@jc-lab/jose/lib/jwa/rsassa_pss.js

JSON Web Almost Everything - JWA, JWS, JWE, JWK, JWT, JWKS for Node.js with minimal dependencies

const { strict: assert } = require('assert')
const {
  sign: signOneShot,
  verify: verifyOneShot,
  createSign,
  createVerify,
  constants
} = require('crypto')

const { KEYOBJECT } = require('../help/consts')
const resolveNodeAlg = require('../help/node_alg')

let sign, verify

if (signOneShot) {
  sign = (nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
    return signOneShot(nodeAlg, payload, {
      key: keyObject,
      padding: constants.RSA_PKCS1_PSS_PADDING,
      saltLength: constants.RSA_PSS_SALTLEN_DIGEST
    })
  }
} else {
  sign = (nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
    const key = keyObject.asInput()
    return createSign(nodeAlg).update(payload).sign({
      key,
      padding: constants.RSA_PKCS1_PSS_PADDING,
      saltLength: constants.RSA_PSS_SALTLEN_DIGEST
    })
  }
}

if (verifyOneShot) {
  verify = (nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
    return verifyOneShot(nodeAlg, payload, {
      key: keyObject,
      padding: constants.RSA_PKCS1_PSS_PADDING,
      saltLength: constants.RSA_PSS_SALTLEN_DIGEST
    }, signature)
  }
} else {
  verify = (nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
    const key = keyObject.asInput(true)
    return createVerify(nodeAlg).update(payload).verify({
      key,
      padding: constants.RSA_PKCS1_PSS_PADDING,
      saltLength: constants.RSA_PSS_SALTLEN_DIGEST
    }, signature)
  }
}

module.exports = (JWA) => {
  ['PS256', 'PS384', 'PS512'].forEach((jwaAlg) => {
    const nodeAlg = resolveNodeAlg(jwaAlg)

    assert(!JWA.sign.has(jwaAlg), `sign alg ${jwaAlg} already registered`)
    assert(!JWA.verify.has(jwaAlg), `verify alg ${jwaAlg} already registered`)

    JWA.sign.set(jwaAlg, sign.bind(undefined, nodeAlg))
    JWA.verify.set(jwaAlg, verify.bind(undefined, nodeAlg))
  })
}