Skip to content

Commit 934fda6

Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: improve accuracy of SubtleCrypto.supports
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63104 Backport-PR-URL: #64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent b9e17dc commit 934fda6

3 files changed

Lines changed: 65 additions & 17 deletions

File tree

‎lib/internal/crypto/webcrypto.js‎

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1928,7 +1928,11 @@ class SubtleCrypto {
19281928
}
19291929
}
19301930

1931-
returncheck(operation,algorithm,length);
1931+
try{
1932+
returncheck(operation,algorithm,length);
1933+
}catch{
1934+
returnfalse;
1935+
}
19321936
}
19331937
}
19341938

@@ -1971,25 +1975,35 @@ function check(op, alg, length) {
19711975
returntrue;
19721976
case'deriveBits': {
19731977
if(normalizedAlgorithm.name==='HKDF'){
1974-
try{
1975-
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
1976-
}catch{
1977-
returnfalse;
1978-
}
1978+
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
19791979
}
19801980

19811981
if(normalizedAlgorithm.name==='PBKDF2'){
1982-
try{
1983-
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
1984-
}catch{
1985-
returnfalse;
1986-
}
1982+
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
19871983
}
19881984

19891985
if(StringPrototypeStartsWith(normalizedAlgorithm.name,'Argon2')){
1990-
try{
1991-
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
1992-
}catch{
1986+
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
1987+
}
1988+
1989+
if(normalizedAlgorithm.name==='X25519'&&length>256){
1990+
returnfalse;
1991+
}
1992+
1993+
if(normalizedAlgorithm.name==='X448'&&length>448){
1994+
returnfalse;
1995+
}
1996+
1997+
if(normalizedAlgorithm.name==='ECDH'){
1998+
constnamedCurve=getCryptoKeyAlgorithm(normalizedAlgorithm.public).namedCurve;
1999+
constmaxLength={
2000+
'__proto__': null,
2001+
'P-256': 256,
2002+
'P-384': 384,
2003+
'P-521': 528,
2004+
}[namedCurve];
2005+
2006+
if(length>maxLength){
19932007
returnfalse;
19942008
}
19952009
}

‎test/fixtures/webcrypto/supports-level-2.mjs‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,18 +103,36 @@ export const vectors = {
103103
[true,
104104
{name: 'X25519',public: X25519.publicKey},
105105
{name: 'AES-CBC',length: 128}],
106-
[true,
106+
[false,
107107
{name: 'X25519',public: X25519.publicKey},
108108
{name: 'HMAC',hash: 'SHA-256'}],
109+
[true,
110+
{name: 'X25519',public: X25519.publicKey},
111+
{name: 'HMAC',hash: 'SHA-256',length: 256}],
112+
[false,
113+
{name: 'X25519',public: X25519.publicKey},
114+
{name: 'HMAC',hash: 'SHA-256',length: 257}],
109115
[true,
110116
{name: 'X25519',public: X25519.publicKey},
111117
'HKDF'],
112118
[true,
113119
{name: 'ECDH',public: ECDH.publicKey},
114120
{name: 'AES-CBC',length: 128}],
115-
[true,
121+
[false,
116122
{name: 'ECDH',public: ECDH.publicKey},
117123
{name: 'HMAC',hash: 'SHA-256'}],
124+
[false,
125+
{name: 'ECDH',public: ECDH.publicKey},
126+
{name: 'HMAC',hash: 'SHA-256',length: 255}],
127+
[true,
128+
{name: 'ECDH',public: ECDH.publicKey},
129+
{name: 'HMAC',hash: 'SHA-256',length: 256}],
130+
[false,
131+
{name: 'ECDH',public: ECDH.publicKey},
132+
{name: 'HMAC',hash: 'SHA-256',length: 257}],
133+
[false,
134+
{name: 'ECDH',public: ECDH.publicKey},
135+
{name: 'HMAC',hash: 'SHA-256',length: 264}],
118136
[true,
119137
{name: 'ECDH',public: ECDH.publicKey},
120138
'HKDF'],
@@ -143,10 +161,18 @@ export const vectors = {
143161

144162
[true,
145163
{name: 'ECDH',public: ECDH.publicKey}],
164+
[true,
165+
{name: 'ECDH',public: ECDH.publicKey},256],
166+
[false,
167+
{name: 'ECDH',public: ECDH.publicKey},257],
168+
[false,
169+
{name: 'ECDH',public: ECDH.publicKey},264],
146170
[false,{name: 'ECDH',public: ECDH.privateKey}],
147171
[false,'ECDH'],
148172

149173
[true,{name: 'X25519',public: X25519.publicKey}],
174+
[true,{name: 'X25519',public: X25519.publicKey},256],
175+
[false,{name: 'X25519',public: X25519.publicKey},257],
150176
[false,{name: 'X25519',public: X25519.privateKey}],
151177
[false,'X25519'],
152178
],

‎test/fixtures/webcrypto/supports-secure-curves.mjs‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,23 @@ export const vectors = {
2828
[!boringSSL,
2929
{name: 'X448',public: X448?.publicKey},
3030
{name: 'AES-CBC',length: 128}],
31-
[!boringSSL,
31+
[false,
3232
{name: 'X448',public: X448?.publicKey},
3333
{name: 'HMAC',hash: 'SHA-256'}],
34+
[!boringSSL,
35+
{name: 'X448',public: X448?.publicKey},
36+
{name: 'HMAC',hash: 'SHA-256',length: 448}],
37+
[false,
38+
{name: 'X448',public: X448?.publicKey},
39+
{name: 'HMAC',hash: 'SHA-256',length: 449}],
3440
[!boringSSL,
3541
{name: 'X448',public: X448?.publicKey},
3642
'HKDF'],
3743
],
3844
'deriveBits': [
3945
[!boringSSL,{name: 'X448',public: X448?.publicKey}],
46+
[!boringSSL,{name: 'X448',public: X448?.publicKey},448],
47+
[false,{name: 'X448',public: X448?.publicKey},449],
4048
[false,{name: 'X448',public: X25519.publicKey}],
4149
[false,{name: 'X448',public: X448?.privateKey}],
4250
[false,'X448'],

0 commit comments

Comments
 (0)