@myazahq/kyc-sdk-react-native 2.0.2 → 2.1.0

package/src/emrtd/bac.ts

@@ -0,0 +1,128 @@
+import { concat, timingSafeEqual } from './bytes';
+import {
+  decrypt3Des,
+  deriveSessionKeys,
+  encrypt3Des,
+  keySeed,
+  macWithPadding,
+  type EmrtdPrimitives,
+  type MrzKeyFields,
+  type SessionKeys,
+} from './crypto';
+
+// ---------------------------------------------------------------------------
+// Basic Access Control (ICAO 9303 Part 11 §4.3).
+//
+// A mutual authentication that proves both sides know a key derived from the
+// printed MRZ — which is the point: the chip only talks to someone who has
+// physically seen the document.
+//
+//   1. Ask the chip for a challenge (RND.IC).
+//   2. Send back RND.IFD | RND.IC | K.IFD, encrypted and MACed under the MRZ
+//      keys.
+//   3. The chip returns RND.IC | RND.IFD | K.IC the same way.
+//   4. Both sides XOR K.IFD with K.IC to get the session seed.
+//
+// Step 3 is where the chip is AUTHENTICATED: a chip that cannot produce a valid
+// MAC, or that echoes back the wrong nonce, does not hold the key. Both checks
+// below are mandatory — skipping the nonce check in particular would accept a
+// replayed response from an earlier session.
+//
+// Pure: no I/O. The caller does the APDU exchange, which is what makes this
+// testable against the standard's worked example.
+// ---------------------------------------------------------------------------
+
+/** What to send the chip, and what is needed to check its reply. */
+export interface BacChallenge {
+  /** The EXTERNAL AUTHENTICATE command data: E.IFD | M.IFD (40 bytes). */
+  command: Uint8Array;
+  /** Kept for the reply check — never leaves this process. */
+  rndIfd: Uint8Array;
+  rndIc: Uint8Array;
+  kIfd: Uint8Array;
+  kEnc: Uint8Array;
+  kMac: Uint8Array;
+}
+
+/**
+ * Build the mutual-authenticate command from the chip's challenge.
+ *
+ * `rndIfd` and `kIfd` are injectable so the ICAO worked example can be
+ * reproduced exactly; production leaves them out and takes real randomness.
+ * They MUST be unpredictable in production — a fixed RND.IFD makes the whole
+ * exchange replayable.
+ */
+export function buildBacChallenge(
+  p: EmrtdPrimitives,
+  mrz: MrzKeyFields,
+  rndIc: Uint8Array,
+  fixed?: { rndIfd?: Uint8Array; kIfd?: Uint8Array },
+): BacChallenge {
+  const seed = keySeed(p, mrz);
+  const { ksEnc: kEnc, ksMac: kMac } = deriveSessionKeys(p, seed);
+
+  const rndIfd = fixed?.rndIfd ?? p.randomBytes(8);
+  const kIfd = fixed?.kIfd ?? p.randomBytes(16);
+
+  const s = concat(rndIfd, rndIc, kIfd);
+  const eIfd = encrypt3Des(p, kEnc, s);
+  const mIfd = macWithPadding(p, kMac, eIfd);
+
+  return { command: concat(eIfd, mIfd), rndIfd, rndIc, kIfd, kEnc, kMac };
+}
+
+export class BacError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'BacError';
+    Object.setPrototypeOf(this, BacError.prototype);
+  }
+}
+
+/**
+ * Verify the chip's reply and derive the session.
+ *
+ * Throws {@link BacError} when the chip fails to prove it holds the key. That
+ * is not a "retry" condition — it means the MRZ was read wrong, or the thing
+ * answering is not the document.
+ */
+export function completeBac(
+  p: EmrtdPrimitives,
+  challenge: BacChallenge,
+  response: Uint8Array,
+): { keys: SessionKeys; ssc: Uint8Array } {
+  if (response.length !== 40) {
+    throw new BacError(`Unexpected response length ${response.length}; expected 40.`);
+  }
+
+  const eIc = response.subarray(0, 32);
+  const mIc = response.subarray(32, 40);
+
+  // The MAC first: without it, everything decrypted below is attacker-chosen.
