crypto: fix X25519 and X448 webcrypto public CryptoKey usages

PR-URL: #45569
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Author: panva

lib/internal/crypto/cfrg.js

@@ -53,7 +53,14 @@ function verifyAcceptableCfrgKeyUse(name, type, usages) {
 case'X25519':
 // Fall through
 case'X448':
-checkSet=['deriveKey','deriveBits'];
+switch(type){
+case'private':
+checkSet=['deriveKey','deriveBits'];
+break;
+case'public':
+checkSet=[];
+break;
+}
 break;
 case'Ed25519':
 // Fall through

test/parallel/test-webcrypto-derivebits-cfrg.js

@@ -52,7 +52,7 @@ async function prepareKeys() {
 Buffer.from(spki,'hex'),
 { name },
 true,
-['deriveKey','deriveBits']),
+[]),
 ]);
 keys[name]={
  privateKey,
@@ -180,7 +180,7 @@ async function prepareKeys() {
 name: 'X448',
 public: keys.X448.publicKey
 },keys.X448.publicKey,null),{
-message: /baseKeymustbeaprivatekey/
+name: 'InvalidAccessError'
 });
 }
 
@@ -190,7 +190,7 @@ async function prepareKeys() {
 name: 'X448',
 public: keys.X448.privateKey
 },keys.X448.publicKey,null),{
-message: /algorithm\.publicmustbeapublickey/
+name: 'InvalidAccessError'
 });
 }
 
@@ -207,7 +207,7 @@ async function prepareKeys() {
 name: 'X448',
 public: key
 },keys.X448.publicKey,null),{
-message: /algorithm\.publicmustbeapublickey/
+name: 'InvalidAccessError'
 });
 }
 })().then(common.mustCall());

test/parallel/test-webcrypto-derivekey-cfrg.js

@@ -51,7 +51,7 @@ async function prepareKeys() {
 Buffer.from(spki,'hex'),
 { name },
 true,
-['deriveKey','deriveBits']),
+[]),
 ]);
 keys[name]={
  privateKey,
@@ -150,20 +150,20 @@ async function prepareKeys() {
 },
 keys.X448.publicKey,
  ...otherArgs),
-{message: /baseKeymustbeaprivatekey/});
+{name: 'InvalidAccessError'});
 }
 
 {
-// Base key is not a private key
+// Public is not a public key
 awaitassert.rejects(
 subtle.deriveKey(
 {
 name: 'X448',
 public: keys.X448.privateKey
 },
-keys.X448.publicKey,
+keys.X448.privateKey,
  ...otherArgs),
-{message: /algorithm\.publicmustbeapublickey/});
+{name: 'InvalidAccessError'});
 }
 
 {
@@ -183,6 +183,6 @@ async function prepareKeys() {
 },
 keys.X448.publicKey,
  ...otherArgs),
-{message: /algorithm\.publicmustbeapublickey/});
+{name: 'InvalidAccessError'});
 }
 })().then(common.mustCall());

test/parallel/test-webcrypto-export-import-cfrg.js

@@ -315,19 +315,19 @@ async function testImportRaw({ name, publicUsages }) {
 constrsaPrivate=crypto.createPrivateKey(
 fixtures.readKey('rsa_private_2048.pem'));
 
-for(const[name,[publicUsage,privateUsage]]ofObject.entries({
-'Ed25519':['verify','sign'],
-'X448': ['deriveBits','deriveBits'],
-})){
+for(const[name,publicUsages,privateUsages]of[
+['Ed25519',['verify'],['sign']],
+['X448',[],['deriveBits']],
+]){
 assert.rejects(subtle.importKey(
 'spki',
 rsaPublic.export({format: 'der',type: 'spki'}),
 { name },
-true,[publicUsage]),{message: /Invalidkeytype/});
+true,publicUsages),{message: /Invalidkeytype/});
 assert.rejects(subtle.importKey(
 'pkcs8',
 rsaPrivate.export({format: 'der',type: 'pkcs8'}),
 { name },
-true,[privateUsage]),{message: /Invalidkeytype/});
+true,privateUsages),{message: /Invalidkeytype/});
 }
 }

test/wpt/status/WebCryptoAPI.json

@@ -59,14 +59,6 @@
 "import_export/okp_importKey_failures_X25519.https.any.js": {
 "fail": {
 "expected": [
-"Bad usages: importKey(spki, {name: X25519}, true, [deriveKey])",
-"Bad usages: importKey(spki, {name: X25519}, false, [deriveKey])",
-"Bad usages: importKey(spki, {name: X25519}, true, [deriveBits])",
-"Bad usages: importKey(spki, {name: X25519}, false, [deriveBits])",
-"Bad usages: importKey(jwk (public) , {name: X25519}, true, [deriveKey])",
-"Bad usages: importKey(jwk (public) , {name: X25519}, false, [deriveKey])",
-"Bad usages: importKey(jwk (public) , {name: X25519}, true, [deriveBits])",
-"Bad usages: importKey(jwk (public) , {name: X25519}, false, [deriveBits])",
 "Bad key length: importKey(spki, {name: X25519}, true, [])",
 "Bad key length: importKey(spki, {name: X25519}, false, [])",
 "Bad key length: importKey(pkcs8, {name: X25519}, true, [deriveKey])",
@@ -97,14 +89,6 @@
 "import_export/okp_importKey_failures_X448.https.any.js": {
 "fail": {
 "expected": [
-"Bad usages: importKey(spki, {name: X448}, true, [deriveKey])",
-"Bad usages: importKey(spki, {name: X448}, false, [deriveKey])",
-"Bad usages: importKey(spki, {name: X448}, true, [deriveBits])",
-"Bad usages: importKey(spki, {name: X448}, false, [deriveBits])",
-"Bad usages: importKey(jwk (public) , {name: X448}, true, [deriveKey])",
-"Bad usages: importKey(jwk (public) , {name: X448}, false, [deriveKey])",
-"Bad usages: importKey(jwk (public) , {name: X448}, true, [deriveBits])",
-"Bad usages: importKey(jwk (public) , {name: X448}, false, [deriveBits])",
 "Bad key length: importKey(spki, {name: X448}, true, [])",
 "Bad key length: importKey(spki, {name: X448}, false, [])",
 "Bad key length: importKey(pkcs8, {name: X448}, true, [deriveKey])",