Class EnvelopedDataBuilder

Builder class for creating CMS EnvelopedData structures.

This builder allows setting the data to be encrypted, the content encryption algorithm, and adding multiple recipients who can decrypt the data. It also supports including certificates and revocation information in the originator info.

Example


const recipientCert1 = Certificate.fromPem(`-----BEGIN CERTIFICATE-----')
const recipientCert2 = Certificate.fromPem(`-----BEGIN CERTIFICATE-----')

const builder = new EnvelopedDataBuilder()
builder.setData("Secret message")
builder.setContentEncryptionAlgorithm({ type: 'AES_256_GCM', params: { nonce: randomBytes(12) } })
builder.addRecipient({ certificate: recipientCert1 })
builder.addRecipient({
    certificate: recipientCert2,
    keyEncryptionAlgorithm: {
        type: 'RSA_OAEP',
        params: { hash: 'SHA-384' }
    }
})
const envelopedData = await builder.build()
const der = envelopedData.toDer

Implements

AsyncBuilder<EnvelopedData>

Index

Constructors

constructor

new EnvelopedDataBuilder(): EnvelopedDataBuilder
Returns EnvelopedDataBuilder

Properties

`Optional`certificates

certificates?: CertificateChoices[]

Optional certificates to include in originator info

`Optional`contentEncryptionAlgorithm

contentEncryptionAlgorithm?: SymmetricEncryptionAlgorithmParams

Algorithm used to encrypt the content

contentType

contentType: ObjectIdentifier = ...

Content type identifier, defaults to PKCS#7 data

crls

crls: RevocationInfoChoice[] = []

Certificate Revocation Lists to include

`Optional`data

data?: Uint8Array<ArrayBufferLike>

The data to be encrypted

recipients

recipients: EnvelopedDataBuilderRecipient[] = []

Recipients who can decrypt the enveloped data

`Static` `Readonly`DEFAULT_KEY_ENCRYPTION_ALGORITHM

DEFAULT_KEY_ENCRYPTION_ALGORITHM: KeyEncryptionAlgorithmIdentifier = ...

Default key encryption algorithm (RSA-OAEP with SHA-1). Used when no specific key encryption algorithm is provided for a recipient.

Accessors

originatorInfo

get originatorInfo(): undefined | OriginatorInfo
Gets the originator info containing certificates and CRLs. Returns undefined if no certificates are present.

Returns undefined | OriginatorInfo
OriginatorInfo or undefined
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:279

Methods

addCrl

addCrl(crl: CertificateList): this
Adds a Certificate Revocation List to the enveloped data. CRLs can be used by recipients to verify certificate validity.
Parameters
- crl: CertificateList
  The certificate revocation list to include
Returns this
This builder instance for method chaining
Example
```
builder.addCrl(latestCrl)
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:246

addOcsp

addOcsp(ocsp: OCSPResponse): this
Adds an OCSP response to the enveloped data for certificate status validation. OCSP responses provide real-time certificate revocation status.
Parameters
- ocsp: OCSPResponse
  The OCSP response to include
Returns this
This builder instance for method chaining
Example
```
builder.addOcsp(ocspResponse)
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:263

addRecipient

addRecipient(...recipient: EnvelopedDataBuilderRecipient[]): this
Adds one or more recipients who can decrypt the enveloped data. Each recipient's public key will be used to encrypt the content encryption key.
Parameters
- ...recipient: EnvelopedDataBuilderRecipient[]
  One or more recipient configurations
Returns this
This builder instance for method chaining
Example
```
builder.addRecipient(
    { certificate: cert1 },
    {
        certificate: cert2,
        keyEncryptionAlgorithm: { type: 'RSA_OAEP', params: { hash: 'SHA-384' } }
    }
)
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:229

build

build(): Promise<EnvelopedData>
Builds the EnvelopedData structure by encrypting the content and creating recipient infos.

The build process:
1. Generates a random symmetric key for content encryption
2. Encrypts the data with the symmetric key
3. For each recipient, encrypts the symmetric key with their public key
4. Creates the final EnvelopedData structure
Returns Promise<EnvelopedData>
Promise resolving to the constructed EnvelopedData
Throws
Error if no data is set or no recipients are specified
Example
```
const envelopedData = await builder
    .setData("Confidential document")
    .addRecipient({ certificate: recipientCert })
    .build()

// The enveloped data can now be transmitted securely
const der = envelopedData.toASN1().toDER()
```
Implementation of AsyncBuilder.build
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:339

setContentEncryptionAlgorithm

setContentEncryptionAlgorithm(
algorithm: SymmetricEncryptionAlgorithmParams,
): this
Sets the symmetric encryption algorithm used to encrypt the content. If not set, defaults to AES-256-CBC with a random IV.
Parameters
- algorithm: SymmetricEncryptionAlgorithmParams
  The content encryption algorithm parameters
Returns this
This builder instance for method chaining
Example
```
builder.setContentEncryptionAlgorithm({
    type: 'AES_256_GCM',
    params: { nonce: crypto.getRandomValues(new Uint8Array(12)) }
})
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:204

setContentType

setContentType(type: ObjectIdentifierString | ObjectIdentifier): this
Sets the content type identifier for the encrypted data.
Parameters
- type: ObjectIdentifierString | ObjectIdentifier
  The content type as ObjectIdentifier or string
Returns this
This builder instance for method chaining
Example
```
builder.setContentType("1.2.840.113549.1.7.1") // PKCS#7 data
builder.setContentType(new ObjectIdentifier({ value: "1.2.840.113549.1.9.16.1.4" })) // eContentTypes id-alg-pwri-kek
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:182

setData

setData(
data: string | Uint8Array<ArrayBufferLike>,
contentType?: ObjectIdentifierString,
): this
Sets the data to be encrypted and optionally the content type.
Parameters
- data: string | Uint8Array<ArrayBufferLike>
  The data to encrypt, either as bytes or string
- OptionalcontentType: ObjectIdentifierString
  Optional content type identifier
Returns this
This builder instance for method chaining
Example
```
builder.setData("Secret message")
builder.setData(documentBytes, "1.2.840.113549.1.7.1") // PKCS#7 data
```
- Defined in packages/pki-lite/src/core/builders/EnvelopedDataBuilder.ts:156

Class EnvelopedDataBuilder

Example

Implements

Index

Constructors

Properties

Accessors

Methods

Constructors

constructor

Returns EnvelopedDataBuilder

Properties

Optionalcertificates

OptionalcontentEncryptionAlgorithm

contentType

crls

Optionaldata

recipients

Static ReadonlyDEFAULT_KEY_ENCRYPTION_ALGORITHM

Accessors

originatorInfo

Returns undefined | OriginatorInfo

Methods

addCrl

Parameters

Returns this

Example

addOcsp

Parameters

Returns this

Example

addRecipient

Parameters

Returns this

Example

build

Returns Promise<EnvelopedData>

Throws

Example

setContentEncryptionAlgorithm

Parameters

Returns this

Example

setContentType

Parameters

Returns this

Example

setData

Parameters

Returns this

Example

Settings

On This Page

`Optional`certificates

`Optional`contentEncryptionAlgorithm

`Optional`data

`Static` `Readonly`DEFAULT_KEY_ENCRYPTION_ALGORITHM