@libp2p/crypto 1.0.12 → 1.0.14

package/src/keys/interface.ts

@@ -18,3 +18,18 @@ export interface ECDHKey {
   key: Uint8Array
   genSharedKey: (theirPub: Uint8Array, forcePrivate?: ECDHKeyPair) => Promise<Uint8Array>
 }
+
+export interface JWKEncodedPublicKey { kty: string, crv: 'P-256' | 'P-384' | 'P-521', x: string, y: string, ext: boolean }
+
+export interface JWKEncodedPrivateKey extends JWKEncodedPublicKey { d: string}
+
+export interface EnhancedKey {
+  iv: Uint8Array
+  cipherKey: Uint8Array
+  macKey: Uint8Array
+}
+
+export interface EnhancedKeyPair {
+  k1: EnhancedKey
+  k2: EnhancedKey
+}

package/src/keys/jwk2pem.ts

@@ -3,14 +3,19 @@ import 'node-forge/lib/rsa.js'
 import forge from 'node-forge/lib/forge.js'
 import { base64urlToBigInteger } from '../util.js'
 
-function convert (key: any, types: string[]) {
+export interface JWK {
+  encrypt: (msg: string) => string
+  decrypt: (msg: string) => string
+}
+
+function convert (key: any, types: string[]): Array<typeof forge.jsbn.BigInteger> {
   return types.map(t => base64urlToBigInteger(key[t]))
 }
 
-export function jwk2priv (key: JsonWebKey) {
+export function jwk2priv (key: JsonWebKey): JWK {
   return forge.pki.setRsaPrivateKey(...convert(key, ['n', 'e', 'd', 'p', 'q', 'dp', 'dq', 'qi']))
 }
 
-export function jwk2pub (key: JsonWebKey) {
+export function jwk2pub (key: JsonWebKey): JWK {
   return forge.pki.setRsaPublicKey(...convert(key, ['n', 'e']))
 }

package/src/keys/key-stretcher.ts

@@ -2,6 +2,7 @@ import { CodeError } from '@libp2p/interfaces/errors'
 import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
 import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
 import * as hmac from '../hmac/index.js'
+import type { EnhancedKey, EnhancedKeyPair } from './interface.js'
 
 const cipherMap = {
   'AES-128': {
@@ -22,7 +23,7 @@ const cipherMap = {
  * Generates a set of keys for each party by stretching the shared key.
  * (myIV, theirIV, myCipherKey, theirCipherKey, myMACKey, theirMACKey)
  */
-export async function keyStretcher (cipherType: 'AES-128' | 'AES-256' | 'Blowfish', hash: 'SHA1' | 'SHA256' | 'SHA512', secret: Uint8Array) {
+export async function keyStretcher (cipherType: 'AES-128' | 'AES-256' | 'Blowfish', hash: 'SHA1' | 'SHA256' | 'SHA512', secret: Uint8Array): Promise<EnhancedKeyPair> {
   const cipher = cipherMap[cipherType]
 
   if (cipher == null) {
@@ -64,7 +65,7 @@ export async function keyStretcher (cipherType: 'AES-128' | 'AES-256' | 'Blowfis
   const r1 = resultBuffer.subarray(0, half)
   const r2 = resultBuffer.subarray(half, resultLength)
 
-  const createKey = (res: Uint8Array) => ({
+  const createKey = (res: Uint8Array): EnhancedKey => ({
     iv: res.subarray(0, ivSize),
     cipherKey: res.subarray(ivSize, ivSize + cipherKeySize),
     macKey: res.subarray(ivSize + cipherKeySize)

package/src/keys/keys.ts

@@ -2,10 +2,11 @@
 /* eslint-disable complexity */
 /* eslint-disable @typescript-eslint/no-namespace */
 /* eslint-disable @typescript-eslint/no-unnecessary-boolean-literal-compare */
+/* eslint-disable @typescript-eslint/no-empty-interface */
 
 import { enumeration, encodeMessage, decodeMessage, message } from 'protons-runtime'
-import type { Uint8ArrayList } from 'uint8arraylist'
 import type { Codec } from 'protons-runtime'
+import type { Uint8ArrayList } from 'uint8arraylist'
 
 export enum KeyType {
   RSA = 'RSA',
@@ -20,7 +21,7 @@ enum __KeyTypeValues {
 }
 
 export namespace KeyType {
-  export const codec = () => {
+  export const codec = (): Codec<KeyType> => {
     return enumeration<KeyType>(__KeyTypeValues)
   }
 }
@@ -80,7 +81,7 @@ export namespace PublicKey {
     return _codec
   }
 
-  export const encode = (obj: PublicKey): Uint8Array => {
+  export const encode = (obj: Partial<PublicKey>): Uint8Array => {
     return encodeMessage(obj, PublicKey.codec())
   }
 
@@ -145,7 +146,7 @@ export namespace PrivateKey {
     return _codec
   }
 
-  export const encode = (obj: PrivateKey): Uint8Array => {
+  export const encode = (obj: Partial<PrivateKey>): Uint8Array => {
     return encodeMessage(obj, PrivateKey.codec())
   }
 

package/src/keys/rsa-browser.ts

@@ -5,10 +5,11 @@ import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
 import * as utils from './rsa-utils.js'
 import { jwk2pub, jwk2priv } from './jwk2pem.js'
 import { CodeError } from '@libp2p/interfaces/errors'
+import type { JWKKeyPair } from './interface.js'
 
 export { utils }
 
-export async function generateKey (bits: number) {
+export async function generateKey (bits: number): Promise<JWKKeyPair> {
   const pair = await webcrypto.get().subtle.generateKey(
     {
       name: 'RSASSA-PKCS1-v1_5',
@@ -29,7 +30,7 @@ export async function generateKey (bits: number) {
 }
 
 // Takes a jwk key
-export async function unmarshalPrivateKey (key: JsonWebKey) {
+export async function unmarshalPrivateKey (key: JsonWebKey): Promise<JWKKeyPair> {
   const privateKey = await webcrypto.get().subtle.importKey(
     'jwk',
     key,
@@ -59,7 +60,7 @@ export async function unmarshalPrivateKey (key: JsonWebKey) {
 
 export { randomBytes as getRandomValues }
 
-export async function hashAndSign (key: JsonWebKey, msg: Uint8Array) {
+export async function hashAndSign (key: JsonWebKey, msg: Uint8Array): Promise<Uint8Array> {
   const privateKey = await webcrypto.get().subtle.importKey(
     'jwk',
     key,
@@ -80,7 +81,7 @@ export async function hashAndSign (key: JsonWebKey, msg: Uint8Array) {
   return new Uint8Array(sig, 0, sig.byteLength)
 }
 
-export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint8Array) {
+export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint8Array): Promise<boolean> {
   const publicKey = await webcrypto.get().subtle.importKey(
     'jwk',
     key,
@@ -100,7 +101,7 @@ export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint
   )
 }
 
-async function exportKey (pair: CryptoKeyPair) {
+async function exportKey (pair: CryptoKeyPair): Promise<[JsonWebKey, JsonWebKey]> {
   if (pair.privateKey == null || pair.publicKey == null) {
     throw new CodeError('Private and public key are required', 'ERR_INVALID_PARAMETERS')
   }
@@ -111,7 +112,7 @@ async function exportKey (pair: CryptoKeyPair) {
   ])
 }
 
-async function derivePublicFromPrivate (jwKey: JsonWebKey) {
+async function derivePublicFromPrivate (jwKey: JsonWebKey): Promise<CryptoKey> {
   return await webcrypto.get().subtle.importKey(
     'jwk',
     {
@@ -140,17 +141,17 @@ Explanation:
 
 */
 
-function convertKey (key: JsonWebKey, pub: boolean, msg: Uint8Array, handle: (msg: string, key: { encrypt: (msg: string) => string, decrypt: (msg: string) => string}) => string) {
+function convertKey (key: JsonWebKey, pub: boolean, msg: Uint8Array, handle: (msg: string, key: { encrypt: (msg: string) => string, decrypt: (msg: string) => string }) => string): Uint8Array {
   const fkey = pub ? jwk2pub(key) : jwk2priv(key)
   const fmsg = uint8ArrayToString(Uint8Array.from(msg), 'ascii')
   const fomsg = handle(fmsg, fkey)
   return uint8ArrayFromString(fomsg, 'ascii')
 }
 
