@blamejs/pki 0.4.12 → 0.4.14

package/lib/cms-encrypt.js

@@ -164,59 +164,69 @@ async function _buildKari(cek, cert, opts) {
   var keyAlg = cert.subjectPublicKeyInfo.algorithm;
   var wrapName = _wrapOidForKek(cek.length);
   var ukm = opts.ukm ? guard.bytes.view(opts.ukm, CmsError, "cms/bad-input", "ukm") : null;
-  var ecdhPub, origKeyAlgId, kek;
-  if (keyAlg.oid === O("ecPublicKey")) {
-    var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
-    var ka = EC_KA[curveOid];
-    if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
-    var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
-    var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
-    origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
-    var z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
-    var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
-    var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
-    kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
-    void ecdhPub;
-  } else if (MONT_KA[keyAlg.oid]) {
-    var mka = MONT_KA[keyAlg.oid];
-    var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
-    var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
-    origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
-    var mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
-    if (mz.every(function (x) { return x === 0; })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
-    var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
-    // RFC 8418 sec. 2.2: when a ukm is present it is used BOTH as the HKDF salt AND as the
-    // ECC-CMS-SharedInfo entityUInfo (the HKDF info) -- omitting it from the info diverges the KEK
-    // from any conformant peer that reads the transmitted ukm.
-    kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
-  } else {
-    // Coverage residual: unreachable -- _buildRecipient routes only ecPublicKey / X25519 / X448
-    // keys into _buildKari; a defensive throw against a future dispatch change.
-    throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
-  }
-  var encryptedKey = await _aesKwWrap(kek, cek);
-  // originatorKey [1] IMPLICIT OriginatorPublicKey { algorithm, publicKey BIT STRING }.
-  var origSpki = asn1.decode(origKeyAlgId.spki);
-  var origPubBits = origSpki.children[1]; // BIT STRING node
-  var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
-  // KeyAgreeRecipientIdentifier CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
-  // RecipientKeyIdentifier } -- the SKI form here wraps a SEQUENCE (rKeyId), unlike ktri's bare
-  // subjectKeyIdentifier [0] IMPLICIT OCTET STRING.
-  var ridNode;
-  _assertKeyIdentifier(opts.keyIdentifier);
-  if (opts.keyIdentifier === "subjectKeyIdentifier") {
-    var ski = _skiOf(cert);
-    if (!ski) throw _err("cms/bad-input", "keyIdentifier: \"subjectKeyIdentifier\" requires the recipient certificate to carry a subjectKeyIdentifier extension");
-    ridNode = b.contextConstructed(0, b.octetString(ski));
-  } else {
-    ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+  // z / mz (the raw agreement secret) and the derived kek are all allocated here and all secret.
+  // Declared together so one `finally` clears whichever the chosen branch produced, including when
+  // a later encoding step throws (RFC 9629 sec. 7 asks the same of the KEM builder below).
+  var ecdhPub, origKeyAlgId, kek, z, mz;
+  try {
+    if (keyAlg.oid === O("ecPublicKey")) {
+      var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
+      var ka = EC_KA[curveOid];
+      if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
+      var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
+      var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
+      origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
+      z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
+      var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
+      var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
+      kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
+      void ecdhPub;
+    } else if (MONT_KA[keyAlg.oid]) {
+      var mka = MONT_KA[keyAlg.oid];
+      var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
+      var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
+      origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
+      mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
+      if (mz.every(function (x) { return x === 0; })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
+      var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
+      // RFC 8418 sec. 2.2: when a ukm is present it is used BOTH as the HKDF salt AND as the
+      // ECC-CMS-SharedInfo entityUInfo (the HKDF info) -- omitting it from the info diverges the KEK
+      // from any conformant peer that reads the transmitted ukm.
+      kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
+    } else {
+      // Coverage residual: unreachable -- _buildRecipient routes only ecPublicKey / X25519 / X448
+      // keys into _buildKari; a defensive throw against a future dispatch change.
+      throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
+    }
+    var encryptedKey = await _aesKwWrap(kek, cek);
+    // originatorKey [1] IMPLICIT OriginatorPublicKey { algorithm, publicKey BIT STRING }.
+    var origSpki = asn1.decode(origKeyAlgId.spki);
+    var origPubBits = origSpki.children[1]; // BIT STRING node
+    var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
+    // KeyAgreeRecipientIdentifier CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
+    // RecipientKeyIdentifier } -- the SKI form here wraps a SEQUENCE (rKeyId), unlike ktri's bare
+    // subjectKeyIdentifier [0] IMPLICIT OCTET STRING.
+    var ridNode;
+    _assertKeyIdentifier(opts.keyIdentifier);
+    if (opts.keyIdentifier === "subjectKeyIdentifier") {
+      var ski = _skiOf(cert);
+      if (!ski) throw _err("cms/bad-input", "keyIdentifier: \"subjectKeyIdentifier\" requires the recipient certificate to carry a subjectKeyIdentifier extension");
+      ridNode = b.contextConstructed(0, b.octetString(ski));
+    } else {
+      ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+    }
+    var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]); // RecipientEncryptedKeys SEQ OF { rid, encKey }
+    var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
+    var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
+    if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
+    kariKids.push(kekAlg, rek);
+    return { tag: 1, node: b.sequence(kariKids) };
+  } finally {
+    // Buffer.from(arrayBuffer) is a VIEW over the engine's returned buffer, so clearing z / mz
+    // clears that allocation too. The CEK belongs to the caller (the message, not this recipient)
+    // and is wiped once at the end of encrypt; the ephemeral PUBLIC key is not secret.
+    guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
   }
-  var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]); // RecipientEncryptedKeys SEQ OF { rid, encKey }
-  var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
-  var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-  if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-  kariKids.push(kekAlg, rek);
-  return { tag: 1, node: b.sequence(kariKids) };
 }
 
