Skip to content

crypto: improve accuracy of SubtleCrypto.supports #63104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
panva wants to merge 4 commits into
base: main
Choose a base branch
from
Open

crypto: improve accuracy of SubtleCrypto.supports #63104

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5710d4e
crypto: improve accuracy of SubtleCrypto.supports
panva May 3, 2026
cc76732
fixup! crypto: improve accuracy of SubtleCrypto.supports
panva May 4, 2026
892a5df
fixup! crypto: improve accuracy of SubtleCrypto.supports
panva May 4, 2026
f1cbedb
fixup! crypto: improve accuracy of SubtleCrypto.supports
panva May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 28 additions & 14 deletions lib/internal/crypto/webcrypto.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1658,7 +1658,11 @@ class SubtleCrypto {
}
}

return check(operation, algorithm, length);
try {
return check(operation, algorithm, length);
} catch {
return false;
Copy link
Copy Markdown
Member

@jasnell jasnell May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a huge fan of suppressing errors like this. If this is part of the spec that this method should not throw, a comment here would be good.

}
}
}

Expand Down Expand Up @@ -1701,25 +1705,35 @@ function check(op, alg, length) {
return true;
case 'deriveBits': {
if (normalizedAlgorithm.name === 'HKDF') {
try {
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
} catch {
return false;
}
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
}

if (normalizedAlgorithm.name === 'PBKDF2') {
try {
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
} catch {
return false;
}
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
}

if (StringPrototypeStartsWith(normalizedAlgorithm.name, 'Argon2')) {
try {
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
} catch {
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
}

if (normalizedAlgorithm.name === 'X25519' && length > 256) {
return false;
}

if (normalizedAlgorithm.name === 'X448' && length > 448) {
return false;
}

if (normalizedAlgorithm.name === 'ECDH') {
const namedCurve = getCryptoKeyAlgorithm(normalizedAlgorithm.public).namedCurve;
const maxLength = {
'__proto__': null,
'P-256': 256,
'P-384': 384,
'P-521': 528,
}[namedCurve];

if (length > maxLength) {
return false;
}
}
Expand Down
22 changes: 20 additions & 2 deletions test/fixtures/webcrypto/supports-level-2.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,18 +103,30 @@ export const vectors = {
[true,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'AES-CBC', length: 128 }],
[true,
[false,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[true,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 256 }],
[false,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 257 }],
Comment thread
panva marked this conversation as resolved.
[true,
{ name: 'X25519', public: X25519.publicKey },
'HKDF'],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'AES-CBC', length: 128 }],
[true,
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 256 }],
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 257 }],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
'HKDF'],
Expand Down Expand Up @@ -143,10 +155,16 @@ export const vectors = {

[true,
{ name: 'ECDH', public: ECDH.publicKey }],
[true,
{ name: 'ECDH', public: ECDH.publicKey }, 256],
[false,
{ name: 'ECDH', public: ECDH.publicKey }, 257],
[false, { name: 'ECDH', public: ECDH.privateKey }],
[false, 'ECDH'],

[true, { name: 'X25519', public: X25519.publicKey }],
[true, { name: 'X25519', public: X25519.publicKey }, 256],
[false, { name: 'X25519', public: X25519.publicKey }, 257],
[false, { name: 'X25519', public: X25519.privateKey }],
[false, 'X25519'],
],
Expand Down
10 changes: 9 additions & 1 deletion test/fixtures/webcrypto/supports-secure-curves.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,23 @@ export const vectors = {
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
{ name: 'AES-CBC', length: 128 }],
[!boringSSL,
[false,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 448 }],
[false,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 449 }],
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
'HKDF'],
],
'deriveBits': [
[!boringSSL, { name: 'X448', public: X448?.publicKey }],
[!boringSSL, { name: 'X448', public: X448?.publicKey }, 448],
[false, { name: 'X448', public: X448?.publicKey }, 449],
[false, { name: 'X448', public: X25519.publicKey }],
[false, { name: 'X448', public: X448?.privateKey }],
[false, 'X448'],
Expand Down
Loading