@blamejs/pki 0.8.60 → 0.8.61

package/lib/hpke.js

@@ -250,10 +250,10 @@ function _importPublic(kem, raw) {
       if (raw[0] !== 0x04) throw _err("hpke/bad-key", "EC public key must be an uncompressed 0x04 point (RFC 9180 sec. 7.1.4)");
       var half = (raw.length - 1) / 2;
       var jwk = { kty: "EC", crv: kem.curve, x: raw.subarray(1, 1 + half).toString("base64url"), y: raw.subarray(1 + half).toString("base64url") };
-      return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+      return guard.crypto.publicKey({ key: jwk, format: "jwk" });
     }
     var prefix = kem.kind === "mlkem" ? ML_KEM_SPKI[kem.name] : OKP_SPKI[kem.curve];
-    return nodeCrypto.createPublicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
+    return guard.crypto.publicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
   } catch (e) {
     if (e instanceof HpkeError) throw e;
     throw _err("hpke/bad-key", "invalid " + kem.name + " public key" +
@@ -261,15 +261,15 @@ function _importPublic(kem, raw) {
   }
 }
 function _exportPublic(kem, keyObject) {
-  var pub = keyObject.type === "public" ? keyObject : nodeCrypto.createPublicKey(keyObject);
+  var pub = keyObject.type === "public" ? keyObject : guard.crypto.publicKey(keyObject);
   if (kem.kind === "mlkem") {
-    var der = pub.export({ format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
+    var der = guard.crypto.exportKey(pub, { format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
     if (der.length !== prefix.length + kem.Npub || !_bufferEquals(_subarray(der, 0, prefix.length), prefix)) {
       throw _err("hpke/bad-key", "the KeyObject is not an " + kem.name + " key");
     }
     return _subarray(der, prefix.length);
   }
-  var jwk = pub.export({ format: "jwk" });
+  var jwk = guard.crypto.exportKey(pub, { format: "jwk" });
   if (jwk.crv !== kem.curve) throw _err("hpke/bad-key", "the KeyObject is not a " + kem.name + " key");
   if (kem.kind === "ec") return concat([Buffer.from([0x04]), _b64u(jwk.x), _b64u(jwk.y)]);
   return _b64u(jwk.x);
@@ -293,7 +293,7 @@ function _importPrivate(kem, rawSk) {
     der = _bufferConcat([_hex(kem.kind === "mlkem" ? ML_KEM_PKCS8[kem.name] : OKP_PKCS8[kem.curve]), rawSk]);
   }
   try {
-    return nodeCrypto.createPrivateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
+    return guard.crypto.privateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
   } catch (e) {
     throw _err("hpke/bad-key", "invalid " + kem.name + " private key", e);
   } finally {
@@ -301,7 +301,7 @@ function _importPrivate(kem, rawSk) {
   }
 }
 function _boundPublic(kem, privateKey, pkm) {
-  var derived = _exportPublic(kem, nodeCrypto.createPublicKey(privateKey));
+  var derived = _exportPublic(kem, guard.crypto.publicKey(privateKey));
   if (pkm === undefined) return derived;
   if (!_isBuffer(pkm) || !_bufferEquals(derived, pkm)) {
     throw _err("hpke/bad-key", "pkm is not the " + kem.name + " public key derived from skm");
@@ -310,7 +310,7 @@ function _boundPublic(kem, privateKey, pkm) {
 }
 function _dh(privateKey, publicKey) {
   try {
-    return nodeCrypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
+    return guard.crypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
   } catch (e) {
     throw _err("hpke/bad-key", "KEM Diffie-Hellman failed: invalid or low-order public key", e);
   }
@@ -319,8 +319,8 @@ function _dh(privateKey, publicKey) {
  *  drawn and expanded by generateKeyPair, and an ML-KEM encapsulation takes its randomness from the
  *  runtime rather than from an ephemeral key pair. */
 function _generate(kem) {
-  if (kem.kind === "ec") return nodeCrypto.generateKeyPairSync("ec", { namedCurve: kem.nodeCurve });
-  return nodeCrypto.generateKeyPairSync(kem.curve.toLowerCase());
+  if (kem.kind === "ec") return guard.crypto.generateKeyPair("ec", { namedCurve: kem.nodeCurve });
+  return guard.crypto.generateKeyPair(intrinsic.toLowerCase(kem.curve));
 }
 
