@breakside/jskit 2024.33.0 → 2024.40.0

package/Frameworks/SecurityKit.jsframework/JS/SECSign+Node.js

@@ -46,306 +46,131 @@ SECSign.definePropertiesFromExtensions({
         if (this.nodeAlgorithm.name == "rsa"){
             nodeOptions.modulusLength = options.modulusLength || 2048;
             nodeOptions.publicExponent = options.publicExponent || 0x10001;
-            nodeOptions.publicKeyEncoding = {
-                type: 'pkcs1',
-                format: 'pem'
-            };
-            nodeOptions.privateKeyEncoding = {
-                type: 'pkcs1',
-                format: 'pem'
-            };
         }else if (this.nodeAlgorithm.name == "ec"){
             if (options.namedCurve){
                 nodeOptions.namedCurve = nodeNamedCurves[options.namedCurve];
             }else{
                 nodeOptions.namedCurve = this.nodeAlgorithm.namedCurve;
             }
-            nodeOptions.publicKeyEncoding = {
-                type: "spki",
-                format: "pem"
-            };
-            nodeOptions.privateKeyEncoding = {
-                type: "sec1",
-                format: "pem"
-            };
         }
-        crypto.generateKeyPair(this.nodeAlgorithm.name, nodeOptions, function(err, publicKeyPem, privateKeyPem){
+        crypto.generateKeyPair(this.nodeAlgorithm.name, nodeOptions, function(err, publicKey, privateKey){
             if (err){
                 completion.call(target, null);
                 return;
             }
             var pair = {
-                public: SECNodeKey.initWithData(publicKeyPem.utf8()),
-                private: SECNodeKey.initWithData(privateKeyPem.utf8()),
+                public: SECNodeKey.initWithNodeKeyObject(publicKey),
+                private: SECNodeKey.initWithNodeKeyObject(privateKey),
             };
+            pair.public.id = pair.private.id = JSSHA1Hash(UUID.init().bytes).base64URLStringRepresentation();
             completion.call(target, pair);
         });
         return completion.promise;
     },
 
