crypto: add WebCrypto CryptoJob mode

Add a WebCrypto-specific CryptoJob mode that returns a promise from
run() and resolves it when native work is finished.
Encode job output directly as Web Crypto values, including CryptoKey
instances and CryptoKeyPair dictionaries. Convert operation-specific
setup failures from AdditionalConfig into OperationError rejections.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63363
Backport-PR-URL: #63563
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Author: panva

lib/internal/crypto/aes.js

@@ -7,7 +7,7 @@ const {
 
 const{
  AESCipherJob,
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
  kKeyVariantAES_CTR_128,
  kKeyVariantAES_CBC_128,
  kKeyVariantAES_GCM_128,
@@ -107,7 +107,7 @@ function getVariant(name, length) {
 
 functionasyncAesCtrCipher(mode,key,data,algorithm){
 returnjobPromise(()=>newAESCipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
@@ -118,7 +118,7 @@ function asyncAesCtrCipher(mode, key, data, algorithm) {
 
 functionasyncAesCbcCipher(mode,key,data,algorithm){
 returnjobPromise(()=>newAESCipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
@@ -128,7 +128,7 @@ function asyncAesCbcCipher(mode, key, data, algorithm) {
 
 functionasyncAesKwCipher(mode,key,data){
 returnjobPromise(()=>newAESCipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
@@ -140,7 +140,7 @@ function asyncAesGcmCipher(mode, key, data, algorithm) {
 consttagByteLength=tagLength/8;
 
 returnjobPromise(()=>newAESCipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
@@ -155,7 +155,7 @@ function asyncAesOcbCipher(mode, key, data, algorithm) {
 consttagByteLength=tagLength/8;
 
 returnjobPromise(()=>newAESCipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
@@ -175,7 +175,7 @@ function aesCipher(mode, key, data, algorithm) {
 }
 }
 
-asyncfunctionaesGenerateKey(algorithm,extractable,keyUsages){
+functionaesGenerateKey(algorithm,extractable,keyUsages){
 const{ name, length }=algorithm;
 
 constcheckUsages=['wrapKey','unwrapKey'];
@@ -188,14 +188,18 @@ async function aesGenerateKey(algorithm, extractable, keyUsages) {
 'Unsupported key usage for an AES key',
 'SyntaxError');
 }
+if(usagesSet.size===0){
+throwlazyDOMException(
+'Usages cannot be empty when creating a key.',
+'SyntaxError');
+}
 
-consthandle=awaitjobPromise(()=>newSecretKeyGenJob(kCryptoJobAsync,length));
-
-returnnewInternalCryptoKey(
-handle,
+returnjobPromise(()=>newSecretKeyGenJob(
+kCryptoJobWebCrypto,
+length,
 { name, length },
 getUsagesMask(usagesSet),
-extractable);
+extractable));
 }
 
 functionaesImportKey(

lib/internal/crypto/argon2.js

@@ -3,8 +3,6 @@
 const{
  FunctionPrototypeCall,
  MathPow,
- StringPrototypeToLowerCase,
- TypedArrayPrototypeGetBuffer,
  Uint8Array,
 }=primordials;
 
@@ -14,14 +12,14 @@ const {
  Argon2Job,
  kCryptoJobAsync,
  kCryptoJobSync,
+ kCryptoJobWebCrypto,
  kTypeArgon2d,
  kTypeArgon2i,
  kTypeArgon2id,
 }=internalBinding('crypto');
 
 const{
  lazyDOMException,
- promisify,
 }=require('internal/util');
 
 const{
@@ -30,6 +28,7 @@ const {
 
 const{
  getArrayBufferOrView,
+ jobPromise,
 }=require('internal/crypto/util');
 
 const{
@@ -143,20 +142,12 @@ function check(algorithm, parameters) {
 validateString(algorithm,'algorithm');
 validateOneOf(algorithm,'algorithm',['argon2d','argon2i','argon2id']);
 
-lettype;
-switch(algorithm){
-case'argon2d':
-type=kTypeArgon2d;
-break;
-case'argon2i':
-type=kTypeArgon2i;
-break;
-case'argon2id':
-type=kTypeArgon2id;
-break;
-default: // unreachable
-thrownewERR_CRYPTO_ARGON2_NOT_SUPPORTED();
-}
+consttype={
+'__proto__': null,
+'argon2d': kTypeArgon2d,
+'argon2i': kTypeArgon2i,
+'argon2id': kTypeArgon2id,
+}[algorithm];
 
 validateObject(parameters,'parameters');
 
@@ -193,7 +184,6 @@ function check(algorithm, parameters) {
 return{ message, nonce, secret, associatedData, tagLength, passes, parallelism, memory, type };
 }
 
-constargon2Promise=promisify(argon2);
 functionvalidateArgon2DeriveBitsLength(length){
 if(length===null)
 throwlazyDOMException('length cannot be null','OperationError');
@@ -211,32 +201,39 @@ function validateArgon2DeriveBitsLength(length) {
 }
 }
 
-asyncfunctionargon2DeriveBits(algorithm,baseKey,length){
+functionargon2DeriveBits(algorithm,baseKey,length){
 validateArgon2DeriveBitsLength(length);
 
-letresult;
+consttype={
+'__proto__': null,
+'Argon2d': kTypeArgon2d,
+'Argon2i': kTypeArgon2i,
+'Argon2id': kTypeArgon2id,
+}[algorithm.name];
+
+letmessage;
 try{
-result=awaitargon2Promise(
-StringPrototypeToLowerCase(algorithm.name),
-{
-// TODO(panva): call the job directly without needing to re-export the handle
-message: getCryptoKeyHandle(baseKey).export(),
-nonce: algorithm.nonce,
-parallelism: algorithm.parallelism,
-tagLength: length/8,
-memory: algorithm.memory,
-passes: algorithm.passes,
-secret: algorithm.secretValue,
-associatedData: algorithm.associatedData,
-},
-);
+// TODO(panva): call the job directly without needing to re-export the handle
+message=getCryptoKeyHandle(baseKey).export();
 }catch(err){
 throwlazyDOMException(
 'The operation failed for an operation-specific reason',
 {name: 'OperationError',cause: err});
 }
 
-returnTypedArrayPrototypeGetBuffer(result);
+constempty=newUint8Array(0);
+
+returnjobPromise(()=>newArgon2Job(
+kCryptoJobWebCrypto,
+message,
+algorithm.nonce,
+algorithm.parallelism,
+length/8,
+algorithm.memory,
+algorithm.passes,
+algorithm.secretValue===undefined ? empty : algorithm.secretValue,
+algorithm.associatedData===undefined ? empty : algorithm.associatedData,
+type));
 }
 
 module.exports={

lib/internal/crypto/cfrg.js

@@ -10,7 +10,7 @@ const { Buffer } = require('buffer');
 
 const{
  SignJob,
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
  kKeyFormatDER,
  kKeyFormatRawPublic,
  kSignJobModeSign,
@@ -75,7 +75,7 @@ function verifyAcceptableCfrgKeyUse(name, isPublic, usages) {
 }
 }
 
-asyncfunctioncfrgGenerateKey(algorithm,extractable,keyUsages){
+functioncfrgGenerateKey(algorithm,extractable,keyUsages){
 const{ name }=algorithm;
 
 constusageSet=newSafeSet(keyUsages);
@@ -99,23 +99,13 @@ async function cfrgGenerateKey(algorithm, extractable, keyUsages) {
 }
 break;
 }
-letnid;
-switch(name){
-case'Ed25519':
-nid=EVP_PKEY_ED25519;
-break;
-case'Ed448':
-nid=EVP_PKEY_ED448;
-break;
-case'X25519':
-nid=EVP_PKEY_X25519;
-break;
-case'X448':
-nid=EVP_PKEY_X448;
-break;
-}
-
-consthandles=awaitjobPromise(()=>newNidKeyPairGenJob(kCryptoJobAsync,nid));
+constnid={
+'__proto__': null,
+'Ed25519': EVP_PKEY_ED25519,
+'Ed448': EVP_PKEY_ED448,
+'X25519': EVP_PKEY_X25519,
+'X448': EVP_PKEY_X448,
+}[name];
 
