visaljs 0.0.2 → 0.0.4

package/runtime/src/crypto_asym.c

@@ -1,11 +1,24 @@
-/* Asymmetric operations (ADR 0018) on the key record: RSA signatures (PKCS#1 v1.5 on BearSSL, PSS
- * of our own so any hash works and a verifier can recover the salt length), ECDSA (BearSSL, DER
- * or IEEE P1363 signatures), RSA encryption (OAEP on BearSSL; PKCS#1 v1.5's paddings and raw RSA
- * ours), and key agreement (EC Diffie-Hellman and X25519), with point compression. The
- * primitives at the end serve node:crypto; Web Crypto calls the functions above them. */
+/* Asymmetric operations (ADR 0018) on the key record: RSA signatures (PKCS#1 v1.5 and PSS
+ * encodings of our own, so any hash works and a verifier can recover a PSS salt's length, over
+ * BoringSSL's raw RSA), ECDSA (BoringSSL; DER or IEEE P1363 signatures), RSA encryption (OAEP's
+ * and PKCS#1 v1.5's paddings ours), and key agreement (EC Diffie-Hellman and X25519), with point
+ * compression. The primitives at the end serve node:crypto; Web Crypto calls the functions above. */
 #include <stdlib.h>
 #include <string.h>
 
+#include <openssl/bn.h>
+#include <openssl/bytestring.h>
+#include <openssl/curve25519.h>
+#include <openssl/dsa.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/ecdh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+#include <openssl/nid.h>
+#include <openssl/rsa.h>
+
 #include "builtins_util.h"
 #include "crypto_internal.h"
 #include "internal.h"
@@ -17,7 +30,7 @@
 #include "jscontext.h"
 #include "jsstring.h"
 
-/* ---- Keys as BearSSL takes them ----------------------------------------------------------------- */
+/* ---- Keys as BoringSSL takes them --------------------------------------------------------------- */
 
 static size_t bit_length(const JSKeyPart *n) {
     size_t i = 0;
@@ -28,35 +41,82 @@ static size_t bit_length(const JSKeyPart *n) {
     return bits;
 }
 
-static br_rsa_public_key rsa_pk(const JSKeyData *k) {
-    br_rsa_public_key pk = { k->part[JS_RSA_N].p, k->part[JS_RSA_N].n, k->part[JS_RSA_E].p, k->part[JS_RSA_E].n };
-    return pk;
-}
-
-static br_rsa_private_key rsa_sk(const JSKeyData *k) {
-    br_rsa_private_key sk = {
-        (uint32_t)bit_length(&k->part[JS_RSA_N]),
-        k->part[JS_RSA_P].p, k->part[JS_RSA_P].n, k->part[JS_RSA_Q].p, k->part[JS_RSA_Q].n,
-        k->part[JS_RSA_DP].p, k->part[JS_RSA_DP].n, k->part[JS_RSA_DQ].p, k->part[JS_RSA_DQ].n,
-        k->part[JS_RSA_QI].p, k->part[JS_RSA_QI].n,
-    };
-    return sk;
-}
-
 static size_t rsa_size(const JSKeyData *k) { return (bit_length(&k->part[JS_RSA_N]) + 7) / 8; }
 
 static bool is_rsa(const JSKeyData *k) { return k->kind == JS_ASYM_RSA || k->kind == JS_ASYM_RSA_PSS; }
 
+static BIGNUM *bn_of(const JSKeyPart *p) { return p->p ? BN_bin2bn(p->p, p->n, NULL) : NULL; }
+
+/* The key as BoringSSL's RSA: its private half too with `priv` (any exponent, as OpenSSL takes) */
+static RSA *rsa_of(const JSKeyData *k, bool priv) {
+    BIGNUM *b[JS_KEY_PARTS];
+    for (int i = 0; i < JS_KEY_PARTS; i++) b[i] = bn_of(&k->part[i]);
+    RSA *r;
+    if (!priv) r = RSA_new_public_key_large_e(b[JS_RSA_N], b[JS_RSA_E]);
+    else if (b[JS_RSA_P] && b[JS_RSA_Q] && b[JS_RSA_DP] && b[JS_RSA_DQ] && b[JS_RSA_QI])
+        r = RSA_new_private_key_large_e(b[JS_RSA_N], b[JS_RSA_E], b[JS_RSA_D], b[JS_RSA_P], b[JS_RSA_Q], b[JS_RSA_DP], b[JS_RSA_DQ],
+                                        b[JS_RSA_QI]);
+    else r = RSA_new_private_key_no_crt(b[JS_RSA_N], b[JS_RSA_E], b[JS_RSA_D]);
+    for (int i = 0; i < JS_KEY_PARTS; i++) BN_clear_free(b[i]);
+    ERR_clear_error();
+    return r;
+}
+
 /* x ← x^e mod n, in place over the modulus's length */
 static bool rsa_public_op(const JSKeyData *k, uint8_t *x, size_t n) {
-    br_rsa_public_key pk = rsa_pk(k);
-    return br_rsa_public_get_default()(x, n, &pk) != 0;
+    RSA *r = rsa_of(k, false);
+    if (!r) return false;
+    uint8_t *out = malloc(n);
+    if (!out) js_fatal("out of memory in crypto");
+    size_t got;
+    bool ok = RSA_verify_raw(r, &got, out, n, x, n, RSA_NO_PADDING) && got == n;
+    if (ok) memcpy(x, out, n);
+    free(out);
+    RSA_free(r);
+    ERR_clear_error();
+    return ok;
 }
 
