const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
const require_forge$1 = require('./forge.cjs');
const require_util$1 = require('./util.cjs');
const require_oids$1 = require('./oids.cjs');
const require_asn1$1 = require('./asn1.cjs');
const require_random$1 = require('./random.cjs');
const require_jsbn$1 = require('./jsbn.cjs');
const require_pkcs1$1 = require('./pkcs1.cjs');
const require_prime$1 = require('./prime.cjs');

//#region ../../node_modules/node-forge/lib/rsa.js
var require_rsa = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/node-forge/lib/rsa.js": ((exports, module) => {
	/**
	* Javascript implementation of basic RSA algorithms.
	*
	* @author Dave Longley
	*
	* Copyright (c) 2010-2014 Digital Bazaar, Inc.
	*
	* The only algorithm currently supported for PKI is RSA.
	*
	* An RSA key is often stored in ASN.1 DER format. The SubjectPublicKeyInfo
	* ASN.1 structure is composed of an algorithm of type AlgorithmIdentifier
	* and a subjectPublicKey of type bit string.
	*
	* The AlgorithmIdentifier contains an Object Identifier (OID) and parameters
	* for the algorithm, if any. In the case of RSA, there aren't any.
	*
	* SubjectPublicKeyInfo ::= SEQUENCE {
	*   algorithm AlgorithmIdentifier,
	*   subjectPublicKey BIT STRING
	* }
	*
	* AlgorithmIdentifer ::= SEQUENCE {
	*   algorithm OBJECT IDENTIFIER,
	*   parameters ANY DEFINED BY algorithm OPTIONAL
	* }
	*
	* For an RSA public key, the subjectPublicKey is:
	*
	* RSAPublicKey ::= SEQUENCE {
	*   modulus            INTEGER,    -- n
	*   publicExponent     INTEGER     -- e
	* }
	*
	* PrivateKeyInfo ::= SEQUENCE {
	*   version                   Version,
	*   privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
	*   privateKey                PrivateKey,
	*   attributes           [0]  IMPLICIT Attributes OPTIONAL
	* }
	*
	* Version ::= INTEGER
	* PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
	* PrivateKey ::= OCTET STRING
	* Attributes ::= SET OF Attribute
	*
	* An RSA private key as the following structure:
	*
	* RSAPrivateKey ::= SEQUENCE {
	*   version Version,
	*   modulus INTEGER, -- n
	*   publicExponent INTEGER, -- e
	*   privateExponent INTEGER, -- d
	*   prime1 INTEGER, -- p
	*   prime2 INTEGER, -- q
	*   exponent1 INTEGER, -- d mod (p-1)
	*   exponent2 INTEGER, -- d mod (q-1)
	*   coefficient INTEGER -- (inverse of q) mod p
	* }
	*
	* Version ::= INTEGER
	*
	* The OID for the RSA key algorithm is: 1.2.840.113549.1.1.1
	*/
	var forge = require_forge$1.default;
	require_asn1$1.default;
	require_jsbn$1.default;
	require_oids$1.default;
	require_pkcs1$1.default;
	require_prime$1.default;
	require_random$1.default;
	require_util$1.default;
	if (typeof BigInteger === "undefined") var BigInteger = forge.jsbn.BigInteger;
	var _crypto = forge.util.isNodejs ? require("crypto") : null;
	var asn1 = forge.asn1;
	var util = forge.util;
	forge.pki = forge.pki || {};
	module.exports = forge.pki.rsa = forge.rsa = forge.rsa || {};
	var pki = forge.pki;
	var GCD_30_DELTA = [
		6,
		4,
		2,
		4,
		2,
		4,
		6,
		2
	];
	var privateKeyValidator = {
		name: "PrivateKeyInfo",
		tagClass: asn1.Class.UNIVERSAL,
		type: asn1.Type.SEQUENCE,
		constructed: true,
		value: [
			{
				name: "PrivateKeyInfo.version",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyVersion"
			},
			{
				name: "PrivateKeyInfo.privateKeyAlgorithm",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.SEQUENCE,
				constructed: true,
				value: [{
					name: "AlgorithmIdentifier.algorithm",
					tagClass: asn1.Class.UNIVERSAL,
					type: asn1.Type.OID,
					constructed: false,
					capture: "privateKeyOid"
				}]
			},
			{
				name: "PrivateKeyInfo",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.OCTETSTRING,
				constructed: false,
				capture: "privateKey"
			}
		]
	};
	var rsaPrivateKeyValidator = {
		name: "RSAPrivateKey",
		tagClass: asn1.Class.UNIVERSAL,
		type: asn1.Type.SEQUENCE,
		constructed: true,
		value: [
			{
				name: "RSAPrivateKey.version",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyVersion"
			},
			{
				name: "RSAPrivateKey.modulus",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyModulus"
			},
			{
				name: "RSAPrivateKey.publicExponent",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyPublicExponent"
			},
			{
				name: "RSAPrivateKey.privateExponent",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyPrivateExponent"
			},
			{
				name: "RSAPrivateKey.prime1",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyPrime1"
			},
			{
				name: "RSAPrivateKey.prime2",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyPrime2"
			},
			{
				name: "RSAPrivateKey.exponent1",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyExponent1"
			},
			{
				name: "RSAPrivateKey.exponent2",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyExponent2"
			},
			{
				name: "RSAPrivateKey.coefficient",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.INTEGER,
				constructed: false,
				capture: "privateKeyCoefficient"
			}
		]
	};
	var rsaPublicKeyValidator = {
		name: "RSAPublicKey",
		tagClass: asn1.Class.UNIVERSAL,
		type: asn1.Type.SEQUENCE,
		constructed: true,
		value: [{
			name: "RSAPublicKey.modulus",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.INTEGER,
			constructed: false,
			capture: "publicKeyModulus"
		}, {
			name: "RSAPublicKey.exponent",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.INTEGER,
			constructed: false,
			capture: "publicKeyExponent"
		}]
	};
	var publicKeyValidator = forge.pki.rsa.publicKeyValidator = {
		name: "SubjectPublicKeyInfo",
		tagClass: asn1.Class.UNIVERSAL,
		type: asn1.Type.SEQUENCE,
		constructed: true,
		captureAsn1: "subjectPublicKeyInfo",
		value: [{
			name: "SubjectPublicKeyInfo.AlgorithmIdentifier",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.SEQUENCE,
			constructed: true,
			value: [{
				name: "AlgorithmIdentifier.algorithm",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.OID,
				constructed: false,
				capture: "publicKeyOid"
			}]
		}, {
			name: "SubjectPublicKeyInfo.subjectPublicKey",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.BITSTRING,
			constructed: false,
			value: [{
				name: "SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.SEQUENCE,
				constructed: true,
				optional: true,
				captureAsn1: "rsaPublicKey"
			}]
		}]
	};
	var digestInfoValidator = {
		name: "DigestInfo",
		tagClass: asn1.Class.UNIVERSAL,
		type: asn1.Type.SEQUENCE,
		constructed: true,
		value: [{
			name: "DigestInfo.DigestAlgorithm",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.SEQUENCE,
			constructed: true,
			value: [{
				name: "DigestInfo.DigestAlgorithm.algorithmIdentifier",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.OID,
				constructed: false,
				capture: "algorithmIdentifier"
			}, {
				name: "DigestInfo.DigestAlgorithm.parameters",
				tagClass: asn1.Class.UNIVERSAL,
				type: asn1.Type.NULL,
				capture: "parameters",
				optional: true,
				constructed: false
			}]
		}, {
			name: "DigestInfo.digest",
			tagClass: asn1.Class.UNIVERSAL,
			type: asn1.Type.OCTETSTRING,
			constructed: false,
			capture: "digest"
		}]
	};
	/**
	* Wrap digest in DigestInfo object.
