react-native-quick-crypto 1.1.0 → 1.1.2

package/cpp/cipher/XChaCha20Poly1305Cipher.cpp

@@ -29,19 +29,16 @@ XChaCha20Poly1305Cipher::~XChaCha20Poly1305Cipher() {
 }
 
 void XChaCha20Poly1305Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
-  auto native_key = ToNativeArrayBuffer(cipher_key);
-  auto native_iv = ToNativeArrayBuffer(iv);
-
-  if (native_key->size() != kKeySize) {
-    throw std::runtime_error("XChaCha20-Poly1305 key must be 32 bytes, got " + std::to_string(native_key->size()) + " bytes");
+  if (cipher_key->size() != kKeySize) {
+    throw std::runtime_error("XChaCha20-Poly1305 key must be 32 bytes, got " + std::to_string(cipher_key->size()) + " bytes");
   }
 
-  if (native_iv->size() != kNonceSize) {
-    throw std::runtime_error("XChaCha20-Poly1305 nonce must be 24 bytes, got " + std::to_string(native_iv->size()) + " bytes");
+  if (iv->size() != kNonceSize) {
+    throw std::runtime_error("XChaCha20-Poly1305 nonce must be 24 bytes, got " + std::to_string(iv->size()) + " bytes");
   }
 
-  std::memcpy(key_, native_key->data(), kKeySize);
-  std::memcpy(nonce_, native_iv->data(), kNonceSize);
+  std::memcpy(key_, cipher_key->data(), kKeySize);
+  std::memcpy(nonce_, iv->data(), kNonceSize);
 
   data_buffer_.clear();
   aad_.clear();
@@ -53,12 +50,11 @@ std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::update(const std::shared_p
 #ifndef BLSALLOC_SODIUM
   throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
 #else
-  auto native_data = ToNativeArrayBuffer(data);
-  size_t data_len = native_data->size();
+  size_t data_len = data->size();
 
   size_t old_size = data_buffer_.size();
   data_buffer_.resize(old_size + data_len);
-  std::memcpy(data_buffer_.data() + old_size, native_data->data(), data_len);
+  std::memcpy(data_buffer_.data() + old_size, data->data(), data_len);
 
   return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
 #endif
@@ -70,42 +66,42 @@ std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::final() {
   throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
 #else
   if (is_cipher) {
-    uint8_t* ciphertext = new uint8_t[data_buffer_.size()];
+    auto ciphertext = std::make_unique<uint8_t[]>(data_buffer_.size());
 
     int result =
-        crypto_aead_xchacha20poly1305_ietf_encrypt_detached(ciphertext, auth_tag_, nullptr, data_buffer_.data(), data_buffer_.size(),
+        crypto_aead_xchacha20poly1305_ietf_encrypt_detached(ciphertext.get(), auth_tag_, nullptr, data_buffer_.data(), data_buffer_.size(),
                                                             aad_.empty() ? nullptr : aad_.data(), aad_.size(), nullptr, nonce_, key_);
 
     if (result != 0) {
-      sodium_memzero(ciphertext, data_buffer_.size());
-      delete[] ciphertext;
+      sodium_memzero(ciphertext.get(), data_buffer_.size());
       throw std::runtime_error("XChaCha20Poly1305Cipher: encryption failed");
     }
 
     is_finalized = true;
     size_t ct_len = data_buffer_.size();
-    return std::make_shared<NativeArrayBuffer>(ciphertext, ct_len, [=]() { delete[] ciphertext; });
+    uint8_t* raw_ptr = ciphertext.get();
+    return std::make_shared<NativeArrayBuffer>(ciphertext.release(), ct_len, [raw_ptr]() { delete[] raw_ptr; });
   } else {
     if (data_buffer_.empty()) {
       is_finalized = true;
       return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
     }
 
