General Upgrade, NEW: WebServers, Better Docs

wasm/src/crypto.rs

@@ -1,4 +1,5 @@
 use wasm_bindgen::prelude::*;
+use zeroize::Zeroizing;
 
 use mtp_crypto::{
     AeadDecrypt, AeadEncrypt, ChaCha20Poly1305, Ed25519Signer, HybridKem, KemPrivateKey,
@@ -22,7 +23,7 @@ impl WasmKeyring {
     /// Serialise the keyring to bytes.
     #[wasm_bindgen]
     pub fn to_bytes(&self) -> Vec<u8> {
-        self.inner.to_bytes()
+        self.inner.to_bytes().to_vec()
     }
 
     /// Deserialise a keyring from bytes.
@@ -45,7 +46,7 @@ impl WasmKeyring {
 /// Generate a full keyring with KEM, ML-DSA, and Ed25519 keys.
 #[wasm_bindgen]
 pub fn keyring_generate() -> Vec<u8> {
-    Keyring::generate().to_bytes()
+    Keyring::generate().to_bytes().to_vec()
 }
 
 /// Build a [`Keyring`] containing only an Ed25519 keypair (no KEM, no ML-DSA).
@@ -68,7 +69,7 @@ pub fn keyring_from_ed25519(secret_key: &[u8], public_key: &[u8]) -> Result<Vec<
         SignaturePublicKey::new(public_key.to_vec()),
         SignaturePrivateKey::new(secret_key.to_vec()),
     );
-    Ok(keyring.to_bytes())
+    Ok(keyring.to_bytes().to_vec())
 }
 
 // ===========================================================================
@@ -121,7 +122,7 @@ impl WasmPublicKeyBundle {
 /// decapsulate and recover the same shared secret.
 #[wasm_bindgen]
 pub struct WasmEncapsulated {
-    inner_shared_secret: Vec<u8>,
+    inner_shared_secret: Zeroizing<Vec<u8>>,
     inner_ciphertext: Vec<u8>,
 }
 
@@ -130,7 +131,7 @@ impl WasmEncapsulated {
     /// Symmetric secret derived during encapsulation.
     #[wasm_bindgen(getter)]
     pub fn shared_secret(&self) -> Vec<u8> {
-        self.inner_shared_secret.clone()
+        self.inner_shared_secret.to_vec()
     }
 
     /// KEM ciphertext to transmit to the recipient.
@@ -167,6 +168,7 @@ pub fn wasm_kem_decapsulate(
 ) -> Result<Vec<u8>, JsValue> {
     let sk = KemPrivateKey::new(recipient_private_key.to_vec());
     HybridKem::decapsulate(&sk, ciphertext)
+        .map(|secret| secret.to_vec())
         .map_err(|e| js_error(&format!("kem_decapsulate failed: {}", e)))
 }