decryptTinSensitiveField — Decrypt sensitive field

Decrypt a TIN-sensitive field locally after deriving the same key from the TIN, field type, and user signature.

What it does

This function decrypts a sensitive field encrypted by encryptTinSensitiveField; the caller must supply the same TIN, field type, nonce, ciphertext, and signature.

How the flow works

1. Caller invokes the function

   The caller supplies the encrypted field and the same authorization inputs used during encryption.
2. Validation

   The SDK derives the field-scoped AES-GCM key from the exact TIN, field type, and signature.
3. Main work

   WebCrypto authenticates and decrypts the ciphertext with the supplied nonce.
4. Result

   The plaintext field is returned locally.

Signature

export async function decryptTinSensitiveField(params: {
  tin: bigint | number | string; fieldType: string; nonce: Uint8Array;
  ciphertext: Uint8Array; userSignature: Uint8Array | string;
}): Promise<string>

tin · bigint | number | string · required

TIN key input.

fieldType · string · required

Field namespace used during encryption.

nonce · Uint8Array · required

Encryption nonce.

ciphertext · Uint8Array · required

Encrypted field value.

userSignature · Uint8Array | string · required

Same authorization material used for encryption.

Result and errors

Returns plaintext or propagates WebCrypto authentication/decryption failure.

const value = await decryptTinSensitiveField({ tin, fieldType, nonce, ciphertext, userSignature });

Source: tins.ts:1381-1403