 /* x ← x^d mod n (CRT), in place */
 static bool rsa_private_op(const JSKeyData *k, uint8_t *x) {
-    br_rsa_private_key sk = rsa_sk(k);
-    return br_rsa_private_get_default()(x, &sk) != 0;
+    RSA *r = rsa_of(k, true);
+    if (!r) return false;
+    size_t n = rsa_size(k), got;
+    uint8_t *out = malloc(n);
+    if (!out) js_fatal("out of memory in crypto");
+    bool ok = RSA_sign_raw(r, &got, out, n, x, n, RSA_NO_PADDING) && got == n;
+    if (ok) memcpy(x, out, n);
+    memset(out, 0, n);
+    free(out);
+    RSA_free(r);
+    ERR_clear_error();
+    return ok;
+}
+
+static int ec_nid(int curve) {
+    return curve == JS_EC_P256 ? NID_X9_62_prime256v1 : curve == JS_EC_P384 ? NID_secp384r1 : curve == JS_EC_P521 ? NID_secp521r1 : NID_undef;
+}
+
+/* The key as BoringSSL's EC_KEY: its private scalar too with `priv` */
+static EC_KEY *ec_key_of(const JSKeyData *k, bool priv) {
+    EC_KEY *key = EC_KEY_new_by_curve_name(ec_nid(k->curve));
+    if (!key) return NULL;
+    const EC_GROUP *g = EC_KEY_get0_group(key);
+    EC_POINT *pt = EC_POINT_new(g);
+    bool ok = pt && k->part[JS_EC_PUB].p && EC_POINT_oct2point(g, pt, k->part[JS_EC_PUB].p, k->part[JS_EC_PUB].n, NULL) &&
+              EC_KEY_set_public_key(key, pt);
+    EC_POINT_free(pt);
+    if (ok && priv) {
+        BIGNUM *d = bn_of(&k->part[JS_EC_PRIV]);
+        ok = d && EC_KEY_set_private_key(key, d);
+        BN_clear_free(d);
+    }
+    ERR_clear_error();
+    if (!ok) {
+        EC_KEY_free(key);
+        return NULL;
+    }
+    return key;
 }
 
 /* ---- MGF1 (RFC 8017 B.2.1) ---------------------------------------------------------------------- */
@@ -149,17 +209,140 @@ static bool pss_verify(const JSKeyData *k, const JSHashAlg *h, const JSHashAlg *
     return ok;
 }
 
-/* BearSSL's class for a hash (ECDSA's nonce generation needs one), or NULL. */
-static const br_hash_class *bear_hash(const JSHashAlg *h) { return h->kind == JS_HASH_BEARSSL ? h->br : NULL; }
+/* EMSA-PKCS1-v1_5's T: the DigestInfo (with its NULL parameters, or without them) or, for
+ * MD5+SHA-1, the digest alone. Its length, or 0 for a hash without an OID. */
+static size_t digest_info(const JSHashAlg *h, const uint8_t *digest, bool with_null, uint8_t *t) {
+    size_t hl = h->out_len;
+    if (!h->oid) {
+        if (strcmp(h->name, "md5-sha1") != 0) return 0;
+        memcpy(t, digest, hl);
+        return hl;
+    }
+    size_t ol = h->oid[0], alg = 2 + ol + (with_null ? 2 : 0), n = 0;
+    t[n++] = 0x30, t[n++] = (uint8_t)(2 + alg + 2 + hl);
+    t[n++] = 0x30, t[n++] = (uint8_t)alg;
+    t[n++] = 0x06, t[n++] = (uint8_t)ol;
+    memcpy(t + n, h->oid + 1, ol), n += ol;
+    if (with_null) t[n++] = 0x05, t[n++] = 0x00;
+    t[n++] = 0x04, t[n++] = (uint8_t)hl;
+    memcpy(t + n, digest, hl);
+    return n + hl;
+}
+
+/* 00 01 FF … FF 00 T, over the modulus's length: false when T doesn't fit */
+static bool pkcs1_type1(uint8_t *em, size_t k_len, const uint8_t *t, size_t tl) {
+    if (tl + 11 > k_len) return false;
+    em[0] = 0, em[1] = 1;
+    memset(em + 2, 0xFF, k_len - tl - 3);
+    em[k_len - tl - 1] = 0;
+    memcpy(em + k_len - tl, t, tl);
+    return true;
+}
+
+/* The key as BoringSSL's DSA: its private value too with `priv` */
+static DSA *dsa_of(const JSKeyData *k, bool priv) {
+    DSA *d = DSA_new();
+    if (!d) return NULL;
+    BIGNUM *p = bn_of(&k->part[JS_DSA_P]), *q = bn_of(&k->part[JS_DSA_Q]), *g = bn_of(&k->part[JS_DSA_G]);
+    BIGNUM *y = bn_of(&k->part[JS_DSA_PUB]), *x = priv ? bn_of(&k->part[JS_DSA_PRIV]) : NULL;
+    if (!p || !q || !g || !y || (priv && !x) || !DSA_set0_pqg(d, p, q, g)) {
+        BN_free(p), BN_free(q), BN_free(g), BN_free(y), BN_clear_free(x);
+        DSA_free(d);
+        return NULL;
+    }
+    if (!DSA_set0_key(d, y, x)) {
+        BN_free(y), BN_clear_free(x);
+        DSA_free(d);
+        return NULL;
+    }
+    return d;
+}
 
-static br_ec_public_key ec_pk(const JSKeyData *k) {
-    br_ec_public_key pk = { k->curve, k->part[JS_EC_PUB].p, k->part[JS_EC_PUB].n };
-    return pk;
+/* (r, s) as DER (Dss-Sig-Value) or IEEE P1363 (r || s, each q's length) */
+static int dsa_sig_out(const BIGNUM *r, const BIGNUM *s, size_t qlen, bool p1363, JSBytesOut *out) {
+    if (p1363) {
+        out->p = malloc(2 * qlen);
+        if (!out->p) js_fatal("out of memory in crypto");
+        BN_bn2bin_padded(out->p, qlen, r);
+        BN_bn2bin_padded(out->p + qlen, qlen, s);
+        out->n = out->cap = 2 * qlen;
+        return 0;
+    }
+    CBB cbb, seq;
+    uint8_t *der;
+    size_t n;
+    if (!CBB_init(&cbb, 0) || !CBB_add_asn1(&cbb, &seq, CBS_ASN1_SEQUENCE) || !BN_marshal_asn1(&seq, r) || !BN_marshal_asn1(&seq, s) ||
+        !CBB_finish(&cbb, &der, &n)) {
+        CBB_cleanup(&cbb);
+        return JS_ASYM_ERR_FAILED;
+    }
+    out->p = malloc(n);
+    if (!out->p) js_fatal("out of memory in crypto");
+    memcpy(out->p, der, n);
+    out->n = out->cap = n;
+    OPENSSL_free(der);
+    return 0;
 }
 
