@blamejs/pki 0.8.31 → 0.8.48

package/lib/validator-tpm.js

@@ -12,9 +12,12 @@ var TPM_ALG = Object.assign(Object.create(null), { RSA: 0x0001, SHA1: 0x0004, SH
 var TPM_ALG_HASH = Object.create(null); TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
 var TPM_CURVE_TO_COSE = Object.create(null); TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
 
+/** @internal The comparison goes through the captured operation. This is what decides that the TPM
+ *  public area holds the credential's key, so a replacement answering zero makes a different key
+ *  match. */
 function _ucmp(a, b) {
   function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
-  return Buffer.compare(strip(a), strip(b)) === 0;
+  return guard.bytes.compare(strip(a), strip(b)) === 0;
 }
 function _uintBytes(n) {
   var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;

package/lib/verify-seam.js

@@ -4,6 +4,12 @@
 // @internal
 
 var guard = require("./guard-all");
+var _seamIntrinsic = require("./guard-intrinsic");
+/** @internal The refusal below is a RESOLVED promise carrying `false`, and `Promise.resolve` builds
+ *  from its RECEIVER. Read from the global binding at the call, that refusal is constructed by whatever
+ *  the binding holds, so a replacement settling truthy turns it into an acceptance. */
+var _Promise = _seamIntrinsic.Promise;
+var _promiseResolve = _seamIntrinsic.uncurry(_seamIntrinsic.promiseResolve);
 
 function makeSeam(name, ErrorClass, code) {
   var engine = null;
@@ -15,7 +21,7 @@ function makeSeam(name, ErrorClass, code) {
       if (engine == null) {
         throw new ErrorClass(code, "the " + name + " signature engine is not initialized (require pki before use)");
       }
-      if (!guard.crypto.isOctetAligned(signature)) return Promise.resolve(false);
+      if (!guard.crypto.isOctetAligned(signature)) return _promiseResolve(_Promise, false);
       return engine(sigAlg, signature.bytes, spkiBytes, preimage);
     },
   };

package/lib/webauthn-mds.js

@@ -8,7 +8,15 @@ var frameworkError = require("./framework-error");
 var x509 = require("./schema-x509");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The seed of the fold below is a RESOLVED promise carrying `false`, the verdict for a chain
+ *  that matched no anchor, and `Promise.resolve` builds from its RECEIVER. Read from the global binding,
+ *  that seed is constructed by whatever the binding holds, so a replacement settling truthy starts the
+ *  fold from "trusted" and every chain is trusted by default. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _hasOwn = intrinsic.hasOwn;
+var _reverse = intrinsic.reverse;
+var _arrSlice = intrinsic.arraySlice;
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
@@ -21,6 +29,11 @@ var nodeCrypto = require("crypto");
 
 var oid = require("./oid");
 var pkix = require("./schema-pkix");
+/** @internal The import and the verify a metadata BLOB's signature check runs, captured at load. One
+ * `verify` answering true accepts a BLOB no authority signed, and the whole authenticator trust list
+ * comes out of that BLOB. */
+var _subtleImportKey = intrinsic.uncurry(webcrypto.webcrypto.subtle.importKey);
+var _subtleVerify = intrinsic.uncurry(webcrypto.webcrypto.subtle.verify);
 var WebauthnError = frameworkError.WebauthnError;
 var _KU_NS = pkix.makeNS("webauthn", WebauthnError, oid);
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
@@ -28,6 +41,17 @@ var _KEYID_HEX_CI = pkix.charTable("0123456789abcdefABCDEF");
 var _KEYID_HEX_LOWER = pkix.charTable("0123456789abcdef");
 var C = constants.LIMITS;
 