+  if (!timingSafeEqual(macWithPadding(p, challenge.kMac, eIc), mIc)) {
+    throw new BacError('The chip’s response failed its integrity check.');
+  }
+
+  const r = decrypt3Des(p, challenge.kEnc, eIc);
+  const rndIcEcho = r.subarray(0, 8);
+  const rndIfdEcho = r.subarray(8, 16);
+  const kIc = r.subarray(16, 32);
+
+  // Both nonces must come back. Checking only the MAC would accept a replayed
+  // response from an earlier session with the same document.
+  if (!timingSafeEqual(rndIcEcho, challenge.rndIc)) {
+    throw new BacError('The chip echoed the wrong challenge.');
+  }
+  if (!timingSafeEqual(rndIfdEcho, challenge.rndIfd)) {
+    throw new BacError('The chip echoed the wrong terminal nonce.');
+  }
+
+  const seed = new Uint8Array(16);
+  for (let i = 0; i < 16; i++) seed[i] = challenge.kIfd[i]! ^ kIc[i]!;
+
+  // The send-sequence counter starts as the low four bytes of each nonce, in
+  // that order — it is incremented before every secure-messaging command.
+  const ssc = concat(challenge.rndIc.subarray(4, 8), challenge.rndIfd.subarray(4, 8));
+
+  return { keys: deriveSessionKeys(p, seed), ssc };
+}

package/src/emrtd/bytes.ts

@@ -0,0 +1,127 @@
+// ---------------------------------------------------------------------------
+// Byte helpers.
+//
+// React Native has no Buffer and no Node crypto, and the native bridge speaks
+// base64, so these are the conversions everything else in the eMRTD code sits
+// on. Kept dependency-free and exact: a subtle bug here would surface as a
+// failed MAC three layers up, where it looks like a wrong key.
+// ---------------------------------------------------------------------------
+
+const B64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+
+/** Bytes → base64. */
+export function toBase64(bytes: Uint8Array): string {
+  let out = '';
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i]!;
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    out += B64_CHARS[b0 >> 2];
+    out += B64_CHARS[((b0 & 0x03) << 4) | ((b1 ?? 0) >> 4)];
+    out += b1 === undefined ? '=' : B64_CHARS[((b1 & 0x0f) << 2) | ((b2 ?? 0) >> 6)];
+    out += b2 === undefined ? '=' : B64_CHARS[b2 & 0x3f];
+  }
+  return out;
+}
+
+/** base64 → bytes. Ignores whitespace and padding. */
+export function fromBase64(b64: string): Uint8Array {
+  const clean = b64.replace(/[^A-Za-z0-9+/]/g, '');
+  const out = new Uint8Array(Math.floor((clean.length * 3) / 4));
+  let o = 0;
+  for (let i = 0; i < clean.length; i += 4) {
+    const c0 = B64_CHARS.indexOf(clean[i]!);
+    const c1 = B64_CHARS.indexOf(clean[i + 1] ?? 'A');
+    const c2 = clean[i + 2] === undefined ? -1 : B64_CHARS.indexOf(clean[i + 2]!);
+    const c3 = clean[i + 3] === undefined ? -1 : B64_CHARS.indexOf(clean[i + 3]!);
+    out[o++] = (c0 << 2) | (c1 >> 4);
+    if (c2 >= 0) out[o++] = ((c1 & 0x0f) << 4) | (c2 >> 2);
+    if (c3 >= 0) out[o++] = ((c2 & 0x03) << 6) | c3;
+  }
+  return out.subarray(0, o);
+}
+
+/** Bytes → lowercase hex. For logs and test vectors. */
+export function toHex(bytes: Uint8Array): string {
+  let out = '';
+  for (const b of bytes) out += b.toString(16).padStart(2, '0');
+  return out;
+}
+
+/** Hex → bytes. Whitespace is ignored so spec vectors can be pasted as-is. */
+export function fromHex(hex: string): Uint8Array {
+  const clean = hex.replace(/\s+/g, '');
+  const out = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+/** ASCII → bytes. The MRZ alphabet is ASCII by definition. */
+export function fromAscii(text: string): Uint8Array {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i) & 0xff;
+  return out;
+}
+
+export function concat(...parts: Uint8Array[]): Uint8Array {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+
+export function xor(a: Uint8Array, b: Uint8Array): Uint8Array {
+  const out = new Uint8Array(Math.min(a.length, b.length));
+  for (let i = 0; i < out.length; i++) out[i] = a[i]! ^ b[i]!;
+  return out;
+}
+
+/**
+ * Constant-time equality.
+ *
+ * Used for MAC comparison. A short-circuiting `===` over a MAC leaks, through
+ * timing, how many leading bytes were right — which is enough to forge one byte
+ * at a time. The cost of doing it properly is nothing.
+ */
+export function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;
+  return diff === 0;
+}
+
+/**
+ * ISO/IEC 9797-1 padding method 2: append 0x80, then zeros to a block edge.
+ * Applied to plaintext before encryption AND to data before MACing.
+ */
+export function padToBlock(data: Uint8Array, blockSize = 8): Uint8Array {
+  // The 0x80 is ALWAYS appended, so already-aligned input grows by a whole
+  // block. That is the standard's rule and it is what makes the padding
+  // unambiguously strippable — without it, data ending in 0x80 would be
+  // indistinguishable from padding.
+  const size = Math.ceil((data.length + 1) / blockSize) * blockSize;
+  const out = new Uint8Array(size);
+  out.set(data);
+  out[data.length] = 0x80;
+  return out;
+}
+
+/**
+ * Strip ISO 9797-1 method 2 padding.
+ *
+ * Returns the input unchanged when it does not end in a valid padding run — a
+ * chip that pads differently should cost us nothing.
+ */
+export function unpadFromBlock(data: Uint8Array, blockSize = 8): Uint8Array {
+  for (let i = data.length - 1; i >= 0 && data.length - i <= blockSize; i--) {
+    if (data[i] === 0x80) return data.subarray(0, i);
+    if (data[i] !== 0x00) break;
+  }
+  return data;
+}

package/src/emrtd/crypto.ts

@@ -0,0 +1,163 @@
+import { concat, fromBase64, padToBlock, toBase64, xor } from './bytes';
+
+// ---------------------------------------------------------------------------
+// eMRTD crypto (ICAO 9303 Part 11).
+//
+// The small set of operations BAC is built from: two-key 3DES in CBC mode, the
+// ISO 9797-1 Algorithm 3 "retail MAC", and the key-derivation function.
+//
+// The BLOCK CIPHERS come from the platform (see MyazaEmrtd.nitro.ts); the
+// CONSTRUCTIONS on top of them are here, in TypeScript, because that is the
+// part the standard specifies and the part worth testing. Every function below
+// is checked against the worked example in ICAO 9303 Part 11 Appendix D — which
+// is what makes this trustworthy without a passport in hand.
+// ---------------------------------------------------------------------------
+
+/** The block-cipher and digest operations the protocol needs. */
+export interface EmrtdPrimitives {
+  sha1(data: Uint8Array): Uint8Array;
+  sha256(data: Uint8Array): Uint8Array;
+  desEde2Cbc(key16: Uint8Array, data: Uint8Array, iv: Uint8Array, encrypt: boolean): Uint8Array;
+  desBlock(key8: Uint8Array, block: Uint8Array, encrypt: boolean): Uint8Array;
+  aesCbc(key: Uint8Array, data: Uint8Array, iv: Uint8Array, encrypt: boolean): Uint8Array;
+  aesCmac(key: Uint8Array, data: Uint8Array): Uint8Array;
+  randomBytes(length: number): Uint8Array;
+}
+
+/** Cipher-block size for DES/3DES, and the unit padding aligns to. */
+export const BLOCK_SIZE = 8;
+
+const ZERO_IV = new Uint8Array(BLOCK_SIZE);
+
+/**
+ * ISO 9797-1 Algorithm 3 MAC ("retail MAC"): single-DES-CBC the whole message
+ * under the first half of the key, then decrypt the final block with the second
+ * half and re-encrypt with the first.
+ *
+ * `data` must already be padded — the caller pads, because the same padded
+ * bytes are needed for the MAC and (in secure messaging) for the length field.
