@blamejs/pki 0.8.60 → 0.9.0

package/lib/cms-digest.js

@@ -26,7 +26,6 @@
  *   attached or detached, constant-time comparison, fail-closed.
  */
 
-var nodeCrypto = require("node:crypto");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
 var frameworkError = require("./framework-error");
@@ -101,7 +100,7 @@ async function _digest(content, opts) {
   var ctOid = O(ctName);
   if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + guard.text.showValue(ctName));
 
-  var value = nodeCrypto.createHash(NODE_DIGEST[alg]).update(raw).digest();
+  var value = guard.crypto.digest(NODE_DIGEST[alg], raw);
   var eciChildren = opts.detached === true
     ? [b.oid(ctOid)]
     : [b.oid(ctOid), b.explicit(0, b.octetString(raw))];
@@ -176,7 +175,7 @@ async function _verifyDigest(input, opts) {
   var covered = embedded != null
     ? guard.bytes.snapshotSource(embedded, CmsError, "cms/bad-input", "the encapsulated content")
     : supplied;
-  var recomputed = nodeCrypto.createHash(NODE_DIGEST[alg]).update(covered).digest();
+  var recomputed = guard.crypto.digest(NODE_DIGEST[alg], covered);
   var matched = guard.crypto.constantTimeEqual(recomputed, parsed.digest);
   return guard.verdict.of({
     valid: matched,

package/lib/cms-encrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.encrypt block live in cms-verify.js, which re-exports this function (the
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var oid = require("./oid");
@@ -203,7 +202,7 @@ async function _buildKekri(cek, desc) {
 
 async function _buildPwri(cek, desc) {
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
   _prfHash(prf);
   var innerKeyBytes = 32;
@@ -213,7 +212,7 @@ async function _buildPwri(cek, desc) {
   var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt: salt, iterations: iterations }, kekKey, innerKeyBytes * 8));
   if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
-    var iv = nodeCrypto.randomBytes(16);
+    var iv = guard.crypto.randomBytes(16);
     var encryptedKey = _pwriWrapIv(kek, cek, iv);
     var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
     var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
@@ -288,17 +287,17 @@ function _pwriFormat(cek) {
   var blk = 16;
   var padLen = body.length % blk === 0 ? 0 : blk - (body.length % blk);
   if (body.length + padLen < 2 * blk) padLen += (2 * blk - (body.length + padLen));
-  var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+  var wrapped = Buffer.concat([body, guard.crypto.randomBytes(padLen)]);
   guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
   return wrapped;
 }
 function _pwriWrapIv(kek, cek, iv) {
   var wk = _pwriFormat(cek);
   try {
-    var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv); c1.setAutoPadding(false);
+    var c1 = guard.crypto.cipher("aes-256-cbc", kek, iv); guard.crypto.transformNoPadding(c1);
     var pass1 = guard.secret.cipherFinish(c1, wk, CmsError, "cms/bad-input", "the PWRI first-pass ciphertext");
     var iv2 = pass1.subarray(pass1.length - 16);
-    var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2); c2.setAutoPadding(false);
+    var c2 = guard.crypto.cipher("aes-256-cbc", kek, iv2); guard.crypto.transformNoPadding(c2);
     return guard.secret.cipherFinish(c2, pass1, CmsError, "cms/bad-input", "the PWRI wrapped key");
   } finally {
     guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
@@ -427,7 +426,7 @@ function encrypt(content, recipients, opts) {
 }
 
 async function _encryptImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var algName = opts.contentEncryptionAlgorithm || "aes-256-gcm";
   var ca = CONTENT_ALGS[guard.text.keyOf(algName)];
   if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + guard.text.showValue(algName));
@@ -444,7 +443,7 @@ async function _encryptImpl(content, recipients, opts) {
    *  them. */
   var contentBytes = contentStream ? null : guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var contentType = opts.contentType || "data";
-  var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
+  var cek = guard.crypto.randomBytes(ca.keyBits / 8);
 
   try {
     if (!Array.isArray(recipients)) return await _encryptedData(contentBytes, contentStream, recipients, ca, contentType, opts, cek);
@@ -477,7 +476,7 @@ async function _encStream(spec, stream) {
 }
 
