@blamejs/pki 0.8.60 → 0.8.61

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.61 — 2026-10-07
+
+Take every cryptographic operation, and every question about which key a key is, through an operation captured when the toolkit loads, so a replacement installed afterwards cannot decide a secret, a tag, a key type or a verdict.
+
+### Added
+
+- The internal crypto guard gained the operations the library needed to stop reading `node:crypto` at call time: randomness, the password-based and extract-and-expand derivations, the RSA transforms, the elliptic-curve point derivation and conversion, the AEAD transform methods, the hash handle for a caller that cannot hold its whole input, and the four key-identity accessors. The digest primitive takes input and output encodings. None of this is on the public surface.
+
+### Changed
+
+- `pki.webcrypto.subtle.exportKey` and `pki.key.export` read a key's type at most twice per call, once to admit the key and once for every decision that follows. Nothing in the public surface changed shape, and no error code was added or removed.
+
+### Fixed
+
+- An imported key is bound to the algorithm the caller named it under. `pki.webcrypto.subtle.importKey` settles that by asking the key which algorithm family it belongs to, and that answer came from an accessor on a node prototype, read at the moment of the check. An accessor answering `rsa` for an Ed25519 key therefore made the import accept it as RSA-PSS, and every later operation ran under an algorithm the key does not belong to. The accessor is captured when the engine loads. The same read also decided a curve, a modulus length and whether a key pair corresponds, across `pki.key`, `pki.tuf`, `pki.tlog`, `pki.sigstore`, `pki.cmc`, `pki.crmf`, `pki.ct` and the signature-scheme check that matches a signer to a certificate.
+- A plain object carrying an `asymmetricKeyType` field is no longer accepted as a key. The sites that asked whether a caller had handed them a key object tested for that one field, which any object can carry, so a forged object passed the test and was then used as a key. The question is asked of the object's prototype now, and the answer settles both whether it is a key and which kind.
+- A shared secret is derived through the agreement the toolkit captured, not one replaced afterwards. `crypto.diffieHellman` returns the traditional half of a hybrid secret outright, so a replacement supplies that half: driving `pki.hpke.decap` with one returning a fixed buffer derived a secret from the value the replacement chose. The post-quantum half, through `encapsulate` and `decapsulate`, had the same shape, as did the key generation that decides the ephemeral key an encapsulation is made under. `pki.hpke`, `pki.kem`, `pki.key`, `pki.cms` and `pki.webcrypto` all take these through operations captured at load.
+- A content-encryption key, a MAC key, an IV, a nonce and a salt are drawn through the randomness the toolkit captured. Twenty-seven sites read it off the module handle when they needed it, so a replacement returning a value it already knows handed it every message those protect, and nothing downstream can tell a chosen key from a random one.
+- An AEAD message is authenticated against the tag it carries. The tag is set and read through methods on the cipher object, which were reached through that object: a replacement decides which tag a ciphertext is checked against, so the verdict stops being a function of the message. The additional authenticated data, the padding mode, and the bytes a transform produces are reached the same way and are now taken through operations captured at load. The streaming paths in `pki.webcrypto` already did this; the one-shot encrypt and decrypt did not.
+- A key-transport ciphertext is produced, and the secret inside one recovered, through the RSA transforms captured at load. A password-derived key-encryption key, an HKDF expansion, and the elliptic-curve point a scalar generates are the same shape: each returns a value rather than a claim about one, so a replacement returning a fixed value makes every password open the message or puts a point of its own choosing where a public key was expected.
+- `pki.key.export` emits a PEM label that agrees with the bytes in the block. It asked the key its type once to choose the label and again to choose the encoding, and on a `CryptoKey` from node's own WebCrypto that is an accessor, so an accessor answering differently across those reads picked the two separately and a public key came back inside a `PRIVATE KEY` block. The type is read once and every decision in an export comes from that one answer.
+- A digest is computed through the hash operation the toolkit captured, across every path that takes one: the certificate and CRL digests, the CMS message digests and countersignature imprints, the transparency-log identifiers, the PKCS#12 key derivation, the hash-based signature trees, the WebAuthn attestation comparisons and the HTTP Digest credential. `pki.scep`'s check that a named digest is available goes through the same operation, so the name it accepts is the name it would use.
+- The RFC 7616 HTTP Digest credential is computed over the octets of the latin1 encoding the specification names, through one operation rather than a copy of the hash construction kept in the module. Three modules held their own copy of what the digest primitive already does; all three route through it now, and the input and output encodings are named at the call rather than defaulted.
+
 ## v0.8.60 — 2026-10-07
 