-    createJWKPair: function(options, completion, target){
-        if (!completion){
-            completion = Promise.completion(Promise.resolveNonNull);
-        }
-        this.createKeyPair(options, function(pair){
-            if (pair === null){
-                completion.call(target, null);
-                return;
-            }
-            var jwkPair = null;
-            try{
-                var kid = JSSHA1Hash(UUID.init().bytes).base64URLStringRepresentation();
-                var alg = null;
-                var kty = null;
-                switch (this.algorithm){
-                    case SECSign.Algorithm.rsaSHA256:
-                        alg = SECJSONWebAlgorithms.Algorithm.rsaSHA256;
-                        kty = SECJSONWebAlgorithms.KeyType.rsa;
-                        break;
-                    case SECSign.Algorithm.rsaSHA384:
-                        alg = SECJSONWebAlgorithms.Algorithm.rsaSHA384;
-                        kty = SECJSONWebAlgorithms.KeyType.rsa;
-                        break;
-                    case SECSign.Algorithm.rsaSHA512:
-                        alg = SECJSONWebAlgorithms.Algorithm.rsaSHA512;
-                        kty = SECJSONWebAlgorithms.KeyType.rsa;
-                        break;
-                    case SECSign.Algorithm.ellipticCurveSHA256:
-                        alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA256;
-                        kty = SECJSONWebAlgorithms.KeyType.ellipticCurve;
-                        break;
-                    case SECSign.Algorithm.ellipticCurveSHA384:
-                        alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA384;
-                        kty = SECJSONWebAlgorithms.KeyType.ellipticCurve;
-                        break;
-                    case SECSign.Algorithm.ellipticCurveSHA512:
-                        alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA512;
-                        kty = SECJSONWebAlgorithms.KeyType.ellipticCurve;
-                        break;
-                    default:
-                        throw new Error("Unable to map SECSign algorithm to JWK");
-                }
-                var publicJWK = {
-                    kid: kid,
-                    kty: kty,
-                    alg: alg,
-                    key_ops: ["verify"]
-                };
-                var privateJWK = {
-                    kid: kid,
-                    kty: kty,
-                    alg: alg,
-                    key_ops: ["sign"]
-                };
-                var pem;
-                var parser;
-                var sequence;
-                if (kty == SECJSONWebAlgorithms.KeyType.rsa){
-                    pem = pair.public.keyData;
-                    parser = SECASN1Parser.initWithPEM(pem, "RSA PUBLIC KEY");
-                    sequence = parser.parse();
-                    publicJWK.n = sequence.values[0].data.base64URLStringRepresentation();
-                    publicJWK.e = sequence.values[1].data.base64URLStringRepresentation();
-
-                    pem = pair.private.keyData;
-                    parser = SECASN1Parser.initWithPEM(pem, "RSA PRIVATE KEY");
-                    sequence = parser.parse();
-                    privateJWK.n = sequence.values[1].data.base64URLStringRepresentation();
-                    privateJWK.e = sequence.values[2].data.base64URLStringRepresentation();
-                    privateJWK.d = sequence.values[3].data.base64URLStringRepresentation();
-                    if (sequence.values.length >= 9){
-                        privateJWK.p = sequence.values[4].data.base64URLStringRepresentation();
-                        privateJWK.q = sequence.values[5].data.base64URLStringRepresentation();
-                        privateJWK.dp = sequence.values[6].data.base64URLStringRepresentation();
-                        privateJWK.dq = sequence.values[7].data.base64URLStringRepresentation();
-                        privateJWK.qi = sequence.values[8].data.base64URLStringRepresentation();
-                    }
-                }else if (kty == SECJSONWebAlgorithms.KeyType.ellipticCurve){
-                    pem = pair.public.keyData;
-                    parser = SECASN1Parser.initWithPEM(pem, "PUBLIC KEY");
-                    sequence = parser.parse();
-                    if (sequence.values[0].values[0].stringValue != "1.2.840.10045.2.1"){
-                        throw new Error("Expecting id-ecPublicKey");
-                    }
-                    var derCurve = sequence.values[0].values[1].stringValue;
-                    var pointLength;
-                    switch (derCurve){
-                        case derNamedCurves[SECSign.EllipticCurve.p256]:
-                            publicJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p256;
-                            pointLength = 32;
-                            break;
-                        case derNamedCurves[SECSign.EllipticCurve.p384]:
-                            publicJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p384;
