@blamejs/pki 0.8.60 → 0.8.61

package/lib/sigstore.js

@@ -28,7 +28,6 @@
  * @card Verify an npm --provenance Sigstore bundle offline (DSSE + Fulcio + Rekor + SLSA).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -227,8 +226,8 @@ function _assertKeyDetailsParameters(want, leafSpki, declared) {
   if (want.bits !== undefined) {
     var bits;
     try {
-      bits = guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })
-        .asymmetricKeyDetails.modulusLength;
+      bits = guard.crypto.keyDetails(
+        guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })).modulusLength;
     } catch (_e) { bits = null; }   // allow:swallow-unverified -- a key that will not import has no modulus size to match, and the mismatch below is the verdict
     if (bits !== want.bits) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
@@ -709,13 +708,14 @@ function _chainDers(vm) {
 }
 
 function _rawVerify(keyObj, data, derSig) {
-  var t = keyObj.asymmetricKeyType;
+  var t = guard.crypto.keyType(keyObj);
   if (t === "ed25519" || t === "ed448") {
     var edSpki = guard.crypto.exportKey(keyObj, { type: "spki", format: "der" });
     edwardsPoint.validateSpki(edSpki, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
     return guard.crypto.verify(null, data, keyObj, derSig);
   }
-  var crv = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
+  var keyObjDetails = guard.crypto.keyDetails(keyObj);
+  var crv = keyObjDetails && keyObjDetails.namedCurve;
   var hash = crv === "secp384r1" ? "sha384" : (crv === "secp521r1" ? "sha512" : "sha256");
   return guard.crypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
@@ -723,7 +723,7 @@ function _pubFromSpki(spkiDer, label) {
   var key;
   try { key = guard.crypto.publicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
-  var t = key.asymmetricKeyType;
+  var t = guard.crypto.keyType(key);
   if (t === "ed25519" || t === "ed448") {
     edwardsPoint.validateSpki(spkiDer, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
   }
@@ -735,7 +735,7 @@ function _parseCert(der, label) {
 }
 
 
-function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).digest(); }
+function _sha256(buf) { return guard.crypto.digest("sha256", buf); }
 
 function _toMs(x) {
   if (x == null) return null;
@@ -1109,7 +1109,7 @@ function _bindHashedRekordV002Entry(body, arm, leafDer, contentType, payloadType
   }
   var digest = _b64(data.digest, "hashedRekordV002.data.digest");
   if (contentType === "dsseEnvelope") {
-    var computed = nodeCrypto.createHash(alg.node).update(pae(payloadType, payload)).digest();
+    var computed = guard.crypto.digest(alg.node, pae(payloadType, payload));
     if (!guard.crypto.constantTimeEqual(computed, digest)) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry digest is not the hash of this envelope's " +
         "signing preimage, so the entry records a different signature than the bundle carries");
@@ -1831,7 +1831,7 @@ async function verifyBundle(bundle, opts) {
   var artifactDigests = intrinsic.create(null);
   function _artifactDigest(nodeName) {
     if (!intrinsic.hasOwn(artifactDigests, nodeName)) {
-      artifactDigests[nodeName] = nodeCrypto.createHash(nodeName).update(artifact).digest();
+      artifactDigests[nodeName] = guard.crypto.digest(nodeName, artifact);
     }
     return artifactDigests[nodeName];
   }

package/lib/smime.js

@@ -48,7 +48,6 @@ var _push = guard.list.append;
 var pkiBuild = require("./pki-build.js");
 var C = require("./constants.js");
 var nodeUtil = require("util");
-var nodeCrypto = require("crypto");
 
 var SmimeError = frameworkError.SmimeError;
 
@@ -591,7 +590,7 @@ function _micalgOf(p7Der) {
   return out.length ? out.sort().join(",") : null;
 }
 
-function _boundary() { return "----=_pki_smime_" + nodeCrypto.randomBytes(18).toString("hex"); }
+function _boundary() { return "----=_pki_smime_" + guard.crypto.randomBytes(18).toString("hex"); }
 
 function _wrap64Crlf(s) {
   var out = "";

package/lib/tlog.js

@@ -299,12 +299,13 @@ function _resolveKey(keyName, publicKey) {
     throw _err("tlog/bad-input", "publicKey must be the raw " + ED25519_RAW_BYTES +
       " Ed25519 bytes or a SubjectPublicKeyInfo, got " + bytes.length + " bytes", e);
   }
-  var type = key.asymmetricKeyType;
+  var type = guard.crypto.keyType(key);
   if (type === "ed25519") {
     return _edKey(name, bytes, _subarray(bytes, bytes.length - ED25519_RAW_BYTES));
   }
   if (type === "ec") {
-    var curve = key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
+    var keyDetails = guard.crypto.keyDetails(key);
+    var curve = keyDetails && keyDetails.namedCurve;
     if (EC_CURVES[curve] !== 1) {
       throw _err("tlog/bad-input", "a signed note names no key-ID derivation for the elliptic curve " +
         guard.text.showValue(_stringOf(curve)));

