---
title: securestore
slug: develop/securestore
docTags: 
createdAt: 2025-03-26T14:48:48.846Z
---

The *securestore* object provides a mechanism for securely storing customer data within the player. Data held in the *securestore* are encrypted using root keys which are held securely within the player hardware and are unique to each unit. In general, the *securestore* is used to hold a second-level key which in turn is used for subsequent decryption. The key itself cannot be retrieved, but the user can ask the *securestore* to perform decryption using it.

The capacity of the *securestore* is limited and customers should not store more than 256kB of keys.

**securestore IDL**

```javascript
interface SecureStore {
    Promise<void> writePkcs8DecryptionKey(String name, Array<byte> data)
    Promise<void> writePkcs8MediaDecryptionKey(String name, Array<byte> data)
    Promise<Array<byte>> decryptWithPkcs8Key(String name, String algorithm, String hash, Array<byte> data)
    Promise<void> eraseSecureStore();
}; 
```

## Object Creation

To create a *securestore* object, load th&#x65;*&#xA0;@brightsign/securestore* module using the Node.js® require() method:

```javascript
var securestoreClass = require("@brightsign/securestore");
var securestore = new securestoreClass();
```

## SecureStore

**writePkcs8DecryptionKey()**

```javascript
Promise<void> writePkcs8DecryptionKey(String name, Array<byte> data)
```

Writes the key in pkcs8 format to the securestore.

- `name` <font color="#6554c0">string:</font> The filename of the key within the secure store.
- `data` <font color="#6554c0">Array:</font>  The key as a Uint8 data array.

**decryptWithPkcs8Key()**

```javascript
Promise<Array<byte>> decryptWithPkcs8Key(String name, String algorithm, String hash, Array<byte> data)
```

Decrypts a data array using the designated key stored in the securestore and using the designated algorithm and hash.

- `name` <font color="#6554c0">string</font>: The filename of the key within the secure store.
- `algorithm` <font color="#6554c0">string</font>: For the moment, the only algorithm supported is ""RSA-OAEP".  
- `hash` <font color="#6554c0">string</font>:  Hash values can be any of the following: "SHA-1", "SHA-256", "SHA-384" or "SHA-512".
- `data` <font color="#6554c0">Array</font>:  Uint8Array data

**eraseSecureStore()**

```javascript
Promise<void> eraseSecureStore()
```

Completely deletes the securestore.

## Examples

Write example:

```javascript
window.crypto.subtle.generateKey(
    {
    name: "RSA-OAEP", 
    modulusLength: 2048, //can be 1024, 2048, or 4096
    publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
    hash: {name: "SHA-1"}, //can be "SHA-1", "SHA-256", "SHA-384", or "SHA-512"
    },
    true, //whether the key is extractable (i.e. can be used in exportKey)
    ["encrypt", "decrypt"] //must be ["encrypt", "decrypt"] or ["wrapKey", "unwrapKey"]
)
.then(function(key){
    window.crypto.subtle.exportKey("pkcs8", key.privateKey)
    .then(function(exportKey) {
        var SecureClass = require("@brightsign/securestore");
        var secure = new SecureClass();
        secure.writePkcs8DecryptionKey("testkey.bin", Array.from(new Uint8Array(exportKey)))
        .then(function(){

        ....

       }

    ....

    });
```

Decrypt example:

```javascript
var SecureClass = require("@brightsign/securestore");
var secure = new SecureClass();

decryptWithPkcs8Key("testkey.bin", "RSA-OAEP", "SHA-1", Array.from(new Uint8Array(encrypted)))
    .then(function(decryptedArray){

        ....
})
```

Delete example:

```javascript
var SecureClass = require("@brightsign/securestore");
var secure = new SecureClass();

secure.eraseSecureStore()
```