subtlepq 0.2.0 → 0.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the [WICG Modern Algorithms draft](https://wicg.github.io/webcrypto-modern-algos/), with native delegation where the platform already supports it.
 
-**Status: P2 — engine, core JS layer, all key formats, key wrapping.** DHKEM is on the way.
+**Status: P4 — engine, core JS layer, all key formats, key wrapping, native-parity suites, DHKEM extension.**
 
 Key formats: `raw-public`, `raw-seed`, `spki`, `pkcs8` (seed-only encoding per the LAMPS
 drafts; the `both` CHOICE is accepted on import and cross-checked), and `jwk` (kty `"AKP"`,
@@ -34,6 +34,26 @@ const sig = await crypto.subtle.sign({ name: "ML-DSA-65", context: ctx }, kp.pri
 
 Known limits (inherent to a script polyfill, made loud rather than silent): ML-* keys are not structured-cloneable — `postMessage`/IndexedDB throws `DataCloneError`; export the 32–64-byte seed and re-import instead. Key material lives in wasm linear memory: `extractable: false` is API-level enforcement, not platform isolation.
 
+## DHKEM: classical ECDH in the same KEM shape
+
+`subtlepq/dhkem` wraps ephemeral-static ECDH as a KEM per [RFC 9180 §4.1](https://www.rfc-editor.org/rfc/rfc9180#section-4.1) — `DHKEM-X25519-HKDF-SHA256` and `DHKEM-P256-HKDF-SHA256` — so classical and post-quantum key agreement share one calling convention, and migrating to ML-KEM is a name change:
+
+```js
+import * as dhkem from "subtlepq/dhkem";
+dhkem.register();       // before install(), if you use the true polyfill
+import { subtle } from "subtlepq";
+
+const kp = await subtle.generateKey("DHKEM-X25519-HKDF-SHA256", false,
+    ["encapsulateKey", "decapsulateKey"]);
+const { sharedKey, ciphertext } = await subtle.encapsulateKey(
+    "DHKEM-X25519-HKDF-SHA256", kp.publicKey,          // -> "ML-KEM-768" later
+    { name: "AES-GCM", length: 256 }, false, ["encrypt"]);
+```
+
+These names are **not** in the WICG draft — this is a subtlepq extension (if the WG adopts DHKEM identifiers, those will be adopted and these aliased). Underneath it is 100% native WebCrypto (ECDH/X25519 + HKDF): no wasm is involved, and the keys are genuine platform CryptoKeys — structured-cloneable, native usage enforcement (surfaced as `deriveBits`). The ciphertext is the serialized ephemeral public key (32 bytes X25519 / 65 bytes P-256), interoperable with any RFC 9180 DHKEM implementation, and validated against the RFC 9180 Appendix A test vectors.
+
+One asymmetry vs a true KEM: RFC 9180 decapsulation mixes the recipient *public* key into the KDF. subtlepq remembers the public half for keys created through `subtlepq/dhkem`; for private keys from elsewhere (or structured-cloned into another realm) pass it explicitly — `decapsulateBits({ name: "DHKEM-X25519-HKDF-SHA256", publicKey }, key, ct)` — or use an extractable key.
+
 ## Engine
 
 `wasm/` builds a minimal [liboqs](https://github.com/open-quantum-safe/liboqs) (pinned submodule, ML-KEM + ML-DSA only) plus a thin shim (`subtlepq_engine.c`) to WebAssembly:
@@ -48,7 +68,15 @@ Outputs `wasm/dist/subtlepq-engine.mjs` (+ `.wasm` sidecar, CSP-clean) and `subt
 
 Seeded operations liboqs does not expose publicly (ML-DSA keygen from seed, KAT-deterministic encapsulation/signing) use a bracketed RNG-playback override — the same technique liboqs' own ACVP tests use.
 
-Tests run NIST ACVP known-answer vectors (subset, see `test/vectors/acvp-subset.json`) for all six parameter sets, plus roundtrip, implicit-rejection, context, and polyfill-routing checks.
+Tests run NIST ACVP known-answer vectors (subset, see `test/vectors/acvp-subset.json`) for all six parameter sets, plus roundtrip, implicit-rejection, context, and polyfill-routing checks. `test/dhkem-test.mjs` validates the DHKEM extension against the RFC 9180 Appendix A vectors (`test/vectors/rfc9180-subset.json`).
+
+`npm run test:parity` (Node >= 24.7) runs the polyfill side-by-side against the
+platform-native ML-KEM/ML-DSA WebCrypto implementation as an oracle: identical
+spki/pkcs8/jwk bytes, cross-stack encapsulate/decapsulate and sign/verify, identical
+AES-KW/AES-GCM wrapKey output, and matching DOMException names on malformed input.
+`npm run test:libves` cross-checks ML-KEM against [libVES](https://github.com/vesvault/libVES)
+(an independent liboqs build and ASN.1 layer): same-seed keypair equality, SPKI byte
+parity, and mutual key import and encapsulation.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "subtlepq",
-    "version": "0.2.0",
+    "version": "0.3.0",
     "description": "Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the WICG Modern Algorithms draft, with native delegation",
     "type": "module",
     "license": "Apache-2.0",
@@ -19,6 +19,7 @@
     "sideEffects": false,
     "files": [
         "src/algorithms.js",
+        "src/dhkem.js",
         "src/engine.js",
         "src/errors.js",
         "src/formats.js",
@@ -33,16 +34,19 @@
     ],
     "exports": {
         ".": "./src/index.js",
-        "./install": "./src/install.js"
+        "./install": "./src/install.js",
+        "./dhkem": "./src/dhkem.js"
     },
     "scripts": {
         "build": "wasm/build.sh",
         "prepack": "node -e \"const p=require('./package.json'),fs=require('fs');for(const f of p.files)if(!fs.existsSync(f))throw new Error(f+' missing - run wasm/build.sh before packing')\"",
-        "test": "node test/engine-test.mjs && node test/polyfill-test.mjs"
+        "test": "node test/engine-test.mjs && node test/polyfill-test.mjs && node test/dhkem-test.mjs",
+        "test:parity": "node test/parity-native.mjs",
+        "test:libves": "node test/parity-libves.mjs"
     },
     "keywords": [
         "ml-kem", "ml-dsa", "webcrypto", "polyfill", "post-quantum",
         "fips203", "fips204", "kyber", "dilithium", "subtlecrypto",
-        "encapsulation", "kem"
+        "encapsulation", "kem", "dhkem", "hpke", "rfc9180"
     ]
 }

package/src/algorithms.js

@@ -13,8 +13,25 @@ const NAMES = [
 export const KEM_PUB_USAGES = ["encapsulateBits", "encapsulateKey"];
 export const KEM_PRIV_USAGES = ["decapsulateBits", "decapsulateKey"];
 
+/* Extension algorithms (subtlepq/dhkem): registered at runtime, carrying
+ * their own ops table; the core ML-* set above stays engine-backed. */
+const EXTENSIONS = new Map();
+
+export function registerExtension(name, kind, ops) {
+    EXTENSIONS.set(name.toLowerCase(), { name, kind, ops });
+}
+
+export function unregisterExtension(name) {
+    EXTENSIONS.delete(name.toLowerCase());
+}
+
+export function hasExtensions() {
+    return EXTENSIONS.size > 0;
+}
+
 /* WebCrypto algorithm names are matched case-insensitively.
- * Returns { name, kind, context? } with the canonical name, or null. */
+ * Returns { name, kind, context?, ops? } with the canonical name, or null;
+ * `ops` marks an extension algorithm handled outside subtle.js. */
 export function normalizeAlg(alg) {
     let name, context;
     if (typeof alg === "string") {
@@ -26,10 +43,14 @@ export function normalizeAlg(alg) {
         return null;
     }
     const canonical = NAMES.find((n) => n.toLowerCase() === name.toLowerCase());
-    if (!canonical) return null;
-    return {
-        name: canonical,
-        kind: canonical.startsWith("ML-KEM") ? "kem" : "sig",
-        context,
-    };
+    if (canonical) {
+        return {
+            name: canonical,
+            kind: canonical.startsWith("ML-KEM") ? "kem" : "sig",
+            context,
+        };
+    }
+    const ext = EXTENSIONS.get(name.toLowerCase());
+    if (!ext) return null;
+    return { name: ext.name, kind: ext.kind, ops: ext.ops, context };
 }

package/src/dhkem.js

@@ -0,0 +1,321 @@
+/***************************************************************************
+ * subtlepq/dhkem: DHKEM over the platform's native ECDH -- RFC 9180 sec 4.1
+ *
+ * (c) 2026 VESvault Corp
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * KEM-shaped classical key agreement: ephemeral-static ECDH wrapped as
+ * encapsulate/decapsulate, so classical and post-quantum share one calling
+ * convention and migrating to ML-KEM is a name change. NOT part of the
+ * WICG draft -- a subtlepq extension; if the WG ever adopts DHKEM
+ * identifiers, those will be adopted here and these names aliased.
+ *
+ * Everything underneath is native WebCrypto (ECDH / X25519 + HKDF-SHA256);
+ * no WASM is involved and all keys are genuine platform CryptoKeys --
+ * structured-cloneable, native usage enforcement (surfaced as
+ * "deriveBits", the underlying native usage).
+ *
+ * Decapsulation needs the recipient PUBLIC key bytes for the RFC 9180
+ * kem_context. They are remembered automatically for private keys made by
+ * generateKey()/importKey() of this module; for foreign or structured-
+ * cloned private keys pass { name, publicKey } (CryptoKey or serialized
+ * bytes) or use an extractable key.
+ ***************************************************************************/
+
+import { registerExtension, unregisterExtension } from "./algorithms.js";
+import { importSharedKey, toBytes } from "./subtle.js";
+import { unb64u } from "./formats.js";
+import * as E from "./errors.js";
+
+const te = new TextEncoder();
+
+function cat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let o = 0;
+    for (const p of parts) { out.set(p, o); o += p.length; }
+    return out;
+}
+
+/* suite_id = "KEM" || I2OSP(kem_id, 2); Nsecret = 32 for both suites.
+ * The RFC serialized public key form is exactly WebCrypto "raw": 32 bytes
+ * for X25519, the 65-byte uncompressed point for P-256. */
+const SUITES = {
+    "DHKEM-X25519-HKDF-SHA256": {
+        nEnc: 32,
+        native: { name: "X25519" },
+        suiteId: cat(te.encode("KEM"), [0x00, 0x20]),
+        jwkPub: (jwk) => (jwk.x === undefined ? null : unb64u(jwk.x, "x")),
+    },
+    "DHKEM-P256-HKDF-SHA256": {
+        nEnc: 65,
+        native: { name: "ECDH", namedCurve: "P-256" },
+        suiteId: cat(te.encode("KEM"), [0x00, 0x10]),
+        jwkPub: (jwk) => (jwk.x === undefined || jwk.y === undefined ? null
+            : cat([0x04], unb64u(jwk.x, "x"), unb64u(jwk.y, "y"))),
+    },
+};
+
+const PUB_USAGES = ["encapsulateBits", "encapsulateKey"];
+const PRIV_USAGES = ["decapsulateBits", "decapsulateKey", "deriveBits", "deriveKey"];
+
+/* key -> its serialized PUBLIC key bytes (for a private key, the public
+ * half): encap serializes pkR and decap mixes it into the kem_context,
+ * and neither can be exported off a non-extractable CryptoKey */
+const pkmap = new WeakMap();
+
+function nativeSubtle() {
+    const ns = globalThis.crypto && globalThis.crypto.subtle;
+    if (!ns) throw E.notSupported("no native SubtleCrypto for DHKEM");
+    return ns;
+}
+
+function requireSuite(alg) {
+    let name, obj;
+    if (typeof alg === "string") {
+        name = alg;
+    } else if (alg && typeof alg.name === "string") {
+        name = alg.name;
+        obj = alg;
+    }
+    const canonical = name === undefined ? undefined :
+        Object.keys(SUITES).find((n) => n.toLowerCase() === name.toLowerCase());
+    if (!canonical) throw E.notSupported("unrecognized DHKEM algorithm");
+    return { name: canonical, s: SUITES[canonical], alg: obj };
+}
+
+function requireKey(key, s, name, type) {
+    const ka = key && key.algorithm;
+    const match = ka && ka.name === s.native.name &&
+        (s.native.namedCurve === undefined || ka.namedCurve === s.native.namedCurve);
+    if (!match) {
+        throw E.invalidAccess("key is not a native " + s.native.name +
+            (s.native.namedCurve ? "/" + s.native.namedCurve : "") +
+            " key usable with " + name);
+    }
+    if (key.type !== type) throw E.invalidAccess("expected a " + type + " key");
+}
+
+function checkUsages(usages, allowed) {
+    for (const u of usages) {
+        if (!allowed.includes(u)) throw E.syntaxError("unsupported key usage " + u);
+    }
+}
+
+/* ExtractAndExpand (RFC 9180 sec 4.1) in one native HKDF deriveBits call:
+ * LabeledExtract("", "eae_prk", dh) + LabeledExpand(prk, "shared_secret",
+ * kem_context, 32) map exactly onto HKDF's extract-then-expand. */
+async function extractAndExpand(ns, s, dh, kemContext) {
+    const ikm = cat(te.encode("HPKE-v1"), s.suiteId, te.encode("eae_prk"), dh);
+    const info = cat([0, 32], te.encode("HPKE-v1"), s.suiteId,
+        te.encode("shared_secret"), kemContext);
+    const k = await ns.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+    ikm.fill(0);
+    return new Uint8Array(await ns.deriveBits(
+        { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info }, k, 256));
+}
+
+const dhBits = async (ns, s, priv, pub) => new Uint8Array(
+    await ns.deriveBits({ name: s.native.name, public: pub }, priv, 256));
+
+async function publicBytesFor(ns, key, s, name, alg) {
+    const given = alg && alg.publicKey;
+    if (given !== undefined && given !== null) {
+        if (typeof CryptoKey !== "undefined" && given instanceof CryptoKey) {
+            requireKey(given, s, name, "public");
+            return new Uint8Array(await ns.exportKey("raw", given));
+        }
+        const b = toBytes(given, "publicKey");
+        if (b.length !== s.nEnc) throw E.dataError("bad " + name + " publicKey length");
+        return b;
+    }
+    const known = pkmap.get(key);
+    if (known) return known.slice();
+    if (key.extractable) {
+        const pub = s.jwkPub(await ns.exportKey("jwk", key));
+        if (pub) return pub;
+    }
+    throw E.invalidAccess("cannot determine the recipient public key for " + name +
+        " decapsulation; pass { name, publicKey } or use a key from this module");
+}
+
+/* ---- key management (thin translation onto native ECDH / X25519) ---- */
+
+export async function generateKey(algorithm, extractable, keyUsages = []) {
+    const { s } = requireSuite(algorithm);
+    checkUsages(keyUsages, [...PUB_USAGES, ...PRIV_USAGES]);
+    if (!keyUsages.some((u) => PRIV_USAGES.includes(u))) {
+        throw E.syntaxError("private key usages must not be empty");
+    }
+    const ns = nativeSubtle();
+    const pair = await ns.generateKey(s.native, extractable, ["deriveBits"]);
+    const pub = new Uint8Array(await ns.exportKey("raw", pair.publicKey));
+    pkmap.set(pair.publicKey, pub);
+    pkmap.set(pair.privateKey, pub);
+    return pair;
+}
+
+export async function importKey(format, keyData, algorithm, extractable, keyUsages = []) {
+    const { s, name } = requireSuite(algorithm);
+    const ns = nativeSubtle();
+    const importPriv = async (fmt, data) => {
+        checkUsages(keyUsages, PRIV_USAGES);
+        if (!keyUsages.length) throw E.syntaxError("private key usages must not be empty");
+        return ns.importKey(fmt, data, s.native, extractable, ["deriveBits"]);
+    };
+    if (format === "raw" || format === "raw-public" || format === "spki") {
+        checkUsages(keyUsages, PUB_USAGES);
+        const fmt = format === "raw-public" ? "raw" : format;
+        const bytes = toBytes(keyData, "keyData");
+        const key = await ns.importKey(fmt, bytes, s.native, extractable, []);
+        if (fmt === "raw") {
+            pkmap.set(key, bytes);
+        } else {
+            /* spki: recover the raw form via an extractable twin */
+            try {
+                const twin = extractable ? key
+                    : await ns.importKey("spki", bytes, s.native, true, []);
+                pkmap.set(key, new Uint8Array(await ns.exportKey("raw", twin)));
+            } catch {}
+        }
+        return key;
+    }
+    if (format === "pkcs8") {
+        const bytes = toBytes(keyData, "keyData");
+        const key = await importPriv("pkcs8", bytes);
+        /* recover the public half for decap: from the key if extractable,
+         * else from a throwaway extractable import of the same bytes */
+        try {
+            const twin = extractable ? key
+                : await ns.importKey("pkcs8", bytes, s.native, true, ["deriveBits"]);
+            const pub = s.jwkPub(await ns.exportKey("jwk", twin));
+            if (pub) pkmap.set(key, pub);
+        } catch {}
+        bytes.fill(0);
+        return key;
+    }
+    if (format === "jwk") {
+        if (!keyData || typeof keyData !== "object" || ArrayBuffer.isView(keyData) ||
+                keyData instanceof ArrayBuffer) {
+            throw E.dataError("jwk import expects a JsonWebKey object");
+        }
+        /* alg/key_ops carry DHKEM-level values the native import would
+         * reject; the native usage set is supplied explicitly instead */
+        const clean = { ...keyData };
+        delete clean.alg;
+        delete clean.key_ops;
+        delete clean.use;
+        if (keyData.d === undefined) {
+            checkUsages(keyUsages, PUB_USAGES);
+            const key = await ns.importKey("jwk", clean, s.native, extractable, []);
+            const pub = s.jwkPub(keyData);
+            if (pub) pkmap.set(key, pub);
+            return key;
+        }
+        const key = await importPriv("jwk", clean);
+        const pub = s.jwkPub(keyData);
+        if (pub) pkmap.set(key, pub);
+        return key;
+    }
+    throw E.notSupported("key format " + format + " is not supported");
+}
+
+/* ---- KEM operations (RFC 9180 sec 4.1 Encap / Decap, base mode) ---- */
+
+async function encap(algorithm, encapsulationKey) {
+    const { s, name } = requireSuite(algorithm);
+    requireKey(encapsulationKey, s, name, "public");
+    const ns = nativeSubtle();
+    const eph = await ns.generateKey(s.native, false, ["deriveBits"]);
+    const enc = new Uint8Array(await ns.exportKey("raw", eph.publicKey));
+    const dh = await dhBits(ns, s, eph.privateKey, encapsulationKey);
+    const known = pkmap.get(encapsulationKey);
+    let pkRm;
+    if (known) {
+        pkRm = known;
+    } else {
+        try {
+            pkRm = new Uint8Array(await ns.exportKey("raw", encapsulationKey));
+        } catch {
+            throw E.invalidAccess("cannot serialize the " + name +
+                " encapsulation key: not extractable and not from this module");
+        }
+    }
+    const ss = await extractAndExpand(ns, s, dh, cat(enc, pkRm));
+    dh.fill(0);
+    return { ss, enc };
+}
+
+async function decap(algorithm, decapsulationKey, ciphertext) {
+    const { s, name, alg } = requireSuite(algorithm);
+    requireKey(decapsulationKey, s, name, "private");
+    const enc = toBytes(ciphertext, "ciphertext");
+    if (enc.length !== s.nEnc) throw E.opError("bad " + name + " ciphertext length");
+    const ns = nativeSubtle();
+    let pkE;
+    try {
+        pkE = await ns.importKey("raw", enc, s.native, true, []);
+    } catch {
+        /* unlike ML-KEM implicit rejection, DHKEM decap MAY fail: an
+         * invalid public key raises ValidationError per RFC 9180 */
+        throw E.opError("invalid " + name + " ciphertext");
+    }
+    const dh = await dhBits(ns, s, decapsulationKey, pkE);
+    const pkRm = await publicBytesFor(ns, decapsulationKey, s, name, alg);
+    const ss = await extractAndExpand(ns, s, dh, cat(enc, pkRm));
+    dh.fill(0);
+    return ss;
+}
+
+export async function encapsulateBits(algorithm, encapsulationKey) {
+    const { ss, enc } = await encap(algorithm, encapsulationKey);
+    return { sharedKey: ss.buffer, ciphertext: enc.buffer };
+}
+
+export async function encapsulateKey(algorithm, encapsulationKey,
+                                     sharedKeyAlgorithm, extractable, keyUsages) {
+    const { ss, enc } = await encap(algorithm, encapsulationKey);
+    const sharedKey = await importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
+    return { sharedKey, ciphertext: enc.buffer };
+}
+
+export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
+    return (await decap(algorithm, decapsulationKey, ciphertext)).buffer;
+}
+
+export async function decapsulateKey(algorithm, decapsulationKey, ciphertext,
+                                     sharedKeyAlgorithm, extractable, keyUsages) {
+    const ss = await decap(algorithm, decapsulationKey, ciphertext);
+    return importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
+}
+
+/* ---- feature detection / registration ---- */
+
+const OPS = ["generateKey", "importKey", "exportKey",
+    "encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"];
+
+export function supports(operation, algorithm) {
+    if (algorithm !== undefined) {
+        try {
+            requireSuite(algorithm);
+        } catch {
+            return false;
+        }
+    }
+    return OPS.includes(operation);
+}
+
+const ops = {
+    generateKey, importKey,
+    encapsulateBits, encapsulateKey, decapsulateBits, decapsulateKey,
+    supports: (operation) => OPS.includes(operation),
+};
+
+/* Makes the DHKEM-* names routable through the subtlepq ponyfill `subtle`
+ * and, after install(), through crypto.subtle; call before install(). */
+export function register() {
+    for (const name of Object.keys(SUITES)) registerExtension(name, "kem", ops);
+}
+
+export function unregister() {
+    for (const name of Object.keys(SUITES)) unregisterExtension(name);
+}

package/src/install.js

@@ -13,6 +13,7 @@
 
 import * as ours from "./subtle.js";
 import { ROUTES, shape } from "./router.js";
+import { hasExtensions } from "./algorithms.js";
 import * as E from "./errors.js";
 
 let saved = null;
@@ -36,8 +37,11 @@ export function install() {
     const ctor = subtle.constructor;
     saved = { proto, ctor, methods: {}, supports: Object.getOwnPropertyDescriptor(ctor, "supports") };
 
-    /* nothing to do on platforms that already do ML-KEM + ML-DSA natively */
-    if (nativeSupports(ctor, "encapsulateBits", "ML-KEM-768") &&
+    /* nothing to do on platforms that already do ML-KEM + ML-DSA natively --
+     * unless extension algorithms (subtlepq/dhkem) are registered, which no
+     * native implementation covers; register() before install() */
+    if (!hasExtensions() &&
+        nativeSupports(ctor, "encapsulateBits", "ML-KEM-768") &&
         nativeSupports(ctor, "sign", "ML-DSA-65")) {
         return;
     }

package/src/subtle.js

@@ -24,7 +24,7 @@ import * as E from "./errors.js";
 
 const rng = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
 
-function toBytes(src, what) {
+export function toBytes(src, what) {
     if (ArrayBuffer.isView(src)) {
         return new Uint8Array(
             src.buffer.slice(src.byteOffset, src.byteOffset + src.byteLength));
@@ -69,7 +69,7 @@ function signContext(a) {
     return ctx;
 }
 
