@blamejs/pki 0.2.20 → 0.2.21

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.21 — 2026-07-15
+
+ML-KEM public keys in X.509 certificates and PKCS#8 private keys (RFC 9935 / FIPS 203) become a first-class, fail-closed surface: certification-path validation enforces the keyEncipherment-only key usage, key import validates the private-key CHOICE and rejects an inconsistent key with a typed error, and pki.lint gains the RFC 9935 certificate rows.
+
+### Added
+
+- pki.path.validate enforces the RFC 9935 section 5 key-usage rule for ML-KEM (id-ml-kem-512/768/1024) certificates: a present keyUsage MUST assert keyEncipherment as the only bit. A leaf with digitalSignature, an ML-KEM key with keyCertSign / cRLSign / keyAgreement / dataEncipherment / nonRepudiation, or keyEncipherment set alongside any reserved bit, fails closed with the frozen code path/kem-key-usage -- for the target and every intermediate whose own subject key is ML-KEM. An absent keyUsage places no restriction (RFC 5280 section 4.2.1.3).
+- pki.lint gains an rfc9935 profile: lint/rfc9935/kem-key-usage (the section 5 keyEncipherment-only rule) and lint/rfc9935/kem-key-length (the SPKI encapsulation key must be exactly 800 / 1184 / 1568 octets for the id-ml-kem-512 / 768 / 1024 OID -- the OID is the sole authority for the parameter set, so an OCTET-STRING-wrapped or wrong-set key is flagged). Both run by default and are silent on a non-ML-KEM certificate.
+
+### Fixed
+
+- pki.webcrypto.subtle.importKey no longer surfaces a raw engine exception when handed a malformed or inconsistent key: a bad SPKI, a bad JWK, or an ML-KEM private key whose seed and expanded halves are inconsistent (FIPS 203 section 7.3) now fails closed with a typed webcrypto/data error. For an ML-KEM PKCS#8, the RFC 9935 section 6 private-key CHOICE is validated by its DER tag and exact size for the algorithm OID before the engine imports it -- the OpenSSL-legacy bare-seed, bare-expanded-key, and concatenated layouts the engine would otherwise accept are rejected, so a non-conformant private key cannot be imported under an ML-KEM name.
+- pki.webcrypto.subtle.importKey now fails closed on two further malformed-input classes: a JWK import whose key data is not an object (null, a primitive, or an array -- including the JSON null an unwrap over non-authenticating ciphertext can yield) returns a typed webcrypto/data error instead of a raw TypeError; and an SPKI or PKCS#8 import requested under a secret-key or key-derivation algorithm name (AES-GCM/CBC/CTR/KW, HMAC, HKDF, PBKDF2) is rejected as webcrypto/not-supported rather than importing a mislabeled key handle.
+
 ## v0.2.20 — 2026-07-15
 
 A WebAuthn attestation object whose attestation statement is not a CBOR map is now rejected with a typed webauthn/bad-attestation-object at parse instead of surfacing an untyped error from a format verifier, and the strict CBOR codec gains pki.cbor.read.mapGet -- a keyed map lookup that asserts the map's major type inside the accessor.

package/README.md

@@ -201,7 +201,7 @@ is callable today; nothing below is a stub.
 | `pki.asn1` | Strict, bounded DER codec — `decode` (zero-copy node tree), `encode`, `build.*` canonical-DER value builders, `read.*` typed readers, `TAGS`, OID-content encode/decode |
 | `pki.cbor` | Strict, bounded RFC 8949 deterministic CBOR codec — `decode` (zero-copy node tree) + `read.*` typed leaf readers incl. the keyed map lookup `read.mapGet` (text or COSE-label integer key, the map's major type asserted in the accessor), fail-closed on every non-canonical shape (indefinite length, non-minimal argument, unsorted / duplicate map keys, non-shortest float, trailing bytes) |
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
-| `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation (KEM encapsulation on the roadmap). Zero-dependency, OpenSSL-interoperable |
+| `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/lint.js

@@ -25,6 +25,7 @@
 
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
+var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
@@ -458,11 +459,51 @@ var CABF_TLS_RULES = [
   },
 ];
 
+// RFC 9935 -- ML-KEM public keys in X.509 certificates. The OID is the sole authority for the
+// parameter set; the SPKI BIT STRING is the raw ek, exactly 384k+32 octets for that OID.
+var ML_KEM_EK_LEN = {};
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n, i) { ML_KEM_EK_LEN[n] = [800, 1184, 1568][i]; });
+function _isMlKem(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  return !!(spki && spki.algorithm && ML_KEM_EK_LEN[spki.algorithm.name] !== undefined);
+}
+var RFC9935_RULES = [
+  {
+    id: "lint/rfc9935/kem-key-usage", severity: "error", source: "rfc9935", citation: "RFC 9935 5",
+    message: "an ML-KEM certificate's keyUsage, if present, must assert keyEncipherment as the only key usage set",
+    appliesTo: _isMlKem,
+    check: function (cert, ctx) {
+      var ku = ctx.decode("keyUsage");
+      if (!ku || !ku.value) return null;   // absent keyUsage is unconstrained (RFC 5280 4.2.1.3)
+      var v = ku.value;
+      var others = v.digitalSignature || v.nonRepudiation || v.dataEncipherment || v.keyAgreement ||
+        v.keyCertSign || v.cRLSign || v.encipherOnly || v.decipherOnly || v.reservedBitsSet === true;
+      return (v.keyEncipherment && !others) ? null : true;
+    },
+  },
+  {
+    id: "lint/rfc9935/kem-key-length", severity: "error", source: "rfc9935", citation: "RFC 9935 4 / FIPS 203",
+    message: "an ML-KEM subjectPublicKey must be the raw encapsulation key at its exact FIPS 203 size for the OID, in a byte-aligned BIT STRING",
+    appliesTo: _isMlKem,
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      var want = ML_KEM_EK_LEN[spki.algorithm.name];
+      var pub = spki.publicKey;   // a parsed SPKI always surfaces the BIT STRING as { bytes, unusedBits }
+      // The ek is a raw byte string carried in the BIT STRING: it must be the exact size AND
+      // byte-aligned. A right-length but non-octet-aligned BIT STRING (unusedBits != 0) is not the
+      // raw ek (RFC 9935 sec. 4); route the alignment test through the shared guard primitive.
+      return (guard.crypto.isOctetAligned(pub) && pub.bytes.length === want) ? null
+        : { context: { expected: want, got: pub.bytes.length, unusedBits: pub.unusedBits } };
+    },
+  },
+];
+
 var PROFILES = {
   "rfc5280": RFC5280_RULES,
+  "rfc9935": RFC9935_RULES,
   "cabf-tls": CABF_TLS_RULES,
 };
-var ALL_RULES = RFC5280_RULES.concat(CABF_TLS_RULES);
+var ALL_RULES = RFC5280_RULES.concat(RFC9935_RULES).concat(CABF_TLS_RULES);
 
 function _selectRules(profile) {
   if (profile == null || profile === "all" || profile === "default") return ALL_RULES;
@@ -557,7 +598,7 @@ function rules(profile) {
  *
  * List the known lint-profile names.
  * @example
- *   pki.lint.profiles();   // -> ["rfc5280", "cabf-tls"]
+ *   pki.lint.profiles();   // -> ["rfc5280", "rfc9935", "cabf-tls"]
  */
 function profiles() { return Object.keys(PROFILES); }
 

package/lib/oid.js

@@ -553,7 +553,7 @@ var _PARAMS_ABSENT = new Set();
   "id-hash-slh-dsa-shake-192s-with-shake256", "id-hash-slh-dsa-shake-192f-with-shake256",
   "id-hash-slh-dsa-shake-256s-with-shake256", "id-hash-slh-dsa-shake-256f-with-shake256",
   "Ed25519", "Ed448", "X25519", "X448",
-  // FIPS 203 ML-KEM (RFC 9936 sec. 3: PARAMS ARE absent).
+  // FIPS 203 ML-KEM (RFC 9935 sec. 3 certificates + RFC 9936 sec. 3 CMS: PARAMS ARE absent).
   "id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024",
   // HKDF key-derivation identifiers (RFC 8619 sec. 2: when any of these appear
   // within AlgorithmIdentifier, the parameters component SHALL be absent).

package/lib/path-validate.js

@@ -331,6 +331,32 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
+// The ML-KEM SubjectPublicKeyInfo OIDs (RFC 9935 / FIPS 203). A certificate carrying one of
+// these keys is a KEM key-establishment certificate: it can neither sign nor agree.
+var ML_KEM_OIDS = {};
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
+
+// RFC 9935 sec. 5: a certificate whose SubjectPublicKeyInfo carries an id-ml-kem-* OID, IF it
+// has a keyUsage extension, MUST assert keyEncipherment as the ONLY key usage set -- an ML-KEM
+// key is a key-establishment-only key (it cannot sign or agree, so no other bit is legitimate,
+// and an unnamed/reserved bit set alongside keyEncipherment is equally forbidden). The caller
+// invokes this only for an ML-KEM-keyed certificate; an absent keyUsage places no restriction
+// (RFC 5280 sec. 4.2.1.3). This also makes an ML-KEM "CA" (keyCertSign) an explicit reject.
+function kemKeyUsageCheck(cert) {
+  var ku;
+  try { ku = decodeExt(cert, OID.keyUsage); }
+  catch (e) { return { ok: false, code: "path/kem-key-usage", error: e }; }
+  if (!ku) return { ok: true };
+  var v = ku.value;
+  var others = v.digitalSignature || v.nonRepudiation || v.dataEncipherment || v.keyAgreement ||
+    v.keyCertSign || v.cRLSign || v.encipherOnly || v.decipherOnly || (v.reservedBitsSet === true);
+  if (!v.keyEncipherment || others) {
+    return { ok: false, code: "path/kem-key-usage",
+      error: E("path/kem-key-usage", "an ML-KEM key's keyUsage must assert keyEncipherment as the only bit (RFC 9935 sec. 5)") };
+  }
+  return { ok: true };
+}
+
 // Import a descriptor's verification key, validating an EdDSA point FIRST: node/OpenSSL import a
 // low-order (e.g. identity or all-zeroes) Ed25519/Ed448 SPKI without complaint and such a key
 // verifies a forged signature. This is the ONE seam both the certificate path and the revocation
@@ -1215,6 +1241,14 @@ async function validate(path, opts) {
       if (!cku.ok) failed = true;
     }
 
+    // RFC 9935 sec. 5: an ML-KEM-keyed certificate's keyUsage must be keyEncipherment-only.
+    // Runs for the target AND every intermediate whose own subject key is ML-KEM.
+    if (ML_KEM_OIDS[cert.subjectPublicKeyInfo.algorithm.oid]) {
+      var kku = kemKeyUsageCheck(cert);
+      checks.push({ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
+      if (!kku.ok) failed = true;
+    }
+
     // 6.1.3(a)(2) validity window.
     var t = opts.time;
     var vOk = true, vCode;

package/lib/schema-pkix.js

@@ -660,6 +660,14 @@ function certExtensionDecoders(ns) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
       out[nm] = byte < bs.bytes.length && (bs.bytes[byte] & mask) !== 0;
     });
+    // Any bit beyond the 9 named positions is a reserved/unknown usage. RFC 5280 tolerates it,
+    // but a "MUST be the ONLY bit" rule (e.g. RFC 9935 sec. 5 ML-KEM keyEncipherment-only) needs
+    // to see it -- so surface it rather than silently drop bits >= 9.
+    var reserved = false;
+    for (var bit2 = KU_BITS.length; bit2 < bs.bytes.length * 8 && !reserved; bit2++) {
+      if ((bs.bytes[bit2 >> 3] & (0x80 >> (bit2 & 7))) !== 0) reserved = true;
+    }
+    out.reservedBitsSet = reserved;
     return out;
   }
 

