@reallyme/crypto 0.1.8 → 0.3.0

package/dist/jwk.js

@@ -3,9 +3,22 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { base64urlDecode as codecBase64urlDecodeValue, base64urlEncode as codecBase64urlEncodeValue, canonicalizeJson as codecCanonicalizeJson, ReallyMeCodecError, } from "@reallyme/codec";
 import { ReallyMeCryptoError } from "./errors.js";
-const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-const DECODE_TABLE = new Map([...BASE64URL_ALPHABET].map((char, index) => [char, index]));
+// JSON and protobuf JWKS ingress routes share this limit so neither boundary
+// can amplify a small public-key record into unbounded curve validation work.
+export const MAX_JWKS_KEYS = 1_024;
+const withJwkBoundaryErrors = (operation) => {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
 const jwkSpec = (algorithm) => {
     switch (algorithm) {
         case "Ed25519":
@@ -32,8 +45,6 @@ const jwkSpec = (algorithm) => {
             return { alg: "SLH-DSA-SHA2-128s", kty: "AKP", publicKeyLength: 32, use: "sig" };
         case "X-Wing-768":
             return { alg: "X-Wing-768", kty: "AKP", publicKeyLength: 1_216, use: "enc" };
-        case "X-Wing-1024":
-            return { alg: "X-Wing-1024", kty: "AKP", publicKeyLength: 1_600, use: "enc" };
     }
 };
 const ensureLength = (bytes, expectedLength) => {
@@ -41,79 +52,58 @@ const ensureLength = (bytes, expectedLength) => {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
-const byteAt = (bytes, index) => {
-    const value = bytes[index];
-    if (value === undefined) {
+const readString = (value, name) => {
+    if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    return value;
-};
-const base64urlEncode = (bytes) => {
-    let encoded = "";
-    let index = 0;
-    while (index < bytes.length) {
-        const first = byteAt(bytes, index);
-        const second = index + 1 < bytes.length ? byteAt(bytes, index + 1) : 0;
-        const third = index + 2 < bytes.length ? byteAt(bytes, index + 2) : 0;
-        const triple = (first << 16) | (second << 8) | third;
-        encoded += BASE64URL_ALPHABET[(triple >> 18) & 0x3f];
-        encoded += BASE64URL_ALPHABET[(triple >> 12) & 0x3f];
-        if (index + 1 < bytes.length) {
-            encoded += BASE64URL_ALPHABET[(triple >> 6) & 0x3f];
-        }
-        if (index + 2 < bytes.length) {
-            encoded += BASE64URL_ALPHABET[triple & 0x3f];
-        }
-        index += 3;
-    }
-    return encoded;
-};
-const decodeChar = (char) => {
-    const value = DECODE_TABLE.get(char);
-    if (value === undefined) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor === undefined ||
+        !("value" in descriptor) ||
+        typeof descriptor.value !== "string") {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    return value;
+    return descriptor.value;
 };
-const base64urlDecode = (encoded) => {
-    if (encoded.length % 4 === 1) {
+const ensureExactMembers = (value, allowedNames) => {
+    if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const outputLength = Math.floor((encoded.length * 6) / 8);
-    const output = new Uint8Array(outputLength);
-    let buffer = 0;
-    let bits = 0;
-    let offset = 0;
-    for (const char of encoded) {
-        buffer = (buffer << 6) | decodeChar(char);
-        bits += 6;
-        if (bits >= 8) {
-            bits -= 8;
-            output[offset] = (buffer >> bits) & 0xff;
-            offset += 1;
+    for (const name of Reflect.ownKeys(value)) {
+        if (typeof name !== "string" || !allowedNames.includes(name)) {
+            throw new ReallyMeCryptoError("invalid-input");
         }
     }
-    if (offset !== output.length) {
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-    return output;
 };
-const readString = (value, name) => {
+const privateJwkMemberNames = [
+    "d",
+    "p",
+    "q",
+    "dp",
+    "dq",
+    "qi",
+    "oth",
+    "k",
+    "priv",
+    "privateKey",
+    "secretKey",
+];
+const rejectPrivateKeyMaterial = (value) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const property = Reflect.get(value, name);
-    if (typeof property !== "string") {
-        throw new ReallyMeCryptoError("invalid-input");
+    for (const name of privateJwkMemberNames) {
+        if (Reflect.has(value, name)) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
     }
-    return property;
 };
 const optionalStringMatches = (value, name, expected) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const property = Reflect.get(value, name);
-    if (property !== undefined && property !== expected) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor !== undefined &&
+        (!("value" in descriptor) || descriptor.value !== expected)) {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
@@ -138,7 +128,6 @@ const specFromAlgorithm = (algorithm) => {
         case "ML-KEM-1024":
         case "SLH-DSA-SHA2-128s":
         case "X-Wing-768":
-        case "X-Wing-1024":
             return jwkSpec(algorithm);
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
@@ -172,14 +161,43 @@ const compressEc = (algorithm, x, y) => {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
+const mapCodecError = (error) => {
+    if (error instanceof ReallyMeCodecError && error.code === "provider-failure") {
+        return new ReallyMeCryptoError("provider-failure");
+    }
+    return new ReallyMeCryptoError("invalid-input");
+};
+const codecBase64urlEncode = (bytes) => {
+    try {
+        return codecBase64urlEncodeValue(bytes);
+    }
+    catch (error) {
+        throw mapCodecError(error);
+    }
+};
+const codecBase64urlDecode = (encoded) => {
+    try {
+        return codecBase64urlDecodeValue(encoded);
+    }
+    catch (error) {
+        throw mapCodecError(error);
+    }
+};
+const codecBase64urlDecodeCanonical = (encoded) => {
+    const bytes = codecBase64urlDecode(encoded);
+    if (codecBase64urlEncode(bytes) !== encoded) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return bytes;
+};
 const toJcs = (jwk) => {
-    if (jwk.kty === "EC") {
-        return `{"alg":${JSON.stringify(jwk.alg)},"crv":${JSON.stringify(jwk.crv)},"kty":"EC","use":"sig","x":${JSON.stringify(jwk.x)},"y":${JSON.stringify(jwk.y)}}`;
+    const key = ReallyMeJwk.fromJwk(jwk);
+    try {
+        return codecCanonicalizeJson(key.jwk);
     }
-    if (jwk.kty === "AKP") {
-        return `{"alg":${JSON.stringify(jwk.alg)},"kty":"AKP","pub":${JSON.stringify(jwk.pub)},"use":${JSON.stringify(jwk.use)}}`;
+    catch (error) {
+        throw mapCodecError(error);
     }
-    return `{"alg":${JSON.stringify(jwk.alg)},"crv":${JSON.stringify(jwk.crv)},"kty":"OKP","use":${JSON.stringify(jwk.use)},"x":${JSON.stringify(jwk.x)}}`;
 };
 export const ReallyMeJwk = {
     toJwk(algorithm, publicKey) {
@@ -193,15 +211,15 @@ export const ReallyMeJwk = {
                 crv: ecAlgorithm,
                 kty: "EC",
                 use: "sig",
-                x: base64urlEncode(uncompressed.slice(1, 33)),
-                y: base64urlEncode(uncompressed.slice(33, 65)),
+                x: codecBase64urlEncode(uncompressed.slice(1, 33)),
+                y: codecBase64urlEncode(uncompressed.slice(33, 65)),
             };
         }
         if (spec.kty === "AKP") {
             return {
                 alg: spec.alg,
                 kty: "AKP",
-                pub: base64urlEncode(publicKey),
+                pub: codecBase64urlEncode(publicKey),
                 use: spec.use,
             };
         }
@@ -214,71 +232,89 @@ export const ReallyMeJwk = {
             crv,
             kty: "OKP",
             use: spec.use,
-            x: base64urlEncode(publicKey),
+            x: codecBase64urlEncode(publicKey),
         };
     },
     fromJwk(value) {
-        const kty = readString(value, "kty");
-        const spec = kty === "AKP"
-            ? specFromAlgorithm(readString(value, "alg"))
-            : specFromCurve(readString(value, "crv"));
-        if (kty !== spec.kty) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        optionalStringMatches(value, "alg", spec.alg);
-        optionalStringMatches(value, "use", spec.use);
-        if (spec.kty === "EC") {
-            const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
-            const x = base64urlDecode(readString(value, "x"));
-            const y = base64urlDecode(readString(value, "y"));
-            const publicKey = compressEc(ecAlgorithm, x, y);
-            ensureLength(publicKey, spec.publicKeyLength);
-            const jwk = ReallyMeJwk.toJwk(ecAlgorithm, publicKey);
-            return { algorithm: ecAlgorithm, publicKey, jwk };
-        }
-        if (spec.kty === "OKP") {
-            const crv = spec.crv;
-            if (crv !== "Ed25519" && crv !== "X25519") {
-                throw new ReallyMeCryptoError("unsupported-algorithm");
+        return withJwkBoundaryErrors(() => {
+            rejectPrivateKeyMaterial(value);
+            const kty = readString(value, "kty");
+            const spec = kty === "AKP"
+                ? specFromAlgorithm(readString(value, "alg"))
+                : specFromCurve(readString(value, "crv"));
+            if (kty !== spec.kty) {
+                throw new ReallyMeCryptoError("invalid-input");
             }
-            const publicKey = base64urlDecode(readString(value, "x"));
