visaljs 0.0.0-stage → 0.0.2

package/runtime/src/crypto_hash.c

@@ -0,0 +1,260 @@
+/* The crypto primitives' hashes, HMAC and random bytes (ADR 0018): BearSSL's MD5, SHA-1 and
+ * SHA-2, SHA-512/224 and /256 on BearSSL's SHA-512 with their own IVs, and SHA-3 and SHAKE on
+ * a Keccak-f[1600] of our own (BearSSL's is private to its SHAKE). HMAC is generic over them. */
+#include <ctype.h>
+#include <string.h>
+
+#include "crypto_internal.h"
+#include "js_builtins.h"
+#include "js_exception.h"
+
+/* ---- Keccak (FIPS 202) ------------------------------------------------------------------------ */
+
+static const uint64_t KECCAK_RC[24] = {
+    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808AULL, 0x8000000080008000ULL,
+    0x000000000000808BULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL,
+    0x000000000000008AULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000AULL,
+    0x000000008000808BULL, 0x800000000000008BULL, 0x8000000000008089ULL, 0x8000000000008003ULL,
+    0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800AULL, 0x800000008000000AULL,
+    0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
+};
+static const unsigned KECCAK_ROT[25] = { 0, 1, 62, 28, 27, 36, 44, 6, 55, 20, 3, 10, 43, 25, 39, 41, 45, 15, 21, 8, 18, 2, 61, 56, 14 };
+
+static inline uint64_t rotl64(uint64_t x, unsigned n) { return n ? (x << n) | (x >> (64 - n)) : x; }
+
+static void keccak_f(uint64_t a[25]) {
+    for (int round = 0; round < 24; round++) {
+        uint64_t c[5], d[5], b[25];
+        for (int x = 0; x < 5; x++) c[x] = a[x] ^ a[x + 5] ^ a[x + 10] ^ a[x + 15] ^ a[x + 20];
+        for (int x = 0; x < 5; x++) d[x] = c[(x + 4) % 5] ^ rotl64(c[(x + 1) % 5], 1);
+        for (int i = 0; i < 25; i++) a[i] ^= d[i % 5];
+        /* rho and pi: B[y, 2x + 3y] = rot(A[x, y]) */
+        for (int x = 0; x < 5; x++)
+            for (int y = 0; y < 5; y++) b[y + 5 * ((2 * x + 3 * y) % 5)] = rotl64(a[x + 5 * y], KECCAK_ROT[x + 5 * y]);
+        for (int y = 0; y < 5; y++)
+            for (int x = 0; x < 5; x++) a[x + 5 * y] = b[x + 5 * y] ^ (~b[(x + 1) % 5 + 5 * y] & b[(x + 2) % 5 + 5 * y]);
+        a[0] ^= KECCAK_RC[round];
+    }
+}
+
+static void keccak_xor_byte(JSKeccak *k, uint32_t i, uint8_t b) { k->a[i / 8] ^= (uint64_t)b << (8 * (i % 8)); }
+
+static void keccak_absorb(JSKeccak *k, const uint8_t *p, size_t n) {
+    while (n--) {
+        keccak_xor_byte(k, k->pos++, *p++);
+        if (k->pos == k->rate) {
+            keccak_f(k->a);
+            k->pos = 0;
+        }
+    }
+}
+
+static void keccak_squeeze(JSKeccak *k, uint8_t suffix, uint8_t *out, size_t n) {
+    if (!k->squeezing) {
+        keccak_xor_byte(k, k->pos, suffix);
+        keccak_xor_byte(k, k->rate - 1, 0x80);
+        keccak_f(k->a);
+        k->pos = 0;
+        k->squeezing = true;
+    }
+    while (n--) {
+        if (k->pos == k->rate) {
+            keccak_f(k->a);
+            k->pos = 0;
+        }
+        *out++ = (uint8_t)(k->a[k->pos / 8] >> (8 * (k->pos % 8)));
+        k->pos++;
+    }
+}
+
+/* ---- The algorithms ---------------------------------------------------------------------------- */
+
+static const uint64_t SHA512_224_IV[8] = {
+    0x8C3D37C819544DA2ULL, 0x73E1996689DCD4D6ULL, 0x1DFAB7AE32FF9C82ULL, 0x679DD514582F9FCFULL,
+    0x0F6D2B697BD44DA8ULL, 0x77E36F7304C48942ULL, 0x3F9D85A86A1D36C8ULL, 0x1112E6AD91D692A1ULL,
+};
+static const uint64_t SHA512_256_IV[8] = {
+    0x22312194FC2BF72CULL, 0x9F555FA3C84C64C2ULL, 0x2393B86B6F53B151ULL, 0x963877195940EABDULL,
+    0x96283EE2A88EFFE3ULL, 0xBE5E1E2553863992ULL, 0x2B0199FC2C85B8AAULL, 0x0EB72DDC81C52CA2ULL,
+};
+
+/* OIDs as BearSSL's PKCS#1 code takes them: the length, then the OID's bytes */
+static const unsigned char OID_MD5[] = { 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05 };
+static const unsigned char OID_SHA1[] = { 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A };
