@blamejs/pki 0.4.12 → 0.4.14

package/lib/webcrypto.js

@@ -467,25 +467,31 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var iv = _toBuf(alg.iv, "AES-GCM iv");
     var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
-      var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
-      if (aad) cipher.setAAD(aad);
-      var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
-      return Buffer.concat([ct, cipher.getAuthTag()]);
+      return _withSecretBytes(key, function (kb) {
+        var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
+        if (aad) cipher.setAAD(aad);
+        var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
+        return Buffer.concat([ct, cipher.getAuthTag()]);
+      });
     }, "encrypt"));
   }
   if (name === "AES-CBC") {
     var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
-      var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv);
-      return Buffer.concat([c2.update(buf), c2.final()]);
+      return _withSecretBytes(key, function (kb) {
+        var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
+        return Buffer.concat([c2.update(buf), c2.final()]);
+      });
     }, "encrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
     var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
-      var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter);
-      return Buffer.concat([c3.update(buf), c3.final()]);
+      return _withSecretBytes(key, function (kb) {
+        var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
+        return Buffer.concat([c3.update(buf), c3.final()]);
+      });
     }, "encrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
@@ -499,11 +505,16 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
-    return _toArrayBuffer(nodeCrypto.privateDecrypt({
+    // For a CMS key-transport recipient this plaintext IS the recovered content-encryption key, and
+    // _toArrayBuffer copies it -- so the node-allocated buffer is finished with the moment the copy
+    // exists, and nothing outside this function can reach it to clear it.
+    var oaepOut = nodeCrypto.privateDecrypt({
       key: key._handle, padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING,
       oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : undefined,
-    }, buf));
+    }, buf);
+    try { return _toArrayBuffer(oaepOut); }
+    finally { guard.secret.zeroize(oaepOut, WebCryptoError, "webcrypto/operation", "the RSA-OAEP decryption output"); }
   }
   if (name === "AES-GCM") {
     var tagLen = (alg.tagLength || 128) / 8;
@@ -513,31 +524,71 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var tag = buf.subarray(buf.length - tagLen);
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
-      var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
-      if (gcmAad) d.setAAD(gcmAad);
-      d.setAuthTag(tag);
-      return Buffer.concat([d.update(ct), d.final()]);
+      return _withSecretBytes(key, function (kb) {
+        var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
+        if (gcmAad) d.setAAD(gcmAad);
+        d.setAuthTag(tag);
+        return Buffer.concat([d.update(ct), d.final()]);
+      });
     }, "decrypt"));
   }
   if (name === "AES-CBC") {
     var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
-      var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv2);
-      return Buffer.concat([d2.update(buf), d2.final()]);
+      return _withSecretBytes(key, function (kb) {
+        var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
+        return Buffer.concat([d2.update(buf), d2.final()]);
+      });
     }, "decrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
     var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
-      var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter2);
-      return Buffer.concat([d3.update(buf), d3.final()]);
+      return _withSecretBytes(key, function (kb) {
+        var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
+        return Buffer.concat([d3.update(buf), d3.final()]);
+      });
     }, "decrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
 };
 
