jose 4.15.4 → 5.0.1

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -1,118 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const buffer_1 = require("buffer");
-const crypto_1 = require("crypto");
-const base64url_js_1 = require("./base64url.js");
-const errors_js_1 = require("../util/errors.js");
-const get_named_curve_js_1 = require("./get_named_curve.js");
-const check_modulus_length_js_1 = require("./check_modulus_length.js");
-const asn1_sequence_encoder_js_1 = require("./asn1_sequence_encoder.js");
-const flags_js_1 = require("./flags.js");
+const node_crypto_1 = require("node:crypto");
 const parse = (jwk) => {
-    if (flags_js_1.jwkImport && jwk.kty !== 'oct') {
-        return jwk.d
-            ? (0, crypto_1.createPrivateKey)({ format: 'jwk', key: jwk })
-            : (0, crypto_1.createPublicKey)({ format: 'jwk', key: jwk });
-    }
-    switch (jwk.kty) {
-        case 'oct': {
-            return (0, crypto_1.createSecretKey)((0, base64url_js_1.decode)(jwk.k));
-        }
-        case 'RSA': {
-            const enc = new asn1_sequence_encoder_js_1.default();
-            const isPrivate = jwk.d !== undefined;
-            const modulus = buffer_1.Buffer.from(jwk.n, 'base64');
-            const exponent = buffer_1.Buffer.from(jwk.e, 'base64');
-            if (isPrivate) {
-                enc.zero();
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.d, 'base64'));
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.p, 'base64'));
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.q, 'base64'));
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.dp, 'base64'));
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.dq, 'base64'));
-                enc.unsignedInteger(buffer_1.Buffer.from(jwk.qi, 'base64'));
-            }
-            else {
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-            }
-            const der = enc.end();
-            const createInput = {
-                key: der,
-                format: 'der',
-                type: 'pkcs1',
-            };
-            const keyObject = isPrivate ? (0, crypto_1.createPrivateKey)(createInput) : (0, crypto_1.createPublicKey)(createInput);
-            (0, check_modulus_length_js_1.setModulusLength)(keyObject, modulus.length << 3);
-            return keyObject;
-        }
-        case 'EC': {
-            const enc = new asn1_sequence_encoder_js_1.default();
-            const isPrivate = jwk.d !== undefined;
-            const pub = buffer_1.Buffer.concat([
-                buffer_1.Buffer.alloc(1, 4),
-                buffer_1.Buffer.from(jwk.x, 'base64'),
-                buffer_1.Buffer.from(jwk.y, 'base64'),
-            ]);
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new asn1_sequence_encoder_js_1.default();
-                enc$1.oidFor('ecPublicKey');
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new asn1_sequence_encoder_js_1.default();
-                enc$2.one();
-                enc$2.octStr(buffer_1.Buffer.from(jwk.d, 'base64'));
-                const enc$3 = new asn1_sequence_encoder_js_1.default();
-                enc$3.bitStr(pub);
-                const f2 = enc$3.end(buffer_1.Buffer.from([0xa1]));
-                enc$2.add(f2);
-                const f = enc$2.end();
-                const enc$4 = new asn1_sequence_encoder_js_1.default();
-                enc$4.add(f);
-                const f3 = enc$4.end(buffer_1.Buffer.from([0x04]));
-                enc.add(f3);
-                const der = enc.end();
-                const keyObject = (0, crypto_1.createPrivateKey)({ key: der, format: 'der', type: 'pkcs8' });
-                (0, get_named_curve_js_1.setCurve)(keyObject, jwk.crv);
-                return keyObject;
-            }
-            const enc$1 = new asn1_sequence_encoder_js_1.default();
-            enc$1.oidFor('ecPublicKey');
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(pub);
-            const der = enc.end();
-            const keyObject = (0, crypto_1.createPublicKey)({ key: der, format: 'der', type: 'spki' });
-            (0, get_named_curve_js_1.setCurve)(keyObject, jwk.crv);
-            return keyObject;
-        }
-        case 'OKP': {
-            const enc = new asn1_sequence_encoder_js_1.default();
-            const isPrivate = jwk.d !== undefined;
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new asn1_sequence_encoder_js_1.default();
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new asn1_sequence_encoder_js_1.default();
-                enc$2.octStr(buffer_1.Buffer.from(jwk.d, 'base64'));
-                const f = enc$2.end(buffer_1.Buffer.from([0x04]));
-                enc.add(f);
-                const der = enc.end();
-                return (0, crypto_1.createPrivateKey)({ key: der, format: 'der', type: 'pkcs8' });
-            }
-            const enc$1 = new asn1_sequence_encoder_js_1.default();
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(buffer_1.Buffer.from(jwk.x, 'base64'));
-            const der = enc.end();
-            return (0, crypto_1.createPublicKey)({ key: der, format: 'der', type: 'spki' });
-        }
-        default:
-            throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
-    }
+    return (jwk.d ? node_crypto_1.createPrivateKey : node_crypto_1.createPublicKey)({ format: 'jwk', key: jwk });
 };
 exports.default = parse;

