jose 4.1.3 → 4.2.1

package/dist/node/cjs/runtime/sign.js

@@ -16,10 +16,6 @@ else {
 const sign = async (alg, key, data) => {
     const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
     if (alg.startsWith('HS')) {
-        const bitlen = parseInt(alg.substr(-3), 10);
-        if (!keyObject.symmetricKeySize || keyObject.symmetricKeySize << 3 < bitlen) {
-            throw new TypeError(`${alg} requires symmetric keys to be ${bitlen} bits or larger`);
-        }
         const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), keyObject);
         hmac.update(data);
         return hmac.digest();

package/dist/node/esm/index.js

@@ -1,6 +1,7 @@
 export { compactDecrypt } from './jwe/compact/decrypt.js';
 export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
 export { generalDecrypt } from './jwe/general/decrypt.js';
+export { GeneralEncrypt } from './jwe/general/encrypt.js';
 export { compactVerify } from './jws/compact/verify.js';
 export { flattenedVerify } from './jws/flattened/verify.js';
 export { generalVerify } from './jws/general/verify.js';

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -7,6 +7,7 @@ import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
+export const unprotected = Symbol();
 export class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -65,7 +66,7 @@ export class FlattenedEncrypt {
             throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
         }
         if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
-            throw new JWEInvalid('JWE Shared Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+            throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
         }
         const joseHeader = {
             ...this._protectedHeader,
@@ -104,11 +105,21 @@ export class FlattenedEncrypt {
             let parameters;
             ({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, key, this._cek, this._keyManagementParameters));
             if (parameters) {
-                if (!this._protectedHeader) {
-                    this.setProtectedHeader(parameters);
+                if (options && unprotected in options) {
+                    if (!this._unprotectedHeader) {
+                        this.setUnprotectedHeader(parameters);
+                    }
+                    else {
+                        this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
+                    }
                 }
                 else {
-                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
+                    if (!this._protectedHeader) {
+                        this.setProtectedHeader(parameters);
+                    }
+                    else {
+                        this._protectedHeader = { ...this._protectedHeader, ...parameters };
+                    }
                 }
             }
         }

package/dist/node/esm/jwe/general/decrypt.js

@@ -8,6 +8,9 @@ export async function generalDecrypt(jwe, key, options) {
     if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
         throw new JWEInvalid('JWE Recipients missing or incorrect type');
     }
+    if (!jwe.recipients.length) {
+        throw new JWEInvalid('JWE Recipients has no members');
+    }
     for (const recipient of jwe.recipients) {
         try {
             return await flattenedDecrypt({