package/lib/webcrypto.js

@@ -22,10 +22,11 @@
  *   still runs on -- RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA, ECDH,
  *   Ed25519 / Ed448, AES-GCM / CBC / KW, HMAC, HKDF, PBKDF2, and the SHA
  *   family (including legacy SHA-1 for old certificates and signatures).
- *   FIPS 203 ML-KEM key generation and encoding are available; KEM
- *   encapsulation follows once Node exposes it. Because it is
- *   OpenSSL-backed, every key and signature it emits is interoperable
- *   with OpenSSL, NSS, and other PKI implementations.
+ *   FIPS 203 ML-KEM key generation, encoding, and certificate/PKCS#8
+ *   import are available; KEM encapsulation/decapsulation is deferred to
+ *   the CMS KEM-decrypt surface by decision (the Node primitive exists).
+ *   Because it is OpenSSL-backed, every key and signature it emits is
+ *   interoperable with OpenSSL, NSS, and other PKI implementations.
  *
  * @card
  *   A zero-dep, PQC-first W3C WebCrypto (`SubtleCrypto`) engine over
@@ -37,6 +38,8 @@ var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var constants = require("./constants");
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
 
 // Single-owner error class -- co-located with its module (framework-error
 // stays the cross-module home; this is webcrypto-private). withCause: a
@@ -127,8 +130,9 @@ var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-
 
 // FIPS 205 SLH-DSA -- stateless hash-based signatures. All twelve
 // parameter sets Node exposes; signing is one-shot (null algorithm), the
-// same shape as ML-DSA / EdDSA. KEM encapsulation for ML-KEM is not yet
-// in Node's API, so ML-KEM here is key-generation / encoding only.
+// same shape as ML-DSA / EdDSA. ML-KEM here is key-generation / encoding /
+// import; encapsulation/decapsulation (which Node now exposes) is deferred
+// to the CMS KEM-decrypt surface, not blocked by the engine.
 var SLH_DSA_NODE = {};
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
@@ -144,6 +148,12 @@ var SIGN_VERIFY_NAMES = {};
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
 var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
 var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true };
+// The secret-key / KDF algorithms whose key material is raw octets (imported via "raw" or a
+// JWK "oct"), NEVER an SPKI / PKCS#8 asymmetric-key structure. importKey("spki"|"pkcs8", ...)
+// under one of these names is unsupported (W3C: NotSupportedError) -- and, without this gate, it
+// would mint a mislabeled CryptoKey wrapping an asymmetric handle AND dodge the algorithm-keyed
+// pkcs8 pre-validation (e.g. the RFC 9935 ML-KEM CHOICE guard).
+var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true };
 
 // ---- CryptoKey -------------------------------------------------------
 
@@ -654,14 +664,97 @@ function _assertAesImportLen(name, byteLen) {
   }
 }
 
+// Run a node:crypto key-import call, mapping a raw engine error (a malformed DER, an
+// inconsistent key) to a typed webcrypto/data DataError -- importKey over hostile bytes
+// must never leak a bare OpenSSL/Node exception through the public API.
+function _nodeKey(fn, who) {
+  try { return fn(); }
+  catch (e) {
+    // Coverage residual -- every current thunk calls node:crypto (which throws a node error),
+    // never a WebCryptoError, so this already-typed passthrough is defensive depth for a future
+    // thunk that pre-validates and throws typed; it prevents double-wrapping a typed error.
+    if (e instanceof WebCryptoError) throw e;
+    throw new WebCryptoError("webcrypto/data", who + ": the key material is malformed or internally inconsistent", e);
+  }
+}
+
+// RFC 9935 sec. 6 ML-KEM-*-PrivateKey CHOICE: the inner sizes, keyed by the OID -- the OID is
+// the SOLE authority for the parameter set (never a length heuristic). ek = 384k+32, dk = the
+// FIPS 203 decapsulation key length.
+var ML_KEM_INNER = {};
+ML_KEM_INNER[oid.byName("id-ml-kem-512")] = { ek: 800, dk: 1632 };
+ML_KEM_INNER[oid.byName("id-ml-kem-768")] = { ek: 1184, dk: 2400 };
+ML_KEM_INNER[oid.byName("id-ml-kem-1024")] = { ek: 1568, dk: 3168 };
+
+function _isOctet(node, size) {
+  return node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING &&
+    !node.constructed && node.content && node.content.length === size;
+}
+// Validate the RFC 9935 sec. 6 inner CHOICE structurally, dispatching on the DER tag (0x80 seed
+// [0] / 0x04 expandedKey / 0x30 both) -- NEVER on the length of the enclosing OCTET STRING. A
+// bare seed, a bare dk, an oqskeypair dk||ek, a constructed [0], or a wrong-size arm is rejected
+// fail-closed (guards never guess a plausible layout). The seed/expandedKey CRYPTOGRAPHIC
+// consistency (sec. 8 / FIPS 203 sec. 7.3) is enforced by the engine on import (a mismatch is a
+// raw node error _nodeKey maps to webcrypto/data).
+function _validateMlKemInner(innerBytes, sizes) {
+  var node;
+  try { node = asn1.decode(innerBytes); }
+  catch (e) { throw new WebCryptoError("webcrypto/data", "an ML-KEM private key must be the RFC 9935 sec. 6 seed/expandedKey/both CHOICE, not a bare key", e); }
+  if (node.tagClass === "context" && node.tagNumber === 0 && !node.constructed) {
+    if (!node.content || node.content.length !== 64) throw new WebCryptoError("webcrypto/data", "an ML-KEM seed must be exactly 64 octets (RFC 9935 sec. 6)");
+    return;
+  }
+  if (_isOctet(node, sizes.dk)) return;
+  if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && !node.constructed) {
+    throw new WebCryptoError("webcrypto/data", "an ML-KEM expandedKey must be exactly " + sizes.dk + " octets for this parameter set (RFC 9935 sec. 6)");
+  }
+  if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SEQUENCE) {
+    // Coverage residual -- a decoded universal SEQUENCE always carries a children array, so the
+    // `|| []` fallback is defensive (asn1.decode never yields a childless constructed node).
+    var kids = node.children || [];
+    if (kids.length !== 2 || !_isOctet(kids[0], 64) || !_isOctet(kids[1], sizes.dk)) {
+      throw new WebCryptoError("webcrypto/data", "an ML-KEM both-arm must be SEQUENCE { seed OCTET STRING(64), expandedKey OCTET STRING(" + sizes.dk + ") } (RFC 9935 sec. 6)");
+    }
+    return;
+  }
+  throw new WebCryptoError("webcrypto/data", "an ML-KEM private key must be the seed, expandedKey, or both CHOICE (RFC 9935 sec. 6)");
+}
+
+// PKCS#8 inner-key pre-validation, keyed by the privateKeyAlgorithm OID (a registry row, not a
+// switch). The parse surfaces the inner key as opaque octets by design; the fail-closed
+// per-algorithm structural check lives here, at the one import boundary. Only ML-KEM needs it
+// today: the engine ACCEPTS the OpenSSL-legacy bare-seed layout RFC 9935 sec. 6 forbids.
+var PKCS8_INNER_VALIDATORS = {};
+Object.keys(ML_KEM_INNER).forEach(function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
+
+function _preValidatePkcs8(p8, name) {
+  if (!ML_KEM_NODE[name]) return;   // only the ML-KEM CHOICE carries the bare-seed hazard
+  var algOid, innerBytes;
+  try {
+    var root = asn1.decode(p8);
+    algOid = asn1.read.oid(root.children[1].children[0]);
+    innerBytes = asn1.read.octetString(root.children[2]);
+  } catch (e) { throw new WebCryptoError("webcrypto/data", "importKey pkcs8: the ML-KEM PKCS#8 envelope is not well-formed", e); }
+  var validate = PKCS8_INNER_VALIDATORS[algOid];
+  if (!validate) throw new WebCryptoError("webcrypto/data", "importKey pkcs8: " + name + " does not match the key's algorithm OID");
+  validate(innerBytes);
+}
+
 SubtleCrypto.prototype.importKey = async function importKey(format, keyData, algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "importKey");
   var usages = keyUsages || [];
   var name = alg.name;
 