+/* (r, s) from DER or P1363; false when it isn't one */
+static bool dsa_sig_in(const uint8_t *sig, size_t n, size_t qlen, bool p1363, BIGNUM **r, BIGNUM **s) {
+    *r = *s = NULL;
+    if (p1363) {
+        if (n != 2 * qlen) return false;
+        *r = BN_bin2bn(sig, qlen, NULL);
+        *s = BN_bin2bn(sig + qlen, qlen, NULL);
+        return *r && *s;
+    }
+    CBS cbs, seq;
+    CBS_init(&cbs, sig, n);
+    *r = BN_new();
+    *s = BN_new();
+    return *r && *s && CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) && CBS_len(&cbs) == 0 && BN_parse_asn1_unsigned(&seq, *r) &&
+           BN_parse_asn1_unsigned(&seq, *s) && CBS_len(&seq) == 0;
+}
+
+static int dsa_sign(const JSKeyData *k, const uint8_t *digest, size_t dn, bool p1363, JSBytesOut *out) {
+    DSA *d = dsa_of(k, true);
+    if (!d) return JS_ASYM_ERR_FAILED;
+    DSA_SIG *sig = DSA_do_sign(digest, dn, d);
+    int err = JS_ASYM_ERR_FAILED;
+    if (sig) {
+        const BIGNUM *r, *s;
+        DSA_SIG_get0(sig, &r, &s);
+        err = dsa_sig_out(r, s, BN_num_bytes(DSA_get0_q(d)), p1363, out);
+    }
+    DSA_SIG_free(sig);
+    DSA_free(d);
+    ERR_clear_error();
+    return err;
+}
+
+static bool dsa_verify(const JSKeyData *k, const uint8_t *digest, size_t dn, bool p1363, const uint8_t *sig, size_t sn) {
+    DSA *d = dsa_of(k, false);
+    if (!d) return false;
+    BIGNUM *r, *s;
+    bool valid = false;
+    if (dsa_sig_in(sig, sn, BN_num_bytes(DSA_get0_q(d)), p1363, &r, &s)) {
+        DSA_SIG *ds = DSA_SIG_new();
+        int ok = 0;
+        if (ds && DSA_SIG_set0(ds, r, s)) {
+            r = s = NULL;
+            valid = DSA_do_check_signature(&ok, digest, dn, ds, d) && ok;
+        }
+        DSA_SIG_free(ds);
+    }
+    BN_free(r), BN_free(s);
+    DSA_free(d);
+    ERR_clear_error();
+    return valid;
+}
+
+static int ec_order_size(const EC_KEY *key) { return (int)BN_num_bytes(EC_GROUP_get0_order(EC_KEY_get0_group(key))); }
+
 int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
                  JSBytesOut *out) {
     if (k->type != JS_KEY_PRIVATE) return JS_ASYM_ERR_KEY_TYPE;
+    if (k->kind == JS_ASYM_ED25519) return JS_ASYM_ERR_UNSUPPORTED;
     if (is_rsa(k)) {
         size_t n = rsa_size(k);
         uint8_t *sig = calloc(n, 1);
@@ -169,10 +352,11 @@ int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest,
             const JSHashAlg *mgf = k->kind == JS_ASYM_RSA_PSS && k->pss_params ? k->pss_mgf1 : h;
             err = pss_sign(k, h, mgf, digest, salt_len, sig);
         } else {
-            br_rsa_private_key sk = rsa_sk(k);
-            const unsigned char *oid = h->oid;
-            if (!oid && strcmp(h->name, "md5-sha1") != 0) err = JS_ASYM_ERR_DIGEST;
-            else if (!br_rsa_pkcs1_sign_get_default()(oid, digest, h->out_len, &sk, sig)) err = JS_ASYM_ERR_FAILED;
+            uint8_t t[128];
+            size_t tl = digest_info(h, digest, true, t);
+            if (!tl) err = JS_ASYM_ERR_DIGEST;
+            else if (!pkcs1_type1(sig, n, t, tl)) err = JS_ASYM_ERR_TOO_SMALL;
+            else if (!rsa_private_op(k, sig)) err = JS_ASYM_ERR_FAILED;
         }
         if (!err) {
             out->p = sig;
@@ -182,43 +366,148 @@ int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest,
         }
         return err;
     }
+    if (k->kind == JS_ASYM_DSA) return dsa_sign(k, digest, h->out_len, p1363, out);
     if (k->kind != JS_ASYM_EC) return JS_ASYM_ERR_KEY_TYPE;
-    const br_hash_class *hf = bear_hash(h);
-    if (!hf) return JS_ASYM_ERR_DIGEST;
-    uint8_t scalar[66];
-    js_ec_scalar_for_bearssl(k, scalar);
-    br_ec_private_key sk = { k->curve, scalar, k->part[JS_EC_PRIV].n };
-    out->p = malloc(160);
-    if (!out->p) js_fatal("out of memory in crypto");
-    size_t n = (p1363 ? br_ecdsa_sign_raw_get_default() : br_ecdsa_sign_asn1_get_default())(br_ec_get_default(), hf, digest, &sk, out->p);
-    out->n = out->cap = n;
-    return n ? 0 : JS_ASYM_ERR_FAILED;
+    EC_KEY *key = ec_key_of(k, true);
+    if (!key) return JS_ASYM_ERR_FAILED;
+    ECDSA_SIG *sig = ECDSA_do_sign(digest, h->out_len, key);
+    int err = sig ? 0 : JS_ASYM_ERR_FAILED;
+    if (sig && p1363) {
+        size_t n = (size_t)ec_order_size(key);
+        out->p = malloc(2 * n);
+        if (!out->p) js_fatal("out of memory in crypto");
+        BN_bn2bin_padded(out->p, n, ECDSA_SIG_get0_r(sig));
+        BN_bn2bin_padded(out->p + n, n, ECDSA_SIG_get0_s(sig));
+        out->n = out->cap = 2 * n;
+    } else if (sig) {
+        uint8_t *der;
+        size_t n;
+        if (!ECDSA_SIG_to_bytes(&der, &n, sig)) {
+            err = JS_ASYM_ERR_FAILED;
+        } else {
+            out->p = malloc(n);
+            if (!out->p) js_fatal("out of memory in crypto");
+            memcpy(out->p, der, n);
+            out->n = out->cap = n;
+            OPENSSL_free(der);
+        }
+    }
+    ECDSA_SIG_free(sig);
+    EC_KEY_free(key);
+    ERR_clear_error();
+    return err;
 }
 
 int js_asym_verify(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
                    const uint8_t *sig, size_t sig_len, bool *valid) {
     *valid = false;
     if (k->type == JS_KEY_SECRET) return JS_ASYM_ERR_KEY_TYPE;
+    if (k->kind == JS_ASYM_ED25519) return JS_ASYM_ERR_UNSUPPORTED;
     if (is_rsa(k)) {
         if (k->kind == JS_ASYM_RSA_PSS || padding == JS_PADDING_PSS) {
             const JSHashAlg *mgf = k->kind == JS_ASYM_RSA_PSS && k->pss_params ? k->pss_mgf1 : h;
             *valid = pss_verify(k, h, mgf, digest, salt_len, sig, sig_len);
             return 0;
         }
-        if (!h->oid && strcmp(h->name, "md5-sha1") != 0) return JS_ASYM_ERR_DIGEST;
-        if (sig_len != rsa_size(k)) return 0;
-        br_rsa_public_key pk = rsa_pk(k);
-        uint8_t got[64];
-        *valid = br_rsa_pkcs1_vrfy_get_default()(sig, sig_len, h->oid, h->out_len, &pk, got) && js_crypto_equal(got, digest, h->out_len);
+        uint8_t t[128];
+        size_t tl = digest_info(h, digest, true, t), n = rsa_size(k);
+        if (!tl) return JS_ASYM_ERR_DIGEST;
+        if (sig_len != n) return 0;
+        uint8_t *x = malloc(2 * n);
+        if (!x) js_fatal("out of memory in crypto");
+        memcpy(x, sig, n);
+        if (rsa_public_op(k, x, n)) {
+            /* the DigestInfo with its NULL parameters, or (as some signers write it) without */
+            *valid = pkcs1_type1(x + n, n, t, tl) && js_crypto_equal(x, x + n, n);
+            if (!*valid && h->oid) {
+                tl = digest_info(h, digest, false, t);
+                *valid = pkcs1_type1(x + n, n, t, tl) && js_crypto_equal(x, x + n, n);
+            }
+        }
+        free(x);
+        return 0;
+    }
+    if (k->kind == JS_ASYM_DSA) {
+        *valid = dsa_verify(k, digest, h->out_len, p1363, sig, sig_len);
         return 0;
     }
     if (k->kind != JS_ASYM_EC) return JS_ASYM_ERR_KEY_TYPE;
-    br_ec_public_key pk = ec_pk(k);
-    *valid = (p1363 ? br_ecdsa_vrfy_raw_get_default() : br_ecdsa_vrfy_asn1_get_default())(br_ec_get_default(), digest, h->out_len, &pk,
-                                                                                          sig, sig_len) != 0;
+    EC_KEY *key = ec_key_of(k, false);
+    if (!key) return 0;
+    ECDSA_SIG *s = NULL;
+    if (p1363) {
+        size_t n = (size_t)ec_order_size(key);
+        if (sig_len == 2 * n) {
+            s = ECDSA_SIG_new();
+            BIGNUM *r = BN_bin2bn(sig, n, NULL), *ss = BN_bin2bn(sig + n, n, NULL);
+            if (!s || !ECDSA_SIG_set0(s, r, ss)) BN_free(r), BN_free(ss);
+        }
+    } else {
+        s = ECDSA_SIG_from_bytes(sig, sig_len);
+    }
+    *valid = s && ECDSA_do_verify(digest, h->out_len, s, key) == 1;
+    ECDSA_SIG_free(s);
+    EC_KEY_free(key);
+    ERR_clear_error();
     return 0;
 }
 
