@blamejs/pki 0.4.2 → 0.4.3

package/lib/webcrypto.js

@@ -20,8 +20,9 @@
  *   **PQC-first without being PQC-only**: the FIPS 204 ML-DSA and FIPS
  *   205 SLH-DSA signature suites sit alongside the full classical set PKI
  *   still runs on -- RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA, ECDH,
- *   Ed25519 / Ed448, AES-GCM / CBC / KW, HMAC, HKDF, PBKDF2, and the SHA
- *   family (including legacy SHA-1 for old certificates and signatures).
+ *   Ed25519 / Ed448, AES-GCM / CBC / KW, HMAC, HKDF, PBKDF2, the SHA family
+ *   (including legacy SHA-1 for old certificates and signatures), and the
+ *   SHAKE128 / SHAKE256 extendable-output functions as message digests.
  *   FIPS 203 ML-KEM key generation, encoding, certificate/PKCS#8 import,
  *   and encapsulation/decapsulation (encapsulateBits / decapsulateBits over
  *   Node's crypto.encapsulate/decapsulate) are all available.
@@ -100,6 +101,21 @@ var HASH_NODE = {
   "SHA3-512": "sha3-512",
 };
 
+// FIPS 202 extendable-output functions, as message digests. Deliberately a
+// SEPARATE table from HASH_NODE rather than rows added to it: an XOF's output
+// length is a parameter rather than a property of its name, and node:crypto
+// refuses an XOF at every other HASH_NODE consumer (signature, HMAC, HKDF,
+// PBKDF2, OAEP). Widening the shared table would turn those consumers' typed
+// "unsupported hash" rejection into a raw error from the underlying library.
+// The length is fixed by the name, not chosen by the caller: RFC 8702 sec. 4
+// requires the output length of SHAKE128 or SHAKE256 used as a message digest
+// to be 32 or 64 bytes respectively, and RFC 9814 sec. 4 and
+// draft-ietf-lamps-cms-composite-sigs sec. 3 restate it for their profiles.
+var XOF_NODE = {
+  "SHAKE128": { node: "shake128", length: 32 },
+  "SHAKE256": { node: "shake256", length: 64 },
+};
+
 function _hashNode(h, who) {
   var name = (typeof h === "string") ? h : (h && h.name);
   var node = HASH_NODE[String(name).toUpperCase()];
@@ -218,8 +234,14 @@ function _requireAlgMatch(alg, key, who) {
 function SubtleCrypto() {}
 
 SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
-  var node = _hashNode(_normalizeAlg(algorithm, "digest").name, "digest");
-  var h = nodeCrypto.createHash(node);
+  var name = _normalizeAlg(algorithm, "digest").name;
+  var xof = XOF_NODE[String(name).toUpperCase()];
+  // An XOF is always constructed with its output length stated. Omitting it
+  // makes node emit a deprecation warning and fall back to a 32-byte squeeze,
+  // which for SHAKE256 would silently produce half the required digest.
+  var h = xof
+    ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
+    : nodeCrypto.createHash(_hashNode(name, "digest"));
   h.update(_toBuf(data, "digest"));
   return _toArrayBuffer(h.digest());
 };
@@ -256,11 +278,15 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
 function _generateKeyPair(alg) {
   var name = alg.name, kp, algorithm;
   if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") {
+    // Resolve the hash BEFORE generating. An RSA keygen is the expensive step here, and a hash
+    // this engine cannot use yields a key that can never sign, so the refusal has to come first
+    // or the caller pays for a keypair only to be told the request was unusable.
+    var rsaHash = _hashObj(alg.hash, "generateKey " + name);
     kp = nodeCrypto.generateKeyPairSync("rsa", {
       modulusLength: alg.modulusLength || 2048,
       publicExponent: alg.publicExponent ? _bufToBigIntNum(alg.publicExponent) : 65537,
     });
-    algorithm = { name: _stdName(name), modulusLength: alg.modulusLength || 2048, publicExponent: alg.publicExponent, hash: _hashObj(alg.hash) };
+    algorithm = { name: _stdName(name), modulusLength: alg.modulusLength || 2048, publicExponent: alg.publicExponent, hash: rsaHash };
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
     if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + JSON.stringify(curve));
@@ -284,7 +310,13 @@ function _generateKeyPair(alg) {
   return { publicKey: kp.publicKey, privateKey: kp.privateKey, algorithm: algorithm };
 }
 
-function _hashObj(h) { if (!h) return undefined; return { name: (typeof h === "string" ? h : h.name) }; }
+// The hash recorded on a CryptoKey's algorithm. The name is RESOLVED here, so an
+// entry point refuses a hash this engine cannot use instead of minting a key that
+// only fails at its first sign / verify / wrap -- after the caller has already paid
+// for the key generation. Resolution runs through _hashNode itself rather than a
+// second table, so what an entry point accepts cannot drift from what the
+// operations support.
+function _hashObj(h, who) { if (!h) return undefined; var n = (typeof h === "string" ? h : h.name); _hashNode(n, who || "importKey"); return { name: n }; }
 // The node key argument for an ML-DSA sign/verify: the bare handle, or a
 // { key, context } when the caller supplies an ML-DSA context. FIPS 204 bounds the
 // context to 0..255 bytes; a longer one is a DataError at the API boundary, not a
@@ -849,7 +881,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
       var raw = _toBuf(keyData, "importKey raw");
       _assertAesImportLen(name, raw.length);
       var secret = nodeCrypto.createSecretKey(raw);
-      var symAlg = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash), length: raw.length * 8 } : { name: name, length: raw.length * 8 };
+      var symAlg = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey raw HMAC"), length: raw.length * 8 } : { name: name, length: raw.length * 8 };
       return new CryptoKey("secret", extractable, symAlg, usages, secret);
     }
     // Raw public keys are imported via JWK reconstruction below.
@@ -879,7 +911,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
       var kbuf = _b64urlToBuf(jwk.k, "JWK oct key material");
       _assertAesImportLen(name, kbuf.length);
       var s2 = nodeCrypto.createSecretKey(kbuf);
-      var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
+      var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey jwk HMAC"), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);
     }
     var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d");
@@ -946,7 +978,7 @@ function _algFromImport(name, alg, keyObject) {
     }
     return { name: name, namedCurve: actualCurve };
   }
-  if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") return { name: _stdName(name), hash: _hashObj(alg.hash) };
+  if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") return { name: _stdName(name), hash: _hashObj(alg.hash, "importKey " + name) };
   if (name === "ED25519" || name === "ED448") return { name: _stdName(name) };
   return { name: alg.name };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:484717d3-b574-44fc-ba53-e13d70ea5f85",
+  "serialNumber": "urn:uuid:1c291ecb-db3e-4569-b3aa-70bb7803b9f3",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-08T05:35:44.402Z",
+    "timestamp": "2026-08-08T07:58:59.469Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.2",
+      "bom-ref": "@blamejs/pki@0.4.3",
       "type": "application",
       "name": "pki",
-      "version": "0.4.2",
+      "version": "0.4.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.2",
+      "ref": "@blamejs/pki@0.4.3",
       "dependsOn": []
     }
   ]