-    uint8_t* plaintext = new uint8_t[data_buffer_.size()];
+    auto plaintext = std::make_unique<uint8_t[]>(data_buffer_.size());
 
     int result =
-        crypto_aead_xchacha20poly1305_ietf_decrypt_detached(plaintext, nullptr, data_buffer_.data(), data_buffer_.size(), auth_tag_,
+        crypto_aead_xchacha20poly1305_ietf_decrypt_detached(plaintext.get(), nullptr, data_buffer_.data(), data_buffer_.size(), auth_tag_,
                                                             aad_.empty() ? nullptr : aad_.data(), aad_.size(), nonce_, key_);
 
     if (result != 0) {
-      sodium_memzero(plaintext, data_buffer_.size());
-      delete[] plaintext;
+      sodium_memzero(plaintext.get(), data_buffer_.size());
       throw std::runtime_error("XChaCha20Poly1305Cipher: decryption failed - authentication tag mismatch");
     }
 
     is_finalized = true;
     size_t pt_len = data_buffer_.size();
-    return std::make_shared<NativeArrayBuffer>(plaintext, pt_len, [=]() { delete[] plaintext; });
+    uint8_t* raw_ptr = plaintext.get();
+    return std::make_shared<NativeArrayBuffer>(plaintext.release(), pt_len, [raw_ptr]() { delete[] raw_ptr; });
   }
 #endif
 }
@@ -114,9 +110,8 @@ bool XChaCha20Poly1305Cipher::setAAD(const std::shared_ptr<ArrayBuffer>& data, s
 #ifndef BLSALLOC_SODIUM
   throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
 #else
-  auto native_aad = ToNativeArrayBuffer(data);
-  aad_.resize(native_aad->size());
-  std::memcpy(aad_.data(), native_aad->data(), native_aad->size());
+  aad_.resize(data->size());
+  std::memcpy(aad_.data(), data->data(), data->size());
   return true;
 #endif
 }
@@ -132,9 +127,10 @@ std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::getAuthTag() {
     throw std::runtime_error("getAuthTag must be called after final()");
   }
 
-  uint8_t* tag_copy = new uint8_t[kTagSize];
-  std::memcpy(tag_copy, auth_tag_, kTagSize);
-  return std::make_shared<NativeArrayBuffer>(tag_copy, kTagSize, [=]() { delete[] tag_copy; });
+  auto tag_copy = std::make_unique<uint8_t[]>(kTagSize);
+  std::memcpy(tag_copy.get(), auth_tag_, kTagSize);
+  uint8_t* raw_ptr = tag_copy.get();
+  return std::make_shared<NativeArrayBuffer>(tag_copy.release(), kTagSize, [raw_ptr]() { delete[] raw_ptr; });
 #endif
 }
 
@@ -146,12 +142,11 @@ bool XChaCha20Poly1305Cipher::setAuthTag(const std::shared_ptr<ArrayBuffer>& tag
     throw std::runtime_error("setAuthTag can only be called during decryption");
   }
 
-  auto native_tag = ToNativeArrayBuffer(tag);
-  if (native_tag->size() != kTagSize) {
-    throw std::runtime_error("XChaCha20-Poly1305 tag must be 16 bytes, got " + std::to_string(native_tag->size()) + " bytes");
+  if (tag->size() != kTagSize) {
+    throw std::runtime_error("XChaCha20-Poly1305 tag must be 16 bytes, got " + std::to_string(tag->size()) + " bytes");
   }
 
-  std::memcpy(auth_tag_, native_tag->data(), kTagSize);
+  std::memcpy(auth_tag_, tag->data(), kTagSize);
   return true;
 #endif
 }

package/cpp/cipher/XSalsa20Cipher.cpp

@@ -1,4 +1,6 @@
+#include <algorithm>
 #include <cstring>   // For std::memcpy
+#include <memory>    // For std::unique_ptr
 #include <stdexcept> // For std::runtime_error
 
 #include "NitroModules/ArrayBuffer.hpp"
@@ -11,41 +13,101 @@ namespace margelo::nitro::crypto {
  * Initialize the cipher with a key and a nonce (using iv argument as nonce)
  */
 void XSalsa20Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
-  auto native_key = ToNativeArrayBuffer(cipher_key);
-  auto native_iv = ToNativeArrayBuffer(iv);
-
   // Validate key size
-  if (native_key->size() < crypto_stream_KEYBYTES) {
+  if (cipher_key->size() < crypto_stream_KEYBYTES) {
     throw std::runtime_error("XSalsa20 key too short: expected " + std::to_string(crypto_stream_KEYBYTES) + " bytes, got " +
-                             std::to_string(native_key->size()) + " bytes.");
+                             std::to_string(cipher_key->size()) + " bytes.");
   }
   // Validate nonce size
-  if (native_iv->size() < crypto_stream_NONCEBYTES) {
+  if (iv->size() < crypto_stream_NONCEBYTES) {
     throw std::runtime_error("XSalsa20 nonce too short: expected " + std::to_string(crypto_stream_NONCEBYTES) + " bytes, got " +
-                             std::to_string(native_iv->size()) + " bytes.");
+                             std::to_string(iv->size()) + " bytes.");
   }
 