 // ---- kekri (symmetric KEK) : AES-KW --------------------------------------
@@ -232,22 +242,37 @@ async function _buildKekri(cek, desc) {
 // A PBKDF2 iterationCount MUST be a positive integer within the same cap the decryptor enforces -- a
 // ---- pwri (password) : PBKDF2 + RFC 3211 double-CBC PWRI-KEK ---------------
 async function _buildPwri(cek, desc) {
-  var password = pbes2.passwordBytes(desc.password, _err, "cms");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  // The option validation runs BEFORE the password is encoded: a rejected iteration count or salt
+  // would otherwise abandon an owned credential copy on the way out.
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
   var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
+  _prfHash(prf);   // reject an unsupported prf HERE, before a credential copy exists to abandon
   var innerKeyBytes = 32; // AES-256-CBC inner
+  var pwOwn = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+  var password = pwOwn.bytes;
   var kekKey = await subtle.importKey("raw", password, { name: "PBKDF2" }, false, ["deriveBits"]);
+  // The derived KEK is this function's allocation and is cleared below. `password` is NOT: when the
+  // caller passes a Buffer, passwordBytes hands back that very buffer, so wiping it would destroy
+  // the caller's own memory -- the one failure this rule must never cause.
   var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt: salt, iterations: iterations }, kekKey, innerKeyBytes * 8));
-  // The RFC 3211 double-CBC wrap under an inner AES-256-CBC whose IV is carried in the
-  // keyEncryptionAlgorithm parameter (id-alg-PWRI-KEK parameter = the inner cipher AlgorithmIdentifier).
-  var iv = nodeCrypto.randomBytes(16);
-  var encryptedKey = _pwriWrapIv(kek, cek, iv);
-  // PBKDF2-params as keyDerivationAlgorithm [0] IMPLICIT.
-  var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
-  var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
-  var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
-  return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+  if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+  try {
+    // The RFC 3211 double-CBC wrap under an inner AES-256-CBC whose IV is carried in the
+    // keyEncryptionAlgorithm parameter (id-alg-PWRI-KEK parameter = the inner cipher AlgorithmIdentifier).
+    var iv = nodeCrypto.randomBytes(16);
+    var encryptedKey = _pwriWrapIv(kek, cek, iv);
+    // PBKDF2-params as keyDerivationAlgorithm [0] IMPLICIT.
+    var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
+    var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
+    var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
+    return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+  } finally {
+    guard.secret.zeroize(kek, CmsError, "cms/bad-input", "the password-derived key-encryption key");
+  }
 }
 
