When OpenSSL reports no peer temporary key object for TLS key
agreement, fall back to the negotiated TLS Supported Group name.
This lets getEphemeralKeyInfo() identify PQ, hybrid, and other
group-based key agreement as TLSGroup without synthesizing a size.
Keep existing DH and ECDH results unchanged when OpenSSL provides
a recognizable temporary key.
Fixes: https://github.com/nodejs/node/issues/59452
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64119
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Add shared bit-length helpers for WebCrypto operations that accept bit
sequences whose length is not byte-aligned.
Use the helpers for cSHAKE output, ECDH-derived bits, HMAC/KMAC key
generation/import/derivation, and KMAC sign/verify output. Preserve the
requested bit length in CryptoKey algorithm metadata while storing and
exporting rounded-up byte material with unused low bits cleared.
Keep byte-multiple validation for algorithms whose specs require it.
Extend the lower-end of KMAC's key length support.
Enable cSHAKE customization and functionName parameters.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63988
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Introduce prepareSubtleMethod() and convertSubtleArgument() for the
common SubtleCrypto call prelude. Methods now reuse the same receiver
check, required-argument check, error prefix construction, argument
context selection, and WebIDL conversion path.
Introduce WebCrypto key usage helpers for common usage validation and
key pair usage splitting. Algorithm modules now define their allowed
public, private, and key generation usages once, then call the shared
helpers from generateKey() and importKey() paths.
This removes repeated function-invocation setup in webcrypto.js and
repeated key usage checks across the WebCrypto algorithm modules while
preserving the existing validation behavior.
Mark normalized-algorithm fallback branches as unreachable assertions.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63975
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Moves support for passing CryptoKey instances to node:crypto APIs to
End-of-Life status (DEP0203).
Moves support for passing a non-extractable CryptoKey instances to
KeyObject.from() End-of-Life status (DEP0204).
Closes#55293
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63188
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Move KeyObject.prototype.toCryptoKey() onto the base KeyObject
class and dispatch from the cached native key type. Both secret and
asymmetric conversions now pass a KeyObjectHandle through the Web
Crypto import paths.
Expose KeyObjectHandle.prototype.getKeyType() so asymmetric importers
can validate public/private usages without wrapping the handle back
into a KeyObject. Secret importers likewise consume KeyObjectHandle
directly.
Use the shared asymmetric conversion helper to derive public
CryptoKeys for SubtleCrypto.getPublicKey(), avoiding the temporary
PrivateKeyObject/createPublicKey round trip while keeping usage
validation in the import path.
Update getPublicKey and KeyObject.toCryptoKey tests to be driven from
the Web Crypto supported-algorithm registry so new algorithms require
either coverage or an explicit skip.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63622
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Avoid re-wrapping native WebCrypto promises with PromiseResolve(),
since resolving a promise can read its user-mutated constructor.
Add a helper for chaining internal WebCrypto job promises without
consulting Promise species state, and use it for intermediate job
results.
Also align JWK wrapping and unwrapping with the spec's fresh-global
JSON handling by detaching internal JWK values from user prototypes.
Use the internal UTF-8 encoder/decoder bindings instead of shared
TextEncoder/TextDecoder prototype methods.
Expand the WebCrypto prototype pollution regression test to cover
SubtleCrypto methods, export formats, zero-length KDF results, JWK
toJSON/kty pollution, and encoder/decoder prototype poisoning.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63363
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Pass CryptoKey handles directly into KDF jobs instead of exporting
secret bytes in lib.
Normalize HKDF, PBKDF2, and Argon2 around the same job construction
pattern so WebCrypto derivation paths avoid extra key material copies
and keep operation failures in native job handling.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63363
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Remove async function wrappers from SubtleCrypto methods while keeping
their public promise-returning behaviour.
Route method entry points through a shared helper that converts
synchronous validation errors into rejected promises. Let the internal
implementations return native job promises directly.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63363
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Add a WebCrypto-specific CryptoJob mode that returns a promise from
run() and resolves it when native work is finished.
Encode job output directly as Web Crypto values, including CryptoKey
instances and CryptoKeyPair dictionaries. Convert operation-specific
setup failures from AdditionalConfig into OperationError rejections.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63363
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
BoringSSL declares EVP_CIPHER_do_all_sorted and
EVP_MD_do_all_sorted, but stock no-decrepit builds do not provide
those symbols. Add a Node build flag that keeps ncrypto and its
dependents on a local BoringSSL fallback list when libdecrepit is
absent.
Keep embedders that provide the EVP enumeration symbols on the normal
OpenSSL-compatible path, matching Electron's patched BoringSSL build.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63206
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63161
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Add ESLint rules that reject public KeyObject and CryptoKey accessor
reads after internal brand checks. Internal code must use the private
key helpers so it reads native-backed slots instead of user-replaceable
properties.
Add a separate rule that rejects instanceof checks against KeyObject
and CryptoKey constructors, including the global CryptoKey constructor.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Clone CryptoKey algorithm dictionaries into null-prototype objects
before storing or caching them internally. Copy nested hash dictionaries
and publicExponent bytes so internal consumers and transferred keys do
not observe user-mutable input objects or polluted Object.prototype
fields.
