crypto: add keyObject.export() JWK format option #37081

panva · 2021-01-26T17:27:30Z

Adds JWK keyObject.export format option.

supported for key types: ec, rsa, ed25519, ed448, x25519, x448, and symmetric keys, resulting in JWK kty (Key Type) values EC, RSA, OKP, and oct.
rsa-pss is not supported since the JWK format does not support PSS Parameters.
EC JWK curves supported are P-256, secp256k1, P-384, and P-521

cc @nodejs/crypto

tniessen

Code itself LGTM, but I don't really trust my understanding of JWK enough to judge whether this is opening a new can of worms. (And yes, I've read most of the WebCrypto and JWK specs multiple times.)

test/fixtures/keys/ec_secp256k1_public.pem

doc/api/crypto.md

panva · 2021-01-26T19:55:49Z

Code itself LGTM, but I don't really trust my understanding of JWK enough to judge whether this is opening a new can of worms. (And yes, I've read most of the WebCrypto and JWK specs multiple times.)

@tniessen Anything I can do to help you disperse this particular trust issue?

doc/api/crypto.md

nodejs-github-bot · 2021-01-27T09:43:43Z

CI: https://ci.nodejs.org/job/node-test-pull-request/35772/

doc/api/errors.md

Trott

The errors in errors.md are in alphabetical order so before this lands, the names need to be determined and then they need to be moved to the right place in the file. Once that's happened, feel free to clear this request for changes. No need to ping me on it or anything. Just leaving this here to make sure it happens before the code lands.

Trott · 2021-01-31T14:18:50Z

I also wonder if we want to avoid creating additional error codes and use something fairly generic like the existing ERR_CRYPTO_UNSUPPORTED_OPERATION? If we want to keep separate error codes for unsupported curves and unsupported key types, maybe make a generic ERR_CRYPTO_UNSUPPORTED_X for each of those and use that? I don't feel strongly about this, though. If ERR_CRYPTO_JWK_UNSUPPORTED_CURVE is the way to go, then OK.

panva · 2021-01-31T16:15:26Z

I also wonder if we want to avoid creating additional error codes and use something fairly generic like the existing ERR_CRYPTO_UNSUPPORTED_OPERATION? If we want to keep separate error codes for unsupported curves and unsupported key types, maybe make a generic ERR_CRYPTO_UNSUPPORTED_X for each of those and use that? I don't feel strongly about this, though. If ERR_CRYPTO_JWK_UNSUPPORTED_CURVE is the way to go, then OK.

I've kept the specific errors here since i couldn't come up with a generic one. As far as future import feature comes in, these two will be re-used. I will keep the amount of specific error codes to the minimum based on this feedback though.

@Trott

feedback applied, @Trott said "feel free to clear this request for changes"

doc/api/crypto.md

lib/internal/crypto/keys.js

test/parallel/test-crypto-key-objects.js

tniessen

I still have my doubts about the integration of WebCrypto/JWK into the crypto module, but that might just be because I spent far too much time on core crypto and not enough time on web crypto standards. It's an incredibly complicated topic.

KeyObjects ignore some JWK properties, e.g., key usages. And that's by design, that's not what KeyObjects are for. But it also means that importing and then exporting a JWK means it loses those additional JWK properties.

ASN.1 remains the most relevant and popular format for public and private keys. I designed the KeyObject class and many other crypto APIs in core, but I cannot fully estimate the impact of the addition of web crypto standards on them. I am fine with these additions as long as they don't get in the way of ASN.1 import and export capabilities, or the mapping of asymmetricKeyType to EVP_PKEY_* in OpenSSL. If JWK key types and EVP_PKEY_* key types ever start diverging, we might be in serious trouble.

