visaljs 0.0.2 → 0.0.3

package/runtime/src/crypto_internal.h

@@ -1,5 +1,5 @@
 /* crypto_internal.h — the crypto primitives (ADR 0018), runtime-private: what Web Crypto (the
- * crypto component) and node:crypto's host primitives share. BearSSL is reached only through
+ * crypto component) and node:crypto's host primitives share. BoringSSL is reached only through
  * the crypto*.c files, behind these. */
 #ifndef JS_CRYPTO_INTERNAL_H
 #define JS_CRYPTO_INTERNAL_H
@@ -8,17 +8,37 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "bearssl.h"
+#include <openssl/aes.h>
+#include <openssl/des.h>
+#include <openssl/md5.h>
+#include <openssl/sha.h>
+
 #include "js_object.h"
 
 /* ---- Hashes ---------------------------------------------------------------------------------- */
 
 typedef enum JSHashKind {
-    JS_HASH_BEARSSL,  /* a BearSSL hash class */
-    JS_HASH_SHA512T,  /* SHA-512/t: SHA-512 with its own IV, truncated */
-    JS_HASH_KECCAK,   /* SHA-3 and SHAKE (crypto_hash.c's Keccak) */
+    JS_HASH_BORINGSSL,  /* one of BoringSSL's (MD5, SHA-1, SHA-2, MD5+SHA-1) */
+    JS_HASH_SHA512T,    /* SHA-512/t: SHA-512 with its own IV, truncated */
+    JS_HASH_KECCAK,     /* SHA-3 and SHAKE (crypto_hash.c's Keccak) */
 } JSHashKind;
 
+/* BoringSSL's hash contexts (plain structs: a copy is a copy of the hash) */
+typedef union JSHashState {
+    MD5_CTX    md5;
+    SHA_CTX    sha1;
+    SHA256_CTX sha256;
+    SHA512_CTX sha512;
+    struct { MD5_CTX md5; SHA_CTX sha1; } md5sha1;
+} JSHashState;
+
+/* A BoringSSL hash: its functions over JSHashState */
+typedef struct JSHashImpl {
+    void (*init)(JSHashState *s);
+    void (*update)(JSHashState *s, const void *p, size_t n);
+    void (*final)(JSHashState *s, uint8_t *out);
+} JSHashImpl;
+
 typedef struct JSHashAlg {
     const char          *name;       /* Node's canonical name: "sha256" */
     const char          *web;        /* Web Crypto's: "SHA-256", or NULL */
@@ -26,10 +46,10 @@ typedef struct JSHashAlg {
     bool                 xof;        /* SHAKE: any output length */
     uint16_t             out_len;    /* digest bytes (SHAKE: the default output length) */
     uint16_t             block_len;  /* HMAC's block (Keccak: the rate) */
-    const br_hash_class *br;         /* JS_HASH_BEARSSL */
+    const JSHashImpl    *impl;       /* JS_HASH_BORINGSSL */
     const uint64_t      *iv;         /* JS_HASH_SHA512T */
     uint8_t              suffix;     /* JS_HASH_KECCAK: 0x06 SHA-3, 0x1F SHAKE */
-    /* the DER of its AlgorithmIdentifier's OID (PKCS#1 v1.5 signatures), or NULL */
+    /* its OID (PKCS#1 v1.5 signatures' DigestInfo): the length, then the bytes; or NULL */
     const unsigned char *oid;
 } JSHashAlg;
 
@@ -42,8 +62,8 @@ typedef struct JSKeccak {
 typedef struct JSHashCtx {
     const JSHashAlg *alg;
     union {
-        br_hash_compat_context br;
-        JSKeccak               keccak;
+        JSHashState hash;
+        JSKeccak    keccak;
     } u;
 } JSHashCtx;
 
@@ -136,12 +156,9 @@ typedef struct JSCipherCtx {
     bool     encrypt, padding;
     uint8_t  state;            /* JS_CIPHER_INIT, … */
     uint8_t  blk;              /* the block cipher's block: 16, or 8 for DES */
-    union { const br_block_cbcenc_class *vtable; br_aes_gen_cbcenc_keys aes; br_des_gen_cbcenc_keys des; } enc;
-    union { const br_block_cbcdec_class *vtable; br_aes_gen_cbcdec_keys aes; br_des_gen_cbcdec_keys des; } dec;
-    br_aes_gen_ctr_keys    ctr;     /* GCM's */
-    br_aes_gen_ctrcbc_keys ctrcbc;  /* CCM's */
-    br_gcm_context gcm;
-    br_ccm_context ccm;
+    AES_KEY  aes_enc, aes_dec;
+    DES_key_schedule des[3];
+    struct evp_cipher_ctx_st *gcm;  /* BoringSSL's GCM (an EVP_CIPHER_CTX) */
     uint8_t  key[32];          /* ChaCha20's */
     uint8_t  iv[16];           /* the chaining value, counter or feedback register; key wrap's IV */
     uint8_t  nonce[16];        /* CCM's and ChaCha20's */
@@ -175,7 +192,7 @@ bool js_aes_ctr_masked(const uint8_t *key, size_t key_len, const uint8_t counter
 
 /* ---- Random bytes ------------------------------------------------------------------------------ */
 
