crypto: improve SubtleCrypto.supports() accuracy

Constrain context parameters, ML-KEM derived-key imports, HKDF output
lengths, and RSA key generation.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65222
Refs: https://redirect.github.com/w3c/webcrypto/pull/558
Refs: https://redirect.github.com/WICG/webcrypto-modern-algos/pull/76
Refs: https://redirect.github.com/WICG/webcrypto-modern-algos/pull/77
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Author: panva

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };

lib/internal/crypto/hkdf.js

@@ -22,6 +22,7 @@ const {
 const{ kMaxLength }=require('buffer');
 
 const{
+ getDigestSizeInBytes,
  jobPromise,
  normalizeHashName,
  toBuf,
@@ -141,19 +142,24 @@ function hkdfSync(hash, key, salt, info, length) {
 returnbits;
 }
 
-functionvalidateHkdfDeriveBitsLength(length){
+functionvalidateHkdfDeriveBitsLength(length,hash){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
 if(length%8){
 throwlazyDOMException(
 'length must be a multiple of 8',
 'OperationError');
 }
+if(length>255*getDigestSizeInBytes(hash.name)*8){
+throwlazyDOMException(
+'length exceeds the maximum derived bit length',
+'OperationError');
+}
 }
 
 functionhkdfDeriveBits(algorithm,baseKey,length){
-validateHkdfDeriveBitsLength(length);
 const{ hash, salt, info }=algorithm;
+validateHkdfDeriveBitsLength(length,hash);
 
 if(length===0)
 returnPromiseResolve(newArrayBuffer(0));

lib/internal/crypto/rsa.js

@@ -103,12 +103,6 @@ function rsaKeyGenerate(
 extractable,
 usages,
 ){
-constpublicExponentConverted=bigIntArrayToUnsignedInt(algorithm.publicExponent);
-if(publicExponentConverted===undefined){
-throwlazyDOMException(
-'The publicExponent must be equivalent to an unsigned 32-bit value',
-'OperationError');
-}
 const{
  name,
  modulusLength,
@@ -118,6 +112,7 @@ function rsaKeyGenerate(
 
 constallowedUsages=kUsages[name];
 constusagesSet=validateKeyUsages(usages,allowedUsages.keygen,name);
+constpublicExponentConverted=bigIntArrayToUnsignedInt(publicExponent);
 
 constkeyAlgorithm={
  name,
@@ -126,12 +121,6 @@ function rsaKeyGenerate(
  hash,
 };
 
-if(publicExponentConverted<3||publicExponentConverted%2===0){
-throwlazyDOMException(
-'The operation failed for an operation-specific reason',
-'OperationError');
-}
-
 constkeyUsages=getKeyPairUsages(usagesSet,allowedUsages);
 validateUsagesNotEmpty(keyUsages.private);
 

lib/internal/crypto/util.js

@@ -341,20 +341,23 @@ const kAlgorithmDefinitions = {
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-768': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'ML-KEM-1024': {
 'generateKey': null,
 'exportKey': null,
 'importKey': null,
 'encapsulate': null,
 'decapsulate': null,
+'get shared key length': null,
 },
 'PBKDF2': {
 'importKey': null,
@@ -886,15 +889,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 functionbigIntArrayToUnsignedInt(input){
 letresult=0;
 constlength=TypedArrayPrototypeGetLength(input);
 
 for(letn=0;n<length;++n){
 constn_reversed=length-n-1;
-if(n_reversed>=4&&input[n])
-return;// Too large
+if(n_reversed>=4&&input[n]){
+throwlazyDOMException(
+'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+'OperationError');
+}
 result|=input[n]<<8*n_reversed;
 }
 

lib/internal/crypto/webcrypto.js

@@ -348,6 +348,54 @@ function getKeyLength({ name, length, hash }) {
 }
 }
 
+functiongetSharedKeyLength({ name }){
+switch(name){
+case'ML-KEM-512':
+// Fall through
+case'ML-KEM-768':
+// Fall through
+case'ML-KEM-1024':
+return256;
+/* c8 ignore start */
+default: {
+constassert=require('internal/assert');
+assert.fail('Unreachable code');
+}
+/* c8 ignore stop */
+}
+}
+
+functioncanImportRawSecret(algorithm,sharedKeyLength){
+switch(algorithm.name){
+case'AES-OCB':
+case'AES-KW':
+case'AES-GCM':
+case'AES-CTR':
+case'AES-CBC':
+returnsharedKeyLength===128||
+sharedKeyLength===192||
+sharedKeyLength===256;
+case'ChaCha20-Poly1305':
+returnsharedKeyLength===256;
+case'HKDF':
+case'PBKDF2':
+case'Argon2i':
+case'Argon2d':
+case'Argon2id':
+returntrue;
+case'HMAC':
+if(sharedKeyLength===0)
+returnfalse;
+// Fall through
+case'KMAC128':
+case'KMAC256':
+returnalgorithm.length===undefined||
+numBitsToBytes(algorithm.length)*8===sharedKeyLength;
+default:
+returnfalse;
+}
+}
+
 functionderiveKey(
 algorithm,
 baseKey,
@@ -1741,37 +1789,19 @@ class SubtleCrypto {
 },
 );
 
+letsharedKeyLength;
 letnormalizedAdditionalAlgorithm;
 try{
+constnormalizedAlgorithm=
+normalizeAlgorithm(algorithm,'get shared key length');
+sharedKeyLength=getSharedKeyLength(normalizedAlgorithm);
 normalizedAdditionalAlgorithm=normalizeAlgorithm(additionalAlgorithm,'importKey');
 }catch{
 returnfalse;
 }
 
-switch(normalizedAdditionalAlgorithm.name){
-case'AES-OCB':
-case'AES-KW':
-case'AES-GCM':
-case'AES-CTR':
-case'AES-CBC':
-case'ChaCha20-Poly1305':
-case'HKDF':
-case'PBKDF2':
-case'Argon2i':
-case'Argon2d':
-case'Argon2id':
-break;
-case'HMAC':
-case'KMAC128':
-case'KMAC256':
-if(normalizedAdditionalAlgorithm.length===undefined||
-numBitsToBytes(normalizedAdditionalAlgorithm.length)===32){
-break;
-}
-returnfalse;
-default:
-returnfalse;
-}
+if(!canImportRawSecret(normalizedAdditionalAlgorithm,sharedKeyLength))
+returnfalse;
 }
 
 try{
@@ -1807,8 +1837,6 @@ function check(op, alg, length) {
 }
 
 switch(op){
-case'decapsulate':
-case'decrypt':
 case'digest': {
 if((normalizedAlgorithm.name==='cSHAKE128'||
 normalizedAlgorithm.name==='cSHAKE256')&&
@@ -1818,6 +1846,8 @@ function check(op, alg, length) {
 }
 returntrue;
 }
+case'decapsulate':
+case'decrypt':
 case'encapsulate':
 case'encrypt':
 case'exportKey':
@@ -1829,7 +1859,8 @@ function check(op, alg, length) {
 returntrue;
 case'deriveBits': {
 if(normalizedAlgorithm.name==='HKDF'){
-require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+require('internal/crypto/hkdf')
+.validateHkdfDeriveBitsLength(length,normalizedAlgorithm.hash);
 }
 
 if(normalizedAlgorithm.name==='PBKDF2'){

lib/internal/crypto/webidl.js

@@ -24,6 +24,7 @@ const {
  getCryptoKeyType,
 }=require('internal/crypto/keys');
 const{
+ bigIntArrayToUnsignedInt,
  validateMaxBufferLength,
  getBufferSourceByteLength,
  getBufferSourceBytes,
@@ -42,6 +43,8 @@ const {
  type,
 }=require('internal/webidl');
 
