@blamejs/pki 0.4.13 → 0.4.14

package/lib/cms-encrypt.js

@@ -164,59 +164,69 @@ async function _buildKari(cek, cert, opts) {
   var keyAlg = cert.subjectPublicKeyInfo.algorithm;
   var wrapName = _wrapOidForKek(cek.length);
   var ukm = opts.ukm ? guard.bytes.view(opts.ukm, CmsError, "cms/bad-input", "ukm") : null;
-  var ecdhPub, origKeyAlgId, kek;
-  if (keyAlg.oid === O("ecPublicKey")) {
-    var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
-    var ka = EC_KA[curveOid];
-    if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
-    var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
-    var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
-    origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
-    var z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
-    var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
-    var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
-    kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
-    void ecdhPub;
-  } else if (MONT_KA[keyAlg.oid]) {
-    var mka = MONT_KA[keyAlg.oid];
-    var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
-    var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
-    origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
-    var mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
-    if (mz.every(function (x) { return x === 0; })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
-    var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
-    // RFC 8418 sec. 2.2: when a ukm is present it is used BOTH as the HKDF salt AND as the
-    // ECC-CMS-SharedInfo entityUInfo (the HKDF info) -- omitting it from the info diverges the KEK
-    // from any conformant peer that reads the transmitted ukm.
-    kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
-  } else {
-    // Coverage residual: unreachable -- _buildRecipient routes only ecPublicKey / X25519 / X448
-    // keys into _buildKari; a defensive throw against a future dispatch change.
-    throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
-  }
-  var encryptedKey = await _aesKwWrap(kek, cek);
-  // originatorKey [1] IMPLICIT OriginatorPublicKey { algorithm, publicKey BIT STRING }.
-  var origSpki = asn1.decode(origKeyAlgId.spki);
-  var origPubBits = origSpki.children[1]; // BIT STRING node
-  var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
-  // KeyAgreeRecipientIdentifier CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
-  // RecipientKeyIdentifier } -- the SKI form here wraps a SEQUENCE (rKeyId), unlike ktri's bare
-  // subjectKeyIdentifier [0] IMPLICIT OCTET STRING.
-  var ridNode;
-  _assertKeyIdentifier(opts.keyIdentifier);
-  if (opts.keyIdentifier === "subjectKeyIdentifier") {
-    var ski = _skiOf(cert);
-    if (!ski) throw _err("cms/bad-input", "keyIdentifier: \"subjectKeyIdentifier\" requires the recipient certificate to carry a subjectKeyIdentifier extension");
-    ridNode = b.contextConstructed(0, b.octetString(ski));
-  } else {
-    ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+  // z / mz (the raw agreement secret) and the derived kek are all allocated here and all secret.
+  // Declared together so one `finally` clears whichever the chosen branch produced, including when
+  // a later encoding step throws (RFC 9629 sec. 7 asks the same of the KEM builder below).
+  var ecdhPub, origKeyAlgId, kek, z, mz;
+  try {
+    if (keyAlg.oid === O("ecPublicKey")) {
+      var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
+      var ka = EC_KA[curveOid];
+      if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
+      var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
+      var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
+      origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
+      z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
+      var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
+      var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
+      kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
+      void ecdhPub;
+    } else if (MONT_KA[keyAlg.oid]) {
+      var mka = MONT_KA[keyAlg.oid];
+      var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
+      var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
+      origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
+      mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
+      if (mz.every(function (x) { return x === 0; })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
+      var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
+      // RFC 8418 sec. 2.2: when a ukm is present it is used BOTH as the HKDF salt AND as the
+      // ECC-CMS-SharedInfo entityUInfo (the HKDF info) -- omitting it from the info diverges the KEK
+      // from any conformant peer that reads the transmitted ukm.
+      kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
+    } else {
+      // Coverage residual: unreachable -- _buildRecipient routes only ecPublicKey / X25519 / X448
+      // keys into _buildKari; a defensive throw against a future dispatch change.
+      throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
+    }
+    var encryptedKey = await _aesKwWrap(kek, cek);
+    // originatorKey [1] IMPLICIT OriginatorPublicKey { algorithm, publicKey BIT STRING }.
+    var origSpki = asn1.decode(origKeyAlgId.spki);
+    var origPubBits = origSpki.children[1]; // BIT STRING node
+    var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
+    // KeyAgreeRecipientIdentifier CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
+    // RecipientKeyIdentifier } -- the SKI form here wraps a SEQUENCE (rKeyId), unlike ktri's bare
+    // subjectKeyIdentifier [0] IMPLICIT OCTET STRING.
+    var ridNode;
+    _assertKeyIdentifier(opts.keyIdentifier);
+    if (opts.keyIdentifier === "subjectKeyIdentifier") {
+      var ski = _skiOf(cert);
+      if (!ski) throw _err("cms/bad-input", "keyIdentifier: \"subjectKeyIdentifier\" requires the recipient certificate to carry a subjectKeyIdentifier extension");
+      ridNode = b.contextConstructed(0, b.octetString(ski));
+    } else {
+      ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+    }
+    var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]); // RecipientEncryptedKeys SEQ OF { rid, encKey }
+    var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
+    var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
+    if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
+    kariKids.push(kekAlg, rek);
+    return { tag: 1, node: b.sequence(kariKids) };
+  } finally {
+    // Buffer.from(arrayBuffer) is a VIEW over the engine's returned buffer, so clearing z / mz
+    // clears that allocation too. The CEK belongs to the caller (the message, not this recipient)
+    // and is wiped once at the end of encrypt; the ephemeral PUBLIC key is not secret.
+    guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
   }
-  var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]); // RecipientEncryptedKeys SEQ OF { rid, encKey }
-  var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
-  var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-  if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-  kariKids.push(kekAlg, rek);
-  return { tag: 1, node: b.sequence(kariKids) };
 }
 
