crypto: unify asymmetric key import through KeyObjectHandle::Init

Consolidate all asymmetric key import paths (DER/PEM, JWK, raw) into
a single KeyObjectHandle::Init() entry point with a uniform signature.
Remove the per-type C++ init methods (InitECRaw, InitEDRaw, InitPqcRaw,
InitJwk, InitECPrivateRaw) and their JS-side callers, replacing them
with shared C++ and JS helpers.
createPublicKey, createPrivateKey, sign, verify, and other operations
that accept key material now handle JWK and raw formats directly in
C++, removing redundant JS-to-C++ key handle round-trips.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62499
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: panva

lib/internal/crypto/aes.js

@@ -10,6 +10,8 @@ const {
  AESCipherJob,
  KeyObjectHandle,
  kCryptoJobAsync,
+ kKeyFormatJWK,
+ kKeyTypeSecret,
  kKeyVariantAES_CTR_128,
  kKeyVariantAES_CBC_128,
  kKeyVariantAES_GCM_128,
@@ -30,7 +32,6 @@ const {
 const{
  hasAnyNotIn,
  jobPromise,
- validateKeyOps,
  kHandle,
  kKeyObject,
 }=require('internal/crypto/util');
@@ -47,6 +48,10 @@ const {
  kAlgorithm,
 }=require('internal/crypto/keys');
 
+const{
+ validateJwk,
+}=require('internal/crypto/webcrypto_util');
+
 const{
 generateKey: _generateKey,
 }=require('internal/crypto/keygen');
@@ -245,31 +250,11 @@ function aesImportKey(
 break;
 }
 case'jwk': {
-if(!keyData.kty)
-throwlazyDOMException('Invalid keyData','DataError');
-
-if(keyData.kty!=='oct')
-throwlazyDOMException('Invalid JWK "kty" Parameter','DataError');
-
-if(usagesSet.size>0&&
-keyData.use!==undefined&&
-keyData.use!=='enc'){
-throwlazyDOMException('Invalid JWK "use" Parameter','DataError');
-}
-
-validateKeyOps(keyData.key_ops,usagesSet);
-
-if(keyData.ext!==undefined&&
-keyData.ext===false&&
-extractable===true){
-throwlazyDOMException(
-'JWK "ext" Parameter and extractable mismatch',
-'DataError');
-}
+validateJwk(keyData,'oct',extractable,usagesSet,'enc');
 
 consthandle=newKeyObjectHandle();
 try{
-handle.initJwk(keyData);
+handle.init(kKeyTypeSecret,keyData,kKeyFormatJWK,null,null);
 }catch(err){
 throwlazyDOMException(
 'Invalid keyData',{name: 'DataError',cause: err});

lib/internal/crypto/cfrg.js

@@ -6,33 +6,22 @@ const {
  TypedArrayPrototypeGetBuffer,
 }=primordials;
 
-const{ Buffer }=require('buffer');
-
 const{
- KeyObjectHandle,
  SignJob,
  kCryptoJobAsync,
  kKeyFormatDER,
- kKeyTypePrivate,
- kKeyTypePublic,
+ kKeyFormatRawPublic,
  kSignJobModeSign,
  kSignJobModeVerify,
  kWebCryptoKeyFormatPKCS8,
  kWebCryptoKeyFormatRaw,
  kWebCryptoKeyFormatSPKI,
 }=internalBinding('crypto');
 
-const{
-codes: {
-ERR_CRYPTO_INVALID_JWK,
-},
-}=require('internal/errors');
-
 const{
  getUsagesUnion,
  hasAnyNotIn,
  jobPromise,
- validateKeyOps,
  kHandle,
  kKeyObject,
 }=require('internal/crypto/util');
@@ -48,13 +37,16 @@ const {
 
 const{
  InternalCryptoKey,
- PrivateKeyObject,
- PublicKeyObject,
- createPrivateKey,
- createPublicKey,
  kKeyType,
 }=require('internal/crypto/keys');
 
+const{
+ importDerKey,
+ importJwkKey,
+ importRawKey,
+ validateJwk,
+}=require('internal/crypto/webcrypto_util');
+
 constgenerateKeyPair=promisify(_generateKeyPair);
 
 functionverifyAcceptableCfrgKeyUse(name,isPublic,usages){
@@ -81,39 +73,6 @@ function verifyAcceptableCfrgKeyUse(name, isPublic, usages) {
 }
 }
 