 Build every list a parse or an encode reads from by defining its indexes, so an accessor inherited from the array prototype cannot take an element as it is added.

package/lib/cmc-build.js

@@ -470,8 +470,8 @@ function identityProofV2(secret, reqSequenceBytes, identity) {
         _ownSecret(Buffer.from(identity, "utf8"), owned),
       ]), owned);
     }
-    key = nodeCrypto.createHash("sha256").update(material).digest();
-    var witness = nodeCrypto.createHmac("sha256", key).update(reqSequenceBytes).digest();
+    key = guard.crypto.digest("sha256", material);
+    var witness = guard.crypto.hmac("sha256", key, reqSequenceBytes);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
     if (key) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the Identity Proof MAC key");
@@ -541,7 +541,7 @@ function _provesRequestKey(opening, outgoing) {
     /** @internal Keys of different types are never the same key, and comparing them through the
      * runtime's equality leaves a fault queued in the crypto library that surfaces on the next
      * unrelated key import in the process, so the type decides that case first. */
-    if (requested.asymmetricKeyType !== opening.key.asymmetricKeyType) return false;
+    if (guard.crypto.keyType(requested) !== guard.crypto.keyType(opening.key)) return false;
     return intrinsic.keyEquals(requested, opening.key);
   }
   /** @internal A key the runtime engine cannot read has no KeyObject to compare, and a composite
@@ -607,7 +607,7 @@ async function _recoverProofValue(decoded, recipient, witnessHash) {
       continue;   // allow:swallow-unverified this recipient is not addressed to the supplied key; the witness decides
     }
     var candidate = opened.content;
-    var computed = nodeCrypto.createHash(witnessHash).update(candidate).digest();
+    var computed = guard.crypto.digest(witnessHash, candidate);
     var matches = computed.length === decoded.witness.length &&
       guard.crypto.constantTimeEqual(computed, decoded.witness);
     guard.secret.zeroize(computed, CmcError, "cmc/bad-input", "the computed witness");
@@ -674,7 +674,7 @@ async function answerPopChallenge(popChallenge, ids) {
      * in the challenge at all: neither side re-encodes it. */
     macKey = _bufferFrom(proofValue.length > POP_MAC_KEY_MAX_BYTES
       ? _subarray(proofValue, 0, POP_MAC_KEY_MAX_BYTES) : proofValue);
-    var thePOP = nodeCrypto.createHmac(macHash, macKey).update(decoded.requestBytes).digest();
+    var thePOP = guard.crypto.hmac(macHash, macKey, decoded.requestBytes);
     return { algBytes: decoded.thePOPAlgID.bytes, thePOP: thePOP, ids: ids,
       recipientSpki: await _openingPublicKey(recipient, recovered.recipientType),
       challengedRequest: _requestIdentity(decoded.request) };
@@ -688,13 +688,18 @@ async function answerPopChallenge(popChallenge, ids) {
 
 function popLinkWitnessV2(secret, R) {
   _assertSecret(secret, "a POP Link Witness V2 control");
-  var key = nodeCrypto.createHash("sha256").update(secret, "utf8").digest();
+  /** @internal The secret's octets, held so the finally can wipe them. Handing the string and an
+   *  encoding to a digest instead leaves the copy inside the provider, where nothing clears it. */
+  var material = _bufferFrom(secret, "utf8");
+  var key = null;
   try {
+    key = guard.crypto.digest("sha256", material);
     /** @internal Inside the try, so a MAC that faults on its message still wipes the key above it. */
-    var witness = nodeCrypto.createHmac("sha256", key).update(R).digest();
+    var witness = guard.crypto.hmac("sha256", key, R);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
-    guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
+    guard.secret.zeroize(material, CmcError, "cmc/bad-input", "the POP Link secret");
+    if (key !== null) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
   }
 }
 