+#define NIST_HASH_OID(last) { 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, (last) }
+static const unsigned char OID_SHA256[] = NIST_HASH_OID(0x01);
+static const unsigned char OID_SHA384[] = NIST_HASH_OID(0x02);
+static const unsigned char OID_SHA512[] = NIST_HASH_OID(0x03);
+static const unsigned char OID_SHA224[] = NIST_HASH_OID(0x04);
+static const unsigned char OID_SHA512_224[] = NIST_HASH_OID(0x05);
+static const unsigned char OID_SHA512_256[] = NIST_HASH_OID(0x06);
+static const unsigned char OID_SHA3_224[] = NIST_HASH_OID(0x07);
+static const unsigned char OID_SHA3_256[] = NIST_HASH_OID(0x08);
+static const unsigned char OID_SHA3_384[] = NIST_HASH_OID(0x09);
+static const unsigned char OID_SHA3_512[] = NIST_HASH_OID(0x0A);
+
+#define BR(name, web, len, block, cls, oid) { name, web, JS_HASH_BEARSSL, false, len, block, &cls, NULL, 0, oid }
+#define SHA512T(name, len, iv, oid) { name, NULL, JS_HASH_SHA512T, false, len, 128, &br_sha512_vtable, iv, 0, oid }
+#define KECCAK(name, xof, len, rate, suffix, oid) { name, NULL, JS_HASH_KECCAK, xof, len, rate, NULL, NULL, suffix, oid }
+
+static const JSHashAlg ALGS[] = {
+    BR("md5", NULL, 16, 64, br_md5_vtable, OID_MD5),
+    BR("sha1", "SHA-1", 20, 64, br_sha1_vtable, OID_SHA1),
+    BR("sha224", NULL, 28, 64, br_sha224_vtable, OID_SHA224),
+    BR("sha256", "SHA-256", 32, 64, br_sha256_vtable, OID_SHA256),
+    BR("sha384", "SHA-384", 48, 128, br_sha384_vtable, OID_SHA384),
+    BR("sha512", "SHA-512", 64, 128, br_sha512_vtable, OID_SHA512),
+    BR("md5-sha1", NULL, 36, 64, br_md5sha1_vtable, NULL),
+    SHA512T("sha512-224", 28, SHA512_224_IV, OID_SHA512_224),
+    SHA512T("sha512-256", 32, SHA512_256_IV, OID_SHA512_256),
+    KECCAK("sha3-224", false, 28, 144, 0x06, OID_SHA3_224),
+    KECCAK("sha3-256", false, 32, 136, 0x06, OID_SHA3_256),
+    KECCAK("sha3-384", false, 48, 104, 0x06, OID_SHA3_384),
+    KECCAK("sha3-512", false, 64, 72, 0x06, OID_SHA3_512),
+    KECCAK("shake128", true, 16, 168, 0x1F, NULL),
+    KECCAK("shake256", true, 32, 136, 0x1F, NULL),
+};
+
+enum { MD5, SHA1, SHA224, SHA256, SHA384, SHA512, MD5SHA1, SHA512_224, SHA512_256, SHA3_224, SHA3_256, SHA3_384, SHA3_512, SHAKE128, SHAKE256 };
+
+/* Every name OpenSSL takes for them (its EVP names, its aliases, its fetch names) */
+static const struct { const char *name; uint8_t alg; } NAMES[] = {
+    { "md5", MD5 }, { "rsa-md5", MD5 }, { "md5withrsaencryption", MD5 }, { "ssl3-md5", MD5 },
+    { "sha1", SHA1 }, { "sha-1", SHA1 }, { "rsa-sha1", SHA1 }, { "rsa-sha1-2", SHA1 }, { "sha1withrsaencryption", SHA1 }, { "ssl3-sha1", SHA1 },
+    { "sha224", SHA224 }, { "sha-224", SHA224 }, { "sha2-224", SHA224 }, { "rsa-sha224", SHA224 }, { "sha224withrsaencryption", SHA224 },
+    { "sha256", SHA256 }, { "sha-256", SHA256 }, { "sha2-256", SHA256 }, { "rsa-sha256", SHA256 }, { "sha256withrsaencryption", SHA256 },
+    { "sha384", SHA384 }, { "sha-384", SHA384 }, { "sha2-384", SHA384 }, { "rsa-sha384", SHA384 }, { "sha384withrsaencryption", SHA384 },
+    { "sha512", SHA512 }, { "sha-512", SHA512 }, { "sha2-512", SHA512 }, { "rsa-sha512", SHA512 }, { "sha512withrsaencryption", SHA512 },
+    { "md5-sha1", MD5SHA1 },
+    { "sha512-224", SHA512_224 }, { "sha-512/224", SHA512_224 }, { "sha2-512/224", SHA512_224 },
+    { "rsa-sha512/224", SHA512_224 }, { "sha512-224withrsaencryption", SHA512_224 },
+    { "sha512-256", SHA512_256 }, { "sha-512/256", SHA512_256 }, { "sha2-512/256", SHA512_256 },
+    { "rsa-sha512/256", SHA512_256 }, { "sha512-256withrsaencryption", SHA512_256 },
+    { "sha3-224", SHA3_224 }, { "rsa-sha3-224", SHA3_224 }, { "id-rsassa-pkcs1-v1_5-with-sha3-224", SHA3_224 },
+    { "sha3-256", SHA3_256 }, { "rsa-sha3-256", SHA3_256 }, { "id-rsassa-pkcs1-v1_5-with-sha3-256", SHA3_256 },
+    { "sha3-384", SHA3_384 }, { "rsa-sha3-384", SHA3_384 }, { "id-rsassa-pkcs1-v1_5-with-sha3-384", SHA3_384 },
+    { "sha3-512", SHA3_512 }, { "rsa-sha3-512", SHA3_512 }, { "id-rsassa-pkcs1-v1_5-with-sha3-512", SHA3_512 },
+    { "shake128", SHAKE128 }, { "shake-128", SHAKE128 }, { "shake256", SHAKE256 }, { "shake-256", SHAKE256 },
+};
+
+/* crypto.getHashes(): Node's list, less the hashes BearSSL doesn't have (RIPEMD-160, BLAKE2, SM3) */
+const char *const js_hash_names[] = {
+    "RSA-MD5", "RSA-SHA1", "RSA-SHA1-2", "RSA-SHA224", "RSA-SHA256", "RSA-SHA3-224", "RSA-SHA3-256", "RSA-SHA3-384",
+    "RSA-SHA3-512", "RSA-SHA384", "RSA-SHA512", "RSA-SHA512/224", "RSA-SHA512/256",
+    "id-rsassa-pkcs1-v1_5-with-sha3-224", "id-rsassa-pkcs1-v1_5-with-sha3-256", "id-rsassa-pkcs1-v1_5-with-sha3-384",
+    "id-rsassa-pkcs1-v1_5-with-sha3-512", "md5", "md5-sha1", "md5WithRSAEncryption", "sha1", "sha1WithRSAEncryption",
+    "sha224", "sha224WithRSAEncryption", "sha256", "sha256WithRSAEncryption", "sha3-224", "sha3-256", "sha3-384",
+    "sha3-512", "sha384", "sha384WithRSAEncryption", "sha512", "sha512-224", "sha512-224WithRSAEncryption",
+    "sha512-256", "sha512-256WithRSAEncryption", "sha512WithRSAEncryption", "shake128", "shake256", "ssl3-md5",
+    "ssl3-sha1",
+};
+const size_t js_hash_names_count = JS_COUNTOF(js_hash_names);
+
+static bool same_ci(const char *a, const char *b) {
+    for (; *a && *b; a++, b++)
+        if (tolower((unsigned char)*a) != tolower((unsigned char)*b)) return false;
+    return *a == *b;
+}
+
+const JSHashAlg *js_hash_by_name(const char *name) {
+    for (size_t i = 0; i < JS_COUNTOF(NAMES); i++)
+        if (same_ci(name, NAMES[i].name)) return &ALGS[NAMES[i].alg];
+    return NULL;
+}
+
+const JSHashAlg *js_hash_by_web_name(const char *name) {
+    for (size_t i = 0; i < JS_COUNTOF(ALGS); i++)
+        if (ALGS[i].web && same_ci(name, ALGS[i].web)) return &ALGS[i];
+    return NULL;
+}
+
+void js_hash_init(JSHashCtx *h, const JSHashAlg *alg) {
+    h->alg = alg;
+    switch (alg->kind) {
+    case JS_HASH_BEARSSL:
+        alg->br->init(&h->u.br.vtable);
+        break;
+    case JS_HASH_SHA512T:
+        br_sha512_init(&h->u.br.sha512);
+        memcpy(h->u.br.sha512.val, alg->iv, sizeof h->u.br.sha512.val);
+        break;
+    case JS_HASH_KECCAK:
+        memset(&h->u.keccak, 0, sizeof h->u.keccak);
+        h->u.keccak.rate = alg->block_len;
+        break;
+    }
+}
+
+void js_hash_update(JSHashCtx *h, const void *data, size_t n) {
+    if (!n) return;
+    if (h->alg->kind == JS_HASH_KECCAK) keccak_absorb(&h->u.keccak, data, n);
+    else h->u.br.vtable->update(&h->u.br.vtable, data, n);
+}
+
+void js_hash_final(JSHashCtx *h, uint8_t *out, size_t n) {
+    if (h->alg->kind == JS_HASH_KECCAK) {
+        keccak_squeeze(&h->u.keccak, h->alg->suffix, out, n);
+        return;
+    }
+    uint8_t full[64];
+    h->u.br.vtable->out(&h->u.br.vtable, full);
+    memcpy(out, full, n);
+}
+
+void js_hash_once(const JSHashAlg *alg, const void *data, size_t n, uint8_t *out) {
+    JSHashCtx h;
+    js_hash_init(&h, alg);
+    js_hash_update(&h, data, n);
+    js_hash_final(&h, out, alg->out_len);
+}
+
+/* ---- HMAC (RFC 2104) -------------------------------------------------------------------------- */
+
+void js_hmac_init(JSHmacCtx *m, const JSHashAlg *alg, const uint8_t *key, size_t key_len) {
+    uint8_t block[168] = { 0 };  /* the largest block: SHAKE128's rate */
+    if (key_len > alg->block_len) js_hash_once(alg, key, key_len, block);
+    else if (key_len) memcpy(block, key, key_len);
+    for (size_t i = 0; i < alg->block_len; i++) block[i] ^= 0x36;
+    js_hash_init(&m->inner, alg);
+    js_hash_update(&m->inner, block, alg->block_len);
+    for (size_t i = 0; i < alg->block_len; i++) block[i] ^= 0x36 ^ 0x5C;
+    js_hash_init(&m->outer, alg);
+    js_hash_update(&m->outer, block, alg->block_len);
+}
+
+void js_hmac_update(JSHmacCtx *m, const void *data, size_t n) { js_hash_update(&m->inner, data, n); }
+
+void js_hmac_final(JSHmacCtx *m, uint8_t *out) {
+    uint8_t inner[64];
+    size_t n = m->inner.alg->out_len;
+    js_hash_final(&m->inner, inner, n);
+    js_hash_update(&m->outer, inner, n);
+    js_hash_final(&m->outer, out, n);
+}
+
+/* ---- Random bytes ------------------------------------------------------------------------------- */
+
+static br_hmac_drbg_context drbg;
+static bool drbg_seeded;
+
+const br_prng_class **js_crypto_prng(void) {
+    uint8_t none;
+    js_crypto_random(&none, 0);  /* seeded */
+    return &drbg.vtable;
+}
+
+void js_crypto_random(void *out, size_t n) {
+    if (!drbg_seeded) {
+        br_hmac_drbg_init(&drbg, &br_sha256_vtable, NULL, 0);
+        br_prng_seeder seeder = br_prng_seeder_system(NULL);
+        if (!seeder || !seeder(&drbg.vtable)) js_fatal("no system entropy source for crypto");
+        drbg_seeded = true;
+    }
+    br_hmac_drbg_generate(&drbg, out, n);
+}
+
+bool js_crypto_equal(const uint8_t *a, const uint8_t *b, size_t n) {
+    uint8_t d = 0;
+    for (size_t i = 0; i < n; i++) d |= a[i] ^ b[i];
+    return d == 0;
+}

package/runtime/src/crypto_host.c

@@ -0,0 +1,414 @@
+/* node:crypto's host primitives (ADR 0018): the prelude (node/prelude/crypto.js) builds Node's
+ * API on these, and Web Crypto shares the C beneath them (crypto_internal.h). Bad arguments are
+ * the prelude's to check; here they are only kept from crashing. Handles are objects of the
+ * classes below (no prototype): the prelude keeps them in its objects. */
+#include <stdlib.h>
+#include <string.h>
+
+#include "builtins_util.h"
+#include "crypto_internal.h"
+#include "internal.h"
+#include "js_buffer.h"
+#include "js_convert.h"
+#include "js_crypto.h"
+#include "js_exception.h"
+#include "js_ops.h"
+#include "js_web.h"
+#include "jscontext.h"
+#include "jsstring.h"
+
+#define PRIMITIVE(fn) \
+    JSValue fn(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target)
+
+/* The bytes of a string (as UTF-8) or a buffer source, for the duration of a call. */
+typedef struct Bytes {
+    const uint8_t *p;
+    size_t         n;
+    uint8_t       *owned;  /* malloc'd for a large string */
+    uint8_t        small[256];
+} Bytes;
+
+static bool bytes_of(JSContext *ctx, JSValue v, Bytes *b) {
+    b->owned = NULL;
+    uint8_t *p;
+    if (js_buffer_source_bytes(v, &p, &b->n)) {
+        b->p = p;
+        return true;
+    }
+    if (!js_is_string(v)) return false;
+    JSStrView view = js_string_view(ctx, v);
+    b->n = js_view_to_utf8(view, (char *)b->small, sizeof b->small);
+    if (b->n <= sizeof b->small) {
+        b->p = b->small;
+        return true;
+    }
+    b->owned = malloc(b->n);
+    if (!b->owned) js_fatal("out of memory in crypto");
+    js_view_to_utf8(view, (char *)b->owned, b->n);
+    b->p = b->owned;
+    return true;
+}
+
+static void bytes_free(Bytes *b) { free(b->owned); }
+
+static char *name_arg(JSContext *ctx, JSValue v, char *buf, size_t cap) {
+    if (!js_is_string(v)) return NULL;
+    JSStrView view = js_string_view(ctx, v);
+    size_t n = js_view_to_utf8(view, buf, cap - 1);
+    if (n >= cap - 1) return NULL;
+    buf[n] = 0;
+    return buf;
+}
+
+/* ---- Hash and Hmac ----------------------------------------------------------------------------- */
+
+typedef struct DigestObject {
+    JSObject obj;
+    bool     hmac;
+    size_t   out_len;  /* SHAKE: the output length asked for */
+    union {
+        JSHashCtx hash;
+        JSHmacCtx hmac;
+    } u;
+} DigestObject;
+
+static const JSClass digest_class = { "Hash", sizeof(DigestObject), NULL, NULL, NULL, NULL, NULL, NULL, NULL };
+
+static DigestObject *as_digest(JSValue v) {
+    return js_is_object(v) && js_as_object(v)->shape->cls == &digest_class ? (DigestObject *)js_as_object(v) : NULL;
+}
+
+static DigestObject *new_digest(JSContext *ctx) {
+    return (DigestObject *)js_alloc_object(ctx, JS_CELL_OBJECT, js_shape_root(ctx, &digest_class, JS_NULL, 0));
+}
+
+/* cryptoHashNew(algorithm, outputLength): a hash handle, or null for an unknown algorithm.
+ * outputLength (a number, or undefined for the default) is the XOFs' only. */
+PRIMITIVE(js_crypto_hash_new) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    const JSHashAlg *alg = name_arg(ctx, ARG(0), name, sizeof name) ? js_hash_by_name(name) : NULL;
+    if (!alg) return JS_NULL;
+    DigestObject *d = new_digest(ctx);
+    d->hmac = false;
+    d->out_len = alg->xof && js_is_number(ARG(1)) ? (size_t)js_as_number(ARG(1)) : alg->out_len;
+    js_hash_init(&d->u.hash, alg);
+    return js_object_value(&d->obj);
+}
+
+/* cryptoHashOutputLength(algorithm): the digest's default length in bytes, -1 for an unknown
+ * algorithm; negated (less one) for the XOFs, whose length can be chosen. */
+PRIMITIVE(js_crypto_hash_info) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    const JSHashAlg *alg = name_arg(ctx, ARG(0), name, sizeof name) ? js_hash_by_name(name) : NULL;
+    if (!alg) return js_int32(-1);
+    return js_int32(alg->xof ? -(int32_t)alg->out_len - 1 : (int32_t)alg->out_len);
+}
+
+/* cryptoHashCopy(hash, outputLength): a copy of the hash's state. */
+PRIMITIVE(js_crypto_hash_copy) {
+    (void)callee, (void)this_val, (void)new_target;
+    DigestObject *src = as_digest(ARG(0));
+    if (!src) return js_throw_type_error(ctx, "cryptoHashCopy: a hash expected");
+    DigestObject *d = new_digest(ctx);
+    src = as_digest(ARG(0));
+    d->hmac = src->hmac;
+    d->u = src->u;
+    d->out_len = src->u.hash.alg->xof && js_is_number(ARG(1)) ? (size_t)js_as_number(ARG(1)) : src->out_len;
+    return js_object_value(&d->obj);
+}
+
+/* cryptoHmacNew(algorithm, key): an HMAC handle, or null for an unknown algorithm (or an XOF). */
+PRIMITIVE(js_crypto_hmac_new) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    const JSHashAlg *alg = name_arg(ctx, ARG(0), name, sizeof name) ? js_hash_by_name(name) : NULL;
+    if (!alg || alg->xof) return JS_NULL;
+    DigestObject *d = new_digest(ctx);
+    Bytes key;
+    if (!bytes_of(ctx, ARG(1), &key)) return js_throw_type_error(ctx, "cryptoHmacNew: a key expected");
+    d->hmac = true;
+    d->out_len = alg->out_len;
+    js_hmac_init(&d->u.hmac, alg, key.p, key.n);
+    bytes_free(&key);
+    return js_object_value(&d->obj);
+}
+
+/* cryptoDigestUpdate(handle, data): data a string (as UTF-8) or a buffer source. */
+PRIMITIVE(js_crypto_digest_update) {
+    (void)callee, (void)this_val, (void)new_target;
+    DigestObject *d = as_digest(ARG(0));
+    Bytes data;
+    if (!d || !bytes_of(ctx, ARG(1), &data)) return js_throw_type_error(ctx, "cryptoDigestUpdate: a handle and data expected");
+    if (d->hmac) js_hmac_update(&d->u.hmac, data.p, data.n);
+    else js_hash_update(&d->u.hash, data.p, data.n);
+    bytes_free(&data);
+    return JS_UNDEFINED;
+}
+
+/* cryptoDigestFinal(handle): the digest, a Buffer. The handle is spent. */
+PRIMITIVE(js_crypto_digest_final) {
+    (void)callee, (void)this_val, (void)new_target;
+    DigestObject *d = as_digest(ARG(0));
+    if (!d) return js_throw_type_error(ctx, "cryptoDigestFinal: a handle expected");
+    uint8_t small[64];
+    uint8_t *out = d->out_len <= sizeof small ? small : malloc(d->out_len);
+    if (!out) js_fatal("out of memory in crypto");
+    if (d->hmac) js_hmac_final(&d->u.hmac, out);
+    else js_hash_final(&d->u.hash, out, d->out_len);
+    JSValue r = js_new_buffer_from_bytes(ctx, out, d->out_len);
+    if (out != small) free(out);
+    return r;
+}
+
+/* ---- Random ------------------------------------------------------------------------------------ */
+
+/* cryptoRandomFill(bufferSource, offset, size): fills those bytes. */
+PRIMITIVE(js_crypto_random_fill) {
+    (void)callee, (void)this_val, (void)new_target;
+    uint8_t *p;
+    size_t n;
+    if (!js_buffer_source_bytes(ARG(0), &p, &n) || !js_is_number(ARG(1)) || !js_is_number(ARG(2)))
+        return js_throw_type_error(ctx, "cryptoRandomFill: bytes, offset and size expected");
+    double off = js_as_number(ARG(1)), size = js_as_number(ARG(2));
+    if (off < 0 || size < 0 || off + size > (double)n) return js_throw_range_error(ctx, "cryptoRandomFill: out of range");
+    js_crypto_random(p + (size_t)off, (size_t)size);
+    return JS_UNDEFINED;
+}
+
+/* cryptoRandomUUID(): a version 4 UUID. */
+PRIMITIVE(js_crypto_host_random_uuid) {
+    (void)callee, (void)this_val, (void)argc, (void)argv, (void)new_target;
+    return js_crypto_random_uuid(ctx);
+}
+
+/* cryptoTimingSafeEqual(a, b): two buffer sources of the same length, compared in constant time. */
+PRIMITIVE(js_crypto_timing_safe_equal) {
+    (void)callee, (void)this_val, (void)new_target;
+    uint8_t *a, *b;
+    size_t na, nb;
+    if (!js_buffer_source_bytes(ARG(0), &a, &na) || !js_buffer_source_bytes(ARG(1), &b, &nb) || na != nb)
+        return js_throw_type_error(ctx, "cryptoTimingSafeEqual: two buffers of one length expected");
+    return js_bool(js_crypto_equal(a, b, na));
+}
+
+/* cryptoHashes(): crypto.getHashes(), a new array. */
+PRIMITIVE(js_crypto_hashes) {
+    (void)callee, (void)this_val, (void)argc, (void)argv, (void)new_target;
+    JSValue a = js_new_array(ctx, (uint32_t)js_hash_names_count);
+    for (size_t i = 0; i < js_hash_names_count; i++) {
+        JSValue s = js_new_string_cstr(ctx, js_hash_names[i]);
+        if (js_is_exception(s) || js_array_append(ctx, a, s) < 0) return JS_EXCEPTION;
+    }
+    return a;
+}
+
+/* ---- Key derivation ---------------------------------------------------------------------------- */
+
+static bool bytes_arg(JSValue v, Bytes *b) {
+    uint8_t *p;
+    b->owned = NULL;
+    if (!js_buffer_source_bytes(v, &p, &b->n)) return false;
+    b->p = p;
+    return true;
+}
+
+/* cryptoPbkdf2(digest, password, salt, iterations, keylen): a Buffer; null for an unknown digest,
+ * false when deriving fails (an XOF, no length), as OpenSSL fails. */
+PRIMITIVE(js_crypto_pbkdf2) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    Bytes pw, salt;
+    if (!name_arg(ctx, ARG(0), name, sizeof name) || !bytes_arg(ARG(1), &pw) || !bytes_arg(ARG(2), &salt) || !js_is_number(ARG(3)) ||
+        !js_is_number(ARG(4)))
+        return js_throw_type_error(ctx, "cryptoPbkdf2: bad arguments");
+    const JSHashAlg *alg = js_hash_by_name(name);
+    if (!alg) return JS_NULL;
+    size_t n = (size_t)js_as_number(ARG(4));
+    uint8_t *out = malloc(n ? n : 1);
+    if (!out) js_fatal("out of memory in crypto");
+    bool ok = n > 0 && js_pbkdf2(alg, pw.p, pw.n, salt.p, salt.n, (uint32_t)js_as_number(ARG(3)), out, n);
+    JSValue r = ok ? js_new_buffer_from_bytes(ctx, out, n) : JS_FALSE;
+    free(out);
+    return r;
+}
+
+/* cryptoHkdf(digest, ikm, salt, info, keylen): an ArrayBuffer; null for an unknown digest, false
+ * when deriving fails (an XOF, no length, more than 255 blocks). */
+PRIMITIVE(js_crypto_hkdf) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    Bytes ikm, salt, info;
+    if (!name_arg(ctx, ARG(0), name, sizeof name) || !bytes_arg(ARG(1), &ikm) || !bytes_arg(ARG(2), &salt) || !bytes_arg(ARG(3), &info) ||
+        !js_is_number(ARG(4)))
+        return js_throw_type_error(ctx, "cryptoHkdf: bad arguments");
+    const JSHashAlg *alg = js_hash_by_name(name);
+    if (!alg) return JS_NULL;
+    double len = js_as_number(ARG(4));
+    if (len <= 0 || len > 255.0 * alg->out_len) return JS_FALSE;
+    size_t n = (size_t)len;
+    uint8_t *out = malloc(n);
+    if (!out) js_fatal("out of memory in crypto");
+    JSValue r = JS_FALSE;
+    if (js_hkdf(alg, ikm.p, ikm.n, salt.p, salt.n, info.p, info.n, out, n)) {
+        r = js_new_array_buffer(ctx, n);
+        if (!js_is_exception(r)) memcpy(js_as_array_buffer(r)->data, out, n);
+    }
+    free(out);
+    return r;
+}
+
+/* cryptoScryptCheck(N, r, p, maxmem): 0, 1 (invalid parameters) or 2 (over maxmem). */
+PRIMITIVE(js_crypto_scrypt_check) {
+    (void)ctx, (void)callee, (void)this_val, (void)new_target;
+    for (uint32_t i = 0; i < 4; i++)
+        if (!js_is_number(ARG(i)) || js_as_number(ARG(i)) < 0) return js_int32(JS_SCRYPT_INVALID);
+    return js_int32(js_scrypt_check((uint64_t)js_as_number(ARG(0)), (uint64_t)js_as_number(ARG(1)), (uint64_t)js_as_number(ARG(2)),
+                                    (uint64_t)js_as_number(ARG(3))));
+}
+
+/* cryptoScrypt(password, salt, N, r, p, keylen), with checked parameters: a Buffer, or false. */
+PRIMITIVE(js_crypto_scrypt) {
+    (void)callee, (void)this_val, (void)new_target;
+    Bytes pw, salt;
+    if (!bytes_arg(ARG(0), &pw) || !bytes_arg(ARG(1), &salt)) return js_throw_type_error(ctx, "cryptoScrypt: bad arguments");
+    for (uint32_t i = 2; i < 6; i++)
+        if (!js_is_number(ARG(i))) return js_throw_type_error(ctx, "cryptoScrypt: bad arguments");
+    size_t n = (size_t)js_as_number(ARG(5));
+    uint8_t *out = malloc(n ? n : 1);
+    if (!out) js_fatal("out of memory in crypto");
+    bool ok = js_scrypt(pw.p, pw.n, salt.p, salt.n, (uint64_t)js_as_number(ARG(2)), (uint32_t)js_as_number(ARG(3)),
+                        (uint32_t)js_as_number(ARG(4)), out, n);
+    JSValue r = ok ? js_new_buffer_from_bytes(ctx, out, n) : JS_FALSE;
+    free(out);
+    return r;
+}
+
+/* ---- Ciphers ----------------------------------------------------------------------------------- */
+
+typedef struct CipherObject {
+    JSObject    obj;
+    JSCipherCtx c;
+} CipherObject;
+
+static void cipher_finalize(JSRuntime *rt, JSCell *cell) {
+    (void)rt;
+    js_cipher_free(&((CipherObject *)cell)->c);
+}
+
+static const JSClass cipher_class = { "CipherBase", sizeof(CipherObject), NULL, NULL, NULL, NULL, NULL, cipher_finalize, NULL };
+
+static CipherObject *as_cipher(JSValue v) {
+    return js_is_object(v) && js_as_object(v)->shape->cls == &cipher_class ? (CipherObject *)js_as_object(v) : NULL;
+}
+
+/* A Buffer of the output (freed), or the error code. */
+static JSValue bytes_result(JSContext *ctx, int err, JSBytesOut *out) {
+    JSValue r = err ? js_int32(err) : js_new_buffer_from_bytes(ctx, out->p, out->n);
+    free(out->p);
+    return r;
+}
+
+/* cryptoCipherNew(name, encrypt, key, iv | null, authTagLength (-1: none)): a handle, or an
+ * error code (JS_CIPHER_ERR_*; -1: an unknown cipher). */
+PRIMITIVE(js_crypto_cipher_new) {
+    (void)callee, (void)this_val, (void)new_target;
+    char name[64];
+    Bytes key, iv;
+    bool has_iv = !js_is_null(ARG(3));
+    if (!name_arg(ctx, ARG(0), name, sizeof name)) return js_int32(-1);
+    if (!bytes_arg(ARG(2), &key) || (has_iv && !bytes_arg(ARG(3), &iv)) || !js_is_number(ARG(4)))
+        return js_throw_type_error(ctx, "cryptoCipherNew: bad arguments");
+    const JSCipherAlg *alg = js_cipher_by_name(name);
+    if (!alg) return js_int32(-1);
+    CipherObject *o = (CipherObject *)js_alloc_object(ctx, JS_CELL_OBJECT, js_shape_root(ctx, &cipher_class, JS_NULL, 0));
+    int err = js_cipher_init(&o->c, alg, js_truthy(ARG(1)), key.p, key.n, has_iv ? iv.p : NULL, has_iv ? iv.n : 0, has_iv,
+                             (long)js_as_number(ARG(4)));
+    return err ? js_int32(err) : js_object_value(&o->obj);
