simple-hpke 0.2.0 → 0.3.1

package/dist/meta.json

@@ -690,8 +690,19 @@
       ],
       "format": "esm"
     },
+    "src/errors.ts": {
+      "bytes": 975,
+      "imports": [
+        {
+          "path": "<runtime>",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "format": "esm"
+    },
     "src/index.ts": {
-      "bytes": 12639,
+      "bytes": 14331,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -703,11 +714,21 @@
           "kind": "import-statement",
           "original": "./util"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors"
+        },
         {
           "path": "src/constants.ts",
           "kind": "import-statement",
           "original": "./constants"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors"
+        },
         {
           "path": "<runtime>",
           "kind": "import-statement",
@@ -717,7 +738,7 @@
       "format": "esm"
     },
     "src/util.ts": {
-      "bytes": 13967,
+      "bytes": 17940,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -729,6 +750,11 @@
           "kind": "import-statement",
           "original": "./index.js"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors.js"
+        },
         {
           "path": "src/constants.ts",
           "kind": "import-statement",
@@ -743,7 +769,7 @@
       "format": "esm"
     },
     "src/constants.ts": {
-      "bytes": 1348,
+      "bytes": 2125,
       "imports": [
         {
           "path": "src/util.ts",
@@ -759,7 +785,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 112940
+      "bytes": 121397
     },
     "dist/constants.js": {
       "imports": [],
@@ -772,6 +798,8 @@
         "KDF_ID",
         "KEM_ID",
         "KEM_SUITE_ID",
+        "KEY_ID_LABEL",
+        "KEY_ID_NONCE_LENGTH",
         "MODE_BASE",
         "NK",
         "NN",
@@ -864,31 +892,55 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/index.ts": {
-          "bytesInOutput": 5486
+          "bytesInOutput": 5995
         },
         "src/util.ts": {
-          "bytesInOutput": 6618
+          "bytesInOutput": 7314
         },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
+        }
+      },
+      "bytes": 52563
+    },
+    "dist/errors.js.map": {
+      "imports": [],
+      "exports": [],
+      "inputs": {},
+      "bytes": 1293
+    },
+    "dist/errors.js": {
+      "imports": [],
+      "exports": [
+        "HpkeError"
+      ],
+      "entryPoint": "src/errors.ts",
+      "inputs": {
+        "src/errors.ts": {
+          "bytesInOutput": 213
         }
       },
-      "bytes": 50987
+      "bytes": 419
     },
     "dist/index.js.map": {
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 113074
+      "bytes": 122106
     },
     "dist/index.js": {
       "imports": [],
       "exports": [
+        "HpkeError",
         "create",
         "decrypt",
         "encrypt",
         "encryptKey",
+        "keyId",
         "open"
       ],
       "entryPoint": "src/index.ts",
@@ -977,23 +1029,26 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
         },
         "src/util.ts": {
-          "bytesInOutput": 6605
+          "bytesInOutput": 8110
         },
         "src/index.ts": {
-          "bytesInOutput": 5649
+          "bytesInOutput": 6166
         }
       },
-      "bytes": 51032
+      "bytes": 53408
     },
     "dist/util.js.map": {
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 112937
+      "bytes": 121973
     },
     "dist/util.js": {
       "imports": [],
@@ -1007,6 +1062,7 @@
         "encryptToString",
         "hmac",
         "i2osp",
+        "keyId",
         "labeledExpand",
         "labeledExtract",
         "resolveRecipientPublicKey"
@@ -1097,17 +1153,20 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
         },
         "src/index.ts": {
-          "bytesInOutput": 5486
+          "bytesInOutput": 5995
         },
         "src/util.ts": {
-          "bytesInOutput": 6618
+          "bytesInOutput": 8126
         }
       },
-      "bytes": 50995
+      "bytes": 53353
     }
   }
 }

package/dist/util.cjs

@@ -30,6 +30,7 @@ __export(util_exports, {
   encryptToString: () => encryptToString,
   hmac: () => hmac,
   i2osp: () => i2osp,
+  keyId: () => keyId,
   labeledExpand: () => labeledExpand,
   labeledExtract: () => labeledExtract,
   resolveRecipientPublicKey: () => resolveRecipientPublicKey
@@ -1314,6 +1315,19 @@ function toString2(array, encoding = "utf8") {
 }
 __name(toString2, "toString");
 
+// src/errors.ts
+var HpkeError = class extends Error {
+  static {
+    __name(this, "HpkeError");
+  }
+  code;
+  constructor(code2, message, opts) {
+    super(message, opts);
+    this.name = "HpkeError";
+    this.code = code2;
+  }
+};
+
 // src/constants.ts
 var KEM_ID = 32;
 var KDF_ID = 1;
@@ -1336,6 +1350,8 @@ var HPKE_SUITE_ID = concat2(
   i2osp(KDF_ID, 2),
   i2osp(AEAD_ID, 2)
 );
+var KEY_ID_LABEL = new TextEncoder().encode("simple-hpke/keyId/v1");
+var KEY_ID_NONCE_LENGTH = 12;
 
 // src/index.ts
 var subtle = globalThis.crypto.subtle;
@@ -1351,13 +1367,19 @@ var decrypt = Object.assign(decryptBytes, {
 });
 async function decryptBytes(keypair, message, opts) {
   if (message.byteLength < WRAPPED_LEN_PREFIX) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrappedLen = message[0] << 8 | message[1];
   const ivStart = WRAPPED_LEN_PREFIX + wrappedLen;
   const ctStart = ivStart + NN;
   if (message.byteLength < ctStart + AEAD_TAG_LENGTH) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrapped = message.slice(WRAPPED_LEN_PREFIX, ivStart);
   const iv = message.slice(ivStart, ctStart);
@@ -1368,11 +1390,20 @@ async function decryptBytes(keypair, message, opts) {
     opts?.info !== void 0 ? { info: opts.info } : void 0
   );
   const key = await importAesKeyDecryptOnly(keyBytes);
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    key,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      key,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the message: tampered ciphertext",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(decryptBytes, "decryptBytes");
@@ -1393,7 +1424,8 @@ async function decryptFromString(keypair, message, opts) {
 __name(decryptFromString, "decryptFromString");
 function validateKeysize(keysize) {
   if (keysize !== 128 && keysize !== 256) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_KEYSIZE",
       `invalid keysize: ${keysize} (expected 128 or 256)`
     );
   }
@@ -1401,7 +1433,8 @@ function validateKeysize(keysize) {
 __name(validateKeysize, "validateKeysize");
 function validateRawKeyBytes(raw) {
   if (raw.length !== 16 && raw.length !== 32) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       `invalid aesKey length: ${raw.length} bytes (expected 16 or 32)`
     );
   }
@@ -1415,19 +1448,20 @@ function normalizeInfo(info) {
 __name(normalizeInfo, "normalizeInfo");
 async function exportAesKeyBytes(key) {
   if (!key.extractable) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       "aesKey must be extractable: its raw bytes are what get sealed"
     );
   }
   return new Uint8Array(await subtle.exportKey("raw", key));
 }
 __name(exportAesKeyBytes, "exportAesKeyBytes");
-async function importAesKey(raw) {
+async function importAesKey(raw, extractable) {
   return subtle.importKey(
     "raw",
     raw,
     { name: "AES-GCM" },
-    true,
+    extractable,
     ["encrypt", "decrypt"]
   );
 }
@@ -1482,7 +1516,10 @@ async function keySchedule(sharedSecret, info) {
 __name(keySchedule, "keySchedule");
 async function openRawBytes(keypair, wrapped, opts) {
   if (wrapped.byteLength < ENC_LENGTH + AEAD_TAG_LENGTH) {
-    throw new Error("malformed envelope: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_ENVELOPE",
+      "malformed envelope: too short"
+    );
   }
   const info = normalizeInfo(opts?.info);
   const enc = wrapped.slice(0, ENC_LENGTH);
@@ -1494,7 +1531,7 @@ async function openRawBytes(keypair, wrapped, opts) {
 __name(openRawBytes, "openRawBytes");
 async function openBytes(keypair, wrapped, opts) {
   const keyBytes = await openRawBytes(keypair, wrapped, opts);
-  return importAesKey(keyBytes);
+  return importAesKey(keyBytes, opts?.extractable ?? false);
 }
 __name(openBytes, "openBytes");
 async function encryptKey(recipient, aesKey, opts) {
@@ -1518,8 +1555,11 @@ async function encryptKey(recipient, aesKey, opts) {
   const { key, baseNonce } = await keySchedule(sharedSecret, info);
   const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
   const wrapped = concat2(enc, ciphertext);
-  const aesGcmKey = await importAesKey(keyBytes);
-  return { enc: wrapped, key: aesGcmKey };
+  const aesGcmKey = await importAesKey(
+    keyBytes,
+    opts?.extractable ?? false
+  );
+  return { wrapped, key: aesGcmKey };
 }
 __name(encryptKey, "encryptKey");
 