-                            pointLength = 48;
-                            break;
-                        case derNamedCurves[SECSign.EllipticCurve.p521]:
-                            publicJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p521;
-                            pointLength = 66;
-                            break;
-                        default:
-                            throw new Error("Unknown elliptic curve");
-                    }
-                    var points = sequence.values[1].data;
-                    if (points[0] != 0x4){
-                        throw new Error("Compressed points not implemented");
-                    }
-                    if (points.length != pointLength + pointLength + 1){
-                        throw new Error("Unexpected point length");
-                    }
-                    publicJWK.x = points.subdataInRange(JSRange(1, pointLength)).base64URLStringRepresentation();
-                    publicJWK.y = points.subdataInRange(JSRange(1 + pointLength, pointLength)).base64URLStringRepresentation();
-
-
-                    pem = pair.private.keyData;
-                    parser = SECASN1Parser.initWithPEM(pem, "EC PRIVATE KEY");
-                    sequence = parser.parse();
-                    var version = sequence.values[0].data[0];
-                    if (version != 1){
-                        throw new Error("Unexpected EC private key version");
-                    }
-                    privateJWK.d = sequence.values[1].data.base64URLStringRepresentation();
-                    var optional = sequence.values[2];
-                    if (optional.classNumber !== 0){
-                        throw new Error("Expecting EC named curve");
-                    }
-                    derCurve = optional.value.stringValue;
-                    switch (derCurve){
-                        case derNamedCurves[SECSign.EllipticCurve.p256]:
-                            privateJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p256;
-                            pointLength = 32;
-                            break;
-                        case derNamedCurves[SECSign.EllipticCurve.p384]:
-                            privateJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p384;
-                            pointLength = 48;
-                            break;
-                        case derNamedCurves[SECSign.EllipticCurve.p521]:
-                            privateJWK.crv = SECJSONWebAlgorithms.EllipticCurve.p521;
-                            pointLength = 66;
-                            break;
-                        default:
-                            throw new Error("Unknown elliptic curve");
-                    }
-                    optional = sequence.values[3];
-                    if (optional.classNumber !== 1){
-                        throw new Error("Expecting EC point");
-                    }
-                    points = optional.value.data;
-                    if (points[0] != 0x4){
-                        throw new Error("Compressed points not implemented");
-                    }
-                    if (points.length != pointLength + pointLength + 1){
-                        throw new Error("Unexpected point length");
-                    }
-                    privateJWK.x = points.subdataInRange(JSRange(1, pointLength)).base64URLStringRepresentation();
-                    privateJWK.y = points.subdataInRange(JSRange(1 + pointLength, pointLength)).base64URLStringRepresentation();
-                }
-                jwkPair = {
-                    public: publicJWK,
-                    private: privateJWK
-                };
-            }catch (e){
-            }
-            completion.call(target, jwkPair);
-        }, this);
-        return completion.promise;
-    },
-
     createKeyFromJWK: function(jwk, completion, target){
         if (!completion){
             completion = Promise.completion();
         }
-        var der, base64, pem, key;
-        if (jwk.kty == SECJSONWebAlgorithms.KeyType.rsa){
-            // RSA private key ASN.1 syntax:
-            // RSAPrivateKey ::= SEQUENCE {
-            //     version           Version,
-            //     modulus           INTEGER,  -- n
-            //     publicExponent    INTEGER,  -- e
-            //     privateExponent   INTEGER,  -- d
-            //     prime1            INTEGER,  -- p
-            //     prime2            INTEGER,  -- q
-            //     exponent1         INTEGER,  -- d mod (p-1)
-            //     exponent2         INTEGER,  -- d mod (q-1)
-            //     coefficient       INTEGER,  -- (inverse of q) mod p
-            //     otherPrimeInfos   OtherPrimeInfos OPTIONAL
-            // }
-            // 
-            if (typeof(jwk.n) == "string" && typeof(jwk.e) == "string" && typeof(jwk.d) == "string"){
-                try{
-                    var values = [
-                        SECASN1Integer.initWithData(JSData.initWithArray([0])),
