Skip to content

Commit a95386f

Browse files
panvatargos
panva
authored and
targos
committed
crypto: subject some algorithms in Web Cryptography on BoringSSL absence
PR-URL: #59365 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
1 parent 3f47a2f commit a95386f

21 files changed

Lines changed: 434 additions & 277 deletions

‎lib/internal/crypto/util.js‎

Lines changed: 54 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,6 @@ const kSupportedAlgorithms = {
187187
'AES-CTR': 'AesKeyGenParams',
188188
'AES-CBC': 'AesKeyGenParams',
189189
'AES-GCM': 'AesKeyGenParams',
190-
'AES-KW': 'AesKeyGenParams',
191190
'HMAC': 'HmacKeyGenParams',
192191
'Ed25519': null,
193192
'X25519': null,
@@ -202,7 +201,6 @@ const kSupportedAlgorithms = {
202201
'AES-CTR': null,
203202
'AES-CBC': null,
204203
'AES-GCM': null,
205-
'AES-KW': null,
206204
'Ed25519': null,
207205
'X25519': null,
208206
},
@@ -232,7 +230,6 @@ const kSupportedAlgorithms = {
232230
'AES-CTR': null,
233231
'AES-CBC': null,
234232
'AES-GCM': null,
235-
'AES-KW': null,
236233
'Ed25519': null,
237234
'X25519': null,
238235
},
@@ -258,48 +255,69 @@ const kSupportedAlgorithms = {
258255
'AES-CBC': 'AesDerivedKeyParams',
259256
'AES-CTR': 'AesDerivedKeyParams',
260257
'AES-GCM': 'AesDerivedKeyParams',
261-
'AES-KW': 'AesDerivedKeyParams',
262258
'HMAC': 'HmacImportParams',
263259
'HKDF': null,
264260
'PBKDF2': null,
265261
},
266-
'wrapKey': {
267-
'AES-KW': null,
268-
},
269-
'unwrapKey': {
270-
'AES-KW': null,
271-
},
262+
'wrapKey': {},
263+
'unwrapKey': {},
272264
};
273265

274-
constexperimentalAlgorithms=ObjectEntries({
275-
'X448': {
276-
generateKey: null,
277-
importKey: null,
278-
deriveBits: 'EcdhKeyDeriveParams',
279-
exportKey: null,
280-
},
281-
'Ed448': {
282-
generateKey: null,
283-
sign: 'Ed448Params',
284-
verify: 'Ed448Params',
285-
importKey: null,
286-
exportKey: null,
287-
},
288-
'cSHAKE128': {digest: 'CShakeParams'},
289-
'cSHAKE256': {digest: 'CShakeParams'},
290-
'SHA3-256': {digest: null},
291-
'SHA3-384': {digest: null},
292-
'SHA3-512': {digest: null},
293-
'ChaCha20-Poly1305': {
294-
'encrypt': 'AeadParams',
295-
'decrypt': 'AeadParams',
296-
'generateKey': null,
297-
'importKey': null,
266+
constconditionalAlgorithms=ObjectEntries({
267+
'AES-KW': [{
268+
'generateKey': 'AesKeyGenParams',
298269
'exportKey': null,
299-
'get key length': null,
300-
},
270+
'importKey': null,
271+
'get key length': 'AesDerivedKeyParams',
272+
'wrapKey': null,
273+
'unwrapKey': null,
274+
},!process.features.openssl_is_boringssl],
301275
});
302276

277+
for(leti=0;i<conditionalAlgorithms.length;i++){
278+
if(conditionalAlgorithms[i][1][1]){
279+
constname=conditionalAlgorithms[i][0];
280+
constops=ObjectEntries(conditionalAlgorithms[i][1][0]);
281+
for(letj=0;j<ops.length;j++){
282+
const{0: op,1: dict}=ops[j];
283+
kSupportedAlgorithms[op][name]=dict;
284+
}
285+
}
286+
}
287+
288+
constexperimentalAlgorithms=ObjectEntries({});
289+
290+
if(!process.features.openssl_is_boringssl){
291+
ArrayPrototypePush(experimentalAlgorithms,
292+
['Ed448',{
293+
generateKey: null,
294+
sign: 'Ed448Params',
295+
verify: 'Ed448Params',
296+
importKey: null,
297+
exportKey: null,
298+
}],
299+
['X448',{
300+
generateKey: null,
301+
importKey: null,
302+
deriveBits: 'EcdhKeyDeriveParams',
303+
exportKey: null,
304+
}],
305+
['cSHAKE128',{digest: 'CShakeParams'}],
306+
['cSHAKE256',{digest: 'CShakeParams'}],
307+
['ChaCha20-Poly1305',{
308+
'encrypt': 'AeadParams',
309+
'decrypt': 'AeadParams',
310+
'generateKey': null,
311+
'importKey': null,
312+
'exportKey': null,
313+
'get key length': null,
314+
}],
315+
['SHA3-256',{digest: null}],
316+
['SHA3-384',{digest: null}],
317+
['SHA3-512',{digest: null}],
318+
);
319+
}
320+
303321
for(const{0: algorithm,1: nid}of[
304322
['ML-DSA-44',EVP_PKEY_ML_DSA_44],
305323
['ML-DSA-65',EVP_PKEY_ML_DSA_65],