@@ -935,7 +940,7 @@ async function _build(spec, signer, opts) {
     if (typeof rBytes !== "number" || !Number.isInteger(rBytes) || rBytes < 1) {
       throw E("cmc/bad-input", "popLinkRandomBytes must be a positive integer");
     }
-    var R = nodeCrypto.randomBytes(rBytes);
+    var R = guard.crypto.randomBytes(rBytes);
     _push(controls,encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
     _push(controls,encodeControl(O("id-cmc-popLinkWitnessV2"),
       [popLinkWitnessV2(spec.popLink.secret, R)], ids));

package/lib/cms-decrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.decrypt block live in cms-verify.js, which re-exports this function.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -235,8 +234,8 @@ async function _ktriCek(ri, km) {
       return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
     }
     if (kea.oid === O("rsaEncryption")) {
-      var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
-      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
+      var keyObj = guard.crypto.privateKey({ key: k.der, format: "der", type: "pkcs8" });
+      try { return guard.crypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
       catch (_e) {
         return null;
       }
@@ -339,7 +338,7 @@ async function _pwriCek(ri, km, opts) {
   var iv = asn1.read.octetString(inner.children[1]);
   var pw = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var kek;
-  try { kek = nodeCrypto.pbkdf2Sync(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
+  try { kek = guard.crypto.pbkdf2(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
   finally { if (pw.owned) guard.secret.zeroize(pw.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try {
     return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -421,7 +420,7 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
   }
   if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
   var substitute = null;
-  if (cek == null || cek.length !== keyBits / 8) { substitute = nodeCrypto.randomBytes(keyBits / 8); cek = substitute; }
+  if (cek == null || cek.length !== keyBits / 8) { substitute = guard.crypto.randomBytes(keyBits / 8); cek = substitute; }
   try {
     if (ct === "authEnvelopedData") {
       var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
@@ -461,9 +460,9 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
 }
 function _gcmOpen(cek, nonce, ct, tag, aad, keyBits, icvLen) {
   if (!tag || tag.length !== icvLen) throw _fail();
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
-  d.setAuthTag(tag);
-  if (aad && aad.length) d.setAAD(aad);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
+  guard.crypto.decipherSetAuthTag(d, tag);
+  if (aad && aad.length) guard.crypto.transformSetAAD(d, aad);
   return guard.secret.cipherFinish(d, ct, CmsError, "cms/decrypt-failed", "the recovered content");
 }
 
@@ -543,7 +542,7 @@ async function _decryptPbes2(parsed, eci, km, opts) {
   if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported PBES2 content cipher " + encOid);
   var pwE = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var key;
-  try { key = nodeCrypto.pbkdf2Sync(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
+  try { key = guard.crypto.pbkdf2(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
   finally { if (pwE.owned) guard.secret.zeroize(pwE.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try { return _originFields({ content: opts.stream === true ? _cbcStream(key, iv, eci.encryptedContent, keyBits) : pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false }, null, null); }
   catch (_e) { throw _fail(); }
@@ -588,13 +587,13 @@ function _pwriUnwrap(kek, wrapped, iv, keyBits) {
   var n = wrapped.length;
   var lastDec = null, pass1 = null, body = null;
   try {
-    var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); ecb.setAutoPadding(false);
+    var ecb = guard.crypto.decipher("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); guard.crypto.transformNoPadding(ecb);
     lastDec = guard.secret.cipherFinish(ecb, wrapped.subarray(n - blk), CmsError, "cms/decrypt-failed", "the recovered CBC last block");
     var iv2 = Buffer.alloc(blk);
     for (var i = 0; i < blk; i++) iv2[i] = lastDec[i] ^ wrapped[n - 2 * blk + i];
-    var d1 = nodeCrypto.createDecipheriv(alg, kek, iv2); d1.setAutoPadding(false);
+    var d1 = guard.crypto.decipher(alg, kek, iv2); guard.crypto.transformNoPadding(d1);
     pass1 = guard.secret.cipherFinish(d1, wrapped, CmsError, "cms/decrypt-failed", "the PWRI first-pass plaintext");
-    var d2 = nodeCrypto.createDecipheriv(alg, kek, iv); d2.setAutoPadding(false);
+    var d2 = guard.crypto.decipher(alg, kek, iv); guard.crypto.transformNoPadding(d2);
     body = guard.secret.cipherFinish(d2, pass1, CmsError, "cms/decrypt-failed", "the PWRI plaintext block");
     var count = body[0];
     if (count < 1 || count + 4 > body.length) throw _fail();
@@ -670,8 +669,9 @@ function _ecCurveFromCert(cert) {
 function _ecCurveFromPrivateKey(keyDer) {
   var spki;
   try {
-    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
-      .export({ format: "der", type: "spki" });
+    spki = guard.crypto.exportKey(
+      guard.crypto.publicKey({ key: keyDer, format: "der", type: "pkcs8" }),
+      { format: "der", type: "spki" });
   } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
   var alg = asn1.decode(spki).children[0];
   if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
@@ -756,7 +756,7 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
       _assertSupported(candidates[ci].ri, km);
       var macKey = await _acquireCek(candidates[ci].ri, km, opts);
       var macSubstitute = null;
-      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
+      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = guard.crypto.randomBytes(MAC_KEY_MIN_OCTETS);
       try {
         var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash: hash }, false, ["verify"]);
         if (!(await _subtleVerify(subtle, { name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();

package/lib/cms-digest.js

@@ -26,7 +26,6 @@
  *   attached or detached, constant-time comparison, fail-closed.
  */
 
-var nodeCrypto = require("node:crypto");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
 var frameworkError = require("./framework-error");
@@ -101,7 +100,7 @@ async function _digest(content, opts) {
   var ctOid = O(ctName);
   if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
 
-  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var value = guard.crypto.digest(NODE_DIGEST[alg], raw);
   var eciChildren = opts.detached === true
     ? [b.oid(ctOid)]
     : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
@@ -176,7 +175,7 @@ async function _verifyDigest(input, opts) {
   var covered = embedded != null
     ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
     : supplied;
-  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var recomputed = guard.crypto.digest(NODE_DIGEST[alg], covered);
   var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
   return guard.verdict.of({
     valid: matched,

package/lib/cms-encrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.encrypt block live in cms-verify.js, which re-exports this function (the
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var oid = require("./oid");
@@ -203,7 +202,7 @@ async function _buildKekri(cek, desc) {
 
 async function _buildPwri(cek, desc) {
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
   _prfHash(prf);
   var innerKeyBytes = 32;
@@ -213,7 +212,7 @@ async function _buildPwri(cek, desc) {
   var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt: salt, iterations: iterations }, kekKey, innerKeyBytes * 8));
   if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
-    var iv = nodeCrypto.randomBytes(16);
+    var iv = guard.crypto.randomBytes(16);
     var encryptedKey = _pwriWrapIv(kek, cek, iv);
     var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
     var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
@@ -288,17 +287,17 @@ function _pwriFormat(cek) {
   var blk = 16;
   var padLen = body.length % blk === 0 ? 0 : blk - (body.length % blk);
   if (body.length + padLen < 2 * blk) padLen += (2 * blk - (body.length + padLen));
-  var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  var wrapped = Buffer.concat([body, guard.crypto.randomBytes(padLen)]);
   guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
   return wrapped;
 }
 function _pwriWrapIv(kek, cek, iv) {
   var wk = _pwriFormat(cek);
   try {
-    var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
+    var c1 = guard.crypto.cipher("aes-256-cbc", kek, iv); guard.crypto.transformNoPadding(c1);
     var pass1 = guard.secret.cipherFinish(c1, wk, CmsError, "cms/bad-input", "the PWRI first-pass ciphertext");
     var iv2 = pass1.subarray(pass1.length - 16);
-    var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
+    var c2 = guard.crypto.cipher("aes-256-cbc", kek, iv2); guard.crypto.transformNoPadding(c2);
     return guard.secret.cipherFinish(c2, pass1, CmsError, "cms/bad-input", "the PWRI wrapped key");
   } finally {
     guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
@@ -444,7 +443,7 @@ async function _encryptImpl(content, recipients, opts) {
    *  them. */
   var contentBytes = contentStream ? null : guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var contentType = opts.contentType || "data";
-  var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
+  var cek = guard.crypto.randomBytes(ca.keyBits / 8);
 