+/* ---- Ed25519 ---------------------------------------------------------------------------------------- */
+
+int js_ed25519_sign(const JSKeyData *k, const uint8_t *msg, size_t n, uint8_t sig[64]) {
+    if (k->kind != JS_ASYM_ED25519 || k->type != JS_KEY_PRIVATE || k->part[JS_EC_PRIV].n != 32) return JS_ASYM_ERR_KEY_TYPE;
+    uint8_t pub[32], priv[64];
+    ED25519_keypair_from_seed(pub, priv, k->part[JS_EC_PRIV].p);
+    int ok = ED25519_sign(sig, msg, n, priv);
+    memset(priv, 0, sizeof priv);
+    return ok ? 0 : JS_ASYM_ERR_FAILED;
+}
+
+int js_ed25519_verify(const JSKeyData *k, const uint8_t *msg, size_t n, const uint8_t *sig, size_t sig_len, bool *valid) {
+    *valid = false;
+    if (k->kind != JS_ASYM_ED25519 || k->type == JS_KEY_SECRET || k->part[JS_EC_PUB].n != 32) return JS_ASYM_ERR_KEY_TYPE;
+    *valid = sig_len == 64 && ED25519_verify(msg, n, sig, k->part[JS_EC_PUB].p);
+    return 0;
+}
+
+/* ---- OAEP (RFC 8017 7.1), over any hash ------------------------------------------------------------ */
+
+/* EME-OAEP-ENCODE into em (k_len bytes): false when the message is too long */
+static bool oaep_encode(const JSHashAlg *h, const uint8_t *label, size_t label_len, const uint8_t *m, size_t m_len, uint8_t *em, size_t k_len) {
+    size_t hl = h->out_len;
+    if (k_len < 2 * hl + 2 || m_len > k_len - 2 * hl - 2) return false;
+    uint8_t *seed = em + 1, *db = em + 1 + hl;
+    size_t db_len = k_len - hl - 1;
+    em[0] = 0;
+    js_hash_once(h, label, label_len, db);
+    memset(db + hl, 0, db_len - hl - m_len - 1);
+    db[db_len - m_len - 1] = 0x01;
+    memcpy(db + db_len - m_len, m, m_len);
+    js_crypto_random(seed, hl);
+    mgf1_xor(h, seed, hl, db, db_len);
+    mgf1_xor(h, db, db_len, seed, hl);
+    return true;
+}
+
+/* EME-OAEP-DECODE in place: the message's offset in em and its length, or false */
+static bool oaep_decode(const JSHashAlg *h, const uint8_t *label, size_t label_len, uint8_t *em, size_t k_len, size_t *at, size_t *m_len) {
+    size_t hl = h->out_len;
+    if (k_len < 2 * hl + 2) return false;
+    uint8_t *seed = em + 1, *db = em + 1 + hl, lhash[64];
+    size_t db_len = k_len - hl - 1;
+    mgf1_xor(h, db, db_len, seed, hl);
+    mgf1_xor(h, seed, hl, db, db_len);
+    js_hash_once(h, label, label_len, lhash);
+    unsigned bad = em[0] | !js_crypto_equal(db, lhash, hl);
+    size_t i = hl;
+    while (i < db_len && db[i] == 0) i++;
+    bad |= i == db_len || db[i] != 0x01;
+    if (bad) return false;
+    *at = 1 + hl + i + 1;
+    *m_len = db_len - i - 1;
+    return true;
+}
+
 /* ---- RSA encryption ----------------------------------------------------------------------------- */
 
 int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_hash, const uint8_t *label, size_t label_len,
@@ -232,20 +521,17 @@ int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_
     int err = 0;
     size_t out_len = kl;
     if (op == JS_RSA_PUBLIC_ENCRYPT && padding == JS_PADDING_OAEP) {
-        if (!bear_hash(oaep_hash)) err = JS_ASYM_ERR_DIGEST;
-        else {
-            br_rsa_public_key pk = rsa_pk(k);
-            out_len = br_rsa_oaep_encrypt_get_default()(js_crypto_prng(), bear_hash(oaep_hash), label, label_len, &pk, x, kl, in, n);
-            if (!out_len) err = JS_ASYM_ERR_TOO_LARGE;
-        }
+        if (oaep_hash->xof) err = JS_ASYM_ERR_DIGEST;
+        else if (!oaep_encode(oaep_hash, label, label_len, in, n, x, kl)) err = JS_ASYM_ERR_TOO_LARGE;
+        else if (!rsa_public_op(k, x, kl)) err = JS_ASYM_ERR_TOO_LARGE;
     } else if (op == JS_RSA_PRIVATE_DECRYPT && padding == JS_PADDING_OAEP) {
-        if (!bear_hash(oaep_hash)) err = JS_ASYM_ERR_DIGEST;
+        size_t at;
+        if (oaep_hash->xof) err = JS_ASYM_ERR_DIGEST;
         else if (n != kl) err = JS_ASYM_ERR_OAEP;
         else {
-            br_rsa_private_key sk = rsa_sk(k);
             memcpy(x, in, n);
-            out_len = n;
-            if (!br_rsa_oaep_decrypt_get_default()(bear_hash(oaep_hash), label, label_len, &sk, x, &out_len)) err = JS_ASYM_ERR_OAEP;
+            if (!rsa_private_op(k, x) || !oaep_decode(oaep_hash, label, label_len, x, kl, &at, &out_len)) err = JS_ASYM_ERR_OAEP;
+            else memmove(x, x + at, out_len);
         }
     } else if (op == JS_RSA_PUBLIC_ENCRYPT || op == JS_RSA_PRIVATE_ENCRYPT) {
         if (padding == JS_PADDING_NONE) {
@@ -305,94 +591,16 @@ int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_
 
 /* ---- Points ------------------------------------------------------------------------------------- */
 