-/* Cryptographically secure: an HMAC_DRBG (SHA-256) seeded from the system's entropy. */
+/* Cryptographically secure: BoringSSL's RAND_bytes (the system's entropy, then its DRBG). */
 void js_crypto_random(void *out, size_t n);
 
 /* Constant time over n bytes: whether they're equal. */
@@ -185,12 +202,20 @@ bool js_crypto_equal(const uint8_t *a, const uint8_t *b, size_t n);
 
 typedef enum JSKeyType { JS_KEY_SECRET, JS_KEY_PUBLIC, JS_KEY_PRIVATE } JSKeyType;
 
-typedef enum JSAsymKind { JS_ASYM_NONE, JS_ASYM_RSA, JS_ASYM_RSA_PSS, JS_ASYM_EC, JS_ASYM_X25519 } JSAsymKind;
+typedef enum JSAsymKind {
+    JS_ASYM_NONE, JS_ASYM_RSA, JS_ASYM_RSA_PSS, JS_ASYM_EC, JS_ASYM_X25519, JS_ASYM_ED25519, JS_ASYM_DH, JS_ASYM_DSA,
+} JSAsymKind;
+
+/* The curves, by their TLS group numbers (Ed25519 by its signature scheme's) */
+enum { JS_EC_P256 = 23, JS_EC_P384 = 24, JS_EC_P521 = 25, JS_EC_X25519 = 29, JS_EC_ED25519 = 0x0807 };
 
 /* The parts of an asymmetric key, by index: RSA's integers (big-endian, minimal), an EC or X25519
  * key's public point (uncompressed for EC) and private scalar. */
 enum { JS_RSA_N, JS_RSA_E, JS_RSA_D, JS_RSA_P, JS_RSA_Q, JS_RSA_DP, JS_RSA_DQ, JS_RSA_QI, JS_KEY_PARTS };
 enum { JS_EC_PUB, JS_EC_PRIV };
+/* finite-field Diffie-Hellman's and DSA's: the parameters, then the keys */
+enum { JS_DH_P, JS_DH_G, JS_DH_PUB, JS_DH_PRIV };
+enum { JS_DSA_P, JS_DSA_Q, JS_DSA_G, JS_DSA_PUB, JS_DSA_PRIV };
 
 typedef struct JSKeyPart {
     uint8_t *p;
@@ -206,7 +231,7 @@ typedef struct JSKeyData {
     uint8_t  *bytes;    /* a secret key's */
     size_t    len;
     JSKeyPart part[JS_KEY_PARTS];
-    int       curve;    /* EC and X25519: BR_EC_* */
+    int       curve;    /* EC and X25519: JS_EC_* */
     /* RSA-PSS keys restricted to parameters (their AlgorithmIdentifier has them) */
     bool             pss_params;
     const JSHashAlg *pss_hash, *pss_mgf1;
@@ -226,24 +251,22 @@ enum { JS_KEY_ENC_SPKI, JS_KEY_ENC_PKCS1, JS_KEY_ENC_PKCS8, JS_KEY_ENC_SEC1, JS_
 int js_key_parse_der(JSContext *ctx, const uint8_t *p, size_t n, int enc, bool priv, JSValue *out);
 int js_key_export_der(const JSKeyData *k, int enc, JSBytesOut *o);
 /* A key from its parts (RSA's integers; EC's uncompressed point and scalar; X25519's): only the
- * public ones when !priv; an EC curve as BR_EC_*. */
+ * public ones when !priv; an EC curve as JS_EC_*. */
 int js_key_from_parts(JSContext *ctx, int kind, bool priv, int curve, const JSKeyPart parts[JS_KEY_PARTS], JSValue *out);
 int js_ec_curve_by_jwk(const char *crv);
 /* The public key of a private one (a new handle). */
 JSValue js_key_public(JSContext *ctx, JSValue private_key);
-/* New private keys: 0, or an error code (5: parameters BearSSL rejects). */
+/* New private keys: 0, or an error code (5: parameters BoringSSL rejects). */
 int js_key_generate_rsa(JSContext *ctx, bool pss, uint32_t bits, uint32_t e, JSValue *out);
 int js_key_generate_ec(JSContext *ctx, int curve, JSValue *out);
+/* DSA parameters of L and N bits, and a key: 0, or an error code. */
+int js_key_generate_dsa(JSContext *ctx, uint32_t l, uint32_t n, JSValue *out);
 const char *js_ec_curve_jwk(int curve);
-/* An EC or X25519 private scalar in BearSSL's byte order (out: the scalar's length). */
-void js_ec_scalar_for_bearssl(const JSKeyData *k, uint8_t *out);
-/* A cryptographically secure PRNG for BearSSL's key generation (crypto_hash.c's DRBG). */
-const br_prng_class **js_crypto_prng(void);
 
 /* Web Crypto's key algorithms */
 typedef enum JSWebAlg {
     JS_WEB_HMAC = 1, JS_WEB_PBKDF2, JS_WEB_HKDF, JS_WEB_AES_CTR, JS_WEB_AES_CBC, JS_WEB_AES_GCM, JS_WEB_AES_KW,
-    JS_WEB_RSASSA, JS_WEB_RSA_PSS, JS_WEB_RSA_OAEP, JS_WEB_ECDSA, JS_WEB_ECDH, JS_WEB_X25519,
+    JS_WEB_RSASSA, JS_WEB_RSA_PSS, JS_WEB_RSA_OAEP, JS_WEB_ECDSA, JS_WEB_ECDH, JS_WEB_X25519, JS_WEB_ED25519,
 } JSWebAlg;
 
 /* KeyUsage, as bits in this order */
@@ -277,9 +300,13 @@ enum { JS_RSA_PUBLIC_ENCRYPT, JS_RSA_PRIVATE_DECRYPT, JS_RSA_PRIVATE_ENCRYPT, JS
 /* why an operation failed (each one of Node's errors) */
 enum {
     JS_ASYM_ERR_KEY_TYPE = 1, JS_ASYM_ERR_DIGEST, JS_ASYM_ERR_FAILED, JS_ASYM_ERR_SALT, JS_ASYM_ERR_TOO_LARGE, JS_ASYM_ERR_TOO_SMALL,
-    JS_ASYM_ERR_OAEP, JS_ASYM_ERR_PADDING, JS_ASYM_ERR_POINT, JS_ASYM_ERR_CURVE,
+    JS_ASYM_ERR_OAEP, JS_ASYM_ERR_PADDING, JS_ASYM_ERR_POINT, JS_ASYM_ERR_CURVE, JS_ASYM_ERR_UNSUPPORTED,
 };
 
+/* Ed25519 signs messages, not digests: a 64-byte signature. 0, or an error. */
+int js_ed25519_sign(const JSKeyData *k, const uint8_t *msg, size_t n, uint8_t sig[64]);
+int js_ed25519_verify(const JSKeyData *k, const uint8_t *msg, size_t n, const uint8_t *sig, size_t sig_len, bool *valid);
+
 /* A signature of a digest (alg->out_len bytes) into out (malloc'd). 0, or an error. */
 int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
                  JSBytesOut *out);
@@ -290,6 +317,8 @@ int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_
 /* The shared secret of a private key and a peer's point (any encoding for EC). */
 int js_ecdh(const JSKeyData *k, const uint8_t *peer, size_t peer_len, uint8_t *secret, size_t *secret_len);
 int js_ec_curve_by_name(const char *name);
+/* A private scalar's public point (EC: uncompressed) or X25519's public value: false when it isn't one. */
+bool js_ec_public_of(int curve, const uint8_t *scalar, size_t n, uint8_t *out, size_t *out_len);
 size_t js_ec_field_size(int curve);
 bool js_ec_point_uncompressed(int curve, const uint8_t *in, size_t n, uint8_t *out);
 size_t js_ec_point_format(int curve, const uint8_t *point, int format, uint8_t *out);

package/runtime/src/crypto_pkey.c

@@ -1,11 +1,19 @@
 /* Asymmetric keys (ADR 0018): RSA, RSA-PSS, EC (P-256, P-384, P-521) and X25519 keys in the key
  * record (crypto_internal.h), their DER encodings (SPKI, PKCS#8, PKCS#1, SEC1, and the public key
  * of an X.509 certificate) with a small DER reader and writer of our own, and their generation on
- * BearSSL. node:crypto's KeyObject is built on the primitives at the end; Web Crypto's keys share
+ * BoringSSL. node:crypto's KeyObject is built on the primitives at the end; Web Crypto's keys share
  * the record. PEM and JWK are the prelude's (base64 in JS), over the DER and the parts here. */
 #include <stdlib.h>
 #include <string.h>
 
+#include <openssl/bn.h>
+#include <openssl/curve25519.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/err.h>
+#include <openssl/nid.h>
+#include <openssl/rsa.h>
+
 #include "builtins_util.h"
 #include "crypto_internal.h"
 #include "internal.h"
@@ -145,18 +153,21 @@ static const uint8_t OID_RSA_PSS[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01,
 static const uint8_t OID_MGF1[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x08 };
 static const uint8_t OID_EC[] = { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01 };
 static const uint8_t OID_X25519[] = { 0x2B, 0x65, 0x6E };
+static const uint8_t OID_ED25519[] = { 0x2B, 0x65, 0x70 };
+static const uint8_t OID_DH[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x03, 0x01 };
+static const uint8_t OID_DSA[] = { 0x2A, 0x86, 0x48, 0xCE, 0x38, 0x04, 0x01 };
 
 static const struct {
-    int            curve;      /* BR_EC_* */
+    int            curve;      /* JS_EC_* */
     const char    *name;       /* Node's (OpenSSL's) */
     const char    *jwk;        /* JWK's crv */
     uint8_t        size;       /* bytes of a coordinate or scalar */
     uint8_t        oid_len;
     const uint8_t *oid;
 } CURVES[] = {
-    { BR_EC_secp256r1, "prime256v1", "P-256", 32, 8, (const uint8_t *)"\x2A\x86\x48\xCE\x3D\x03\x01\x07" },
-    { BR_EC_secp384r1, "secp384r1", "P-384", 48, 5, (const uint8_t *)"\x2B\x81\x04\x00\x22" },
-    { BR_EC_secp521r1, "secp521r1", "P-521", 66, 5, (const uint8_t *)"\x2B\x81\x04\x00\x23" },
+    { JS_EC_P256, "prime256v1", "P-256", 32, 8, (const uint8_t *)"\x2A\x86\x48\xCE\x3D\x03\x01\x07" },
+    { JS_EC_P384, "secp384r1", "P-384", 48, 5, (const uint8_t *)"\x2B\x81\x04\x00\x22" },
+    { JS_EC_P521, "secp521r1", "P-521", 66, 5, (const uint8_t *)"\x2B\x81\x04\x00\x23" },
 };
 