Adds [JWK](https://tools.ietf.org/html/rfc7517) keyObject.export format option. Supported key types: `ec`, `rsa`, `ed25519`, `ed448`, `x25519`, `x448`, and symmetric keys, resulting in JWK `kty` (Key Type) values `EC`, `RSA`, `OKP`, and `oct`. `rsa-pss` is not supported since the JWK format does not support PSS Parameters. `EC` JWK curves supported are `P-256`, `secp256k1`, `P-384`, and `P-521`

Co-authored-by: James M Snell <[email protected]>

nodejs-github-bot · 2021-02-02T19:37:58Z

CI: https://ci.nodejs.org/job/node-test-pull-request/35899/

Adds [JWK](https://tools.ietf.org/html/rfc7517) keyObject.export format option. Supported key types: `ec`, `rsa`, `ed25519`, `ed448`, `x25519`, `x448`, and symmetric keys, resulting in JWK `kty` (Key Type) values `EC`, `RSA`, `OKP`, and `oct`. `rsa-pss` is not supported since the JWK format does not support PSS Parameters. `EC` JWK curves supported are `P-256`, `secp256k1`, `P-384`, and `P-521` PR-URL: #37081 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>

panva · 2021-02-02T22:17:41Z

Landed in a8d7de1

Adds [JWK](https://tools.ietf.org/html/rfc7517) keyObject.export format option. Supported key types: `ec`, `rsa`, `ed25519`, `ed448`, `x25519`, `x448`, and symmetric keys, resulting in JWK `kty` (Key Type) values `EC`, `RSA`, `OKP`, and `oct`. `rsa-pss` is not supported since the JWK format does not support PSS Parameters. `EC` JWK curves supported are `P-256`, `secp256k1`, `P-384`, and `P-521` PR-URL: #37081 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>

Notable Changes: * crypto: * add keyObject.export() 'jwk' format option (Filip Skokan) #37081 * deps: * upgrade to libuv 1.41.0 (Colin Ihrig) #37360 * doc: * add dmabupt to collaborators (Xu Meng) #37377 * refactor fs docs structure (James M Snell) #37170 * fs: * add fsPromises.watch() (James M Snell) #37179 * use a default callback for fs.close() (James M Snell) #37174 * add AbortSignal support to watch (Benjamin Gruenbaum) #37190 * perf_hooks: * introduce createHistogram (James M Snell) #37155 * stream: * improve Readable.from error handling (Benjamin Gruenbaum) #37158 * timers: * introduce setInterval async iterator (linkgoron) #37153 * tls: * add ability to get cert/peer cert as X509Certificate object (James M Snell) #37070

Notable Changes: * crypto: * add keyObject.export() jwk format option (Filip Skokan) #37081 * deps: * upgrade to libuv 1.41.0 (Colin Ihrig) #37360 * doc: * add dmabupt to collaborators (Xu Meng) #37377 * refactor fs docs structure (James M Snell) #37170 * fs: * add fsPromises.watch() (James M Snell) #37179 * use a default callback for fs.close() (James M Snell) #37174 * add AbortSignal support to watch (Benjamin Gruenbaum) #37190 * perf_hooks: * introduce createHistogram (James M Snell) #37155 * stream: * improve Readable.from error handling (Benjamin Gruenbaum) #37158 * timers: * introduce setInterval async iterator (linkgoron) #37153 * tls: * add ability to get cert/peer cert as X509Certificate object (James M Snell) #37070

PR-URL: #37406 Notable Changes: * crypto: * add keyObject.export() jwk format option (Filip Skokan) #37081 * deps: * upgrade to libuv 1.41.0 (Colin Ihrig) #37360 * doc: * add dmabupt to collaborators (Xu Meng) #37377 * refactor fs docs structure (James M Snell) #37170 * fs: * add fsPromises.watch() (James M Snell) #37179 * use a default callback for fs.close() (James M Snell) #37174 * add AbortSignal support to watch (Benjamin Gruenbaum) #37190 * perf_hooks: * introduce createHistogram (James M Snell) #37155 * stream: * improve Readable.from error handling (Benjamin Gruenbaum) #37158 * timers: * introduce setInterval async iterator (linkgoron) #37153 * tls: * add ability to get cert/peer cert as X509Certificate object (James M Snell) #37070

panva added crypto Issues and PRs related to the crypto subsystem. semver-minor PRs that contain new features and should be released in the next minor version. labels Jan 26, 2021

panva requested a review from tniessen January 26, 2021 17:27

nodejs-github-bot added the errors Issues and PRs related to JavaScript errors originated in Node.js core. label Jan 26, 2021

panva changed the title ~~crypto: add keyObject.export() 'jwk' format option~~ crypto: add keyObject.export() JWK format option Jan 26, 2021

jasnell approved these changes Jan 26, 2021

View reviewed changes

This comment has been minimized.