 // ---- kekri (symmetric KEK) : AES-KW --------------------------------------
@@ -232,22 +242,37 @@ async function _buildKekri(cek, desc) {
 // A PBKDF2 iterationCount MUST be a positive integer within the same cap the decryptor enforces -- a
 // ---- pwri (password) : PBKDF2 + RFC 3211 double-CBC PWRI-KEK ---------------
 async function _buildPwri(cek, desc) {
-  var password = pbes2.passwordBytes(desc.password, _err, "cms");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  // The option validation runs BEFORE the password is encoded: a rejected iteration count or salt
+  // would otherwise abandon an owned credential copy on the way out.
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
   var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
+  _prfHash(prf);   // reject an unsupported prf HERE, before a credential copy exists to abandon
   var innerKeyBytes = 32; // AES-256-CBC inner
+  var pwOwn = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+  var password = pwOwn.bytes;
   var kekKey = await subtle.importKey("raw", password, { name: "PBKDF2" }, false, ["deriveBits"]);
+  // The derived KEK is this function's allocation and is cleared below. `password` is NOT: when the
+  // caller passes a Buffer, passwordBytes hands back that very buffer, so wiping it would destroy
+  // the caller's own memory -- the one failure this rule must never cause.
   var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt: salt, iterations: iterations }, kekKey, innerKeyBytes * 8));
-  // The RFC 3211 double-CBC wrap under an inner AES-256-CBC whose IV is carried in the
-  // keyEncryptionAlgorithm parameter (id-alg-PWRI-KEK parameter = the inner cipher AlgorithmIdentifier).
-  var iv = nodeCrypto.randomBytes(16);
-  var encryptedKey = _pwriWrapIv(kek, cek, iv);
-  // PBKDF2-params as keyDerivationAlgorithm [0] IMPLICIT.
-  var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
-  var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
-  var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
-  return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+  if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+  try {
+    // The RFC 3211 double-CBC wrap under an inner AES-256-CBC whose IV is carried in the
+    // keyEncryptionAlgorithm parameter (id-alg-PWRI-KEK parameter = the inner cipher AlgorithmIdentifier).
+    var iv = nodeCrypto.randomBytes(16);
+    var encryptedKey = _pwriWrapIv(kek, cek, iv);
+    // PBKDF2-params as keyDerivationAlgorithm [0] IMPLICIT.
+    var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
+    var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
+    var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
+    return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+  } finally {
+    guard.secret.zeroize(kek, CmsError, "cms/bad-input", "the password-derived key-encryption key");
+  }
 }
 
