simple-hpke 0.2.0 → 0.3.3

package/dist/meta.json

@@ -690,8 +690,19 @@
       ],
       "format": "esm"
     },
+    "src/errors.ts": {
+      "bytes": 975,
+      "imports": [
+        {
+          "path": "<runtime>",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "format": "esm"
+    },
     "src/index.ts": {
-      "bytes": 12639,
+      "bytes": 15697,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -703,11 +714,21 @@
           "kind": "import-statement",
           "original": "./util"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors"
+        },
         {
           "path": "src/constants.ts",
           "kind": "import-statement",
           "original": "./constants"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors"
+        },
         {
           "path": "<runtime>",
           "kind": "import-statement",
@@ -717,7 +738,7 @@
       "format": "esm"
     },
     "src/util.ts": {
-      "bytes": 13967,
+      "bytes": 22056,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -729,6 +750,11 @@
           "kind": "import-statement",
           "original": "./index.js"
         },
+        {
+          "path": "src/errors.ts",
+          "kind": "import-statement",
+          "original": "./errors.js"
+        },
         {
           "path": "src/constants.ts",
           "kind": "import-statement",
@@ -743,7 +769,7 @@
       "format": "esm"
     },
     "src/constants.ts": {
-      "bytes": 1348,
+      "bytes": 2125,
       "imports": [
         {
           "path": "src/util.ts",
@@ -759,7 +785,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 112940
+      "bytes": 128024
     },
     "dist/constants.js": {
       "imports": [],
@@ -772,6 +798,8 @@
         "KDF_ID",
         "KEM_ID",
         "KEM_SUITE_ID",
+        "KEY_ID_LABEL",
+        "KEY_ID_NONCE_LENGTH",
         "MODE_BASE",
         "NK",
         "NN",
@@ -864,32 +892,57 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/index.ts": {
-          "bytesInOutput": 5486
+          "bytesInOutput": 6418
         },
         "src/util.ts": {
-          "bytesInOutput": 6618
+          "bytesInOutput": 8581
         },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
+        }
+      },
+      "bytes": 54253
+    },
+    "dist/errors.js.map": {
+      "imports": [],
+      "exports": [],
+      "inputs": {},
+      "bytes": 1293
+    },
+    "dist/errors.js": {
+      "imports": [],
+      "exports": [
+        "HpkeError"
+      ],
+      "entryPoint": "src/errors.ts",
+      "inputs": {
+        "src/errors.ts": {
+          "bytesInOutput": 213
         }
       },
-      "bytes": 50987
+      "bytes": 419
     },
     "dist/index.js.map": {
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 113074
+      "bytes": 128969
     },
     "dist/index.js": {
       "imports": [],
       "exports": [
+        "HpkeError",
         "create",
         "decrypt",
         "encrypt",
         "encryptKey",
-        "open"
+        "keyId",
+        "open",
+        "verifyKeyId"
       ],
       "entryPoint": "src/index.ts",
       "inputs": {
@@ -977,23 +1030,26 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
         },
         "src/util.ts": {
-          "bytesInOutput": 6605
+          "bytesInOutput": 9693
         },
         "src/index.ts": {
-          "bytesInOutput": 5649
+          "bytesInOutput": 6589
         }
       },
-      "bytes": 51032
+      "bytes": 55429
     },
     "dist/util.js.map": {
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 112937
+      "bytes": 128835
     },
     "dist/util.js": {
       "imports": [],
@@ -1007,9 +1063,11 @@
         "encryptToString",
         "hmac",
         "i2osp",
+        "keyId",
         "labeledExpand",
         "labeledExtract",
-        "resolveRecipientPublicKey"
+        "resolveRecipientPublicKey",
+        "verifyKeyId"
       ],
       "entryPoint": "src/util.ts",
       "inputs": {
@@ -1097,17 +1155,20 @@
         "node_modules/uint8arrays/dist/src/to-string.js": {
           "bytesInOutput": 258
         },
+        "src/errors.ts": {
+          "bytesInOutput": 215
+        },
         "src/constants.ts": {
-          "bytesInOutput": 452
+          "bytesInOutput": 551
         },
         "src/index.ts": {
-          "bytesInOutput": 5486
+          "bytesInOutput": 6418
         },
         "src/util.ts": {
-          "bytesInOutput": 6618
+          "bytesInOutput": 9709
         }
       },
-      "bytes": 50995
+      "bytes": 55374
     }
   }
 }

package/dist/util.cjs

@@ -30,9 +30,11 @@ __export(util_exports, {
   encryptToString: () => encryptToString,
   hmac: () => hmac,
   i2osp: () => i2osp,
+  keyId: () => keyId,
   labeledExpand: () => labeledExpand,
   labeledExtract: () => labeledExtract,
-  resolveRecipientPublicKey: () => resolveRecipientPublicKey
+  resolveRecipientPublicKey: () => resolveRecipientPublicKey,
+  verifyKeyId: () => verifyKeyId
 });
 module.exports = __toCommonJS(util_exports);
 
@@ -1314,6 +1316,19 @@ function toString2(array, encoding = "utf8") {
 }
 __name(toString2, "toString");
 
+// src/errors.ts
+var HpkeError = class extends Error {
+  static {
+    __name(this, "HpkeError");
+  }
+  code;
+  constructor(code2, message, opts) {
+    super(message, opts);
+    this.name = "HpkeError";
+    this.code = code2;
+  }
+};
+
 // src/constants.ts
 var KEM_ID = 32;
 var KDF_ID = 1;
@@ -1336,6 +1351,8 @@ var HPKE_SUITE_ID = concat2(
   i2osp(KDF_ID, 2),
   i2osp(AEAD_ID, 2)
 );
+var KEY_ID_LABEL = new TextEncoder().encode("simple-hpke/keyId/v1");
+var KEY_ID_NONCE_LENGTH = 12;
 
 // src/index.ts
 var subtle = globalThis.crypto.subtle;
@@ -1351,13 +1368,19 @@ var decrypt = Object.assign(decryptBytes, {
 });
 async function decryptBytes(keypair, message, opts) {
   if (message.byteLength < WRAPPED_LEN_PREFIX) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrappedLen = message[0] << 8 | message[1];
   const ivStart = WRAPPED_LEN_PREFIX + wrappedLen;
   const ctStart = ivStart + NN;
   if (message.byteLength < ctStart + AEAD_TAG_LENGTH) {
-    throw new Error("malformed message: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: too short"
+    );
   }
   const wrapped = message.slice(WRAPPED_LEN_PREFIX, ivStart);
   const iv = message.slice(ivStart, ctStart);
@@ -1368,11 +1391,20 @@ async function decryptBytes(keypair, message, opts) {
     opts?.info !== void 0 ? { info: opts.info } : void 0
   );
   const key = await importAesKeyDecryptOnly(keyBytes);
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    key,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      key,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the message: tampered ciphertext",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(decryptBytes, "decryptBytes");
@@ -1382,7 +1414,16 @@ async function decryptToString(keypair, message, opts) {
 }
 __name(decryptToString, "decryptToString");
 async function decryptFromString(keypair, message, opts) {
-  const bytes = fromString2(message, "base64url");
+  let bytes;
+  try {
+    bytes = fromString2(message, "base64url");
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: not base64url",
+      { cause: err }
+    );
+  }
   const plaintext = await decryptBytes(
     keypair,
     bytes,
@@ -1393,7 +1434,8 @@ async function decryptFromString(keypair, message, opts) {
 __name(decryptFromString, "decryptFromString");
 function validateKeysize(keysize) {
   if (keysize !== 128 && keysize !== 256) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_KEYSIZE",
       `invalid keysize: ${keysize} (expected 128 or 256)`
     );
   }
@@ -1401,7 +1443,8 @@ function validateKeysize(keysize) {
 __name(validateKeysize, "validateKeysize");
 function validateRawKeyBytes(raw) {
   if (raw.length !== 16 && raw.length !== 32) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       `invalid aesKey length: ${raw.length} bytes (expected 16 or 32)`
     );
   }
@@ -1415,19 +1458,20 @@ function normalizeInfo(info) {
 __name(normalizeInfo, "normalizeInfo");
 async function exportAesKeyBytes(key) {
   if (!key.extractable) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
       "aesKey must be extractable: its raw bytes are what get sealed"
     );
   }
   return new Uint8Array(await subtle.exportKey("raw", key));
 }
 __name(exportAesKeyBytes, "exportAesKeyBytes");
-async function importAesKey(raw) {
+async function importAesKey(raw, extractable) {
   return subtle.importKey(
     "raw",
     raw,
     { name: "AES-GCM" },
-    true,
+    extractable,
     ["encrypt", "decrypt"]
   );
 }
@@ -1482,7 +1526,10 @@ async function keySchedule(sharedSecret, info) {
 __name(keySchedule, "keySchedule");
 async function openRawBytes(keypair, wrapped, opts) {
   if (wrapped.byteLength < ENC_LENGTH + AEAD_TAG_LENGTH) {
-    throw new Error("malformed envelope: too short");
+    throw new HpkeError(
+      "ERR_MALFORMED_ENVELOPE",
+      "malformed envelope: too short"
+    );
   }
   const info = normalizeInfo(opts?.info);
   const enc = wrapped.slice(0, ENC_LENGTH);
@@ -1494,7 +1541,7 @@ async function openRawBytes(keypair, wrapped, opts) {
 __name(openRawBytes, "openRawBytes");
 async function openBytes(keypair, wrapped, opts) {
   const keyBytes = await openRawBytes(keypair, wrapped, opts);
-  return importAesKey(keyBytes);
+  return importAesKey(keyBytes, opts?.extractable ?? false);
 }
 __name(openBytes, "openBytes");
 async function encryptKey(recipient, aesKey, opts) {
@@ -1504,6 +1551,12 @@ async function encryptKey(recipient, aesKey, opts) {
     validateRawKeyBytes(aesKey);
     keyBytes = aesKey;
   } else if (aesKey) {
+    if (aesKey.algorithm.name !== "AES-GCM") {
+      throw new HpkeError(
+        "ERR_INVALID_AES_KEY",
+        "aesKey must be an AES-GCM key, got " + aesKey.algorithm.name
+      );
+    }
     keyBytes = await exportAesKeyBytes(aesKey);
     validateRawKeyBytes(keyBytes);
   } else {
@@ -1518,8 +1571,12 @@ async function encryptKey(recipient, aesKey, opts) {
   const { key, baseNonce } = await keySchedule(sharedSecret, info);
   const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
   const wrapped = concat2(enc, ciphertext);
-  const aesGcmKey = await importAesKey(keyBytes);
-  return { enc: wrapped, key: aesGcmKey };
+  if (aesKey instanceof CryptoKey) return { wrapped, key: aesKey };
+  const aesGcmKey = await importAesKey(
+    keyBytes,
+    opts?.extractable ?? false
+  );
+  return { wrapped, key: aesGcmKey };
 }
 __name(encryptKey, "encryptKey");
 
@@ -1549,24 +1606,44 @@ async function aeadOpen(key, nonce, ciphertext) {
     false,
     ["decrypt"]
   );
-  const pt = await subtle2.decrypt(
-    { name: "AES-GCM", iv: nonce },
-    k,
-    ciphertext
-  );
+  let pt;
+  try {
+    pt = await subtle2.decrypt(
+      { name: "AES-GCM", iv: nonce },
+      k,
+      ciphertext
+    );
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_DECRYPT_FAILED",
+      "failed to decrypt the wrapped key: wrong keypair, wrong info, or a tampered envelope",
+      { cause: err }
+    );
+  }
   return new Uint8Array(pt);
 }
 __name(aeadOpen, "aeadOpen");
 async function encryptBytes(recipient, message, aesKey, opts) {
+  if (aesKey instanceof CryptoKey && !aesKey.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      'aesKey is missing the "encrypt" usage, which encrypt needs to encrypt the message'
+    );
+  }
   const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
-  const { enc, key } = await encryptKey(recipient, aesKey, opts);
+  const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
   const ct = new Uint8Array(await subtle2.encrypt(
     { name: "AES-GCM", iv },
     key,
     plaintext
   ));
-  return concat2(i2osp(enc.length, WRAPPED_LEN_PREFIX), enc, iv, ct);
+  return concat2(
+    i2osp(wrapped.length, WRAPPED_LEN_PREFIX),
+    wrapped,
+    iv,
+    ct
+  );
 }
 __name(encryptBytes, "encryptBytes");
 async function encryptToString(recipient, message, aesKey, opts) {
@@ -1632,7 +1709,8 @@ async function exportRawPublic(key) {
 __name(exportRawPublic, "exportRawPublic");
 async function importRawPublic(raw) {
   if (raw.length !== ENC_LENGTH) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
       `invalid public key length: ${raw.length} bytes (expected ${ENC_LENGTH})`
     );
   }
@@ -1650,44 +1728,83 @@ async function resolveRecipientPublicKey(recipient) {
     return importRawPublic(recipient);
   }
   if (recipient instanceof CryptoKey) {
-    if (recipient.type !== "public") {
-      throw new Error("recipient CryptoKey must be a public key");
-    }
-    assertX25519Algorithm(recipient, "recipient CryptoKey");
-    return recipient;
+    return assertRecipientPublicKey(recipient, "recipient CryptoKey");
   }
   if (typeof recipient.publicKey === "string") {
     const { publicKey, encoding } = recipient;
-    return importRawPublic(fromString2(publicKey, encoding ?? "base64url"));
+    let decoded;
+    try {
+      decoded = fromString2(publicKey, encoding ?? "base64url");
+    } catch (err) {
+      throw new HpkeError(
+        "ERR_INVALID_RECIPIENT_KEY",
+        `recipient publicKey string does not decode as ${encoding ?? "base64url"}`,
+        { cause: err }
+      );
+    }
+    return importRawPublic(decoded);
   }
   const pair = recipient;
   if (pair.publicKey instanceof CryptoKey) {
-    if (pair.publicKey.type !== "public") {
-      throw new Error("recipient keypair publicKey must be a public key");
-    }
-    assertX25519Algorithm(pair.publicKey, "recipient keypair publicKey");
-    return pair.publicKey;
+    return assertRecipientPublicKey(
+      pair.publicKey,
+      "recipient keypair publicKey"
+    );
   }
-  throw new Error("unrecognized recipient key form");
+  throw new HpkeError(
+    "ERR_INVALID_RECIPIENT_KEY",
+    "unrecognized recipient key form"
+  );
 }
 __name(resolveRecipientPublicKey, "resolveRecipientPublicKey");
-function assertX25519Algorithm(key, context) {
+function assertRecipientPublicKey(key, context) {
+  if (key.type !== "public") {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be a public key`
+    );
+  }
+  assertX25519Algorithm(key, context, "ERR_INVALID_RECIPIENT_KEY");
+  if (!key.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be extractable (the KEM exports it)`
+    );
+  }
+  return key;
+}
+__name(assertRecipientPublicKey, "assertRecipientPublicKey");
+function assertX25519Algorithm(key, context, code2) {
   if (key.algorithm.name !== "X25519") {
-    throw new Error(
+    throw new HpkeError(
+      code2,
       `${context} must be an X25519 key (got ${key.algorithm.name})`
     );
   }
 }
 __name(assertX25519Algorithm, "assertX25519Algorithm");
 async function dh(priv, pub) {
-  const bits = await subtle2.deriveBits(
-    { name: "X25519", public: pub },
-    priv,
-    256
-  );
+  let bits;
+  try {
+    bits = await subtle2.deriveBits(
+      { name: "X25519", public: pub },
+      priv,
+      256
+    );
+  } catch (err) {
+    if (err?.name === "OperationError") {
+      throw new HpkeError(
+        "ERR_SMALL_ORDER_KEY",
+        "X25519 deriveBits rejected a small-order public key",
+        { cause: err }
+      );
+    }
+    throw err;
+  }
   const bytes = new Uint8Array(bits);
   if (bytes.every((b) => b === 0)) {
-    throw new Error(
+    throw new HpkeError(
+      "ERR_SMALL_ORDER_KEY",
       "X25519 shared secret is all-zero (small-order public key?)"
     );
   }
@@ -1726,9 +1843,33 @@ async function encap(pkR) {
 __name(encap, "encap");
 async function decap(enc, keypair) {
   if (keypair.privateKey.type !== "private") {
-    throw new Error("keypair.privateKey must be a private key");
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must be a private key"
+    );
+  }
+  assertX25519Algorithm(
+    keypair.privateKey,
+    "keypair.privateKey",
+    "ERR_INVALID_KEYPAIR"
+  );
+  if (!keypair.privateKey.usages.includes("deriveBits")) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must have the deriveBits usage"
+    );
+  }
+  if (keypair.publicKey.type !== "public" || !keypair.publicKey.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.publicKey must be an extractable public key"
+    );
   }
-  assertX25519Algorithm(keypair.privateKey, "keypair.privateKey");
+  assertX25519Algorithm(
+    keypair.publicKey,
+    "keypair.publicKey",
+    "ERR_INVALID_KEYPAIR"
+  );
   const pkE = await subtle2.importKey(
     "raw",
     enc,
@@ -1742,6 +1883,45 @@ async function decap(enc, keypair) {
   return extractAndExpand(dhBytes, kemContext);
 }
 __name(decap, "decap");
+async function keyId(key) {
+  if (key.algorithm.name !== "AES-GCM") {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      `keyId needs an AES-GCM key (got ${key.algorithm.name})`
+    );
+  }
+  if (!key.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      "keyId needs a key with the 'encrypt' usage"
+    );
+  }
+  const labelHash = new Uint8Array(
+    await subtle2.digest("SHA-256", KEY_ID_LABEL)
+  );
+  const nonce = labelHash.slice(0, KEY_ID_NONCE_LENGTH);
+  const ciphertext = new Uint8Array(await subtle2.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    key,
+    KEY_ID_LABEL
+  ));
+  const digest2 = await subtle2.digest(
+    "SHA-256",
+    concat2(KEY_ID_LABEL, ciphertext)
+  );
+  return toString2(new Uint8Array(digest2), "base64url");
+}
+__name(keyId, "keyId");
+async function verifyKeyId(key, expected) {
+  const actual = await keyId(key);
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) {
+    diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return diff === 0;
+}
+__name(verifyKeyId, "verifyKeyId");
 function i2osp(n, len) {
   const out = new Uint8Array(len);
   let v = n;