	*
	* This function implements EMSA-PKCS1-v1_5-ENCODE as per RFC 3447.
	*
	* DigestInfo ::= SEQUENCE {
	*   digestAlgorithm DigestAlgorithmIdentifier,
	*   digest Digest
	* }
	*
	* DigestAlgorithmIdentifier ::= AlgorithmIdentifier
	* Digest ::= OCTET STRING
	*
	* @param md the message digest object with the hash to sign.
	*
	* @return the encoded message (ready for RSA encrytion)
	*/
	var emsaPkcs1v15encode = function(md) {
		var oid;
		if (md.algorithm in pki.oids) oid = pki.oids[md.algorithm];
		else {
			var error = /* @__PURE__ */ new Error("Unknown message digest algorithm.");
			error.algorithm = md.algorithm;
			throw error;
		}
		var oidBytes = asn1.oidToDer(oid).getBytes();
		var digestInfo = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, []);
		var digestAlgorithm = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, []);
		digestAlgorithm.value.push(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, oidBytes));
		digestAlgorithm.value.push(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, ""));
		var digest = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false, md.digest().getBytes());
		digestInfo.value.push(digestAlgorithm);
		digestInfo.value.push(digest);
		return asn1.toDer(digestInfo).getBytes();
	};
	/**
	* Performs x^c mod n (RSA encryption or decryption operation).
	*
	* @param x the number to raise and mod.
	* @param key the key to use.
	* @param pub true if the key is public, false if private.
	*
	* @return the result of x^c mod n.
	*/
	var _modPow = function(x, key, pub) {
		if (pub) return x.modPow(key.e, key.n);
		if (!key.p || !key.q) return x.modPow(key.d, key.n);
		if (!key.dP) key.dP = key.d.mod(key.p.subtract(BigInteger.ONE));
		if (!key.dQ) key.dQ = key.d.mod(key.q.subtract(BigInteger.ONE));
		if (!key.qInv) key.qInv = key.q.modInverse(key.p);
		var r;
		do
			r = new BigInteger(forge.util.bytesToHex(forge.random.getBytes(key.n.bitLength() / 8)), 16);
		while (r.compareTo(key.n) >= 0 || !r.gcd(key.n).equals(BigInteger.ONE));
		x = x.multiply(r.modPow(key.e, key.n)).mod(key.n);
		var xp = x.mod(key.p).modPow(key.dP, key.p);
		var xq = x.mod(key.q).modPow(key.dQ, key.q);
		while (xp.compareTo(xq) < 0) xp = xp.add(key.p);
		var y = xp.subtract(xq).multiply(key.qInv).mod(key.p).multiply(key.q).add(xq);
		y = y.multiply(r.modInverse(key.n)).mod(key.n);
		return y;
	};
	/**
	* NOTE: THIS METHOD IS DEPRECATED, use 'sign' on a private key object or
	* 'encrypt' on a public key object instead.
	*
	* Performs RSA encryption.
	*
	* The parameter bt controls whether to put padding bytes before the
	* message passed in. Set bt to either true or false to disable padding
	* completely (in order to handle e.g. EMSA-PSS encoding seperately before),
	* signaling whether the encryption operation is a public key operation
	* (i.e. encrypting data) or not, i.e. private key operation (data signing).
	*
	* For PKCS#1 v1.5 padding pass in the block type to use, i.e. either 0x01
	* (for signing) or 0x02 (for encryption). The key operation mode (private
	* or public) is derived from this flag in that case).
	*
	* @param m the message to encrypt as a byte string.
	* @param key the RSA key to use.
	* @param bt for PKCS#1 v1.5 padding, the block type to use
	*   (0x01 for private key, 0x02 for public),
	*   to disable padding: true = public key, false = private key.
	*
	* @return the encrypted bytes as a string.
	*/
	pki.rsa.encrypt = function(m, key, bt) {
		var pub = bt;
		var eb;
		var k = Math.ceil(key.n.bitLength() / 8);
		if (bt !== false && bt !== true) {
			pub = bt === 2;
			eb = _encodePkcs1_v1_5(m, key, bt);
		} else {
			eb = forge.util.createBuffer();
			eb.putBytes(m);
		}
		var yhex = _modPow(new BigInteger(eb.toHex(), 16), key, pub).toString(16);
		var ed = forge.util.createBuffer();
		var zeros = k - Math.ceil(yhex.length / 2);
		while (zeros > 0) {
			ed.putByte(0);
			--zeros;
		}
		ed.putBytes(forge.util.hexToBytes(yhex));
		return ed.getBytes();
	};
	/**
	* NOTE: THIS METHOD IS DEPRECATED, use 'decrypt' on a private key object or
	* 'verify' on a public key object instead.
