visaljs 0.0.1 → 0.0.3

package/node/prelude/internal/crypto/asym.js

@@ -4,10 +4,11 @@
 // runtime's C (crypto_asym.c), which signs digests: the hashing is the Hash primitives'.
 import {
   cryptoDigestFinal, cryptoDigestUpdate, cryptoEcdh, cryptoEcPoint, cryptoEcPrivate, cryptoHashNew, cryptoKeyGenerate, cryptoKeyParts,
-  cryptoRsaCrypt, cryptoSign, cryptoVerify,
+  cryptoRsaCrypt, cryptoSign, cryptoSignMessage, cryptoVerify, cryptoVerifyMessage,
 } from "visaljs:host";
 import { Writable } from "../../stream.js";
 import { codeError, invalidArgType, invalidArgValue, validateFunction, validateString } from "../errors.js";
+import { dhStateless } from "./diffiehellman.js";
 import { asymmetricKeyTypeOf, KeyObject, preparePrivateKey, preparePublicOrPrivateKey, pssParamsOf } from "./keys.js";
 import { isAnyArrayBuffer, isArrayBufferView, kHandle, stringBytes, validateEncoding, validateObject } from "./util.js";
 
@@ -25,6 +26,7 @@ function asymError(code, digest) {
     case 8: return codeError(Error, "ERR_OSSL_RSA_PADDING_CHECK_FAILED", "error:02000072:rsa routines::padding check failed");
     case 9: return codeError(Error, "ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY", "Public key is not valid for specified curve");
     case 10: return codeError(TypeError, "ERR_CRYPTO_INVALID_CURVE", "Invalid EC curve name");
+    case 11: return codeError(Error, "ERR_CRYPTO_UNSUPPORTED_OPERATION", "Unsupported crypto operation");
     default: return new Error("Crypto operation failed");
   }
 }
@@ -59,6 +61,24 @@ function getDSASignatureEncoding(options) {
   return false;
 }
 
+/* Ed25519 signs the message (no digest: naming one is OpenSSL's error) */
+const signsMessages = (handle) => asymmetricKeyTypeOf(handle) === "ed25519";
+const invalidDigest = () => codeError(Error, "ERR_OSSL_INVALID_DIGEST", "error:1C80007A:Provider routines::invalid digest");
+
+function signMessage(handle, algorithm, data) {
+  if (algorithm != null) throw invalidDigest();
+  const sig = cryptoSignMessage(handle, data);
+  if (typeof sig === "number") throw asymError(sig);
+  return sig;
+}
+
+function verifyMessage(handle, algorithm, data, signature) {
+  if (algorithm != null) throw invalidDigest();
+  const ok = cryptoVerifyMessage(handle, data, signature);
+  if (typeof ok === "number") throw asymError(ok);
+  return ok;
+}
+
 /* The hash a signature uses: the one named, else the key's default (its PSS parameters', or SHA-256) */
 function hashFor(algorithm, handle) {
   if (algorithm != null) return algorithm;
@@ -166,13 +186,16 @@ export function sign(algorithm, data, key, callback) {
   getIntOption("saltLength", key);
   getDSASignatureEncoding(key);
   const handle = preparePrivateKey(key);
-  const hash = hashFor(algorithm, handle);
-  const digest = digestOf(hash, data);
-  if (digest === null) throw asymError(2, hash);
-  if (callback === undefined) return signDigest(handle, hash, digest, key);
+  const run = signsMessages(handle) ? () => signMessage(handle, algorithm, data) : () => {
+    const hash = hashFor(algorithm, handle);
+    const digest = digestOf(hash, data);
+    if (digest === null) throw asymError(2, hash);
+    return signDigest(handle, hash, digest, key);
+  };
+  if (callback === undefined) return run();
   let result;
   try {
-    result = signDigest(handle, hash, digest, key);
+    result = run();
   } catch (e) {
     later(() => callback(e));
     return;
@@ -190,13 +213,16 @@ export function verify(algorithm, data, key, signature, callback) {
   getDSASignatureEncoding(key);
   if (!isArrayBufferView(signature)) throw invalidArgType("signature", "an instance of Buffer, TypedArray, or DataView", signature);
   const handle = preparePublicOrPrivateKey(key);
-  const hash = hashFor(algorithm, handle);
-  const digest = digestOf(hash, data);
-  if (digest === null) throw asymError(2, hash);
-  if (callback === undefined) return verifyDigest(handle, hash, digest, signature, key);
+  const run = signsMessages(handle) ? () => verifyMessage(handle, algorithm, data, signature) : () => {
+    const hash = hashFor(algorithm, handle);
+    const digest = digestOf(hash, data);
+    if (digest === null) throw asymError(2, hash);
+    return verifyDigest(handle, hash, digest, signature, key);
+  };
+  if (callback === undefined) return run();
   let result;
   try {
-    result = verifyDigest(handle, hash, digest, signature, key);
+    result = run();
   } catch (e) {
     later(() => callback(e));
     return;
@@ -324,9 +350,10 @@ export function diffieHellman(options) {
   if (publicKey.type !== "public" && publicKey.type !== "private") throw keyObjectType(publicKey.type, "private or public");
   const privateType = asymmetricKeyTypeOf(privateKey[kHandle]);
   const publicType = asymmetricKeyTypeOf(publicKey[kHandle]);
-  if (privateType !== publicType || (privateType !== "ec" && privateType !== "x25519")) {
+  if (privateType !== publicType || (privateType !== "ec" && privateType !== "x25519" && privateType !== "dh")) {
     throw codeError(Error, "ERR_CRYPTO_INCOMPATIBLE_KEY", `Incompatible key types for Diffie-Hellman: ${privateType} and ${publicType}`);
   }
+  if (privateType === "dh") return dhStateless(cryptoKeyParts(privateKey[kHandle]), cryptoKeyParts(publicKey[kHandle]));
   const ret = cryptoEcdh(privateKey[kHandle], publicKey[kHandle]);
   if (typeof ret === "number") throw asymError(9);
   return ret;

