@reallyme/crypto 0.2.0 → 0.3.1

package/dist/proto.d.ts

@@ -2,10 +2,10 @@ import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHpkeSuite, R
 import { ReallyMeCryptoError } from "./errors.js";
 import type { ReallyMeHpkeSealedMessage, ReallyMeKemEncapsulation, ReallyMeKemKeyPair, ReallyMeKeyAgreementKeyPair, ReallyMeSignatureKeyPair } from "./cryptoFacade.js";
 import type { ReallyMeJwkKey, ReallyMeJwksKeySet } from "./jwk.js";
-export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-export type { CryptoAlgorithmIdentifier, CryptoAeadOpenRequest, CryptoAeadOpenResult, CryptoAeadSealRequest, CryptoAeadSealResult, CryptoBackendError, CryptoBip340SchnorrSignRequest, CryptoError, CryptoHashRequest, CryptoHashResult, CryptoHkdfDeriveRequest, CryptoHkdfDeriveResult, CryptoHpkeOpenRequest, CryptoHpkeOpenResult, CryptoHpkeSealRequest, CryptoHpkeSealedMessage, CryptoJwaConcatKdfSha256DeriveRequest, CryptoJwaConcatKdfSha256DeriveResult, CryptoKdfDeriveKeyRequest, CryptoKdfDeriveKeyResult, CryptoKemEncapsulation, CryptoKemDecapsulateRequest, CryptoKemDecapsulateResult, CryptoKemEncapsulateRequest, CryptoKemGenerateKeyPairRequest, CryptoKeyAgreementDeriveKeyPairRequest, CryptoKeyAgreementDeriveSharedSecretRequest, CryptoKeyAgreementDeriveSharedSecretResult, CryptoKeyPair, CryptoKeyUnwrapRequest, CryptoKeyUnwrapResult, CryptoKeyWrapRequest, CryptoKeyWrapResult, CryptoMacAuthenticateRequest, CryptoMacAuthenticateResult, CryptoMacVerifyRequest, CryptoPrimitiveError, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoProviderError, CryptoRsaVerifyRequest, CryptoSignatureDeriveKeyPairRequest, CryptoSignatureGenerateKeyPairRequest, CryptoSignatureSignRequest, CryptoSignatureSignResult, CryptoSignatureVerifyRequest, CryptoVerificationResult, JsonWebKey, JsonWebKeySet, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmFamily, CryptoErrorReason } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import type { CryptoAlgorithmIdentifier, CryptoError, CryptoHpkeSealedMessage, CryptoKemEncapsulation, CryptoKeyPair, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoVerificationResult, JsonWebKey, JsonWebKeySet } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemDeriveKeyPairRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoOperationRequestSchema, CryptoOperationResponseSchema, CryptoOperationResultSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeAeadId, HpkeAeadIdSchema, HpkeKdfId, HpkeKdfIdSchema, HpkeKemId, HpkeKemIdSchema, HpkeSuiteIdentifierSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export type { CryptoAlgorithmIdentifier, CryptoAeadOpenRequest, CryptoAeadOpenResult, CryptoAeadSealRequest, CryptoAeadSealResult, CryptoBackendError, CryptoBip340SchnorrSignRequest, CryptoError, CryptoHashRequest, CryptoHashResult, CryptoHkdfDeriveRequest, CryptoHkdfDeriveResult, CryptoHpkeOpenRequest, CryptoHpkeOpenResult, CryptoHpkeSealRequest, CryptoHpkeSealedMessage, CryptoJwaConcatKdfSha256DeriveRequest, CryptoJwaConcatKdfSha256DeriveResult, CryptoKdfDeriveKeyRequest, CryptoKdfDeriveKeyResult, CryptoKemEncapsulation, CryptoKemDecapsulateRequest, CryptoKemDecapsulateResult, CryptoKemEncapsulateRequest, CryptoKemDeriveKeyPairRequest, CryptoKemGenerateKeyPairRequest, CryptoKeyAgreementDeriveKeyPairRequest, CryptoKeyAgreementDeriveSharedSecretRequest, CryptoKeyAgreementDeriveSharedSecretResult, CryptoKeyPair, CryptoKeyUnwrapRequest, CryptoKeyUnwrapResult, CryptoKeyWrapRequest, CryptoKeyWrapResult, CryptoMacAuthenticateRequest, CryptoMacAuthenticateResult, CryptoMacVerifyRequest, CryptoOperationRequest, CryptoOperationResponse, CryptoOperationResult, CryptoPrimitiveError, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoProviderError, CryptoRsaVerifyRequest, CryptoSignatureDeriveKeyPairRequest, CryptoSignatureGenerateKeyPairRequest, CryptoSignatureSignRequest, CryptoSignatureSignResult, CryptoSignatureVerifyRequest, CryptoVerificationResult, HpkeSuiteIdentifier, JsonWebKey, JsonWebKeySet, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { AeadAlgorithm, HashAlgorithm, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmFamily, CryptoErrorReason } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import type { CryptoAlgorithmIdentifier, CryptoError, CryptoHpkeSealedMessage, CryptoKemEncapsulation, CryptoKeyPair, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoVerificationResult, HpkeSuiteIdentifier, JsonWebKey, JsonWebKeySet } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
 export type ReallyMeCryptoWireErrorBranch = "primitive" | "provider" | "backend";
 export type ReallyMeCryptoWireError = Readonly<{
     branch: ReallyMeCryptoWireErrorBranch;
@@ -20,20 +20,6 @@ export type ReallyMeCryptoWireErrorValidationResult = Readonly<{
     ok: false;
     error: ReallyMeCryptoWireErrorValidationCode;
 }>;
-export type ReallyMeCryptoProtoStatus = "result" | "crypto-error";
-export declare class ReallyMeCryptoProtoResult {
-    #private;
-    readonly status: ReallyMeCryptoProtoStatus;
-    constructor(status: ReallyMeCryptoProtoStatus, bytes: Uint8Array);
-    get bytes(): Uint8Array;
-    get isCryptoError(): boolean;
-    bestEffortClear(): void;
-    toString(): string;
-    toJSON(): Readonly<{
-        status: ReallyMeCryptoProtoStatus;
-        bytes: "<redacted>";
-    }>;
-}
 export type ReallyMeMulticodecKeyAlgorithm = "ed25519-pub" | "x25519-pub" | "secp256k1-pub" | "p256-pub" | "p384-pub" | "p521-pub" | "ed448-pub" | "rsa-pub" | "mlkem-512-pub" | "mlkem-768-pub" | "mlkem-1024-pub" | "mldsa-44-pub" | "mldsa-65-pub" | "mldsa-87-pub";
 export type ReallyMeProviderSupportStatus = "partial" | "provider-aware" | "supported" | "unsupported";
 export type ReallyMeProviderCapability = Readonly<{
@@ -79,8 +65,8 @@ export declare const kdfAlgorithmFromProto: (value: KdfAlgorithm) => ReallyMeKdf
 export declare const kdfAlgorithmToProto: (value: ReallyMeKdfAlgorithm) => KdfAlgorithm;
 export declare const keyWrapAlgorithmFromProto: (value: KeyWrapAlgorithm) => ReallyMeKeyWrapAlgorithm;
 export declare const keyWrapAlgorithmToProto: (value: ReallyMeKeyWrapAlgorithm) => KeyWrapAlgorithm;
-export declare const hpkeSuiteFromProto: (value: HpkeSuite) => ReallyMeHpkeSuite;
-export declare const hpkeSuiteToProto: (value: ReallyMeHpkeSuite) => HpkeSuite;
+export declare const hpkeSuiteFromProto: (value: HpkeSuiteIdentifier) => ReallyMeHpkeSuite;
+export declare const hpkeSuiteToProto: (value: ReallyMeHpkeSuite) => HpkeSuiteIdentifier;
 export declare const multicodecKeyAlgorithmFromProto: (value: MulticodecKeyAlgorithm) => ReallyMeMulticodecKeyAlgorithm;
 export declare const multicodecKeyAlgorithmToProto: (value: ReallyMeMulticodecKeyAlgorithm) => MulticodecKeyAlgorithm;
 export declare const cryptoWireErrorToProto: (error: ReallyMeCryptoWireError) => CryptoError;
@@ -89,8 +75,6 @@ export declare const cryptoWireErrorToProtoBytes: (error: ReallyMeCryptoWireErro
 export declare const cryptoWireErrorFromProtoBytes: (bytes: Uint8Array) => ReallyMeCryptoWireError;
 export declare const cryptoWireErrorTryNew: (branch: ReallyMeCryptoWireErrorBranch, reason: CryptoErrorReason) => ReallyMeCryptoWireErrorValidationResult;
 export declare const cryptoWireErrorToFacadeError: (error: ReallyMeCryptoWireError) => ReallyMeCryptoError;
-export declare const cryptoProtoResult: (bytes: Uint8Array) => ReallyMeCryptoProtoResult;
-export declare const cryptoProtoErrorResult: (error: CryptoError | ReallyMeCryptoWireError | ReallyMeCryptoError) => ReallyMeCryptoProtoResult;
 export declare const cryptoErrorToProto: (error: ReallyMeCryptoError) => CryptoError;
 export declare const cryptoErrorToProtoBytes: (error: ReallyMeCryptoError) => Uint8Array;
 export declare const cryptoErrorFromProto: (value: CryptoError) => ReallyMeCryptoError;

