@yielded/crypto 0.1.0-beta.28 → 0.1.0-beta.30

package/src/internal/aead.ts

@@ -1,16 +1,28 @@
 import { Effect, Redacted, Schema } from "effect";
 
-import { Aead, DecryptInput, EncryptInput } from "../Aead";
+import {
+  Aead,
+  DecryptInput,
+  EncryptInput,
+  type Key,
+  KeyDecryptInput,
+  KeyEncryptInput,
+  KeyInput,
+} from "../Aead";
 import { AuthenticationFailed, type OperationError, UnsupportedAlgorithm } from "../Errors";
 import { copy, decode, importError, nativeError, nativeErrorName, withSecret } from "./common";
+import { makeScopedKey } from "./scoped-key";
 
-interface CipherInput {
-  readonly key: Uint8Array<ArrayBuffer>;
+interface CipherData {
   readonly nonce: Uint8Array<ArrayBuffer>;
   readonly additionalData: Uint8Array<ArrayBuffer>;
   readonly data: Uint8Array<ArrayBuffer>;
 }
 
+interface CipherInput extends CipherData {
+  readonly key: Uint8Array<ArrayBuffer>;
+}
+
 export interface XChaCha {
   readonly encrypt: (input: CipherInput) => Effect.Effect<Uint8Array, OperationError>;
   readonly decrypt: (
@@ -19,9 +31,86 @@ export interface XChaCha {
 }
 
 const keyBytes = Schema.Uint8Array.check(Schema.isBetweenLength(32, 32));
+const aesNonce = Schema.Uint8Array.check(Schema.isBetweenLength(12, 12));
+
+export const makeAead = (subtle: SubtleCrypto, xchacha?: XChaCha): Aead["Service"] => {
+  const encryptAes = (key: CryptoKey, input: CipherData) =>
+    Effect.tryPromise({
+      try: () =>
+        subtle.encrypt(
+          {
+            name: "AES-GCM",
+            iv: input.nonce,
+            additionalData: input.additionalData,
+            tagLength: 128,
+          },
+          key,
+          input.data,
+        ),
+      catch: nativeError,
+    }).pipe(Effect.map((encrypted) => new Uint8Array(encrypted)));
+
+  const decryptAes = (key: CryptoKey, input: CipherData) =>
+    Effect.tryPromise({
+      try: () =>
+        subtle.decrypt(
+          {
+            name: "AES-GCM",
+            iv: input.nonce,
+            additionalData: input.additionalData,
+            tagLength: 128,
+          },
+          key,
+          input.data,
+        ),
+      // WebCrypto specifies OperationError for a rejected GCM tag.
+      catch: (cause) =>
+        nativeErrorName(cause) === "OperationError"
+          ? AuthenticationFailed.make({})
+          : nativeError(cause),
+    }).pipe(Effect.map((decrypted) => new Uint8Array(decrypted)));
+
+  return Aead.of({
+    importKey: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(KeyInput, input, "key");
+
+      yield* decode(keyBytes, Redacted.value(value.key), "key");
+
+      const use = yield* makeScopedKey(
+        withSecret(value.key, (material) =>
+          Effect.tryPromise({
+            try: () => subtle.importKey("raw", material, "AES-GCM", false, ["encrypt", "decrypt"]),
+            catch: importError,
+          }),
+        ),
+      );
 
-export const makeAead = (subtle: SubtleCrypto, xchacha?: XChaCha): Aead["Service"] =>
-  Aead.of({
+      return {
+        encrypt: Effect.fnUntraced(function* (input) {
+          const value = yield* decode(KeyEncryptInput, input, "data");
+          const nonce = yield* decode(aesNonce, value.nonce, "nonce").pipe(Effect.flatMap(copy));
+          const additionalData = yield* copy(value.additionalData ?? new Uint8Array());
+
+          return yield* withSecret(value.plaintext, (data) =>
+            use((key) => encryptAes(key, { nonce, additionalData, data })),
+          );
+        }),
+        decrypt: Effect.fnUntraced(function* (input) {
+          const value = yield* decode(KeyDecryptInput, input, "data");
+          const nonce = yield* decode(aesNonce, value.nonce, "nonce").pipe(Effect.flatMap(copy));
+          const additionalData = yield* copy(value.additionalData ?? new Uint8Array());
+          const data = yield* copy(value.ciphertext);
+
+          const plaintext = yield* use((key) =>
+            data.length < 16
+              ? Effect.fail(AuthenticationFailed.make({}))
+              : decryptAes(key, { nonce, additionalData, data }),
+          );
+
+          return Redacted.make(plaintext);
+        }),
+      } satisfies Key;
+    }),
     encrypt: Effect.fnUntraced(function* (input) {
       const value = yield* decode(EncryptInput, input, "data");
       const nonceLength = value.algorithm === "AES-256-GCM" ? 12 : 24;
@@ -51,17 +140,7 @@ export const makeAead = (subtle: SubtleCrypto, xchacha?: XChaCha): Aead["Service
               catch: importError,
             });
 
-            const encrypted = yield* Effect.tryPromise({
-              try: () =>
-                subtle.encrypt(
-                  { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
-                  imported,
-                  data,
-                ),
-              catch: nativeError,
-            });
-
-            return new Uint8Array(encrypted);
+            return yield* encryptAes(imported, { nonce, additionalData, data });
           }).pipe(Effect.uninterruptible);
         }),
       );
@@ -96,24 +175,11 @@ export const makeAead = (subtle: SubtleCrypto, xchacha?: XChaCha): Aead["Service
             catch: importError,
           });
 
-          const decrypted = yield* Effect.tryPromise({
-            try: () =>
-              subtle.decrypt(
-                { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
-                imported,
-                data,
-              ),
-            // WebCrypto specifies OperationError for a rejected GCM tag.
-            catch: (cause) =>
-              nativeErrorName(cause) === "OperationError"
-                ? AuthenticationFailed.make({})
-                : nativeError(cause),
-          });
-
-          return new Uint8Array(decrypted);
+          return yield* decryptAes(imported, { nonce, additionalData, data });
         }).pipe(Effect.uninterruptible);
       });
 
       return Redacted.make(plaintext);
     }),
   });
+};

package/src/internal/argon2.ts

@@ -1,20 +1,29 @@
-import { Effect } from "effect";
+import { Clock, Effect } from "effect";
 
 import { allocate, destroy, fill, initialize, output } from "./argon2-core";
 import type { Argon2 } from "./kdf";
 
-/** Effect schedules bounded batches; admission remains held through buffer cleanup. */
+/** Effect schedules time slices; admission remains held through buffer cleanup. */
 export const argon2: Argon2 = (input) =>
   Effect.acquireUseRelease(
     Effect.sync(() => allocate(input)),
     (state) =>
       Effect.gen(function* () {
+        const clock = yield* Clock.Clock;
+
         initialize(state, input);
         const blocks = fill(state, input);
 
         for (;;) {
-          for (let batch = 0; batch < 256; batch++) {
-            if (blocks.next().done) return output(state, input);
+          const started = clock.monotonicTimeNanosUnsafe();
+
+          // Workers freeze clocks during CPU work. Cap each slice as well so
+          // interruption and other fibers still get a turn on those runtimes.
+          for (let processed = 0; processed < 2048; processed += 256) {
+            for (let batch = 0; batch < 256; batch++) {
+              if (blocks.next().done) return output(state, input);
+            }
+            if (clock.monotonicTimeNanosUnsafe() - started >= 8_000_000n) break;
           }
           yield* Effect.yieldNow;
         }

package/src/internal/hmac.ts

@@ -1,8 +1,8 @@
-import { Effect, Exit, Fiber, Redacted, Schema, Scope } from "effect";
+import { Effect, Redacted, Schema } from "effect";
 
-import { CryptoUnavailable } from "../Errors";
 import { Hmac, Input, type Key, KeyInput, VerifyInput } from "../Hmac";
 import { copy, decode, importError, nativeError, withSecret } from "./common";
+import { makeScopedKey } from "./scoped-key";
 
 const keyBytes = Schema.Uint8Array.check(Schema.isMinLength(1));
 
