@reallyme/crypto 0.3.9 → 0.3.11

package/dist/cryptoFacadeAsymmetric.js

@@ -0,0 +1,252 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { ReallyMeBip340Schnorr } from "./bip340Schnorr.js";
+import { ReallyMeEd25519 } from "./ed25519.js";
+import { ReallyMeCryptoError } from "./errors.js";
+import { ReallyMeHpke } from "./hpke.js";
+import { ReallyMeMlDsa } from "./mlDsa.js";
+import { ReallyMeMlKem } from "./mlKem.js";
+import { ReallyMeP256Ecdh } from "./p256Ecdh.js";
+import { ReallyMeP256Ecdsa } from "./p256Ecdsa.js";
+import { ReallyMeP384Ecdh } from "./p384Ecdh.js";
+import { ReallyMeP384Ecdsa } from "./p384Ecdsa.js";
+import { ReallyMeP521Ecdh } from "./p521Ecdh.js";
+import { ReallyMeP521Ecdsa } from "./p521Ecdsa.js";
+import { ReallyMeRsa } from "./rsa.js";
+import { ReallyMeSecp256k1 } from "./secp256k1.js";
+import { ReallyMeSlhDsa } from "./slhDsa.js";
+import { ReallyMeX25519 } from "./x25519.js";
+import { ReallyMeXWing } from "./xWing.js";
+const SECP256K1_ECDSA = "ECDSA-secp256k1-SHA256";
+const P256_ECDSA = "ECDSA-P256-SHA256";
+const P384_ECDSA = "ECDSA-P384-SHA384";
+const P521_ECDSA = "ECDSA-P521-SHA512";
+const BIP340_SCHNORR = "BIP340-Schnorr-secp256k1-SHA256";
+const ED25519 = "Ed25519";
+export const createReallyMeAsymmetricFacade = (resolveWasmProvider) => ({
+    generateKeyPair(algorithm) {
+        if (algorithm === ED25519) {
+            return ReallyMeEd25519.generateKeyPair();
+        }
+        switch (algorithm) {
+            case P256_ECDSA:
+                return ReallyMeP256Ecdsa.generateKeyPair();
+            case P384_ECDSA:
+                return ReallyMeP384Ecdsa.generateKeyPair();
+            case P521_ECDSA:
+                return ReallyMeP521Ecdsa.generateKeyPair();
+            case SECP256K1_ECDSA:
+                return ReallyMeSecp256k1.generateKeyPair();
+            case BIP340_SCHNORR:
+                return ReallyMeBip340Schnorr.generateKeyPair();
+            case "ML-DSA-44":
+            case "ML-DSA-65":
+            case "ML-DSA-87":
+                return ReallyMeMlDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            case "SLH-DSA-SHA2-128s":
+                return ReallyMeSlhDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKeyPair(algorithm, secretKey) {
+        // Import an existing secret and reconstruct its public key. Do not use
+        // this as key generation from passwords or other low-entropy input; use
+        // generateKeyPair for new keys, or a protocol-approved KDF before import.
+        if (algorithm === ED25519) {
+            return ReallyMeEd25519.deriveKeyPair(secretKey);
+        }
+        switch (algorithm) {
+            case P256_ECDSA:
+                return ReallyMeP256Ecdsa.deriveKeyPair(secretKey);
+            case P384_ECDSA:
+                return ReallyMeP384Ecdsa.deriveKeyPair(secretKey);
+            case P521_ECDSA:
+                return ReallyMeP521Ecdsa.deriveKeyPair(secretKey);
+            case SECP256K1_ECDSA:
+                return ReallyMeSecp256k1.deriveKeyPair(secretKey);
+            case BIP340_SCHNORR:
+                return ReallyMeBip340Schnorr.deriveKeyPair(secretKey);
+            case "ML-DSA-44":
+            case "ML-DSA-65":
+            case "ML-DSA-87":
+                return ReallyMeMlDsa.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
+            case "SLH-DSA-SHA2-128s":
+                // SLH-DSA deterministic derivation uses three FIPS seed components,
+                // so it deliberately does not fit this single-secret import shape.
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    sign(algorithm, message, secretKey) {
+        if (algorithm === ED25519) {
+            return ReallyMeEd25519.sign(message, secretKey);
+        }
+        switch (algorithm) {
+            case P256_ECDSA:
+                return ReallyMeP256Ecdsa.sign(message, secretKey);
+            case P384_ECDSA:
+                return ReallyMeP384Ecdsa.sign(message, secretKey);
+            case P521_ECDSA:
+                return ReallyMeP521Ecdsa.sign(message, secretKey);
+            case SECP256K1_ECDSA:
+                return ReallyMeSecp256k1.sign(message, secretKey);
+            case "ML-DSA-44":
+            case "ML-DSA-65":
+            case "ML-DSA-87":
+                return ReallyMeMlDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
+            case "SLH-DSA-SHA2-128s":
+                return ReallyMeSlhDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    signBip340Schnorr(message32, secretKey, auxRand32) {
+        return ReallyMeBip340Schnorr.sign(message32, secretKey, auxRand32);
+    },
+    verify(algorithm, signature, message, publicKey) {
+        if (algorithm === ED25519) {
+            ReallyMeEd25519.verify(signature, message, publicKey);
+            return;
+        }
+        switch (algorithm) {
+            case P256_ECDSA:
+                ReallyMeP256Ecdsa.verify(signature, message, publicKey);
+                return;
+            case P384_ECDSA:
+                ReallyMeP384Ecdsa.verify(signature, message, publicKey);
+                return;
+            case P521_ECDSA:
+                ReallyMeP521Ecdsa.verify(signature, message, publicKey);
+                return;
+            case SECP256K1_ECDSA:
+                ReallyMeSecp256k1.verify(signature, message, publicKey);
+                return;
+            case BIP340_SCHNORR:
+                ReallyMeBip340Schnorr.verify(signature, message, publicKey);
+                return;
+            case "ML-DSA-44":
+            case "ML-DSA-65":
+            case "ML-DSA-87":
+                ReallyMeMlDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
+                return;
+            case "SLH-DSA-SHA2-128s":
+                ReallyMeSlhDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
+                return;
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    verifyRsa(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
+        switch (algorithm) {
+            case "RSA-PKCS1v15-SHA1":
+            case "RSA-PKCS1v15-SHA256":
+            case "RSA-PKCS1v15-SHA384":
+            case "RSA-PKCS1v15-SHA512":
+            case "RSA-PSS-SHA1-MGF1-SHA1":
+            case "RSA-PSS-SHA256-MGF1-SHA256":
+            case "RSA-PSS-SHA384-MGF1-SHA384":
+            case "RSA-PSS-SHA512-MGF1-SHA512":
+                ReallyMeRsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKeyDer, publicKeyEncoding);
+                return;
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveSharedSecret(algorithm, publicKey, secretKey) {
+        switch (algorithm) {
+            case "X25519":
+                return ReallyMeX25519.deriveSharedSecret(publicKey, secretKey);
+            case "P-256-ECDH":
+                return ReallyMeP256Ecdh.deriveSharedSecret(publicKey, secretKey);
+            case "P-384-ECDH":
+                return ReallyMeP384Ecdh.deriveSharedSecret(publicKey, secretKey);
+            case "P-521-ECDH":
+                return ReallyMeP521Ecdh.deriveSharedSecret(publicKey, secretKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKeyAgreementKeyPair(algorithm, secretKey) {
+        switch (algorithm) {
+            case "X25519":
+                return ReallyMeX25519.deriveKeyPair(secretKey);
+            case "P-256-ECDH":
+                return ReallyMeP256Ecdh.deriveKeyPair(secretKey);
+            case "P-384-ECDH":
+                return ReallyMeP384Ecdh.deriveKeyPair(secretKey);
+            case "P-521-ECDH":
+                return ReallyMeP521Ecdh.deriveKeyPair(secretKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    generateKemKeyPair(algorithm) {
+        switch (algorithm) {
+            case "X-Wing-768":
+                return ReallyMeXWing.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKemKeyPair(algorithm, secretKey) {
+        switch (algorithm) {
+            case "X-Wing-768":
+                return ReallyMeXWing.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    encapsulate(algorithm, publicKey) {
+        switch (algorithm) {
+            case "X-Wing-768":
+                return ReallyMeXWing.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    decapsulate(algorithm, ciphertext, secretKey) {
+        switch (algorithm) {
+            case "X-Wing-768":
+                return ReallyMeXWing.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    sealHpke(suite, recipientPublicKey, info, aad, plaintext) {
+        switch (suite) {
+            case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
+            case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
+                return ReallyMeHpke.sealBaseWithProvider(resolveWasmProvider(), suite, recipientPublicKey, info, aad, plaintext);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    openHpke(suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext) {
+        switch (suite) {
+            case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
+            case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
+                return ReallyMeHpke.openBaseWithProvider(resolveWasmProvider(), suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+});

package/dist/cryptoFacadeSymmetric.d.ts

@@ -0,0 +1,27 @@
+import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHkdfAlgorithm, ReallyMeJwaConcatKdfAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeKmacKdfAlgorithm, ReallyMeMacAlgorithm, ReallyMePbkdf2Algorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
+export declare const createReallyMeSymmetricFacade: (resolveWasmProvider: () => ReallyMeWasmProvider) => {
+    /**
+     * Executes a generated binary request and returns a binary
+     * `CryptoOperationResponse`.
+     */
+    processOperationResponse(request: Uint8Array): Uint8Array;
+    /**
+     * Executes a permitted non-secret generated ProtoJSON request and returns
+     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
+     * before JSON value deserialization.
+     */
+    processOperationResponseJson(requestJson: Uint8Array): Uint8Array;
+    hash(algorithm: ReallyMeHashAlgorithm, bytes: Uint8Array): Uint8Array;
+    seal(algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+    open(algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+    authenticate(algorithm: ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array): Uint8Array;
+    verifyMac(algorithm: ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array): void;
+    deriveArgon2id(kdfVersion: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
+    deriveKey(algorithm: ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number): Uint8Array;
+    deriveHkdf(algorithm: ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number): Uint8Array;
+    deriveJwaConcatKdfSha256(algorithm: ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number): Uint8Array;
+    deriveKmac256(algorithm: ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number): Uint8Array;
+    wrapKey(algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array): Uint8Array;
+    unwrapKey(algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array): Uint8Array;
+};

package/dist/cryptoFacadeSymmetric.js

@@ -0,0 +1,166 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { ReallyMeAead } from "./aead.js";
+import { ReallyMeAesKw } from "./aesKw.js";
+import { ReallyMeArgon2id } from "./argon2id.js";
+import { ReallyMeDigest } from "./digest.js";
+import { ReallyMeCryptoError } from "./errors.js";
+import { ReallyMeHkdf } from "./hkdf.js";
+import { ReallyMeHmac } from "./hmac.js";
+import { ReallyMeJwaConcatKdf } from "./jwaConcatKdf.js";
+import { ReallyMeKmac } from "./kmac.js";
+import { processOperationResponseJsonWithProvider, processOperationResponseWithProvider, } from "./operationResponse.js";
+import { ReallyMePbkdf2 } from "./pbkdf2.js";
+import { ensureByteArray } from "./validateBytes.js";
+export const createReallyMeSymmetricFacade = (resolveWasmProvider) => ({
+    /**
+     * Executes a generated binary request and returns a binary
+     * `CryptoOperationResponse`.
+     */
+    processOperationResponse(request) {
+        ensureByteArray(request);
+        return processOperationResponseWithProvider(resolveWasmProvider(), request);
+    },
+    /**
+     * Executes a permitted non-secret generated ProtoJSON request and returns
+     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
+     * before JSON value deserialization.
+     */
+    processOperationResponseJson(requestJson) {
+        ensureByteArray(requestJson);
+        return processOperationResponseJsonWithProvider(resolveWasmProvider(), requestJson);
+    },
+    hash(algorithm, bytes) {
+        switch (algorithm) {
+            case "SHA2-256":
+                return ReallyMeDigest.sha256(bytes);
+            case "SHA2-384":
+                return ReallyMeDigest.sha384(bytes);
+            case "SHA2-512":
+                return ReallyMeDigest.sha512(bytes);
+            case "SHA3-224":
+                return ReallyMeDigest.sha3_224(bytes);
+            case "SHA3-256":
+                return ReallyMeDigest.sha3_256(bytes);
+            case "SHA3-384":
+                return ReallyMeDigest.sha3_384(bytes);
+            case "SHA3-512":
+                return ReallyMeDigest.sha3_512(bytes);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    seal(algorithm, key, nonce, aad, plaintext) {
+        switch (algorithm) {
+            case "AES-128-GCM":
+            case "AES-192-GCM":
+            case "AES-256-GCM":
+            case "AES-256-GCM-SIV":
+            case "ChaCha20-Poly1305":
+            case "XChaCha20-Poly1305":
+                return ReallyMeAead.sealWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, plaintext);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    open(algorithm, key, nonce, aad, ciphertextWithTag) {
+        switch (algorithm) {
+            case "AES-128-GCM":
+            case "AES-192-GCM":
+            case "AES-256-GCM":
+            case "AES-256-GCM-SIV":
+            case "ChaCha20-Poly1305":
+            case "XChaCha20-Poly1305":
+                return ReallyMeAead.openWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, ciphertextWithTag);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    authenticate(algorithm, key, message) {
+        switch (algorithm) {
+            case "HMAC-SHA-256":
+                return ReallyMeHmac.authenticateSha256(key, message);
+            case "HMAC-SHA-384":
+                return ReallyMeHmac.authenticateSha384(key, message);
+            case "HMAC-SHA-512":
+                return ReallyMeHmac.authenticateSha512(key, message);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    verifyMac(algorithm, tag, key, message) {
+        switch (algorithm) {
+            case "HMAC-SHA-256":
+                ReallyMeHmac.verifySha256(tag, key, message);
+                return;
+            case "HMAC-SHA-384":
+                ReallyMeHmac.verifySha384(tag, key, message);
+                return;
+            case "HMAC-SHA-512":
+                ReallyMeHmac.verifySha512(tag, key, message);
+                return;
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveArgon2id(kdfVersion, secret, salt) {
+        return ReallyMeArgon2id.deriveKeyWithProvider(resolveWasmProvider(), kdfVersion, secret, salt);
+    },
+    deriveKey(algorithm, password, salt, iterations, outputLength) {
+        switch (algorithm) {
+            case "PBKDF2-HMAC-SHA-256":
+                return ReallyMePbkdf2.deriveHmacSha256(password, salt, iterations, outputLength);
+            case "PBKDF2-HMAC-SHA-512":
+                return ReallyMePbkdf2.deriveHmacSha512(password, salt, iterations, outputLength);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveHkdf(algorithm, inputKeyMaterial, salt, info, outputLength) {
+        switch (algorithm) {
+            case "HKDF-SHA256":
+                return ReallyMeHkdf.deriveSha256(inputKeyMaterial, salt, info, outputLength);
+            case "HKDF-SHA384":
+                return ReallyMeHkdf.deriveSha384(inputKeyMaterial, salt, info, outputLength);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveJwaConcatKdfSha256(algorithm, sharedSecret, algorithmId, partyUInfo, partyVInfo, outputLength) {
+        switch (algorithm) {
+            case "JWA-CONCAT-KDF-SHA256":
+                return ReallyMeJwaConcatKdf.deriveSha256(sharedSecret, algorithmId, partyUInfo, partyVInfo, outputLength);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKmac256(algorithm, key, context, customization, outputLength) {
+        switch (algorithm) {
+            case "KMAC256":
+                return ReallyMeKmac.deriveKmac256WithProvider(resolveWasmProvider(), key, context, customization, outputLength);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    wrapKey(algorithm, wrappingKey, keyToWrap) {
+        switch (algorithm) {
+            case "AES-128-KW":
+            case "AES-192-KW":
+            case "AES-256-KW":
+                return ReallyMeAesKw.wrapKeyWithProvider(algorithm, resolveWasmProvider(), wrappingKey, keyToWrap);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    unwrapKey(algorithm, wrappingKey, wrappedKey) {
+        switch (algorithm) {
+            case "AES-128-KW":
+            case "AES-192-KW":
+            case "AES-256-KW":
+                return ReallyMeAesKw.unwrapKeyWithProvider(algorithm, resolveWasmProvider(), wrappingKey, wrappedKey);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+});