 async function _envelopedData(contentBytes, contentStream, cek, ca, contentType, riNodes, recips) {
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var enc = contentStream
     ? (await _encStream({ algNode: "aes-" + ca.keyBits + "-cbc", key: cek, iv: iv }, contentStream)).ciphertext
     : pbes2.cbcEncrypt(cek, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
@@ -522,7 +521,7 @@ var AUTH_ENVELOPED_FORBIDDEN = intrinsic.assign(intrinsic.create(null), {
 });
 
 async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentType, opts, riNodes, recips) {
-  var nonce = nodeCrypto.randomBytes(12);
+  var nonce = guard.crypto.randomBytes(12);
   var authAttrsDer = null, aad = Buffer.alloc(0);
   if (contentType !== "data" && !(opts.authAttrs && opts.authAttrs.length)) {
     throw _err("cms/bad-input", "AuthEnvelopedData with a non-data contentType requires authAttrs (RFC 5083 sec. 2.1)");
@@ -561,7 +560,7 @@ async function _encryptedData(contentBytes, contentStream, desc, ca, contentType
         " EncryptedData descriptor; that field is not read for this arm";
     });
   }
-  var iv = nodeCrypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var contentAlgNode, encKey;
   if (desc && desc.cek != null) {
     encKey = guard.bytes.view(desc.cek, CmsError, "cms/bad-input", "cek");
@@ -584,9 +583,9 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
   var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
   var password = pwOwn2.bytes;
   var iterations = pbes2.assertIterations(desc.iterations == null ? 600000 : desc.iterations, _err, "cms");
-  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
+  var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : guard.crypto.randomBytes(16);
   var prf = desc.prf || "hmacWithSHA256";
-  var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
+  var key = guard.crypto.pbkdf2(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
   if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
   try {
     var enc = contentStream
@@ -602,10 +601,10 @@ async function _encryptedDataPbes2(contentBytes, contentStream, desc, ca, conten
 }
 
 function _gcmEncrypt(key, nonce, plaintext, aad, keyBits, tagLen) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
-  if (aad && aad.length) c.setAAD(aad);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
+  if (aad && aad.length) guard.crypto.transformSetAAD(c, aad);
   var ct = guard.secret.cipherFinish(c, plaintext, CmsError, "cms/bad-input", "a content-encryption intermediate");
-  return { ct: ct, tag: c.getAuthTag() };
+  return { ct: ct, tag: guard.crypto.cipherAuthTag(c) };
 }
 
 function _tlvHeaderLen(der) {
@@ -649,7 +648,7 @@ function authenticate(content, recipients, opts) {
 }
 
 async function _authenticateImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var withAttrs = opts.authenticatedAttributes !== false;
   guard.identifier.assertKnownKeys(opts, withAttrs ? _AUTHENTICATE_OPTS_ATTRS : _AUTHENTICATE_OPTS_BARE,
     _err, "cms/bad-input", function (k) {
@@ -682,7 +681,7 @@ async function _authenticateImpl(content, recipients, opts) {
   var contentType = opts.contentType || "data";
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
 
-  var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
+  var macKey = guard.crypto.randomBytes(MAC_KEY_OCTETS);
   try {
     var recips = [];
     var consumedAuth = {};

package/lib/cms-sign.js

@@ -203,7 +203,7 @@ function _assertAlgorithmProtectionPairs(pairs, digestAlgId, armAlgId, armTag) {
 }
 
 function _resolveSignerContext(signer, opts) {
-  var so = signer || {};
+  var so = signer || intrinsic.create(null);
   var keyOnly = so.cert == null && so.spki != null;
   var soKey = so.key;
   var soSpki = keyOnly ? guard.bytes.snapshotSource(so.spki, CmsError, "cms/bad-input", "a key-only signer's spki") : null;
@@ -533,7 +533,7 @@ function _resolveSignerIndices(spec, n) {
 }
 
 function _buildCountersignature(targetSigOctets, countersigner, opts) {
-  var so = countersigner || {};
+  var so = countersigner || intrinsic.create(null);
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
   var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);