 // ---- kemri (ML-KEM ori) : RFC 9629 + 9936 ---------------------------------
@@ -319,15 +344,25 @@ function _pwriFormat(cek) {
   var blk = 16;
   var padLen = body.length % blk === 0 ? 0 : blk - (body.length % blk);
   if (body.length + padLen < 2 * blk) padLen += (2 * blk - (body.length + padLen));
-  return Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  //  and  each hold a plaintext copy of the CEK; only the padded result is returned, so
+  // the intermediates are cleared here rather than abandoned.
+  var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
+  return wrapped;
 }
 function _pwriWrapIv(kek, cek, iv) {
+  // wk is the formatted plaintext -- a complete copy of the CEK -- and is cleared once the first
+  // encryption pass has consumed it. pass1 is already ciphertext.
   var wk = _pwriFormat(cek);
-  var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
-  var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
-  var iv2 = pass1.subarray(pass1.length - 16);
-  var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
-  return Buffer.concat([c2.update(pass1), c2.final()]);
+  try {
+    var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
+    var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
+    var iv2 = pass1.subarray(pass1.length - 16);
+    var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
+    return Buffer.concat([c2.update(pass1), c2.final()]);
+  } finally {
+    guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
+  }
 }
 
 var PRF_HASH = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
@@ -376,16 +411,23 @@ async function encrypt(content, recipients, opts) {
   var contentType = opts.contentType || "data";
   var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
 
-  // EncryptedData: a single non-array { cek } or { password } descriptor, no RecipientInfos.
-  if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
+  // The CEK protects the content for EVERY recipient, so unlike a per-recipient shared secret it is
+  // cleared ONCE, after the last recipient entry is built and the content is encrypted -- wiping it
+  // inside the recipient loop would destroy the key the remaining recipients must be given.
+  try {
+    // EncryptedData: a single non-array { cek } or { password } descriptor, no RecipientInfos.
+    if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
 
-  if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
-  var recips = [];
-  for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
-  var riNodes = recips.map(_taggedRecipient);
+    if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
+    var recips = [];
+    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
+    var riNodes = recips.map(_taggedRecipient);
 
-  if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
-  return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+    if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
+    return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+  } finally {
+    guard.secret.zeroize(cek, CmsError, "cms/bad-input", "the content-encryption key");
+  }
 }
 
 function _emit(inner, ctName, opts) {
@@ -445,16 +487,27 @@ function _encryptedData(contentBytes, desc, ca, contentType, opts, cek) {
 }
 
 function _encryptedDataPbes2(contentBytes, desc, ca, contentType, iv, opts) {
-  var password = pbes2.passwordBytes(desc.password, _err, "cms");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+  var password = pwOwn2.bytes;
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
   var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
+  // The password-derived content key is this function's allocation; `password` may be the caller's
+  // own buffer (passwordBytes passes a Buffer straight through) and is left alone.
   var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
-  var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
-  var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
-  var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
-  var inner = b.sequence([b.integer(0n), eci]);
-  return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+  if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+  try {
+    var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
+    var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
+    var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
+    var inner = b.sequence([b.integer(0n), eci]);
+    return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+  } finally {
+    guard.secret.zeroize(key, CmsError, "cms/bad-input", "the password-derived content-encryption key");
+  }
 }
 
