zapo-js 0.2.0 → 1.0.0

package/dist/crypto/core/primitives.js

@@ -1,110 +1,140 @@
 "use strict";
-/**
- * Low-level crypto primitives using WebCrypto API
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sha256 = sha256;
 exports.sha1 = sha1;
+exports.sha256 = sha256;
 exports.sha512 = sha512;
 exports.md5Bytes = md5Bytes;
-exports.importAesGcmKey = importAesGcmKey;
 exports.aesGcmEncrypt = aesGcmEncrypt;
 exports.aesGcmDecrypt = aesGcmDecrypt;
-exports.importAesCbcKey = importAesCbcKey;
 exports.aesCbcEncrypt = aesCbcEncrypt;
 exports.aesCbcDecrypt = aesCbcDecrypt;
-exports.importHmacKey = importHmacKey;
-exports.importHmacSha512Key = importHmacSha512Key;
-exports.hmacSign = hmacSign;
-exports.pbkdf2DeriveAesCtrKey = pbkdf2DeriveAesCtrKey;
 exports.aesCtrEncrypt = aesCtrEncrypt;
 exports.aesCtrDecrypt = aesCtrDecrypt;
+exports.hmacSha256Sign = hmacSha256Sign;
+exports.hmacSha512Sign = hmacSha512Sign;
+exports.pbkdf2Sha256 = pbkdf2Sha256;
 const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
 const bytes_1 = require("../../util/bytes");
-async function digestBytes(algorithm, value) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.digest(algorithm, value));
-}
-// ============================================
-// Hash functions
-// ============================================
-async function sha256(value) {
-    return digestBytes('SHA-256', value);
-}
-async function sha1(value) {
-    return digestBytes('SHA-1', value);
-}
-async function sha512(value) {
-    return digestBytes('SHA-512', value);
-}
+const AES_GCM_TAG_LENGTH = 16;
+const pbkdf2Async = (0, node_util_1.promisify)(node_crypto_1.pbkdf2);
+function feed(target, input) {
+    if (Array.isArray(input)) {
+        for (let i = 0; i < input.length; i += 1) {
+            target.update(input[i]);
+        }
+    }
+    else {
+        target.update(input);
+    }
+    return target;
+}
+/** Computes the SHA-1 digest of `value`. Accepts a single chunk or array of chunks. */
+function sha1(value) {
+    return (0, bytes_1.toBytesView)(feed((0, node_crypto_1.createHash)('sha1'), value).digest());
+}
+/** Computes the SHA-256 digest of `value`. */
+function sha256(value) {
+    return (0, bytes_1.toBytesView)(feed((0, node_crypto_1.createHash)('sha256'), value).digest());
+}
+/** Computes the SHA-512 digest of `value`. */
+function sha512(value) {
+    return (0, bytes_1.toBytesView)(feed((0, node_crypto_1.createHash)('sha512'), value).digest());
+}
+/** Computes the MD5 digest of `input`, accepting a string or raw chunks. */
 function md5Bytes(input) {
-    return (0, bytes_1.toBytesView)((0, node_crypto_1.createHash)('md5').update(input).digest());
-}
-// ============================================
-// AES-GCM (for Noise protocol)
-// ============================================
-async function importAesGcmKey(raw, usages) {
-    return node_crypto_1.webcrypto.subtle.importKey('raw', raw, 'AES-GCM', false, usages);
-}
-async function aesGcmEncrypt(key, nonce, plaintext, aad = bytes_1.EMPTY_BYTES) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plaintext));
-}
-async function aesGcmDecrypt(key, nonce, ciphertext, aad = bytes_1.EMPTY_BYTES) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, ciphertext));
+    const hash = (0, node_crypto_1.createHash)('md5');
+    if (typeof input === 'string') {
+        hash.update(input);
+    }
+    else {
+        feed(hash, input);
+    }
+    return (0, bytes_1.toBytesView)(hash.digest());
 }
-// ============================================
-// AES-CBC (for Signal protocol)
-// ============================================
-async function importAesCbcKey(keyBytes) {
-    return node_crypto_1.webcrypto.subtle.importKey('raw', keyBytes, { name: 'AES-CBC', length: 256 }, false, [
-        'encrypt',
-        'decrypt'
-    ]);
-}
-async function aesCbcEncrypt(key, iv, plaintext) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, plaintext));
-}
-async function aesCbcDecrypt(key, iv, ciphertext) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext));
-}
-// ============================================
-// HMAC-SHA256 (for Signal protocol)
-// ============================================
-async function importHmacKey(keyBytes) {
-    return node_crypto_1.webcrypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-256' }, false, [
-        'sign'
-    ]);
-}
-async function importHmacSha512Key(keyBytes) {
-    return node_crypto_1.webcrypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-512' }, false, [
-        'sign'
-    ]);
-}