 static int curve_index(int curve) {
@@ -186,7 +197,7 @@ static const JSHashAlg *hash_by_oid(Der oid) {
 enum {
     KEY_ERR_DECODE = 1,   /* not a key the decoder takes: "DECODER routines::unsupported" */
     KEY_ERR_TAG,          /* bad DER: "asn1 encoding routines::wrong tag" */
-    KEY_ERR_KEY_TYPE,     /* a key type BearSSL doesn't have (Ed25519, DSA, …) */
+    KEY_ERR_KEY_TYPE,     /* a key type not provided (Ed25519, DSA, …) */
     KEY_ERR_ENCODING,     /* an encoding the key's type can't have (pkcs1 of an EC key) */
     KEY_ERR_GENERATE,     /* parameters key generation rejects */
 };
@@ -204,23 +215,34 @@ static void set_part_fixed(JSKeyData *k, int i, const uint8_t *p, size_t n, size
     js_key_part_set(&k->part[i], buf, size);
 }
 
-/* A private scalar as BearSSL takes it: X25519's reversed (BearSSL reads Curve25519 scalars
- * big-endian; RFC 7748, OpenSSL and Node keep them little-endian, as the key record does). */
-void js_ec_scalar_for_bearssl(const JSKeyData *k, uint8_t *out) {
-    const JSKeyPart *x = &k->part[JS_EC_PRIV];
-    for (size_t i = 0; i < x->n; i++) out[i] = k->curve == BR_EC_curve25519 ? x->p[x->n - 1 - i] : x->p[i];
+/* A finite-field key's public value from the private one: y = g^x mod p */
+static bool ff_compute_pub(JSKeyData *k) {
+    bool dh = k->kind == JS_ASYM_DH;
+    const JSKeyPart *p = &k->part[dh ? JS_DH_P : JS_DSA_P], *g = &k->part[dh ? JS_DH_G : JS_DSA_G], *x = &k->part[dh ? JS_DH_PRIV : JS_DSA_PRIV];
+    if (!p->p || !g->p || !x->p) return false;
+    BIGNUM *bp = BN_bin2bn(p->p, p->n, NULL), *bg = BN_bin2bn(g->p, g->n, NULL), *bx = BN_bin2bn(x->p, x->n, NULL), *y = BN_new();
+    BN_CTX *bc = BN_CTX_new();
+    bool ok = bp && bg && bx && y && bc && BN_is_odd(bp) && BN_mod_exp_mont_consttime(y, bg, bx, bp, bc, NULL);
+    if (ok) {
+        size_t n = BN_num_bytes(y);
+        uint8_t *buf = malloc(n ? n : 1);
+        if (!buf) js_fatal("out of memory in crypto");
+        if (n == 0) buf[0] = 0, n = 1;
+        else BN_bn2bin(y, buf);
+        js_key_part_set(&k->part[dh ? JS_DH_PUB : JS_DSA_PUB], buf, n);
+        free(buf);
+    }
+    BN_free(bp), BN_free(bg), BN_clear_free(bx), BN_free(y), BN_CTX_free(bc);
+    ERR_clear_error();
+    return ok;
 }
 
-/* The EC public point from the private scalar. */
+/* The EC public point (or X25519 public value) from the private scalar. */
 static bool ec_compute_pub(JSKeyData *k) {
-    uint8_t scalar[66];
-    js_ec_scalar_for_bearssl(k, scalar);
-    br_ec_private_key sk = { k->curve, scalar, k->part[JS_EC_PRIV].n };
-    uint8_t pub[BR_EC_KBUF_PUB_MAX_SIZE];
-    br_ec_public_key pk;
-    size_t n = br_ec_compute_pub(br_ec_get_default(), &pk, pub, &sk);
-    if (!n) return false;
-    js_key_part_set(&k->part[JS_EC_PUB], pk.q, pk.qlen);
+    uint8_t pub[133];
+    size_t n;
+    if (!js_ec_public_of(k->curve, k->part[JS_EC_PRIV].p, k->part[JS_EC_PRIV].n, pub, &n)) return false;
+    js_key_part_set(&k->part[JS_EC_PUB], pub, n);
     return true;
 }
 