 // ---- content-encryption primitives ----------------------------------------
@@ -505,65 +558,71 @@ async function authenticate(content, recipients, opts) {
   // RFC 5652 sec. 9.1: authAttrs MUST be present when the eContentType is not id-data.
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
 
+  // The MAC key is this path's content-encryption key: every recipient is given it, so it is cleared
+  // ONCE at the end rather than per recipient, and only after the MAC has been computed over it.
   var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
-  var recips = [];
-  for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
-  var riNodes = recips.map(_taggedRecipient);
-
-  var digestName = opts.digestAlgorithm || mac.node;
-  var digestAlgTagged = null, authAttrsDer = null, preimage;
-  if (withAttrs) {
-    if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
-    // sec. 9.2: content-type (== eContentType) + message-digest (== digest(content)) attributes,
-    // SET-OF-sorted, MACed under the EXPLICIT SET OF tag (0x31) but transmitted [2] IMPLICIT (0xA2).
-    var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
-    var pairs = [
-      b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
-      b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),
-    ];
-    if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
-    // Every authAttr (auto-built or caller-supplied) MUST be a well-formed Attribute SEQUENCE
-    // { type OBJECT IDENTIFIER, values SET OF } and each type appears at most once (RFC 5652) -- so a
-    // malformed or duplicate caller attribute is rejected BEFORE it is MACed and emitted, never left to
-    // fail an operator's parser downstream.
-    var seenTypes = {};
-    pairs.forEach(function (p) {
-      var node;
-      try { node = asn1.decode(p); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e); }
-      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 ||
-        node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET ||
-        !node.children[1].children || node.children[1].children.length < 1) {
-        throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
-      }
-      var t;
-      try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
-      if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
-      seenTypes[t] = 1;
-    });
-    var setOf = b.setOf(pairs);
-    preimage = setOf;                                                            // MAC over the 0x31 SET OF
-    authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));   // [2] IMPLICIT on the wire
-    digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));             // [1] IMPLICIT DigestAlgorithmIdentifier
-  } else {
-    preimage = contentBytes;                                                    // MAC over the eContent value octets
-  }
-
-  var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
-  var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
+  try {
+    var recips = [];
+    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
+    var riNodes = recips.map(_taggedRecipient);
+
+    var digestName = opts.digestAlgorithm || mac.node;
+    var digestAlgTagged = null, authAttrsDer = null, preimage;
+    if (withAttrs) {
+      if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
+      // sec. 9.2: content-type (== eContentType) + message-digest (== digest(content)) attributes,
+      // SET-OF-sorted, MACed under the EXPLICIT SET OF tag (0x31) but transmitted [2] IMPLICIT (0xA2).
+      var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
+      var pairs = [
+        b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
+        b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),
+      ];
+      if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
+      // Every authAttr (auto-built or caller-supplied) MUST be a well-formed Attribute SEQUENCE
+      // { type OBJECT IDENTIFIER, values SET OF } and each type appears at most once (RFC 5652) -- so a
+      // malformed or duplicate caller attribute is rejected BEFORE it is MACed and emitted, never left to
+      // fail an operator's parser downstream.
+      var seenTypes = {};
+      pairs.forEach(function (p) {
+        var node;
+        try { node = asn1.decode(p); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e); }
+        if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 ||
+          node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET ||
+          !node.children[1].children || node.children[1].children.length < 1) {
+          throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
+        }
+        var t;
+        try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
+        if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+        seenTypes[t] = 1;
+      });
+      var setOf = b.setOf(pairs);
+      preimage = setOf;                                                            // MAC over the 0x31 SET OF
+      authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));   // [2] IMPLICIT on the wire
+      digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));             // [1] IMPLICIT DigestAlgorithmIdentifier
+    } else {
+      preimage = contentBytes;                                                    // MAC over the eContent value octets
+    }
 
