lemon-tls 0.9.0 → 0.11.0

package/src/secure_context.js

@@ -1,6 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import * as PEM from 'cryptographic-formats/pem';
+import * as PKCS8 from 'cryptographic-formats/pkcs8';
+import { parse_cert } from './session/x509.js';
 
 function looksLikePath(x) {
   return typeof x === 'string' && (x.indexOf('\n') === -1) && (x.length < 4096) &&
@@ -22,31 +25,36 @@ function isPEM(buf) {
   return s.indexOf('-----BEGIN ') !== -1 && s.indexOf('-----END ') !== -1;
 }
 
+// The PEM blocks of a text (cryptographic-formats, RFC 7468): [{ type, der, block }].
+// Text between blocks — the comments of a CA bundle — is passed over. A
+// block that does not decode fails the whole text: nothing is taken from a
+// file that is not what it says (see normalizeCA).
 function splitPEMBlocks(pemText) {
-  let out = [];
-  let re = /-----BEGIN ([A-Z0-9 \-]+)-----([\s\S]*?)-----END \1-----/g;
-  let m;
-  while ((m = re.exec(pemText)) !== null) {
-    let typ = m[1].trim();
-    let b64 = m[2].replace(/[\r\n\s]/g, '');
-    let derBuf = Buffer.from(b64, 'base64');
-    out.push({ type: typ, der: new Uint8Array(derBuf) });
-  }
-  return out;
+  return PEM.decode(pemText).map(function (b) { return { type: b.label, der: b.der, block: b }; });
 }
+// A certificate block's label: 'CERTIFICATE', and the 'X509 CERTIFICATE' /
+// 'TRUSTED CERTIFICATE' spellings (OpenSSL's aux form, whose trailing trust
+// data the certificate reader then refuses).
+function isCertificateBlock(b) { return b.type.indexOf('CERTIFICATE') !== -1; }
 
 function ensureArray(x) { return x == null ? [] : (Array.isArray(x) ? x : [x]); }
 
-function normalizeCA(caOption) {
+// The `ca` certificates, as DER. A PEM block that does not decode is
+// skipped, as node:tls skips it — not silently: each is in `skipped`
+// ({ label, line, code, detail }, cryptographic-formats' decode_skipping), which
+// createSecureContext returns as `caSkipped`.
+function normalizeCA(caOption, skipped) {
   let arr = ensureArray(caOption);
   let ders = [];
   for (let i = 0; i < arr.length; i++) {
     let raw = readMaybeFile(arr[i]);
     if (!raw) continue;
     if (isPEM(raw)) {
-      let blocks = splitPEMBlocks(raw.toString('utf8'));
-      for (let j = 0; j < blocks.length; j++) {
-        if (blocks[j].type.indexOf('CERTIFICATE') !== -1) ders.push(blocks[j].der);
+      let read;
+      try { read = PEM.decode_skipping(raw.toString('utf8')); } catch (e) { read = { blocks: [], skipped: [] }; }
+      for (let j = 0; j < read.skipped.length; j++) skipped.push(read.skipped[j]);
+      for (let j = 0; j < read.blocks.length; j++) {
+        if (read.blocks[j].label.indexOf('CERTIFICATE') !== -1) ders.push(read.blocks[j].der);
       }
     } else {
       ders.push(new Uint8Array(raw));
@@ -55,37 +63,72 @@ function normalizeCA(caOption) {
   return ders;
 }
 
+// node:tls's X509Certificate, for the `certObjs` this returns (an API
+// field). Everything decided here reads the certificate with cryptographic-formats.
 function makeX509FromDerOrPem(buf) {
   return new crypto.X509Certificate(Buffer.from(buf));
 }
 