@@ -1549,24 +1589,38 @@ async function aeadOpen(key, nonce, ciphertext) {
     false,
     ["decrypt"]
   );
-  const pt = await subtle2.decrypt(
-    { name: "AES-GCM", iv: nonce },
-    k,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle2.decrypt(
+      { name: "AES-GCM", iv: nonce },
+      k,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the wrapped key: wrong keypair, wrong info, or a tampered envelope",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(aeadOpen, "aeadOpen");
 async function encryptBytes(recipient, message, aesKey, opts) {
   const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
-  const { enc, key } = await encryptKey(recipient, aesKey, opts);
+  const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
   const ct = new Uint8Array(await subtle2.encrypt(
     { name: "AES-GCM", iv },
     key,
     plaintext
   ));
-  return concat2(i2osp(enc.length, WRAPPED_LEN_PREFIX), enc, iv, ct);
+  return concat2(
+    i2osp(wrapped.length, WRAPPED_LEN_PREFIX),
+    wrapped,
+    iv,
+    ct
+  );
 }
 __name(encryptBytes, "encryptBytes");
 async function encryptToString(recipient, message, aesKey, opts) {
@@ -1632,7 +1686,8 @@ async function exportRawPublic(key) {
 __name(exportRawPublic, "exportRawPublic");
 async function importRawPublic(raw) {
   if (raw.length !== ENC_LENGTH) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
       `invalid public key length: ${raw.length} bytes (expected ${ENC_LENGTH})`
     );
   }
@@ -1651,9 +1706,16 @@ async function resolveRecipientPublicKey(recipient) {
   }
   if (recipient instanceof CryptoKey) {
     if (recipient.type !== "public") {
-      throw new Error("recipient CryptoKey must be a public key");
+      throw new HpkeError(
+        "ERR_INVALID_RECIPIENT_KEY",
+        "recipient CryptoKey must be a public key"
+      );
     }
-    assertX25519Algorithm(recipient, "recipient CryptoKey");
+    assertX25519Algorithm(
+      recipient,
+      "recipient CryptoKey",
+      "ERR_INVALID_RECIPIENT_KEY"
+    );
     return recipient;
   }
   if (typeof recipient.publicKey === "string") {
@@ -1663,17 +1725,28 @@ async function resolveRecipientPublicKey(recipient) {
   const pair = recipient;
   if (pair.publicKey instanceof CryptoKey) {
     if (pair.publicKey.type !== "public") {
-      throw new Error("recipient keypair publicKey must be a public key");
+      throw new HpkeError(
+        "ERR_INVALID_RECIPIENT_KEY",
+        "recipient keypair publicKey must be a public key"
+      );
     }
-    assertX25519Algorithm(pair.publicKey, "recipient keypair publicKey");
+    assertX25519Algorithm(
+      pair.publicKey,
+      "recipient keypair publicKey",
+      "ERR_INVALID_RECIPIENT_KEY"
+    );
     return pair.publicKey;
   }
-  throw new Error("unrecognized recipient key form");
+  throw new HpkeError(
+    "ERR_INVALID_RECIPIENT_KEY",
+    "unrecognized recipient key form"
+  );
 }
 __name(resolveRecipientPublicKey, "resolveRecipientPublicKey");
-function assertX25519Algorithm(key, context) {
+function assertX25519Algorithm(key, context, code2) {
   if (key.algorithm.name !== "X25519") {
-    throw new Error(
+    throw new HpkeError(
+      code2,
       `${context} must be an X25519 key (got ${key.algorithm.name})`
     );
   }
@@ -1687,7 +1760,8 @@ async function dh(priv, pub) {
   );
   const bytes = new Uint8Array(bits);
   if (bytes.every((b) => b === 0)) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_SMALL_ORDER_KEY",
       "X25519 shared secret is all-zero (small-order public key?)"
     );
   }
@@ -1726,9 +1800,16 @@ async function encap(pkR) {
 __name(encap, "encap");
 async function decap(enc, keypair) {
   if (keypair.privateKey.type !== "private") {
-    throw new Error("keypair.privateKey must be a private key");
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must be a private key"
+    );
   }
-  assertX25519Algorithm(keypair.privateKey, "keypair.privateKey");
+  assertX25519Algorithm(
+    keypair.privateKey,
+    "keypair.privateKey",
+    "ERR_INVALID_KEYPAIR"
+  );
   const pkE = await subtle2.importKey(
     "raw",
     enc,
@@ -1742,6 +1823,35 @@ async function decap(enc, keypair) {
   return extractAndExpand(dhBytes, kemContext);
 }
 __name(decap, "decap");
+async function keyId(key) {
+  if (key.algorithm.name !== "AES-GCM") {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      `keyId needs an AES-GCM key (got ${key.algorithm.name})`
+    );
+  }
+  if (!key.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      "keyId needs a key with the 'encrypt' usage"
+    );
+  }
+  const labelHash = new Uint8Array(
+    await subtle2.digest("SHA-256", KEY_ID_LABEL)
+  );
+  const nonce = labelHash.slice(0, KEY_ID_NONCE_LENGTH);
+  const ciphertext = new Uint8Array(await subtle2.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    key,
+    KEY_ID_LABEL
+  ));
+  const digest2 = await subtle2.digest(
+    "SHA-256",
+    concat2(KEY_ID_LABEL, ciphertext)
+  );
+  return toString2(new Uint8Array(digest2), "base64url");
+}
+__name(keyId, "keyId");
 function i2osp(n, len) {
   const out = new Uint8Array(len);
   let v = n;