-                        SECASN1Integer.initWithData(jwk.n.dataByDecodingBase64URL()),
-                        SECASN1Integer.initWithData(jwk.e.dataByDecodingBase64URL()),
-                        SECASN1Integer.initWithData(jwk.d.dataByDecodingBase64URL()),
-                    ];
-
-                    if (typeof(jwk.p) == "string" && typeof(jwk.q) == "string" && typeof(jwk.dp) == "string" && typeof(jwk.dq) == "string" && typeof(jwk.qi) == "string"){
-                        values.push(SECASN1Integer.initWithData(jwk.p.dataByDecodingBase64URL()));
-                        values.push(SECASN1Integer.initWithData(jwk.q.dataByDecodingBase64URL()));
-                        values.push(SECASN1Integer.initWithData(jwk.dp.dataByDecodingBase64URL()));
-                        values.push(SECASN1Integer.initWithData(jwk.dq.dataByDecodingBase64URL()));
-                        values.push(SECASN1Integer.initWithData(jwk.qi.dataByDecodingBase64URL()));
-                    }
-
-                    if (jwk.oth){
-                        JSRunLoop.main.schedule(completion, target, null);
-                        return completion.promise;
-                    }
-
-                    var rsaPrivateKey = SECASN1Sequence.initWithValues(values);
-                    pem = rsaPrivateKey.pemRepresentation("RSA PRIVATE KEY");
-                    key = SECNodeKey.initWithData(pem.utf8());
-                    JSRunLoop.main.schedule(completion, target, key);
-                }catch (e){
-                    JSRunLoop.main.schedule(completion, target, null);
-                }
-            }else{
-                JSRunLoop.main.schedule(completion, target, null);
-            }
-        }else if (jwk.kty == SECJSONWebAlgorithms.KeyType.ellipticCurve){
-            // ECPrivateKey ::= SEQUENCE {
-            //   version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
-            //   privateKey     OCTET STRING,
-            //   parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
-            //   publicKey  [1] BIT STRING OPTIONAL
-            // }
-            try{
-                var namedCurve;
-                switch (jwk.crv){
-                    case SECJSONWebAlgorithms.EllipticCurve.p256:
-                        namedCurve = derNamedCurves[SECSign.EllipticCurve.p256];
-                        break;
-                    case SECJSONWebAlgorithms.EllipticCurve.p384:
-                        namedCurve = derNamedCurves[SECSign.EllipticCurve.p384];
-                        break;
-                    case SECJSONWebAlgorithms.EllipticCurve.p521:
-                        namedCurve = derNamedCurves[SECSign.EllipticCurve.p521];
-                        break;
-                    default:
-                        throw new Error("Unsupported curve name");
-                }
-                var privateKey = SECASN1Sequence.initWithValues([
-                    SECASN1Integer.initWithData(JSData.initWithArray([1])),
-                    SECASN1OctetString.initWithData(jwk.d.dataByDecodingBase64URL()),
-                    SECASN1Optional.initWithValue(
-                        SECASN1ObjectIdentifier.initWithString(namedCurve),
-                        0
-                    ),
-                    SECASN1Optional.initWithValue(
-                        SECASN1BitString.initWithData(JSData.initWithChunks([
-                            JSData.initWithArray([0x04]), // uncompressed
-                            jwk.x.dataByDecodingBase64URL(),
-                            jwk.y.dataByDecodingBase64URL()
-                        ]), 0),
-                        1
-                    )
-                ]);
-                pem = privateKey.pemRepresentation("EC PRIVATE KEY");
-                key = SECNodeKey.initWithData(pem.utf8());
-                JSRunLoop.main.schedule(completion, target, key);
-            }catch (e){
-                JSRunLoop.main.schedule(completion, target, null);
+        var der, base64, pem, nodeKeyObject, key;
+        if (jwk.kty === SECJSONWebAlgorithms.KeyType.rsa || jwk.kty === SECJSONWebAlgorithms.KeyType.ellipticCurve){
+            nodeKeyObject = crypto.createPrivateKey({key: jwk, format: "jwk"});
+            key = SECNodeKey.initWithNodeKeyObject(nodeKeyObject);
+            if (key !== null){
+                key.id = jwk.kid || null;
             }
+            JSRunLoop.main.schedule(completion, target, key);
+        // if (jwk.kty == SECJSONWebAlgorithms.KeyType.rsa){
+        //     // RSA private key ASN.1 syntax:
+        //     // RSAPrivateKey ::= SEQUENCE {
+        //     //     version           Version,
+        //     //     modulus           INTEGER,  -- n
+        //     //     publicExponent    INTEGER,  -- e
+        //     //     privateExponent   INTEGER,  -- d
+        //     //     prime1            INTEGER,  -- p
+        //     //     prime2            INTEGER,  -- q
+        //     //     exponent1         INTEGER,  -- d mod (p-1)
+        //     //     exponent2         INTEGER,  -- d mod (q-1)