-            ensureLength(publicKey, spec.publicKeyLength);
-            const jwk = ReallyMeJwk.toJwk(crv, publicKey);
-            return { algorithm: crv, publicKey, jwk };
-        }
-        const algorithm = readString(value, "alg");
-        const akpSpec = specFromAlgorithm(algorithm);
-        const publicKey = base64urlDecode(readString(value, "pub"));
-        ensureLength(publicKey, akpSpec.publicKeyLength);
-        switch (algorithm) {
-            case "ML-DSA-44":
-            case "ML-DSA-65":
-            case "ML-DSA-87":
-            case "ML-KEM-512":
-            case "ML-KEM-768":
-            case "ML-KEM-1024":
-            case "SLH-DSA-SHA2-128s":
-            case "X-Wing-768":
-            case "X-Wing-1024": {
-                const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
-                return { algorithm, publicKey, jwk };
+            if (spec.kty === "EC") {
+                ensureExactMembers(value, ["alg", "crv", "kty", "use", "x", "y"]);
+                if (readString(value, "alg") !== spec.alg ||
+                    readString(value, "use") !== spec.use) {
+                    throw new ReallyMeCryptoError("invalid-input");
+                }
+                const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
+                const x = codecBase64urlDecodeCanonical(readString(value, "x"));
+                const y = codecBase64urlDecodeCanonical(readString(value, "y"));
+                const publicKey = compressEc(ecAlgorithm, x, y);
+                ensureLength(publicKey, spec.publicKeyLength);
+                const jwk = ReallyMeJwk.toJwk(ecAlgorithm, publicKey);
+                return { algorithm: ecAlgorithm, publicKey, jwk };
             }
-            default:
-                throw new ReallyMeCryptoError("unsupported-algorithm");
-        }
+            if (spec.kty === "OKP") {
+                ensureExactMembers(value, ["alg", "crv", "kty", "use", "x"]);
+                optionalStringMatches(value, "alg", spec.alg);
+                optionalStringMatches(value, "use", spec.use);
+                const crv = spec.crv;
+                if (crv !== "Ed25519" && crv !== "X25519") {
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+                }
+                const publicKey = codecBase64urlDecodeCanonical(readString(value, "x"));
+                ensureLength(publicKey, spec.publicKeyLength);
+                const jwk = ReallyMeJwk.toJwk(crv, publicKey);
+                return { algorithm: crv, publicKey, jwk };
+            }
+            const algorithm = readString(value, "alg");
+            ensureExactMembers(value, ["alg", "kty", "pub", "use"]);
+            if (readString(value, "use") !== spec.use) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            const akpSpec = specFromAlgorithm(algorithm);
+            const publicKey = codecBase64urlDecodeCanonical(readString(value, "pub"));
+            ensureLength(publicKey, akpSpec.publicKeyLength);
+            switch (algorithm) {
+                case "ML-DSA-44":
+                case "ML-DSA-65":
+                case "ML-DSA-87":
+                case "ML-KEM-512":
+                case "ML-KEM-768":
+                case "ML-KEM-1024":
+                case "SLH-DSA-SHA2-128s":
+                case "X-Wing-768": {
+                    const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
+                    return { algorithm, publicKey, jwk };
+                }
+                default:
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+            }
+        });
     },
     toJwks(keys) {
         return { keys: [...keys] };
     },
     fromJwks(value) {
-        if (typeof value !== "object" || value === null) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        const keys = Reflect.get(value, "keys");
-        if (!Array.isArray(keys)) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        return { keys: keys.map((key) => ReallyMeJwk.fromJwk(key)) };
+        return withJwkBoundaryErrors(() => {
+            ensureExactMembers(value, ["keys"]);
+            if (typeof value !== "object" || value === null) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(value, "keys");
+            const keys = descriptor !== undefined && "value" in descriptor
+                ? descriptor.value
+                : undefined;
+            if (!Array.isArray(keys) || keys.length > MAX_JWKS_KEYS) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            return { keys: keys.map((key) => ReallyMeJwk.fromJwk(key)) };
+        });
     },
     publicKeyBytes(jwk) {
         return ReallyMeJwk.fromJwk(jwk).publicKey;

package/dist/kmac.d.ts

@@ -0,0 +1,11 @@
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
+export declare const KMAC256_MIN_KEY_LENGTH = 32;
+export declare const KMAC256_MAX_KEY_LENGTH = 4096;
+export declare const KMAC256_MAX_CONTEXT_LENGTH = 65536;
+export declare const KMAC256_MAX_CUSTOMIZATION_LENGTH = 4096;
+export declare const KMAC256_MIN_OUTPUT_LENGTH = 1;
+export declare const KMAC256_MAX_OUTPUT_LENGTH = 65536;
+export declare const ReallyMeKmac: {
+    readonly deriveKmac256: (key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveKmac256WithProvider: (provider: ReallyMeWasmProvider, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
+};

package/dist/kmac.js

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+export const KMAC256_MIN_KEY_LENGTH = 32;
+export const KMAC256_MAX_KEY_LENGTH = 4_096;
+export const KMAC256_MAX_CONTEXT_LENGTH = 65_536;
+export const KMAC256_MAX_CUSTOMIZATION_LENGTH = 4_096;
+export const KMAC256_MIN_OUTPUT_LENGTH = 1;
+export const KMAC256_MAX_OUTPUT_LENGTH = 65_536;
+const validate = (key, context, customization, outputLength) => {
+    ensureByteArray(key);
+    ensureByteArray(context);
+    ensureByteArray(customization);
+    if (key.length < KMAC256_MIN_KEY_LENGTH ||
+        key.length > KMAC256_MAX_KEY_LENGTH ||
+        context.length > KMAC256_MAX_CONTEXT_LENGTH ||
+        customization.length > KMAC256_MAX_CUSTOMIZATION_LENGTH ||
+        !Number.isInteger(outputLength) ||
+        outputLength < KMAC256_MIN_OUTPUT_LENGTH ||
+        outputLength > KMAC256_MAX_OUTPUT_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const requireDerivedKey = (value, outputLength, inputs) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    // A provider result must have independent ownership. Check overlap before
+    // clearing malformed output so validation cannot erase caller-owned input.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== outputLength) {
+        value.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return value;
+};
+export const ReallyMeKmac = {
+    deriveKmac256(key, context, customization, outputLength) {
+        validate(key, context, customization, outputLength);
+        return requireDerivedKey(requireReallyMeWasmProvider().kmac256Derive(key, context, customization, outputLength), outputLength, [key, context, customization]);
+    },
+    deriveKmac256WithProvider(provider, key, context, customization, outputLength) {
+        validate(key, context, customization, outputLength);
+        return requireDerivedKey(provider.kmac256Derive(key, context, customization, outputLength), outputLength, [key, context, customization]);
+    },
+};

package/dist/memory.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Best-effort cleanup for caller-owned managed-runtime byte arrays.
+ *
+ * This overwrites the supplied `Uint8Array` view in place. It does not and
+ * cannot clear copies already made by JavaScript engines, WebAssembly
+ * marshalling, snapshots, browser developer tools, or native providers.
+ */
+export declare const bestEffortClear: (bytes: Uint8Array) => void;

package/dist/memory.js

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Best-effort cleanup for caller-owned managed-runtime byte arrays.
+ *
+ * This overwrites the supplied `Uint8Array` view in place. It does not and
+ * cannot clear copies already made by JavaScript engines, WebAssembly
+ * marshalling, snapshots, browser developer tools, or native providers.
+ */
+export const bestEffortClear = (bytes) => {
+    bytes.fill(0);
+};

package/dist/mlDsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const ML_DSA_44_PUBLIC_KEY_LENGTH = 1312;
 export declare const ML_DSA_44_SIGNATURE_LENGTH = 2420;
 export declare const ML_DSA_65_PUBLIC_KEY_LENGTH = 1952;
@@ -12,7 +13,11 @@ export type ReallyMeMlDsaKeyPair = Readonly<{
 }>;
 export declare const ReallyMeMlDsa: {
     readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeMlDsaKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm) => ReallyMeMlDsaKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeMlDsaKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeMlDsaKeyPair;
     readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly signWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
 };

package/dist/mlDsa.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const ML_DSA_44_PUBLIC_KEY_LENGTH = 1_312;
 export const ML_DSA_44_SIGNATURE_LENGTH = 2_420;
@@ -13,6 +13,9 @@ export const ML_DSA_87_SIGNATURE_LENGTH = 4_627;
 export const ML_DSA_SECRET_KEY_LENGTH = 32;
 const mlDsaSuite = (algorithm) => {
     const provider = requireReallyMeWasmProvider();
+    return mlDsaSuiteWithProvider(algorithm, provider);
+};
+const mlDsaSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-DSA-44":
             return {
@@ -45,15 +48,22 @@ const mlDsaSuite = (algorithm) => {
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value, suite) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
-    secretKey: readByteArrayProperty(value, "secretKey", ML_DSA_SECRET_KEY_LENGTH),
-});
-const readSignature = (value, suite) => {
+const readKeyPair = (value, suite, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", suite.publicKeyLength, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", ML_DSA_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readSignature = (value, suite, inputs) => {
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    ensureBytes(value, suite.signatureLength);
+    // Signature bytes are public, but their shape and ownership are provider
+    // postconditions. A malformed provider must never be reported as bad caller
+    // input, and an aliased result must not be mistaken for provider-owned data.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== suite.signatureLength) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
     return value;
 };
 const readVoid = (value) => {
@@ -66,20 +76,44 @@ export const ReallyMeMlDsa = {
         const suite = mlDsaSuite(algorithm);
         return readKeyPair(suite.generateKeyPair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeyPair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         // Import an existing FIPS 204 seed and reconstruct its public key. Do not
         // feed passwords or other low-entropy material here.
         const suite = mlDsaSuite(algorithm);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
+    },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     sign(algorithm, message, secretKey) {
         const suite = mlDsaSuite(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
+        ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
+        return readSignature(suite.sign(secretKey, message), suite, [secretKey, message]);
+    },
+    signWithProvider(provider, algorithm, message, secretKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readSignature(suite.sign(secretKey, message), suite);
+        return readSignature(suite.sign(secretKey, message), suite, [secretKey, message]);
     },
     verify(algorithm, signature, message, publicKey) {
         const suite = mlDsaSuite(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        ensureBytes(signature, suite.signatureLength);
+        readVoid(suite.verify(publicKey, message, signature));
+    },
+    verifyWithProvider(provider, algorithm, signature, message, publicKey) {
+        const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, suite.publicKeyLength);
         ensureBytes(signature, suite.signatureLength);
         readVoid(suite.verify(publicKey, message, signature));

package/dist/mlKem.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeKemAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const ML_KEM_512_PUBLIC_KEY_LENGTH = 800;
 export declare const ML_KEM_512_CIPHERTEXT_LENGTH = 768;
 export declare const ML_KEM_768_PUBLIC_KEY_LENGTH = 1184;
@@ -6,7 +7,6 @@ export declare const ML_KEM_768_CIPHERTEXT_LENGTH = 1088;
 export declare const ML_KEM_1024_PUBLIC_KEY_LENGTH = 1568;
 export declare const ML_KEM_1024_CIPHERTEXT_LENGTH = 1568;
 export declare const ML_KEM_SECRET_KEY_LENGTH = 64;
-export declare const ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH = 32;
 export declare const ML_KEM_SHARED_SECRET_LENGTH = 32;
 export type ReallyMeMlKemKeyPair = Readonly<{
     publicKey: Uint8Array;
@@ -18,8 +18,11 @@ export type ReallyMeMlKemEncapsulation = Readonly<{
 }>;
 export declare const ReallyMeMlKem: {
     readonly generateKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeMlKemKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm) => ReallyMeMlKemKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeMlKemKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeMlKemKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
-    readonly encapsulateDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, randomness: Uint8Array) => ReallyMeMlKemEncapsulation;
+    readonly encapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly decapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
 };