   // Copy key and nonce data
-  std::memcpy(key, native_key->data(), crypto_stream_KEYBYTES);
-  std::memcpy(nonce, native_iv->data(), crypto_stream_NONCEBYTES);
+  std::memcpy(key, cipher_key->data(), crypto_stream_KEYBYTES);
+  std::memcpy(nonce, iv->data(), crypto_stream_NONCEBYTES);
+
+  // Reset streaming state so a re-init'd cipher does not accidentally reuse
+  // keystream bytes from a previous session.
+  block_counter = 0;
+  leftover_offset = kSalsa20BlockBytes;
+
   is_finalized = false;
 }
 
 /**
- * xsalsa20 call to sodium implementation
+ * xsalsa20 update — encrypts/decrypts `data` while keeping the keystream
+ * advancing across successive update() calls.
+ *
+ * Implementation notes:
+ *   1. First, drain any unused keystream bytes left over from the previous
+ *      chunk's trailing partial block.
+ *   2. Then process as many aligned whole 64-byte blocks as possible by
+ *      jumping the keystream to `block_counter` via crypto_stream_xsalsa20_xor_ic.
+ *   3. For the remaining tail (< 64 bytes), generate one full keystream
+ *      block, XOR the requested prefix, and stash the unused suffix for the
+ *      next update() call.
  */
 std::shared_ptr<ArrayBuffer> XSalsa20Cipher::update(const std::shared_ptr<ArrayBuffer>& data) {
   checkNotFinalized();
 #ifndef BLSALLOC_SODIUM
   throw std::runtime_error("XSalsa20Cipher: libsodium must be enabled to use this cipher (BLSALLOC_SODIUM is not defined).");
 #else
-  auto native_data = ToNativeArrayBuffer(data);
-  auto output = new uint8_t[native_data->size()];
-  int result = crypto_stream_xor(output, native_data->data(), native_data->size(), nonce, key);
-  if (result != 0) {
-    throw std::runtime_error("XSalsa20Cipher: Failed to update");
+  const std::size_t data_size = data->size();
+
+  if (data_size == 0) {
+    return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+  }
+
+  // Owning buffer: prevents leaking `output` if we throw on the way out.
+  auto output = std::make_unique<uint8_t[]>(data_size);
+  const uint8_t* input = data->data();
+  std::size_t pos = 0;
+
+  // (1) Drain any unused keystream from the previous update()'s tail block.
+  if (leftover_offset < kSalsa20BlockBytes) {
+    const std::size_t avail = kSalsa20BlockBytes - leftover_offset;
+    const std::size_t take = std::min(avail, data_size);
+    for (std::size_t i = 0; i < take; ++i) {
+      output[i] = input[i] ^ leftover_keystream[leftover_offset + i];
+    }
+    leftover_offset += take;
+    pos = take;
+  }
+
+  // (2) Encrypt the aligned whole blocks at the current block counter.
+  const std::size_t remaining = data_size - pos;
+  const std::size_t whole_blocks = remaining / kSalsa20BlockBytes;
+  const std::size_t whole_bytes = whole_blocks * kSalsa20BlockBytes;
+  if (whole_bytes > 0) {
+    int rc = crypto_stream_xsalsa20_xor_ic(output.get() + pos, input + pos, whole_bytes, nonce, block_counter, key);
+    if (rc != 0) {
+      throw std::runtime_error("XSalsa20Cipher: crypto_stream_xsalsa20_xor_ic failed");
+    }
+    block_counter += whole_blocks;
+    pos += whole_bytes;
   }
-  return std::make_shared<NativeArrayBuffer>(output, native_data->size(), [=]() { delete[] output; });
+
+  // (3) For any trailing partial block, generate one full keystream block,
+  //     XOR the requested prefix, and stash the unused keystream bytes for
+  //     the next update() call.
+  const std::size_t tail = data_size - pos;
+  if (tail > 0) {
+    uint8_t zeros[kSalsa20BlockBytes] = {};
+    int rc = crypto_stream_xsalsa20_xor_ic(leftover_keystream, zeros, kSalsa20BlockBytes, nonce, block_counter, key);
+    if (rc != 0) {
+      throw std::runtime_error("XSalsa20Cipher: crypto_stream_xsalsa20_xor_ic failed");
+    }
+    for (std::size_t i = 0; i < tail; ++i) {
+      output[pos + i] = input[pos + i] ^ leftover_keystream[i];
+    }
+    leftover_offset = tail;
+    block_counter += 1;
+  }
+
+  uint8_t* raw = output.release();
+  return std::make_shared<NativeArrayBuffer>(raw, data_size, [=]() { delete[] raw; });
 #endif
 }
 

package/cpp/cipher/XSalsa20Cipher.hpp

@@ -8,17 +8,26 @@
 #define crypto_stream_NONCEBYTES 24 // XSalsa20 nonce size (24 bytes)
 #endif
 
+#include <cstddef>
+#include <cstdint>
+
 #include "HybridCipher.hpp"
 #include "NitroModules/ArrayBuffer.hpp"
+#include "QuickCryptoUtils.hpp"
 
 namespace margelo::nitro::crypto {
 
 class XSalsa20Cipher : public HybridCipher {
  public:
   XSalsa20Cipher() : HybridObject(TAG) {}
-  ~XSalsa20Cipher() {
-    // Let parent destructor free the context
-    ctx = nullptr;
+  ~XSalsa20Cipher() override {
+    // Wipe key material and any cached keystream bytes before the heap is
+    // returned. Without this the secret-bearing bytes persist on the heap
+    // until overwritten — see audit HIGH finding (XSalsa20Cipher.hpp:19-22).
+    // The base-class unique_ptr ctx frees itself; we don't touch it here.
+    secureZero(key);
+    secureZero(nonce);
+    secureZero(leftover_keystream);
   }
 
   void init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) override;
@@ -26,8 +35,21 @@ class XSalsa20Cipher : public HybridCipher {
   std::shared_ptr<ArrayBuffer> final() override;
 
  private:
+  // Salsa20 (and therefore XSalsa20) processes the keystream in 64-byte blocks.
+  static constexpr std::size_t kSalsa20BlockBytes = 64;
+
   uint8_t key[crypto_stream_KEYBYTES];
   uint8_t nonce[crypto_stream_NONCEBYTES];
+
+  // Streaming state — keeps the keystream advancing across multiple update()
+  // calls. Without this, every update() would restart at block 0, producing
+  // identical keystream for each chunk (a two-time-pad break).
+  uint8_t leftover_keystream[kSalsa20BlockBytes] = {};
+  // 0..kSalsa20BlockBytes; the sentinel value kSalsa20BlockBytes means "no
+  // leftover keystream available — start the next chunk on a block boundary".
+  std::size_t leftover_offset = kSalsa20BlockBytes;
+  // Index of the next 64-byte keystream block to consume.
+  uint64_t block_counter = 0;
 };
 
 } // namespace margelo::nitro::crypto

package/cpp/cipher/XSalsa20Poly1305Cipher.cpp

@@ -9,35 +9,27 @@
 namespace margelo::nitro::crypto {
 
 XSalsa20Poly1305Cipher::~XSalsa20Poly1305Cipher() {
-#ifdef BLSALLOC_SODIUM
-  sodium_memzero(key_, kKeySize);
-  sodium_memzero(nonce_, kNonceSize);
-  sodium_memzero(auth_tag_, kTagSize);
-  if (!data_buffer_.empty()) {
-    sodium_memzero(data_buffer_.data(), data_buffer_.size());
-  }
-#else
-  std::memset(key_, 0, kKeySize);
-  std::memset(nonce_, 0, kNonceSize);
-  std::memset(auth_tag_, 0, kTagSize);
-#endif
+  // Always wipe via OPENSSL_cleanse (even when libsodium is enabled) so the
+  // non-sodium `std::memset` fallback can't be optimized away by the
+  // compiler. Audit MEDIUM finding (XSalsa20Poly1305Cipher.cpp:20-22).
+  secureZero(key_);
+  secureZero(nonce_);
+  secureZero(auth_tag_);
+  secureZero(data_buffer_);
   data_buffer_.clear();
 }
 