package/dist/proto.js

@@ -3,32 +3,10 @@
 // SPDX-License-Identifier: Apache-2.0
 import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { ReallyMeCryptoError } from "./errors.js";
-import { ReallyMeJwk } from "./jwk.js";
-export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamily, CryptoBackendErrorSchema, CryptoErrorReason, CryptoErrorSchema, CryptoHpkeSealedMessageSchema, CryptoKemEncapsulationSchema, CryptoKeyPairSchema, CryptoPrimitiveErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderErrorSchema, CryptoProviderSupportStatus, CryptoVerificationResultSchema, CryptoVerificationStatus, JsonWebKeySchema, JsonWebKeySetSchema, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-export class ReallyMeCryptoProtoResult {
-    #bytes;
-    status;
-    constructor(status, bytes) {
-        this.status = status;
-        this.#bytes = bytes.slice();
-    }
-    get bytes() {
-        return this.#bytes.slice();
-    }
-    get isCryptoError() {
-        return this.status === "crypto-error";
-    }
-    bestEffortClear() {
-        this.#bytes.fill(0);
-    }
-    toString() {
-        return `ReallyMeCryptoProtoResult(status=${this.status}, bytes=<redacted>)`;
-    }
-    toJSON() {
-        return { status: this.status, bytes: "<redacted>" };
-    }
-}
+import { MAX_JWKS_KEYS, ReallyMeJwk } from "./jwk.js";
+import { ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
+export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemDeriveKeyPairRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoOperationRequestSchema, CryptoOperationResponseSchema, CryptoOperationResultSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeAeadId, HpkeAeadIdSchema, HpkeKdfId, HpkeKdfIdSchema, HpkeKemId, HpkeKemIdSchema, HpkeSuiteIdentifierSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { AeadAlgorithm, HashAlgorithm, HpkeAeadId, HpkeKdfId, HpkeKemId, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamily, CryptoBackendErrorSchema, CryptoErrorReason, CryptoErrorSchema, CryptoHpkeSealedMessageSchema, HpkeSuiteIdentifierSchema, CryptoKemEncapsulationSchema, CryptoKeyPairSchema, CryptoPrimitiveErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderErrorSchema, CryptoProviderSupportStatus, CryptoVerificationResultSchema, CryptoVerificationStatus, JsonWebKeySchema, JsonWebKeySetSchema, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
 export const signatureAlgorithmFromProto = (value) => {
     switch (value) {
         case SignatureAlgorithm.ED25519:
@@ -193,8 +171,6 @@ export const kemAlgorithmFromProto = (value) => {
             return "ML-KEM-1024";
         case KemAlgorithm.X_WING_768:
             return "X-Wing-768";
-        case KemAlgorithm.X_WING_1024:
-            return "X-Wing-1024";
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
@@ -209,8 +185,6 @@ export const kemAlgorithmToProto = (value) => {
             return KemAlgorithm.ML_KEM_1024;
         case "X-Wing-768":
             return KemAlgorithm.X_WING_768;
-        case "X-Wing-1024":
-            return KemAlgorithm.X_WING_1024;
     }
 };
 export const keyAgreementAlgorithmFromProto = (value) => {
@@ -243,6 +217,8 @@ export const macAlgorithmFromProto = (value) => {
     switch (value) {
         case MacAlgorithm.HMAC_SHA256:
             return "HMAC-SHA-256";
+        case MacAlgorithm.HMAC_SHA384:
+            return "HMAC-SHA-384";
         case MacAlgorithm.HMAC_SHA512:
             return "HMAC-SHA-512";
         default:
@@ -253,6 +229,8 @@ export const macAlgorithmToProto = (value) => {
     switch (value) {
         case "HMAC-SHA-256":
             return MacAlgorithm.HMAC_SHA256;
+        case "HMAC-SHA-384":
+            return MacAlgorithm.HMAC_SHA384;
         case "HMAC-SHA-512":
             return MacAlgorithm.HMAC_SHA512;
     }
@@ -261,6 +239,10 @@ export const kdfAlgorithmFromProto = (value) => {
     switch (value) {
         case KdfAlgorithm.HKDF_SHA256:
             return "HKDF-SHA256";
+        case KdfAlgorithm.HKDF_SHA384:
+            return "HKDF-SHA384";
+        case KdfAlgorithm.KMAC_256:
+            return "KMAC256";
         case KdfAlgorithm.ARGON2ID:
             return "Argon2id";
         case KdfAlgorithm.PBKDF2_HMAC_SHA256:
@@ -277,6 +259,10 @@ export const kdfAlgorithmToProto = (value) => {
     switch (value) {
         case "HKDF-SHA256":
             return KdfAlgorithm.HKDF_SHA256;
+        case "HKDF-SHA384":
+            return KdfAlgorithm.HKDF_SHA384;
+        case "KMAC256":
+            return KdfAlgorithm.KMAC_256;
         case "Argon2id":
             return KdfAlgorithm.ARGON2ID;
         case "PBKDF2-HMAC-SHA-256":
@@ -289,6 +275,10 @@ export const kdfAlgorithmToProto = (value) => {
 };
 export const keyWrapAlgorithmFromProto = (value) => {
     switch (value) {
+        case KeyWrapAlgorithm.AES_128_KW:
+            return "AES-128-KW";
+        case KeyWrapAlgorithm.AES_192_KW:
+            return "AES-192-KW";
         case KeyWrapAlgorithm.AES_256_KW:
             return "AES-256-KW";
         default:
@@ -297,26 +287,41 @@ export const keyWrapAlgorithmFromProto = (value) => {
 };
 export const keyWrapAlgorithmToProto = (value) => {
     switch (value) {
+        case "AES-128-KW":
+            return KeyWrapAlgorithm.AES_128_KW;
+        case "AES-192-KW":
+            return KeyWrapAlgorithm.AES_192_KW;
         case "AES-256-KW":
             return KeyWrapAlgorithm.AES_256_KW;
     }
 };
 export const hpkeSuiteFromProto = (value) => {
-    switch (value) {
-        case HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM:
-            return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
-        case HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305:
-            return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
-        default:
-            throw new ReallyMeCryptoError("unsupported-algorithm");
+    if (value.kem === HpkeKemId.DHKEM_P256_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.AES_256_GCM) {
+        return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
+    }
+    if (value.kem === HpkeKemId.DHKEM_X25519_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.CHACHA20_POLY1305) {
+        return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
     }
+    throw new ReallyMeCryptoError("unsupported-algorithm");
 };
 export const hpkeSuiteToProto = (value) => {
     switch (value) {
         case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
-            return HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM;
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_P256_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.AES_256_GCM,
+            });
         case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-            return HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305;
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_X25519_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.CHACHA20_POLY1305,
+            });
     }
 };
 const signatureAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
@@ -329,7 +334,7 @@ const kemAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifie
     algorithm: { case: "kem", value: kemAlgorithmToProto(value) },
 });
 const hpkeSuiteIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
-    algorithm: { case: "hpke", value: hpkeSuiteToProto(value) },
+    algorithm: { case: "hpkeSuite", value: hpkeSuiteToProto(value) },
 });
 const signatureAlgorithmFromIdentifier = (value) => {
     if (value?.algorithm.case !== "signature") {
@@ -350,7 +355,7 @@ const kemAlgorithmFromIdentifier = (value) => {
     return kemAlgorithmFromProto(value.algorithm.value);
 };
