@suveren/gateway 0.4.1 → 0.6.0

package/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import { keyAlgorithm } from '../lib/key_algorithm.js';
 function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
@@ -7,91 +8,41 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
+    const entry = keyAlgorithm(alg);
+    if (entry.secret) {
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
     let algorithm;
-    let keyUsages;
-    switch (alg) {
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            algorithm = {
-                name: 'RSA-PSS',
-                hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            algorithm = {
-                name: 'RSASSA-PKCS1-v1_5',
-                hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            algorithm = {
-                name: 'RSA-OAEP',
-                hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey'];
-            break;
-        case 'ES256':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'ES384':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'ES512':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'Ed25519':
-        case 'EdDSA': {
-            keyUsages = ['sign', 'verify'];
-            algorithm = { name: 'Ed25519' };
-            break;
+    if (entry.resolve) {
+        const crv = options?.crv ?? 'P-256';
+        switch (crv) {
+            case 'P-256':
+            case 'P-384':
+            case 'P-521':
+                algorithm = { name: 'ECDH', namedCurve: crv };
+                break;
+            case 'X25519':
+                algorithm = { name: 'X25519' };
+                break;
+            default:
+                throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
         }
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87': {
-            keyUsages = ['sign', 'verify'];
-            algorithm = { name: alg };
-            break;
+    }
+    else {
+        if (entry.crv !== undefined && options?.crv !== undefined && options.crv !== entry.crv) {
+            throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
         }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            keyUsages = ['deriveBits'];
-            const crv = options?.crv ?? 'P-256';
-            switch (crv) {
-                case 'P-256':
-                case 'P-384':
-                case 'P-521': {
-                    algorithm = { name: 'ECDH', namedCurve: crv };
-                    break;
+        algorithm =
+            entry.kty[0] === 'RSA'
+                ? {
+                    ...entry.subtle,
+                    publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
+                    modulusLength: getModulusLengthOption(options),
                 }
-                case 'X25519':
-                    algorithm = { name: 'X25519' };
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
-            }
-            break;
-        }
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+                : entry.subtle;
     }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
+        ...entry.usages[1],
+        ...entry.usages[0],
+    ]);
 }

package/node_modules/jose/dist/webapi/key/import.js

@@ -1,6 +1,7 @@
 import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import { jwkToKey } from '../lib/jwk_to_key.js';
+import { keyAlgorithm } from '../lib/key_algorithm.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isObject } from '../lib/type_checks.js';
 export async function importSPKI(spki, alg, options) {
@@ -25,9 +26,11 @@ export async function importJWK(jwk, alg, options) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    let ext;
     alg ??= jwk.alg;
-    ext ??= options?.extractable ?? jwk.ext;
+    const ext = options?.extractable ?? jwk.ext;
+    if (jwk.kty !== 'oct' && !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
@@ -35,10 +38,7 @@ export async function importJWK(jwk, alg, options) {
             }
             return decodeBase64URL(jwk.k);
         case 'RSA':
-            if ('oth' in jwk && jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-            return jwkToKey({ ...jwk, alg, ext });
+            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
         case 'AKP': {
             if (typeof jwk.alg !== 'string' || !jwk.alg) {
                 throw new TypeError('missing "alg" (Algorithm) Parameter value');
@@ -46,11 +46,11 @@ export async function importJWK(jwk, alg, options) {
