Skip to content

Commit

Permalink
webcrypto: RSA support (#1791)
Browse files Browse the repository at this point in the history
* webcrypto: RSA support

* webcrypto: mentioning RsaHashedImportParams

---------

Co-authored-by: Joan López de la Franca Beltran <[email protected]>
  • Loading branch information
olegbespalov and joanlopez authored Nov 7, 2024
1 parent 4c77b19 commit 27a5d99
Show file tree
Hide file tree
Showing 12 changed files with 114 additions and 15 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ The `HmacKeyGenParams` object represents the object that should be passed as the

| Property | Type | Description |
| :---------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| name | `string` | The should be set to `HMAC`. |
| name | `string` | This should be set to `HMAC`. |
| hash | `string` | The name of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`. |
| length (optional) | `number` | The length of the key in bits. If this is omitted, the length of the key is equal to the block size of the hash function you have chosen. We recommend to leave this parameter empty, unless you have a good reason to use something different. |

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
title: 'RsaHashedImportParams'
description: 'RsaHashedImportParams represents the object that should be passed as the algorithm parameter into the importKey operation, when using the RSA algorithm.'
weight: 12
---

# RsaHashedImportParams

The `RsaHashedImportParams` represents the object that should be passed as the algorithm parameter into [`importKey`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/importkey/) when using the RSA algorithm.

## Properties

| Property | Type | Description |
| :------- | :------- | :------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| name | `string` | This should be set to `RSASSA-PKCS1-v1_5`, `RSA-PSS` or `RSA-OAEP`. |
| hash | `string` | `object` | The name or an object with a `name` property of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`. |
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
---
title: 'RSAHashedKeyGenParams'
description: 'RSAHashedKeyGenParams represents the object that should be passed as the algorithm parameter into the generateKey operation, when generating an RSA key pair.'
weight: 12
---

# RSAHashedKeyGenParams

The `RSAHashedKeyGenParams` object represents the object that should be passed as the algorithm parameter into the [generateKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/generatekey) operation when generating an RSA key pair.

## Properties

| Property | Type | Description |
| :------------- | :----------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| name | `string` | This should be set to `RSASSA-PKCS1-v1_5`, `RSA-PSS` or `RSA-OAEP`. |
| modulusLength | `number` | The length in bits of the RSA modulus. This should be at least 2048. Some organizations are now recommending that it should be 4096. |
| publicExponent | `Uint8Array` | The public exponent. Unless you have a good reason to use something else, specify `65537` here, which represented as a `Uint8Array` is `new Uint8Array([1, 0, 1])` |
| hash | `string` | `object` | The name or an object with a `name` property of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`. |

## Example

{{< code >}}

```javascript
import { crypto } from 'k6/experimental/webcrypto';

export default async function () {
const keyPair = await crypto.subtle.generateKey(
{
name: 'RSA-PSS',
modulusLength: 2048,
publicExponent: new Uint8Array([1, 0, 1]),
hash: { name: 'SHA-256' },
},
true,
['sign', 'verify']
);
}
```

{{< /code >}}
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
title: 'RsaOaepParams'
description: 'RsaOaepParams represents the object that should be passed as the algorithm parameter into the encrypt and decrypt operation when using the RSA-OAEP algorithm.'
weight: 06
---

# RsaOaepParams

The `RsaOaepParams` object represents the object that should be passed as the algorithm parameter into the [encrypt](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/encrypt) and [decrypt](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/decrypt) operation when using the RSA-OAEP algorithm.

For more details, head to the [MDN Web Crypto API documentation on RSA-OAEP](https://developer.mozilla.org/en-US/docs/Web/API/RsaOaepParams).

## Properties

| Property | Type | Description |
| :--------------- | :----------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| name | `string` | Should be set to `RSA-OAEP`. |
| label (optional) | `ArrayBuffer`, `TypedArray`, or `DataView` | It's an array of bytes that does not itself need to be encrypted but which should be bound to the ciphertext. A digest of the label is part of the input to the encryption operation. Unless your application calls for a label, you can just omit this argument, and it will not affect the security of the encryption operation. |
| |
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
---
title: 'RsaPssParams'
description: 'RsaPssParams is a parameter used for sign or verify operations.'
weight: 11
---

# RsaPssParams

The `RsaPssParams` represents the object that should be passed as the algorithm parameter into [`sign`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/sign/) or [`verify`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/subtlecrypto/verify/) when using the RSA-PSS algorithm.