package/lib/composite-kem.js

@@ -23,7 +23,6 @@
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
-var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
@@ -115,11 +114,11 @@ function _mlkemDecaps(d, seed, mlkemCT) {
 function _ecPubFromPoint(d, point) {
   if (point.length < 1 || point[0] !== 0x04) throw _err("kem/bad-key", "the EC component point is not in uncompressed form");
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName("ecPublicKey")), _b.oid(oid.byName(d.trad.curve))]), _b.bitString(point, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 function _okpPubFromRaw(d, raw) {
   var spki = _b.sequence([_b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.bitString(raw, 0)]);
-  return nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return guard.crypto.publicKey({ key: spki, format: "der", type: "spki" });
 }
 /** @internal The encoding is this helper's own allocation and holds the traditional private scalar, so
  * it is cleared here. A caller's own cleanup cannot reach a buffer it never sees, and both the
@@ -127,13 +126,13 @@ function _okpPubFromRaw(d, raw) {
 function _okpPrivFromRaw(d, raw) {
   var p8 = _b.sequence([_b.integer(0n), _b.sequence([_b.oid(oid.byName(d.trad.curve))]), _b.octetString(_b.octetString(raw))]);
   try {
-    return nodeCrypto.createPrivateKey({ key: p8, format: "der", type: "pkcs8" });
+    return guard.crypto.privateKey({ key: p8, format: "der", type: "pkcs8" });
   } finally {
     guard.secret.zeroize(p8, KemError, "kem/bad-input", "the " + d.trad.curve + " component key encoding");
   }
 }
 function _rawPubOf(keyObject) {
-  var spki = keyObject.export({ format: "der", type: "spki" });
+  var spki = guard.crypto.exportKey(keyObject, { format: "der", type: "spki" });
   return Buffer.from(asn1.read.bitString(asn1.decode(spki).children[1]).bytes);
 }
 
