simple-hpke 0.3.1 → 0.3.3

package/dist/index.cjs

@@ -27,7 +27,8 @@ __export(index_exports, {
   encrypt: () => encrypt,
   encryptKey: () => encryptKey,
   keyId: () => keyId,
-  open: () => open
+  open: () => open,
+  verifyKeyId: () => verifyKeyId
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1391,6 +1392,12 @@ async function aeadOpen(key, nonce, ciphertext) {
 }
 __name(aeadOpen, "aeadOpen");
 async function encryptBytes(recipient, message, aesKey, opts) {
+  if (aesKey instanceof CryptoKey && !aesKey.usages.includes("encrypt")) {
+    throw new HpkeError(
+      "ERR_INVALID_AES_KEY",
+      'aesKey is missing the "encrypt" usage, which encrypt needs to encrypt the message'
+    );
+  }
   const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
   const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
@@ -1489,37 +1496,28 @@ async function resolveRecipientPublicKey(recipient) {
     return importRawPublic(recipient);
   }
   if (recipient instanceof CryptoKey) {
-    if (recipient.type !== "public") {
-      throw new HpkeError(
-        "ERR_INVALID_RECIPIENT_KEY",
-        "recipient CryptoKey must be a public key"
-      );
-    }
-    assertX25519Algorithm(
-      recipient,
-      "recipient CryptoKey",
-      "ERR_INVALID_RECIPIENT_KEY"
-    );
-    return recipient;
+    return assertRecipientPublicKey(recipient, "recipient CryptoKey");
   }
   if (typeof recipient.publicKey === "string") {
     const { publicKey, encoding } = recipient;
-    return importRawPublic(fromString2(publicKey, encoding ?? "base64url"));
-  }
-  const pair = recipient;
-  if (pair.publicKey instanceof CryptoKey) {
-    if (pair.publicKey.type !== "public") {
+    let decoded;
+    try {
+      decoded = fromString2(publicKey, encoding ?? "base64url");
+    } catch (err) {
       throw new HpkeError(
         "ERR_INVALID_RECIPIENT_KEY",
-        "recipient keypair publicKey must be a public key"
+        `recipient publicKey string does not decode as ${encoding ?? "base64url"}`,
+        { cause: err }
       );
     }
-    assertX25519Algorithm(
+    return importRawPublic(decoded);
+  }
+  const pair = recipient;
+  if (pair.publicKey instanceof CryptoKey) {
+    return assertRecipientPublicKey(
       pair.publicKey,
-      "recipient keypair publicKey",
-      "ERR_INVALID_RECIPIENT_KEY"
+      "recipient keypair publicKey"
     );
-    return pair.publicKey;
   }
   throw new HpkeError(
     "ERR_INVALID_RECIPIENT_KEY",
@@ -1527,6 +1525,23 @@ async function resolveRecipientPublicKey(recipient) {
   );
 }
 __name(resolveRecipientPublicKey, "resolveRecipientPublicKey");
+function assertRecipientPublicKey(key, context) {
+  if (key.type !== "public") {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be a public key`
+    );
+  }
+  assertX25519Algorithm(key, context, "ERR_INVALID_RECIPIENT_KEY");
+  if (!key.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_RECIPIENT_KEY",
+      `${context} must be extractable (the KEM exports it)`
+    );
+  }
+  return key;
+}
+__name(assertRecipientPublicKey, "assertRecipientPublicKey");
 function assertX25519Algorithm(key, context, code2) {
   if (key.algorithm.name !== "X25519") {
     throw new HpkeError(
@@ -1537,11 +1552,23 @@ function assertX25519Algorithm(key, context, code2) {
 }
 __name(assertX25519Algorithm, "assertX25519Algorithm");
 async function dh(priv, pub) {
-  const bits = await subtle.deriveBits(
-    { name: "X25519", public: pub },
-    priv,
-    256
-  );
+  let bits;
+  try {
+    bits = await subtle.deriveBits(
+      { name: "X25519", public: pub },
+      priv,
+      256
+    );
+  } catch (err) {
+    if (err?.name === "OperationError") {
+      throw new HpkeError(
+        "ERR_SMALL_ORDER_KEY",
+        "X25519 deriveBits rejected a small-order public key",
+        { cause: err }
+      );
+    }
+    throw err;
+  }
   const bytes = new Uint8Array(bits);
   if (bytes.every((b) => b === 0)) {
     throw new HpkeError(
@@ -1594,6 +1621,23 @@ async function decap(enc, keypair) {
     "keypair.privateKey",
     "ERR_INVALID_KEYPAIR"
   );
+  if (!keypair.privateKey.usages.includes("deriveBits")) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.privateKey must have the deriveBits usage"
+    );
+  }
+  if (keypair.publicKey.type !== "public" || !keypair.publicKey.extractable) {
+    throw new HpkeError(
+      "ERR_INVALID_KEYPAIR",
+      "keypair.publicKey must be an extractable public key"
+    );
+  }
+  assertX25519Algorithm(
+    keypair.publicKey,
+    "keypair.publicKey",
+    "ERR_INVALID_KEYPAIR"
+  );
   const pkE = await subtle.importKey(
     "raw",
     enc,
@@ -1636,6 +1680,16 @@ async function keyId(key) {
   return toString2(new Uint8Array(digest2), "base64url");
 }
 __name(keyId, "keyId");
+async function verifyKeyId(key, expected) {
+  const actual = await keyId(key);
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) {
+    diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return diff === 0;
+}
+__name(verifyKeyId, "verifyKeyId");
 function i2osp(n, len) {
   const out = new Uint8Array(len);
   let v = n;
@@ -1724,7 +1778,16 @@ async function decryptToString(keypair, message, opts) {
 }
 __name(decryptToString, "decryptToString");
 async function decryptFromString(keypair, message, opts) {
-  const bytes = fromString2(message, "base64url");
+  let bytes;
+  try {
+    bytes = fromString2(message, "base64url");
+  } catch (err) {
+    throw new HpkeError(
+      "ERR_MALFORMED_MESSAGE",
+      "malformed message: not base64url",
+      { cause: err }
+    );
+  }
   const plaintext = await decryptBytes(
     keypair,
     bytes,
@@ -1852,6 +1915,12 @@ async function encryptKey(recipient, aesKey, opts) {
     validateRawKeyBytes(aesKey);
     keyBytes = aesKey;
   } else if (aesKey) {
+    if (aesKey.algorithm.name !== "AES-GCM") {
+      throw new HpkeError(
+        "ERR_INVALID_AES_KEY",
+        "aesKey must be an AES-GCM key, got " + aesKey.algorithm.name
+      );
+    }
     keyBytes = await exportAesKeyBytes(aesKey);
     validateRawKeyBytes(keyBytes);
   } else {
@@ -1866,6 +1935,7 @@ async function encryptKey(recipient, aesKey, opts) {
   const { key, baseNonce } = await keySchedule(sharedSecret, info);
   const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
   const wrapped = concat2(enc, ciphertext);
+  if (aesKey instanceof CryptoKey) return { wrapped, key: aesKey };
   const aesGcmKey = await importAesKey(
     keyBytes,
     opts?.extractable ?? false