mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-05-20 18:12:53 +00:00
LibWeb: Implement the importKey algorithm for X448
This commit is contained in:
Andreas Kling
Andreas Kling
parent
4a734226aa
commit
96ddccd961
Notes:
github-actions[bot]
2024-11-25 16:17:49 +00:00
Author: https://github.com/awesomekling
Commit: 96ddccd961
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/2573
6 changed files with 484 additions and 230 deletions
|
|
@ -3914,6 +3914,258 @@ WebIDL::ExceptionOr<GC::Ref<JS::Object>> X448::export_key(Bindings::KeyFormat fo
|
|||
return WebIDL::NotSupportedError::create(m_realm, "Invalid key format"_string);
|
||||
}
|
||||
|
||||
// https://wicg.github.io/webcrypto-secure-curves/#x448-operations
|
||||
WebIDL::ExceptionOr<GC::Ref<CryptoKey>> X448::import_key(
|
||||
AlgorithmParams const&,
|
||||
Bindings::KeyFormat format,
|
||||
CryptoKey::InternalKeyData key_data,
|
||||
bool extractable,
|
||||
Vector<Bindings::KeyUsage> const& usages)
|
||||
{
|
||||
// 1. Let keyData be the key data to be imported.
|
||||
|
||||
// 2. If format is "spki":
|
||||
if (format == Bindings::KeyFormat::Spki) {
|
||||
// 1. If usages is not empty then throw a SyntaxError.
|
||||
if (!usages.is_empty())
|
||||
return WebIDL::SyntaxError::create(m_realm, "Usages must be empty"_string);
|
||||
|
||||
// 2. Let spki be the result of running the parse a subjectPublicKeyInfo algorithm over keyData.
|
||||
// 3. If an error occurred while parsing, then throw a DataError.
|
||||
auto spki = TRY(parse_a_subject_public_key_info(m_realm, key_data.get<ByteBuffer>()));
|
||||
|
||||
// 4. If the algorithm object identifier field of the algorithm AlgorithmIdentifier field of spki is not equal to the id-X448 object identifier defined in [RFC8410], then throw a DataError.
|
||||
if (spki.algorithm.identifier != ::Crypto::Certificate::x448_oid)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid algorithm"_string);
|
||||
|
||||
// 5. If the parameters field of the algorithm AlgorithmIdentifier field of spki is present, then throw a DataError.
|
||||
if (spki.algorithm.ec_parameters.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Invalid algorithm parameters"_string);
|
||||
|
||||
// 6. Let publicKey be the X448 public key identified by the subjectPublicKey field of spki.
|
||||
auto const& public_key = spki.raw_key;
|
||||
|
||||
// 7. Let key be a new CryptoKey associated with the relevant global object of this [HTML], and that represents publicKey.
|
||||
auto key = CryptoKey::create(m_realm, CryptoKey::InternalKeyData { public_key });
|
||||
|
||||
// 8. Set the [[type]] internal slot of key to "public"
|
||||
key->set_type(Bindings::KeyType::Public);
|
||||
|
||||
// 9. Let algorithm be a new KeyAlgorithm.
|
||||
auto algorithm = KeyAlgorithm::create(m_realm);
|
||||
|
||||
// 10. Set the name attribute of algorithm to "X448".
|
||||
algorithm->set_name("X448"_string);
|
||||
|
||||
// 11. Set the [[algorithm]] internal slot of key to algorithm.
|
||||
key->set_algorithm(algorithm);
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
// 3. If format is "pkcs8":
|
||||
if (format == Bindings::KeyFormat::Pkcs8) {
|
||||
// 1. If usages contains an entry which is not "deriveKey" or "deriveBits" then throw a SyntaxError.
|
||||
for (auto const& usage : usages) {
|
||||
if (usage != Bindings::KeyUsage::Derivekey && usage != Bindings::KeyUsage::Derivebits) {
|
||||
return WebIDL::SyntaxError::create(m_realm, MUST(String::formatted("Invalid key usage '{}'", idl_enum_to_string(usage))));
|
||||
}
|
||||
}
|
||||
|
||||
// 2. Let privateKeyInfo be the result of running the parse a privateKeyInfo algorithm over keyData.
|
||||
// 3. If an error occurred while parsing, then throw a DataError.
|
||||
auto private_key_info = TRY(parse_a_private_key_info(m_realm, key_data.get<ByteBuffer>()));
|
||||
auto private_key = private_key_info.raw_key;
|
||||
|
||||
// 4. If the algorithm object identifier field of the privateKeyAlgorithm PrivateKeyAlgorithm field of privateKeyInfo is not equal to the id-X448 object identifier defined in [RFC8410], then throw a DataError.
|
||||
if (private_key_info.algorithm.identifier != ::Crypto::Certificate::x448_oid)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid algorithm"_string);
|
||||
|
||||
// 5. If the parameters field of the privateKeyAlgorithm PrivateKeyAlgorithmIdentifier field of privateKeyInfo is present, then throw a DataError.