   try {
     if (!Array.isArray(recipients)) return await _encryptedData(contentBytes, contentStream, recipients, ca, contentType, opts, cek);
@@ -477,7 +476,7 @@ async function _encStream(spec, stream) {
 }
 
 async function _envelopedData(contentBytes, contentStream, cek, ca, contentType, riNodes, recips) {
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var enc = contentStream
     ? (await _encStream({ algNode: "aes-" + ca.keyBits + "-cbc", key: cek, iv: iv }, contentStream)).ciphertext
     : pbes2.cbcEncrypt(cek, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
@@ -522,7 +521,7 @@ var AUTH_ENVELOPED_FORBIDDEN = intrinsic.assign(intrinsic.create(null), {
 });
 
 async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentType, opts, riNodes, recips) {
-  var nonce = nodeCrypto.randomBytes(12);
+  var nonce = guard.crypto.randomBytes(12);
   var authAttrsDer = null, aad = Buffer.alloc(0);
   if (contentType !== "data" && !(opts.authAttrs && opts.authAttrs.length)) {
     throw _err("cms/bad-input", "AuthEnvelopedData with a non-data contentType requires authAttrs (RFC 5083 sec. 2.1)");
@@ -561,7 +560,7 @@ async function _encryptedData(contentBytes, contentStream, desc, ca, contentType
         " EncryptedData descriptor; that field is not read for this arm";
     });
   }
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var contentAlgNode, encKey;
   if (desc && desc.cek != null) {
     encKey = guard.bytes.view(desc.cek, CmsError, "cms/bad-input", "cek");
@@ -584,9 +583,9 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
   var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
   var password = pwOwn2.bytes;
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
-  var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
+  var key = guard.crypto.pbkdf2(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
   if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
     var enc = contentStream
@@ -602,10 +601,10 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
 }
 
 function _gcmEncrypt(key, nonce, plaintext, aad, keyBits, tagLen) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
-  if (aad && aad.length) c.setAAD(aad);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
+  if (aad && aad.length) guard.crypto.transformSetAAD(c, aad);
   var ct = guard.secret.cipherFinish(c, plaintext, CmsError, "cms/bad-input", "a content-encryption intermediate");
-  return { ct: ct, tag: c.getAuthTag() };
+  return { ct: ct, tag: guard.crypto.cipherAuthTag(c) };
 }
 
 function _tlvHeaderLen(der) {
@@ -682,7 +681,7 @@ async function _authenticateImpl(content, recipients, opts) {
   var contentType = opts.contentType || "data";
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
 
-  var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
+  var macKey = guard.crypto.randomBytes(MAC_KEY_OCTETS);
   try {
     var recips = [];
     var consumedAuth = {};

package/lib/composite-kem.js

@@ -23,7 +23,6 @@
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
-var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
@@ -115,11 +114,11 @@ function _mlkemDecaps(d, seed, mlkemCT) {
 function _ecPubFromPoint(d, point) {
   if (point.length < 1 || point[0] !== 0x04) throw _err("kem/bad-key", "the EC component point is not in uncompressed form");
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(d.trad.curve))]), _b.bitString(point, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 function _okpPubFromRaw(d, raw) {
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.bitString(raw, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 /** @internal The encoding is this helper's own allocation and holds the traditional private scalar, so
  * it is cleared here. A caller's own cleanup cannot reach a buffer it never sees, and both the
@@ -127,13 +126,13 @@ function _okpPubFromRaw(d, raw) {
 function _okpPrivFromRaw(d, raw) {
   var p8 = _b.sequence([_b.integer(0n), _b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.octetString(_b.octetString(raw))]);
   try {
-    return nodeCrypto.createPrivateKey({ key: p8, format: "der", type: "pkcs8" });
+    return guard.crypto.privateKey({ key: p8, format: "der", type: "pkcs8" });
   } finally {
     guard.secret.zeroize(p8, KemError, "kem/bad-input", "the " + d.trad.curve + " component key encoding");
   }
 }
 function _rawPubOf(keyObject) {
-  var spki = keyObject.export({ format: "der", type: "spki" });
+  var spki = guard.crypto.exportKey(keyObject, { format: "der", type: "spki" });
   return Buffer.from(asn1.read.bitString(asn1.decode(spki).children[1]).bytes);
 }
 