-/* Little fixed-size integers for decompressing points: y = sqrt(x^3 - 3x + b) mod p, which is
- * (x^3 - 3x + b)^((p + 1) / 4) as p ≡ 3 (mod 4) on all three curves. 32-bit limbs, little-endian. */
-#define LIMBS 17  /* 544 bits: P-521's field */
-
-typedef struct { uint32_t w[LIMBS]; } Big;
-
-static void big_from_bytes(Big *a, const uint8_t *p, size_t n) {
-    memset(a, 0, sizeof *a);
-    for (size_t i = 0; i < n; i++) a->w[i / 4] |= (uint32_t)p[n - 1 - i] << (8 * (i % 4));
-}
-
-static void big_to_bytes(const Big *a, uint8_t *p, size_t n) {
-    for (size_t i = 0; i < n; i++) p[n - 1 - i] = (uint8_t)(a->w[i / 4] >> (8 * (i % 4)));
-}
-
-static int big_cmp(const Big *a, const Big *b) {
-    for (int i = LIMBS - 1; i >= 0; i--)
-        if (a->w[i] != b->w[i]) return a->w[i] < b->w[i] ? -1 : 1;
-    return 0;
-}
-
-static void big_sub(Big *a, const Big *b) {
-    uint64_t borrow = 0;
-    for (int i = 0; i < LIMBS; i++) {
-        uint64_t d = (uint64_t)a->w[i] - b->w[i] - borrow;
-        a->w[i] = (uint32_t)d;
-        borrow = (d >> 32) & 1;
-    }
-}
-
-/* r = a * b mod m, by schoolbook multiplication and bitwise reduction */
-static void big_mulmod(Big *r, const Big *a, const Big *b, const Big *m) {
-    uint32_t t[2 * LIMBS] = { 0 };
-    for (int i = 0; i < LIMBS; i++) {
-        uint64_t carry = 0;
-        for (int j = 0; j < LIMBS; j++) {
-            uint64_t v = (uint64_t)a->w[i] * b->w[j] + t[i + j] + carry;
-            t[i + j] = (uint32_t)v;
-            carry = v >> 32;
-        }
-        t[i + LIMBS] = (uint32_t)carry;
-    }
-    Big acc = { { 0 } };
-    for (int bit = 2 * LIMBS * 32 - 1; bit >= 0; bit--) {
-        uint32_t top = acc.w[LIMBS - 1] >> 31;
-        for (int i = LIMBS - 1; i > 0; i--) acc.w[i] = acc.w[i] << 1 | acc.w[i - 1] >> 31;
-        acc.w[0] = acc.w[0] << 1 | ((t[bit / 32] >> (bit % 32)) & 1);
-        if (top || big_cmp(&acc, m) >= 0) big_sub(&acc, m);
-    }
-    *r = acc;
-}
-
-static void big_powmod(Big *r, const Big *a, const Big *e, const Big *m) {
-    Big acc = { { 1 } };
-    for (int bit = LIMBS * 32 - 1; bit >= 0; bit--) {
-        big_mulmod(&acc, &acc, &acc, m);
-        if ((e->w[bit / 32] >> (bit % 32)) & 1) big_mulmod(&acc, &acc, a, m);
-    }
-    *r = acc;
-}
-
 static const struct {
-    int            curve;
-    const char    *name;
-    size_t         size;
-    const char    *p, *b;  /* hex */
+    int         curve;
+    const char *name;
+    size_t      size;
 } FIELDS[] = {
-    { BR_EC_secp256r1, "prime256v1", 32, "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
-      "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b" },
-    { BR_EC_secp384r1, "secp384r1", 48,
-      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff",
-      "b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef" },
-    { BR_EC_secp521r1, "secp521r1", 66,
-      "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-      "0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00" },
+    { JS_EC_P256, "prime256v1", 32 },
+    { JS_EC_P384, "secp384r1", 48 },
+    { JS_EC_P521, "secp521r1", 66 },
 };
 
-static void hex_bytes(const char *hex, uint8_t *out, size_t n) {
-    for (size_t i = 0; i < n; i++) {
-        unsigned v = 0;
-        for (int k = 0; k < 2; k++) {
-            char c = hex[2 * i + k];
-            v = v << 4 | (unsigned)(c <= '9' ? c - '0' : c - 'a' + 10);
-        }
-        out[i] = (uint8_t)v;
-    }
-}
-
 int js_ec_curve_by_name(const char *name) {
     for (size_t i = 0; i < JS_COUNTOF(FIELDS); i++)
         if (strcmp(name, FIELDS[i].name) == 0) return FIELDS[i].curve;
@@ -402,73 +610,29 @@ int js_ec_curve_by_name(const char *name) {
 size_t js_ec_field_size(int curve) {
     for (size_t i = 0; i < JS_COUNTOF(FIELDS); i++)
         if (FIELDS[i].curve == curve) return FIELDS[i].size;
-    return curve == BR_EC_curve25519 ? 32 : 0;
+    return curve == JS_EC_X25519 || curve == JS_EC_ED25519 ? 32 : 0;
 }
 