@@ -12,37 +12,7 @@ export const makeHmac = (subtle: SubtleCrypto): Hmac["Service"] => {
 
     yield* decode(keyBytes, Redacted.value(value.key), "key");
 
-    // A sequential child joins every native call before dropping the key, even
-    // when the caller's Scope runs its other finalizers in parallel.
-    const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
-    let imported: CryptoKey | undefined;
-
-    yield* Scope.addFinalizer(
-      scope,
-      Effect.sync(() => {
-        imported = undefined;
-      }),
-    );
-
-    const available = Effect.suspend(() =>
-      scope.state._tag === "Closed" ? Effect.fail(CryptoUnavailable.make({})) : Effect.void,
-    );
-
-    const run = <A, E>(operation: Effect.Effect<A, E>) =>
-      Effect.acquireUseRelease(
-        available.pipe(Effect.andThen(Effect.forkIn(operation, scope, { uninterruptible: false }))),
-        (fiber) =>
-          Effect.gen(function* () {
-            const exit = yield* Fiber.await(fiber);
-
-            yield* available;
-
-            return yield* exit;
-          }),
-        Fiber.interrupt,
-      );
-
-    yield* run(
+    const use = yield* makeScopedKey(
       withSecret(value.key, (material) =>
         Effect.tryPromise({
           try: () =>
@@ -51,41 +21,30 @@ export const makeHmac = (subtle: SubtleCrypto): Hmac["Service"] => {
               "verify",
             ]),
           catch: importError,
-        }).pipe(
-          Effect.tap((key) =>
-            Effect.sync(() => {
-              imported = key;
-            }),
-          ),
-          Effect.uninterruptible,
-        ),
+        }),
       ),
-    ).pipe(
-      Effect.onExit((exit) => (Exit.isFailure(exit) ? Scope.close(scope, exit) : Effect.void)),
     );
 
-    const use = <A>(operation: (key: CryptoKey) => Promise<A>) =>
-      run(
-        Effect.suspend(() => {
-          const key = imported;
-
-          return key === undefined
-            ? Effect.fail(CryptoUnavailable.make({}))
-            : Effect.tryPromise({ try: () => operation(key), catch: nativeError });
-        }).pipe(Effect.uninterruptible),
-      );
-
     return {
       sign: Effect.fnUntraced(function* (input) {
         const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
 
-        return new Uint8Array(yield* use((key) => subtle.sign("HMAC", key, data)));
+        return new Uint8Array(
+          yield* use((key) =>
+            Effect.tryPromise({ try: () => subtle.sign("HMAC", key, data), catch: nativeError }),
+          ),
+        );
       }),
       verify: Effect.fnUntraced(function* (input, signature) {
         const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
         const tag = yield* decode(Schema.Uint8Array, signature, "data").pipe(Effect.flatMap(copy));
 
-        return yield* use((key) => subtle.verify("HMAC", key, tag, data));
+        return yield* use((key) =>
+          Effect.tryPromise({
+            try: () => subtle.verify("HMAC", key, tag, data),
+            catch: nativeError,
+          }),
+        );
       }),
     } satisfies Key;
   });

package/src/internal/scoped-key.ts

@@ -0,0 +1,60 @@
+import { Effect, Exit, Fiber, Scope } from "effect";
+
+import { CryptoUnavailable, type OperationError } from "../Errors";
+
+/** Join native calls before releasing a key, including parallel parent closure. */
+export const makeScopedKey = Effect.fnUntraced(function* (
+  acquire: Effect.Effect<CryptoKey, OperationError>,
+) {
+  const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
+  let imported: CryptoKey | undefined;
+
+  yield* Scope.addFinalizer(
+    scope,
+    Effect.sync(() => {
+      imported = undefined;
+    }),
+  );
+
+  const available = Effect.suspend(() =>
+    scope.state._tag === "Closed" ? Effect.fail(CryptoUnavailable.make({})) : Effect.void,
+  );
+
+  const run = <A, E>(operation: Effect.Effect<A, E>) =>
+    Effect.acquireUseRelease(
+      available.pipe(
+        Effect.andThen(
+          Effect.forkIn(operation, scope, { uninterruptible: false, startImmediately: true }),
+        ),
+      ),
+      (fiber) =>
+        Effect.gen(function* () {
+          const exit = yield* Fiber.await(fiber);
+
+          yield* available;
+
+          return yield* exit;
+        }),
+      Fiber.interrupt,
+    );
+
+  yield* run(
+    acquire.pipe(
+      Effect.tap((key) =>
+        Effect.sync(() => {
+          imported = key;
+        }),
+      ),
+      Effect.uninterruptible,
+    ),
+  ).pipe(Effect.onExit((exit) => (Exit.isFailure(exit) ? Scope.close(scope, exit) : Effect.void)));
+
+  return <A, E>(operation: (key: CryptoKey) => Effect.Effect<A, E>) =>
+    run(
+      Effect.suspend((): Effect.Effect<A, E | CryptoUnavailable> => {
+        const key = imported;
+
+        return key === undefined ? Effect.fail(CryptoUnavailable.make({})) : operation(key);
+      }).pipe(Effect.uninterruptible),
+    );
+});

package/src/internal/signature.ts

@@ -1,16 +1,22 @@
 import { Effect, Redacted, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 
-import { InvalidInput } from "../Errors";
+import { CryptoUnavailable, InvalidInput } from "../Errors";
 import {
   type Algorithm,
+  type PrivateKey,
+  PrivateKeyInput,
+  GenerateKeyPairInput,
   PrivateKeyParameters,
+  type PublicKey,
+  PublicKeyInput,
   PublicKeyParameters,
   SignInput,
   Signature,
   VerifyInput,
 } from "../Signature";
 import { copy, decode, importError, nativeError, withSecret } from "./common";
+import { makeScopedKey } from "./scoped-key";
 
 const derBytes = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(16384));
 
@@ -18,6 +24,21 @@ const RsaAlgorithm = Schema.Struct({
   modulusLength: Schema.Int.check(Schema.isGreaterThanOrEqualTo(2048)),
 });
 
+const component = Schema.Uint8ArrayFromBase64Url;
+const GeneratedEc = Schema.Struct({ x: component, y: component, d: component });
+const GeneratedEd = Schema.Struct({ x: component, d: component });
+
+const GeneratedRsa = Schema.Struct({
+  n: component,
+  e: component,
+  d: component,
+  p: component,
+  q: component,
+  dp: component,
+  dq: component,
+  qi: component,
+});
+
 const importAlgorithm = (algorithm: Algorithm) => {
   switch (algorithm) {
     case "ECDSA-P256-SHA256":
@@ -121,6 +142,124 @@ export const makeSignature = (subtle: SubtleCrypto): Signature["Service"] => {
   });
 
