react-native-quick-crypto 1.1.0 → 1.1.1

package/src/dsa.ts

@@ -25,6 +25,12 @@ export class Dsa {
   }
 }
 
+// FIPS 186-4 §4.2: only L = 1024, 2048, 3072 are sanctioned. NIST has
+// deprecated DSA-1024 for new applications, but we retain it for
+// interop with legacy systems and match Node's permissive default. We
+// reject anything below 1024 outright.
+const DSA_MIN_MODULUS_LENGTH = 1024;
+
 function dsa_prepareKeyGenParams(
   options: GenerateKeyPairOptions | undefined,
 ): Dsa {
@@ -34,8 +40,11 @@ function dsa_prepareKeyGenParams(
 
   const { modulusLength, divisorLength } = options;
 
-  if (!modulusLength || modulusLength <= 0) {
-    throw new Error('Invalid or missing modulusLength for DSA key generation');
+  if (!modulusLength || modulusLength < DSA_MIN_MODULUS_LENGTH) {
+    throw new RangeError(
+      `DSA modulusLength must be at least ${DSA_MIN_MODULUS_LENGTH} bits ` +
+        `(got ${modulusLength ?? 0})`,
+    );
   }
 
   return new Dsa(modulusLength, divisorLength);

package/src/hash.ts

@@ -183,18 +183,28 @@ class Hash extends Stream.Transform {
     return this.native.getOpenSSLVersion();
   }
 
-  // stream interface
+  // Stream interface — surface synchronous errors via the callback so
+  // they emit as stream 'error' events instead of throwing out of the
+  // Transform plumbing (which would crash the host pipeline).
   _transform(
     chunk: BinaryLike,
     encoding: BufferEncoding,
-    callback: () => void,
+    callback: (err?: Error | null) => void,
   ) {
-    this.update(chunk, encoding as Encoding);
-    callback();
+    try {
+      this.update(chunk, encoding as Encoding);
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
-  _flush(callback: () => void) {
-    this.push(this.digest());
-    callback();
+  _flush(callback: (err?: Error | null) => void) {
+    try {
+      this.push(this.digest());
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
 }
 

package/src/hkdf.ts

@@ -45,6 +45,46 @@ function sanitizeInput(input: BinaryLike, name: string): ArrayBuffer {
   }
 }
 
+// Output byte-length of each fixed-length digest. HKDF requires a fixed-
+// output hash (it builds on HMAC), so XOFs like SHAKE128/256 are not
+// included even though `normalizeHashName` will accept them — passing
+// SHAKE here is a caller bug we surface as `Unsupported HKDF digest`
+// instead of letting the native side return an opaque error.
+const HKDF_HASH_BYTES: Readonly<Record<string, number>> = {
+  sha1: 20,
+  sha224: 28,
+  sha256: 32,
+  sha384: 48,
+  sha512: 64,
+  'sha3-256': 32,
+  'sha3-384': 48,
+  'sha3-512': 64,
+  ripemd160: 20,
+};
+
+function validateHkdfKeylen(digest: string, keylen: number): void {
+  if (
+    typeof keylen !== 'number' ||
+    !Number.isFinite(keylen) ||
+    !Number.isInteger(keylen) ||
+    keylen < 0 ||
+    keylen > 0x7fff_ffff
+  ) {
+    throw new TypeError('Bad key length');
+  }
+  const hashLen = HKDF_HASH_BYTES[digest.toLowerCase()];
+  if (hashLen === undefined) {
+    throw new TypeError(`Unsupported HKDF digest: ${digest}`);
+  }
+  // RFC 5869 §2.3: L ≤ 255 * HashLen.
+  if (keylen > 255 * hashLen) {
+    throw new RangeError(
+      `HKDF keylen ${keylen} exceeds RFC 5869 ceiling ` +
+        `255 * HashLen (${255 * hashLen}) for ${digest}`,
+    );
+  }
+}
+
 export function hkdf(
   digest: string,
   key: KeyMaterial,
@@ -61,9 +101,7 @@ export function hkdf(
     const sanitizedSalt = sanitizeInput(salt, 'Salt');
     const sanitizedInfo = sanitizeInput(info, 'Info');
 
-    if (keylen < 0) {
-      throw new TypeError('Bad key length');
-    }
+    validateHkdfKeylen(normalizedDigest, keylen);
 
     const nativeMod = getNative();
     nativeMod
@@ -99,9 +137,7 @@ export function hkdfSync(
   const sanitizedSalt = sanitizeInput(salt, 'Salt');
   const sanitizedInfo = sanitizeInput(info, 'Info');
 
-  if (keylen < 0) {
-    throw new TypeError('Bad key length');
-  }
+  validateHkdfKeylen(normalizedDigest, keylen);
 
   const nativeMod = getNative();
   const result = nativeMod.deriveKeySync(
@@ -134,6 +170,8 @@ export function hkdfDeriveBits(
   const hashName = typeof hash === 'string' ? hash : hash.name;
   const normalizedDigest = normalizeHashName(hashName);
 
+  validateHkdfKeylen(normalizedDigest, keylen);
+
   const nativeMod = getNative();
   const result = nativeMod.deriveKeySync(
     normalizedDigest,

package/src/hmac.ts

@@ -85,18 +85,28 @@ class Hmac extends Stream.Transform {
     return Buffer.from(nativeDigest);
   }
 
-  // stream interface
+  // Stream interface — surface synchronous errors via the callback so
+  // they emit as stream 'error' events instead of throwing out of the
+  // Transform plumbing.
   _transform(
     chunk: BinaryLike,
     encoding: BufferEncoding,
-    callback: () => void,
+    callback: (err?: Error | null) => void,
   ) {
-    this.update(chunk, encoding as Encoding);
-    callback();
+    try {
+      this.update(chunk, encoding as Encoding);
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
-  _flush(callback: () => void) {
-    this.push(this.digest());
-    callback();
+  _flush(callback: (err?: Error | null) => void) {
+    try {
+      this.push(this.digest());
+      callback();
+    } catch (err) {
+      callback(err as Error);
+    }
   }
 }
 

package/src/keys/publicCipher.ts

@@ -144,8 +144,13 @@ export function publicDecrypt(
       paddingMode,
     );
     return Buffer.from(decrypted);
-  } catch (error) {
-    throw new Error(`publicDecrypt failed: ${(error as Error).message}`);
+  } catch {
+    // Bleichenbacher mitigation: surface a single, content-independent error
+    // for every decrypt failure so an attacker cannot use error-message
+    // differences as a padding oracle. The native side already collapses its
+    // OpenSSL error codes to the same opaque message; we drop it here too
+    // rather than re-leaking it via string interpolation.
+    throw new Error('publicDecrypt failed');
   }
 }
 
@@ -244,7 +249,8 @@ export function privateDecrypt(
       oaepLabel,
     );
     return Buffer.from(decrypted);
-  } catch (error) {
-    throw new Error(`privateDecrypt failed: ${(error as Error).message}`);
+  } catch {
+    // Bleichenbacher mitigation — see publicDecrypt above.
+    throw new Error('privateDecrypt failed');
   }
 }

package/src/random.ts

@@ -59,8 +59,17 @@ export function randomFill(buffer: ABV, ...rest: unknown[]): void {
   }
 
   getNative();
-  random.randomFill(abvToArrayBuffer(buffer), viewOffset + offset, size).then(
+  const ab = abvToArrayBuffer(buffer);
+  const start = viewOffset + offset;
+  random.randomFill(ab, start, size).then(
     (res: ArrayBuffer) => {
+      // The native async path operates on a copy of the underlying buffer to
+      // avoid races with JS-owned memory on the worker thread, so the
+      // randomized bytes live in `res`, not in the caller's buffer. Copy them
+      // back to preserve Node's in-place randomFill semantics.
+      if (res !== ab) {
+        new Uint8Array(ab, start, size).set(new Uint8Array(res, start, size));
+      }
       callback(null, res);
     },
     (e: Error) => {
@@ -224,7 +233,7 @@ export function randomInt(
     if (x < randLimit) {
       const n = (x % range) + min;
       if (isSync) return n;
-      process.nextTick(callback as RandomIntCallback, undefined, n);
+      process.nextTick(callback as RandomIntCallback, null, n);
       return;
     }
   }

package/src/rsa.ts

@@ -60,6 +60,13 @@ export class Rsa {
   }
 }
 
+// Modern best practice (NIST SP 800-131A Rev. 2, IETF RFC 8017): RSA keys
+// shorter than 2048 bits are deprecated for both signing and encryption.
+// 1024-bit moduli have been factored in academic settings; 768-bit keys
+// have been factored on commodity hardware. Reject anything below 2048
+// at the JS boundary so callers can't accidentally generate weak keys.
+const RSA_MIN_MODULUS_LENGTH = 2048;
+
 // Node API
 export async function rsa_generateKeyPair(
   algorithm: SubtleAlgorithm,
@@ -70,8 +77,12 @@ export async function rsa_generateKeyPair(
     algorithm as RsaHashedKeyGenParams;
 
   // Validate parameters first
-  if (!modulusLength || modulusLength < 256) {
-    throw lazyDOMException('Invalid key length', 'OperationError');
+  if (!modulusLength || modulusLength < RSA_MIN_MODULUS_LENGTH) {
+    throw lazyDOMException(
+      `RSA modulusLength must be at least ${RSA_MIN_MODULUS_LENGTH} bits ` +
+        `(got ${modulusLength ?? 0})`,
+      'OperationError',
+    );
   }
 
   if (!publicExponent || publicExponent.length === 0) {
@@ -198,8 +209,11 @@ function rsa_prepareKeyGenParams(
     hash?: string;
   };
 
-  if (!modulusLength || modulusLength < 256) {
-    throw new Error('Invalid modulus length');
+  if (!modulusLength || modulusLength < RSA_MIN_MODULUS_LENGTH) {
+    throw new RangeError(
+      `RSA modulusLength must be at least ${RSA_MIN_MODULUS_LENGTH} bits ` +
+        `(got ${modulusLength ?? 0})`,
+    );
   }
 
   const pubExp = publicExponent || 65537;

package/src/scrypt.ts

@@ -35,12 +35,83 @@ const defaults = {
   maxmem: 32 * 1024 * 1024,
 };
 
+// RFC 7914 § 2: scrypt parameters
+//   N — CPU/memory cost; must be a power of 2 > 1.
+//   r — block size; positive integer.
+//   p — parallelization factor; positive integer.
+//   r * p must be < 2^30 (otherwise the spec output is undefined).
+//   The work buffer is 128 * r * N bytes, which must fit in maxmem.
+const SCRYPT_MAX_RP = 1 << 30; // 2^30 per RFC 7914
+
+function isPositiveInteger(value: unknown): value is number {
+  return (
+    typeof value === 'number' &&
+    Number.isFinite(value) &&
+    Number.isInteger(value) &&
+    value > 0
+  );
+}
+
+function validateScryptParams(
+  N: number,
+  r: number,
+  p: number,
+  maxmem: number,
+): void {
+  if (!isPositiveInteger(N)) {
+    throw new RangeError(`Invalid scrypt cost (N): ${N}`);
+  }
+  // Power-of-two & > 1 check (RFC 7914 §6 step 1).
+  if (N <= 1 || (N & (N - 1)) !== 0) {
+    throw new RangeError(
+      `Invalid scrypt cost (N): ${N} — must be a power of 2 greater than 1`,
+    );
+  }
+  if (!isPositiveInteger(r)) {
+    throw new RangeError(`Invalid scrypt blockSize (r): ${r}`);
+  }
+  if (!isPositiveInteger(p)) {
+    throw new RangeError(`Invalid scrypt parallelization (p): ${p}`);
+  }
+  if (r * p >= SCRYPT_MAX_RP) {
+    throw new RangeError(
+      `Invalid scrypt parameters: r * p (${r * p}) must be < 2^30`,
+    );
+  }
+  if (!isPositiveInteger(maxmem)) {
+    throw new RangeError(`Invalid scrypt maxmem: ${maxmem}`);
+  }
+  // 128 * r * N is the minimum working memory. Reject early so we don't
+  // hand a doomed parameter set to native and OOM the device.
+  const required = 128 * r * N;
+  if (required > maxmem) {
+    throw new RangeError(
+      `Invalid scrypt parameters: working memory ${required} bytes ` +
+        `exceeds maxmem ${maxmem}`,
+    );
+  }
+}
+
+function validateScryptKeylen(keylen: number): void {
+  if (
+    typeof keylen !== 'number' ||
+    !Number.isFinite(keylen) ||
+    !Number.isInteger(keylen) ||
+    keylen < 0 ||
+    keylen > 0x7fff_ffff
+  ) {
+    throw new TypeError('Bad key length');
+  }
+}
+
 function getScryptParams(options?: ScryptOptions) {
   const N = options?.N ?? options?.cost ?? defaults.N;
   const r = options?.r ?? options?.blockSize ?? defaults.r;
   const p = options?.p ?? options?.parallelization ?? defaults.p;
   const maxmem = options?.maxmem ?? defaults.maxmem;
 
+  validateScryptParams(N, r, p, maxmem);
+
   return { N, r, p, maxmem };
 }
 
@@ -85,9 +156,7 @@ export function scrypt(
     const sanitizedPassword = sanitizeInput(password, 'Password');
     const sanitizedSalt = sanitizeInput(salt, 'Salt');
 
-    if (keylen < 0) {
-      throw new TypeError('Bad key length');
-    }
+    validateScryptKeylen(keylen);
 
     const nativeMod = getNative();
     nativeMod
@@ -115,9 +184,7 @@ export function scryptSync(
   const sanitizedPassword = sanitizeInput(password, 'Password');
   const sanitizedSalt = sanitizeInput(salt, 'Salt');
 
-  if (keylen < 0) {
-    throw new TypeError('Bad key length');
-  }
+  validateScryptKeylen(keylen);
 
   const nativeMod = getNative();
   const result = nativeMod.deriveKeySync(

package/src/specs/utils.nitro.ts

@@ -2,6 +2,4 @@ import { type HybridObject } from 'react-native-nitro-modules';
 
 export interface Utils extends HybridObject<{ ios: 'c++'; android: 'c++' }> {
   timingSafeEqual(a: ArrayBuffer, b: ArrayBuffer): boolean;
-  bufferToString(buffer: ArrayBuffer, encoding: string): string;
-  stringToBuffer(str: string, encoding: string): ArrayBuffer;
 }

package/src/subtle.ts

@@ -83,16 +83,78 @@ function hasAnyNotIn(usages: KeyUsage[], allowed: KeyUsage[]): boolean {
   return usages.some(usage => !allowed.includes(usage));
 }
 
+// WebCrypto §18.4.4: algorithm name lookup is case-insensitive, but the
+// canonical mixed-case form is preserved in the resulting `name` field
+// (e.g. "aes-gcm" → "AES-GCM"). This map is built lazily on first call so
+// the registry of canonical names below can stay declared after the
+// function. Without this, callers who pass lowercase strings bypass the
+// downstream `SUPPORTED_ALGORITHMS` set comparisons silently.
+//
+// The map's value type is `AnyAlgorithm` so callers can use the lookup
+// result directly without re-asserting. The `as AnyAlgorithm` at insertion
+// is the single contract boundary: every name in `SUPPORTED_ALGORITHMS` is
+// already a member of `AnyAlgorithm` by construction.
+let _canonicalAlgorithmNames: Map<string, AnyAlgorithm> | null = null;
+function getCanonicalAlgorithmNames(): Map<string, AnyAlgorithm> {
+  if (_canonicalAlgorithmNames === null) {
+    const map = new Map<string, AnyAlgorithm>();
+    for (const set of Object.values(SUPPORTED_ALGORITHMS)) {
+      if (!set) continue;
+      for (const name of set) {
+        map.set(name.toLowerCase(), name as AnyAlgorithm);
+      }
+    }
+    _canonicalAlgorithmNames = map;
+  }
+  return _canonicalAlgorithmNames;
+}
+
 function normalizeAlgorithm(
   algorithm: SubtleAlgorithm | AnyAlgorithm,
   _operation: Operation,
 ): SubtleAlgorithm {
+  const map = getCanonicalAlgorithmNames();
   if (typeof algorithm === 'string') {
-    return { name: algorithm };
+    return { name: map.get(algorithm.toLowerCase()) ?? algorithm };
+  }
+  if (typeof algorithm.name === 'string') {
+    const canonical = map.get(algorithm.name.toLowerCase()) ?? algorithm.name;
+    return { ...algorithm, name: canonical };
   }
   return algorithm as SubtleAlgorithm;
 }
 
+// WebCrypto §25.7.6 (JWK import): if the JWK's `ext` member is present and
+// false, the requested `extractable` parameter must also be false. If the
+// JWK's `key_ops` member is present, every requested usage must appear in
+// it. We centralize the check here so every importKey path that accepts
+// `format === 'jwk'` can reuse it.
+function validateJwkExtAndKeyOps(
+  jwk: JWK,
+  extractable: boolean,
+  keyUsages: KeyUsage[],
+): void {
+  if (jwk.ext === false && extractable) {
+    throw lazyDOMException(
+      'JWK "ext" is false but extractable was requested',
+      'DataError',
+    );
+  }
+  if (jwk.key_ops !== undefined) {
+    if (!Array.isArray(jwk.key_ops)) {
+      throw lazyDOMException('JWK "key_ops" must be an array', 'DataError');
+    }
+    for (const usage of keyUsages) {
+      if (!jwk.key_ops.includes(usage)) {
+        throw lazyDOMException(
+          `JWK "key_ops" does not include requested usage "${usage}"`,
+          'DataError',
+        );
+      }
+    }
+  }
+}
+
 function getAlgorithmName(name: string, length: number): string {
   switch (name) {
     case 'AES-CBC':
@@ -816,6 +878,8 @@ async function kmacImportKey(
       throw lazyDOMException('Invalid keyData', 'DataError');
     }
 
+    validateJwkExtAndKeyOps(jwk, extractable, keyUsages);
+
     if (jwk.kty !== 'oct') {
       throw lazyDOMException('Invalid JWK format for KMAC key', 'DataError');
     }
@@ -902,6 +966,8 @@ function rsaImportKey(
       throw new Error('Invalid JWK format for RSA key');
     }
 
+    validateJwkExtAndKeyOps(jwk, extractable, keyUsages);
+
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
     const keyType = handle.initJwk(jwk, undefined);
@@ -992,6 +1058,8 @@ async function hmacImportKey(
       throw new Error('Invalid keyData');
     }
 
+    validateJwkExtAndKeyOps(jwk, extractable, keyUsages);
+
     if (jwk.kty !== 'oct') {
       throw new Error('Invalid JWK format for HMAC key');
     }
@@ -1069,6 +1137,8 @@ async function aesImportKey(
       throw new Error('Invalid JWK format for AES key');
     }
 
+    validateJwkExtAndKeyOps(jwk, extractable, keyUsages);
+
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
     const keyType = handle.initJwk(jwk, undefined);
@@ -1164,6 +1234,7 @@ function edImportKey(
     keyObject = new PublicKeyObject(handle);
   } else if (format === 'jwk') {
     const jwkData = data as JWK;
+    validateJwkExtAndKeyOps(jwkData, extractable, keyUsages);
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
     const keyType = handle.initJwk(jwkData);
@@ -1588,6 +1659,13 @@ const hkdfImportKey = async (
   keyUsages: KeyUsage[],
 ): Promise<CryptoKey> => {
   const { name } = algorithm;
+  // WebCrypto §28.7.6: HKDF keys are never extractable. The previous
+  // implementation passed `extractable` through verbatim, allowing callers
+  // to round-trip the input keying material via `exportKey` — defeating
+  // the whole point of the deriveBits-only usage.
+  if (extractable) {
+    throw lazyDOMException(`${name} keys are not extractable`, 'SyntaxError');
+  }
   if (hasAnyNotIn(keyUsages, ['deriveKey', 'deriveBits'])) {
     throw new Error(`Unsupported key usage for a ${name} key`);
   }
@@ -1595,7 +1673,7 @@ const hkdfImportKey = async (
   switch (format) {
     case 'raw': {
       const keyObject = createSecretKey(keyData as BinaryLike);
-      return new CryptoKey(keyObject, { name }, keyUsages, extractable);
+      return new CryptoKey(keyObject, { name }, keyUsages, false);
     }
     default:
       throw new Error(`Unable to import ${name} key with format ${format}`);
@@ -2161,12 +2239,16 @@ export class Subtle {
     baseKey: CryptoKey,
     length: number,
   ): Promise<ArrayBuffer> {
-    // Allow either deriveBits OR deriveKey usage (WebCrypto spec allows both)
-    if (
-      !baseKey.keyUsages.includes('deriveBits') &&
-      !baseKey.keyUsages.includes('deriveKey')
-    ) {
-      throw new Error('baseKey does not have deriveBits or deriveKey usage');
+    // WebCrypto §SubtleCrypto.deriveBits step 11: throw InvalidAccessError
+    // unless `baseKey.[[usages]]` contains "deriveBits" specifically. The
+    // previous `deriveBits || deriveKey` accept-either branch silently
+    // promoted deriveKey-only keys into deriveBits use, contradicting the
+    // spec usage gate.
+    if (!baseKey.keyUsages.includes('deriveBits')) {
+      throw lazyDOMException(
+        'baseKey does not have deriveBits usage',
+        'InvalidAccessError',
+      );
     }
     if (baseKey.algorithm.name !== algorithm.name)
       throw new Error('Key algorithm mismatch');

package/src/utils/cipher.ts

@@ -48,13 +48,35 @@ export function validateEncoding(data: string, encoding: string) {
   }
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export function getUIntOption(options: Record<string, any>, key: string) {
-  let value;
-  if (options && (value = options[key]) != null) {
-    // >>> Turns any type into a positive integer (also sets the sign bit to 0)
-    if (value >>> 0 !== value) throw new Error(`options.${key}: ${value}`);
-    return value;
+/**
+ * Reads an unsigned-integer option from an options-like object.
+ *
+ * Returns `undefined` if the option is missing, `null`, or `undefined`.
+ * Throws `RangeError` if the value is present but not a non-negative
+ * 32-bit integer (NaN, Infinity, fractional, negative, or > 2^32 - 1).
+ *
+ * Replaces the previous `Record<string, any>` + sentinel-`-1` signature,
+ * which defeated the type checker (audit Phase 1.4). Callers that used
+ * `getUIntOption(opts ?? {}, key) !== -1 ? getUIntOption(...) : default`
+ * collapse to `getUIntOption(opts, key) ?? default`.
+ */
+export function getUIntOption(
+  options: Readonly<Record<string, unknown>> | undefined,
+  key: string,
+): number | undefined {
+  if (options == null) return undefined;
+  const value = options[key];
+  if (value == null) return undefined;
+  if (
+    typeof value !== 'number' ||
+    !Number.isFinite(value) ||
+    !Number.isInteger(value) ||
+    value < 0 ||
+    value > 0xffff_ffff
+  ) {
+    throw new RangeError(
+      `options.${key} must be a non-negative 32-bit integer, got ${String(value)}`,
+    );
   }
-  return -1;
+  return value;
 }