feat(crypto): stabilize AES-GCM encryption

crypto/unstable_aes_gcm.ts → crypto/aes_gcm.ts

@@ -12,7 +12,7 @@ export type { Uint8Array_ };
  *
  * @example Usage
  * ```ts
- * import { encryptAesGcm, decryptAesGcm } from "@std/crypto/unstable-aes-gcm";
+ * import { encryptAesGcm, decryptAesGcm } from "@std/crypto/aes-gcm";
  * import { assertEquals } from "@std/assert";
  *
  * const key = await crypto.subtle.generateKey(
@@ -48,7 +48,7 @@ export interface AesGcmOptions {
  *
  * @example Usage
  * ```ts
- * import { encryptAesGcm } from "@std/crypto/unstable-aes-gcm";
+ * import { encryptAesGcm } from "@std/crypto/aes-gcm";
  * import { assertNotEquals } from "@std/assert";
  *
  * const key = await crypto.subtle.generateKey(
@@ -88,6 +88,7 @@ export async function encryptAesGcm(
     iv: nonce,
     tagLength: TAG_LENGTH * 8,
   };
+
   if (options?.additionalData !== undefined) {
     params.additionalData = options.additionalData;
   }
@@ -109,7 +110,7 @@ export async function encryptAesGcm(
  *
  * @example Usage
  * ```ts
- * import { decryptAesGcm, encryptAesGcm } from "@std/crypto/unstable-aes-gcm";
+ * import { decryptAesGcm, encryptAesGcm } from "@std/crypto/aes-gcm";
  * import { assertEquals } from "@std/assert";
  *
  * const key = await crypto.subtle.generateKey(

crypto/unstable_aes_gcm_test.ts → crypto/aes_gcm_test.ts

@@ -1,7 +1,7 @@
 // Copyright 2018-2026 the Deno authors. MIT license.
 
 import { assertEquals, assertNotEquals, assertRejects } from "@std/assert";
-import { decryptAesGcm, encryptAesGcm } from "./unstable_aes_gcm.ts";
+import { decryptAesGcm, encryptAesGcm } from "./aes_gcm.ts";
 
 const encoder = new TextEncoder();
 
@@ -192,3 +192,21 @@ Deno.test("encryptAesGcm()/decryptAesGcm() round-trips DataView inputs", async (
   const decrypted = await decryptAesGcm(key, encryptedView);
   assertEquals(decrypted, plaintext);
 });
+
+Deno.test("encryptAesGcm()/decryptAesGcm() round-trips Uint8Array subarray with non-zero byteOffset", async () => {
+  const key = await generateKey(256);
+  const plaintext = encoder.encode("offset test");
+
+  const paddedPlaintext = new Uint8Array(16 + plaintext.byteLength);
+  paddedPlaintext.set(plaintext, 16);
+  const plaintextSubarray = paddedPlaintext.subarray(16);
+
+  const encrypted = await encryptAesGcm(key, plaintextSubarray);
+
+  const paddedEncrypted = new Uint8Array(8 + encrypted.byteLength);
+  paddedEncrypted.set(encrypted, 8);
+  const encryptedSubarray = paddedEncrypted.subarray(8);
+
+  const decrypted = await decryptAesGcm(key, encryptedSubarray);
+  assertEquals(decrypted, plaintext);
+});

crypto/deno.json

@@ -5,7 +5,7 @@
     ".": "./mod.ts",
     "./crypto": "./crypto.ts",
     "./timing-safe-equal": "./timing_safe_equal.ts",
-    "./unstable-aes-gcm": "./unstable_aes_gcm.ts"
+    "./aes-gcm": "./aes_gcm.ts"
   },
   "exclude": [
     "_wasm/target"

crypto/mod.ts

@@ -20,5 +20,6 @@
  * @module
  */
 
+export * from "./aes_gcm.ts";
 export * from "./crypto.ts";
 export * from "./timing_safe_equal.ts";