‎test/fixtures/crypto/eddsa.js‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
'use strict';
22

3+
constcommon=require('../../common');
4+
35
module.exports=function(){
46
constpkcs8={
57
'Ed25519': Buffer.from(
@@ -37,7 +39,13 @@ module.exports = function() {
3739
'025a2a5a572b9d23b0642f00','hex')
3840
}
3941

40-
constalgorithms=['Ed25519','Ed448'];
42+
constalgorithms=['Ed25519'];
43+
44+
if(!process.features.openssl_is_boringssl){
45+
algorithms.push('Ed448')
46+
}else{
47+
common.printSkipMessage(`Skipping unsupported Ed448 test cases`);
48+
}
4149

4250
constvectors=algorithms.map((algorithm)=>({
4351
publicKeyBuffer: spki[algorithm],

‎test/fixtures/webcrypto/supports-level-2.mjs‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ const [ECDH, X448, X25519] = await Promise.all([
1111
subtle.generateKey('X25519',false,['deriveBits','deriveKey']),
1212
]);
1313

14+
constboringSSL=process.features.openssl_is_boringssl;
15+
1416
exportconstvectors={
1517
'encrypt': [
1618
[false,'Invalid'],
@@ -79,7 +81,7 @@ export const vectors = {
7981
[false,{name: 'AES-CBC',length: 25}],
8082
[true,{name: 'AES-GCM',length: 128}],
8183
[false,{name: 'AES-GCM',length: 25}],
82-
[true,{name: 'AES-KW',length: 128}],
84+
[!boringSSL,{name: 'AES-KW',length: 128}],
8385
[false,{name: 'AES-KW',length: 25}],
8486
[true,{name: 'HMAC',hash: 'SHA-256'}],
8587
[true,{name: 'HMAC',hash: 'SHA-256',length: 256}],
@@ -189,7 +191,7 @@ export const vectors = {
189191
[true,'AES-CTR'],
190192
[true,'AES-CBC'],
191193
[true,'AES-GCM'],
192-
[true,'AES-KW'],
194+
[!boringSSL,'AES-KW'],
193195
[true,{name: 'HMAC',hash: 'SHA-256'}],
194196
[true,{name: 'HMAC',hash: 'SHA-256',length: 256}],
195197
[false,{name: 'HMAC',hash: 'SHA-256',length: 25}],
@@ -211,18 +213,18 @@ export const vectors = {
211213
[true,'AES-CTR'],
212214
[true,'AES-CBC'],
213215
[true,'AES-GCM'],
214-
[true,'AES-KW'],
216+
[!boringSSL,'AES-KW'],
215217
[true,'Ed25519'],
216218
[true,'X25519'],
217219
],
218220
'wrapKey': [
219221
[false,'AES-KW'],
220-
[true,'AES-KW','AES-CTR'],
221-
[true,'AES-KW','HMAC'],
222+
[!boringSSL,'AES-KW','AES-CTR'],
223+
[!boringSSL,'AES-KW','HMAC'],
222224
],
223225
'unwrapKey': [
224226
[false,'AES-KW'],
225-
[true,'AES-KW','AES-CTR'],
227+
[!boringSSL,'AES-KW','AES-CTR'],
226228
],
227229
'unsupported operation': [
228230
[false,''],

‎test/fixtures/webcrypto/supports-modern-algorithms.mjs‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,27 @@
1+
import*ascryptofrom'node:crypto'
2+
13
import{hasOpenSSL}from'../../common/crypto.js'
24

35
constpqc=hasOpenSSL(3,5);
6+
constshake128=crypto.getHashes().includes('shake128');
7+
constshake256=crypto.getHashes().includes('shake256');
8+
constchacha=crypto.getCiphers().includes('chacha20-poly1305');
49