 const hpkeSuiteFromIdentifier = (value) => {
-    if (value?.algorithm.case !== "hpke") {
+    if (value?.algorithm.case !== "hpkeSuite") {
         throw new ReallyMeCryptoError("invalid-input");
     }
     return hpkeSuiteFromProto(value.algorithm.value);
@@ -421,7 +426,14 @@ export const multicodecKeyAlgorithmToProto = (value) => {
             return MulticodecKeyAlgorithm.ML_DSA_87_PUB;
     }
 };
+// The largest supported canonical JWK is below 4 KiB. Keeping a full factor of
+// two for future public-key encodings prevents attacker-controlled allocations
+// and guarantees conversion never depends on an engine's argument-count limit.
+const MAX_JWK_CANONICAL_JCS_LENGTH = 8_192;
 const asciiToBytes = (value) => {
+    if (value.length > MAX_JWK_CANONICAL_JCS_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
     const bytes = new Uint8Array(value.length);
     for (let index = 0; index < value.length; index += 1) {
         const codeUnit = value.charCodeAt(index);
@@ -433,14 +445,26 @@ const asciiToBytes = (value) => {
     return bytes;
 };
 const asciiFromBytes = (value) => {
-    const codeUnits = [];
+    ensureByteArrayAtMost(value, MAX_JWK_CANONICAL_JCS_LENGTH);
+    const characters = [];
     for (const byte of value) {
         if (byte > 0x7f) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        codeUnits.push(byte);
+        characters.push(String.fromCharCode(byte));
+    }
+    return characters.join("");
+};
+const withJwkProtoBoundaryErrors = (operation) => {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
     }
-    return String.fromCharCode(...codeUnits);
 };
 const cryptoErrorReasonToFacadeError = (reason) => {
     switch (reason) {
@@ -452,11 +476,15 @@ const cryptoErrorReasonToFacadeError = (reason) => {
             return new ReallyMeCryptoError("unsupported-algorithm");
         case CryptoErrorReason.PROVIDER_UNAVAILABLE:
         case CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_KEY_EXISTS:
+        case CryptoErrorReason.PROVIDER_KEY_NOT_FOUND:
+        case CryptoErrorReason.PROVIDER_ACCESS_DENIED:
+        case CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED:
+        case CryptoErrorReason.PROVIDER_USER_CANCELED:
+        case CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY:
         case CryptoErrorReason.BACKEND_INVALID_STATE:
         case CryptoErrorReason.BACKEND_INTERNAL:
-        case CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF:
-        case CryptoErrorReason.BACKEND_MALFORMED_JSON:
-        case CryptoErrorReason.BACKEND_RESOURCE_LIMIT_EXCEEDED:
             return new ReallyMeCryptoError("provider-failure");
         case CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER:
         case CryptoErrorReason.PRIMITIVE_INVALID_LENGTH:
@@ -470,6 +498,10 @@ const cryptoErrorReasonToFacadeError = (reason) => {
         case CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET:
         case CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT:
         case CryptoErrorReason.PRIMITIVE_INVALID_TAG:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_JSON:
+        case CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED:
+        case CryptoErrorReason.PRIMITIVE_MISSING_OPERATION:
             return new ReallyMeCryptoError("invalid-input");
         case CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED:
             return new ReallyMeCryptoError("authentication-failed");
@@ -490,6 +522,10 @@ const invalidInputReasons = new Set([
     CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
     CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
     CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
 ]);
 export const cryptoWireErrorToProto = (error) => {
     switch (error.branch) {
@@ -560,9 +596,9 @@ export const cryptoWireErrorTryNew = (branch, reason) => {