|
||||
if (private_key_info.algorithm.ec_parameters.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Invalid algorithm parameters"_string);
|
||||
|
||||
// 6. Let curvePrivateKey be the result of performing the parse an ASN.1 structure algorithm,
|
||||
// with data as the privateKey field of privateKeyInfo, structure as the ASN.1 CurvePrivateKey
|
||||
// structure specified in Section 7 of [RFC8410], and exactData set to true.
|
||||
// 7. If an error occurred while parsing, then throw a DataError.
|
||||
auto curve_private_key = TRY(parse_an_ASN1_structure<StringView>(m_realm, private_key_info.raw_key, true));
|
||||
auto curve_private_key_bytes = TRY_OR_THROW_OOM(m_realm->vm(), ByteBuffer::copy(curve_private_key.bytes()));
|
||||
|
||||
// 8. Let key be a new CryptoKey associated with the relevant global object of this [HTML], and that represents the X448 private key identified by curvePrivateKey.
|
||||
auto key = CryptoKey::create(m_realm, CryptoKey::InternalKeyData { curve_private_key_bytes });
|
||||
|
||||
// 9. Set the [[type]] internal slot of key to "private"
|
||||
key->set_type(Bindings::KeyType::Private);
|
||||
|
||||
// 10. Let algorithm be a new KeyAlgorithm.
|
||||
auto algorithm = KeyAlgorithm::create(m_realm);
|
||||
|
||||
// 11. Set the name attribute of algorithm to "X448".
|
||||
algorithm->set_name("X448"_string);
|
||||
|
||||
// 12. Set the [[algorithm]] internal slot of key to algorithm.
|
||||
key->set_algorithm(algorithm);
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
// 3. If format is "jwk":
|
||||
if (format == Bindings::KeyFormat::Jwk) {
|
||||
// 1. If keyData is a JsonWebKey dictionary:
|
||||
// Let jwk equal keyData.
|
||||
// Otherwise:
|
||||
// Throw a DataError.
|
||||
if (!key_data.has<Bindings::JsonWebKey>())
|
||||
return WebIDL::DataError::create(m_realm, "Data is not a JsonWebKey dictionary"_string);
|
||||
auto jwk = key_data.get<Bindings::JsonWebKey>();
|
||||
|
||||
// 2. If the d field is present and if usages contains an entry which is not "deriveKey" or "deriveBits" then throw a SyntaxError.
|
||||
if (jwk.d.has_value()) {
|
||||
for (auto const& usage : usages) {
|
||||
if (usage != Bindings::KeyUsage::Derivekey && usage != Bindings::KeyUsage::Derivebits) {
|
||||
return WebIDL::SyntaxError::create(m_realm, MUST(String::formatted("Invalid key usage '{}'", idl_enum_to_string(usage))));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// 3. If the d field is not present and if usages is not empty then throw a SyntaxError.
|
||||
if (!jwk.d.has_value() && !usages.is_empty())
|
||||
return WebIDL::SyntaxError::create(m_realm, "Usages must be empty"_string);
|
||||
|
||||
// 4. If the kty field of jwk is not "OKP", then throw a DataError.
|
||||
if (jwk.kty != "OKP"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid key type"_string);
|
||||
|
||||
// 5. If the crv field of jwk is not "X448", then throw a DataError.
|
||||
if (jwk.crv != "X448"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid curve"_string);
|
||||
|
||||
// 6. If usages is non-empty and the use field of jwk is present and is not equal to "enc" then throw a DataError.
|
||||
if (!usages.is_empty() && jwk.use.has_value() && jwk.use.value() != "enc"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid use"_string);
|
||||
|
||||
// 7. If the key_ops field of jwk is present, and is invalid according to the requirements of JSON Web Key [JWK],
|
||||
// or it does not contain all of the specified usages values, then throw a DataError.
|
||||
TRY(validate_jwk_key_ops(m_realm, jwk, usages));
|
||||
|
||||
// 8. If the ext field of jwk is present and has the value false and extractable is true, then throw a DataError.
|
||||
if (jwk.ext.has_value() && !jwk.ext.value() && extractable)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid extractable"_string);
|
||||
|
||||
GC::Ptr<CryptoKey> key = nullptr;
|
||||
|
||||
// 9. If the d field is present:
|
||||
if (jwk.d.has_value()) {
|
||||
// 1. If jwk does not meet the requirements of the JWK private key format described in Section 2 of [RFC8037], then throw a DataError.
|
||||
|
||||
// o The parameter "kty" MUST be "OKP".
|
||||
if (jwk.kty != "OKP"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid key type"_string);
|
||||
|
||||
// // https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
|
||||
// o The parameter "crv" MUST be present and contain the subtype of the key (from the "JSON Web Elliptic Curve" registry).
|
||||
if (jwk.crv != "X448"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid curve"_string);
|
||||
|
||||
// o The parameter "x" MUST be present and contain the public key encoded using the base64url [RFC4648] encoding.
|
||||
if (!jwk.x.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Missing x field"_string);
|
||||
|
||||
// o The parameter "d" MUST be present for private keys and contain the private key encoded using the base64url encoding.