	*
	* Performs RSA decryption.
	*
	* The parameter ml controls whether to apply PKCS#1 v1.5 padding
	* or not.  Set ml = false to disable padding removal completely
	* (in order to handle e.g. EMSA-PSS later on) and simply pass back
	* the RSA encryption block.
	*
	* @param ed the encrypted data to decrypt in as a byte string.
	* @param key the RSA key to use.
	* @param pub true for a public key operation, false for private.
	* @param ml the message length, if known, false to disable padding.
	*
	* @return the decrypted message as a byte string.
	*/
	pki.rsa.decrypt = function(ed, key, pub, ml) {
		var k = Math.ceil(key.n.bitLength() / 8);
		if (ed.length !== k) {
			var error = /* @__PURE__ */ new Error("Encrypted message length is invalid.");
			error.length = ed.length;
			error.expected = k;
			throw error;
		}
		var y = new BigInteger(forge.util.createBuffer(ed).toHex(), 16);
		if (y.compareTo(key.n) >= 0) throw new Error("Encrypted message is invalid.");
		var xhex = _modPow(y, key, pub).toString(16);
		var eb = forge.util.createBuffer();
		var zeros = k - Math.ceil(xhex.length / 2);
		while (zeros > 0) {
			eb.putByte(0);
			--zeros;
		}
		eb.putBytes(forge.util.hexToBytes(xhex));
		if (ml !== false) return _decodePkcs1_v1_5(eb.getBytes(), key, pub);
		return eb.getBytes();
	};
	/**
	* Creates an RSA key-pair generation state object. It is used to allow
	* key-generation to be performed in steps. It also allows for a UI to
	* display progress updates.
	*
	* @param bits the size for the private key in bits, defaults to 2048.
	* @param e the public exponent to use, defaults to 65537 (0x10001).
	* @param [options] the options to use.
	*          prng a custom crypto-secure pseudo-random number generator to use,
	*            that must define "getBytesSync".
	*          algorithm the algorithm to use (default: 'PRIMEINC').
	*
	* @return the state object to use to generate the key-pair.
	*/
	pki.rsa.createKeyPairGenerationState = function(bits, e, options) {
		if (typeof bits === "string") bits = parseInt(bits, 10);
		bits = bits || 2048;
		options = options || {};
		var prng = options.prng || forge.random;
		var rng = { nextBytes: function(x) {
			var b = prng.getBytesSync(x.length);
			for (var i = 0; i < x.length; ++i) x[i] = b.charCodeAt(i);
		} };
		var algorithm = options.algorithm || "PRIMEINC";
		var rval;
		if (algorithm === "PRIMEINC") {
			rval = {
				algorithm,
				state: 0,
				bits,
				rng,
				eInt: e || 65537,
				e: new BigInteger(null),
				p: null,
				q: null,
				qBits: bits >> 1,
				pBits: bits - (bits >> 1),
				pqState: 0,
				num: null,
				keys: null
			};
			rval.e.fromInt(rval.eInt);
		} else throw new Error("Invalid key generation algorithm: " + algorithm);
		return rval;
	};
	/**
	* Attempts to runs the key-generation algorithm for at most n seconds
	* (approximately) using the given state. When key-generation has completed,
	* the keys will be stored in state.keys.
	*
	* To use this function to update a UI while generating a key or to prevent
	* causing browser lockups/warnings, set "n" to a value other than 0. A
	* simple pattern for generating a key and showing a progress indicator is:
	*
	* var state = pki.rsa.createKeyPairGenerationState(2048);
	* var step = function() {
	*   // step key-generation, run algorithm for 100 ms, repeat
	*   if(!forge.pki.rsa.stepKeyPairGenerationState(state, 100)) {
	*     setTimeout(step, 1);
	*   } else {
	*     // key-generation complete
	*     // TODO: turn off progress indicator here
	*     // TODO: use the generated key-pair in "state.keys"
	*   }
	* };
	* // TODO: turn on progress indicator here
	* setTimeout(step, 0);
	*
	* @param state the state to use.
	* @param n the maximum number of milliseconds to run the algorithm for, 0
	*          to run the algorithm to completion.
	*
	* @return true if the key-generation completed, false if not.