@@ -143,12 +142,12 @@ function _tradEncaps(d, tradPK) {
     var pub;
     try {
       asn1.decode(tradPK);
-      pub = nodeCrypto.createPublicKey({ key: tradPK, format: "der", type: "pkcs1" });
+      pub = guard.crypto.publicKey({ key: tradPK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component public key is not a valid RSAPublicKey", e)); }
-    if (pub.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
-    var ss = Buffer.from(nodeCrypto.randomBytes(RSA_SS));
+    if (guard.crypto.keyDetails(pub).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    var ss = Buffer.from(guard.crypto.randomBytes(RSA_SS));
     var ct;
-    try { ct = Buffer.from(nodeCrypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
+    try { ct = Buffer.from(guard.crypto.publicEncrypt({ key: pub, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, ss)); }
     catch (e) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/bad-key", "the RSA-OAEP component encryption failed", e));
@@ -158,8 +157,8 @@ function _tradEncaps(d, tradPK) {
   var dh, dhCt;
   try {
     var recip = trad.kind === "ec" ? _ecPubFromPoint(d, tradPK) : _okpPubFromRaw(d, tradPK);
-    var eph = trad.kind === "ec" ? nodeCrypto.generateKeyPairSync("ec", { namedCurve: trad.node }) : nodeCrypto.generateKeyPairSync(trad.curve.toLowerCase());
-    dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
+    var eph = trad.kind === "ec" ? guard.crypto.generateKeyPair("ec", { namedCurve: trad.node }) : guard.crypto.generateKeyPair(trad.curve.toLowerCase());
+    dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recip }));
     dhCt = _rawPubOf(eph.publicKey);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " public key is invalid", e)); }
   return _promiseResolve(_Promise, { ss: dh, ct: dhCt });
@@ -171,37 +170,38 @@ function _tradDecaps(d, tradSK, tradCT) {
     var priv;
     try {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e)); }
-    if (priv.asymmetricKeyDetails.modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
+    if (guard.crypto.keyDetails(priv).modulusLength !== trad.bits) return _promiseReject(_Promise, _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)"));
     var ss;
-    try { ss = Buffer.from(nodeCrypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
+    try { ss = Buffer.from(guard.crypto.privateDecrypt({ key: priv, padding: guard.crypto.padding.RSA_PKCS1_OAEP, oaepHash: "sha256" }, tradCT)); }
     catch (_e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed")); }
     if (ss.length !== RSA_SS) {
       guard.secret.zeroize(ss, KemError, "kem/bad-input", "the RSA-OAEP component secret");
       return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the RSA-OAEP component decryption failed"));
     }
-    return _promiseResolve(_Promise, { ss: ss, tradPK: Buffer.from(nodeCrypto.createPublicKey(priv).export({ format: "der", type: "pkcs1" })) });
+    return _promiseResolve(_Promise, { ss: ss,
+      tradPK: Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(priv), { format: "der", type: "pkcs1" })) });
   }
   var priv2, eph;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv2 = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv2 = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv2 = _okpPrivFromRaw(d, tradSK);
     }
     eph = trad.kind === "ec" ? _ecPubFromPoint(d, tradCT) : _okpPubFromRaw(d, tradCT);
   } catch (e) { return _promiseReject(_Promise, _err("kem/bad-key", "the " + trad.curve + " key material is invalid", e)); }
   var dh;
-  try { dh = Buffer.from(nodeCrypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
+  try { dh = Buffer.from(guard.crypto.diffieHellman({ privateKey: priv2, publicKey: eph })); }
   catch (e) { return _promiseReject(_Promise, _err("kem/decapsulation-failed", "the " + trad.curve + " Diffie-Hellman failed", e)); }
   /** @internal The same canonical point the derivation states, read from the one function that spells
    * it. The combiner hashes these bytes, so a stored spelling here and a generated one there would
    * reach different secrets from the two sides of one key. */
   var tradPK;
   try {
-    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(nodeCrypto.createPublicKey(priv2));
+    tradPK = trad.kind === "ec" ? _ecPointOf(d, tradSK) : _rawPubOf(guard.crypto.publicKey(priv2));
   } catch (e) {
     /** @internal The agreement already produced a secret, and this rejection happens after it, so the
      * secret is wiped here: the caller's settle-or-wipe covers a value it was handed, and a rejected
@@ -371,9 +371,7 @@ function _ecPointOf(d, tradSK) {
   var scalar = _ecScalarOf(d, tradSK);
   var point;
   try {
-    var ecdh = nodeCrypto.createECDH(d.trad.node);
-    ecdh.setPrivateKey(scalar);
-    point = ecdh.getPublicKey(null, "uncompressed");
+    point = guard.crypto.ecPointFromScalar(d.trad.node, scalar);
   } catch (e) {
     if (e instanceof KemError) throw e;
     throw _err("kem/bad-key", "the EC component scalar does not generate a point on " + d.trad.node, e);
@@ -418,18 +416,18 @@ function _tradPubOf(d, tradSK) {
     var rp;
     try {
       asn1.decode(tradSK);
-      rp = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "pkcs1" });
+      rp = guard.crypto.privateKey({ key: tradSK, format: "der", type: "pkcs1" });
     } catch (e) { throw _err("kem/bad-key", "the RSA component private key is not a valid RSAPrivateKey", e); }
-    if (rp.asymmetricKeyDetails.modulusLength !== trad.bits) {
+    if (guard.crypto.keyDetails(rp).modulusLength !== trad.bits) {
       throw _err("kem/bad-key", "the RSA component modulus is not " + trad.bits + " bits (draft sec. 6)");
     }
-    return Buffer.from(nodeCrypto.createPublicKey(rp).export({ format: "der", type: "pkcs1" }));
+    return Buffer.from(guard.crypto.exportKey(guard.crypto.publicKey(rp), { format: "der", type: "pkcs1" }));
   }
   var priv;
   try {
     if (trad.kind === "ec") {
       asn1.decode(tradSK);
-      priv = nodeCrypto.createPrivateKey({ key: tradSK, format: "der", type: "sec1" });
+      priv = guard.crypto.privateKey({ key: tradSK, format: "der", type: "sec1" });
     } else {
       priv = _okpPrivFromRaw(d, tradSK);
     }
@@ -439,7 +437,8 @@ function _tradPubOf(d, tradSK) {
    * public key nothing can use, so the two are held to each other here. Decapsulation reaches the same
    * conclusion by failing the agreement; a derivation performs no operation that would notice. */
   if (trad.kind === "ec") {
-    var named = priv.asymmetricKeyDetails && priv.asymmetricKeyDetails.namedCurve;
+    var privDetails = guard.crypto.keyDetails(priv);
+    var named = privDetails && privDetails.namedCurve;
     if (named !== trad.node) {
       throw _err("kem/bad-key", "the EC component is on " + guard.text.showValue(named) + ", and " + d.name + " names " + trad.node);
     }
@@ -450,7 +449,7 @@ function _tradPubOf(d, tradSK) {
      * point stored beside it cannot stand in for one it does not generate. */
     return _ecPointOf(d, tradSK);
   }
-  return _rawPubOf(nodeCrypto.createPublicKey(priv));
+  return _rawPubOf(guard.crypto.publicKey(priv));
 }
 
