simple-hpke 0.3.1 → 0.3.3

package/dist/meta.json

@@ -702,7 +702,7 @@
       "format": "esm"
     },
     "src/index.ts": {
-      "bytes": 14331,
+      "bytes": 15697,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -738,7 +738,7 @@
       "format": "esm"
     },
     "src/util.ts": {
-      "bytes": 17940,
+      "bytes": 22056,
       "imports": [
         {
           "path": "node_modules/uint8arrays/dist/src/index.js",
@@ -785,7 +785,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 121397
+      "bytes": 128024
     },
     "dist/constants.js": {
       "imports": [],
@@ -896,16 +896,16 @@
           "bytesInOutput": 215
         },
         "src/index.ts": {
-          "bytesInOutput": 5995
+          "bytesInOutput": 6418
         },
         "src/util.ts": {
-          "bytesInOutput": 7314
+          "bytesInOutput": 8581
         },
         "src/constants.ts": {
           "bytesInOutput": 551
         }
       },
-      "bytes": 52563
+      "bytes": 54253
     },
     "dist/errors.js.map": {
       "imports": [],
@@ -930,7 +930,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 122106
+      "bytes": 128969
     },
     "dist/index.js": {
       "imports": [],
@@ -941,7 +941,8 @@
         "encrypt",
         "encryptKey",
         "keyId",
-        "open"
+        "open",
+        "verifyKeyId"
       ],
       "entryPoint": "src/index.ts",
       "inputs": {
@@ -1036,19 +1037,19 @@
           "bytesInOutput": 551
         },
         "src/util.ts": {
-          "bytesInOutput": 8110
+          "bytesInOutput": 9693
         },
         "src/index.ts": {
-          "bytesInOutput": 6166
+          "bytesInOutput": 6589
         }
       },
-      "bytes": 53408
+      "bytes": 55429
     },
     "dist/util.js.map": {
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 121973
+      "bytes": 128835
     },
     "dist/util.js": {
       "imports": [],
@@ -1065,7 +1066,8 @@
         "keyId",
         "labeledExpand",
         "labeledExtract",
-        "resolveRecipientPublicKey"
+        "resolveRecipientPublicKey",
+        "verifyKeyId"
       ],
       "entryPoint": "src/util.ts",
       "inputs": {
@@ -1160,13 +1162,13 @@
           "bytesInOutput": 551
         },
         "src/index.ts": {
-          "bytesInOutput": 5995
+          "bytesInOutput": 6418
         },
         "src/util.ts": {
-          "bytesInOutput": 8126
+          "bytesInOutput": 9709
         }
       },
-      "bytes": 53353
+      "bytes": 55374
     }
   }
 }

package/dist/util.cjs

@@ -33,7 +33,8 @@ __export(util_exports, {
   keyId: () => keyId,
   labeledExpand: () => labeledExpand,
   labeledExtract: () => labeledExtract,
-  resolveRecipientPublicKey: () => resolveRecipientPublicKey
+  resolveRecipientPublicKey: () => resolveRecipientPublicKey,
+  verifyKeyId: () => verifyKeyId
 });
 module.exports = __toCommonJS(util_exports);
 
@@ -1413,7 +1414,16 @@ async function decryptToString(keypair, message, opts) {
 }
 __name(decryptToString, "decryptToString");
 async function decryptFromString(keypair, message, opts) {
-  const bytes = fromString2(message, "base64url");
+  let bytes;
+  try {
+    bytes = fromString2(message, "base64url");
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: not base64url",
+      { cause: err }
+    );
+  }
   const plaintext = await decryptBytes(
     keypair,
     bytes,
@@ -1541,6 +1551,12 @@ async function encryptKey(recipient, aesKey, opts) {
     validateRawKeyBytes(aesKey);
     keyBytes = aesKey;
   } else if (aesKey) {
+    if (aesKey.algorithm.name !== "AES-GCM") {
+      throw new HpkeError(
+        "ERR_INVALID_AES_KEY",
+        "aesKey must be an AES-GCM key, got " + aesKey.algorithm.name
+      );
+    }
     keyBytes = await exportAesKeyBytes(aesKey);
     validateRawKeyBytes(keyBytes);
   } else {
@@ -1555,6 +1571,7 @@ async function encryptKey(recipient, aesKey, opts) {
   const { key, baseNonce } = await keySchedule(sharedSecret, info);
   const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
   const wrapped = concat2(enc, ciphertext);
+  if (aesKey instanceof CryptoKey) return { wrapped, key: aesKey };
   const aesGcmKey = await importAesKey(
     keyBytes,
     opts?.extractable ?? false
@@ -1607,6 +1624,12 @@ async function aeadOpen(key, nonce, ciphertext) {
 }
 __name(aeadOpen, "aeadOpen");
 async function encryptBytes(recipient, message, aesKey, opts) {
+  if (aesKey instanceof CryptoKey && !aesKey.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      'aesKey is missing the "encrypt" usage, which encrypt needs to encrypt the message'
+    );
+  }
   const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
   const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
@@ -1705,37 +1728,28 @@ async function resolveRecipientPublicKey(recipient) {
     return importRawPublic(recipient);
   }
   if (recipient instanceof CryptoKey) {
-    if (recipient.type !== "public") {
-      throw new HpkeError(
-        "ERR_INVALID_RECIPIENT_KEY",
-        "recipient CryptoKey must be a public key"
-      );
-    }
-    assertX25519Algorithm(
-      recipient,
-      "recipient CryptoKey",
-      "ERR_INVALID_RECIPIENT_KEY"
-    );
-    return recipient;
+    return assertRecipientPublicKey(recipient, "recipient CryptoKey");
   }
   if (typeof recipient.publicKey === "string") {
     const { publicKey, encoding } = recipient;
-    return importRawPublic(fromString2(publicKey, encoding ?? "base64url"));
-  }
-  const pair = recipient;
-  if (pair.publicKey instanceof CryptoKey) {
-    if (pair.publicKey.type !== "public") {
+    let decoded;
+    try {
+      decoded = fromString2(publicKey, encoding ?? "base64url");
+    } catch (err) {
       throw new HpkeError(
         "ERR_INVALID_RECIPIENT_KEY",
-        "recipient keypair publicKey must be a public key"
+        `recipient publicKey string does not decode as ${encoding ?? "base64url"}`,
+        { cause: err }
       );
     }
-    assertX25519Algorithm(
+    return importRawPublic(decoded);
+  }
+  const pair = recipient;
+  if (pair.publicKey instanceof CryptoKey) {
+    return assertRecipientPublicKey(
       pair.publicKey,
-      "recipient keypair publicKey",
-      "ERR_INVALID_RECIPIENT_KEY"
+      "recipient keypair publicKey"
     );
-    return pair.publicKey;
   }
   throw new HpkeError(
     "ERR_INVALID_RECIPIENT_KEY",
@@ -1743,6 +1757,23 @@ async function resolveRecipientPublicKey(recipient) {
   );
 }
 __name(resolveRecipientPublicKey, "resolveRecipientPublicKey");
+function assertRecipientPublicKey(key, context) {
+  if (key.type !== "public") {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be a public key`
+    );
+  }
+  assertX25519Algorithm(key, context, "ERR_INVALID_RECIPIENT_KEY");
+  if (!key.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be extractable (the KEM exports it)`
+    );
+  }
+  return key;
+}
+__name(assertRecipientPublicKey, "assertRecipientPublicKey");
 function assertX25519Algorithm(key, context, code2) {
   if (key.algorithm.name !== "X25519") {
     throw new HpkeError(
@@ -1753,11 +1784,23 @@ function assertX25519Algorithm(key, context, code2) {
 }
 __name(assertX25519Algorithm, "assertX25519Algorithm");
 async function dh(priv, pub) {
-  const bits = await subtle2.deriveBits(
-    { name: "X25519", public: pub },
-    priv,
-    256
-  );
+  let bits;
+  try {
+    bits = await subtle2.deriveBits(
+      { name: "X25519", public: pub },
+      priv,
+      256
+    );
+  } catch (err) {
+    if (err?.name === "OperationError") {
+      throw new HpkeError(
+        "ERR_SMALL_ORDER_KEY",
+        "X25519 deriveBits rejected a small-order public key",
+        { cause: err }
+      );
+    }
+    throw err;
+  }
   const bytes = new Uint8Array(bits);
   if (bytes.every((b) => b === 0)) {
     throw new HpkeError(
@@ -1810,6 +1853,23 @@ async function decap(enc, keypair) {
     "keypair.privateKey",
     "ERR_INVALID_KEYPAIR"
   );
+  if (!keypair.privateKey.usages.includes("deriveBits")) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must have the deriveBits usage"
+    );
+  }
+  if (keypair.publicKey.type !== "public" || !keypair.publicKey.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.publicKey must be an extractable public key"
+    );
+  }
+  assertX25519Algorithm(
+    keypair.publicKey,
+    "keypair.publicKey",
+    "ERR_INVALID_KEYPAIR"
+  );
   const pkE = await subtle2.importKey(
     "raw",
     enc,
@@ -1852,6 +1912,16 @@ async function keyId(key) {
   return toString2(new Uint8Array(digest2), "base64url");
 }
 __name(keyId, "keyId");
+async function verifyKeyId(key, expected) {
+  const actual = await keyId(key);
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) {
+    diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return diff === 0;
+}
+__name(verifyKeyId, "verifyKeyId");
 function i2osp(n, len) {
   const out = new Uint8Array(len);
   let v = n;