-async function hmacSign(key, data) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.sign('HMAC', key, data));
-}
-// ============================================
-// PBKDF2 → AES-CTR (for pairing code crypto)
-// ============================================
-async function pbkdf2DeriveAesCtrKey(password, salt, iterations) {
-    const imported = await node_crypto_1.webcrypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, [
-        'deriveKey'
-    ]);
-    return node_crypto_1.webcrypto.subtle.deriveKey({
-        name: 'PBKDF2',
-        hash: 'SHA-256',
-        salt,
-        iterations
-    }, imported, {
-        name: 'AES-CTR',
-        length: 256
-    }, false, ['encrypt', 'decrypt']);
-}
-// ============================================
-// AES-CTR (for pairing code crypto)
-// ============================================
-async function aesCtrEncrypt(key, counter, plaintext) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.encrypt({ name: 'AES-CTR', counter, length: 64 }, key, plaintext));
+/**
+ * AES-256-GCM encrypt. The 16-byte auth tag is appended to the ciphertext.
+ * Pass `aad` when binding the ciphertext to associated data.
+ */
+function aesGcmEncrypt(key, nonce, plaintext, aad = bytes_1.EMPTY_BYTES) {
+    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, nonce);
+    if (aad.length > 0) {
+        cipher.setAAD(aad);
+    }
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    const tag = cipher.getAuthTag();
+    return (0, bytes_1.concatBytes)([head, tail, tag]);
 }
-async function aesCtrDecrypt(key, counter, ciphertext) {
-    return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
+/**
+ * AES-256-GCM decrypt. Expects the 16-byte auth tag appended to the
+ * ciphertext (matching {@link aesGcmEncrypt}'s layout). Throws on auth failure.
+ */
+function aesGcmDecrypt(key, nonce, ciphertext, aad = bytes_1.EMPTY_BYTES) {
+    const tagOffset = ciphertext.length - AES_GCM_TAG_LENGTH;
+    const tag = ciphertext.subarray(tagOffset);
+    const ct = ciphertext.subarray(0, tagOffset);
+    const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, nonce);
+    if (aad.length > 0) {
+        decipher.setAAD(aad);
+    }
+    decipher.setAuthTag(tag);
+    const head = decipher.update(ct);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return (0, bytes_1.toBytesView)(head);
+    }
+    return (0, bytes_1.concatBytes)([head, tail]);
+}
+/** AES-256-CBC encrypt with PKCS#7 padding (default Node behavior). */
+function aesCbcEncrypt(key, iv, plaintext) {
+    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-cbc', key, iv);
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    if (tail.length === 0) {
+        return (0, bytes_1.toBytesView)(head);
+    }
+    return (0, bytes_1.concatBytes)([head, tail]);
+}
+/** AES-256-CBC decrypt with PKCS#7 padding. */
+function aesCbcDecrypt(key, iv, ciphertext) {
+    const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-cbc', key, iv);
+    const head = decipher.update(ciphertext);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return (0, bytes_1.toBytesView)(head);
+    }
+    return (0, bytes_1.concatBytes)([head, tail]);
+}
+/** AES-256-CTR encrypt with the given 16-byte counter. */
+function aesCtrEncrypt(key, counter, plaintext) {
+    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-ctr', key, counter);
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    if (tail.length === 0) {
+        return (0, bytes_1.toBytesView)(head);
+    }
+    return (0, bytes_1.concatBytes)([head, tail]);
+}
+/** AES-256-CTR decrypt with the given 16-byte counter. */
+function aesCtrDecrypt(key, counter, ciphertext) {
+    const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-ctr', key, counter);
+    const head = decipher.update(ciphertext);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return (0, bytes_1.toBytesView)(head);
+    }
+    return (0, bytes_1.concatBytes)([head, tail]);
+}
+/** Computes the HMAC-SHA-256 MAC of `data` keyed by `key`. */
+function hmacSha256Sign(key, data) {
+    return (0, bytes_1.toBytesView)(feed((0, node_crypto_1.createHmac)('sha256', key), data).digest());
+}
+/** Computes the HMAC-SHA-512 MAC of `data` keyed by `key`. */
+function hmacSha512Sign(key, data) {
+    return (0, bytes_1.toBytesView)(feed((0, node_crypto_1.createHmac)('sha512', key), data).digest());
+}
+/** PBKDF2 over HMAC-SHA-256 – derives `length` bytes from `password` + `salt`. */
+async function pbkdf2Sha256(password, salt, iterations, length) {
+    return (0, bytes_1.toBytesView)(await pbkdf2Async(password, salt, iterations, length, 'sha256'));
 }