Sign in to view

tniessen reviewed Jan 26, 2021

View reviewed changes

test/fixtures/keys/ec_secp256k1_public.pem Show resolved Hide resolved

mscdex reviewed Jan 26, 2021

View reviewed changes

doc/api/crypto.md Outdated Show resolved Hide resolved

mscdex reviewed Jan 26, 2021

View reviewed changes

doc/api/crypto.md Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

panva added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jan 26, 2021

jasnell reviewed Jan 26, 2021

View reviewed changes

doc/api/crypto.md Outdated Show resolved Hide resolved

jasnell approved these changes Jan 29, 2021

View reviewed changes

Trott reviewed Jan 31, 2021

View reviewed changes

doc/api/errors.md Outdated Show resolved Hide resolved

Trott reviewed Jan 31, 2021

View reviewed changes

doc/api/errors.md Outdated Show resolved Hide resolved

Trott previously requested changes Jan 31, 2021

View reviewed changes

panva requested a review from Trott January 31, 2021 16:33

This comment has been minimized.

Sign in to view

panva removed the request for review from Trott January 31, 2021 16:39

tniessen reviewed Feb 1, 2021

View reviewed changes

doc/api/crypto.md Outdated Show resolved Hide resolved

lib/internal/crypto/keys.js Show resolved Hide resolved

test/parallel/test-crypto-key-objects.js Show resolved Hide resolved

test/parallel/test-crypto-key-objects.js Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

tniessen approved these changes Feb 1, 2021

View reviewed changes

This comment has been minimized.

Sign in to view

panva and others added 10 commits February 2, 2021 18:56

add custom doc type

5ba12fb

add doc changes entry

1cfd243

address doc comments

25a6c8c

add makefile for fixtures

955696f

get a curve not supported on openssl111fips

a76db7a

Update doc/api/crypto.md

5f03cdf

Co-authored-by: James M Snell <[email protected]>

apply review feedback

5ca795c

address nits

44d49e0

fail on private export with a passphrase

a6d1e96

panva force-pushed the crypto-jwk-keyobject-export branch from 641de23 to a6d1e96 Compare February 2, 2021 17:57

This comment has been minimized.

Sign in to view

jasnell approved these changes Feb 2, 2021

View reviewed changes

panva closed this Feb 2, 2021

panva deleted the crypto-jwk-keyobject-export branch February 2, 2021 22:40

This was referenced Feb 16, 2021

v15.9.0 proposal #37405

Closed

v15.9.0 proposal #37406

Merged

targos added dont-land-on-v12.x labels Aug 8, 2021

panva mentioned this pull request Aug 21, 2021

crypto: fix JWK RSA-PSS SubtleCrypto.exportKey #39828

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: add keyObject.export() JWK format option #37081

crypto: add keyObject.export() JWK format option #37081

panva commented Jan 26, 2021

This comment has been minimized.

tniessen left a comment

panva commented Jan 26, 2021

This comment has been minimized.

nodejs-github-bot commented Jan 27, 2021

Trott left a comment •

edited

Loading

Trott commented Jan 31, 2021

panva commented Jan 31, 2021 •

edited

Loading

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

tniessen left a comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

nodejs-github-bot commented Feb 2, 2021

panva commented Feb 2, 2021

crypto: add keyObject.export() JWK format option #37081

crypto: add keyObject.export() JWK format option #37081

Conversation

panva commented Jan 26, 2021

This comment has been minimized.

tniessen left a comment

Choose a reason for hiding this comment

panva commented Jan 26, 2021

This comment has been minimized.

nodejs-github-bot commented Jan 27, 2021

Trott left a comment • edited Loading

Choose a reason for hiding this comment

Trott commented Jan 31, 2021

panva commented Jan 31, 2021 • edited Loading

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

tniessen left a comment

Choose a reason for hiding this comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

nodejs-github-bot commented Feb 2, 2021

panva commented Feb 2, 2021

Trott left a comment •

edited

Loading

panva commented Jan 31, 2021 •

edited

Loading