Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

jose-browser-runtime

Package Overview
Dependencies
Maintainers
1
Versions
132
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

jose-browser-runtime - npm Package Compare versions

Comparing version 4.0.4 to 4.1.0

dist/browser/lib/aesgcmkw.js

2

dist/browser/lib/check_key_type.js

@@ -1,2 +0,2 @@

import invalidKeyInput from '../runtime/invalid_key_input.js';
import invalidKeyInput from './invalid_key_input.js';
import isKeyLike, { types } from '../runtime/is_key_like.js';

@@ -3,0 +3,0 @@ const symmetricTypeCheck = (key) => {

import { isCloudflareWorkers, isNodeJs } from '../runtime/global.js';
function unusable(name, prop = 'algorithm.name') {
return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
}
function isAlgorithm(algorithm, name) {
return algorithm.name === name;
}
function getHashLength(hash) {
return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
return parseInt(hash.name.substr(4), 10);
}

@@ -13,2 +19,4 @@ function getNamedCurve(alg) {

return 'P-521';
default:
throw new Error('unreachable');
}

@@ -37,10 +45,8 @@ }

case 'HS512': {
if (key.algorithm.name !== 'HMAC') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
}
if (!isAlgorithm(key.algorithm, 'HMAC'))
throw unusable('HMAC');
const expected = parseInt(alg.substr(2), 10);
const actual = getHashLength(key.algorithm.hash);
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
}
if (actual !== expected)
throw unusable(`SHA-${expected}`, 'algorithm.hash');
break;

@@ -51,10 +57,8 @@ }

case 'RS512': {
if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
}
if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
throw unusable('RSASSA-PKCS1-v1_5');
const expected = parseInt(alg.substr(2), 10);
const actual = getHashLength(key.algorithm.hash);
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
}
if (actual !== expected)
throw unusable(`SHA-${expected}`, 'algorithm.hash');
break;

@@ -65,22 +69,18 @@ }

case 'PS512': {
if (key.algorithm.name !== 'RSA-PSS') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
}
if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
throw unusable('RSA-PSS');
const expected = parseInt(alg.substr(2), 10);
const actual = getHashLength(key.algorithm.hash);
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
}
if (actual !== expected)
throw unusable(`SHA-${expected}`, 'algorithm.hash');
break;
}
case isNodeJs() && 'EdDSA': {
if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
}
if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
throw unusable('NODE-ED25519 or NODE-ED448');
break;
}
case isCloudflareWorkers() && 'EdDSA': {
if (key.algorithm.name !== 'NODE-ED25519') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519.`);
}
if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
throw unusable('NODE-ED25519');
break;

@@ -91,10 +91,8 @@ }

case 'ES512': {
if (key.algorithm.name !== 'ECDSA') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
}
if (!isAlgorithm(key.algorithm, 'ECDSA'))
throw unusable('ECDSA');
const expected = getNamedCurve(alg);
const actual = key.algorithm.namedCurve;
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
}
if (actual !== expected)
throw unusable(expected, 'algorithm.namedCurve');
break;

@@ -112,10 +110,8 @@ }

case 'A256GCM': {
if (key.algorithm.name !== 'AES-GCM') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
}
if (!isAlgorithm(key.algorithm, 'AES-GCM'))
throw unusable('AES-GCM');
const expected = parseInt(alg.substr(1, 3), 10);
const actual = key.algorithm.length;
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
}
if (actual !== expected)
throw unusable(expected, 'algorithm.length');
break;

@@ -126,16 +122,13 @@ }

case 'A256KW': {
if (key.algorithm.name !== 'AES-KW') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
}
if (!isAlgorithm(key.algorithm, 'AES-KW'))
throw unusable('AES-KW');
const expected = parseInt(alg.substr(1, 3), 10);
const actual = key.algorithm.length;
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
}
if (actual !== expected)
throw unusable(expected, 'algorithm.length');
break;
}
case 'ECDH-ES':
if (key.algorithm.name !== 'ECDH') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
}
if (!isAlgorithm(key.algorithm, 'ECDH'))
throw unusable('ECDH');
break;