package/node/prelude/internal/crypto/dh_groups.js

@@ -0,0 +1,12 @@
+// Generated from Node v22.22.2's crypto.getDiffieHellman(name).getPrime("hex"): the MODP groups of RFC 2409 and RFC
+// 3526 (generator 2), with the private key lengths OpenSSL uses for them (0: the prime's length less one).
+export const DH_GROUPS = {
+  modp1: [0, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a63a3620ffffffffffffffff"],
+  modp2: [0, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff"],
+  modp5: [200, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca237327ffffffffffffffff"],
+  modp14: [225, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff"],
+  modp15: [275, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a93ad2caffffffffffffffff"],
+  modp16: [325, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c934063199ffffffffffffffff"],
+  modp17: [375, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dcc4024ffffffffffffffff"],
+  modp18: [400, "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dbe115974a3926f12fee5e438777cb6a932df8cd8bec4d073b931ba3bc832b68d9dd300741fa7bf8afc47ed2576f6936ba424663aab639c5ae4f5683423b4742bf1c978238f16cbe39d652de3fdb8befc848ad922222e04a4037c0713eb57a81a23f0c73473fc646cea306b4bcbc8862f8385ddfa9d4b7fa2c087e879683303ed5bdd3a062b3cf5b3a278a66d2a13f83f44f82ddf310ee074ab6a364597e899a0255dc164f31cc50846851df9ab48195ded7ea1b1d510bd7ee74d73faf36bc31ecfa268359046f4eb879f924009438b481c6cd7889a002ed5ee382bc9190da6fc026e479558e4475677e9aa9e3050e2765694dfc81f56e880b96e7160c980dd98edd3dfffffffffffffffff"],
+};

