jose 4.1.5 → 4.3.2

package/dist/browser/runtime/rsaes.js

@@ -4,9 +4,10 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import checkKeyLength from './check_key_length.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export const encrypt = async (alg, key, cek) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
     checkKeyLength(alg, key);
@@ -21,7 +22,7 @@ export const encrypt = async (alg, key, cek) => {
 };
 export const decrypt = async (alg, key, encryptedKey) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
     checkKeyLength(alg, key);

package/dist/node/cjs/index.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
 Object.defineProperty(exports, "flattenedDecrypt", { enumerable: true, get: function () { return decrypt_js_2.flattenedDecrypt; } });
 var decrypt_js_3 = require("./jwe/general/decrypt.js");
 Object.defineProperty(exports, "generalDecrypt", { enumerable: true, get: function () { return decrypt_js_3.generalDecrypt; } });
+var encrypt_js_1 = require("./jwe/general/encrypt.js");
+Object.defineProperty(exports, "GeneralEncrypt", { enumerable: true, get: function () { return encrypt_js_1.GeneralEncrypt; } });
 var verify_js_1 = require("./jws/compact/verify.js");
 Object.defineProperty(exports, "compactVerify", { enumerable: true, get: function () { return verify_js_1.compactVerify; } });
 var verify_js_2 = require("./jws/flattened/verify.js");
@@ -17,10 +19,10 @@ var verify_js_4 = require("./jwt/verify.js");
 Object.defineProperty(exports, "jwtVerify", { enumerable: true, get: function () { return verify_js_4.jwtVerify; } });
 var decrypt_js_4 = require("./jwt/decrypt.js");
 Object.defineProperty(exports, "jwtDecrypt", { enumerable: true, get: function () { return decrypt_js_4.jwtDecrypt; } });
-var encrypt_js_1 = require("./jwe/compact/encrypt.js");
-Object.defineProperty(exports, "CompactEncrypt", { enumerable: true, get: function () { return encrypt_js_1.CompactEncrypt; } });
-var encrypt_js_2 = require("./jwe/flattened/encrypt.js");
-Object.defineProperty(exports, "FlattenedEncrypt", { enumerable: true, get: function () { return encrypt_js_2.FlattenedEncrypt; } });
+var encrypt_js_2 = require("./jwe/compact/encrypt.js");
+Object.defineProperty(exports, "CompactEncrypt", { enumerable: true, get: function () { return encrypt_js_2.CompactEncrypt; } });
+var encrypt_js_3 = require("./jwe/flattened/encrypt.js");
+Object.defineProperty(exports, "FlattenedEncrypt", { enumerable: true, get: function () { return encrypt_js_3.FlattenedEncrypt; } });
 var sign_js_1 = require("./jws/compact/sign.js");
 Object.defineProperty(exports, "CompactSign", { enumerable: true, get: function () { return sign_js_1.CompactSign; } });
 var sign_js_2 = require("./jws/flattened/sign.js");
@@ -29,8 +31,8 @@ var sign_js_3 = require("./jws/general/sign.js");
 Object.defineProperty(exports, "GeneralSign", { enumerable: true, get: function () { return sign_js_3.GeneralSign; } });
 var sign_js_4 = require("./jwt/sign.js");
 Object.defineProperty(exports, "SignJWT", { enumerable: true, get: function () { return sign_js_4.SignJWT; } });
-var encrypt_js_3 = require("./jwt/encrypt.js");
-Object.defineProperty(exports, "EncryptJWT", { enumerable: true, get: function () { return encrypt_js_3.EncryptJWT; } });
+var encrypt_js_4 = require("./jwt/encrypt.js");
+Object.defineProperty(exports, "EncryptJWT", { enumerable: true, get: function () { return encrypt_js_4.EncryptJWT; } });
 var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
 var embedded_js_1 = require("./jwk/embedded.js");

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FlattenedEncrypt = void 0;
+exports.FlattenedEncrypt = exports.unprotected = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
@@ -10,6 +10,7 @@ const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
+exports.unprotected = Symbol();
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -68,7 +69,7 @@ class FlattenedEncrypt {
             throw new errors_js_1.JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
         }
         if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
-            throw new errors_js_1.JWEInvalid('JWE Shared Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+            throw new errors_js_1.JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
         }
         const joseHeader = {
             ...this._protectedHeader,
@@ -107,11 +108,21 @@ class FlattenedEncrypt {
             let parameters;
             ({ cek, encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(alg, enc, key, this._cek, this._keyManagementParameters));
             if (parameters) {
-                if (!this._protectedHeader) {
-                    this.setProtectedHeader(parameters);
+                if (options && exports.unprotected in options) {
+                    if (!this._unprotectedHeader) {
+                        this.setUnprotectedHeader(parameters);
+                    }
+                    else {
+                        this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
+                    }
                 }
                 else {
-                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
+                    if (!this._protectedHeader) {
+                        this.setProtectedHeader(parameters);
+                    }
+                    else {
+                        this._protectedHeader = { ...this._protectedHeader, ...parameters };
+                    }
                 }
             }
         }

package/dist/node/cjs/jwe/general/decrypt.js

@@ -11,6 +11,9 @@ async function generalDecrypt(jwe, key, options) {
     if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(is_object_js_1.default)) {
         throw new errors_js_1.JWEInvalid('JWE Recipients missing or incorrect type');
     }
+    if (!jwe.recipients.length) {
+        throw new errors_js_1.JWEInvalid('JWE Recipients has no members');
+    }
     for (const recipient of jwe.recipients) {
         try {
             return await (0, decrypt_js_1.flattenedDecrypt)({

package/dist/node/cjs/jwe/general/encrypt.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GeneralEncrypt = void 0;
+const encrypt_js_1 = require("../flattened/encrypt.js");
+const errors_js_1 = require("../../util/errors.js");
+const cek_js_1 = require("../../lib/cek.js");
+const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
+const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js");
+const base64url_js_1 = require("../../runtime/base64url.js");
+const validate_crit_js_1 = require("../../lib/validate_crit.js");
+class IndividualRecipient {
+    constructor(enc, key, options) {
+        this.parent = enc;
+        this.key = key;
+        this.options = options;
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        if (this.unprotectedHeader) {
+            throw new TypeError('setUnprotectedHeader can only be called once');
+        }
+        this.unprotectedHeader = unprotectedHeader;
+        return this;
+    }
+    addRecipient(...args) {
+        return this.parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.parent.encrypt(...args);
+    }
+    done() {
+        return this.parent;
+    }
+}
+class GeneralEncrypt {
+    constructor(plaintext) {
+        this._recipients = [];
+        this._plaintext = plaintext;
+    }
+    addRecipient(key, options) {
+        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
+        this._recipients.push(recipient);
+        return recipient;
+    }
+    setProtectedHeader(protectedHeader) {
+        if (this._protectedHeader) {
+            throw new TypeError('setProtectedHeader can only be called once');
+        }
+        this._protectedHeader = protectedHeader;
+        return this;
+    }
+    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+        if (this._unprotectedHeader) {
+            throw new TypeError('setSharedUnprotectedHeader can only be called once');
+        }
+        this._unprotectedHeader = sharedUnprotectedHeader;
+        return this;
+    }
+    setAdditionalAuthenticatedData(aad) {
+        this._aad = aad;
+        return this;
+    }
+    async encrypt(options) {
+        var _a, _b, _c;
+        if (!this._recipients.length) {
+            throw new errors_js_1.JWEInvalid('at least one recipient must be added');
+        }
+        options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
+        if (this._recipients.length === 1) {
+            const [recipient] = this._recipients;
+            const flattened = await new encrypt_js_1.FlattenedEncrypt(this._plaintext)
+                .setAdditionalAuthenticatedData(this._aad)
+                .setProtectedHeader(this._protectedHeader)
+                .setSharedUnprotectedHeader(this._unprotectedHeader)
+                .setUnprotectedHeader(recipient.unprotectedHeader)
+                .encrypt(recipient.key, { ...recipient.options, ...options });
+            let jwe = {
+                ciphertext: flattened.ciphertext,
+                iv: flattened.iv,
+                recipients: [{}],
+                tag: flattened.tag,
+            };
+            if (flattened.aad)
+                jwe.aad = flattened.aad;
+            if (flattened.protected)
+                jwe.protected = flattened.protected;
+            if (flattened.unprotected)
+                jwe.unprotected = flattened.unprotected;
+            if (flattened.encrypted_key)
+                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
+            if (flattened.header)
+                jwe.recipients[0].header = flattened.header;
+            return jwe;
+        }
+        let enc;
+        for (let i = 0; i < this._recipients.length; i++) {
+            const recipient = this._recipients[i];
+            if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
+                throw new errors_js_1.JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+            }
+            const joseHeader = {
+                ...this._protectedHeader,
+                ...this._unprotectedHeader,
+                ...recipient.unprotectedHeader,
+            };
+            const { alg } = joseHeader;
+            if (typeof alg !== 'string' || !alg) {
+                throw new errors_js_1.JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+            }
+            if (alg === 'dir' || alg === 'ECDH-ES') {
+                throw new errors_js_1.JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');
+            }
+            if (typeof joseHeader.enc !== 'string' || !joseHeader.enc) {
+                throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+            }
+            if (!enc) {
+                enc = joseHeader.enc;
+            }
+            else if (enc !== joseHeader.enc) {
+                throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+            }
+            (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
+            if (joseHeader.zip !== undefined) {
+                if (!this._protectedHeader || !this._protectedHeader.zip) {
+                    throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
+                }
+            }
+        }
+        const cek = (0, cek_js_1.default)(enc);
+        let jwe = {
+            ciphertext: '',
+            iv: '',
+            recipients: [],
+            tag: '',
+        };
+        for (let i = 0; i < this._recipients.length; i++) {
+            const recipient = this._recipients[i];
+            const target = {};
+            jwe.recipients.push(target);
+            if (i === 0) {
+                const flattened = await new encrypt_js_1.FlattenedEncrypt(this._plaintext)
+                    .setAdditionalAuthenticatedData(this._aad)
+                    .setContentEncryptionKey(cek)
+                    .setProtectedHeader(this._protectedHeader)
+                    .setSharedUnprotectedHeader(this._unprotectedHeader)
+                    .setUnprotectedHeader(recipient.unprotectedHeader)
+                    .encrypt(recipient.key, {
+                    ...recipient.options,
+                    ...options,
+                    [encrypt_js_1.unprotected]: true,
+                });
+                jwe.ciphertext = flattened.ciphertext;
+                jwe.iv = flattened.iv;
+                jwe.tag = flattened.tag;
+                if (flattened.aad)
+                    jwe.aad = flattened.aad;
+                if (flattened.protected)
+                    jwe.protected = flattened.protected;
+                if (flattened.unprotected)
+                    jwe.unprotected = flattened.unprotected;
+                target.encrypted_key = flattened.encrypted_key;
+                if (flattened.header)
+                    target.header = flattened.header;
+                continue;
+            }
+            const { encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
+                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
+                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek);
+            target.encrypted_key = (0, base64url_js_1.encode)(encryptedKey);
+            if (recipient.unprotectedHeader || parameters)
+                target.header = { ...recipient.unprotectedHeader, ...parameters };
+        }
+        return jwe;
+    }
+}
+exports.GeneralEncrypt = GeneralEncrypt;

