@blamejs/pki 0.8.59 → 0.8.61

package/lib/composite-kem.js

@@ -23,7 +23,6 @@
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
-var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
@@ -115,11 +114,11 @@ function _mlkemDecaps(d, seed, mlkemCT) {
 function _ecPubFromPoint(d, point) {
   if (point.length < 1 || point[0] !== 0x04) throw _err("kem/bad-key", "the EC component point is not in uncompressed form");
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(d.trad.curve))]), _b.bitString(point, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 function _okpPubFromRaw(d, raw) {
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.bitString(raw, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 /** @internal The encoding is this helper's own allocation and holds the traditional private scalar, so
  * it is cleared here. A caller's own cleanup cannot reach a buffer it never sees, and both the
@@ -127,13 +126,13 @@ function _okpPubFromRaw(d, raw) {
 function _okpPrivFromRaw(d, raw) {
   var p8 = _b.sequence([_b.integer(0n), _b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.octetString(_b.octetString(raw))]);
   try {
-    return nodeCrypto.createPrivateKey({ key: p8, format: "der", type: "pkcs8" });
+    return guard.crypto.privateKey({ key: p8, format: "der", type: "pkcs8" });
   } finally {
     guard.secret.zeroize(p8, KemError, "kem/bad-input", "the " + d.trad.curve + " component key encoding");
   }
 }
 function _rawPubOf(keyObject) {
-  var spki = keyObject.export({ format: "der", type: "spki" });
+  var spki = guard.crypto.exportKey(keyObject, { format: "der", type: "spki" });
   return Buffer.from(asn1.read.bitString(asn1.decode(spki).children[1]).bytes);
 }
 
