Separate dhkemSecp256k1HkdfSha256 from core module.

.github/workflows/ci.yml

@@ -27,3 +27,8 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.lcov
           flags: unittests
+      - name: Run deno test for /x/dhkemSecp256k1HkdfSha256
+        working-directory: ./x/dhkemSecp256k1HkdfSha256
+        run: |
+          deno fmt --check
+          deno task test

.github/workflows/ci_browser.yml

@@ -24,6 +24,13 @@ jobs:
           npm install -g esbuild
           deno task dnt
           deno task minify > test/pages/src/hpke.js
+          mkdir test/pages/dhkemSecp256k1HkdfSha256
+          cp -rf x/dhkemSecp256k1HkdfSha256/test/runtimes/browsers/pages/* test/pages/dhkemSecp256k1HkdfSha256
+          deno task minify > test/pages/dhkemSecp256k1HkdfSha256/src/hpke.js
+      - working-directory: ./x/dhkemSecp256k1HkdfSha256
+        run: |
+          deno task dnt
+          deno task minify > ../../test/pages/dhkemSecp256k1HkdfSha256/src/hpke-dhkemSecp256k1HkdfSha256.js
       - uses: peaceiris/actions-gh-pages@v3
         with:
           deploy_key: ${{ secrets.ACTIONS_DEPLOY_KEY }}
@@ -41,3 +48,5 @@ jobs:
           npm ci
           npx playwright install --with-deps
           npx playwright test
+      - working-directory: ./x/dhkemSecp256k1HkdfSha256/test/runtimes/browsers
+        run: npm install && npx playwright install && npx playwright test

.github/workflows/ci_bun.yml

@@ -24,6 +24,11 @@ jobs:
           npm install -g esbuild
           deno task dnt
           deno task minify > test/bun/src/hpke.js
+          deno task minify > x/dhkemSecp256k1HkdfSha256/test/runtimes/bun/src/hpke.js
+      - working-directory: ./x/dhkemSecp256k1HkdfSha256/
+        run: |
+          deno task dnt
+          deno task minify > test/runtimes/bun/src/hpke-dhkemSecp256k1HkdfSha256.js
       - uses: antongolub/action-setup-bun@v1
         with:
           bun-version: 0.4
@@ -32,4 +37,10 @@ jobs:
         run: |
           nohup bun src/index.js &
           sleep 3
-          deno test hpke.spec.ts --allow-net --allow-env
+          deno test hpke.spec.ts --allow-net
+      - name: Run test for dhkemSecp256k1HkdfSha256
+        working-directory: ./x/dhkemSecp256k1HkdfSha256/test/runtimes/bun
+        run: |
+          nohup bun src/index.js &
+          sleep 3
+          deno test dhkemSecp256k1HkdfSha256.spec.ts --allow-net

.github/workflows/ci_cfw.yml

@@ -24,10 +24,22 @@ jobs:
           npm install -g esbuild
           deno task dnt
           deno task minify > test/wrangler/src/hpke.js
+          deno task minify > x/dhkemSecp256k1HkdfSha256/test/runtimes/cloudflare/src/hpke.js
+      - working-directory: ./x/dhkemSecp256k1HkdfSha256/
+        run: |
+          deno task dnt
+          deno task minify > test/runtimes/cloudflare/src/hpke-dhkemSecp256k1HkdfSha256.js
       - name: Run test
         working-directory: ./test/wrangler
         run: |
           npm install
           nohup npm start &
           sleep 3
-          deno test hpke.spec.ts --allow-net --allow-env
+          deno test hpke.spec.ts --allow-net
+      - name: Run test for dhkemSecp256k1HkdfSha256
+        working-directory: ./x/dhkemSecp256k1HkdfSha256/test/runtimes/cloudflare
+        run: |
+          npm install
+          nohup npm start &
+          sleep 3
+          deno test dhkemSecp256k1HkdfSha256.spec.ts --allow-net

.github/workflows/ci_node.yml

@@ -27,3 +27,8 @@ jobs:
           npm install -g esbuild
           deno task dnt
           deno task minify > ./npm/hpke.min.js
+      - name: Run dnt & minify for /x/dhkemSecp256k1HkdfSha256
+        working-directory: ./x/dhkemSecp256k1HkdfSha256
+        run: |
+          deno task dnt
+          deno task minify > ./npm/hpke-dhkemSecp256k1.min.js

deno.json

@@ -15,6 +15,7 @@
       "test/"
     ],
     "exclude": [
+      "x",
       "samples/node/node_modules",
       "samples/ts-node/node_modules",
       "test/bun",
@@ -25,6 +26,7 @@
   "lint": {
     "include": ["mod.ts", "samples/", "src/", "test/"],
     "exclude": [
+      "x",
       "samples/node/node_modules",
       "samples/ts-node/node_modules",
       "test/bun",

dnt.ts

@@ -1,6 +1,7 @@
 import { build, emptyDir } from "dnt";
 
 await emptyDir("./npm");
+await emptyDir("./x/dhkemSecp256k1HkdfSha256/npm");
 
 await build({
   entryPoints: ["./mod.ts"],

src/cipherSuite.ts

@@ -29,7 +29,6 @@ import {
   DhkemP256HkdfSha256,
   DhkemP384HkdfSha384,
   DhkemP521HkdfSha512,
-  DhkemSecp256K1HkdfSha256,
   DhkemX25519HkdfSha256,
   DhkemX448HkdfSha512,
 } from "./kems/dhkem.ts";
@@ -88,16 +87,16 @@ export class CipherSuite {
         case KemId.DhkemP521HkdfSha512:
           this._kem = new DhkemP521HkdfSha512();
           break;
-        case KemId.DhkemSecp256K1HkdfSha256:
-          this._kem = new DhkemSecp256K1HkdfSha256();
-          break;
         case KemId.DhkemX25519HkdfSha256:
           this._kem = new DhkemX25519HkdfSha256();
           break;
-        default:
-          // case KemId.DhkemX448HkdfSha512:
+        case KemId.DhkemX448HkdfSha512:
           this._kem = new DhkemX448HkdfSha512();
           break;
+        default:
+          throw new errors.InvalidParamError(
+            `The KEM (${params.kem}) cannot be specified by KemId. Use submodule for the KEM`,
+          );
       }
     }
     this.kem = this._kem.id;

src/identifiers.ts

@@ -22,8 +22,10 @@ export const Kem = {
   DhkemP384HkdfSha384: 0x0011,
   /** DHKEM (P-521, HKDF-SHA512). */
   DhkemP521HkdfSha512: 0x0012,
-  /** DHKEM (secp256k1, HKDF-SHA256). EXPERIMENTAL. The KEM id can be changed in the standardization process. */
+  /** DHKEM (secp256k1, HKDF-SHA256). EXPERIMENTAL/DEPRECATED. The KEM id can be changed in the standardization process. */
   DhkemSecp256K1HkdfSha256: 0x0013,
+  /** DHKEM (secp256k1, HKDF-SHA256). EXPERIMENTAL. The KEM id can be changed in the standardization process. */
+  DhkemSecp256k1HkdfSha256: 0x0013,
   /** DHKEM (X25519, HKDF-SHA256) */
   DhkemX25519HkdfSha256: 0x0020,
   /** DHKEM (X448, HKDF-SHA512) */

src/kems/dhkem.ts

@@ -6,7 +6,6 @@ import type { RecipientContextParams } from "../interfaces/recipientContextParam
 
 import { Algorithm } from "../algorithm.ts";
 import { Ec } from "./dhkemPrimitives/ec.ts";
-import { Secp256K1 } from "./dhkemPrimitives/secp256k1.ts";
 import { X25519 } from "./dhkemPrimitives/x25519.ts";
 import { X448 } from "./dhkemPrimitives/x448.ts";
 import { KemId } from "../identifiers.ts";
@@ -250,20 +249,6 @@ export class DhkemP521HkdfSha512 extends Dhkem implements KemInterface {
   }
 }
 
-export class DhkemSecp256K1HkdfSha256 extends Dhkem implements KemInterface {
-  public readonly id: KemId = KemId.DhkemSecp256K1HkdfSha256;
-  public readonly secretSize: number = 32;
-  public readonly encSize: number = 65;
-  public readonly publicKeySize: number = 65;
-  public readonly privateKeySize: number = 32;
-
-  constructor() {
-    const kdf = new HkdfSha256();
-    const prim = new Secp256K1(kdf);
-    super(prim, kdf);
-  }
-}
-
 export class DhkemX25519HkdfSha256 extends Dhkem {
   public readonly id: KemId = KemId.DhkemX25519HkdfSha256;
   public readonly secretSize: number = 32;

test/bun/hpke.spec.ts

@@ -41,18 +41,18 @@ describe("Cloudflare Workers", () => {
     });
   });
 
-  describe("GET /test?kem=0x0013", () => {
-    it("should return ok", async () => {
-      for (const kdf of ["0x0001", "0x0002", "0x0003"]) {
-        for (const aead of ["0x0001", "0x0002", "0x0003"]) {
-          const res = await fetch(
-            `http://localhost:3000/test?kem=0x0013&kdf=${kdf}&aead=${aead}`,
-          );
-          assertEquals("ok", await res.text());
-        }
-      }
-    });
-  });
+  // describe("GET /test?kem=0x0013", () => {
+  //   it("should return ok", async () => {
+  //     for (const kdf of ["0x0001", "0x0002", "0x0003"]) {
+  //       for (const aead of ["0x0001", "0x0002", "0x0003"]) {
+  //         const res = await fetch(
+  //           `http://localhost:3000/test?kem=0x0013&kdf=${kdf}&aead=${aead}`,
+  //         );
+  //         assertEquals("ok", await res.text());
+  //       }
+  //     }
+  //   });
+  // });
 
   describe("GET /test?kem=0x0020", () => {
     it("should return ok", async () => {

test/cipherSuite.test.ts

@@ -1,4 +1,4 @@
-import { assertEquals, assertRejects } from "testing/asserts.ts";
+import { assertEquals, assertRejects, assertThrows } from "testing/asserts.ts";
 
 import { describe, it } from "testing/bdd.ts";
 
@@ -170,26 +170,19 @@ describe("CipherSuite", () => {
     });
   });
 
-  describe("constructor with DhkemP256HkdfSha256/HkdfSha256/ExportOnly", () => {
-    it("should have ciphersuites", async () => {
-      const suite: CipherSuite = new CipherSuite({
-        kem: KemId.DhkemSecp256K1HkdfSha256,
-        kdf: KdfId.HkdfSha256,
-        aead: AeadId.ExportOnly,
-      });
-      const kem = await suite.kemContext();
-      assertEquals(kem.secretSize, 32);
-      assertEquals(kem.encSize, 65);
-      assertEquals(kem.publicKeySize, 65);
-      assertEquals(kem.privateKeySize, 32);
-
+  describe("constructor with DhkemSecp256KHkdfSha256/HkdfSha256/ExportOnly", () => {
+    it("should throw InvalidParamError", async () => {
       // assert
-      assertEquals(suite.kem, KemId.DhkemSecp256K1HkdfSha256);
-      assertEquals(suite.kem, 0x0013);
-      assertEquals(suite.kdf, KdfId.HkdfSha256);
-      assertEquals(suite.kdf, 0x0001);
-      assertEquals(suite.aead, AeadId.ExportOnly);
-      assertEquals(suite.aead, 0xFFFF);
+      await assertThrows(
+        () =>
+          new CipherSuite({
+            kem: KemId.DhkemSecp256k1HkdfSha256,
+            kdf: KdfId.HkdfSha256,
+            aead: AeadId.ExportOnly,
+          }),
+        errors.InvalidParamError,
+        "The KEM (19) cannot be specified by KemId. Use submodule for the KEM",
+      );
     });
   });
 
@@ -667,39 +660,6 @@ describe("CipherSuite", () => {
     });
   });
 
-  describe("A README example of Base mode (KemId.DhkemSecp256K1HkdfSha256/KdfId.HkdfSha256)", () => {
-    it("should work normally", async () => {
-      // setup
-      const suite = new CipherSuite({
-        kem: KemId.DhkemSecp256K1HkdfSha256,
-        kdf: KdfId.HkdfSha256,
-        aead: AeadId.Aes128Gcm,
-      });
-
-      const rkp = await suite.generateKeyPair();
-
-      const sender = await suite.createSenderContext({
-        recipientPublicKey: rkp.publicKey,
-      });
-
-      const recipient = await suite.createRecipientContext({
-        recipientKey: rkp,
-        enc: sender.enc,
-      });
-
-      // encrypt
-      const ct = await sender.seal(
-        new TextEncoder().encode("my-secret-message"),
-      );
-
-      // decrypt
-      const pt = await recipient.open(ct);
-
-      // assert
-      assertEquals(new TextDecoder().decode(pt), "my-secret-message");
-    });
-  });
-
   describe("A README example of Base mode (KemId.DhkemX448HkdfSha256/KdfId.HkdfSha512)", () => {
     it("should work normally with ids", async () => {
       // setup

test/cipherSuiteBackwardCompat.test.ts

@@ -1,4 +1,4 @@
-import { assertEquals, assertRejects } from "testing/asserts.ts";
+import { assertEquals, assertRejects, assertThrows } from "testing/asserts.ts";
 
 import { describe, it } from "testing/bdd.ts";
 
@@ -158,26 +158,19 @@ describe("CipherSuite(backward-compat)", () => {
     });
   });
 
-  describe("constructor with DhkemP256HkdfSha256/HkdfSha256/ExportOnly", () => {
-    it("should have ciphersuites", async () => {
-      const suite: CipherSuite = new CipherSuite({
-        kem: Kem.DhkemSecp256K1HkdfSha256,
-        kdf: Kdf.HkdfSha256,
-        aead: Aead.ExportOnly,
-      });
-      const kem = await suite.kemContext();
-      assertEquals(kem.secretSize, 32);
-      assertEquals(kem.encSize, 65);
-      assertEquals(kem.publicKeySize, 65);
-      assertEquals(kem.privateKeySize, 32);
-
+  describe("constructor with DhkemSecp256KHkdfSha256/HkdfSha256/ExportOnly", () => {
+    it("should throw InvalidParamError", async () => {
       // assert
-      assertEquals(suite.kem, Kem.DhkemSecp256K1HkdfSha256);
-      assertEquals(suite.kem, 0x0013);
-      assertEquals(suite.kdf, Kdf.HkdfSha256);
-      assertEquals(suite.kdf, 0x0001);
-      assertEquals(suite.aead, Aead.ExportOnly);
-      assertEquals(suite.aead, 0xFFFF);
+      await assertThrows(
+        () =>
+          new CipherSuite({
+            kem: Kem.DhkemSecp256K1HkdfSha256,
+            kdf: Kdf.HkdfSha256,
+            aead: Aead.ExportOnly,
+          }),
+        errors.InvalidParamError,
+        "The KEM (19) cannot be specified by KemId. Use submodule for the KEM",
+      );
     });
   });
 
@@ -525,39 +518,6 @@ describe("CipherSuite(backward-compat)", () => {
     });
   });
 
-  describe("A README example of Base mode (Kem.DhkemSecp256K1HkdfSha256/Kdf.HkdfSha256)", () => {
-    it("should work normally", async () => {
-      // setup
-      const suite = new CipherSuite({
-        kem: Kem.DhkemSecp256K1HkdfSha256,
-        kdf: Kdf.HkdfSha256,
-        aead: Aead.Aes128Gcm,
-      });
-
-      const rkp = await suite.generateKeyPair();
-
-      const sender = await suite.createSenderContext({
-        recipientPublicKey: rkp.publicKey,
-      });
-
-      const recipient = await suite.createRecipientContext({
-        recipientKey: rkp,
-        enc: sender.enc,
-      });
-
-      // encrypt
-      const ct = await sender.seal(
-        new TextEncoder().encode("my-secret-message"),
-      );
-
-      // decrypt
-      const pt = await recipient.open(ct);
-
-      // assert
-      assertEquals(new TextDecoder().decode(pt), "my-secret-message");
-    });
-  });
-
   describe("A README example of Base mode (Kem.DhkemX448HkdfSha256/Kdf.HkdfSha512)", () => {
     it("should work normally", async () => {
       // setup