@crossdyne/security 0.4.0-beta.1 → 0.5.0-beta.1

package/dist/index.js

@@ -46,16 +46,22 @@ var SecurityUtils = class {
       return 0n;
     return BigInt("0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join(""));
   }
-  /** Converts bigint to fixed-length big-endian bytes (pads/truncates). */
+  /** Converts bigint to fixed-length big-endian bytes (pads only; never truncates). */
   static bigIntToFixedBytes(bn, length) {
+    if (length <= 0)
+      throw new Error("Length must be positive.");
     let hex = bn.toString(16);
     if (hex.length % 2 !== 0)
       hex = "0" + hex;
-    if (hex.length > length * 2)
-      hex = hex.slice(hex.length - length * 2);
-    else
-      hex = hex.padStart(length * 2, "0");
-    return new Uint8Array(hex.match(/.{1,2}/g)?.map((b) => parseInt(b, 16)) || []);
+    const byteLength = hex.length / 2;
+    if (byteLength > length)
+      throw new Error(`Value byte length (${byteLength}) exceeds expected length (${length}). Possible data corruption or context mismatch.`);
+    hex = hex.padStart(length * 2, "0");
+    const bytes = new Uint8Array(length);
+    for (let i = 0; i < length; i++) {
+      bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return bytes;
   }
   /** Constant-time comparison of two Uint8Arrays. */
   static fixedTimeEquals(a, b) {
@@ -68,16 +74,26 @@ var SecurityUtils = class {
   }
   /** Modular exponentiation (base^exp mod mod) using binary exponentiation. */
   static expMod(base, exp, mod) {
-    let res = BigInt(1);
+    if (mod === 1n) return 0n;
+    let res = 1n;
     base = base % mod;
     while (exp > 0n) {
-      if (exp % 2n === 1n)
+      if ((exp & 1n) === 1n)
         res = res * base % mod;
-      base = base * base % mod;
-      exp = exp / 2n;
+      exp >>= 1n;
+      if (exp > 0n)
+        base = base * base % mod;
     }
     return res;
   }
+  static bigIntToRawBytes(bn) {
+    if (bn === 0n)
+      return new Uint8Array([0]);
+    let hex = bn.toString(16);
+    if (hex.length % 2 !== 0)
+      hex = "0" + hex;
+    return new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
+  }
 };
 
 // src/crypto/aes-gcm-options.ts
@@ -130,6 +146,97 @@ var AesGcmOptions = class _AesGcmOptions {
   }
 };
 
+// src/crypto/crypto-profile.ts
+var CryptoProfile = class {
+  /**
+   * Creates a new CryptoProfile.
+   * @param params - Object containing version, kdfOptions, aesGcmOptions.
+   */
+  constructor(params) {
+    this.version = params.version;
+    this.kdfOptions = params.kdfOptions;
+    this.aesGcmOptions = params.aesGcmOptions;
+  }
+};
+
+// src/crypto/crypto-version.ts
+var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
+  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
+  return CryptoVersion2;
+})(CryptoVersion || {});
+
+// src/crypto/kdf-options.ts
+var KdfOptions = class _KdfOptions {
+  constructor() {
+    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
+    this._hashAlgorithm = "SHA-256";
+  }
+  /** PBKDF2 iteration count (minimum 100_000). */
+  get pbkdf2Iterations() {
+    return this._pbkdf2Iterations;
+  }
+  set pbkdf2Iterations(v) {
+    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
+    this._pbkdf2Iterations = v;
+  }
+  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
+  get hashAlgorithm() {
+    return this._hashAlgorithm;
+  }
+  set hashAlgorithm(v) {
+    if (!SupportedHashAlgorithms.includes(v))
+      throw new RangeError(`Unsupported hash: ${v}`);
+    this._hashAlgorithm = v;
+  }
+  /** Validates iterations and hash algorithm. */
+  validate() {
+    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
+    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
+      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
+  }
+  /** Default preset: SHA-256, 600_000 iterations. */
+  static get default() {
+    return new _KdfOptions();
+  }
+  /** Fluent setter for {@link pbkdf2Iterations}. */
+  withPbkdf2Iterations(i) {
+    this.pbkdf2Iterations = i;
+    return this;
+  }
+  /** Fluent setter for {@link hashAlgorithm}. */
+  withHashAlgorithm(h) {
+    this.hashAlgorithm = h;
+    return this;
+  }
+  /** Validates and returns this instance. */
+  build() {
+    this.validate();
+    return this;
+  }
+};
+
+// src/crypto/crypto-profile-registry.ts
+var CryptoProfileRegistry = class {
+  static getProfile(version) {
+    switch (version) {
+      case 1 /* V1 */:
+        return new CryptoProfile({
+          version: 1 /* V1 */,
+          kdfOptions: KdfOptions.default,
+          aesGcmOptions: AesGcmOptions.default
+        });
+      default:
+        throw new Error(`Unsupported crypto version: ${version}`);
+    }
+  }
+  /** Latest supported profile (currently V1). */
+  static get latest() {
+    return this.getProfile(1 /* V1 */);
+  }
+};
+
 // src/crypto/crypto.service.ts
 var CryptoService = class {
   constructor() {
@@ -147,12 +254,13 @@ var CryptoService = class {
   * @param options - AES-GCM configuration; uses default if omitted.
   * @returns Base64-encoded ciphertext with prepended nonce.
   */
-  async encryptData(dataModel, key, options) {
-    const opts = options ?? AesGcmOptions.default;
+  async encryptData(dataModel, key, version = 1 /* V1 */) {
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
     opts.validate();
     const encoder = new TextEncoder();
     let jsonString;
-    if (dataModel instanceof Uint8Array) {
+    if (ArrayBuffer.isView(dataModel) && dataModel.constructor === Uint8Array) {
       jsonString = `"${SecurityUtils.toBase64(dataModel)}"`;
     } else {
       jsonString = JSON.stringify(dataModel);
@@ -180,9 +288,10 @@ var CryptoService = class {
       cryptoKey,
       plainBytes
     );
-    const result = new Uint8Array(opts.nonceSize + encryptedContent.byteLength);
-    result.set(nonce, 0);
-    result.set(new Uint8Array(encryptedContent), opts.nonceSize);
+    const result = new Uint8Array(1 + opts.nonceSize + encryptedContent.byteLength);
+    result[0] = version;
+    result.set(nonce, 1);
+    result.set(new Uint8Array(encryptedContent), 1 + opts.nonceSize);
     return SecurityUtils.toBase64(result);
   }
   /**
@@ -193,16 +302,19 @@ var CryptoService = class {
   * @returns Deserialized object, or null if input is empty.
   * @throws If authentication tag mismatch or corrupted data.
   */
-  async decryptData(encryptedBase64, key, options, isBytes = false) {
+  async decryptData(encryptedBase64, key, isBytes = false) {
     if (!encryptedBase64)
       return null;
-    const opts = options ?? AesGcmOptions.default;
-    opts.validate();
     const encryptedBytes = SecurityUtils.fromBase64(encryptedBase64);
-    if (encryptedBytes.length < opts.nonceSize + opts.tagSize)
+    const version = encryptedBytes[0];
+    const payload = encryptedBytes.slice(1);
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
+    opts.validate();
+    if (payload.length < opts.nonceSize + opts.tagSize)
       throw new Error(`Invalid format: minimum expected ${opts.nonceSize + opts.tagSize} byte.`);
-    const nonce = encryptedBytes.slice(0, opts.nonceSize);
-    const ciphertextWithTag = encryptedBytes.slice(opts.nonceSize);
+    const nonce = payload.slice(0, opts.nonceSize);
+    const ciphertextWithTag = payload.slice(opts.nonceSize);
     const cryptoKey = await crypto.subtle.importKey(
       "raw",
       key,
@@ -212,9 +324,8 @@ var CryptoService = class {
     );
     try {
       let associatedData = new Uint8Array(0);
-      if (opts.associatedData != null) {
+      if (opts.associatedData != null)
         associatedData = opts.associatedData;
-      }
       const decryptedBuffer = await crypto.subtle.decrypt(
         {
           name: "AES-GCM",
@@ -231,7 +342,7 @@ var CryptoService = class {
       if (isBytes && typeof parsed === "string") {
         return SecurityUtils.fromBase64(parsed);
       }
-      return JSON.parse(jsonString);
+      return parsed;
     } catch (e) {
       console.error("Decryption error:", e);
       throw new Error("Decryption failed: authentication tag mismatch or corrupted data.");
@@ -239,88 +350,40 @@ var CryptoService = class {
   }
 };
 
-// src/crypto/kdf-options.ts
-var KdfOptions = class _KdfOptions {
-  constructor() {
-    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
-    this._hashAlgorithm = "SHA-256";
-  }
-  /** PBKDF2 iteration count (minimum 100_000). */
-  get pbkdf2Iterations() {
-    return this._pbkdf2Iterations;
-  }
-  set pbkdf2Iterations(v) {
-    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
-    this._pbkdf2Iterations = v;
-  }
-  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
-  get hashAlgorithm() {
-    return this._hashAlgorithm;
-  }
-  set hashAlgorithm(v) {
-    if (!SupportedHashAlgorithms.includes(v))
-      throw new RangeError(`Unsupported hash: ${v}`);
-    this._hashAlgorithm = v;
-  }
-  /** Validates iterations and hash algorithm. */
-  validate() {
-    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
-    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
-      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
-  }
-  /** Default preset: SHA-256, 600_000 iterations. */
-  static get default() {
-    return new _KdfOptions();
-  }
-  /** Fluent setter for {@link pbkdf2Iterations}. */
-  withPbkdf2Iterations(i) {
-    this.pbkdf2Iterations = i;
-    return this;
-  }
-  /** Fluent setter for {@link hashAlgorithm}. */
-  withHashAlgorithm(h) {
-    this.hashAlgorithm = h;
-    return this;
-  }
-  /** Validates and returns this instance. */
-  build() {
-    this.validate();
-    return this;
-  }
-};
-
 // src/crypto/key-derivation.service.ts
 var KeyDerivationService = class {
   /**
-  * Derives KEK and Base64 AuthHash. Identity is normalized (trimmed, lowercase).
+  * Derives KEK and Base64 AuthHash. Identity is hashed as-is — caller must 
+  * normalize (trim, lowercase, etc.) before calling.
+  * @param identity - User identity (pre-normalized by caller).
   * @param identity - User identity (email, username).
   * @param password - User password.
   * @param salt - Random salt.
   * @param options - KDF configuration; uses default if omitted.
   * @returns Object with `kek` (Uint8Array) and `authHash` (Base64 string).
   */
-  async deriveKeysFromPassword(identity, password, salt, options) {
-    if (!identity || identity.trim().length === 0)
+  async deriveKeysFromPassword(identity, password, salt, version) {
+    if (!identity || identity.length === 0)
       throw new Error("Identity cannot be null or empty.");
     if (!password || password.trim().length === 0)
       throw new Error("Password cannot be null or empty.");
     if (!salt || salt.length < 16)
       throw new Error("Salt must be at least 16 bytes.");
-    const opts = options ?? KdfOptions.default;
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
     opts.validate();
     const safeSalt = new Uint8Array(salt);
     const encoder = new TextEncoder();
     const combinedPassword = `${identity}:${password}`;
     const passwordBytes = encoder.encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey("raw", passwordBytes, "PBKDF2", false, ["deriveBits", "deriveKey"]);
+    const hashSize = HashSizes[opts.hashAlgorithm] ?? 32;
     const masterKeyBits = await crypto.subtle.deriveBits({
       name: "PBKDF2",
       salt: safeSalt,
       iterations: opts.pbkdf2Iterations,
       hash: opts.hashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
+    }, baseKey, hashSize * 8);
     const masterKey = await crypto.subtle.importKey("raw", masterKeyBits, "HKDF", false, ["deriveBits"]);
     const kek = await crypto.subtle.deriveBits(
       { name: "HKDF", hash: opts.hashAlgorithm, salt: new Uint8Array(0), info: encoder.encode("AES-GCM-KEK-v1") },
@@ -339,6 +402,8 @@ var KeyDerivationService = class {
   }
   /**
   * Derives an SRP-compatible authentication hash (output size = hash output length).