     return { ok: true, value: { branch, reason, reasonCode: reason } };
 };
 const malformedCryptoErrorEnvelope = () => ({
-    branch: "backend",
-    reason: CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
-    reasonCode: CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
+    branch: "primitive",
+    reason: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    reasonCode: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
 });
 const cryptoErrorReasonCodeMatchesBranch = (branch, reasonCode) => {
     switch (branch) {
@@ -600,19 +636,27 @@ const primitiveCryptoErrorReasons = new Set([
     CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
     CryptoErrorReason.PRIMITIVE_INVALID_TAG,
     CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
 ]);
 const providerCryptoErrorReasons = new Set([
     CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
     CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND,
     CryptoErrorReason.PROVIDER_UNAVAILABLE,
     CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_KEY_EXISTS,
+    CryptoErrorReason.PROVIDER_KEY_NOT_FOUND,
+    CryptoErrorReason.PROVIDER_ACCESS_DENIED,
+    CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED,
+    CryptoErrorReason.PROVIDER_USER_CANCELED,
+    CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY,
 ]);
 const backendCryptoErrorReasons = new Set([
     CryptoErrorReason.BACKEND_INVALID_STATE,
     CryptoErrorReason.BACKEND_INTERNAL,
-    CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
-    CryptoErrorReason.BACKEND_MALFORMED_JSON,
-    CryptoErrorReason.BACKEND_RESOURCE_LIMIT_EXCEEDED,
 ]);
 const knownCryptoErrorReasons = new Set([
     ...primitiveCryptoErrorReasons,
@@ -635,15 +679,6 @@ export const cryptoWireErrorToFacadeError = (error) => {
             return new ReallyMeCryptoError("provider-failure");
     }
 };
-export const cryptoProtoResult = (bytes) => new ReallyMeCryptoProtoResult("result", bytes);
-export const cryptoProtoErrorResult = (error) => {
-    const bytes = error instanceof ReallyMeCryptoError
-        ? cryptoErrorToProtoBytes(error)
-        : "branch" in error
-            ? cryptoWireErrorToProtoBytes(error)
-            : toBinary(CryptoErrorSchema, error);
-    return new ReallyMeCryptoProtoResult("crypto-error", bytes);
-};
 export const cryptoErrorToProto = (error) => {
     switch (error.code) {
         case "invalid-input":
@@ -757,13 +792,6 @@ const jwkAlgorithmToProto = (value) => {
                     value: KemAlgorithm.X_WING_768,
                 },
             });
-        case "X-Wing-1024":
-            return create(CryptoAlgorithmIdentifierSchema, {
-                algorithm: {
-                    case: "kem",
-                    value: KemAlgorithm.X_WING_1024,
-                },
-            });
         default:
             return create(CryptoAlgorithmIdentifierSchema, {
                 algorithm: {
@@ -812,8 +840,6 @@ const jwkAlgorithmFromProto = (value) => {
                     return "ML-KEM-1024";
                 case KemAlgorithm.X_WING_768:
                     return "X-Wing-768";
-                case KemAlgorithm.X_WING_1024:
-                    return "X-Wing-1024";
                 default:
                     throw new ReallyMeCryptoError("unsupported-algorithm");
             }
@@ -827,51 +853,47 @@ export const jsonWebKeyToProto = (key) => create(JsonWebKeySchema, {
     canonicalJcs: asciiToBytes(ReallyMeJwk.toJcs(key.jwk)),
 });
 export const jsonWebKeyToProtoBytes = (key) => toBinary(JsonWebKeySchema, jsonWebKeyToProto(key));
-export const jsonWebKeyFromProto = (value) => {
-    const algorithm = value.algorithm === undefined
+export const jsonWebKeyFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    // Read each field once so a hostile message proxy cannot change values
+    // between validation and construction.