package/dist/node/esm/jwe/general/encrypt.js

@@ -0,0 +1,156 @@
+import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
+import { JWEInvalid } from '../../util/errors.js';
+import generateCek from '../../lib/cek.js';
+import isDisjoint from '../../lib/is_disjoint.js';
+import encryptKeyManagement from '../../lib/encrypt_key_management.js';
+import { encode as base64url } from '../../runtime/base64url.js';
+import validateCrit from '../../lib/validate_crit.js';
+const recipientRef = new WeakMap();
+class IndividualRecipient {
+    setUnprotectedHeader(unprotectedHeader) {
+        const ref = recipientRef.get(this);
+        if (ref.unprotectedHeader) {
+            throw new TypeError('setUnprotectedHeader can only be called once');
+        }
+        ref.unprotectedHeader = unprotectedHeader;
+        return this;
+    }
+}
+export class GeneralEncrypt {
+    constructor(plaintext) {
+        this._recipients = [];
+        this._plaintext = plaintext;
+    }
+    addRecipient(key, options) {
+        const recipient = new IndividualRecipient();
+        recipientRef.set(recipient, { key, options: { crit: options === null || options === void 0 ? void 0 : options.crit } });
+        this._recipients.push(recipient);
+        return recipient;
+    }
+    setProtectedHeader(protectedHeader) {
+        if (this._protectedHeader) {
+            throw new TypeError('setProtectedHeader can only be called once');
+        }
+        this._protectedHeader = protectedHeader;
+        return this;
+    }
+    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+        if (this._unprotectedHeader) {
+            throw new TypeError('setSharedUnprotectedHeader can only be called once');
+        }
+        this._unprotectedHeader = sharedUnprotectedHeader;
+        return this;
+    }
+    setAdditionalAuthenticatedData(aad) {
+        this._aad = aad;
+        return this;
+    }
+    async encrypt(options) {
+        var _a, _b;
+        if (!this._recipients.length) {
+            throw new JWEInvalid('at least one recipient must be added');
+        }
+        options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
+        if (this._recipients.length === 1) {
+            const { unprotectedHeader, options: recipientOpts, key, } = recipientRef.get(this._recipients[0]);
+            const flattened = await new FlattenedEncrypt(this._plaintext)
+                .setAdditionalAuthenticatedData(this._aad)
+                .setProtectedHeader(this._protectedHeader)
+                .setSharedUnprotectedHeader(this._unprotectedHeader)
+                .setUnprotectedHeader(unprotectedHeader)
+                .encrypt(key, { ...recipientOpts, ...options });
+            let jwe = {
+                ciphertext: flattened.ciphertext,
+                iv: flattened.iv,
+                recipients: [{}],
+                tag: flattened.tag,
+            };
+            if (flattened.aad)
+                jwe.aad = flattened.aad;
+            if (flattened.protected)
+                jwe.protected = flattened.protected;
+            if (flattened.unprotected)
+                jwe.unprotected = flattened.unprotected;
+            if (flattened.encrypted_key)
+                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
+            if (flattened.header)
+                jwe.recipients[0].header = flattened.header;
+            return jwe;
+        }
+        let enc;
+        for (let i = 0; i < this._recipients.length; i++) {
+            const recipient = this._recipients[i];
+            const { unprotectedHeader, options: recipientOpts } = recipientRef.get(recipient);
+            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, unprotectedHeader)) {
+                throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+            }
+            const joseHeader = {
+                ...this._protectedHeader,
+                ...this._unprotectedHeader,
+                ...unprotectedHeader,
+            };
+            const { alg } = joseHeader;
+            if (typeof alg !== 'string' || !alg) {
+                throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+            }
+            if (alg === 'dir' || alg === 'ECDH-ES') {
+                throw new JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');
+            }
+            if (typeof joseHeader.enc !== 'string' || !joseHeader.enc) {
+                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+            }
+            if (!enc) {
+                enc = joseHeader.enc;
+            }
+            else if (enc !== joseHeader.enc) {
+                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+            }
+            validateCrit(JWEInvalid, new Map(), recipientOpts === null || recipientOpts === void 0 ? void 0 : recipientOpts.crit, this._protectedHeader, joseHeader);
+            if (joseHeader.zip !== undefined) {
+                if (!this._protectedHeader || !this._protectedHeader.zip) {
+                    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
+                }
+            }
+        }
+        const cek = generateCek(enc);
+        let jwe = {
+            ciphertext: '',
+            iv: '',
+            recipients: [],
+            tag: '',
+        };
+        for (let i = 0; i < this._recipients.length; i++) {
+            const recipient = this._recipients[i];
+            const target = {};
+            jwe.recipients.push(target);
+            const { unprotectedHeader, options: recipientOpts, key } = recipientRef.get(recipient);
+            if (i === 0) {
+                const flattened = await new FlattenedEncrypt(this._plaintext)
+                    .setAdditionalAuthenticatedData(this._aad)
+                    .setContentEncryptionKey(cek)
+                    .setProtectedHeader(this._protectedHeader)
+                    .setSharedUnprotectedHeader(this._unprotectedHeader)
+                    .setUnprotectedHeader(unprotectedHeader)
+                    .encrypt(key, { ...recipientOpts, ...options, [unprotected]: true });
+                jwe.ciphertext = flattened.ciphertext;
+                jwe.iv = flattened.iv;
+                jwe.tag = flattened.tag;
+                if (flattened.aad)
+                    jwe.aad = flattened.aad;
+                if (flattened.protected)
+                    jwe.protected = flattened.protected;
+                if (flattened.unprotected)
+                    jwe.unprotected = flattened.unprotected;
+                target.encrypted_key = flattened.encrypted_key;
+                if (flattened.header)
+                    target.header = flattened.header;
+                continue;
+            }
+            const { encryptedKey, parameters } = await encryptKeyManagement((unprotectedHeader === null || unprotectedHeader === void 0 ? void 0 : unprotectedHeader.alg) || ((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.alg) || ((_b = this._unprotectedHeader) === null || _b === void 0 ? void 0 : _b.alg), enc, key, cek);
+            target.encrypted_key = base64url(encryptedKey);
+            if (unprotectedHeader || parameters)
+                target.header = { ...unprotectedHeader, ...parameters };
+        }
+        return jwe;
+    }
+}

package/dist/node/esm/jws/general/sign.js

@@ -3,31 +3,21 @@ import { JWSInvalid } from '../../util/errors.js';
 const signatureRef = new WeakMap();
 class IndividualSignature {
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        const ref = signatureRef.get(this);
+        if (ref.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        ref.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        const ref = signatureRef.get(this);
+        if (ref.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        ref.unprotectedHeader = unprotectedHeader;
         return this;
     }
-    set _protectedHeader(value) {
-        signatureRef.get(this).protectedHeader = value;
-    }
-    get _protectedHeader() {
-        return signatureRef.get(this).protectedHeader;
-    }
-    set _unprotectedHeader(value) {
-        signatureRef.get(this).unprotectedHeader = value;
-    }
-    get _unprotectedHeader() {
-        return signatureRef.get(this).unprotectedHeader;
-    }
 }
 export class GeneralSign {
     constructor(payload) {

package/dist/node/esm/key/import.js

@@ -62,7 +62,8 @@ function parseElement(bytes) {
     };
 }
 function spkiFromX509(buf) {
-    return encodeBase64(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+    const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
+    return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
 }
 function getSPKI(x509) {
     const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');

package/dist/node/esm/lib/cek.js

@@ -2,18 +2,17 @@ import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
 export function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 256;
-        case 'A192CBC-HS384':
-            return 384;
-        case 'A256CBC-HS512':
-            return 512;
         case 'A128GCM':
             return 128;
         case 'A192GCM':
             return 192;
         case 'A256GCM':
+        case 'A128CBC-HS256':
             return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
         default:
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/node/esm/lib/decrypt_key_management.js

@@ -40,7 +40,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = base64url(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.substr(-5, 3), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/esm/lib/encrypt_key_management.js

@@ -29,7 +29,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.substr(-5, 3), 10), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = base64url(apu);

package/dist/node/esm/lib/iv.js

@@ -2,24 +2,17 @@ import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
 export function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 128;
         case 'A128GCM':
-            return 96;
         case 'A128GCMKW':
-            return 96;
-        case 'A192CBC-HS384':
-            return 128;
         case 'A192GCM':
-            return 96;
         case 'A192GCMKW':
-            return 96;
-        case 'A256CBC-HS512':
-            return 128;
         case 'A256GCM':
-            return 96;
         case 'A256GCMKW':
             return 96;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            return 128;
         default:
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/node/esm/runtime/aeskw.js