-  var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
-  var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-  if (digestAlgTagged) kids.push(digestAlgTagged);
-  kids.push(eci);
-  if (authAttrsDer) kids.push(authAttrsDer);
-  kids.push(b.octetString(macValue));
-  var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
-  // Self-verify: the emitted AuthenticatedData MUST re-parse clean through the strict parser, so a
-  // caller-supplied authenticated attribute with a recognized type but extra RFC 5652 constraints (a
-  // misplaced type, a signing-time whose value is not a Time) is rejected HERE at build time rather
-  // than by the recipient's parser after the fact.
-  try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
-  return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+    var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
+    var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
+
+    var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
+    var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
+    if (digestAlgTagged) kids.push(digestAlgTagged);
+    kids.push(eci);
+    if (authAttrsDer) kids.push(authAttrsDer);
+    kids.push(b.octetString(macValue));
+    var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
+    // Self-verify: the emitted AuthenticatedData MUST re-parse clean through the strict parser, so a
+    // caller-supplied authenticated attribute with a recognized type but extra RFC 5652 constraints (a
+    // misplaced type, a signing-time whose value is not a Time) is rejected HERE at build time rather
+    // than by the recipient's parser after the fact.
+    try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
+    return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+  } finally {
+    guard.secret.zeroize(macKey, CmsError, "cms/bad-input", "the message-authentication key");
+  }
 }
 
 module.exports = { encrypt: encrypt, authenticate: authenticate };

package/lib/hpke.js

@@ -94,13 +94,29 @@ function _expand(hash, Nh, prk, info, len) {
   if (len > 255 * Nh) throw _err("hpke/export-length", "requested length " + len + " exceeds 255*Nh");
   var out = [], t = Buffer.alloc(0), n = Math.ceil(len / Nh);
   for (var i = 1; i <= n; i++) {
-    t = nodeCrypto.createHmac(hash, prk).update(concat([t, info, Buffer.from([i])])).digest();
+    // The feedback input carries the PREVIOUS output block, so each round's concatenation holds
+    // secret material and is cleared once the HMAC has absorbed it.
+    var fed = concat([t, info, Buffer.from([i])]);
+    t = nodeCrypto.createHmac(hash, prk).update(fed).digest();
+    guard.secret.zeroize(fed, HpkeError, "hpke/bad-input", "an expand feedback input");
     out.push(t);
   }
-  return concat(out).subarray(0, len);
+  // An exact-sized owning buffer, not a VIEW over the joined blocks: this is keying material, and a
+  // caller clearing what it received must not leave the unused tail of the final HMAC block behind
+  // it. The accumulator and each block are cleared here.
+  var joined = concat(out);
+  var exact = Buffer.alloc(len);
+  joined.copy(exact, 0, 0, len);
+  guard.secret.zeroize(joined, HpkeError, "hpke/bad-input", "the KDF accumulator");
+  for (var oi = 0; oi < out.length; oi++) guard.secret.zeroize(out[oi], HpkeError, "hpke/bad-input", "a KDF block");
+  return exact;
 }
 function _labeledExtract(kdf, suiteId, salt, label, ikm) {
-  return _extract(kdf.hash, kdf.Nh, salt, concat([HPKE_V1, suiteId, L(label), ikm]));
+  // The concatenation copies the input keying material -- a DH secret or a PSK -- into a fresh
+  // buffer, so that copy is cleared once extract has consumed it. The caller still owns .
+  var labeled = concat([HPKE_V1, suiteId, L(label), ikm]);
+  try { return _extract(kdf.hash, kdf.Nh, salt, labeled); }
+  finally { guard.secret.zeroize(labeled, HpkeError, "hpke/bad-input", "the labeled extract input"); }
 }
 function _labeledExpand(kdf, suiteId, prk, label, info, len) {
   return _expand(kdf.hash, kdf.Nh, prk, concat([i2osp(len, 2), HPKE_V1, suiteId, L(label), info]), len);
@@ -177,8 +193,11 @@ function _generate(kem) {
 function _kemSuiteId(kemId) { return concat([L("KEM"), i2osp(kemId, 2)]); }
 function _extractAndExpand(kem, dh, kemContext) {
   var kdf = _kdf(kem.kdf), sid = _kemSuiteId(_kemId(kem));
+  // The extract PRK is a secret intermediate this function allocated: it is as sensitive as the DH
+  // input it summarises, so it is cleared once the expand has consumed it.
   var eaePrk = _labeledExtract(kdf, sid, Buffer.alloc(0), "eae_prk", dh);
-  return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret);
+  try { return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret); }
+  finally { guard.secret.zeroize(eaePrk, HpkeError, "hpke/bad-input", "the KEM extract PRK"); }
 }
 function _kemId(kem) { for (var k in KEMS) if (KEMS[k] === kem) return Number(k); return 0; }
 
