jose 4.0.2 → 4.1.1

package/dist/browser/runtime/jwk_to_key.js

@@ -11,7 +11,7 @@ function subtleMapping(jwk) {
                 case 'HS256':
                 case 'HS384':
                 case 'HS512':
-                    algorithm = { name: 'HMAC', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'HMAC', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = ['sign', 'verify'];
                     break;
                 case 'A128CBC-HS256':
@@ -49,13 +49,13 @@ function subtleMapping(jwk) {
                 case 'PS256':
                 case 'PS384':
                 case 'PS512':
-                    algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 case 'RS256':
                 case 'RS384':
                 case 'RS512':
-                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 case 'RSA-OAEP':
@@ -64,7 +64,7 @@ function subtleMapping(jwk) {
                 case 'RSA-OAEP-512':
                     algorithm = {
                         name: 'RSA-OAEP',
-                        hash: { name: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}` },
+                        hash: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}`,
                     };
                     keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
                     break;

package/dist/browser/runtime/key_to_jwk.js

@@ -1,5 +1,5 @@
 import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encode as base64url } from './base64url.js';
 const keyToJWK = async (key) => {
     if (key instanceof Uint8Array) {

package/dist/browser/runtime/pbes2kw.js

@@ -4,22 +4,24 @@ import { encode as base64url } from './base64url.js';
 import { wrap, unwrap } from './aeskw.js';
 import checkP2s from '../lib/check_p2s.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from './invalid_key_input.js';
-function getCryptoKey(key) {
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+function getCryptoKey(key, alg) {
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
     }
     if (isCryptoKey(key)) {
+        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
         return key;
     }
     throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
 }
-export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+async function deriveKey(p2s, alg, p2c, key) {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
     const keylen = parseInt(alg.substr(13, 3), 10);
     const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
+        hash: `SHA-${alg.substr(8, 3)}`,
         iterations: p2c,
         name: 'PBKDF2',
         salt,
@@ -28,44 +30,21 @@ export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 20
         length: keylen,
         name: 'AES-KW',
     };
-    const cryptoKey = await getCryptoKey(key);
-    let derived;
+    const cryptoKey = await getCryptoKey(key, alg);
     if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey']);
+        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
     }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+    if (cryptoKey.usages.includes('deriveKey')) {
+        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
     }
+    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+}
+export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
     const encryptedKey = await wrap(alg.substr(-6), derived, cek);
     return { encryptedKey, p2c, p2s: base64url(p2s) };
 };
 export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10);
-    const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const wrapAlg = {
-        length: keylen,
-        name: 'AES-KW',
-    };
-    const cryptoKey = await getCryptoKey(key);
-    let derived;
-    if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['unwrapKey']);
-    }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
-    }
+    const derived = await deriveKey(p2s, alg, p2c, key);
     return unwrap(alg.substr(-6), derived, encryptedKey);
 };

package/dist/browser/runtime/rsaes.js

@@ -1,12 +1,14 @@
 import subtleAlgorithm from './subtle_rsaes.js';
 import bogusWebCrypto from './bogus.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import checkKeyLength from './check_key_length.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 export const encrypt = async (alg, key, cek) => {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
     }
+    checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
     checkKeyLength(alg, key);
     if (key.usages.includes('encrypt')) {
         return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
@@ -21,6 +23,7 @@ export const decrypt = async (alg, key, encryptedKey) => {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
     }
+    checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
     checkKeyLength(alg, key);
     if (key.usages.includes('decrypt')) {
         return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));

