refactor: backwards compatibility for node < 12

.github/workflows/test.yml

@@ -30,6 +30,8 @@ jobs:
         node-version:
           - 10.13.0
           - 10
+          - 11.0.0
+          - 11
           - 12.0.0
           - 12
           - 13.0.0

README.md

@@ -336,9 +336,8 @@ private API and is subject to change between any versions.
 
 #### How do I use it outside of Node.js
 
-It is **only built for ^10.13.0 || >=12.0.0 Node.js** environment - including `jose` in
-transpiled browser-environment targeted projects is not supported and may result in unexpected
-results.
+It is **only built for >=10.13.0 Node.js** environment - including `jose` in transpiled
+browser-environment targeted projects is not supported and may result in unexpected results.
 
 #### How is it different from [`jws`](https://github.com/brianloveswords/node-jws), [`jwa`](https://github.com/brianloveswords/node-jwa) or [`jsonwebtoken`](https://github.com/auth0/node-jsonwebtoken)?
 

lib/help/key_object.js

@@ -1,11 +1,16 @@
 let { createPublicKey, createPrivateKey, createSecretKey, KeyObject } = require('crypto')
 
-if (!createPublicKey || !createPrivateKey || !createSecretKey || !KeyObject) {
+const { keyObjectSupported } = require('./runtime_support')
+
+let asInput
+
+if (!keyObjectSupported) {
   const { EOL } = require('os')
 
   const errors = require('../errors')
   const isObject = require('./is_object')
   const asn1 = require('./asn1')
+  const toInput = Symbol('toInput')
 
   const namedCurve = Symbol('namedCurve')
   const map = new WeakMap()
@@ -17,6 +22,14 @@ if (!createPublicKey || !createPrivateKey || !createSecretKey || !KeyObject) {
     return map.get(ctx)
   }
 
+  asInput = (keyObject, needsPublic) => {
+    if (keyObject instanceof KeyObject) {
+      return keyObject[toInput](needsPublic)
+    }
+
+    return createSecretKey(keyObject)[toInput](needsPublic)
+  }
+
   const pemToDer = pem => Buffer.from(pem.replace(/(?:-----(?:BEGIN|END)(?: (?:RSA|EC))? (?:PRIVATE|PUBLIC) KEY-----|\s)/g, ''), 'base64')
   const derToPem = (der, label) => `-----BEGIN ${label}-----${EOL}${der.toString('base64').match(/.{1,64}/g).join(EOL)}${EOL}-----END ${label}-----`
 
@@ -168,7 +181,7 @@ if (!createPublicKey || !createPrivateKey || !createSecretKey || !KeyObject) {
       return i(this).symmetricKeySize
     }
 
-    asInput (needsPublic = false) {
+    [toInput] (needsPublic) {
       switch (i(this).type) {
         case 'secret':
           return i(this).buffer
@@ -180,7 +193,7 @@ if (!createPublicKey || !createPrivateKey || !createSecretKey || !KeyObject) {
               i(this).pub = createPublicKey(this)
             }
 
-            return i(this).pub.asInput()
+            return i(this).pub[toInput](false)
           }
 
           return i(this).pem
@@ -415,6 +428,8 @@ if (!createPublicKey || !createPrivateKey || !createSecretKey || !KeyObject) {
         throw new TypeError('type must be one of "pkcs8", "pkcs1" or "sec1"')
     }
   }
+} else {
+  asInput = (input) => input
 }
 
-module.exports = { createPublicKey, createPrivateKey, createSecretKey, KeyObject }
+module.exports = { createPublicKey, createPrivateKey, createSecretKey, KeyObject, asInput }

lib/help/runtime_support.js

@@ -4,6 +4,6 @@ const [major, minor] = process.version.substr(1).split('.').map(x => parseInt(x,
 
 module.exports = {
   oaepHashSupported: major > 12 || (major === 12 && minor >= 9),
-  keyObjectSupported: !!KeyObject,
+  keyObjectSupported: !!KeyObject && major >= 12,
   edDSASupported: !!sign && !!verify
 }

lib/jwa/aes_gcm.js

@@ -3,6 +3,7 @@ const { createCipheriv, createDecipheriv } = require('crypto')
 
 const { KEYOBJECT } = require('../help/consts')
 const { JWEInvalid, JWEDecryptionFailed } = require('../errors')
+const { asInput } = require('../help/key_object')
 
 const checkInput = function (size, iv, tag) {
   if (iv.length !== 12) {
@@ -16,7 +17,7 @@ const checkInput = function (size, iv, tag) {
 }
 
 const encrypt = (size, { [KEYOBJECT]: keyObject }, cleartext, { iv, aad = Buffer.alloc(0) }) => {
-  const key = keyObject.asInput ? keyObject.asInput() : keyObject
+  const key = asInput(keyObject, false)
   checkInput(size, iv)
 
   const cipher = createCipheriv(`aes-${size}-gcm`, key, iv)
@@ -29,7 +30,7 @@ const encrypt = (size, { [KEYOBJECT]: keyObject }, cleartext, { iv, aad = Buffer
 }
 
 const decrypt = (size, { [KEYOBJECT]: keyObject }, ciphertext, { iv, tag = Buffer.alloc(0), aad = Buffer.alloc(0) }) => {
-  const key = keyObject.asInput ? keyObject.asInput() : keyObject
+  const key = asInput(keyObject, false)
   checkInput(size, iv, tag)
 
   try {

lib/jwa/aes_kw.js

@@ -4,6 +4,7 @@ const { createCipheriv, createDecipheriv } = require('crypto')
 const uint64be = require('../help/uint64be')
 const timingSafeEqual = require('../help/timing_safe_equal')
 const { KEYOBJECT } = require('../help/consts')
+const { asInput } = require('../help/key_object')
 
 const checkInput = (data) => {
   if (data !== undefined && data.length % 8 !== 0) {
@@ -32,7 +33,7 @@ const split = (input, size) => {
 }
 
 const wrapKey = (size, { [KEYOBJECT]: keyObject }, payload) => {
-  const key = keyObject.asInput ? keyObject.asInput() : keyObject
+  const key = asInput(keyObject, false)
   const iv = Buffer.alloc(16)
   let R = split(payload, 8)
   let A
@@ -56,7 +57,7 @@ const wrapKey = (size, { [KEYOBJECT]: keyObject }, payload) => {
 }
 
 const unwrapKey = (size, { [KEYOBJECT]: keyObject }, payload) => {
-  const key = keyObject.asInput ? keyObject.asInput() : keyObject
+  const key = asInput(keyObject, false)
   checkInput(payload)
 
   const iv = Buffer.alloc(16)

lib/jwa/ecdsa.js

@@ -4,31 +4,32 @@ const { sign: signOneShot, verify: verifyOneShot, createSign, createVerify } = r
 const { derToJose, joseToDer } = require('../help/ecdsa_signatures')
 const { KEYOBJECT } = require('../help/consts')
 const resolveNodeAlg = require('../help/node_alg')
+const { asInput } = require('../help/key_object')
 
 let sign, verify
 
 if (signOneShot) {
   sign = (jwaAlg, nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
-    return derToJose(signOneShot(nodeAlg, payload, keyObject), jwaAlg)
+    return derToJose(signOneShot(nodeAlg, payload, asInput(keyObject, false)), jwaAlg)
   }
 } else {
   sign = (jwaAlg, nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
-    return derToJose(createSign(nodeAlg).update(payload).sign(keyObject.asInput()), jwaAlg)
+    return derToJose(createSign(nodeAlg).update(payload).sign(asInput(keyObject, false)), jwaAlg)
   }
 }
 
 if (verifyOneShot) {
   verify = (jwaAlg, nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
     try {
-      return verifyOneShot(nodeAlg, payload, keyObject, joseToDer(signature, jwaAlg))
+      return verifyOneShot(nodeAlg, payload, asInput(keyObject, true), joseToDer(signature, jwaAlg))
     } catch (err) {
       return false
     }
   }
 } else {
   verify = (jwaAlg, nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
     try {
-      return createVerify(nodeAlg).update(payload).verify(keyObject.asInput(true), joseToDer(signature, jwaAlg))
+      return createVerify(nodeAlg).update(payload).verify(asInput(keyObject, true), joseToDer(signature, jwaAlg))
     } catch (err) {
       return false
     }

lib/jwa/hmac.js

@@ -4,15 +4,16 @@ const { createHmac } = require('crypto')
 const { KEYOBJECT } = require('../help/consts')
 const timingSafeEqual = require('../help/timing_safe_equal')
 const resolveNodeAlg = require('../help/node_alg')
+const { asInput } = require('../help/key_object')
 
 const sign = (jwaAlg, hmacAlg, { [KEYOBJECT]: keyObject }, payload) => {
-  const hmac = createHmac(hmacAlg, keyObject.asInput ? keyObject.asInput() : keyObject)
+  const hmac = createHmac(hmacAlg, asInput(keyObject, false))
   hmac.update(payload)
   return hmac.digest()
 }
 
 const verify = (jwaAlg, hmacAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
-  const hmac = createHmac(hmacAlg, keyObject.asInput ? keyObject.asInput() : keyObject)
+  const hmac = createHmac(hmacAlg, asInput(keyObject, false))
   hmac.update(payload)
   const expected = hmac.digest()
   const actual = signature

lib/jwa/rsaes.js

@@ -2,6 +2,7 @@ const { strict: assert } = require('assert')
 const { publicEncrypt, privateDecrypt, constants } = require('crypto')
 
 const { KEYOBJECT } = require('../help/consts')
+const { asInput } = require('../help/key_object')
 
 const resolvePadding = (alg) => {
   switch (alg) {
@@ -25,12 +26,12 @@ const resolveOaepHash = (alg) => {
 }
 
 const wrapKey = (padding, oaepHash, { [KEYOBJECT]: keyObject }, payload) => {
-  const key = keyObject.asInput ? keyObject.asInput(true) : keyObject
+  const key = asInput(keyObject, true)
   return { wrapped: publicEncrypt({ key, oaepHash, padding }, payload) }
 }
 
 const unwrapKey = (padding, oaepHash, { [KEYOBJECT]: keyObject }, payload) => {
-  const key = keyObject.asInput ? keyObject.asInput(false) : keyObject
+  const key = asInput(keyObject, false)
   return privateDecrypt({ key, oaepHash, padding }, payload)
 }
 

lib/jwa/rsassa.js

@@ -3,6 +3,7 @@ const { sign: signOneShot, verify: verifyOneShot, createSign, createVerify } = r
 
 const { KEYOBJECT } = require('../help/consts')
 const resolveNodeAlg = require('../help/node_alg')
+const { asInput } = require('../help/key_object')
 
 let sign, verify
 
@@ -12,7 +13,7 @@ if (signOneShot) {
   }
 } else {
   sign = (nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
-    return createSign(nodeAlg).update(payload).sign(keyObject.asInput())
+    return createSign(nodeAlg).update(payload).sign(asInput(keyObject, false))
   }
 }
 
@@ -23,7 +24,7 @@ if (verifyOneShot) {
 } else {
   verify = (nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
     try {
-      return createVerify(nodeAlg).update(payload).verify(keyObject.asInput(true), signature)
+      return createVerify(nodeAlg).update(payload).verify(asInput(keyObject, true), signature)
     } catch (err) {
       return false
     }

lib/jwa/rsassa_pss.js

@@ -9,20 +9,21 @@ const {
 
 const { KEYOBJECT } = require('../help/consts')
 const resolveNodeAlg = require('../help/node_alg')
+const { asInput } = require('../help/key_object')
 
 let sign, verify
 
 if (signOneShot) {
   sign = (nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
     return signOneShot(nodeAlg, payload, {
-      key: keyObject,
+      key: asInput(keyObject, false),
       padding: constants.RSA_PKCS1_PSS_PADDING,
       saltLength: constants.RSA_PSS_SALTLEN_DIGEST
     })
   }
 } else {
   sign = (nodeAlg, { [KEYOBJECT]: keyObject }, payload) => {
-    const key = keyObject.asInput()
+    const key = asInput(keyObject, false)
     return createSign(nodeAlg).update(payload).sign({
       key,
       padding: constants.RSA_PKCS1_PSS_PADDING,
@@ -34,14 +35,14 @@ if (signOneShot) {
 if (verifyOneShot) {
   verify = (nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
     return verifyOneShot(nodeAlg, payload, {
-      key: keyObject,
+      key: asInput(keyObject, false),
       padding: constants.RSA_PKCS1_PSS_PADDING,
       saltLength: constants.RSA_PSS_SALTLEN_DIGEST
     }, signature)
   }
 } else {
   verify = (nodeAlg, { [KEYOBJECT]: keyObject }, payload, signature) => {
-    const key = keyObject.asInput(true)
+    const key = asInput(keyObject, true)
     return createVerify(nodeAlg).update(payload).verify({
       key,
       padding: constants.RSA_PKCS1_PSS_PADDING,

package.json

@@ -70,7 +70,7 @@
     "standard": "^14.3.1"
   },
   "engines": {
-    "node": "^10.13.0 || >=12.0.0"
+    "node": ">=10.13.0"
   },
   "ava": {
     "babel": false,