 void XSalsa20Poly1305Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
-  auto native_key = ToNativeArrayBuffer(cipher_key);
-  auto native_iv = ToNativeArrayBuffer(iv);
-
-  if (native_key->size() != kKeySize) {
-    throw std::runtime_error("XSalsa20-Poly1305 key must be 32 bytes, got " + std::to_string(native_key->size()) + " bytes");
+  if (cipher_key->size() != kKeySize) {
+    throw std::runtime_error("XSalsa20-Poly1305 key must be 32 bytes, got " + std::to_string(cipher_key->size()) + " bytes");
   }
 
-  if (native_iv->size() != kNonceSize) {
-    throw std::runtime_error("XSalsa20-Poly1305 nonce must be 24 bytes, got " + std::to_string(native_iv->size()) + " bytes");
+  if (iv->size() != kNonceSize) {
+    throw std::runtime_error("XSalsa20-Poly1305 nonce must be 24 bytes, got " + std::to_string(iv->size()) + " bytes");
   }
 
-  std::memcpy(key_, native_key->data(), kKeySize);
-  std::memcpy(nonce_, native_iv->data(), kNonceSize);
+  std::memcpy(key_, cipher_key->data(), kKeySize);
+  std::memcpy(nonce_, iv->data(), kNonceSize);
 
   data_buffer_.clear();
   is_finalized = false;
@@ -48,12 +40,11 @@ std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::update(const std::shared_pt
 #ifndef BLSALLOC_SODIUM
   throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
 #else
-  auto native_data = ToNativeArrayBuffer(data);
-  size_t data_len = native_data->size();
+  size_t data_len = data->size();
 
   size_t old_size = data_buffer_.size();
   data_buffer_.resize(old_size + data_len);
-  std::memcpy(data_buffer_.data() + old_size, native_data->data(), data_len);
+  std::memcpy(data_buffer_.data() + old_size, data->data(), data_len);
 
   return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
 #endif
@@ -65,38 +56,38 @@ std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::final() {
   throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
 #else
   if (is_cipher) {
-    uint8_t* ciphertext = new uint8_t[data_buffer_.size()];
+    auto ciphertext = std::make_unique<uint8_t[]>(data_buffer_.size());
 
-    int result = crypto_secretbox_detached(ciphertext, auth_tag_, data_buffer_.data(), data_buffer_.size(), nonce_, key_);
+    int result = crypto_secretbox_detached(ciphertext.get(), auth_tag_, data_buffer_.data(), data_buffer_.size(), nonce_, key_);
 
     if (result != 0) {
-      sodium_memzero(ciphertext, data_buffer_.size());
-      delete[] ciphertext;
+      sodium_memzero(ciphertext.get(), data_buffer_.size());
       throw std::runtime_error("XSalsa20Poly1305Cipher: encryption failed");
     }
 
     is_finalized = true;
     size_t ct_len = data_buffer_.size();
-    return std::make_shared<NativeArrayBuffer>(ciphertext, ct_len, [=]() { delete[] ciphertext; });
+    uint8_t* raw_ptr = ciphertext.get();
+    return std::make_shared<NativeArrayBuffer>(ciphertext.release(), ct_len, [raw_ptr]() { delete[] raw_ptr; });
   } else {
     if (data_buffer_.empty()) {
       is_finalized = true;
       return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
     }
 
-    uint8_t* plaintext = new uint8_t[data_buffer_.size()];
+    auto plaintext = std::make_unique<uint8_t[]>(data_buffer_.size());
 
-    int result = crypto_secretbox_open_detached(plaintext, data_buffer_.data(), auth_tag_, data_buffer_.size(), nonce_, key_);
+    int result = crypto_secretbox_open_detached(plaintext.get(), data_buffer_.data(), auth_tag_, data_buffer_.size(), nonce_, key_);
 
     if (result != 0) {
-      sodium_memzero(plaintext, data_buffer_.size());
-      delete[] plaintext;
+      sodium_memzero(plaintext.get(), data_buffer_.size());
       throw std::runtime_error("XSalsa20Poly1305Cipher: decryption failed - authentication tag mismatch");
     }
 
     is_finalized = true;
     size_t pt_len = data_buffer_.size();
-    return std::make_shared<NativeArrayBuffer>(plaintext, pt_len, [=]() { delete[] plaintext; });
+    uint8_t* raw_ptr = plaintext.get();
+    return std::make_shared<NativeArrayBuffer>(plaintext.release(), pt_len, [raw_ptr]() { delete[] raw_ptr; });
   }
 #endif
 }
@@ -116,9 +107,10 @@ std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::getAuthTag() {
     throw std::runtime_error("getAuthTag must be called after final()");
   }
 
