@matter/thread-br-client 0.0.1 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/src/dtls/channel/NobleDtlsChannel.ts

@@ -9,6 +9,7 @@ import {
     Crypto,
     type Duration,
     type Entropy,
+    errorOf,
     ImplementationError,
     InternalError,
     Logger,
@@ -102,8 +103,16 @@ export class NobleDtlsChannel implements DtlsChannel {
 
     #udp: UdpSocket | undefined;
     #client: DtlsClient | undefined;
+    #crypto: Crypto | undefined;
     #retransmit: DtlsRetransmitTimer | undefined;
 
+    /**
+     * Serializes every DtlsClient / record-codec interaction. UDP `onData` fires
+     * sequentially but async handlers interleave at each `await`; chaining onto this
+     * promise guarantees datagrams and retransmits never re-enter the client concurrently.
+     */
+    #inbound: Promise<void> = Promise.resolve();
+
     /** Established cipher state (snapshot of the DtlsClient's after handshake). */
     #cipherState: DtlsCipherState | undefined;
     #connected = false;
@@ -153,14 +162,18 @@ export class NobleDtlsChannel implements DtlsChannel {
 
         const environment = this.#opts.environment;
         const network = environment.get(Network);
-        const entropy = environment.get(Crypto);
+        const crypto = environment.get(Crypto);
+        this.#crypto = crypto;
         const udp = await network.createUdpSocket({ type: this.#udpType, listeningPort: 0 });
         if (this.#closed) {
             await udp.close();
             throw new ImplementationError("NobleDtlsChannel.connect: closed");
         }
         this.#udp = udp;
-        udp.onData((_netInterface, _peerAddress, _peerPort, data) => this.#onDatagram(Bytes.of(data)));
+        udp.onData((_netInterface, _peerAddress, _peerPort, data) => {
+            const bytes = Bytes.of(data);
+            this.#enqueue(() => this.#onDatagram(bytes));
+        });
 
         const initialRetransmit: Duration =
             this.#opts.initialRetransmitMs !== undefined
@@ -170,9 +183,10 @@ export class NobleDtlsChannel implements DtlsChannel {
             this.#opts.maxRetransmitMs !== undefined ? Millis(this.#opts.maxRetransmitMs) : DEFAULT_MAX_RETRANSMIT;
 
         const clientCfg: DtlsClientConfig = {
+            crypto,
             password: this.#opts.password,
-            random: this.#opts.random ?? (() => defaultRandom(entropy)),
-            ephemeralScalar: this.#opts.ephemeralScalar ?? (() => defaultEphemeralScalar(entropy)),
+            random: this.#opts.random ?? (() => defaultRandom(crypto)),
+            ephemeralScalar: this.#opts.ephemeralScalar ?? (() => defaultEphemeralScalar(crypto)),
             initialRetransmitMs: initialRetransmit,
             maxRetransmitMs: maxRetransmit,
             mtu: this.#opts.mtu ?? DEFAULT_MTU,
@@ -184,7 +198,7 @@ export class NobleDtlsChannel implements DtlsChannel {
             initialMs: initialRetransmit,
             maxMs: maxRetransmit,
             maxRetransmits: this.#opts.maxRetransmits ?? DEFAULT_MAX_RETRANSMITS,
-            onRetransmit: () => this.#onRetransmit(),
+            onRetransmit: () => this.#enqueue(() => this.#onRetransmit()),
             onGiveUp: () => this.#fail(new DtlsError("NobleDtlsChannel: handshake gave up after max retransmits")),
         });
 
@@ -197,14 +211,9 @@ export class NobleDtlsChannel implements DtlsChannel {
             this.#fail(new TimeoutError(`NobleDtlsChannel: connect timed out after ${connectTimeout}ms`)),
         ).start();
 