+        //     //     coefficient       INTEGER,  -- (inverse of q) mod p
+        //     //     otherPrimeInfos   OtherPrimeInfos OPTIONAL
+        //     // }
+        //     // 
+        //     if (typeof(jwk.n) == "string" && typeof(jwk.e) == "string" && typeof(jwk.d) == "string"){
+        //         try{
+        //             var values = [
+        //                 SECASN1Integer.initWithData(JSData.initWithArray([0])),
+        //                 SECASN1Integer.initWithData(jwk.n.dataByDecodingBase64URL()),
+        //                 SECASN1Integer.initWithData(jwk.e.dataByDecodingBase64URL()),
+        //                 SECASN1Integer.initWithData(jwk.d.dataByDecodingBase64URL()),
+        //             ];
+
+        //             if (typeof(jwk.p) == "string" && typeof(jwk.q) == "string" && typeof(jwk.dp) == "string" && typeof(jwk.dq) == "string" && typeof(jwk.qi) == "string"){
+        //                 values.push(SECASN1Integer.initWithData(jwk.p.dataByDecodingBase64URL()));
+        //                 values.push(SECASN1Integer.initWithData(jwk.q.dataByDecodingBase64URL()));
+        //                 values.push(SECASN1Integer.initWithData(jwk.dp.dataByDecodingBase64URL()));
+        //                 values.push(SECASN1Integer.initWithData(jwk.dq.dataByDecodingBase64URL()));
+        //                 values.push(SECASN1Integer.initWithData(jwk.qi.dataByDecodingBase64URL()));
+        //             }
+
+        //             if (jwk.oth){
+        //                 JSRunLoop.main.schedule(completion, target, null);
+        //                 return completion.promise;
+        //             }
+
+        //             var rsaPrivateKey = SECASN1Sequence.initWithValues(values);
+        //             pem = rsaPrivateKey.pemRepresentation("RSA PRIVATE KEY");
+        //             key = SECNodeKey.initWithData(pem.utf8());
+        //             JSRunLoop.main.schedule(completion, target, key);
+        //         }catch (e){
+        //             JSRunLoop.main.schedule(completion, target, null);
+        //         }
+        //     }else{
+        //         JSRunLoop.main.schedule(completion, target, null);
+        //     }
+        // }else if (jwk.kty == SECJSONWebAlgorithms.KeyType.ellipticCurve){
+        //     // ECPrivateKey ::= SEQUENCE {
+        //     //   version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
+        //     //   privateKey     OCTET STRING,
+        //     //   parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
+        //     //   publicKey  [1] BIT STRING OPTIONAL
+        //     // }
+        //     try{
+        //         var namedCurve;
+        //         switch (jwk.crv){
+        //             case SECJSONWebAlgorithms.EllipticCurve.p256:
+        //                 namedCurve = derNamedCurves[SECSign.EllipticCurve.p256];
+        //                 break;
+        //             case SECJSONWebAlgorithms.EllipticCurve.p384:
+        //                 namedCurve = derNamedCurves[SECSign.EllipticCurve.p384];
+        //                 break;
+        //             case SECJSONWebAlgorithms.EllipticCurve.p521:
+        //                 namedCurve = derNamedCurves[SECSign.EllipticCurve.p521];
+        //                 break;
+        //             default:
+        //                 throw new Error("Unsupported curve name");
+        //         }
+        //         var privateKey = SECASN1Sequence.initWithValues([
+        //             SECASN1Integer.initWithData(JSData.initWithArray([1])),
+        //             SECASN1OctetString.initWithData(jwk.d.dataByDecodingBase64URL()),
+        //             SECASN1Optional.initWithValue(
+        //                 SECASN1ObjectIdentifier.initWithString(namedCurve),
+        //                 0
+        //             ),
+        //             SECASN1Optional.initWithValue(
+        //                 SECASN1BitString.initWithData(JSData.initWithChunks([
+        //                     JSData.initWithArray([0x04]), // uncompressed
+        //                     jwk.x.dataByDecodingBase64URL(),
+        //                     jwk.y.dataByDecodingBase64URL()
+        //                 ]), 0),
+        //                 1
+        //             )
+        //         ]);
+        //         pem = privateKey.pemRepresentation("EC PRIVATE KEY");
+        //         key = SECNodeKey.initWithData(pem.utf8());
+        //         JSRunLoop.main.schedule(completion, target, key);
+        //     }catch (e){
+        //         JSRunLoop.main.schedule(completion, target, null);
+        //     }
         }else{
             JSRunLoop.main.schedule(completion, target, null);
         }
@@ -361,7 +186,7 @@ SECSign.definePropertiesFromExtensions({
             completion = Promise.completion();
         }
         this.nodeSign.end();
-        var signature = this.nodeSign.sign(key.keyData);
+        var signature = this.nodeSign.sign(key.nodeKeyObject);
         completion.call(target, JSData.initWithNodeBuffer(signature));
         return completion.promise;
     }