             if (alg !== undefined && alg !== jwk.alg) {
                 throw new TypeError('JWK alg and alg option value mismatch');
             }
-            return jwkToKey({ ...jwk, ext });
+            return jwkToKey(keyAlgorithm(jwk.alg), { ...jwk, ext });
         }
         case 'EC':
         case 'OKP':
-            return jwkToKey({ ...jwk, alg, ext });
+            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
         default:
             throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/node_modules/jose/dist/webapi/lib/asn1.js

@@ -1,6 +1,7 @@
 import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
+import { keyAlgorithm } from './key_algorithm.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {
     const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
@@ -36,34 +37,41 @@ const bytesEqual = (a, b) => {
     return true;
 };
 const createASN1State = (data) => ({ data, pos: 0 });
+const readByte = (state) => {
+    const byte = state.data[state.pos++];
+    if (byte === undefined) {
+        throw new Error('Unexpected end of ASN.1 input');
+    }
+    return byte;
+};
 const parseLength = (state) => {
-    const first = state.data[state.pos++];
+    const first = readByte(state);
     if (first & 0x80) {
         const lengthOfLen = first & 0x7f;
         let length = 0;
         for (let i = 0; i < lengthOfLen; i++) {
-            length = (length << 8) | state.data[state.pos++];
+            length = (length << 8) | readByte(state);
         }
         return length;
     }
     return first;
 };
 const skipElement = (state, count = 1) => {
-    if (count <= 0)
-        return;
-    state.pos++;
-    const length = parseLength(state);
-    state.pos += length;
-    if (count > 1) {
-        skipElement(state, count - 1);
+    while (count-- > 0) {
+        state.pos++;
+        const length = parseLength(state);
+        state.pos += length;
     }
 };
 const expectTag = (state, expectedTag, errorMessage) => {
-    if (state.data[state.pos++] !== expectedTag) {
+    if (readByte(state) !== expectedTag) {
         throw new Error(errorMessage);
     }
 };
 const getSubarray = (state, length) => {
+    if (length < 0 || state.pos + length > state.data.length) {
+        throw new Error('Unexpected end of ASN.1 input');
+    }
     const result = state.data.subarray(state.pos, state.pos + length);
     state.pos += length;
     return result;
@@ -73,24 +81,16 @@ const parseAlgorithmOID = (state) => {
     const oidLen = parseLength(state);
     return getSubarray(state, oidLen);
 };
-function parsePKCS8Header(state) {
-    expectTag(state, 0x30, 'Invalid PKCS#8 structure');
+function parseKeyHeader(state, keyFormat) {
+    expectTag(state, 0x30, `Invalid ${keyFormat === 'spki' ? 'SPKI' : 'PKCS#8'} structure`);
     parseLength(state);
-    expectTag(state, 0x02, 'Expected version field');
-    const verLen = parseLength(state);
-    state.pos += verLen;
+    if (keyFormat === 'pkcs8') {
+        expectTag(state, 0x02, 'Expected version field');
+        const length = parseLength(state);
+        state.pos += length;
+    }
     expectTag(state, 0x30, 'Expected algorithm identifier');
-    const algIdLen = parseLength(state);
-    const algIdStart = state.pos;
-    return { algIdStart, algIdLength: algIdLen };
-}
-function parseSPKIHeader(state) {
-    expectTag(state, 0x30, 'Invalid SPKI structure');
     parseLength(state);
-    expectTag(state, 0x30, 'Expected algorithm identifier');
-    const algIdLen = parseLength(state);
-    const algIdStart = state.pos;
-    return { algIdStart, algIdLength: algIdLen };
 }
 const parseECAlgorithmIdentifier = (state) => {
     const algOid = parseAlgorithmOID(state);
@@ -103,112 +103,46 @@ const parseECAlgorithmIdentifier = (state) => {
     expectTag(state, 0x06, 'Expected curve OID');
     const curveOidLen = parseLength(state);
     const curveOid = getSubarray(state, curveOidLen);
-    for (const { name, oid } of [
-        { name: 'P-256', oid: [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07] },
-        { name: 'P-384', oid: [0x2b, 0x81, 0x04, 0x00, 0x22] },
-        { name: 'P-521', oid: [0x2b, 0x81, 0x04, 0x00, 0x23] },
-    ]) {
-        if (bytesEqual(curveOid, oid)) {
-            return name;
-        }
-    }
+    if (bytesEqual(curveOid, [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07]))
+        return 'P-256';
+    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x22]))