-functioncreateCFRGRawKey(name,keyData,isPublic){
-consthandle=newKeyObjectHandle();
-
-switch(name){
-case'Ed25519':
-case'X25519':
-if(keyData.byteLength!==32){
-throwlazyDOMException(
-`${name} raw keys must be exactly 32-bytes`,'DataError');
-}
-break;
-case'Ed448':
-if(keyData.byteLength!==57){
-throwlazyDOMException(
-`${name} raw keys must be exactly 57-bytes`,'DataError');
-}
-break;
-case'X448':
-if(keyData.byteLength!==56){
-throwlazyDOMException(
-`${name} raw keys must be exactly 56-bytes`,'DataError');
-}
-break;
-}
-
-constkeyType=isPublic ? kKeyTypePublic : kKeyTypePrivate;
-if(!handle.initEDRaw(name,keyData,keyType)){
-throwlazyDOMException('Invalid keyData','DataError');
-}
-
-returnisPublic ? newPublicKeyObject(handle) : newPrivateKeyObject(handle);
-}
-
 asyncfunctioncfrgGenerateKey(algorithm,extractable,keyUsages){
 const{ name }=algorithm;
 
@@ -243,113 +202,36 @@ function cfrgImportKey(
 }
 case'spki': {
 verifyAcceptableCfrgKeyUse(name,true,usagesSet);
-try{
-keyObject=createPublicKey({
-key: keyData,
-format: 'der',
-type: 'spki',
-});
-}catch(err){
-throwlazyDOMException(
-'Invalid keyData',{name: 'DataError',cause: err});
-}
+keyObject=importDerKey(keyData,true);
 break;
 }
 case'pkcs8': {
 verifyAcceptableCfrgKeyUse(name,false,usagesSet);
-try{
-keyObject=createPrivateKey({
-key: keyData,
-format: 'der',
-type: 'pkcs8',
-});
-}catch(err){
-throwlazyDOMException(
-'Invalid keyData',{name: 'DataError',cause: err});
-}
+keyObject=importDerKey(keyData,false);
 break;
 }
 case'jwk': {
-if(!keyData.kty)
-throwlazyDOMException('Invalid keyData','DataError');
-if(keyData.kty!=='OKP')
-throwlazyDOMException('Invalid JWK "kty" Parameter','DataError');
+constexpectedUse=(name==='X25519'||name==='X448') ? 'enc' : 'sig';
+validateJwk(keyData,'OKP',extractable,usagesSet,expectedUse);
+
 if(keyData.crv!==name)
 throwlazyDOMException(
 'JWK "crv" Parameter and algorithm name mismatch','DataError');
-constisPublic=keyData.d===undefined;
-
-if(usagesSet.size>0&&keyData.use!==undefined){
-letcheckUse;
-switch(name){
-case'Ed25519':
-// Fall through
-case'Ed448':
-checkUse='sig';
-break;
-case'X25519':
-// Fall through
-case'X448':
-checkUse='enc';
-break;
-}
-if(keyData.use!==checkUse)
-throwlazyDOMException('Invalid JWK "use" Parameter','DataError');
-}
-
-validateKeyOps(keyData.key_ops,usagesSet);
-
-if(keyData.ext!==undefined&&
-keyData.ext===false&&
-extractable===true){
-throwlazyDOMException(
-'JWK "ext" Parameter and extractable mismatch',
-'DataError');
-}
 
 if(keyData.alg!==undefined&&(name==='Ed25519'||name==='Ed448')){
-if(keyData.alg!==name&&keyData.alg!=='EdDSA'){
+if(keyData.alg!==name&&keyData.alg!=='EdDSA')
 throwlazyDOMException(
-'JWK "alg" does not match the requested algorithm',
-'DataError');
-}
+'JWK "alg" does not match the requested algorithm','DataError');
 }
 
