@reallyme/crypto 0.1.8 → 0.3.0

package/dist/mlKem.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureBytes, readIndependentByteArrayProperty, readIndependentProviderBytes, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const ML_KEM_512_PUBLIC_KEY_LENGTH = 800;
 export const ML_KEM_512_CIPHERTEXT_LENGTH = 768;
@@ -11,10 +11,12 @@ export const ML_KEM_768_CIPHERTEXT_LENGTH = 1_088;
 export const ML_KEM_1024_PUBLIC_KEY_LENGTH = 1_568;
 export const ML_KEM_1024_CIPHERTEXT_LENGTH = 1_568;
 export const ML_KEM_SECRET_KEY_LENGTH = 64;
-export const ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH = 32;
 export const ML_KEM_SHARED_SECRET_LENGTH = 32;
 const mlKemSuite = (algorithm) => {
     const provider = requireReallyMeWasmProvider();
+    return mlKemSuiteWithProvider(algorithm, provider);
+};
+const mlKemSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-KEM-512":
             return {
@@ -23,7 +25,6 @@ const mlKemSuite = (algorithm) => {
                 generateKeyPair: provider.mlKem512GenerateKeypair,
                 deriveKeyPair: provider.mlKem512DeriveKeypair,
                 encapsulate: provider.mlKem512Encapsulate,
-                encapsulateDerand: provider.mlKem512EncapsulateDerand,
                 decapsulate: provider.mlKem512Decapsulate,
             };
         case "ML-KEM-768":
@@ -33,7 +34,6 @@ const mlKemSuite = (algorithm) => {
                 generateKeyPair: provider.mlKem768GenerateKeypair,
                 deriveKeyPair: provider.mlKem768DeriveKeypair,
                 encapsulate: provider.mlKem768Encapsulate,
-                encapsulateDerand: provider.mlKem768EncapsulateDerand,
                 decapsulate: provider.mlKem768Decapsulate,
             };
         case "ML-KEM-1024":
@@ -43,55 +43,66 @@ const mlKemSuite = (algorithm) => {
                 generateKeyPair: provider.mlKem1024GenerateKeypair,
                 deriveKeyPair: provider.mlKem1024DeriveKeypair,
                 encapsulate: provider.mlKem1024Encapsulate,
-                encapsulateDerand: provider.mlKem1024EncapsulateDerand,
                 decapsulate: provider.mlKem1024Decapsulate,
             };
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value, suite) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
-    secretKey: readByteArrayProperty(value, "secretKey", ML_KEM_SECRET_KEY_LENGTH),
-});
-const readEncapsulation = (value, suite) => ({
-    ciphertext: readByteArrayProperty(value, "ciphertext", suite.ciphertextLength),
-    sharedSecret: readByteArrayProperty(value, "sharedSecret", ML_KEM_SHARED_SECRET_LENGTH),
-});
-const readSharedSecret = (value) => {
-    if (!(value instanceof Uint8Array)) {
-        throw new ReallyMeCryptoError("provider-failure");
-    }
-    ensureBytes(value, ML_KEM_SHARED_SECRET_LENGTH);
-    return value;
+const readKeyPair = (value, suite, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", suite.publicKeyLength, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", ML_KEM_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readEncapsulation = (value, suite, inputs) => {
+    const ciphertext = readIndependentByteArrayProperty(value, "ciphertext", suite.ciphertextLength, inputs);
+    const sharedSecret = readIndependentByteArrayProperty(value, "sharedSecret", ML_KEM_SHARED_SECRET_LENGTH, [...inputs, ciphertext]);
+    return { ciphertext, sharedSecret };
+};
+const readSharedSecret = (value, inputs) => {
+    return readIndependentProviderBytes(value, ML_KEM_SHARED_SECRET_LENGTH, inputs);
 };
 export const ReallyMeMlKem = {
     generateKeyPair(algorithm) {
         const suite = mlKemSuite(algorithm);
         return readKeyPair(suite.generateKeyPair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeyPair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         // Import an existing FIPS 203 seed-form secret and reconstruct its public
         // key. Do not feed passwords or other low-entropy material here.
         const suite = mlKemSuite(algorithm);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
+    },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     encapsulate(algorithm, publicKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
-        return readEncapsulation(suite.encapsulate(publicKey), suite);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
     },
-    encapsulateDeterministicallyForTest(algorithm, publicKey, randomness) {
-        const suite = mlKemSuite(algorithm);
+    encapsulateWithProvider(provider, algorithm, publicKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
         ensureBytes(publicKey, suite.publicKeyLength);
-        ensureBytes(randomness, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH);
-        return readEncapsulation(suite.encapsulateDerand(publicKey, randomness), suite);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
     },
     decapsulate(algorithm, ciphertext, secretKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(ciphertext, suite.ciphertextLength);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readSharedSecret(suite.decapsulate(ciphertext, secretKey));
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
+    },
+    decapsulateWithProvider(provider, algorithm, ciphertext, secretKey) {
+        const suite = mlKemSuiteWithProvider(algorithm, provider);
+        ensureBytes(ciphertext, suite.ciphertextLength);
+        ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
     },
 };

package/dist/operationResponse.d.ts

@@ -0,0 +1,16 @@
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
+/**
+ * Execute one generated binary protobuf request.
+ *
+ * The returned bytes are always a generated `CryptoOperationResponse` with a
+ * typed `result` or typed `error` outcome.
+ */
+export declare const processOperationResponse: (requestBytes: Uint8Array) => Uint8Array;
+export declare const processOperationResponseWithProvider: (provider: ReallyMeWasmProvider, requestBytes: Uint8Array) => Uint8Array;
+/**
+ * Execute one permitted non-secret generated ProtoJSON request and return the
+ * same binary `CryptoOperationResponse` used by `processOperationResponse`.
+ * Secret-bearing selectors fail before JSON value deserialization.
+ */
+export declare const processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
+export declare const processOperationResponseJsonWithProvider: (provider: ReallyMeWasmProvider, requestJson: Uint8Array) => Uint8Array;

package/dist/operationResponse.js

@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+const MAX_CRYPTO_OPERATION_RESPONSE_BYTES = 1_048_608;
+const readOperationResponse = (value, request) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    ensureIndependentByteArray(value, [request]);
+    if (value.length === 0 ||
+        value.length > MAX_CRYPTO_OPERATION_RESPONSE_BYTES) {
+        value.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return value;
+};
+/**
+ * Execute one generated binary protobuf request.
+ *
+ * The returned bytes are always a generated `CryptoOperationResponse` with a
+ * typed `result` or typed `error` outcome.
+ */
+export const processOperationResponse = (requestBytes) => {
+    ensureByteArray(requestBytes);
+    return processOperationResponseWithProvider(requireReallyMeWasmProvider(), requestBytes);
+};
+export const processOperationResponseWithProvider = (provider, requestBytes) => {
+    ensureByteArray(requestBytes);
+    return readOperationResponse(provider.processOperationResponse(requestBytes), requestBytes);
+};
+/**
+ * Execute one permitted non-secret generated ProtoJSON request and return the
+ * same binary `CryptoOperationResponse` used by `processOperationResponse`.
+ * Secret-bearing selectors fail before JSON value deserialization.
+ */
+export const processOperationResponseJson = (requestJson) => {
+    ensureByteArray(requestJson);
+    return processOperationResponseJsonWithProvider(requireReallyMeWasmProvider(), requestJson);
+};
+export const processOperationResponseJsonWithProvider = (provider, requestJson) => {
+    ensureByteArray(requestJson);
+    return readOperationResponse(provider.processOperationResponseJson(requestJson), requestJson);
+};

package/dist/p256Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-256 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP256Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p256.getSharedSecret(secretKey, publicKey, false).slice(1, 33);
+            const uncompressed = p256.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 33);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p384Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p384 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-384 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP384Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p384.getSharedSecret(secretKey, publicKey, false).slice(1, 49);
+            const uncompressed = p384.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 49);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p521Ecdh.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p521 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 /**
  * P-521 ECDH backed by @noble/curves.
  *
@@ -44,7 +45,10 @@ export const ReallyMeP521Ecdh = {
             throw new ReallyMeCryptoError("invalid-input");
         }
         try {
-            return p521.getSharedSecret(secretKey, publicKey, false).slice(1, 67);
+            const uncompressed = p521.getSharedSecret(secretKey, publicKey, false);
+            const sharedSecret = uncompressed.slice(1, 67);
+            bestEffortClear(uncompressed);
+            return sharedSecret;
         }
         catch {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/pbkdf2.d.ts

@@ -1,28 +1,26 @@
 export declare const PBKDF2_MIN_INPUT_LENGTH = 1;
 export declare const PBKDF2_MAX_INPUT_LENGTH = 4096;
-export declare const PBKDF2_MIN_ITERATIONS = 1;
+export declare const PBKDF2_MIN_ITERATIONS = 100000;
+export declare const PBKDF2_MAX_ITERATIONS = 10000000;
 export declare const PBKDF2_MIN_OUTPUT_LENGTH = 1;
 export declare const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
 /**
  * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
  * *new* password key.
- * The primitive does not enforce these (it must remain able to verify
- * externally created hashes), so callers creating new key material SHOULD
- * pass at least the value for their PRF.
+ * These stronger profile recommendations remain above the enforced public
+ * baseline and should be selected when protocol latency budgets permit.
  */
 export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600000;
 export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220000;
 export declare const ReallyMePbkdf2: {
     /**
      * PBKDF2-HMAC-SHA-256. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations.
      */
     readonly deriveHmacSha256: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
     /**
      * PBKDF2-HMAC-SHA-512. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations.
      */
     readonly deriveHmacSha512: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
 };

package/dist/pbkdf2.js

@@ -6,27 +6,27 @@ import { sha256, sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
 export const PBKDF2_MIN_INPUT_LENGTH = 1;
 export const PBKDF2_MAX_INPUT_LENGTH = 4096;
-// The primitive accepts any count >= 1 so it can verify PBKDF2 hashes created
-// elsewhere at their stored iteration count (a required interop use), matching
-// the Rust lane. It is NOT a security floor; see the recommended minimums
-// below for deriving *new* password keys.
-export const PBKDF2_MIN_ITERATIONS = 1;
+// Public derivation routes enforce a modern baseline. Historical hashes with a
+// lower work factor require an explicit migration tool, not a silent downgrade
+// in the v0.3 API.
+export const PBKDF2_MIN_ITERATIONS = 100_000;
+// Bound hostile work-factor inputs before the provider begins CPU-expensive
+// derivation. This matches the Rust, Swift, and Kotlin public lanes.
+export const PBKDF2_MAX_ITERATIONS = 10_000_000;
 export const PBKDF2_MIN_OUTPUT_LENGTH = 1;
 export const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
 /**
  * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
  * *new* password key.
- * The primitive does not enforce these (it must remain able to verify
- * externally created hashes), so callers creating new key material SHOULD
- * pass at least the value for their PRF.
+ * These stronger profile recommendations remain above the enforced public
+ * baseline and should be selected when protocol latency budgets permit.
  */
 export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600_000;
 export const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220_000;
 export const ReallyMePbkdf2 = {
     /**
      * PBKDF2-HMAC-SHA-256. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations.
      */
     deriveHmacSha256(password, salt, iterations, outputLength) {
         validate(password, salt, iterations, outputLength);
@@ -34,8 +34,7 @@ export const ReallyMePbkdf2 = {
     },
     /**
      * PBKDF2-HMAC-SHA-512. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations.
      */
     deriveHmacSha512(password, salt, iterations, outputLength) {
         validate(password, salt, iterations, outputLength);
@@ -49,6 +48,7 @@ function validate(password, salt, iterations, outputLength) {
         salt.length > PBKDF2_MAX_INPUT_LENGTH ||
         !Number.isInteger(iterations) ||
         iterations < PBKDF2_MIN_ITERATIONS ||
+        iterations > PBKDF2_MAX_ITERATIONS ||
         !Number.isInteger(outputLength) ||
         outputLength < PBKDF2_MIN_OUTPUT_LENGTH ||
         outputLength > PBKDF2_MAX_OUTPUT_LENGTH) {