The Web Cryptography API of the W3C, the same on the JVM, in Node and in
browsers. It uses the JCA on the JVM and WebCrypto in JavaScript.

The methods of SubtleCrypto are here under their names in kebab case,
e.g. import-key, and take their arguments in the same order. Each returns
its result on the JVM (and a promise of it in ClojureScript). To chain
them the same way on both platforms, use then.

- An algorithm is a keyword, its WebCrypto name in lower case (e.g.
  :sha-256), or a map of its :name and its parameters, named as the
  members of its dictionary in kebab case (e.g. :tag-length).
- A usage of a key is a keyword, e.g. :encrypt or :derive-bits, and a
  format is :raw, :spki, :pkcs8 or :jwk.
- Bytes are a byte array on the JVM and a Uint8Array in JavaScript.
- A JWK is a map of its JSON members as keywords, e.g. :kty and :key_ops.
- A key is WebCrypto's CryptoKey in ClojureScript and a type of the
  library's own on the JVM. Use key-info for its attributes. A key pair
  is a map of its :public-key and its :private-key.

The algorithms are these:

- SHA-1 and SHA-2 for digest
- HMAC, ECDSA, RSASSA-PKCS1-v1_5, RSA-PSS and Ed25519 for sign and verify
- AES-GCM for encrypt and decrypt
- HKDF, PBKDF2 and ECDH for derive-bits and derive-key

ECDSA and ECDH take the curves P-256, P-384 and P-521. Ed25519 needs
Java 15 or later on the JVM. For hashes, HMACs and HKDF without promises,
see the hash namespace, and for keys in PEM, the pem namespace.

An error is an ex-info whose :type is one of these keywords, named after
the exceptions of WebCrypto, section 14.4:

- ::not-supported-error, for an algorithm, a format or a parameter that
  the library doesn't support
- ::syntax-error, for usages that a key can't have, or none
- ::invalid-access-error, for a key of another algorithm or type, without
  the usage, or one that can't be exported
- ::data-error, for key data that isn't what the algorithm takes
- ::operation-error, for an operation that fails, e.g. a decryption of a
  changed ciphertext, or a parameter out of its range
- ::type-error, for an argument of the wrong type or a missing parameter

Bytes on both platforms, a byte array on the JVM and a Uint8Array in
JavaScript, and their encodings: UTF-8, hex, base64 and base64url.

Each decoder returns nil for text that isn't valid. The decoders of
base64 are strict on both platforms: they take only the alphabet, the
padding where RFC 4648 asks for it and pad bits of zero, so that no two
texts decode to the same bytes.

Hashes, HMACs and HKDF, synchronous on every platform.

A hash is :sha-1, :sha-256, :sha-384 or :sha-512 (FIPS 180-4). They come
from the JCA on the JVM and from the Closure Library in JavaScript, since
WebCrypto only returns promises. For the same results as promises, which
WebCrypto computes faster on large data, use digest, sign and derive-bits
of the root namespace.

An error is an ex-info whose :type is one of the keywords of the root
namespace: not-supported-error for another hash, type-error for an
argument that isn't bytes, and operation-error for an HKDF longer than it
can be.

Keys in PEM (RFC 7468): the base64 of their DER between a BEGIN line and
an END line with a label, e.g. PUBLIC KEY, as OpenSSL writes them.

WebCrypto only imports SPKI and PKCS#8, so key-data turns the older
PKCS#1 and SEC1 keys into those, without any cryptography.