	*/
	pki.rsa.stepKeyPairGenerationState = function(state, n) {
		if (!("algorithm" in state)) state.algorithm = "PRIMEINC";
		var THIRTY = new BigInteger(null);
		THIRTY.fromInt(30);
		var deltaIdx = 0;
		var op_or = function(x, y) {
			return x | y;
		};
		var t1 = +/* @__PURE__ */ new Date();
		var t2;
		var total = 0;
		while (state.keys === null && (n <= 0 || total < n)) {
			if (state.state === 0) {
				var bits = state.p === null ? state.pBits : state.qBits;
				var bits1 = bits - 1;
				if (state.pqState === 0) {
					state.num = new BigInteger(bits, state.rng);
					if (!state.num.testBit(bits1)) state.num.bitwiseTo(BigInteger.ONE.shiftLeft(bits1), op_or, state.num);
					state.num.dAddOffset(31 - state.num.mod(THIRTY).byteValue(), 0);
					deltaIdx = 0;
					++state.pqState;
				} else if (state.pqState === 1) if (state.num.bitLength() > bits) state.pqState = 0;
				else if (state.num.isProbablePrime(_getMillerRabinTests(state.num.bitLength()))) ++state.pqState;
				else state.num.dAddOffset(GCD_30_DELTA[deltaIdx++ % 8], 0);
				else if (state.pqState === 2) state.pqState = state.num.subtract(BigInteger.ONE).gcd(state.e).compareTo(BigInteger.ONE) === 0 ? 3 : 0;
				else if (state.pqState === 3) {
					state.pqState = 0;
					if (state.p === null) state.p = state.num;
					else state.q = state.num;
					if (state.p !== null && state.q !== null) ++state.state;
					state.num = null;
				}
			} else if (state.state === 1) {
				if (state.p.compareTo(state.q) < 0) {
					state.num = state.p;
					state.p = state.q;
					state.q = state.num;
				}
				++state.state;
			} else if (state.state === 2) {
				state.p1 = state.p.subtract(BigInteger.ONE);
				state.q1 = state.q.subtract(BigInteger.ONE);
				state.phi = state.p1.multiply(state.q1);
				++state.state;
			} else if (state.state === 3) if (state.phi.gcd(state.e).compareTo(BigInteger.ONE) === 0) ++state.state;
			else {
				state.p = null;
				state.q = null;
				state.state = 0;
			}
			else if (state.state === 4) {
				state.n = state.p.multiply(state.q);
				if (state.n.bitLength() === state.bits) ++state.state;
				else {
					state.q = null;
					state.state = 0;
				}
			} else if (state.state === 5) {
				var d = state.e.modInverse(state.phi);
				state.keys = {
					privateKey: pki.rsa.setPrivateKey(state.n, state.e, d, state.p, state.q, d.mod(state.p1), d.mod(state.q1), state.q.modInverse(state.p)),
					publicKey: pki.rsa.setPublicKey(state.n, state.e)
				};
			}
			t2 = +/* @__PURE__ */ new Date();
			total += t2 - t1;
			t1 = t2;
		}
		return state.keys !== null;
	};
	/**
	* Generates an RSA public-private key pair in a single call.
	*
	* To generate a key-pair in steps (to allow for progress updates and to
	* prevent blocking or warnings in slow browsers) then use the key-pair
	* generation state functions.
	*
	* To generate a key-pair asynchronously (either through web-workers, if
	* available, or by breaking up the work on the main thread), pass a
	* callback function.
	*
	* @param [bits] the size for the private key in bits, defaults to 2048.
	* @param [e] the public exponent to use, defaults to 65537.
	* @param [options] options for key-pair generation, if given then 'bits'
	*            and 'e' must *not* be given:
	*          bits the size for the private key in bits, (default: 2048).
	*          e the public exponent to use, (default: 65537 (0x10001)).
	*          workerScript the worker script URL.
	*          workers the number of web workers (if supported) to use,
	*            (default: 2).
	*          workLoad the size of the work load, ie: number of possible prime
	*            numbers for each web worker to check per work assignment,
	*            (default: 100).
	*          prng a custom crypto-secure pseudo-random number generator to use,
	*            that must define "getBytesSync". Disables use of native APIs.
	*          algorithm the algorithm to use (default: 'PRIMEINC').
	* @param [callback(err, keypair)] called once the operation completes.
	*
	* @return an object with privateKey and publicKey properties.
	*/
	pki.rsa.generateKeyPair = function(bits, e, options, callback) {
		if (arguments.length === 1) {
			if (typeof bits === "object") {
				options = bits;
				bits = void 0;
			} else if (typeof bits === "function") {
				callback = bits;
				bits = void 0;
			}
		} else if (arguments.length === 2) if (typeof bits === "number") {
			if (typeof e === "function") {
				callback = e;
				e = void 0;
			} else if (typeof e !== "number") {
				options = e;
				e = void 0;
			}
		} else {
			options = bits;
			callback = e;
			bits = void 0;
			e = void 0;
		}
		else if (arguments.length === 3) if (typeof e === "number") {
			if (typeof options === "function") {
				callback = options;
				options = void 0;
			}
		} else {
			callback = options;
			options = e;
			e = void 0;
		}
		options = options || {};
		if (bits === void 0) bits = options.bits || 2048;
		if (e === void 0) e = options.e || 65537;
		if (!forge.options.usePureJavaScript && !options.prng && bits >= 256 && bits <= 16384 && (e === 65537 || e === 3)) {
			if (callback) {
				if (_detectNodeCrypto("generateKeyPair")) return _crypto.generateKeyPair("rsa", {
					modulusLength: bits,
					publicExponent: e,
					publicKeyEncoding: {
						type: "spki",
						format: "pem"
					},
					privateKeyEncoding: {
						type: "pkcs8",
						format: "pem"
					}
				}, function(err, pub, priv) {
					if (err) return callback(err);
					callback(null, {
						privateKey: pki.privateKeyFromPem(priv),
						publicKey: pki.publicKeyFromPem(pub)
					});
				});
				if (_detectSubtleCrypto("generateKey") && _detectSubtleCrypto("exportKey")) return util.globalScope.crypto.subtle.generateKey({
					name: "RSASSA-PKCS1-v1_5",
					modulusLength: bits,
					publicExponent: _intToUint8Array(e),
					hash: { name: "SHA-256" }
				}, true, ["sign", "verify"]).then(function(pair) {
					return util.globalScope.crypto.subtle.exportKey("pkcs8", pair.privateKey);
				}).then(void 0, function(err) {
					callback(err);
				}).then(function(pkcs8) {
					if (pkcs8) {
						var privateKey = pki.privateKeyFromAsn1(asn1.fromDer(forge.util.createBuffer(pkcs8)));
						callback(null, {
							privateKey,
							publicKey: pki.setRsaPublicKey(privateKey.n, privateKey.e)
						});
					}
				});
				if (_detectSubtleMsCrypto("generateKey") && _detectSubtleMsCrypto("exportKey")) {
					var genOp = util.globalScope.msCrypto.subtle.generateKey({
						name: "RSASSA-PKCS1-v1_5",
						modulusLength: bits,
						publicExponent: _intToUint8Array(e),
						hash: { name: "SHA-256" }
					}, true, ["sign", "verify"]);
					genOp.oncomplete = function(e$1) {
						var pair = e$1.target.result;
						var exportOp = util.globalScope.msCrypto.subtle.exportKey("pkcs8", pair.privateKey);
						exportOp.oncomplete = function(e$2) {
							var pkcs8 = e$2.target.result;
							var privateKey = pki.privateKeyFromAsn1(asn1.fromDer(forge.util.createBuffer(pkcs8)));
							callback(null, {
								privateKey,
								publicKey: pki.setRsaPublicKey(privateKey.n, privateKey.e)
							});
						};
						exportOp.onerror = function(err) {
							callback(err);
						};
					};
					genOp.onerror = function(err) {
						callback(err);
					};
					return;
				}
			} else if (_detectNodeCrypto("generateKeyPairSync")) {
				var keypair = _crypto.generateKeyPairSync("rsa", {
					modulusLength: bits,
					publicExponent: e,
					publicKeyEncoding: {
						type: "spki",
						format: "pem"
					},
					privateKeyEncoding: {
						type: "pkcs8",
						format: "pem"
					}
				});
				return {
					privateKey: pki.privateKeyFromPem(keypair.privateKey),
					publicKey: pki.publicKeyFromPem(keypair.publicKey)
				};
			}
		}
		var state = pki.rsa.createKeyPairGenerationState(bits, e, options);
		if (!callback) {
			pki.rsa.stepKeyPairGenerationState(state, 0);
			return state.keys;
		}
		_generateKeyPair(state, options, callback);
	};
	/**
	* Sets an RSA public key from BigIntegers modulus and exponent.