package/node/prelude/internal/crypto/diffiehellman.js

@@ -0,0 +1,354 @@
+// node:crypto's finite-field Diffie-Hellman and primes (ADR 0018): DiffieHellman, DiffieHellmanGroup,
+// createDiffieHellman, getDiffieHellman (createDiffieHellmanGroup), generatePrime(Sync) and
+// checkPrime(Sync), as Node's lib/internal/crypto/{diffiehellman,random}.js have them, over the
+// runtime's big integers (crypto_bn.c: modular exponentiation, prime generation and testing).
+// What OpenSSL decides beneath Node's API is OpenSSL's here too: the private key lengths of the
+// MODP groups, DH_check's flags (verifyError), the public key checks of computeSecret.
+import { cryptoCheckPrime, cryptoGeneratePrime, cryptoModExp, cryptoRandomFill } from "visaljs:host";
+import { codeError, invalidArgType, outOfRange, validateFunction } from "../errors.js";
+import { DH_GROUPS } from "./dh_groups.js";
+import { isAnyArrayBuffer, isArrayBufferView, kHandle, validateObject } from "./util.js";
+
+const later = (fn) => setTimeout(fn, 0);
+
+function validateInt32(value, name, min = -2147483648, max = 2147483647) {
+  if (typeof value !== "number") throw invalidArgType(name, "of type number", value);
+  if (!Number.isInteger(value)) throw outOfRange(name, "an integer", value);
+  if (value < min || value > max) throw outOfRange(name, `>= ${min} && <= ${max}`, value);
+}
+
+function validateBoolean(value, name) {
+  if (typeof value !== "boolean") throw invalidArgType(name, "of type boolean", value);
+}
+
+/* getArrayBufferOrView / toBuf: a string in `encoding`, or the buffer's bytes */
+function toBuf(value, encoding) {
+  if (typeof value === "string") return Buffer.from(value, encoding === undefined || encoding === "buffer" || !encoding ? "utf8" : encoding);
+  if (isAnyArrayBuffer(value)) return Buffer.from(value);
+  return Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+}
+
+function bytesArg(value, name, encoding) {
+  if (typeof value !== "string" && !isAnyArrayBuffer(value) && !isArrayBufferView(value)) {
+    throw invalidArgType(name, "of type string or an instance of ArrayBuffer, Buffer, TypedArray, or DataView", value);
+  }
+  return toBuf(value, encoding);
+}
+
+const encode = (buffer, encoding) => (encoding && encoding !== "buffer" ? buffer.toString(encoding) : buffer);
+
+/* big-endian integers: minimal, compared, and as BigInts */
+const strip = (b) => {
+  let i = 0;
+  while (i < b.length - 1 && b[i] === 0) i++;
+  return b.subarray(i);
+};
+const toBig = (b) => (b.length ? BigInt("0x" + Buffer.from(b).toString("hex")) : 0n);
+function fromBig(n) {
+  const hex = n.toString(16);
+  return Buffer.from(hex.length % 2 ? "0" + hex : hex, "hex");
+}
+const bitsOf = (b) => {
+  const s = strip(b);
+  return s.length === 0 || (s.length === 1 && s[0] === 0) ? 0 : (s.length - 1) * 8 + (32 - Math.clz32(s[0]));
+};
+
+/** A private value of at most `bits` bits, not zero */
+function randomPrivate(bits) {
+  const n = Math.ceil(bits / 8);
+  const b = Buffer.alloc(n);
+  do {
+    cryptoRandomFill(b, 0, n);
+    if (bits % 8) b[0] &= (1 << (bits % 8)) - 1;
+  } while (b.every((x) => x === 0));
+  return Buffer.from(strip(b));
+}
+
+/* the generator as OpenSSL generates parameters for it: a safe prime p with p mod 24 = 23 for
+ * generator 2, p mod 60 = 59 for 5, else p mod 12 = 11 */
+function generateParameters(bits, generator) {
+  const [add, rem] = generator === 2 ? [24, 23] : generator === 5 ? [60, 59] : [12, 11];
+  const p = cryptoGeneratePrime(bits, true, Buffer.from([add]), Buffer.from([rem]));
+  if (p === null) throw new Error("Prime generation failed");
+  return p;
+}
+
+const invalidParameters = () => codeError(TypeError, "ERR_INVALID_ARG_VALUE", "Invalid DH parameters");
+
+/* DH_check's flags (OpenSSL 3): what verifyError reports for given parameters */
+const DH_CHECK_P_NOT_PRIME = 0x01, DH_CHECK_P_NOT_SAFE_PRIME = 0x02, DH_NOT_SUITABLE_GENERATOR = 0x08, DH_MODULUS_TOO_SMALL = 0x80;
+function dhCheck(p, g) {
+  let flags = 0;
+  const big = toBig(p);
+  const gen = toBig(g);
+  if (!(big & 1n)) flags |= DH_CHECK_P_NOT_PRIME;
+  if (gen <= 1n || gen >= big - 1n) flags |= DH_NOT_SUITABLE_GENERATOR;
+  if (bitsOf(p) < 512) flags |= DH_MODULUS_TOO_SMALL;
+  if (!cryptoCheckPrime(p, 0)) flags |= DH_CHECK_P_NOT_PRIME;
+  else if (!cryptoCheckPrime(fromBig(big >> 1n), 0)) flags |= DH_CHECK_P_NOT_SAFE_PRIME;
+  return flags;
+}
+
+/* ---- DiffieHellman and DiffieHellmanGroup ------------------------------------------------------ */
+
+function defineVerifyError(self, value) {
+  Object.defineProperty(self, "verifyError", { enumerable: true, value, writable: false });
+}
+
+export function DiffieHellman(sizeOrKey, keyEncoding, generator, genEncoding) {
+  if (!(this instanceof DiffieHellman)) return new DiffieHellman(sizeOrKey, keyEncoding, generator, genEncoding);
+  if (typeof sizeOrKey !== "number" && typeof sizeOrKey !== "string" && !isArrayBufferView(sizeOrKey) && !isAnyArrayBuffer(sizeOrKey)) {
+    throw invalidArgType("sizeOrKey", "one of type number or string or an instance of ArrayBuffer, Buffer, TypedArray, or DataView", sizeOrKey);
+  }
+  if (typeof sizeOrKey === "number") validateInt32(sizeOrKey, "sizeOrKey");
+  if (keyEncoding && !Buffer.isEncoding(keyEncoding) && keyEncoding !== "buffer") {
+    genEncoding = generator;
+    generator = keyEncoding;
+    keyEncoding = false;
+  }
+  if (typeof sizeOrKey !== "number") sizeOrKey = toBuf(sizeOrKey, keyEncoding);
+  if (!generator) {
+    generator = 2;
+  } else if (typeof generator === "number") {
+    validateInt32(generator, "generator");
+  } else if (typeof generator === "string") {
+    generator = toBuf(generator, genEncoding);
+  } else if (!isArrayBufferView(generator) && !isAnyArrayBuffer(generator)) {
+    throw invalidArgType("generator", "one of type number or string or an instance of ArrayBuffer, Buffer, TypedArray, or DataView", generator);
+  } else {
+    generator = toBuf(generator);
+  }
+  let p, g, verifyError;
+  if (typeof sizeOrKey === "number") {
+    if (sizeOrKey < 512 || typeof generator !== "number" || generator < 2) throw invalidParameters();
+    p = generateParameters(sizeOrKey, generator);
+    g = fromBig(BigInt(generator));
+    verifyError = 0;
+  } else {
+    p = Buffer.from(strip(sizeOrKey));
+    g = typeof generator === "number" ? fromBig(BigInt(generator)) : Buffer.from(strip(generator));
+    if (bitsOf(p) === 0 || toBig(g) < 2n) throw invalidParameters();
+    verifyError = dhCheck(p, g);
+  }
+  this[kHandle] = { p, g, privateBits: bitsOf(p) - 1, publicKey: null, privateKey: null };
+  defineVerifyError(this, verifyError);
+}
+
+export function DiffieHellmanGroup(name) {
+  if (!(this instanceof DiffieHellmanGroup)) return new DiffieHellmanGroup(name);
+  const group = typeof name === "string" && Object.hasOwn(DH_GROUPS, name) ? DH_GROUPS[name] : undefined;
+  if (group === undefined) throw codeError(Error, "ERR_CRYPTO_UNKNOWN_DH_GROUP", "Unknown DH group");
+  const p = Buffer.from(group[1], "hex");
+  this[kHandle] = { p, g: Buffer.from([2]), privateBits: group[0] || bitsOf(p) - 1, publicKey: null, privateKey: null };
+  defineVerifyError(this, 0);
+}
+
+function dhGenerateKeys(encoding) {
+  const state = this[kHandle];
+  if (state.privateKey === null) state.privateKey = randomPrivate(state.privateBits);
+  const pub = cryptoModExp(state.g, state.privateKey, state.p, undefined);
+  if (pub === null) throw codeError(Error, "ERR_CRYPTO_OPERATION_FAILED", "Key generation failed");
+  state.publicKey = Buffer.from(strip(pub));
+  return encode(state.publicKey, encoding);
+}
+
+/* the peer's public value, checked as OpenSSL's DH_check_pub_key does */
+function checkPeer(state, key) {
+  const pub = toBig(key);
+  const p = toBig(state.p);
+  if (pub <= 1n) throw codeError(RangeError, "ERR_CRYPTO_INVALID_KEYLEN", "Supplied key is too small");