|
||||
// This parameter MUST NOT be present for public keys.
|
||||
if (!jwk.d.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Missing d field"_string);
|
||||
|
||||
// 2. Let key be a new CryptoKey object that represents the X25519 private key identified by interpreting jwk according to Section 2 of [RFC8037].
|
||||
auto private_key_base_64 = jwk.d.value();
|
||||
auto private_key_or_error = decode_base64url(private_key_base_64);
|
||||
if (private_key_or_error.is_error()) {
|
||||
return WebIDL::DataError::create(m_realm, "Failed to decode base64"_string);
|
||||
}
|
||||
auto private_key = private_key_or_error.release_value();
|
||||
key = CryptoKey::create(m_realm, CryptoKey::InternalKeyData { private_key });
|
||||
|
||||
// 3. Set the [[type]] internal slot of Key to "private".
|
||||
key->set_type(Bindings::KeyType::Private);
|
||||
}
|
||||
// Otherwise:
|
||||
else {
|
||||
// 1. If jwk does not meet the requirements of the JWK public key format described in Section 2 of [RFC8037], then throw a DataError.
|
||||
// o The parameter "kty" MUST be "OKP".
|
||||
if (jwk.kty != "OKP"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid key type"_string);
|
||||
|
||||
// https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
|
||||
// o The parameter "crv" MUST be present and contain the subtype of the key (from the "JSON Web Elliptic Curve" registry).
|
||||
if (jwk.crv != "X448"sv)
|
||||
return WebIDL::DataError::create(m_realm, "Invalid curve"_string);
|
||||
|
||||
// o The parameter "x" MUST be present and contain the public key encoded using the base64url [RFC4648] encoding.
|
||||
if (!jwk.x.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Missing x field"_string);
|
||||
|
||||
// o The parameter "d" MUST be present for private keys and contain the private key encoded using the base64url encoding.
|
||||
// This parameter MUST NOT be present for public keys.
|
||||
if (jwk.d.has_value())
|
||||
return WebIDL::DataError::create(m_realm, "Present d field"_string);
|
||||
|
||||
// 2. Let key be a new CryptoKey object that represents the Ed25519 public key identified by interpreting jwk according to Section 2 of [RFC8037].
|
||||
auto public_key_base_64 = jwk.x.value();
|
||||
auto public_key_or_error = decode_base64url(public_key_base_64);
|
||||
if (public_key_or_error.is_error()) {
|
||||
return WebIDL::DataError::create(m_realm, "Failed to decode base64"_string);
|
||||
}
|
||||
auto public_key = public_key_or_error.release_value();
|
||||
key = CryptoKey::create(m_realm, CryptoKey::InternalKeyData { public_key });
|
||||
|
||||
// 3. Set the [[type]] internal slot of Key to "public".
|
||||
key->set_type(Bindings::KeyType::Public);
|
||||
}
|
||||
|
||||
// 10. Let algorithm be a new instance of a KeyAlgorithm object.
|
||||
auto algorithm = KeyAlgorithm::create(m_realm);
|
||||
|
||||
// 11. Set the name attribute of algorithm to "X448".
|
||||
algorithm->set_name("X448"_string);
|
||||
|
||||
// 12. Set the [[algorithm]] internal slot of key to algorithm.
|
||||
key->set_algorithm(algorithm);
|
||||
|
||||
return GC::Ref { *key };
|
||||
}
|
||||
|
||||
// 3. If format is "raw":
|
||||
if (format == Bindings::KeyFormat::Raw) {
|
||||
// 1. If usages is not empty then throw a SyntaxError.
|
||||
if (!usages.is_empty())
|
||||
return WebIDL::SyntaxError::create(m_realm, "Usages must be empty"_string);
|
||||
|
||||
// 2. Let algorithm be a new KeyAlgorithm object.
|
||||
auto algorithm = KeyAlgorithm::create(m_realm);
|
||||
|
||||
// 3. Set the name attribute of algorithm to "X448".
|
||||
algorithm->set_name("X448"_string);
|
||||
|
||||
// 4. Let key be a new CryptoKey associated with the relevant global object of this [HTML], and representing the key data provided in keyData.
|
||||
auto key = CryptoKey::create(m_realm, key_data);
|
||||
|
||||
// 5. Set the [[type]] internal slot of key to "public"
|
||||
key->set_type(Bindings::KeyType::Public);
|
||||
|
||||
// 6. Set the [[algorithm]] internal slot of key to algorithm.
|
||||
key->set_algorithm(algorithm);
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
(void)extractable;
|
||||
|
||||
// 3. Otherwise:
|
||||
// throw a NotSupportedError.
|
||||
return WebIDL::NotSupportedError::create(m_realm, "Invalid key format"_string);
|
||||
}
|
||||
|
||||
static WebIDL::ExceptionOr<ByteBuffer> hmac_calculate_message_digest(JS::Realm& realm, GC::Ptr<KeyAlgorithm> hash, ReadonlyBytes key, ReadonlyBytes message)
|
||||
{
|
||||
auto calculate_digest = [&]<typename T>() -> ByteBuffer {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue