jose 6.0.13 → 6.1.0

package/dist/types/types.d.ts

@@ -35,11 +35,25 @@ export interface JWK_OKP_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private OKP JSON Web Keys */
-export interface JWK_OKP_Private extends JWK_OKP_Public, JWKParameters {
+export interface JWK_OKP_Private extends JWK_OKP_Public {
   /** OKP JWK "d" (The Private Key) Parameter */
   d: string
 }
 
+/** Convenience interface for Public AKP JSON Web Keys */
+export interface JWK_AKP_Public extends JWKParameters {
+  /** JWK "alg" (Algorithm) Parameter */
+  alg: string
+  /** AKP JWK "pub" (The Public key) Parameter */
+  pub: string
+}
+
+/** Convenience interface for Private AKP JSON Web Keys */
+export interface JWK_AKP_Private extends JWK_AKP_Public {
+  /** AKP JWK "priv" (The Private Key) Parameter */
+  priv: string
+}
+
 /** Convenience interface for Public EC JSON Web Keys */
 export interface JWK_EC_Public extends JWKParameters {
   /** EC JWK "crv" (Curve) Parameter */
@@ -51,7 +65,7 @@ export interface JWK_EC_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private EC JSON Web Keys */
-export interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
+export interface JWK_EC_Private extends JWK_EC_Public {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string
 }
@@ -65,7 +79,7 @@ export interface JWK_RSA_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private RSA JSON Web Keys */
-export interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
+export interface JWK_RSA_Private extends JWK_RSA_Public {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string
   /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -87,9 +101,11 @@ export interface JWK_oct extends JWKParameters {
 }
 
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
- * key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", "AKP", and
+ * "oct" key types are supported.
  *
+ * @see {@link JWK_AKP_Public}
+ * @see {@link JWK_AKP_Private}
  * @see {@link JWK_OKP_Public}
  * @see {@link JWK_OKP_Private}
  * @see {@link JWK_EC_Public}
@@ -133,6 +149,10 @@ export interface JWK extends JWKParameters {
   x?: string
   /** EC JWK "y" (Y Coordinate) Parameter */
   y?: string
+  /** AKP JWK "pub" (Public Key) Parameter */
+  pub?: string
+  /** AKP JWK "priv" (Private key) Parameter */
+  priv?: string
 }
 
 /**
@@ -251,7 +271,7 @@ export interface JoseHeaderParameters {
   jku?: string
 
   /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n'>
+  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n' | 'alg' | 'pub'>
 
   /** "typ" (Type) Header Parameter */
   typ?: string

package/dist/webapi/jwk/thumbprint.js

@@ -30,6 +30,11 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
     }
     let components;
     switch (jwk.kty) {
+        case 'AKP':
+            check(jwk.alg, '"alg" (Algorithm) Parameter');
+            check(jwk.pub, '"pub" (Public key) Parameter');
+            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+            break;
         case 'EC':
             check(jwk.crv, '"crv" (Curve) Parameter');
             check(jwk.x, '"x" (X Coordinate) Parameter');

package/dist/webapi/jwks/local.js

@@ -10,6 +10,8 @@ function getKtyFromAlg(alg) {
             return 'EC';
         case 'Ed':
             return 'OKP';
+        case 'ML':
+            return 'AKP';
         default:
             throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
     }
@@ -43,7 +45,7 @@ class LocalJWKSet {
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
             }
-            if (candidate && typeof jwk.alg === 'string') {
+            if (candidate && (typeof jwk.alg === 'string' || kty === 'AKP')) {
                 candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.13';
+    const VERSION = 'v6.1.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/key/generate_key_pair.js

