encryptTinSocialIdentity — Encrypt social identity

Encrypt a social identity locally with an AES-GCM key derived from the TIN and return the nonce and ciphertext for linking.

What it does

This function derives the SDK social-identity key from the TIN and encrypts an arbitrary identity value locally. Plaintext is not included in the returned payload.

How the flow works

1. Caller invokes the function

   The caller supplies the TIN and plaintext identity value, with an optional nonce for deterministic tests.
2. Validation

   The SDK requires WebCrypto AES-GCM support.
3. Main work

   It derives the social key, generates a 12-byte nonce when needed, and encrypts the value.
4. Result

   It returns { nonce, ciphertext } for a later registry instruction.

Signature

export async function encryptTinSocialIdentity(params: {
  tin: bigint | number | string; value: string; nonce?: Uint8Array;
}): Promise<{ nonce: Uint8Array; ciphertext: Uint8Array }>

tin · bigint | number | string · required

Input for deterministic key derivation.

value · string · required

Plaintext identity value held only during local encryption.

nonce · Uint8Array

Optional AES-GCM nonce; otherwise generated locally.

Result and errors

Returns nonce and ciphertext. Throws WebCrypto subtle API is required for TIN encryption when WebCrypto is unavailable.

const encrypted = await encryptTinSocialIdentity({ tin, value: "example" });

Source: tins.ts:1335-1346