 // ---- kemri (ML-KEM ori) : RFC 9629 + 9936 ---------------------------------
@@ -275,15 +300,29 @@ async function _buildKemri(cek, cert, opts) {
   var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: wcName }, false, ["encapsulateBits"]);
   var kem = await subtle.encapsulateBits({ name: wcName }, pub);
   var ss = Buffer.from(kem.sharedKey), kemct = Buffer.from(kem.ciphertext);
-  var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
-  var kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8));
-  var encryptedKey = await _aesKwWrap(kek, cek);
-  var rid = _rid(cert, opts.keyIdentifier);
-  var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-  if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-  kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
-  var kemri = b.sequence(kemriKids);
-  return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+  var kek = null, kekAb = null;
+  try {
+    var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
+    kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8);
+    kek = Buffer.from(kekAb);
+    var encryptedKey = await _aesKwWrap(kek, cek);
+    var rid = _rid(cert, opts.keyIdentifier);
+    var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
+    if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
+    kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+    var kemri = b.sequence(kemriKids);
+    return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+  } finally {
+    // RFC 9629 sec. 7 asks the SENDER to discard the shared secret and KEK once the recipient entry
+    // is built -- and to use a fresh secret per recipient, so this runs per call rather than once at
+    // the end of a multi-recipient message. In a `finally`, so a wrap or encoding failure does not
+    // leave them behind. The CEK is the caller's and is wiped by no one here; kemct is public.
+    // kem.sharedKey is the ArrayBuffer the engine returned and ss is this function's copy of it;
+    // both hold the secret, so both are cleared. A Uint8Array view aliases the buffer's bytes, so
+    // wiping the view wipes the buffer itself. kem.ciphertext is public and stays.
+    guard.secret.zeroizeAll([ss, kek, kem.sharedKey ? new Uint8Array(kem.sharedKey) : null, kekAb ? new Uint8Array(kekAb) : null],
+      CmsError, "cms/bad-input", "the KEM shared secret");
+  }
 }
 
 // AES-KW wrap of the CEK under a raw KEK.
@@ -305,15 +344,25 @@ function _pwriFormat(cek) {
   var blk = 16;
   var padLen = body.length % blk === 0 ? 0 : blk - (body.length % blk);
   if (body.length + padLen < 2 * blk) padLen += (2 * blk - (body.length + padLen));
-  return Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  //  and  each hold a plaintext copy of the CEK; only the padded result is returned, so
+  // the intermediates are cleared here rather than abandoned.
+  var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
+  return wrapped;
 }
 function _pwriWrapIv(kek, cek, iv) {
+  // wk is the formatted plaintext -- a complete copy of the CEK -- and is cleared once the first
+  // encryption pass has consumed it. pass1 is already ciphertext.
   var wk = _pwriFormat(cek);
-  var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
-  var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
-  var iv2 = pass1.subarray(pass1.length - 16);
-  var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
-  return Buffer.concat([c2.update(pass1), c2.final()]);
+  try {
+    var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
+    var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
+    var iv2 = pass1.subarray(pass1.length - 16);
+    var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
+    return Buffer.concat([c2.update(pass1), c2.final()]);
+  } finally {
+    guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
+  }
 }
 
 var PRF_HASH = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
@@ -362,16 +411,23 @@ async function encrypt(content, recipients, opts) {
   var contentType = opts.contentType || "data";
   var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
 