+}
+
+/* cryptoCipherUpdate(handle, data): a Buffer, or an error code. */
+PRIMITIVE(js_crypto_cipher_update) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    Bytes data;
+    if (!o || !bytes_of(ctx, ARG(1), &data)) return js_throw_type_error(ctx, "cryptoCipherUpdate: a handle and data expected");
+    JSBytesOut out = { 0 };
+    int err = js_cipher_update(&o->c, data.p, data.n, &out);
+    bytes_free(&data);
+    return bytes_result(ctx, err, &out);
+}
+
+/* cryptoCipherFinal(handle): a Buffer, or an error code. */
+PRIMITIVE(js_crypto_cipher_final) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "cryptoCipherFinal: a handle expected");
+    JSBytesOut out = { 0 };
+    return bytes_result(ctx, js_cipher_final(&o->c, &out), &out);
+}
+
+/* cryptoCipherSetAAD(handle, bytes, plaintextLength (-1: none)): 0, or an error code. */
+PRIMITIVE(js_crypto_cipher_set_aad) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    Bytes aad;
+    if (!o || !bytes_arg(ARG(1), &aad) || !js_is_number(ARG(2))) return js_throw_type_error(ctx, "cryptoCipherSetAAD: bad arguments");
+    return js_int32(js_cipher_set_aad(&o->c, aad.p, aad.n, (long)js_as_number(ARG(2))));
+}
+
+/* cryptoCipherSetAuthTag(handle, bytes): 0, or an error code. */
+PRIMITIVE(js_crypto_cipher_set_auth_tag) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    Bytes tag;
+    if (!o || !bytes_arg(ARG(1), &tag)) return js_throw_type_error(ctx, "cryptoCipherSetAuthTag: bad arguments");
+    return js_int32(js_cipher_set_auth_tag(&o->c, tag.p, tag.n));
+}
+
+/* cryptoCipherGetAuthTag(handle): a Buffer, or undefined when there is none (yet). */
+PRIMITIVE(js_crypto_cipher_get_auth_tag) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "cryptoCipherGetAuthTag: a handle expected");
+    const uint8_t *p;
+    size_t n;
+    return js_cipher_get_auth_tag(&o->c, &p, &n) ? js_new_buffer_from_bytes(ctx, p, n) : JS_UNDEFINED;
+}
+
+/* cryptoCipherSetPadding(handle, padding): whether it could. */
+PRIMITIVE(js_crypto_cipher_set_padding) {
+    (void)callee, (void)this_val, (void)new_target;
+    CipherObject *o = as_cipher(ARG(0));
+    if (!o) return js_throw_type_error(ctx, "cryptoCipherSetPadding: a handle expected");
+    return js_bool(js_cipher_set_padding(&o->c, js_truthy(ARG(1))));
+}
+
+/* cryptoCipherInfo(name | nid): [name, nid, mode, blockSize, ivLength, keyLength], or null.
+ * blockSize and ivLength are 0 when getCipherInfo omits them. */
+PRIMITIVE(js_crypto_cipher_info) {
+    (void)callee, (void)this_val, (void)new_target;
+    const JSCipherAlg *alg = NULL;
+    char name[64];
+    if (js_is_number(ARG(0))) alg = js_cipher_by_nid((int)js_as_number(ARG(0)));
+    else if (name_arg(ctx, ARG(0), name, sizeof name)) alg = js_cipher_by_name(name);
+    if (!alg) return JS_NULL;
+    JSValue a = js_new_array(ctx, 6);
+    JSValue items[6] = { js_new_string_cstr(ctx, alg->info_name), js_int32(alg->nid), js_new_string_cstr(ctx, alg->mode_name),
+                         js_int32(alg->block_size), js_int32(alg->iv_len), js_int32(alg->key_len) };
+    for (int i = 0; i < 6; i++)
+        if (js_array_append(ctx, a, items[i]) < 0) return JS_EXCEPTION;
+    return a;
+}
+
+/* cryptoCiphers(): crypto.getCiphers(), a new array. */
+PRIMITIVE(js_crypto_ciphers) {
+    (void)callee, (void)this_val, (void)argc, (void)argv, (void)new_target;
+    JSValue a = js_new_array(ctx, (uint32_t)js_cipher_count);
+    for (size_t i = 0; i < js_cipher_count; i++) {
+        JSValue s = js_new_string_cstr(ctx, js_cipher_at(i)->name);
+        if (js_is_exception(s) || js_array_append(ctx, a, s) < 0) return JS_EXCEPTION;
+    }
+    return a;
+}