@lindorm/rsa 0.2.5 → 0.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/README.md +42 -45
  3. package/dist/classes/RsaKit.d.ts.map +1 -1
  4. package/dist/classes/RsaKit.js +3 -0
  5. package/dist/classes/RsaKit.js.map +1 -1
  6. package/dist/utils/private/map-algorithm.d.ts.map +1 -1
  7. package/dist/utils/private/map-algorithm.js +15 -7
  8. package/dist/utils/private/map-algorithm.js.map +1 -1
  9. package/package.json +11 -14
package/CHANGELOG.md CHANGED
@@ -3,6 +3,12 @@
3
3
  All notable changes to this project will be documented in this file.
4
4
  See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
5
5
 
6
+ ## [0.2.6](https://github.com/lindorm-io/monorepo/compare/@lindorm/rsa@0.2.5...@lindorm/rsa@0.2.6) (2026-02-17)
7
+
8
+ ### Bug Fixes
9
+
10
+ - **ec,oct,okp,rsa:** harden signing kits with validation and security fixes ([910f016](https://github.com/lindorm-io/monorepo/commit/910f01669aefcb4e6eb69c0297291fe2404232f8))
11
+
6
12
  ## [0.2.5](https://github.com/lindorm-io/monorepo/compare/@lindorm/rsa@0.2.4...@lindorm/rsa@0.2.5) (2025-09-18)
7
13
 
8
14
  **Note:** Version bump only for package @lindorm/rsa
package/README.md CHANGED
@@ -1,82 +1,79 @@
1
1
  # @lindorm/rsa
2
2
 
3
- Lightweight **RSA signing / verification kit** that wraps a `RSxxx` key from
4
- [`@lindorm/kryptos`](../kryptos). Provides a convenient `RsaKit` class that fulfils the `IKeyKit`
5
- contract used by the Lindorm crypto packages.
6
-
7
- ---
3
+ RSA signature kit built on Node's `crypto` module and [`@lindorm/kryptos`](../kryptos). Provides an `RsaKit` class that implements the `IKeyKit` contract used across the Lindorm cryptography packages.
8
4
 
9
5
  ## Installation
10
6
 
11
7
  ```bash
12
8
  npm install @lindorm/rsa
13
- # or
14
- yarn add @lindorm/rsa
15
- ```
16
-
17
- Generate or import a key via Kryptos:
18
-
19
- ```ts
20
- import { KryptosKit } from '@lindorm/kryptos';
21
-
22
- const RS256 = KryptosKit.generate.rsa({ alg: 'RS256', use: 'sig', modulusLength: 2048 });
23
9
  ```
24
10
 
25
- ---
11
+ ## Quick Start
26
12
 
27
- ## Example
13
+ ```typescript
14
+ import { RsaKit } from "@lindorm/rsa";
15
+ import { KryptosKit } from "@lindorm/kryptos";
28
16
 
29
- ```ts
30
- import { RsaKit } from '@lindorm/rsa';
17
+ const kryptos = KryptosKit.generate.sig.rsa({ algorithm: "PS256" });
18
+ const kit = new RsaKit({ kryptos });
31
19
 
32
- const kit = new RsaKit({ kryptos: RS256, encoding: 'base64url' });
20
+ // Sign
21
+ const signature = kit.sign("hello world");
33
22
 
34
- const signature = kit.sign('hello');
23
+ // Verify
24
+ kit.verify("hello world", signature); // true
35
25
 
36
- kit.assert('hello', signature); // throws RsaError if invalid
26
+ // Assert (throws RsaError if invalid)
27
+ kit.assert("hello world", signature);
37
28
 
38
- console.log(kit.format(signature)); // string representation
29
+ // Format Buffer to string
30
+ kit.format(signature); // base64 string
39
31
  ```
40
32
 
41
- ### DSA encoding
33
+ ## Constructor Options
42
34
 
43
- Set `dsa: 'ieee-p1363'` when you need raw concatenated r||s encoding instead of DER:
44
-
45
- ```ts
46
- const kit = new RsaKit({ kryptos: RS256, dsa: 'ieee-p1363' });
35
+ ```typescript
36
+ new RsaKit({
37
+ kryptos, // IKryptos — must be an RSA key with a signing algorithm
38
+ dsa: "der", // DsaEncoding — "der" | "ieee-p1363" (default: "der")
39
+ encoding: "base64", // BufferEncoding — output encoding (default: "base64")
40
+ });
47
41
  ```
48
42
 
49
- ---
43
+ The constructor validates that the key is an RSA type with a supported signing algorithm (RS256, RS384, RS512, PS256, PS384, PS512). Encryption keys (RSA-OAEP etc.) are rejected with an `RsaError`.
50
44
 
51
45
  ## API
52
46
 
53
- ```ts
47
+ ```typescript
54
48
  class RsaKit implements IKeyKit {
55
- constructor(options: {
56
- kryptos: IKryptosRsa;
57
- dsa?: DsaEncoding; // 'der' | 'ieee-p1363' (default 'der')
58
- encoding?: BufferEncoding; // default 'base64'
59
- });
60
-
61
49
  sign(data: KeyData): Buffer;
62
50
  verify(data: KeyData, signature: KeyData): boolean;
63
51
  assert(data: KeyData, signature: KeyData): void; // throws RsaError
64
- format(buf: Buffer): string; // encode Buffer → string
52
+ format(data: Buffer): string;
65
53
  }
66
54
  ```
67
55
 
68
- `KeyData` accepts `Buffer`, `string` or `Uint8Array`.
56
+ `KeyData` is `Buffer | string`.
69
57
 
70
- ---
58
+ ## Supported Algorithms
71
59
 
72
- ## TypeScript
60
+ | Algorithm | Padding | Hash |
61
+ | --------- | ----------- | ------- |
62
+ | RS256 | PKCS#1 v1.5 | SHA-256 |
63
+ | RS384 | PKCS#1 v1.5 | SHA-384 |
64
+ | RS512 | PKCS#1 v1.5 | SHA-512 |
65
+ | PS256 | PSS | SHA-256 |
66
+ | PS384 | PSS | SHA-384 |
67
+ | PS512 | PSS | SHA-512 |
73
68
 
74
- Written in TS; declaration files included. Runtime dependencies are limited to Node’s `crypto`
75
- module plus Lindorm utilities.
69
+ ## Error Handling
76
70
 
77
- ---
71
+ All errors are `RsaError` instances:
78
72
 
79
- ## License
73
+ ```typescript
74
+ import { RsaError } from "@lindorm/rsa";
75
+ ```
80
76
 
81
- AGPL-3.0-or-later – see the root [`LICENSE`](../../LICENSE).
77
+ ## License
82
78
 
79
+ AGPL-3.0-or-later
package/dist/classes/RsaKit.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"RsaKit.d.ts","sourceRoot":"","sources":["../../src/classes/RsaKit.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAOzC,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;gBAEnB,OAAO,EAAE,aAAa;IAWlC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM;IAQ3B,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO;IAUlD,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAU/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAGpC"}
1
+ {"version":3,"file":"RsaKit.d.ts","sourceRoot":"","sources":["../../src/classes/RsaKit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAOzC,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;gBAEnB,OAAO,EAAE,aAAa;IAiBlC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM;IAQ3B,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO;IAUlD,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAU/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAGpC"}
package/dist/classes/RsaKit.js CHANGED
@@ -14,6 +14,9 @@ class RsaKit {
14
14
  if (!kryptos_1.KryptosKit.isRsa(options.kryptos)) {
15
15
  throw new errors_1.RsaError("Invalid Kryptos instance");
16
16
  }
17
+ if (!kryptos_1.RSA_SIG_ALGORITHMS.includes(options.kryptos.algorithm)) {
18
+ throw new errors_1.RsaError("RsaKit only supports signing algorithms (RS256, RS384, RS512, PS256, PS384, PS512)");
19
+ }
17
20
  this.kryptos = options.kryptos;
18
21
  }
19
22
  sign(data) {
package/dist/classes/RsaKit.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"RsaKit.js","sourceRoot":"","sources":["../../src/classes/RsaKit.ts"],"names":[],"mappings":";;;AAAA,8CAA2D;AAE3D,sCAAqC;AAErC,8CAI0B;AAE1B,MAAa,MAAM;IACA,GAAG,CAAc;IACjB,QAAQ,CAAiB;IACzB,OAAO,CAAc;IAEtC,YAAmB,OAAsB;QACvC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAE7C,IAAI,CAAC,oBAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAQ,CAAC,0BAA0B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAEM,IAAI,CAAC,IAAa;QACvB,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;CACF;AA/CD,wBA+CC"}
1
+ {"version":3,"file":"RsaKit.js","sourceRoot":"","sources":["../../src/classes/RsaKit.ts"],"names":[],"mappings":";;;AAAA,8CAK0B;AAE1B,sCAAqC;AAErC,8CAI0B;AAE1B,MAAa,MAAM;IACA,GAAG,CAAc;IACjB,QAAQ,CAAiB;IACzB,OAAO,CAAc;IAEtC,YAAmB,OAAsB;QACvC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAE7C,IAAI,CAAC,oBAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAQ,CAAC,0BAA0B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,4BAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,SAA4B,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,iBAAQ,CAChB,oFAAoF,CACrF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAEM,IAAI,CAAC,IAAa;QACvB,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAA,4BAAkB,EAAC;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;CACF;AArDD,wBAqDC"}
package/dist/utils/private/map-algorithm.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"map-algorithm.d.ts","sourceRoot":"","sources":["../../../src/utils/private/map-algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,eAAO,MAAM,eAAe,GAAI,SAAS,WAAW,KAAG,YAMtD,CAAC"}
1
+ {"version":3,"file":"map-algorithm.d.ts","sourceRoot":"","sources":["../../../src/utils/private/map-algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuC,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAY9C,eAAO,MAAM,eAAe,GAAI,SAAS,WAAW,KAAG,YAQtD,CAAC"}
package/dist/utils/private/map-algorithm.js CHANGED
@@ -1,15 +1,23 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.mapRsaAlgorithm = void 0;
4
+ const kryptos_1 = require("@lindorm/kryptos");
4
5
  const errors_1 = require("../../errors");
6
+ const RSA_SIG_ALGORITHM_MAP = {
7
+ RS256: "SHA256",
8
+ RS384: "SHA384",
9
+ RS512: "SHA512",
10
+ PS256: "SHA256",
11
+ PS384: "SHA384",
12
+ PS512: "SHA512",
13
+ };
5
14
  const mapRsaAlgorithm = (kryptos) => {
6
- if (kryptos.algorithm.endsWith("256"))
7
- return "SHA256";
8
- if (kryptos.algorithm.endsWith("384"))
9
- return "SHA384";
10
- if (kryptos.algorithm.endsWith("512"))
11
- return "SHA512";
12
- throw new errors_1.RsaError("Unsupported RSA algorithm", { debug: { kryptos } });
15
+ if (!kryptos_1.RSA_SIG_ALGORITHMS.includes(kryptos.algorithm)) {
16
+ throw new errors_1.RsaError("Unsupported RSA algorithm for signing", {
17
+ debug: { algorithm: kryptos.algorithm },
18
+ });
19
+ }
20
+ return RSA_SIG_ALGORITHM_MAP[kryptos.algorithm];
13
21
  };
14
22
  exports.mapRsaAlgorithm = mapRsaAlgorithm;
15
23
  //# sourceMappingURL=map-algorithm.js.map
package/dist/utils/private/map-algorithm.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"map-algorithm.js","sourceRoot":"","sources":["../../../src/utils/private/map-algorithm.ts"],"names":[],"mappings":";;;AAEA,yCAAwC;AAEjC,MAAM,eAAe,GAAG,CAAC,OAAoB,EAAgB,EAAE;IACpE,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,MAAM,IAAI,iBAAQ,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AANW,QAAA,eAAe,mBAM1B"}
1
+ {"version":3,"file":"map-algorithm.js","sourceRoot":"","sources":["../../../src/utils/private/map-algorithm.ts"],"names":[],"mappings":";;;AAAA,8CAAoF;AAEpF,yCAAwC;AAExC,MAAM,qBAAqB,GAA0C;IACnE,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEK,MAAM,eAAe,GAAG,CAAC,OAAoB,EAAgB,EAAE;IACpE,IAAI,CAAC,4BAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAA4B,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,iBAAQ,CAAC,uCAAuC,EAAE;YAC1D,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,qBAAqB,CAAC,OAAO,CAAC,SAA4B,CAAC,CAAC;AACrE,CAAC,CAAC;AARW,QAAA,eAAe,mBAQ1B"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lindorm/rsa",
3
- "version": "0.2.5",
3
+ "version": "0.2.6",
4
4
  "license": "AGPL-3.0-or-later",
5
5
  "author": "Jonn Nilsson",
6
6
  "repository": {
@@ -16,25 +16,22 @@
16
16
  "scripts": {
17
17
  "build": "rimraf dist && tsc -b ./tsconfig.build.json",
18
18
  "example": "ts-node example",
19
- "integration": "compd --file docker-compose.yml jest --config jest.config.integration.js --watch",
20
- "integration:focus": "compd --file docker-compose.yml jest --config jest.config.integration.js --watch $1",
21
19
  "prettier": "prettier --write ./src/*",
22
- "test": "jest --watch --",
23
- "test:ci": "npm run test:unit",
24
- "test:integration": "jest --config jest.config.integration.js --",
25
- "test:unit": "jest --config jest.config.js --",
26
- "typecheck": "tsc --watch",
27
- "typecheck:ci": "tsc",
20
+ "test": "jest --",
21
+ "test:ci": "jest",
22
+ "test:watch": "jest --watch --",
23
+ "typecheck": "tsc",
24
+ "typecheck:watch": "tsc --watch --",
28
25
  "update": "ncu -i",
29
26
  "update:auto": "ncu -u"
30
27
  },
31
28
  "dependencies": {
32
- "@lindorm/errors": "^0.1.12",
33
- "@lindorm/is": "^0.1.11",
34
- "@lindorm/kryptos": "^0.4.5"
29
+ "@lindorm/errors": "^0.1.13",
30
+ "@lindorm/is": "^0.1.12",
31
+ "@lindorm/kryptos": "^0.5.0"
35
32
  },
36
33
  "devDependencies": {
37
- "@lindorm/types": "^0.3.3"
34
+ "@lindorm/types": "^0.3.4"
38
35
  },
39
- "gitHead": "3302fa2c4d75f2832959018d9e089d11af4a35fc"
36
+ "gitHead": "4b8579886ad8a24c22a8bf260dd0bb5dc45afc08"
40
37
  }