+/** @internal The BLOB members this module reads as integers, and so the members whose number tokens must
+ *  denote exactly the integer they are read as. `no` is the one that decides something: `_assertFresh`
+ *  admits a BLOB only when its `no` exceeds the one a relying party holds, so a rounded spelling compares
+ *  as an integer it is not and a stale catalogue is accepted as a newer one.
+ *
+ *  Named individually rather than applied to the document, because a metadata statement is ordinary JSON
+ *  and carries genuine doubles: the published BLOB has members whose values are not integers, among them
+ *  the biometric `selfAttestedFRR` and `selfAttestedFAR` rates and `iAPARThreshold`. A document-wide rule
+ *  refuses the real catalogue. */
+var EXACT_INTEGER_BLOB_MEMBERS = intrinsic.assign(intrinsic.create(null), { no: 1 });
+
 var LEAF_SCHEMES_BY_SPKI_ALG = Object.assign(Object.create(null), {
   ecPublicKey: { ECDSA: 1 },
   rsaEncryption: { "RSASSA-PKCS1-v1_5": 1, "RSA-PSS": 1 },
@@ -193,6 +217,8 @@ function _verifyMetadataBlob(blob, opts) {
   }
   var header, sig;
   try {
+    /** @internal The header carries `alg`, `typ` and the `x5c` chain, all strings, and no number this
+     *  module reads as an integer, so there is nothing here for the rule to apply to. */
     header = guard.json.parse(Buffer.from(jose.base64url.decode(segs[0])), _err, {
       maxBytes: C.MDS_BLOB_HEADER_MAX_BYTES, maxDepth: C.JSON_MAX_DEPTH,
       tooLarge: "webauthn/too-large", badJson: "webauthn/bad-metadata-blob",
@@ -261,9 +287,9 @@ function _verifyMetadataBlob(blob, opts) {
   }
   var params = _blobAlgParams(algRow, leafAlg);
   var signingInput = Buffer.from(segs[0] + "." + segs[1], "ascii");
-  return webcrypto.webcrypto.subtle.importKey("spki", leaf.subjectPublicKeyInfo.bytes, params.imp, false, ["verify"])
+  return _subtleImportKey(webcrypto.webcrypto.subtle, "spki", leaf.subjectPublicKeyInfo.bytes, params.imp, false, ["verify"])
     .then(function (key) {
-      return webcrypto.webcrypto.subtle.verify(params.ver, key, sig, signingInput)
+      return _subtleVerify(webcrypto.webcrypto.subtle, params.ver, key, sig, signingInput)
         .catch(function (e) { throw _err("webauthn/verify-error", "the metadata BLOB signature could not be evaluated under its x5c leaf key", e); });
     }, function (e) { throw _err("webauthn/unsupported-algorithm", "the metadata BLOB x5c leaf key could not be imported for " + header.alg, e); })
     .then(function (ok) {
@@ -278,7 +304,7 @@ function _verifyMetadataBlob(blob, opts) {
 function _chainToAnchor(chain, anchors, at, what, code) {
   var subject = what || "metadata BLOB certificate chain";
   var faultCode = code || "webauthn/metadata-untrusted";
-  var ordered = chain.slice().reverse();
+  var ordered = _reverse(_arrSlice(chain));
   var lastFault = null;
   return anchors.reduce(function (p, anchor) {
     return p.then(function (done) {
@@ -294,7 +320,7 @@ function _chainToAnchor(chain, anchors, at, what, code) {
           parameters: anchor.subjectPublicKeyInfo.algorithm.parameters },
       }).then(function (r) { return !!(r && r.valid); }, function (e) { lastFault = e; return false; });
     });
-  }, Promise.resolve(false)).then(function (trusted) {
+  }, _promiseResolve(_Promise, false)).then(function (trusted) {
     if (!trusted) {
       throw _err(faultCode, "the " + subject + " does not validate to any of the roots it must reach", lastFault);
     }
@@ -321,8 +347,19 @@ function assertFresh(metadata, at, label) {
 function _parsePayload(seg, at, opts) {
   var payload;
   try {
+    /** @internal The exact-integer rule applies to `no` ALONE, not to the document. `no` is the rollback
+     *  counter: `_assertFresh` admits a BLOB only when its `no` exceeds the one a relying party already
+     *  holds, and `1.0000000000000001` converts to the Number 1, so a stale BLOB spelled that way passed
+     *  the `Number.isSafeInteger` check as the integer it is not and compared as that integer.
+     *
+     *  Document-wide would refuse the real catalogue. A metadata statement is ordinary JSON and carries
+     *  genuine doubles: the published BLOB has ten members whose values are not integers, among them
+     *  `selfAttestedFRR` and `selfAttestedFAR`, the biometric false-reject and false-accept rates, and
+     *  `iAPARThreshold`. Measured on the live BLOB from mds3.fidoalliance.org rather than read off the
+     *  specification, because the catalogue is what has to be ingestible. */
     payload = guard.json.parse(Buffer.from(jose.base64url.decode(seg)), _err, {
       maxBytes: C.MDS_BLOB_MAX_BYTES, maxDepth: C.JSON_MAX_DEPTH,
+      exactIntegerMembers: EXACT_INTEGER_BLOB_MEMBERS,
       tooLarge: "webauthn/too-large", badJson: "webauthn/bad-metadata-blob",
       tooDeep: "webauthn/bad-metadata-blob", duplicateMember: "webauthn/bad-metadata-blob",
       badInput: "webauthn/bad-metadata-blob", label: "the metadata BLOB payload",