-async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsages) {
+export async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsages) {
     const ns = globalThis.crypto && globalThis.crypto.subtle;
     if (!ns) throw E.notSupported("no native SubtleCrypto to hold the shared key");
     try {
@@ -83,6 +83,7 @@ async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsag
 
 export async function generateKey(algorithm, extractable, keyUsages = []) {
     const a = requireAlg(algorithm);
+    if (a.ops) return a.ops.generateKey(algorithm, extractable, keyUsages);
     const eng = await getEngine();
     if (a.kind === "kem") {
         checkUsages(keyUsages, [...KEM_PUB_USAGES, ...KEM_PRIV_USAGES]);
@@ -111,6 +112,7 @@ export async function generateKey(algorithm, extractable, keyUsages = []) {
 
 export async function importKey(format, keyData, algorithm, extractable, keyUsages = []) {
     const a = requireAlg(algorithm);
+    if (a.ops) return a.ops.importKey(format, keyData, algorithm, extractable, keyUsages);
     const eng = await getEngine();
     const L = a.kind === "kem" ? eng.kemLengths(a.name) : eng.sigLengths(a.name);
     const pubUsages = a.kind === "kem" ? KEM_PUB_USAGES : ["verify"];
@@ -234,6 +236,7 @@ export async function getPublicKey(key, keyUsages = []) {
 
 export async function encapsulateBits(algorithm, encapsulationKey) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) return a.ops.encapsulateBits(algorithm, encapsulationKey);
     const m = requireKey(encapsulationKey, a, "public", "encapsulateBits");
     const { ct, ss } = (await getEngine()).kemEncaps(a.name, m.pub);
     return { sharedKey: ss.buffer, ciphertext: ct.buffer };
@@ -242,6 +245,10 @@ export async function encapsulateBits(algorithm, encapsulationKey) {
 export async function encapsulateKey(algorithm, encapsulationKey,
                                      sharedKeyAlgorithm, extractable, keyUsages) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) {
+        return a.ops.encapsulateKey(algorithm, encapsulationKey,
+            sharedKeyAlgorithm, extractable, keyUsages);
+    }
     const m = requireKey(encapsulationKey, a, "public", "encapsulateKey");
     const { ct, ss } = (await getEngine()).kemEncaps(a.name, m.pub);
     const sharedKey = await importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
@@ -250,6 +257,7 @@ export async function encapsulateKey(algorithm, encapsulationKey,
 
 export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) return a.ops.decapsulateBits(algorithm, decapsulationKey, ciphertext);
     const m = requireKey(decapsulationKey, a, "private", "decapsulateBits");
     const eng = await getEngine();
     const ct = toBytes(ciphertext, "ciphertext");
@@ -262,6 +270,10 @@ export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
 export async function decapsulateKey(algorithm, decapsulationKey, ciphertext,
                                      sharedKeyAlgorithm, extractable, keyUsages) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) {
+        return a.ops.decapsulateKey(algorithm, decapsulationKey, ciphertext,
+            sharedKeyAlgorithm, extractable, keyUsages);
+    }
     const m = requireKey(decapsulationKey, a, "private", "decapsulateKey");
     const eng = await getEngine();
     const ct = toBytes(ciphertext, "ciphertext");
@@ -371,5 +383,7 @@ const OPS = {
 
 export function supports(operation, algorithm) {
     const a = normalizeAlg(algorithm);
-    return a ? OPS[a.kind].includes(operation) : false;
+    if (!a) return false;
+    if (a.ops) return a.ops.supports(operation);
+    return OPS[a.kind].includes(operation);
 }