crypto: limit KangarooTwelveParams customization to 512 bytes

To align with a future OpenSSL-imposed limit.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64557
Backport-PR-URL: #65087
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));

doc/api/webcrypto.md

@@ -2249,11 +2249,16 @@ added: v24.18.0
 
 <!-- YAML
 added: v24.18.0
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/64557
+ description: Limit customization to 512 bytes.
 -->
 
 * Type: {ArrayBuffer|TypedArray|DataView|Buffer|undefined}
 
-The optional customization string for KangarooTwelve.
+The optional customization string for KangarooTwelve. It must not exceed 512
+bytes.
 
 #### `kangarooTwelveParams.name`
 

lib/internal/crypto/webidl.js

@@ -296,10 +296,6 @@ function validateCShakeFunctionName(V) {
 'NotSupportedError');
 }
 
-functionvalidateCShakeCustomization(V){
-validateMaxBufferLength(V,'CShakeParams.customization',512);
-}
-
 converters.RsaPssParams=createDictionaryConverter(
 'RsaPssParams',[
 dictAlgorithm,
@@ -452,7 +448,7 @@ converters.CShakeParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
-validator: validateCShakeCustomization,
+validator: (V,opts)=>validateMaxBufferLength(V,'CShakeParams.customization',512),
 },
 ],
 ]);
@@ -774,6 +770,7 @@ converters.KangarooTwelveParams = createDictionaryConverter(
 {
 key: 'customization',
 converter: converters.BufferSource,
+validator: (V,opts)=>validateMaxBufferLength(V,'KangarooTwelveParams.customization',512),
 },
 ],
 ]);

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -48,11 +48,15 @@ export const vectors = {
 [false,'KT128'],
 [true,{name: 'KT128',outputLength: 128}],
 [true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(0)}],
+[true,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(512)}],
+[false,{name: 'KT128',outputLength: 128,customization: Buffer.alloc(513)}],
 [false,{name: 'KT128',outputLength: 0}],
 [false,{name: 'KT128',outputLength: 127}],
 [false,'KT256'],
 [true,{name: 'KT256',outputLength: 256}],
 [true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(0)}],
+[true,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(512)}],
+[false,{name: 'KT256',outputLength: 256,customization: Buffer.alloc(513)}],
 [false,{name: 'KT256',outputLength: 0}],
 [false,{name: 'KT256',outputLength: 255}],
 ],

test/parallel/test-webcrypto-digest-turboshake-rfc.js

@@ -326,6 +326,15 @@ async function checkDigest(name, vectors) {
 else
 algorithm.domainSeparation=rest[0];
 }
+
+if(isKT&&algorithm.customization?.byteLength>512){
+awaitassert.rejects(subtle.digest(algorithm,input),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
+continue;
+}
+
 constresult=awaitsubtle.digest(algorithm,input);
 assert.deepStrictEqual(
 Buffer.from(result).toString('hex'),

test/parallel/test-webcrypto-digest-turboshake.js

@@ -155,11 +155,22 @@ async function testDigest(size, alg) {
 
 // KT128 with customization string
 (async()=>{
-constdigest=awaitsubtle.digest(
-{name: 'KT128',outputLength: 256,customization: Buffer.from('test')},
-Buffer.from('hello'));
+constdigest=awaitsubtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(512),
+},Buffer.from('hello'));
 assert(digestinstanceofArrayBuffer);
 assert.strictEqual(digest.byteLength,32);
+
+awaitassert.rejects(subtle.digest({
+name: 'KT128',
+outputLength: 256,
+customization: Buffer.alloc(513),
+},Buffer.from('hello')),{
+name: 'OperationError',
+message: 'KangarooTwelveParams.customization must be at most 512 bytes',
+});
 })().then(common.mustCall());
 
 // TurboSHAKE domain separation out of range

test/wpt/status/WebCryptoAPI.cjs

@@ -91,6 +91,9 @@ if (process.features.openssl_is_boringssl) {
 ['supports-modern.tentative.https.any.js',/ml-kem-512/i]);
 }
 
+skipSubtests(
+['digest/kangarootwelve.tentative.https.any.js',/C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2})bytes/]);
+
 functionassertNoOverlap(fileSkips,subtestSkips){
 constsubtestSkipFiles=newSet(Object.keys(subtestSkips));
 constoverlap=Object.keys(fileSkips).filter((file)=>subtestSkipFiles.has(file));