 /** @internal The composite `SubjectPublicKeyInfo` for a composite ML-KEM private key. The runtime key
@@ -488,8 +487,8 @@ async function _publicFromPrivate(privateKey) {
        * copy of the seed and is registered as one. */
       var seedPkcs8 = _mlkemSeedPkcs8(d, seed);
       guard.list.append(secrets, seedPkcs8);
-      var mlPriv = nodeCrypto.createPrivateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
-      ek = _rawPubOf(nodeCrypto.createPublicKey(mlPriv));
+      var mlPriv = guard.crypto.privateKey({ key: seedPkcs8, format: "der", type: "pkcs8" });
+      ek = _rawPubOf(guard.crypto.publicKey(mlPriv));
     } catch (e) {
       if (e instanceof KemError) throw e;
       throw _err("kem/bad-key", "the ML-KEM component private key is invalid", e);

package/lib/crl-sign.js

@@ -240,7 +240,7 @@ function _buildCrlExtensions(spec, ctx) {
   var crlNumberVal = null;
   if (spec.crlNumber != null) { var cn = _boundedInteger(spec.crlNumber, "cRLNumber"); crlNumberVal = cn.value; push("cRLNumber", false, cn.tlv); }
   var ext = spec.extensions;
-  if (ext == null) ext = {};
+  if (ext == null) ext = intrinsic.create(null);
   if (Array.isArray(ext)) {
     var arrBase = null, arrCrlNum = null;
     /** @internal The walk goes through `guard.list.copyMap`, never the caller's own `forEach`. Reached
@@ -391,9 +391,9 @@ function _assertIssuerCanSignCrl(issuerCert) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crl/bad-input", "the CRL spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   var byCert = issuer.cert != null, byName = issuer.name != null;
   guard.identifier.assertKnownKeys(spec, byCert || byName ? KNOWN_SPEC_KEYS_ISSUER_NAMED : KNOWN_SPEC_KEYS,
     _err, "crl/bad-input", function (k) {

package/lib/crmf-sign.js

@@ -17,12 +17,6 @@
  * @card Build a CRMF CertReqMessages with a signature proof of possession.
  */
 
-var nodeCrypto = require("node:crypto");
-/** @internal Bound at module load, like every other capture here: the proof below decides what it
- * agrees and what it hashes, so a replacement swapped in afterwards must not be able to steer it. */
-var _diffieHellman = nodeCrypto.diffieHellman;
-var _createPublicKey = nodeCrypto.createPublicKey;
-var _createPrivateKey = nodeCrypto.createPrivateKey;
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -345,7 +339,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
       _assertAgreementExponent(pkcs3, "the authority certificate's key");
     }
   }
-  try { caPub = _createPublicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
+  try { caPub = guard.crypto.publicKey({ key: caSpkiBytes, format: "der", type: "spki" }); }
   catch (e) { throw _err("crmf/bad-popo", "the authority certificate does not carry a key this runtime can agree with", e); }
   /** @internal The snapshot of the caller's key is this function's own copy of private material, so it
    * is registered for the wipe below rather than left to the argument boundary, which clears what it
@@ -357,7 +351,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     /** @internal Inside the cleanup scope, because the import can throw AFTER the snapshot exists: a
      * catch that returned from out here would leave that copy of private material behind. */
     try {
-      if (pop.key && typeof pop.key === "object" && pop.key.asymmetricKeyType != null) {
+      if (guard.crypto.keyTypeOf(pop.key) != null) {
         eePriv = pop.key;
       } else if (pop.key && typeof pop.key === "object" && pop.key.type === "private" &&
                  typeof pop.key.export === "function") {
@@ -366,10 +360,10 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * applies here: supporting the encoding for a caller holding bytes and refusing the caller
          * holding the key those bytes import to would be the same key admitted one way. The export
          * is this function's own copy of private material and is cleared with the rest. */
-        keySnapshot = pop.key.export({ format: "der", type: "pkcs8" });
+        keySnapshot = guard.crypto.exportKey(pop.key, { format: "der", type: "pkcs8" });
         translated = _x942PrivToPkcs3(keySnapshot);
         eePriv = translated !== null
-          ? _createPrivateKey({ key: translated, format: "der", type: "pkcs8" })
+          ? guard.crypto.privateKey({ key: translated, format: "der", type: "pkcs8" })
           : pop.key;
       } else if (guard.bytes.isByteSource(pop.key)) {
         keySnapshot = guard.bytes.snapshotSource(pop.key, CrmfError, "crmf/bad-popo", "the requester's private key");
@@ -377,7 +371,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
          * copy of the private value, and an import that throws after it exists must not leave it
          * behind. The wipe below clears whatever was made, on every way out. */
         translated = _x942PrivToPkcs3(keySnapshot);
-        eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+        eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
       } else {
         /** @internal A PEM key reaches the same conversion: it is the same key in the same encoding
          * with an armor around it, so admitting one form and not the other would support X9.42 for a
@@ -386,9 +380,9 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
         if (pemDer !== null) {
           keySnapshot = pemDer;
           translated = _x942PrivToPkcs3(keySnapshot);
-          eePriv = _createPrivateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
+          eePriv = guard.crypto.privateKey({ key: translated || keySnapshot, format: "der", type: "pkcs8" });
         } else {
-          eePriv = _createPrivateKey(pop.key);
+          eePriv = guard.crypto.privateKey(pop.key);
         }
       }
     } catch (e) {
@@ -402,7 +396,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * something this request never asked to have certified. The encryptedKey arm holds its enclosed
      * key to the same rule. */
     var eeSpki;
-    try { eeSpki = _createPublicKey(eePriv).export({ format: "der", type: "spki" }); }
+    try { eeSpki = guard.crypto.exportKey(guard.crypto.publicKey(eePriv), { format: "der", type: "spki" }); }
     catch (e) { throw _err("crmf/bad-popo", "the public half of pop.key could not be derived to check it against the requested key", e); }
     /** @internal Compared as keys, not as bytes. A PKCS#3 DHParameter carries an optional
      * privateValueLength, so one finite-field key has more than one valid SubjectPublicKeyInfo and a
@@ -449,7 +443,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
      * with parameters g and p, agreeing `g^xy mod p`. An elliptic-curve or montgomery pair agrees a
      * secret through the same call and would be emitted under the same OID, which names an operation
      * the recipient would not be performing. */
-    if (eePriv.asymmetricKeyType !== "dh" || caPub.asymmetricKeyType !== "dh") {
+    if (guard.crypto.keyType(eePriv) !== "dh" || guard.crypto.keyType(caPub) !== "dh") {
       /** @internal A key this runtime imported but did not classify reports no asymmetricKeyType, which
        * is what an X9.42 dhpublicnumber SubjectPublicKeyInfo does here where the PKCS#3 dhKeyAgreement
        * form is classified. The agreement refuses such a key on its own, so naming the unrecognized
@@ -459,7 +453,7 @@ function _buildAgreeMac(pop, outerTag, certReqDer, template) {
     }
     /** @internal The agreement's own Buffer, not a copy of it: wrapping it would leave the original
      * holding the secret with nothing to clear it. */
-    try { zz = _diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
+    try { zz = guard.crypto.diffieHellman({ privateKey: eePriv, publicKey: caPub }); }
     catch (e) { throw _err("crmf/bad-popo", "the requester's key and the authority's key did not agree a secret; this proof needs a key on the authority's own parameters (RFC 4211 sec. 4.3)", e); }
     /** @internal K = SHA1(LeadingInfo | ZZ | TrailingInfo) (RFC 2875 sec. 3, step 3c), under the
      * digest the proof's own algorithm identifier names. */
@@ -762,7 +756,7 @@ function _x942ToPkcs3(spkiBytes, what) {
 /** @internal How a key reads in the refusal above. A key the runtime imported without classifying
  * carries no asymmetricKeyType, and reporting that as a type name says nothing an operator can act on. */
 function _keyTypeLabel(what, key) {
-  var type = key && key.asymmetricKeyType;
+  var type = guard.crypto.keyTypeOf(key);
   if (typeof type !== "string" || type === "") {
     return what + " carries an algorithm this runtime does not recognize as a key it can agree with";
   }
@@ -1221,7 +1215,7 @@ function _buildCertReqMsg(spec, key, opts) {
 }
 
 function _build(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || _isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
   var specs;
   if (spec.messages != null) {

package/lib/csr-sign.js

@@ -209,7 +209,7 @@ function sign(spec, key, opts) {
 }
 
 function _sign(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");