Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 28 additions & 14 deletions lib/internal/crypto/webcrypto.js
Original file line number Diff line number Diff line change
Expand Up @@ -1658,7 +1658,11 @@ class SubtleCrypto {
}
}

return check(operation, algorithm, length);
try {
return check(operation, algorithm, length);
} catch {
return false;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a huge fan of suppressing errors like this. If this is part of the spec that this method should not throw, a comment here would be good.

}
}
}

Expand Down Expand Up @@ -1701,25 +1705,35 @@ function check(op, alg, length) {
return true;
case 'deriveBits': {
if (normalizedAlgorithm.name === 'HKDF') {
try {
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
} catch {
return false;
}
require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
}

if (normalizedAlgorithm.name === 'PBKDF2') {
try {
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
} catch {
return false;
}
require('internal/crypto/pbkdf2').validatePbkdf2DeriveBitsLength(length);
}

if (StringPrototypeStartsWith(normalizedAlgorithm.name, 'Argon2')) {
try {
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
} catch {
require('internal/crypto/argon2').validateArgon2DeriveBitsLength(length);
}

if (normalizedAlgorithm.name === 'X25519' && length > 256) {
return false;
}

if (normalizedAlgorithm.name === 'X448' && length > 448) {
return false;
}

if (normalizedAlgorithm.name === 'ECDH') {
const namedCurve = getCryptoKeyAlgorithm(normalizedAlgorithm.public).namedCurve;
const maxLength = {
'__proto__': null,
'P-256': 256,
'P-384': 384,
'P-521': 528,
}[namedCurve];

if (length > maxLength) {
return false;
}
}
Expand Down
30 changes: 28 additions & 2 deletions test/fixtures/webcrypto/supports-level-2.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -103,18 +103,36 @@ export const vectors = {
[true,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'AES-CBC', length: 128 }],
[true,
[false,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[true,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 256 }],
[false,
{ name: 'X25519', public: X25519.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 257 }],
Comment thread
panva marked this conversation as resolved.
[true,
{ name: 'X25519', public: X25519.publicKey },
'HKDF'],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'AES-CBC', length: 128 }],
[true,
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 255 }],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 256 }],
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 257 }],
[false,
{ name: 'ECDH', public: ECDH.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 264 }],
[true,
{ name: 'ECDH', public: ECDH.publicKey },
'HKDF'],
Expand Down Expand Up @@ -143,10 +161,18 @@ export const vectors = {

[true,
{ name: 'ECDH', public: ECDH.publicKey }],
[true,
{ name: 'ECDH', public: ECDH.publicKey }, 256],
[false,
{ name: 'ECDH', public: ECDH.publicKey }, 257],
[false,
{ name: 'ECDH', public: ECDH.publicKey }, 264],
[false, { name: 'ECDH', public: ECDH.privateKey }],
[false, 'ECDH'],

[true, { name: 'X25519', public: X25519.publicKey }],
[true, { name: 'X25519', public: X25519.publicKey }, 256],
[false, { name: 'X25519', public: X25519.publicKey }, 257],
[false, { name: 'X25519', public: X25519.privateKey }],
[false, 'X25519'],
],
Expand Down
10 changes: 9 additions & 1 deletion test/fixtures/webcrypto/supports-secure-curves.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,23 @@ export const vectors = {
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
{ name: 'AES-CBC', length: 128 }],
[!boringSSL,
[false,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256' }],
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 448 }],
[false,
{ name: 'X448', public: X448?.publicKey },
{ name: 'HMAC', hash: 'SHA-256', length: 449 }],
[!boringSSL,
{ name: 'X448', public: X448?.publicKey },
'HKDF'],
],
'deriveBits': [
[!boringSSL, { name: 'X448', public: X448?.publicKey }],
[!boringSSL, { name: 'X448', public: X448?.publicKey }, 448],
[false, { name: 'X448', public: X448?.publicKey }, 449],
[false, { name: 'X448', public: X25519.publicKey }],
[false, { name: 'X448', public: X448?.privateKey }],
[false, 'X448'],
Expand Down
2 changes: 1 addition & 1 deletion test/fixtures/wpt/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Last update:
- wasm/jsapi: https://github.com/web-platform-tests/wpt/tree/65a2134d50/wasm/jsapi
- wasm/webapi: https://github.com/web-platform-tests/wpt/tree/fd1b23eeaa/wasm/webapi
- web-locks: https://github.com/web-platform-tests/wpt/tree/10a122a6bc/web-locks
- WebCryptoAPI: https://github.com/web-platform-tests/wpt/tree/2cb332d710/WebCryptoAPI
- WebCryptoAPI: https://github.com/web-platform-tests/wpt/tree/8b5cd267b4/WebCryptoAPI
- webidl: https://github.com/web-platform-tests/wpt/tree/63ca529a02/webidl
- webidl/ecmascript-binding/es-exceptions: https://github.com/web-platform-tests/wpt/tree/2f96fa1996/webidl/ecmascript-binding/es-exceptions
- webmessaging/broadcastchannel: https://github.com/web-platform-tests/wpt/tree/6495c91853/webmessaging/broadcastchannel
Expand Down
159 changes: 159 additions & 0 deletions test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,159 @@
// META: title=WebCrypto API: supports method tests for algorithms in https://wicg.github.io/webcrypto-modern-algos/
// META: script=util/helpers.js