-  // EncryptedData: a single non-array { cek } or { password } descriptor, no RecipientInfos.
-  if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
-
-  if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
-  var recips = [];
-  for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
-  var riNodes = recips.map(_taggedRecipient);
-
-  if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
-  return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+  // The CEK protects the content for EVERY recipient, so unlike a per-recipient shared secret it is
+  // cleared ONCE, after the last recipient entry is built and the content is encrypted -- wiping it
+  // inside the recipient loop would destroy the key the remaining recipients must be given.
+  try {
+    // EncryptedData: a single non-array { cek } or { password } descriptor, no RecipientInfos.
+    if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
+
+    if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
+    var recips = [];
+    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
+    var riNodes = recips.map(_taggedRecipient);
+
+    if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
+    return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+  } finally {
+    guard.secret.zeroize(cek, CmsError, "cms/bad-input", "the content-encryption key");
+  }
 }
 
 function _emit(inner, ctName, opts) {
@@ -431,16 +487,27 @@ function _encryptedData(contentBytes, desc, ca, contentType, opts, cek) {
 }
 
 function _encryptedDataPbes2(contentBytes, desc, ca, contentType, iv, opts) {
-  var password = pbes2.passwordBytes(desc.password, _err, "cms");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+  var password = pwOwn2.bytes;
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
   var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
+  // The password-derived content key is this function's allocation; `password` may be the caller's
+  // own buffer (passwordBytes passes a Buffer straight through) and is left alone.
   var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
-  var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
-  var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
-  var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
-  var inner = b.sequence([b.integer(0n), eci]);
-  return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+  if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+  try {
+    var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
+    var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
+    var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
+    var inner = b.sequence([b.integer(0n), eci]);
+    return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+  } finally {
+    guard.secret.zeroize(key, CmsError, "cms/bad-input", "the password-derived content-encryption key");
+  }
 }
 
 // ---- content-encryption primitives ----------------------------------------
@@ -491,65 +558,71 @@ async function authenticate(content, recipients, opts) {
   // RFC 5652 sec. 9.1: authAttrs MUST be present when the eContentType is not id-data.
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
 
+  // The MAC key is this path's content-encryption key: every recipient is given it, so it is cleared
+  // ONCE at the end rather than per recipient, and only after the MAC has been computed over it.
   var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
-  var recips = [];
-  for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
-  var riNodes = recips.map(_taggedRecipient);
-
-  var digestName = opts.digestAlgorithm || mac.node;
-  var digestAlgTagged = null, authAttrsDer = null, preimage;
-  if (withAttrs) {
-    if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
-    // sec. 9.2: content-type (== eContentType) + message-digest (== digest(content)) attributes,
-    // SET-OF-sorted, MACed under the EXPLICIT SET OF tag (0x31) but transmitted [2] IMPLICIT (0xA2).
-    var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
-    var pairs = [
-      b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
-      b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),
-    ];
-    if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
-    // Every authAttr (auto-built or caller-supplied) MUST be a well-formed Attribute SEQUENCE
-    // { type OBJECT IDENTIFIER, values SET OF } and each type appears at most once (RFC 5652) -- so a
-    // malformed or duplicate caller attribute is rejected BEFORE it is MACed and emitted, never left to
-    // fail an operator's parser downstream.
-    var seenTypes = {};
-    pairs.forEach(function (p) {
-      var node;
-      try { node = asn1.decode(p); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e); }
-      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 ||
-        node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET ||
-        !node.children[1].children || node.children[1].children.length < 1) {
-        throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
-      }
-      var t;
-      try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
-      if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
-      seenTypes[t] = 1;
-    });
-    var setOf = b.setOf(pairs);
-    preimage = setOf;                                                            // MAC over the 0x31 SET OF
-    authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));   // [2] IMPLICIT on the wire
-    digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));             // [1] IMPLICIT DigestAlgorithmIdentifier
-  } else {
-    preimage = contentBytes;                                                    // MAC over the eContent value octets
-  }
-
-  var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
-  var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
+  try {
+    var recips = [];
+    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
+    var riNodes = recips.map(_taggedRecipient);
+
+    var digestName = opts.digestAlgorithm || mac.node;
+    var digestAlgTagged = null, authAttrsDer = null, preimage;
+    if (withAttrs) {
+      if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
+      // sec. 9.2: content-type (== eContentType) + message-digest (== digest(content)) attributes,
+      // SET-OF-sorted, MACed under the EXPLICIT SET OF tag (0x31) but transmitted [2] IMPLICIT (0xA2).
+      var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
+      var pairs = [
+        b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
+        b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),
+      ];
+      if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
+      // Every authAttr (auto-built or caller-supplied) MUST be a well-formed Attribute SEQUENCE
+      // { type OBJECT IDENTIFIER, values SET OF } and each type appears at most once (RFC 5652) -- so a
+      // malformed or duplicate caller attribute is rejected BEFORE it is MACed and emitted, never left to
+      // fail an operator's parser downstream.
+      var seenTypes = {};
+      pairs.forEach(function (p) {
+        var node;
+        try { node = asn1.decode(p); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e); }
+        if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 ||
+          node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET ||
+          !node.children[1].children || node.children[1].children.length < 1) {
+          throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
+        }
+        var t;
+        try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
+        if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+        seenTypes[t] = 1;
+      });
+      var setOf = b.setOf(pairs);
+      preimage = setOf;                                                            // MAC over the 0x31 SET OF
+      authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));   // [2] IMPLICIT on the wire
+      digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));             // [1] IMPLICIT DigestAlgorithmIdentifier
+    } else {
+      preimage = contentBytes;                                                    // MAC over the eContent value octets
+    }
 
-  var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
-  var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-  if (digestAlgTagged) kids.push(digestAlgTagged);
-  kids.push(eci);
-  if (authAttrsDer) kids.push(authAttrsDer);
-  kids.push(b.octetString(macValue));
-  var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
-  // Self-verify: the emitted AuthenticatedData MUST re-parse clean through the strict parser, so a
-  // caller-supplied authenticated attribute with a recognized type but extra RFC 5652 constraints (a
-  // misplaced type, a signing-time whose value is not a Time) is rejected HERE at build time rather
-  // than by the recipient's parser after the fact.
-  try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
-  return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+    var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
+    var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
+
+    var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
+    var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
+    if (digestAlgTagged) kids.push(digestAlgTagged);
+    kids.push(eci);
+    if (authAttrsDer) kids.push(authAttrsDer);
+    kids.push(b.octetString(macValue));
+    var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
+    // Self-verify: the emitted AuthenticatedData MUST re-parse clean through the strict parser, so a
+    // caller-supplied authenticated attribute with a recognized type but extra RFC 5652 constraints (a
+    // misplaced type, a signing-time whose value is not a Time) is rejected HERE at build time rather
+    // than by the recipient's parser after the fact.
+    try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
+    return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+  } finally {
+    guard.secret.zeroize(macKey, CmsError, "cms/bad-input", "the message-authentication key");
+  }
 }
 
 module.exports = { encrypt: encrypt, authenticate: authenticate };

package/lib/guard-all.js

@@ -59,6 +59,7 @@ var json   = require("./guard-json");
 var identifier = require("./guard-identifier");
 var header = require("./guard-header");
 var compress = require("./guard-compress");
+var secret = require("./guard-secret");
 
 module.exports = {
   bytes:  bytes,
@@ -73,4 +74,5 @@ module.exports = {
   identifier: identifier,
   header: header,
   compress: compress,
+  secret: secret,
 };