510
exportconstvectors={
11+
'digest': [
12+
[false,'cSHAKE128'],
13+
[shake128,{name: 'cSHAKE128',length: 128}],
14+
[shake128,{name: 'cSHAKE128',length: 128,functionName: Buffer.alloc(0),customization: Buffer.alloc(0)}],
15+
[false,{name: 'cSHAKE128',length: 128,functionName: Buffer.alloc(1)}],
16+
[false,{name: 'cSHAKE128',length: 128,customization: Buffer.alloc(1)}],
17+
[false,{name: 'cSHAKE128',length: 127}],
18+
[false,'cSHAKE256'],
19+
[shake256,{name: 'cSHAKE256',length: 256}],
20+
[shake256,{name: 'cSHAKE256',length: 256,functionName: Buffer.alloc(0),customization: Buffer.alloc(0)}],
21+
[false,{name: 'cSHAKE256',length: 256,functionName: Buffer.alloc(1)}],
22+
[false,{name: 'cSHAKE256',length: 256,customization: Buffer.alloc(1)}],
23+
[false,{name: 'cSHAKE256',length: 255}],
24+
],
625
'sign': [
726
[pqc,'ML-DSA-44'],
827
[pqc,'ML-DSA-65'],
@@ -12,19 +31,19 @@ export const vectors = {
1231
[pqc,'ML-DSA-44'],
1332
[pqc,'ML-DSA-65'],
1433
[pqc,'ML-DSA-87'],
15-
[true,'ChaCha20-Poly1305'],
34+
[chacha,'ChaCha20-Poly1305'],
1635
],
1736
'importKey': [
1837
[pqc,'ML-DSA-44'],
1938
[pqc,'ML-DSA-65'],
2039
[pqc,'ML-DSA-87'],
21-
[true,'ChaCha20-Poly1305'],
40+
[chacha,'ChaCha20-Poly1305'],
2241
],
2342
'exportKey': [
2443
[pqc,'ML-DSA-44'],
2544
[pqc,'ML-DSA-65'],
2645
[pqc,'ML-DSA-87'],
27-
[true,'ChaCha20-Poly1305'],
46+
[chacha,'ChaCha20-Poly1305'],
2847
],
2948
'getPublicKey': [
3049
[true,'RSA-OAEP'],
@@ -44,9 +63,9 @@ export const vectors = {
4463
[false,'ChaCha20-Poly1305'],
4564
],
4665
'encrypt': [
47-
[true,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(12)}],
66+
[chacha,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(12)}],
4867
[false,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(16)}],
49-
[true,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(12),tagLength: 128}],
68+
[chacha,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(12),tagLength: 128}],
5069
[false,{name: 'ChaCha20-Poly1305',iv: Buffer.alloc(12),tagLength: 64}],
5170
[false,'ChaCha20-Poly1305'],
5271
]

‎test/fixtures/webcrypto/supports-secure-curves.mjs‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,41 @@
11
const{ subtle }=globalThis.crypto;
22

3-
const[X448,X25519]=awaitPromise.all([
4-
subtle.generateKey('X448',false,['deriveBits','deriveKey']),
5-
subtle.generateKey('X25519',false,['deriveBits','deriveKey']),
6-
]);
3+
constboringSSL=process.features.openssl_is_boringssl;
4+
5+
constX25519=awaitsubtle.generateKey('X25519',false,['deriveBits','deriveKey']);
6+
letX448;
7+
if(!boringSSL){
8+
X448=awaitsubtle.generateKey('X448',false,['deriveBits','deriveKey'])
9+
}
710

811
exportconstvectors={
912
'generateKey': [
10-
[true,'X448'],
11-
[true,'Ed448'],
13+
[!boringSSL,'X448'],
14+
[!boringSSL,'Ed448'],
1215
],
1316
'deriveKey': [
14-
[true,
15-
{name: 'X448',public: X448.publicKey},
17+
[!boringSSL,
18+
{name: 'X448',public: X448?.publicKey},
1619
{name: 'AES-CBC',length: 128}],
17-
[true,
18-
{name: 'X448',public: X448.publicKey},
20+
[!boringSSL,
21+
{name: 'X448',public: X448?.publicKey},
1922
{name: 'HMAC',hash: 'SHA-256'}],
20-
[true,
21-
{name: 'X448',public: X448.publicKey},
23+
[!boringSSL,
24+
{name: 'X448',public: X448?.publicKey},
2225
'HKDF'],
2326
],
2427
'deriveBits': [
25-
[true,{name: 'X448',public: X448.publicKey}],
28+
[!boringSSL,{name: 'X448',public: X448?.publicKey}],
2629
[false,{name: 'X448',public: X25519.publicKey}],
27-
[false,{name: 'X448',public: X448.privateKey}],
30+
[false,{name: 'X448',public: X448?.privateKey}],
2831
[false,'X448'],
2932
],
3033
'importKey': [
31-
[true,'X448'],
32-
[true,'Ed448'],
34+
[!boringSSL,'X448'],
35+
[!boringSSL,'Ed448'],
3336
],
3437
'exportKey': [
35-
[true,'Ed448'],
36-
[true,'X448'],
38+
[!boringSSL,'Ed448'],
39+
[!boringSSL,'X448'],
3740
],
3841
};

0 commit comments

Comments
 (0)