-function _secretBytes(key) { return key._handle.export(); }
+// _withSecretBytes(key, fn) -- export a secret key's raw material, hand it to fn, and wipe
+// the export the moment fn is done with it (NIST SP 800-227 RS5 / sec. 4.2, RFC 9629 sec. 7).
+//
+// export() allocates a FRESH Buffer this module owns; the CryptoKey keeps its own copy inside
+// the node KeyObject, so wiping the export never destroys the caller's key or the key itself.
+// Node's cipher and KDF constructors copy the key into their own context, so the export's
+// useful life ends when the operation returns.
+//
+// This is the ONLY way to reach raw secret key material: there is deliberately no unwiped
+// `_secretBytes(key)` primitive to call, because a new consumer that forgot the wipe was the
+// live defect this replaced -- the AES content-encryption paths and two of the three KDF arms
+// each exported the key and left it readable while their sibling arms did not.
+//
+// When fn returns a PROMISE the wipe rides the settlement rather than the callback's return.
+// Node's async primitives copy their inputs when the job is queued, so an eager wipe would not
+// corrupt today's derivations -- but that is an implementation detail of the provider, not a
+// documented guarantee, and the export's useful life is the operation's, not the callback's.
+// Deferring costs nothing and keeps the rule true for any future asynchronous consumer.
+function _withSecretBytes(key, fn) {
+  var kb = key._handle.export();
+  // Set once the export's lifetime has been handed to the promise handlers below, so the
+  // `finally` does not clear a buffer the pending operation is still entitled to.
+  var deferred = false;
+  try {
+    var out = fn(kb);
+    if (out && typeof out.then === "function") {
+      deferred = true;
+      return out.then(function (v) { _wipeExport(kb); return v; }, function (e) { _wipeExport(kb); throw e; });
+    }
+    return out;
+  } finally {
+    if (!deferred) guard.secret.zeroize(kb, WebCryptoError, "webcrypto/operation", "the exported key material");
+  }
+}
+function _wipeExport(kb) { guard.secret.zeroize(kb, WebCryptoError, "webcrypto/operation", "the exported key material"); }
 
 // AES-CTR: node always treats the full 128-bit block as the counter and
 // never reads the spec's `length` (counter-width) parameter. A length < 128
@@ -595,33 +646,62 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
     _requireOwnKey(alg.public, "deriveBits public key");
+    // The provider hands back z (ECDH) / mz (X25519, X448) in a Buffer this module owns. It is
+    // the raw key-agreement shared secret -- the same class of material as a KEM shared secret --
+    // so it is wiped once the caller's copy exists, on EVERY exit including the over-request
+    // throw. _toArrayBuffer copies via ArrayBuffer.slice, so the returned bits are unaffected.
     var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
-    if (length == null) return _toArrayBuffer(secret);
-    _requireDeriveLength(length, name);
-    // subarray clamps at the end of the secret, so an unchecked over-request
-    // would silently return fewer bytes than asked. W3C deriveBits: throw an
-    // OperationError when the requested length cannot be satisfied.
-    if (length / 8 > secret.length) {
-      throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + (secret.length * 8));
+    try {
+      if (length == null) return _toArrayBuffer(secret);
+      _requireDeriveLength(length, name);
+      // subarray clamps at the end of the secret, so an unchecked over-request
+      // would silently return fewer bytes than asked. W3C deriveBits: throw an
+      // OperationError when the requested length cannot be satisfied.
+      if (length / 8 > secret.length) {
+        throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + (secret.length * 8));
+      }
+      return _toArrayBuffer(secret.subarray(0, length / 8));
+    } finally {
+      guard.secret.zeroize(secret, WebCryptoError, "webcrypto/operation", "the raw key-agreement shared secret");
     }
-    return _toArrayBuffer(secret.subarray(0, length / 8));
   }
   if (name === "HKDF") {
     _requireDeriveLength(length, "HKDF");
-    var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), _secretBytes(key), _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
-    return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+    // The export is a fresh Buffer this module owns -- for a KEM flow it is the shared secret
+    // itself. A controllable allocation, not one of the runtime-internal copies the best-effort
+    // caveat covers, so it is wiped once the derivation has consumed it.
+    return _withSecretBytes(key, function (ikm) {
+      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
+      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+    });
   }
   if (name === "PBKDF2") {
     _requireDeriveLength(length, "PBKDF2");
-    var out = await _pbkdf2Async(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
-    return _toArrayBuffer(out);
+    // The derivation is asynchronous; _withSecretBytes defers the wipe to the promise's
+    // settlement so the export outlives the operation rather than the callback.
+    return _withSecretBytes(key, function (pw) {
+      return _pbkdf2Async(pw, _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"))
+        .then(function (out) {
+          // _toArrayBuffer COPIES, so the node-allocated derivation buffer is finished with the
+          // moment the copy exists -- and nothing else can reach it to clear it.
+          try { return _toArrayBuffer(out); }
+          finally { guard.secret.zeroize(out, WebCryptoError, "webcrypto/operation", "the PBKDF2 output"); }
+        });
+    });
   }
   if (name === "X963KDF") {
     // ANSI-X9.63 / SEC1 sec. 3.6.1 single-step KDF: K = H(Z || INT32(counter) || SharedInfo)
     // concatenated over counter = 1, 2, ... The RFC 5753 kari KEK derivation; the base key holds
     // the ECDH shared secret Z, alg.info holds the DER ECC-CMS-SharedInfo.
     _requireDeriveLength(length, "X963KDF");
-    return _toArrayBuffer(_x963Kdf(_hashNode(alg.hash, "X963KDF"), _secretBytes(key), _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8));
+    // The base key here HOLDS the ECDH shared secret Z of an RFC 5753 kari, so this export is
+    // exactly as sensitive as the raw agreement secret wiped above.
+    return _withSecretBytes(key, function (z) {
+      var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8);
+      // Same as PBKDF2 above: the copy is what the caller receives, so the derived buffer is cleared.
+      try { return _toArrayBuffer(derived); }
+      finally { guard.secret.zeroize(derived, WebCryptoError, "webcrypto/operation", "the X9.63 KDF output"); }
+    });
   }
   throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(name));
 }
@@ -636,7 +716,16 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
     var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
     blocks.push(h); got += h.length; counter += 1;
   }
-  return Buffer.concat(blocks).subarray(0, lenBytes);
+  // Return an exact-sized buffer the caller wholly owns, not a VIEW over the joined blocks: a
+  // caller clearing what it received would otherwise leave the unused tail of the final digest
+  // block -- derived from the shared secret -- readable behind it. The accumulator and the
+  // per-block digests are cleared here, where they were allocated.
+  var joined = Buffer.concat(blocks);
+  var exact = Buffer.alloc(lenBytes);
+  joined.copy(exact, 0, 0, lenBytes);
+  guard.secret.zeroize(joined, WebCryptoError, "webcrypto/operation", "the KDF accumulator");
+  for (var bi = 0; bi < blocks.length; bi++) guard.secret.zeroize(blocks[bi], WebCryptoError, "webcrypto/operation", "a KDF block");
+  return exact;
 }
 
