jose 5.9.6 → 6.0.0

package/dist/{browser/runtime → webapi/lib}/asn1.js

@@ -1,12 +1,20 @@
-import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
+import invalidKeyInput from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from './base64url.js';
-import formatPEM from '../lib/format_pem.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { types } from './is_key_like.js';
+import { isCryptoKey, isKeyObject } from './is_key_like.js';
+const formatPEM = (b64, descriptor) => {
+    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
+    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
+};
 const genericExport = async (keyType, keyFormat, key) => {
+    if (isKeyObject(key)) {
+        if (key.type !== keyType) {
+            throw new TypeError(`key is not a ${keyType} key`);
+        }
+        return key.export({ format: 'pem', type: keyFormat });
+    }
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types));
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject'));
     }
     if (!key.extractable) {
         throw new TypeError('CryptoKey is not extractable');
@@ -43,16 +51,8 @@ const getNamedCurve = (keyData) => {
             return 'P-384';
         case findOid(keyData, [0x2b, 0x81, 0x04, 0x00, 0x23]):
             return 'P-521';
-        case findOid(keyData, [0x2b, 0x65, 0x6e]):
-            return 'X25519';
-        case findOid(keyData, [0x2b, 0x65, 0x6f]):
-            return 'X448';
-        case findOid(keyData, [0x2b, 0x65, 0x70]):
-            return 'Ed25519';
-        case findOid(keyData, [0x2b, 0x65, 0x71]):
-            return 'Ed448';
         default:
-            throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
+            return undefined;
     }
 };
 const genericImport = async (replace, keyFormat, pem, alg, options) => {
@@ -102,18 +102,19 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
             const namedCurve = getNamedCurve(keyData);
-            algorithm = namedCurve.startsWith('P-') ? { name: 'ECDH', namedCurve } : { name: namedCurve };
+            algorithm = namedCurve?.startsWith('P-') ? { name: 'ECDH', namedCurve } : { name: 'X25519' };
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
         }
+        case 'Ed25519':
         case 'EdDSA':
-            algorithm = { name: getNamedCurve(keyData) };
+            algorithm = { name: 'Ed25519' };
             keyUsages = isPublic ? ['verify'] : ['sign'];
             break;
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? false, keyUsages);
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
 };
 export const fromPKCS8 = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);
@@ -184,7 +185,14 @@ function spkiFromX509(buf) {
     const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
     return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
 }
+let X509Certificate;
 function getSPKI(x509) {
+    if ((X509Certificate ||= globalThis.process?.getBuiltinModule?.('node:crypto')?.X509Certificate)) {
+        try {
+            return new X509Certificate(x509).publicKey.export({ format: 'pem', type: 'spki' });
+        }
+        catch { }
+    }
     const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
     const raw = decodeBase64(pem);
     return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');

package/dist/{browser/runtime → webapi/lib}/base64url.js

@@ -1,5 +1,7 @@
-import { encoder, decoder } from '../lib/buffer_utils.js';
-export const encodeBase64 = (input) => {
+import { encoder, decoder, Buffer } from '../lib/buffer_utils.js';
+export function encodeBase64(input) {
+    if (Buffer)
+        return Buffer.from(input).toString('base64');
     let unencoded = input;
     if (typeof unencoded === 'string') {
         unencoded = encoder.encode(unencoded);
@@ -10,23 +12,29 @@ export const encodeBase64 = (input) => {
         arr.push(String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE)));
     }
     return btoa(arr.join(''));
-};
-export const encode = (input) => {
+}
+export function encode(input) {
+    if (Buffer)
+        return Buffer.from(input).toString('base64url');
     return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-};
-export const decodeBase64 = (encoded) => {
+}
+export function decodeBase64(encoded) {
+    if (Buffer)
+        return Buffer.from(encoded, 'base64');
     const binary = atob(encoded);
     const bytes = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i++) {
         bytes[i] = binary.charCodeAt(i);
     }
     return bytes;
-};
-export const decode = (input) => {
+}
+export function decode(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
         encoded = decoder.decode(encoded);
     }
+    if (Buffer)
+        return Buffer.from(encoded, 'base64url');
     encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
     try {
         return decodeBase64(encoded);
@@ -34,4 +42,4 @@ export const decode = (input) => {
     catch {
         throw new TypeError('The input to be decoded is not correctly encoded.');
     }
-};
+}

package/dist/{browser → webapi}/lib/buffer_utils.js

@@ -1,8 +1,11 @@
-import digest from '../runtime/digest.js';
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
+const Buffer = globalThis.process?.getBuiltinModule?.('node:buffer')?.Buffer;
+export { Buffer };
 export function concat(...buffers) {
+    if (Buffer)
+        return Buffer.concat(buffers);
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
@@ -12,9 +15,6 @@ export function concat(...buffers) {
     }
     return buf;
 }
-export function p2s(alg, p2sInput) {
-    return concat(encoder.encode(alg), new Uint8Array([0]), p2sInput);
-}
 function writeUInt32BE(buf, value, offset) {
     if (value < 0 || value >= MAX_INT32) {
         throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
@@ -34,18 +34,3 @@ export function uint32be(value) {
     writeUInt32BE(buf, value);
     return buf;
 }
-export function lengthAndInput(input) {
-    return concat(uint32be(input.length), input);
-}
-export async function concatKdf(secret, bits, value) {
-    const iterations = Math.ceil((bits >> 3) / 32);
-    const res = new Uint8Array(iterations * 32);
-    for (let iter = 0; iter < iterations; iter++) {
-        const buf = new Uint8Array(4 + secret.length + value.length);
-        buf.set(uint32be(iter + 1));
-        buf.set(secret, 4);
-        buf.set(value, 4 + secret.length);
-        res.set(await digest('sha256', buf), iter * 32);
-    }
-    return res.slice(0, bits >> 3);
-}

package/dist/{browser → webapi}/lib/cek.js

@@ -1,5 +1,4 @@
 import { JOSENotSupported } from '../util/errors.js';
-import random from '../runtime/random.js';
 export function bitLength(alg) {
     switch (alg) {
         case 'A128GCM':
@@ -17,4 +16,4 @@ export function bitLength(alg) {
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
 }
-export default (alg) => random(new Uint8Array(bitLength(alg) >> 3));
+export default (alg) => crypto.getRandomValues(new Uint8Array(bitLength(alg) >> 3));

package/dist/{browser/runtime → webapi/lib}/check_cek_length.js

@@ -1,8 +1,7 @@
 import { JWEInvalid } from '../util/errors.js';
-const checkCekLength = (cek, expected) => {
+export default (cek, expected) => {
     const actual = cek.byteLength << 3;
     if (actual !== expected) {
         throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
     }
 };
-export default checkCekLength;

package/dist/{browser → webapi}/lib/check_iv_length.js

@@ -1,8 +1,7 @@
 import { JWEInvalid } from '../util/errors.js';
 import { bitLength } from './iv.js';
-const checkIvLength = (enc, iv) => {
+export default (enc, iv) => {
     if (iv.length << 3 !== bitLength(enc)) {
         throw new JWEInvalid('Invalid Initialization Vector length');
     }
 };
-export default checkIvLength;

package/dist/webapi/lib/check_key_type.js

@@ -0,0 +1,126 @@
+import { withAlg as invalidKeyInput } from './invalid_key_input.js';
+import isKeyLike from './is_key_like.js';
+import * as jwk from './is_jwk.js';
+const tag = (key) => key?.[Symbol.toStringTag];
+const jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== undefined) {
+        let expected;
+        switch (usage) {
+            case 'sign':
+            case 'verify':
+                expected = 'sig';
+                break;
+            case 'encrypt':
+            case 'decrypt':
+                expected = 'enc';
+                break;
+        }
+        if (key.use !== expected) {
+            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+        }
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+    }
+    if (Array.isArray(key.key_ops)) {
+        let expectedKeyOp;
+        switch (true) {
+            case usage === 'sign' || usage === 'verify':
+            case alg === 'dir':
+            case alg.includes('CBC-HS'):
+                expectedKeyOp = usage;
+                break;
+            case alg.startsWith('PBES2'):
+                expectedKeyOp = 'deriveBits';
+                break;
+            case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
+                if (!alg.includes('GCM') && alg.endsWith('KW')) {
+                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';
+                }
+                else {
+                    expectedKeyOp = usage;
+                }
+                break;
+            case usage === 'encrypt' && alg.startsWith('RSA'):
+                expectedKeyOp = 'wrapKey';
+                break;
+            case usage === 'decrypt':
+                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';
+                break;
+        }
+        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
+            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+        }
+    }
+    return true;
+};
+const symmetricTypeCheck = (alg, key, usage) => {
+    if (key instanceof Uint8Array)
+        return;
+    if (jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));
+    }
+    if (key.type !== 'secret') {
+        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    }
+};
+const asymmetricTypeCheck = (alg, key, usage) => {
+    if (jwk.isJWK(key)) {
+        switch (usage) {
+            case 'decrypt':
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+            case 'encrypt':
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+        }
+    }
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+    }
+    if (key.type === 'secret') {
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+    }
+    if (key.type === 'public') {
+        switch (usage) {
+            case 'sign':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+            case 'decrypt':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+            default:
+                break;
+        }
+    }
+    if (key.type === 'private') {
+        switch (usage) {
+            case 'verify':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+            case 'encrypt':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+            default:
+                break;
+        }
+    }
+};
+export default (alg, key, usage) => {
+    const symmetric = alg.startsWith('HS') ||
+        alg === 'dir' ||
+        alg.startsWith('PBES2') ||
+        /^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(alg) ||
+        /^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(alg);
+    if (symmetric) {
+        symmetricTypeCheck(alg, key, usage);
+    }
+    else {
+        asymmetricTypeCheck(alg, key, usage);
+    }
+};

package/dist/{node/esm → webapi}/lib/crypto_key.js

@@ -19,23 +19,12 @@ function getNamedCurve(alg) {
             throw new Error('unreachable');
     }
 }
-function checkUsage(key, usages) {
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
+function checkUsage(key, usage) {
+    if (usage && !key.usages.includes(usage)) {
+        throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
     }
 }
-export function checkSigCryptoKey(key, alg, ...usages) {
+export function checkSigCryptoKey(key, alg, usage) {
     switch (alg) {
         case 'HS256':
         case 'HS384':
@@ -70,10 +59,10 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
+        case 'Ed25519':
         case 'EdDSA': {
-            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                throw unusable('Ed25519 or Ed448');
-            }
+            if (!isAlgorithm(key.algorithm, 'Ed25519'))
+                throw unusable('Ed25519');
             break;
         }
         case 'ES256':
@@ -90,9 +79,9 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         default:
             throw new TypeError('CryptoKey does not support this operation');
     }
-    checkUsage(key, usages);
+    checkUsage(key, usage);
 }
-export function checkEncCryptoKey(key, alg, ...usages) {
+export function checkEncCryptoKey(key, alg, usage) {
     switch (alg) {
         case 'A128GCM':
         case 'A192GCM':
@@ -120,10 +109,9 @@ export function checkEncCryptoKey(key, alg, ...usages) {
             switch (key.algorithm.name) {
                 case 'ECDH':
                 case 'X25519':
-                case 'X448':
                     break;
                 default:
-                    throw unusable('ECDH, X25519, or X448');
+                    throw unusable('ECDH or X25519');
             }
             break;
         }
@@ -148,5 +136,5 @@ export function checkEncCryptoKey(key, alg, ...usages) {
         default:
             throw new TypeError('CryptoKey does not support this operation');
     }
-    checkUsage(key, usages);
+    checkUsage(key, usage);
 }

package/dist/{browser/runtime → webapi/lib}/decrypt.js

@@ -1,12 +1,29 @@
-import { concat, uint64be } from '../lib/buffer_utils.js';
-import checkIvLength from '../lib/check_iv_length.js';
+import { concat, uint64be } from './buffer_utils.js';
+import checkIvLength from './check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
-import timingSafeEqual from './timing_safe_equal.js';
 import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
+import { checkEncCryptoKey } from './crypto_key.js';
+import invalidKeyInput from './invalid_key_input.js';
+import { isCryptoKey } from './is_key_like.js';
+let timingSafeEqual = globalThis.process?.getBuiltinModule?.('node:crypto')?.timingSafeEqual;
+timingSafeEqual ||= (a, b) => {
+    if (!(a instanceof Uint8Array)) {
+        throw new TypeError('First argument must be a buffer');
+    }
+    if (!(b instanceof Uint8Array)) {
+        throw new TypeError('Second argument must be a buffer');
+    }
+    if (a.length !== b.length) {
+        throw new TypeError('Input buffers must have the same length');
+    }
+    const len = a.length;
+    let out = 0;
+    let i = -1;
+    while (++i < len) {
+        out |= a[i] ^ b[i];
+    }
+    return out === 0;
+};
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
@@ -60,9 +77,9 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new JWEDecryptionFailed();
     }
 }
-const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
+export default async (enc, cek, ciphertext, iv, tag, aad) => {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'KeyObject', 'Uint8Array', 'JSON Web Key'));
     }
     if (!iv) {
         throw new JWEInvalid('JWE Initialization Vector missing');
@@ -88,4 +105,3 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
             throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
-export default decrypt;

package/dist/{node/esm → webapi}/lib/decrypt_key_management.js

@@ -1,18 +1,15 @@
-import { unwrap as aesKw } from '../runtime/aeskw.js';
-import * as ECDH from '../runtime/ecdhes.js';
-import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
-import { decrypt as rsaEs } from '../runtime/rsaes.js';
-import { decode as base64url } from '../runtime/base64url.js';
-import normalize from '../runtime/normalize_key.js';
+import * as aeskw from './aeskw.js';
+import * as ecdhes from './ecdhes.js';
+import * as pbes2kw from './pbes2kw.js';
+import * as rsaes from './rsaes.js';
+import * as base64url from '../lib/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
-import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
-    checkKeyType(alg, key, 'decrypt');
-    key = (await normalize.normalizePrivateKey?.(key, alg)) || key;
+import { assertCryptoKey } from './is_key_like.js';
+export default async (alg, key, encryptedKey, joseHeader, options) => {
     switch (alg) {
         case 'dir': {
             if (encryptedKey !== undefined)
@@ -27,16 +24,18 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
         case 'ECDH-ES+A256KW': {
             if (!isObject(joseHeader.epk))
                 throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
-            if (!ECDH.ecdhAllowed(key))
+            assertCryptoKey(key);
+            if (!ecdhes.allowed(key))
                 throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
             const epk = await importJWK(joseHeader.epk, alg);
+            assertCryptoKey(epk);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined) {
                 if (typeof joseHeader.apu !== 'string')
                     throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
                 try {
-                    partyUInfo = base64url(joseHeader.apu);
+                    partyUInfo = base64url.decode(joseHeader.apu);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apu');
@@ -46,27 +45,27 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 if (typeof joseHeader.apv !== 'string')
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 try {
-                    partyVInfo = base64url(joseHeader.apv);
+                    partyVInfo = base64url.decode(joseHeader.apv);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apv');
                 }
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+            const sharedSecret = await ecdhes.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)
                 throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg.slice(-6), sharedSecret, encryptedKey);
+            return aeskw.unwrap(alg.slice(-6), sharedSecret, encryptedKey);
         }
-        case 'RSA1_5':
         case 'RSA-OAEP':
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
             if (encryptedKey === undefined)
                 throw new JWEInvalid('JWE Encrypted Key missing');
-            return rsaEs(alg, key, encryptedKey);
+            assertCryptoKey(key);
+            return rsaes.decrypt(alg, key, encryptedKey);
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
@@ -82,19 +81,19 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             let p2s;
             try {
-                p2s = base64url(joseHeader.p2s);
+                p2s = base64url.decode(joseHeader.p2s);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the p2s');
             }
-            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
+            return pbes2kw.unwrap(alg, key, encryptedKey, joseHeader.p2c, p2s);
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
             if (encryptedKey === undefined)
                 throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg, key, encryptedKey);
+            return aeskw.unwrap(alg, key, encryptedKey);
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
@@ -107,14 +106,14 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
             let iv;
             try {
-                iv = base64url(joseHeader.iv);
+                iv = base64url.decode(joseHeader.iv);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the iv');
             }
             let tag;
             try {
-                tag = base64url(joseHeader.tag);
+                tag = base64url.decode(joseHeader.tag);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the tag');
@@ -125,5 +124,4 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
-}
-export default decryptKeyManagement;
+};

package/dist/{browser/runtime → webapi/lib}/digest.js

@@ -1,6 +1,4 @@
-import crypto from './webcrypto.js';
-const digest = async (algorithm, data) => {
+export default async (algorithm, data) => {
     const subtleDigest = `SHA-${algorithm.slice(-3)}`;
     return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
 };
-export default digest;

package/dist/webapi/lib/ecdhes.js

@@ -0,0 +1,46 @@
+import { encoder, concat, uint32be } from './buffer_utils.js';
+import { checkEncCryptoKey } from './crypto_key.js';
+import digest from './digest.js';
+function lengthAndInput(input) {
+    return concat(uint32be(input.length), input);
+}
+async function concatKdf(secret, bits, value) {
+    const iterations = Math.ceil((bits >> 3) / 32);
+    const res = new Uint8Array(iterations * 32);
+    for (let iter = 0; iter < iterations; iter++) {
+        const buf = new Uint8Array(4 + secret.length + value.length);
+        buf.set(uint32be(iter + 1));
+        buf.set(secret, 4);
+        buf.set(value, 4 + secret.length);
+        res.set(await digest('sha256', buf), iter * 32);
+    }
+    return res.slice(0, bits >> 3);
+}
+export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+    checkEncCryptoKey(publicKey, 'ECDH');
+    checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
+    const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+    let length;
+    if (publicKey.algorithm.name === 'X25519') {
+        length = 256;
+    }
+    else {
+        length =
+            Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3;
+    }
+    const sharedSecret = new Uint8Array(await crypto.subtle.deriveBits({
+        name: publicKey.algorithm.name,
+        public: publicKey,
+    }, privateKey, length));
+    return concatKdf(sharedSecret, keyLength, value);
+}
+export function allowed(key) {
+    switch (key.algorithm.namedCurve) {
+        case 'P-256':
+        case 'P-384':
+        case 'P-521':
+            return true;
+        default:
+            return key.algorithm.name === 'X25519';
+    }
+}