simple-hpke 0.2.0 → 0.3.3

package/dist/errors.cjs

@@ -0,0 +1,38 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/errors.ts
+var errors_exports = {};
+__export(errors_exports, {
+  HpkeError: () => HpkeError
+});
+module.exports = __toCommonJS(errors_exports);
+var HpkeError = class extends Error {
+  static {
+    __name(this, "HpkeError");
+  }
+  code;
+  constructor(code, message, opts) {
+    super(message, opts);
+    this.name = "HpkeError";
+    this.code = code;
+  }
+};
+//# sourceMappingURL=errors.cjs.map

package/dist/errors.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts"],
+  "sourcesContent": ["/**\n * The set of stable error codes this package raises.\n *\n * Branch on `err.code`, not on `err.message`: the codes are part of the\n * public API, the prose is not.\n */\nexport type HpkeErrorCode =\n    'ERR_INVALID_RECIPIENT_KEY'|\n    'ERR_INVALID_KEYPAIR'|\n    'ERR_SMALL_ORDER_KEY'|\n    'ERR_MALFORMED_ENVELOPE'|\n    'ERR_MALFORMED_MESSAGE'|\n    'ERR_INVALID_KEYSIZE'|\n    'ERR_INVALID_AES_KEY'|\n    'ERR_DECRYPT_FAILED'\n\n/**\n * An `Error` carrying a stable `code`. Every throw site in this package\n * raises one of these, so callers can branch on the failure instead of\n * pattern matching on a message.\n *\n * Where a WebCrypto failure is being wrapped, the original is kept on\n * `cause`.\n */\nexport class HpkeError extends Error {\n    readonly code:HpkeErrorCode\n\n    constructor (\n        code:HpkeErrorCode,\n        message:string,\n        opts?:{ cause?:unknown }\n    ) {\n        super(message, opts)\n        this.name = 'HpkeError'\n        this.code = code\n    }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAxBrC,OAwBqC;AAAA;AAAA;AAAA,EACxB;AAAA,EAET,YACI,MACA,SACA,MACF;AACE,UAAM,SAAS,IAAI;AACnB,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EAChB;AACJ;",
+  "names": []
+}

package/dist/errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The set of stable error codes this package raises.
+ *
+ * Branch on `err.code`, not on `err.message`: the codes are part of the
+ * public API, the prose is not.
+ */
+export type HpkeErrorCode = 'ERR_INVALID_RECIPIENT_KEY' | 'ERR_INVALID_KEYPAIR' | 'ERR_SMALL_ORDER_KEY' | 'ERR_MALFORMED_ENVELOPE' | 'ERR_MALFORMED_MESSAGE' | 'ERR_INVALID_KEYSIZE' | 'ERR_INVALID_AES_KEY' | 'ERR_DECRYPT_FAILED';
+/**
+ * An `Error` carrying a stable `code`. Every throw site in this package
+ * raises one of these, so callers can branch on the failure instead of
+ * pattern matching on a message.
+ *
+ * Where a WebCrypto failure is being wrapped, the original is kept on
+ * `cause`.
+ */
+export declare class HpkeError extends Error {
+    readonly code: HpkeErrorCode;
+    constructor(code: HpkeErrorCode, message: string, opts?: {
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,CAAA;AAExB;;;;;;;GAOG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAC,aAAa,CAAA;gBAGvB,IAAI,EAAC,aAAa,EAClB,OAAO,EAAC,MAAM,EACd,IAAI,CAAC,EAAC;QAAE,KAAK,CAAC,EAAC,OAAO,CAAA;KAAE;CAM/B"}

package/dist/errors.js

@@ -0,0 +1,19 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/errors.ts
+var HpkeError = class extends Error {
+  static {
+    __name(this, "HpkeError");
+  }
+  code;
+  constructor(code, message, opts) {
+    super(message, opts);
+    this.name = "HpkeError";
+    this.code = code;
+  }
+};
+export {
+  HpkeError
+};
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts"],
+  "sourcesContent": ["/**\n * The set of stable error codes this package raises.\n *\n * Branch on `err.code`, not on `err.message`: the codes are part of the\n * public API, the prose is not.\n */\nexport type HpkeErrorCode =\n    'ERR_INVALID_RECIPIENT_KEY'|\n    'ERR_INVALID_KEYPAIR'|\n    'ERR_SMALL_ORDER_KEY'|\n    'ERR_MALFORMED_ENVELOPE'|\n    'ERR_MALFORMED_MESSAGE'|\n    'ERR_INVALID_KEYSIZE'|\n    'ERR_INVALID_AES_KEY'|\n    'ERR_DECRYPT_FAILED'\n\n/**\n * An `Error` carrying a stable `code`. Every throw site in this package\n * raises one of these, so callers can branch on the failure instead of\n * pattern matching on a message.\n *\n * Where a WebCrypto failure is being wrapped, the original is kept on\n * `cause`.\n */\nexport class HpkeError extends Error {\n    readonly code:HpkeErrorCode\n\n    constructor (\n        code:HpkeErrorCode,\n        message:string,\n        opts?:{ cause?:unknown }\n    ) {\n        super(message, opts)\n        this.name = 'HpkeError'\n        this.code = code\n    }\n}\n"],
+  "mappings": ";;;;AAwBO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAxBrC,OAwBqC;AAAA;AAAA;AAAA,EACxB;AAAA,EAET,YACI,MACA,SACA,MACF;AACE,UAAM,SAAS,IAAI;AACnB,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EAChB;AACJ;",
+  "names": []
+}

package/dist/errors.min.cjs

@@ -0,0 +1,2 @@
+"use strict";var o=Object.defineProperty;var L=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var t=Object.prototype.hasOwnProperty;var A=(R,E)=>o(R,"name",{value:E,configurable:!0});var D=(R,E)=>{for(var r in E)o(R,r,{get:E[r],enumerable:!0})},n=(R,E,r,e)=>{if(E&&typeof E=="object"||typeof E=="function")for(let _ of s(E))!t.call(R,_)&&_!==r&&o(R,_,{get:()=>E[_],enumerable:!(e=L(E,_))||e.enumerable});return R};var d=R=>n(o({},"__esModule",{value:!0}),R);var p={};D(p,{HpkeError:()=>I});module.exports=d(p);var I=class extends Error{static{A(this,"HpkeError")}code;constructor(E,r,e){super(r,e),this.name="HpkeError",this.code=E}};
+//# sourceMappingURL=errors.min.cjs.map

package/dist/errors.min.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts"],
+  "sourcesContent": ["/**\n * The set of stable error codes this package raises.\n *\n * Branch on `err.code`, not on `err.message`: the codes are part of the\n * public API, the prose is not.\n */\nexport type HpkeErrorCode =\n    'ERR_INVALID_RECIPIENT_KEY'|\n    'ERR_INVALID_KEYPAIR'|\n    'ERR_SMALL_ORDER_KEY'|\n    'ERR_MALFORMED_ENVELOPE'|\n    'ERR_MALFORMED_MESSAGE'|\n    'ERR_INVALID_KEYSIZE'|\n    'ERR_INVALID_AES_KEY'|\n    'ERR_DECRYPT_FAILED'\n\n/**\n * An `Error` carrying a stable `code`. Every throw site in this package\n * raises one of these, so callers can branch on the failure instead of\n * pattern matching on a message.\n *\n * Where a WebCrypto failure is being wrapped, the original is kept on\n * `cause`.\n */\nexport class HpkeError extends Error {\n    readonly code:HpkeErrorCode\n\n    constructor (\n        code:HpkeErrorCode,\n        message:string,\n        opts?:{ cause?:unknown }\n    ) {\n        super(message, opts)\n        this.name = 'HpkeError'\n        this.code = code\n    }\n}\n"],
+  "mappings": "4dAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,eAAAE,IAAA,eAAAC,EAAAH,GAwBO,IAAMI,EAAN,cAAwB,KAAM,CAxBrC,MAwBqC,CAAAC,EAAA,kBACxB,KAET,YACIC,EACAC,EACAC,EACF,CACE,MAAMD,EAASC,CAAI,EACnB,KAAK,KAAO,YACZ,KAAK,KAAOF,CAChB,CACJ",
+  "names": ["errors_exports", "__export", "HpkeError", "__toCommonJS", "HpkeError", "__name", "code", "message", "opts"]
+}

package/dist/errors.min.js

@@ -0,0 +1,2 @@
+var I=Object.defineProperty;var r=(R,E)=>I(R,"name",{value:E,configurable:!0});var _=class extends Error{static{r(this,"HpkeError")}code;constructor(E,e,o){super(e,o),this.name="HpkeError",this.code=E}};export{_ as HpkeError};
+//# sourceMappingURL=errors.min.js.map

package/dist/errors.min.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts"],
+  "sourcesContent": ["/**\n * The set of stable error codes this package raises.\n *\n * Branch on `err.code`, not on `err.message`: the codes are part of the\n * public API, the prose is not.\n */\nexport type HpkeErrorCode =\n    'ERR_INVALID_RECIPIENT_KEY'|\n    'ERR_INVALID_KEYPAIR'|\n    'ERR_SMALL_ORDER_KEY'|\n    'ERR_MALFORMED_ENVELOPE'|\n    'ERR_MALFORMED_MESSAGE'|\n    'ERR_INVALID_KEYSIZE'|\n    'ERR_INVALID_AES_KEY'|\n    'ERR_DECRYPT_FAILED'\n\n/**\n * An `Error` carrying a stable `code`. Every throw site in this package\n * raises one of these, so callers can branch on the failure instead of\n * pattern matching on a message.\n *\n * Where a WebCrypto failure is being wrapped, the original is kept on\n * `cause`.\n */\nexport class HpkeError extends Error {\n    readonly code:HpkeErrorCode\n\n    constructor (\n        code:HpkeErrorCode,\n        message:string,\n        opts?:{ cause?:unknown }\n    ) {\n        super(message, opts)\n        this.name = 'HpkeError'\n        this.code = code\n    }\n}\n"],
+  "mappings": "+EAwBO,IAAMA,EAAN,cAAwB,KAAM,CAxBrC,MAwBqC,CAAAC,EAAA,kBACxB,KAET,YACIC,EACAC,EACAC,EACF,CACE,MAAMD,EAASC,CAAI,EACnB,KAAK,KAAO,YACZ,KAAK,KAAOF,CAChB,CACJ",
+  "names": ["HpkeError", "__name", "code", "message", "opts"]
+}

package/dist/index.cjs

@@ -21,11 +21,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  HpkeError: () => HpkeError,
   create: () => create2,
   decrypt: () => decrypt,
   encrypt: () => encrypt,
   encryptKey: () => encryptKey,
-  open: () => open
+  keyId: () => keyId,
+  open: () => open,
+  verifyKeyId: () => verifyKeyId
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1307,6 +1310,19 @@ function toString2(array, encoding = "utf8") {
 }
 __name(toString2, "toString");
 
+// src/errors.ts
+var HpkeError = class extends Error {
+  static {
+    __name(this, "HpkeError");
+  }
+  code;
+  constructor(code2, message, opts) {
+    super(message, opts);
+    this.name = "HpkeError";
+    this.code = code2;
+  }
+};
+
 // src/constants.ts
 var KEM_ID = 32;
 var KDF_ID = 1;
@@ -1329,6 +1345,8 @@ var HPKE_SUITE_ID = concat2(
   i2osp(KDF_ID, 2),
   i2osp(AEAD_ID, 2)
 );
+var KEY_ID_LABEL = new TextEncoder().encode("simple-hpke/keyId/v1");
+var KEY_ID_NONCE_LENGTH = 12;
 
 // src/util.ts
 var subtle = globalThis.crypto.subtle;
@@ -1356,24 +1374,44 @@ async function aeadOpen(key, nonce, ciphertext) {
     false,
     ["decrypt"]
   );
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv: nonce },
-    k,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle.decrypt(
+      { name: "AES-GCM", iv: nonce },
+      k,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the wrapped key: wrong keypair, wrong info, or a tampered envelope",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(aeadOpen, "aeadOpen");
 async function encryptBytes(recipient, message, aesKey, opts) {
+  if (aesKey instanceof CryptoKey && !aesKey.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      'aesKey is missing the "encrypt" usage, which encrypt needs to encrypt the message'
+    );
+  }
   const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
-  const { enc, key } = await encryptKey(recipient, aesKey, opts);
+  const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
   const ct = new Uint8Array(await subtle.encrypt(
     { name: "AES-GCM", iv },
     key,
     plaintext
   ));
-  return concat2(i2osp(enc.length, WRAPPED_LEN_PREFIX), enc, iv, ct);
+  return concat2(
+    i2osp(wrapped.length, WRAPPED_LEN_PREFIX),
+    wrapped,
+    iv,
+    ct
+  );
 }
 __name(encryptBytes, "encryptBytes");
 async function encryptToString(recipient, message, aesKey, opts) {
@@ -1439,7 +1477,8 @@ async function exportRawPublic(key) {
 __name(exportRawPublic, "exportRawPublic");
 async function importRawPublic(raw) {
   if (raw.length !== ENC_LENGTH) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
       `invalid public key length: ${raw.length} bytes (expected ${ENC_LENGTH})`
     );
   }
@@ -1457,44 +1496,83 @@ async function resolveRecipientPublicKey(recipient) {
     return importRawPublic(recipient);
   }
   if (recipient instanceof CryptoKey) {
-    if (recipient.type !== "public") {
-      throw new Error("recipient CryptoKey must be a public key");
-    }
-    assertX25519Algorithm(recipient, "recipient CryptoKey");
-    return recipient;
+    return assertRecipientPublicKey(recipient, "recipient CryptoKey");
   }
   if (typeof recipient.publicKey === "string") {
     const { publicKey, encoding } = recipient;
-    return importRawPublic(fromString2(publicKey, encoding ?? "base64url"));
+    let decoded;
+    try {
+      decoded = fromString2(publicKey, encoding ?? "base64url");
+    } catch (err) {
+      throw new HpkeError(
+        "ERR_INVALID_RECIPIENT_KEY",
+        `recipient publicKey string does not decode as ${encoding ?? "base64url"}`,
+        { cause: err }
+      );
+    }
+    return importRawPublic(decoded);
   }
   const pair = recipient;
   if (pair.publicKey instanceof CryptoKey) {
-    if (pair.publicKey.type !== "public") {
-      throw new Error("recipient keypair publicKey must be a public key");
-    }
-    assertX25519Algorithm(pair.publicKey, "recipient keypair publicKey");
-    return pair.publicKey;
+    return assertRecipientPublicKey(
+      pair.publicKey,
+      "recipient keypair publicKey"
+    );
   }
-  throw new Error("unrecognized recipient key form");
+  throw new HpkeError(
+    "ERR_INVALID_RECIPIENT_KEY",
+    "unrecognized recipient key form"
+  );
 }
 __name(resolveRecipientPublicKey, "resolveRecipientPublicKey");
-function assertX25519Algorithm(key, context) {
+function assertRecipientPublicKey(key, context) {
+  if (key.type !== "public") {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be a public key`
+    );
+  }
+  assertX25519Algorithm(key, context, "ERR_INVALID_RECIPIENT_KEY");
+  if (!key.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be extractable (the KEM exports it)`
+    );
+  }
+  return key;
+}
+__name(assertRecipientPublicKey, "assertRecipientPublicKey");
+function assertX25519Algorithm(key, context, code2) {
   if (key.algorithm.name !== "X25519") {
-    throw new Error(
+    throw new HpkeError(
+      code2,
       `${context} must be an X25519 key (got ${key.algorithm.name})`
     );
   }
 }
 __name(assertX25519Algorithm, "assertX25519Algorithm");
 async function dh(priv, pub) {
