> ## Documentation Index
> Fetch the complete documentation index at: https://trust-link-tsn.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# encryptTinSensitiveField — Encrypt sensitive field

> Encrypt a TIN-sensitive field locally with a signature-derived AES-GCM key and return its authorization hash.

## What it does

This function encrypts a sensitive TIN field using a key derived from the TIN, field type, and user signature. It also returns a hash of the signature for registry binding.

## How the flow works

<Steps>
  <Step title="Caller invokes the function">The caller provides the TIN, field type, plaintext value, and user signature.</Step>
  <Step title="Validation">The SDK requires WebCrypto AES-GCM support and uses the exact field type and signature bytes for key derivation.</Step>
  <Step title="Main work">It generates or accepts a nonce, encrypts the value, and hashes the signature bytes.</Step>
  <Step title="Result">It returns `{ nonce, ciphertext, userAuthorizationHash }` for the sensitive-field instruction.</Step>
</Steps>

## Signature

```ts theme={null}
export async function encryptTinSensitiveField(params: {
  tin: bigint | number | string; fieldType: string; value: string;
  userSignature: Uint8Array | string; nonce?: Uint8Array;
}): Promise<{ nonce: Uint8Array; ciphertext: Uint8Array; userAuthorizationHash: Uint8Array }>
```

<ParamField path="tin" type="bigint | number | string" required>TIN key input.</ParamField>
<ParamField path="fieldType" type="string" required>Field namespace bound into the key.</ParamField>
<ParamField path="value" type="string" required>Plaintext field value.</ParamField>
<ParamField path="userSignature" type="Uint8Array | string" required>Authorization material used for key derivation and hashing.</ParamField>
<ParamField path="nonce" type="Uint8Array" required={false}>Optional AES-GCM nonce.</ParamField>

## Result and errors

Returns ciphertext, nonce, and a 32-byte authorization hash. WebCrypto failures are propagated.

```ts theme={null}
const encrypted = await encryptTinSensitiveField({ tin, fieldType: "phone", value, userSignature });
```

Source: [`tins.ts:1362-1379`](https://github.com/Trustlink-Labs/TSN-Protocol/blob/main/tsn-protocol/sdks/tsn-sdk/src/tins.ts#L1362-L1379)