	*
	* @param n the modulus.
	* @param e the exponent.
	*
	* @return the public key.
	*/
	pki.setRsaPublicKey = pki.rsa.setPublicKey = function(n, e) {
		var key = {
			n,
			e
		};
		/**
		* Encrypts the given data with this public key. Newer applications
		* should use the 'RSA-OAEP' decryption scheme, 'RSAES-PKCS1-V1_5' is for
		* legacy applications.
		*
		* @param data the byte string to encrypt.
		* @param scheme the encryption scheme to use:
		*          'RSAES-PKCS1-V1_5' (default),
		*          'RSA-OAEP',
		*          'RAW', 'NONE', or null to perform raw RSA encryption,
		*          an object with an 'encode' property set to a function
		*          with the signature 'function(data, key)' that returns
		*          a binary-encoded string representing the encoded data.
		* @param schemeOptions any scheme-specific options.
		*
		* @return the encrypted byte string.
		*/
		key.encrypt = function(data, scheme, schemeOptions) {
			if (typeof scheme === "string") scheme = scheme.toUpperCase();
			else if (scheme === void 0) scheme = "RSAES-PKCS1-V1_5";
			if (scheme === "RSAES-PKCS1-V1_5") scheme = { encode: function(m, key$1, pub) {
				return _encodePkcs1_v1_5(m, key$1, 2).getBytes();
			} };
			else if (scheme === "RSA-OAEP" || scheme === "RSAES-OAEP") scheme = { encode: function(m, key$1) {
				return forge.pkcs1.encode_rsa_oaep(key$1, m, schemeOptions);
			} };
			else if ([
				"RAW",
				"NONE",
				"NULL",
				null
			].indexOf(scheme) !== -1) scheme = { encode: function(e$2) {
				return e$2;
			} };
			else if (typeof scheme === "string") throw new Error("Unsupported encryption scheme: \"" + scheme + "\".");
			var e$1 = scheme.encode(data, key, true);
			return pki.rsa.encrypt(e$1, key, true);
		};
		/**
		* Verifies the given signature against the given digest.
		*
		* PKCS#1 supports multiple (currently two) signature schemes:
		* RSASSA-PKCS1-V1_5 and RSASSA-PSS.
		*
		* By default this implementation uses the "old scheme", i.e.
		* RSASSA-PKCS1-V1_5, in which case once RSA-decrypted, the
		* signature is an OCTET STRING that holds a DigestInfo.
		*
		* DigestInfo ::= SEQUENCE {
		*   digestAlgorithm DigestAlgorithmIdentifier,
		*   digest Digest
		* }
		* DigestAlgorithmIdentifier ::= AlgorithmIdentifier
		* Digest ::= OCTET STRING
		*
		* To perform PSS signature verification, provide an instance
		* of Forge PSS object as the scheme parameter.
		*
		* @param digest the message digest hash to compare against the signature,
		*          as a binary-encoded string.
		* @param signature the signature to verify, as a binary-encoded string.
		* @param scheme signature verification scheme to use:
		*          'RSASSA-PKCS1-V1_5' or undefined for RSASSA PKCS#1 v1.5,
		*          a Forge PSS object for RSASSA-PSS,
		*          'NONE' or null for none, DigestInfo will not be expected, but
		*            PKCS#1 v1.5 padding will still be used.
		* @param options optional verify options
		*          _parseAllDigestBytes testing flag to control parsing of all
		*            digest bytes. Unsupported and not for general usage.
		*            (default: true)
		*
		* @return true if the signature was verified, false if not.
		*/
		key.verify = function(digest, signature, scheme, options) {
			if (typeof scheme === "string") scheme = scheme.toUpperCase();
			else if (scheme === void 0) scheme = "RSASSA-PKCS1-V1_5";
			if (options === void 0) options = { _parseAllDigestBytes: true };
			if (!("_parseAllDigestBytes" in options)) options._parseAllDigestBytes = true;
			if (scheme === "RSASSA-PKCS1-V1_5") scheme = { verify: function(digest$1, d$1) {
				d$1 = _decodePkcs1_v1_5(d$1, key, true);
				var obj = asn1.fromDer(d$1, { parseAllBytes: options._parseAllDigestBytes });
				var capture = {};
				var errors = [];
				if (!asn1.validate(obj, digestInfoValidator, capture, errors)) {
					var error = /* @__PURE__ */ new Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");
					error.errors = errors;
					throw error;
				}
				var oid = asn1.derToOid(capture.algorithmIdentifier);
				if (!(oid === forge.oids.md2 || oid === forge.oids.md5 || oid === forge.oids.sha1 || oid === forge.oids.sha224 || oid === forge.oids.sha256 || oid === forge.oids.sha384 || oid === forge.oids.sha512 || oid === forge.oids["sha512-224"] || oid === forge.oids["sha512-256"])) {
					var error = /* @__PURE__ */ new Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");
					error.oid = oid;
					throw error;
				}
				if (oid === forge.oids.md2 || oid === forge.oids.md5) {
					if (!("parameters" in capture)) throw new Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifer NULL parameters.");
				}
				return digest$1 === capture.digest;
			} };
			else if (scheme === "NONE" || scheme === "NULL" || scheme === null) scheme = { verify: function(digest$1, d$1) {
				d$1 = _decodePkcs1_v1_5(d$1, key, true);
				return digest$1 === d$1;
			} };
			var d = pki.rsa.decrypt(signature, key, true, false);
			return scheme.verify(digest, d, key.n.bitLength());
		};
		return key;
	};
	/**
	* Sets an RSA private key from BigIntegers modulus, exponent, primes,
	* prime exponents, and modular multiplicative inverse.