+  if (pub >= p - 1n) throw codeError(RangeError, "ERR_CRYPTO_INVALID_KEYTYPE", "Unspecified validation error");
+}
+
+function dhComputeSecret(key, inEnc, outEnc) {
+  key = bytesArg(key, "key", inEnc);
+  const state = this[kHandle];
+  if (state.privateKey === null) throw codeError(Error, "ERR_CRYPTO_INVALID_STATE", "No private key - did you forget to generate one?");
+  checkPeer(state, key);
+  return encode(cryptoModExp(key, state.privateKey, state.p, state.p.length), outEnc);
+}
+
+function dhGetPrime(encoding) {
+  return encode(Buffer.from(this[kHandle].p), encoding);
+}
+
+function dhGetGenerator(encoding) {
+  return encode(Buffer.from(this[kHandle].g), encoding);
+}
+
+function dhGetPublicKey(encoding) {
+  const key = this[kHandle].publicKey;
+  if (key === null) throw codeError(Error, "ERR_CRYPTO_INVALID_STATE", "No public key - did you forget to generate one?");
+  return encode(Buffer.from(key), encoding);
+}
+
+function dhGetPrivateKey(encoding) {
+  const key = this[kHandle].privateKey;
+  if (key === null) throw codeError(Error, "ERR_CRYPTO_INVALID_STATE", "No private key - did you forget to generate one?");
+  return encode(Buffer.from(key), encoding);
+}
+
+for (const C of [DiffieHellman, DiffieHellmanGroup]) {
+  C.prototype.generateKeys = dhGenerateKeys;
+  C.prototype.computeSecret = dhComputeSecret;
+  C.prototype.getPrime = dhGetPrime;
+  C.prototype.getGenerator = dhGetGenerator;
+  C.prototype.getPublicKey = dhGetPublicKey;
+  C.prototype.getPrivateKey = dhGetPrivateKey;
+}
+
+DiffieHellman.prototype.setPublicKey = function setPublicKey(key, encoding) {
+  this[kHandle].publicKey = Buffer.from(strip(bytesArg(key, "key", encoding)));
+  return this;
+};
+
+DiffieHellman.prototype.setPrivateKey = function setPrivateKey(key, encoding) {
+  this[kHandle].privateKey = Buffer.from(strip(bytesArg(key, "key", encoding)));
+  return this;
+};
+
+export function createDiffieHellman(sizeOrKey, keyEncoding, generator, genEncoding) {
+  return new DiffieHellman(sizeOrKey, keyEncoding, generator, genEncoding);
+}
+
+export function createDiffieHellmanGroup(name) {
+  return new DiffieHellmanGroup(name);
+}
+
+export const getDiffieHellman = createDiffieHellmanGroup;
+
+/* ---- 'dh' KeyObjects: their parameters and keys, and the stateless agreement ---------------------- */
+
+/** [p, g, privateBits] of generateKeyPair('dh')'s options (validated as Node's keygen does) */
+export function dhParameters(options) {
+  validateObject(options, "options");
+  const { group, primeLength, prime, generator } = options;
+  const pair = (a, b) => codeError(TypeError, "ERR_INCOMPATIBLE_OPTION_PAIR", `Option "${a}" cannot be used in combination with option "${b}"`);
+  if (group != null) {
+    if (prime != null) throw pair("group", "prime");
+    if (primeLength != null) throw pair("group", "primeLength");
+    if (generator != null) throw pair("group", "generator");
+    if (typeof group !== "string") throw invalidArgType("options.group", "of type string", group);
+    const { [kHandle]: state } = new DiffieHellmanGroup(group);
+    return [state.p, state.g, state.privateBits];
+  }
+  if (prime != null) {
+    if (primeLength != null) throw pair("prime", "primeLength");
+    if (!isArrayBufferView(prime)) throw invalidArgType("options.prime", "an instance of Buffer, TypedArray, or DataView", prime);
+  } else if (primeLength != null) {
+    validateInt32(primeLength, "options.primeLength", 0);
+  } else {
+    throw codeError(TypeError, "ERR_MISSING_OPTION", "At least one of the group, prime, or primeLength options is required");
+  }
+  if (generator != null) validateInt32(generator, "options.generator", 0);
+  const gen = generator == null ? 2 : generator;
+  const p = prime != null ? Buffer.from(strip(toBuf(prime))) : generateParameters(primeLength, gen);
+  return [p, fromBig(BigInt(gen)), bitsOf(p) - 1];
+}
+