'use strict';

const modernAlgorithms = {
// Asymmetric algorithms
'ML-DSA-44': {
operations: ['generateKey', 'importKey', 'sign', 'verify'],
},
'ML-DSA-65': {
operations: ['generateKey', 'importKey', 'sign', 'verify'],
},
'ML-DSA-87': {
operations: ['generateKey', 'importKey', 'sign', 'verify'],
},
'ML-KEM-512': {
operations: [
'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
'decapsulateKey', 'decapsulateBits'
],
},
'ML-KEM-768': {
operations: [
'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
'decapsulateKey', 'decapsulateBits'
],
},
'ML-KEM-1024': {
operations: [
'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
'decapsulateKey', 'decapsulateBits'
],
},

// Symmetric algorithms
'ChaCha20-Poly1305': {
operations: ['generateKey', 'importKey', 'encrypt', 'decrypt'],
encryptParams: {name: 'ChaCha20-Poly1305', iv: new Uint8Array(12)},
},

};

const operations = [
'generateKey',
'importKey',
'sign',
'verify',
'encrypt',
'decrypt',
'deriveBits',
'digest',
'encapsulateKey',
'encapsulateBits',
'decapsulateKey',
'decapsulateBits',
];

// Test that supports method exists and is a static method
test(() => {
assert_true(
typeof SubtleCrypto.supports === 'function',
'SubtleCrypto.supports should be a function');
}, 'SubtleCrypto.supports method exists');


// Test standard WebCrypto algorithms for requested operations
for (const [algorithmName, algorithmInfo] of Object.entries(modernAlgorithms)) {
for (const operation of operations) {
promise_test(async (t) => {
const isSupported = algorithmInfo.operations.includes(operation);

// Use appropriate algorithm parameters for each operation
let algorithm;
let lengthOrAdditionalAlgorithm;
switch (operation) {
case 'generateKey':
algorithm = algorithmInfo.keyGenParams || algorithmName;
break;
case 'importKey':
algorithm = algorithmInfo.importParams || algorithmName;
break;
case 'sign':
case 'verify':
algorithm = algorithmInfo.signParams || algorithmName;
break;
case 'encrypt':
case 'decrypt':
algorithm = algorithmInfo.encryptParams || algorithmName;
break;
case 'deriveBits':
algorithm = algorithmInfo.deriveBitsParams || algorithmName;
if (algorithm?.public instanceof Promise) {
algorithm.public = (await algorithm.public).publicKey;
}
if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
lengthOrAdditionalAlgorithm = 256;
}
break;
case 'digest':
algorithm = algorithmName;
break;
case 'encapsulateKey':
case 'encapsulateBits':
case 'decapsulateKey':
case 'decapsulateBits':
algorithm = algorithmName;
if (operation === 'encapsulateKey' || operation === 'decapsulateKey') {
lengthOrAdditionalAlgorithm = { name: 'AES-GCM', length: 256 };
}
break;
default:
algorithm = algorithmName;
}

const result = SubtleCrypto.supports(operation, algorithm, lengthOrAdditionalAlgorithm);

if (isSupported) {
assert_true(result, `${algorithmName} should support ${operation}`);
} else {
assert_false(
result, `${algorithmName} should not support ${operation}`);
}
}, `supports(${operation}, ${algorithmName})`);
}
}

// Test some algorithm objects with valid parameters
test(() => {
assert_true(
SubtleCrypto.supports('encrypt', {
name: 'ChaCha20-Poly1305',
iv: new Uint8Array(12),
tagLength: 128,
}),
'ChaCha20-Poly1305 encrypt with valid tagLength');
}, 'supports returns true for algorithm objects with valid parameters');

// Test some algorithm objects with invalid parameters
test(() => {
assert_false(
SubtleCrypto.supports('encrypt', {
name: 'ChaCha20-Poly1305',
iv: new Uint8Array(12),
tagLength: 100,
}),
'ChaCha20-Poly1305 encrypt with invalid tagLength');

assert_false(
SubtleCrypto.supports('encrypt', {
name: 'ChaCha20-Poly1305',
iv: new Uint8Array(10),
tagLength: 128,
}),
'ChaCha20-Poly1305 encrypt with invalid iv');
}, 'supports returns false for algorithm objects with invalid parameters');


done();
Loading
Loading