@@ -145,5 +138,4 @@ case 'PBES2-HS256+A128KW':

case 'PBES2-HS512+A256KW':
if (key.algorithm.name !== 'PBKDF2') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
}
if (!isAlgorithm(key.algorithm, 'PBKDF2'))
throw unusable('PBKDF2');
break;

@@ -154,10 +146,8 @@ case 'RSA-OAEP':

case 'RSA-OAEP-512': {
if (key.algorithm.name !== 'RSA-OAEP') {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
}
if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
throw unusable('RSA-OAEP');
const expected = parseInt(alg.substr(9), 10) || 1;
const actual = getHashLength(key.algorithm.hash);
if (actual !== expected) {
throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
}
if (actual !== expected)
throw unusable(`SHA-${expected}`, 'algorithm.hash');
break;

@@ -164,0 +154,0 @@ }

@@ -5,3 +5,2 @@ import { unwrap as aesKw } from '../runtime/aeskw.js';

import { decrypt as rsaEs } from '../runtime/rsaes.js';
import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
import { decode as base64url } from '../runtime/base64url.js';

@@ -13,2 +12,3 @@ import { JOSENotSupported, JWEInvalid } from '../util/errors.js';

import isObject from './is_object.js';
import { unwrap as aesGcmKw } from './aesgcmkw.js';
async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {

@@ -15,0 +15,0 @@ checkKeyType(alg, key, 'decrypt');

@@ -5,3 +5,2 @@ import { wrap as aesKw } from '../runtime/aeskw.js';

import { encrypt as rsaEs } from '../runtime/rsaes.js';
import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
import { encode as base64url } from '../runtime/base64url.js';

@@ -12,2 +11,3 @@ import generateCek, { bitLength as cekLength } from '../lib/cek.js';

import checkKeyType from './check_key_type.js';
import { wrap as aesGcmKw } from './aesgcmkw.js';
async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {

@@ -14,0 +14,0 @@ let encryptedKey;

import bogusWebCrypto from './bogus.js';
import crypto, { isCryptoKey } from './webcrypto.js';
import { checkEncCryptoKey } from '../lib/crypto_key.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
function checkKeySize(key, alg) {

@@ -6,0 +6,0 @@ if (key.algorithm.length !== parseInt(alg.substr(1, 3), 10)) {

import globalThis, { isCloudflareWorkers, isNodeJs } from './global.js';
import crypto, { isCryptoKey } from './webcrypto.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
import { encodeBase64 } from './base64url.js';

@@ -66,3 +66,3 @@ import formatPEM from '../lib/format_pem.js';

case 'PS512':
algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${alg.substr(-3)}` } };
algorithm = { name: 'RSA-PSS', hash: `SHA-${alg.substr(-3)}` };
keyUsages = isPublic ? ['verify'] : ['sign'];

@@ -73,3 +73,3 @@ break;

case 'RS512':
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${alg.substr(-3)}` } };
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.substr(-3)}` };
keyUsages = isPublic ? ['verify'] : ['sign'];

@@ -83,3 +83,3 @@ break;

name: 'RSA-OAEP',
hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
hash: `SHA-${parseInt(alg.substr(-3), 10) || 1}`,
};

@@ -86,0 +86,0 @@ keyUsages = isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];

const bogusWebCrypto = [
{ hash: { name: 'SHA-256' }, name: 'HMAC' },
{ hash: 'SHA-256', name: 'HMAC' },
true,

@@ -4,0 +4,0 @@ ['sign'],

@@ -8,3 +8,3 @@ import { concat, uint64be } from '../lib/buffer_utils.js';

import { checkEncCryptoKey } from '../lib/crypto_key.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {

@@ -17,3 +17,3 @@ if (!(cek instanceof Uint8Array)) {

const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
hash: { name: `SHA-${keySize << 1}` },
hash: `SHA-${keySize << 1}`,
name: 'HMAC',

@@ -20,0 +20,0 @@ }, false, ['sign']);

@@ -5,3 +5,3 @@ import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';

import digest from './digest.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
export const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {

@@ -8,0 +8,0 @@ if (!isCryptoKey(publicKey)) {

@@ -6,3 +6,3 @@ import { concat, uint64be } from '../lib/buffer_utils.js';

import { checkEncCryptoKey } from '../lib/crypto_key.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
import { JOSENotSupported } from '../util/errors.js';

