@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
110 lines (109 loc) • 3.56 kB
JavaScript
import { TypedArrayEncoder } from "../../../../utils/TypedArrayEncoder.mjs";
import "../../../../utils/index.mjs";
import { KeyManagementError } from "../../error/KeyManagementError.mjs";
import { getJwkHumanDescription } from "../humanDescription.mjs";
//#region src/modules/kms/jwk/alg/signing.ts
/**
* Get the allowed algs for a signing key. If takes all the known supported
* algs and will filter these based on the optional `alg` key in the JWK.
*
* This does not handle the intended key `use` and `key_ops`.
*/
function allowedSigningAlgsForSigningKey(jwk) {
const supportedAlgs = supportedSigningAlgsForKey(jwk);
const allowedAlg = jwk.alg;
return !allowedAlg ? supportedAlgs : allowedAlg && supportedAlgs.includes(allowedAlg) ? [allowedAlg] : [];
}
function assertAllowedSigningAlgForKey(jwk, algorithm) {
const allowedAlgs = allowedSigningAlgsForSigningKey(jwk);
if (!allowedAlgs.includes(algorithm)) {
const allowedAlgsText = allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(", ")}` : "";
throw new KeyManagementError(`${getJwkHumanDescription(jwk)} cannot be used with algorithm '${algorithm}' for signature creation or verification.${allowedAlgsText}`);
}
}
function supportedSigningAlgsForKey(jwk) {
if (jwk.kty === "EC" || jwk.kty === "OKP") switch (jwk.crv) {
case "secp256k1": return ["ES256K"];
case "P-256": return ["ES256"];
case "P-384": return ["ES384"];
case "P-521": return ["ES512"];
case "Ed25519": return ["EdDSA", "Ed25519"];
default: return [];
}
if (jwk.kty === "RSA") {
const keyBits = TypedArrayEncoder.fromBase64Url(jwk.n).length * 8;
const minBits2048 = ["PS256", "RS256"];
const minBits3072 = [
...minBits2048,
"RS384",
"PS384"
];
const minBits4096 = [
...minBits3072,
"RS512",
"PS512"
];
return keyBits >= 4096 ? minBits4096 : keyBits >= 3072 ? minBits3072 : keyBits >= 2048 ? minBits2048 : [];
}
if (jwk.kty === "oct") {
const keyBits = TypedArrayEncoder.fromBase64Url(jwk.k).length * 8;
const minBits256 = ["HS256"];
const minBits384 = [...minBits256, "HS384"];
const minBits512 = [...minBits384, "HS512"];
return keyBits >= 512 ? minBits512 : keyBits >= 384 ? minBits384 : keyBits >= 256 ? minBits256 : [];
}
return [];
}
function createKeyTypeForSigningAlgorithm(algorithm) {
if (algorithm === "ES256") return {
kty: "EC",
crv: "P-256"
};
if (algorithm === "ES384") return {
kty: "EC",
crv: "P-384"
};
if (algorithm === "ES512") return {
kty: "EC",
crv: "P-521"
};
if (algorithm === "ES256K") return {
kty: "EC",
crv: "secp256k1"
};
if (algorithm === "EdDSA" || algorithm === "Ed25519") return {
kty: "OKP",
crv: "Ed25519"
};
if (algorithm === "HS256") return {
kty: "oct",
algorithm: "hmac",
length: 256
};
if (algorithm === "HS384") return {
kty: "oct",
algorithm: "hmac",
length: 384
};
if (algorithm === "HS512") return {
kty: "oct",
algorithm: "hmac",
length: 512
};
if (algorithm === "PS256" || algorithm === "RS256") return {
kty: "RSA",
modulusLength: 2048
};
if (algorithm === "PS384" || algorithm === "RS384") return {
kty: "RSA",
modulusLength: 3072
};
if (algorithm === "PS512" || algorithm === "RS512") return {
kty: "RSA",
modulusLength: 4096
};
throw new KeyManagementError(`unknown signature algorithm '${algorithm}' for creating key `);
}
//#endregion
export { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, createKeyTypeForSigningAlgorithm, supportedSigningAlgsForKey };
//# sourceMappingURL=signing.mjs.map