jose 4.0.0 → 4.0.4

package/dist/node/esm/lib/cek.js

@@ -1,19 +1,21 @@
 import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
-const bitLengths = new Map([
-    ['A128CBC-HS256', 256],
-    ['A128GCM', 128],
-    ['A192CBC-HS384', 384],
-    ['A192GCM', 192],
-    ['A256CBC-HS512', 512],
-    ['A256GCM', 256],
-]);
-const generateCek = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+export function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
+        case 'A128GCM':
+            return 128;
+        case 'A192GCM':
+            return 192;
+        case 'A256GCM':
+            return 256;
+        default:
+            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
-};
-export default generateCek;
-export { bitLengths };
+}
+export default (alg) => random(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/esm/lib/check_iv_length.js

@@ -1,7 +1,7 @@
 import { JWEInvalid } from '../util/errors.js';
-import { bitLengths } from './iv.js';
+import { bitLength } from './iv.js';
 const checkIvLength = (enc, iv) => {
-    if (iv.length << 3 !== bitLengths.get(enc)) {
+    if (iv.length << 3 !== bitLength(enc)) {
         throw new JWEInvalid('Invalid Initialization Vector length');
     }
 };

package/dist/node/esm/lib/crypto_key.js

@@ -0,0 +1,160 @@
+import { isCloudflareWorkers, isNodeJs } from '../runtime/global.js';
+function getHashLength(hash) {
+    return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
+}
+function getNamedCurve(alg) {
+    switch (alg) {
+        case 'ES256':
+            return 'P-256';
+        case 'ES384':
+            return 'P-384';
+        case 'ES512':
+            return 'P-521';
+    }
+}
+function checkUsage(key, usages) {
+    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
+        let msg = 'CryptoKey does not support this operation, its usages must include ';
+        if (usages.length > 2) {
+            const last = usages.pop();
+            msg += `one of ${usages.join(', ')}, or ${last}.`;
+        }
+        else if (usages.length === 2) {
+            msg += `one of ${usages[0]} or ${usages[1]}.`;
+        }
+        else {
+            msg += `${usages[0]}.`;
+        }
+        throw new TypeError(msg);
+    }
+}
+export function checkSigCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512': {
+            if (key.algorithm.name !== 'HMAC') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case 'RS256':
+        case 'RS384':
+        case 'RS512': {
+            if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case 'PS256':
+        case 'PS384':
+        case 'PS512': {
+            if (key.algorithm.name !== 'RSA-PSS') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case isNodeJs() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
+            }
+            break;
+        }
+        case isCloudflareWorkers() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519.`);
+            }
+            break;
+        }
+        case 'ES256':
+        case 'ES384':
+        case 'ES512': {
+            if (key.algorithm.name !== 'ECDSA') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
+            }
+            const expected = getNamedCurve(alg);
+            const actual = key.algorithm.namedCurve;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
+            }
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+export function checkEncCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM': {
+            if (key.algorithm.name !== 'AES-GCM') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
+            }
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
+            }
+            break;
+        }
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW': {
+            if (key.algorithm.name !== 'AES-KW') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
+            }
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
+            }
+            break;
+        }
+        case 'ECDH-ES':
+            if (key.algorithm.name !== 'ECDH') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
+            }
+            break;
+        case 'PBES2-HS256+A128KW':
+        case 'PBES2-HS384+A192KW':
+        case 'PBES2-HS512+A256KW':
+            if (key.algorithm.name !== 'PBKDF2') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
+            }
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512': {
+            if (key.algorithm.name !== 'RSA-OAEP') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
+            }
+            const expected = parseInt(alg.substr(9), 10) || 1;
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}

package/dist/node/esm/lib/decrypt_key_management.js

@@ -5,7 +5,7 @@ import { decrypt as rsaEs } from '../runtime/rsaes.js';
 import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { bitLengths as cekLengths } from '../lib/cek.js';
+import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
@@ -40,7 +40,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = base64url(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(joseHeader.enc), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/esm/lib/encrypt_key_management.js

@@ -4,7 +4,7 @@ import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
-import generateCek, { bitLengths as cekLengths } from '../lib/cek.js';
+import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
@@ -29,7 +29,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLengths.get(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = base64url(apu);

package/dist/node/esm/lib/iv.js

@@ -1,22 +1,27 @@
 import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
-const bitLengths = new Map([
-    ['A128CBC-HS256', 128],
-    ['A128GCM', 96],
-    ['A128GCMKW', 96],
-    ['A192CBC-HS384', 128],
-    ['A192GCM', 96],
-    ['A192GCMKW', 96],
-    ['A256CBC-HS512', 128],
-    ['A256GCM', 96],
-    ['A256GCMKW', 96],
-]);
-const generateIv = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+export function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 128;
+        case 'A128GCM':
+            return 96;
+        case 'A128GCMKW':
+            return 96;
+        case 'A192CBC-HS384':
+            return 128;
+        case 'A192GCM':
+            return 96;
+        case 'A192GCMKW':
+            return 96;
+        case 'A256CBC-HS512':
+            return 128;
+        case 'A256GCM':
+            return 96;
+        case 'A256GCMKW':
+            return 96;
+        default:
+            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
-};
-export default generateIv;
-export { bitLengths };
+}
+export default (alg) => random(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/esm/runtime/aeskw.js

