@blamejs/pki 0.2.6 → 0.2.7

package/CHANGELOG.md

@@ -4,7 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.6 — 2026-07-13
+## v0.2.7 — 2026-07-13
+
+pki.webcrypto rejects an imported key whose type disagrees with its algorithm, and reports every cipher fault as a typed error.
+
+### Changed
+
+- The pkijs.com documentation site is regenerated with content-hashed CSS/JS under a strict Content-Security-Policy, an in-memory search endpoint, a browsable reference of every error class and code, symbol autocomplete, and concept guides. Documentation only -- the published package is unchanged.
+
+### Fixed
+
+- pki.webcrypto.subtle.importKey now validates that an imported asymmetric key's actual type matches the requested algorithm (an RSA key imported under an Ed25519, ECDSA, or RSA-PSS name is rejected as webcrypto/data), closing an algorithm-confusion path where a mislabeled CryptoKey could later be used under the wrong signature scheme. The EC import path already derived and checked the curve; this extends the same key-is-authority rule to RSA and the Edwards/Montgomery curves.
+- pki.webcrypto AES cipher faults now fail closed with a typed webcrypto/operation error instead of a raw Node exception: a decrypt of a tampered AES-GCM ciphertext (failed authentication tag), bad AES-CBC padding, a non-8-byte-multiple AES-KW wrap/unwrap length, and a malformed cipher parameter all surface as a WebCryptoError, so a caller catching pki.errors.PkiError sees a typed verdict rather than a bare Node error crossing the API boundary.
+
+## v0.2.6 — 2026-07-12
 
 WebAuthn attestation verification covers Ed448 and the RFC 9864 fully-specified COSE algorithms, and hardens credential-key conformance.
 

package/lib/path-validate.js

@@ -1463,7 +1463,7 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
     // dnEqual throws only on a control-byte / malformed cRLIssuer DN; returning false excludes
     // that DP from the correspondence (a malformed indirect-CRL issuer name never corresponds).
     try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
-    catch (_e) { return false; }   // allow:swallow-unverified fail-closed predicate: error -> no match -> DP excluded (restrictive)
+    catch (_e) { return false; }
   }
   return false;
 }

package/lib/webcrypto.js

@@ -353,6 +353,16 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
   throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
 };
 
+// Run a node:crypto AES cipher sequence, converting any raw node fault -- a bad IV length,
+// a failed GCM authentication tag, bad CBC padding -- into a typed OperationError. A
+// decrypt of tampered ciphertext (or a malformed cipher parameter) is a typed webcrypto
+// verdict, never a raw Error crossing the public API (input prep that already throws a
+// typed error runs OUTSIDE this, so a typed fault is never double-wrapped).
+function _runCipher(fn, who) {
+  try { return fn(); }
+  catch (e) { throw new WebCryptoError("webcrypto/operation", who + ": AES cipher operation failed (bad key / iv / tag / padding)", e); }
+}
+
 SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   var alg = _normalizeAlg(algorithm, "encrypt");
   _requireUsage(key, "encrypt");
@@ -369,19 +379,28 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   }
   if (name === "AES-GCM") {
     var iv = _toBuf(alg.iv, "AES-GCM iv");
-    var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
-    if (alg.additionalData) cipher.setAAD(_toBuf(alg.additionalData, "AES-GCM aad"));
-    var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
-    return _toArrayBuffer(Buffer.concat([ct, cipher.getAuthTag()]));
+    var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
+    return _toArrayBuffer(_runCipher(function () {
+      var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
+      if (aad) cipher.setAAD(aad);
+      var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
+      return Buffer.concat([ct, cipher.getAuthTag()]);
+    }, "encrypt"));
   }
   if (name === "AES-CBC") {
-    var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), _toBuf(alg.iv, "AES-CBC iv"));
-    return _toArrayBuffer(Buffer.concat([c2.update(buf), c2.final()]));
+    var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
+    return _toArrayBuffer(_runCipher(function () {
+      var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv);
+      return Buffer.concat([c2.update(buf), c2.final()]);
+    }, "encrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
-    var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), _toBuf(alg.counter, "AES-CTR counter"));
-    return _toArrayBuffer(Buffer.concat([c3.update(buf), c3.final()]));
+    var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
+    return _toArrayBuffer(_runCipher(function () {
+      var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter);
+      return Buffer.concat([c3.update(buf), c3.final()]);
+    }, "encrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
 };
@@ -403,21 +422,31 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (name === "AES-GCM") {
     var tagLen = (alg.tagLength || 128) / 8;
     var iv = _toBuf(alg.iv, "AES-GCM iv");
+    if (buf.length < tagLen) throw new WebCryptoError("webcrypto/operation", "decrypt: AES-GCM ciphertext is shorter than its authentication tag");
     var ct = buf.subarray(0, buf.length - tagLen);
     var tag = buf.subarray(buf.length - tagLen);
-    var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
-    if (alg.additionalData) d.setAAD(_toBuf(alg.additionalData, "AES-GCM aad"));
-    d.setAuthTag(tag);
-    return _toArrayBuffer(Buffer.concat([d.update(ct), d.final()]));
+    var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
+    return _toArrayBuffer(_runCipher(function () {
+      var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
+      if (gcmAad) d.setAAD(gcmAad);
+      d.setAuthTag(tag);
+      return Buffer.concat([d.update(ct), d.final()]);
+    }, "decrypt"));
   }
   if (name === "AES-CBC") {
-    var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), _toBuf(alg.iv, "AES-CBC iv"));
-    return _toArrayBuffer(Buffer.concat([d2.update(buf), d2.final()]));
+    var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
+    return _toArrayBuffer(_runCipher(function () {
+      var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv2);
+      return Buffer.concat([d2.update(buf), d2.final()]);
+    }, "decrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
-    var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), _toBuf(alg.counter, "AES-CTR counter"));
-    return _toArrayBuffer(Buffer.concat([d3.update(buf), d3.final()]));
+    var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
+    return _toArrayBuffer(_runCipher(function () {
+      var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter2);
+      return Buffer.concat([d3.update(buf), d3.final()]);
+    }, "decrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
 };
@@ -526,8 +555,16 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
   if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
   _requireAlgMatch(alg, wrappingKey, "wrapKey");
   if (alg.name === "AES-KW") {
-    var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-    return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+    // AES-KW wraps 64-bit blocks (RFC 3394): the serialized key MUST be a multiple of 8
+    // bytes and at least 16. A "jwk" serialization (arbitrary-length JSON) or any other
+    // non-conforming length is an OperationError -- a typed verdict, never a raw node fault.
+    if (bytes.length < 16 || bytes.length % 8 !== 0) {
+      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
+    }
+    try {
+      var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+    } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
   }
   // Delegate to a content-encryption algorithm (RSA-OAEP / AES-GCM).
   var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
@@ -546,8 +583,17 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   _requireAlgMatch(alg, unwrappingKey, "unwrapKey");
   var bytes;
   if (alg.name === "AES-KW") {
-    var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-    bytes = Buffer.concat([d.update(_toBuf(wrappedKey, "unwrapKey")), d.final()]);
+    var wrapped = _toBuf(wrappedKey, "unwrapKey");
+    // The wrapped input is the plaintext plus one 64-bit integrity block: a multiple of 8,
+    // at least 24. A wrong length, or a failed integrity check inside final(), is an
+    // OperationError -- a typed verdict, never a raw node cipher fault.
+    if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
+      throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
+    }
+    try {
+      var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      bytes = Buffer.concat([d.update(wrapped), d.final()]);
+    } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
     bytes = Buffer.from(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
@@ -633,7 +679,28 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + JSON.stringify(name));
 }
 
+// The node asymmetricKeyType(s) each imported asymmetric algorithm requires. The key TYPE
+// is a property of the key material, not the caller's claim: an RSA key imported under
+// {name:"Ed25519"} must be a DataError, not a CryptoKey mislabeled Ed25519 that then signs
+// under the wrong scheme (algorithm confusion). EC is additionally curve-validated below.
+var IMPORT_KEY_TYPE = {
+  "RSASSA-PKCS1-V1_5": { rsa: 1 }, "RSA-PSS": { rsa: 1, "rsa-pss": 1 }, "RSA-OAEP": { rsa: 1 },
+  "ECDSA": { ec: 1 }, "ECDH": { ec: 1 },
+  "ED25519": { ed25519: 1 }, "ED448": { ed448: 1 },
+  "X25519": { x25519: 1 }, "X448": { x448: 1 },
+};
+// The FIPS 203/204/205 PQC families import the same key-is-authority rule: each WebCrypto
+// algorithm name maps to exactly its node asymmetricKeyType, so an RSA (or any) key imported
+// under an ML-DSA / ML-KEM / SLH-DSA name is a DataError, not a mislabeled PQC CryptoKey.
+[ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
+  Object.keys(m).forEach(function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
+});
 function _algFromImport(name, alg, keyObject) {
+  var wantType = IMPORT_KEY_TYPE[name];
+  if (wantType && keyObject && keyObject.asymmetricKeyType && !wantType[keyObject.asymmetricKeyType]) {
+    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + keyObject.asymmetricKeyType +
+      " key, which is not compatible with algorithm " + name);
+  }
   if (name === "ECDSA" || name === "ECDH") {
     // W3C WebCrypto EC import -- the curve is a property of the KEY, not the
     // caller's claim. Derive it from the imported key material; reject an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a602dc26-1f23-43cd-ad30-ef4f457ccc22",
+  "serialNumber": "urn:uuid:ea60e88f-9354-49c4-aa35-ad6712102de1",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-13T05:42:29.445Z",
+    "timestamp": "2026-07-13T07:29:25.087Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.6",
+      "bom-ref": "@blamejs/pki@0.2.7",
       "type": "application",
       "name": "pki",
-      "version": "0.2.6",
+      "version": "0.2.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.6",
+      "ref": "@blamejs/pki@0.2.7",
       "dependsOn": []
     }
   ]