## Properties

| Property | Type | Description |
| :--------- | :------- | :-------------------------------------------------------------------------- |
| name | `string` | An algorithm name. Should be `RSA-PSS`. |
| saltLength | `number` | A long integer representing the length of the random salt to use, in bytes. |

{{< admonition type="caution" >}}

Since under the hood we use Golang's SDK the salt length 0 is not supported. In that case the maximum possible salt length will be used.

{{< /admonition >}}
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ weight: 05

# generateKey

The `generateKey()` generates a new cryptographic key and returns it as a [CryptoKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokey) object that can be used with the Web Crypto API.
The `generateKey()` generates a new cryptographic key and returns it as a [CryptoKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokey) object or a [CryptoKeyPair](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokeypair) object that can be used with the Web Crypto API.

## Usage

Expand All @@ -28,20 +28,20 @@ generateKey(algorithm, extractable, keyUsages)

## Return Value

A `Promise` that resolves with the generated key as a [CryptoKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokey) object or a [CryptoKeyPair](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokeypair).
A `Promise` that resolves with the generated key as a [CryptoKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokey) object or a [CryptoKeyPair](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokeypair) object.

### Algorithm specific input

| | HMAC | AES | ECDH | ECDSA |
| :--------------------- | :----------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------- |
| Parameters type to use | [`HmacKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/hmackeygenparams) | [`AesKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/aeskeygenparams) | [`EcKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/eckeygenparams) | [`EcKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/eckeygenparams) |
| Possible key usages | `sign`, `verify` | `encrypt`, `decrypt` | `deriveKey`, `deriveBits` | `sign`, `verify` |
| | HMAC | AES | ECDH | ECDSA | RSA-OAEP | RSASSA-PKCS1-v1_5 | RSA-PSS |
| :--------------------- | :----------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------- |----- |----- |----- |
| Parameters type to use | [`HmacKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/hmackeygenparams) | [`AesKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/aeskeygenparams) | [`EcKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/eckeygenparams) | [`EcKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/eckeygenparams) | [`RSAHashedKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/rsahashedkeygenparams) | [`RSAHashedKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/rsahashedkeygenparams) | [`RSAHashedKeyGenParams`](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/rsahashedkeygenparams) |
| Possible key usages | `sign`, `verify` | `encrypt`, `decrypt` | `deriveKey`, `deriveBits` | `sign`, `verify` | `encrypt`, `decrypt` | `sign`, `verify` | `sign`, `verify` |

## Throws

| Type | Description |
| :------------ | :------------------------------------------------------------------------------------------- |
| `SyntaxError` | Raised when the `keyUsages` parameter is empty but the key is of type `secret` or `private`. |
| `SyntaxError` | Raised when the `keyUsages` parameter is empty, but the key is of type `secret` or `private`. |

## Example

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ sign(algorithm, key, data)

| Name | Type | Description |
| :---------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------- |
| `algorithm` | `string` or object with a single `name` string property or an [EcdsaParams](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/ecdsaparams/), or [HmacKeyGenParams](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/hmackeygenparams/) object | The signature algorithm to use. Currently supported: `HMAC` and `ECDSA`. |
| `algorithm` | `string` or object with a single `name` string property (`{name: "RSASSA-PKCS1-v1_5"}`) or an [EcdsaParams](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/ecdsaparams/), [HmacKeyGenParams](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/hmackeygenparams/), or [RsaPssParams](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/rsapssparams/) object. | The signature algorithm to use. |
| `key` | [CryptoKey](https://grafana.com/docs/k6/<K6_VERSION>/javascript-api/k6-experimental/webcrypto/cryptokey) | The key to use for signing. |
| `data` | `ArrayBuffer`, `TypedArray`, or `DataView` | The data to be signed. |

Expand Down
Loading

0 comments on commit 27a5d99

Please sign in to comment.