@@ -16,3 +16,3 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {

const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
hash: { name: `SHA-${keySize << 1}` },
hash: `SHA-${keySize << 1}`,
name: 'HMAC',

@@ -19,0 +19,0 @@ }, false, ['sign']);

@@ -15,3 +15,3 @@ import { isCloudflareWorkers, isNodeJs } from './global.js';

length = parseInt(alg.substr(-3), 10);
algorithm = { name: 'HMAC', hash: { name: `SHA-${length}` }, length };
algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
keyUsages = ['sign', 'verify'];

@@ -64,3 +64,3 @@ break;

name: 'RSA-PSS',
hash: { name: `SHA-${alg.substr(-3)}` },
hash: `SHA-${alg.substr(-3)}`,
publicExponent: new Uint8Array([0x01, 0x00, 0x01]),

@@ -76,3 +76,3 @@ modulusLength: getModulusLengthOption(options),

name: 'RSASSA-PKCS1-v1_5',
hash: { name: `SHA-${alg.substr(-3)}` },
hash: `SHA-${alg.substr(-3)}`,
publicExponent: new Uint8Array([0x01, 0x00, 0x01]),

@@ -89,3 +89,3 @@ modulusLength: getModulusLengthOption(options),

name: 'RSA-OAEP',
hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
hash: `SHA-${parseInt(alg.substr(-3), 10) || 1}`,
publicExponent: new Uint8Array([0x01, 0x00, 0x01]),

@@ -92,0 +92,0 @@ modulusLength: getModulusLengthOption(options),

import crypto, { isCryptoKey } from './webcrypto.js';
import { checkSigCryptoKey } from '../lib/crypto_key.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
export default function getCryptoKey(alg, key, usage) {

@@ -13,5 +13,5 @@ if (isCryptoKey(key)) {

}
return crypto.subtle.importKey('raw', key, { hash: { name: `SHA-${alg.substr(-3)}` }, name: 'HMAC' }, false, [usage]);
return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.substr(-3)}`, name: 'HMAC' }, false, [usage]);
}
throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
}

@@ -14,3 +14,3 @@ import { isCloudflareWorkers, isNodeJs } from './global.js';

case 'HS512':
algorithm = { name: 'HMAC', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
algorithm = { name: 'HMAC', hash: `SHA-${jwk.alg.substr(-3)}` };
keyUsages = ['sign', 'verify'];

@@ -53,3 +53,3 @@ break;

case 'PS512':
algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.substr(-3)}` };
keyUsages = jwk.d ? ['sign'] : ['verify'];

@@ -60,3 +60,3 @@ break;

case 'RS512':
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.substr(-3)}` };
keyUsages = jwk.d ? ['sign'] : ['verify'];

@@ -70,3 +70,3 @@ break;

name: 'RSA-OAEP',
hash: { name: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}` },
hash: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}`,
};

@@ -73,0 +73,0 @@ keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];

import crypto, { isCryptoKey } from './webcrypto.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
import { encode as base64url } from './base64url.js';

@@ -4,0 +4,0 @@ const keyToJWK = async (key) => {

@@ -8,3 +8,3 @@ import random from './random.js';

import { checkEncCryptoKey } from '../lib/crypto_key.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
function getCryptoKey(key, alg) {

@@ -20,3 +20,3 @@ if (key instanceof Uint8Array) {

}
export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
async function deriveKey(p2s, alg, p2c, key) {
checkP2s(p2s);

@@ -26,3 +26,3 @@ const salt = concatSalt(alg, p2s);

const subtleAlg = {
hash: { name: `SHA-${alg.substr(8, 3)}` },
hash: `SHA-${alg.substr(8, 3)}`,
iterations: p2c,

@@ -37,12 +37,12 @@ name: 'PBKDF2',

const cryptoKey = await getCryptoKey(key, alg);
let derived;
if (cryptoKey.usages.includes('deriveBits')) {
derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
}
else if (cryptoKey.usages.includes('deriveKey')) {
derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey']);
if (cryptoKey.usages.includes('deriveKey')) {
return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
}
else {
throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
}
throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
}
export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
const derived = await deriveKey(p2s, alg, p2c, key);
const encryptedKey = await wrap(alg.substr(-6), derived, cek);