   return Signature.of({
+    importPrivateKey: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(PrivateKeyInput, input, "key");
+      const algorithm = value.algorithm;
+
+      const use = yield* makeScopedKey(
+        withSecret(value.privateKey, (material) => importKey(algorithm, "pkcs8", material)),
+      );
+
+      return {
+        sign: Effect.fnUntraced(function* (input) {
+          const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
+
+          const result = yield* use((key) =>
+            Effect.tryPromise({
+              try: () => subtle.sign(operationAlgorithm(algorithm), key, data),
+              catch: nativeError,
+            }),
+          );
+
+          return new Uint8Array(result);
+        }),
+      } satisfies PrivateKey;
+    }),
+    importPublicKey: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(PublicKeyInput, input, "key");
+      const algorithm = value.algorithm;
+      const material = yield* copy(value.publicKey);
+      const use = yield* makeScopedKey(importKey(algorithm, "spki", material));
+
+      return {
+        verify: Effect.fnUntraced(function* (input, signature) {
+          const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
+
+          const tag = yield* decode(Schema.Uint8Array, signature, "data").pipe(
+            Effect.flatMap(copy),
+          );
+
+          return yield* use((key) => {
+            if ((algorithm === "ECDSA-P256-SHA256" || algorithm === "Ed25519") && tag.length !== 64)
+              return Effect.succeed(false);
+
+            return Effect.tryPromise({
+              try: () => subtle.verify(operationAlgorithm(algorithm), key, tag, data),
+              catch: nativeError,
+            });
+          });
+        }),
+      } satisfies PublicKey;
+    }),
+    generateKeyPair: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(GenerateKeyPairInput, input, "parameters");
+
+      const pair = yield* Effect.tryPromise({
+        try: () => {
+          switch (value.algorithm) {
+            case "ECDSA-P256-SHA256":
+              return subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
+                "sign",
+                "verify",
+              ]);
+            case "Ed25519":
+              return subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+            case "RSASSA-PKCS1-v1_5-SHA256":
+            case "RSA-PSS-SHA256":
+              return subtle.generateKey(
+                {
+                  name: value.algorithm === "RSA-PSS-SHA256" ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+                  hash: "SHA-256",
+                  modulusLength: value.modulusLength ?? 2048,
+                  publicExponent: new Uint8Array([1, 0, 1]),
+                },
+                true,
+                ["sign", "verify"],
+              );
+          }
+        },
+        catch: nativeError,
+      });
+
+      const jwk = yield* Effect.tryPromise({
+        try: () => subtle.exportKey("jwk", pair.privateKey),
+        catch: nativeError,
+      });
+
+      // JsonWebKey does not guarantee algorithm-specific fields. Decode only at
+      // this native boundary; callers receive typed components, never loose JWKs.
+      const parameters: PrivateKeyParameters = yield* Effect.gen(function* () {
+        switch (value.algorithm) {
+          case "ECDSA-P256-SHA256":
+            return {
+              algorithm: value.algorithm,
+              ...(yield* Schema.decodeUnknownEffect(GeneratedEc)(jwk, { reportInput: false })),
+            };
+          case "Ed25519":
+            return {
+              algorithm: value.algorithm,
+              ...(yield* Schema.decodeUnknownEffect(GeneratedEd)(jwk, { reportInput: false })),
+            };
+          case "RSASSA-PKCS1-v1_5-SHA256":
+          case "RSA-PSS-SHA256":
+            return {
+              algorithm: value.algorithm,
+              ...(yield* Schema.decodeUnknownEffect(GeneratedRsa)(jwk, { reportInput: false })),
+            };
+        }
+      }).pipe(Effect.mapError(() => CryptoUnavailable.make({})));
+
+      yield* decode(PrivateKeyParameters, parameters, "key");
+
+      const publicKey: PublicKeyParameters =
+        "n" in parameters
+          ? { algorithm: parameters.algorithm, n: parameters.n.slice(), e: parameters.e.slice() }
+          : "y" in parameters
+            ? { algorithm: parameters.algorithm, x: parameters.x.slice(), y: parameters.y.slice() }
+            : { algorithm: "Ed25519", x: parameters.x.slice() };
+
+      return { publicKey, privateKey: Redacted.make(parameters) };
+    }, Effect.uninterruptible),
     encodePublicKey: Effect.fnUntraced(function* (input) {
       const parameters = yield* decode(PublicKeyParameters, input, "key");
       const key = yield* importComponents(parameters, "verify");

package/src/internal/xchacha-core.ts

@@ -258,6 +258,7 @@ interface State {
   readonly nonce: Uint32Array;
   readonly words: Uint32Array;
   readonly stream: Uint8Array;
+  readonly streamView: DataView;
 }
 
 const readWords = (data: Uint8Array, words: Uint32Array): void => {
@@ -270,11 +271,14 @@ function withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: Sta
   const original = new Uint32Array(8);
   const extendedNonce = new Uint32Array(4);
 
+  const stream = new Uint8Array(64);
+
   const state: State = {
     key: new Uint32Array(8),
     nonce: new Uint32Array(3),
     words: new Uint32Array(16),
-    stream: new Uint8Array(64),
+    stream,
+    streamView: new DataView(stream.buffer),
   };
 
   try {
@@ -300,7 +304,7 @@ function withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: Sta
 
 const blockAt = (state: State, counter: number): void => {
   chachaCore(sigma, state.key, state.nonce, state.words, counter);
-  const view = new DataView(state.stream.buffer, state.stream.byteOffset, state.stream.byteLength);
+  const view = state.streamView;
 
   for (let i = 0; i < 16; i++) view.setUint32(i * 4, state.words[i], true);
 };