@noz-ele/edgca 0.1.0 → 0.3.0

package/dist/bytes.d.ts

@@ -6,4 +6,5 @@ export declare function bytesToBinary(bytes: Uint8Array): string;
 export declare function binaryToBytes(binary: string): Uint8Array;
 export declare function cloneBytes(bytes: Uint8Array): Uint8Array;
 export declare function arrayBufferFromBytes(bytes: Uint8Array): ArrayBuffer;
+export declare function randomBytes(length: number): Uint8Array;
 //# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAWpE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAWhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAYpD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAUvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAQxD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAExD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAInE"}
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAWpE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAWhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAYpD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAUvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAQxD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAExD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAInE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAItD"}

package/dist/bytes.js

@@ -56,3 +56,8 @@ export function arrayBufferFromBytes(bytes) {
     copy.set(bytes);
     return copy.buffer;
 }
+export function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return bytes;
+}

package/dist/ca.d.ts

@@ -1,6 +1,7 @@
-import type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate } from "./types.js";
+import type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey } from "./types.js";
 export declare function createRootCA(options: CreateRootCAOptions): Promise<CertificateAuthority>;
 export declare function issueIntermediateCA(options: IssueIntermediateCAOptions): Promise<CertificateAuthority>;
 export declare function issueClientCert(options: IssueClientCertOptions): Promise<IssuedClientCertificate>;
+export declare function issueClientCertForPublicKey(options: IssueClientCertForPublicKeyOptions): Promise<IssuedClientCertificateForPublicKey>;
 export declare function importCertificateAuthority(options: ImportCertificateAuthorityOptions): Promise<CertificateAuthority>;
 //# sourceMappingURL=ca.d.ts.map

package/dist/ca.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../src/ca.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAapB,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwB9F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8B5G;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyCvG;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB1H"}
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../src/ca.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EAEpC,MAAM,YAAY,CAAC;AAapB,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B9F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgC5G;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqBvG;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAkB9C;AAuDD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe1H"}