package/dist/node/cjs/jwks/remote.js

@@ -40,17 +40,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -58,11 +62,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -84,7 +88,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new errors_js_1.JWKSNoMatchingKey();
         }
@@ -92,14 +96,14 @@ class RemoteJWKSet {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/node/cjs/jws/general/sign.js

@@ -3,33 +3,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GeneralSign = void 0;
 const sign_js_1 = require("../flattened/sign.js");
 const errors_js_1 = require("../../util/errors.js");
-const signatureRef = new WeakMap();
 class IndividualSignature {
+    constructor(sig, key, options) {
+        this.parent = sig;
+        this.key = key;
+        this.options = options;
+    }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
-    set _protectedHeader(value) {
-        signatureRef.get(this).protectedHeader = value;
-    }
-    get _protectedHeader() {
-        return signatureRef.get(this).protectedHeader;
+    addSignature(...args) {
+        return this.parent.addSignature(...args);
     }
-    set _unprotectedHeader(value) {
-        signatureRef.get(this).unprotectedHeader = value;
+    sign(...args) {
+        return this.parent.sign(...args);
     }
-    get _unprotectedHeader() {
-        return signatureRef.get(this).unprotectedHeader;
+    done() {
+        return this.parent;
     }
 }
 class GeneralSign {
@@ -38,8 +39,7 @@ class GeneralSign {
         this._payload = payload;
     }
     addSignature(key, options) {
-        const signature = new IndividualSignature();
-        signatureRef.set(signature, { key, options });
+        const signature = new IndividualSignature(this, key, options);
         this._signatures.push(signature);
         return signature;
     }
@@ -51,23 +51,19 @@ class GeneralSign {
             signatures: [],
             payload: '',
         };
-        let payloads = new Set();
-        await Promise.all(this._signatures.map(async (sig) => {
-            const { protectedHeader, unprotectedHeader, options, key } = signatureRef.get(sig);
+        for (let i = 0; i < this._signatures.length; i++) {
+            const signature = this._signatures[i];
             const flattened = new sign_js_1.FlattenedSign(this._payload);
-            if (protectedHeader) {
-                flattened.setProtectedHeader(protectedHeader);
+            flattened.setProtectedHeader(signature.protectedHeader);
+            flattened.setUnprotectedHeader(signature.unprotectedHeader);
+            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (i === 0) {
+                jws.payload = payload;
             }
-            if (unprotectedHeader) {
-                flattened.setUnprotectedHeader(unprotectedHeader);
+            else if (jws.payload !== payload) {
+                throw new errors_js_1.JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
             }
-            const { payload, ...rest } = await flattened.sign(key, options);
-            payloads.add(payload);
-            jws.payload = payload;
             jws.signatures.push(rest);
-        }));
-        if (payloads.size !== 1) {
-            throw new errors_js_1.JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
         }
         return jws;
     }

package/dist/node/cjs/lib/cek.js

@@ -5,18 +5,17 @@ const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
 function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 256;
-        case 'A192CBC-HS384':
-            return 384;
-        case 'A256CBC-HS512':
-            return 512;
         case 'A128GCM':
             return 128;
         case 'A192GCM':
             return 192;
         case 'A256GCM':
+        case 'A128CBC-HS256':
             return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
         default:
             throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -42,7 +42,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(joseHeader.enc) : parseInt(alg.substr(-5, 3), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -31,7 +31,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(enc) : parseInt(alg.substr(-5, 3), 10), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);

package/dist/node/cjs/lib/iv.js

@@ -5,24 +5,17 @@ const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
 function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 128;
         case 'A128GCM':
-            return 96;
         case 'A128GCMKW':
-            return 96;
-        case 'A192CBC-HS384':
-            return 128;
         case 'A192GCM':
-            return 96;
         case 'A192GCMKW':
-            return 96;
-        case 'A256CBC-HS512':
-            return 128;
         case 'A256GCM':
-            return 96;
         case 'A256GCMKW':
             return 96;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            return 128;
         default:
             throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/node/cjs/runtime/aeskw.js

@@ -11,6 +11,7 @@ const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
+const is_key_like_js_1 = require("./is_key_like.js");
 function checkKeySize(key, alg) {
     if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
@@ -27,9 +28,9 @@ function ensureKeyObject(key, alg, usage) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
         return crypto_1.KeyObject.from(key);
     }
-    throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }
-const wrap = async (alg, key, cek) => {
+const wrap = (alg, key, cek) => {
     const size = parseInt(alg.substr(1, 3), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
@@ -41,7 +42,7 @@ const wrap = async (alg, key, cek) => {
     return (0, buffer_utils_js_1.concat)(cipher.update(cek), cipher.final());
 };
 exports.wrap = wrap;
-const unwrap = async (alg, key, encryptedKey) => {
+const unwrap = (alg, key, encryptedKey) => {
     const size = parseInt(alg.substr(1, 3), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {

package/dist/node/cjs/runtime/asn1.js

@@ -6,6 +6,7 @@ const buffer_1 = require("buffer");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
+const is_key_like_js_1 = require("./is_key_like.js");
 const genericExport = (keyType, keyFormat, key) => {
     let keyObject;
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
@@ -18,7 +19,7 @@ const genericExport = (keyType, keyFormat, key) => {
         keyObject = key;
     }
     else {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+        throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
     }
     if (keyObject.type !== keyType) {
         throw new TypeError(`key is not a ${keyType} key`);

package/dist/node/cjs/runtime/decrypt.js

@@ -12,7 +12,8 @@ const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
-async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+const is_key_like_js_1 = require("./is_key_like.js");
+function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     if ((0, is_key_object_js_1.default)(cek)) {
         cek = cek.export();
@@ -46,7 +47,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     }
     return plaintext;
 }
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
@@ -66,7 +67,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new errors_js_1.JWEDecryptionFailed();
     }
 }
-const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
+const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'decrypt');
@@ -76,7 +77,7 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
         key = cek;
     }
     else {
-        throw new TypeError((0, invalid_key_input_js_1.default)(cek, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError((0, invalid_key_input_js_1.default)(cek, ...is_key_like_js_1.types, 'Uint8Array'));
     }
     (0, check_cek_length_js_1.default)(enc, key);
     (0, check_iv_length_js_1.default)(enc, iv);