package/lib/webauthn.js

@@ -36,6 +36,18 @@ var edwardsPoint = require("./edwards-point");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
+var _reverse = intrinsic.reverse;
+var _arrSlice = intrinsic.arraySlice;
+/** @internal `resolve` and `reject` build their promise from the RECEIVER, so reading the global
+ *  binding at the call hands the construction to whatever that binding holds. Two shapes here decide a
+ *  verdict: the seeds the attestation trust-path reductions fold over, where a replacement settling
+ *  without awaiting the chain emits a verdict for a path that was never walked, and the refusals
+ *  returned as rejected promises, where a replacement whose `reject` resolves turns an unsupported
+ *  format or a missing attested credential into a pass. The constructor and both operations are taken
+ *  at load. */
+var _Promise = intrinsic.Promise;
+var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var jose = require("./jose");
 var mds = require("./webauthn-mds");
 var nodeCrypto = require("crypto");
@@ -52,11 +64,17 @@ function _decodeExt(cert, oidName) {
   return { critical: ext.critical, value: dec(ext.value) };
 }
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The verify operation, captured at load. One answering true accepts an assertion or an
+ * attestation statement that the credential's key never signed, which is the whole verdict. */
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
 
 function _sha(name, buf) { return nodeCrypto.createHash(name).update(buf).digest(); }
+/** @internal The comparison goes through the captured operation. This is what decides that an
+ *  attestation statement's key is the credential's key, so a replacement answering zero makes a
+ *  different key match. */
 function _ucmp(a, b) {
   function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
-  return Buffer.compare(strip(a), strip(b)) === 0;
+  return intrinsic.compare(strip(a), strip(b)) === 0;
 }
 function _isInteger(node) { return !!node && !node.constructed && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER; }
 var COSE_ALG_HASH = intrinsic.assign(intrinsic.create(null), { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-38": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-39": "sha512", "-65535": "sha1" });
@@ -183,7 +201,7 @@ function _verifySig(alg, sig, spkiBytes, message, E) {
   if (imp.name === "Ed25519" || imp.name === "Ed448") _requireValidEdPoint(spkiBytes, imp.name);
   var s = d.ecdsa ? _derEcdsaToRaw(sig, d.imp.namedCurve) : sig;
   return subtle.importKey("spki", spkiBytes, imp, false, ["verify"])
-    .then(function (key) { return subtle.verify(ver, key, s, message); })
+    .then(function (key) { return _subtleVerify(subtle, ver, key, s, message); })
     .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });
 }
 var ED_OID_NAME = intrinsic.create(null);
@@ -406,10 +424,10 @@ function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
   return paths.reduce(function (p, info) {
     return p.then(function () {
       var pathAt = vopts.time !== undefined ? vopts.time : (info.at || at);
-      return mds.chainToAnchor(info.tp.slice().reverse(), roots, pathAt,
+      return mds.chainToAnchor(_reverse(_arrSlice(info.tp)), roots, pathAt,
         "attestation trust path (against the roots supplied as opts.rootCertificates)");
     });
-  }, Promise.resolve()).then(function () {
+  }, _promiseResolve(_Promise, undefined)).then(function () {
     return guard.verdict.of(res, { anchoredTo: _anchoredRoutes(res, "rootCertificates") });
   });
 }
@@ -558,7 +576,7 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     var embedded = _appleNonce(ext.value);
     if (!embedded.equals(nonce)) throw _err("webauthn/verify-failed", "the apple attestation nonce does not equal SHA-256(authData || clientDataHash)");
     _certPubKeyEqualsCose(leaf, att.authData.credentialPublicKey, _err);
-    return Promise.resolve(_result("apple", "AnonCA", chain, att));
+    return _promiseResolve(_Promise, _result("apple", "AnonCA", chain, att));
   },
 
   "android-key": function (att, clientDataHash) {
@@ -706,12 +724,12 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     var out = [];
     return elements.reduce(function (p, e) {
       return p.then(function () {
-        return Promise.resolve().then(function () { return VERIFIERS[e.fmt](e.att, clientDataHash, opts); })
+        return _promiseResolve(_Promise, undefined).then(function () { return VERIFIERS[e.fmt](e.att, clientDataHash, opts); })
           .then(function (r) { guard.list.append(out, r); }, function (err) {
             throw _err("webauthn/compound-element-failed", "compound element " + e.index + " (format '" + e.fmt + "') did not verify", err);
           });
       });
-    }, Promise.resolve()).then(function () {
+    }, _promiseResolve(_Promise, undefined)).then(function () {
       return guard.verdict.of(_result("compound", "Compound", [], att), { compound: out });
     });
   },
@@ -720,7 +738,7 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     if (att.attStmt.children.length !== 0) {
       throw _err("webauthn/bad-att-stmt", "the none attestation statement MUST be an empty map (WebAuthn 8.7)");
     }
-    return Promise.resolve(_result("none", "None", [], att));
+    return _promiseResolve(_Promise, _result("none", "None", [], att));
   },
 });
 
@@ -750,7 +768,7 @@ function _safetyNetChainTrusted(chain, roots, time) {
         } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
       }, _err, "webauthn/bad-input", label);
     });
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _promiseReject(_Promise, e); }
   return mds.chainToAnchor(chain, anchors, time === undefined ? new Date() : time,
     "android-safetynet x5c certificate chain", "webauthn/safetynet-cert-untrusted");
 }
@@ -758,7 +776,7 @@ function _safetyNetChainTrusted(chain, roots, time) {
 function _result(fmt, attestationType, chain, att) {
   return guard.verdict.of({
     valid: true, attestationVerified: true, fmt: fmt, attestationType: attestationType,
-    trustPath: (chain || []).slice().reverse(),
+    trustPath: _reverse(_arrSlice(chain || [])),
     aaguid: att.authData.aaguid,
     credentialId: att.authData.credentialId,
     credentialPublicKey: att.authData.credentialPublicKey,
@@ -911,7 +929,7 @@ function verify(attestationObject, clientDataHash, opts) {
     _FORMAT_SCOPED_BOOLEAN_OPTS.forEach(function (k) {
       if (opts[k] !== undefined && typeof opts[k] !== "boolean") throw _err("webauthn/bad-input", "opts." + k + " must be a boolean");
     });
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _promiseReject(_Promise, e); }
   var att;
   var attBytes, cdh, clientData = null;
   try {
@@ -939,20 +957,20 @@ function verify(attestationObject, clientDataHash, opts) {
       cdh = _bytesArg(clientDataHash, "clientDataHash");
       if (cdh.length !== 32) throw _err("webauthn/bad-input", "clientDataHash must be a 32-byte SHA-256 digest");
     }
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _promiseReject(_Promise, e); }
   attestationObject = attBytes;
   clientDataHash = cdh;
-  try { att = parseAttestationObject(attestationObject); } catch (e) { return Promise.reject(e); }
+  try { att = parseAttestationObject(attestationObject); } catch (e) { return _promiseReject(_Promise, e); }
   if (!att.authData.flags.at || !att.authData.credentialPublicKey) {
-    return Promise.reject(_err("webauthn/bad-auth-data", "attestation requires attestedCredentialData (the AT flag must be set)"));
+    return _promiseReject(_Promise, _err("webauthn/bad-auth-data", "attestation requires attestedCredentialData (the AT flag must be set)"));
   }
   var verifier = VERIFIERS[att.fmt];
-  if (!verifier) return Promise.reject(_err("webauthn/unsupported-format", "attestation statement format '" + att.fmt + "' is not supported"));
+  if (!verifier) return _promiseReject(_Promise, _err("webauthn/unsupported-format", "attestation statement format '" + att.fmt + "' is not supported"));
   if (opts.tpmPolicy !== undefined && !_formatCarries(att, "tpm")) {
-    return Promise.reject(_err("webauthn/tpm-policy", "opts.tpmPolicy requires a TPM attestation, but this attestation is format '" + att.fmt + "', which carries no TPM public area"));
+    return _promiseReject(_Promise, _err("webauthn/tpm-policy", "opts.tpmPolicy requires a TPM attestation, but this attestation is format '" + att.fmt + "', which carries no TPM public area"));
   }
   if (opts.requireCtsProfileMatch === true && !_formatCarries(att, "android-safetynet")) {
-    return Promise.reject(_err("webauthn/safetynet-cts-profile", "opts.requireCtsProfileMatch requires an android-safetynet attestation, but this attestation is format '" + att.fmt + "', whose statement carries no device-integrity signals"));
+    return _promiseReject(_Promise, _err("webauthn/safetynet-cts-profile", "opts.requireCtsProfileMatch requires an android-safetynet attestation, but this attestation is format '" + att.fmt + "', whose statement carries no device-integrity signals"));
   }
   var bindingChecked, vopts;
   try {
@@ -960,8 +978,8 @@ function verify(attestationObject, clientDataHash, opts) {
     vopts = guard.identifier.ownOptions(opts);
     vopts.rootCertificates = _snapshotRoots(opts.rootCertificates);
     vopts.safetyNetRoots = _snapshotRoots(opts.safetyNetRoots);
-  } catch (e) { return Promise.reject(e); }
-  return Promise.resolve().then(function () { return verifier(att, clientDataHash, vopts); })
+  } catch (e) { return _promiseReject(_Promise, e); }
+  return _promiseResolve(_Promise, undefined).then(function () { return verifier(att, clientDataHash, vopts); })
     .then(function (res) {
       return guard.verdict.of(res, { clientData: clientData });
     })
@@ -977,10 +995,10 @@ function verify(attestationObject, clientDataHash, opts) {
         }
         return anchored;
       }
-      return Promise.resolve().then(function () { return _applyMetadata(res, att, vopts); })
+      return _promiseResolve(_Promise, undefined).then(function () { return _applyMetadata(res, att, vopts); })
         .then(function (out) { return guard.verdict.of(out, { anchoredTo: _anchoredRoutes(out, "metadata") }); }, function (e) {
           if (!e || e.code !== "webauthn/metadata-not-found" || vopts.rootCertificates === undefined) throw e;
-          return Promise.resolve(_applyCallerRoots(res, vopts.rootCertificates, vopts, e.missedPaths))
+          return _promiseResolve(_Promise, _applyCallerRoots(res, vopts.rootCertificates, vopts, e.missedPaths))
             .then(function (withRoots) {
               /** @internal The element coverage the metadata attempt measured is the whole
                * statement's, so it travels on the error rather than being recomputed from the
@@ -1060,10 +1078,10 @@ function _applyMetadata(res, att, opts) {
     return p.then(function () {
       var g = item.g, info = item.info;
       var pathAt = opts.time !== undefined ? opts.time : (info.at || at);
-      return mds.chainToAnchor(info.tp.slice().reverse(), g.anchors, pathAt,
+      return mds.chainToAnchor(_reverse(_arrSlice(info.tp)), g.anchors, pathAt,
         "attestation trust path for " + g.identifier + " (against the roots its metadata entry registers)");
     });
-  }, Promise.resolve())
+  }, _promiseResolve(_Promise, undefined))
     .then(function () {
       if (missed) throw missed;
       var primary = applied[0];
@@ -1504,8 +1522,8 @@ function _snapshotAssertion(input) {
 