 
@@ -385,8 +385,8 @@ function _hybridExpand(kem, seed) {
     var skT = _importPrivate(_groupRow(kem), _randomScalar(kem, _subarray(full, kem.pq.Nsk)));
     return {
       skPQ: skPQ, skT: skT,
-      ekPQ: _exportPublic(kem.pq, nodeCrypto.createPublicKey(skPQ)),
-      ekT: _exportPublic(_groupRow(kem), nodeCrypto.createPublicKey(skT)),
+      ekPQ: _exportPublic(kem.pq, guard.crypto.publicKey(skPQ)),
+      ekT: _exportPublic(_groupRow(kem), guard.crypto.publicKey(skT)),
     };
   } finally {
     guard.secret.zeroize(full, HpkeError, "hpke/bad-input", "the hybrid seed expansion");
@@ -491,7 +491,7 @@ function _refuseEph(kem, eph) {
 function _mlKemEncap(kem, pkR, eph) {
   _refuseEph(kem, eph);
   var r;
-  try { r = nodeCrypto.encapsulate(pkR); }
+  try { r = guard.crypto.encapsulate(pkR); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " encapsulation failed", e); }
   return { sharedSecret: r.sharedKey, enc: r.ciphertext };
 }
@@ -499,7 +499,7 @@ function _mlKemDecap(kem, enc, skR) {
   if (enc.length !== kem.Nenc) {
     throw _err("hpke/bad-key", kem.name + " encapsulated key must be " + kem.Nenc + " bytes (FIPS 203 sec. 7.3 ciphertext check)");
   }
-  try { return nodeCrypto.decapsulate(skR, enc); }
+  try { return guard.crypto.decapsulate(skR, enc); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " decapsulation failed", e); }
 }
 function _encap(kem, pkR, pkRm, eph) {
@@ -648,10 +648,10 @@ Context.prototype.seal = function (aad, pt) {
    *  which is what RFC 9180 sec. 5.2 uses. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var c = nodeCrypto.createCipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) c.setAAD(aadBytes);
+  var c = guard.crypto.cipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(c, aadBytes);
   var body = guard.secret.cipherFinish(c, _buf(pt), HpkeError, "hpke/bad-input", "a seal intermediate");
-  var ct = concat([body, c.getAuthTag()]);
+  var ct = concat([body, guard.crypto.cipherAuthTag(c)]);
   this._inc();
   return ct;
 };
@@ -665,9 +665,9 @@ Context.prototype.open = function (aad, ct) {
    *  so the AAD was dropped on this side too and the pair round-tripped with nothing bound. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var d = nodeCrypto.createDecipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) d.setAAD(aadBytes);
-  d.setAuthTag(ct.subarray(ct.length - aead.Nt));
+  var d = guard.crypto.decipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(d, aadBytes);
+  guard.crypto.decipherSetAuthTag(d, ct.subarray(ct.length - aead.Nt));
   var pt;
   try { pt = guard.secret.cipherFinish(d, ct.subarray(0, ct.length - aead.Nt), HpkeError, "hpke/bad-input", "the recovered plaintext"); }
   catch (e) { throw _err("hpke/open-failed", "AEAD authentication failed (RFC 9180 sec. 5.2)", e); }
@@ -814,7 +814,7 @@ function _recipPrivate(suite, sk) {
   }
   try {
     if (sk.type !== "private") throw _err("hpke/bad-key", "the private key must be a private KeyObject or { skm, pkm }, got a " + guard.text.showValue(sk.type) + " KeyObject");
-    var pkm = _exportPublic(kem, nodeCrypto.createPublicKey(sk));
+    var pkm = _exportPublic(kem, guard.crypto.publicKey(sk));
     return { key: sk, pkm: pkm };
   } catch (e) {
     if (e instanceof HpkeError) throw e;
@@ -1118,11 +1118,11 @@ function deriveKeyPair(kemId, ikm) {
      *  and the decapsulation key returned is that 64-byte value. */
     var dk = _labeledDerive("shake256", _kemSuiteId(_kemId(kem)), input, "DeriveKeyPair", _EMPTY, kem.Nsk);
     var mlSk = _importPrivate(kem, dk);
-    return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(mlSk)), privateKey: dk };
+    return { publicKey: _exportPublic(kem, guard.crypto.publicKey(mlSk)), privateKey: dk };
   }
   var raw = _deriveKeyPairDhkem(kem, input);
   var sk = _importPrivate(kem, raw);
-  return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(sk)), privateKey: raw };
+  return { publicKey: _exportPublic(kem, guard.crypto.publicKey(sk)), privateKey: raw };
 }
 