@@ -1,9 +1,10 @@
 import { Buffer } from 'buffer';
-import { createDecipheriv, createCipheriv } from 'crypto';
+import { KeyObject, createDecipheriv, createCipheriv } from 'crypto';
 import { JOSENotSupported } from '../util/errors.js';
 import { concat } from '../lib/buffer_utils.js';
 import getSecretKey from './secret_key.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 import supported from './ciphers.js';
@@ -20,7 +21,8 @@ function ensureKeyObject(key, alg, usage) {
         return getSecretKey(key);
     }
     if (isCryptoKey(key)) {
-        return getKeyObject(key, alg, new Set([usage]));
+        checkEncCryptoKey(key, alg, usage);
+        return KeyObject.from(key);
     }
     throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/esm/runtime/asn1.js

@@ -1,6 +1,6 @@
-import { createPrivateKey, createPublicKey } from 'crypto';
+import { createPrivateKey, createPublicKey, KeyObject } from 'crypto';
 import { Buffer } from 'buffer';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const genericExport = (keyType, keyFormat, key) => {
@@ -9,7 +9,7 @@ const genericExport = (keyType, keyFormat, key) => {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = getKeyObject(key);
+        keyObject = KeyObject.from(key);
     }
     else if (isKeyObject(key)) {
         keyObject = key;

package/dist/node/esm/runtime/decrypt.js

@@ -1,11 +1,12 @@
-import { createDecipheriv } from 'crypto';
+import { createDecipheriv, KeyObject } from 'crypto';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import { concat } from '../lib/buffer_utils.js';
 import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
 import timingSafeEqual from './timing_safe_equal.js';
 import cbcTag from './cbc_tag.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 import supported from './ciphers.js';
@@ -64,7 +65,8 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if (isCryptoKey(cek)) {
-        key = getKeyObject(cek, enc, new Set(['decrypt']));
+        checkEncCryptoKey(cek, enc, 'decrypt');
+        key = KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || isKeyObject(cek)) {
         key = cek;

package/dist/node/esm/runtime/ecdhes.js

@@ -1,17 +1,19 @@
-import { diffieHellman, generateKeyPair as generateKeyPairCb } from 'crypto';
+import { diffieHellman, generateKeyPair as generateKeyPairCb, KeyObject } from 'crypto';
 import { promisify } from 'util';
 import getNamedCurve from './get_named_curve.js';
 import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
 import digest from './digest.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const generateKeyPair = promisify(generateKeyPairCb);
 export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     let publicKey;
     if (isCryptoKey(publicKee)) {
-        publicKey = getKeyObject(publicKee, 'ECDH-ES');
+        checkEncCryptoKey(publicKee, 'ECDH-ES');
+        publicKey = KeyObject.from(publicKee);
     }
     else if (isKeyObject(publicKee)) {
         publicKey = publicKee;
@@ -21,7 +23,8 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
     }
     let privateKey;
     if (isCryptoKey(privateKee)) {
-        privateKey = getKeyObject(privateKee, 'ECDH-ES', new Set(['deriveBits', 'deriveKey']));
+        checkEncCryptoKey(privateKee, 'ECDH-ES', 'deriveBits', 'deriveKey');
+        privateKey = KeyObject.from(privateKee);
     }
     else if (isKeyObject(privateKee)) {
         privateKey = privateKee;
@@ -36,7 +39,7 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
 export const generateEpk = async (kee) => {
     let key;
     if (isCryptoKey(kee)) {
-        key = getKeyObject(kee);
+        key = KeyObject.from(kee);
     }
     else if (isKeyObject(kee)) {
         key = kee;

package/dist/node/esm/runtime/encrypt.js

@@ -1,9 +1,10 @@
-import { createCipheriv } from 'crypto';
+import { createCipheriv, KeyObject } from 'crypto';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import { concat } from '../lib/buffer_utils.js';
 import cbcTag from './cbc_tag.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 import { JOSENotSupported } from '../util/errors.js';
@@ -42,7 +43,8 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 const encrypt = async (enc, plaintext, cek, iv, aad) => {
     let key;
     if (isCryptoKey(cek)) {
-        key = getKeyObject(cek, enc, new Set(['encrypt']));
+        checkEncCryptoKey(cek, enc, 'encrypt');
+        key = KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || isKeyObject(cek)) {
         key = cek;

package/dist/node/esm/runtime/fetch_jwks.js

@@ -1,18 +1,22 @@
-import { get as http } from 'http';
-import { get as https } from 'https';
+import * as http from 'http';
+import * as https from 'https';
 import { once } from 'events';
 import { JOSEError, JWKSTimeout } from '../util/errors.js';
 import { concat, decoder } from '../lib/buffer_utils.js';
-const protocols = {
-    'https:': https,
-    'http:': http,
-};
 const fetchJwks = async (url, timeout, options) => {
-    if (protocols[url.protocol] === undefined) {
-        throw new TypeError('Unsupported URL protocol.');
+    let get;
+    switch (url.protocol) {
+        case 'https:':
+            get = https.get;
+            break;
+        case 'http:':
+            get = http.get;
+            break;
+        default:
+            throw new TypeError('Unsupported URL protocol.');
     }
     const { agent } = options;
-    const req = protocols[url.protocol](url.href, {
+    const req = get(url.href, {
         agent,
         timeout,
     });

package/dist/node/esm/runtime/get_named_curve.js

@@ -1,7 +1,7 @@
 import { Buffer } from 'buffer';
-import { createPublicKey } from 'crypto';
+import { createPublicKey, KeyObject } from 'crypto';
 import { JOSENotSupported } from '../util/errors.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const p256 = Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
@@ -27,7 +27,7 @@ const getNamedCurve = (kee, raw) => {
     var _a;
     let key;
     if (isCryptoKey(kee)) {
-        key = getKeyObject(kee);
+        key = KeyObject.from(kee);
     }
     else if (isKeyObject(kee)) {
         key = kee;

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -1,5 +1,6 @@
-import * as crypto from 'crypto';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { KeyObject } from 'crypto';
+import { isCryptoKey } from './webcrypto.js';
+import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import getSecretKey from './secret_key.js';
 import invalidKeyInput from './invalid_key_input.js';
 export default function getSignVerifyKey(alg, key, usage) {
@@ -9,11 +10,12 @@ export default function getSignVerifyKey(alg, key, usage) {
         }
         return getSecretKey(key);
     }
-    if (key instanceof crypto.KeyObject) {
+    if (key instanceof KeyObject) {
         return key;
     }
     if (isCryptoKey(key)) {
-        return getKeyObject(key, alg, new Set([usage]));
+        checkSigCryptoKey(key, alg, usage);
+        return KeyObject.from(key);
     }
     throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/esm/runtime/global.js

@@ -0,0 +1,6 @@
+export function isCloudflareWorkers() {
+    return false;
+}
+export function isNodeJs() {
+    return true;
+}

package/dist/node/esm/runtime/key_to_jwk.js

@@ -1,9 +1,9 @@
-import { createPublicKey } from 'crypto';
+import { KeyObject, createPublicKey } from 'crypto';
 import { encode as base64url } from './base64url.js';
 import Asn1SequenceDecoder from './asn1_sequence_decoder.js';
 import { JOSENotSupported } from '../util/errors.js';
 import getNamedCurve from './get_named_curve.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const [major, minor] = process.version
@@ -17,7 +17,7 @@ const keyToJWK = (key) => {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = getKeyObject(key);
+        keyObject = KeyObject.from(key);
     }
     else if (isKeyObject(key)) {
         keyObject = key;

package/dist/node/esm/runtime/pbes2kw.js

@@ -1,11 +1,12 @@
 import { promisify } from 'util';
-import { pbkdf2 as pbkdf2cb } from 'crypto';
+import { KeyObject, pbkdf2 as pbkdf2cb } from 'crypto';
 import random from './random.js';
 import { p2s as concatSalt } from '../lib/buffer_utils.js';
 import { encode as base64url } from './base64url.js';
 import { wrap, unwrap } from './aeskw.js';
 import checkP2s from '../lib/check_p2s.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const pbkdf2 = promisify(pbkdf2cb);
@@ -17,7 +18,8 @@ function getPassword(key, alg) {
         return key;
     }
     if (isCryptoKey(key)) {
-        return getKeyObject(key, alg, new Set(['deriveBits', 'deriveKey'])).export();
+        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
+        return KeyObject.from(key).export();
     }
     throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/esm/runtime/rsaes.js

@@ -1,6 +1,7 @@
-import { publicEncrypt, constants, privateDecrypt } from 'crypto';
+import { KeyObject, publicEncrypt, constants, privateDecrypt } from 'crypto';
 import checkModulusLength from './check_modulus_length.js';
-import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const checkKey = (key, alg) => {
@@ -41,7 +42,8 @@ function ensureKeyObject(key, alg, ...usages) {
         return key;
     }
     if (isCryptoKey(key)) {
-        return getKeyObject(key, alg, new Set(usages));
+        checkEncCryptoKey(key, alg, ...usages);
+        return KeyObject.from(key);
     }
     throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
 }