+constkRsaKeyGenMinimumModulusLength=isFips ? 2048 : 512;
+
 functionvalidateByteLength(buf,name,target){
 if(getBufferSourceByteLength(buf)!==target){
 throwlazyDOMException(
@@ -176,11 +179,33 @@ const dictRsaKeyGenParams = [
 key: 'modulusLength',
 converter: (V,opts)=>
 converters['unsigned long'](V,enforceRangeOptions(opts)),
+validator: (modulusLength)=>{
+if(modulusLength<kRsaKeyGenMinimumModulusLength){
+throwlazyDOMException(
+`algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+'OperationError');
+}
+},
 required: true,
 },
 {
 key: 'publicExponent',
 converter: converters.BigInteger,
+validator: (publicExponent)=>{
+constconverted=bigIntArrayToUnsignedInt(publicExponent);
+
+if(converted<3){
+throwlazyDOMException(
+'algorithm.publicExponent must be at least 3',
+'OperationError');
+}
+
+if(converted%2===0){
+throwlazyDOMException(
+'algorithm.publicExponent must be odd',
+'OperationError');
+}
+},
 required: true,
 },
 ];
@@ -649,20 +674,27 @@ converters.ContextParams = createDictionaryConverter(
 key: 'context',
 converter: converters.BufferSource,
 validator(V,dict){
+constvalidateLength=(V)=>
+validateMaxBufferLength(V,'ContextParams.context',255);
+
 if(process.features.openssl_is_boringssl){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
 let{0: major,1: minor}=
 StringPrototypeSplit(process.versions.openssl,'.');
 major=NumberParseInt(major,10);
 minor=NumberParseInt(minor,10);
 if(major>3||(major===3&&minor>=2)){
-this.validator=undefined;
+this.validator=validateLength;
 }else{
-this.validator=validateZeroLength('ContextParams.context');
-this.validator(V,dict);
+constvalidateEmpty=validateZeroLength('ContextParams.context');
+this.validator=(V,dict)=>{
+validateLength(V);
+validateEmpty(V,dict);
+};
 }
 }
+this.validator(V,dict);
 },
 },
 ],

test/fixtures/webcrypto/supports-level-2.mjs

@@ -1,4 +1,7 @@
+import{getFips}from'node:crypto';
+
 const{ subtle }=globalThis.crypto;
+constRSA_MINIMUM_MODULUS_LENGTH=getFips()===1 ? 2048 : 512;
 
 constRSA_KEY_GEN={
 modulusLength: 2048,
@@ -66,6 +69,30 @@ export const vectors = {
 [true,{name: 'RSASSA-PKCS1-v1_5',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-PSS',hash: 'SHA-256', ...RSA_KEY_GEN}],
 [true,{name: 'RSA-OAEP',hash: 'SHA-256', ...RSA_KEY_GEN}],
+[true,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSASSA-PKCS1-v1_5',
+hash: 'SHA-256',
+modulusLength: RSA_MINIMUM_MODULUS_LENGTH-1,
+publicExponent: newUint8Array([1,0,1]),
+}],
+[false,{
+name: 'RSA-PSS',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([2]),
+}],
+[false,{
+name: 'RSA-OAEP',
+hash: 'SHA-256',
+ ...RSA_KEY_GEN,
+publicExponent: newUint8Array([1,0,0,0,1]),
+}],
 [true,{name: 'ECDSA',namedCurve: 'P-256'}],
 [false,{name: 'ECDSA',namedCurve: 'X25519'}],
 [true,{name: 'AES-CTR',length: 128}],
@@ -146,6 +173,8 @@ export const vectors = {
 'deriveBits': [
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
 [true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},0],
+[true,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65280],
+[false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},65288],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},null],
 [false,{name: 'HKDF',hash: 'SHA-256',salt: Buffer.alloc(0),info: Buffer.alloc(0)},7],
 [false,{name: 'HKDF',hash: 'Invalid',salt: Buffer.alloc(0),info: Buffer.alloc(0)},8],
@@ -234,4 +263,7 @@ export const vectors = {
 'get key length': [
 [false,{name: 'HMAC',hash: 'SHA-256'}],
 ],
+'get shared key length': [
+[false,'ML-KEM-768'],
+],
 };