 /** @internal DeriveKeyPair for a DHKEM (RFC 9180 sec. 7.1.3). X25519 and X448 expand the extract output
@@ -1258,7 +1258,7 @@ function decap(kemId, enc, recipientPrivateKey) {
  *  Nsk rather than trusted. An ML-KEM or hybrid key never reaches here, its private half being a seed
  *  that generateKeyPair draws. */
 function _exportPrivateRaw(kem, privateKey) {
-  var raw = _b64u(privateKey.export({ format: "jwk" }).d);
+  var raw = _b64u(guard.crypto.exportKey(privateKey, { format: "jwk" }).d);
   if (!_isBuffer(raw) || raw.length !== kem.Nsk) {
     throw _err("hpke/bad-key", "the generated " + kem.name + " private key is not the " +
       kem.Nsk + "-byte scalar this verb returns");

package/lib/http-digest.js

@@ -6,6 +6,7 @@
 var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
 var guardIdentifier = require("./guard-identifier");
 var _hasOwn = intrinsic.hasOwn;
 /** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
@@ -46,14 +47,11 @@ var DEFAULT_CODES = intrinsic.assign(intrinsic.create(null), {
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
 });
 
-/** @internal The hash the credential is computed with, taken at load along with the methods of the
- * object it returns. Every Digest response value is this function's output, so a replacement chooses
- * what is sent in place of the password-derived proof. */
-var _createHash = crypto.createHash;
+/** @internal Every Digest response value is this function's output, so whatever computes it chooses
+ * what is sent in place of the password-derived proof. RFC 7616 sec. 3 computes over the octets of
+ * the latin1 encoding, which is why the input encoding is named rather than defaulted. */
 var _randomBytes = crypto.randomBytes;
-var _hashUpdate = intrinsic.uncurry(crypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(crypto.createHash("sha256").digest);
-function H(hash, s) { return _hashDigest(_hashUpdate(_createHash(hash), s, "latin1"), "hex"); }
+function H(hash, s) { return guard.crypto.digest(hash, s, { input: "latin1", output: "hex" }); }
 function KD(hash, secret, data) { return H(hash, secret + ":" + data); }
 function _qstr(v) {
   var s = intrinsic.String(v), out = "";

package/lib/key.js

@@ -183,11 +183,11 @@ async function encrypt(privateKey, password, opts) {
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = pbes2.prfNodeByName(prf, _err, "key");
   var iterations = pbes2.assertIterations(opts.iterations == null ? 600000 : opts.iterations, _err, "key");
-  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
-  var iv = nodeCrypto.randomBytes(16);
+  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : guard.crypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var pwK = pbes2.passwordBytesOwned(password, _err, "key");
   var dk;
-  try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
+  try { dk = guard.crypto.pbkdf2(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
   finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try {
     var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits, KeyError, "key/bad-input");
@@ -290,6 +290,10 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
 var _EXPORT_OPTS = _assign(_create(null), { format: 1, label: 1 });
+/** @internal The WebCrypto export format each key type calls for, named here so the ONE read of the
+ * key's type below settles the encoding as well as the PEM label. Passing the format explicitly is
+ * what keeps the engine from reading the type a second time. */
+var _EXPORT_WANT_BY_TYPE = _assign(_create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
 