-export function encrypt (key: JsonWebKey, msg: Uint8Array) {
+export function encrypt (key: JsonWebKey, msg: Uint8Array): Uint8Array {
   return convertKey(key, true, msg, (msg, key) => key.encrypt(msg))
 }
 
-export function decrypt (key: JsonWebKey, msg: Uint8Array) {
+export function decrypt (key: JsonWebKey, msg: Uint8Array): Uint8Array {
   return convertKey(key, false, msg, (msg, key) => key.decrypt(msg))
 }

package/src/keys/rsa-class.ts

@@ -9,6 +9,7 @@ import forge from 'node-forge/lib/forge.js'
 import * as crypto from './rsa.js'
 import * as pbm from './keys.js'
 import { exporter } from './exporter.js'
+import type { Multibase } from 'multiformats'
 
 export class RsaPublicKey {
   private readonly _key: JsonWebKey
@@ -17,30 +18,30 @@ export class RsaPublicKey {
     this._key = key
   }
 
-  async verify (data: Uint8Array, sig: Uint8Array) { // eslint-disable-line require-await
+  async verify (data: Uint8Array, sig: Uint8Array): Promise<boolean> { // eslint-disable-line require-await
     return await crypto.hashAndVerify(this._key, sig, data)
   }
 
-  marshal () {
+  marshal (): Uint8Array {
     return crypto.utils.jwkToPkix(this._key)
   }
 
-  get bytes () {
+  get bytes (): Uint8Array {
     return pbm.PublicKey.encode({
       Type: pbm.KeyType.RSA,
       Data: this.marshal()
     }).subarray()
   }
 
-  encrypt (bytes: Uint8Array) {
+  encrypt (bytes: Uint8Array): Uint8Array {
     return crypto.encrypt(this._key, bytes)
   }
 
-  equals (key: any) {
+  equals (key: any): boolean {
     return uint8ArrayEquals(this.bytes, key.bytes)
   }
 
-  async hash () {
+  async hash (): Promise<Uint8Array> {
     const { bytes } = await sha256.digest(this.bytes)
 
     return bytes
@@ -56,15 +57,15 @@ export class RsaPrivateKey {
     this._publicKey = publicKey
   }
 
-  genSecret () {
+  genSecret (): Uint8Array {
     return crypto.getRandomValues(16)
   }
 
-  async sign (message: Uint8Array) { // eslint-disable-line require-await
+  async sign (message: Uint8Array): Promise<Uint8Array> { // eslint-disable-line require-await
     return await crypto.hashAndSign(this._key, message)
   }
 
-  get public () {
+  get public (): RsaPublicKey {
     if (this._publicKey == null) {
       throw new CodeError('public key not provided', 'ERR_PUBKEY_NOT_PROVIDED')
     }
@@ -72,26 +73,26 @@ export class RsaPrivateKey {
     return new RsaPublicKey(this._publicKey)
   }
 
-  decrypt (bytes: Uint8Array) {
+  decrypt (bytes: Uint8Array): Uint8Array {
     return crypto.decrypt(this._key, bytes)
   }
 
-  marshal () {
+  marshal (): Uint8Array {
     return crypto.utils.jwkToPkcs1(this._key)
   }
 
-  get bytes () {
+  get bytes (): Uint8Array {
     return pbm.PrivateKey.encode({
       Type: pbm.KeyType.RSA,
       Data: this.marshal()
     }).subarray()
   }
 
-  equals (key: any) {
+  equals (key: any): boolean {
     return uint8ArrayEquals(this.bytes, key.bytes)
   }
 
