securestore

The securestore object provides a mechanism for securely storing customer data within the player. Data held in the securestore are encrypted using root keys which are held securely within the player hardware and are unique to each unit. In general, the securestore is used to hold a second-level key which in turn is used for subsequent decryption. The key itself cannot be retrieved, but the user can ask the securestore to perform decryption using it.

The capacity of the securestore is limited and customers should not store more than 256kB of keys.

securestore IDL

interface SecureStore {
    Promise<void> writePkcs8DecryptionKey(String name, Array<byte> data)
    Promise<Array<byte>> decryptWithPkcs8Key(String name, String algorithm, String hash, Array<byte> data)
    Promise<void> eraseSecureStore();
};

Object Creation

To create a securestore object, load the @brightsign/securestore module using the Node.js® require() method:

var securestoreClass = require("@brightsign/securestore");
var securestore = new securestoreClass();

SecureStore

writePkcs8DecryptionKey()

Promise<void> writePkcs8DecryptionKey(String name, Array<byte> data)

Writes the key in pkcs8 format to the securestore.

name string: The filename of the key within the secure store.
data Array: The key as a Uint8 data array.

decryptWithPkcs8Key()

Promise<Array<byte>> decryptWithPkcs8Key(String name, String algorithm, String hash, Array<byte> data)

Decrypts a data array using the designated key stored in the securestore and using the designated algorithm and hash.

name string: The filename of the key within the secure store.
algorithm string: For the moment, the only algorithm supported is ""RSA-OAEP".
hash string: Hash values can be any of the following: "SHA-1", "SHA-256", "SHA-384" or "SHA-512".
data Array: Uint8Array data

eraseSecureStore()

Promise<void> eraseSecureStore()

Completely deletes the securestore.

Examples

Write example:

window.crypto.subtle.generateKey(
    {
    name: "RSA-OAEP", 
    modulusLength: 2048, //can be 1024, 2048, or 4096
    publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
    hash: {name: "SHA-1"}, //can be "SHA-1", "SHA-256", "SHA-384", or "SHA-512"
    },
    true, //whether the key is extractable (i.e. can be used in exportKey)
    ["encrypt", "decrypt"] //must be ["encrypt", "decrypt"] or ["wrapKey", "unwrapKey"]
)
.then(function(key){
    window.crypto.subtle.exportKey("pkcs8", key.privateKey)
    .then(function(exportKey) {
        var SecureClass = require("@brightsign/securestore");
        var secure = new SecureClass();
        secure.write("testkey.bin", Array.from(new Uint8Array(exportKey)))
        .then(function(store){

        ....

       }

    ....

    });

Decrypt example:

var SecureClass = require("@brightsign/securestore");
var secure = new SecureClass();

decryptWithPkcs8Key("testkey.bin", "RSA-OAEP", "SHA-1", Array.from(new Uint8Array(encrypted)))
    .then(function(decryptedArray){

        ....
})

Delete example:

var SecureClass = require("@brightsign/securestore");
var secure = new SecureClass();

secure.eraseSecureStore()

Documentation