 async function export_(key, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
@@ -297,9 +301,14 @@ async function export_(key, opts) {
     "pki.key.export has an unknown option. It serializes only. To protect a private key, call " +
     "pki.key.encrypt(key, password) first and export its result. The unknown option was: ");
   if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
+  /** @internal ONE read of the key's type, which both the PEM label and every encoding decision
+   *  below come from. On node's own CryptoKey it is a getter, so reading it per question let a
+   *  replacement answer "private" where the label was chosen and "public" where the bytes were, and
+   *  a public key came back inside a `PRIVATE KEY` block. */
+  var keyType = key.type;
   var defaultLabel;
-  if (key.type === "private") defaultLabel = "PRIVATE KEY";
-  else if (key.type === "public") defaultLabel = "PUBLIC KEY";
+  if (keyType === "private") defaultLabel = "PRIVATE KEY";
+  else if (keyType === "public") defaultLabel = "PUBLIC KEY";
   else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
   var fmt = opts.format || "der";
   if (fmt === "jwk") {
@@ -310,11 +319,11 @@ async function export_(key, opts) {
       throw _err("key/bad-input", "exporting the key as a JWK failed", e);
     }
   }
-  var der = await _exportAnyKey(key, _err, "key/bad-input");
+  var der = await _exportAnyKey(key, _err, "key/bad-input", _EXPORT_WANT_BY_TYPE[keyType]);
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
-  if (fmt === "pkcs1") return _toPkcs1(der, key);
-  if (fmt === "sec1") return _toSec1(der, key);
+  if (fmt === "pkcs1") return _toPkcs1(der, key, keyType);
+  if (fmt === "sec1") return _toSec1(der, key, keyType);
   throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem / pkcs1 / sec1 / jwk)");
 }
 
@@ -923,18 +932,19 @@ var _PAIR_RSA = _assign(_create(null), { rsa: 1, "rsa-pss": 1 });
 var _PAIR_PROBE = _bufferFrom("pki.js key pair correspondence", "utf8");
 
 function _sameKeyFamily(priv, pub) {
-  if (priv.asymmetricKeyType === pub.asymmetricKeyType) return true;
-  return !!(_PAIR_RSA[guard.text.keyOf(priv.asymmetricKeyType)] &&
-    _PAIR_RSA[guard.text.keyOf(pub.asymmetricKeyType)]);
+  var privType = guard.crypto.keyType(priv), pubType = guard.crypto.keyType(pub);
+  if (privType === pubType) return true;
+  return !!(_PAIR_RSA[guard.text.keyOf(privType)] && _PAIR_RSA[guard.text.keyOf(pubType)]);
 }
 