package/dist/digest.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { sha256 as nobleSha256, sha384 as nobleSha384, sha512 as nobleSha512 } from "@noble/hashes/sha2.js";

package/dist/ed25519.d.ts

@@ -10,6 +10,8 @@
 export declare const ED25519_SECRET_KEY_LENGTH = 32;
 export declare const ED25519_PUBLIC_KEY_LENGTH = 32;
 export declare const ED25519_SIGNATURE_LENGTH = 64;
+/** Require one canonical prime-subgroup encoding for an Ed25519 identity. */
+export declare const validateEd25519PublicKeyIdentity: (publicKey: Uint8Array) => void;
 export declare const ReallyMeEd25519: {
     /** Generates a random Ed25519 keypair: 32-byte public key, 32-byte seed. */
     readonly generateKeyPair: () => {

package/dist/ed25519.js

@@ -1,7 +1,9 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ed25519 } from "@noble/curves/ed25519.js";
+import { bytesToNumberLE, concatBytes } from "@noble/curves/utils.js";
+import { sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArray } from "./validateBytes.js";
 /**
@@ -16,6 +18,25 @@ import { ensureByteArray } from "./validateBytes.js";
 export const ED25519_SECRET_KEY_LENGTH = 32;
 export const ED25519_PUBLIC_KEY_LENGTH = 32;
 export const ED25519_SIGNATURE_LENGTH = 64;
+/** Require one canonical prime-subgroup encoding for an Ed25519 identity. */
+export const validateEd25519PublicKeyIdentity = (publicKey) => {
+    ensureByteArray(publicKey);
+    if (publicKey.length !== ED25519_PUBLIC_KEY_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    try {
+        const point = ed25519.Point.fromBytes(publicKey, false);
+        const canonical = point.toBytes();
+        if (!point.isTorsionFree() ||
+            point.isSmallOrder() ||
+            canonical.some((byte, index) => byte !== publicKey[index])) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
+    catch {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
 export const ReallyMeEd25519 = {
     /** Generates a random Ed25519 keypair: 32-byte public key, 32-byte seed. */
     generateKeyPair() {
@@ -78,13 +99,33 @@ export const ReallyMeEd25519 = {
             publicKey.length !== ED25519_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
+        let point;
         try {
-            ed25519.Point.fromBytes(publicKey, false);
+            point = ed25519.Point.fromBytes(publicKey, false);
         }
         catch {
-            throw new ReallyMeCryptoError("invalid-input");
+            throw new ReallyMeCryptoError("invalid-signature");
+        }
+        try {
+            const rBytes = signature.subarray(0, ED25519_PUBLIC_KEY_LENGTH);
+            const rPoint = ed25519.Point.fromBytes(rBytes, false);
+            const scalar = bytesToNumberLE(signature.subarray(ED25519_PUBLIC_KEY_LENGTH));
+            const order = ed25519.Point.Fn.ORDER;
+            if (scalar >= order ||
+                !point.isTorsionFree() ||
+                !rPoint.isTorsionFree() ||
+                point.isSmallOrder() ||
+                rPoint.isSmallOrder()) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
+            // Noble's ordinary verify uses a cofactored equation. Rust's verify_strict
+            // compares the full Edwards equation, including any torsion component.
+            const challenge = bytesToNumberLE(sha512(concatBytes(rBytes, publicKey, message))) % order;
+            if (!ed25519.Point.BASE.multiplyUnsafe(scalar).equals(rPoint.add(point.multiplyUnsafe(challenge)))) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
         }
-        if (!ed25519.verify(signature, message, publicKey, { zip215: false })) {
+        catch {
             throw new ReallyMeCryptoError("invalid-signature");
         }
     },