package/dist/crypto/core/random.js

@@ -1,16 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.randomIntAsync = void 0;
-exports.randomBytesAsync = randomBytesAsync;
+exports.randomBytesAsync = exports.randomIntAsync = void 0;
 exports.randomFillAsync = randomFillAsync;
 const node_crypto_1 = require("node:crypto");
 const node_util_1 = require("node:util");
-const bytes_1 = require("../../util/bytes");
-const randomBytesAsyncImpl = (0, node_util_1.promisify)(node_crypto_1.randomBytes);
-const randomIntAsyncImpl = (0, node_util_1.promisify)(node_crypto_1.randomInt);
-async function randomBytesAsync(size) {
-    return (0, bytes_1.toBytesView)(await randomBytesAsyncImpl(size));
-}
+/**
+ * Cryptographically fills `target` (optionally a sub-range) with random bytes.
+ * Resolves to the same `target` reference for chaining.
+ */
 async function randomFillAsync(target, offset, size) {
     await new Promise((resolve, reject) => {
         const onDone = (error) => {
@@ -32,4 +29,7 @@ async function randomFillAsync(target, offset, size) {
     });
     return target;
 }
-exports.randomIntAsync = randomIntAsyncImpl;
+/** Returns a cryptographically secure integer in `[min, max)`. */
+exports.randomIntAsync = (0, node_util_1.promisify)(node_crypto_1.randomInt);
+/** Returns `size` cryptographically secure random bytes. */
+exports.randomBytesAsync = (0, node_util_1.promisify)(node_crypto_1.randomBytes);

package/dist/crypto/core/xeddsa.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.xeddsaVerify = xeddsaVerify;
+exports.xeddsaSign = xeddsaSign;
+const primitives_1 = require("../core/primitives");
+const random_1 = require("../core/random");
+const Ed25519_1 = require("../curves/Ed25519");
+const X25519_1 = require("../curves/X25519");
+const edwards_1 = require("../math/edwards");
+const le_1 = require("../math/le");
+const mod_1 = require("../math/mod");
+const bytes_1 = require("../../util/bytes");
+const PREFIX_SIGNATURE_RANDOM = new Uint8Array([
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+/**
+ * Verifies an XEdDSA signature over `message` against an X25519 (Montgomery)
+ * public key, converting to the Edwards form internally. Returns `false`
+ * on shape mismatch instead of throwing.
+ */
+async function xeddsaVerify(curvePublicKey, message, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    if ((signature[63] & 0x60) !== 0) {
+        return false;
+    }
+    const lastByteIndex = 63;
+    const originalLastByte = signature[lastByteIndex];
+    const signBit = originalLastByte & 0x80;
+    signature[lastByteIndex] = originalLastByte & 0x7f;
+    const edPublic = (0, X25519_1.montgomeryToEdwardsPublic)(curvePublicKey, signBit);
+    try {
+        return await Ed25519_1.Ed25519.verify(message, signature, edPublic);
+    }
+    finally {
+        signature[lastByteIndex] = originalLastByte;
+    }
+}
+/**
+ * Signs `message` with an X25519 (Montgomery) private key using the XEdDSA
+ * construction. Returns a 64-byte signature.
+ */
+async function xeddsaSign(privateKey, message) {
+    (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
+    const clampedPrivateKey = (0, X25519_1.clampCurvePrivateKeyInPlace)(privateKey);
+    const privateScalar = (0, le_1.bytesToBigIntLE)(clampedPrivateKey);
+    const encodedPublic = (0, edwards_1.encodeExtendedPoint)((0, edwards_1.scalarMultBase)(privateScalar));
+    const pubKeySignBit = encodedPublic[31] & 0x80;
+    const randomSuffix = await (0, random_1.randomBytesAsync)(64);
+    const r = (0, mod_1.modGroup)((0, le_1.bytesToBigIntLE)((0, primitives_1.sha512)([PREFIX_SIGNATURE_RANDOM, clampedPrivateKey, message, randomSuffix])));
+    const encodedR = (0, edwards_1.encodeExtendedPoint)((0, edwards_1.scalarMultBase)(r));
+    const h = (0, mod_1.modGroup)((0, le_1.bytesToBigIntLE)((0, primitives_1.sha512)([encodedR, encodedPublic, message])));
+    const s = (0, mod_1.modGroup)(r + h * privateScalar);
+    const encodedS = (0, le_1.bigIntToBytesLE)(s, 32);
+    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
+    return (0, bytes_1.concatBytes)([encodedR, encodedS]);
+}

package/dist/crypto/curves/Ed25519.js

@@ -2,40 +2,51 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Ed25519 = void 0;
 const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
 const bytes_1 = require("../../util/bytes");
+const generateKeyPairAsync = (0, node_util_1.promisify)(node_crypto_1.generateKeyPair);
+const signAsync = (0, node_util_1.promisify)(node_crypto_1.sign);
+const verifyAsync = (0, node_util_1.promisify)(node_crypto_1.verify);
+function ed25519PrivateKeyObject(privKey) {
+    return (0, node_crypto_1.createPrivateKey)({
+        key: (0, types_1.pkcs8FromRawPrivate)(constants_1.ED25519_PKCS8_PREFIX, privKey),
+        format: 'der',
+        type: 'pkcs8'
+    });
+}
+function ed25519PublicKeyObject(pubKey) {
+    return (0, node_crypto_1.createPublicKey)({
+        key: (0, bytes_1.concatBytes)([constants_1.ED25519_SPKI_PREFIX, pubKey]),
+        format: 'der',
+        type: 'spki'
+    });
+}
+/**
+ * Ed25519 sign/verify backed by Node's native primitives. All operations are
+ * async to keep crypto off the event loop.
+ */
 class Ed25519 {
+    /** Generates a fresh Ed25519 key pair. */
     static async generateKeyPair() {
-        const keys = (await node_crypto_1.webcrypto.subtle.generateKey({ name: 'Ed25519' }, true, [
-            'sign',
-            'verify'
-        ]));
-        const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', keys.privateKey);
-        return {
-            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
-            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
-        };
-    }
-    static async keyPairFromPrivateKey(privKey) {
-        (0, bytes_1.assertByteLength)(privKey, 32, 'ed25519 private key must be 32 bytes');
-        const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, true, ['sign']);
-        const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', privateKey);
+        const { privateKey } = await generateKeyPairAsync('ed25519');
+        const jwk = privateKey.export({ format: 'jwk' });
         return {
-            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
-            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(jwk.x, 'ed25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(jwk.d, 'ed25519 private key')
         };
     }
+    /** Signs `message` with a 32-byte Ed25519 private key. Returns a 64-byte signature. */
     static async sign(message, privKey) {
         (0, bytes_1.assertByteLength)(privKey, 32, 'ed25519 private key must be 32 bytes');
-        const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, false, ['sign']);
-        const signature = await node_crypto_1.webcrypto.subtle.sign('Ed25519', privateKey, message);
-        return (0, bytes_1.toBytesView)(signature);
+        const sig = await signAsync(null, message, ed25519PrivateKeyObject(privKey));
+        return (0, bytes_1.toBytesView)(sig);
     }
+    /** Verifies an Ed25519 `signature` over `message` against a 32-byte public key. */
     static async verify(message, signature, pubKey) {
         (0, bytes_1.assertByteLength)(pubKey, 32, 'ed25519 public key must be 32 bytes');
-        const publicKey = await node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'Ed25519' }, false, ['verify']);
-        return node_crypto_1.webcrypto.subtle.verify('Ed25519', publicKey, signature, message);
+        return verifyAsync(null, message, ed25519PublicKeyObject(pubKey), signature);
     }
 }
 exports.Ed25519 = Ed25519;

package/dist/crypto/curves/X25519.js

@@ -4,11 +4,32 @@ exports.X25519 = void 0;
 exports.clampCurvePrivateKeyInPlace = clampCurvePrivateKeyInPlace;
 exports.montgomeryToEdwardsPublic = montgomeryToEdwardsPublic;
 const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const generateKeyPairAsync = (0, node_util_1.promisify)(node_crypto_1.generateKeyPair);
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
 const constants_2 = require("../math/constants");
 const fe_1 = require("../math/fe");
 const bytes_1 = require("../../util/bytes");
+const diffieHellmanWithCallback = node_crypto_1.diffieHellman;
+let diffieHellmanAsync = null;
+let diffieHellmanAsyncProbed = false;
+function resolveDiffieHellmanAsync() {
+    if (diffieHellmanAsyncProbed)
+        return diffieHellmanAsync;
+    diffieHellmanAsyncProbed = true;
+    try {
+        const probe = (0, node_crypto_1.generateKeyPairSync)('x25519');
+        const result = node_crypto_1.diffieHellman({ privateKey: probe.privateKey, publicKey: probe.publicKey }, () => { });
+        if (result === undefined) {
+            diffieHellmanAsync = (0, node_util_1.promisify)(diffieHellmanWithCallback);
+        }
+    }
+    catch {
+        // callback form not supported by this runtime; stay on sync path
+    }
+    return diffieHellmanAsync;
+}
 // Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
 const _mx = (0, fe_1.fe)();
 const _m1 = (0, fe_1.fe)();
@@ -24,6 +45,10 @@ function isFieldPMinus1(b) {
             return false;
     return true;
 }
+/**
+ * Applies the standard curve25519 scalar clamping in place and returns the
+ * same buffer for chaining. Throws on non-32-byte inputs.
+ */
 function clampCurvePrivateKeyInPlace(privateKey) {
     (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
@@ -31,6 +56,11 @@ function clampCurvePrivateKeyInPlace(privateKey) {
     privateKey[31] |= 64;
     return privateKey;
 }
+/**
+ * Converts a 32-byte Montgomery (curve25519) public key to its Edwards form
+ * for XEdDSA verification, applying the supplied `signBit` (`0x80` mask).
+ * Throws on the field-`p-1` low-order point.
+ */
 function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     (0, bytes_1.assertByteLength)(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
     if (isFieldPMinus1(curvePublicKey)) {
@@ -46,35 +76,59 @@ function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
+function x25519PrivateKeyObject(privKey) {
+    return (0, node_crypto_1.createPrivateKey)({
+        key: (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey),
+        format: 'der',
+        type: 'pkcs8'
+    });
+}
+function x25519PublicKeyObject(pubKey) {
+    return (0, node_crypto_1.createPublicKey)({
+        key: (0, bytes_1.concatBytes)([constants_1.X25519_SPKI_PREFIX, pubKey]),
+        format: 'der',
+        type: 'spki'
+    });
+}
+/**
+ * X25519 key-pair generation and Diffie-Hellman scalar multiplication
+ * backed by Node's native primitives.
+ */
 class X25519 {
+    /** Generates a fresh X25519 key pair. */
     static async generateKeyPair() {
-        const keys = (await node_crypto_1.webcrypto.subtle.generateKey({ name: 'X25519' }, true, [
-            'deriveBits'
-        ]));
-        const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', keys.privateKey);
+        const { privateKey } = await generateKeyPairAsync('x25519');
+        const jwk = privateKey.export({ format: 'jwk' });
         return {
-            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
-            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(jwk.x, 'x25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(jwk.d, 'x25519 private key')
         };
     }
-    static async keyPairFromPrivateKey(privKey) {
+    /** Derives the matching public key from a 32-byte X25519 private key. */
+    static keyPairFromPrivateKey(privKey) {
         (0, bytes_1.assertByteLength)(privKey, 32, 'x25519 private key must be 32 bytes');
-        const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, true, ['deriveBits']);
-        const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', privateKey);
+        const jwk = x25519PrivateKeyObject(privKey).export({ format: 'jwk' });
         return {
-            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
-            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(jwk.x, 'x25519 public key'),
+            privKey
         };
     }
+    /**
+     * Computes the X25519 shared secret between `privKey` and `pubKey`.
+     * Uses Node's async DH path when supported, otherwise falls back to sync.
+     */
     static async scalarMult(privKey, pubKey) {
         (0, bytes_1.assertByteLength)(privKey, 32, 'x25519 private key must be 32 bytes');
         (0, bytes_1.assertByteLength)(pubKey, 32, 'x25519 public key must be 32 bytes');
-        const [privateKey, publicKey] = await Promise.all([
-            node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
-            node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])
-        ]);
-        const sharedBits = await node_crypto_1.webcrypto.subtle.deriveBits({ name: 'X25519', public: publicKey }, privateKey, 256);
-        return (0, bytes_1.toBytesView)(sharedBits);
+        const opts = {
+            privateKey: x25519PrivateKeyObject(privKey),
+            publicKey: x25519PublicKeyObject(pubKey)
+        };
+        const dhAsync = resolveDiffieHellmanAsync();
+        if (dhAsync) {
+            return (0, bytes_1.toBytesView)(await dhAsync(opts));
+        }
+        return (0, bytes_1.toBytesView)((0, node_crypto_1.diffieHellman)(opts));
     }
 }
 exports.X25519 = X25519;

package/dist/crypto/curves/constants.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ED25519_PKCS8_PREFIX = exports.X25519_PKCS8_PREFIX = void 0;
+exports.ED25519_SPKI_PREFIX = exports.ED25519_PKCS8_PREFIX = exports.X25519_SPKI_PREFIX = exports.X25519_PKCS8_PREFIX = void 0;
 const bytes_1 = require("../../util/bytes");
 exports.X25519_PKCS8_PREFIX = (0, bytes_1.hexToBytes)('302e020100300506032b656e04220420');
+exports.X25519_SPKI_PREFIX = (0, bytes_1.hexToBytes)('302a300506032b656e032100');
 exports.ED25519_PKCS8_PREFIX = (0, bytes_1.hexToBytes)('302e020100300506032b657004220420');
+exports.ED25519_SPKI_PREFIX = (0, bytes_1.hexToBytes)('302a300506032b6570032100');

package/dist/crypto/math/constants.js

@@ -1,11 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_POINT = exports.BASE_POINT = exports.FE_ONE = exports.FE_ZERO = exports.FE_TWO_D = exports.GROUP_L = exports.FIELD_P = void 0;
+exports.IDENTITY_POINT = exports.BASE_POINT = exports.FE_ONE = exports.FE_TWO_D = exports.GROUP_L = exports.FIELD_P = void 0;
 const fe_1 = require("../math/fe");
 exports.FIELD_P = (1n << 255n) - 19n;
 exports.GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
 exports.FE_TWO_D = (0, fe_1.feFromBigInt)(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
-exports.FE_ZERO = (0, fe_1.fe)();
 exports.FE_ONE = (0, fe_1.feFromBigInt)(1n);
 exports.BASE_POINT = Object.freeze({
     x: (0, fe_1.feFromBigInt)(15112221349535400772501151409588531511454012693041857206046113283949847762202n),

package/dist/crypto/math/mod.js

@@ -2,9 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mod = mod;
 exports.modGroup = modGroup;
-exports.modInv = modInv;
 const constants_1 = require("../math/constants");
-const fe_1 = require("../math/fe");
 function mod(value, modulus = constants_1.FIELD_P) {
     const remainder = value % modulus;
     return remainder >= 0n ? remainder : remainder + modulus;
@@ -12,34 +10,3 @@ function mod(value, modulus = constants_1.FIELD_P) {
 function modGroup(value) {
     return mod(value, constants_1.GROUP_L);
 }
-function modInv(value, modulus = constants_1.FIELD_P) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    if (modulus === constants_1.FIELD_P) {
-        return fieldInv(value);
-    }
-    return modPow(value, modulus - 2n, modulus);
-}
-function fieldInv(x) {
-    const a = (0, fe_1.feFromBigInt)(mod(x));
-    const out = (0, fe_1.fe)();
-    (0, fe_1.feInv)(out, a);
-    return (0, fe_1.feToBigInt)(out);
-}
-function modPow(base, exponent, modulus) {
-    if (modulus <= 0n) {
-        throw new Error('modulus must be positive');
-    }
-    let result = 1n;
-    let current = ((base % modulus) + modulus) % modulus;
-    let e = exponent;
-    while (e > 0n) {
-        if ((e & 1n) === 1n) {
-            result = (result * current) % modulus;
-        }
-        current = (current * current) % modulus;
-        e >>= 1n;
-    }
-    return result;
-}