@blamejs/pki 0.2.21 → 0.2.23

package/lib/webcrypto.js

@@ -22,9 +22,9 @@
  *   still runs on -- RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA, ECDH,
  *   Ed25519 / Ed448, AES-GCM / CBC / KW, HMAC, HKDF, PBKDF2, and the SHA
  *   family (including legacy SHA-1 for old certificates and signatures).
- *   FIPS 203 ML-KEM key generation, encoding, and certificate/PKCS#8
- *   import are available; KEM encapsulation/decapsulation is deferred to
- *   the CMS KEM-decrypt surface by decision (the Node primitive exists).
+ *   FIPS 203 ML-KEM key generation, encoding, certificate/PKCS#8 import,
+ *   and encapsulation/decapsulation (encapsulateBits / decapsulateBits over
+ *   Node's crypto.encapsulate/decapsulate) are all available.
  *   Because it is OpenSSL-backed, every key and signature it emits is
  *   interoperable with OpenSSL, NSS, and other PKI implementations.
  *
@@ -83,6 +83,7 @@ function _normalizeAlg(algorithm, who) {
 // backwards compatibility with legacy certificates and signatures.
 var HASH_NODE = {
   "SHA-1":   "sha1",
+  "SHA-224": "sha224",
   "SHA-256": "sha256",
   "SHA-384": "sha384",
   "SHA-512": "sha512",
@@ -130,9 +131,8 @@ var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-
 
 // FIPS 205 SLH-DSA -- stateless hash-based signatures. All twelve
 // parameter sets Node exposes; signing is one-shot (null algorithm), the
-// same shape as ML-DSA / EdDSA. ML-KEM here is key-generation / encoding /
-// import; encapsulation/decapsulation (which Node now exposes) is deferred
-// to the CMS KEM-decrypt surface, not blocked by the engine.
+// same shape as ML-DSA / EdDSA. ML-KEM covers key-generation / encoding /
+// import plus encapsulateBits / decapsulateBits over Node's KEM primitive.
 var SLH_DSA_NODE = {};
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
@@ -147,13 +147,13 @@ var SIGN_VERIFY_NAMES = {};
   .concat(Object.keys(ML_DSA_NODE), Object.keys(SLH_DSA_NODE))
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
 var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
-var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true };
+var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
 // The secret-key / KDF algorithms whose key material is raw octets (imported via "raw" or a
 // JWK "oct"), NEVER an SPKI / PKCS#8 asymmetric-key structure. importKey("spki"|"pkcs8", ...)
 // under one of these names is unsupported (W3C: NotSupportedError) -- and, without this gate, it
 // would mint a mislabeled CryptoKey wrapping an asymmetric handle AND dodge the algorithm-keyed
 // pkcs8 pre-validation (e.g. the RFC 9935 ML-KEM CHOICE guard).
-var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true };
+var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
 
 // ---- CryptoKey -------------------------------------------------------
 
@@ -533,9 +533,29 @@ function _deriveBitsRaw(alg, key, length) {
     var out = nodeCrypto.pbkdf2Sync(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
     return _toArrayBuffer(out);
   }
+  if (name === "X963KDF") {
+    // ANSI-X9.63 / SEC1 sec. 3.6.1 single-step KDF: K = H(Z || INT32(counter) || SharedInfo)
+    // concatenated over counter = 1, 2, ... The RFC 5753 kari KEK derivation; the base key holds
+    // the ECDH shared secret Z, alg.info holds the DER ECC-CMS-SharedInfo.
+    _requireDeriveLength(length, "X963KDF");
+    return _toArrayBuffer(_x963Kdf(_hashNode(alg.hash, "X963KDF"), _secretBytes(key), _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8));
+  }
   throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(name));
 }
 
+// The X9.63 single-step KDF counter loop. Bounded by the 2^32 counter range; every input is a
+// public/agreed value, so a plain (non-constant-time) hash concat is correct.
+function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
+  var blocks = [], counter = 1, got = 0;
+  while (got < lenBytes) {
+    if (counter > 0xffffffff) throw new WebCryptoError("webcrypto/operation", "X963KDF: requested output exceeds the counter range");
+    var ctr = Buffer.alloc(4); ctr.writeUInt32BE(counter, 0);
+    var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
+    blocks.push(h); got += h.length; counter += 1;
+  }
+  return Buffer.concat(blocks).subarray(0, lenBytes);
+}
+
 SubtleCrypto.prototype.deriveBits = async function deriveBits(algorithm, key, length) {
   var alg = _normalizeAlg(algorithm, "deriveBits");
   _requireUsage(key, "deriveBits");
@@ -579,6 +599,41 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
   return this.importKey("raw", raw, dk, extractable, keyUsages);
 };
 
+// ML-KEM (FIPS 203) key encapsulation over Node's crypto.encapsulate/decapsulate.
+// encapsulateBits takes the recipient's PUBLIC (encapsulation) key and returns a fresh
+// { sharedKey, ciphertext }; decapsulateBits takes the PRIVATE (decapsulation) key + a
+// ciphertext and recovers the shared key. ML-KEM's Fujisaki-Okamoto transform gives IMPLICIT
+// rejection: a tampered but correctly-sized ciphertext decapsulates to a pseudo-random shared
+// key rather than failing, so decapsulateBits only throws (typed) on a malformed / wrong-length
+// ciphertext -- the "wrong key" case is indistinguishable by design, which the CMS uniform
+// decrypt-failure verdict relies on. The usage split (encapsulateBits -> public, decapsulateBits
+// -> private) already lives in the generateKey usage filters; the explicit type check hardens a
+// key imported with custom usages.
+SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorithm, encapsulationKey) {
+  var alg = _normalizeAlg(algorithm, "encapsulateBits");
+  _requireUsage(encapsulationKey, "encapsulateBits");
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "encapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
+  if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + JSON.stringify(encapsulationKey.type));
+  var r;
+  try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
+  catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
+  return { sharedKey: _toArrayBuffer(Buffer.from(r.sharedKey)), ciphertext: _toArrayBuffer(Buffer.from(r.ciphertext)) };
+};
+
+SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
+  var alg = _normalizeAlg(algorithm, "decapsulateBits");
+  _requireUsage(decapsulationKey, "decapsulateBits");
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "decapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
+  if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
+  var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
+  var ss;
+  try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
+  catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
+  return _toArrayBuffer(Buffer.from(ss));
+};
+
 SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
   var exported = await this.exportKey(format, key);
   var bytes = (format === "jwk") ? Buffer.from(JSON.stringify(exported)) : Buffer.from(exported);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:77add14d-d236-4f91-aec8-607349cb6aa8",
+  "serialNumber": "urn:uuid:218fb396-9c81-482d-be9e-f08c7add5683",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T01:35:31.295Z",
+    "timestamp": "2026-07-16T08:33:14.109Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.21",
+      "bom-ref": "@blamejs/pki@0.2.23",
       "type": "application",
       "name": "pki",
-      "version": "0.2.21",
+      "version": "0.2.23",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.21",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.23",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.21",
+      "ref": "@blamejs/pki@0.2.23",
       "dependsOn": []
     }
   ]