visaljs 0.0.0-stage → 0.0.2

package/runtime/src/crypto_asym.c

@@ -0,0 +1,644 @@
+/* Asymmetric operations (ADR 0018) on the key record: RSA signatures (PKCS#1 v1.5 on BearSSL, PSS
+ * of our own so any hash works and a verifier can recover the salt length), ECDSA (BearSSL, DER
+ * or IEEE P1363 signatures), RSA encryption (OAEP on BearSSL; PKCS#1 v1.5's paddings and raw RSA
+ * ours), and key agreement (EC Diffie-Hellman and X25519), with point compression. The
+ * primitives at the end serve node:crypto; Web Crypto calls the functions above them. */
+#include <stdlib.h>
+#include <string.h>
+
+#include "builtins_util.h"
+#include "crypto_internal.h"
+#include "internal.h"
+#include "js_buffer.h"
+#include "js_crypto.h"
+#include "js_exception.h"
+#include "js_ops.h"
+#include "js_web.h"
+#include "jscontext.h"
+#include "jsstring.h"
+
+/* ---- Keys as BearSSL takes them ----------------------------------------------------------------- */
+
+static size_t bit_length(const JSKeyPart *n) {
+    size_t i = 0;
+    while (i < n->n && n->p[i] == 0) i++;
+    if (i == n->n) return 0;
+    size_t bits = (n->n - i - 1) * 8;
+    for (uint8_t top = n->p[i]; top; top >>= 1) bits++;
+    return bits;
+}
+
+static br_rsa_public_key rsa_pk(const JSKeyData *k) {
+    br_rsa_public_key pk = { k->part[JS_RSA_N].p, k->part[JS_RSA_N].n, k->part[JS_RSA_E].p, k->part[JS_RSA_E].n };
+    return pk;
+}
+
+static br_rsa_private_key rsa_sk(const JSKeyData *k) {
+    br_rsa_private_key sk = {
+        (uint32_t)bit_length(&k->part[JS_RSA_N]),
+        k->part[JS_RSA_P].p, k->part[JS_RSA_P].n, k->part[JS_RSA_Q].p, k->part[JS_RSA_Q].n,
+        k->part[JS_RSA_DP].p, k->part[JS_RSA_DP].n, k->part[JS_RSA_DQ].p, k->part[JS_RSA_DQ].n,
+        k->part[JS_RSA_QI].p, k->part[JS_RSA_QI].n,
+    };
+    return sk;
+}
+
+static size_t rsa_size(const JSKeyData *k) { return (bit_length(&k->part[JS_RSA_N]) + 7) / 8; }
+
+static bool is_rsa(const JSKeyData *k) { return k->kind == JS_ASYM_RSA || k->kind == JS_ASYM_RSA_PSS; }
+
+/* x ← x^e mod n, in place over the modulus's length */
+static bool rsa_public_op(const JSKeyData *k, uint8_t *x, size_t n) {
+    br_rsa_public_key pk = rsa_pk(k);
+    return br_rsa_public_get_default()(x, n, &pk) != 0;
+}
+
+/* x ← x^d mod n (CRT), in place */
+static bool rsa_private_op(const JSKeyData *k, uint8_t *x) {
+    br_rsa_private_key sk = rsa_sk(k);
+    return br_rsa_private_get_default()(x, &sk) != 0;
+}
+
+/* ---- MGF1 (RFC 8017 B.2.1) ---------------------------------------------------------------------- */
+
+static void mgf1_xor(const JSHashAlg *h, const uint8_t *seed, size_t seed_len, uint8_t *data, size_t n) {
+    uint8_t block[64];
+    for (uint32_t c = 0; n > 0; c++) {
+        uint8_t be[4] = { (uint8_t)(c >> 24), (uint8_t)(c >> 16), (uint8_t)(c >> 8), (uint8_t)c };
+        JSHashCtx ctx;
+        js_hash_init(&ctx, h);
+        js_hash_update(&ctx, seed, seed_len);
+        js_hash_update(&ctx, be, 4);
+        js_hash_final(&ctx, block, h->out_len);
+        size_t take = n < h->out_len ? n : h->out_len;
+        for (size_t i = 0; i < take; i++) data[i] ^= block[i];
+        data += take;
+        n -= take;
+    }
+}
+
+/* ---- Signatures --------------------------------------------------------------------------------- */
+
+/* EMSA-PSS-ENCODE, then the private operation: sig gets the modulus's length. */