 function verifyAssertion(input) {
   var frozen;
-  try { frozen = _snapshotAssertion(input); } catch (e) { return Promise.reject(e); }
-  return Promise.resolve().then(function () {
+  try { frozen = _snapshotAssertion(input); } catch (e) { return _promiseReject(_Promise, e); }
+  return _promiseResolve(_Promise, undefined).then(function () {
     input = frozen;
     var authData = parseAuthenticatorData(input.authenticatorData);
     input.signature = _bytesArg(input.signature, "signature");

package/lib/webcrypto.js

@@ -92,6 +92,12 @@ var _bigIntToString = intrinsic.bigIntToString;
 var _push = intrinsic.push;
 var _concat = intrinsic.concat;
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The promise constructor, captured at load. `promiseResolve` builds its promise from the
+ * RECEIVER, so reading the global binding at the call handed that construction over: measured, a
+ * replacement whose constructor filled the message buffer made `signOverTbs` sign rewritten bytes
+ * through the key-adoption path below, and the signature then verified against the rewritten message
+ * and failed against the caller's. */
+var _Promise = intrinsic.Promise;
 var _types = intrinsic.types;
 
 var WebCryptoError = frameworkError.defineClass("WebCryptoError", { withCause: true });
@@ -104,7 +110,7 @@ function _toBuf(data, who) {
 }
 
 function _toArrayBuffer(buf) {
-  return _arrayBufferSlice(buf.buffer, buf.byteOffset, buf.byteOffset + buf.byteLength);
+  return guard.bytes.toArrayBuffer(buf);
 }
 
 function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
@@ -352,12 +358,12 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW") {
     var bits = alg.length;
     if (bits !== 128 && bits !== 192 && bits !== 256) throw new WebCryptoError("webcrypto/syntax", name + ": length must be 128/192/256");
-    var secret = nodeCrypto.createSecretKey(nodeCrypto.randomBytes(bits / 8));
+    var secret = guard.crypto.secretKey(nodeCrypto.randomBytes(bits / 8));
     return new CryptoKey("secret", extractable, { name: name, length: bits }, usages, secret);
   }
   if (name === "HMAC") {
     var lenBits = _hmacLengthBits(alg, "generateKey HMAC");
-    var hkey = nodeCrypto.createSecretKey(nodeCrypto.randomBytes(lenBits / 8));
+    var hkey = guard.crypto.secretKey(nodeCrypto.randomBytes(lenBits / 8));
     return new CryptoKey("secret", extractable, { name: name, hash: { name: (typeof alg.hash === "string" ? alg.hash : alg.hash.name) }, length: lenBits }, usages, hkey);
   }
 
