@blamejs/pki 0.8.5 → 0.8.6

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.6 — 2026-09-25
+
+A node:crypto KeyObject signs, without being asked to export its private half.
+
+### Added
+
+- A `node:crypto` `KeyObject` is accepted wherever a signing verb takes a private key, and signs through `node:crypto` rather than being exported to PKCS#8 first. RSA with PKCS#1 v1.5 and with PSS padding, ECDSA on P-256, P-384 and P-521, Ed25519, Ed448, ML-DSA and SLH-DSA all sign this way, and the bytes produced are the bytes WebCrypto would have produced: an ECDSA signature is taken in the fixed-width form of RFC 9053 sec. 2.1 and encoded by the toolkit, so the artifact is byte-identical to one signed by the equivalent `CryptoKey`.
+- A `KeyObject` is held to the key the artifact names exactly as a `CryptoKey` is. Its algorithm must match the certificate's key algorithm and, for an EC key, its curve must match the certificate's curve; a public or a secret key is refused by type; and the signature is verified against the declared key before the artifact is returned, so a `KeyObject` for a different key of the same algorithm is refused rather than producing something no relying party can validate.
+
+### Changed
+
+- `pki.x509.sign` and the other signing verbs no longer refuse a `node:crypto` `KeyObject` with the message naming it as not a `CryptoKey`. A caller matching on that message to detect the refusal will stop seeing it, because the key now signs.
+
 ## v0.8.5 — 2026-09-25
 
 A key this process cannot export can sign, and every verb that signs proves its signature first.

package/README.md

@@ -192,10 +192,18 @@ var ok  = await subtle.verify({ name: "ML-DSA-65" }, kp.publicKey, sig, data); /
 
 ### Sign with a key this process cannot export
 
-Every signing verb takes a signer object wherever it takes a private key, for a
-key held in a hardware security module, a cloud key management service, a PKCS#11
-token, a PIV slot or a Trusted Platform Module. The private half never reaches
-the toolkit.
+Every signing verb takes a `node:crypto` `KeyObject` wherever it takes a private
+key, and signs through `node:crypto`, so a key an OpenSSL engine or provider
+refuses to export still signs.
+
+```js
+var keyObject = crypto.createPrivateKey({ key: pem });
+var cert = await pki.x509.sign(spec, { key: keyObject, cert: caCert });
+```
+
+For a key that is not in this process at all, held in a hardware security module,
+a cloud key management service, a PKCS#11 token, a PIV slot or a Trusted Platform
+Module, every signing verb takes a signer object in the same place.
 
 ```js
 var signer = {

package/lib/sign-scheme.js

@@ -5,6 +5,7 @@
 
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+var nodeCrypto = require("crypto");
 var pkcs8 = require("./schema-pkcs8");
 var pkix = require("./schema-pkix");
 var frameworkError = require("./framework-error");
@@ -22,6 +23,7 @@ var _String = intrinsic.String;
 var _filter = intrinsic.filter;
 var _stringify = intrinsic.stringify;
 var _toUpperCase = intrinsic.toUpperCase;
+var _toLowerCase = intrinsic.toLowerCase;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
@@ -218,9 +220,10 @@ function _importKey(key, imp, E) {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
     owned = true;
-  } else if (intrinsic.types.isKeyObject(key)) {
-    throw E("bad-input", "the signing key is a node:crypto KeyObject, not a WebCrypto CryptoKey; pass a CryptoKey (e.g. from pki.key.generate) or export it to a PKCS#8 DER Buffer or PEM string");
-  } else throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
+  } else {
+    throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a node:crypto KeyObject, a PKCS#8 DER Buffer, " +
+      "a PKCS#8 PEM string, or a signer { algorithm, publicKey, sign }");
+  }
   var imported = subtle.importKey("pkcs8", der, imp, false, ["sign"]);
   if (!owned) return imported;
   return imported.then(function (k) {
@@ -324,7 +327,83 @@ function _signExternally(signer, scheme, signedBytes, E) {
   });
 }
 
+/** @internal What `node:crypto` calls the key an algorithm the toolkit signs with uses, keyed by
+ *  the WebCrypto name the scheme resolved to. The two vocabularies differ, and the map is the one
+ *  place that knows it, so a new algorithm adds a row rather than a branch. */
+var NODE_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
+  "RSASSA-PKCS1-v1_5": "rsa", "RSA-PSS": "rsa-pss", ECDSA: "ec", Ed25519: "ed25519", Ed448: "ed448",
+});
+/** @internal The curve a KeyObject reports, keyed by the WebCrypto curve a scheme names. */
+var NODE_CURVE = intrinsic.assign(intrinsic.create(null), {
+  "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1",
+});
+
+/** @internal An RSA key carries no padding in its type, so an RSA-PSS scheme signs with a plain
+ *  `rsa` key too; the padding is named on the signature, not on the key. */
+function _keyTypeAccepts(reported, wanted) {
+  if (reported === wanted) return true;
+  return wanted === "rsa-pss" && reported === "rsa";
+}
+
+function _assertKeyObjectMatchesScheme(key, scheme, E) {
+  var reported = key.asymmetricKeyType;
+  var wanted = NODE_KEY_TYPE[scheme.imp.name] || _toLowerCase(_String(scheme.imp.name));
+  if (!_keyTypeAccepts(reported, wanted)) {
+    throw E("bad-input", "the signer KeyObject algorithm (" + reported +
+      ") does not match the certificate's key algorithm (" + scheme.imp.name + ")");
+  }
+  if (scheme.imp.namedCurve) {
+    var details = key.asymmetricKeyDetails;
+    var curve = details && details.namedCurve;
+    if (curve !== NODE_CURVE[scheme.imp.namedCurve]) {
+      throw E("bad-input", "the signer KeyObject curve (" + curve +
+        ") does not match the certificate curve (" + scheme.imp.namedCurve + ")");
+    }
+  }
+}
+
+/** @internal The options `node:crypto` signs a scheme under, so the bytes it returns are the bytes
+ *  WebCrypto would have returned: an ECDSA signature in the fixed-width form of RFC 9053 sec. 2.1,
+ *  which the caller then encodes, and a PSS signature at the salt length the scheme fixed. */
+function _nodeSignOptions(key, scheme) {
+  var name = scheme.sign.name;
+  if (name === "ECDSA") return { key: key, dsaEncoding: "ieee-p1363" };
+  if (name === "RSA-PSS") {
+    return { key: key, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: scheme.sign.saltLength };
+  }
+  return key;
+}
+
+/** @internal A digest `node:crypto` applies before signing. An algorithm that hashes the message
+ *  itself (the Edwards curves, ML-DSA, SLH-DSA) takes none, and naming one there is an error. */
+function _nodeDigest(scheme) {
+  var name = scheme.sign.name;
+  if (name === "ECDSA" || name === "RSA-PSS" || name === "RSASSA-PKCS1-v1_5") return NODE_DIGEST[scheme.digest] || scheme.digest;
+  return null;
+}
+
+function _signWithKeyObject(key, scheme, signedBytes, E) {
+  if (scheme.composite) {
+    throw E("bad-input", "a composite " + scheme.composite.name + " signature is produced from both component private keys, " +
+      "which one KeyObject cannot hold; pass { mldsa, trad } PKCS#8 keys");
+  }
+  if (key.type !== "private") {
+    throw E("bad-input", "the signing key is a node:crypto KeyObject of type " + _stringify(key.type) +
+      "; a signing key must be a private key (type \"private\")");
+  }
+  _assertKeyObjectMatchesScheme(key, scheme, E);
+  try {
+    return _bufferFrom(nodeCrypto.sign(_nodeDigest(scheme), signedBytes, _nodeSignOptions(key, scheme)));
+  } catch (e) {
+    throw E("bad-input", "the signer KeyObject could not produce a " + scheme.imp.name + " signature", e);
+  }
+}
+
 function signOverTbs(scheme, key, signedBytes, E) {
+  if (intrinsic.types.isKeyObject(key)) {
+    var koSig = _signWithKeyObject(key, scheme, signedBytes, E);
+    return _resolve(Promise, scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(koSig, scheme.coordLen) : koSig);
+  }
   var signer = _snapshotSigner(key);
   if (signer) {
     return _signExternally(signer, scheme, signedBytes, E).then(function (sig) {

package/lib/x509-sign.js

@@ -366,13 +366,14 @@ function _hasCriticalSan(extSpec) {
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
  * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` (a `pki.key.generate`
- * private key passed directly, without exporting), a PKCS#8 private key as DER (`Buffer`) or PEM
- * (`string`), or a signer `{ algorithm, publicKey, sign }` for a key this process cannot export,
- * such as one in a hardware security module, a cloud key management service, a PKCS#11 token or a
- * PIV slot. `sign(bytes)` returns the bytes WebCrypto would return for that algorithm, which for
- * ECDSA is the fixed-width `r || s` of RFC 9053 sec. 2.1, and holds its client in its own closure,
- * since this verb snapshots its options. A public or secret CryptoKey,
- * or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * private key passed directly, without exporting), a `node:crypto` `KeyObject`, a PKCS#8 private
+ * key as DER (`Buffer`) or PEM (`string`), or a signer `{ algorithm, publicKey, sign }` for a key
+ * this process cannot export, such as one in a hardware security module, a cloud key management
+ * service, a PKCS#11 token or a PIV slot. A `KeyObject` signs through `node:crypto`, so a key that
+ * refuses to export its private half still signs. `sign(bytes)` returns the bytes WebCrypto would
+ * return for that algorithm, which for ECDSA is the fixed-width `r || s` of RFC 9053 sec. 2.1, and
+ * holds its client in its own closure, since this verb snapshots its options. A public or secret
+ * key is refused whichever form carries it. A `subjectAltName`
  * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
  * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:67dbc768-79f1-44d5-921c-53ce9accac3e",
+  "serialNumber": "urn:uuid:81aab9c8-7ee6-4344-8f73-8b672cade34f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T07:17:13.483Z",
+    "timestamp": "2026-09-20T07:41:52.928Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.5",
+      "bom-ref": "@blamejs/pki@0.8.6",
       "type": "application",
       "name": "pki",
-      "version": "0.8.5",
+      "version": "0.8.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.5",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.5",
+      "ref": "@blamejs/pki@0.8.6",
       "dependsOn": []
     }
   ]