react-native-quick-crypto 1.1.0 → 1.1.2

package/src/keys/classes.ts

@@ -1,4 +1,4 @@
-import { Buffer } from 'buffer';
+import { Buffer } from '@craftzdog/react-native-buffer';
 import { NitroModules } from 'react-native-nitro-modules';
 import type {
   AsymmetricKeyType,
@@ -9,7 +9,7 @@ import type {
   KeyUsage,
   SubtleAlgorithm,
 } from '../utils';
-import { KeyType, KFormatType, KeyEncoding } from '../utils';
+import { KeyType, KFormatType, KeyEncoding, getSortedUsages } from '../utils';
 import { parsePrivateKeyEncoding, parsePublicKeyEncoding } from './utils';
 
 export class CryptoKey {
@@ -30,7 +30,8 @@ export class CryptoKey {
   ) {
     this.keyObject = keyObject;
     this.keyAlgorithm = keyAlgorithm;
-    this.keyUsages = keyUsages;
+    // Frozen so external code can't mutate `key.usages` (per WebCrypto spec).
+    this.keyUsages = Object.freeze(getSortedUsages(keyUsages)) as KeyUsage[];
     this.keyExtractable = keyExtractable;
   }
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -286,15 +287,36 @@ export class PublicKeyObject extends AsymmetricKeyObject {
   export(options: { format: 'pem' } & EncodingOptions): string;
   export(options: { format: 'der' } & EncodingOptions): Buffer;
   export(options: { format: 'jwk' } & EncodingOptions): JWK;
+  export(options: { format: 'raw-public' } & EncodingOptions): Buffer;
   export(options: EncodingOptions): string | Buffer | JWK {
     if (options?.format === 'jwk') {
       return this.handle.exportJwk({}, false);
     }
+    if (options?.format === 'raw-public') {
+      if (this.asymmetricKeyType === 'ec') {
+        const pointType = options.type ?? 'uncompressed';
+        if (pointType !== 'compressed' && pointType !== 'uncompressed') {
+          throw new Error(
+            `Invalid options.type for raw-public EC export: ${pointType}`,
+          );
+        }
+        return Buffer.from(
+          this.handle.exportECPublicRaw(pointType === 'compressed'),
+        );
+      }
+      return Buffer.from(this.handle.exportRawPublic());
+    }
     const { format, type } = parsePublicKeyEncoding(
       options,
       this.asymmetricKeyType,
     );
-    const key = this.handle.exportKey(format, type);
+    if (typeof format !== 'number') {
+      throw new Error(`Unexpected format ${format} after raw-format dispatch`);
+    }
+    const key = this.handle.exportKey(
+      format,
+      typeof type === 'string' ? undefined : type,
+    );
     const buffer = Buffer.from(key);
     if (options?.format === 'pem') {
       return buffer.toString('utf-8');
@@ -311,6 +333,8 @@ export class PrivateKeyObject extends AsymmetricKeyObject {
   export(options: { format: 'pem' } & EncodingOptions): string;
   export(options: { format: 'der' } & EncodingOptions): Buffer;
   export(options: { format: 'jwk' } & EncodingOptions): JWK;
+  export(options: { format: 'raw-private' } & EncodingOptions): Buffer;
+  export(options: { format: 'raw-seed' } & EncodingOptions): Buffer;
   export(options: EncodingOptions): string | Buffer | JWK {
     if (options?.format === 'jwk') {
       if (options.passphrase !== undefined) {
@@ -318,11 +342,28 @@ export class PrivateKeyObject extends AsymmetricKeyObject {
       }
       return this.handle.exportJwk({}, false);
     }
+    if (options?.format === 'raw-private') {
+      if (this.asymmetricKeyType === 'ec') {
+        return Buffer.from(this.handle.exportECPrivateRaw());
+      }
+      return Buffer.from(this.handle.exportRawPrivate());
+    }
+    if (options?.format === 'raw-seed') {
+      return Buffer.from(this.handle.exportRawSeed());
+    }
     const { format, type, cipher, passphrase } = parsePrivateKeyEncoding(
       options,
       this.asymmetricKeyType,
     );
-    const key = this.handle.exportKey(format, type, cipher, passphrase);
+    if (typeof format !== 'number') {
+      throw new Error(`Unexpected format ${format} after raw-format dispatch`);
+    }
+    const key = this.handle.exportKey(
+      format,
+      typeof type === 'string' ? undefined : type,
+      cipher,
+      passphrase,
+    );
     const buffer = Buffer.from(key);
     if (options?.format === 'pem') {
       return buffer.toString('utf-8');

