encrypt

Use the Signer class with RSASigner to create digital signatures. This example uses RSASignDigest.SHA256.

import 'package:encrypt/encrypt.dart';
import 'package:pointycastle/asymmetric/api.dart';

// Assuming keys are loaded via parseKeyFromFile
final publicKey = await parseKeyFromFile<RSAPublicKey>('test/public.pem');
final privateKey = await parseKeyFromFile<RSAPrivateKey>('test/private.pem');

final signer = Signer(RSASigner(RSASignDigest.SHA256, publicKey: publicKey, privateKey: privateKey));

// Sign data
final signature = signer.sign('hello world');
print(signature.base64); 

// Verify data
final isValid = signer.verify64('hello world', 'SIGNATURE_BASE64_STRING');
print(isValid);

 final publicKey = await parseKeyFromFile<RSAPublicKey>('test/public.pem');
 final privateKey = await parseKeyFromFile<RSAPrivateKey>('test/private.pem');
 final signer = Signer(RSASigner(RSASignDigest.SHA256, publicKey: publicKey, privateKey: privateKey));

 print(signer.sign('hello world').base64);
 print(signer.verify64('hello world', 'jfMhNM2v6hauQr6w3ji0xNOxGInHbeIH3DHlpf2W3vmSMyAuwGHG0KLcunggG4XtZrZPAib7oHaKEAdkHaSIGXAtEqaAvocq138oJ7BEznA4KVYuMcW9c8bRy5E4tUpikTpoO+okHdHr5YLc9y908CAQBVsfhbt0W9NClvDWegs='));

AES is a symmetric encryption algorithm. To use it, create a Key and an IV, then pass them to an Encrypter initialized with AES.

Modes of Operation: The default mode is AESMode.sic. You can override this using the mode parameter in the AES constructor. Supported modes include:

• AESMode.cbc (CBC)
• AESMode.cfb64 (CFB-64)
• AESMode.ctr (CTR)
• AESMode.ecb (ECB)
• AESMode.ofb64Gctr (OFB-64/GCTR)
• AESMode.ofb64 (OFB-64)
• AESMode.sic (SIC)

Padding: By default, AES uses PKCS7 padding. To use no/zero padding, pass null to the padding parameter.

import 'package:encrypt/encrypt.dart';

void main() {
  final plainText = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit';
  final key = Key.fromUtf8('my 32 length key................');
  final iv = IV.fromLength(16);

  final encrypter = Encrypter(AES(key));

  final encrypted = encrypter.encrypt(plainText, iv: iv);
  final decrypted = encrypter.decrypt(encrypted, iv: iv);

  print(decrypted); // Lorem ipsum dolor sit amet, consectetur adipiscing elit
}

The Encrypter class acts as a high-level wrapper around an Algorithm. It provides convenient methods for handling both raw bytes (List<int> or Uint8List) and UTF-8 encoded strings.

When initializing an Encrypter, you must provide an instance of an Algorithm (such as a symmetric or asymmetric algorithm implementation).

Key Capabilities:

• Encryption: Supports encrypting String inputs (automatically UTF-8 encoded) or List<int>/Uint8List inputs.
• Decryption: Supports decrypting to List<int> or decoding directly back to a String.
• Encoded String Decryption: Provides shorthand methods (decrypt16 and decrypt64) to decrypt data that has been pre-encoded as Hexadecimal or Base64 strings.

// Example usage pattern
final encrypter = Encrypter(myAlgorithm);

// Encrypt a string
final encrypted = encrypter.encrypt('my secret message');

// Decrypt back to string
final decrypted = encrypter.decrypt(encrypted);

The Encrypted class is the base representation for any encrypted byte sequence. It provides multiple factory constructors to initialize data from different formats and getters to export the data back to common encodings.

Constructors

• Encrypted(Uint8List bytes): Initialize from raw bytes.
• Encrypted.fromBase16(String encoded): Initialize from a hexadecimal string.
• Encrypted.fromBase64(String encoded) or Encrypted.from64(String encoded): Initialize from a Base64 string.
• Encrypted.fromUtf8(String input): Initialize from a UTF-8 string.
• Encrypted.fromLength(int length): Generates a cryptographically secure random sequence of the specified length.
• Encrypted.fromSecureRandom(int length): Alias for fromLength using SecureRandom.
• Encrypted.allZerosOfLength(int length): Creates a sequence of zeros. Warning: This is not cryptographically secure.

Getters

• bytes: Returns the underlying Uint8List.
• base16: Returns the hexadecimal string representation.
• base64: Returns the Base64 string representation.

// Create from random bytes
final encrypted = Encrypted.fromLength(32);

// Export to hex
String hex = encrypted.base16;

// Create from existing hex
final existing = Encrypted.fromBase16(hex);

The AES class implements the Algorithm interface for symmetric encryption using the Advanced Encryption Standard. It requires a Key and supports various modes and padding schemes.

Constructor

AES(this.key, {this.mode = AESMode.sic, this.padding = 'PKCS7'})

• key: An instance of Key containing the secret bytes.
• mode: An AESMode value (defaults to AESMode.sic).
• padding: A string specifying the padding scheme (defaults to 'PKCS7'). If set to null, no padding is applied.

Methods

encrypt

Encrypted encrypt(Uint8List bytes, {IV? iv, Uint8List? associatedData}) Encrypts the provided Uint8List bytes.

• Note: If the mode is not AESMode.ecb, an IV (Initialization Vector) must be provided, otherwise a StateError('IV is required.') is thrown.
• associatedData: Optional data used for authenticated encryption modes like AESMode.gcm.

decrypt

Uint8List decrypt(Encrypted encrypted, {IV? iv, Uint8List? associatedData}) Decrypts the provided Encrypted object.

• Note: If the mode is not AESMode.ecb, an IV must be provided, otherwise a StateError('IV is required.') is thrown.
• associatedData: Optional data used for authenticated encryption modes like AESMode.gcm.

// Example usage of AES encryption
final key = Key.fromBytes(myBytes);
final aes = AES(key, mode: AESMode.cbc, padding: 'PKCS7');
final iv = IV.fromBytes(myIvBytes);

final encrypted = aes.encrypt(dataBytes, iv: iv);
final decrypted = aes.decrypt(encrypted, iv: iv);

The Fernet class implements the Fernet symmetric encryption algorithm. It requires a 32-byte key, which is internally split into a 16-byte signing key and a 16-byte encryption key.

Key Requirements

• The key must be exactly 32 bytes.
• The key must be url-safe base64-encoded bytes.
• If the key length is not 32, a StateError is thrown.

Encryption

Use the encrypt method to transform Uint8List bytes into an Encrypted object. If no IV (Initialization Vector) is provided, one is automatically generated using secure random bytes.

Decryption

Use the decrypt method to recover the original Uint8List.

• TTL (Time To Live): You can provide an optional ttl (integer) to ensure the token is only valid for a certain duration from its creation timestamp.
• IV Handling: You should not provide a custom IV during decryption; the Fernet token format embeds the IV within the data, and the method will infer it automatically. Providing an IV will result in a StateError.
• Validation: The method performs signature verification and checks for clock skew and TTL expiration. If any check fails, it throws a StateError('Invalid token').

// Example usage of Fernet
final key = Key.fromBytes(Uint8List(32)); // Must be 32 bytes
final fernet = Fernet(key);

// Encrypting data
final originalData = Uint8List.fromList("hello world".codeUnits);
final encrypted = fernet.encrypt(originalData);

// Decrypting data with a TTL of 60 seconds
try {
  final decrypted = fernet.decrypt(encrypted, ttl: 60);
  print(String.fromCharCodes(decrypted));
} catch (e) {
  print("Decryption failed: $e");
}