package/Frameworks/SecurityKit.jsframework/JS/SECSign.js

@@ -38,6 +38,33 @@ JSClass("SECSign", JSObject, {
     },
 
     createJWKPair: function(options, completion, target){
+        if (!completion){
+            completion = Promise.completion(Promise.resolveNonNull);
+        }
+        this.createKeyPair(options, function(pair){
+            if (pair === null){
+                completion.call(target, null);
+                return;
+            }
+            pair.private.getJWK(function(privateJWK){
+                if (privateJWK === null){
+                    completion.call(target, null);
+                    return;
+                }
+                pair.public.getJWK(function(publicJWK){
+                    if (publicJWK === null){
+                        completion.call(target, null);
+                        return;
+                    }
+                    var pair = {
+                        public: publicJWK,
+                        private: privateJWK
+                    };
+                    completion.call(target, pair);
+                }, this);
+            }, this);
+        }, this);
+        return completion.promise;
     },
 
     createKeyFromJWK: function(jwk, completion, target){        

package/Frameworks/SecurityKit.jsframework/JS/SECVerify+Node.js

@@ -43,7 +43,7 @@ SECVerify.definePropertiesFromExtensions({
         if (!completion){
             completion = Promise.completion();
         }
-        var verified = this.nodeVerify.verify(key.keyData, signature);
+        var verified = this.nodeVerify.verify(key.nodeKeyObject, signature);
         completion.call(target, verified);
         return completion.promise;
     },
@@ -53,63 +53,66 @@ SECVerify.definePropertiesFromExtensions({
             completion = Promise.completion();
         }
         var der, base64, pem, key;
-        if (jwk.kty == SECJSONWebAlgorithms.KeyType.rsa){
-            // RSA public key ASN.1 syntax:
-            // RSAPublicKey ::= SEQUENCE {
-            //     modulus           INTEGER,  -- n
-            //     publicExponent    INTEGER   -- e
-            // }
-            // 
+        if (jwk.kty === SECJSONWebAlgorithms.KeyType.rsa || jwk.kty === SECJSONWebAlgorithms.KeyType.ellipticCurve){
+            key = crypto.createPublicKey({key: jwk, format: "jwk"});
+            JSRunLoop.main.schedule(completion, target, SECNodeKey.initWithNodeKeyObject(key));
+        // if (jwk.kty == SECJSONWebAlgorithms.KeyType.rsa){
+        //     // RSA public key ASN.1 syntax:
+        //     // RSAPublicKey ::= SEQUENCE {
+        //     //     modulus           INTEGER,  -- n
+        //     //     publicExponent    INTEGER   -- e
+        //     // }
+        //     // 
 