package/src/keys/generateKeyPair.ts

@@ -1,4 +1,5 @@
 import { ed_generateKeyPair } from '../ed';
+import { Buffer } from '@craftzdog/react-native-buffer';
 import { rsa_generateKeyPairNode, rsa_generateKeyPairNodeSync } from '../rsa';
 import { ec_generateKeyPairNode, ec_generateKeyPairNodeSync } from '../ec';
 import { dsa_generateKeyPairNode, dsa_generateKeyPairNodeSync } from '../dsa';
@@ -6,6 +7,7 @@ import {
   dh_generateKeyPairNode,
   dh_generateKeyPairNodeSync,
 } from '../dhKeyPair';
+import { SlhDsa, type SlhDsaVariant } from '../slhdsa';
 import {
   kEmptyObject,
   validateFunction,
@@ -17,9 +19,129 @@ import {
   type KeyPairGenConfig,
   type KeyPairKey,
   type KeyPairType,
+  type SlhDsaKeyPairType,
+  KFormatType,
+  KeyEncoding,
 } from '../utils';
+import {
+  KeyObject,
+  type PublicKeyObject,
+  type PrivateKeyObject,
+} from './classes';
 import { parsePrivateKeyEncoding, parsePublicKeyEncoding } from './utils';
 
+const SLH_DSA_TYPE_TO_VARIANT: Readonly<
+  Record<SlhDsaKeyPairType, SlhDsaVariant>
+> = {
+  'slh-dsa-sha2-128s': 'SLH-DSA-SHA2-128s',
+  'slh-dsa-sha2-128f': 'SLH-DSA-SHA2-128f',
+  'slh-dsa-sha2-192s': 'SLH-DSA-SHA2-192s',
+  'slh-dsa-sha2-192f': 'SLH-DSA-SHA2-192f',
+  'slh-dsa-sha2-256s': 'SLH-DSA-SHA2-256s',
+  'slh-dsa-sha2-256f': 'SLH-DSA-SHA2-256f',
+  'slh-dsa-shake-128s': 'SLH-DSA-SHAKE-128s',
+  'slh-dsa-shake-128f': 'SLH-DSA-SHAKE-128f',
+  'slh-dsa-shake-192s': 'SLH-DSA-SHAKE-192s',
+  'slh-dsa-shake-192f': 'SLH-DSA-SHAKE-192f',
+  'slh-dsa-shake-256s': 'SLH-DSA-SHAKE-256s',
+  'slh-dsa-shake-256f': 'SLH-DSA-SHAKE-256f',
+};
+
+function isSlhDsaType(type: string): type is SlhDsaKeyPairType {
+  return type in SLH_DSA_TYPE_TO_VARIANT;
+}
+
+function slhDsaFormatKeyPairOutput(
+  slhdsa: SlhDsa,
+  encoding: KeyPairGenConfig,
+): {
+  publicKey: PublicKeyObject | string | ArrayBuffer | Buffer;
+  privateKey: PrivateKeyObject | string | ArrayBuffer | Buffer;
+} {
+  const { publicFormat, privateFormat, cipher, passphrase } = encoding;
+
+  const publicKey = KeyObject.createKeyObject(
+    'public',
+    slhdsa.getPublicKey(),
+    KFormatType.DER,
+    KeyEncoding.SPKI,
+  ) as PublicKeyObject;
+  const privateKey = KeyObject.createKeyObject(
+    'private',
+    slhdsa.getPrivateKey(),
+    KFormatType.DER,
+    KeyEncoding.PKCS8,
+  ) as PrivateKeyObject;
+
+  let publicKeyOutput: PublicKeyObject | string | ArrayBuffer | Buffer;
+  let privateKeyOutput: PrivateKeyObject | string | ArrayBuffer | Buffer;
+
+  if (publicFormat === -1) {
+    publicKeyOutput = publicKey;
+  } else if (publicFormat === 'raw-public') {
+    publicKeyOutput = Buffer.from(publicKey.handle.exportRawPublic());
+  } else {
+    const format =
+      publicFormat === KFormatType.PEM ? KFormatType.PEM : KFormatType.DER;
+    const exported = publicKey.handle.exportKey(format, KeyEncoding.SPKI);
+    if (format === KFormatType.PEM) {
+      publicKeyOutput = Buffer.from(new Uint8Array(exported)).toString('utf-8');
+    } else {
+      publicKeyOutput = exported;
+    }
+  }
+
+  if (privateFormat === -1) {
+    privateKeyOutput = privateKey;
+  } else if (privateFormat === 'raw-private') {
+    privateKeyOutput = Buffer.from(privateKey.handle.exportRawPrivate());
+  } else if (privateFormat === 'raw-seed') {
+    privateKeyOutput = Buffer.from(privateKey.handle.exportRawSeed());
+  } else {
+    const format =
+      privateFormat === KFormatType.PEM ? KFormatType.PEM : KFormatType.DER;
+    const exported = privateKey.handle.exportKey(
+      format,
+      KeyEncoding.PKCS8,
+      cipher,
+      passphrase,
+    );
+    if (format === KFormatType.PEM) {
+      privateKeyOutput = Buffer.from(new Uint8Array(exported)).toString(
+        'utf-8',
+      );
+    } else {
+      privateKeyOutput = exported;
+    }
+  }
+
+  return { publicKey: publicKeyOutput, privateKey: privateKeyOutput };
+}
+
+function slhDsaGenerateKeyPairNodeSync(
+  type: SlhDsaKeyPairType,
+  encoding: KeyPairGenConfig,
+): {
+  publicKey: PublicKeyObject | string | ArrayBuffer | Buffer;
+  privateKey: PrivateKeyObject | string | ArrayBuffer | Buffer;
+} {
+  const slhdsa = new SlhDsa(SLH_DSA_TYPE_TO_VARIANT[type]);
+  slhdsa.generateKeyPairSync();
+  return slhDsaFormatKeyPairOutput(slhdsa, encoding);
+}
+
+async function slhDsaGenerateKeyPairNode(
+  type: SlhDsaKeyPairType,
+  encoding: KeyPairGenConfig,
+): Promise<{
+  publicKey: PublicKeyObject | string | ArrayBuffer | Buffer;
+  privateKey: PrivateKeyObject | string | ArrayBuffer | Buffer;
+}> {
+  const slhdsa = new SlhDsa(SLH_DSA_TYPE_TO_VARIANT[type]);
+  await slhdsa.generateKeyPair();
+  return slhDsaFormatKeyPairOutput(slhdsa, encoding);
+}
+
 export const generateKeyPair = (
   type: KeyPairType,
   options: GenerateKeyPairOptions,
@@ -47,7 +169,24 @@ export const generateKeyPairPromise = (
 };
 