+  * Identity is hashed as-is — caller must normalize (trim, lowercase, etc.) before calling.
+  * @param identity - User identity (pre-normalized by caller).
   * @param identity - User identity.
   * @param password - User password.
   * @param salt - Random salt.
@@ -346,14 +411,15 @@ var KeyDerivationService = class {
   * @param options - KDF configuration; uses default if omitted.
   * @returns Raw hash bytes for use as SRP verifier input (x).
   */
-  async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, options) {
+  async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, version) {
     if (!identity || identity.trim().length === 0)
       throw new Error("Identity cannot be null or empty.");
     if (!password || password.trim().length === 0)
       throw new Error("Password cannot be null or empty.");
     if (!salt || salt.length < 16)
       throw new Error("Salt must be at least 16 bytes.");
-    const opts = options ?? KdfOptions.default;
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
     opts.validate();
     const srpHashSize = HashSizes[srpHashAlgorithm];
     const combinedPassword = `${identity}:${password}`;
@@ -370,7 +436,7 @@ var KeyDerivationService = class {
       salt,
       iterations: opts.pbkdf2Iterations,
       hash: srpHashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
+    }, baseKey, srpHashSize * 8);
     const masterKey = await crypto.subtle.importKey(
       "raw",
       masterKeyBits,
@@ -393,45 +459,6 @@ var KeyDerivationService = class {
   }
 };
 
-// src/crypto/crypto-version.ts
-var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
-  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
-  return CryptoVersion2;
-})(CryptoVersion || {});
-
-// src/crypto/crypto-profile.ts
-var CryptoProfile = class {
-  /**
-   * Creates a new CryptoProfile.
-   * @param params - Object containing version, kdfOptions, aesGcmOptions.
-   */
-  constructor(params) {
-    this.version = params.version;
-    this.kdfOptions = params.kdfOptions;
-    this.aesGcmOptions = params.aesGcmOptions;
-  }
-};
-
-// src/crypto/crypto-profile-registry.ts
-var CryptoProfileRegistry = class {
-  static getProfile(version) {
-    switch (version) {
-      case 1 /* V1 */:
-        return new CryptoProfile({
-          version: 1 /* V1 */,
-          kdfOptions: KdfOptions.default,
-          aesGcmOptions: AesGcmOptions.default
-        });
-      default:
-        throw new Error(`Unsupported crypto version: ${version}`);
-    }
-  }
-  /** Latest supported profile (currently V1). */
-  static get latest() {
-    return this.getProfile(1 /* V1 */);
-  }
-};
-
 // src/utils/srp-encoding.ts
 var SrpEncoding = class {
   /** Serializes a bigint to modulus-sized big-endian bytes. */
@@ -460,7 +487,7 @@ var SrpEncoding = class {
   * @param A - Client ephemeral public key.
   * @param B - Server ephemeral public key.
   * @param sessionKeyK - Session key K as raw bytes.
-  * @param identity - User identity (login). Should already be normalized (trimmed / lowercased) by the caller.
+  * @param identity - User identity (login). Must be pre-normalized by the caller.
   * @param salt - User-specific salt bytes.
   * @returns The M1 proof as raw hash bytes.
   */
@@ -495,11 +522,8 @@ var SrpEncoding = class {
   }
   /** Computes session key K = H(S). */
   static async computeSessionKey(ctx, S) {
-    let hex = S.toString(16);
-    if (hex.length % 2 !== 0)
-      hex = "0" + hex;
-    const sBytes = new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
-    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, sBytes);
+    const sBytes = SecurityUtils.bigIntToRawBytes(S);
+    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, sBytes.buffer);
     return new Uint8Array(hashBuffer);
   }
   /** Hashes bytes and returns raw Uint8Array (для M1/M2). */
@@ -548,23 +572,27 @@ var SrpClientService = class {
    * Generates client proof (A, M1, session key S) from server challenge.
    * @param login - User login.
    * @param password - Plaintext password.
-   * @param saltBase64 - Server salt (URL-safe Base64).
-   * @param B_base64 - Server public ephemeral B (URL-safe Base64).
+   * @param saltBase64 - Server salt (standard Base64).
+   * @param B_base64 - Server public ephemeral B (standard Base64).
    * @param ctx - SRP context.
-   * @returns Object with A, M1, S as Base64 strings.
+   * @returns Object with A and M1 as standard Base64; SessionKeyK as raw bytes.
    */
-  async generateSrpProof(login, password, saltBase64, B_base64, ctx) {
+  async generateSrpProof(login, password, saltBase64, B_base64, ctx, version) {
     const salt = SecurityUtils.fromBase64(saltBase64);
-    const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName);
+    const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName, version);
     const x = SecurityUtils.bytesToBigInt(authHash);
     const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
-    const aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
-    const a = SecurityUtils.bytesToBigInt(aBytes);
+    let aBytes;
+    let a;
+    do {
+      aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      a = SecurityUtils.bytesToBigInt(aBytes);
+    } while (a === 0n);
     const A = SecurityUtils.expMod(ctx.g, a, ctx.N);
-    if (A % ctx.N === 0n)
-      throw new Error("Critical error: A % N === 0");
+    if (A <= 0n || A >= ctx.N)
+      throw new Error("Invalid client public key A.");
     const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(B_base64));
-    if (B % ctx.N === 0n)
+    if (B <= 0n || B >= ctx.N || B % ctx.N === 0n)
       throw new Error("Critical error: B % N === 0");
     const u = await SrpEncoding.hashModuli(ctx, A, B);
     if (u === 0n)
@@ -612,23 +640,32 @@ var SrpServerService = class {
    * @returns Session state with private b, verifier, and public B.
    */
   async getSrpChallenge(login, verifierBytes, salt, ctx) {
+    if (!login || login.trim().length === 0)
+      throw new Error("Login cannot be null or empty.");
+    if (!verifierBytes || verifierBytes.length === 0)
+      throw new Error("Verifier cannot be null or empty.");
     const v = SecurityUtils.bytesToBigInt(verifierBytes);
+    if (v <= 0n || v >= ctx.N)
+      throw new Error("The verifier is corrupted");
     const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
-    let bBytes;
-    let B;
-    do {
-      bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+    while (true) {
+      const bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
       const b = SecurityUtils.bytesToBigInt(bBytes);
+      if (b === 0n) {
+        continue;
+      }
       const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
-      B = (ctx.k * v + gB) % ctx.N;
-    } while (B === 0n);
-    return {
-      login,
-      privateKeyB: bBytes,
-      verifier: verifierBytes,
-      publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
-      salt
-    };
+      const B = (ctx.k * v + gB) % ctx.N;
+      if (B !== 0n) {
+        return {
+          login,
+          privateKeyB: bBytes,
+          verifier: verifierBytes,
+          publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
+          salt
+        };
+      }
+    }
   }
   /**
    * Verifies client M1 proof and returns server M2 proof.
@@ -645,17 +682,21 @@ var SrpServerService = class {
     const b = SecurityUtils.bytesToBigInt(sessionState.privateKeyB);
     const v = SecurityUtils.bytesToBigInt(sessionState.verifier);
     const B = SecurityUtils.bytesToBigInt(sessionState.publicKeyB);
-    if (v <= 0n)
+    if (v <= 0n || v >= ctx.N)
       throw new Error("The verifier is corrupted");
     if (A % ctx.N === 0n)
       throw new Error("Incorrect value of A");
     if (A <= 0n || A >= ctx.N)
       throw new Error("Invalid A (out of range)");
+    if (B <= 0n || B >= ctx.N)
+      throw new Error("Invalid server public key B.");
     const u = await SrpEncoding.hashModuli(ctx, A, B);
     if (u === 0n)
       throw new Error("Error in calculating the parameter u");
     const vU = SecurityUtils.expMod(v, u, ctx.N);
     const S = SecurityUtils.expMod(A * vU % ctx.N, b, ctx.N);
+    if (S === 0n)
+      throw new Error("Critical error: shared secret S is zero (possible malicious A).");
     const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
     const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, sessionState.login, sessionState.salt);
     if (!SecurityUtils.fixedTimeEquals(M1_server, M1_client))