@@ -430,27 +436,25 @@ SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
   if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "sign");
   if (name === "RSASSA-PKCS1-V1_5") {
-    return _toArrayBuffer(nodeCrypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, key._handle));
+    return _toArrayBuffer(guard.crypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, key._handle));
   }
   if (name === "RSA-PSS") {
-    return _toArrayBuffer(nodeCrypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, {
-      key: key._handle, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: (typeof alg.saltLength === "number" ? alg.saltLength : nodeCrypto.constants.RSA_PSS_SALTLEN_DIGEST),
+    return _toArrayBuffer(guard.crypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, {
+      key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_PSS,
+      saltLength: (typeof alg.saltLength === "number" ? alg.saltLength : guard.crypto.saltLength.DIGEST),
     }));
   }
   if (name === "ECDSA") {
-    return _toArrayBuffer(nodeCrypto.sign(_hashNode(alg.hash, "sign"), buf, { key: key._handle, dsaEncoding: "ieee-p1363" }));
+    return _toArrayBuffer(guard.crypto.sign(_hashNode(alg.hash, "sign"), buf, { key: key._handle, dsaEncoding: "ieee-p1363" }));
   }
   if (ML_DSA_NODE[name]) {
-    return _toArrayBuffer(nodeCrypto.sign(null, buf, _mldsaKeyArg(alg, key._handle, "sign")));
+    return _toArrayBuffer(guard.crypto.sign(null, buf, _mldsaKeyArg(alg, key._handle, "sign")));
   }
   if (name === "ED25519" || name === "ED448" || SLH_DSA_NODE[name]) {
-    return _toArrayBuffer(nodeCrypto.sign(null, buf, key._handle));
+    return _toArrayBuffer(guard.crypto.sign(null, buf, key._handle));
   }
   if (name === "HMAC") {
-    var hm = nodeCrypto.createHmac(_hashNode(key.algorithm.hash, "sign"), key._handle);
-    hm.update(buf);
-    return _toArrayBuffer(hm.digest());
+    return _toArrayBuffer(guard.crypto.hmac(_hashNode(key.algorithm.hash, "sign"), key._handle, buf));
   }
   throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
 };
@@ -464,27 +468,25 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
   if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "verify");
   if (name === "RSASSA-PKCS1-V1_5") {
-    return nodeCrypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, key._handle, sig);
+    return guard.crypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, key._handle, sig);
   }
   if (name === "RSA-PSS") {
-    return nodeCrypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, {
-      key: key._handle, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: (typeof alg.saltLength === "number" ? alg.saltLength : nodeCrypto.constants.RSA_PSS_SALTLEN_DIGEST),
+    return guard.crypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, {
+      key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_PSS,
+      saltLength: (typeof alg.saltLength === "number" ? alg.saltLength : guard.crypto.saltLength.DIGEST),
     }, sig);
   }
   if (name === "ECDSA") {
-    return nodeCrypto.verify(_hashNode(alg.hash, "verify"), buf, { key: key._handle, dsaEncoding: "ieee-p1363" }, sig);
+    return guard.crypto.verify(_hashNode(alg.hash, "verify"), buf, { key: key._handle, dsaEncoding: "ieee-p1363" }, sig);
   }
   if (ML_DSA_NODE[name]) {
-    return nodeCrypto.verify(null, buf, _mldsaKeyArg(alg, key._handle, "verify"), sig);
+    return guard.crypto.verify(null, buf, _mldsaKeyArg(alg, key._handle, "verify"), sig);
   }
   if (name === "ED25519" || name === "ED448" || SLH_DSA_NODE[name]) {
-    return nodeCrypto.verify(null, buf, key._handle, sig);
+    return guard.crypto.verify(null, buf, key._handle, sig);
   }
   if (name === "HMAC") {
-    var hm = nodeCrypto.createHmac(_hashNode(key.algorithm.hash, "verify"), key._handle);
-    hm.update(buf);
-    var digest = hm.digest();
+    var digest = guard.crypto.hmac(_hashNode(key.algorithm.hash, "verify"), key._handle, buf);
     return guard.crypto.constantTimeEqual(digest, sig);
   }
   throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
@@ -504,7 +506,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
     return _toArrayBuffer(nodeCrypto.publicEncrypt({
-      key: key._handle, padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING,
+      key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "encrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "encrypt label") : undefined,
     }, buf));
@@ -552,7 +554,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
     var oaepOut = nodeCrypto.privateDecrypt({
-      key: key._handle, padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING,
+      key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : undefined,
     }, buf);
@@ -598,7 +600,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
 };
 