+  // spki / pkcs8 carry an asymmetric key; a secret-key / KDF name has no such structure. Reject
+  // it up front (W3C NotSupportedError) so it can neither mint a mislabeled key nor bypass the
+  // per-algorithm pkcs8 pre-validation below.
+  if ((format === "spki" || format === "pkcs8") && SECRET_KEY_NAMES[name]) {
+    throw new WebCryptoError("webcrypto/not-supported", "importKey: " + name + " does not support the " + format + " key format");
+  }
+
   if (format === "raw") {
     // Symmetric raw material, or a raw public key for EC/OKP.
-    if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW" || name === "HMAC" || name === "HKDF" || name === "PBKDF2") {
+    if (SECRET_KEY_NAMES[name]) {
       var raw = _toBuf(keyData, "importKey raw");
       _assertAesImportLen(name, raw.length);
       var secret = nodeCrypto.createSecretKey(raw);
@@ -673,15 +766,24 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
   }
 
   if (format === "spki") {
-    var pub = nodeCrypto.createPublicKey({ key: _toBuf(keyData, "importKey spki"), format: "der", type: "spki" });
+    var spkiBuf = _toBuf(keyData, "importKey spki");
+    var pub = _nodeKey(function () { return nodeCrypto.createPublicKey({ key: spkiBuf, format: "der", type: "spki" }); }, "importKey spki");
     return new CryptoKey("public", true, _algFromImport(name, alg, pub), usages, pub);
   }
   if (format === "pkcs8") {
-    var priv = nodeCrypto.createPrivateKey({ key: _toBuf(keyData, "importKey pkcs8"), format: "der", type: "pkcs8" });
+    var p8Buf = _toBuf(keyData, "importKey pkcs8");
+    _preValidatePkcs8(p8Buf, name);
+    var priv = _nodeKey(function () { return nodeCrypto.createPrivateKey({ key: p8Buf, format: "der", type: "pkcs8" }); }, "importKey pkcs8");
     return new CryptoKey("private", extractable, _algFromImport(name, alg, priv), usages, priv);
   }
   if (format === "jwk") {
     var jwk = keyData;
+    // A JWK is a JSON object; null / undefined / an array / a primitive (incl. the JSON token
+    // `null` from an unwrapKey over non-authenticating ciphertext) fails closed as a typed
+    // DataError, never a raw property-access TypeError.
+    if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) {
+      throw new WebCryptoError("webcrypto/data", "importKey jwk: keyData must be a JsonWebKey object");
+    }
     if (jwk.kty === "oct") {
       var kbuf = _b64urlToBuf(jwk.k, "JWK oct key material");
       _assertAesImportLen(name, kbuf.length);
@@ -690,7 +792,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
       return new CryptoKey("secret", extractable, a2, usages, s2);
     }
     var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d");
-    var ko = isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+    var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
   throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + JSON.stringify(format));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2c42308d-4c79-437b-8bf2-36089abf8898",
+  "serialNumber": "urn:uuid:77add14d-d236-4f91-aec8-607349cb6aa8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-15T22:55:37.673Z",
+    "timestamp": "2026-07-16T01:35:31.295Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.20",
+      "bom-ref": "@blamejs/pki@0.2.21",
       "type": "application",
       "name": "pki",
-      "version": "0.2.20",
+      "version": "0.2.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.20",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.20",
+      "ref": "@blamejs/pki@0.2.21",
       "dependsOn": []
     }
   ]