@@ -62,6 +62,13 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'Ed25519' };
             break;
         }
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87': {
+            keyUsages = ['sign', 'verify'];
+            algorithm = { name: alg };
+            break;
+        }
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':

package/dist/webapi/key/import.js

@@ -38,6 +38,16 @@ export async function importJWK(jwk, alg, options) {
             if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
+            return toCryptoKey({ ...jwk, alg, ext });
+        case 'AKP': {
+            if (typeof jwk.alg !== 'string' || !jwk.alg) {
+                throw new TypeError('missing "alg" (Algorithm) Parameter value');
+            }
+            if (alg !== undefined && alg !== jwk.alg) {
+                throw new TypeError('JWK alg and alg option value mismatch');
+            }
+            return toCryptoKey({ ...jwk, ext });
+        }
         case 'EC':
         case 'OKP':
             return toCryptoKey({ ...jwk, alg, ext });

package/dist/webapi/lib/asn1.js

@@ -174,6 +174,12 @@ const genericImport = async (keyFormat, keyData, alg, options) => {
             algorithm = { name: 'Ed25519' };
             keyUsages = getSigUsages();
             break;
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87':
+            algorithm = { name: alg };
+            keyUsages = getSigUsages();
+            break;
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }

package/dist/webapi/lib/crypto_key.js

@@ -65,6 +65,13 @@ export function checkSigCryptoKey(key, alg, usage) {
                 throw unusable('Ed25519');
             break;
         }
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87': {
+            if (!isAlgorithm(key.algorithm, alg))
+                throw unusable(alg);
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/webapi/lib/is_jwk.js

@@ -3,10 +3,11 @@ export function isJWK(key) {
     return isObject(key) && typeof key.kty === 'string';
 }
 export function isPrivateJWK(key) {
-    return key.kty !== 'oct' && typeof key.d === 'string';
+    return (key.kty !== 'oct' &&
+        ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string'));
 }
 export function isPublicJWK(key) {
-    return key.kty !== 'oct' && typeof key.d === 'undefined';
+    return key.kty !== 'oct' && typeof key.d === 'undefined' && typeof key.priv === 'undefined';
 }
 export function isSecretJWK(key) {
     return key.kty === 'oct' && typeof key.k === 'string';

package/dist/webapi/lib/jwk_to_key.js

@@ -3,6 +3,19 @@ function subtleMapping(jwk) {
     let algorithm;
     let keyUsages;
     switch (jwk.kty) {
+        case 'AKP': {
+            switch (jwk.alg) {
+                case 'ML-DSA-44':
+                case 'ML-DSA-65':
+                case 'ML-DSA-87':
+                    algorithm = { name: jwk.alg };
+                    keyUsages = jwk.priv ? ['sign'] : ['verify'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
         case 'RSA': {
             switch (jwk.alg) {
                 case 'PS256':
@@ -88,7 +101,9 @@ export default async (jwk) => {
     }
     const { algorithm, keyUsages } = subtleMapping(jwk);
     const keyData = { ...jwk };
-    delete keyData.alg;
+    if (keyData.kty !== 'AKP') {
+        delete keyData.alg;
+    }
     delete keyData.use;
-    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
+    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
 };

package/dist/webapi/lib/key_to_jwk.js

@@ -23,5 +23,9 @@ export default async function keyToJWK(key) {
         throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
     }
     const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey('jwk', key);
+    if (jwk.kty === 'AKP') {
+        ;
+        jwk.alg = alg;
+    }
     return jwk;
 }

package/dist/webapi/lib/normalize_key.js

@@ -49,6 +49,18 @@ const handleKeyObject = (keyObject, alg) => {
             isPublic ? 'verify' : 'sign',
         ]);
     }
+    switch (keyObject.asymmetricKeyType) {
+        case 'ml-dsa-44':
+        case 'ml-dsa-65':
+        case 'ml-dsa-87': {
+            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
+                throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+            }
+            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+                isPublic ? 'verify' : 'sign',
+            ]);
+        }
+    }
     if (keyObject.asymmetricKeyType === 'rsa') {
         let hash;
         switch (alg) {

package/dist/webapi/lib/subtle_dsa.js

@@ -21,6 +21,10 @@ export default (alg, algorithm) => {
         case 'Ed25519':
         case 'EdDSA':
             return { name: 'Ed25519' };
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87':
+            return { name: alg };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "jose",
-  "version": "6.0.13",
+  "version": "6.1.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
+    "akp",
     "browser",
     "bun",
     "cloudflare",
@@ -29,8 +30,9 @@
     "jwk",
     "jwks",
     "jws",
-    "jwt",
     "jwt-decode",
+    "jwt",
+    "ml-dsa",
     "netlify",
     "next",
     "nextjs",