 /** @internal How to exercise a signing pair: the digest, and any padding the encoding requires. An
  * `id-RSASSA-PSS` key may pin the hash and salt length it is usable with, and the engine refuses any
  * other, so a pinned value from either half is what proves the pair. */
 function _pairSignOptions(priv, pub) {
-  var privPss = priv.asymmetricKeyType === "rsa-pss", pubPss = pub.asymmetricKeyType === "rsa-pss";
+  var privType = guard.crypto.keyType(priv);
+  var privPss = privType === "rsa-pss", pubPss = guard.crypto.keyType(pub) === "rsa-pss";
   if (!privPss && !pubPss) {
-    return { digest: _PAIR_DIGEST[guard.text.keyOf(priv.asymmetricKeyType)] || null, options: null };
+    return { digest: _PAIR_DIGEST[guard.text.keyOf(privType)] || null, options: null };
   }
   var privDetails = _pssRestrictionOf(priv, privPss);
   var pubDetails = _pssRestrictionOf(pub, pubPss);
@@ -969,7 +979,7 @@ var _PSS_PINS = ["hashAlgorithm", "mgf1HashAlgorithm", "saltLength"];
  * carried, and refuse a genuine pair. */
 function _pssRestrictionOf(key, isPss) {
   var out = _create(null);
-  var details = isPss ? key.asymmetricKeyDetails : null;
+  var details = isPss ? guard.crypto.keyDetails(key) : null;
   if (details == null) return out;
   for (var i = 0; i < _PSS_PINS.length; i++) {
     var name = _PSS_PINS[i];
@@ -1026,7 +1036,7 @@ async function correspondsTo(privateKey, spkiDer) {
   try { pub = guard.crypto.publicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
   if (!_sameKeyFamily(priv, pub)) return false;
-  var kind = guard.text.keyOf(priv.asymmetricKeyType);
+  var kind = guard.text.keyOf(guard.crypto.keyType(priv));
   /** @internal Every secret a probe makes, wiped once the verdict is decided, on every way out. */
   var secrets = [];
   try {
@@ -1041,17 +1051,17 @@ async function correspondsTo(privateKey, spkiDer) {
       return _keyEquals(guard.crypto.publicKey(priv), pub) === true;
     }
     if (_PAIR_KEM[kind]) {
-      var sealed = nodeCrypto.encapsulate(pub);
+      var sealed = guard.crypto.encapsulate(pub);
       guard.list.append(secrets, sealed.sharedKey);
-      var opened = nodeCrypto.decapsulate(priv, sealed.ciphertext);
+      var opened = guard.crypto.decapsulate(priv, sealed.ciphertext);
       guard.list.append(secrets, opened);
       return guard.crypto.constantTimeEqual(opened, sealed.sharedKey);
     }
     if (_PAIR_AGREE[kind]) {
-      var ephemeral = nodeCrypto.generateKeyPairSync(priv.asymmetricKeyType);
-      var ours = nodeCrypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
+      var ephemeral = guard.crypto.generateKeyPair(guard.crypto.keyType(priv));
+      var ours = guard.crypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
       guard.list.append(secrets, ours);
-      var theirs = nodeCrypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
+      var theirs = guard.crypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
       guard.list.append(secrets, theirs);
       if (!guard.crypto.constantTimeEqual(ours, theirs)) return false;
       /** @internal The agreement proves the SCALAR, not the encoding it was handed. RFC 7748 masks the
@@ -1194,13 +1204,13 @@ async function _importNamedFormat(input, opts) {
 /** @internal The inverse of the wrap: pull the inner key out of the PKCS#8 or SPKI the engine
  * wrote. The bytes come back as they went in, since the engine carries the inner structure
  * unchanged and this reads it rather than re-encoding it. */
-function _toPkcs1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toPkcs1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("rsaEncryption")) {
     throw _err("key/bad-input", "PKCS#1 is an RSA encoding (RFC 8017 App. A.1) and this key is " + _algName(key.algorithm));
   }
   var node = asn1.decode(der);
-  if (key.type === "public") {
+  if (keyType === "public") {
     var bits = asn1.read.bitString(node.children[1]);
     if (bits.unusedBits !== 0) throw _err("key/bad-input", "the exported public key does not hold whole octets");
     schemaPkcs1.parsePublic(bits.bytes);
@@ -1210,12 +1220,12 @@ function _toPkcs1(der, key) {
   schemaPkcs1.parse(inner);
   return inner;
 }
-function _toSec1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toSec1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("ecPublicKey")) {
     throw _err("key/bad-input", "SEC1 is an elliptic-curve private-key encoding (RFC 5915 sec. 3) and this key is " + _algName(key.algorithm));
   }
-  if (key.type !== "private") {
+  if (keyType !== "private") {
     throw _err("key/bad-input", "SEC1 encodes a private key; export the public half as SubjectPublicKeyInfo");
   }
   var node = asn1.decode(der);
@@ -1248,11 +1258,13 @@ function _toSec1(der, key) {
 }
 
 /** @internal The algorithm the wrapper names, read from whichever wrapper the key type produced:
- * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. */
-function _wrappedAlgorithmOid(der, key) {
+ * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. `keyType` is the one read the
+ * caller took, rather than a fresh one off the key, so every decision in an export comes from the
+ * same answer. */
+function _wrappedAlgorithmOid(der, keyType) {
   var node;
   try { node = asn1.decode(der); } catch (e) { throw _err("key/bad-input", "the exported key is not DER", e); }
-  var algSeq = key.type === "public" ? node.children[0] : node.children[1];
+  var algSeq = keyType === "public" ? node.children[0] : node.children[1];
   if (!algSeq || !algSeq.children || algSeq.children.length === 0) {
     throw _err("key/bad-input", "the exported key names no algorithm");
   }

package/lib/ocsp.js

@@ -23,7 +23,6 @@
  * @card Build, sign, and verify RFC 6960 OCSP requests + responses (a responder + a relying party).
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var _ocspIntrinsic = require("./guard-intrinsic");
@@ -245,7 +244,7 @@ function _buildRequest(query, opts) {
     _push(tbsChildren,b.sequence(requests));
     var reqExts = [];
     if (opts.nonce) {
-      var nonceBytes = opts.nonce === true ? nodeCrypto.randomBytes(32) : opts.nonce;
+      var nonceBytes = opts.nonce === true ? guard.crypto.randomBytes(32) : opts.nonce;
       _assertNonce(nonceBytes, REQUESTER_NONCE_FLOOR);
       _push(reqExts,_nonceExt(nonceBytes));
     }

package/lib/pbes2.js

@@ -3,7 +3,6 @@
 "use strict";
 // @internal
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
@@ -102,11 +101,11 @@ function parsePbkdf2Params(paramsDer, opts, E, prefix, strictPrf) {
 }
 
 function cbcEncrypt(key, iv, plaintext, keyBits, E, code) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(c, plaintext, E, code, "a content-encryption intermediate");
 }
 function cbcDecrypt(key, iv, ct, keyBits, E, code) {
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(d, ct, E, code, "the partially recovered plaintext");
 }
 
@@ -118,9 +117,9 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = prfNodeByName(prf, E, prefix);
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
-  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : nodeCrypto.randomBytes(16);
-  var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
-  var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
+  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : guard.crypto.randomBytes(16);
+  var iv = opts.iv != null ? opts.iv : guard.crypto.randomBytes(16);
+  var key = guard.crypto.pbkdf2(pwBytes, salt, iterations, keyBits / 8, prfNode);
   try {
     return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits, E, prefix + "/bad-input") };
   } finally {
@@ -152,7 +151,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
     budget.rounds -= pb.iterations;
     if (budget.rounds < 0) throw E(prefix + "/iteration-limit", "the aggregate PBKDF2 key-derivation work exceeds the budget (a hostile many-element input)");
   }
-  var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
+  var dk = guard.crypto.pbkdf2(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits, E, prefix + "/decrypt-failed"); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(dk, E, prefix + "/bad-input", "the password-derived decryption key"); }

package/lib/pkcs12-build.js

@@ -17,7 +17,6 @@
  * @card Build a password-integrity PKCS#12 store (RFC 7292 / RFC 9579) and verify its MAC.
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var rc2 = require("./rc2");
 var oid = require("./oid");
@@ -150,7 +149,7 @@ function _p12Kdf(hashName, id, pwBytes, salt, iterations, nBytes) {
     var A = Buffer.concat([D, I]);
     for (var r = 0; r < iterations; r++) {
       var prev = A;
-      A = nodeCrypto.createHash(hashName).update(A).digest();
+      A = guard.crypto.digest(hashName, A);
       guard.secret.zeroize(prev, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
     }
     A.copy(out, i * u);
@@ -351,7 +350,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   var password = macOpts.password != null ? macOpts.password : sharedPassword;
   var algorithm = macOpts.algorithm || "hmac";
   var hash = macOpts.hash || "sha256";
-  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : nodeCrypto.randomBytes(MAC_SALT_BYTES);
+  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : guard.crypto.randomBytes(MAC_SALT_BYTES);
   if (salt.length === 0) throw _err("pkcs12/bad-input", "the MAC salt must be non-empty (RFC 9579 sec. 4c)");
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
 
@@ -363,7 +362,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);
     if (macPw.owned) guard.secret.zeroize(macPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
     try {
-      var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
+      var digest = guard.crypto.hmac(node, macKey, authSafeDer);
       var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
       return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
     } finally {
@@ -688,7 +687,7 @@ async function _verifyMacOfStore(m, password, opts) {
     var vMacPw = _p12PasswordOwned(password);
     var macKey = _p12Kdf(node, 3, vMacPw.bytes, m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);
     if (vMacPw.owned) guard.secret.zeroize(vMacPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
-    try { computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest(); }
+    try { computed = guard.crypto.hmac(node, macKey, m.macedBytes); }
     finally { guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key"); }
   } else {
     var kdf = m.mac.pbmac1.kdf;
@@ -868,7 +867,7 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
   if (p12pw.owned) guard.secret.zeroize(p12pw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
   try {
     if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
-    var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
+    var d = guard.crypto.decipher(scheme.cipher, keyM, iv);
     return guard.secret.cipherFinish(d, ct, Pkcs12Error, "pkcs12/bad-input", "the recovered safe contents");
   } catch (_e) { throw _err("pkcs12/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(keyM, Pkcs12Error, "pkcs12/bad-input", "the password-derived decryption key"); }