@@ -189,25 +208,49 @@ function _ephemeral(kem, eph) {
   var kp = _generate(kem);
   return { skE: kp.privateKey, enc: _exportPublic(kem, kp.publicKey) };
 }
+// The raw DH output is the KEM's shared secret before extraction: it is this module's allocation
+// and is cleared once _extractAndExpand has consumed it, on every DHKEM arm. In the authenticated
+// arms  builds a THIRD copy holding both DH results, so the concatenation is cleared as
+// well -- clearing only the pieces would leave the joined buffer readable.
+function _wipeDh(dh) { guard.secret.zeroize(dh, HpkeError, "hpke/bad-input", "the KEM shared secret"); }
+// EVERY agreement happens inside the protected region. In the authenticated modes the second
+// agreement can throw on an attacker-supplied low-order sender key, and a first secret computed
+// outside the region would be left behind on exactly that failure path.
 function _encap(kem, pkR, pkRm, eph) {
   var e = _ephemeral(kem, eph);
-  var dh = _dh(e.skE, pkR);
-  return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+  var dh = null;
+  try {
+    dh = _dh(e.skE, pkR);
+    return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+  } finally { _wipeDh(dh); }
 }
 function _decap(kem, enc, skR, pkRm) {
   var pkE = _importPublic(kem, enc);
-  var dh = _dh(skR, pkE);
-  return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+  var dh = null;
+  try {
+    dh = _dh(skR, pkE);
+    return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+  } finally { _wipeDh(dh); }
 }
 function _authEncap(kem, pkR, pkRm, skS, pkSm, eph) {
   var e = _ephemeral(kem, eph);
-  var dh = concat([_dh(e.skE, pkR), _dh(skS, pkR)]);
-  return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+  var dh1 = null, dh2 = null, dh = null;
+  try {
+    dh1 = _dh(e.skE, pkR);
+    dh2 = _dh(skS, pkR);
+    dh = concat([dh1, dh2]);
+    return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+  } finally { _wipeDh(dh1); _wipeDh(dh2); _wipeDh(dh); }
 }
 function _authDecap(kem, enc, skR, pkRm, pkS, pkSm) {
   var pkE = _importPublic(kem, enc);
-  var dh = concat([_dh(skR, pkE), _dh(skR, pkS)]);
-  return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+  var dh1 = null, dh2 = null, dh = null;
+  try {
+    dh1 = _dh(skR, pkE);
+    dh2 = _dh(skR, pkS);
+    dh = concat([dh1, dh2]);
+    return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+  } finally { _wipeDh(dh1); _wipeDh(dh2); _wipeDh(dh); }
 }
 