 // generateKeyPairSync
-export function generateKeyPairSync(type: KeyPairType): CryptoKeyPair;
+export type KeyObjectKeyPair = {
+  publicKey: PublicKeyObject;
+  privateKey: PrivateKeyObject;
+};
+
+type KeyObjectGenerateKeyPairOptions = Omit<
+  GenerateKeyPairOptions,
+  'publicKeyEncoding' | 'privateKeyEncoding'
+> & {
+  publicKeyEncoding?: undefined;
+  privateKeyEncoding?: undefined;
+};
+
+export function generateKeyPairSync(type: KeyPairType): KeyObjectKeyPair;
+export function generateKeyPairSync(
+  type: KeyPairType,
+  options: KeyObjectGenerateKeyPairOptions,
+): KeyObjectKeyPair;
 export function generateKeyPairSync(
   type: KeyPairType,
   options: GenerateKeyPairOptions,
@@ -117,10 +256,10 @@ function parseKeyPairEncoding(
   }
 
   return {
-    publicFormat,
-    publicType,
-    privateFormat,
-    privateType,
+    publicFormat: publicFormat as KeyPairGenConfig['publicFormat'],
+    publicType: publicType as KeyPairGenConfig['publicType'],
+    privateFormat: privateFormat as KeyPairGenConfig['privateFormat'],
+    privateType: privateType as KeyPairGenConfig['privateType'],
     cipher,
     passphrase,
   };
@@ -147,6 +286,9 @@ function internalGenerateKeyPair(
     case 'dh':
       break;
     default: {
+      if (isSlhDsaType(type)) {
+        break;
+      }
       const err = new Error(`
         Invalid Argument options: '${type}' scheme not supported for
         generateKeyPair(). Currently not all encryption methods are supported in
@@ -168,6 +310,8 @@ function internalGenerateKeyPair(
           result = await dsa_generateKeyPairNode(options, encoding);
         } else if (type === 'dh') {
           result = await dh_generateKeyPairNode(options, encoding);
+        } else if (isSlhDsaType(type)) {
+          result = await slhDsaGenerateKeyPairNode(type, encoding);
         } else {
           throw new Error(`Unsupported key type: ${type}`);
         }
@@ -198,6 +342,8 @@ function internalGenerateKeyPair(
       result = dsa_generateKeyPairNodeSync(options, encoding);
     } else if (type === 'dh') {
       result = dh_generateKeyPairNodeSync(options, encoding);
+    } else if (isSlhDsaType(type)) {
+      result = slhDsaGenerateKeyPairNodeSync(type, encoding);
     } else {
       throw new Error(`Unsupported key type: ${type}`);
     }

package/src/keys/index.ts

@@ -40,14 +40,68 @@ import { randomBytes } from '../random';
 
 interface KeyInputObject {
   key: BinaryLike | KeyObject | CryptoKey | JWK;
-  format?: 'pem' | 'der' | 'jwk';
+  format?: 'pem' | 'der' | 'jwk' | 'raw-public' | 'raw-private' | 'raw-seed';
   type?: 'pkcs1' | 'pkcs8' | 'spki' | 'sec1';
   passphrase?: BinaryLike;
   encoding?: BufferEncoding;
+  asymmetricKeyType?: string;
+  namedCurve?: string;
 }
 
 type KeyInput = BinaryLike | KeyInputObject | KeyObject | CryptoKey;
 
+function isRawFormat(
+  format: string | undefined,
+): format is 'raw-public' | 'raw-private' | 'raw-seed' {
+  return (
+    format === 'raw-public' || format === 'raw-private' || format === 'raw-seed'
+  );
+}
+
+function createPublicKeyFromRaw(input: KeyInputObject): PublicKeyObject {
+  if (input.format !== 'raw-public') {
+    throw new Error('Invalid format for createPublicKey raw import');
+  }
+  if (typeof input.asymmetricKeyType !== 'string') {
+    throw new Error('options.asymmetricKeyType is required for raw key import');
+  }
+  if (input.asymmetricKeyType === 'ec' && !input.namedCurve) {
+    throw new Error('options.namedCurve is required for EC raw key import');
+  }
+  const handle =
+    NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
+  handle.initRawPublic(
+    input.asymmetricKeyType,
+    toAB(input.key as BinaryLike),
+    input.namedCurve,
+  );
+  return new PublicKeyObject(handle);
+}
+
+function createPrivateKeyFromRaw(input: KeyInputObject): PrivateKeyObject {
+  if (input.format !== 'raw-private' && input.format !== 'raw-seed') {
+    throw new Error('Invalid format for createPrivateKey raw import');
+  }
+  if (typeof input.asymmetricKeyType !== 'string') {
+    throw new Error('options.asymmetricKeyType is required for raw key import');
+  }
+  if (input.asymmetricKeyType === 'ec' && !input.namedCurve) {
+    throw new Error('options.namedCurve is required for EC raw key import');
+  }
+  const handle =
+    NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
+  if (input.format === 'raw-seed') {
+    handle.initRawSeed(input.asymmetricKeyType, toAB(input.key as BinaryLike));
+  } else {
+    handle.initRawPrivate(
+      input.asymmetricKeyType,
+      toAB(input.key as BinaryLike),
+      input.namedCurve,
+    );
+  }
+  return new PrivateKeyObject(handle);
+}
+
 function createSecretKey(key: BinaryLike): SecretKeyObject {
   const keyBuffer = toAB(key);
   return KeyObject.createKeyObject('secret', keyBuffer) as SecretKeyObject;
@@ -116,8 +170,10 @@ function prepareAsymmetricKey(
       return { data: toAB(data), format: 'pem', type };
     }
 
-    // Filter out 'jwk' format - only 'pem' and 'der' are supported here
-    const filteredFormat = format === 'jwk' ? undefined : format;
+    // Filter to only 'pem' or 'der' — JWK and raw formats are handled
+    // separately via dedicated paths.
+    const filteredFormat: 'pem' | 'der' | undefined =
+      format === 'pem' || format === 'der' ? format : undefined;
     return { data: toAB(data), format: filteredFormat, type };
   }
 
