crypto: reject duplicate ML-KEM JWK key_ops

panva · aduh95 · commit 6eea52426f7d · 2026-05-05T16:19:37.000+02:00
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #62905 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
@@ -801,6 +801,10 @@ const kKeyOps = {
 unwrapKey: 6,
 deriveKey: 7,
 deriveBits: 8,
+ encapsulateKey: 9,
+ encapsulateBits: 10,
+ decapsulateKey: 11,
+ decapsulateBits: 12,
 };
 
 function validateKeyOps(keyOps, usagesSet) {
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -321,3 +321,16 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
 });
 }
 })().then(common.mustCall());
+
+// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
+// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
+// duplicate entries are rejected
+(async function() {
+ for (const op of ['encapsulateKey', 'encapsulateBits',
+ 'decapsulateKey', 'decapsulateBits']) {
+ const jwk = { ...keyData['ML-KEM-768'].jwk, key_ops: [op, op] };
+ await assert.rejects(
+ subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+ { name: 'DataError', message: /Duplicate key operation/ });
+ }
+})().then(common.mustCall());

-Original file line number
+Diff line change
 });
+}
 })().then(common.mustCall());
++
 +// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
 +// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
 +// duplicate entries are rejected
 +(asyncfunction(){
 +for(constopof['encapsulateKey','encapsulateBits',
 +'decapsulateKey','decapsulateBits']){
 +constjwk={ ...keyData['ML-KEM-768'].jwk,key_ops: [op,op]};
 +awaitassert.rejects(
 +subtle.importKey('jwk',jwk,{name: 'ML-KEM-768'},true,[op]),
 +{name: 'DataError',message: /Duplicatekeyoperation/});
 +}
 +})().then(common.mustCall());