Implement end-user recovery

import crypto from 'crypto'

// Generate a recovery keypair
const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'prime256v1',
})

// Export keys
const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' })
const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' })

// Generate a random recovery password for the user
const recoveryPassword = crypto.randomBytes(16).toString('base64') // Or use a word-based format

// Derive an encryption key from the password
const salt = crypto.randomBytes(16)
const encryptionKey = crypto.pbkdf2Sync(recoveryPassword, salt, 100000, 32, 'sha256')

// Encrypt the private key
const iv = crypto.randomBytes(16)
const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, iv)

let encrypted = cipher.update(privateKeyPem, 'utf8', 'base64')
encrypted += cipher.final('base64')
const authTag = cipher.getAuthTag()

const encryptedPrivateKey = JSON.stringify({
  salt: salt.toString('base64'),
  iv: iv.toString('base64'),
  authTag: authTag.toString('base64'),
  data: encrypted,
})

// Keys must be alphabetically sorted, no spaces in JSON separators
const clientData = {
  challenge: registrationChallenge, // from Create (Delegated) Registration Challenge
  type: 'key.create',
}
const clientDataJson = JSON.stringify(clientData)
const clientDataBase64 = Buffer.from(clientDataJson).toString('base64url')

const recoveryCredential = {
  credentialKind: 'RecoveryKey',
  credentialInfo: {
    credId: generateCredentialId(),
    clientData: clientDataBase64,       // built above
    attestationData: attestationBase64, // contains the public key
  },
  encryptedPrivateKey, // encrypted blob only, password stays with user
}

// 1. Prompt user for their recovery password
const recoveryPassword = await promptUser('Enter your recovery password')

// 2. Get the encrypted recovery key from Dfns (returned during recovery init)
const encryptedData = JSON.parse(encryptedPrivateKey)

// 3. Derive the encryption key from the user's password
const encryptionKey = crypto.pbkdf2Sync(
  recoveryPassword,
  Buffer.from(encryptedData.salt, 'base64'),
  100000,
  32,
  'sha256'
)

// 4. Decrypt the private key
const decipher = crypto.createDecipheriv(
  'aes-256-gcm',
  encryptionKey,
  Buffer.from(encryptedData.iv, 'base64')
)
decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'base64'))

let privateKeyPem = decipher.update(encryptedData.data, 'base64', 'utf8')
privateKeyPem += decipher.final('utf8')

// 5. Sign the recovery challenge with the decrypted key
const recoveryKey = crypto.createPrivateKey(privateKeyPem)
const newCredential = { /* user's new passkey */ }
const signature = crypto.sign(
  undefined,
  Buffer.from(JSON.stringify(newCredential)),
  recoveryKey
)

// 6. Complete recovery - send signature to Dfns
await dfnsClient.auth.recoverUser({
  body: {
    recovery: {
      credentialAssertion: {
        credId: recoveryCredentialId,
        clientData: clientDataBase64,  // See credentials-data docs
        signature: signature.toString('base64'),
      }
    },
    newCredential,
  }
})