crypto: re-add padding for AES-KW wrapped JWKs

PR-URL: #46563
Reviewed-By: James M Snell <jasnell@gmail.com>
Backport-PR-URL: #46252

Author: panva

lib/internal/crypto/webcrypto.js

@@ -8,6 +8,7 @@ const {
  ReflectApply,
  ReflectConstruct,
  SafeSet,
+ StringPrototypeRepeat,
  SymbolToStringTag,
 }=primordials;
 
@@ -680,7 +681,16 @@ async function wrapKey(format, key, wrappingKey, algorithm) {
 letkeyData=awaitReflectApply(exportKey,this,[format,key]);
 
 if(format==='jwk'){
-keyData=newTextEncoder().encode(JSONStringify(keyData));
+constec=newTextEncoder();
+constraw=JSONStringify(keyData);
+// As per the NOTE in step 13 https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
+// we're padding AES-KW wrapped JWK to make sure it is always a multiple of 8 bytes
+// in length
+if(algorithm.name==='AES-KW'&&raw.length%8!==0){
+keyData=ec.encode(raw+StringPrototypeRepeat(' ',8-(raw.length%8)));
+}else{
+keyData=ec.encode(raw);
+}
 }
 
 returncipherOrWrap(

test/parallel/test-webcrypto-wrap-unwrap.js

@@ -231,6 +231,10 @@ function getFormats(key) {
 // material length must be a multiple of 8.
 // If the wrapping algorithm is RSA-OAEP, the exported key
 // material maximum length is a factor of the modulusLength
+//
+// As per the NOTE in step 13 https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
+// we're padding AES-KW wrapped JWK to make sure it is always a multiple of 8 bytes
+// in length
 asyncfunctionwrappingIsPossible(name,exported){
 if('byteLength'inexported){
 switch(name){
@@ -239,13 +243,8 @@ async function wrappingIsPossible(name, exported) {
 case'RSA-OAEP':
 returnexported.byteLength<=446;
 }
-}elseif('kty'inexported){
-switch(name){
-case'AES-KW':
-returnJSON.stringify(exported).length%8===0;
-case'RSA-OAEP':
-returnJSON.stringify(exported).length<=478;
-}
+}elseif('kty'inexported&&name==='RSA-OAEP'){
+returnJSON.stringify(exported).length<=478;
 }
 returntrue;
 }