From e4cf548a2a5c738894b6bed0c8812b165541fee5 Mon Sep 17 00:00:00 2001
From: devgianlu <altomanigianluca@gmail.com>
Date: Fri, 13 Feb 2026 19:20:25 +0100
Subject: [PATCH] Add length check for JWK key import

---
 spec/Overview.html | 72 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/spec/Overview.html b/spec/Overview.html
index 8f8fd42..927cc46 100644
--- a/spec/Overview.html
+++ b/spec/Overview.html
@@ -10832,6 +10832,30 @@ <h5>Import Key</h5>
                                   of [[RFC8037]], then [= exception/throw =] a {{DataError}}.
                                 </p>
                               </li>
+                              <li>
+                                <p>
+                                  Let |jwkPublic| be the {{JsonWebKey/x}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =] of |jwkPublic| is not 256,
+                                  then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  Let |jwkPrivate| be the {{JsonWebKey/d}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =] of |jwkPrivate| is not 256,
+                                  then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
                               <li>
                                 <p>
                                   Let |key| be a new {{CryptoKey}} object that represents the
@@ -10857,6 +10881,18 @@ <h5>Import Key</h5>
                                   of [[RFC8037]], then [= exception/throw =] a {{DataError}}.
                                 </p>
                               </li>
+                              <li>
+                                <p>
+                                  Let |jwkPublic| be the {{JsonWebKey/x}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =] of |jwkPublic| is not 256,
+                                  then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
                               <li>
                                 <p>
                                   Let |key| be a new {{CryptoKey}} object that represents the
@@ -11684,6 +11720,30 @@ <h5>Import Key</h5>
                                   of [[RFC8037]], then [= exception/throw =] a {{DataError}}.
                                 </p>
                               </li>
+                              <li>
+                                <p>
+                                  Let |jwkPublic| be the {{JsonWebKey/x}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =] of |jwkPublic| is not 256,
+                                  then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  Let |jwkPrivate| be the {{JsonWebKey/d}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =] of |jwkPrivate| is not 256,
+                                  then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
                               <li>
                                 <p>
                                   Let |key| be a new {{CryptoKey}} object that represents the
@@ -11709,6 +11769,18 @@ <h5>Import Key</h5>
                                   of [[RFC8037]], then [= exception/throw =] a {{DataError}}.
                                 </p>
                               </li>
+                              <li>
+                                <p>
+                                  Let |jwkPublic| be the {{JsonWebKey/x}} field of |jwk| interpreted
+                                  according to Section 2 of [[RFC8037]].
+                                </p>
+                              </li>
+                              <li>
+                                <p>
+                                  If the [= length in bits =]
+                                  of |jwkPublic| is not 256, then [= exception/throw =] a {{DataError}}.
+                                </p>
+                              </li>
                               <li>
                                 <p>
                                   Let |key| be a new {{CryptoKey}} object that represents the