+ */
+export function retailMac(
+  p: EmrtdPrimitives,
+  key16: Uint8Array,
+  data: Uint8Array,
+): Uint8Array {
+  const k1 = key16.subarray(0, 8);
+  const k2 = key16.subarray(8, 16);
+
+  // CBC by hand: the primitive is a raw block cipher, and chaining is one XOR.
+  let chain: Uint8Array = new Uint8Array(BLOCK_SIZE);
+  for (let off = 0; off < data.length; off += BLOCK_SIZE) {
+    const input = xor(data.subarray(off, off + BLOCK_SIZE), chain);
+    chain = p.desBlock(k1, input, true);
+  }
+
+  return p.desBlock(k1, p.desBlock(k2, chain, false), true);
+}
+
+/**
+ * Set the (cryptographically ignored) DES parity bits.
+ *
+ * DES discards the low bit of every key byte, so this changes nothing about the
+ * cipher — but the standard's worked examples carry adjusted keys, and matching
+ * them is how the derivation is verified.
+ */
+export function adjustParity(key: Uint8Array): Uint8Array {
+  const out = new Uint8Array(key);
+  for (let i = 0; i < out.length; i++) {
+    let ones = 0;
+    for (let bit = 1; bit < 8; bit++) if ((out[i]! & (1 << bit)) !== 0) ones++;
+    out[i] = ones % 2 === 0 ? out[i]! | 0x01 : out[i]! & 0xfe;
+  }
+  return out;
+}
+
+/**
+ * SHA-1 over a seed plus a 4-byte counter — the raw digest, before any
+ * key-specific treatment. The counter is 1 for the encryption key, 2 for the
+ * MAC key, 3 for the PACE password key.
+ */
+export function deriveDigestSha1(
+  p: EmrtdPrimitives,
+  seed: Uint8Array,
+  counter: number,
+): Uint8Array {
+  return p.sha1(concat(seed, new Uint8Array([0, 0, 0, counter])));
+}
+
+/**
+ * ICAO 9303 key derivation for 3DES: the leading 16 digest bytes, parity
+ * adjusted. AES keys skip the parity step — it is a DES-only convention, and
+ * applying it to an AES key silently produces the wrong key.
+ */
+export function deriveKey(
+  p: EmrtdPrimitives,
+  seed: Uint8Array,
+  counter: number,
+): Uint8Array {
+  return adjustParity(deriveDigestSha1(p, seed, counter).subarray(0, 16));
+}
+
+// The MRZ-derived key lives in ./mrzKey; re-exported so callers keep one import.
+export { keySeed, mrzKeySeedInput, type MrzKeyFields } from './mrzKey';
+
+/** The pair of session keys derived from a seed. */
+export interface SessionKeys {
+  /** Encryption key (counter 1). */
+  ksEnc: Uint8Array;
+  /** MAC key (counter 2). */
+  ksMac: Uint8Array;
+}
+
+export function deriveSessionKeys(p: EmrtdPrimitives, seed: Uint8Array): SessionKeys {
+  return { ksEnc: deriveKey(p, seed, 1), ksMac: deriveKey(p, seed, 2) };
+}
+
+/** 3DES-CBC with the zero IV that BAC specifies. */
+export function encrypt3Des(
+  p: EmrtdPrimitives,
+  key16: Uint8Array,
+  data: Uint8Array,
+): Uint8Array {
+  return p.desEde2Cbc(key16, data, ZERO_IV, true);
+}
+
+export function decrypt3Des(
+  p: EmrtdPrimitives,
+  key16: Uint8Array,
+  data: Uint8Array,
+): Uint8Array {
+  return p.desEde2Cbc(key16, data, ZERO_IV, false);
+}
+
+/** MAC over already-unpadded data — pads, then runs the retail MAC. */
+export function macWithPadding(
+  p: EmrtdPrimitives,
+  key16: Uint8Array,
+  data: Uint8Array,
+): Uint8Array {
+  return retailMac(p, key16, padToBlock(data, BLOCK_SIZE));
+}
+
+/** Adapts the native HybridObject (base64 in and out) to {@link EmrtdPrimitives}. */
+export function primitivesFromNative(native: {
+  sha1(d: string): string;
+  sha256(d: string): string;
+  desEde2Cbc(k: string, d: string, iv: string, e: boolean): string;
+  desBlock(k: string, b: string, e: boolean): string;
+  aesCbc(k: string, d: string, iv: string, e: boolean): string;
+  aesCmac(k: string, d: string): string;