	*
	* @param n the modulus.
	* @param e the public exponent.
	* @param d the private exponent ((inverse of e) mod n).
	* @param p the first prime.
	* @param q the second prime.
	* @param dP exponent1 (d mod (p-1)).
	* @param dQ exponent2 (d mod (q-1)).
	* @param qInv ((inverse of q) mod p)
	*
	* @return the private key.
	*/
	pki.setRsaPrivateKey = pki.rsa.setPrivateKey = function(n, e, d, p, q, dP, dQ, qInv) {
		var key = {
			n,
			e,
			d,
			p,
			q,
			dP,
			dQ,
			qInv
		};
		/**
		* Decrypts the given data with this private key. The decryption scheme
		* must match the one used to encrypt the data.
		*
		* @param data the byte string to decrypt.
		* @param scheme the decryption scheme to use:
		*          'RSAES-PKCS1-V1_5' (default),
		*          'RSA-OAEP',
		*          'RAW', 'NONE', or null to perform raw RSA decryption.
		* @param schemeOptions any scheme-specific options.
		*
		* @return the decrypted byte string.
		*/
		key.decrypt = function(data, scheme, schemeOptions) {
			if (typeof scheme === "string") scheme = scheme.toUpperCase();
			else if (scheme === void 0) scheme = "RSAES-PKCS1-V1_5";
			var d$1 = pki.rsa.decrypt(data, key, false, false);
			if (scheme === "RSAES-PKCS1-V1_5") scheme = { decode: _decodePkcs1_v1_5 };
			else if (scheme === "RSA-OAEP" || scheme === "RSAES-OAEP") scheme = { decode: function(d$2, key$1) {
				return forge.pkcs1.decode_rsa_oaep(key$1, d$2, schemeOptions);
			} };
			else if ([
				"RAW",
				"NONE",
				"NULL",
				null
			].indexOf(scheme) !== -1) scheme = { decode: function(d$2) {
				return d$2;
			} };
			else throw new Error("Unsupported encryption scheme: \"" + scheme + "\".");
			return scheme.decode(d$1, key, false);
		};
		/**
		* Signs the given digest, producing a signature.
		*
		* PKCS#1 supports multiple (currently two) signature schemes:
		* RSASSA-PKCS1-V1_5 and RSASSA-PSS.
		*
		* By default this implementation uses the "old scheme", i.e.
		* RSASSA-PKCS1-V1_5. In order to generate a PSS signature, provide
		* an instance of Forge PSS object as the scheme parameter.
		*
		* @param md the message digest object with the hash to sign.
		* @param scheme the signature scheme to use:
		*          'RSASSA-PKCS1-V1_5' or undefined for RSASSA PKCS#1 v1.5,
		*          a Forge PSS object for RSASSA-PSS,
		*          'NONE' or null for none, DigestInfo will not be used but
		*            PKCS#1 v1.5 padding will still be used.
		*
		* @return the signature as a byte string.
		*/
		key.sign = function(md, scheme) {
			var bt = false;
			if (typeof scheme === "string") scheme = scheme.toUpperCase();
			if (scheme === void 0 || scheme === "RSASSA-PKCS1-V1_5") {
				scheme = { encode: emsaPkcs1v15encode };
				bt = 1;
			} else if (scheme === "NONE" || scheme === "NULL" || scheme === null) {
				scheme = { encode: function() {
					return md;
				} };
				bt = 1;
			}
			var d$1 = scheme.encode(md, key.n.bitLength());
			return pki.rsa.encrypt(d$1, key, bt);
		};
		return key;
	};
	/**
	* Wraps an RSAPrivateKey ASN.1 object in an ASN.1 PrivateKeyInfo object.
	*
	* @param rsaKey the ASN.1 RSAPrivateKey.
	*
	* @return the ASN.1 PrivateKeyInfo.
	*/
	pki.wrapRsaPrivateKey = function(rsaKey) {
		return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, asn1.integerToDer(0).getBytes()),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, asn1.oidToDer(pki.oids.rsaEncryption).getBytes()), asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, "")]),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false, asn1.toDer(rsaKey).getBytes())
		]);
	};
	/**
	* Converts a private key from an ASN.1 object.
	*
	* @param obj the ASN.1 representation of a PrivateKeyInfo containing an
	*          RSAPrivateKey or an RSAPrivateKey.
	*
	* @return the private key.
	*/
	pki.privateKeyFromAsn1 = function(obj) {
		var capture = {};
		var errors = [];
		if (asn1.validate(obj, privateKeyValidator, capture, errors)) obj = asn1.fromDer(forge.util.createBuffer(capture.privateKey));
		capture = {};
		errors = [];
		if (!asn1.validate(obj, rsaPrivateKeyValidator, capture, errors)) {
			var error = /* @__PURE__ */ new Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");
			error.errors = errors;
			throw error;
		}
		var n = forge.util.createBuffer(capture.privateKeyModulus).toHex(), e = forge.util.createBuffer(capture.privateKeyPublicExponent).toHex(), d = forge.util.createBuffer(capture.privateKeyPrivateExponent).toHex(), p = forge.util.createBuffer(capture.privateKeyPrime1).toHex(), q = forge.util.createBuffer(capture.privateKeyPrime2).toHex(), dP = forge.util.createBuffer(capture.privateKeyExponent1).toHex(), dQ = forge.util.createBuffer(capture.privateKeyExponent2).toHex(), qInv = forge.util.createBuffer(capture.privateKeyCoefficient).toHex();
		return pki.setRsaPrivateKey(new BigInteger(n, 16), new BigInteger(e, 16), new BigInteger(d, 16), new BigInteger(p, 16), new BigInteger(q, 16), new BigInteger(dP, 16), new BigInteger(dQ, 16), new BigInteger(qInv, 16));
	};
	/**
	* Converts a private key to an ASN.1 RSAPrivateKey.