-  const bits = await subtle.deriveBits(
-    { name: "X25519", public: pub },
-    priv,
-    256
-  );
+  let bits;
+  try {
+    bits = await subtle.deriveBits(
+      { name: "X25519", public: pub },
+      priv,
+      256
+    );
+  } catch (err) {
+    if (err?.name === "OperationError") {
+      throw new HpkeError(
+        "ERR_SMALL_ORDER_KEY",
+        "X25519 deriveBits rejected a small-order public key",
+        { cause: err }
+      );
+    }
+    throw err;
+  }
   const bytes = new Uint8Array(bits);
   if (bytes.every((b) => b === 0)) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_SMALL_ORDER_KEY",
       "X25519 shared secret is all-zero (small-order public key?)"
     );
   }
@@ -1533,9 +1611,33 @@ async function encap(pkR) {
 __name(encap, "encap");
 async function decap(enc, keypair) {
   if (keypair.privateKey.type !== "private") {
-    throw new Error("keypair.privateKey must be a private key");
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must be a private key"
+    );
   }
-  assertX25519Algorithm(keypair.privateKey, "keypair.privateKey");
+  assertX25519Algorithm(
+    keypair.privateKey,
+    "keypair.privateKey",
+    "ERR_INVALID_KEYPAIR"
+  );
+  if (!keypair.privateKey.usages.includes("deriveBits")) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must have the deriveBits usage"
+    );
+  }
+  if (keypair.publicKey.type !== "public" || !keypair.publicKey.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.publicKey must be an extractable public key"
+    );
+  }
+  assertX25519Algorithm(
+    keypair.publicKey,
+    "keypair.publicKey",
+    "ERR_INVALID_KEYPAIR"
+  );
   const pkE = await subtle.importKey(
     "raw",
     enc,
@@ -1549,6 +1651,45 @@ async function decap(enc, keypair) {
   return extractAndExpand(dhBytes, kemContext);
 }
 __name(decap, "decap");
+async function keyId(key) {
+  if (key.algorithm.name !== "AES-GCM") {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      `keyId needs an AES-GCM key (got ${key.algorithm.name})`
+    );
+  }
+  if (!key.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      "keyId needs a key with the 'encrypt' usage"
+    );
+  }
+  const labelHash = new Uint8Array(
+    await subtle.digest("SHA-256", KEY_ID_LABEL)
+  );
+  const nonce = labelHash.slice(0, KEY_ID_NONCE_LENGTH);
+  const ciphertext = new Uint8Array(await subtle.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    key,
+    KEY_ID_LABEL
+  ));
+  const digest2 = await subtle.digest(
+    "SHA-256",
+    concat2(KEY_ID_LABEL, ciphertext)
+  );
+  return toString2(new Uint8Array(digest2), "base64url");
+}
+__name(keyId, "keyId");
+async function verifyKeyId(key, expected) {
+  const actual = await keyId(key);
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) {
+    diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return diff === 0;
+}
+__name(verifyKeyId, "verifyKeyId");
 function i2osp(n, len) {
   const out = new Uint8Array(len);
   let v = n;
@@ -1575,8 +1716,8 @@ __name(concat2, "concat");
 // src/index.ts
 var subtle2 = globalThis.crypto.subtle;
 async function create2(recipient, opts) {
-  const { enc, key } = await encryptKey(recipient, null, opts);
-  return { enc, key };
+  const { wrapped, key } = await encryptKey(recipient, null, opts);
+  return { wrapped, key };
 }
 __name(create2, "create");
 var open = Object.assign(openBytes, {
@@ -1591,13 +1732,19 @@ var decrypt = Object.assign(decryptBytes, {
 });
 async function decryptBytes(keypair, message, opts) {
   if (message.byteLength < WRAPPED_LEN_PREFIX) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrappedLen = message[0] << 8 | message[1];
   const ivStart = WRAPPED_LEN_PREFIX + wrappedLen;
   const ctStart = ivStart + NN;
   if (message.byteLength < ctStart + AEAD_TAG_LENGTH) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrapped = message.slice(WRAPPED_LEN_PREFIX, ivStart);
   const iv = message.slice(ivStart, ctStart);
@@ -1608,11 +1755,20 @@ async function decryptBytes(keypair, message, opts) {
     opts?.info !== void 0 ? { info: opts.info } : void 0
   );
   const key = await importAesKeyDecryptOnly(keyBytes);
-  const pt = await subtle2.decrypt(
-    { name: "AES-GCM", iv },
-    key,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle2.decrypt(
+      { name: "AES-GCM", iv },
+      key,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the message: tampered ciphertext",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(decryptBytes, "decryptBytes");
@@ -1622,7 +1778,16 @@ async function decryptToString(keypair, message, opts) {
 }
 __name(decryptToString, "decryptToString");
 async function decryptFromString(keypair, message, opts) {
-  const bytes = fromString2(message, "base64url");
+  let bytes;
+  try {
+    bytes = fromString2(message, "base64url");
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: not base64url",
+      { cause: err }
+    );
+  }
   const plaintext = await decryptBytes(
     keypair,
     bytes,
@@ -1633,7 +1798,8 @@ async function decryptFromString(keypair, message, opts) {
 __name(decryptFromString, "decryptFromString");
 function validateKeysize(keysize) {
   if (keysize !== 128 && keysize !== 256) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_KEYSIZE",
       `invalid keysize: ${keysize} (expected 128 or 256)`
     );
   }
@@ -1641,7 +1807,8 @@ function validateKeysize(keysize) {
 __name(validateKeysize, "validateKeysize");
 function validateRawKeyBytes(raw) {
   if (raw.length !== 16 && raw.length !== 32) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       `invalid aesKey length: ${raw.length} bytes (expected 16 or 32)`
     );
   }
@@ -1655,19 +1822,20 @@ function normalizeInfo(info) {
 __name(normalizeInfo, "normalizeInfo");
 async function exportAesKeyBytes(key) {
   if (!key.extractable) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       "aesKey must be extractable: its raw bytes are what get sealed"
     );
   }
   return new Uint8Array(await subtle2.exportKey("raw", key));
 }
 __name(exportAesKeyBytes, "exportAesKeyBytes");
-async function importAesKey(raw) {
+async function importAesKey(raw, extractable) {
   return subtle2.importKey(
     "raw",
     raw,
     { name: "AES-GCM" },
-    true,
+    extractable,
     ["encrypt", "decrypt"]
   );
 }
@@ -1722,7 +1890,10 @@ async function keySchedule(sharedSecret, info) {
 __name(keySchedule, "keySchedule");
 async function openRawBytes(keypair, wrapped, opts) {
   if (wrapped.byteLength < ENC_LENGTH + AEAD_TAG_LENGTH) {
-    throw new Error("malformed envelope: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_ENVELOPE",
+      "malformed envelope: too short"
+    );
   }
   const info = normalizeInfo(opts?.info);
   const enc = wrapped.slice(0, ENC_LENGTH);
@@ -1734,7 +1905,7 @@ async function openRawBytes(keypair, wrapped, opts) {
 __name(openRawBytes, "openRawBytes");
 async function openBytes(keypair, wrapped, opts) {
   const keyBytes = await openRawBytes(keypair, wrapped, opts);
-  return importAesKey(keyBytes);
+  return importAesKey(keyBytes, opts?.extractable ?? false);
 }
 __name(openBytes, "openBytes");
 async function encryptKey(recipient, aesKey, opts) {
@@ -1744,6 +1915,12 @@ async function encryptKey(recipient, aesKey, opts) {
     validateRawKeyBytes(aesKey);
     keyBytes = aesKey;
   } else if (aesKey) {
+    if (aesKey.algorithm.name !== "AES-GCM") {
+      throw new HpkeError(
+        "ERR_INVALID_AES_KEY",
+        "aesKey must be an AES-GCM key, got " + aesKey.algorithm.name
+      );
+    }
     keyBytes = await exportAesKeyBytes(aesKey);
     validateRawKeyBytes(keyBytes);
   } else {
@@ -1758,8 +1935,12 @@ async function encryptKey(recipient, aesKey, opts) {
   const { key, baseNonce } = await keySchedule(sharedSecret, info);
   const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
   const wrapped = concat2(enc, ciphertext);
-  const aesGcmKey = await importAesKey(keyBytes);
-  return { enc: wrapped, key: aesGcmKey };
+  if (aesKey instanceof CryptoKey) return { wrapped, key: aesKey };
+  const aesGcmKey = await importAesKey(
+    keyBytes,
+    opts?.extractable ?? false
+  );
+  return { wrapped, key: aesGcmKey };
 }
 __name(encryptKey, "encryptKey");
 //# sourceMappingURL=index.cjs.map