04/26 Enhanced app and extension security

extension/shared/crypto.js

@@ -95,5 +95,40 @@ const ExtCrypto = (() => {
     return bytesToBase64(crypto.getRandomValues(new Uint8Array(byteLength)));
   }
 
-  return { deriveAuthHash, deriveVaultKey, exportVaultKey, importVaultKey, encryptItem, decryptItem, generateSalt };
+  /**
+   * Encrypt a plain name string with the vault key.
+   * Returns { enc_name: base64, iv_name: base64 }
+   */
+  async function encryptName(vaultKey, nameStr) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const plaintext = new TextEncoder().encode(nameStr);
+    const ciphertext = await crypto.subtle.encrypt(
+      { name: 'AES-GCM', iv },
+      vaultKey,
+      plaintext
+    );
+    return {
+      enc_name: bytesToBase64(new Uint8Array(ciphertext)),
+      iv_name: bytesToBase64(iv),
+    };
+  }
+
+  /**
+   * Decrypt an enc_name blob back to a plain string.
+   * Returns null on failure (legacy item without enc_name).
+   */
+  async function decryptName(vaultKey, enc_name, iv_name) {
+    try {
+      const plaintext = await crypto.subtle.decrypt(
+        { name: 'AES-GCM', iv: base64ToBytes(iv_name) },
+        vaultKey,
+        base64ToBytes(enc_name)
+      );
+      return new TextDecoder().decode(plaintext);
+    } catch {
+      return null;
+    }
+  }
+
+  return { deriveAuthHash, deriveVaultKey, exportVaultKey, importVaultKey, encryptItem, decryptItem, encryptName, decryptName, generateSalt };
 })();