 function _withSecretBytes(key, fn) {
-  var kb = key._handle.export();
+  var kb = guard.crypto.exportKey(key._handle);
   var deferred = false;
   try {
     var out = fn(kb);
@@ -629,7 +631,7 @@ var _PBKDF2_MAX_CONCURRENT = _max(1, (_parseInt(process.env.UV_THREADPOOL_SIZE,
 var _pbkdf2InFlight = 0;
 var _pbkdf2Waiters = [];
 function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
-  return new Promise(function (resolve, reject) {
+  return new _Promise(function (resolve, reject) {
     function start() {
       _pbkdf2InFlight++;
       function done(err, derived) {
@@ -932,7 +934,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     if (SECRET_KEY_NAMES[name]) {
       var raw = _toBuf(keyData, "importKey raw");
       _assertAesImportLen(name, raw.length);
-      var secret = nodeCrypto.createSecretKey(raw);
+      var secret = guard.crypto.secretKey(raw);
       var symAlg = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey raw HMAC"), length: raw.length * 8 } : { name: name, length: raw.length * 8 };
       return new CryptoKey("secret", extractable, symAlg, usages, secret);
     }
@@ -942,13 +944,13 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
   if (format === "spki") {
     var spkiBuf = _toBuf(keyData, "importKey spki");
     _preValidateSpki(spkiBuf, name);
-    var pub = _nodeKey(function () { return nodeCrypto.createPublicKey({ key: spkiBuf, format: "der", type: "spki" }); }, "importKey spki");
+    var pub = _nodeKey(function () { return guard.crypto.publicKey({ key: spkiBuf, format: "der", type: "spki" }); }, "importKey spki");
     return new CryptoKey("public", true, _algFromImport(name, alg, pub), usages, pub);
   }
   if (format === "pkcs8") {
     var p8Buf = _toBuf(keyData, "importKey pkcs8");
     _preValidatePkcs8(p8Buf, name);
-    var priv = _nodeKey(function () { return nodeCrypto.createPrivateKey({ key: p8Buf, format: "der", type: "pkcs8" }); }, "importKey pkcs8");
+    var priv = _nodeKey(function () { return guard.crypto.privateKey({ key: p8Buf, format: "der", type: "pkcs8" }); }, "importKey pkcs8");
     return new CryptoKey("private", extractable, _algFromImport(name, alg, priv), usages, priv);
   }
   if (format === "jwk") {
@@ -959,13 +961,13 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     if (jwk.kty === "oct") {
       var kbuf = _b64urlToBuf(jwk.k, "JWK oct key material");
       _assertAesImportLen(name, kbuf.length);
-      var s2 = nodeCrypto.createSecretKey(kbuf);
+      var s2 = guard.crypto.secretKey(kbuf);
       var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey jwk HMAC"), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);
     }
     var isPrivate = _hasOwn(jwk, "d") ||
       (jwk.kty === "AKP" && _hasOwn(jwk, "priv"));
-    var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
+    var ko = _nodeKey(function () { return isPrivate ? guard.crypto.privateKey({ key: jwk, format: "jwk" }) : guard.crypto.publicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
   throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + _stringify(format));
@@ -974,14 +976,14 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
 function _importRawPublic(name, alg, raw, extractable, usages) {
   if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
     var jwk = { kty: "OKP", crv: (name === "ED25519" ? "Ed25519" : name === "ED448" ? "Ed448" : name === "X25519" ? "X25519" : "X448"), x: _bufToB64url(raw) };
-    var ko = nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+    var ko = guard.crypto.publicKey({ key: jwk, format: "jwk" });
     return new CryptoKey("public", true, { name: _stdName(name) }, usages, ko);
   }
   if (name === "ECDSA" || name === "ECDH") {
     var fb = CURVE_FIELD_BYTES[alg.namedCurve];
     if (!fb || raw[0] !== 0x04 || raw.length !== 1 + 2 * fb) throw new WebCryptoError("webcrypto/data", "importKey raw EC: expected an uncompressed point for " + alg.namedCurve);
     var ecjwk = { kty: "EC", crv: alg.namedCurve, x: _bufToB64url(_subarray(raw, 1, 1 + fb)), y: _bufToB64url(_subarray(raw, 1 + fb)) };
-    var eck = nodeCrypto.createPublicKey({ key: ecjwk, format: "jwk" });
+    var eck = guard.crypto.publicKey({ key: ecjwk, format: "jwk" });
     return new CryptoKey("public", true, { name: name, namedCurve: alg.namedCurve }, usages, eck);
   }
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
@@ -1028,7 +1030,7 @@ function _algFromImport(name, alg, keyObject) {
 