@@ -125,6 +181,14 @@ function prepareAsymmetricKey(
 }
 
 function createPublicKey(key: KeyInput): PublicKeyObject {
+  if (typeof key === 'object' && 'key' in key && isRawFormat(key.format)) {
+    if (key.format !== 'raw-public') {
+      throw new Error(
+        `Invalid format ${key.format} for createPublicKey — only 'raw-public' is allowed`,
+      );
+    }
+    return createPublicKeyFromRaw(key as KeyInputObject);
+  }
   if (typeof key === 'object' && 'key' in key && key.format === 'jwk') {
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');
@@ -169,6 +233,12 @@ function createPublicKey(key: KeyInput): PublicKeyObject {
 }
 
 function createPrivateKey(key: KeyInput): PrivateKeyObject {
+  if (typeof key === 'object' && 'key' in key && isRawFormat(key.format)) {
+    if (key.format === 'raw-public') {
+      throw new Error("Invalid format 'raw-public' for createPrivateKey");
+    }
+    return createPrivateKeyFromRaw(key as KeyInputObject);
+  }
   if (typeof key === 'object' && 'key' in key && key.format === 'jwk') {
     const handle =
       NitroModules.createHybridObject<KeyObjectHandle>('KeyObjectHandle');

package/src/keys/publicCipher.ts

@@ -144,8 +144,13 @@ export function publicDecrypt(
       paddingMode,
     );
     return Buffer.from(decrypted);
-  } catch (error) {
-    throw new Error(`publicDecrypt failed: ${(error as Error).message}`);
+  } catch {
+    // Bleichenbacher mitigation: surface a single, content-independent error
+    // for every decrypt failure so an attacker cannot use error-message
+    // differences as a padding oracle. The native side already collapses its
+    // OpenSSL error codes to the same opaque message; we drop it here too
+    // rather than re-leaking it via string interpolation.
+    throw new Error('publicDecrypt failed');
   }
 }
 
@@ -244,7 +249,8 @@ export function privateDecrypt(
       oaepLabel,
     );
     return Buffer.from(decrypted);
-  } catch (error) {
-    throw new Error(`privateDecrypt failed: ${(error as Error).message}`);
+  } catch {
+    // Bleichenbacher mitigation — see publicDecrypt above.
+    throw new Error('privateDecrypt failed');
   }
 }

package/src/keys/signVerify.ts

@@ -13,6 +13,7 @@ import {
   KFormatType,
   KeyEncoding,
 } from '../utils';
+import { constants } from '../constants';
 
 type KeyInput = BinaryLike | KeyObject | CryptoKey | KeyInputObject;
 
@@ -144,6 +145,16 @@ function dsaEncodingToNumber(
   return undefined;
 }
 
+function getSaltLength(options?: SignOptions): number | undefined {
+  if (
+    options?.padding === constants.RSA_PKCS1_PSS_PADDING &&
+    options?.saltLength === undefined
+  ) {
+    return constants.RSA_PSS_SALTLEN_MAX_SIGN;
+  }
+  return options?.saltLength;
+}
+
 export class Sign {
   private handle: SignHandleSpec;
 
@@ -169,7 +180,7 @@ export class Sign {
     const signature = this.handle.sign(
       keyObject.handle,
       options?.padding,
-      options?.saltLength,
+      getSaltLength(options),
       dsaEncodingToNumber(options?.dsaEncoding),
     );
 
@@ -219,7 +230,7 @@ export class Verify {
       keyObject.handle,
       sigBuffer,
       options?.padding,
-      options?.saltLength,
+      getSaltLength(options),
       dsaEncodingToNumber(options?.dsaEncoding),
     );
   }

package/src/keys/utils.ts

@@ -5,13 +5,36 @@ import {
   KFormatType,
 } from '../utils';
 import type { CryptoKeyPair, EncodingOptions } from '../utils';
-import type { CryptoKey } from './classes';
+import type { CryptoKey, PublicKeyObject, PrivateKeyObject } from './classes';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const isCryptoKey = (obj: any): boolean => {
   return obj !== null && obj?.keyObject !== undefined;
 };
 
+export function exportPublicKeyRaw(
+  pub: PublicKeyObject,
+  pointType: 'compressed' | 'uncompressed' | undefined,
+): ArrayBuffer {
+  if (pub.asymmetricKeyType === 'ec') {
+    return pub.handle.exportECPublicRaw(pointType === 'compressed');
+  }
+  return pub.handle.exportRawPublic();
+}
+
+export function exportPrivateKeyRaw(
+  priv: PrivateKeyObject,
+  format: 'raw-private' | 'raw-seed',
+): ArrayBuffer {
+  if (format === 'raw-seed') {
+    return priv.handle.exportRawSeed();
+  }
+  if (priv.asymmetricKeyType === 'ec') {
+    return priv.handle.exportECPrivateRaw();
+  }
+  return priv.handle.exportRawPrivate();
+}
+
 export function getCryptoKeyPair(
   key: CryptoKey | CryptoKeyPair,
 ): CryptoKeyPair {
@@ -62,6 +85,19 @@ export function parseKeyEncoding(
     objName,
   );
 
+  if (
+    format === 'raw-public' ||
+    format === 'raw-private' ||
+    format === 'raw-seed'
+  ) {
+    if (enc.cipher != null || enc.passphrase !== undefined) {
+      throw new Error(
+        `Incompatible key options: ${format} does not support encryption`,
+      );
+    }
+    return { format, type, cipher: undefined, passphrase: undefined };
+  }
+
   let cipher, passphrase, encoding;
   if (isPublic !== true) {
     ({ cipher, passphrase, encoding } = enc);
@@ -77,7 +113,7 @@ export function parseKeyEncoding(
           (type === KeyEncoding.PKCS1 || type === KeyEncoding.SEC1)
         ) {
           throw new Error(
-            `Incompatible key options ${encodingNames[type]} does not support encryption`,
+            `Incompatible key options ${encodingNames[type as KeyEncoding]} does not support encryption`,
           );
         }
       } else if (passphrase !== undefined) {
@@ -120,12 +156,15 @@ function parseKeyFormat(
   formatStr?: string,
   defaultFormat?: KFormatType,
   optionName?: string,
-) {
+): KFormatType | 'raw-public' | 'raw-private' | 'raw-seed' {
   if (formatStr === undefined && defaultFormat !== undefined)
     return defaultFormat;
   else if (formatStr === 'pem') return KFormatType.PEM;
   else if (formatStr === 'der') return KFormatType.DER;
   else if (formatStr === 'jwk') return KFormatType.JWK;
+  else if (formatStr === 'raw-public') return 'raw-public';
+  else if (formatStr === 'raw-private') return 'raw-private';
+  else if (formatStr === 'raw-seed') return 'raw-seed';
   throw new Error(`Invalid key format str: ${optionName}`);
 }
 
@@ -166,7 +205,10 @@ function parseKeyFormatAndType(
   keyType?: string,
   isPublic?: boolean,
   objName?: string,
-) {
+): {
+  format: KFormatType | 'raw-public' | 'raw-private' | 'raw-seed';
+  type: KeyEncoding | 'compressed' | 'uncompressed' | undefined;
+} {
   const { format: formatStr, type: typeStr } = enc;
 
   const isInput = keyType === undefined;
@@ -176,11 +218,42 @@ function parseKeyFormatAndType(
     option('format', objName),
   );
 
+  if (format === 'raw-public') {
+    if (isPublic === false) {
+      throw new Error(
+        `Invalid format 'raw-public' for ${option('format', objName)}`,
+      );
+    }
+    if (typeStr === undefined || typeStr === 'uncompressed') {
+      return { format, type: 'uncompressed' };
+    }
+    if (typeStr === 'compressed') {
+      return { format, type: 'compressed' };
+    }
+    throw new Error(
+      `Invalid ${option('type', objName)} for raw-public: ${typeStr}`,
+    );
+  }
+
+  if (format === 'raw-private' || format === 'raw-seed') {
+    if (isPublic === true) {
+      throw new Error(
+        `Invalid format '${format}' for ${option('format', objName)}`,
+      );
+    }
+    if (typeStr !== undefined) {
+      throw new Error(
+        `Invalid ${option('type', objName)} for ${format}: ${typeStr}`,
+      );
+    }
+    return { format, type: undefined };
+  }
+
   const isRequired =
     (!isInput || format === KFormatType.DER) && format !== KFormatType.JWK;
 
   const type = parseKeyType(
-    typeStr,
+    typeStr as string | undefined,
     isRequired,
     keyType,
     isPublic,