package/lib/guard-secret.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the KEM
+// key-establishment paths that compose this guard (pki.cms.encrypt / decrypt).
+//
+// guard-secret -- wipe a secret buffer the TOOLKIT ALLOCATED at the moment it
+// stops being needed. NIST SP 800-227 RS5 / sec. 4.2 requires that a KEM shared
+// secret and every intermediate value be destroyed as soon as they are no longer
+// needed; RFC 9629 sec. 7 says the same of the KEK a KEMRecipientInfo derives.
+//
+// The defended class is secret lifetime, not secret disclosure: a shared secret
+// or KEK left readable in the heap widens the window in which a later memory
+// disclosure -- a core dump, a swapped page, a same-process read primitive --
+// yields key material for traffic that was already decrypted.
+//
+// SCOPE, stated honestly because the docstring is the only place a reader learns
+// it: this is BEST EFFORT. The runtime copies buffers into places no JS can
+// reach (node's decapsulate return is copied on the way out; importKey("raw")
+// copies into a KeyObject), and V8 may relocate a backing store, leaving the
+// original bytes behind. Wiping the copies the toolkit holds shortens the
+// window. It does not support a claim that a secret never persists in memory,
+// and no operator-facing text may imply that it does.
+//
+// OWNERSHIP IS THE CONTRACT. Only a buffer the toolkit allocated may be wiped --
+// never a caller's opts.key / opts.cert / opts.kek / opts.password, and never the
+// input DER. Silently destroying a caller's own memory is a worse defect than
+// leaving a secret readable, and it is the failure mode a zeroization patch
+// reaches for first, so the call sites pass only their own intermediates.
+
+var bytes = require("./guard-bytes");
+
+// zeroize(value, ErrorClass, code, label) -> the same object, cleared.
+//   value      : a Buffer / TypedArray the TOOLKIT allocated, or null / undefined
+//                (absent is a no-op so a `finally` needs no branch around it).
+//   ErrorClass : the caller's typed error CONSTRUCTOR, declared with
+//                `{ withCause: true }`. The guard family carries two currencies --
+//                most guards take a (code, message) factory and call it without
+//                `new`, while guard-bytes / guard-header take the class and
+//                construct it. This module's ONLY throw is the delegated re-view
+//                below, so it must pass what guard-bytes expects: the class, and
+//                one that accepts a cause, because guard-bytes threads the raw
+//                detach fault through as one. A plain class fails to construct at
+//                the single moment the caller needs a real error.
+//   code       : the frozen domain/reason code a detached buffer rejects under.
+//   label      : field phrase for the message.
+//
+// A detached ArrayBuffer cannot be written, and reaching one here means a caller
+// handed over memory that was transferred away -- a real fault, not something to
+// swallow, so it routes through the shared re-view guard and throws typed.
+//
+// The `.fill(0)` shape lives ONLY in this module: a wipe re-inlined anywhere in
+// lib/ -- including a module not yet written -- is flagged, so the safe
+// implementation is also the tripwire that stops the next consumer from rolling
+// its own partial one.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.fill\s*\(\s*0\s*[,)]
+function zeroize(value, ErrorClass, code, label) {
+  if (value === null || value === undefined) return value;
+  // Re-view through the shared bytes guard: it is the single place that decides
+  // what counts as a writable BufferSource and rejects a detached one typed.
+  var view = bytes.view(value, ErrorClass, code, label);
+  view.fill(0);
+  return value;
+}
+
+// zeroizeAll(list, ErrorClass, code, label) -- wipe every present member, tolerating
+// holes so a `finally` can name intermediates that may not have been reached.
+//
+// @enforced-by behavioral -- this is a loop over zeroize, which carries the family's only
+// rename-proof shape (the `.fill(0)` above). It introduces no shape of its own, so a lexical
+// detector here would anchor on a renameable symbol and go silently green (drift rule sec. 3).
+// The behavioural guards are guard-secret.test.js (holes tolerated, every member cleared) and the
+// CMS vectors that assert the shared secret and KEK are wiped on BOTH the success and failure paths.
+function zeroizeAll(list, ErrorClass, code, label) {
+  if (!list) return list;
+  for (var i = 0; i < list.length; i++) zeroize(list[i], ErrorClass, code, label);
+  return list;
+}
+
+module.exports = { zeroize: zeroize, zeroizeAll: zeroizeAll };