@@ -263,7 +285,21 @@ static int algorithm_identifier(JSKeyData *k, Der alg_seq) {
         if (k->curve < 0) return KEY_ERR_KEY_TYPE;
     } else if (der_oid_is(oid, OID_X25519, sizeof OID_X25519)) {
         k->kind = JS_ASYM_X25519;
-        k->curve = BR_EC_curve25519;
+        k->curve = JS_EC_X25519;
+    } else if (der_oid_is(oid, OID_ED25519, sizeof OID_ED25519)) {
+        k->kind = JS_ASYM_ED25519;
+        k->curve = JS_EC_ED25519;
+    } else if (der_oid_is(oid, OID_DH, sizeof OID_DH) || der_oid_is(oid, OID_DSA, sizeof OID_DSA)) {
+        /* DHParameter (PKCS#3: p, g[, privateValueLength]) or Dss-Parms (p, q, g) */
+        bool dh = oid.n == sizeof OID_DH;
+        Der params, v;
+        k->kind = dh ? JS_ASYM_DH : JS_ASYM_DSA;
+        if (!der_expect(&alg_seq, DER_SEQ, &params)) return KEY_ERR_TAG;
+        int n = dh ? 2 : 3;
+        for (int i = 0; i < n; i++) {
+            if (!der_uint(&params, &v)) return KEY_ERR_TAG;
+            set_part(k, i, v);
+        }
     } else {
         return KEY_ERR_KEY_TYPE;
     }
@@ -320,7 +356,13 @@ static int spki(JSKeyData *k, Der in) {
     if (!der_expect(&seq, DER_BIT_STRING, &bits) || bits.n < 1 || bits.p[0] != 0) return KEY_ERR_TAG;
     Der key = { bits.p + 1, bits.n - 1 };
     if (k->kind == JS_ASYM_RSA || k->kind == JS_ASYM_RSA_PSS) return rsa_public(k, key);
-    if (k->kind == JS_ASYM_X25519 && key.n != 32) return KEY_ERR_TAG;
+    if (k->kind == JS_ASYM_DH || k->kind == JS_ASYM_DSA) {
+        Der y;
+        if (!der_uint(&key, &y)) return KEY_ERR_TAG;
+        set_part(k, k->kind == JS_ASYM_DH ? JS_DH_PUB : JS_DSA_PUB, y);
+        return 0;
+    }
+    if ((k->kind == JS_ASYM_X25519 || k->kind == JS_ASYM_ED25519) && key.n != 32) return KEY_ERR_TAG;
     if (k->kind == JS_ASYM_EC && (key.n != 1 + 2u * CURVES[curve_index(k->curve)].size || key.p[0] != 4)) return KEY_ERR_TAG;
     js_key_part_set(&k->part[JS_EC_PUB], key.p, key.n);
     return 0;
@@ -340,6 +382,13 @@ static int pkcs8(JSKeyData *k, Der in) {
         return rsa_private(k, priv);
     case JS_ASYM_EC:
         return ec_private(k, priv);
+    case JS_ASYM_DH:
+    case JS_ASYM_DSA: {
+        Der x;
+        if (!der_uint(&priv, &x)) return KEY_ERR_TAG;
+        set_part(k, k->kind == JS_ASYM_DH ? JS_DH_PRIV : JS_DSA_PRIV, x);
+        return ff_compute_pub(k) ? 0 : KEY_ERR_TAG;
+    }
     default: {
         Der scalar;
         if (!der_expect(&priv, DER_OCTET_STRING, &scalar) || scalar.n != 32) return KEY_ERR_TAG;
@@ -409,6 +458,18 @@ static void w_algorithm(JSBytesOut *o, const JSKeyData *k) {
         w_tlv(&a, DER_OID, CURVES[ci].oid, CURVES[ci].oid_len);
         break;
     }
+    case JS_ASYM_ED25519:
+        w_tlv(&a, DER_OID, OID_ED25519, sizeof OID_ED25519);
+        break;
+    case JS_ASYM_DH:
+    case JS_ASYM_DSA: {
+        bool dh = k->kind == JS_ASYM_DH;
+        JSBytesOut p = { 0 };
+        w_tlv(&a, DER_OID, dh ? OID_DH : OID_DSA, dh ? sizeof OID_DH : sizeof OID_DSA);
+        for (int i = 0; i < (dh ? 2 : 3); i++) w_uint(&p, k->part[i].p, k->part[i].n);
+        w_wrap(&a, DER_SEQ, &p);
+        break;
+    }
     default:
         w_tlv(&a, DER_OID, OID_X25519, sizeof OID_X25519);
         break;
@@ -456,6 +517,8 @@ static void w_spki(JSBytesOut *o, const JSKeyData *k) {
     static const uint8_t unused = 0;
     w_raw(&key, &unused, 1);
     if (k->kind == JS_ASYM_RSA || k->kind == JS_ASYM_RSA_PSS) w_rsa_public(&key, k);
+    else if (k->kind == JS_ASYM_DH) w_uint(&key, k->part[JS_DH_PUB].p, k->part[JS_DH_PUB].n);
+    else if (k->kind == JS_ASYM_DSA) w_uint(&key, k->part[JS_DSA_PUB].p, k->part[JS_DSA_PUB].n);
     else w_raw(&key, k->part[JS_EC_PUB].p, k->part[JS_EC_PUB].n);
     w_tlv(&s, DER_BIT_STRING, key.p, key.n);
     free(key.p);
@@ -468,13 +531,15 @@ static void w_pkcs8(JSBytesOut *o, const JSKeyData *k) {
     w_algorithm(&s, k);
     if (k->kind == JS_ASYM_RSA || k->kind == JS_ASYM_RSA_PSS) w_rsa_private(&priv, k);
     else if (k->kind == JS_ASYM_EC) w_ec_private(&priv, k, false);
+    else if (k->kind == JS_ASYM_DH) w_uint(&priv, k->part[JS_DH_PRIV].p, k->part[JS_DH_PRIV].n);
+    else if (k->kind == JS_ASYM_DSA) w_uint(&priv, k->part[JS_DSA_PRIV].p, k->part[JS_DSA_PRIV].n);
     else w_tlv(&priv, DER_OCTET_STRING, k->part[JS_EC_PRIV].p, k->part[JS_EC_PRIV].n);
     w_wrap(&s, DER_OCTET_STRING, &priv);
     w_wrap(o, DER_SEQ, &s);
 }
 
-/* BearSSL's limit on RSA moduli (its private BR_MAX_RSA_SIZE) */
-#define RSA_MAX_BITS 4096
+/* the largest RSA key generated (OpenSSL's limit) */
+#define RSA_MAX_BITS 16384
 
 /* ---- The handle's primitives -------------------------------------------------------------------- */
 
@@ -551,7 +616,7 @@ PRIMITIVE(js_crypto_key_export) {
     return r;
 }
 
-static const char *const KINDS[] = { NULL, "rsa", "rsa-pss", "ec", "x25519" };
+static const char *const KINDS[] = { NULL, "rsa", "rsa-pss", "ec", "x25519", "ed25519", "dh", "dsa" };
 
 /* cryptoKeyInfo(handle): [type, asymmetricKeyType, namedCurve, pss], pss [hash, mgf1, salt] or null. */
 PRIMITIVE(js_crypto_key_info) {
@@ -595,16 +660,17 @@ int js_key_from_parts(JSContext *ctx, int kind, bool priv, int curve, const JSKe
     *out = js_object_value(&k->obj);
     for (int i = 0; i < JS_KEY_PARTS; i++)
         if (parts[i].p) js_key_part_set(&k->part[i], parts[i].p, parts[i].n);
-    if (kind == JS_ASYM_RSA) {
+    if (kind == JS_ASYM_RSA || kind == JS_ASYM_DH || kind == JS_ASYM_DSA) {
         for (int i = 0; i < JS_KEY_PARTS; i++) {  /* minimal integers */
             JSKeyPart *pt = &k->part[i];
             size_t z = 0;
             while (pt->p && z + 1 < pt->n && pt->p[z] == 0) z++;
             if (z) memmove(pt->p, pt->p + z, pt->n -= z);
         }
+        if (kind != JS_ASYM_RSA && priv && !k->part[kind == JS_ASYM_DH ? JS_DH_PUB : JS_DSA_PUB].p && !ff_compute_pub(k)) return KEY_ERR_TAG;
         return 0;
     }
-    k->curve = kind == JS_ASYM_X25519 ? BR_EC_curve25519 : curve;
+    k->curve = kind == JS_ASYM_X25519 ? JS_EC_X25519 : kind == JS_ASYM_ED25519 ? JS_EC_ED25519 : curve;
     if (kind == JS_ASYM_EC) {
         int ci = curve_index(curve);
         if (ci < 0) return KEY_ERR_KEY_TYPE;
@@ -643,7 +709,8 @@ PRIMITIVE(js_crypto_key_from_parts) {
         size_t n;
         if (js_buffer_source_bytes(v, &p, &n)) got[i].p = p, got[i].n = n;
     }
-    int k = strcmp(kind, "rsa") == 0 ? JS_ASYM_RSA : strcmp(kind, "x25519") == 0 ? JS_ASYM_X25519 : JS_ASYM_EC;
+    int k = strcmp(kind, "rsa") == 0 ? JS_ASYM_RSA : strcmp(kind, "x25519") == 0 ? JS_ASYM_X25519 : strcmp(kind, "ed25519") == 0 ? JS_ASYM_ED25519
+          : strcmp(kind, "dh") == 0 ? JS_ASYM_DH : strcmp(kind, "dsa") == 0 ? JS_ASYM_DSA : JS_ASYM_EC;
     JSValue key;
     int e = js_key_from_parts(ctx, k, js_truthy(ARG(1)), js_ec_curve_by_jwk(curve), got, &key);
     return e ? js_int32(e) : key;
@@ -658,6 +725,9 @@ JSValue js_key_public(JSContext *ctx, JSValue private_key) {
     if (src->kind == JS_ASYM_RSA || src->kind == JS_ASYM_RSA_PSS) {
         js_key_part_set(&k->part[JS_RSA_N], src->part[JS_RSA_N].p, src->part[JS_RSA_N].n);
         js_key_part_set(&k->part[JS_RSA_E], src->part[JS_RSA_E].p, src->part[JS_RSA_E].n);
+    } else if (src->kind == JS_ASYM_DH || src->kind == JS_ASYM_DSA) {  /* the parameters and the public key */
+        int n = src->kind == JS_ASYM_DH ? JS_DH_PRIV : JS_DSA_PRIV;
+        for (int i = 0; i < n; i++) js_key_part_set(&k->part[i], src->part[i].p, src->part[i].n);
     } else {
         js_key_part_set(&k->part[JS_EC_PUB], src->part[JS_EC_PUB].p, src->part[JS_EC_PUB].n);
     }
@@ -704,52 +774,111 @@ PRIMITIVE(js_crypto_key_secret_bytes) {
 
 int js_key_generate_rsa(JSContext *ctx, bool pss, uint32_t bits, uint32_t e, JSValue *out) {
     if (bits < 512 || bits > RSA_MAX_BITS || e < 3 || !(e & 1)) return KEY_ERR_GENERATE;
-    uint8_t *kpriv = malloc(BR_RSA_KBUF_PRIV_SIZE(RSA_MAX_BITS)), *kpub = malloc(BR_RSA_KBUF_PUB_SIZE(RSA_MAX_BITS));
-    uint8_t *d = malloc(RSA_MAX_BITS / 8);
-    if (!kpriv || !kpub || !d) js_fatal("out of memory in crypto");
-    br_rsa_private_key sk;
-    br_rsa_public_key pk;
-    bool ok = br_rsa_keygen_get_default()(js_crypto_prng(), &sk, kpriv, &pk, kpub, bits, e);
-    size_t dn = ok ? br_rsa_compute_privexp_get_default()(d, &sk, e) : 0;
+    RSA *r = RSA_new();
+    BIGNUM *be = BN_new();
     int err = KEY_ERR_GENERATE;
-    if (ok && dn) {
+    if (r && be && BN_set_word(be, e) && RSA_generate_key_ex(r, (int)bits, be, NULL)) {
         JSKeyData *k = js_new_asym_key(ctx, JS_KEY_PRIVATE, pss ? JS_ASYM_RSA_PSS : JS_ASYM_RSA);
-        const uint8_t *parts[8] = { pk.n, pk.e, d, sk.p, sk.q, sk.dp, sk.dq, sk.iq };
-        size_t lens[8] = { pk.nlen, pk.elen, dn, sk.plen, sk.qlen, sk.dplen, sk.dqlen, sk.iqlen };
+        const BIGNUM *parts[8] = {
+            RSA_get0_n(r), RSA_get0_e(r), RSA_get0_d(r), RSA_get0_p(r), RSA_get0_q(r), RSA_get0_dmp1(r), RSA_get0_dmq1(r), RSA_get0_iqmp(r),
+        };
+        uint8_t *buf = malloc(RSA_MAX_BITS / 8 + 1);
+        if (!buf) js_fatal("out of memory in crypto");
         for (int i = 0; i < 8; i++) {
-            const uint8_t *p = parts[i];
-            size_t n = lens[i];
-            while (n > 1 && p[0] == 0) p++, n--;
-            js_key_part_set(&k->part[i], p, n);
+            size_t n = BN_bn2bin(parts[i], buf);
+            if (n == 0) buf[0] = 0, n = 1;
+            js_key_part_set(&k->part[i], buf, n);
         }
+        memset(buf, 0, RSA_MAX_BITS / 8 + 1);
+        free(buf);
         *out = js_object_value(&k->obj);
         err = 0;
     }
-    memset(kpriv, 0, BR_RSA_KBUF_PRIV_SIZE(RSA_MAX_BITS));
-    memset(d, 0, RSA_MAX_BITS / 8);
-    free(kpriv), free(kpub), free(d);
+    BN_free(be);
+    RSA_free(r);
+    ERR_clear_error();
     return err;
 }
 