package/lib/pki-build.js

@@ -418,7 +418,7 @@ var DP_KEYS = intrinsic.assign(intrinsic.create(null), { fullName: 1, reasons: 1
  * others, so the loop keeps the leading octet uniform over 1 to 127. */
 function randomSerial() {
   for (;;) {
-    var rnd = nodeCrypto.randomBytes(20);
+    var rnd = guard.crypto.randomBytes(20);
     rnd[0] &= 0x7f;
     if (rnd[0] !== 0) return BigInt("0x" + rnd.toString("hex"));
   }
@@ -1249,7 +1249,7 @@ function makeBuilder(ctx) {
 
   function spkiKeyId(spkiDer) {
     var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
-    return nodeCrypto.createHash("sha1").update(keyBytes).digest();
+    return guard.crypto.digest("sha1", keyBytes);
   }
   function skiKeyId(val, spkiDer) {
     if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
@@ -1517,7 +1517,7 @@ function samePublicKey(spkiA, spkiB) {
   /** @internal Two keys of different types are never the same key, and comparing them through
    *  the runtime's equality leaves a fault queued in the crypto library that surfaces on the
    *  next unrelated key import in the process, so the type decides that case first. */
-  if (ka.asymmetricKeyType !== kb.asymmetricKeyType) return false;
+  if (guard.crypto.keyType(ka) !== guard.crypto.keyType(kb)) return false;
   return _keyEquals(ka, kb) === true;
 }
 

package/lib/scep.js

@@ -77,7 +77,6 @@ var C = require("./constants");
 var httpTransport = require("./http-transport");
 var retryAfter = require("./http-retry-after");
 var _defaultSleep = require("./sleep").sleep;
-var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
 function _showValue(v) { return guard.text.showValue(v); }
@@ -103,7 +102,7 @@ var ENVELOPE_CIPHER = "aes-128-cbc";
 var EMPTY_CONTENT = Buffer.alloc(0);
 
 function _nonce(v, label) {
-  if (v == null) return nodeCrypto.randomBytes(16);
+  if (v == null) return guard.crypto.randomBytes(16);
   var buf = guard.bytes.snapshotSource(v, ScepError, "scep/bad-nonce", label);
   if (buf.length !== 16) throw _err("scep/bad-nonce", label + " must be exactly 16 bytes (RFC 8894 sec. 3.2.1.5), got " + buf.length);
   return buf;
@@ -903,7 +902,7 @@ function findIssuedCert(certs, wantSpki) {
 }
 function _normalizeFingerprint(fp, algName) {
   var algorithm = _foldLower(String(algName == null ? "sha256" : algName));
-  try { nodeCrypto.createHash(algorithm); }
+  try { guard.crypto.hash(algorithm); }
   catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + _showValue(algorithm) + " is not an available hash"); }
   var value;
   if (Buffer.isBuffer(fp)) value = Buffer.from(fp);
@@ -968,7 +967,7 @@ async function getCACert(baseUrl, opts) {
   if (fp != null) {
     var matched = null, j;
     for (j = 0; j < certs.length; j++) {
-      var got = nodeCrypto.createHash(fp.algorithm).update(certs[j]).digest();
+      var got = guard.crypto.digest(fp.algorithm, certs[j]);
       if (got.length === fp.value.length && got.equals(fp.value)) { matched = certs[j]; break; }
     }
     if (!matched) throw _err("scep/fingerprint-mismatch", "no GetCACert certificate matched the expected " + fp.algorithm + " fingerprint (RFC 8894 sec. 2.2)");
@@ -1030,7 +1029,7 @@ async function getNextCACert(baseUrl, opts) {
 }
 
 function _defaultTransactionId() {
-  return nodeCrypto.randomBytes(16).toString("hex");
+  return guard.crypto.randomBytes(16).toString("hex");
 }
 var POLL_COUNT_MAX = 1000;
 
@@ -1078,7 +1077,7 @@ async function _pollForIssuance(ctx) {
     if (waitedMs > ctx.maxTotalWait * C.TIME.seconds(1)) throw _pollExhausted("the total wait budget", ctx.transactionId, lastNonce);
     if (ctx.onRetryAfter) ctx.onRetryAfter(delaySec);
     await ctx.sleep(delaySec * C.TIME.seconds(1));
-    var sn = nodeCrypto.randomBytes(16);
+    var sn = guard.crypto.randomBytes(16);
     lastNonce = sn;
     var certPoll = await build({ messageType: "CertPoll", requestSubject: ctx.csrSubject, issuer: issuerName, recipient: ctx.caCert, signer: ctx.signer, transactionId: ctx.transactionId, senderNonce: sn });
     res = await _pkiRequest(ctx.httpMethod, ctx.postUrl, certPoll, ctx.clientOpts);
@@ -1125,7 +1124,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var maxTotalWait = guard.limits.cap(opts.maxTotalWait, "maxTotalWait", retryAfter.MAX_RETRY_AFTER_SECONDS, { E: _err, code: "scep/bad-input", min: 0, max: retryAfter.MAX_RETRY_AFTER_SECONDS });
   var sleep = typeof opts.sleep === "function" ? opts.sleep : _defaultSleep;
   var onRetryAfter = typeof opts.onRetryAfter === "function" ? opts.onRetryAfter : null;
-  var senderNonce = nodeCrypto.randomBytes(16);
+  var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var reqMsg = await build({ messageType: messageType, messageData: csrView, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce });
   var res = await _pkiRequest(httpMethod, postUrl, reqMsg, clientOpts);
@@ -1258,7 +1257,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var want = _resolveQueryTarget(opts);
   var clientOpts = { tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
   if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
-  var senderNonce = nodeCrypto.randomBytes(16);
+  var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var httpMethod = _pkiMethod(opts);
   var reqMsg = await build(Object.assign({ messageType: messageType, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce }, want.buildSpec));

package/lib/schema-tsp.js

@@ -528,8 +528,8 @@ function essDigest(name) {
   var xof = ESS_XOF_BYTES[name];
   /** @internal One read of the name answers both whether the digest can be computed and how to
    *  compute it, so the hash every candidate is put through is the one that read settled. */
-  return function () {
-    return xof ? nodeCrypto.createHash(name, { outputLength: xof }) : nodeCrypto.createHash(name);
+  return function (bytes) {
+    return xof ? guard.crypto.xof(name, bytes, xof) : guard.crypto.digest(name, bytes);
   };
 }
 
@@ -579,7 +579,7 @@ function _essNamedCertificate(token, attr) {
   for (var j = 0; j < certs.length; j++) {
     var element = certs[j];
     if (!element || element.tagClass !== "universal" || !Buffer.isBuffer(element.bytes)) continue;
-    var actual = digest().update(element.bytes).digest();
+    var actual = digest(element.bytes);
     if (actual.length === want.length && guard.bytes.compare(actual, want) === 0) return element.bytes;
   }
   return null;

package/lib/shbs.js

@@ -21,7 +21,6 @@
  * @card Verify HSS/LMS signatures (post-quantum, CNSA 2.0 firmware signing).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 /** @internal The append every list here is built with: `push` stores at the index and a store
@@ -82,11 +81,9 @@ function _lmotsSet(code) {
 }
 
 function _hash(family, n, parts) {
-  var h;
-  if (family === "shake256") h = nodeCrypto.createHash("shake256", { outputLength: n });
-  else h = nodeCrypto.createHash("sha256");
-  for (var i = 0; i < parts.length; i++) h.update(parts[i]);
-  var d = h.digest();
+  var d = family === "shake256"
+    ? guard.crypto.digestParts("shake256", parts, n)
+    : guard.crypto.digestParts("sha256", parts);
   return (family === "shake256" || n === 32) ? d : d.subarray(0, n);
 }
 

package/lib/sign-scheme.js

@@ -359,14 +359,14 @@ function _keyTypeAccepts(reported, wanted) {
 }
 
 function _assertKeyObjectMatchesScheme(key, scheme, E) {
-  var reported = key.asymmetricKeyType;
+  var reported = guard.crypto.keyType(key);
   var wanted = NODE_KEY_TYPE[scheme.imp.name] || _toLowerCase(_String(scheme.imp.name));
   if (!_keyTypeAccepts(reported, wanted)) {
     throw E("bad-input", "the signer KeyObject algorithm (" + reported +
       ") does not match the certificate's key algorithm (" + scheme.imp.name + ")");
   }
   if (scheme.imp.namedCurve) {
-    var details = key.asymmetricKeyDetails;
+    var details = guard.crypto.keyDetails(key);
     var curve = details && details.namedCurve;
     if (curve !== NODE_CURVE[scheme.imp.namedCurve]) {
       throw E("bad-input", "the signer KeyObject curve (" + curve +