+static int pss_sign(const JSKeyData *k, const JSHashAlg *h, const JSHashAlg *mgf, const uint8_t *mhash, long salt_len, uint8_t *sig) {
+    size_t mod_bits = bit_length(&k->part[JS_RSA_N]), em_bits = mod_bits - 1, em_len = (em_bits + 7) / 8, hlen = h->out_len;
+    size_t max_salt = em_len >= hlen + 2 ? em_len - hlen - 2 : 0;
+    size_t slen = salt_len == JS_SALT_DIGEST ? hlen : salt_len < 0 ? max_salt : (size_t)salt_len;
+    if (em_len < hlen + slen + 2) return JS_ASYM_ERR_TOO_LARGE;  /* as OpenSSL reports it */
+    uint8_t salt[1024], hh[64];
+    if (slen > sizeof salt) return JS_ASYM_ERR_TOO_LARGE;
+    js_crypto_random(salt, slen);
+    static const uint8_t zeros[8] = { 0 };
+    JSHashCtx ctx;
+    js_hash_init(&ctx, h);
+    js_hash_update(&ctx, zeros, 8);
+    js_hash_update(&ctx, mhash, hlen);
+    js_hash_update(&ctx, salt, slen);
+    js_hash_final(&ctx, hh, hlen);
+    size_t k_len = rsa_size(k), db_len = em_len - hlen - 1;
+    uint8_t *em = sig + (k_len - em_len);
+    memset(sig, 0, k_len);
+    em[db_len - slen - 1] = 0x01;
+    memcpy(em + db_len - slen, salt, slen);
+    mgf1_xor(mgf, hh, hlen, em, db_len);
+    em[0] &= (uint8_t)(0xFF >> (8 * em_len - em_bits));
+    memcpy(em + db_len, hh, hlen);
+    em[em_len - 1] = 0xBC;
+    return rsa_private_op(k, sig) ? 0 : JS_ASYM_ERR_FAILED;
+}
+
+/* EMSA-PSS-VERIFY after the public operation; salt_len JS_SALT_AUTO recovers it. */
+static bool pss_verify(const JSKeyData *k, const JSHashAlg *h, const JSHashAlg *mgf, const uint8_t *mhash, long salt_len,
+                       const uint8_t *sig, size_t sig_len) {
+    size_t k_len = rsa_size(k), mod_bits = bit_length(&k->part[JS_RSA_N]), em_bits = mod_bits - 1, em_len = (em_bits + 7) / 8;
+    size_t hlen = h->out_len;
+    if (sig_len != k_len || em_len < hlen + 2) return false;
+    uint8_t *x = malloc(k_len);
+    if (!x) js_fatal("out of memory in crypto");
+    memcpy(x, sig, k_len);
+    bool ok = rsa_public_op(k, x, k_len);
+    uint8_t *em = x + (k_len - em_len);
+    if (ok && k_len != em_len && x[0] != 0) ok = false;
+    if (ok && em[em_len - 1] != 0xBC) ok = false;
+    size_t db_len = em_len - hlen - 1;
+    if (ok && (em[0] & ~(0xFF >> (8 * em_len - em_bits)))) ok = false;
+    if (ok) {
+        uint8_t hh[64];
+        memcpy(hh, em + db_len, hlen);
+        mgf1_xor(mgf, hh, hlen, em, db_len);
+        em[0] &= (uint8_t)(0xFF >> (8 * em_len - em_bits));
+        size_t i = 0;
+        while (i < db_len && em[i] == 0) i++;
+        size_t slen = i < db_len ? db_len - i - 1 : 0;
+        if (i == db_len || em[i] != 0x01) ok = false;
+        else if (salt_len == JS_SALT_DIGEST && slen != hlen) ok = false;
+        else if (salt_len >= 0 && slen != (size_t)salt_len) ok = false;
+        if (ok) {
+            static const uint8_t zeros[8] = { 0 };
+            uint8_t h2[64];
+            JSHashCtx ctx;
+            js_hash_init(&ctx, h);
+            js_hash_update(&ctx, zeros, 8);
+            js_hash_update(&ctx, mhash, hlen);
+            js_hash_update(&ctx, em + i + 1, slen);
+            js_hash_final(&ctx, h2, hlen);
+            ok = js_crypto_equal(h2, hh, hlen);
+        }
+    }
+    free(x);
+    return ok;
+}
+
+/* BearSSL's class for a hash (ECDSA's nonce generation needs one), or NULL. */
+static const br_hash_class *bear_hash(const JSHashAlg *h) { return h->kind == JS_HASH_BEARSSL ? h->br : NULL; }
+
+static br_ec_public_key ec_pk(const JSKeyData *k) {
