@reallyme/crypto 0.1.8 → 0.3.0

package/dist/rsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export type ReallyMeRsaPublicKeyDerEncoding = "PKCS1" | "SPKI";
 export declare const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4096;
 export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
@@ -6,8 +7,10 @@ export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
  * RSA signature verification through the ReallyMe Rust WASM provider.
  *
  * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
- * authentication, and legacy interoperability; no RSA signing API is exposed.
+ * authentication, and historical document interoperability; no RSA signing
+ * API is exposed.
  */
 export declare const ReallyMeRsa: {
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
 };

package/dist/rsa.js

@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4_096;
 export const RSA_SIGNATURE_MAX_LENGTH = 1_024;
@@ -12,6 +13,7 @@ const RSA_HASH_SHA512 = 4;
 const RSA_PUBLIC_KEY_ENCODING_PKCS1_DER = 1;
 const RSA_PUBLIC_KEY_ENCODING_SPKI_DER = 2;
 const validateBytes = (bytes, maxLength) => {
+    ensureByteArray(bytes);
     if (bytes.length === 0 || bytes.length > maxLength) {
         throw new ReallyMeCryptoError("invalid-input");
     }
@@ -75,28 +77,33 @@ const readVoid = (value) => {
         throw new ReallyMeCryptoError("provider-failure");
     }
 };
+const verifyWithProvider = (provider, algorithm, signature, message, publicKeyDer, publicKeyEncoding) => {
+    validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
+    validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
+    ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
+    const encoding = encodingId(publicKeyEncoding);
+    const pkcs1 = pkcs1v15Suite(algorithm);
+    if (pkcs1 !== undefined) {
+        readVoid(provider.rsaVerifyPkcs1v15(publicKeyDer, encoding, pkcs1.hashSuite, message, signature));
+        return;
+    }
+    const pss = pssSuite(algorithm);
+    if (pss !== undefined) {
+        readVoid(provider.rsaVerifyPss(publicKeyDer, encoding, pss.messageHashSuite, pss.mgf1HashSuite, pss.saltLength, message, signature));
+        return;
+    }
+    throw new ReallyMeCryptoError("unsupported-algorithm");
+};
 /**
  * RSA signature verification through the ReallyMe Rust WASM provider.
  *
  * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
- * authentication, and legacy interoperability; no RSA signing API is exposed.
+ * authentication, and historical document interoperability; no RSA signing
+ * API is exposed.
  */
 export const ReallyMeRsa = {
     verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
-        validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
-        validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
-        const encoding = encodingId(publicKeyEncoding);
-        const pkcs1 = pkcs1v15Suite(algorithm);
-        const provider = requireReallyMeWasmProvider();
-        if (pkcs1 !== undefined) {
-            readVoid(provider.rsaVerifyPkcs1v15(publicKeyDer, encoding, pkcs1.hashSuite, message, signature));
-            return;
-        }
-        const pss = pssSuite(algorithm);
-        if (pss !== undefined) {
-            readVoid(provider.rsaVerifyPss(publicKeyDer, encoding, pss.messageHashSuite, pss.mgf1HashSuite, pss.saltLength, message, signature));
-            return;
-        }
-        throw new ReallyMeCryptoError("unsupported-algorithm");
+        verifyWithProvider(requireReallyMeWasmProvider(), algorithm, signature, message, publicKeyDer, publicKeyEncoding);
     },
+    verifyWithProvider,
 };

package/dist/slhDsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH = 32;
 export declare const SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH = 64;
 export declare const SLH_DSA_SHA2_128S_SIGNATURE_LENGTH = 7856;
@@ -9,7 +10,11 @@ export type ReallyMeSlhDsaKeyPair = Readonly<{
 }>;
 export declare const ReallyMeSlhDsa: {
     readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSlhDsaKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSlhDsaKeyPair;
     readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly signWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
 };
 export declare const deriveSlhDsaSha2128sKeypairForTest: (skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => ReallyMeSlhDsaKeyPair;
+export declare const deriveSlhDsaSha2128sKeypairWithProviderForTest: (provider: ReallyMeWasmProvider, skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => ReallyMeSlhDsaKeyPair;

package/dist/slhDsa.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH = 32;
 export const SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH = 64;
@@ -13,15 +13,21 @@ const assertSlhDsa = (algorithm) => {
         throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH),
-    secretKey: readByteArrayProperty(value, "secretKey", SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH),
-});
-const readSignature = (value) => {
+const readKeyPair = (value, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readSignature = (value, inputs) => {
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    ensureBytes(value, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
+    // Signature bytes are public, but their shape and ownership are provider
+    // postconditions rather than caller validation failures.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== SLH_DSA_SHA2_128S_SIGNATURE_LENGTH) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
     return value;
 };
 const readVoid = (value) => {
@@ -34,21 +40,46 @@ export const ReallyMeSlhDsa = {
         assertSlhDsa(algorithm);
         return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sGenerateKeypair());
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        assertSlhDsa(algorithm);
+        return readKeyPair(provider.slhDsaSha2128sGenerateKeypair());
+    },
     sign(algorithm, message, secretKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
+        ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
+        return readSignature(requireReallyMeWasmProvider().slhDsaSha2128sSign(secretKey, message), [secretKey, message]);
+    },
+    signWithProvider(provider, algorithm, message, secretKey) {
+        assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
-        return readSignature(requireReallyMeWasmProvider().slhDsaSha2128sSign(secretKey, message));
+        return readSignature(provider.slhDsaSha2128sSign(secretKey, message), [secretKey, message]);
     },
     verify(algorithm, signature, message, publicKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
         ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
         readVoid(requireReallyMeWasmProvider().slhDsaSha2128sVerify(publicKey, message, signature));
     },
+    verifyWithProvider(provider, algorithm, signature, message, publicKey) {
+        assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
+        ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
+        ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
+        readVoid(provider.slhDsaSha2128sVerify(publicKey, message, signature));
+    },
 };
 export const deriveSlhDsaSha2128sKeypairForTest = (skSeed, skPrf, pkSeed) => {
     ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(skPrf, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
-    return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed));
+    return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed), [skSeed, skPrf, pkSeed]);
+};
+export const deriveSlhDsaSha2128sKeypairWithProviderForTest = (provider, skSeed, skPrf, pkSeed) => {
+    ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    ensureBytes(skPrf, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    return readKeyPair(provider.slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed), [skSeed, skPrf, pkSeed]);
 };

package/dist/validateBytes.d.ts

@@ -1,2 +1,8 @@
+export declare const MAX_CRYPTO_INPUT_LENGTH = 1048576;
+export declare const ensureByteArray: (value: Uint8Array) => void;
+export declare const ensureByteArrayAtMost: (value: Uint8Array, maximumLength: number) => void;
 export declare const ensureBytes: (value: Uint8Array, expectedLength: number) => void;
-export declare const readByteArrayProperty: (value: unknown, propertyName: string, expectedLength: number) => Uint8Array;
+export declare const byteArraysOverlap: (left: Uint8Array, right: Uint8Array) => boolean;
+export declare const ensureIndependentByteArray: (value: Uint8Array, disallowedViews: ReadonlyArray<Uint8Array>) => void;
+export declare const readIndependentByteArrayProperty: (value: unknown, propertyName: string, expectedLength: number, disallowedViews: ReadonlyArray<Uint8Array>) => Uint8Array;
+export declare const readIndependentProviderBytes: (value: unknown, expectedLength: number, disallowedViews: ReadonlyArray<Uint8Array>) => Uint8Array;

package/dist/validateBytes.js

@@ -2,19 +2,79 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
+// Match the structured operation boundary so direct primitive facades cannot
+// ask a provider to copy or allocate an attacker-controlled unbounded buffer.
+export const MAX_CRYPTO_INPUT_LENGTH = 1_048_576;
+export const ensureByteArray = (value) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const ensureByteArrayAtMost = (value, maximumLength) => {
+    ensureByteArray(value);
+    if (value.length > maximumLength) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
 export const ensureBytes = (value, expectedLength) => {
+    ensureByteArray(value);
     if (value.length !== expectedLength) {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
-export const readByteArrayProperty = (value, propertyName, expectedLength) => {
+export const byteArraysOverlap = (left, right) => {
+    if (left.buffer !== right.buffer) {
+        return false;
+    }
+    const leftEnd = left.byteOffset + left.byteLength;
+    const rightEnd = right.byteOffset + right.byteLength;
+    return left.byteOffset < rightEnd && right.byteOffset < leftEnd;
+};
+export const ensureIndependentByteArray = (value, disallowedViews) => {
+    // A disjoint view into the same ArrayBuffer is still not independently
+    // owned: transferring or detaching the caller's buffer would invalidate the
+    // provider output too. Provider results must own separate backing storage.
+    if (disallowedViews.some((view) => value.buffer === view.buffer)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+};
+const readProviderByteArrayProperty = (value, propertyName) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    const property = Reflect.get(value, propertyName);
+    let property;
+    try {
+        property = Reflect.get(value, propertyName);
+    }
+    catch (_error) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
     if (!(property instanceof Uint8Array)) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    ensureBytes(property, expectedLength);
     return property;
 };
+export const readIndependentByteArrayProperty = (value, propertyName, expectedLength, disallowedViews) => {
+    const property = readProviderByteArrayProperty(value, propertyName);
+    // Check ownership before cleanup so a malformed provider cannot make the
+    // validator erase a caller-owned input view.
+    ensureIndependentByteArray(property, disallowedViews);
+    if (property.length !== expectedLength) {
+        property.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return property;
+};
+export const readIndependentProviderBytes = (value, expectedLength, disallowedViews) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    // Provider-owned secret outputs are cleared on malformed length, but only
+    // after proving the provider did not hand back a caller-owned buffer.
+    ensureIndependentByteArray(value, disallowedViews);
+    if (value.length !== expectedLength) {
+        value.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return value;
+};