-            if (typeof(jwk.n) == "string" && typeof(jwk.e) == "string"){
-                try{
-                    var rsaPublicKey = SECASN1Sequence.initWithValues([
-                        SECASN1Integer.initWithData(jwk.n.dataByDecodingBase64URL()),
-                        SECASN1Integer.initWithData(jwk.e.dataByDecodingBase64URL())
-                    ]);
-                    pem = rsaPublicKey.pemRepresentation("RSA PUBLIC KEY");
-                    key = SECNodeKey.initWithData(pem.utf8());
-                    JSRunLoop.main.schedule(completion, target, key);
-                }catch (e){
-                    JSRunLoop.main.schedule(completion, target, null);
-                }
-            }else{
-                JSRunLoop.main.schedule(completion, target, null);
-            }
-        }else if (jwk.kty == SECJSONWebAlgorithms.KeyType.ellipticCurve){
-            // SPKI format
-            try{
-                var derCurve;
-                switch (jwk.crv){
-                    case SECJSONWebAlgorithms.EllipticCurve.p256:
-                        derCurve = derNamedCurves[SECVerify.EllipticCurve.p256];
-                        break;
-                    case SECJSONWebAlgorithms.EllipticCurve.p384:
-                        derCurve = derNamedCurves[SECVerify.EllipticCurve.p384];
-                        break;
-                    case SECJSONWebAlgorithms.EllipticCurve.p384:
-                        derCurve = derNamedCurves[SECVerify.EllipticCurve.p384];
-                        break;
-                    default:
-                        throw new Error("Unknown jwk.crv");
-                }
-                var publicKey = SECASN1Sequence.initWithValues([
-                    SECASN1Sequence.initWithValues([
-                        SECASN1ObjectIdentifier.initWithString("1.2.840.10045.2.1"),
-                        SECASN1ObjectIdentifier.initWithString(derCurve),
-                    ]),
-                    SECASN1BitString.initWithData(JSData.initWithChunks([
-                        JSData.initWithArray([0x4]), // uncompressed
-                        jwk.x.dataByDecodingBase64URL(),
-                        jwk.y.dataByDecodingBase64URL()
-                    ]), 0)
-                ]);
-                pem = publicKey.pemRepresentation("PUBLIC KEY");
-                key = SECNodeKey.initWithData(pem.utf8());
-                JSRunLoop.main.schedule(completion, target, key);
-            }catch (e){
-                JSRunLoop.main.schedule(completion, target, null);
-            }
+        //     if (typeof(jwk.n) == "string" && typeof(jwk.e) == "string"){
+        //         try{
+        //             var rsaPublicKey = SECASN1Sequence.initWithValues([
+        //                 SECASN1Integer.initWithData(jwk.n.dataByDecodingBase64URL()),
+        //                 SECASN1Integer.initWithData(jwk.e.dataByDecodingBase64URL())
+        //             ]);
+        //             pem = rsaPublicKey.pemRepresentation("RSA PUBLIC KEY");
+        //             key = SECNodeKey.initWithData(pem.utf8());
+        //             JSRunLoop.main.schedule(completion, target, key);
+        //         }catch (e){
+        //             JSRunLoop.main.schedule(completion, target, null);
+        //         }
+        //     }else{
+        //         JSRunLoop.main.schedule(completion, target, null);
+        //     }
+        // }else if (jwk.kty == SECJSONWebAlgorithms.KeyType.ellipticCurve){
+        //     // SPKI format
+        //     try{
+        //         var derCurve;
+        //         switch (jwk.crv){
+        //             case SECJSONWebAlgorithms.EllipticCurve.p256:
+        //                 derCurve = derNamedCurves[SECVerify.EllipticCurve.p256];
+        //                 break;
+        //             case SECJSONWebAlgorithms.EllipticCurve.p384:
+        //                 derCurve = derNamedCurves[SECVerify.EllipticCurve.p384];
+        //                 break;
+        //             case SECJSONWebAlgorithms.EllipticCurve.p384:
+        //                 derCurve = derNamedCurves[SECVerify.EllipticCurve.p384];
+        //                 break;
+        //             default:
+        //                 throw new Error("Unknown jwk.crv");
+        //         }
+        //         var publicKey = SECASN1Sequence.initWithValues([
+        //             SECASN1Sequence.initWithValues([
+        //                 SECASN1ObjectIdentifier.initWithString("1.2.840.10045.2.1"),
+        //                 SECASN1ObjectIdentifier.initWithString(derCurve),
+        //             ]),
+        //             SECASN1BitString.initWithData(JSData.initWithChunks([
+        //                 JSData.initWithArray([0x4]), // uncompressed
+        //                 jwk.x.dataByDecodingBase64URL(),
+        //                 jwk.y.dataByDecodingBase64URL()
+        //             ]), 0)
+        //         ]);
+        //         pem = publicKey.pemRepresentation("PUBLIC KEY");
+        //         key = SECNodeKey.initWithData(pem.utf8());
+        //         JSRunLoop.main.schedule(completion, target, key);
+        //     }catch (e){
+        //         JSRunLoop.main.schedule(completion, target, null);
+        //     }
         }else{
             JSRunLoop.main.schedule(completion, target, null);
         }