@@ -143,12 +142,12 @@ function _tradEncaps(d, tradPK) {
     var pub;
     try {
       asn1.decode(tradPK);
-      pub = nodeCrypto.createPublicKey({ key: tradPK, format: "der", type: "pkcs1" });
+      pub = guard.crypto.publicKey({ key: tradPK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component public key is not a valid RSAPublicKey", e)); }
-    if (pub.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
-    var ss = Buffer.from(nodeCrypto.randomBytes(RSA_SS));
+    if (guard.crypto.keyDetails(pub).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    var ss = Buffer.from(guard.crypto.randomBytes(RSA_SS));
     var ct;
-    try { ct = Buffer.from(nodeCrypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
+    try { ct = Buffer.from(guard.crypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
     catch (e) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/bad-key", "the RSA-OAEP component encryption failed", e));
@@ -158,8 +157,8 @@ function _tradEncaps(d, tradPK) {
   var dh, dhCt;
   try {
     var recip = trad.kind === "ec" ? _ecPubFromPoint(d, tradPK) : _okpPubFromRaw(d, tradPK);
-    var eph = trad.kind === "ec" ? nodeCrypto.generateKeyPairSync("ec", { namedCurve: trad.node }) : nodeCrypto.generateKeyPairSync(trad.curve.toLowerCase());
-    dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
+    var eph = trad.kind === "ec" ? guard.crypto.generateKeyPair("ec", { namedCurve: trad.node }) : guard.crypto.generateKeyPair(trad.curve.toLowerCase());
+    dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
     dhCt = _rawPubOf(eph.publicKey);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " public key is invalid", e)); }
   return _promiseResolve(_Promise, { ss: dh, ct: dhCt });
@@ -171,37 +170,38 @@ function _tradDecaps(d, tradSK, tradCT) {
     var priv;
     try {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e)); }
-    if (priv.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    if (guard.crypto.keyDetails(priv).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
     var ss;
-    try { ss = Buffer.from(nodeCrypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
+    try { ss = Buffer.from(guard.crypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
     catch (_e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed")); }
     if (ss.length !== RSA_SS) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed"));
     }
-    return _promiseResolve(_Promise, { ss: ss, tradPK: Buffer.from(nodeCrypto.createPublicKey(priv).export({ format: "der", type: "pkcs1" })) });
+    return _promiseResolve(_Promise, { ss: ss,
+      tradPK: Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "pkcs1" })) });
   }
   var priv2, eph;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv2 = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv2 = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv2 = _okpPrivFromRaw(d, tradSK);
     }
     eph = trad.kind === "ec" ? _ecPubFromPoint(d, tradCT) : _okpPubFromRaw(d, tradCT);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " key material is invalid", e)); }
   var dh;
-  try { dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
+  try { dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
   catch (e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the " + trad.curve + " Diffie-Hellman failed", e)); }
   /** @internal The same canonical point the derivation states, read from the one function that spells
    * it. The combiner hashes these bytes, so a stored spelling here and a generated one there would
    * reach different secrets from the two sides of one key. */
   var tradPK;
   try {
-    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(nodeCrypto.createPublicKey(priv2));
+    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(guard.crypto.publicKey(priv2));
   } catch (e) {
     /** @internal The agreement already produced a secret, and this rejection happens after it, so the
      * secret is wiped here: the caller's settle-or-wipe covers a value it was handed, and a rejected
@@ -371,9 +371,7 @@ function _ecPointOf(d, tradSK) {
   var scalar = _ecScalarOf(d, tradSK);
   var point;
   try {
-    var ecdh = nodeCrypto.createECDH(d.trad.node);
-    ecdh.setPrivateKey(scalar);
-    point = ecdh.getPublicKey(null, "uncompressed");
+    point = guard.crypto.ecPointFromScalar(d.trad.node, scalar);
   } catch (e) {
     if (e instanceof KemError) throw e;
     throw _err("kem/bad-key", "the EC component scalar does not generate a point on " + d.trad.node, e);
@@ -418,18 +416,18 @@ function _tradPubOf(d, tradSK) {
     var rp;
     try {
       asn1.decode(tradSK);
-      rp = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      rp = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { throw _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e); }
-    if (rp.asymmetricKeyDetails.modulusLength !== trad.bits) {
+    if (guard.crypto.keyDetails(rp).modulusLength !== trad.bits) {
       throw _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)");
     }
-    return Buffer.from(nodeCrypto.createPublicKey(rp).export({ format: "der", type: "pkcs1" }));
+    return Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(rp), { format: "der", type: "pkcs1" }));
   }
   var priv;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv = _okpPrivFromRaw(d, tradSK);
     }
@@ -439,7 +437,8 @@ function _tradPubOf(d, tradSK) {
    * public key nothing can use, so the two are held to each other here. Decapsulation reaches the same
    * conclusion by failing the agreement; a derivation performs no operation that would notice. */
   if (trad.kind === "ec") {
-    var named = priv.asymmetricKeyDetails && priv.asymmetricKeyDetails.namedCurve;
+    var privDetails = guard.crypto.keyDetails(priv);
+    var named = privDetails && privDetails.namedCurve;
     if (named !== trad.node) {
       throw _err("kem/bad-key", "the EC component is on " + guard.text.showValue(named) + ", and " + d.name + " names " + trad.node);
     }
@@ -450,7 +449,7 @@ function _tradPubOf(d, tradSK) {
      * point stored beside it cannot stand in for one it does not generate. */
     return _ecPointOf(d, tradSK);
   }
-  return _rawPubOf(nodeCrypto.createPublicKey(priv));
+  return _rawPubOf(guard.crypto.publicKey(priv));
 }
 
 /** @internal The composite `SubjectPublicKeyInfo` for a composite ML-KEM private key. The runtime key
@@ -488,8 +487,8 @@ async function _publicFromPrivate(privateKey) {
        * copy of the seed and is registered as one. */
       var seedPkcs8 = _mlkemSeedPkcs8(d, seed);
       guard.list.append(secrets, seedPkcs8);
-      var mlPriv = nodeCrypto.createPrivateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
-      ek = _rawPubOf(nodeCrypto.createPublicKey(mlPriv));
+      var mlPriv = guard.crypto.privateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
+      ek = _rawPubOf(guard.crypto.publicKey(mlPriv));
     } catch (e) {
       if (e instanceof KemError) throw e;
       throw _err("kem/bad-key", "the ML-KEM component private key is invalid", e);

package/lib/crl-sign.js

@@ -24,6 +24,9 @@ var x509Schema = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the bytes that get signed. */
+var _push = intrinsic.append;
 var _hasOwn = intrinsic.hasOwn, _bufferEquals = intrinsic.bufferEquals;
 var _arrSlice = intrinsic.arraySlice, _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal The RECEIVER for the captured `Promise.resolve`, captured too. `resolve` builds through
@@ -184,11 +187,11 @@ function _idpValue(idp) {
   if (idp.fullName != null) {
     var entries = Array.isArray(idp.fullName) ? pkiBuild.reqDenseArray(idp.fullName, "issuingDistributionPoint.fullName", _err, "crl/bad-idp") : [idp.fullName];
     if (!entries.length) throw _err("crl/bad-idp", "issuingDistributionPoint fullName must carry at least one GeneralName");
-    children.push(b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName)))));
+    _push(children,b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName)))));
   }
   var scopeTrue = 0;
-  if (idp.onlyContainsUserCerts === true) { children.push(b.contextPrimitive(1, Buffer.from([0xff]))); scopeTrue++; }
-  if (idp.onlyContainsCACerts === true) { children.push(b.contextPrimitive(2, Buffer.from([0xff]))); scopeTrue++; }
+  if (idp.onlyContainsUserCerts === true) { _push(children,b.contextPrimitive(1, Buffer.from([0xff]))); scopeTrue++; }
+  if (idp.onlyContainsCACerts === true) { _push(children,b.contextPrimitive(2, Buffer.from([0xff]))); scopeTrue++; }
   if (idp.indirectCRL === true) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);
   if (scopeTrue > 1) throw _err("crl/bad-idp", "at most one of onlyContainsUserCerts / onlyContainsCACerts may be TRUE (RFC 5280 sec. 5.2.5)");
   if (!children.length) throw _err("crl/bad-idp", "issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
@@ -232,7 +235,7 @@ function _buildCrlExtensions(spec, ctx) {
     var id = O(oidName);
     if (seen[id]) throw _err("crl/bad-input", "duplicate CRL extension " + oidName + " (RFC 5280 sec. 5.2 -- at most one instance)");
     seen[id] = true;
-    out.push(_ext(id, critical, valueDer));
+    _push(out,_ext(id, critical, valueDer));
   }
   var crlNumberVal = null;
   if (spec.crlNumber != null) { var cn = _boundedInteger(spec.crlNumber, "cRLNumber"); crlNumberVal = cn.value; push("cRLNumber", false, cn.tlv); }
@@ -264,7 +267,7 @@ function _buildCrlExtensions(spec, ctx) {
       }
       _assertExtensionValueDecodes(node, extnId, "extension");
       if (extnId === O("deltaCRLIndicator")) isDelta = true;
-      out.push(b.raw(der));
+      _push(out,b.raw(der));
     });
     if (isDelta) {
       if (seen[O("freshestCRL")]) throw _err("crl/bad-input", "freshestCRL MUST NOT appear in a delta CRL (RFC 5280 sec. 5.2.6)");
@@ -323,7 +326,7 @@ function _buildRevoked(entryList, isDelta) {
       var id = O(oidName);
       if (seen[id]) throw _err("crl/bad-input", "duplicate entry extension " + oidName + " in revoked entry [" + idx + "]");
       seen[id] = true;
-      entryExts.push(_ext(id, critical, valueDer));
+      _push(entryExts,_ext(id, critical, valueDer));
     }
     if (e.reason != null) {
       var codeNum = _resolveReason(e.reason, isDelta);
@@ -360,10 +363,10 @@ function _buildRevoked(entryList, isDelta) {
           }
         }
         _assertExtensionValueDecodes(xnode, extnId, "entry extension");
-        entryExts.push(b.raw(der));
+        _push(entryExts,b.raw(der));
       });
     }
-    if (entryExts.length) { anyExt = true; children.push(b.sequence(entryExts)); }
+    if (entryExts.length) { anyExt = true; _push(children,b.sequence(entryExts)); }
     return b.sequence(children);
   });
   return { entries: entries, anyExt: anyExt };
@@ -375,7 +378,11 @@ function _parseIssuerCert(cert) {
 }
 
 function _assertIssuerCanSignCrl(issuerCert) {
-  var kuExt = (issuerCert.extensions || []).filter(function (e) { return e.oid === O("keyUsage"); })[0];
+  /** @internal The selection returns the first matching row or null. `filter(...)[0]` indexes a
+   *  result that is EMPTY when the certificate carries no keyUsage, and index 0 of an empty array
+   *  answers from the array prototype, so a value installed there would be decoded as the issuer's
+   *  key usage and decide whether it may sign this CRL. */
+  var kuExt = guard.list.firstMatch(issuerCert.extensions || [], function (e) { return e.oid === O("keyUsage"); });
   if (!kuExt) return;
   var ku;
   try { ku = EXT_DECODERS[O("keyUsage")](kuExt.value); }
@@ -453,13 +460,13 @@ function _sign(spec, issuer, opts) {
    *  into the PreTBSCertList the alternative signature covers. */
   function tbsOver(extList, omitSignatureAlg) {
     var tbsChildren = [];
-    if (version === 2) tbsChildren.push(b.integer(1n));
-    if (omitSignatureAlg !== true) tbsChildren.push(scheme.sigAlgId);
-    tbsChildren.push(issuerDer);
-    tbsChildren.push(thisU);
-    if (nextU) tbsChildren.push(nextU);
-    if (revoked.entries.length) tbsChildren.push(b.sequence(revoked.entries));
-    if (extList.length) tbsChildren.push(b.explicit(0, b.sequence(extList)));
+    if (version === 2) _push(tbsChildren,b.integer(1n));
+    if (omitSignatureAlg !== true) _push(tbsChildren,scheme.sigAlgId);
+    _push(tbsChildren,issuerDer);
+    _push(tbsChildren,thisU);
+    if (nextU) _push(tbsChildren,nextU);
+    if (revoked.entries.length) _push(tbsChildren,b.sequence(revoked.entries));
+    if (extList.length) _push(tbsChildren,b.explicit(0, b.sequence(extList)));
     return b.sequence(tbsChildren);
   }
 
@@ -813,7 +820,7 @@ function isRevoked(crl, serialNumber, opts) {
 
 function _findExtOid(list, name) {
   var want = O(name);
-  return (list || []).filter(function (e) { return e.oid === want; })[0] || null;
+  return guard.list.firstMatch(list || [], function (e) { return e.oid === want; });
 }
 
 var _IDP_SCHEMA = pkix.issuingDistributionPoint("crl/scope-not-authoritative");

package/lib/crmf-sign.js

@@ -17,12 +17,6 @@
  * @card Build a CRMF CertReqMessages with a signature proof of possession.
  */
 
-var nodeCrypto = require("node:crypto");
-/** @internal Bound at module load, like every other capture here: the proof below decides what it
- * agrees and what it hashes, so a replacement swapped in afterwards must not be able to steer it. */
-var _diffieHellman = nodeCrypto.diffieHellman;
-var _createPublicKey = nodeCrypto.createPublicKey;
-var _createPrivateKey = nodeCrypto.createPrivateKey;
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -345,7 +339,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
       _assertAgreementExponent(pkcs3, "the authority certificate's key");
     }
   }
-  try { caPub = _createPublicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
+  try { caPub = guard.crypto.publicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
   catch (e) { throw _err("crmf/bad-popo", "the authority certificate does not carry a key this runtime can agree with", e); }
   /** @internal The snapshot of the caller's key is this function's own copy of private material, so it
    * is registered for the wipe below rather than left to the argument boundary, which clears what it
@@ -357,7 +351,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     /** @internal Inside the cleanup scope, because the import can throw AFTER the snapshot exists: a
      * catch that returned from out here would leave that copy of private material behind. */
     try {
-      if (pop.key && typeof pop.key === "object" && pop.key.asymmetricKeyType != null) {
+      if (guard.crypto.keyTypeOf(pop.key) != null) {
         eePriv = pop.key;
       } else if (pop.key && typeof pop.key === "object" && pop.key.type === "private" &&
                  typeof pop.key.export === "function") {
@@ -366,10 +360,10 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * applies here: supporting the encoding for a caller holding bytes and refusing the caller
          * holding the key those bytes import to would be the same key admitted one way. The export
          * is this function's own copy of private material and is cleared with the rest. */
-        keySnapshot = pop.key.export({ format: "der", type: "pkcs8" });
+        keySnapshot = guard.crypto.exportKey(pop.key, { format: "der", type: "pkcs8" });
         translated = _x942PrivToPkcs3(keySnapshot);
         eePriv = translated !== null
-          ? _createPrivateKey({ key: translated, format: "der", type: "pkcs8" })
+          ? guard.crypto.privateKey({ key: translated, format: "der", type: "pkcs8" })
           : pop.key;
       } else if (guard.bytes.isByteSource(pop.key)) {
         keySnapshot = guard.bytes.snapshotSource(pop.key, CrmfError, "crmf/bad-popo", "the requester's private key");
@@ -377,7 +371,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * copy of the private value, and an import that throws after it exists must not leave it
          * behind. The wipe below clears whatever was made, on every way out. */
         translated = _x942PrivToPkcs3(keySnapshot);
-        eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+        eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
       } else {
         /** @internal A PEM key reaches the same conversion: it is the same key in the same encoding
          * with an armor around it, so admitting one form and not the other would support X9.42 for a
@@ -386,9 +380,9 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
         if (pemDer !== null) {
           keySnapshot = pemDer;
           translated = _x942PrivToPkcs3(keySnapshot);
-          eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+          eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
         } else {
-          eePriv = _createPrivateKey(pop.key);
+          eePriv = guard.crypto.privateKey(pop.key);
         }
       }
     } catch (e) {
@@ -402,7 +396,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * something this request never asked to have certified. The encryptedKey arm holds its enclosed
      * key to the same rule. */
     var eeSpki;
-    try { eeSpki = _createPublicKey(eePriv).export({ format: "der", type: "spki" }); }
+    try { eeSpki = guard.crypto.exportKey(guard.crypto.publicKey(eePriv), { format: "der", type: "spki" }); }
     catch (e) { throw _err("crmf/bad-popo", "the public half of pop.key could not be derived to check it against the requested key", e); }
     /** @internal Compared as keys, not as bytes. A PKCS#3 DHParameter carries an optional
      * privateValueLength, so one finite-field key has more than one valid SubjectPublicKeyInfo and a
@@ -449,7 +443,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * with parameters g and p, agreeing `g^xy mod p`. An elliptic-curve or montgomery pair agrees a
      * secret through the same call and would be emitted under the same OID, which names an operation
      * the recipient would not be performing. */
-    if (eePriv.asymmetricKeyType !== "dh" || caPub.asymmetricKeyType !== "dh") {
+    if (guard.crypto.keyType(eePriv) !== "dh" || guard.crypto.keyType(caPub) !== "dh") {
       /** @internal A key this runtime imported but did not classify reports no asymmetricKeyType, which
        * is what an X9.42 dhpublicnumber SubjectPublicKeyInfo does here where the PKCS#3 dhKeyAgreement
        * form is classified. The agreement refuses such a key on its own, so naming the unrecognized
@@ -459,7 +453,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     }
     /** @internal The agreement's own Buffer, not a copy of it: wrapping it would leave the original
      * holding the secret with nothing to clear it. */
-    try { zz = _diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
+    try { zz = guard.crypto.diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
     catch (e) { throw _err("crmf/bad-popo", "the requester's key and the authority's key did not agree a secret; this proof needs a key on the authority's own parameters (RFC 4211 sec. 4.3)", e); }
     /** @internal K = SHA1(LeadingInfo | ZZ | TrailingInfo) (RFC 2875 sec. 3, step 3c), under the
      * digest the proof's own algorithm identifier names. */
@@ -762,7 +756,7 @@ function _x942ToPkcs3(spkiBytes, what) {
 /** @internal How a key reads in the refusal above. A key the runtime imported without classifying
  * carries no asymmetricKeyType, and reporting that as a type name says nothing an operator can act on. */
 function _keyTypeLabel(what, key) {
-  var type = key && key.asymmetricKeyType;
+  var type = guard.crypto.keyTypeOf(key);
   if (typeof type !== "string" || type === "") {
     return what + " carries an algorithm this runtime does not recognize as a key it can agree with";
   }

package/lib/csr-sign.js

@@ -26,6 +26,9 @@ var pkiBuild = require("./pki-build");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the bytes that get signed. */
+var _push = intrinsic.append;
 /** @internal The promise a self-check is awaited through, built from the constructor captured at load.
  *  `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands the
  *  construction to whatever that binding holds, and a constructor settling without awaiting its
@@ -224,7 +227,7 @@ function _sign(spec, key, opts) {
   function addAttr(attrType, valueTlv) {
     if (seenAttr[attrType]) throw _err("csr/bad-input", "duplicate " + (oid.name(attrType) || attrType) + " attribute");
     seenAttr[attrType] = true;
-    attrs.push(b.sequence([b.oid(attrType), b.set([valueTlv])]));
+    _push(attrs,b.sequence([b.oid(attrType), b.set([valueTlv])]));
   }
   if (spec.extensionRequest != null) addAttr(O("extensionRequest"), _buildRequestedExtensions(spec.extensionRequest, subjectSpki));
   if (spec.challengePassword != null) addAttr(O("challengePassword"), _challengePassword(spec.challengePassword));
@@ -259,7 +262,7 @@ function _sign(spec, key, opts) {
       if (!n.children[1].children || n.children[1].children.length === 0) throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] value SET must contain at least one value (RFC 2986 SET SIZE(1..MAX))");
       if (seenAttr[at]) throw _err("csr/bad-input", "duplicate " + (oid.name(at) || at) + " attribute");
       seenAttr[at] = true;
-      attrs.push(b.raw(der));
+      _push(attrs,b.raw(der));
     });
   }
 

package/lib/ct.js

@@ -39,7 +39,6 @@
  *   bounded TLS-struct decode, fail-closed.
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der.js");
 var constants = require("./constants.js");
 var frameworkError = require("./framework-error.js");
@@ -64,6 +63,7 @@ var _bufferCompare = intrinsic.compare;
 var _subarray = intrinsic.subarray;
 var _toLowerCase = intrinsic.toLowerCase;
 var _ctTrim = intrinsic.uncurry(String.prototype.trim);
+var _writeBigUInt64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
 var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
@@ -293,8 +293,11 @@ function parseSctList(extValue) {
     }
     sctCount.tick();
     var one = _parseSct(outer.subReader(sctLen, "ct/list-trailing-bytes"), sctLen);
-    if (one.unknown) { var u = { version: one.version, rawSct: one.rawSct }; unknownScts.push(u); all.push(u); }
-    else { scts.push(one); all.push(one); }
+    /** @internal The parsed timestamps are appended by defining their indexes: the lists a caller
+     *  reads its verdict from, and the `all` list a policy counts, are what a numeric setter on the
+     *  array prototype would otherwise take an entry out of. */
+    if (one.unknown) { var u = { version: one.version, rawSct: one.rawSct }; intrinsic.append(unknownScts, u); intrinsic.append(all, u); }
+    else { intrinsic.append(scts, one); intrinsic.append(all, one); }
   }
   return guard.verdict.of({ scts: scts, unknownScts: unknownScts, all: all });
 }
@@ -366,29 +369,36 @@ function reconstructSignedData(entry, sct) {
     throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
   }
   var tsVal = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp (RFC 6962 3.2)");
+  /** @internal EVERY component of this preimage is appended by defining its index, and the
+   *  concatenation is the captured one. These bytes are what a log's signature is verified over, so a
+   *  numeric setter inherited from the array prototype replacing any one of them, the version, the
+   *  signature type, the timestamp, the entry type, the certificate or the extensions, puts the
+   *  verification on bytes the log never signed. Converting only the timestamp left the rest open,
+   *  which is the whole class: the rule belongs to the function, not to the line it was found on. */
   var parts = [];
-  parts.push(_bufferFrom([sct.version & 0xff]));
-  parts.push(_bufferFrom([0]));
-  var ts = _bufferAlloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);
-  parts.push(_bufferFrom([(entryType >> 8) & 0xff, entryType & 0xff]));
+  intrinsic.append(parts, _bufferFrom([sct.version & 0xff]));
+  intrinsic.append(parts, _bufferFrom([0]));
+  var ts = _bufferAlloc(8); _writeBigUInt64BE(ts, tsVal); intrinsic.append(parts, ts);
+  intrinsic.append(parts, _bufferFrom([(entryType >> 8) & 0xff, entryType & 0xff]));
   if (entryType === 0) {
     var cert = _toBuffer(entry.leafCert, "leafCert", undefined, undefined, 0xffffff, "ct/bad-tbs-length");
-    parts.push(_u24Bytes(cert.length)); parts.push(cert);
+    intrinsic.append(parts, _u24Bytes(cert.length)); intrinsic.append(parts, cert);
   } else {
     var ikh = _toBuffer(entry.issuerKeyHash, "issuerKeyHash");
     if (ikh.length !== 32) {
       throw new CtError("ct/bad-issuer-key-hash", "issuer_key_hash must be exactly 32 bytes (SHA-256 of the issuer SPKI), got " + ikh.length + " (RFC 6962 sec. 3.2)");
     }
     var tbs = _toBuffer(entry.tbsCertificate, "tbsCertificate", undefined, undefined, 0xffffff, "ct/bad-tbs-length");
-    parts.push(ikh);
-    parts.push(_u24Bytes(tbs.length)); parts.push(tbs);
+    intrinsic.append(parts, ikh);
+    intrinsic.append(parts, _u24Bytes(tbs.length)); intrinsic.append(parts, tbs);
   }
   var ext = _toBuffer(sct.extensions, "sct.extensions", undefined, undefined, 0xffff, "ct/bad-extensions");
   if (ext.length > 0xffff) {
     throw new CtError("ct/bad-extensions", "CtExtensions must be 0..65535 bytes, got " + ext.length + " (RFC 6962 3.2)");
   }
-  parts.push(_bufferFrom([(ext.length >> 8) & 0xff, ext.length & 0xff])); parts.push(ext);
-  return Buffer.concat(parts);
+  intrinsic.append(parts, _bufferFrom([(ext.length >> 8) & 0xff, ext.length & 0xff]));
+  intrinsic.append(parts, ext);
+  return intrinsic.bufferConcat(parts);
 }
 