+// A certificate's public key as node:crypto exports it (SPKI DER): the form
+// a private key's public half is compared in. Through a KeyObject, so two
+// encodings of one key — named or explicit curve parameters, a compressed
+// point — compare equal, as they did.
+function certPublicKeyDer(der) {
+  let cert = parse_cert(der);
+  if (!cert) {
+    let e = new Error('createSecureContext: the certificate does not parse');
+    e.code = 'ERR_INVALID_CERTIFICATE';
+    throw e;
+  }
+  let key = cert.publicKey();
+  return key ? key.export({ type: 'spki', format: 'der' }) : null;
+}
+
+// The DER form of a private key, by what cryptographic-formats reads it as:
+// PKCS#8 (plain or encrypted), PKCS#1 (RSA) or SEC 1 (EC) — node:crypto is
+// told which, rather than tried with each in turn.
+function derKeyType(der) {
+  let readers = [['pkcs8', PKCS8.from_der], ['pkcs8', PKCS8.encrypted_from_der],
+                 ['pkcs1', PKCS8.pkcs1_from_der], ['sec1', PKCS8.sec1_from_der]];
+  for (let i = 0; i < readers.length; i++) {
+    try { readers[i][1](der); return readers[i][0]; } catch (e) { /* the next */ }
+  }
+  return null;
+}
+// The same, from a PEM label (RFC 7468 §10, §11; OpenSSL's traditional ones)
+const PEM_KEY_TYPES = {
+  'PRIVATE KEY': 'pkcs8', 'ENCRYPTED PRIVATE KEY': 'pkcs8',
+  'RSA PRIVATE KEY': 'pkcs1', 'EC PRIVATE KEY': 'sec1',
+};
+
 function makePrivateKeyFromDerOrPem(buf, passphrase) {
   // node:crypto rejects an explicit `passphrase: null` with ERR_INVALID_ARG_VALUE
   // — for an unencrypted key the property must be ABSENT, not present-and-null.
   // Callers that forward an optional option straight through would otherwise
   // break every unencrypted key, which is the overwhelmingly common case.
   let pass = (passphrase === null || passphrase === undefined) ? undefined : passphrase;
+  let withPass = function (o) { if (pass !== undefined) o.passphrase = pass; return o; };
 
+  let der, type;
   if (isPEM(buf)) {
-    let opts = { key: buf, format: 'pem' };
-    if (pass !== undefined) opts.passphrase = pass;
-    return crypto.createPrivateKey(opts);
+    // The key's block (a file from `openssl ecparam -genkey` starts with an
+    // EC PARAMETERS block), read by cryptographic-formats.
+    let blocks = splitPEMBlocks(buf.toString('utf8'));
+    let block = null;
+    for (let i = 0; i < blocks.length && !block; i++) if (PEM_KEY_TYPES[blocks[i].type]) block = blocks[i];
+    if (!block) throw new Error('createSecureContext: no private key in the PEM (' +
+                                blocks.map(function (b) { return b.type; }).join(', ') + ')');
+    // RFC 1421's encrypted form (Proc-Type / DEK-Info headers): its
+    // decryption is node:crypto's, and node:crypto reads it only as PEM.
+    if (block.block.encrypted) return crypto.createPrivateKey(withPass({ key: buf, format: 'pem' }));
+    der = Buffer.from(block.der);
+    type = PEM_KEY_TYPES[block.type];
   } else {
-    let der = Buffer.from(buf), keyObj = null;
-    try {
-      keyObj = crypto.createPrivateKey(Object.assign({ key: der, format: 'der', type: 'pkcs8' },
-                                        pass !== undefined ? { passphrase: pass } : {}));
-    } catch (e1) {
-      try {
-        keyObj = crypto.createPrivateKey(Object.assign({ key: der, format: 'der', type: 'pkcs1' },
-                                        pass !== undefined ? { passphrase: pass } : {}));
-      } catch (e2) {
-        keyObj = crypto.createPrivateKey(Object.assign({ key: der, format: 'der', type: 'sec1' },
-                                        pass !== undefined ? { passphrase: pass } : {}));
-      }
-    }
-    return keyObj;
+    der = Buffer.from(buf);
+    type = derKeyType(der);
+    if (type === null) throw new Error('createSecureContext: the key is not PKCS#8, PKCS#1 or SEC 1 DER');
   }
+  return crypto.createPrivateKey(withPass({ key: der, format: 'der', type: type }));
 }
 