package/lib/tuf.js

@@ -798,12 +798,13 @@ function _declarationOf(key) {
 function _checkedPublicKey(key, d) {
   if (d.nodeType === "ed25519") return null;
   var imported = _publicFromPem(key.keyval.public, "a " + key.keytype + " public key");
-  if (imported.asymmetricKeyType !== d.nodeType) {
+  var importedType = guard.crypto.keyType(imported);
+  if (importedType !== d.nodeType) {
     throw _err("tuf/bad-key", "the key declared as " + key.keytype + " holds a " +
-      guard.text.showValue(imported.asymmetricKeyType) + " public key, so the signature would be checked " +
+      guard.text.showValue(importedType) + " public key, so the signature would be checked " +
       "under an algorithm the metadata does not name");
   }
-  var details = imported.asymmetricKeyDetails || {};
+  var details = guard.crypto.keyDetails(imported) || {};
   if (d.curve !== null && details.namedCurve !== d.curve) {
     throw _err("tuf/bad-key", "the scheme " + key.scheme + " names the " + d.curve +
       " curve; the key is on " + guard.text.showValue(details.namedCurve));

package/lib/validator-cose.js

@@ -7,7 +7,7 @@ var cbor = require("./cbor-det");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var edwardsPoint = require("./edwards-point");
-var nodeCrypto = require("crypto");
+var guard = require("./guard-all.js");
 
 var EC2_CRV_LEN = Object.assign(Object.create(null), { 1: 32, 2: 48, 3: 66 });
 var EC2_CRV_OID = Object.assign(Object.create(null), { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" });
@@ -114,7 +114,7 @@ function assertKeyMaterial(key, E, code, unsupportedCode) {
   if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
-  try { nodeCrypto.createPublicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
+  try { guard.crypto.publicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
   catch (e) { throw bad("the credential public key point is not valid for its curve", e); }
   if (Number(key.kty) === 1 && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
   return key;

package/lib/webauthn-mds.js

@@ -26,12 +26,6 @@ var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var _strToLowerCase = intrinsic.toLowerCase;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strSplit = intrinsic.uncurry(String.prototype.split);
-/** @internal The hash constructor and the methods of the object it returns. What a digest here
- *  produces is a metadata lookup key and the identity two certificates are told apart by, so a
- *  replaced constructor, update or digest decides which entry governs an attestation. */
-var _createHash = _nodeCrypto.createHash;
-var _hashUpdate = intrinsic.uncurry(_nodeCrypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(_nodeCrypto.createHash("sha256").digest);
 var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
 var constants = require("./constants");
@@ -702,7 +696,9 @@ function certKeyIdentifier(cert) {
   if (!pk || !intrinsic.isBuffer(pk.bytes)) {
     throw _err("webauthn/bad-input", "certKeyIdentifier expects a parsed certificate carrying a subject public key");
   }
-  return _hashDigest(_hashUpdate(_createHash("sha1"), pk.bytes), "hex");
+  /** @internal A metadata lookup key, and the identity two certificates are told apart by, so
+   *  whatever computes it decides which entry governs an attestation. */
+  return guard.crypto.digest("sha1", pk.bytes, { output: "hex" });
 }
 
 function metadataForKeyIdentifier(metadata, keyId) {

package/lib/webauthn.js

@@ -54,7 +54,6 @@ var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var jose = require("./jose");
 var mds = require("./webauthn-mds");
-var nodeCrypto = require("crypto");
 
 var WebauthnError = frameworkError.WebauthnError;
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
@@ -76,16 +75,10 @@ var _subtleVerify = intrinsic.uncurry(subtle.verify);
  * while the bytes handed in were never the credential's. */
 var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
 
-/** @internal The hash constructor is captured, and so are the methods of the object it returns. Every
- * attestation comparison in this module rests on a digest, so a replaced `createHash`, or a replaced
- * `update` or `digest` on the object it hands back, chooses what the comparison sees. */
-var _createHash = nodeCrypto.createHash;
-function _sha(name, buf) {
-  var h = _createHash(name);
-  return _hashDigest(_hashUpdate(h, buf));
-}
-var _hashUpdate = intrinsic.uncurry(nodeCrypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(nodeCrypto.createHash("sha256").digest);
+/** @internal Every attestation comparison in this module rests on a digest, so whatever computes one
+ * chooses what the comparison sees. The guard owns the hash construction and the methods of the
+ * object it returns. */
+function _sha(name, buf) { return guard.crypto.digest(name, buf); }
 /** @internal The comparison goes through the captured operation. This is what decides that an
  *  attestation statement's key is the credential's key, so a replacement answering zero makes a
  *  different key match. */

package/lib/webcrypto.js

@@ -261,10 +261,10 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   var name = _normalizeAlg(algorithm, "digest").name;
   var xof = XOF_NODE[_toUpperCase(_String(name))];
   var h = xof
-    ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-    : nodeCrypto.createHash(_hashNode(name, "digest"));
-  h.update(_toBuf(data, "digest"));
-  return _toArrayBuffer(h.digest());
+    ? guard.crypto.hash(xof.node, xof.length)
+    : guard.crypto.hash(_hashNode(name, "digest"));
+  _hashUpdate(h, _toBuf(data, "digest"));
+  return _toArrayBuffer(_hashDigest(h));
 };
 
 SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, source) {
@@ -276,8 +276,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
     var name = _normalizeAlg(algorithms[_h], "digestStream").name;
     var xof = XOF_NODE[_toUpperCase(_String(name))];
     hashes[_h] = xof
-      ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-      : nodeCrypto.createHash(_hashNode(name, "digestStream"));
+      ? guard.crypto.hash(xof.node, xof.length)
+      : guard.crypto.hash(_hashNode(name, "digestStream"));
   }
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -307,8 +307,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
 
 SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source) {
   var cipher = spec.authTagLength
-    ? nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
-    : nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv);
+    ? guard.crypto.cipher(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
+    : guard.crypto.cipher(spec.algNode, spec.key, spec.iv);
   if (spec.aad && spec.aad.length) _cipherSetAAD(cipher, spec.aad);
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -344,7 +344,7 @@ SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source
 };
 
 SubtleCrypto.prototype.decryptStream = function decryptStream(spec, ct) {
-  var decipher = nodeCrypto.createDecipheriv(spec.algNode, spec.key, spec.iv);
+  var decipher = guard.crypto.decipher(spec.algNode, spec.key, spec.iv);
   return _decipherDrive(decipher, _bufferFrom(_toBuf(ct, "decryptStream ciphertext")), _STREAM_CHUNK);
 };
 async function* _decipherDrive(decipher, ct, chunkSize) {
@@ -368,12 +368,12 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW") {
     var bits = alg.length;
     if (bits !== 128 && bits !== 192 && bits !== 256) throw new WebCryptoError("webcrypto/syntax", name + ": length must be 128/192/256");
-    var secret = guard.crypto.secretKey(nodeCrypto.randomBytes(bits / 8));
+    var secret = guard.crypto.secretKey(guard.crypto.randomBytes(bits / 8));
     return new CryptoKey("secret", extractable, { name: name, length: bits }, usages, secret);
   }
   if (name === "HMAC") {
     var lenBits = _hmacLengthBits(alg, "generateKey HMAC");
-    var hkey = guard.crypto.secretKey(nodeCrypto.randomBytes(lenBits / 8));
+    var hkey = guard.crypto.secretKey(guard.crypto.randomBytes(lenBits / 8));
     return new CryptoKey("secret", extractable, { name: name, hash: { name: (typeof alg.hash === "string" ? alg.hash : alg.hash.name) }, length: lenBits }, usages, hkey);
   }
 
@@ -391,7 +391,7 @@ function _generateKeyPair(alg) {
   var name = alg.name, kp, algorithm;
   if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") {
     var rsaHash = _hashObj(alg.hash, "generateKey " + name);
-    kp = nodeCrypto.generateKeyPairSync("rsa", {
+    kp = guard.crypto.generateKeyPair("rsa", {
       modulusLength: alg.modulusLength || 2048,
       publicExponent: alg.publicExponent ? _bufToBigIntNum(alg.publicExponent) : 65537,
     });
@@ -399,19 +399,19 @@ function _generateKeyPair(alg) {
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
     if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + _stringify(curve));
-    kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: CURVE_NODE[curve] });
+    kp = guard.crypto.generateKeyPair("ec", { namedCurve: CURVE_NODE[curve] });
     algorithm = { name: name, namedCurve: curve };
   } else if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
-    kp = nodeCrypto.generateKeyPairSync(_toLowerCase(name));
+    kp = guard.crypto.generateKeyPair(_toLowerCase(name));
     algorithm = { name: _stdName(name) };
   } else if (ML_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_DSA_NODE[name]);
     algorithm = { name: name };
   } else if (ML_KEM_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_KEM_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_KEM_NODE[name]);
     algorithm = { name: name };
   } else if (SLH_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(SLH_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(SLH_DSA_NODE[name]);
     algorithm = { name: name };
   } else {
     throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + _stringify(name));
@@ -515,7 +515,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
-    return _toArrayBuffer(nodeCrypto.publicEncrypt({
+    return _toArrayBuffer(guard.crypto.publicEncrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "encrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "encrypt label") : undefined,
@@ -526,10 +526,10 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
-        if (aad) cipher.setAAD(aad);
+        var cipher = guard.crypto.cipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
+        if (aad) guard.crypto.transformSetAAD(cipher, aad);
         var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
-        return _bufferConcat([ct, cipher.getAuthTag()]);
+        return _bufferConcat([ct, guard.crypto.cipherAuthTag(cipher)]);
       });
     }, "encrypt"));
   }
@@ -537,7 +537,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
+        var c2 = guard.crypto.cipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
         return guard.secret.cipherFinish(c2, buf, WebCryptoError, "webcrypto/operation", "an AES-CBC encrypt intermediate");
       });
     }, "encrypt"));
@@ -547,7 +547,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
+        var c3 = guard.crypto.cipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
         return guard.secret.cipherFinish(c3, buf, WebCryptoError, "webcrypto/operation", "an AES-CTR encrypt intermediate");
       });
     }, "encrypt"));
@@ -563,7 +563,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
-    var oaepOut = nodeCrypto.privateDecrypt({
+    var oaepOut = guard.crypto.privateDecrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : undefined,
@@ -580,9 +580,9 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
-        if (gcmAad) d.setAAD(gcmAad);
-        d.setAuthTag(tag);
+        var d = guard.crypto.decipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
+        if (gcmAad) guard.crypto.transformSetAAD(d, gcmAad);
+        guard.crypto.decipherSetAuthTag(d, tag);
         return guard.secret.cipherFinish(d, ct, WebCryptoError, "webcrypto/operation", "the recovered AES-GCM plaintext");
       });
     }, "decrypt"));
@@ -591,7 +591,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
+        var d2 = guard.crypto.decipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
         return guard.secret.cipherFinish(d2, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CBC plaintext");
       });
     }, "decrypt"));
@@ -601,7 +601,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
+        var d3 = guard.crypto.decipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
         return guard.secret.cipherFinish(d3, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CTR plaintext");
       });
     }, "decrypt"));
@@ -650,7 +650,7 @@ function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
         if (next) next();
         if (err) reject(err); else resolve(derived);
       }
-      try { nodeCrypto.pbkdf2(pw, salt, iterations, keylen, digest, done); }
+      try { guard.crypto.pbkdf2Async(pw, salt, iterations, keylen, digest, done); }
       catch (e) { done(e); }
     }
     if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _push(_pbkdf2Waiters,start);
@@ -662,7 +662,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
     _requireOwnKey(alg.public, "deriveBits public key");
-    var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
+    var secret = guard.crypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
     try {
       if (length == null) return _toArrayBuffer(secret);
       _requireDeriveLength(length, name);
@@ -677,7 +677,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "HKDF") {
     _requireDeriveLength(length, "HKDF");
     return _withSecretBytes(key, function (ikm) {
-      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
+      var derived = guard.crypto.hkdf(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
       return _types.isArrayBuffer(derived) ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
@@ -710,7 +710,7 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
      * hash of the shared secret with this counter in it, so a replaced write makes two blocks derive
      * from the same input and the key material repeats. */
     var ctr = _bufferAlloc(4); intrinsic.writeUInt32BE(ctr, counter, 0);
-    var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
+    var h = guard.crypto.digestParts(hashNode, [z, ctr, sharedInfo]);
     _push(blocks, h); got += h.length; counter += 1;
   }
   var joined = _bufferConcat(blocks);
@@ -758,7 +758,7 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
   _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
   if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + _stringify(encapsulationKey.type));
   var r;
-  try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
+  try { r = guard.crypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
   try {
     return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
@@ -780,7 +780,7 @@ SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorith
       "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)");
   }
   var ss;
-  try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
+  try { ss = guard.crypto.decapsulate(decapsulationKey._handle, ct); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
   try {
     return _toArrayBuffer(ss);
@@ -803,7 +803,7 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
     }
     try {
       return _withSecretBytes(wrappingKey, function (wkBytes) {
-        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var c = guard.crypto.cipher("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
@@ -828,7 +828,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     }
     try {
       bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
-        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var d = guard.crypto.decipher("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
@@ -1021,8 +1021,13 @@ _forEach([ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE], function (m) {
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];
-  if (wantType && keyObject && keyObject.asymmetricKeyType && !wantType[keyObject.asymmetricKeyType]) {
-    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + keyObject.asymmetricKeyType +
+  /** @internal The key's own family, read through the accessor captured at load. This is the check
+   *  that binds the algorithm a caller named to the key they supplied, so reading it off the live
+   *  prototype let a replaced accessor answer `"rsa"` for an Ed25519 key and the import accepted it
+   *  as RSA-PSS. */
+  var actualType = guard.crypto.keyTypeOf(keyObject);
+  if (wantType && actualType && !wantType[actualType]) {
+    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + actualType +
       " key, which is not compatible with algorithm " + name);
   }
   if (name === "ECDSA" || name === "ECDH") {
@@ -1136,17 +1141,17 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
   if (out.length > MAX_RANDOM_BYTES) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: byteLength exceeds " + MAX_RANDOM_BYTES);
   }
-  nodeCrypto.randomFillSync(out);
+  guard.crypto.randomFill(out);
   return typedArray;
 };
 
-Crypto.prototype.randomUUID = function randomUUID() { return nodeCrypto.randomUUID(); };
+Crypto.prototype.randomUUID = function randomUUID() { return guard.crypto.randomUUID(); };
 
 function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
   var head = sec1Compressed[0];
   if (head !== 0x02 && head !== 0x03) throw E(code, "EC point de-compression expects a compressed SEC1 point (0x02/0x03)");
   try {
-    return nodeCrypto.ECDH.convertKey(sec1Compressed, nodeCurve, undefined, undefined, "uncompressed");
+    return guard.crypto.ecConvertPoint(sec1Compressed, nodeCurve, "uncompressed");
   } catch (e) {
     throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
   }
@@ -1170,9 +1175,19 @@ function isCryptoKeyLike(x) {
  * key this engine did not make while the others returned it. A JWK is an object rather than
  * bytes, so only the byte formats are wrapped. */
 function exportAnyKey(key, E, code, want) {
-  var format = want || _EXPORT_FORMAT[key && key.type];
+  /** @internal At most ONE read of the key's type, and none at all when the caller named the format
+   *  it wants. It is a getter on node's own CryptoKey, so each read is a call a replacement answers,
+   *  and reading it per decision let one answer "private" where a PEM label was chosen and "public"
+   *  where the bytes were, which put a public key inside a `PRIVATE KEY` block. */
+  var keyType;
+  var readType = false;
+  function typeOnce() {
+    if (!readType) { keyType = key == null ? undefined : key.type; readType = true; }
+    return keyType;
+  }
+  var format = want || _EXPORT_FORMAT[typeOnce()];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
-  if (want === "jwk" && !_EXPORT_FORMAT[key && key.type]) {
+  if (want === "jwk" && !_EXPORT_FORMAT[typeOnce()]) {
     throw E(code, "a CryptoKey with a private, public, or secret type is required");
   }
   var asJwk = format === "jwk";
@@ -1186,7 +1201,7 @@ function exportAnyKey(key, E, code, want) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
   }
   var handle = key._handle;
-  if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
+  if (guard.crypto.isKeyObject(handle) && guard.crypto.keyKind(handle) === key.type) {
     return _resolve(_Promise).then(function () {
       if (asJwk) return guard.crypto.exportKey(handle, { format: "jwk" });
       return format === "raw" ? guard.crypto.exportKey(handle) : guard.crypto.exportKey(handle, { format: "der", type: format });
@@ -1195,7 +1210,7 @@ function exportAnyKey(key, E, code, want) {
     });
   }
   return _resolve(_Promise)
-    .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
+    .then(function () { return guard.crypto.nodeExportKey(format, key); })
     .then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.60",
+  "version": "0.8.61",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a0bc3a87-4c9e-4598-95ba-7457dca63e87",
+  "serialNumber": "urn:uuid:dc638a09-3eb3-4620-b84b-f3edd3453ec6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T18:31:09.061Z",
+    "timestamp": "2026-10-07T23:02:52.146Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.60",
+      "bom-ref": "@blamejs/pki@0.8.61",
       "type": "application",
       "name": "pki",
-      "version": "0.8.60",
+      "version": "0.8.61",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.60",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.61",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.60",
+      "ref": "@blamejs/pki@0.8.61",
       "dependsOn": []
     }
   ]