package/dist/ca.js

@@ -1,11 +1,12 @@
 import { bytesEqual, cloneBytes } from "./bytes.js";
-import { assertKeyPairMatches, exportSpki, generateKeyPair, importPrivateKeyPem, keyIdentifierFromSpki, keyPairFromPrivateKeyPem, privateKeyToPem, publicKeyToPem, signDer } from "./crypto.js";
+import { assertKeyPairMatches, curveOf, exportSpki, generateKeyPair, keyIdentifierFromSpki, signDer } from "./crypto.js";
 import { encodeName } from "./name.js";
 import { certificateToPem, pemToDer, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
 import { parseCertificateDer } from "./parser.js";
 import { authorityKeyIdentifierExtension, basicConstraintsCaExtension, basicConstraintsLeafExtension, buildCertificate, buildTbsCertificate, extendedKeyUsageClientAuthExtension, keyUsageExtension, subjectAltNameExtension, subjectKeyIdentifierExtension } from "./x509.js";
 export async function createRootCA(options) {
-    const keyPair = await resolveKeyPair(options.privateKeyPem);
+    const keyPair = await resolveKeyPair(options.keyPair);
+    const issuerCurve = curveOf(keyPair.privateKey);
     const subjectNameDer = encodeName(options.subject);
     const spki = await exportSpki(keyPair.publicKey);
     const keyIdentifier = await keyIdentifierFromSpki(spki);
@@ -23,10 +24,11 @@ export async function createRootCA(options) {
         issuerNameDer: subjectNameDer,
         subjectNameDer,
         subjectPublicKeyInfoDer: spki,
-        extensions
+        extensions,
+        issuerCurve
     });
     const signatureDer = await signDer(keyPair.privateKey, tbsCertificateDer);
-    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer, issuerCurve);
     return assembleCertificateAuthority(certDer, keyPair, "");
 }
 export async function issueIntermediateCA(options) {
@@ -34,7 +36,8 @@ export async function issueIntermediateCA(options) {
     const issuerChainPem = options.ca.issuerChainPem;
     assertCanIssueCertificate(issuer);
     assertCanIssueIntermediate(issuer, issuerChainPem, options.pathLenConstraint);
-    const keyPair = await resolveKeyPair(options.privateKeyPem);
+    const issuerCurve = curveOf(options.ca.privateKey);
+    const keyPair = await resolveKeyPair(options.keyPair);
     const subjectNameDer = encodeName(options.subject);
     const spki = await exportSpki(keyPair.publicKey);
     const subjectKeyIdentifier = await keyIdentifierFromSpki(spki);
@@ -52,23 +55,57 @@ export async function issueIntermediateCA(options) {
         issuerNameDer: issuer.subjectNameDer,
         subjectNameDer,
         subjectPublicKeyInfoDer: spki,
-        extensions
+        extensions,
+        issuerCurve
     });
     const signatureDer = await signDer(options.ca.privateKey, tbsCertificateDer);
-    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer, issuerCurve);
     const childChainPem = joinPemChain([options.ca.certPem, issuerChainPem]);
     return assembleCertificateAuthority(certDer, keyPair, childChainPem);
 }
 export async function issueClientCert(options) {
-    const issuer = await parseIssuer(options.ca);
-    const issuerChainPem = options.ca.issuerChainPem;
-    assertCanIssueCertificate(issuer);
     const keyPair = await generateKeyPair();
-    const subjectNameDer = encodeName(options.subject);
-    const spki = await exportSpki(keyPair.publicKey);
+    const built = await buildClientCertificate(options.ca, keyPair.publicKey, {
+        subject: options.subject,
+        days: options.days,
+        notBefore: options.notBefore,
+        serialNumber: options.serialNumber,
+        dnsNames: options.dnsNames,
+        ipAddresses: options.ipAddresses
+    });
+    return {
+        certPem: built.certPem,
+        certDer: built.certDer,
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        certChainPem: built.certChainPem
+    };
+}
+export async function issueClientCertForPublicKey(options) {
+    const built = await buildClientCertificate(options.ca, options.publicKey, {
+        subject: options.subject,
+        days: options.days,
+        notBefore: options.notBefore,
+        serialNumber: options.serialNumber,
+        dnsNames: options.dnsNames,
+        ipAddresses: options.ipAddresses
+    });
+    return {
+        certPem: built.certPem,
+        certDer: built.certDer,
+        certChainPem: built.certChainPem
+    };
+}
+async function buildClientCertificate(ca, subjectPublicKey, content) {
+    const issuer = await parseIssuer(ca);
+    const issuerChainPem = ca.issuerChainPem;
+    assertCanIssueCertificate(issuer);
+    const issuerCurve = curveOf(ca.privateKey);
+    const subjectNameDer = encodeName(content.subject);
+    const spki = await exportSpki(subjectPublicKey);
     const subjectKeyIdentifier = await keyIdentifierFromSpki(spki);
     const authorityKeyIdentifier = issuer.subjectKeyIdentifier ?? await keyIdentifierFromSpki(issuer.subjectPublicKeyInfoDer);
-    const san = subjectAltNameExtension(options.dnsNames, options.ipAddresses);
+    const san = subjectAltNameExtension(content.dnsNames, content.ipAddresses);
     const extensions = [
         basicConstraintsLeafExtension(),
         keyUsageExtension(["digitalSignature"]),
@@ -78,25 +115,22 @@ export async function issueClientCert(options) {
         ...(san ? [san] : [])
     ];
     const { tbsCertificateDer } = buildTbsCertificate({
-        serialNumber: options.serialNumber,
-        notBefore: options.notBefore,
-        days: options.days,
+        serialNumber: content.serialNumber,
+        notBefore: content.notBefore,
+        days: content.days,
         issuerNameDer: issuer.subjectNameDer,
         subjectNameDer,
         subjectPublicKeyInfoDer: spki,
-        extensions
+        extensions,
+        issuerCurve
     });
-    const signatureDer = await signDer(options.ca.privateKey, tbsCertificateDer);
-    const certDer = buildCertificate(tbsCertificateDer, signatureDer);
+    const signatureDer = await signDer(ca.privateKey, tbsCertificateDer);
+    const certDer = buildCertificate(tbsCertificateDer, signatureDer, issuerCurve);
     const certPem = certificateToPem(certDer);
     return {
         certPem,
-        privateKeyPem: await privateKeyToPem(keyPair.privateKey),
-        publicKeyPem: await publicKeyToPem(keyPair.publicKey),
         certDer: cloneBytes(certDer),
-        privateKey: keyPair.privateKey,
-        publicKey: keyPair.publicKey,
-        certChainPem: joinPemChain([certPem, options.ca.certPem, issuerChainPem])
+        certChainPem: joinPemChain([certPem, ca.certPem, issuerChainPem])
     };
 }
 export async function importCertificateAuthority(options) {
@@ -104,14 +138,11 @@ export async function importCertificateAuthority(options) {
     assertIssuerChainPem(issuerChainPem);
     const certDer = pemToDerWithLabel(options.certPem, "CERTIFICATE");
     const parsed = await parseCertificateDer(certDer);
-    const privateKey = await importPrivateKeyPem(options.privateKeyPem);
-    await assertKeyPairMatches(privateKey, parsed.publicKey);
+    await assertKeyPairMatches(options.privateKey, parsed.publicKey);
     return {
         certPem: options.certPem,
-        privateKeyPem: options.privateKeyPem,
-        publicKeyPem: await publicKeyToPem(parsed.publicKey),
         certDer: cloneBytes(certDer),
-        privateKey,
+        privateKey: options.privateKey,
         publicKey: parsed.publicKey,
         issuerChainPem
     };
@@ -128,17 +159,15 @@ function assertIssuerChainPem(chainPem) {
         pemToDerWithLabel(block, "CERTIFICATE");
     }
 }
-async function resolveKeyPair(privateKeyPem) {
-    if (privateKeyPem !== undefined) {
-        return keyPairFromPrivateKeyPem(privateKeyPem);
+async function resolveKeyPair(provided) {
+    if (provided !== undefined) {
+        return provided;
     }
     return generateKeyPair();
 }
 async function assembleCertificateAuthority(certDer, keyPair, issuerChainPem) {
     return {
         certPem: certificateToPem(certDer),
-        privateKeyPem: await privateKeyToPem(keyPair.privateKey),
-        publicKeyPem: await publicKeyToPem(keyPair.publicKey),
         certDer: cloneBytes(certDer),
         privateKey: keyPair.privateKey,
         publicKey: keyPair.publicKey,

package/dist/crypto.d.ts

@@ -1,16 +1,16 @@
-export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export type SupportedCurve = "P-256" | "P-384" | "P-521";
+export declare function curveOf(key: CryptoKey): SupportedCurve;
+export declare function componentSizeForCurve(curve: SupportedCurve): number;
+export declare function signatureAlgorithmOidForCurve(curve: SupportedCurve): string;
+export declare function generateKeyPair(curve?: SupportedCurve): Promise<CryptoKeyPair>;
 export declare function signDer(privateKey: CryptoKey, data: Uint8Array): Promise<Uint8Array>;
 export declare function verifyDer(publicKey: CryptoKey, signatureDer: Uint8Array, data: Uint8Array): Promise<boolean>;
 export declare function digestSha256(data: Uint8Array): Promise<Uint8Array>;
 export declare function digestSha1(data: Uint8Array): Promise<Uint8Array>;
 export declare function keyIdentifierFromSpki(spki: Uint8Array): Promise<Uint8Array>;
-export declare function privateKeyToPem(key: CryptoKey): Promise<string>;
-export declare function publicKeyToPem(key: CryptoKey): Promise<string>;
 export declare function exportSpki(key: CryptoKey): Promise<Uint8Array>;
-export declare function importPrivateKeyPem(pem: string): Promise<CryptoKey>;
-export declare function keyPairFromPrivateKeyPem(pem: string): Promise<CryptoKeyPair>;
 export declare function importPublicKeySpki(spki: Uint8Array): Promise<CryptoKey>;
 export declare function assertKeyPairMatches(privateKey: CryptoKey, publicKey: CryptoKey): Promise<void>;
-export declare function ecdsaRawToDer(raw: Uint8Array): Uint8Array;
-export declare function ecdsaDerToRaw(signature: Uint8Array): Uint8Array;
+export declare function ecdsaRawToDer(raw: Uint8Array, componentSize: number): Uint8Array;
+export declare function ecdsaDerToRaw(signature: Uint8Array, componentSize: number): Uint8Array;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAcA,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED,wBAAsB,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAG1F;AAED,wBAAsB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAExE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtE;AAID,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAWjF;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAEpE;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOlF;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE9E;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrG;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAMzD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAY/D"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAkCzD,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,cAAc,CAUtD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAEnE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAE3E;AAED,wBAAsB,eAAe,CAAC,KAAK,GAAE,cAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAE7F;AAED,wBAAsB,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAO1F;AAED,wBAAsB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CASlH;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAExE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtE;AAID,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAWjF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAEpE;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAS9E;AAkCD,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrG;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,UAAU,CAMhF;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,UAAU,CAetF"}

package/dist/crypto.js

@@ -1,23 +1,61 @@
 import { arrayBufferFromBytes, concatBytes } from "./bytes.js";
-import { integer, readChildren, readElement, readSequenceChildren, sequence, TAG } from "./der.js";
-import { pemToDerWithLabel, privateKeyDerToPem, publicKeyDerToPem } from "./pem.js";
-const EC_ALGORITHM = {
-    name: "ECDSA",
-    namedCurve: "P-256"
+import { decodeOid, integer, readChildren, readElement, readSequenceChildren, sequence, TAG } from "./der.js";
+import { OID } from "./oids.js";
+const CURVE_PROFILE = {
+    "P-256": {
+        componentSize: 32,
+        hash: "SHA-256",
+        signatureAlgorithmOid: OID.ecdsaWithSha256,
+        curveOid: OID.secp256r1
+    },
+    "P-384": {
+        componentSize: 48,
+        hash: "SHA-384",
+        signatureAlgorithmOid: OID.ecdsaWithSha384,
+        curveOid: OID.secp384r1
+    },
+    "P-521": {
+        componentSize: 66,
+        hash: "SHA-512",
+        signatureAlgorithmOid: OID.ecdsaWithSha512,
+        curveOid: OID.secp521r1
+    }
 };
-const ECDSA_SIGN_ALGORITHM = {
-    name: "ECDSA",
-    hash: "SHA-256"
+const CURVE_OID_TO_NAME = {
+    [OID.secp256r1]: "P-256",
+    [OID.secp384r1]: "P-384",
+    [OID.secp521r1]: "P-521"
 };
-export async function generateKeyPair() {
-    return crypto.subtle.generateKey(EC_ALGORITHM, true, ["sign", "verify"]);
+export function curveOf(key) {
+    const algorithm = key.algorithm;
+    if (algorithm.name !== "ECDSA") {
+        throw new Error(`Expected ECDSA key, got ${algorithm.name}`);
+    }
+    const curve = algorithm.namedCurve;
+    if (curve !== "P-256" && curve !== "P-384" && curve !== "P-521") {
+        throw new Error(`Unsupported ECDSA curve: ${curve}`);
+    }
+    return curve;
+}
+export function componentSizeForCurve(curve) {
+    return CURVE_PROFILE[curve].componentSize;
+}
+export function signatureAlgorithmOidForCurve(curve) {
+    return CURVE_PROFILE[curve].signatureAlgorithmOid;
+}
+export async function generateKeyPair(curve = "P-256") {
+    return crypto.subtle.generateKey({ name: "ECDSA", namedCurve: curve }, true, ["sign", "verify"]);
 }
 export async function signDer(privateKey, data) {
-    const raw = new Uint8Array(await crypto.subtle.sign(ECDSA_SIGN_ALGORITHM, privateKey, arrayBufferFromBytes(data)));
-    return ecdsaRawToDer(raw);
+    const curve = curveOf(privateKey);
+    const profile = CURVE_PROFILE[curve];
+    const raw = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: profile.hash }, privateKey, arrayBufferFromBytes(data)));
+    return ecdsaRawToDer(raw, profile.componentSize);
 }
 export async function verifyDer(publicKey, signatureDer, data) {
-    return crypto.subtle.verify(ECDSA_SIGN_ALGORITHM, publicKey, arrayBufferFromBytes(ecdsaDerToRaw(signatureDer)), arrayBufferFromBytes(data));
+    const curve = curveOf(publicKey);
+    const profile = CURVE_PROFILE[curve];
+    return crypto.subtle.verify({ name: "ECDSA", hash: profile.hash }, publicKey, arrayBufferFromBytes(ecdsaDerToRaw(signatureDer, profile.componentSize)), arrayBufferFromBytes(data));
 }
 export async function digestSha256(data) {
     return new Uint8Array(await crypto.subtle.digest("SHA-256", arrayBufferFromBytes(data)));
@@ -39,30 +77,43 @@ export async function keyIdentifierFromSpki(spki) {
     }
     return digestSha1(subjectPublicKey.value.subarray(1));
 }
-export async function privateKeyToPem(key) {
-    const der = new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
-    return privateKeyDerToPem(der);
-}
-export async function publicKeyToPem(key) {
-    const der = new Uint8Array(await crypto.subtle.exportKey("spki", key));
-    return publicKeyDerToPem(der);
-}
 export async function exportSpki(key) {
     return new Uint8Array(await crypto.subtle.exportKey("spki", key));
 }
-export async function importPrivateKeyPem(pem) {
-    return crypto.subtle.importKey("pkcs8", arrayBufferFromBytes(pemToDerWithLabel(pem, "PRIVATE KEY")), EC_ALGORITHM, true, ["sign"]);
-}
-export async function keyPairFromPrivateKeyPem(pem) {
-    const privateKey = await importPrivateKeyPem(pem);
-    const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-    delete jwk.d;
-    jwk.key_ops = ["verify"];
-    const publicKey = await crypto.subtle.importKey("jwk", jwk, EC_ALGORITHM, true, ["verify"]);
-    return { privateKey, publicKey };
-}
 export async function importPublicKeySpki(spki) {
-    return crypto.subtle.importKey("spki", arrayBufferFromBytes(spki), EC_ALGORITHM, true, ["verify"]);
+    const curve = curveFromSpki(spki);
+    return crypto.subtle.importKey("spki", arrayBufferFromBytes(spki), { name: "ECDSA", namedCurve: curve }, true, ["verify"]);
+}
+// SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }
+// AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY }
+// For EC keys, parameters is the named-curve OID.
+function curveFromSpki(spki) {
+    const root = readElement(spki);
+    if (root.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid SubjectPublicKeyInfo");
+    }
+    const algorithm = readSequenceChildren(root)[0];
+    if (!algorithm || algorithm.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid SubjectPublicKeyInfo algorithm");
+    }
+    const algorithmChildren = readSequenceChildren(algorithm);
+    const algorithmOidElement = algorithmChildren[0];
+    const parametersElement = algorithmChildren[1];
+    if (!algorithmOidElement || algorithmOidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+        throw new Error("Invalid SubjectPublicKeyInfo algorithm OID");
+    }
+    if (decodeOid(algorithmOidElement.value) !== OID.ecPublicKey) {
+        throw new Error("SubjectPublicKeyInfo is not an EC public key");
+    }
+    if (!parametersElement || parametersElement.tag !== TAG.OBJECT_IDENTIFIER) {
+        throw new Error("EC SubjectPublicKeyInfo parameters must be a named-curve OID");
+    }
+    const curveOid = decodeOid(parametersElement.value);
+    const curve = CURVE_OID_TO_NAME[curveOid];
+    if (!curve) {
+        throw new Error(`Unsupported EC named curve OID: ${curveOid}`);
+    }
+    return curve;
 }
 export async function assertKeyPairMatches(privateKey, publicKey) {
     const data = new TextEncoder().encode("edgca-key-pair-check");
@@ -72,13 +123,13 @@ export async function assertKeyPairMatches(privateKey, publicKey) {
         throw new Error("Private key does not match CA certificate public key");
     }
 }
-export function ecdsaRawToDer(raw) {
-    if (raw.length !== 64) {
-        throw new Error("P-256 ECDSA raw signature must be 64 bytes");
+export function ecdsaRawToDer(raw, componentSize) {
+    if (raw.length !== componentSize * 2) {
+        throw new Error(`ECDSA raw signature must be ${componentSize * 2} bytes`);
     }
-    return sequence(integer(raw.subarray(0, 32)), integer(raw.subarray(32)));
+    return sequence(integer(raw.subarray(0, componentSize)), integer(raw.subarray(componentSize)));
 }
-export function ecdsaDerToRaw(signature) {
+export function ecdsaDerToRaw(signature, componentSize) {
     const root = readElement(signature);
     if (root.tag !== TAG.SEQUENCE || root.end !== signature.length) {
         throw new Error("Invalid DER ECDSA signature");
@@ -87,18 +138,21 @@ export function ecdsaDerToRaw(signature) {
     if (!r || !s || r.tag !== TAG.INTEGER || s.tag !== TAG.INTEGER) {
         throw new Error("Invalid DER ECDSA signature integers");
     }
-    return concatBytes([integerToFixedWidth(r.value), integerToFixedWidth(s.value)]);
+    return concatBytes([
+        integerToFixedWidth(r.value, componentSize),
+        integerToFixedWidth(s.value, componentSize)
+    ]);
 }
-function integerToFixedWidth(value) {
+function integerToFixedWidth(value, size) {
     let start = 0;
     while (start < value.length - 1 && value[start] === 0) {
         start += 1;
     }
     const trimmed = value.subarray(start);
-    if (trimmed.length > 32) {
-        throw new Error("ECDSA integer is wider than P-256");
+    if (trimmed.length > size) {
+        throw new Error(`ECDSA integer is wider than ${size} bytes`);
     }
-    const out = new Uint8Array(32);
-    out.set(trimmed, 32 - trimmed.length);
+    const out = new Uint8Array(size);
+    out.set(trimmed, size - trimmed.length);
     return out;
 }