 function exportKeyPkcs8Der(keyObj) {
@@ -134,10 +177,10 @@ function createSecureContext(options) {
       let cert = null;
       for (let j = 0; j < certs.length && cert === null; j++) {
         let raw = readMaybeFile(certs[j]);
-        let first = isPEM(raw) ? splitPEMBlocks(raw.toString('utf8')).filter(function (b) { return b.type.indexOf('CERTIFICATE') !== -1; })[0] : { der: new Uint8Array(raw) };
+        let first = isPEM(raw) ? splitPEMBlocks(raw.toString('utf8')).filter(isCertificateBlock)[0] : { der: new Uint8Array(raw) };
         if (!first) continue;
-        let leafPub = makeX509FromDerOrPem(first.der).publicKey.export({ type: 'spki', format: 'der' });
-        if (Buffer.compare(Buffer.from(leafPub), Buffer.from(pub)) === 0) cert = certs[j];
+        let leafPub = certPublicKeyDer(first.der);
+        if (leafPub && Buffer.compare(Buffer.from(leafPub), Buffer.from(pub)) === 0) cert = certs[j];
       }
       if (cert === null) throw new Error('createSecureContext: no certificate in `cert` for key ' + i);
       return createSecureContext(Object.assign({}, options, { key: keyIn, passphrase: pass, cert: cert }));
@@ -159,7 +202,7 @@ function createSecureContext(options) {
     if (isPEM(cRaw)) {
       let blocks = splitPEMBlocks(cRaw.toString('utf8'));
       for (let i=0;i<blocks.length;i++) {
-        if (blocks[i].type.indexOf('CERTIFICATE') !== -1) {
+        if (isCertificateBlock(blocks[i])) {
           certBlocksDer.push(blocks[i].der);
           certObjs.push(makeX509FromDerOrPem(blocks[i].der));
         }
@@ -186,8 +229,23 @@ function createSecureContext(options) {
     if (!privateKey) throw new Error('createSecureContext: missing private key.');
   }
 
+  // The key must be the certificate's — node:tls throws on this too
+  // (KEY_VALUES_MISMATCH). Unchecked, a renewal that paired the new key with
+  // the old certificate went in without a word, and every handshake after it
+  // failed at the client's signature check.
+  if (keyObj && certBlocksDer.length > 0) {
+    let fromKey = crypto.createPublicKey(keyObj).export({ type: 'spki', format: 'der' });
+    let fromCert = certPublicKeyDer(certBlocksDer[0]);
+    if (!fromCert || Buffer.compare(Buffer.from(fromKey), Buffer.from(fromCert)) !== 0) {
+      let e = new Error('createSecureContext: the private key does not match the certificate');
+      e.code = 'ERR_OSSL_X509_KEY_VALUES_MISMATCH';
+      throw e;
+    }
+  }
+
   // --- CA (Trust store) ---
-  let ca = normalizeCA(options.ca);
+  let caSkipped = [];
+  let ca = normalizeCA(options.ca, caSkipped);
 
   // --- OCSP stapling (אופציונלי) ---
   let ocsp = null;
@@ -207,15 +265,15 @@ function createSecureContext(options) {
 
   // מידע עזר לזיהוי סוג המפתח הציבורי של ה-leaf
   let leafPublicKeyType = null;
-  if (certObjs.length > 0 && certObjs[0].publicKey) {
-    try { leafPublicKeyType = certObjs[0].publicKey.asymmetricKeyType || null; } catch (e) { leafPublicKeyType = null; }
-  }
+  let leafCert = certBlocksDer.length > 0 ? parse_cert(certBlocksDer[0]) : null;
+  if (leafCert && leafCert.publicKey()) leafPublicKeyType = leafCert.publicKey().asymmetricKeyType || null;
 
   return {
     // חומר לשכבת ההנדשייק/רקורד:
     certificateChain: certificateChain,  // [{ cert: DER(Uint8Array) }, ...]
     privateKey: privateKey,              // PKCS#8 DER (Uint8Array)
     ca: ca,                              // Trust store (DER)
+    caSkipped: caSkipped,                // PEM blocks of `ca` that did not decode: [{ label, line, code, detail }]
     ocsp: ocsp,                          // DER (אם הוגדר)
     ticketKeys: ticketKeys,              // Uint8Array (אם הוגדר)
 

package/src/session/ecdh.js

@@ -1,94 +1,105 @@
 /**
- * ECDH key generation and shared secret helpers using node:crypto.
- * X25519, P-256 and P-384; ML-KEM alone and in hybrids with them (below).
+ * The key-exchange groups: the Diffie-Hellman ones — X25519, X448, P-256,
+ * P-384, P-521 — and ML-KEM alone and in hybrids with them (below), over
+ * node:crypto. The one place a group is implemented: TLS's key exchange,
+ * the hybrids' classical halves and HPKE's DHKEMs (hpke.js) all take their
+ * primitives from here.
  */
 
 import * as crypto from 'crypto';
-
-// DER prefixes for raw X25519 key import/export
-let X25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
-let X25519_SPKI_PREFIX  = Buffer.from('302a300506032b656e032100', 'hex');
-
-/**
- * Derive the X25519 public key from a 32-byte private key.
- */
-function x25519_get_public_key(privateKeyRaw) {
-  let der = Buffer.concat([X25519_PKCS8_PREFIX, Buffer.from(privateKeyRaw)]);
-  let privObj = crypto.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-  let pubObj = crypto.createPublicKey(privObj);
-  let spki = pubObj.export({ type: 'spki', format: 'der' });
-  return new Uint8Array(spki.subarray(X25519_SPKI_PREFIX.length));
-}
-
-/**
- * Compute X25519 shared secret from local private key and remote public key (both raw 32 bytes).
- */
-function x25519_get_shared_secret(localPrivateRaw, remotePublicRaw) {
-  let privDer = Buffer.concat([X25519_PKCS8_PREFIX, Buffer.from(localPrivateRaw)]);
-  let pubDer  = Buffer.concat([X25519_SPKI_PREFIX, Buffer.from(remotePublicRaw)]);
-  let privObj = crypto.createPrivateKey({ key: privDer, format: 'der', type: 'pkcs8' });
-  let pubObj  = crypto.createPublicKey({ key: pubDer, format: 'der', type: 'spki' });
-  let secret  = new Uint8Array(crypto.diffieHellman({ privateKey: privObj, publicKey: pubObj }));
-
-  // RFC 7748 §6.1: implementations MUST reject an all-zero shared secret. A peer
-  // that sends a low-order/small-order public key can force the X25519 result to
-  // be all zeros — a value it knows in advance — which would let it choose the
-  // key material. The `break` here is safe (does not leak a secret): the peer's
-  // public key is public, so an early exit reveals nothing exploitable.
-  let allZero = true;
-  for (let i = 0; i < secret.length; i++) {
-    if (secret[i] !== 0) { allZero = false; break; }
-  }
-  if (allZero) {
-    throw new Error('X25519: all-zero shared secret — invalid peer public key (RFC 7748 §6.1)');
-  }
-
+import * as SPKI from 'cryptographic-formats/spki';
+import * as PKCS8 from 'cryptographic-formats/pkcs8';
+
+// RFC 7748 §6: an all-zero shared secret means the peer's public key was of
+// low order — a value it knew in advance. MUST be rejected. Constant time
+// (the peer's key is public, but there is no reason to branch on secrets).
+function reject_all_zero(secret, name) {
+  let acc = 0;
+  for (let i = 0; i < secret.length; i++) acc |= secret[i];
+  if (acc === 0) throw new Error(name + ': all-zero shared secret — invalid peer public key (RFC 7748 §6)');
   return secret;
 }
 
-/**
- * Generate a P-256 keypair. Returns { private_key: Uint8Array, public_key: Uint8Array(65) }.
- * Public key is uncompressed format (0x04 || x || y).
- */
-function p256_generate_keypair() {
-  let ecdh = crypto.createECDH('prime256v1');
-  ecdh.generateKeys();
-  return {
-    private_key: new Uint8Array(ecdh.getPrivateKey()),
-    public_key: new Uint8Array(ecdh.getPublicKey(null, 'uncompressed'))
+// The native key behind a private key this module generated, by the bytes
+// it handed out. Importing a raw private key is not cheap — for X25519
+// node:crypto computes the public key on import, ~50 µs, as much as the
+// Diffie-Hellman itself — and every handshake imported its own key twice:
+// once to derive the public key, once for the shared secret. The key made by
+// generate() is kept here and used by shared(); a private key from anywhere
+// else (HPKE's, a test vector's) is imported as before. Keyed by the
+// Uint8Array's identity, so the entry goes with the key: nothing outlives it.
+const NATIVE_PRIVATE = new WeakMap();
+
+const b64u = (s) => new Uint8Array(Buffer.from(s, 'base64url'));
+
+// A Montgomery curve. node:crypto takes and gives its raw keys only inside
+// PKCS#8 and SPKI: cryptographic-formats writes and reads that wrapping (RFC 8410)
+// — it was two DER prefixes written out here by hand.
+function montgomery(name, len) {
+  let type = name.toLowerCase();
+  let priv = (sk) => NATIVE_PRIVATE.get(sk) ||
+    crypto.createPrivateKey({ key: Buffer.from(PKCS8.to_der({ algorithm: name, scalar: sk })), format: 'der', type: 'pkcs8' });
+  let c = {
+    kind: 'montgomery', len: len, privLen: len,
+    public_key: function (sk) {
+      return new Uint8Array(SPKI.from_der(crypto.createPublicKey(priv(sk)).export({ type: 'spki', format: 'der' })).point);
+    },
+    shared: function (sk, pk) {
+      let pub = crypto.createPublicKey({ key: Buffer.from(SPKI.to_der({ algorithm: name, point: pk })), format: 'der', type: 'spki' });
+      return reject_all_zero(new Uint8Array(crypto.diffieHellman({ privateKey: priv(sk), publicKey: pub })), name);
+    },
+    // Made natively (the same CSPRNG as randomBytes), and read back as JWK —
+    // the raw scalar and public key, without a DER round trip.
+    generate: function () {
+      let kp = crypto.generateKeyPairSync(type);
+      let jwk = kp.privateKey.export({ format: 'jwk' });
+      let sk = b64u(jwk.d), pk = b64u(jwk.x);
+      if (sk.length !== len || pk.length !== len) throw new Error(name + ': unexpected key size from node:crypto');
+      NATIVE_PRIVATE.set(sk, kp.privateKey);
+      return { private_key: sk, public_key: pk };
+    },
   };
+  return c;
 }
-
-/**
- * Compute P-256 shared secret (raw x-coordinate, 32 bytes).
- */
-function p256_get_shared_secret(localPrivateRaw, remotePublicRaw) {
-  let ecdh = crypto.createECDH('prime256v1');
-  ecdh.setPrivateKey(Buffer.from(localPrivateRaw));
-  return new Uint8Array(ecdh.computeSecret(Buffer.from(remotePublicRaw)));
-}
-
-/**
- * Generate a P-384 keypair. Returns { private_key: Uint8Array(48), public_key: Uint8Array(97) }.
- * Public key is uncompressed format (0x04 || x || y).
- */
-function p384_generate_keypair() {
-  let ecdh = crypto.createECDH('secp384r1');
-  ecdh.generateKeys();
+// A NIST prime curve: shares are uncompressed points (0x04 || X || Y,
+// RFC 8446 §4.2.8.2), the shared secret the x-coordinate.
+function nist(curve, coordLen) {
+  let ecdh = (sk) => {
+    let e = NATIVE_PRIVATE.get(sk);
+    if (e) return e;
+    e = crypto.createECDH(curve); e.setPrivateKey(Buffer.from(sk));
+    return e;
+  };
   return {
-    private_key: new Uint8Array(ecdh.getPrivateKey()),
-    public_key: new Uint8Array(ecdh.getPublicKey(null, 'uncompressed'))
+    kind: 'nist', len: 1 + 2 * coordLen, coordLen: coordLen, privLen: coordLen,
+    public_key: function (sk) {
+      return new Uint8Array(ecdh(sk).getPublicKey(null, 'uncompressed'));
+    },
+    // computeSecret validates the peer point (on the curve, not infinity)
+    // before any secret exists.
+    shared: function (sk, pk) {
+      return new Uint8Array(ecdh(sk).computeSecret(Buffer.from(pk)));
+    },
+    generate: function () {
+      let e = crypto.createECDH(curve); e.generateKeys();
+      // getPrivateKey drops leading zero bytes — half of all P-521 scalars,
+      // 1 in 256 of P-256's — and a private key is privLen bytes.
+      let raw = e.getPrivateKey(), sk = new Uint8Array(coordLen);
+      sk.set(raw, coordLen - raw.length);
+      NATIVE_PRIVATE.set(sk, e);
+      return { private_key: sk, public_key: new Uint8Array(e.getPublicKey(null, 'uncompressed')) };
+    },
   };
 }
 