Keep public algorithm and inspect output as ordinary objects. Make the
clone path check only own hash and publicExponent properties.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Move KeyObject type and handle storage behind NativeKeyObject and
expose it to JS through a module-private slot reader, mirroring the
CryptoKey hardening. Cache the native slot tuple in a private field
and lazily derive secret and asymmetric metadata from the cached
KeyObjectHandle.
Update internal crypto, QUIC, and comparison callers to use private
helpers instead of public KeyObject accessors. Keep getKeyObjectSlots
restricted to internal/crypto/keys with an ESLint guard.
Add regression coverage for brand checks, hidden slots, clone and
transfer behavior, own-property reflection, and post-clone crypto
operations. Extend the CryptoKey brand test to assert getSlots is not
reachable through the public constructor or prototype chain.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Replace object spread in nested WebIDL conversion
options with stable-shape ordinary objects. This keeps
hot dictionary and sequence conversion paths from
allocating null-prototype spread results.
Apply the same pattern to Web Crypto converter wrappers
that override allowResizable or enable [EnforceRange].
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Replace the O(n) case-insensitive algorithm-name scan
with an O(1) SafeMap lookup. The map is pre-built at
module init alongside kSupportedAlgorithms.
Hoist the opts object literal used in normalizeAlgorithm
to module level to avoid allocating identical
{ prefix, context } objects on every call.
Pre-compute ObjectKeys() for simpleAlgorithmDictionaries
entries at module init to avoid allocating a new keys
array on every normalizeAlgorithm call.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Rework lib/internal/webidl.js into a documented shared converter module
that follows the Web IDL conversion algorithms more closely.
Improvements:
- Add documented converters and helper factories for primitive values,
dictionaries, enums, sequences, interfaces, required arguments,
integers, `Uint8Array`, and `BufferSource`.
- Move WebCrypto onto the shared converters, while keeping compatibility
wrappers for its existing `BufferSource` and `BigInteger` behavior.
- Use shared converters from Blob, Performance, Web Locks, and
structured clone option handling.
- Add benchmarks for `ConvertToInt` and WebCrypto Web IDL converter hot
paths.
- Add focused tests for core converters, WebCrypto converters, integer
conversion, and buffer source behavior.
Fixes:
- Make the shared `BufferSource` and `Uint8Array` converters reject
resizable `ArrayBuffer` and growable `SharedArrayBuffer` backing
stores unless explicitly allowed. WebCrypto preserves its legacy
resizable backing-store behavior through compatibility wrappers until
a semver-major follow-up can opt in to the stricter behavior.
- Use Web IDL `ToNumber` and `ToString` behavior for BigInt, Symbol, and
object primitive conversion.
- Use exact BigInt modulo for 64-bit `ConvertToInt` wrapping and
document the final Number approximation behavior.
- Normalize mathematical modulo results to `+0` where Web IDL requires
it.
- Process inherited dictionaries in least-derived to most-derived order,
sorting members only within each dictionary level.
- Use `IteratorComplete` truthiness for sequence conversion.
- Cover detached buffers, resizable-backed views, growable-backed views,
cross-realm buffer sources, mutation-after-call behavior, inherited
dictionary member order, and sequence iterator completion behavior.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62979
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Consolidate all asymmetric key import paths (DER/PEM, JWK, raw) into
a single KeyObjectHandle::Init() entry point with a uniform signature.
Remove the per-type C++ init methods (InitECRaw, InitEDRaw, InitPqcRaw,
InitJwk, InitECPrivateRaw) and their JS-side callers, replacing them
with shared C++ and JS helpers.
createPublicKey, createPrivateKey, sign, verify, and other operations
that accept key material now handle JWK and raw formats directly in
C++, removing redundant JS-to-C++ key handle round-trips.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62499
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Add raw key format support (raw-public, raw-private, raw-seed) to
KeyObject.prototype.export(), crypto.createPrivateKey(),
and crypto.createPublicKey() for applicable asymmetric keys (EC,
CFRG curves, ML-DSA, ML-KEM, and SLH-DSA).
Also wire these to the Web Cryptography APIs and remove the unnecessary
KeyExportJob. The KeyExportJob classes were removed because the export
operations they performed are not computationally expensive. They're
just serialization of already-available key data (SPKI, PKCS8, raw
bytes). Running them as async CryptoJobs on the libuv thread pool added
unnecessary overhead and complexity for operations that complete
instantly.
PR-URL: https://github.com/nodejs/node/pull/62240
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Implement QuotaExceededError as a DOMException-derived interface per the
WebIDL specification update.
QuotaExceededError is now a proper constructor exposed as a global
[Exposed=*] interface that extends DOMException with optional `quota`
and `requested` attributes (both nullable doubles, defaulting to null).
The constructor validates that quota and requested are finite,
non-negative, and that requested is not less than quota when both are
provided.
QuotaExceededError is [Serializable] and supports structuredClone,
preserving the quota and requested values across the serialization
boundary.
Callers updated:
- crypto.getRandomValues() now throws a QuotaExceededError instance
- WebStorage (C++) now constructs QuotaExceededError directly
Refs: https://redirect.github.com/whatwg/webidl/pull/1465
Fixes: https://github.com/nodejs/node/issues/58987
PR-URL: https://github.com/nodejs/node/pull/62293
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Filip Skokan