crypto: support JWK objects in create*Key

PR-URL: #37254
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: panva

doc/api/crypto.md

@@ -2452,6 +2452,9 @@ input.on('readable', () => {
 <!-- YAML
 added: v11.6.0
 changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/37254
+ description: The key can also be a JWK object.
  - version: v15.0.0
  pr-url: https://github.com/nodejs/node/pull/35093
  description: The key can also be an ArrayBuffer. The encoding option was
@@ -2460,11 +2463,12 @@ changes:
 
 <!--lint disable maximum-line-length remark-lint-->
 *`key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView}
-*`key`: {string|ArrayBuffer|Buffer|TypedArray|DataView} The key material,
- either in PEM or DER format.
-*`format`: {string} Must be `'pem'` or `'der'`. **Default:**`'pem'`.
+*`key`: {string|ArrayBuffer|Buffer|TypedArray|DataView|Object} The key
+ material, either in PEM, DER, or JWK format.
+*`format`: {string} Must be `'pem'`, `'der'`, or '`'jwk'`.
+**Default:**`'pem'`.
 *`type`: {string} Must be `'pkcs1'`, `'pkcs8'` or `'sec1'`. This option is
- required only if the `format` is `'der'` and ignored if it is `'pem'`.
+ required only if the `format` is `'der'` and ignored otherwise.
 *`passphrase`: {string | Buffer} The passphrase to use for decryption.
 *`encoding`: {string} The string encoding to use when `key` is a string.
 * Returns: {KeyObject}
@@ -2481,6 +2485,9 @@ of the passphrase is limited to 1024 bytes.
 <!-- YAML
 added: v11.6.0
 changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/37254
+ description: The key can also be a JWK object.
  - version: v15.0.0
  pr-url: https://github.com/nodejs/node/pull/35093
  description: The key can also be an ArrayBuffer. The encoding option was
@@ -2496,10 +2503,12 @@ changes:
 
 <!--lint disable maximum-line-length remark-lint-->
 *`key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView}
-*`key`: {string|ArrayBuffer|Buffer|TypedArray|DataView}
-*`format`: {string} Must be `'pem'` or `'der'`. **Default:**`'pem'`.
-*`type`: {string} Must be `'pkcs1'` or `'spki'`. This option is required
- only if the `format` is `'der'`.
+*`key`: {string|ArrayBuffer|Buffer|TypedArray|DataView|Object} The key
+ material, either in PEM, DER, or JWK format.
+*`format`: {string} Must be `'pem'`, `'der'`, or '`'jwk'`.
+**Default:**`'pem'`.
+*`type`: {string} Must be `'pkcs1'` or `'spki'`. This option is
+ required only if the `format` is `'der'` and ignored otherwise.
 *`encoding` {string} The string encoding to use when `key` is a string.
 * Returns: {KeyObject}
 <!--lint enable maximum-line-length remark-lint-->

lib/internal/crypto/keys.js

@@ -26,6 +26,7 @@ const {
 const{
  validateObject,
  validateOneOf,
+ validateString,
 }=require('internal/validators');
 
 const{
@@ -38,6 +39,7 @@ const {
 ERR_OPERATION_FAILED,
 ERR_CRYPTO_JWK_UNSUPPORTED_CURVE,
 ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE,
+ERR_CRYPTO_INVALID_JWK,
 }
 }=require('internal/errors');
 
@@ -65,6 +67,8 @@ const {
 
 const{ inspect }=require('internal/util/inspect');
 
+const{ Buffer }=require('buffer');
+
 constkAlgorithm=Symbol('kAlgorithm');
 constkExtractable=Symbol('kExtractable');
 constkKeyType=Symbol('kKeyType');
@@ -413,6 +417,122 @@ function getKeyTypes(allowKeyObject, bufferOnly = false) {
 returntypes;
 }
 
+functiongetKeyObjectHandleFromJwk(key,ctx){
+validateObject(key,'key');
+validateOneOf(
+key.kty,'key.kty',['RSA','EC','OKP']);
+constisPublic=ctx===kConsumePublic||ctx===kCreatePublic;
+
+if(key.kty==='OKP'){
+validateString(key.crv,'key.crv');
+validateOneOf(
+key.crv,'key.crv',['Ed25519','Ed448','X25519','X448']);
+validateString(key.x,'key.x');
+
+if(!isPublic)
+validateString(key.d,'key.d');
+
+letkeyData;
+if(isPublic)
+keyData=Buffer.from(key.x,'base64');
+else
+keyData=Buffer.from(key.d,'base64');
+
+switch(key.crv){
+case'Ed25519':
+case'X25519':
+if(keyData.byteLength!==32){
+thrownewERR_CRYPTO_INVALID_JWK();
+}
+break;
+case'Ed448':
+if(keyData.byteLength!==57){
+thrownewERR_CRYPTO_INVALID_JWK();
+}
+break;
+case'X448':
+if(keyData.byteLength!==56){
+thrownewERR_CRYPTO_INVALID_JWK();
+}
+break;
+}
+
+consthandle=newKeyObjectHandle();
+if(isPublic){
+handle.initEDRaw(
+`NODE-${key.crv.toUpperCase()}`,
+keyData,
+kKeyTypePublic);
+}else{
+handle.initEDRaw(
+`NODE-${key.crv.toUpperCase()}`,
+keyData,
+kKeyTypePrivate);
+}
+
+returnhandle;
+}
+
+if(key.kty==='EC'){
+validateString(key.crv,'key.crv');
+validateOneOf(
+key.crv,'key.crv',['P-256','secp256k1','P-384','P-521']);
+validateString(key.x,'key.x');
+validateString(key.y,'key.y');
+
+constjwk={
+kty: key.kty,
+crv: key.crv,
+x: key.x,
+y: key.y
+};
+
+if(!isPublic){
+validateString(key.d,'key.d');
+jwk.d=key.d;
+}
+
+consthandle=newKeyObjectHandle();
+consttype=handle.initJwk(jwk,jwk.crv);
+if(type===undefined)
+thrownewERR_CRYPTO_INVALID_JWK();
+
+returnhandle;
+}
+
+// RSA
+validateString(key.n,'key.n');
+validateString(key.e,'key.e');
+
+constjwk={
+kty: key.kty,
+n: key.n,
+e: key.e
+};
+
+if(!isPublic){
+validateString(key.d,'key.d');
+validateString(key.p,'key.p');
+validateString(key.q,'key.q');
+validateString(key.dp,'key.dp');
+validateString(key.dq,'key.dq');
+validateString(key.qi,'key.qi');
+jwk.d=key.d;
+jwk.p=key.p;
+jwk.q=key.q;
+jwk.dp=key.dp;
+jwk.dq=key.dq;
+jwk.qi=key.qi;
+}
+
+consthandle=newKeyObjectHandle();
+consttype=handle.initJwk(jwk);
+if(type===undefined)
+thrownewERR_CRYPTO_INVALID_JWK();
+
+returnhandle;
+}
+
 functionprepareAsymmetricKey(key,ctx){
 if(isKeyObject(key)){
 // Best case: A key object, as simple as that.
@@ -423,13 +543,15 @@ function prepareAsymmetricKey(key, ctx) {
 // Expect PEM by default, mostly for backward compatibility.
 return{format: kKeyFormatPEM,data: getArrayBufferOrView(key,'key')};
 }elseif(typeofkey==='object'){
-const{key: data, encoding }=key;
+const{key: data, encoding, format}=key;
 // The 'key' property can be a KeyObject as well to allow specifying
 // additional options such as padding along with the key.
 if(isKeyObject(data))
 return{data: getKeyObjectHandle(data,ctx)};
 elseif(isCryptoKey(data))
 return{data: getKeyObjectHandle(data[kKeyObject],ctx)};
+elseif(isJwk(data)&&format==='jwk')
+return{data: getKeyObjectHandleFromJwk(data,ctx),format: 'jwk'};
 // Either PEM or DER using PKCS#1 or SPKI.
 if(!isStringOrBuffer(data)){
 thrownewERR_INVALID_ARG_TYPE(
@@ -494,16 +616,26 @@ function createSecretKey(key, encoding) {
 functioncreatePublicKey(key){
 const{ format, type, data, passphrase }=
 prepareAsymmetricKey(key,kCreatePublic);
-consthandle=newKeyObjectHandle();
-handle.init(kKeyTypePublic,data,format,type,passphrase);
+lethandle;
+if(format==='jwk'){
+handle=data;
+}else{
+handle=newKeyObjectHandle();
+handle.init(kKeyTypePublic,data,format,type,passphrase);
+}
 returnnewPublicKeyObject(handle);
 }
 
 functioncreatePrivateKey(key){
 const{ format, type, data, passphrase }=
 prepareAsymmetricKey(key,kCreatePrivate);
-consthandle=newKeyObjectHandle();
-handle.init(kKeyTypePrivate,data,format,type,passphrase);
+lethandle;
+if(format==='jwk'){
+handle=data;
+}else{
+handle=newKeyObjectHandle();
+handle.init(kKeyTypePrivate,data,format,type,passphrase);
+}
 returnnewPrivateKeyObject(handle);
 }
 
@@ -609,6 +741,10 @@ function isCryptoKey(obj) {
 returnobj!=null&&obj[kKeyObject]!==undefined;
 }
 
+functionisJwk(obj){
+returnobj!=null&&obj.kty!==undefined;
+}
+
 module.exports={
 // Public API.
  createSecretKey,

lib/internal/errors.js

@@ -836,6 +836,7 @@ E('ERR_CRYPTO_INCOMPATIBLE_KEY', 'Incompatible %s: %s', Error);
 E('ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS','The selected key encoding %s %s.',
 Error);
 E('ERR_CRYPTO_INVALID_DIGEST','Invalid digest: %s',TypeError);
+E('ERR_CRYPTO_INVALID_JWK','Invalid JWK data',TypeError);
 E('ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE',
 'Invalid key object type %s, expected %s.',TypeError);
 E('ERR_CRYPTO_INVALID_STATE','Invalid state for operation %s',Error);