Algorithm parameters

The algorithm parameter objects define the methods and parameters used by the various SubtleCrypto methods. While described here as "classes", they are simple JavaScript dictionary objects.

Extra input that is not encrypted but is included in the authentication of the data. The use of additionalData is optional.

The initialization vector must be unique for every encryption operation using a given key.

The length of the AES key to be derived. This must be either 128, 192, or 256.

Provides the initialization vector. It must be exactly 16-bytes in length and should be unpredictable and cryptographically random.

The initial value of the counter block. This must be exactly 16 bytes long.

The AES-CTR method uses the rightmost length bits of the block as the counter and the remaining bits as the nonce.

The length of the AES key in bits.

The length of the AES key to be generated. This must be either 128, 192, or 256.

Represents the optional associated data.

Represents the memory size in kibibytes. It must be at least 8 times the degree of parallelism.

Represents the nonce, which is a salt for password hashing applications.

Represents the degree of parallelism.

Represents the number of passes.

Represents the optional secret value.

Represents the Argon2 version number. The default and currently only defined version is 19 (0x13).

The context member represents the optional context data to associate with the message.

The functionName member represents the NIST function-name byte string used to domain-separate functions built on top of cSHAKE. Accepted values are:

• empty or undefined, in which case cSHAKE is equivalent to plain SHAKE
• the ASCII byte sequence 'KMAC'
• the ASCII byte sequence 'TupleHash'
• the ASCII byte sequence 'ParallelHash'

The customization member represents the customization data. Accepted values are:

• empty or undefined, in which case cSHAKE is equivalent to plain SHAKE
• up to 512 bytes of arbitrary data

ECDH key derivation operates by taking as input one party's private key and another party's public key -- using both to generate a common shared secret. The ecdhKeyDeriveParams.public property is set to the other party's public key.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

A temporary symmetric secret key (represented as ArrayBuffer) for message encryption and the ciphertext (that can be transmitted to the message recipient along with the message) encrypted by this shared key. The recipient uses their private key to determine what the shared key is which then allows them to decrypt the message.

A temporary symmetric secret key (represented as CryptoKey) for message encryption and the ciphertext (that can be transmitted to the message recipient along with the message) encrypted by this shared key. The recipient uses their private key to determine what the shared key is which then allows them to decrypt the message.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

Provides application-specific contextual input to the HKDF algorithm. This can be zero-length but must be provided.

The salt value significantly improves the strength of the HKDF algorithm. It should be random or pseudorandom and should be the same length as the output of the digest function (for instance, if using 'SHA-256' as the digest, the salt should be 256-bits of random data).

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

The optional number of bits in the HMAC key. This is optional and should be omitted for most cases.

The length of the HMAC key in bits.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

The number of bits to generate for the HMAC key. If omitted, the length will be determined by the hash algorithm used. This is optional and should be omitted for most cases.

The optional customization string for KangarooTwelve. It must not exceed 512 bytes.

The optional number of bits in the KMAC key. This is optional and should be omitted for most cases.

The length of the KMAC key in bits.

The number of bits to generate for the KMAC key. If omitted, the length will be determined by the KMAC algorithm used. This is optional and should be omitted for most cases.

The customization member represents the optional customization string.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

The number of iterations the PBKDF2 algorithm should make when deriving bits.

Should be at least 16 random or pseudorandom bytes.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

The length in bits of the RSA modulus.

The RSA public exponent.

If represented as a string, the value must be one of:

• 'SHA-1'
• 'SHA-256'
• 'SHA-384'
• 'SHA-512'
• 'SHA3-256'¹
• 'SHA3-384'¹
• 'SHA3-512'¹

If represented as an Algorithm, the object's name property must be one of the above listed values.

The length in bits of the RSA modulus. As a best practice, this should be at least 2048.

The RSA public exponent. This must be a Uint8Array containing a big-endian, unsigned integer that must fit within 32-bits. The Uint8Array may contain an arbitrary number of leading zero-bits. The value must be a prime number. Unless there is reason to use a different value, use new Uint8Array([1, 0, 1]) (65537) as the public exponent.

An additional collection of bytes that will not be encrypted, but will be bound to the generated ciphertext.

The rsaOaepParams.label parameter is optional.

The length (in bytes) of the random salt to use.

The optional domain separation byte (0x01-0x7f). Defaults to 0x1f.