+        return 'P-384';
+    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x23]))
+        return 'P-521';
     throw new Error('Unsupported named curve');
 };
 const genericImport = async (keyFormat, keyData, alg, options) => {
-    let algorithm;
-    let keyUsages;
+    const entry = keyAlgorithm(alg);
+    if (entry.secret) {
+        throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+    }
     const isPublic = keyFormat === 'spki';
-    const getSigUsages = () => (isPublic ? ['verify'] : ['sign']);
-    const getEncUsages = () => isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];
-    switch (alg) {
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            algorithm = { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };
-            keyUsages = getSigUsages();
-            break;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };
-            keyUsages = getSigUsages();
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            algorithm = {
-                name: 'RSA-OAEP',
-                hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-            };
-            keyUsages = getEncUsages();
-            break;
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            const curveMap = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };
-            algorithm = { name: 'ECDSA', namedCurve: curveMap[alg] };
-            keyUsages = getSigUsages();
-            break;
+    let algorithm;
+    if (entry.resolve) {
+        try {
+            const state = createASN1State(keyData);
+            parseKeyHeader(state, keyFormat);
+            algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
         }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            try {
-                const namedCurve = options.getNamedCurve(keyData);
-                algorithm = namedCurve === 'X25519' ? { name: 'X25519' } : { name: 'ECDH', namedCurve };
-            }
-            catch (cause) {
-                throw new JOSENotSupported('Invalid or unsupported key format');
-            }
-            keyUsages = isPublic ? [] : ['deriveBits'];
-            break;
+        catch {
+            throw new JOSENotSupported('Invalid or unsupported key format');
         }
-        case 'Ed25519':
-        case 'EdDSA':
-            algorithm = { name: 'Ed25519' };
-            keyUsages = getSigUsages();
-            break;
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87':
-            algorithm = { name: alg };
-            keyUsages = getSigUsages();
-            break;
-        default:
-            throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
-    }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
+    }
+    else {
+        algorithm = entry.subtle;
+    }
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
 };
 const processPEMData = (pem, pattern) => {
     return decodeBase64(pem.replace(pattern, ''));
 };
 export const fromPKCS8 = (pem, alg, options) => {
     const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
-    let opts = options;
-    if (alg?.startsWith?.('ECDH-ES')) {
-        opts ||= {};
-        opts.getNamedCurve = (keyData) => {
-            const state = createASN1State(keyData);
-            parsePKCS8Header(state);
-            return parseECAlgorithmIdentifier(state);
-        };
-    }
-    return genericImport('pkcs8', keyData, alg, opts);
+    return genericImport('pkcs8', keyData, alg, options);
 };
 export const fromSPKI = (pem, alg, options) => {
     const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);
-    let opts = options;
-    if (alg?.startsWith?.('ECDH-ES')) {
-        opts ||= {};
-        opts.getNamedCurve = (keyData) => {
-            const state = createASN1State(keyData);
-            parseSPKIHeader(state);
-            return parseECAlgorithmIdentifier(state);
-        };
-    }
-    return genericImport('spki', keyData, alg, opts);
+    return genericImport('spki', keyData, alg, options);
 };
 function spkiFromX509(buf) {
     const state = createASN1State(buf);
@@ -227,17 +161,14 @@ function spkiFromX509(buf) {
     const spkiContentLen = parseLength(state);
     return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
 }
-function extractX509SPKI(x509) {
-    const derBytes = processPEMData(x509, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
-    return spkiFromX509(derBytes);
-}
 export const fromX509 = (pem, alg, options) => {
     let spki;
     try {
-        spki = extractX509SPKI(pem);
+        const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
+        spki = spkiFromX509(certificate);
     }
     catch (cause) {
         throw new TypeError('Failed to parse the X.509 certificate', { cause });
     }
-    return fromSPKI(formatPEM(encodeBase64(spki), 'PUBLIC KEY'), alg, options);
+    return genericImport('spki', spki, alg, options);
 };

package/node_modules/jose/dist/webapi/lib/buffer_utils.js

@@ -1,5 +1,6 @@
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
+export const strictDecoder = new TextDecoder('utf-8', { fatal: true });
 const MAX_INT32 = 2 ** 32;
 export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);

package/node_modules/jose/dist/webapi/lib/content_encryption.js

@@ -1,52 +1,18 @@
 import { concat, uint64be } from './buffer_utils.js';
-import { checkEncCryptoKey } from './crypto_key.js';
+import { checkCryptoKey } from './crypto_key.js';
 import { invalidKeyInput } from './invalid_key_input.js';
-import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
+import { JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import { isCryptoKey } from './is_key_like.js';
-export function cekLength(alg) {
-    switch (alg) {
-        case 'A128GCM':
-            return 128;
-        case 'A192GCM':
-            return 192;
-        case 'A256GCM':
-        case 'A128CBC-HS256':
-            return 256;
-        case 'A192CBC-HS384':
-            return 384;
-        case 'A256CBC-HS512':
-            return 512;
-        default:
-            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
-    }
-}
-export const generateCek = (alg) => crypto.getRandomValues(new Uint8Array(cekLength(alg) >> 3));
+export const generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
 function checkCekLength(cek, expected) {
     const actual = cek.byteLength << 3;
     if (actual !== expected) {
         throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
     }
 }
-function ivBitLength(alg) {
-    switch (alg) {
-        case 'A128GCM':
-        case 'A128GCMKW':
-        case 'A192GCM':
-        case 'A192GCMKW':
-        case 'A256GCM':
-        case 'A256GCMKW':
-            return 96;
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            return 128;
-        default:
-            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
-    }
-}
-export const generateIv = (alg) => crypto.getRandomValues(new Uint8Array(ivBitLength(alg) >> 3));
+export const generateIv = (enc) => crypto.getRandomValues(new Uint8Array(enc.ivBits >> 3));
 export function checkIvLength(enc, iv) {
-    if (iv.length << 3 !== ivBitLength(enc)) {
+    if (iv.length << 3 !== enc.ivBits) {
         throw new JWEInvalid('Invalid Initialization Vector length');
     }
 }
@@ -54,48 +20,36 @@ async function cbcKeySetup(enc, cek, usage) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
     }
-    const keySize = parseInt(enc.slice(1, 4), 10);
+    const keySize = enc.cekBits >> 1;
     const encKey = await crypto.subtle.importKey('raw', cek.subarray(keySize >> 3), 'AES-CBC', false, [usage]);
     const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
         hash: `SHA-${keySize << 1}`,
         name: 'HMAC',
     }, false, ['sign']);
-    return { encKey, macKey, keySize };
+    return [encKey, macKey, keySize];
 }
 async function cbcHmacTag(macKey, macData, keySize) {
     return new Uint8Array((await crypto.subtle.sign('HMAC', macKey, macData)).slice(0, keySize >> 3));
 }
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const { encKey, macKey, keySize } = await cbcKeySetup(enc, cek, 'encrypt');
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, 'encrypt');
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
         iv: iv,
         name: 'AES-CBC',
     }, encKey, plaintext));
-    const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
+    const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
     const tag = await cbcHmacTag(macKey, macData, keySize);
     return { ciphertext, tag, iv };
 }
 async function timingSafeEqual(a, b) {
-    if (!(a instanceof Uint8Array)) {
-        throw new TypeError('First argument must be a buffer');
-    }
-    if (!(b instanceof Uint8Array)) {
-        throw new TypeError('Second argument must be a buffer');
-    }
     const algorithm = { name: 'HMAC', hash: 'SHA-256' };
-    const key = (await crypto.subtle.generateKey(algorithm, false, ['sign']));
