Primary Provider Integration

import { p256 } from '@noble/curves/p256';

// Generate HPKE keypair for Privy
function generateHPKEKeyPair() {
// Generate random 32-byte private key
const privateKeyBytes = p256.utils.randomPrivateKey();
const publicKeyBytes = p256.getPublicKey(privateKeyBytes);

// Format as SPKI (public) and PKCS#8 (private)
const spkiPublicKey = createSPKIPublicKey(publicKeyBytes);
const pkcs8PrivateKey = createPKCS8PrivateKey(privateKeyBytes);

return {
publicKey: Buffer.from(spkiPublicKey).toString('base64'),
privateKey: Buffer.from(pkcs8PrivateKey).toString('base64')
};
}

// Algorithm:
// 1. Generate random 32-byte private key using P-256 curve
// 2. Compute public key: publicKey = privateKey \* G (curve point)
// 3. Wrap public key in SPKI DER format
// 4. Wrap private key in PKCS#8 DER format
// 5. Base64-encode both keys

// Store the private key securely - you'll need it to decrypt the response!
const keypair = generateHPKEKeyPair();

import { CipherSuite, KemId, KdfId, AeadId } from "@hpke/core";

async function decryptAuthorizationKey(
encryptedData: any,
privateKeyB64: string
): Promise<string> {
// Configure HPKE suite for Privy
const suite = new CipherSuite({
kem: KemId.DhP256HkdfSha256,
kdf: KdfId.HkdfSha256,
aead: AeadId.Chacha20Poly1305
});

// Decode the encrypted data
const encapsulatedKey = Buffer.from(encryptedData.encapsulated_key, 'base64');
const ciphertext = Buffer.from(encryptedData.ciphertext, 'base64');
const privateKeyDer = Buffer.from(privateKeyB64, 'base64');

// Create recipient context
const recipient = await suite.createRecipientContext({
recipientKey: privateKeyDer,
enc: encapsulatedKey,
info: new Uint8Array(), // Empty info
});

// Decrypt the ciphertext
const plaintext = await recipient.open(ciphertext, new Uint8Array()); // Empty AAD
const authKey = new TextDecoder().decode(plaintext);

// Remove "wallet-auth:" prefix if present
return authKey.replace("wallet-auth:", "");
}

// Usage after API call
const privyAuth = response.authentication.find(auth => auth.provider === 'Privy');
const encryptedAuthKey = privyAuth.session.session.encrypted_authorization_key;
const decryptedAuthKey = await decryptAuthorizationKey(encryptedAuthKey, keypair.privateKey);

function extractSigningKey(authKeyB64: string): Uint8Array {
  const pkcs8Bytes = Buffer.from(authKeyB64, 'base64');

// Look for pattern [0x04, 0x20] followed by 32-byte key
const pattern = Buffer.from([0x04, 0x20]);
const patternIndex = pkcs8Bytes.indexOf(pattern);

if (patternIndex === -1) {
throw new Error('Private key marker not found');
}

const keyStart = patternIndex + 2;
return new Uint8Array(pkcs8Bytes.slice(keyStart, keyStart + 32));
}

function canonicalizeJson(obj: any): any {
  if (obj && typeof obj === 'object' && !Array.isArray(obj)) {
    const sorted: any = {};
    // Sort keys alphabetically
    Object.keys(obj).sort().forEach(key => {
      sorted[key] = canonicalizeJson(obj[key]);
    });
    return sorted;
  } else if (Array.isArray(obj)) {
    return obj.map(item => canonicalizeJson(item));
  }
  return obj;
}

function serializeCanonical(payload: any): string {
const canonical = canonicalizeJson(payload);
return JSON.stringify(canonical);
}

import { p256 } from '@noble/curves/p256';

function signPayload(kmsPayloadB64: string, authKeyB64: string): string {
// Decode and parse the KMS payload
const payloadJson = Buffer.from(kmsPayloadB64, 'base64').toString('utf-8');
const payload = JSON.parse(payloadJson);

// Canonicalize the JSON
const canonicalPayload = serializeCanonical(payload);

// Extract the signing key
const privateKeyBytes = extractSigningKey(authKeyB64);

// Sign with ECDSA P-256
const signature = p256.sign(Buffer.from(canonicalPayload), privateKeyBytes);

// Return base64 DER signature
return Buffer.from(signature.toDERRawBytes()).toString('base64');
}

// Usage
const signature = signPayload(kmsPayload.payload, decryptedAuthKey);