ThicketScript

crypto ​

Hashing, HMAC, AES, PBKDF2, random bytes and UUIDs.

Import

ts
import { Crypto } from "crypto";

Needs the "crypto" permission in thicket.json.

Crypto static class ​

ts
static class Crypto

Crypto.MD5 ​

ts
static readonly MD5: string

Algorithm constant for MD5 hashing ("md5"). Warning: MD5 is cryptographically broken; use SHA256/SHA512 for security-sensitive purposes.

Crypto.SHA1 ​

ts
static readonly SHA1: string

Algorithm constant for SHA-1 hashing ("sha1"). Warning: SHA-1 is weak; use SHA256/SHA512 for security-sensitive purposes.

Crypto.SHA256 ​

ts
static readonly SHA256: string

Algorithm constant for SHA-256 hashing ("sha256"). Recommended for most uses.

Crypto.SHA512 ​

ts
static readonly SHA512: string

Algorithm constant for SHA-512 hashing ("sha512"). Recommended for security-sensitive uses.

Crypto.decrypt ​

ts
static decrypt(key: string, iv: string, ciphertext: string): string

Decrypt AES-256-CBC ciphertext.

Parameters

  • key: 64 hex characters (32 bytes).
  • iv: 32 hex characters (16 bytes).
  • ciphertext: Hex string with length a non-zero multiple of 16 bytes.

Returns: The decrypted plaintext string.

Crypto.encrypt ​

ts
static encrypt(key: string, iv: string, plaintext: string | ByteArray): string

Encrypt plaintext using AES-256-CBC.

Parameters

  • key: 64 hex characters (32 bytes).
  • iv: 32 hex characters (16 bytes).
  • plaintext: A string (encrypted as its UTF-8 bytes) or a ByteArray (whole content, position ignored).

Returns: The ciphertext as a hex string. Note: AES-CBC provides confidentiality only; always authenticate with HMAC.

Crypto.hash ​

ts
static hash(algorithm: string, data: string | ByteArray): string

Compute a hash digest.

Parameters

  • algorithm: Hash algorithm: Crypto.MD5, Crypto.SHA1, Crypto.SHA256, or Crypto.SHA512.
  • data: The data to hash: a string (hashed as its UTF-8 bytes) or a ByteArray (its whole content; position is ignored). Any other type throws TypeError.

Returns: The digest as a hex string.

Crypto.hmac ​

ts
static hmac(algorithm: string, key: string | ByteArray, data: string | ByteArray): string

Compute an HMAC.

Parameters

  • algorithm: Hash algorithm: Crypto.SHA1, Crypto.SHA256, or Crypto.SHA512. Warning: SHA1-based HMAC is weak.
  • key: The secret key: a string (UTF-8 bytes) or a ByteArray (whole content, position ignored).
  • data: The data to authenticate: a string (UTF-8 bytes) or a ByteArray (whole content, position ignored).

Returns: The HMAC as a hex string.

Crypto.pbkdf2 ​

ts
static pbkdf2(password: string | ByteArray, salt: any, iterations: int, keyLength: int, digest?: string): any

Derive a key from a password using PBKDF2.

Parameters

  • password: A string (UTF-8 bytes) or a ByteArray (whole content, position ignored).
  • salt: Random salt bytes.
  • iterations: Number of iterations (higher is slower but more secure).
  • keyLength: Desired output key length in bytes.
  • digest: Optional hash algorithm: Crypto.SHA256 (default) or Crypto.SHA512.

Returns: A buffer containing the derived key bytes.

Crypto.randomBytes ​

ts
static randomBytes(n: int): string

Generate cryptographically secure random bytes.

Parameters

  • n: Number of bytes to generate (max 1024).

Returns: A hex string (n * 2 characters).

Crypto.randomUUID ​

ts
static randomUUID(): string

Generate a UUID v4 string.

Returns: A UUID in standard 8-4-4-4-12 format (e.g., "550e8400-e29b-41d4-a716-446655440000").

Generated from lang/types/crypto.d.tks in the ThicketScript repository.