-        // Drive the first flight.
-        try {
-            const step = client.start();
-            this.#sendRecords(step.records);
-            this.#retransmit.armNewFlight();
-        } catch (e) {
-            this.#fail(e instanceof Error ? e : new InternalError(String(e)));
-        }
+        // Drive the first flight on the same serialization queue as inbound/retransmit,
+        // so a datagram arriving mid-`start()` cannot re-enter the client concurrently.
+        this.#enqueue(() => this.#startHandshake());
 
         try {
             await connectPromise;
@@ -223,18 +232,22 @@ export class NobleDtlsChannel implements DtlsChannel {
         }
         const cipherState = this.#cipherState;
         const udp = this.#udp;
-        if (cipherState === undefined || udp === undefined) {
+        const crypto = this.#crypto;
+        if (cipherState === undefined || udp === undefined || crypto === undefined) {
             throw new InternalError("NobleDtlsChannel.send: missing cipher state or transport");
         }
         const seq = cipherState.nextWriteSeq();
-        const record = DtlsRecord.encode(
-            {
-                type: ContentType.APPLICATION_DATA,
-                epoch: cipherState.writeEpoch,
-                sequenceNumber: seq,
-                fragment: Bytes.of(bytes),
-            },
-            cipherState,
+        const record = Bytes.of(
+            await DtlsRecord.encode(
+                crypto,
+                {
+                    type: ContentType.APPLICATION_DATA,
+                    epoch: cipherState.writeEpoch,
+                    sequenceNumber: seq,
+                    fragment: Bytes.of(bytes),
+                },
+                cipherState,
+            ),
         );
         await this.#sendDatagram(udp, record);
     }
@@ -285,17 +298,21 @@ export class NobleDtlsChannel implements DtlsChannel {
         // Best-effort close_notify alert at epoch 1 if armed.
         const cipherState = this.#cipherState;
         const udp = this.#udp;
-        if (this.#connected && cipherState !== undefined && udp !== undefined) {
+        const crypto = this.#crypto;
+        if (this.#connected && cipherState !== undefined && udp !== undefined && crypto !== undefined) {
             try {
                 const seq = cipherState.nextWriteSeq();
-                const alertRecord = DtlsRecord.encode(
-                    {
-                        type: ContentType.ALERT,
-                        epoch: cipherState.writeEpoch,
-                        sequenceNumber: seq,
-                        fragment: Uint8Array.of(ALERT_LEVEL_WARNING, ALERT_DESC_CLOSE_NOTIFY),
-                    },
-                    cipherState,
+                const alertRecord = Bytes.of(
+                    await DtlsRecord.encode(
+                        crypto,
+                        {
+                            type: ContentType.ALERT,
+                            epoch: cipherState.writeEpoch,
+                            sequenceNumber: seq,
+                            fragment: Uint8Array.of(ALERT_LEVEL_WARNING, ALERT_DESC_CLOSE_NOTIFY),
+                        },
+                        cipherState,
+                    ),
                 );
                 await this.#sendDatagram(udp, alertRecord).catch(() => {});
             } catch {
@@ -337,28 +354,50 @@ export class NobleDtlsChannel implements DtlsChannel {
     // -----------------------------------------------------------------------
     // Internals
 
-    #onDatagram(bytes: Uint8Array): void {
+    /**
+     * Chain `work` onto the single serialization queue. The `.catch` routes any error to
+     * {@link #fail} (which rejects the pending connect / settles the channel error state)
+     * and keeps the queue alive — errors surface, never swallowed.
+     */
+    #enqueue(work: () => Promise<void>): void {
+        this.#inbound = this.#inbound.then(work).catch(err => this.#fail(errorOf(err)));
+    }
+
+    async #startHandshake(): Promise<void> {
+        const client = this.#client;
+        const retransmit = this.#retransmit;
+        if (client === undefined || retransmit === undefined) {
+            throw new InternalError("NobleDtlsChannel: start before client/timer initialised");
+        }
+        const step = await client.start();
+        if (this.#closed) {
+            return;
+        }
+        this.#sendRecords(step.records);
+        retransmit.armNewFlight();
+    }
+
+    async #onDatagram(bytes: Uint8Array): Promise<void> {
         if (this.#closed) {
             return;
         }
-        try {
-            if (this.#connected) {
-                this.#handleAppDatagram(bytes);
-            } else {
-                this.#handleHandshakeDatagram(bytes);
-            }
-        } catch (e) {
-            this.#fail(e instanceof Error ? e : new InternalError(String(e)));
+        if (this.#connected) {
+            await this.#handleAppDatagram(bytes);
+        } else {
+            await this.#handleHandshakeDatagram(bytes);
         }
     }
 