-/**
- * Compute P-384 shared secret (raw x-coordinate, 48 bytes).
- */
-function p384_get_shared_secret(localPrivateRaw, remotePublicRaw) {
-  let ecdh = crypto.createECDH('secp384r1');
-  ecdh.setPrivateKey(Buffer.from(localPrivateRaw));
-  return new Uint8Array(ecdh.computeSecret(Buffer.from(remotePublicRaw)));
-}
+const CURVES = {
+  x25519: montgomery('X25519', 32),
+  x448:   montgomery('X448',   56),
+  p256:   nist('prime256v1', 32),
+  p384:   nist('secp384r1', 48),
+  p521:   nist('secp521r1', 66),
+};
+
 
 /**
  * Named groups this module actually implements, in preference order.
@@ -104,8 +115,10 @@ function p384_get_shared_secret(localPrivateRaw, remotePublicRaw) {
  */
 const NAMED_GROUP = {
   X25519:    0x001d,
+  X448:      0x001e,
   SECP256R1: 0x0017,
   SECP384R1: 0x0018,
+  SECP521R1: 0x0019,
   // Post-quantum. KEMs, not Diffie-Hellman: the server does not make a key
   // pair of its own, it ENCAPSULATES to the client's — see kem_server_exchange.
   //   Hybrids (draft-ietf-tls-ecdhe-mlkem): ML-KEM (FIPS 203) and an ECDH
@@ -124,12 +137,24 @@ const NAMED_GROUP = {
 
 // Each group's name — the IANA registry's, as OpenSSL and node:tls spell them.
 const GROUP_NAMES = {
-  0x001d: 'X25519', 0x0017: 'P-256', 0x0018: 'P-384',
+  0x001d: 'X25519', 0x001e: 'X448', 0x0017: 'P-256', 0x0018: 'P-384', 0x0019: 'P-521',
   0x11ec: 'X25519MLKEM768', 0x11eb: 'SecP256r1MLKEM768', 0x11ed: 'SecP384r1MLKEM1024',
   0x0200: 'MLKEM512', 0x0201: 'MLKEM768', 0x0202: 'MLKEM1024',
 };
 function group_name(group) { return GROUP_NAMES[group] || null; }
 
+// The Diffie-Hellman groups, by code point: their curve, and how node:tls
+// (getEphemeralKeyInfo) names and sizes them.
+const DH_GROUPS = {
+  0x001d: { curve: CURVES.x25519, ecdhName: 'x25519',     bits: 253 },
+  0x001e: { curve: CURVES.x448,   ecdhName: 'x448',       bits: 448 },
+  0x0017: { curve: CURVES.p256,   ecdhName: 'prime256v1', bits: 256 },
+  0x0018: { curve: CURVES.p384,   ecdhName: 'secp384r1',  bits: 384 },
+  0x0019: { curve: CURVES.p521,   ecdhName: 'secp521r1',  bits: 521 },
+};
+/** node:tls's description of a DH group ({ name, size }), or null. */
+function dh_group_info(group) { let d = DH_GROUPS[group]; return d ? { name: d.ecdhName, size: d.bits } : null; }
+
 // ML-KEM's three parameter sets (FIPS 203 Table 3): encapsulation key and
 // ciphertext sizes. The shared secret is 32 bytes for each.
 const MLKEM = {
@@ -138,18 +163,12 @@ const MLKEM = {
   1024: { type: 'ml-kem-1024', ek: 1568, ct: 1568 },
 };
 