 letpublicUsages;
 letprivateUsages;
@@ -136,21 +126,19 @@ async function cfrgGenerateKey(algorithm, extractable, keyUsages) {
 
 constkeyAlgorithm={ name };
 
-constpublicKey=
-newInternalCryptoKey(
-handles[0],
-keyAlgorithm,
-getUsagesMask(publicUsages),
-true);
-
-constprivateKey=
-newInternalCryptoKey(
-handles[1],
-keyAlgorithm,
-getUsagesMask(privateUsages),
-extractable);
+if(privateUsages.size===0){
+throwlazyDOMException(
+'Usages cannot be empty when creating a key.',
+'SyntaxError');
+}
 
-return{__proto__: null, privateKey, publicKey };
+returnjobPromise(()=>newNidKeyPairGenJob(
+kCryptoJobWebCrypto,
+nid,
+keyAlgorithm,
+getUsagesMask(publicUsages),
+getUsagesMask(privateUsages),
+extractable));
 }
 
 functioncfrgExportKey(key,format){
@@ -251,15 +239,15 @@ function cfrgImportKey(
 extractable);
 }
 
-asyncfunctioneddsaSignVerify(key,data,algorithm,signature){
+functioneddsaSignVerify(key,data,algorithm,signature){
 constmode=signature===undefined ? kSignJobModeSign : kSignJobModeVerify;
 consttype=mode===kSignJobModeSign ? 'private' : 'public';
 
 if(getCryptoKeyType(key)!==type)
 throwlazyDOMException(`Key must be a ${type} key`,'InvalidAccessError');
 
-returnawaitjobPromise(()=>newSignJob(
-kCryptoJobAsync,
+returnjobPromise(()=>newSignJob(
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 undefined,

lib/internal/crypto/chacha20_poly1305.js

@@ -7,7 +7,7 @@ const {
 const{
  ChaCha20Poly1305CipherJob,
  SecretKeyGenJob,
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 }=internalBinding('crypto');
 
 const{
@@ -39,15 +39,15 @@ function validateKeyLength(length) {
 
 functionc20pCipher(mode,key,data,algorithm){
 returnjobPromise(()=>newChaCha20Poly1305CipherJob(
-kCryptoJobAsync,
+kCryptoJobWebCrypto,
 mode,
 getCryptoKeyHandle(key),
 data,
 algorithm.iv,
 algorithm.additionalData));
 }
 
-asyncfunctionc20pGenerateKey(algorithm,extractable,keyUsages){
+functionc20pGenerateKey(algorithm,extractable,keyUsages){
 const{ name }=algorithm;
 
 constcheckUsages=['encrypt','decrypt','wrapKey','unwrapKey'];
@@ -58,14 +58,18 @@ async function c20pGenerateKey(algorithm, extractable, keyUsages) {
 `Unsupported key usage for a ${algorithm.name} key`,
 'SyntaxError');
 }
+if(usagesSet.size===0){
+throwlazyDOMException(
+'Usages cannot be empty when creating a key.',
+'SyntaxError');
+}
 
-consthandle=awaitjobPromise(()=>newSecretKeyGenJob(kCryptoJobAsync,256));
-
-returnnewInternalCryptoKey(
-handle,
+returnjobPromise(()=>newSecretKeyGenJob(
+kCryptoJobWebCrypto,
+256,
 { name },
 getUsagesMask(usagesSet),
-extractable);
+extractable));
 }
 
 functionc20pImportKey(