 function _curveFromKey(ko) {
   try {
-    var jwk = ko.export({ format: "jwk" });
+    var jwk = guard.crypto.exportKey(ko, { format: "jwk" });
     var curves = guard.identifier.optionNames(CURVE_NODE);
     for (var k = 0; k < curves.length; k++) { if (jwk.crv === curves[k]) return curves[k]; }
   }
@@ -1066,15 +1068,15 @@ function _curveFromKey(ko) {
 SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
   _requireOwnKey(key, "exportKey");
   if (!key.extractable) throw new WebCryptoError("webcrypto/invalid-access", "key is not extractable");
-  if (format === "jwk") return key._handle.export({ format: "jwk" });
+  if (format === "jwk") return guard.crypto.exportKey(key._handle, { format: "jwk" });
   if (key.type === "secret") {
     return _withSecretBytes(key, function (raw) {
       if (format === "raw") return _toArrayBuffer(raw);
       throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
     });
   }
-  if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
-  if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));
+  if (format === "spki") return _toArrayBuffer(guard.crypto.exportKey(key._handle, { format: "der", type: "spki" }));
+  if (format === "pkcs8") return _toArrayBuffer(guard.crypto.exportKey(key._handle, { format: "der", type: "pkcs8" }));
   if (format === "raw") {
     if (key.type !== "public") {
       throw new WebCryptoError("webcrypto/not-supported",
@@ -1087,7 +1089,7 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
 };
 
 function _rawPublic(key) {
-  var jwk = key._handle.export({ format: "jwk" });
+  var jwk = guard.crypto.exportKey(key._handle, { format: "jwk" });
   if (jwk.kty === "OKP") return _b64urlToBuf(jwk.x);
   if (jwk.kty === "EC") return _bufferConcat([_bufferFrom([0x04]), _b64urlToBuf(jwk.x), _b64urlToBuf(jwk.y)]);
   throw new WebCryptoError("webcrypto/not-supported", "exportKey raw: unsupported key type " + jwk.kty);
@@ -1163,7 +1165,7 @@ function exportAnyKey(key, E, code, want) {
   var asJwk = format === "jwk";
   function wrap(b) { return asJwk ? b : _bufferFrom(b); }
   if (key instanceof CryptoKey) {
-    return _resolve(Promise)
+    return _resolve(_Promise)
       .then(function () { return _crypto.subtle.exportKey(format, key); })
       .then(wrap);
   }
@@ -1172,14 +1174,14 @@ function exportAnyKey(key, E, code, want) {
   }
   var handle = key._handle;
   if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
-    return _resolve(Promise).then(function () {
-      if (asJwk) return handle.export({ format: "jwk" });
-      return format === "raw" ? handle.export() : handle.export({ format: "der", type: format });
+    return _resolve(_Promise).then(function () {
+      if (asJwk) return guard.crypto.exportKey(handle, { format: "jwk" });
+      return format === "raw" ? guard.crypto.exportKey(handle) : guard.crypto.exportKey(handle, { format: "der", type: format });
     }).then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different copy of this WebCrypto engine and its key material could not be read; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
   }
-  return _resolve(Promise)
+  return _resolve(_Promise)
     .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
     .then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
@@ -1188,14 +1190,14 @@ function exportAnyKey(key, E, code, want) {
 
 // @internal
 function adoptKey(key, importParams, usages, E, code) {
-  if (key instanceof CryptoKey) return _resolve(Promise, key);
+  if (key instanceof CryptoKey) return _resolve(_Promise, key);
   if (!_isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
   for (var i = 0; i < usages.length; i++) {
     if (_indexOf(key.usages, usages[i]) === -1) {
       throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + _join(key.usages, ",") + ")");
     }
   }
-  return _resolve(Promise)
+  return _resolve(_Promise)
     .then(function () { return exportAnyKey(key, E, code); })
     .then(function (der) {
       return _crypto.subtle.importKey(_EXPORT_FORMAT[key.type], der, importParams || key.algorithm, false, usages);