 SubtleCrypto.prototype.deriveBits = async function deriveBits(algorithm, key, length) {
@@ -678,8 +767,12 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
     // material; a KDF base has no implicit output size and fails closed.
     bits = dk.length != null ? dk.length : null;
   }
+  // The derived bits are the KEY -- importKey copies them into a KeyObject, so this buffer is a
+  // transient copy nothing else can reach once the CryptoKey exists, and it is cleared on the
+  // failing import too (a bad derivedKeyType is caller-controlled).
   var raw = await _deriveBitsRaw(alg, baseKey, bits);
-  return this.importKey("raw", raw, dk, extractable, keyUsages);
+  try { return await this.importKey("raw", raw, dk, extractable, keyUsages); }
+  finally { guard.secret.zeroize(new Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material"); }
 };
 
 // ML-KEM (FIPS 203) key encapsulation over Node's crypto.encapsulate/decapsulate.
@@ -701,7 +794,18 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
   var r;
   try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
-  return { sharedKey: _toArrayBuffer(Buffer.from(r.sharedKey)), ciphertext: _toArrayBuffer(Buffer.from(r.ciphertext)) };
+  try {
+    // _toArrayBuffer copies via ArrayBuffer.slice, so the shared key is passed straight through --
+    // an intermediate Buffer.from would be another copy of the secret that nothing wipes. The
+    // ciphertext is public and needs no such care, but it is copied the same way for symmetry.
+    return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
+  } finally {
+    // Encapsulation produces a shared secret exactly as decapsulation does, so it owes the same
+    // duty: the provider's buffer is wiped once the caller's copy exists (NIST SP 800-227 RS5 /
+    // sec. 4.2, RFC 9629 sec. 7). Wiping only the decapsulation side would make the guarantee a
+    // half-truth -- the sender holds the same secret the recipient does.
+    guard.secret.zeroize(r.sharedKey, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+  }
 };
 
 SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
@@ -711,15 +815,48 @@ SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorith
   _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
   if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
   var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
+  // FIPS 203 sec. 7.3 makes the ciphertext-length check the ONE per-execution input check a
+  // decapsulating party owes, so it belongs here, at the engine boundary, rather than only in the
+  // format module that happens to call this today: a direct caller -- or a future composite-KEM or
+  // HPKE consumer -- inherits nothing from a check that lives in cms-decrypt. A distinct code names
+  // the real reason, which "the operation failed" cannot.
+  //
+  // Length ONLY. A correct-length ciphertext that has been tampered with must still resolve to a
+  // pseudo-random shared secret (the Fujisaki-Okamoto implicit rejection of FIPS 203 sec. 6.3);
+  // turning that into a throw would hand an attacker a decryption oracle, and it is the property
+  // the CMS uniform verdict is built on.
+  // The registry is keyed by the registered OID name ("id-ml-kem-768"), which is the node
+  // algorithm name this module already maps ("ml-kem-768") under its id- prefix.
+  var kemRow = oid.kemParams("id-" + ML_KEM_NODE[alg.name]);
+  if (kemRow && ct.length !== kemRow.ct) {
+    throw new WebCryptoError("webcrypto/bad-kem-ciphertext",
+      "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)");
+  }
   var ss;
   try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
-  return _toArrayBuffer(Buffer.from(ss));
+  try {
+    // ss is already a Buffer, and _toArrayBuffer copies via ArrayBuffer.slice -- so it is passed
+    // straight through. An intermediate Buffer.from(ss) would be a THIRD copy of the secret that
+    // nothing wipes, which would give back most of what the wipe below is for.
+    return _toArrayBuffer(ss);
+  } finally {
+    // The shared secret is returned as a COPY, so the buffer the provider handed back would stay
+    // readable until collection -- and a caller wiping only what it receives would leave the
+    // original behind, which is the whole secret. Wiping here means the engine owns the lifetime of
+    // the buffer it allocated, and every caller (CMS today, a composite KEM or HPKE later) inherits
+    // it rather than each having to remember (NIST SP 800-227 RS5 / sec. 4.2).
+    guard.secret.zeroize(ss, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+  }
 };
 
 SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
+  //  is the PLAINTEXT serialization of the key being wrapped -- the very material the wrap
+  // exists to protect. It is this function's allocation and is cleared once the wrap has consumed
+  // it, on the delegated branch as well as the AES-KW one.
   var exported = await this.exportKey(format, key);
   var bytes = (format === "jwk") ? Buffer.from(JSON.stringify(exported)) : Buffer.from(exported);
+  try {
   var alg = _normalizeAlg(wrapAlgorithm, "wrapKey");
   _requireUsage(wrappingKey, "wrapKey");
   if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
@@ -731,14 +868,27 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
     if (bytes.length < 16 || bytes.length % 8 !== 0) {
       throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
     }
+    // The mirror of unwrapKey below: in a KEM flow this export is the SENDER's copy of the same
+    // key-encryption key, so leaving it unwiped would keep a full copy of the KEK alive for the
+    // process lifetime and make the wipes the CMS layer performs pointless in the encrypt direction.
     try {
-      var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-      return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+      return _withSecretBytes(wrappingKey, function (wkBytes) {
+        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+      });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
   }
   // Delegate to a content-encryption algorithm (RSA-OAEP / AES-GCM).
   var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
-  return this.encrypt(wrapAlgorithm, wrapKeyClone, bytes);
+  return await this.encrypt(wrapAlgorithm, wrapKeyClone, bytes);
+  } finally {
+    // Clearing  also clears the export it came from: for every non-jwk format
+    // Buffer.from(<ArrayBuffer>) is a VIEW over that buffer, not a copy, so one wipe covers both.
+    // A "jwk" export is the residual -- its key material lives in immutable JavaScript strings that
+    // no code can overwrite -- so wrapping a jwk serialization cannot offer this guarantee, and the
+    // documentation does not claim it does.
+    guard.secret.zeroize(bytes, WebCryptoError, "webcrypto/operation", "the exported key being wrapped");
+  }
 };
 
 SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey, unwrappingKey, unwrapAlgorithm, unwrappedKeyAlgorithm, extractable, keyUsages) {
@@ -760,9 +910,17 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
       throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
     }
+    // The exported wrapping key is a Buffer this module owns; in a KEM flow it is the KEK derived
+    // from the shared secret, so it is wiped once the unwrap has consumed it -- on the failing path
+    // too, which is the one an attacker induces by tampering with the wrapped key.
+    // The export happens INSIDE the try: a key whose handle cannot be exported must still surface
+    // the typed verdict this branch promises, not a raw node TypeError -- and a non-PkiError throw
+    // would also break the fuzz-harness contract.
     try {
-      var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-      bytes = Buffer.concat([d.update(wrapped), d.final()]);
+      bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
+        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        return Buffer.concat([d.update(wrapped), d.final()]);
+      });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
@@ -783,7 +941,14 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   } else {
     keyData = bytes;
   }
-  return this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+  try {
+    return await this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+  } finally {
+    // `bytes` is the UNWRAPPED key in plaintext -- a module-owned buffer, and the last plaintext
+    // copy this layer controls once importKey has taken its own. Clearing the caller-visible copy
+    // downstream while leaving this one live would make that wipe ceremonial.
+    guard.secret.zeroize(bytes, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
+  }
 };
 
 function _cloneWithUsage(key, usage) {
@@ -819,10 +984,13 @@ function _nodeKey(fn, who) {
 // RFC 9935 sec. 6 ML-KEM-*-PrivateKey CHOICE: the inner sizes, keyed by the OID -- the OID is
 // the SOLE authority for the parameter set (never a length heuristic). ek = 384k+32, dk = the
 // FIPS 203 decapsulation key length.
+// {ek, dk} come from the shared ML-KEM parameter registry (FIPS 203 Table 3) -- the same rows the
+// CMS codec and the linter read, so a parameter set cannot mean one size here and another there.
 var ML_KEM_INNER = {};
-ML_KEM_INNER[oid.byName("id-ml-kem-512")] = { ek: 800, dk: 1632 };
-ML_KEM_INNER[oid.byName("id-ml-kem-768")] = { ek: 1184, dk: 2400 };
-ML_KEM_INNER[oid.byName("id-ml-kem-1024")] = { ek: 1568, dk: 3168 };
+["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
+  var row = oid.kemParams(n);
+  ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
+});
 
 function _isOctet(node, size) {
   return node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING &&
@@ -1028,9 +1196,13 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
   if (!key.extractable) throw new WebCryptoError("webcrypto/invalid-access", "key is not extractable");
   if (format === "jwk") return key._handle.export({ format: "jwk" });
   if (key.type === "secret") {
-    var raw = key._handle.export();
-    if (format === "raw") return _toArrayBuffer(raw);
-    throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+    // The export is a fresh Buffer holding the secret key, and _toArrayBuffer copies it via
+    // ArrayBuffer.slice -- so the export is a controllable allocation nothing references once the
+    // copy exists. The unsupported-format throw below clears it too.
+    return _withSecretBytes(key, function (raw) {
+      if (format === "raw") return _toArrayBuffer(raw);
+      throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+    });
   }
   if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
   if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:14a71e45-54e7-49bd-8fe1-ac576a769036",
+  "serialNumber": "urn:uuid:a5caa56c-cfae-4869-93f2-4e8984c7c32f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-10T02:28:13.520Z",
+    "timestamp": "2026-08-10T23:24:00.079Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.12",
+      "bom-ref": "@blamejs/pki@0.4.14",
       "type": "application",
       "name": "pki",
-      "version": "0.4.12",
+      "version": "0.4.14",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.12",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.14",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.12",
+      "ref": "@blamejs/pki@0.4.14",
       "dependsOn": []
     }
   ]