-// The classical halves of the hybrids: a share's size, a key pair, a secret.
-const ECDH_PART = {
-  x25519: { len: 32,
-            generate: function () { let priv = new Uint8Array(crypto.randomBytes(32)); return { private_key: priv, public_key: x25519_get_public_key(priv) }; },
-            shared: function (priv, pub) { return x25519_get_shared_secret(priv, pub); } },
-  p256:   { len: 65, generate: function () { return p256_generate_keypair(); },
-            shared: function (priv, pub) { check_point(pub, 65); return p256_get_shared_secret(priv, pub); } },
-  p384:   { len: 97, generate: function () { return p384_generate_keypair(); },
-            shared: function (priv, pub) { check_point(pub, 97); return p384_get_shared_secret(priv, pub); } },
-};
-function check_point(pub, len) {
-  if (pub.length !== len || pub[0] !== 0x04) throw new Error('the ECDH part must be a ' + len + '-byte uncompressed point');
+// The classical halves of the hybrids: the curves above, their parts checked
+// as a group's share is (normalize_dh_share).
+const ECDH_PART = {};
+for (const name of ['x25519', 'p256', 'p384']) {
+  let c = CURVES[name];
+  ECDH_PART[name] = { len: c.len, generate: c.generate, shared: function (sk, pk) { return c.shared(sk, normalize_dh_share(c, pk)); } };
 }
 
 // The KEM groups: which ML-KEM, which ECDH half (none for ML-KEM alone), and
@@ -172,9 +191,12 @@ const KEM_GROUPS = {
 //
 // Decided once per parameter set, by a real round trip rather than by the
 // functions existing (on BoringSSL, crypto.encapsulate can be defined and
-// still not know ML-KEM) — and the raw key's SPKI wrapping taken from the key
-// made: a fixed DER prefix, as for X25519 above.
-const MLKEM_SPKI_PREFIX = {};
+// still not know ML-KEM). The raw key's SPKI wrapping is cryptographic-formats'
+// (RFC 9935), and the probe checks it is the one node:crypto writes: a set
+// where they differ is not offered.
+function mlkem_spki(bits, raw) {
+  return Buffer.from(SPKI.to_der({ algorithm: 'mlKem' + bits, point: raw }));
+}
 function probe_mlkem(bits) {
   if (typeof crypto.encapsulate !== 'function' || typeof crypto.decapsulate !== 'function') return false;
   try {
@@ -184,8 +206,8 @@ function probe_mlkem(bits) {
     let dec = crypto.decapsulate(kp.privateKey, enc.ciphertext);
     if (enc.ciphertext.length !== p.ct || Buffer.compare(Buffer.from(enc.sharedKey), Buffer.from(dec)) !== 0) return false;
     let spki = kp.publicKey.export({ format: 'der', type: 'spki' });
-    MLKEM_SPKI_PREFIX[bits] = Buffer.from(spki.subarray(0, spki.length - p.ek));
-    return true;
+    let ek = SPKI.from_der(spki).point;
+    return ek.length === p.ek && Buffer.compare(mlkem_spki(bits, ek), Buffer.from(spki)) === 0;
   } catch (e) {
     return false;
   }
@@ -196,7 +218,7 @@ const MLKEM_AVAILABLE = MLKEM_SETS[768];
 // Import checks the key (FIPS 203 §7.2: every coefficient below q) and throws
 // on a bad one — before any secret exists.
 function mlkem_public_key(bits, raw) {
-  return crypto.createPublicKey({ key: Buffer.concat([MLKEM_SPKI_PREFIX[bits], Buffer.from(raw)]), format: 'der', type: 'spki' });
+  return crypto.createPublicKey({ key: mlkem_spki(bits, raw), format: 'der', type: 'spki' });
 }
 
 function kem_group_available(group) {
@@ -239,6 +261,11 @@ const SERVER_DEFAULT_GROUPS = [
   NAMED_GROUP.X25519,
   NAMED_GROUP.SECP256R1,
   NAMED_GROUP.SECP384R1,
+  // Taken from a client that offers them — none offers only these by
+  // default, so they come last (OpenSSL's order: X448 after the NIST
+  // curves it offers by default, P-521 last).
+  NAMED_GROUP.X448,
+  NAMED_GROUP.SECP521R1,
 ]);
 
 // Everything implemented here, on either side. A KEM group only where
@@ -260,16 +287,13 @@ function is_kem_group(group) {
  * Returns { private_key, public_key } or null for an unsupported group.
  */
 function generate_keypair(group) {
-  if (group === NAMED_GROUP.X25519) return ECDH_PART.x25519.generate();
-  if (group === NAMED_GROUP.SECP256R1) return p256_generate_keypair();
-  if (group === NAMED_GROUP.SECP384R1) return p384_generate_keypair();
+  if (DH_GROUPS[group]) return DH_GROUPS[group].curve.generate();
   if (kem_group_available(group)) {
     // The CLIENT side: an ML-KEM key pair, and an ECDH one for a hybrid; the
     // share is the two public keys in the group's order.
     let d = KEM_GROUPS[group], sz = kem_sizes(group);
     let kem = crypto.generateKeyPairSync(MLKEM[d.kem].type);
-    let spki = kem.publicKey.export({ format: 'der', type: 'spki' });
-    let ek = spki.subarray(spki.length - sz.ek);
+    let ek = SPKI.from_der(kem.publicKey.export({ format: 'der', type: 'spki' })).point;
     let ec = d.ecdh ? ECDH_PART[d.ecdh].generate() : null;
     let pub = new Uint8Array(sz.client);
     if (!ec) pub.set(ek, 0);
@@ -351,17 +375,17 @@ function normalize_peer_public_key(group, pub) {
     return pub;
   }
 
-  if (group === NAMED_GROUP.X25519) {
-    if (pub.length !== 32) {
-      throw new Error('X25519 key_exchange must be 32 bytes, got ' + pub.length);
-    }
+  if (!DH_GROUPS[group]) throw new Error('unsupported group 0x' + (group >>> 0).toString(16));
+  return normalize_dh_share(DH_GROUPS[group].curve, pub);
+}
+
+// A Diffie-Hellman share as the curve has it, or an error.
+function normalize_dh_share(c, pub) {
+  if (c.kind === 'montgomery') {
+    if (pub.length !== c.len) throw new Error('key_exchange must be ' + c.len + ' bytes, got ' + pub.length);
     return pub;
   }
-
-  let coordLen = (group === NAMED_GROUP.SECP256R1) ? 32
-               : (group === NAMED_GROUP.SECP384R1) ? 48 : 0;
-  if (coordLen === 0) throw new Error('unsupported group 0x' + (group >>> 0).toString(16));
-
+  let coordLen = c.coordLen;
   // RFC 8446 §4.2.8.2: for the secp*r1 groups the key_exchange is an
   // UNCOMPRESSED point — 0x04 || X || Y — and nothing else. The length is
   // therefore exact.
@@ -373,7 +397,7 @@ function normalize_peer_public_key(group, pub) {
   // as a DIFFERENT, prefix-less point and happily fed to the ECDH. The same
   // arithmetic applies to P-384 (97 → 96). Malformed input must be rejected,
   // not silently reinterpreted.
-  let expected = 1 + 2 * coordLen;
+  let expected = c.len;
 
   if (pub.length !== expected) {
     // Name the two shapes we know we are refusing, so the failure is
@@ -394,7 +418,7 @@ function normalize_peer_public_key(group, pub) {
   }
 
   // Whether the point actually lies on the curve is checked by the ECDH
-  // primitive below (node throws ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY), which
+  // primitive (node throws ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY), which
   // happens before any secret is produced — so an off-curve point can never
   // yield key material.
   return pub;
@@ -408,9 +432,7 @@ function normalize_peer_public_key(group, pub) {
 function get_shared_secret(group, localPrivateRaw, remotePublicRaw) {
   let pub = normalize_peer_public_key(group, remotePublicRaw);
 
-  if (group === NAMED_GROUP.X25519)    return x25519_get_shared_secret(localPrivateRaw, pub);
-  if (group === NAMED_GROUP.SECP256R1) return p256_get_shared_secret(localPrivateRaw, pub);
-  if (group === NAMED_GROUP.SECP384R1) return p384_get_shared_secret(localPrivateRaw, pub);
+  if (DH_GROUPS[group]) return DH_GROUPS[group].curve.shared(localPrivateRaw, pub);
   if (kem_group_available(group)) {
     // The CLIENT side: the server's share is the ciphertext (and, for a
     // hybrid, the server's ECDH public key), in the group's order.
@@ -442,10 +464,6 @@ export {
   generate_keypair,
   normalize_peer_public_key,
   get_shared_secret,
-  x25519_get_public_key,
-  x25519_get_shared_secret,
-  p256_generate_keypair,
-  p256_get_shared_secret,
-  p384_generate_keypair,
-  p384_get_shared_secret
+  dh_group_info,
+  CURVES,
 };