@@ -143,12 +142,12 @@ function _tradEncaps(d, tradPK) {
     var pub;
     try {
       asn1.decode(tradPK);
-      pub = nodeCrypto.createPublicKey({ key: tradPK, format: "der", type: "pkcs1" });
+      pub = guard.crypto.publicKey({ key: tradPK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component public key is not a valid RSAPublicKey", e)); }
-    if (pub.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
-    var ss = Buffer.from(nodeCrypto.randomBytes(RSA_SS));
+    if (guard.crypto.keyDetails(pub).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    var ss = Buffer.from(guard.crypto.randomBytes(RSA_SS));
     var ct;
-    try { ct = Buffer.from(nodeCrypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
+    try { ct = Buffer.from(guard.crypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
     catch (e) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/bad-key", "the RSA-OAEP component encryption failed", e));
@@ -158,8 +157,8 @@ function _tradEncaps(d, tradPK) {
   var dh, dhCt;
   try {
     var recip = trad.kind === "ec" ? _ecPubFromPoint(d, tradPK) : _okpPubFromRaw(d, tradPK);
-    var eph = trad.kind === "ec" ? nodeCrypto.generateKeyPairSync("ec", { namedCurve: trad.node }) : nodeCrypto.generateKeyPairSync(trad.curve.toLowerCase());
-    dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
+    var eph = trad.kind === "ec" ? guard.crypto.generateKeyPair("ec", { namedCurve: trad.node }) : guard.crypto.generateKeyPair(trad.curve.toLowerCase());
+    dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
     dhCt = _rawPubOf(eph.publicKey);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " public key is invalid", e)); }
   return _promiseResolve(_Promise, { ss: dh, ct: dhCt });
@@ -171,37 +170,38 @@ function _tradDecaps(d, tradSK, tradCT) {
     var priv;
     try {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e)); }
-    if (priv.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    if (guard.crypto.keyDetails(priv).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
     var ss;
-    try { ss = Buffer.from(nodeCrypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
+    try { ss = Buffer.from(guard.crypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
     catch (_e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed")); }
     if (ss.length !== RSA_SS) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed"));
     }
-    return _promiseResolve(_Promise, { ss: ss, tradPK: Buffer.from(nodeCrypto.createPublicKey(priv).export({ format: "der", type: "pkcs1" })) });
+    return _promiseResolve(_Promise, { ss: ss,
+      tradPK: Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "pkcs1" })) });
   }
   var priv2, eph;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv2 = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv2 = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv2 = _okpPrivFromRaw(d, tradSK);
     }
     eph = trad.kind === "ec" ? _ecPubFromPoint(d, tradCT) : _okpPubFromRaw(d, tradCT);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " key material is invalid", e)); }
   var dh;
-  try { dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
+  try { dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
   catch (e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the " + trad.curve + " Diffie-Hellman failed", e)); }
   /** @internal The same canonical point the derivation states, read from the one function that spells
    * it. The combiner hashes these bytes, so a stored spelling here and a generated one there would
    * reach different secrets from the two sides of one key. */
   var tradPK;
   try {
-    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(nodeCrypto.createPublicKey(priv2));
+    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(guard.crypto.publicKey(priv2));
   } catch (e) {
     /** @internal The agreement already produced a secret, and this rejection happens after it, so the
      * secret is wiped here: the caller's settle-or-wipe covers a value it was handed, and a rejected
@@ -371,9 +371,7 @@ function _ecPointOf(d, tradSK) {
   var scalar = _ecScalarOf(d, tradSK);
   var point;
   try {
-    var ecdh = nodeCrypto.createECDH(d.trad.node);
-    ecdh.setPrivateKey(scalar);
-    point = ecdh.getPublicKey(null, "uncompressed");
+    point = guard.crypto.ecPointFromScalar(d.trad.node, scalar);
   } catch (e) {
     if (e instanceof KemError) throw e;
     throw _err("kem/bad-key", "the EC component scalar does not generate a point on " + d.trad.node, e);
@@ -418,18 +416,18 @@ function _tradPubOf(d, tradSK) {
     var rp;
     try {
       asn1.decode(tradSK);
-      rp = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      rp = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { throw _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e); }
-    if (rp.asymmetricKeyDetails.modulusLength !== trad.bits) {
+    if (guard.crypto.keyDetails(rp).modulusLength !== trad.bits) {
       throw _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)");
     }
-    return Buffer.from(nodeCrypto.createPublicKey(rp).export({ format: "der", type: "pkcs1" }));
+    return Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(rp), { format: "der", type: "pkcs1" }));
   }
   var priv;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv = _okpPrivFromRaw(d, tradSK);
     }
@@ -439,7 +437,8 @@ function _tradPubOf(d, tradSK) {
    * public key nothing can use, so the two are held to each other here. Decapsulation reaches the same
    * conclusion by failing the agreement; a derivation performs no operation that would notice. */
   if (trad.kind === "ec") {
-    var named = priv.asymmetricKeyDetails && priv.asymmetricKeyDetails.namedCurve;
+    var privDetails = guard.crypto.keyDetails(priv);
+    var named = privDetails && privDetails.namedCurve;
     if (named !== trad.node) {
       throw _err("kem/bad-key", "the EC component is on " + guard.text.showValue(named) + ", and " + d.name + " names " + trad.node);
     }
@@ -450,7 +449,7 @@ function _tradPubOf(d, tradSK) {
      * point stored beside it cannot stand in for one it does not generate. */
     return _ecPointOf(d, tradSK);
   }
-  return _rawPubOf(nodeCrypto.createPublicKey(priv));
+  return _rawPubOf(guard.crypto.publicKey(priv));
 }
 
