, seed: Uint8Array): MOSAICKeyPair;
/**
 * Encapsulate: Generate shared secret and ciphertext for recipient
 *
 * Security:
 * - Ephemeral secret provides forward secrecy
 * - Shared secret is bound to the ciphertext via hash
 * - Uses full entropy for ephemeral secret
 *
 * @param publicKey - Recipient's public key
 * @returns Promise resolving to shared secret and ciphertext
 */
export declare function encapsulate(publicKey: MOSAICPublicKey): Promise<EncapsulationResult>;
/**
 * Deterministic encapsulation (for CCA re-encryption check)
 *
 * Security:
 * - All randomness is derived from ephemeral secret and public key
 * - This enables the Fujisaki-Okamoto re-encryption check in decapsulation
 * - Secret sharing ensures all three problems must be broken to recover secret
 * - NIZK proof proves correct construction without leaking secret
 *
 * Algorithm:
 * 1. Derive randomness from ephemeral secret and public key binding
 * 2. Split secret into 3 shares (information-theoretic security)
 * 3. Encrypt each share with different problem (SLSS, TDD, EGRW)
 * 4. Generate NIZK proof of correct construction
 * 5. Derive shared secret from ephemeral secret and ciphertext hash
 *
 * @param publicKey - Recipient's public key
 * @param ephemeralSecret - Ephemeral secret (32 bytes)
 * @returns Encapsulation result (shared secret + ciphertext)
 * @throws Error if ephemeral secret is invalid
 */
export declare function encapsulateDeterministic(publicKey: MOSAICPublicKey, ephemeralSecret: Uint8Array): EncapsulationResult;
/**
 * Decapsulate: Recover shared secret from ciphertext
 *
 * Security:
 * - Implements Fujisaki-Okamoto transform for IND-CCA2 security
 * - Uses implicit rejection: on failure, returns pseudorandom value
 * - Constant-time execution path to prevent timing attacks
 * - Verifies NIZK proof to ensure ciphertext validity
 *
 * Algorithm:
 * 1. Compute implicit rejection value (for constant-time return)
 * 2. Decrypt all three fragments (SLSS, TDD, EGRW)
 * 3. Reconstruct candidate ephemeral secret
 * 4. Re-encapsulate with candidate secret (FO transform)
 * 5. Verify re-encapsulated ciphertext matches input
 * 6. Verify NIZK proof
 * 7. Return shared secret if valid, else implicit rejection value
 *
 * @param ciphertext - Ciphertext to decapsulate
 * @param secretKey - Recipient's secret key
 * @param publicKey - Recipient's public key (needed for re-encapsulation)
 * @returns Promise resolving to shared secret
 */
export declare function decapsulate(ciphertext: MOSAICCiphertext, secretKey: MOSAICSecretKey, publicKey: MOSAICPublicKey): Promise<Uint8Array>;
/**
 * Encrypt data using kMOSAIC KEM + AES-256-GCM
 *
 * Security:
 * - KEM-DEM composition (Key Encapsulation Mechanism + Data Encapsulation Mechanism)
 * - Provides authenticated encryption (confidentiality + integrity)
 * - Symmetric key is derived from the KEM shared secret
 * - Uses AES-256-GCM for high performance and security
 *
 * @param plaintext - Data to encrypt
 * @param publicKey - Recipient's public key
 * @returns Promise resolving to encrypted data (KEM ciphertext + AES ciphertext)
 */
export declare function encrypt(plaintext: Uint8Array, publicKey: MOSAICPublicKey): Promise<Uint8Array>;
/**
 * Decrypt data using kMOSAIC KEM + AES-256-GCM
 *
 * Security:
 * - Authenticated decryption prevents tampering
 * - Implicit rejection from KEM protects against oracle attacks
 * - Constant-time operations where critical
 *
 * @param encrypted - Encrypted data
 * @param secretKey - Recipient's secret key
 * @param publicKey - Recipient's public key
 * @returns Promise resolving to decrypted plaintext
 * @throws Error if decryption fails (authentication tag mismatch)
 */
export declare function decrypt(encrypted: Uint8Array, secretKey: MOSAICSecretKey, publicKey: MOSAICPublicKey): Promise<Uint8Array>;
/**
 * Analyze security properties of a public key
 *
 * Provides estimates of security bits against classical and quantum attacks.
 * Note: These are heuristic estimates based on current best known attacks.
 *
 * @param publicKey - Public key to analyze
 * @returns Security analysis report
 */
export declare function analyzePublicKey(publicKey: MOSAICPublicKey): SecurityAnalysis;
/**
 * Serialize full MOSAIC ciphertext
 *
 * Format:
 * [c1_len] [c1_bytes] [c2_len] [c2_bytes] [c3_len] [c3_bytes] [proof_bytes]
 *
 * @param ct - Ciphertext object
 * @returns Serialized bytes
 */
export declare function serializeCiphertext(ct: MOSAICCiphertext): Uint8Array;
/**
 * Deserialize full MOSAIC ciphertext
 *
 * @param data - Serialized ciphertext bytes
 * @returns Ciphertext object
 */
export declare function deserializeCiphertext(data: Uint8Array): MOSAICCiphertext;
/**
 * Serialize public key to bytes
 * Format: [level_len:4][level_string][slss_len:4][slss_data][tdd_len:4][tdd_data][egrw_len:4][egrw_data][binding:32]
 */
export declare function serializePublicKey(pk: MOSAICPublicKey): Uint8Array;
/**
 * Deserialize public key from bytes
 * Format: [level_len:4][level_string][slss_len:4][slss_data][tdd_len:4][tdd_data][egrw_len:4][egrw_data][binding:32]
 */
export declare function deserializePublicKey(data: Uint8Array): MOSAICPublicKey;
//# sourceMappingURL=index.d.ts.map