	*
	* @param key the private key.
	*
	* @return the ASN.1 representation of an RSAPrivateKey.
	*/
	pki.privateKeyToAsn1 = pki.privateKeyToRSAPrivateKey = function(key) {
		return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, asn1.integerToDer(0).getBytes()),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.n)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.e)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.d)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.p)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.q)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.dP)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.dQ)),
			asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.qInv))
		]);
	};
	/**
	* Converts a public key from an ASN.1 SubjectPublicKeyInfo or RSAPublicKey.
	*
	* @param obj the asn1 representation of a SubjectPublicKeyInfo or RSAPublicKey.
	*
	* @return the public key.
	*/
	pki.publicKeyFromAsn1 = function(obj) {
		var capture = {};
		var errors = [];
		if (asn1.validate(obj, publicKeyValidator, capture, errors)) {
			var oid = asn1.derToOid(capture.publicKeyOid);
			if (oid !== pki.oids.rsaEncryption) {
				var error = /* @__PURE__ */ new Error("Cannot read public key. Unknown OID.");
				error.oid = oid;
				throw error;
			}
			obj = capture.rsaPublicKey;
		}
		errors = [];
		if (!asn1.validate(obj, rsaPublicKeyValidator, capture, errors)) {
			var error = /* @__PURE__ */ new Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");
			error.errors = errors;
			throw error;
		}
		var n = forge.util.createBuffer(capture.publicKeyModulus).toHex();
		var e = forge.util.createBuffer(capture.publicKeyExponent).toHex();
		return pki.setRsaPublicKey(new BigInteger(n, 16), new BigInteger(e, 16));
	};
	/**
	* Converts a public key to an ASN.1 SubjectPublicKeyInfo.
	*
	* @param key the public key.
	*
	* @return the asn1 representation of a SubjectPublicKeyInfo.
	*/
	pki.publicKeyToAsn1 = pki.publicKeyToSubjectPublicKeyInfo = function(key) {
		return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false, asn1.oidToDer(pki.oids.rsaEncryption).getBytes()), asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, "")]), asn1.create(asn1.Class.UNIVERSAL, asn1.Type.BITSTRING, false, [pki.publicKeyToRSAPublicKey(key)])]);
	};
	/**
	* Converts a public key to an ASN.1 RSAPublicKey.
	*
	* @param key the public key.
	*
	* @return the asn1 representation of a RSAPublicKey.
	*/
	pki.publicKeyToRSAPublicKey = function(key) {
		return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.n)), asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false, _bnToBytes(key.e))]);
	};
	/**
	* Encodes a message using PKCS#1 v1.5 padding.
	*
	* @param m the message to encode.
	* @param key the RSA key to use.
	* @param bt the block type to use, i.e. either 0x01 (for signing) or 0x02
	*          (for encryption).
	*
	* @return the padded byte buffer.
	*/
	function _encodePkcs1_v1_5(m, key, bt) {
		var eb = forge.util.createBuffer();
		var k = Math.ceil(key.n.bitLength() / 8);
		if (m.length > k - 11) {
			var error = /* @__PURE__ */ new Error("Message is too long for PKCS#1 v1.5 padding.");
			error.length = m.length;
			error.max = k - 11;
			throw error;
		}
		eb.putByte(0);
		eb.putByte(bt);
		var padNum = k - 3 - m.length;
		var padByte;
		if (bt === 0 || bt === 1) {
			padByte = bt === 0 ? 0 : 255;
			for (var i = 0; i < padNum; ++i) eb.putByte(padByte);
		} else while (padNum > 0) {
			var numZeros = 0;
			var padBytes = forge.random.getBytes(padNum);
			for (var i = 0; i < padNum; ++i) {
				padByte = padBytes.charCodeAt(i);
				if (padByte === 0) ++numZeros;
				else eb.putByte(padByte);
			}
			padNum = numZeros;
		}
		eb.putByte(0);
		eb.putBytes(m);
		return eb;
	}
	/**
	* Decodes a message using PKCS#1 v1.5 padding.
	*
	* @param em the message to decode.
	* @param key the RSA key to use.
	* @param pub true if the key is a public key, false if it is private.
	* @param ml the message length, if specified.
	*
	* @return the decoded bytes.
	*/
	function _decodePkcs1_v1_5(em, key, pub, ml) {
		var k = Math.ceil(key.n.bitLength() / 8);
		var eb = forge.util.createBuffer(em);
		var first = eb.getByte();
		var bt = eb.getByte();
		if (first !== 0 || pub && bt !== 0 && bt !== 1 || !pub && bt != 2 || pub && bt === 0 && typeof ml === "undefined") throw new Error("Encryption block is invalid.");
		var padNum = 0;
		if (bt === 0) {
			padNum = k - 3 - ml;
			for (var i = 0; i < padNum; ++i) if (eb.getByte() !== 0) throw new Error("Encryption block is invalid.");
		} else if (bt === 1) {
			padNum = 0;
			while (eb.length() > 1) {
				if (eb.getByte() !== 255) {
					--eb.read;
					break;
				}
				++padNum;
			}
		} else if (bt === 2) {
			padNum = 0;
			while (eb.length() > 1) {
				if (eb.getByte() === 0) {
					--eb.read;
					break;
				}
				++padNum;
			}
		}
		if (eb.getByte() !== 0 || padNum !== k - 3 - eb.length()) throw new Error("Encryption block is invalid.");
		return eb.getBytes();
	}
	/**
	* Runs the key-generation algorithm asynchronously, either in the background
	* via Web Workers, or using the main thread and setImmediate.