 /** @internal The composite `SubjectPublicKeyInfo` for a composite ML-KEM private key. The runtime key
@@ -488,8 +487,8 @@ async function _publicFromPrivate(privateKey) {
        * copy of the seed and is registered as one. */
       var seedPkcs8 = _mlkemSeedPkcs8(d, seed);
       guard.list.append(secrets, seedPkcs8);
-      var mlPriv = nodeCrypto.createPrivateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
-      ek = _rawPubOf(nodeCrypto.createPublicKey(mlPriv));
+      var mlPriv = guard.crypto.privateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
+      ek = _rawPubOf(guard.crypto.publicKey(mlPriv));
     } catch (e) {
       if (e instanceof KemError) throw e;
       throw _err("kem/bad-key", "the ML-KEM component private key is invalid", e);

package/lib/crmf-sign.js

@@ -17,12 +17,6 @@
  * @card Build a CRMF CertReqMessages with a signature proof of possession.
  */
 
-var nodeCrypto = require("node:crypto");
-/** @internal Bound at module load, like every other capture here: the proof below decides what it
- * agrees and what it hashes, so a replacement swapped in afterwards must not be able to steer it. */
-var _diffieHellman = nodeCrypto.diffieHellman;
-var _createPublicKey = nodeCrypto.createPublicKey;
-var _createPrivateKey = nodeCrypto.createPrivateKey;
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -345,7 +339,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
       _assertAgreementExponent(pkcs3, "the authority certificate's key");
     }
   }
-  try { caPub = _createPublicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
+  try { caPub = guard.crypto.publicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
   catch (e) { throw _err("crmf/bad-popo", "the authority certificate does not carry a key this runtime can agree with", e); }
   /** @internal The snapshot of the caller's key is this function's own copy of private material, so it
    * is registered for the wipe below rather than left to the argument boundary, which clears what it
@@ -357,7 +351,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     /** @internal Inside the cleanup scope, because the import can throw AFTER the snapshot exists: a
      * catch that returned from out here would leave that copy of private material behind. */
     try {
-      if (pop.key && typeof pop.key === "object" && pop.key.asymmetricKeyType != null) {
+      if (guard.crypto.keyTypeOf(pop.key) != null) {
         eePriv = pop.key;
       } else if (pop.key && typeof pop.key === "object" && pop.key.type === "private" &&
                  typeof pop.key.export === "function") {
@@ -366,10 +360,10 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * applies here: supporting the encoding for a caller holding bytes and refusing the caller
          * holding the key those bytes import to would be the same key admitted one way. The export
          * is this function's own copy of private material and is cleared with the rest. */
-        keySnapshot = pop.key.export({ format: "der", type: "pkcs8" });
+        keySnapshot = guard.crypto.exportKey(pop.key, { format: "der", type: "pkcs8" });
         translated = _x942PrivToPkcs3(keySnapshot);
         eePriv = translated !== null
-          ? _createPrivateKey({ key: translated, format: "der", type: "pkcs8" })
+          ? guard.crypto.privateKey({ key: translated, format: "der", type: "pkcs8" })
           : pop.key;
       } else if (guard.bytes.isByteSource(pop.key)) {
         keySnapshot = guard.bytes.snapshotSource(pop.key, CrmfError, "crmf/bad-popo", "the requester's private key");
@@ -377,7 +371,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * copy of the private value, and an import that throws after it exists must not leave it
          * behind. The wipe below clears whatever was made, on every way out. */
         translated = _x942PrivToPkcs3(keySnapshot);
-        eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+        eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
       } else {
         /** @internal A PEM key reaches the same conversion: it is the same key in the same encoding
          * with an armor around it, so admitting one form and not the other would support X9.42 for a
@@ -386,9 +380,9 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
         if (pemDer !== null) {
           keySnapshot = pemDer;
           translated = _x942PrivToPkcs3(keySnapshot);
-          eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+          eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
         } else {
-          eePriv = _createPrivateKey(pop.key);
+          eePriv = guard.crypto.privateKey(pop.key);
         }
       }
     } catch (e) {
@@ -402,7 +396,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * something this request never asked to have certified. The encryptedKey arm holds its enclosed
      * key to the same rule. */
     var eeSpki;
-    try { eeSpki = _createPublicKey(eePriv).export({ format: "der", type: "spki" }); }
+    try { eeSpki = guard.crypto.exportKey(guard.crypto.publicKey(eePriv), { format: "der", type: "spki" }); }
     catch (e) { throw _err("crmf/bad-popo", "the public half of pop.key could not be derived to check it against the requested key", e); }
     /** @internal Compared as keys, not as bytes. A PKCS#3 DHParameter carries an optional
      * privateValueLength, so one finite-field key has more than one valid SubjectPublicKeyInfo and a
@@ -449,7 +443,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * with parameters g and p, agreeing `g^xy mod p`. An elliptic-curve or montgomery pair agrees a
      * secret through the same call and would be emitted under the same OID, which names an operation
      * the recipient would not be performing. */
-    if (eePriv.asymmetricKeyType !== "dh" || caPub.asymmetricKeyType !== "dh") {
+    if (guard.crypto.keyType(eePriv) !== "dh" || guard.crypto.keyType(caPub) !== "dh") {
       /** @internal A key this runtime imported but did not classify reports no asymmetricKeyType, which
        * is what an X9.42 dhpublicnumber SubjectPublicKeyInfo does here where the PKCS#3 dhKeyAgreement
        * form is classified. The agreement refuses such a key on its own, so naming the unrecognized
@@ -459,7 +453,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     }
     /** @internal The agreement's own Buffer, not a copy of it: wrapping it would leave the original
      * holding the secret with nothing to clear it. */
-    try { zz = _diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
+    try { zz = guard.crypto.diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
     catch (e) { throw _err("crmf/bad-popo", "the requester's key and the authority's key did not agree a secret; this proof needs a key on the authority's own parameters (RFC 4211 sec. 4.3)", e); }
     /** @internal K = SHA1(LeadingInfo | ZZ | TrailingInfo) (RFC 2875 sec. 3, step 3c), under the
      * digest the proof's own algorithm identifier names. */
@@ -762,7 +756,7 @@ function _x942ToPkcs3(spkiBytes, what) {
 /** @internal How a key reads in the refusal above. A key the runtime imported without classifying
  * carries no asymmetricKeyType, and reporting that as a type name says nothing an operator can act on. */
 function _keyTypeLabel(what, key) {
-  var type = key && key.asymmetricKeyType;
+  var type = guard.crypto.keyTypeOf(key);
   if (typeof type !== "string" || type === "") {
     return what + " carries an algorithm this runtime does not recognize as a key it can agree with";
   }