 // ---- key schedule (RFC 9180 sec. 5.1) ----------------------------------------
@@ -227,14 +270,20 @@ function _keySchedule(suite, mode, sharedSecret, info, psk, pskId, role) {
   var pskIdHash = _labeledExtract(kdf, sid, Buffer.alloc(0), "psk_id_hash", pskId);
   var infoHash = _labeledExtract(kdf, sid, Buffer.alloc(0), "info_hash", info);
   var ksc = concat([Buffer.from([mode]), pskIdHash, infoHash]);
+  //  is the key schedule's master PRK -- every key below is derived from it, so it is the
+  // most valuable intermediate here and is cleared once the derivations are done.
   var secret = _labeledExtract(kdf, sid, sharedSecret, "secret", psk);
-  var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
-  var key = null, baseNonce = null;
-  if (!aead.exportOnly) {
-    key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
-    baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+  try {
+    var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
+    var key = null, baseNonce = null;
+    if (!aead.exportOnly) {
+      key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
+      baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+    }
+    return new Context(suite, key, baseNonce, exporterSecret, role);
+  } finally {
+    guard.secret.zeroize(secret, HpkeError, "hpke/bad-input", "the key-schedule PRK");
   }
-  return new Context(suite, key, baseNonce, exporterSecret, role);
 }
 
 // ---- AEAD context (RFC 9180 sec. 5.2 / 5.3) ----------------------------------
@@ -246,6 +295,12 @@ function Context(suite, key, baseNonce, exporterSecret, role) {
   this._suite = suite; this._key = key; this._baseNonce = baseNonce;
   this._exporterSecret = exporterSecret; this._seq = 0n; this._role = role;
 }
+// Clear the context's key material. The single-shot entry points below build a context, use it once
+// and drop it, so without this the AEAD key, base nonce and exporter secret stay readable for the
+// process lifetime -- the multi-message API hands the context to the caller, who owns its lifetime.
+Context.prototype._dispose = function () {
+  guard.secret.zeroizeAll([this._key, this._baseNonce, this._exporterSecret], HpkeError, "hpke/bad-input", "the HPKE context key material");
+};
 Context.prototype._nonce = function () {
   var aead = this._suite.aead;
   var seqBytes = i2osp(this._seq, aead.Nn);
@@ -431,7 +486,10 @@ function _setupR(ids, enc, skR, opts) {
   } else {
     ss = _decap(kem, _buf(enc), r.key, r.pkm);
   }
-  return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R");
+  // The recipient derives this shared secret and never hands it back (unlike setupS, whose caller
+  // receives it and owns it from then on), so it is cleared once the key schedule has consumed it.
+  try { return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R"); }
+  finally { guard.secret.zeroize(ss, HpkeError, "hpke/bad-input", "the KEM shared secret"); }
 }
 
 /**
@@ -453,8 +511,21 @@ function _setupR(ids, enc, skR, opts) {
  *   var out = pki.hpke.seal(ids, pkR, {}, Buffer.from("aad"), Buffer.from("msg"));
  */
 function seal(ids, pkR, opts, aad, pt) {
-  var s = _setupS(ids, pkR, opts);
+  // _setupS itself can reject after allocating (an unusable AEAD, a bad psk pairing), so the whole
+  // call is inside the protected region rather than only what follows a successful setup.
+  var s = null;
+  try {
+  s = _setupS(ids, pkR, opts);
+  // The single-shot wrapper returns neither the setup result nor its shared secret, so no caller can
+  // own that buffer -- it is cleared here along with the context. setupS itself still hands both to
+  // its caller, whose lifetime they become.
   return { enc: s.enc, ct: s.context.seal(_buf(aad), _buf(pt)) };
+  } finally {
+    if (s) {
+      s.context._dispose();
+      guard.secret.zeroize(s.sharedSecret, HpkeError, "hpke/bad-input", "the KEM shared secret");
+    }
+  }
 }
 
 /**
@@ -477,7 +548,9 @@ function seal(ids, pkR, opts, aad, pt) {
  *   var pt = pki.hpke.open(ids, o.enc, { skm: skR, pkm: pkR }, {}, Buffer.alloc(0), o.ct);
  */
 function open(ids, enc, skR, opts, aad, ct) {
-  return _setupR(ids, enc, skR, opts).open(_buf(aad), _buf(ct));
+  var ctx = _setupR(ids, enc, skR, opts);
+  try { return ctx.open(_buf(aad), _buf(ct)); }
+  finally { ctx._dispose(); }
 }
 
 module.exports = {