 /* Any encoding of a point (uncompressed 04, compressed 02/03, hybrid 06/07) as uncompressed;
- * false when it isn't one (decompression checks the curve; BearSSL checks the rest). */
+ * false when it isn't one of the curve's points. */
 bool js_ec_point_uncompressed(int curve, const uint8_t *in, size_t n, uint8_t *out) {
-    size_t fs = js_ec_field_size(curve), i = 0;
-    while (i < JS_COUNTOF(FIELDS) && FIELDS[i].curve != curve) i++;
-    if (!fs || i == JS_COUNTOF(FIELDS) || n == 0) return false;
-    if ((in[0] == 4 || in[0] == 6 || in[0] == 7) && n == 1 + 2 * fs) {
-        if (in[0] != 4 && (in[n - 1] & 1) != (in[0] & 1)) return false;
-        memcpy(out, in, n);
-        out[0] = 4;
-        return true;
-    }
-    if ((in[0] != 2 && in[0] != 3) || n != 1 + fs) return false;
-    uint8_t buf[66];
-    Big p, x, rhs, t, three, e;
-    hex_bytes(FIELDS[i].p, buf, fs);
-    big_from_bytes(&p, buf, fs);
-    big_from_bytes(&x, in + 1, fs);
-    if (big_cmp(&x, &p) >= 0) return false;
-    big_mulmod(&t, &x, &x, &p);
-    big_mulmod(&rhs, &t, &x, &p);  /* x^3 */
-    memset(&three, 0, sizeof three);
-    three.w[0] = 3;
-    big_mulmod(&t, &x, &three, &p);  /* 3x */
-    if (big_cmp(&rhs, &t) < 0) {  /* rhs - 3x, mod p */
-        Big s = p;
-        big_sub(&s, &t);
-        t = s;
-        uint64_t carry = 0;
-        for (int w = 0; w < LIMBS; w++) {
-            uint64_t v = (uint64_t)rhs.w[w] + t.w[w] + carry;
-            rhs.w[w] = (uint32_t)v;
-            carry = v >> 32;
-        }
-        if (big_cmp(&rhs, &p) >= 0) big_sub(&rhs, &p);
-    } else {
-        big_sub(&rhs, &t);
-    }
-    Big b;
-    hex_bytes(FIELDS[i].b, buf, fs);
-    big_from_bytes(&b, buf, fs);
-    uint64_t carry = 0;
-    for (int w = 0; w < LIMBS; w++) {
-        uint64_t v = (uint64_t)rhs.w[w] + b.w[w] + carry;
-        rhs.w[w] = (uint32_t)v;
-        carry = v >> 32;
-    }
-    if (big_cmp(&rhs, &p) >= 0) big_sub(&rhs, &p);
-    e = p;  /* (p + 1) / 4 */
-    for (int w = 0, c = 1; w < LIMBS && c; w++) c = ++e.w[w] == 0;
-    for (int w = 0; w < LIMBS; w++) e.w[w] = e.w[w] >> 2 | (w + 1 < LIMBS ? e.w[w + 1] << 30 : 0);
-    Big y, check;
-    big_powmod(&y, &rhs, &e, &p);
-    big_mulmod(&check, &y, &y, &p);
-    if (big_cmp(&check, &rhs) != 0) return false;  /* not on the curve */
-    if ((y.w[0] & 1) != (in[0] & 1u)) {
-        Big ny = p;
-        big_sub(&ny, &y);
-        y = ny;
+    size_t fs = js_ec_field_size(curve);
+    if (!fs || curve == JS_EC_X25519 || curve == JS_EC_ED25519 || n == 0) return false;
+    uint8_t buf[133];
+    if ((in[0] == 6 || in[0] == 7) && n == 1 + 2 * fs) {  /* hybrid: BoringSSL takes it as uncompressed */
+        if ((in[n - 1] & 1) != (in[0] & 1)) return false;
+        memcpy(buf, in, n);
+        buf[0] = 4;
+        in = buf;
     }
-    out[0] = 4;
-    memcpy(out + 1, in + 1, fs);
-    big_to_bytes(&y, out + 1 + fs, fs);
-    return true;
+    EC_GROUP *g = EC_GROUP_new_by_curve_name(ec_nid(curve));
+    EC_POINT *pt = g ? EC_POINT_new(g) : NULL;
+    bool ok = pt && EC_POINT_oct2point(g, pt, in, n, NULL) &&
+              EC_POINT_point2oct(g, pt, POINT_CONVERSION_UNCOMPRESSED, out, 1 + 2 * fs, NULL) == 1 + 2 * fs;
+    EC_POINT_free(pt);
+    EC_GROUP_free(g);
+    ERR_clear_error();
+    return ok;
 }
 
 /* An uncompressed point in a format: 4 uncompressed, 2 compressed, 6 hybrid (Node's constants). */
@@ -485,32 +649,59 @@ size_t js_ec_point_format(int curve, const uint8_t *point, int format, uint8_t *
     return 1 + 2 * fs;
 }
 
+/* The public point of a private scalar, uncompressed (EC), or X25519's public value: false when
+ * the scalar isn't one */
+bool js_ec_public_of(int curve, const uint8_t *scalar, size_t n, uint8_t *out, size_t *out_len) {
+    if (curve == JS_EC_ED25519) {  /* the private key is the seed */
+        uint8_t priv[64];
+        if (n != 32) return false;
+        ED25519_keypair_from_seed(out, priv, scalar);
+        memset(priv, 0, sizeof priv);
+        *out_len = 32;
+        return true;
+    }
+    if (curve == JS_EC_X25519) {
+        if (n != 32) return false;
+        X25519_public_from_private(out, scalar);
+        *out_len = 32;
+        return true;
+    }
+    size_t fs = js_ec_field_size(curve);
+    EC_GROUP *g = EC_GROUP_new_by_curve_name(ec_nid(curve));
+    EC_POINT *pt = g ? EC_POINT_new(g) : NULL;
+    BIGNUM *d = BN_bin2bn(scalar, n, NULL);
+    bool ok = pt && d && !BN_is_zero(d) && BN_cmp(d, EC_GROUP_get0_order(g)) < 0 && EC_POINT_mul(g, pt, d, NULL, NULL, NULL) &&
+              EC_POINT_point2oct(g, pt, POINT_CONVERSION_UNCOMPRESSED, out, 1 + 2 * fs, NULL) == 1 + 2 * fs;
+    *out_len = 1 + 2 * fs;
+    BN_clear_free(d);
+    EC_POINT_free(pt);
+    EC_GROUP_free(g);
+    ERR_clear_error();
+    return ok;
+}
+
 /* The shared secret of a private key and a peer's public point (EC: the x coordinate; X25519:
  * the u coordinate). 0, or JS_ASYM_ERR_POINT. */
 int js_ecdh(const JSKeyData *k, const uint8_t *peer, size_t peer_len, uint8_t *secret, size_t *secret_len) {
-    uint8_t g[133], scalar[66];
-    size_t glen;
-    if (k->curve == BR_EC_curve25519) {
-        if (peer_len != 32) return JS_ASYM_ERR_POINT;
-        memcpy(g, peer, 32);
-        glen = 32;
-    } else {
-        if (!js_ec_point_uncompressed(k->curve, peer, peer_len, g)) return JS_ASYM_ERR_POINT;
-        glen = 1 + 2 * js_ec_field_size(k->curve);
-    }
-    js_ec_scalar_for_bearssl(k, scalar);
-    if (!br_ec_get_default()->mul(g, glen, scalar, k->part[JS_EC_PRIV].n, k->curve)) return JS_ASYM_ERR_POINT;
-    if (k->curve == BR_EC_curve25519) {
-        uint8_t zero = 0;
-        for (int i = 0; i < 32; i++) zero |= g[i];
-        if (!zero) return JS_ASYM_ERR_POINT;  /* a small-order point, as OpenSSL rejects it */
-        memcpy(secret, g, 32);
+    if (k->curve == JS_EC_X25519) {
+        if (peer_len != 32 || k->part[JS_EC_PRIV].n != 32) return JS_ASYM_ERR_POINT;
+        if (!X25519(secret, k->part[JS_EC_PRIV].p, peer)) return JS_ASYM_ERR_POINT;  /* a small-order point, as OpenSSL rejects it */
         *secret_len = 32;
-    } else {
-        size_t fs = js_ec_field_size(k->curve);
-        memcpy(secret, g + 1, fs);
-        *secret_len = fs;
+        return 0;
     }
+    uint8_t g[133];
+    if (!js_ec_point_uncompressed(k->curve, peer, peer_len, g)) return JS_ASYM_ERR_POINT;
+    size_t fs = js_ec_field_size(k->curve);
+    EC_KEY *key = ec_key_of(k, true);
+    if (!key) return JS_ASYM_ERR_POINT;
+    const EC_GROUP *group = EC_KEY_get0_group(key);
+    EC_POINT *pt = EC_POINT_new(group);
+    bool ok = pt && EC_POINT_oct2point(group, pt, g, 1 + 2 * fs, NULL) && ECDH_compute_key(secret, fs, pt, key, NULL) == (int)fs;
+    EC_POINT_free(pt);
+    EC_KEY_free(key);
+    ERR_clear_error();
+    if (!ok) return JS_ASYM_ERR_POINT;
+    *secret_len = fs;
     return 0;
 }
 
