crypto: experimental (Ed/X)25519/(Ed/X)448 support

[jasnell]

Implements initial experimental support for Curve25519 and Curve448 support for both ECDH and sign/verify in Web Crypto (with raw public and private key import)

Introduced as a Node.js-specific extension to Web Crypto.

Signed-off-by: James M Snell jasnell@gmail.com

/cc @indutny@panva@devsnek@bnb @nodejs/crypto

[jasnell]

@tniessen ... will this need the mutexes on the key uses?

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35450/

[panva]

Didn't dive into a detailed review yet, one thing i see tho is this being an extension to the "EC" key type. As in, the docs extend e.g. EcKeyImportParams rather than definining the right thing...

In the JWK registry, the Key Type ('kty') for these keys is not "EC", it's "OKP". Defined in rfc8037, private key components are (in addition to kty) crv, x and d; public only crv, and x. The crv (when in OKP keys being the "sub type", not curve 🤦) values when JWK format is used are Ed25519, Ed448, X25519, X448.

I don't know how to deal with this being a node-specific extension to webcrypto as in - should we allow JWK export/import? I'll play around with the implementation before coming back with more feedback.

[jasnell]

Yeah I specifically punted on the JWK support for now for precisely those reasons.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35458/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35460/

[tniessen]

@tniessen ... will this need the mutexes on the key uses?

@jasnell Sorry, could you clarify which code sections you are referring to?

[panva]

@jasnell@tniessen this?

• ed25519/448 private - ['sign']
• ed25519/448 public - ['verify']
• x25519/448 private - ['deriveBits', 'deriveKey']
• x25519/448 public - []

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35533/ 💚

[panva]

I ran just a few sanity checks so far:

⬇️ I would expect these to fail on the account of ECDH being forbidden with Ed* in RFC8037, not sure if outside of JOSE its okay.

subtle.generateKey({name: 'ECDH',namedCurve: 'NODE-ED25519'},true,['deriveKey','deriveBits'])subtle.generateKey({name: 'ECDH',namedCurve: 'NODE-ED448'},true,['deriveKey','deriveBits'])

⬇️ I would expect these to fail on the account of ECDSA being forbidden with X* in RFC8037, not sure if outside of JOSE its okay.

subtle.generateKey({name: 'ECDSA',namedCurve: 'NODE-X25519'},true,['sign','verify'])subtle.generateKey({name: 'ECDSA',namedCurve: 'NODE-X448'},true,['sign','verify'])

Number of oddities follow

⬇️ Is that rejection expected?

> kp
{
publicKey: CryptoKey {
type: 'public',
extractable: true,
algorithm: { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' },
usages: [ 'verify' ]
},
privateKey: CryptoKey {
type: 'private',
extractable: true,
algorithm: { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' },
usages: [ 'sign' ]
}
}
> subtle.exportKey('raw',kp.publicKey).then(console.log)
Promise { <pending> }
> ArrayBuffer {
[Uint8Contents]: <80 b1 40 32 f2 4e eb 54 7e c5 18 10 de 28 64 5b b2 34 b5 8d f7 64 84 43 61 30 ae b9 d8 5e bf fa>,
byteLength: 32
}
> subtle.exportKey('raw',kp.privateKey).then(console.log)
Promise { <pending> }
> Uncaught:
DOMException [InvalidAccessError]: Unable to export a raw NODE-ED25519 private key
at __node_internal_ (node:internal/crypto/util:71:10)
at exportKeyRaw (node:internal/crypto/webcrypto:310:9)
at SubtleCrypto.exportKey (node:internal/crypto/webcrypto:382:24)

[jasnell]

@panva:

I would expect these to fail on the account of ECDH being forbidden with Ed* in RFC8037, not sure if outside of JOSE its okay.
...
I would expect these to fail on the account of ECDSA being forbidden with X* in RFC8037, not sure if outside of JOSE its okay.

Good catch.

Is that rejection expected?

Yes, but only because I hadn't completed it. Just added those bits. Note that it's still not possible to export an ECDH private key (so X25519 private keys) per spec.

[jasnell]

the public key property should be x, not k. k is only used by oct secret keys.

Doh, I knew that lol.. not sure why I had k stuck in my head. Fixed

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/35564/

[panva]

Can't speak for the c++ implementation. The API surface LGTM.

[jasnell]

Landed in bd899bc

[tniessen]

Note that this technically landed without approval of the full PR. (And our rules might technically allow that.)

[tniessen]

Hoping to get this issue addressed before this PR lands in a release: #37055.