+    br_ec_public_key pk = { k->curve, k->part[JS_EC_PUB].p, k->part[JS_EC_PUB].n };
+    return pk;
+}
+
+int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
+                 JSBytesOut *out) {
+    if (k->type != JS_KEY_PRIVATE) return JS_ASYM_ERR_KEY_TYPE;
+    if (is_rsa(k)) {
+        size_t n = rsa_size(k);
+        uint8_t *sig = calloc(n, 1);
+        if (!sig) js_fatal("out of memory in crypto");
+        int err = 0;
+        if (k->kind == JS_ASYM_RSA_PSS || padding == JS_PADDING_PSS) {
+            const JSHashAlg *mgf = k->kind == JS_ASYM_RSA_PSS && k->pss_params ? k->pss_mgf1 : h;
+            err = pss_sign(k, h, mgf, digest, salt_len, sig);
+        } else {
+            br_rsa_private_key sk = rsa_sk(k);
+            const unsigned char *oid = h->oid;
+            if (!oid && strcmp(h->name, "md5-sha1") != 0) err = JS_ASYM_ERR_DIGEST;
+            else if (!br_rsa_pkcs1_sign_get_default()(oid, digest, h->out_len, &sk, sig)) err = JS_ASYM_ERR_FAILED;
+        }
+        if (!err) {
+            out->p = sig;
+            out->n = out->cap = n;
+        } else {
+            free(sig);
+        }
+        return err;
+    }
+    if (k->kind != JS_ASYM_EC) return JS_ASYM_ERR_KEY_TYPE;
+    const br_hash_class *hf = bear_hash(h);
+    if (!hf) return JS_ASYM_ERR_DIGEST;
+    uint8_t scalar[66];
+    js_ec_scalar_for_bearssl(k, scalar);
+    br_ec_private_key sk = { k->curve, scalar, k->part[JS_EC_PRIV].n };
+    out->p = malloc(160);
+    if (!out->p) js_fatal("out of memory in crypto");
+    size_t n = (p1363 ? br_ecdsa_sign_raw_get_default() : br_ecdsa_sign_asn1_get_default())(br_ec_get_default(), hf, digest, &sk, out->p);
+    out->n = out->cap = n;
+    return n ? 0 : JS_ASYM_ERR_FAILED;
+}
+
+int js_asym_verify(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
+                   const uint8_t *sig, size_t sig_len, bool *valid) {
+    *valid = false;
+    if (k->type == JS_KEY_SECRET) return JS_ASYM_ERR_KEY_TYPE;
+    if (is_rsa(k)) {
+        if (k->kind == JS_ASYM_RSA_PSS || padding == JS_PADDING_PSS) {
+            const JSHashAlg *mgf = k->kind == JS_ASYM_RSA_PSS && k->pss_params ? k->pss_mgf1 : h;
+            *valid = pss_verify(k, h, mgf, digest, salt_len, sig, sig_len);
+            return 0;
+        }
+        if (!h->oid && strcmp(h->name, "md5-sha1") != 0) return JS_ASYM_ERR_DIGEST;
+        if (sig_len != rsa_size(k)) return 0;
+        br_rsa_public_key pk = rsa_pk(k);
+        uint8_t got[64];
+        *valid = br_rsa_pkcs1_vrfy_get_default()(sig, sig_len, h->oid, h->out_len, &pk, got) && js_crypto_equal(got, digest, h->out_len);
+        return 0;
+    }
+    if (k->kind != JS_ASYM_EC) return JS_ASYM_ERR_KEY_TYPE;
+    br_ec_public_key pk = ec_pk(k);
+    *valid = (p1363 ? br_ecdsa_vrfy_raw_get_default() : br_ecdsa_vrfy_asn1_get_default())(br_ec_get_default(), digest, h->out_len, &pk,
+                                                                                          sig, sig_len) != 0;
+    return 0;
+}
+
+/* ---- RSA encryption ----------------------------------------------------------------------------- */
+
+int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_hash, const uint8_t *label, size_t label_len,
+                 const uint8_t *in, size_t n, JSBytesOut *out) {
+    if (!is_rsa(k)) return JS_ASYM_ERR_KEY_TYPE;
+    bool private_op = op == JS_RSA_PRIVATE_DECRYPT || op == JS_RSA_PRIVATE_ENCRYPT;
+    if (private_op && k->type != JS_KEY_PRIVATE) return JS_ASYM_ERR_KEY_TYPE;
+    size_t kl = rsa_size(k);
+    uint8_t *x = calloc(kl, 1);
+    if (!x) js_fatal("out of memory in crypto");
+    int err = 0;
+    size_t out_len = kl;
+    if (op == JS_RSA_PUBLIC_ENCRYPT && padding == JS_PADDING_OAEP) {
+        if (!bear_hash(oaep_hash)) err = JS_ASYM_ERR_DIGEST;
+        else {
+            br_rsa_public_key pk = rsa_pk(k);
+            out_len = br_rsa_oaep_encrypt_get_default()(js_crypto_prng(), bear_hash(oaep_hash), label, label_len, &pk, x, kl, in, n);
+            if (!out_len) err = JS_ASYM_ERR_TOO_LARGE;
+        }
+    } else if (op == JS_RSA_PRIVATE_DECRYPT && padding == JS_PADDING_OAEP) {
+        if (!bear_hash(oaep_hash)) err = JS_ASYM_ERR_DIGEST;
+        else if (n != kl) err = JS_ASYM_ERR_OAEP;
+        else {
+            br_rsa_private_key sk = rsa_sk(k);
+            memcpy(x, in, n);
+            out_len = n;
+            if (!br_rsa_oaep_decrypt_get_default()(bear_hash(oaep_hash), label, label_len, &sk, x, &out_len)) err = JS_ASYM_ERR_OAEP;
+        }
+    } else if (op == JS_RSA_PUBLIC_ENCRYPT || op == JS_RSA_PRIVATE_ENCRYPT) {
+        if (padding == JS_PADDING_NONE) {
+            if (n > kl) err = JS_ASYM_ERR_TOO_LARGE;
+            else if (n < kl) err = JS_ASYM_ERR_TOO_SMALL;
+            else memcpy(x, in, n);
+        } else if (padding != JS_PADDING_PKCS1) {
+            err = JS_ASYM_ERR_PADDING;
+        } else if (n + 11 > kl) {
+            err = JS_ASYM_ERR_TOO_LARGE;
+        } else {  /* EME-PKCS1-v1_5 (00 02 random 00 M) or the signature form (00 01 FF… 00 M) */
+            size_t ps = kl - n - 3;
+            x[1] = op == JS_RSA_PUBLIC_ENCRYPT ? 2 : 1;
+            if (op == JS_RSA_PUBLIC_ENCRYPT) {
+                js_crypto_random(x + 2, ps);
+                for (size_t i = 0; i < ps; i++)
+                    while (x[2 + i] == 0) js_crypto_random(x + 2 + i, 1);
+            } else {
+                memset(x + 2, 0xFF, ps);
+            }
+            memcpy(x + 3 + ps, in, n);
+        }
+        if (!err && !(op == JS_RSA_PUBLIC_ENCRYPT ? rsa_public_op(k, x, kl) : rsa_private_op(k, x))) err = JS_ASYM_ERR_TOO_LARGE;
+    } else {  /* privateDecrypt or publicDecrypt without OAEP */
+        if (n > kl) err = JS_ASYM_ERR_TOO_LARGE;
+        else if (n < kl && padding == JS_PADDING_NONE) err = JS_ASYM_ERR_TOO_SMALL;
+        else {
+            memcpy(x + kl - n, in, n);
+            if (!(op == JS_RSA_PRIVATE_DECRYPT ? rsa_private_op(k, x) : rsa_public_op(k, x, kl))) err = JS_ASYM_ERR_TOO_LARGE;
+        }
+        if (!err && padding == JS_PADDING_PKCS1) {
+            uint8_t type = op == JS_RSA_PRIVATE_DECRYPT ? 2 : 1;
+            size_t i = 2;
+            if (x[0] != 0 || x[1] != type) err = JS_ASYM_ERR_PADDING;
+            while (!err && i < kl && x[i] != 0) {
+                if (type == 1 && x[i] != 0xFF) err = JS_ASYM_ERR_PADDING;
+                i++;
+            }
+            if (!err && (i == kl || i < 10)) err = JS_ASYM_ERR_PADDING;
+            if (!err) {
+                out_len = kl - i - 1;
+                memmove(x, x + i + 1, out_len);
+            }
+        } else if (!err && padding != JS_PADDING_NONE) {
+            err = JS_ASYM_ERR_PADDING;
+        }
+    }
+    if (err) {
+        free(x);
+        return err;
+    }
+    out->p = x;
+    out->n = out_len;
+    out->cap = kl;
+    return 0;
+}
+