@@ -52,27 +52,4 @@ return { encryptedKey, p2c, p2s: base64url(p2s) };

export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
checkP2s(p2s);
const salt = concatSalt(alg, p2s);
const keylen = parseInt(alg.substr(13, 3), 10);
const subtleAlg = {
hash: { name: `SHA-${alg.substr(8, 3)}` },
iterations: p2c,
name: 'PBKDF2',
salt,
};
const wrapAlg = {
length: keylen,
name: 'AES-KW',
};
const cryptoKey = await getCryptoKey(key, alg);
let derived;
if (cryptoKey.usages.includes('deriveBits')) {
derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
}
else if (cryptoKey.usages.includes('deriveKey')) {
derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['unwrapKey']);
}
else {
throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
}
const derived = await deriveKey(p2s, alg, p2c, key);
return unwrap(alg.substr(-6), derived, encryptedKey);
};

@@ -6,3 +6,3 @@ import subtleAlgorithm from './subtle_rsaes.js';

import checkKeyLength from './check_key_length.js';
import invalidKeyInput from './invalid_key_input.js';
import invalidKeyInput from '../lib/invalid_key_input.js';
export const encrypt = async (alg, key, cek) => {

@@ -9,0 +9,0 @@ if (!isCryptoKey(key)) {

import { isCloudflareWorkers, isNodeJs } from './global.js';
import { JOSENotSupported } from '../util/errors.js';
export default function subtleDsa(alg, crv) {
export default function subtleDsa(alg, namedCurve) {
const length = parseInt(alg.substr(-3), 10);
switch (alg) {
case 'HS256':
return { hash: { name: 'SHA-256' }, name: 'HMAC' };
case 'HS384':
return { hash: { name: 'SHA-384' }, name: 'HMAC' };
case 'HS512':
return { hash: { name: 'SHA-512' }, name: 'HMAC' };
return { hash: `SHA-${length}`, name: 'HMAC' };
case 'PS256':
return {
hash: { name: 'SHA-256' },
name: 'RSA-PSS',
saltLength: 256 >> 3,
};
case 'PS384':
return {
hash: { name: 'SHA-384' },
name: 'RSA-PSS',
saltLength: 384 >> 3,
};
case 'PS512':
return {
hash: { name: 'SHA-512' },
name: 'RSA-PSS',
saltLength: 512 >> 3,
};
return { hash: `SHA-${length}`, name: 'RSA-PSS', saltLength: length >> 3 };
case 'RS256':
return { hash: { name: 'SHA-256' }, name: 'RSASSA-PKCS1-v1_5' };
case 'RS384':
return { hash: { name: 'SHA-384' }, name: 'RSASSA-PKCS1-v1_5' };
case 'RS512':
return { hash: { name: 'SHA-512' }, name: 'RSASSA-PKCS1-v1_5' };
return { hash: `SHA-${length}`, name: 'RSASSA-PKCS1-v1_5' };
case 'ES256':
return { hash: { name: 'SHA-256' }, name: 'ECDSA', namedCurve: 'P-256' };
case 'ES384':
return { hash: { name: 'SHA-384' }, name: 'ECDSA', namedCurve: 'P-384' };
case 'ES512':
return { hash: { name: 'SHA-512' }, name: 'ECDSA', namedCurve: 'P-521' };
return { hash: `SHA-${length}`, name: 'ECDSA', namedCurve };
case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
return { name: crv, namedCurve: crv };
return { name: namedCurve, namedCurve };
default:

@@ -44,0 +25,0 @@ throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

{
"name": "jose-browser-runtime",
"version": "4.0.4",
"version": "4.1.0",
"description": "(Browser Runtime) 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",

@@ -61,2 +61,5 @@ "keywords": [

"dist/types/**/*.d.ts",
"!dist/**/*.bundle.js",
"!dist/**/*.umd.js",
"!dist/**/*.min.js",
"!dist/node/webcrypto/**/*",

@@ -63,0 +66,0 @@ "!dist/types/runtime/*",

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc