@blamejs/pki 0.8.60 → 0.9.0

package/lib/pbes2.js

@@ -3,8 +3,10 @@
 "use strict";
 // @internal
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 25 live runtime reads. */
+var _create = Object.create;
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var guard = require("./guard-all");
@@ -102,25 +104,25 @@ function parsePbkdf2Params(paramsDer, opts, E, prefix, strictPrf) {
 }
 
 function cbcEncrypt(key, iv, plaintext, keyBits, E, code) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(c, plaintext, E, code, "a content-encryption intermediate");
 }
 function cbcDecrypt(key, iv, ct, keyBits, E, code) {
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(d, ct, E, code, "the partially recovered plaintext");
 }
 
 function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cipherName = opts.cipher || "aes256-CBC";
   var keyBits = CONTENT_KEYBITS[O(cipherName)];
   if (!keyBits || cipherName.indexOf("CBC") === -1) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = prfNodeByName(prf, E, prefix);
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
-  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : nodeCrypto.randomBytes(16);
-  var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
-  var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
+  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : guard.crypto.randomBytes(16);
+  var iv = opts.iv != null ? opts.iv : guard.crypto.randomBytes(16);
+  var key = guard.crypto.pbkdf2(pwBytes, salt, iterations, keyBits / 8, prfNode);
   try {
     return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits, E, prefix + "/bad-input") };
   } finally {
@@ -152,7 +154,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
     budget.rounds -= pb.iterations;
     if (budget.rounds < 0) throw E(prefix + "/iteration-limit", "the aggregate PBKDF2 key-derivation work exceeds the budget (a hostile many-element input)");
   }
-  var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
+  var dk = guard.crypto.pbkdf2(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits, E, prefix + "/decrypt-failed"); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(dk, E, prefix + "/bad-input", "the password-derived decryption key"); }
@@ -169,9 +171,10 @@ function pbmac1AlgId(desc) {
 
 function pbmac1(pwBytes, salt, iterationCount, keyLength, prfHash, macHash, message) {
   var subtle = webcrypto.webcrypto.subtle;
-  /** @internal Every step is continued through the capture, and the wipe is attached on BOTH outcomes
-   * rather than through `finally`, which calls the receiver's own `then`. These steps derive the key
-   * a PBMAC1 integrity tag is computed under, so a replacement settling one hands back a tag computed
+  /** @internal Every step is continued through the capture, and the wipe is attached on the success
+   * outcome and the failure outcome separately, not through `finally`, which calls the receiver's own
+   * `then`. These steps derive the key a PBMAC1 integrity tag is computed under, so a replacement
+   * settling one hands back a tag computed
    * under bytes nobody derived, and skips the wipe that keeps the derived key from outliving it. */
   var base = guard.async.chain(subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]),
     function (baseKey) {

package/lib/pkcs12-build.js

@@ -17,7 +17,6 @@
  * @card Build a password-integrity PKCS#12 store (RFC 7292 / RFC 9579) and verify its MAC.
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var rc2 = require("./rc2");
 var oid = require("./oid");
@@ -150,7 +149,7 @@ function _p12Kdf(hashName, id, pwBytes, salt, iterations, nBytes) {
     var A = Buffer.concat([D, I]);
     for (var r = 0; r < iterations; r++) {
       var prev = A;
-      A = nodeCrypto.createHash(hashName).update(A).digest();
+      A = guard.crypto.digest(hashName, A);
       guard.secret.zeroize(prev, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
     }
     A.copy(out, i * u);
@@ -238,7 +237,7 @@ function _buildBag(bag, opts, depth) {
     case "shroudedKey": {
       var kDer = _coerceDer(bag.key, "shroudedKey key");
       try { pkcs8.parse(kDer); } catch (e2) { throw _err("pkcs12/bad-input", "shroudedKey key is not a well-formed PKCS#8 PrivateKeyInfo", e2); }
-      var enc = bag.encrypt || {};
+      var enc = bag.encrypt || intrinsic.create(null);
       var bagPbe = _pbeOpts(enc);
       var pw = _pbePasswordOwned(enc.password != null ? enc.password : opts.password);
       var r;
@@ -351,7 +350,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   var password = macOpts.password != null ? macOpts.password : sharedPassword;
   var algorithm = macOpts.algorithm || "hmac";
   var hash = macOpts.hash || "sha256";
-  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : nodeCrypto.randomBytes(MAC_SALT_BYTES);
+  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : guard.crypto.randomBytes(MAC_SALT_BYTES);
   if (salt.length === 0) throw _err("pkcs12/bad-input", "the MAC salt must be non-empty (RFC 9579 sec. 4c)");
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
 
@@ -363,7 +362,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);
     if (macPw.owned) guard.secret.zeroize(macPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
     try {
-      var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
+      var digest = guard.crypto.hmac(node, macKey, authSafeDer);
       var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
       return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
     } finally {
@@ -553,7 +552,7 @@ function build(spec, opts) {
 }
 
 async function _build(spec, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var form = _specForm(spec);
   if (form.isObject) {
     guard.identifier.assertKnownKeys(spec, form.full ? _BUILD_SPEC_FULL_KEYS : _BUILD_SPEC_SHORTHAND_KEYS,
@@ -622,7 +621,7 @@ async function _build(spec, opts) {
             : "");
       });
     }
-    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || {}, opts.password, authSafeDer));
+    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || intrinsic.create(null), opts.password, authSafeDer));
     pfx = b.sequence(pfxChildren);
   }
 
@@ -677,7 +676,7 @@ async function verifyMac(pfx, password, opts) {
 }
 
 async function _verifyMacOfStore(m, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (m.integrityMode !== "password" || !m.mac) throw _err("pkcs12/bad-input", "the store carries no password MAC (integrityMode " + m.integrityMode + ")");
   var expected = m.mac.macValue;
   var computed;
@@ -688,7 +687,7 @@ async function _verifyMacOfStore(m, password, opts) {
     var vMacPw = _p12PasswordOwned(password);
     var macKey = _p12Kdf(node, 3, vMacPw.bytes, m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);
     if (vMacPw.owned) guard.secret.zeroize(vMacPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
-    try { computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest(); }
+    try { computed = guard.crypto.hmac(node, macKey, m.macedBytes); }
     finally { guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key"); }
   } else {
     var kdf = m.mac.pbmac1.kdf;
@@ -768,7 +767,7 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  *   var keyDer = store.keys[0].pkcs8, certDer = store.certs[0].cert;
  */
 async function open(pfx, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _OPEN_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.open has an unknown option ");
   /** @internal Every option is taken once, here, and everything below reads the snapshot. A store
    * is opened in many passes, the MAC and then each bag, so an option left on the caller's object is
@@ -868,7 +867,7 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
   if (p12pw.owned) guard.secret.zeroize(p12pw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
   try {
     if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
-    var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
+    var d = guard.crypto.decipher(scheme.cipher, keyM, iv);
     return guard.secret.cipherFinish(d, ct, Pkcs12Error, "pkcs12/bad-input", "the recovered safe contents");
   } catch (_e) { throw _err("pkcs12/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(keyM, Pkcs12Error, "pkcs12/bad-input", "the password-derived decryption key"); }

package/lib/pki-build.js

@@ -418,7 +418,7 @@ var DP_KEYS = intrinsic.assign(intrinsic.create(null), { fullName: 1, reasons: 1
  * others, so the loop keeps the leading octet uniform over 1 to 127. */
 function randomSerial() {
   for (;;) {
-    var rnd = nodeCrypto.randomBytes(20);
+    var rnd = guard.crypto.randomBytes(20);
     rnd[0] &= 0x7f;
     if (rnd[0] !== 0) return BigInt("0x" + rnd.toString("hex"));
   }
@@ -1249,7 +1249,7 @@ function makeBuilder(ctx) {
 
   function spkiKeyId(spkiDer) {
     var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
-    return nodeCrypto.createHash("sha1").update(keyBytes).digest();
+    return guard.crypto.digest("sha1", keyBytes);
   }
   function skiKeyId(val, spkiDer) {
     if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
@@ -1517,7 +1517,7 @@ function samePublicKey(spkiA, spkiB) {
   /** @internal Two keys of different types are never the same key, and comparing them through
    *  the runtime's equality leaves a fault queued in the crypto library that surfaces on the
    *  next unrelated key import in the process, so the type decides that case first. */
-  if (ka.asymmetricKeyType !== kb.asymmetricKeyType) return false;
+  if (guard.crypto.keyType(ka) !== guard.crypto.keyType(kb)) return false;
   return _keyEquals(ka, kb) === true;
 }
 

package/lib/scep.js

@@ -77,7 +77,6 @@ var C = require("./constants");
 var httpTransport = require("./http-transport");
 var retryAfter = require("./http-retry-after");
 var _defaultSleep = require("./sleep").sleep;
-var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
 function _showValue(v) { return guard.text.showValue(v); }
@@ -103,7 +102,7 @@ var ENVELOPE_CIPHER = "aes-128-cbc";
 var EMPTY_CONTENT = Buffer.alloc(0);
 
 function _nonce(v, label) {
-  if (v == null) return nodeCrypto.randomBytes(16);
+  if (v == null) return guard.crypto.randomBytes(16);
   var buf = guard.bytes.snapshotSource(v, ScepError, "scep/bad-nonce", label);
   if (buf.length !== 16) throw _err("scep/bad-nonce", label + " must be exactly 16 bytes (RFC 8894 sec. 3.2.1.5), got " + buf.length);
   return buf;
@@ -746,7 +745,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
     return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
       var status = res.status;
@@ -903,7 +902,7 @@ function findIssuedCert(certs, wantSpki) {
 }
 function _normalizeFingerprint(fp, algName) {
   var algorithm = _foldLower(String(algName == null ? "sha256" : algName));
-  try { nodeCrypto.createHash(algorithm); }
+  try { guard.crypto.hash(algorithm); }
   catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + _showValue(algorithm) + " is not an available hash"); }
   var value;
   if (Buffer.isBuffer(fp)) value = Buffer.from(fp);
@@ -968,7 +967,7 @@ async function getCACert(baseUrl, opts) {
   if (fp != null) {
     var matched = null, j;
     for (j = 0; j < certs.length; j++) {
-      var got = nodeCrypto.createHash(fp.algorithm).update(certs[j]).digest();
+      var got = guard.crypto.digest(fp.algorithm, certs[j]);
       if (got.length === fp.value.length && got.equals(fp.value)) { matched = certs[j]; break; }
     }
     if (!matched) throw _err("scep/fingerprint-mismatch", "no GetCACert certificate matched the expected " + fp.algorithm + " fingerprint (RFC 8894 sec. 2.2)");
@@ -1030,7 +1029,7 @@ async function getNextCACert(baseUrl, opts) {
 }
 
 function _defaultTransactionId() {
-  return nodeCrypto.randomBytes(16).toString("hex");
+  return guard.crypto.randomBytes(16).toString("hex");
 }
 var POLL_COUNT_MAX = 1000;
 
@@ -1078,7 +1077,7 @@ async function _pollForIssuance(ctx) {
     if (waitedMs > ctx.maxTotalWait * C.TIME.seconds(1)) throw _pollExhausted("the total wait budget", ctx.transactionId, lastNonce);
     if (ctx.onRetryAfter) ctx.onRetryAfter(delaySec);
     await ctx.sleep(delaySec * C.TIME.seconds(1));
-    var sn = nodeCrypto.randomBytes(16);
+    var sn = guard.crypto.randomBytes(16);
     lastNonce = sn;
     var certPoll = await build({ messageType: "CertPoll", requestSubject: ctx.csrSubject, issuer: issuerName, recipient: ctx.caCert, signer: ctx.signer, transactionId: ctx.transactionId, senderNonce: sn });
     res = await _pkiRequest(ctx.httpMethod, ctx.postUrl, certPoll, ctx.clientOpts);
@@ -1125,7 +1124,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var maxTotalWait = guard.limits.cap(opts.maxTotalWait, "maxTotalWait", retryAfter.MAX_RETRY_AFTER_SECONDS, { E: _err, code: "scep/bad-input", min: 0, max: retryAfter.MAX_RETRY_AFTER_SECONDS });
   var sleep = typeof opts.sleep === "function" ? opts.sleep : _defaultSleep;
   var onRetryAfter = typeof opts.onRetryAfter === "function" ? opts.onRetryAfter : null;
-  var senderNonce = nodeCrypto.randomBytes(16);
+  var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var reqMsg = await build({ messageType: messageType, messageData: csrView, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce });
   var res = await _pkiRequest(httpMethod, postUrl, reqMsg, clientOpts);
@@ -1258,7 +1257,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var want = _resolveQueryTarget(opts);
   var clientOpts = { tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
   if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
-  var senderNonce = nodeCrypto.randomBytes(16);
+  var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var httpMethod = _pkiMethod(opts);
   var reqMsg = await build(Object.assign({ messageType: messageType, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce }, want.buildSpec));

package/lib/schema-engine.js

@@ -169,7 +169,7 @@ function time(ns) {
 
 function field(name, schema)          { return { fkind: "required", name: name, schema: schema }; }
 function optional(name, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var match = opts.whenAny
     ? function () { return true; }
     : opts.whenUniversal
@@ -182,51 +182,51 @@ function optional(name, schema, opts) {
            defaultCode: opts.defaultCode };
 }
 function trailing(members, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { fkind: "trailing", members: members, minTag: opts.minTag, maxTag: opts.maxTag,
            unexpectedCode: opts.unexpectedCode, orderCode: opts.orderCode };
 }
 
 
 function seq(fields, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }
 
 function explicit(tag, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "explicit", tag: tag, schema: schema, emptyCode: opts.emptyCode, code: opts.code, what: opts.what };
 }
 
 function choice(alts, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "choice", alts: alts, code: opts.code, what: opts.what };
 }
 
 function seqOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
-  return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
+  return setOf(item, Object.assign({ unique: keyFn }, opts || intrinsic.create(null)));
 }
 function implicitSetOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function implicitSeqOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
@@ -471,7 +471,7 @@ function _wrapConstructed(schema, parts) {
 function _present(v) { return v !== undefined && v !== null; }
 
 function _encodeSeq(schema, value, ctx) {
-  value = value || {};
+  value = value || intrinsic.create(null);
   var parts = [];
   for (var f = 0; f < schema.fields.length; f++) {
     var fld = schema.fields[f];
@@ -578,7 +578,7 @@ function _encodeChoice(schema, value, ctx) {
  *     { code: "app/bad-der", what: "the embedded structure" });
  */
 function embeddedDer(schema, bytes, ctx, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (opts.budget) {
     if (!(opts.budget.remaining > 0)) {
       throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +

package/lib/schema-pkix.js

@@ -330,7 +330,7 @@ function _blockCap(given, ceiling, what, PemError) {
  * label is the only thing separating a CERTIFICATE from a TRUSTED CERTIFICATE or a PRIVATE KEY, and
  * the byte offset it started at, so a fault in a file of hundreds names the one object it is about. */
 function pemDecodeBundle(text, opts, PemError, detect) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var maxBlocks = _blockCap(opts.maxBlocks, constants.LIMITS.PEM_MAX_BLOCKS, "maxBlocks", PemError);
   var maxDecoded = _blockCap(opts.maxDecodedBytes, constants.LIMITS.PEM_MAX_DECODED_BYTES, "maxDecodedBytes", PemError);
   var route = opts.route === true;
@@ -739,7 +739,7 @@ function versionReader(ns, accept) {
 }
 
 function algorithmIdentifier(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", schema.oidLeaf()),
     schema.optional("parameters", schema.any(), { whenAny: true }),
@@ -761,7 +761,7 @@ function algorithmIdentifier(ns, opts) {
  *  (RFC 5652 sec. 10.2.4). CMS names the type and RFC 9763 sec. 3.1 reuses it inside a CSR attribute,
  *  so the shape is defined once and each caller supplies its own code and name for the refusal. */
 function issuerAndSerialNumber(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("issuer", name(ns)),
     schema.field("serialNumber", schema.integerLeaf()),
@@ -952,7 +952,7 @@ function relativeDistinguishedName(ns) {
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
 function name(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   function nameBuild(m) {
     var rdns = [], parts = [];
     _forEach(m.items, function (rdnItem) {
@@ -978,7 +978,7 @@ function name(ns, opts) {
 }
 
 function generalizedTime(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-time");
   var message = opts.message || "the time must be a GeneralizedTime";
   var readOpts = opts.allowFractional ? { allowFractional: true } : undefined;
@@ -991,7 +991,7 @@ function generalizedTime(ns, opts) {
 }
 
 function utf8Text(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-freetext");
   var message = opts.message || "the element must be a UTF8String";
   return schema.decode(function (n, ctx) {
@@ -1003,7 +1003,7 @@ function utf8Text(ns, opts) {
 }
 
 function rawNonEmptySequence(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-sequence");
   var message = opts.message || "expected a non-empty universal SEQUENCE";
   return schema.decode(function (n, ctx) {
@@ -1069,7 +1069,7 @@ var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
 var DIRECTORY_STRING_TAGS = [asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING];
 function generalName(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-name");
   var decodeValue = opts.decodeValue === true;
   var subtreeBase = opts.subtreeBase === true;
@@ -1165,7 +1165,7 @@ function generalName(ns, opts) {
 }
 
 function generalNames(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-names");
   var gn = generalName(ns, { code: code, decodeValue: opts.decodeValue === true, subtreeBase: opts.subtreeBase === true });
   function build(m) { return { names: _map(m.items, function (it) { return it.value; }), bytes: m.node.bytes }; }
@@ -2528,7 +2528,7 @@ function extension(ns) {
   });
 }
 function extensions(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var EXT = extension(ns);
   var extOpts = {
     min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
@@ -2540,7 +2540,7 @@ function extensions(ns, opts) {
 }
 
 function spki(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", algorithmIdentifier(ns)),
     schema.field("subjectPublicKey", schema.bitString()),
@@ -2558,7 +2558,7 @@ function spki(ns, opts) {
 }
 
 function attribute(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var minValues = opts.minValues === undefined ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),

package/lib/schema-tsp.js

@@ -528,8 +528,8 @@ function essDigest(name) {
   var xof = ESS_XOF_BYTES[name];
   /** @internal One read of the name answers both whether the digest can be computed and how to
    *  compute it, so the hash every candidate is put through is the one that read settled. */
-  return function () {
-    return xof ? nodeCrypto.createHash(name, { outputLength: xof }) : nodeCrypto.createHash(name);
+  return function (bytes) {
+    return xof ? guard.crypto.xof(name, bytes, xof) : guard.crypto.digest(name, bytes);
   };
 }
 
@@ -579,7 +579,7 @@ function _essNamedCertificate(token, attr) {
   for (var j = 0; j < certs.length; j++) {
     var element = certs[j];
     if (!element || element.tagClass !== "universal" || !Buffer.isBuffer(element.bytes)) continue;
-    var actual = digest().update(element.bytes).digest();
+    var actual = digest(element.bytes);
     if (actual.length === want.length && guard.bytes.compare(actual, want) === 0) return element.bytes;
   }
   return null;

package/lib/shbs.js

@@ -21,7 +21,6 @@
  * @card Verify HSS/LMS signatures (post-quantum, CNSA 2.0 firmware signing).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 /** @internal The append every list here is built with: `push` stores at the index and a store
@@ -82,11 +81,9 @@ function _lmotsSet(code) {
 }
 
 function _hash(family, n, parts) {
-  var h;
-  if (family === "shake256") h = nodeCrypto.createHash("shake256", { outputLength: n });
-  else h = nodeCrypto.createHash("sha256");
-  for (var i = 0; i < parts.length; i++) h.update(parts[i]);
-  var d = h.digest();
+  var d = family === "shake256"
+    ? guard.crypto.digestParts("shake256", parts, n)
+    : guard.crypto.digestParts("sha256", parts);
   return (family === "shake256" || n === 32) ? d : d.subarray(0, n);
 }
 

package/lib/sign-scheme.js

@@ -124,7 +124,7 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _resolveSignScheme(cert, so, noSignedAttrs, E) {
-  so = so || {};
+  so = so || intrinsic.create(null);
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
@@ -180,7 +180,7 @@ function _resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _assertKeyMatchesScheme(key, imp, E, what) {
-  var ka = key.algorithm || {};
+  var ka = key.algorithm || intrinsic.create(null);
   var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")
@@ -359,14 +359,14 @@ function _keyTypeAccepts(reported, wanted) {
 }
 
 function _assertKeyObjectMatchesScheme(key, scheme, E) {
-  var reported = key.asymmetricKeyType;
+  var reported = guard.crypto.keyType(key);
   var wanted = NODE_KEY_TYPE[scheme.imp.name] || _toLowerCase(_String(scheme.imp.name));
   if (!_keyTypeAccepts(reported, wanted)) {
     throw E("bad-input", "the signer KeyObject algorithm (" + reported +
       ") does not match the certificate's key algorithm (" + scheme.imp.name + ")");
   }
   if (scheme.imp.namedCurve) {
-    var details = key.asymmetricKeyDetails;
+    var details = guard.crypto.keyDetails(key);
     var curve = details && details.namedCurve;
     if (curve !== NODE_CURVE[scheme.imp.namedCurve]) {
       throw E("bad-input", "the signer KeyObject curve (" + curve +

package/lib/sigstore.js

@@ -28,7 +28,6 @@
  * @card Verify an npm --provenance Sigstore bundle offline (DSSE + Fulcio + Rekor + SLSA).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -227,8 +226,8 @@ function _assertKeyDetailsParameters(want, leafSpki, declared) {
   if (want.bits !== undefined) {
     var bits;
     try {
-      bits = guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })
-        .asymmetricKeyDetails.modulusLength;
+      bits = guard.crypto.keyDetails(
+        guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })).modulusLength;
     } catch (_e) { bits = null; }   // allow:swallow-unverified -- a key that will not import has no modulus size to match, and the mismatch below is the verdict
     if (bits !== want.bits) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
@@ -709,13 +708,14 @@ function _chainDers(vm) {
 }
 
 function _rawVerify(keyObj, data, derSig) {
-  var t = keyObj.asymmetricKeyType;
+  var t = guard.crypto.keyType(keyObj);
   if (t === "ed25519" || t === "ed448") {
     var edSpki = guard.crypto.exportKey(keyObj, { type: "spki", format: "der" });
     edwardsPoint.validateSpki(edSpki, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
     return guard.crypto.verify(null, data, keyObj, derSig);
   }
-  var crv = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
+  var keyObjDetails = guard.crypto.keyDetails(keyObj);
+  var crv = keyObjDetails && keyObjDetails.namedCurve;
   var hash = crv === "secp384r1" ? "sha384" : (crv === "secp521r1" ? "sha512" : "sha256");
   return guard.crypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
@@ -723,7 +723,7 @@ function _pubFromSpki(spkiDer, label) {
   var key;
   try { key = guard.crypto.publicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
-  var t = key.asymmetricKeyType;
+  var t = guard.crypto.keyType(key);
   if (t === "ed25519" || t === "ed448") {
     edwardsPoint.validateSpki(spkiDer, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
   }
@@ -735,7 +735,7 @@ function _parseCert(der, label) {
 }
 
 
-function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).digest(); }
+function _sha256(buf) { return guard.crypto.digest("sha256", buf); }
 
 function _toMs(x) {
   if (x == null) return null;
@@ -1109,7 +1109,7 @@ function _bindHashedRekordV002Entry(body, arm, leafDer, contentType, payloadType
   }
   var digest = _b64(data.digest, "hashedRekordV002.data.digest");
   if (contentType === "dsseEnvelope") {
-    var computed = nodeCrypto.createHash(alg.node).update(pae(payloadType, payload)).digest();
+    var computed = guard.crypto.digest(alg.node, pae(payloadType, payload));
     if (!guard.crypto.constantTimeEqual(computed, digest)) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry digest is not the hash of this envelope's " +
         "signing preimage, so the entry records a different signature than the bundle carries");
@@ -1715,7 +1715,7 @@ async function verifyBundle(bundle, opts) {
   if (bundle === null || typeof bundle !== "object" && typeof bundle !== "string" && !_isBuffer(bundle)) {
     throw new TypeError("verifyBundle: bundle must be an object, JSON string, or Buffer");
   }
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_BUNDLE_OPTS, _err, "sigstore/bad-input", "pki.sigstore.verifyBundle has an unknown option ");
   /** @internal parseBundle takes the copy, so every check below runs on plain data that cannot change
    * under it, whichever field it reads and however many times. */
@@ -1831,7 +1831,7 @@ async function verifyBundle(bundle, opts) {
   var artifactDigests = intrinsic.create(null);
   function _artifactDigest(nodeName) {
     if (!intrinsic.hasOwn(artifactDigests, nodeName)) {
-      artifactDigests[nodeName] = nodeCrypto.createHash(nodeName).update(artifact).digest();
+      artifactDigests[nodeName] = guard.crypto.digest(nodeName, artifact);
     }
     return artifactDigests[nodeName];
   }