jose 4.3.5 → 4.3.9

package/dist/node/cjs/runtime/aeskw.js

@@ -5,7 +5,6 @@ const buffer_1 = require("buffer");
 const crypto_1 = require("crypto");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const secret_key_js_1 = require("./secret_key.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
@@ -13,7 +12,7 @@ const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function checkKeySize(key, alg) {
-    if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
+    if (key.symmetricKeySize << 3 !== parseInt(alg.slice(1, 4), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
@@ -22,7 +21,7 @@ function ensureKeyObject(key, alg, usage) {
         return key;
     }
     if (key instanceof Uint8Array) {
-        return (0, secret_key_js_1.default)(key);
+        return (0, crypto_1.createSecretKey)(key);
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
@@ -31,7 +30,7 @@ function ensureKeyObject(key, alg, usage) {
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }
 const wrap = (alg, key, cek) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
@@ -43,7 +42,7 @@ const wrap = (alg, key, cek) => {
 };
 exports.wrap = wrap;
 const unwrap = (alg, key, encryptedKey) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/node/cjs/runtime/check_cek_length.js

@@ -8,12 +8,12 @@ const checkCekLength = (enc, cek) => {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            expected = parseInt(enc.substr(-3), 10);
+            expected = parseInt(enc.slice(-3), 10);
             break;
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            expected = parseInt(enc.substr(1, 3), 10);
+            expected = parseInt(enc.slice(1, 4), 10);
             break;
         default:
             throw new errors_js_1.JOSENotSupported(`Content Encryption Algorithm ${enc} is not supported either by JOSE or your javascript runtime`);

package/dist/node/cjs/runtime/decrypt.js

@@ -14,13 +14,13 @@ const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if ((0, is_key_object_js_1.default)(cek)) {
         cek = cek.export();
     }
     const encKey = cek.subarray(keySize >> 3);
     const macKey = cek.subarray(0, keySize >> 3);
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const algorithm = `aes-${keySize}-cbc`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
@@ -48,7 +48,7 @@ function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/cjs/runtime/ecdhes.js

@@ -13,7 +13,7 @@ const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 const generateKeyPair = (0, util_1.promisify)(crypto_1.generateKeyPair);
-const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
     let publicKey;
     if ((0, webcrypto_js_1.isCryptoKey)(publicKee)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(publicKee, 'ECDH-ES');
@@ -39,9 +39,9 @@ const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8A
     const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
     const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
     return (0, buffer_utils_js_1.concatKdf)(digest_js_1.default, sharedSecret, keyLength, value);
-};
+}
 exports.deriveKey = deriveKey;
-const generateEpk = async (kee) => {
+async function generateEpk(kee) {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
         key = crypto_1.KeyObject.from(kee);
@@ -54,18 +54,18 @@ const generateEpk = async (kee) => {
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
-            return (await generateKeyPair('x25519')).privateKey;
+            return generateKeyPair('x25519');
         case 'x448': {
-            return (await generateKeyPair('x448')).privateKey;
+            return generateKeyPair('x448');
         }
         case 'ec': {
             const namedCurve = (0, get_named_curve_js_1.default)(key);
-            return (await generateKeyPair('ec', { namedCurve })).privateKey;
+            return generateKeyPair('ec', { namedCurve });
         }
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported EPK');
     }
-};
+}
 exports.generateEpk = generateEpk;
 const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes((0, get_named_curve_js_1.default)(key));
 exports.ecdhAllowed = ecdhAllowed;

package/dist/node/cjs/runtime/encrypt.js

@@ -13,7 +13,7 @@ const errors_js_1 = require("../util/errors.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if ((0, is_key_object_js_1.default)(cek)) {
         cek = cek.export();
     }
@@ -25,12 +25,12 @@ function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     }
     const cipher = (0, crypto_1.createCipheriv)(algorithm, encKey, iv);
     const ciphertext = (0, buffer_utils_js_1.concat)(cipher.update(plaintext), cipher.final());
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const tag = (0, cbc_tag_js_1.default)(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
 function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/cjs/runtime/generate.js

@@ -16,7 +16,7 @@ async function generateSecret(alg, options) {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            length = parseInt(alg.substr(-3), 10);
+            length = parseInt(alg.slice(-3), 10);
             break;
         case 'A128KW':
         case 'A192KW':
@@ -27,7 +27,7 @@ async function generateSecret(alg, options) {
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            length = parseInt(alg.substring(1, 4), 10);
+            length = parseInt(alg.slice(1, 4), 10);
             break;
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');

package/dist/node/cjs/runtime/get_named_curve.js

@@ -45,10 +45,10 @@ const getNamedCurve = (kee, raw) => {
     switch (key.asymmetricKeyType) {
         case 'ed25519':
         case 'ed448':
-            return `Ed${key.asymmetricKeyType.substr(2)}`;
+            return `Ed${key.asymmetricKeyType.slice(2)}`;
         case 'x25519':
         case 'x448':
-            return `X${key.asymmetricKeyType.substr(1)}`;
+            return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
             if (exports.weakMap.has(key)) {
                 return exports.weakMap.get(key);

package/dist/node/cjs/runtime/get_sign_verify_key.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
-const secret_key_js_1 = require("./secret_key.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function getSignVerifyKey(alg, key, usage) {
@@ -11,7 +10,7 @@ function getSignVerifyKey(alg, key, usage) {
         if (!alg.startsWith('HS')) {
             throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
         }
-        return (0, secret_key_js_1.default)(key);
+        return (0, crypto_1.createSecretKey)(key);
     }
     if (key instanceof crypto_1.KeyObject) {
         return key;

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -8,7 +8,7 @@ const get_named_curve_js_1 = require("./get_named_curve.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const asn1_sequence_encoder_js_1 = require("./asn1_sequence_encoder.js");
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -10,7 +10,7 @@ const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);

package/dist/node/cjs/runtime/node_key.js

@@ -5,10 +5,11 @@ const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
-const rsaPssParams = major >= 17 || (major === 16 && minor >= 9);
+const electron = 'electron' in process.versions;
+const rsaPssParams = !electron && (major >= 17 || (major === 16 && minor >= 9));
 const PSS = {
     padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
     saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
@@ -39,7 +40,7 @@ function keyForCrypto(alg, key) {
         case rsaPssParams && 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
-                const length = parseInt(alg.substr(-3), 10);
+                const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);

package/dist/node/cjs/runtime/pbes2kw.js

@@ -30,19 +30,19 @@ function getPassword(key, alg) {
 const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = (0, random_js_1.default)(new Uint8Array(16))) => {
     (0, check_p2s_js_1.default)(p2s);
     const salt = (0, buffer_utils_js_1.p2s)(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
+    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
     const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    const encryptedKey = await (0, aeskw_js_1.wrap)(alg.substr(-6), derivedKey, cek);
+    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
+    const encryptedKey = await (0, aeskw_js_1.wrap)(alg.slice(-6), derivedKey, cek);
     return { encryptedKey, p2c, p2s: (0, base64url_js_1.encode)(p2s) };
 };
 exports.encrypt = encrypt;
 const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
     (0, check_p2s_js_1.default)(p2s);
     const salt = (0, buffer_utils_js_1.p2s)(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
+    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
     const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    return (0, aeskw_js_1.unwrap)(alg.substr(-6), derivedKey, encryptedKey);
+    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
+    return (0, aeskw_js_1.unwrap)(alg.slice(-6), derivedKey, encryptedKey);
 };
 exports.decrypt = decrypt;

package/dist/node/cjs/runtime/verify.js

@@ -7,7 +7,7 @@ const node_key_js_1 = require("./node_key.js");
 const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);

package/dist/node/esm/jwks/remote.js

@@ -3,7 +3,7 @@ import { importJWK } from '../key/import.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
 import isObject from '../lib/is_object.js';
 function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.substr(0, 2)) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
         case 'RS':
         case 'PS':
             return 'RSA';

package/dist/node/esm/lib/aesgcmkw.js

@@ -3,12 +3,12 @@ import decrypt from '../runtime/decrypt.js';
 import generateIv from './iv.js';
 import { encode as base64url } from '../runtime/base64url.js';
 export async function wrap(alg, key, cek, iv) {
-    const jweAlgorithm = alg.substr(0, 7);
+    const jweAlgorithm = alg.slice(0, 7);
     iv || (iv = generateIv(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: base64url(iv), tag: base64url(tag) };
 }
 export async function unwrap(alg, key, encryptedKey, iv, tag) {
-    const jweAlgorithm = alg.substr(0, 7);
+    const jweAlgorithm = alg.slice(0, 7);
     return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
 }

package/dist/node/esm/lib/crypto_key.js

@@ -6,7 +6,7 @@ function isAlgorithm(algorithm, name) {
     return algorithm.name === name;
 }
 function getHashLength(hash) {
-    return parseInt(hash.name.substr(4), 10);
+    return parseInt(hash.name.slice(4), 10);
 }
 function getNamedCurve(alg) {
     switch (alg) {
@@ -43,7 +43,7 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         case 'HS512': {
             if (!isAlgorithm(key.algorithm, 'HMAC'))
                 throw unusable('HMAC');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -54,7 +54,7 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         case 'RS512': {
             if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
                 throw unusable('RSASSA-PKCS1-v1_5');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -65,7 +65,7 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         case 'PS512': {
             if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
                 throw unusable('RSA-PSS');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -104,7 +104,7 @@ export function checkEncCryptoKey(key, alg, ...usages) {
         case 'A256GCM': {
             if (!isAlgorithm(key.algorithm, 'AES-GCM'))
                 throw unusable('AES-GCM');
-            const expected = parseInt(alg.substr(1, 3), 10);
+            const expected = parseInt(alg.slice(1, 4), 10);
             const actual = key.algorithm.length;
             if (actual !== expected)
                 throw unusable(expected, 'algorithm.length');
@@ -115,7 +115,7 @@ export function checkEncCryptoKey(key, alg, ...usages) {
         case 'A256KW': {
             if (!isAlgorithm(key.algorithm, 'AES-KW'))
                 throw unusable('AES-KW');
-            const expected = parseInt(alg.substr(1, 3), 10);
+            const expected = parseInt(alg.slice(1, 4), 10);
             const actual = key.algorithm.length;
             if (actual !== expected)
                 throw unusable(expected, 'algorithm.length');
@@ -137,7 +137,7 @@ export function checkEncCryptoKey(key, alg, ...usages) {
         case 'RSA-OAEP-512': {
             if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
                 throw unusable('RSA-OAEP');
-            const expected = parseInt(alg.substr(9), 10) || 1;
+            const expected = parseInt(alg.slice(9), 10) || 1;
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');

package/dist/node/esm/lib/decrypt_key_management.js

@@ -40,12 +40,12 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = base64url(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.substr(-5, 3), 10), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)
                 throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg.substr(-6), sharedSecret, encryptedKey);
+            return aesKw(alg.slice(-6), sharedSecret, encryptedKey);
         }
         case 'RSA1_5':
         case 'RSA-OAEP':

package/dist/node/esm/lib/encrypt_key_management.js

@@ -27,10 +27,12 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             }
             const { apu, apv } = providedParameters;
             let { epk: ephemeralKey } = providedParameters;
-            ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
+            ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.substr(-5, 3), 10), apu, apv);
-            parameters = { epk: { x, y, crv, kty } };
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
             if (apu)
                 parameters.apu = base64url(apu);
             if (apv)
@@ -40,7 +42,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
                 break;
             }
             cek = providedCek || generateCek(enc);
-            const kwAlg = alg.substr(-6);
+            const kwAlg = alg.slice(-6);
             encryptedKey = await aesKw(kwAlg, sharedSecret, cek);
             break;
         }

package/dist/node/esm/runtime/aeskw.js

@@ -1,8 +1,7 @@
 import { Buffer } from 'buffer';
-import { KeyObject, createDecipheriv, createCipheriv } from 'crypto';
+import { KeyObject, createDecipheriv, createCipheriv, createSecretKey } from 'crypto';
 import { JOSENotSupported } from '../util/errors.js';
 import { concat } from '../lib/buffer_utils.js';
-import getSecretKey from './secret_key.js';
 import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
@@ -10,7 +9,7 @@ import invalidKeyInput from '../lib/invalid_key_input.js';
 import supported from './ciphers.js';
 import { types } from './is_key_like.js';
 function checkKeySize(key, alg) {
-    if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
+    if (key.symmetricKeySize << 3 !== parseInt(alg.slice(1, 4), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
@@ -19,7 +18,7 @@ function ensureKeyObject(key, alg, usage) {
         return key;
     }
     if (key instanceof Uint8Array) {
-        return getSecretKey(key);
+        return createSecretKey(key);
     }
     if (isCryptoKey(key)) {
         checkEncCryptoKey(key, alg, usage);
@@ -28,7 +27,7 @@ function ensureKeyObject(key, alg, usage) {
     throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 export const wrap = (alg, key, cek) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
@@ -39,7 +38,7 @@ export const wrap = (alg, key, cek) => {
     return concat(cipher.update(cek), cipher.final());
 };
 export const unwrap = (alg, key, encryptedKey) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/node/esm/runtime/check_cek_length.js

@@ -6,12 +6,12 @@ const checkCekLength = (enc, cek) => {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            expected = parseInt(enc.substr(-3), 10);
+            expected = parseInt(enc.slice(-3), 10);
             break;
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            expected = parseInt(enc.substr(1, 3), 10);
+            expected = parseInt(enc.slice(1, 4), 10);
             break;
         default:
             throw new JOSENotSupported(`Content Encryption Algorithm ${enc} is not supported either by JOSE or your javascript runtime`);

package/dist/node/esm/runtime/decrypt.js

@@ -12,13 +12,13 @@ import invalidKeyInput from '../lib/invalid_key_input.js';
 import supported from './ciphers.js';
 import { types } from './is_key_like.js';
 function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
     }
     const encKey = cek.subarray(keySize >> 3);
     const macKey = cek.subarray(0, keySize >> 3);
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const algorithm = `aes-${keySize}-cbc`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
@@ -46,7 +46,7 @@ function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/esm/runtime/ecdhes.js

@@ -10,7 +10,7 @@ import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 const generateKeyPair = promisify(generateKeyPairCb);
-export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+export async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
     let publicKey;
     if (isCryptoKey(publicKee)) {
         checkEncCryptoKey(publicKee, 'ECDH-ES');
@@ -36,8 +36,8 @@ export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
     return concatKdf(digest, sharedSecret, keyLength, value);
-};
-export const generateEpk = async (kee) => {
+}
+export async function generateEpk(kee) {
     let key;
     if (isCryptoKey(kee)) {
         key = KeyObject.from(kee);
@@ -50,16 +50,16 @@ export const generateEpk = async (kee) => {
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
-            return (await generateKeyPair('x25519')).privateKey;
+            return generateKeyPair('x25519');
         case 'x448': {
-            return (await generateKeyPair('x448')).privateKey;
+            return generateKeyPair('x448');
         }
         case 'ec': {
             const namedCurve = getNamedCurve(key);
-            return (await generateKeyPair('ec', { namedCurve })).privateKey;
+            return generateKeyPair('ec', { namedCurve });
         }
         default:
             throw new JOSENotSupported('Invalid or unsupported EPK');
     }
-};
+}
 export const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes(getNamedCurve(key));

package/dist/node/esm/runtime/encrypt.js

@@ -11,7 +11,7 @@ import { JOSENotSupported } from '../util/errors.js';
 import supported from './ciphers.js';
 import { types } from './is_key_like.js';
 function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
     }
@@ -23,12 +23,12 @@ function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     }
     const cipher = createCipheriv(algorithm, encKey, iv);
     const ciphertext = concat(cipher.update(plaintext), cipher.final());
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const tag = cbcTag(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
 function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/esm/runtime/generate.js

@@ -13,7 +13,7 @@ export async function generateSecret(alg, options) {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            length = parseInt(alg.substr(-3), 10);
+            length = parseInt(alg.slice(-3), 10);
             break;
         case 'A128KW':
         case 'A192KW':
@@ -24,7 +24,7 @@ export async function generateSecret(alg, options) {
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            length = parseInt(alg.substring(1, 4), 10);
+            length = parseInt(alg.slice(1, 4), 10);
             break;
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');

package/dist/node/esm/runtime/get_named_curve.js

@@ -42,10 +42,10 @@ const getNamedCurve = (kee, raw) => {
     switch (key.asymmetricKeyType) {
         case 'ed25519':
         case 'ed448':
-            return `Ed${key.asymmetricKeyType.substr(2)}`;
+            return `Ed${key.asymmetricKeyType.slice(2)}`;
         case 'x25519':
         case 'x448':
-            return `X${key.asymmetricKeyType.substr(1)}`;
+            return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
             if (weakMap.has(key)) {
                 return weakMap.get(key);

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -1,7 +1,6 @@
-import { KeyObject } from 'crypto';
+import { KeyObject, createSecretKey } from 'crypto';
 import { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
-import getSecretKey from './secret_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 export default function getSignVerifyKey(alg, key, usage) {
@@ -9,7 +8,7 @@ export default function getSignVerifyKey(alg, key, usage) {
         if (!alg.startsWith('HS')) {
             throw new TypeError(invalidKeyInput(key, ...types));
         }
-        return getSecretKey(key);
+        return createSecretKey(key);
     }
     if (key instanceof KeyObject) {
         return key;

package/dist/node/esm/runtime/jwk_to_key.js

@@ -6,7 +6,7 @@ import { setCurve } from './get_named_curve.js';
 import { setModulusLength } from './check_modulus_length.js';
 import Asn1SequenceEncoder from './asn1_sequence_encoder.js';
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);