 var CT_HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256" });
@@ -584,7 +594,7 @@ function encodeSctList(scts) {
     var el = ew.build();
     total += el.length;
     if (total > 0xffff) throw new CtError("ct/too-large", "the SCT list body exceeds the 65535-byte maximum (RFC 6962 sec. 3.3)");
-    elements.push(el);
+    intrinsic.append(elements, el);
   }
   var lw = new TlsWriter();
   lw.vector(2, 1, 0xffff, Buffer.concat(elements, total), "ct/too-large");
@@ -594,11 +604,14 @@ function encodeSctList(scts) {
 function _logKeyMaterial(logKey) {
   try {
     var keyObj;
-    if (logKey && typeof logKey === "object" && logKey.asymmetricKeyType) keyObj = logKey;
-    else if (Buffer.isBuffer(logKey)) keyObj = nodeCrypto.createPrivateKey({ key: logKey, format: "der", type: "pkcs8" });
-    else keyObj = nodeCrypto.createPrivateKey(logKey);
-    if (keyObj.type !== "private") throw new CtError("ct/bad-input", "signSct requires the CT log PRIVATE key");
-    return { pkcs8: keyObj.export({ type: "pkcs8", format: "der" }), spki: nodeCrypto.createPublicKey(keyObj).export({ type: "spki", format: "der" }) };
+    if (guard.crypto.keyTypeOf(logKey)) keyObj = logKey;
+    else if (Buffer.isBuffer(logKey)) keyObj = guard.crypto.privateKey({ key: logKey, format: "der", type: "pkcs8" });
+    else keyObj = guard.crypto.privateKey(logKey);
+    if (guard.crypto.keyKind(keyObj) !== "private") throw new CtError("ct/bad-input", "signSct requires the CT log PRIVATE key");
+    return {
+      pkcs8: guard.crypto.exportKey(keyObj, { type: "pkcs8", format: "der" }),
+      spki: guard.crypto.exportKey(guard.crypto.publicKey(keyObj), { type: "spki", format: "der" }),
+    };
   } catch (e) {
     if (e instanceof CtError) throw e;
     throw new CtError("ct/bad-input", "the CT log private key could not be loaded", e);
@@ -714,7 +727,7 @@ function _parseLog(log, operatorName) {
   var statedId = guard.encoding.base64(log.log_id, 64, _ctErr, "ct/bad-log-list", "the CT log id");
   if (statedId.length !== 32) throw _ctErr("ct/bad-log-list", "a CT log_id must be 32 bytes (SHA-256), got " + statedId.length);
   _spkiAlg(spki);
-  var logId = nodeCrypto.createHash("sha256").update(spki).digest();
+  var logId = guard.crypto.digest("sha256", spki);
   if (!logId.equals(statedId)) throw _ctErr("ct/log-id-mismatch", "the CT log_id does not match SHA-256 of the log key (RFC 6962 sec. 3.2)");
   return guard.verdict.of({
     logId: logId, logIdHex: logId.toString("hex"), key: spki,
@@ -803,7 +816,7 @@ function parseLogList(json, opts) {
           continue;
         }
         byLogId[rec.logIdHex] = rec;
-        logs.push(rec);
+        intrinsic.append(logs, rec);
       }
     }
   }
@@ -1092,15 +1105,15 @@ function x509CertEntry(cert, issuer) {
   for (var j = 0; j < extsSeq.children.length; j++) {
     var ext = extsSeq.children[j];
     if (ext.children[0] && intrinsic.bufferEquals(ext.children[0].bytes, sctOid)) { removed++; continue; }
-    intrinsic.push(kept, ext.bytes);
+    intrinsic.append(kept, ext.bytes);
   }
   if (removed === 0) throw _ctErr("ct/no-sct-extension", "the certificate carries no signedCertificateTimestampList extension (RFC 6962 sec. 3.2)");
   var tbsChildren = [];
   for (var k = 0; k < tbs.children.length; k++) {
-    if (k !== wrapIdx) { intrinsic.push(tbsChildren, tbs.children[k].bytes); continue; }
-    if (kept.length > 0) intrinsic.push(tbsChildren, asn1.build.explicit(3, asn1.build.sequence(kept)));
+    if (k !== wrapIdx) { intrinsic.append(tbsChildren, tbs.children[k].bytes); continue; }
+    if (kept.length > 0) intrinsic.append(tbsChildren, asn1.build.explicit(3, asn1.build.sequence(kept)));
   }
-  var issuerKeyHash = nodeCrypto.createHash("sha256").update(issSpki).digest();
+  var issuerKeyHash = guard.crypto.digest("sha256", issSpki);
   return { entryType: 1, tbsCertificate: asn1.build.sequence(tbsChildren), issuerKeyHash: issuerKeyHash };
 }
 
@@ -2017,7 +2030,7 @@ async function _addChain(opts, message, entryType) {
       ? _bufferAlloc(0) : _b64Field(doc, "extensions", "ct/bad-sct", "sct"),
     signature: _b64Field(doc, "signature", "ct/bad-sct", "sct"),
   };
-  var pinnedId = nodeCrypto.createHash("sha256").update(pinnedKey).digest();
+  var pinnedId = guard.crypto.digest("sha256", pinnedKey);
   if (_bufferCompare(sct.logId, pinnedId) !== 0) {
     throw _ctErr("ct/sct-untrusted", "the SCT names log id " + _bufToString(sct.logId, "hex") +
       " where the pinned key's id is " + _bufToString(pinnedId, "hex") + " -- it is not this log's receipt");