 int js_key_generate_ec(JSContext *ctx, int curve, JSValue *out) {
-    uint8_t kbuf[BR_EC_KBUF_PRIV_MAX_SIZE];
-    br_ec_private_key sk;
-    if (curve != BR_EC_curve25519 && curve_index(curve) < 0) return KEY_ERR_GENERATE;
-    if (!br_ec_keygen(js_crypto_prng(), br_ec_get_default(), &sk, kbuf, curve)) return KEY_ERR_GENERATE;
-    JSKeyData *k = js_new_asym_key(ctx, JS_KEY_PRIVATE, curve == BR_EC_curve25519 ? JS_ASYM_X25519 : JS_ASYM_EC);
+    if (curve != JS_EC_X25519 && curve != JS_EC_ED25519 && curve_index(curve) < 0) return KEY_ERR_GENERATE;
+    JSKeyData *k = js_new_asym_key(ctx, JS_KEY_PRIVATE, curve == JS_EC_X25519 ? JS_ASYM_X25519 : curve == JS_EC_ED25519 ? JS_ASYM_ED25519 : JS_ASYM_EC);
     k->curve = curve;
-    if (curve == BR_EC_curve25519) {  /* stored little-endian (js_ec_scalar_for_bearssl) */
-        for (size_t i = 0; i < sk.xlen / 2; i++) {
-            unsigned char t = sk.x[i];
-            sk.x[i] = sk.x[sk.xlen - 1 - i];
-            sk.x[sk.xlen - 1 - i] = t;
+    if (curve == JS_EC_ED25519) {
+        uint8_t pub[32], priv[64];
+        ED25519_keypair(pub, priv);
+        js_key_part_set(&k->part[JS_EC_PRIV], priv, 32);  /* the seed */
+        js_key_part_set(&k->part[JS_EC_PUB], pub, 32);
+        memset(priv, 0, sizeof priv);
+        *out = js_object_value(&k->obj);
+        return 0;
+    }
+    if (curve == JS_EC_X25519) {
+        uint8_t pub[32], priv[32];
+        X25519_keypair(pub, priv);
+        js_key_part_set(&k->part[JS_EC_PRIV], priv, 32);
+        js_key_part_set(&k->part[JS_EC_PUB], pub, 32);
+        memset(priv, 0, sizeof priv);
+        *out = js_object_value(&k->obj);
+        return 0;
+    }
+    int nid = curve == JS_EC_P256 ? NID_X9_62_prime256v1 : curve == JS_EC_P384 ? NID_secp384r1 : NID_secp521r1;
+    EC_KEY *key = EC_KEY_new_by_curve_name(nid);
+    int err = KEY_ERR_GENERATE;
+    if (key && EC_KEY_generate_key(key)) {
+        size_t fs = CURVES[curve_index(curve)].size;
+        uint8_t priv[66];
+        BN_bn2bin_padded(priv, fs, EC_KEY_get0_private_key(key));
+        js_key_part_set(&k->part[JS_EC_PRIV], priv, fs);
+        memset(priv, 0, sizeof priv);
+        if (ec_compute_pub(k)) {
+            *out = js_object_value(&k->obj);
+            err = 0;
         }
     }
-    js_key_part_set(&k->part[JS_EC_PRIV], sk.x, sk.xlen);
-    memset(kbuf, 0, sizeof kbuf);
-    if (!ec_compute_pub(k)) return KEY_ERR_GENERATE;
-    *out = js_object_value(&k->obj);
-    return 0;
+    EC_KEY_free(key);
+    ERR_clear_error();
+    return err;
+}
+
+/* DSA parameters of L and N bits (q prime of N bits, p prime of L bits with q dividing p − 1, g of
+ * order q), then a key: any (L, N), as OpenSSL's divisorLength allows */
+int js_key_generate_dsa(JSContext *ctx, uint32_t l, uint32_t n, JSValue *out) {
+    if (l < 512 || l > 10000 || n < 160 || n >= l) return KEY_ERR_GENERATE;
+    BIGNUM *q = BN_new(), *q2 = BN_new(), *one = BN_new(), *p = BN_new(), *e = BN_new(), *g = BN_new(), *h = BN_new(), *x = BN_new();
+    BN_CTX *bc = BN_CTX_new();
+    bool ok = q && q2 && one && p && e && g && h && x && bc && BN_one(one) &&
+              BN_generate_prime_ex(q, (int)n, 0, NULL, NULL, NULL) && BN_lshift1(q2, q) &&
+              BN_generate_prime_ex(p, (int)l, 0, q2, one, NULL);  /* p ≡ 1 (mod 2q) */
+    /* g = h^((p − 1)/q) mod p for the first h from 2 that gives more than 1 */
+    ok = ok && BN_sub(e, p, one) && BN_div(e, NULL, e, q, bc);
+    for (unsigned w = 2; ok; w++) {
+        ok = BN_set_word(h, w) && BN_mod_exp_mont(g, h, e, p, bc, NULL);
+        if (ok && !BN_is_one(g)) break;
+    }
+    /* x in [1, q − 1] */
+    ok = ok && BN_rand_range_ex(x, 1, q);
+    int err = KEY_ERR_GENERATE;
+    if (ok) {
+        JSKeyData *k = js_new_asym_key(ctx, JS_KEY_PRIVATE, JS_ASYM_DSA);
+        const BIGNUM *parts[4] = { p, q, g, NULL };
+        parts[3] = x;
+        int idx[4] = { JS_DSA_P, JS_DSA_Q, JS_DSA_G, JS_DSA_PRIV };
+        uint8_t *buf = malloc(l / 8 + 2);
+        if (!buf) js_fatal("out of memory in crypto");
+        for (int i = 0; i < 4; i++) {
+            size_t len = BN_bn2bin(parts[i], buf);
+            js_key_part_set(&k->part[idx[i]], buf, len);
+        }
+        free(buf);
+        if (ff_compute_pub(k)) {
+            *out = js_object_value(&k->obj);
+            err = 0;
+        }
+    }
+    BN_free(q), BN_free(q2), BN_free(one), BN_free(p), BN_free(e), BN_free(g), BN_free(h), BN_clear_free(x), BN_CTX_free(bc);
+    ERR_clear_error();
+    return err;
 }
 
 /* cryptoKeyGenerate(kind, sizeOrCurve, publicExponent, pss): a private key handle, or
@@ -760,6 +889,12 @@ PRIMITIVE(js_crypto_key_generate) {
     if (!js_is_string(ARG(0))) return js_throw_type_error(ctx, "cryptoKeyGenerate: bad arguments");
     js_view_to_utf8(js_string_view(ctx, ARG(0)), kind, sizeof kind - 1);
     JSValue key;
+    if (strcmp(kind, "dsa") == 0) {  /* (L, N) */
+        double l = js_is_number(ARG(1)) ? js_as_number(ARG(1)) : 0, n = js_is_number(ARG(2)) ? js_as_number(ARG(2)) : 0;
+        if (l < 0 || l > 10000 || n < 0 || n > 10000) return js_int32(KEY_ERR_GENERATE);
+        int err = js_key_generate_dsa(ctx, (uint32_t)l, (uint32_t)n, &key);
+        return err ? js_int32(err) : key;
+    }
     if (strcmp(kind, "rsa") == 0 || strcmp(kind, "rsa-pss") == 0) {
         double bits = js_is_number(ARG(1)) ? js_as_number(ARG(1)) : 0, e = js_is_number(ARG(2)) ? js_as_number(ARG(2)) : 65537;
         if (bits < 0 || bits > RSA_MAX_BITS || e < 0 || e > 4294967295.0) return js_int32(KEY_ERR_GENERATE);
@@ -781,7 +916,9 @@ PRIMITIVE(js_crypto_key_generate) {
     }
     int curve = -1;
     if (strcmp(kind, "x25519") == 0) {
-        curve = BR_EC_curve25519;
+        curve = JS_EC_X25519;
+    } else if (strcmp(kind, "ed25519") == 0) {
+        curve = JS_EC_ED25519;
     } else {
         char name[24] = "";
         if (js_is_string(ARG(1))) js_view_to_utf8(js_string_view(ctx, ARG(1)), name, sizeof name - 1);