package/dist/browser/runtime/subtle_dsa.js

@@ -1,45 +1,26 @@
 import { isCloudflareWorkers, isNodeJs } from './global.js';
 import { JOSENotSupported } from '../util/errors.js';
-export default function subtleDsa(alg, crv) {
+export default function subtleDsa(alg, namedCurve) {
+    const length = parseInt(alg.substr(-3), 10);
     switch (alg) {
         case 'HS256':
-            return { hash: { name: 'SHA-256' }, name: 'HMAC' };
         case 'HS384':
-            return { hash: { name: 'SHA-384' }, name: 'HMAC' };
         case 'HS512':
-            return { hash: { name: 'SHA-512' }, name: 'HMAC' };
+            return { hash: `SHA-${length}`, name: 'HMAC' };
         case 'PS256':
-            return {
-                hash: { name: 'SHA-256' },
-                name: 'RSA-PSS',
-                saltLength: 256 >> 3,
-            };
         case 'PS384':
-            return {
-                hash: { name: 'SHA-384' },
-                name: 'RSA-PSS',
-                saltLength: 384 >> 3,
-            };
         case 'PS512':
-            return {
-                hash: { name: 'SHA-512' },
-                name: 'RSA-PSS',
-                saltLength: 512 >> 3,
-            };
+            return { hash: `SHA-${length}`, name: 'RSA-PSS', saltLength: length >> 3 };
         case 'RS256':
-            return { hash: { name: 'SHA-256' }, name: 'RSASSA-PKCS1-v1_5' };
         case 'RS384':
-            return { hash: { name: 'SHA-384' }, name: 'RSASSA-PKCS1-v1_5' };
         case 'RS512':
-            return { hash: { name: 'SHA-512' }, name: 'RSASSA-PKCS1-v1_5' };
+            return { hash: `SHA-${length}`, name: 'RSASSA-PKCS1-v1_5' };
         case 'ES256':
-            return { hash: { name: 'SHA-256' }, name: 'ECDSA', namedCurve: 'P-256' };
         case 'ES384':
-            return { hash: { name: 'SHA-384' }, name: 'ECDSA', namedCurve: 'P-384' };
         case 'ES512':
-            return { hash: { name: 'SHA-512' }, name: 'ECDSA', namedCurve: 'P-521' };
+            return { hash: `SHA-${length}`, name: 'ECDSA', namedCurve };
         case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
-            return { name: crv, namedCurve: crv };
+            return { name: namedCurve, namedCurve };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }

package/dist/node/cjs/{runtime → lib}/aesgcmkw.js

@@ -1,19 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.unwrap = exports.wrap = void 0;
-const encrypt_js_1 = require("./encrypt.js");
-const decrypt_js_1 = require("./decrypt.js");
-const iv_js_1 = require("../lib/iv.js");
-const base64url_js_1 = require("./base64url.js");
-const wrap = async (alg, key, cek, iv) => {
+const encrypt_js_1 = require("../runtime/encrypt.js");
+const decrypt_js_1 = require("../runtime/decrypt.js");
+const iv_js_1 = require("./iv.js");
+const base64url_js_1 = require("../runtime/base64url.js");
+async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = (0, iv_js_1.default)(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await (0, encrypt_js_1.default)(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: (0, base64url_js_1.encode)(iv), tag: (0, base64url_js_1.encode)(tag) };
-};
+}
 exports.wrap = wrap;
-const unwrap = async (alg, key, encryptedKey, iv, tag) => {
+async function unwrap(alg, key, encryptedKey, iv, tag) {
     const jweAlgorithm = alg.substr(0, 7);
     return (0, decrypt_js_1.default)(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
-};
+}
 exports.unwrap = unwrap;

package/dist/node/cjs/lib/cek.js

@@ -1,22 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bitLengths = void 0;
+exports.bitLength = void 0;
 const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
-const bitLengths = new Map([
-    ['A128CBC-HS256', 256],
-    ['A128GCM', 128],
-    ['A192CBC-HS384', 384],
-    ['A192GCM', 192],
-    ['A256CBC-HS512', 512],
-    ['A256GCM', 256],
-]);
-exports.bitLengths = bitLengths;
-const generateCek = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
+        case 'A128GCM':
+            return 128;
+        case 'A192GCM':
+            return 192;
+        case 'A256GCM':
+            return 256;
+        default:
+            throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
-};
-exports.default = generateCek;
+}
+exports.bitLength = bitLength;
+exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/cjs/lib/check_iv_length.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const errors_js_1 = require("../util/errors.js");
 const iv_js_1 = require("./iv.js");
 const checkIvLength = (enc, iv) => {
-    if (iv.length << 3 !== iv_js_1.bitLengths.get(enc)) {
+    if (iv.length << 3 !== (0, iv_js_1.bitLength)(enc)) {
         throw new errors_js_1.JWEInvalid('Invalid Initialization Vector length');
     }
 };

package/dist/node/cjs/lib/check_key_type.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const invalid_key_input_js_1 = require("../runtime/invalid_key_input.js");
+const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const is_key_like_js_1 = require("../runtime/is_key_like.js");
 const symmetricTypeCheck = (key) => {
     if (key instanceof Uint8Array)

package/dist/node/cjs/lib/crypto_key.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEncCryptoKey = exports.checkSigCryptoKey = void 0;
+const global_js_1 = require("../runtime/global.js");
+function unusable(name, prop = 'algorithm.name') {
+    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm(algorithm, name) {
+    return algorithm.name === name;
+}
+function getHashLength(hash) {
+    return parseInt(hash.name.substr(4), 10);
+}
+function getNamedCurve(alg) {
+    switch (alg) {
+        case 'ES256':
+            return 'P-256';
+        case 'ES384':
+            return 'P-384';
+        case 'ES512':
+            return 'P-521';
+        default:
+            throw new Error('unreachable');
+    }
+}
+function checkUsage(key, usages) {
+    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
+        let msg = 'CryptoKey does not support this operation, its usages must include ';
+        if (usages.length > 2) {
+            const last = usages.pop();
+            msg += `one of ${usages.join(', ')}, or ${last}.`;
+        }
+        else if (usages.length === 2) {
+            msg += `one of ${usages[0]} or ${usages[1]}.`;
+        }
+        else {
+            msg += `${usages[0]}.`;
+        }
+        throw new TypeError(msg);
+    }
+}
+function checkSigCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512': {
+            if (!isAlgorithm(key.algorithm, 'HMAC'))
+                throw unusable('HMAC');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case 'RS256':
+        case 'RS384':
+        case 'RS512': {
+            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
+                throw unusable('RSASSA-PKCS1-v1_5');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case 'PS256':
+        case 'PS384':
+        case 'PS512': {
+            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
+                throw unusable('RSA-PSS');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case (0, global_js_1.isNodeJs)() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
+                throw unusable('NODE-ED25519 or NODE-ED448');
+            break;
+        }
+        case (0, global_js_1.isCloudflareWorkers)() && 'EdDSA': {
+            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                throw unusable('NODE-ED25519');
+            break;
+        }
+        case 'ES256':
+        case 'ES384':
+        case 'ES512': {
+            if (!isAlgorithm(key.algorithm, 'ECDSA'))
+                throw unusable('ECDSA');
+            const expected = getNamedCurve(alg);
+            const actual = key.algorithm.namedCurve;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.namedCurve');
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkSigCryptoKey = checkSigCryptoKey;
+function checkEncCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM': {
+            if (!isAlgorithm(key.algorithm, 'AES-GCM'))
+                throw unusable('AES-GCM');
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
+            break;
+        }
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW': {
+            if (!isAlgorithm(key.algorithm, 'AES-KW'))
+                throw unusable('AES-KW');
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
+            break;
+        }
+        case 'ECDH-ES':
+            if (!isAlgorithm(key.algorithm, 'ECDH'))
+                throw unusable('ECDH');
+            break;
+        case 'PBES2-HS256+A128KW':
+        case 'PBES2-HS384+A192KW':
+        case 'PBES2-HS512+A256KW':
+            if (!isAlgorithm(key.algorithm, 'PBKDF2'))
+                throw unusable('PBKDF2');
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512': {
+            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
+                throw unusable('RSA-OAEP');
+            const expected = parseInt(alg.substr(9), 10) || 1;
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkEncCryptoKey = checkEncCryptoKey;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -4,13 +4,13 @@ const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
-const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
 const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 const is_object_js_1 = require("./is_object.js");
+const aesgcmkw_js_1 = require("./aesgcmkw.js");
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
     switch (alg) {
@@ -42,7 +42,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(joseHeader.enc), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -4,12 +4,12 @@ const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
-const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const cek_js_1 = require("../lib/cek.js");
 const errors_js_1 = require("../util/errors.js");
 const export_js_1 = require("../key/export.js");
 const check_key_type_js_1 = require("./check_key_type.js");
+const aesgcmkw_js_1 = require("./aesgcmkw.js");
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;
@@ -31,7 +31,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);

package/dist/node/cjs/{runtime → lib}/invalid_key_input.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const util_1 = require("util");
 exports.default = (actual, ...types) => {
     let msg = 'Key must be ';
     if (types.length > 2) {
@@ -23,16 +22,6 @@ exports.default = (actual, ...types) => {
         if (actual.constructor && actual.constructor.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
-        else {
-            const inspected = (0, util_1.inspect)(actual, { depth: -1 });
-            msg += ` Received ${inspected}`;
-        }
-    }
-    else {
-        let inspected = (0, util_1.inspect)(actual, { colors: false });
-        if (inspected.length > 25)
-            inspected = `${inspected.slice(0, 25)}...`;
-        msg += ` Received type ${typeof actual} (${inspected})`;
     }
     return msg;
 };

package/dist/node/cjs/lib/iv.js

@@ -1,25 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bitLengths = void 0;
+exports.bitLength = void 0;
 const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
-const bitLengths = new Map([
-    ['A128CBC-HS256', 128],
-    ['A128GCM', 96],
-    ['A128GCMKW', 96],
-    ['A192CBC-HS384', 128],
-    ['A192GCM', 96],
-    ['A192GCMKW', 96],
-    ['A256CBC-HS512', 128],
-    ['A256GCM', 96],
-    ['A256GCMKW', 96],
-]);
-exports.bitLengths = bitLengths;
-const generateIv = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 128;
+        case 'A128GCM':
+            return 96;
+        case 'A128GCMKW':
+            return 96;
+        case 'A192CBC-HS384':
+            return 128;
+        case 'A192GCM':
+            return 96;
+        case 'A192GCMKW':
+            return 96;
+        case 'A256CBC-HS512':
+            return 128;
+        case 'A256GCM':
+            return 96;
+        case 'A256GCMKW':
+            return 96;
+        default:
+            throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
-};
-exports.default = generateIv;
+}
+exports.bitLength = bitLength;
+exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/cjs/runtime/aeskw.js

@@ -7,8 +7,9 @@ const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const secret_key_js_1 = require("./secret_key.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
-const invalid_key_input_js_1 = require("./invalid_key_input.js");
+const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 function checkKeySize(key, alg) {
     if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
@@ -23,7 +24,8 @@ function ensureKeyObject(key, alg, usage) {
         return (0, secret_key_js_1.default)(key);
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, new Set([usage]));
+        (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
+        return crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/cjs/runtime/asn1.js

@@ -5,14 +5,14 @@ const crypto_1 = require("crypto");
 const buffer_1 = require("buffer");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
-const invalid_key_input_js_1 = require("./invalid_key_input.js");
+const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const genericExport = (keyType, keyFormat, key) => {
     let keyObject;
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = (0, webcrypto_js_1.getKeyObject)(key);
+        keyObject = crypto_1.KeyObject.from(key);
     }
     else if ((0, is_key_object_js_1.default)(key)) {
         keyObject = key;

package/dist/node/cjs/runtime/decrypt.js

@@ -8,8 +8,9 @@ const errors_js_1 = require("../util/errors.js");
 const timing_safe_equal_js_1 = require("./timing_safe_equal.js");
 const cbc_tag_js_1 = require("./cbc_tag.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
-const invalid_key_input_js_1 = require("./invalid_key_input.js");
+const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
@@ -66,7 +67,8 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
-        key = (0, webcrypto_js_1.getKeyObject)(cek, enc, new Set(['decrypt']));
+        (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'decrypt');
+        key = crypto_1.KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || (0, is_key_object_js_1.default)(cek)) {
         key = cek;