+/* ---- Points ------------------------------------------------------------------------------------- */
+
+/* Little fixed-size integers for decompressing points: y = sqrt(x^3 - 3x + b) mod p, which is
+ * (x^3 - 3x + b)^((p + 1) / 4) as p ≡ 3 (mod 4) on all three curves. 32-bit limbs, little-endian. */
+#define LIMBS 17  /* 544 bits: P-521's field */
+
+typedef struct { uint32_t w[LIMBS]; } Big;
+
+static void big_from_bytes(Big *a, const uint8_t *p, size_t n) {
+    memset(a, 0, sizeof *a);
+    for (size_t i = 0; i < n; i++) a->w[i / 4] |= (uint32_t)p[n - 1 - i] << (8 * (i % 4));
+}
+
+static void big_to_bytes(const Big *a, uint8_t *p, size_t n) {
+    for (size_t i = 0; i < n; i++) p[n - 1 - i] = (uint8_t)(a->w[i / 4] >> (8 * (i % 4)));
+}
+
+static int big_cmp(const Big *a, const Big *b) {
+    for (int i = LIMBS - 1; i >= 0; i--)
+        if (a->w[i] != b->w[i]) return a->w[i] < b->w[i] ? -1 : 1;
+    return 0;
+}
+
+static void big_sub(Big *a, const Big *b) {
+    uint64_t borrow = 0;
+    for (int i = 0; i < LIMBS; i++) {
+        uint64_t d = (uint64_t)a->w[i] - b->w[i] - borrow;
+        a->w[i] = (uint32_t)d;
+        borrow = (d >> 32) & 1;
+    }
+}
+
+/* r = a * b mod m, by schoolbook multiplication and bitwise reduction */
+static void big_mulmod(Big *r, const Big *a, const Big *b, const Big *m) {
+    uint32_t t[2 * LIMBS] = { 0 };
+    for (int i = 0; i < LIMBS; i++) {
+        uint64_t carry = 0;
+        for (int j = 0; j < LIMBS; j++) {
+            uint64_t v = (uint64_t)a->w[i] * b->w[j] + t[i + j] + carry;
+            t[i + j] = (uint32_t)v;
+            carry = v >> 32;
+        }
+        t[i + LIMBS] = (uint32_t)carry;
+    }
+    Big acc = { { 0 } };
+    for (int bit = 2 * LIMBS * 32 - 1; bit >= 0; bit--) {
+        uint32_t top = acc.w[LIMBS - 1] >> 31;
+        for (int i = LIMBS - 1; i > 0; i--) acc.w[i] = acc.w[i] << 1 | acc.w[i - 1] >> 31;
+        acc.w[0] = acc.w[0] << 1 | ((t[bit / 32] >> (bit % 32)) & 1);
+        if (top || big_cmp(&acc, m) >= 0) big_sub(&acc, m);
+    }
+    *r = acc;
+}
+
+static void big_powmod(Big *r, const Big *a, const Big *e, const Big *m) {
+    Big acc = { { 1 } };
+    for (int bit = LIMBS * 32 - 1; bit >= 0; bit--) {
+        big_mulmod(&acc, &acc, &acc, m);
+        if ((e->w[bit / 32] >> (bit % 32)) & 1) big_mulmod(&acc, &acc, a, m);
+    }
+    *r = acc;
+}
+
+static const struct {
+    int            curve;
+    const char    *name;
+    size_t         size;
+    const char    *p, *b;  /* hex */
+} FIELDS[] = {
+    { BR_EC_secp256r1, "prime256v1", 32, "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
+      "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b" },
+    { BR_EC_secp384r1, "secp384r1", 48,
+      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff",
+      "b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef" },
+    { BR_EC_secp521r1, "secp521r1", 66,
+      "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00" },
+};
+
+static void hex_bytes(const char *hex, uint8_t *out, size_t n) {
+    for (size_t i = 0; i < n; i++) {
+        unsigned v = 0;
+        for (int k = 0; k < 2; k++) {
+            char c = hex[2 * i + k];
+            v = v << 4 | (unsigned)(c <= '9' ? c - '0' : c - 'a' + 10);
+        }
+        out[i] = (uint8_t)v;
+    }
+}
+
+int js_ec_curve_by_name(const char *name) {
+    for (size_t i = 0; i < JS_COUNTOF(FIELDS); i++)
+        if (strcmp(name, FIELDS[i].name) == 0) return FIELDS[i].curve;
+    return -1;
+}
+
+size_t js_ec_field_size(int curve) {
+    for (size_t i = 0; i < JS_COUNTOF(FIELDS); i++)
+        if (FIELDS[i].curve == curve) return FIELDS[i].size;
+    return curve == BR_EC_curve25519 ? 32 : 0;
+}
+
+/* Any encoding of a point (uncompressed 04, compressed 02/03, hybrid 06/07) as uncompressed;
+ * false when it isn't one (decompression checks the curve; BearSSL checks the rest). */
+bool js_ec_point_uncompressed(int curve, const uint8_t *in, size_t n, uint8_t *out) {
+    size_t fs = js_ec_field_size(curve), i = 0;
+    while (i < JS_COUNTOF(FIELDS) && FIELDS[i].curve != curve) i++;
+    if (!fs || i == JS_COUNTOF(FIELDS) || n == 0) return false;
+    if ((in[0] == 4 || in[0] == 6 || in[0] == 7) && n == 1 + 2 * fs) {
+        if (in[0] != 4 && (in[n - 1] & 1) != (in[0] & 1)) return false;
+        memcpy(out, in, n);
+        out[0] = 4;
+        return true;
+    }
+    if ((in[0] != 2 && in[0] != 3) || n != 1 + fs) return false;
+    uint8_t buf[66];
+    Big p, x, rhs, t, three, e;
+    hex_bytes(FIELDS[i].p, buf, fs);
+    big_from_bytes(&p, buf, fs);
+    big_from_bytes(&x, in + 1, fs);
+    if (big_cmp(&x, &p) >= 0) return false;
+    big_mulmod(&t, &x, &x, &p);
+    big_mulmod(&rhs, &t, &x, &p);  /* x^3 */
+    memset(&three, 0, sizeof three);
+    three.w[0] = 3;
+    big_mulmod(&t, &x, &three, &p);  /* 3x */
+    if (big_cmp(&rhs, &t) < 0) {  /* rhs - 3x, mod p */
+        Big s = p;
+        big_sub(&s, &t);
+        t = s;
+        uint64_t carry = 0;
+        for (int w = 0; w < LIMBS; w++) {
+            uint64_t v = (uint64_t)rhs.w[w] + t.w[w] + carry;
+            rhs.w[w] = (uint32_t)v;
+            carry = v >> 32;
+        }
+        if (big_cmp(&rhs, &p) >= 0) big_sub(&rhs, &p);
+    } else {
+        big_sub(&rhs, &t);
+    }
+    Big b;
+    hex_bytes(FIELDS[i].b, buf, fs);
+    big_from_bytes(&b, buf, fs);
+    uint64_t carry = 0;
+    for (int w = 0; w < LIMBS; w++) {
+        uint64_t v = (uint64_t)rhs.w[w] + b.w[w] + carry;
+        rhs.w[w] = (uint32_t)v;
+        carry = v >> 32;
+    }
+    if (big_cmp(&rhs, &p) >= 0) big_sub(&rhs, &p);
+    e = p;  /* (p + 1) / 4 */
+    for (int w = 0, c = 1; w < LIMBS && c; w++) c = ++e.w[w] == 0;
+    for (int w = 0; w < LIMBS; w++) e.w[w] = e.w[w] >> 2 | (w + 1 < LIMBS ? e.w[w + 1] << 30 : 0);
+    Big y, check;
+    big_powmod(&y, &rhs, &e, &p);
+    big_mulmod(&check, &y, &y, &p);
+    if (big_cmp(&check, &rhs) != 0) return false;  /* not on the curve */
+    if ((y.w[0] & 1) != (in[0] & 1u)) {
+        Big ny = p;
+        big_sub(&ny, &y);
+        y = ny;
+    }
+    out[0] = 4;
+    memcpy(out + 1, in + 1, fs);
+    big_to_bytes(&y, out + 1 + fs, fs);
+    return true;
+}
+
+/* An uncompressed point in a format: 4 uncompressed, 2 compressed, 6 hybrid (Node's constants). */
+size_t js_ec_point_format(int curve, const uint8_t *point, int format, uint8_t *out) {
+    size_t fs = js_ec_field_size(curve);
+    uint8_t odd = point[2 * fs] & 1;
+    if (format == 2) {
+        out[0] = (uint8_t)(2 | odd);
+        memcpy(out + 1, point + 1, fs);
+        return 1 + fs;
+    }
+    memcpy(out, point, 1 + 2 * fs);
+    if (format == 6) out[0] = (uint8_t)(6 | odd);
+    return 1 + 2 * fs;
+}
+
+/* The shared secret of a private key and a peer's public point (EC: the x coordinate; X25519:
+ * the u coordinate). 0, or JS_ASYM_ERR_POINT. */