@@ -8,6 +8,7 @@ import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import supported from './ciphers.js';
+import { types } from './is_key_like.js';
 function checkKeySize(key, alg) {
     if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
@@ -24,9 +25,9 @@ function ensureKeyObject(key, alg, usage) {
         checkEncCryptoKey(key, alg, usage);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
-export const wrap = async (alg, key, cek) => {
+export const wrap = (alg, key, cek) => {
     const size = parseInt(alg.substr(1, 3), 10);
     const algorithm = `aes${size}-wrap`;
     if (!supported(algorithm)) {
@@ -37,7 +38,7 @@ export const wrap = async (alg, key, cek) => {
     const cipher = createCipheriv(algorithm, keyObject, Buffer.alloc(8, 0xa6));
     return concat(cipher.update(cek), cipher.final());
 };
-export const unwrap = async (alg, key, encryptedKey) => {
+export const unwrap = (alg, key, encryptedKey) => {
     const size = parseInt(alg.substr(1, 3), 10);
     const algorithm = `aes${size}-wrap`;
     if (!supported(algorithm)) {

package/dist/node/esm/runtime/asn1.js

@@ -3,6 +3,7 @@ import { Buffer } from 'buffer';
 import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const genericExport = (keyType, keyFormat, key) => {
     let keyObject;
     if (isCryptoKey(key)) {
@@ -15,7 +16,7 @@ const genericExport = (keyType, keyFormat, key) => {
         keyObject = key;
     }
     else {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     if (keyObject.type !== keyType) {
         throw new TypeError(`key is not a ${keyType} key`);

package/dist/node/esm/runtime/decrypt.js

@@ -10,7 +10,8 @@ import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import supported from './ciphers.js';
-async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+import { types } from './is_key_like.js';
+function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
@@ -34,8 +35,8 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     }
     let plaintext;
     try {
-        const cipher = createDecipheriv(algorithm, encKey, iv);
-        plaintext = concat(cipher.update(ciphertext), cipher.final());
+        const decipher = createDecipheriv(algorithm, encKey, iv);
+        plaintext = concat(decipher.update(ciphertext), decipher.final());
     }
     catch {
     }
@@ -44,25 +45,27 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     }
     return plaintext;
 }
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
     }
     try {
-        const cipher = createDecipheriv(algorithm, cek, iv, { authTagLength: 16 });
-        cipher.setAuthTag(tag);
+        const decipher = createDecipheriv(algorithm, cek, iv, { authTagLength: 16 });
+        decipher.setAuthTag(tag);
         if (aad.byteLength) {
-            cipher.setAAD(aad, { plaintextLength: ciphertext.length });
+            decipher.setAAD(aad, { plaintextLength: ciphertext.length });
         }
-        return concat(cipher.update(ciphertext), cipher.final());
+        const plaintext = decipher.update(ciphertext);
+        decipher.final();
+        return plaintext;
     }
     catch {
         throw new JWEDecryptionFailed();
     }
 }
-const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
+const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if (isCryptoKey(cek)) {
         checkEncCryptoKey(cek, enc, 'decrypt');
@@ -72,7 +75,7 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
         key = cek;
     }
     else {
-        throw new TypeError(invalidKeyInput(cek, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
     checkCekLength(enc, key);
     checkIvLength(enc, iv);

package/dist/node/esm/runtime/ecdhes.js

@@ -8,8 +8,9 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const generateKeyPair = promisify(generateKeyPairCb);
-export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     let publicKey;
     if (isCryptoKey(publicKee)) {
         checkEncCryptoKey(publicKee, 'ECDH-ES');
@@ -19,7 +20,7 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
         publicKey = publicKee;
     }
     else {
-        throw new TypeError(invalidKeyInput(publicKee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(publicKee, ...types));
     }
     let privateKey;
     if (isCryptoKey(privateKee)) {
@@ -30,7 +31,7 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
         privateKey = privateKee;
     }
     else {
-        throw new TypeError(invalidKeyInput(privateKee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(privateKee, ...types));
     }
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
@@ -45,7 +46,7 @@ export const generateEpk = async (kee) => {
         key = kee;
     }
     else {
-        throw new TypeError(invalidKeyInput(kee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(kee, ...types));
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':

package/dist/node/esm/runtime/encrypt.js

@@ -9,7 +9,8 @@ import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { JOSENotSupported } from '../util/errors.js';
 import supported from './ciphers.js';
-async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+import { types } from './is_key_like.js';
+function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
@@ -26,7 +27,7 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     const tag = cbcTag(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
+function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
@@ -36,11 +37,12 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     if (aad.byteLength) {
         cipher.setAAD(aad, { plaintextLength: plaintext.length });
     }
-    const ciphertext = concat(cipher.update(plaintext), cipher.final());
+    const ciphertext = cipher.update(plaintext);
+    cipher.final();
     const tag = cipher.getAuthTag();
     return { ciphertext, tag };
 }
-const encrypt = async (enc, plaintext, cek, iv, aad) => {
+const encrypt = (enc, plaintext, cek, iv, aad) => {
     let key;
     if (isCryptoKey(cek)) {
         checkEncCryptoKey(cek, enc, 'encrypt');
@@ -50,7 +52,7 @@ const encrypt = async (enc, plaintext, cek, iv, aad) => {
         key = cek;
     }
     else {
-        throw new TypeError(invalidKeyInput(cek, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
     checkCekLength(enc, key);
     checkIvLength(enc, iv);

package/dist/node/esm/runtime/get_named_curve.js

@@ -4,6 +4,7 @@ import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const p256 = Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
 const p384 = Buffer.from([43, 129, 4, 0, 34]);
 const p521 = Buffer.from([43, 129, 4, 0, 35]);
@@ -33,7 +34,7 @@ const getNamedCurve = (kee, raw) => {
         key = kee;
     }
     else {
-        throw new TypeError(invalidKeyInput(kee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(kee, ...types));
     }
     if (key.type === 'secret') {
         throw new TypeError('only "private" or "public" type keys can be used for this operation');

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -3,10 +3,11 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import getSecretKey from './secret_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export default function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+            throw new TypeError(invalidKeyInput(key, ...types));
         }
         return getSecretKey(key);
     }
@@ -17,5 +18,5 @@ export default function getSignVerifyKey(alg, key, usage) {
         checkSigCryptoKey(key, alg, usage);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }

package/dist/node/esm/runtime/key_to_jwk.js

@@ -6,6 +6,7 @@ import getNamedCurve from './get_named_curve.js';
 import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const [major, minor] = process.version
     .substr(1)
     .split('.')
@@ -29,7 +30,7 @@ const keyToJWK = (key) => {
         };
     }
     else {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
         return keyObject.export({ format: 'jwk' });

package/dist/node/esm/runtime/pbes2kw.js

@@ -9,6 +9,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const pbkdf2 = promisify(pbkdf2cb);
 function getPassword(key, alg) {
     if (isKeyObject(key)) {
@@ -21,7 +22,7 @@ function getPassword(key, alg) {
         checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
         return KeyObject.from(key).export();
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
     checkP2s(p2s);

package/dist/node/esm/runtime/rsaes.js

@@ -4,6 +4,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const checkKey = (key, alg) => {
     if (key.asymmetricKeyType !== 'rsa') {
         throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
@@ -45,16 +46,16 @@ function ensureKeyObject(key, alg, ...usages) {
         checkEncCryptoKey(key, alg, ...usages);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+    throw new TypeError(invalidKeyInput(key, ...types));
 }
-export const encrypt = async (alg, key, cek) => {
+export const encrypt = (alg, key, cek) => {
     const padding = resolvePadding(alg);
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'wrapKey', 'encrypt');
     checkKey(keyObject, alg);
     return publicEncrypt({ key: keyObject, oaepHash, padding }, cek);
 };
-export const decrypt = async (alg, key, encryptedKey) => {
+export const decrypt = (alg, key, encryptedKey) => {
     const padding = resolvePadding(alg);
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'unwrapKey', 'decrypt');