package/Frameworks/SecurityKit.jsframework/JS/SecurityKit.js

@@ -21,6 +21,7 @@
 // #import "SECKeychain.js"
 // #import "SECJSONWebAlgorithms.js"
 // #import "SECJSONWebToken.js"
+// #import "SECJSONWebEncryption.js"
 // #import "SECPassword.js"
 // #import "SECASN1.js"
 // #import "SECASN1Parser.js"

package/Frameworks/SecurityKit.jsframework/io.breakside.JSKit.SecurityKit-bundle.js

@@ -3,7 +3,7 @@ JSBundle.bundles['io.breakside.JSKit.SecurityKit'] = {
   "Info": {
     "JSBundleType": "framework",
     "JSBundleIdentifier": "io.breakside.JSKit.SecurityKit",
-    "JSBundleVersion": "2024.33.0",
+    "JSBundleVersion": "2024.40.0",
     "JSDevelopmentLanguage": "en",
     "JSCopyright": "Copyright © 2020 Breakside Inc.",
     "JSBundleEnvironments": {
@@ -11,7 +11,7 @@ JSBundle.bundles['io.breakside.JSKit.SecurityKit'] = {
       "node": "SecurityKit+Node.js"
     },
     "JSLicenseNotice": "Licensed under the Breakside Public License, Version 1.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nIf a copy of the License was not distributed with this file, you may\nobtain a copy at\n\n    http://breakside.io/licenses/LICENSE-1.0.txt\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n",
-    "GitRevision": "2677079d37e78e1708c6e0985e71548b6001c1b6"
+    "GitRevision": "f17cafe60642c3c9674095789dec1d1803b72586"
   },
   "Resources": [],
   "ResourceLookup": {

package/Frameworks/SecurityKit.jsframework/sources.json

@@ -14,6 +14,7 @@
       "SECHMAC.js",
       "SECSign.js",
       "SECJSONWebToken.js",
+      "SECJSONWebEncryption.js",
       "SECPassword.js",
       "SECASN1.js",
       "SECASN1Parser.js",
@@ -29,9 +30,11 @@
       "SECDataKey",
       "SECJSONWebAlgorithms",
       "SECCipher",
+      "SECCipherAES",
       "SECCipherAESCipherBlockChaining",
       "SECCipherAESCounter",
       "SECCipherAESGaloisCounterMode",
+      "SECCipherRSAOAEP",
       "SECCipherRC4",
       "SECHash",
       "SECVerify",
@@ -39,6 +42,7 @@
       "SECHMAC",
       "SECSign",
       "SECJSONWebToken",
+      "SECJSONWebEncryption",
       "SECPassword",
       "SECASN1Value",
       "SECASN1Boolean",
@@ -68,6 +72,7 @@
       "SECSign+HTML.js",
       "SECVerify+HTML.js",
       "SECPassword+HTML.js",
+      "SECCOSE.js",
       "SECHTMLDeviceAuthentication.js",
       "SECHTMLKeychain.js",
       "SecurityKit+HTML.js"
@@ -78,6 +83,7 @@
     ],
     "globals": [
       "SECHTMLKey",
+      "SECCOSE",
       "SECHTMLDeviceAuthentication",
       "SECHTMLPasswordCredentialKeychain"
     ]