@blamejs/pki 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.3 — 2026-07-04
+
+WebCrypto EC key import validates the curve against the key material.
+
+### Security
+
+- pki.webcrypto.subtle.importKey now derives an imported EC key's named curve from the key material and enforces it across the spki, pkcs8 and jwk formats. Previously it trusted the caller-supplied namedCurve without checking it against the key, so a key on an unsupported curve (for example secp256k1) imported as an approved curve, and a key on one curve could be labelled as another — an algorithm-confusion vector in which the CryptoKey's algorithm disagreed with its key material. A curve the framework does not support is now rejected (NotSupportedError) and a namedCurve that does not match the key is rejected (DataError); generateKey already enforced this, and import now matches it. The raw-key format was already validated against its declared curve and is unchanged.
+
 ## v0.1.2 — 2026-07-04
 
 Fail-closed hardening across the DER codec, WebCrypto engine, and X.509 parser.

package/lib/webcrypto.js

@@ -490,7 +490,23 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
 }
 
 function _algFromImport(name, alg, keyObject) {
-  if (name === "ECDSA" || name === "ECDH") return { name: name, namedCurve: alg.namedCurve || _curveFromKey(keyObject) };
+  if (name === "ECDSA" || name === "ECDH") {
+    // W3C WebCrypto EC import — the curve is a property of the KEY, not the
+    // caller's claim. Derive it from the imported key material; reject an
+    // unsupported curve (NotSupportedError, matching generateKey) and reject a
+    // requested namedCurve that disagrees with the key (DataError). Trusting
+    // alg.namedCurve would mislabel the CryptoKey (algorithm confusion) and let
+    // a non-approved curve import as an approved one.
+    var actualCurve = _curveFromKey(keyObject);
+    if (!actualCurve) {
+      throw new WebCryptoError("webcrypto/not-supported", name + ": imported key uses an unsupported EC curve");
+    }
+    if (alg.namedCurve && alg.namedCurve !== actualCurve) {
+      throw new WebCryptoError("webcrypto/data", name + ": importKey namedCurve " + JSON.stringify(alg.namedCurve) +
+        " does not match the imported key's curve " + JSON.stringify(actualCurve));
+    }
+    return { name: name, namedCurve: actualCurve };
+  }
   if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") return { name: name, hash: _hashObj(alg.hash) };
   if (name === "ED25519") return { name: "Ed25519" };
   if (name === "ED448") return { name: "Ed448" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:61f60234-7f86-4857-9542-58817209d84d",
+  "serialNumber": "urn:uuid:2e1fe0ea-94e8-4271-ae62-9f7de0920674",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-04T19:11:06.976Z",
+    "timestamp": "2026-07-04T19:30:56.018Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.2",
+      "bom-ref": "@blamejs/pki@0.1.3",
       "type": "application",
       "name": "pki",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.2",
+      "ref": "@blamejs/pki@0.1.3",
       "dependsOn": []
     }
   ]