+int js_ecdh(const JSKeyData *k, const uint8_t *peer, size_t peer_len, uint8_t *secret, size_t *secret_len) {
+    uint8_t g[133], scalar[66];
+    size_t glen;
+    if (k->curve == BR_EC_curve25519) {
+        if (peer_len != 32) return JS_ASYM_ERR_POINT;
+        memcpy(g, peer, 32);
+        glen = 32;
+    } else {
+        if (!js_ec_point_uncompressed(k->curve, peer, peer_len, g)) return JS_ASYM_ERR_POINT;
+        glen = 1 + 2 * js_ec_field_size(k->curve);
+    }
+    js_ec_scalar_for_bearssl(k, scalar);
+    if (!br_ec_get_default()->mul(g, glen, scalar, k->part[JS_EC_PRIV].n, k->curve)) return JS_ASYM_ERR_POINT;
+    if (k->curve == BR_EC_curve25519) {
+        uint8_t zero = 0;
+        for (int i = 0; i < 32; i++) zero |= g[i];
+        if (!zero) return JS_ASYM_ERR_POINT;  /* a small-order point, as OpenSSL rejects it */
+        memcpy(secret, g, 32);
+        *secret_len = 32;
+    } else {
+        size_t fs = js_ec_field_size(k->curve);
+        memcpy(secret, g + 1, fs);
+        *secret_len = fs;
+    }
+    return 0;
+}
+
+/* ---- node:crypto's primitives ------------------------------------------------------------------- */
+
+#define PRIMITIVE(fn) \
+    JSValue fn(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target)
+#define UNUSED_PRIMITIVE_ARGS (void)callee, (void)this_val, (void)new_target
+
+static const JSHashAlg *hash_arg(JSContext *ctx, JSValue v) {
+    char name[64];
+    if (!js_is_string(v)) return NULL;
+    size_t n = js_view_to_utf8(js_string_view(ctx, v), name, sizeof name - 1);
+    if (n >= sizeof name - 1) return NULL;
+    name[n] = 0;
+    return js_hash_by_name(name);
+}
+
+static JSValue result(JSContext *ctx, int err, JSBytesOut *out) {
+    JSValue r = err ? js_int32(err) : js_new_buffer_from_bytes(ctx, out->p, out->n);
+    free(out->p);
+    return r;
+}
+
+static long num_or(JSValue v, long dflt) { return js_is_number(v) ? (long)js_as_number(v) : dflt; }
+
+/* cryptoSign(key, hash, digest, padding, saltLength, p1363): a Buffer, or an error code. */
+PRIMITIVE(js_crypto_sign) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0));
+    const JSHashAlg *h = hash_arg(ctx, ARG(1));
+    uint8_t *d;
+    size_t dn;
+    if (!k || !js_buffer_source_bytes(ARG(2), &d, &dn)) return js_throw_type_error(ctx, "cryptoSign: bad arguments");
+    if (!h || h->xof || dn != h->out_len) return js_int32(JS_ASYM_ERR_DIGEST);
+    JSBytesOut out = { 0 };
+    return result(ctx, js_asym_sign(k, h, d, (int)num_or(ARG(3), JS_PADDING_PKCS1), num_or(ARG(4), JS_SALT_MAX), js_truthy(ARG(5)), &out), &out);
+}
+
+/* cryptoVerify(key, hash, digest, signature, padding, saltLength, p1363): a boolean, or an error code. */
+PRIMITIVE(js_crypto_verify) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0));
+    const JSHashAlg *h = hash_arg(ctx, ARG(1));
+    uint8_t *d, *sig;
+    size_t dn, sn;
+    if (!k || !js_buffer_source_bytes(ARG(2), &d, &dn) || !js_buffer_source_bytes(ARG(3), &sig, &sn))
+        return js_throw_type_error(ctx, "cryptoVerify: bad arguments");
+    if (!h || h->xof || dn != h->out_len) return js_int32(JS_ASYM_ERR_DIGEST);
+    bool valid;
+    int err = js_asym_verify(k, h, d, (int)num_or(ARG(4), JS_PADDING_PKCS1), num_or(ARG(5), JS_SALT_AUTO), js_truthy(ARG(6)), sig, sn, &valid);
+    return err ? js_int32(err) : js_bool(valid);
+}
+
+/* cryptoRsaCrypt(key, op, data, padding, oaepHash, oaepLabel): a Buffer, or an error code.
+ * op: 0 publicEncrypt, 1 privateDecrypt, 2 privateEncrypt, 3 publicDecrypt. */
+PRIMITIVE(js_crypto_rsa_crypt) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0));
+    uint8_t *in, *label = NULL;
+    size_t n, label_len = 0;
+    if (!k || !js_is_number(ARG(1)) || !js_buffer_source_bytes(ARG(2), &in, &n)) return js_throw_type_error(ctx, "cryptoRsaCrypt: bad arguments");
+    const JSHashAlg *h = js_is_undefined(ARG(4)) ? js_hash_by_name("sha1") : hash_arg(ctx, ARG(4));
+    if (!h) return js_int32(JS_ASYM_ERR_DIGEST);
+    if (!js_is_undefined(ARG(5))) js_buffer_source_bytes(ARG(5), &label, &label_len);
+    JSBytesOut out = { 0 };
+    return result(ctx, js_rsa_crypt(k, (int)js_as_number(ARG(1)), (int)num_or(ARG(3), JS_PADDING_OAEP), h, label, label_len, in, n, &out), &out);
+}
+
+/* cryptoEcdh(private key, peer public point or key): the shared secret, or an error code. */
+PRIMITIVE(js_crypto_ecdh) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0)), *peer = js_key_data(ARG(1));
+    uint8_t *p;
+    size_t n;
+    if (!k) return js_throw_type_error(ctx, "cryptoEcdh: bad arguments");
+    if (peer) p = peer->part[JS_EC_PUB].p, n = peer->part[JS_EC_PUB].n;
+    else if (!js_buffer_source_bytes(ARG(1), &p, &n)) return js_throw_type_error(ctx, "cryptoEcdh: bad arguments");
+    uint8_t secret[66];
+    size_t sn;
+    int err = js_ecdh(k, p, n, secret, &sn);
+    return err ? js_int32(err) : js_new_buffer_from_bytes(ctx, secret, sn);
+}
+
+/* cryptoEcPoint(curve, point, format): the point in a format (4, 2 or 6), or an error code. */
+PRIMITIVE(js_crypto_ec_point) {
+    UNUSED_PRIMITIVE_ARGS;
+    char name[24] = "";
+    uint8_t *p;
+    size_t n;
+    if (!js_is_string(ARG(0)) || !js_buffer_source_bytes(ARG(1), &p, &n)) return js_throw_type_error(ctx, "cryptoEcPoint: bad arguments");
+    js_view_to_utf8(js_string_view(ctx, ARG(0)), name, sizeof name - 1);
+    int curve = js_ec_curve_by_name(name);
+    if (curve < 0) return js_int32(JS_ASYM_ERR_CURVE);
+    uint8_t point[133], out[133];
+    if (!js_ec_point_uncompressed(curve, p, n, point)) return js_int32(JS_ASYM_ERR_POINT);
+    br_ec_public_key pk = { curve, point, 1 + 2 * js_ec_field_size(curve) };
+    /* on the curve: BearSSL's multiplication checks it */
+    uint8_t one[66] = { 0 }, copy[133];
+    one[js_ec_field_size(curve) - 1] = 1;
+    memcpy(copy, pk.q, pk.qlen);
+    if (!br_ec_get_default()->mul(copy, pk.qlen, one, js_ec_field_size(curve), curve)) return js_int32(JS_ASYM_ERR_POINT);
+    size_t on = js_ec_point_format(curve, point, (int)num_or(ARG(2), 4), out);
+    return js_new_buffer_from_bytes(ctx, out, on);
+}
+
+/* cryptoEcPrivate(curve, scalar): an EC private key handle, or an error code. */
+PRIMITIVE(js_crypto_ec_private) {
+    UNUSED_PRIMITIVE_ARGS;
+    char name[24] = "";
+    uint8_t *p;
+    size_t n;
+    if (!js_is_string(ARG(0)) || !js_buffer_source_bytes(ARG(1), &p, &n)) return js_throw_type_error(ctx, "cryptoEcPrivate: bad arguments");
+    js_view_to_utf8(js_string_view(ctx, ARG(0)), name, sizeof name - 1);
+    int curve = js_ec_curve_by_name(name);
+    if (curve < 0) return js_int32(JS_ASYM_ERR_CURVE);
+    size_t fs = js_ec_field_size(curve);
+    while (n > fs && p[0] == 0) p++, n--;
+    if (n > fs) return js_int32(JS_ASYM_ERR_POINT);
+    JSKeyData *k = js_new_asym_key(ctx, JS_KEY_PRIVATE, JS_ASYM_EC);
+    k->curve = curve;
+    uint8_t buf[66] = { 0 };
+    memcpy(buf + fs - n, p, n);
+    js_key_part_set(&k->part[JS_EC_PRIV], buf, fs);
+    uint8_t pub[BR_EC_KBUF_PUB_MAX_SIZE];
+    br_ec_private_key sk = { curve, buf, fs };
+    br_ec_public_key pk;
+    if (!br_ec_compute_pub(br_ec_get_default(), &pk, pub, &sk)) return js_int32(JS_ASYM_ERR_POINT);
+    js_key_part_set(&k->part[JS_EC_PUB], pk.q, pk.qlen);
+    return js_object_value(&k->obj);
+}