+/** A 'dh' key pair's parts [p, g, pub, priv] for those parameters */
+export function dhKeyParts([p, g, privateBits]) {
+  const priv = randomPrivate(privateBits);
+  return [p, g, Buffer.from(strip(cryptoModExp(g, priv, p, undefined))), priv];
+}
+
+/** The shared secret of two 'dh' keys' parts (diffieHellman()), as long as the prime */
+export function dhStateless(privateParts, publicParts) {
+  const [p, g, , priv] = privateParts;
+  const [p2, g2, pub] = publicParts;
+  if (!p.equals(p2) || !g.equals(g2)) throw codeError(Error, "ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS", "error:1C800073:Provider routines::mismatching domain parameters");
+  checkPeer({ p }, pub);
+  return cryptoModExp(pub, priv, p, p.length);
+}
+
+/* ---- Primes ------------------------------------------------------------------------------------- */
+
+function unsignedBigIntToBuffer(bigint, name) {
+  if (bigint < 0) throw outOfRange(name, ">= 0", bigint);
+  return fromBig(bigint);
+}
+
+const bufferOrBigint = (v, name) => {
+  if (typeof v === "bigint") return unsignedBigIntToBuffer(v, name);
+  if (!isAnyArrayBuffer(v) && !isArrayBufferView(v)) {
+    throw invalidArgType(name, "of type bigint or an instance of ArrayBuffer, TypedArray, Buffer, or DataView", v);
+  }
+  return toBuf(v);
+};
+
+function primeJob(size, options) {
+  validateObject(options, "options");
+  const { safe = false, bigint = false } = options;
+  let { add, rem } = options;
+  validateBoolean(safe, "options.safe");
+  validateBoolean(bigint, "options.bigint");
+  if (add !== undefined) add = bufferOrBigint(add, "options.add");
+  if (rem !== undefined) rem = bufferOrBigint(rem, "options.rem");
+  /* RandomPrimeConfig's checks */
+  if (add !== undefined) {
+    if (bitsOf(add) > size) throw codeError(RangeError, "ERR_OUT_OF_RANGE", "invalid options.add");
+    if (rem !== undefined && toBig(add) <= toBig(rem)) throw codeError(RangeError, "ERR_OUT_OF_RANGE", "invalid options.rem");
+  }
+  return () => {
+    const p = cryptoGeneratePrime(size, safe, add, rem);
+    if (p === null) throw codeError(Error, "ERR_CRYPTO_OPERATION_FAILED", "Prime generation failed");
+    if (bigint) return toBig(p);
+    const out = new ArrayBuffer(p.length);
+    new Uint8Array(out).set(p);
+    return out;
+  };
+}
+
+export function generatePrimeSync(size, options = {}) {
+  validateInt32(size, "size", 1);
+  return primeJob(size, options)();
+}
+
+export function generatePrime(size, options, callback) {
+  validateInt32(size, "size", 1);
+  if (typeof options === "function") {
+    callback = options;
+    options = {};
+  }
+  validateFunction(callback, "callback");
+  const job = primeJob(size, options);
+  later(() => {
+    let result;
+    try {
+      result = job();
+    } catch (e) {
+      callback(e);
+      return;
+    }
+    callback(undefined, result);
+  });
+}
+
+function candidateOf(candidate) {
+  if (typeof candidate === "bigint") return unsignedBigIntToBuffer(candidate, "candidate");
+  if (!isAnyArrayBuffer(candidate) && !isArrayBufferView(candidate)) {
+    throw invalidArgType("candidate", "of type bigint or an instance of ArrayBuffer, TypedArray, Buffer, or DataView", candidate);
+  }
+  return toBuf(candidate);
+}
+
+export function checkPrimeSync(candidate, options = {}) {
+  candidate = candidateOf(candidate);
+  validateObject(options, "options");
+  const { checks = 0 } = options;
+  validateInt32(checks, "options.checks", 0);
+  return cryptoCheckPrime(candidate, checks);
+}
+
+export function checkPrime(candidate, options = {}, callback) {
+  candidate = candidateOf(candidate);
+  if (typeof options === "function") {
+    callback = options;
+    options = {};
+  }
+  validateFunction(callback, "callback");
+  validateObject(options, "options");
+  const { checks = 0 } = options;
+  validateInt32(checks, "options.checks", 0);
+  later(() => callback(undefined, cryptoCheckPrime(candidate, checks)));
+}