-    const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-    const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-    let out = 0;
-    let i = -1;
-    while (++i < 32) {
-        out |= aHmac[i] ^ bHmac[i];
-    }
-    return out === 0;
+    const key = (await crypto.subtle.generateKey(algorithm, false, ['sign', 'verify']));
+    const aHmac = await crypto.subtle.sign(algorithm, key, a);
+    return crypto.subtle.verify(algorithm, key, aHmac, b);
 }
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const { encKey, macKey, keySize } = await cbcKeySetup(enc, cek, 'decrypt');
-    const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, 'decrypt');
+    const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
     const expectedTag = await cbcHmacTag(macKey, macData, keySize);
     let macCheckPassed;
     try {
@@ -118,14 +72,11 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    let encKey;
-    if (cek instanceof Uint8Array) {
-        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['encrypt']);
-    }
-    else {
-        checkEncCryptoKey(cek, enc, 'encrypt');
-        encKey = cek;
-    }
+    const encKey = cek instanceof Uint8Array
+        ? await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [
+            'encrypt',
+        ])
+        : (checkCryptoKey(cek, enc.subtle, 'encrypt'), cek);
     const encrypted = new Uint8Array(await crypto.subtle.encrypt({
         additionalData: aad,
         iv: iv,
@@ -137,14 +88,11 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     return { ciphertext, tag, iv };
 }
 async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    let encKey;
-    if (cek instanceof Uint8Array) {
-        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['decrypt']);
-    }
-    else {
-        checkEncCryptoKey(cek, enc, 'decrypt');
-        encKey = cek;
-    }
+    const encKey = cek instanceof Uint8Array
+        ? await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [
+            'decrypt',
+        ])
+        : (checkCryptoKey(cek, enc.subtle, 'decrypt'), cek);
     try {
         return new Uint8Array(await crypto.subtle.decrypt({
             additionalData: aad,
@@ -157,7 +105,6 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new JWEDecryptionFailed();
     }
 }
-const unsupportedEnc = 'Unsupported JWE Content Encryption Algorithm';
 export async function encrypt(enc, plaintext, cek, iv, aad) {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'KeyObject', 'Uint8Array', 'JSON Web Key'));
@@ -168,24 +115,12 @@ export async function encrypt(enc, plaintext, cek, iv, aad) {
     else {
         iv = generateIv(enc);
     }
-    switch (enc) {
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            if (cek instanceof Uint8Array) {
-                checkCekLength(cek, parseInt(enc.slice(-3), 10));
-            }
-            return cbcEncrypt(enc, plaintext, cek, iv, aad);
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM':
-            if (cek instanceof Uint8Array) {
-                checkCekLength(cek, parseInt(enc.slice(1, 4), 10));
-            }
-            return gcmEncrypt(enc, plaintext, cek, iv, aad);
-        default:
-            throw new JOSENotSupported(unsupportedEnc);
+    if (cek instanceof Uint8Array) {
+        checkCekLength(cek, enc.cekBits);
     }
+    return enc.cbc
+        ? cbcEncrypt(enc, plaintext, cek, iv, aad)
+        : gcmEncrypt(enc, plaintext, cek, iv, aad);
 }
 export async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
@@ -198,20 +133,10 @@ export async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new JWEInvalid('JWE Authentication Tag missing');
     }
     checkIvLength(enc, iv);
-    switch (enc) {
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            if (cek instanceof Uint8Array)
-                checkCekLength(cek, parseInt(enc.slice(-3), 10));
-            return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM':
-            if (cek instanceof Uint8Array)
-                checkCekLength(cek, parseInt(enc.slice(1, 4), 10));
-            return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-        default:
-            throw new JOSENotSupported(unsupportedEnc);
+    if (cek instanceof Uint8Array) {
+        checkCekLength(cek, enc.cekBits);
     }
+    return enc.cbc
+        ? cbcDecrypt(enc, cek, ciphertext, iv, tag, aad)
+        : gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
 }