-  uint8_t* tag_copy = new uint8_t[kTagSize];
-  std::memcpy(tag_copy, auth_tag_, kTagSize);
-  return std::make_shared<NativeArrayBuffer>(tag_copy, kTagSize, [=]() { delete[] tag_copy; });
+  auto tag_copy = std::make_unique<uint8_t[]>(kTagSize);
+  std::memcpy(tag_copy.get(), auth_tag_, kTagSize);
+  uint8_t* raw_ptr = tag_copy.get();
+  return std::make_shared<NativeArrayBuffer>(tag_copy.release(), kTagSize, [raw_ptr]() { delete[] raw_ptr; });
 #endif
 }
 
@@ -130,12 +122,11 @@ bool XSalsa20Poly1305Cipher::setAuthTag(const std::shared_ptr<ArrayBuffer>& tag)
     throw std::runtime_error("setAuthTag can only be called during decryption");
   }
 
-  auto native_tag = ToNativeArrayBuffer(tag);
-  if (native_tag->size() != kTagSize) {
-    throw std::runtime_error("XSalsa20-Poly1305 tag must be 16 bytes, got " + std::to_string(native_tag->size()) + " bytes");
+  if (tag->size() != kTagSize) {
+    throw std::runtime_error("XSalsa20-Poly1305 tag must be 16 bytes, got " + std::to_string(tag->size()) + " bytes");
   }
 
-  std::memcpy(auth_tag_, native_tag->data(), kTagSize);
+  std::memcpy(auth_tag_, tag->data(), kTagSize);
   return true;
 #endif
 }

package/cpp/dh/HybridDiffieHellman.cpp

@@ -133,6 +133,35 @@ std::shared_ptr<ArrayBuffer> HybridDiffieHellman::computeSecret(const std::share
   const BIGNUM *p, *q, *g;
   DH_get0_pqg(ourDh, &p, &q, &g);
 
+  // Validate the peer's public key against our DH parameters BEFORE doing
+  // anything else. EVP_PKEY_derive_set_peer() does NOT call DH_check_pub_key,
+  // so without this check a peer key of 0, 1, or p-1 silently produces a
+  // degenerate "shared secret" (0, 1, or ±1) — the small-subgroup attack.
+  // Match the ncrypto pattern (DHPointer::checkPublicKey) and Node.js error
+  // surface so callers see why the key was rejected.
+  {
+    BN_ptr peerPubCheck(BN_bin2bn(otherPublicKey->data(), static_cast<int>(otherPublicKey->size()), nullptr), BN_free);
+    if (!peerPubCheck) {
+      throw std::runtime_error("DiffieHellman: failed to parse peer public key");
+    }
+    int codes = 0;
+    if (DH_check_pub_key(ourDh, peerPubCheck.get(), &codes) != 1) {
+      throw std::runtime_error("DiffieHellman: failed to check peer public key");
+    }
+    if (codes & DH_CHECK_PUBKEY_TOO_SMALL) {
+      throw std::runtime_error("DiffieHellman: peer public key is too small (<= 1)");
+    }
+    if (codes & DH_CHECK_PUBKEY_TOO_LARGE) {
+      throw std::runtime_error("DiffieHellman: peer public key is too large (>= p-1)");
+    }
+    if (codes & DH_CHECK_PUBKEY_INVALID) {
+      throw std::runtime_error("DiffieHellman: peer public key is invalid (not in subgroup)");
+    }
+    if (codes != 0) {
+      throw std::runtime_error("DiffieHellman: peer public key is invalid");
+    }
+  }
+
   // Create peer DH with same parameters but peer's public key
   DH_ptr peerDh(DH_new(), DH_free);
   if (!peerDh) {