	*
	* @param state the key-pair generation state.
	* @param [options] options for key-pair generation:
	*          workerScript the worker script URL.
	*          workers the number of web workers (if supported) to use,
	*            (default: 2, -1 to use estimated cores minus one).
	*          workLoad the size of the work load, ie: number of possible prime
	*            numbers for each web worker to check per work assignment,
	*            (default: 100).
	* @param callback(err, keypair) called once the operation completes.
	*/
	function _generateKeyPair(state, options, callback) {
		if (typeof options === "function") {
			callback = options;
			options = {};
		}
		options = options || {};
		var opts = { algorithm: {
			name: options.algorithm || "PRIMEINC",
			options: {
				workers: options.workers || 2,
				workLoad: options.workLoad || 100,
				workerScript: options.workerScript
			}
		} };
		if ("prng" in options) opts.prng = options.prng;
		generate();
		function generate() {
			getPrime(state.pBits, function(err, num) {
				if (err) return callback(err);
				state.p = num;
				if (state.q !== null) return finish(err, state.q);
				getPrime(state.qBits, finish);
			});
		}
		function getPrime(bits, callback$1) {
			forge.prime.generateProbablePrime(bits, opts, callback$1);
		}
		function finish(err, num) {
			if (err) return callback(err);
			state.q = num;
			if (state.p.compareTo(state.q) < 0) {
				var tmp = state.p;
				state.p = state.q;
				state.q = tmp;
			}
			if (state.p.subtract(BigInteger.ONE).gcd(state.e).compareTo(BigInteger.ONE) !== 0) {
				state.p = null;
				generate();
				return;
			}
			if (state.q.subtract(BigInteger.ONE).gcd(state.e).compareTo(BigInteger.ONE) !== 0) {
				state.q = null;
				getPrime(state.qBits, finish);
				return;
			}
			state.p1 = state.p.subtract(BigInteger.ONE);
			state.q1 = state.q.subtract(BigInteger.ONE);
			state.phi = state.p1.multiply(state.q1);
			if (state.phi.gcd(state.e).compareTo(BigInteger.ONE) !== 0) {
				state.p = state.q = null;
				generate();
				return;
			}
			state.n = state.p.multiply(state.q);
			if (state.n.bitLength() !== state.bits) {
				state.q = null;
				getPrime(state.qBits, finish);
				return;
			}
			var d = state.e.modInverse(state.phi);
			state.keys = {
				privateKey: pki.rsa.setPrivateKey(state.n, state.e, d, state.p, state.q, d.mod(state.p1), d.mod(state.q1), state.q.modInverse(state.p)),
				publicKey: pki.rsa.setPublicKey(state.n, state.e)
			};
			callback(null, state.keys);
		}
	}
	/**
	* Converts a positive BigInteger into 2's-complement big-endian bytes.
	*
	* @param b the big integer to convert.
	*
	* @return the bytes.
	*/
	function _bnToBytes(b) {
		var hex = b.toString(16);
		if (hex[0] >= "8") hex = "00" + hex;
		var bytes = forge.util.hexToBytes(hex);
		if (bytes.length > 1 && (bytes.charCodeAt(0) === 0 && (bytes.charCodeAt(1) & 128) === 0 || bytes.charCodeAt(0) === 255 && (bytes.charCodeAt(1) & 128) === 128)) return bytes.substr(1);
		return bytes;
	}
	/**
	* Returns the required number of Miller-Rabin tests to generate a
	* prime with an error probability of (1/2)^80.
	*
	* See Handbook of Applied Cryptography Chapter 4, Table 4.4.
	*
	* @param bits the bit size.
	*
	* @return the required number of iterations.
	*/
	function _getMillerRabinTests(bits) {
		if (bits <= 100) return 27;
		if (bits <= 150) return 18;
		if (bits <= 200) return 15;
		if (bits <= 250) return 12;
		if (bits <= 300) return 9;
		if (bits <= 350) return 8;
		if (bits <= 400) return 7;
		if (bits <= 500) return 6;
		if (bits <= 600) return 5;
		if (bits <= 800) return 4;
		if (bits <= 1250) return 3;
		return 2;
	}
	/**
	* Performs feature detection on the Node crypto interface.
	*
	* @param fn the feature (function) to detect.
	*
	* @return true if detected, false if not.
	*/
	function _detectNodeCrypto(fn) {
		return forge.util.isNodejs && typeof _crypto[fn] === "function";
	}
	/**
	* Performs feature detection on the SubtleCrypto interface.
	*
	* @param fn the feature (function) to detect.
	*
	* @return true if detected, false if not.
	*/
	function _detectSubtleCrypto(fn) {
		return typeof util.globalScope !== "undefined" && typeof util.globalScope.crypto === "object" && typeof util.globalScope.crypto.subtle === "object" && typeof util.globalScope.crypto.subtle[fn] === "function";
	}
	/**
	* Performs feature detection on the deprecated Microsoft Internet Explorer
	* outdated SubtleCrypto interface. This function should only be used after
	* checking for the modern, standard SubtleCrypto interface.
	*
	* @param fn the feature (function) to detect.
	*
	* @return true if detected, false if not.
	*/
	function _detectSubtleMsCrypto(fn) {
		return typeof util.globalScope !== "undefined" && typeof util.globalScope.msCrypto === "object" && typeof util.globalScope.msCrypto.subtle === "object" && typeof util.globalScope.msCrypto.subtle[fn] === "function";
	}
	function _intToUint8Array(x) {
		var bytes = forge.util.hexToBytes(x.toString(16));
		var buffer = new Uint8Array(bytes.length);
		for (var i = 0; i < bytes.length; ++i) buffer[i] = bytes.charCodeAt(i);
		return buffer;
	}
}) });

//#endregion
Object.defineProperty(exports, 'default', {
  enumerable: true,
  get: function () {
    return require_rsa();
  }
});
//# sourceMappingURL=rsa.cjs.map