package/node/prelude/internal/crypto/hash.js

@@ -1,5 +1,5 @@
 // node:crypto's Hash and Hmac, and crypto.hash() (ADR 0018): Node's lib/internal/crypto/hash.js
-// over the host primitives, which hash in C (BearSSL, and SHA-3 of our own).
+// over the host primitives, which hash in C (BoringSSL, and SHA-3 of our own).
 import {
   cryptoDigestFinal, cryptoDigestUpdate, cryptoHashCopy, cryptoHashes, cryptoHashInfo, cryptoHashNew, cryptoHmacNew,
 } from "visaljs:host";

package/node/prelude/internal/crypto/key_type.js

@@ -0,0 +1,3 @@
+// KeyObject's type slot (Node's kKeyType), apart from keys.js so util.types.isKeyObject can check
+// for it without bringing in node:crypto.
+export const kKeyType = Symbol("kKeyType");

package/node/prelude/internal/crypto/keys.js

@@ -7,9 +7,10 @@ import {
   cryptoKeyParse, cryptoKeyParts, cryptoKeyPublic, cryptoKeySecret, cryptoKeySecretBytes, cryptoToCryptoKey,
 } from "visaljs:host";
 import { codeError, invalidArgType, invalidArgValue, notSupported, outOfRange, validateFunction, validateString } from "../errors.js";
+import { dhKeyParts, dhParameters } from "./diffiehellman.js";
+import { kKeyType } from "./key_type.js";
 import { isAnyArrayBuffer, isArrayBufferView, kHandle, validateNumber, validateObject } from "./util.js";
 
-const kKeyType = Symbol("kKeyType");
 const kAsymmetricKeyType = Symbol("kAsymmetricKeyType");
 const kAsymmetricKeyDetails = Symbol("kAsymmetricKeyDetails");
 