-    #handleHandshakeDatagram(bytes: Uint8Array): void {
+    async #handleHandshakeDatagram(bytes: Uint8Array): Promise<void> {
         const client = this.#client;
         const retransmit = this.#retransmit;
         if (client === undefined || retransmit === undefined) {
             throw new InternalError("NobleDtlsChannel: handshake datagram before client/timer initialised");
         }
-        const step = client.onDatagram(bytes);
+        const step = await client.onDatagram(bytes);
+        if (this.#closed) {
+            return;
+        }
         // RFC 6347 §4.2.4: receiving the next flight implicitly acknowledges the previous one.
         retransmit.cancel();
         if (step.records.length > 0) {
@@ -377,9 +416,10 @@ export class NobleDtlsChannel implements DtlsChannel {
         }
     }
 
-    #handleAppDatagram(bytes: Uint8Array): void {
+    async #handleAppDatagram(bytes: Uint8Array): Promise<void> {
         const cipherState = this.#cipherState;
-        if (cipherState === undefined) {
+        const crypto = this.#crypto;
+        if (cipherState === undefined || crypto === undefined) {
             throw new InternalError("NobleDtlsChannel: post-handshake datagram with no cipher state");
         }
         let p = 0;
@@ -395,7 +435,7 @@ export class NobleDtlsChannel implements DtlsChannel {
             const slice = bytes.subarray(p, recordEnd);
             let record: DtlsRecord;
             try {
-                ({ record } = DtlsRecord.decode(slice, cipherState));
+                ({ record } = await DtlsRecord.decode(crypto, slice, cipherState));
             } catch (e) {
                 // RFC 6347 §4.1.2.6: a replayed/old-sequence record is benign (normal UDP
                 // duplication) — drop just this record and keep processing the datagram.
@@ -408,16 +448,17 @@ export class NobleDtlsChannel implements DtlsChannel {
                 throw e;
             }
             if (record.type === ContentType.APPLICATION_DATA) {
-                this.#deliverPlaintext(record.fragment);
+                this.#deliverPlaintext(Bytes.of(record.fragment));
             } else if (record.type === ContentType.ALERT) {
+                const alertFragment = Bytes.of(record.fragment);
                 // close_notify (level=1, desc=0) ends the session; other alerts surface as errors.
-                if (record.fragment.length >= 2 && record.fragment[1] === ALERT_DESC_CLOSE_NOTIFY) {
+                if (alertFragment.length >= 2 && alertFragment[1] === ALERT_DESC_CLOSE_NOTIFY) {
                     this.#fail(new DtlsError("NobleDtlsChannel: peer sent close_notify"));
                     return;
                 }
                 this.#fail(
                     new DtlsError(
-                        `NobleDtlsChannel: peer alert level=${record.fragment[0] ?? -1} desc=${record.fragment[1] ?? -1}`,
+                        `NobleDtlsChannel: peer alert level=${alertFragment[0] ?? -1} desc=${alertFragment[1] ?? -1}`,
                     ),
                 );
                 return;
@@ -441,20 +482,16 @@ export class NobleDtlsChannel implements DtlsChannel {
         }
     }
 
-    #onRetransmit(): void {
+    async #onRetransmit(): Promise<void> {
         const client = this.#client;
         if (client === undefined || this.#connected || this.#closed) {
             return;
         }
-        try {
-            const step = client.onRetransmit();
-            this.#sendRecords(step.records);
-        } catch (e) {
-            this.#fail(e instanceof Error ? e : new InternalError(String(e)));
-        }
+        const step = await client.onRetransmit();
+        this.#sendRecords(step.records);
     }
 
-    #sendRecords(records: Uint8Array[]): void {
+    #sendRecords(records: Bytes[]): void {
         const udp = this.#udp;
         if (udp === undefined) {
             throw new InternalError("NobleDtlsChannel: send before bind");
@@ -469,7 +506,8 @@ export class NobleDtlsChannel implements DtlsChannel {
         const datagrams = new Array<Uint8Array>();
         let acc = new Array<Uint8Array>();
         let accLen = 0;
-        for (const record of records) {
+        for (const rawRecord of records) {
+            const record = Bytes.of(rawRecord);
             if (accLen > 0 && accLen + record.length > mtu) {
                 datagrams.push(concatBuffers(acc));
                 acc = [];
@@ -482,9 +520,7 @@ export class NobleDtlsChannel implements DtlsChannel {
             datagrams.push(concatBuffers(acc));
         }
         for (const dg of datagrams) {
-            void this.#sendDatagram(udp, dg).catch(e =>
-                this.#fail(e instanceof Error ? e : new InternalError(String(e))),
-            );
+            void this.#sendDatagram(udp, dg).catch(e => this.#fail(errorOf(e)));
         }
     }
 

package/src/dtls/ecjpake/EcJpakePms.ts

@@ -4,9 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
+import { Bytes, Crypto, InternalError } from "@matter/general";
 import { p256 } from "@noble/curves/nist.js";
-import { sha256 } from "@noble/hashes/sha2.js";
 import { DtlsError } from "../channel/DtlsChannel.js";
 
 const Point = p256.Point;
@@ -35,7 +34,7 @@ const COORDINATE_BYTES = 32;
  * TLS 1.2 PRF takes over (Phase 0c.5 / DTLS layer).
  */
 export const EcJpakePms = {
-    derive(args: { Xp: Uint8Array; Xp2: Uint8Array; xm2: bigint; s: bigint }): Uint8Array {
+    async derive(crypto: Crypto, args: { Xp: Bytes; Xp2: Bytes; xm2: bigint; s: bigint }): Promise<Bytes> {
         const { Xp, Xp2, xm2, s } = args;
         if (xm2 <= 0n || xm2 >= N) {
             throw new InternalError("xm2 must be in [1, n-1]");
@@ -43,8 +42,8 @@ export const EcJpakePms = {
         if (s <= 0n) {
             throw new InternalError("s (password as integer) must be positive");
         }
-        const Xp_pt = Point.fromBytes(Xp);
-        const Xp2_pt = Point.fromBytes(Xp2);
+        const Xp_pt = Point.fromBytes(Bytes.of(Xp));
+        const Xp2_pt = Point.fromBytes(Bytes.of(Xp2));
         if (Xp_pt.is0() || Xp2_pt.is0()) {
             throw new DtlsError("peer points must not be the point at infinity");
         }
@@ -60,6 +59,6 @@ export const EcJpakePms = {
         // 0x04 || X(32) || Y(32) — slice X out at offset 1.
         const sec1 = K.toBytes(false);
         const xBytes = sec1.subarray(1, 1 + COORDINATE_BYTES);
-        return sha256(xBytes);
+        return Bytes.of(await crypto.computeHash(xBytes));
     },
 } as const;

package/src/dtls/ecjpake/EcJpakeRound.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
+import { Bytes, Crypto, InternalError } from "@matter/general";
 import { p256 } from "@noble/curves/nist.js";
 import { DtlsError } from "../channel/DtlsChannel.js";
 import { SchnorrZkp, type SchnorrZkpGenerator } from "./SchnorrZkp.js";
@@ -22,7 +22,7 @@ import { SchnorrZkp, type SchnorrZkpGenerator } from "./SchnorrZkp.js";
  */
 export interface EcJpakeKeyKP {
     /** SEC1-uncompressed public key `X = x*G`. */
-    X: Uint8Array;
+    X: Bytes;
     /** Schnorr ZKP proving knowledge of `x`. */
     zkp: SchnorrZkp;
 }
@@ -57,38 +57,44 @@ function readSlice(bytes: Uint8Array, offset: number, length: number): Uint8Arra
 }
 
 function validateKeyKP(keyKP: EcJpakeKeyKP): void {
-    if (keyKP.X.length !== POINT_LEN || keyKP.X[0] !== 0x04) {
+    const X = Bytes.of(keyKP.X);
+    const V = Bytes.of(keyKP.zkp.V);
+    const r = Bytes.of(keyKP.zkp.r);
+    if (X.length !== POINT_LEN || X[0] !== 0x04) {
         throw new InternalError("X must be SEC1-uncompressed P-256 (65 bytes, 0x04 prefix)");
     }
-    if (keyKP.zkp.V.length !== POINT_LEN || keyKP.zkp.V[0] !== 0x04) {
+    if (V.length !== POINT_LEN || V[0] !== 0x04) {
         throw new InternalError("ZKP.V must be SEC1-uncompressed P-256 (65 bytes, 0x04 prefix)");
     }
-    if (keyKP.zkp.r.length === 0 || keyKP.zkp.r.length > 255) {
-        throw new InternalError(`ZKP.r length must be 1..255, got ${keyKP.zkp.r.length}`);
+    if (r.length === 0 || r.length > 255) {
+        throw new InternalError(`ZKP.r length must be 1..255, got ${r.length}`);
     }
     // Minimal-encoding invariant: leading byte must be non-zero (except r === 0,
     // already excluded above). mbedTLS produces the minimal form via mbedtls_mpi_size,
     // so ours must too if we want byte-identical output.
-    if (keyKP.zkp.r[0] === 0x00) {
+    if (r[0] === 0x00) {
         throw new InternalError("ZKP.r must be minimal big-endian (no leading zero)");
     }
 }
 
 function keyKpEncodedLength(keyKP: EcJpakeKeyKP): number {
-    return 1 + POINT_LEN + 1 + POINT_LEN + 1 + keyKP.zkp.r.length;
+    return 1 + POINT_LEN + 1 + POINT_LEN + 1 + keyKP.zkp.r.byteLength;
 }
 
 function writeKeyKP(keyKP: EcJpakeKeyKP, out: Uint8Array, offset: number): number {
+    const X = Bytes.of(keyKP.X);
+    const V = Bytes.of(keyKP.zkp.V);
+    const r = Bytes.of(keyKP.zkp.r);
     let p = offset;
     out[p++] = POINT_LEN;
-    out.set(keyKP.X, p);
+    out.set(X, p);
     p += POINT_LEN;
     out[p++] = POINT_LEN;
-    out.set(keyKP.zkp.V, p);
+    out.set(V, p);
     p += POINT_LEN;
-    out[p++] = keyKP.zkp.r.length;
-    out.set(keyKP.zkp.r, p);
-    p += keyKP.zkp.r.length;
+    out[p++] = r.length;
+    out.set(r, p);
+    p += r.length;
     return p;
 }
 
@@ -137,22 +143,25 @@ export const EcJpakeRound = {
      *
      * `id` is `ECJPAKE_ID_CLIENT` for the joiner and `ECJPAKE_ID_SERVER` for the commissioner.
      */
-    buildRound1(args: { x1: bigint; x2: bigint; v1: bigint; v2: bigint; id: string }): {
+    async buildRound1(
+        crypto: Crypto,
+        args: { x1: bigint; x2: bigint; v1: bigint; v2: bigint; id: string },
+    ): Promise<{
         kp1: EcJpakeKeyKP;
         kp2: EcJpakeKeyKP;
-    } {
+    }> {
         const { x1, x2, v1, v2, id } = args;
         const X1 = Point.BASE.multiply(x1).toBytes(false);
         const X2 = Point.BASE.multiply(x2).toBytes(false);
-        const zkp1 = SchnorrZkp.generate({ privateKey: x1, publicKey: X1, ephemeral: v1, id });
-        const zkp2 = SchnorrZkp.generate({ privateKey: x2, publicKey: X2, ephemeral: v2, id });
+        const zkp1 = await SchnorrZkp.generate(crypto, { privateKey: x1, publicKey: X1, ephemeral: v1, id });
+        const zkp2 = await SchnorrZkp.generate(crypto, { privateKey: x2, publicKey: X2, ephemeral: v2, id });
         return {
             kp1: { X: X1, zkp: zkp1 },
             kp2: { X: X2, zkp: zkp2 },
         };
     },
 
-    serializeRound1(kp1: EcJpakeKeyKP, kp2: EcJpakeKeyKP): Uint8Array {
+    serializeRound1(kp1: EcJpakeKeyKP, kp2: EcJpakeKeyKP): Bytes {
         validateKeyKP(kp1);
         validateKeyKP(kp2);
         const out = new Uint8Array(keyKpEncodedLength(kp1) + keyKpEncodedLength(kp2));
@@ -161,11 +170,12 @@ export const EcJpakeRound = {
         return out;
     },
 
-    parseRound1(bytes: Uint8Array): { kp1: EcJpakeKeyKP; kp2: EcJpakeKeyKP } {
-        const first = readKeyKP(bytes, 0);
-        const second = readKeyKP(bytes, first.nextOffset);
-        if (second.nextOffset !== bytes.length) {
-            throw new DtlsError(`trailing bytes after round-1 pair: ${bytes.length - second.nextOffset} extra`);
+    parseRound1(bytes: Bytes): { kp1: EcJpakeKeyKP; kp2: EcJpakeKeyKP } {
+        const buf = Bytes.of(bytes);
+        const first = readKeyKP(buf, 0);
+        const second = readKeyKP(buf, first.nextOffset);
+        if (second.nextOffset !== buf.length) {
+            throw new DtlsError(`trailing bytes after round-1 pair: ${buf.length - second.nextOffset} extra`);
         }
         return { kp1: first.kp, kp2: second.kp };
     },
@@ -176,8 +186,11 @@ export const EcJpakeRound = {
      * Both sides use the same formula by symmetry — for the client `Xp1 = X3`,
      * `Xp2 = X4`, `Xm1 = X1`; for the server `Xp1 = X1`, `Xp2 = X2`, `Xm1 = X3`.
      */
-    composeRound2Generator(args: { Xp1: Uint8Array; Xp2: Uint8Array; Xm1: Uint8Array }): SchnorrZkpGenerator {
-        const point = Point.fromBytes(args.Xp1).add(Point.fromBytes(args.Xp2)).add(Point.fromBytes(args.Xm1));
+    composeRound2Generator(args: { Xp1: Bytes; Xp2: Bytes; Xm1: Bytes }): SchnorrZkpGenerator {
+        const Xp1 = Bytes.of(args.Xp1);
+        const Xp2 = Bytes.of(args.Xp2);
+        const Xm1 = Bytes.of(args.Xm1);
+        const point = Point.fromBytes(Xp1).add(Point.fromBytes(Xp2)).add(Point.fromBytes(Xm1));
         if (point.is0()) {
             throw new DtlsError("round-2 generator G' must not be the point at infinity");
         }
@@ -193,7 +206,10 @@ export const EcJpakeRound = {
      * Caller-supplied `v` makes output deterministic for testing; production
      * callers must source `v` from a CSPRNG.
      */
-    buildRound2(args: { xm2: bigint; s: bigint; v: bigint; id: string; generator: SchnorrZkpGenerator }): EcJpakeKeyKP {
+    async buildRound2(
+        crypto: Crypto,
+        args: { xm2: bigint; s: bigint; v: bigint; id: string; generator: SchnorrZkpGenerator },
+    ): Promise<EcJpakeKeyKP> {
         const { xm2, s, v, id, generator } = args;
         if (xm2 <= 0n || xm2 >= N) {
             throw new InternalError("xm2 must be in [1, n-1]");
@@ -207,7 +223,7 @@ export const EcJpakeRound = {
         }
         const Xm = generator.point.multiply(xm);
         const XmBytes = Xm.toBytes(false);
-        const zkp = SchnorrZkp.generate({
+        const zkp = await SchnorrZkp.generate(crypto, {
             privateKey: xm,
             publicKey: XmBytes,
             ephemeral: v,
@@ -225,7 +241,7 @@ export const EcJpakeRound = {
      * Server-side messages (ServerKeyExchange) use `true`; client-side
      * (ClientKeyExchange) uses `false`.
      */
-    serializeRound2(kp: EcJpakeKeyKP, options: { prependEcParameters: boolean }): Uint8Array {
+    serializeRound2(kp: EcJpakeKeyKP, options: { prependEcParameters: boolean }): Bytes {
         validateKeyKP(kp);
         const headerLen = options.prependEcParameters ? 3 : 0;
         const out = new Uint8Array(headerLen + keyKpEncodedLength(kp));
@@ -244,24 +260,25 @@ export const EcJpakeRound = {
      * is the client reading ServerKeyExchange, and `false` when the parser is the
      * server reading ClientKeyExchange.
      */
-    parseRound2(bytes: Uint8Array, options: { expectEcParameters: boolean }): EcJpakeKeyKP {
+    parseRound2(bytes: Bytes, options: { expectEcParameters: boolean }): EcJpakeKeyKP {
+        const buf = Bytes.of(bytes);
         let p = 0;
         if (options.expectEcParameters) {
-            if (bytes.length < 3) {
+            if (buf.length < 3) {
                 throw new DtlsError("round-2 message too short for ECParameters header");
             }
-            if (bytes[0] !== 0x03 || bytes[1] !== 0x00 || bytes[2] !== 0x17) {
+            if (buf[0] !== 0x03 || buf[1] !== 0x00 || buf[2] !== 0x17) {
                 throw new DtlsError(
-                    `expected ECParameters{named_curve, secp256r1} (03 00 17), got ${Array.from(bytes.subarray(0, 3))
+                    `expected ECParameters{named_curve, secp256r1} (03 00 17), got ${Array.from(buf.subarray(0, 3))
                         .map(b => b.toString(16).padStart(2, "0"))
                         .join(" ")}`,
                 );
             }
             p = 3;
         }
-        const { kp, nextOffset } = readKeyKP(bytes, p);
-        if (nextOffset !== bytes.length) {
-            throw new DtlsError(`trailing bytes after round-2 message: ${bytes.length - nextOffset} extra`);
+        const { kp, nextOffset } = readKeyKP(buf, p);
+        if (nextOffset !== buf.length) {
+            throw new DtlsError(`trailing bytes after round-2 message: ${buf.length - nextOffset} extra`);
         }
         return kp;
     },
@@ -272,8 +289,11 @@ export const EcJpakeRound = {
      * on any verification failure — including malformed bytes — to mirror the
      * round-1 `SchnorrZkp.verify` contract.
      */
-    verifyRound2Zkp(args: { kp: EcJpakeKeyKP; generator: SchnorrZkpGenerator; peerId: string }): boolean {
+    async verifyRound2Zkp(
+        crypto: Crypto,
+        args: { kp: EcJpakeKeyKP; generator: SchnorrZkpGenerator; peerId: string },
+    ): Promise<boolean> {
         const { kp, generator, peerId } = args;
-        return SchnorrZkp.verify({ zkp: kp.zkp, publicKey: kp.X, id: peerId, generator });
+        return await SchnorrZkp.verify(crypto, { zkp: kp.zkp, publicKey: kp.X, id: peerId, generator });
     },
 } as const;