package/dist/encodeEcdsaDer.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/errors.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 export class ReallyMeCryptoError extends Error {

package/dist/hkdf.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { hkdf } from "@noble/hashes/hkdf.js";

package/dist/hmac.d.ts

@@ -6,7 +6,7 @@ export declare const ReallyMeHmac: {
     readonly authenticateSha256: (key: Uint8Array, message: Uint8Array) => Uint8Array;
     readonly authenticateSha384: (key: Uint8Array, message: Uint8Array) => Uint8Array;
     readonly authenticateSha512: (key: Uint8Array, message: Uint8Array) => Uint8Array;
-    readonly verifySha256: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
-    readonly verifySha384: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
-    readonly verifySha512: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
+    readonly verifySha256: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => void;
+    readonly verifySha384: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => void;
+    readonly verifySha512: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => void;
 };

package/dist/hmac.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { hmac } from "@noble/hashes/hmac.js";
@@ -30,21 +30,21 @@ export const ReallyMeHmac = {
         if (tag.length !== HMAC_SHA256_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha256(key, message));
+        verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha256(key, message));
     },
     verifySha384(tag, key, message) {
         ensureByteArray(tag);
         if (tag.length !== HMAC_SHA384_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha384(key, message));
+        verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha384(key, message));
     },
     verifySha512(tag, key, message) {
         ensureByteArray(tag);
         if (tag.length !== HMAC_SHA512_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha512(key, message));
+        verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha512(key, message));
     },
 };
 function validateKey(key) {
@@ -70,7 +70,10 @@ function constantTimeEquals(left, right) {
 }
 function verifyAndClearExpectedTag(tag, expectedTag) {
     try {
-        return constantTimeEquals(tag, expectedTag);
+        if (!constantTimeEquals(tag, expectedTag)) {
+            // Verification must fail even when a caller ignores the return value.
+            throw new ReallyMeCryptoError("authentication-failed");
+        }
     }
     finally {
         // Noble returns a new typed array. Clear it immediately so verification

package/dist/hpke.d.ts

@@ -5,7 +5,7 @@ export declare const HPKE_P256_PUBLIC_KEY_LENGTH = 65;
 export declare const HPKE_X25519_PRIVATE_KEY_LENGTH = 32;
 export declare const HPKE_X25519_PUBLIC_KEY_LENGTH = 32;
 export declare const HPKE_AEAD_TAG_LENGTH = 16;
-export declare const HPKE_INFO_MAX_LENGTH = 65530;
+export declare const HPKE_INFO_MAX_LENGTH = 1048576;
 export type ReallyMeHpkeSealedMessage = Readonly<{
     encapsulatedKey: Uint8Array;
     ciphertext: Uint8Array;

package/dist/hpke.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
@@ -9,7 +9,9 @@ export const HPKE_P256_PUBLIC_KEY_LENGTH = 65;
 export const HPKE_X25519_PRIVATE_KEY_LENGTH = 32;
 export const HPKE_X25519_PUBLIC_KEY_LENGTH = 32;
 export const HPKE_AEAD_TAG_LENGTH = 16;
-export const HPKE_INFO_MAX_LENGTH = 65_530;
+// HKDF-based HPKE suites accept info beyond a u16 length; the package-wide
+// input limit is the resource boundary for this public parameter.
+export const HPKE_INFO_MAX_LENGTH = MAX_CRYPTO_INPUT_LENGTH;
 const hpkeSuite = (suite) => {
     switch (suite) {
         case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":

package/dist/index.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 export { ReallyMeCryptoError } from "./errors.js";

package/dist/jwaConcatKdf.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { sha256 } from "@noble/hashes/sha2.js";