@@ -140,9 +141,19 @@ class SecretKeyObject extends KeyObject {
 }
 
 /* asymmetricKeyDetails: Node's normalized form of the key's details */
+const bitLength = (b) => {
+  let bits = (b.length - 1) * 8;
+  for (let top = b[0]; top; top >>= 1) bits++;
+  return bits;
+};
+
 function keyDetails(handle) {
   const [, kind, namedCurve, pss] = cryptoKeyInfo(handle);
   if (kind === "ec") return { namedCurve };
+  if (kind === "dsa") {
+    const [p, q] = cryptoKeyParts(handle);
+    return { modulusLength: bitLength(p), divisorLength: bitLength(q) };
+  }
   const [n, e] = cryptoKeyParts(handle);
   let bits = (n.length - 1) * 8;
   for (let top = n[0]; top; top >>= 1) bits++;
@@ -165,6 +176,7 @@ class AsymmetricKeyObject extends KeyObject {
       case "rsa":
       case "rsa-pss":
       case "ec":
+      case "dsa":
         return this[kAsymmetricKeyDetails] ||= keyDetails(this[kHandle]);
       default:
         return {};
@@ -328,8 +340,9 @@ function exportJwk(handle, isPrivate) {
     if (isPrivate) jwk.d = b64u(parts[1]);
     return jwk;
   }
-  if (kind === "x25519") {
-    return isPrivate ? { crv: "X25519", d: b64u(parts[1]), x: b64u(parts[0]), kty: "OKP" } : { crv: "X25519", x: b64u(parts[0]), kty: "OKP" };
+  if (kind === "x25519" || kind === "ed25519") {
+    const crv = kind === "x25519" ? "X25519" : "Ed25519";
+    return isPrivate ? { crv, d: b64u(parts[1]), x: b64u(parts[0]), kty: "OKP" } : { crv, x: b64u(parts[0]), kty: "OKP" };
   }
   throw codeError(Error, "ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE", "Unsupported JWK Key Type.");
 }
@@ -350,9 +363,10 @@ function keyFromJwk(key, isPublic) {
     validateString(key.x, "key.x");
     if (!isPublic) validateString(key.d, "key.d");
     const data = isPublic ? b64(key.x) : b64(key.d);
-    if (key.crv !== "X25519") throw notSupported(key.crv + " keys");
+    if (key.crv !== "X25519" && key.crv !== "Ed25519") throw notSupported(key.crv + " keys");
     if (data.byteLength !== 32) throw invalidJwk();
-    return isPublic ? fromParts("x25519", false, undefined, [data]) : fromParts("x25519", true, undefined, [undefined, data]);
+    const kind = key.crv.toLowerCase();
+    return isPublic ? fromParts(kind, false, undefined, [data]) : fromParts(kind, true, undefined, [undefined, data]);
   }
   if (key.kty === "EC") {
     validateString(key.crv, "key.crv");
@@ -557,13 +571,29 @@ function keyPairJob(type, options) {
       break;
     }
     case "x25519":
-      generate = () => cryptoKeyGenerate("x25519");
-      break;
     case "ed25519":
+      generate = () => cryptoKeyGenerate(type);
+      break;
+    case "dsa": {
+      validateObject(options, "options");
+      const { modulusLength } = options;
+      validateUint32(modulusLength, "options.modulusLength");
+      let { divisorLength } = options;
+      if (divisorLength == null) divisorLength = 224;  /* OpenSSL 3's default */
+      else validateIntegerIn(divisorLength, "options.divisorLength", 0, 2147483647);
+      generate = () => cryptoKeyGenerate("dsa", modulusLength, divisorLength);
+      break;
+    }
+    case "dh": {
+      const params = dhParameters(options);
+      generate = () => {
+        const handle = cryptoKeyFromParts("dh", true, undefined, dhKeyParts(params));
+        return handle;
+      };
+      break;
+    }
     case "ed448":
     case "x448":
-    case "dsa":
-    case "dh":
       throw notSupported(`A ${type} key`);
     default:
       throw invalidArgValue("type", "must be a supported key type", type);