@@ -565,6 +756,31 @@ PRIMITIVE(js_crypto_verify) {
     return err ? js_int32(err) : js_bool(valid);
 }
 
+/* cryptoSignMessage(key, data): Ed25519's signature of a message, a Buffer, or an error code. */
+PRIMITIVE(js_crypto_sign_message) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0));
+    uint8_t *d;
+    size_t dn;
+    if (!k || !js_buffer_source_bytes(ARG(1), &d, &dn)) return js_throw_type_error(ctx, "cryptoSignMessage: bad arguments");
+    uint8_t sig[64];
+    int err = js_ed25519_sign(k, d, dn, sig);
+    return err ? js_int32(err) : js_new_buffer_from_bytes(ctx, sig, 64);
+}
+
+/* cryptoVerifyMessage(key, data, signature): a boolean, or an error code. */
+PRIMITIVE(js_crypto_verify_message) {
+    UNUSED_PRIMITIVE_ARGS;
+    JSKeyData *k = js_key_data(ARG(0));
+    uint8_t *d, *sig;
+    size_t dn, sn;
+    if (!k || !js_buffer_source_bytes(ARG(1), &d, &dn) || !js_buffer_source_bytes(ARG(2), &sig, &sn))
+        return js_throw_type_error(ctx, "cryptoVerifyMessage: bad arguments");
+    bool valid;
+    int err = js_ed25519_verify(k, d, dn, sig, sn, &valid);
+    return err ? js_int32(err) : js_bool(valid);
+}
+
 /* cryptoRsaCrypt(key, op, data, padding, oaepHash, oaepLabel): a Buffer, or an error code.
  * op: 0 publicEncrypt, 1 privateDecrypt, 2 privateEncrypt, 3 publicDecrypt. */
 PRIMITIVE(js_crypto_rsa_crypt) {
@@ -606,13 +822,7 @@ PRIMITIVE(js_crypto_ec_point) {
     int curve = js_ec_curve_by_name(name);
     if (curve < 0) return js_int32(JS_ASYM_ERR_CURVE);
     uint8_t point[133], out[133];
-    if (!js_ec_point_uncompressed(curve, p, n, point)) return js_int32(JS_ASYM_ERR_POINT);
-    br_ec_public_key pk = { curve, point, 1 + 2 * js_ec_field_size(curve) };
-    /* on the curve: BearSSL's multiplication checks it */
-    uint8_t one[66] = { 0 }, copy[133];
-    one[js_ec_field_size(curve) - 1] = 1;
-    memcpy(copy, pk.q, pk.qlen);
-    if (!br_ec_get_default()->mul(copy, pk.qlen, one, js_ec_field_size(curve), curve)) return js_int32(JS_ASYM_ERR_POINT);
+    if (!js_ec_point_uncompressed(curve, p, n, point)) return js_int32(JS_ASYM_ERR_POINT);  /* on the curve too */
     size_t on = js_ec_point_format(curve, point, (int)num_or(ARG(2), 4), out);
     return js_new_buffer_from_bytes(ctx, out, on);
 }
@@ -635,10 +845,9 @@ PRIMITIVE(js_crypto_ec_private) {
     uint8_t buf[66] = { 0 };
     memcpy(buf + fs - n, p, n);
     js_key_part_set(&k->part[JS_EC_PRIV], buf, fs);
-    uint8_t pub[BR_EC_KBUF_PUB_MAX_SIZE];
-    br_ec_private_key sk = { curve, buf, fs };
-    br_ec_public_key pk;
-    if (!br_ec_compute_pub(br_ec_get_default(), &pk, pub, &sk)) return js_int32(JS_ASYM_ERR_POINT);
-    js_key_part_set(&k->part[JS_EC_PUB], pk.q, pk.qlen);
+    uint8_t pub[133];
+    size_t pn;
+    if (!js_ec_public_of(curve, buf, fs, pub, &pn)) return js_int32(JS_ASYM_ERR_POINT);
+    js_key_part_set(&k->part[JS_EC_PUB], pub, pn);
     return js_object_value(&k->obj);
 }