+  randomBytes(n: number): string;
+}): EmrtdPrimitives {
+  const b = fromBase64;
+  const s = toBase64;
+  return {
+    sha1: (d) => b(native.sha1(s(d))),
+    sha256: (d) => b(native.sha256(s(d))),
+    desEde2Cbc: (k, d, iv, e) => b(native.desEde2Cbc(s(k), s(d), s(iv), e)),
+    desBlock: (k, blk, e) => b(native.desBlock(s(k), s(blk), e)),
+    aesCbc: (k, d, iv, e) => b(native.aesCbc(s(k), s(d), s(iv), e)),
+    aesCmac: (k, d) => b(native.aesCmac(s(k), s(d))),
+    randomBytes: (n) => b(native.randomBytes(n)),
+  };
+}

package/src/emrtd/der.ts

@@ -0,0 +1,192 @@
+// ---------------------------------------------------------------------------
+// A minimal BER-TLV / DER reader.
+//
+// Every structure the chip returns is BER-TLV: the elementary files, the
+// security object, the secure-messaging response objects. This reads exactly
+// what those need and nothing more — a general ASN.1 library would be a large
+// dependency for a handful of shapes, and the parsing surface here is exposed
+// to whatever a chip (or something impersonating one) sends.
+//
+// Which is why it is DEFENSIVE throughout: every length is checked against the
+// remaining buffer before it is used. A malformed tag returns null rather than
+// reading past the end.
+// ---------------------------------------------------------------------------
+
+export interface Tlv {
+  /** The tag, as an integer — 0x5F1F for a two-byte tag, and so on. */
+  tag: number;
+  /** The value, as a view into the source buffer (no copy). */
+  value: Uint8Array;
+  /** Offset just past this element, for iterating siblings. */
+  end: number;
+}
+
+/**
+ * Read one TLV at `offset`, or null when the buffer does not hold a complete,
+ * well-formed element there.
+ */
+export function readTlv(data: Uint8Array, offset = 0): Tlv | null {
+  if (offset >= data.length) return null;
+
+  // Tag: low five bits all set means the tag number continues into further
+  // bytes, each of which carries a continuation flag in its top bit.
+  let tag = data[offset]!;
+  let i = offset + 1;
+  if ((tag & 0x1f) === 0x1f) {
+    // Multi-byte tag: each subsequent byte continues the number while its top
+    // bit is set. Bounded at four bytes — nothing a passport emits is longer,
+    // and an unbounded loop here is exactly what a crafted file would exploit.
+    for (let n = 0; ; n++) {
+      if (i >= data.length || n >= 3) return null;
+      const byte = data[i]!;
+      tag = tag * 256 + byte;
+      i++;
+      if ((byte & 0x80) === 0) break;
+    }
+  }
+
+  if (i >= data.length) return null;
+
+  // Length: short form is one byte under 0x80; long form's low bits give the
+  // number of length bytes that follow.
+  let length = data[i]!;
+  i++;
+  if ((length & 0x80) !== 0) {
+    const count = length & 0x7f;
+    // 0x80 alone is the indefinite form, which DER forbids and a chip will not
+    // send; more than four length bytes exceeds anything addressable here.
+    if (count === 0 || count > 4 || i + count > data.length) return null;
+    length = 0;
+    for (let n = 0; n < count; n++) {
+      length = length * 256 + data[i]!;
+      i++;
+    }
+  }
+
+  if (i + length > data.length) return null;
+  return { tag, value: data.subarray(i, i + length), end: i + length };
+}
+
+/** Just the tag and length, without needing the value to be present. */
+export interface TlvHeader {
+  tag: number;
+  /** Bytes the tag and length occupy. */
+  headerLength: number;
+  /** Bytes of value that FOLLOW the header. */
+  valueLength: number;
+}
+
+/**
+ * Read a TLV header from a prefix of the element.
+ *
+ * `readTlv` requires the whole value to be present, which is exactly what the
+ * caller does not have when probing a chip file's size — the point of the probe
+ * is to LEARN that size. This reads only as far as the length field.
+ */
+export function readTlvHeader(data: Uint8Array, offset = 0): TlvHeader | null {
+  if (offset >= data.length) return null;
+
+  let tag = data[offset]!;
+  let i = offset + 1;
+  if ((tag & 0x1f) === 0x1f) {
+    for (let n = 0; ; n++) {
+      if (i >= data.length || n >= 3) return null;
+      const byte = data[i]!;
+      tag = tag * 256 + byte;
+      i++;
+      if ((byte & 0x80) === 0) break;
+    }
+  }
+
+  if (i >= data.length) return null;
+  let valueLength = data[i]!;
+  i++;
+  if ((valueLength & 0x80) !== 0) {
+    const count = valueLength & 0x7f;
+    if (count === 0 || count > 4 || i + count > data.length) return null;
+    valueLength = 0;
+    for (let n = 0; n < count; n++) {
+      valueLength = valueLength * 256 + data[i]!;
+      i++;
+    }
+  }
+
+  return { tag, headerLength: i - offset, valueLength };
+}
+
+/** Every TLV at this level, in order. Stops at the first malformed element. */
+export function readTlvSequence(data: Uint8Array, offset = 0): Tlv[] {
+  const out: Tlv[] = [];
+  let i = offset;
+  while (i < data.length) {
+    const tlv = readTlv(data, i);
+    if (!tlv) break;
+    out.push(tlv);
+    // A zero-length element at the same offset would loop forever.
+    if (tlv.end <= i) break;
+    i = tlv.end;
+  }
+  return out;
+}
+
+/** The first TLV with this tag at the top level, or null. */
+export function findTlv(data: Uint8Array, tag: number): Tlv | null {
+  return readTlvSequence(data).find((t) => t.tag === tag) ?? null;
+}
+
+/**
+ * Depth-first search for a tag at any nesting level.
+ *
+ * Constructed elements (bit 6 of the first tag byte) are descended into. The
+ * depth is bounded because a crafted file could otherwise nest deeply enough to
+ * exhaust the stack.
+ */
+export function findTlvDeep(data: Uint8Array, tag: number, maxDepth = 12): Tlv | null {
+  if (maxDepth <= 0) return null;
+  for (const tlv of readTlvSequence(data)) {
+    if (tlv.tag === tag) return tlv;
+    const firstTagByte = tagFirstByte(tlv.tag);
+    if ((firstTagByte & 0x20) !== 0) {
+      const nested = findTlvDeep(tlv.value, tag, maxDepth - 1);
+      if (nested) return nested;
+    }
+  }
+  return null;
+}
+
+/** The leading byte of a (possibly multi-byte) tag. */
+function tagFirstByte(tag: number): number {
+  let t = tag;
+  while (t > 0xff) t >>= 8;
+  return t;
+}
+
+/**
+ * Encode a TLV.
+ *
+ * Only the short and two-byte long forms are emitted, which covers every
+ * command this SDK builds — the longest is a DG2 read, and command data never
+ * approaches 64KB.
+ */
+export function encodeTlv(tag: number, value: Uint8Array): Uint8Array {
+  const tagBytes: number[] = [];
+  let t = tag;
+  while (t > 0) {
+    tagBytes.unshift(t & 0xff);
+    t >>= 8;
+  }
+  if (tagBytes.length === 0) tagBytes.push(0);
+
+  const lengthBytes: number[] =
+    value.length < 0x80
+      ? [value.length]
+      : value.length <= 0xff
+        ? [0x81, value.length]
+        : [0x82, (value.length >> 8) & 0xff, value.length & 0xff];
+
+  const out = new Uint8Array(tagBytes.length + lengthBytes.length + value.length);
+  out.set(tagBytes, 0);
+  out.set(lengthBytes, tagBytes.length);
+  out.set(value, tagBytes.length + lengthBytes.length);
+  return out;
+}