-  async hash () {
+  async hash (): Promise<Uint8Array> {
     const { bytes } = await sha256.digest(this.bytes)
 
     return bytes
@@ -104,7 +105,7 @@ export class RsaPrivateKey {
    * The public key is a protobuf encoding containing a type and the DER encoding
    * of the PKCS SubjectPublicKeyInfo.
    */
-  async id () {
+  async id (): Promise<string> {
     const hash = await this.public.hash()
     return uint8ArrayToString(hash, 'base58btc')
   }
@@ -112,7 +113,7 @@ export class RsaPrivateKey {
   /**
    * Exports the key into a password protected PEM format
    */
-  async export (password: string, format = 'pkcs-8') { // eslint-disable-line require-await
+  async export (password: string, format = 'pkcs-8'): Promise<Multibase<'m'>> { // eslint-disable-line require-await
     if (format === 'pkcs-8') {
       const buffer = new forge.util.ByteBuffer(this.marshal())
       const asn1 = forge.asn1.fromDer(buffer)
@@ -133,23 +134,23 @@ export class RsaPrivateKey {
   }
 }
 
-export async function unmarshalRsaPrivateKey (bytes: Uint8Array) {
+export async function unmarshalRsaPrivateKey (bytes: Uint8Array): Promise<RsaPrivateKey> {
   const jwk = crypto.utils.pkcs1ToJwk(bytes)
   const keys = await crypto.unmarshalPrivateKey(jwk)
   return new RsaPrivateKey(keys.privateKey, keys.publicKey)
 }
 
-export function unmarshalRsaPublicKey (bytes: Uint8Array) {
+export function unmarshalRsaPublicKey (bytes: Uint8Array): RsaPublicKey {
   const jwk = crypto.utils.pkixToJwk(bytes)
   return new RsaPublicKey(jwk)
 }
 
-export async function fromJwk (jwk: JsonWebKey) {
+export async function fromJwk (jwk: JsonWebKey): Promise<RsaPrivateKey> {
   const keys = await crypto.unmarshalPrivateKey(jwk)
   return new RsaPrivateKey(keys.privateKey, keys.publicKey)
 }
 
-export async function generateKeyPair (bits: number) {
+export async function generateKeyPair (bits: number): Promise<RsaPrivateKey> {
   const keys = await crypto.generateKey(bits)
   return new RsaPrivateKey(keys.privateKey, keys.publicKey)
 }

package/src/keys/rsa-utils.ts

@@ -28,7 +28,7 @@ export function pkcs1ToJwk (bytes: Uint8Array): JsonWebKey {
 }
 
 // Convert a JWK key into PKCS#1 in ASN1 DER format
-export function jwkToPkcs1 (jwk: JsonWebKey) {
+export function jwkToPkcs1 (jwk: JsonWebKey): Uint8Array {
   if (jwk.n == null || jwk.e == null || jwk.d == null || jwk.p == null || jwk.q == null || jwk.dp == null || jwk.dq == null || jwk.qi == null) {
     throw new CodeError('JWK was missing components', 'ERR_INVALID_PARAMETERS')
   }
@@ -60,7 +60,7 @@ export function pkixToJwk (bytes: Uint8Array): JsonWebKey {
 }
 
 // Convert a JWK key to PKCIX in ASN1 DER format
-export function jwkToPkix (jwk: JsonWebKey) {
+export function jwkToPkix (jwk: JsonWebKey): Uint8Array {
   if (jwk.n == null || jwk.e == null) {
     throw new CodeError('JWK was missing components', 'ERR_INVALID_PARAMETERS')
   }

package/src/keys/rsa.ts

@@ -42,14 +42,14 @@ export async function unmarshalPrivateKey (key: JsonWebKey): Promise<JWKKeyPair>
 
 export { randomBytes as getRandomValues }
 
-export async function hashAndSign (key: JsonWebKey, msg: Uint8Array) { // eslint-disable-line require-await
+export async function hashAndSign (key: JsonWebKey, msg: Uint8Array): Promise<Uint8Array> {
   return crypto.createSign('RSA-SHA256')
     .update(msg)
     // @ts-expect-error node types are missing jwk as a format
     .sign({ format: 'jwk', key })
 }
 
-export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint8Array) { // eslint-disable-line require-await
+export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint8Array): Promise<boolean> { // eslint-disable-line require-await
   return crypto.createVerify('RSA-SHA256')
     .update(msg)
     // @ts-expect-error node types are missing jwk as a format
@@ -58,12 +58,12 @@ export async function hashAndVerify (key: JsonWebKey, sig: Uint8Array, msg: Uint
 
 const padding = crypto.constants.RSA_PKCS1_PADDING
 
-export function encrypt (key: JsonWebKey, bytes: Uint8Array) {
+export function encrypt (key: JsonWebKey, bytes: Uint8Array): Uint8Array {
   // @ts-expect-error node types are missing jwk as a format
   return crypto.publicEncrypt({ format: 'jwk', key, padding }, bytes)
 }
 
-export function decrypt (key: JsonWebKey, bytes: Uint8Array) {
+export function decrypt (key: JsonWebKey, bytes: Uint8Array): Uint8Array {
   // @ts-expect-error node types are missing jwk as a format
   return crypto.privateDecrypt({ format: 'jwk', key, padding }, bytes)
 }

package/src/keys/secp256k1-class.ts

@@ -5,6 +5,7 @@ import { toString as uint8ArrayToString } from 'uint8arrays/to-string'
 import * as crypto from './secp256k1.js'
 import { exporter } from './exporter.js'
 import * as keysProtobuf from './keys.js'
+import type { Multibase } from 'multiformats'
 
 export class Secp256k1PublicKey {
   private readonly _key: Uint8Array
@@ -14,26 +15,26 @@ export class Secp256k1PublicKey {
     this._key = key
   }
 
-  async verify (data: Uint8Array, sig: Uint8Array) {
+  async verify (data: Uint8Array, sig: Uint8Array): Promise<boolean> {
     return await crypto.hashAndVerify(this._key, sig, data)
   }
 
-  marshal () {
+  marshal (): Uint8Array {
     return crypto.compressPublicKey(this._key)
   }
 
-  get bytes () {
+  get bytes (): Uint8Array {
     return keysProtobuf.PublicKey.encode({
       Type: keysProtobuf.KeyType.Secp256k1,
       Data: this.marshal()
     }).subarray()
   }
 
-  equals (key: any) {
+  equals (key: any): boolean {
     return uint8ArrayEquals(this.bytes, key.bytes)
   }
 
-  async hash () {
+  async hash (): Promise<Uint8Array> {
     const { bytes } = await sha256.digest(this.bytes)
 
     return bytes
@@ -51,30 +52,30 @@ export class Secp256k1PrivateKey {
     crypto.validatePublicKey(this._publicKey)
   }
 
-  async sign (message: Uint8Array) {
+  async sign (message: Uint8Array): Promise<Uint8Array> {
     return await crypto.hashAndSign(this._key, message)
   }
 
-  get public () {
+  get public (): Secp256k1PublicKey {
     return new Secp256k1PublicKey(this._publicKey)
   }
 
-  marshal () {
+  marshal (): Uint8Array {
     return this._key
   }
 
-  get bytes () {
+  get bytes (): Uint8Array {
     return keysProtobuf.PrivateKey.encode({
       Type: keysProtobuf.KeyType.Secp256k1,
       Data: this.marshal()
     }).subarray()
   }
 
-  equals (key: any) {
+  equals (key: any): boolean {
     return uint8ArrayEquals(this.bytes, key.bytes)
   }
 
-  async hash () {
+  async hash (): Promise<Uint8Array> {
     const { bytes } = await sha256.digest(this.bytes)
 
     return bytes
@@ -87,7 +88,7 @@ export class Secp256k1PrivateKey {
    * The public key is a protobuf encoding containing a type and the DER encoding
    * of the PKCS SubjectPublicKeyInfo.
    */
-  async id () {
+  async id (): Promise<string> {
     const hash = await this.public.hash()
     return uint8ArrayToString(hash, 'base58btc')
   }
@@ -95,7 +96,7 @@ export class Secp256k1PrivateKey {
   /**
    * Exports the key into a password protected `format`
    */
-  async export (password: string, format = 'libp2p-key') { // eslint-disable-line require-await
+  async export (password: string, format = 'libp2p-key'): Promise<Multibase<'m'>> {
     if (format === 'libp2p-key') {
       return await exporter(this.bytes, password)
     } else {
@@ -104,15 +105,15 @@ export class Secp256k1PrivateKey {
   }
 }
 
-export function unmarshalSecp256k1PrivateKey (bytes: Uint8Array) {
+export function unmarshalSecp256k1PrivateKey (bytes: Uint8Array): Secp256k1PrivateKey {
   return new Secp256k1PrivateKey(bytes)
 }
 
-export function unmarshalSecp256k1PublicKey (bytes: Uint8Array) {
+export function unmarshalSecp256k1PublicKey (bytes: Uint8Array): Secp256k1PublicKey {
   return new Secp256k1PublicKey(bytes)
 }
 
-export async function generateKeyPair () {
-  const privateKeyBytes = await crypto.generateKey()
+export async function generateKeyPair (): Promise<Secp256k1PrivateKey> {
+  const privateKeyBytes = crypto.generateKey()
   return new Secp256k1PrivateKey(privateKeyBytes)
 }

package/src/keys/secp256k1.ts

@@ -6,14 +6,14 @@ const PRIVATE_KEY_BYTE_LENGTH = 32
 
 export { PRIVATE_KEY_BYTE_LENGTH as privateKeyLength }
 
-export function generateKey () {
+export function generateKey (): Uint8Array {
   return secp.utils.randomPrivateKey()
 }
 
 /**
  * Hash and sign message with private key
  */
-export async function hashAndSign (key: Uint8Array, msg: Uint8Array) {
+export async function hashAndSign (key: Uint8Array, msg: Uint8Array): Promise<Uint8Array> {
   const { digest } = await sha256.digest(msg)
   try {
     return await secp.sign(digest, key)
@@ -25,7 +25,7 @@ export async function hashAndSign (key: Uint8Array, msg: Uint8Array) {
 /**
  * Hash message and verify signature with public key
  */
-export async function hashAndVerify (key: Uint8Array, sig: Uint8Array, msg: Uint8Array) {
+export async function hashAndVerify (key: Uint8Array, sig: Uint8Array, msg: Uint8Array): Promise<boolean> {
   try {
     const { digest } = await sha256.digest(msg)
     return secp.verify(sig, digest, key)
@@ -34,17 +34,17 @@ export async function hashAndVerify (key: Uint8Array, sig: Uint8Array, msg: Uint
   }
 }
 
-export function compressPublicKey (key: Uint8Array) {
+export function compressPublicKey (key: Uint8Array): Uint8Array {
   const point = secp.Point.fromHex(key).toRawBytes(true)
   return point
 }
 
-export function decompressPublicKey (key: Uint8Array) {
+export function decompressPublicKey (key: Uint8Array): Uint8Array {
   const point = secp.Point.fromHex(key).toRawBytes(false)
   return point
 }
 
-export function validatePrivateKey (key: Uint8Array) {
+export function validatePrivateKey (key: Uint8Array): void {
   try {
     secp.getPublicKey(key, true)
   } catch (err) {
@@ -52,7 +52,7 @@ export function validatePrivateKey (key: Uint8Array) {
   }
 }
 
-export function validatePublicKey (key: Uint8Array) {
+export function validatePublicKey (key: Uint8Array): void {
   try {
     secp.Point.fromHex(key)
   } catch (err) {
@@ -60,7 +60,7 @@ export function validatePublicKey (key: Uint8Array) {
   }
 }
 
-export function computePublicKey (privateKey: Uint8Array) {
+export function computePublicKey (privateKey: Uint8Array): Uint8Array {
   try {
     return secp.getPublicKey(privateKey, true)
   } catch (err) {

package/src/util.ts

@@ -6,7 +6,7 @@ import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
 import { toString as uint8ArrayToString } from 'uint8arrays/to-string'
 import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
 
-export function bigIntegerToUintBase64url (num: { abs: () => any}, len?: number) {
+export function bigIntegerToUintBase64url (num: { abs: () => any }, len?: number): string {
   // Call `.abs()` to convert to unsigned
   let buf = Uint8Array.from(num.abs().toByteArray()) // toByteArray converts to big endian
 
@@ -30,7 +30,7 @@ export function base64urlToBigInteger (str: string): typeof forge.jsbn.BigIntege
   return new forge.jsbn.BigInteger(uint8ArrayToString(buf, 'base16'), 16)
 }
 
-export function base64urlToBuffer (str: string, len?: number) {
+export function base64urlToBuffer (str: string, len?: number): Uint8Array {
   let buf = uint8ArrayFromString(str, 'base64urlpad')
 
   if (len != null) {