+    const algorithmValue = value.algorithm;
+    const publicKey = value.publicKey;
+    const canonicalJcs = value.canonicalJcs;
+    const algorithm = algorithmValue === undefined
         ? undefined
-        : jwkAlgorithmFromProto(value.algorithm);
+        : jwkAlgorithmFromProto(algorithmValue);
     if (algorithm === undefined) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const jwk = ReallyMeJwk.toJwk(algorithm, value.publicKey);
-    if (value.canonicalJcs.length > 0) {
+    ensureByteArrayAtMost(publicKey, MAX_CRYPTO_INPUT_LENGTH);
+    const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
+    if (canonicalJcs.length > 0) {
         const expected = ReallyMeJwk.toJcs(jwk);
-        if (asciiFromBytes(value.canonicalJcs) !== expected) {
+        if (asciiFromBytes(canonicalJcs) !== expected) {
             throw new ReallyMeCryptoError("invalid-input");
         }
     }
-    return { algorithm, publicKey: value.publicKey, jwk };
-};
-export const jsonWebKeyFromProtoBytes = (bytes) => {
-    try {
-        return jsonWebKeyFromProto(fromBinary(JsonWebKeySchema, bytes));
-    }
-    catch (error) {
-        if (error instanceof ReallyMeCryptoError) {
-            throw error;
-        }
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-};
+    return { algorithm, publicKey, jwk };
+});
+export const jsonWebKeyFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeyFromProto(fromBinary(JsonWebKeySchema, bytes));
+});
 export const jsonWebKeySetToProto = (keySet) => create(JsonWebKeySetSchema, {
     keys: keySet.keys.map((key) => jsonWebKeyToProto(key)),
 });
 export const jsonWebKeySetToProtoBytes = (keySet) => toBinary(JsonWebKeySetSchema, jsonWebKeySetToProto(keySet));
-export const jsonWebKeySetFromProto = (value) => ({
-    keys: value.keys.map((key) => jsonWebKeyFromProto(key)),
-});
-export const jsonWebKeySetFromProtoBytes = (bytes) => {
-    try {
-        return jsonWebKeySetFromProto(fromBinary(JsonWebKeySetSchema, bytes));
-    }
-    catch (error) {
-        if (error instanceof ReallyMeCryptoError) {
-            throw error;
-        }
+export const jsonWebKeySetFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    const keys = value.keys;
+    if (!Array.isArray(keys) || keys.length > MAX_JWKS_KEYS) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-};
+    return { keys: keys.map((key) => jsonWebKeyFromProto(key)) };
+});
+export const jsonWebKeySetFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeySetFromProto(fromBinary(JsonWebKeySetSchema, bytes));
+});
 const keyPairToProto = (algorithm, keyPair) => create(CryptoKeyPairSchema, {
     algorithm,
     publicKey: keyPair.publicKey,

package/dist/rsa.d.ts

@@ -7,7 +7,8 @@ export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
  * RSA signature verification through the ReallyMe Rust WASM provider.
  *
  * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
- * authentication, and legacy interoperability; no RSA signing API is exposed.
+ * authentication, and historical document interoperability; no RSA signing
+ * API is exposed.
  */
 export declare const ReallyMeRsa: {
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;

package/dist/rsa.js

@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4_096;
 export const RSA_SIGNATURE_MAX_LENGTH = 1_024;
@@ -12,6 +13,7 @@ const RSA_HASH_SHA512 = 4;
 const RSA_PUBLIC_KEY_ENCODING_PKCS1_DER = 1;
 const RSA_PUBLIC_KEY_ENCODING_SPKI_DER = 2;
 const validateBytes = (bytes, maxLength) => {
+    ensureByteArray(bytes);
     if (bytes.length === 0 || bytes.length > maxLength) {
         throw new ReallyMeCryptoError("invalid-input");
     }
@@ -78,6 +80,7 @@ const readVoid = (value) => {
 const verifyWithProvider = (provider, algorithm, signature, message, publicKeyDer, publicKeyEncoding) => {
     validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
     validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
+    ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
     const encoding = encodingId(publicKeyEncoding);
     const pkcs1 = pkcs1v15Suite(algorithm);
     if (pkcs1 !== undefined) {
@@ -95,7 +98,8 @@ const verifyWithProvider = (provider, algorithm, signature, message, publicKeyDe
  * RSA signature verification through the ReallyMe Rust WASM provider.