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -1,22 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const base64url_js_1 = require("./base64url.js");
-const asn1_sequence_decoder_js_1 = require("./asn1_sequence_decoder.js");
 const errors_js_1 = require("../util/errors.js");
-const get_named_curve_js_1 = require("./get_named_curve.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const flags_js_1 = require("./flags.js");
 const keyToJWK = (key) => {
     let keyObject;
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = crypto_1.KeyObject.from(key);
+        keyObject = node_crypto_1.KeyObject.from(key);
     }
     else if ((0, is_key_object_js_1.default)(key)) {
         keyObject = key;
@@ -30,131 +27,10 @@ const keyToJWK = (key) => {
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
-    if (flags_js_1.jwkExport) {
-        if (keyObject.type !== 'secret' &&
-            !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
-            throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
-        }
-        return keyObject.export({ format: 'jwk' });
-    }
-    switch (keyObject.type) {
-        case 'secret':
-            return {
-                kty: 'oct',
-                k: (0, base64url_js_1.encode)(keyObject.export()),
-            };
-        case 'private':
-        case 'public': {
-            switch (keyObject.asymmetricKeyType) {
-                case 'rsa': {
-                    const der = keyObject.export({ format: 'der', type: 'pkcs1' });
-                    const dec = new asn1_sequence_decoder_js_1.default(der);
-                    if (keyObject.type === 'private') {
-                        dec.unsignedInteger();
-                    }
-                    const n = (0, base64url_js_1.encode)(dec.unsignedInteger());
-                    const e = (0, base64url_js_1.encode)(dec.unsignedInteger());
-                    let jwk;
-                    if (keyObject.type === 'private') {
-                        jwk = {
-                            d: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            p: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            q: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            dp: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            dq: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            qi: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                        };
-                    }
-                    dec.end();
-                    return { kty: 'RSA', n, e, ...jwk };
-                }
-                case 'ec': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
-                    let len;
-                    let offset;
-                    let correction;
-                    switch (crv) {
-                        case 'secp256k1':
-                            len = 64;
-                            offset = 31 + 2;
-                            correction = -1;
-                            break;
-                        case 'P-256':
-                            len = 64;
-                            offset = 34 + 2;
-                            correction = -1;
-                            break;
-                        case 'P-384':
-                            len = 96;
-                            offset = 33 + 2;
-                            correction = -3;
-                            break;
-                        case 'P-521':
-                            len = 132;
-                            offset = 33 + 2;
-                            correction = -3;
-                            break;
-                        default:
-                            throw new errors_js_1.JOSENotSupported('Unsupported curve');
-                    }
-                    if (keyObject.type === 'public') {
-                        const der = keyObject.export({ type: 'spki', format: 'der' });
-                        return {
-                            kty: 'EC',
-                            crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(-len, -len / 2)),
-                            y: (0, base64url_js_1.encode)(der.subarray(-len / 2)),
-                        };
-                    }
-                    const der = keyObject.export({ type: 'pkcs8', format: 'der' });
-                    if (der.length < 100) {
-                        offset += correction;
-                    }
-                    return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(offset, offset + len / 2)),
-                    };
-                }
-                case 'ed25519':
-                case 'x25519': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
-                    if (keyObject.type === 'public') {
-                        const der = keyObject.export({ type: 'spki', format: 'der' });
-                        return {
-                            kty: 'OKP',
-                            crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(-32)),
-                        };
-                    }
-                    const der = keyObject.export({ type: 'pkcs8', format: 'der' });
-                    return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(-32)),
-                    };
-                }
-                case 'ed448':
-                case 'x448': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
-                    if (keyObject.type === 'public') {
-                        const der = keyObject.export({ type: 'spki', format: 'der' });
-                        return {
-                            kty: 'OKP',
-                            crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(crv === 'Ed448' ? -57 : -56)),
-                        };
-                    }
-                    const der = keyObject.export({ type: 'pkcs8', format: 'der' });
-                    return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(crv === 'Ed448' ? -57 : -56)),
-                    };
-                }
-                default:
-                    throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
-            }
-        }
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported key type');
+    if (keyObject.type !== 'secret' &&
+        !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
+        throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
     }
+    return keyObject.export({ format: 'jwk' });
 };
 exports.default = keyToJWK;