package/dist/csr.d.ts

@@ -0,0 +1,25 @@
+import type { Subject } from "./types.js";
+export interface CertificateSigningRequestExtension {
+    oid: string;
+    critical: boolean;
+    valueDer: Uint8Array;
+}
+export interface CertificateSigningRequestAttribute {
+    oid: string;
+    valuesDer: ReadonlyArray<Uint8Array>;
+}
+export interface ParsedCertificateSigningRequest {
+    subject: Subject;
+    publicKey: CryptoKey;
+    subjectPublicKeyInfoDer: Uint8Array;
+    requestedDnsNames: readonly string[];
+    requestedIpAddresses: readonly string[];
+    requestedExtensions: readonly CertificateSigningRequestExtension[];
+    otherAttributes: readonly CertificateSigningRequestAttribute[];
+    signatureAlgorithmOid: string;
+    signatureDer: Uint8Array;
+    certificationRequestInfoDer: Uint8Array;
+}
+export declare function parseCertificateSigningRequest(input: string | Uint8Array): Promise<ParsedCertificateSigningRequest>;
+export declare function verifyCertificateSigningRequestSignature(csr: ParsedCertificateSigningRequest): Promise<boolean>;
+//# sourceMappingURL=csr.d.ts.map

package/dist/csr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csr.d.ts","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,YAAY,CAAC;AAkBhE,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,uBAAuB,EAAE,UAAU,CAAC;IACpC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,mBAAmB,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACnE,eAAe,EAAE,SAAS,kCAAkC,EAAE,CAAC;IAC/D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,2BAA2B,EAAE,UAAU,CAAC;CACzC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,MAAM,GAAG,UAAU,GACzB,OAAO,CAAC,+BAA+B,CAAC,CAwE1C;AAED,wBAAsB,wCAAwC,CAC5D,GAAG,EAAE,+BAA+B,GACnC,OAAO,CAAC,OAAO,CAAC,CAElB"}