-if(!isPublic&&typeofkeyData.x!=='string'){
-throwlazyDOMException('Invalid JWK','DataError');
-}
-
-verifyAcceptableCfrgKeyUse(
-name,
-isPublic,
-usagesSet);
-
-try{
-constpublicKeyObject=createCFRGRawKey(
-name,
-Buffer.from(keyData.x,'base64'),
-true);
-
-if(isPublic){
-keyObject=publicKeyObject;
-}else{
-keyObject=createCFRGRawKey(
-name,
-Buffer.from(keyData.d,'base64'),
-false);
-
-if(!createPublicKey(keyObject).equals(publicKeyObject)){
-thrownewERR_CRYPTO_INVALID_JWK();
-}
-}
-}catch(err){
-throwlazyDOMException('Invalid keyData',{name: 'DataError',cause: err});
-}
+constisPublic=keyData.d===undefined;
+verifyAcceptableCfrgKeyUse(name,isPublic,usagesSet);
+keyObject=importJwkKey(isPublic,keyData);
 break;
 }
 case'raw': {
 verifyAcceptableCfrgKeyUse(name,true,usagesSet);
-keyObject=createCFRGRawKey(name,keyData,true);
+keyObject=importRawKey(true,keyData,kKeyFormatRawPublic,name);
 break;
 }
 default:
@@ -381,6 +263,7 @@ async function eddsaSignVerify(key, data, algorithm, signature) {
 undefined,
 undefined,
 undefined,
+undefined,
 data,
 undefined,
 undefined,

lib/internal/crypto/chacha20_poly1305.js

@@ -9,12 +9,13 @@ const {
  ChaCha20Poly1305CipherJob,
  KeyObjectHandle,
  kCryptoJobAsync,
+ kKeyFormatJWK,
+ kKeyTypeSecret,
 }=internalBinding('crypto');
 
 const{
  hasAnyNotIn,
  jobPromise,
- validateKeyOps,
  kHandle,
  kKeyObject,
 }=require('internal/crypto/util');
@@ -30,6 +31,10 @@ const {
  createSecretKey,
 }=require('internal/crypto/keys');
 
+const{
+ validateJwk,
+}=require('internal/crypto/webcrypto_util');
+
 const{
 randomBytes: _randomBytes,
 }=require('internal/crypto/random');
@@ -107,31 +112,11 @@ function c20pImportKey(
 break;
 }
 case'jwk': {
-if(!keyData.kty)
-throwlazyDOMException('Invalid keyData','DataError');
-
-if(keyData.kty!=='oct')
-throwlazyDOMException('Invalid JWK "kty" Parameter','DataError');
-
-if(usagesSet.size>0&&
-keyData.use!==undefined&&
-keyData.use!=='enc'){
-throwlazyDOMException('Invalid JWK "use" Parameter','DataError');
-}
-
-validateKeyOps(keyData.key_ops,usagesSet);
-
-if(keyData.ext!==undefined&&
-keyData.ext===false&&
-extractable===true){
-throwlazyDOMException(
-'JWK "ext" Parameter and extractable mismatch',
-'DataError');
-}
+validateJwk(keyData,'oct',extractable,usagesSet,'enc');
 
 consthandle=newKeyObjectHandle();
 try{
-handle.initJwk(keyData);
+handle.init(kKeyTypeSecret,keyData,kKeyFormatJWK,null,null);
 }catch(err){
 throwlazyDOMException(
 'Invalid keyData',{name: 'DataError',cause: err});

lib/internal/crypto/cipher.js

@@ -64,7 +64,7 @@ const { StringDecoder } = require('string_decoder');
 
 functionrsaFunctionFor(method,defaultPadding,keyType){
 return(options,buffer)=>{
-const{ format, type, data, passphrase }=
+const{ format, type, data, passphrase, namedCurve}=
 keyType==='private' ?
 preparePrivateKey(options) :
 preparePublicOrPrivateKey(options);
@@ -76,8 +76,8 @@ function rsaFunctionFor(method, defaultPadding, keyType) {
 if(oaepLabel!==undefined)
 oaepLabel=getArrayBufferOrView(oaepLabel,'key.oaepLabel',encoding);
 buffer=getArrayBufferOrView(buffer,'buffer',encoding);
-returnmethod(data,format,type,passphrase,buffer,padding,oaepHash,
-oaepLabel);
+returnmethod(data,format,type,passphrase,namedCurve,buffer,
+padding,oaepHash,oaepLabel);
 };
 }