package/dist/node/cjs/runtime/node_key.js

@@ -1,13 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
-const check_modulus_length_js_1 = require("./check_modulus_length.js");
-const flags_js_1 = require("./flags.js");
+const check_key_length_js_1 = require("./check_key_length.js");
 const PSS = {
-    padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
+    padding: node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
 };
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
@@ -28,11 +27,11 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
-            (0, check_modulus_length_js_1.default)(key, alg);
+            (0, check_key_length_js_1.default)(key, alg);
             return key;
-        case flags_js_1.rsaPssParams && 'PS256':
-        case flags_js_1.rsaPssParams && 'PS384':
-        case flags_js_1.rsaPssParams && 'PS512':
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
@@ -47,15 +46,7 @@ function keyForCrypto(alg, key) {
             else if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
-            (0, check_modulus_length_js_1.default)(key, alg);
-            return { key, ...PSS };
-        case !flags_js_1.rsaPssParams && 'PS256':
-        case !flags_js_1.rsaPssParams && 'PS384':
-        case !flags_js_1.rsaPssParams && 'PS512':
-            if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            (0, check_modulus_length_js_1.default)(key, alg);
+            (0, check_key_length_js_1.default)(key, alg);
             return { key, ...PSS };
         case 'ES256':
         case 'ES256K':

package/dist/node/cjs/runtime/pbes2kw.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decrypt = exports.encrypt = void 0;
-const util_1 = require("util");
-const crypto_1 = require("crypto");
+const node_util_1 = require("node:util");
+const node_crypto_1 = require("node:crypto");
 const random_js_1 = require("./random.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const base64url_js_1 = require("./base64url.js");
@@ -13,7 +13,7 @@ const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const pbkdf2 = (0, util_1.promisify)(crypto_1.pbkdf2);
+const pbkdf2 = (0, node_util_1.promisify)(node_crypto_1.pbkdf2);
 function getPassword(key, alg) {
     if ((0, is_key_object_js_1.default)(key)) {
         return key.export();
@@ -23,7 +23,7 @@ function getPassword(key, alg) {
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, 'deriveBits', 'deriveKey');
-        return crypto_1.KeyObject.from(key).export();
+        return node_crypto_1.KeyObject.from(key).export();
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }

package/dist/node/cjs/runtime/random.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = void 0;
-var crypto_1 = require("crypto");
-Object.defineProperty(exports, "default", { enumerable: true, get: function () { return crypto_1.randomFillSync; } });
+var node_crypto_1 = require("node:crypto");
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return node_crypto_1.randomFillSync; } });

package/dist/node/cjs/runtime/rsaes.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decrypt = exports.encrypt = void 0;
-const crypto_1 = require("crypto");
-const check_modulus_length_js_1 = require("./check_modulus_length.js");
+const node_crypto_1 = require("node:crypto");
+const check_key_length_js_1 = require("./check_key_length.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
@@ -12,7 +12,7 @@ const checkKey = (key, alg) => {
     if (key.asymmetricKeyType !== 'rsa') {
         throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
     }
-    (0, check_modulus_length_js_1.default)(key, alg);
+    (0, check_key_length_js_1.default)(key, alg);
 };
 const resolvePadding = (alg) => {
     switch (alg) {
@@ -20,9 +20,9 @@ const resolvePadding = (alg) => {
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512':
-            return crypto_1.constants.RSA_PKCS1_OAEP_PADDING;
+            return node_crypto_1.constants.RSA_PKCS1_OAEP_PADDING;
         case 'RSA1_5':
-            return crypto_1.constants.RSA_PKCS1_PADDING;
+            return node_crypto_1.constants.RSA_PKCS1_PADDING;
         default:
             return undefined;
     }
@@ -47,7 +47,7 @@ function ensureKeyObject(key, alg, ...usages) {
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, ...usages);
-        return crypto_1.KeyObject.from(key);
+        return node_crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
 }
@@ -56,7 +56,7 @@ const encrypt = (alg, key, cek) => {
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'wrapKey', 'encrypt');
     checkKey(keyObject, alg);
-    return (0, crypto_1.publicEncrypt)({ key: keyObject, oaepHash, padding }, cek);
+    return (0, node_crypto_1.publicEncrypt)({ key: keyObject, oaepHash, padding }, cek);
 };
 exports.encrypt = encrypt;
 const decrypt = (alg, key, encryptedKey) => {
@@ -64,6 +64,6 @@ const decrypt = (alg, key, encryptedKey) => {
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'unwrapKey', 'decrypt');
     checkKey(keyObject, alg);
-    return (0, crypto_1.privateDecrypt)({ key: keyObject, oaepHash, padding }, encryptedKey);
+    return (0, node_crypto_1.privateDecrypt)({ key: keyObject, oaepHash, padding }, encryptedKey);
 };
 exports.decrypt = decrypt;

package/dist/node/cjs/runtime/sign.js

@@ -1,18 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto = require("crypto");
-const util_1 = require("util");
+const crypto = require("node:crypto");
+const node_util_1 = require("node:util");
 const dsa_digest_js_1 = require("./dsa_digest.js");
 const hmac_digest_js_1 = require("./hmac_digest.js");
 const node_key_js_1 = require("./node_key.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-let oneShotSign;
-if (crypto.sign.length > 3) {
-    oneShotSign = (0, util_1.promisify)(crypto.sign);
-}
-else {
-    oneShotSign = crypto.sign;
-}
+const oneShotSign = (0, node_util_1.promisify)(crypto.sign);
 const sign = async (alg, key, data) => {
     const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
     if (alg.startsWith('HS')) {

package/dist/node/cjs/runtime/timing_safe_equal.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
-const timingSafeEqual = crypto_1.timingSafeEqual;
+const node_crypto_1 = require("node:crypto");
+const timingSafeEqual = node_crypto_1.timingSafeEqual;
 exports.default = timingSafeEqual;

package/dist/node/cjs/runtime/verify.js

@@ -1,19 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto = require("crypto");
-const util_1 = require("util");
+const crypto = require("node:crypto");
+const node_util_1 = require("node:util");
 const dsa_digest_js_1 = require("./dsa_digest.js");
 const node_key_js_1 = require("./node_key.js");
 const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-const flags_js_1 = require("./flags.js");
-let oneShotVerify;
-if (crypto.verify.length > 4 && flags_js_1.oneShotCallback) {
-    oneShotVerify = (0, util_1.promisify)(crypto.verify);
-}
-else {
-    oneShotVerify = crypto.verify;
-}
+const oneShotVerify = (0, node_util_1.promisify)(crypto.verify);
 const verify = async (alg, key, signature, data) => {
     const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
     if (alg.startsWith('HS')) {

package/dist/node/cjs/runtime/webcrypto.js

@@ -1,11 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isCryptoKey = void 0;
-const crypto = require("crypto");
-const util = require("util");
+const crypto = require("node:crypto");
+const util = require("node:util");
 const webcrypto = crypto.webcrypto;
 exports.default = webcrypto;
-exports.isCryptoKey = util.types.isCryptoKey
-    ? (key) => util.types.isCryptoKey(key)
-    :
-        (key) => false;
+const isCryptoKey = (key) => util.types.isCryptoKey(key);
+exports.isCryptoKey = isCryptoKey;