crypto: fix unencrypted DER PKCS8 parsing

[tniessen]

The previously used OpenSSL call only supports encrypted PKCS8, this commit adds support for unencrypted PKCS8. This only affects keys that are encoded as DER using PKCS#8 without encryption, which probably explains why nobody noticed this earlier.

cc @nodejs/crypto

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[nodejs-github-bot]

@tniessen build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/2685/pipeline

[addaleax]

@nodejs/crypto

[tniessen]

CI: https://ci.nodejs.org/job/node-test-pull-request/20935/
Resumed in: https://ci.nodejs.org/job/node-test-pull-request/20942/

[sam-github]

You can test by running the decoding in a loop over a valid key, something like this pseudo-code.

valid = valid_der;
for (i = 0; i < valid.size; i++) {
  invalid = valid.truncate(i)
  let err
  try {
   parse(invalid)
  } catch (e) {
    err = e;
  }
  if (i < valid.size()) assert(err !== null)
  else assert.ifError(err)
}

We don't usually do this, because we assume that OpenSSL has a correct bug-free decoder, but if we have our own, I think we should be careful to test invalid data.

[ryzokuken]

I checked out this branch, and this change literally is exactly what was needed to make easy-crypto work and what not.

Great work, @tniessen! 🎉

[mcollina]

LGTM

[tniessen]

Thanks for reviewing, landed in 8d69fdd.

[ryzokuken]

@addaleax this should land on all release lines, right?

[addaleax]

I think that’s a question for @tniessen :)

[tniessen]

@ryzokuken I believe the key object API (which also added support for DER) has only landed on v11 so far so this only applies to v11.