  *
  * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
- * authentication, and legacy interoperability; no RSA signing API is exposed.
+ * authentication, and historical document interoperability; no RSA signing
+ * API is exposed.
  */
 export const ReallyMeRsa = {
     verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {

package/dist/slhDsa.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH = 32;
 export const SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH = 64;
@@ -13,15 +13,21 @@ const assertSlhDsa = (algorithm) => {
         throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH),
-    secretKey: readByteArrayProperty(value, "secretKey", SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH),
-});
-const readSignature = (value) => {
+const readKeyPair = (value, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readSignature = (value, inputs) => {
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    ensureBytes(value, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
+    // Signature bytes are public, but their shape and ownership are provider
+    // postconditions rather than caller validation failures.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== SLH_DSA_SHA2_128S_SIGNATURE_LENGTH) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
     return value;
 };
 const readVoid = (value) => {
@@ -40,22 +46,26 @@ export const ReallyMeSlhDsa = {
     },
     sign(algorithm, message, secretKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
-        return readSignature(requireReallyMeWasmProvider().slhDsaSha2128sSign(secretKey, message));
+        return readSignature(requireReallyMeWasmProvider().slhDsaSha2128sSign(secretKey, message), [secretKey, message]);
     },
     signWithProvider(provider, algorithm, message, secretKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
-        return readSignature(provider.slhDsaSha2128sSign(secretKey, message));
+        return readSignature(provider.slhDsaSha2128sSign(secretKey, message), [secretKey, message]);
     },
     verify(algorithm, signature, message, publicKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
         ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
         readVoid(requireReallyMeWasmProvider().slhDsaSha2128sVerify(publicKey, message, signature));
     },
     verifyWithProvider(provider, algorithm, signature, message, publicKey) {
         assertSlhDsa(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
         ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
         readVoid(provider.slhDsaSha2128sVerify(publicKey, message, signature));
@@ -65,11 +75,11 @@ export const deriveSlhDsaSha2128sKeypairForTest = (skSeed, skPrf, pkSeed) => {
     ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(skPrf, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
-    return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed));
+    return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed), [skSeed, skPrf, pkSeed]);
 };
 export const deriveSlhDsaSha2128sKeypairWithProviderForTest = (provider, skSeed, skPrf, pkSeed) => {
     ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(skPrf, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
-    return readKeyPair(provider.slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed));
+    return readKeyPair(provider.slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed), [skSeed, skPrf, pkSeed]);
 };

package/dist/validateBytes.d.ts

@@ -1,3 +1,8 @@
+export declare const MAX_CRYPTO_INPUT_LENGTH = 1048576;
 export declare const ensureByteArray: (value: Uint8Array) => void;
+export declare const ensureByteArrayAtMost: (value: Uint8Array, maximumLength: number) => void;
 export declare const ensureBytes: (value: Uint8Array, expectedLength: number) => void;
-export declare const readByteArrayProperty: (value: unknown, propertyName: string, expectedLength: number) => Uint8Array;
+export declare const byteArraysOverlap: (left: Uint8Array, right: Uint8Array) => boolean;
+export declare const ensureIndependentByteArray: (value: Uint8Array, disallowedViews: ReadonlyArray<Uint8Array>) => void;
+export declare const readIndependentByteArrayProperty: (value: unknown, propertyName: string, expectedLength: number, disallowedViews: ReadonlyArray<Uint8Array>) => Uint8Array;
+export declare const readIndependentProviderBytes: (value: unknown, expectedLength: number, disallowedViews: ReadonlyArray<Uint8Array>) => Uint8Array;