feat: Add support for SubtleCrypto #440

JakeChampion · 2023-03-08T17:04:15Z

This adds an implementation of a subset of SubtleCrypto, specifically for JSON Web Token signing and validating.

SubtleCrypto.prototype.generateKey
SubtleCrypto.prototype.importKey
SubtleCrypto.prototype.sign
SubtleCrypto.prototype.verify with the following algorithms:
RSASSA_PKCS1_v1_5
RSA_OAEP and the following digest algorithms:
SHA_1
SHA_224
SHA_256
SHA_384
SHA_512

Work in the future will be done to add the remaining algorithms and SubtleCrypto method implementations

This adds an implementation of a subset of SubtleCrypto, specifically for JSON Web Token signing and validating. - SubtleCrypto.prototype.generateKey - SubtleCrypto.prototype.importKey - SubtleCrypto.prototype.sign - SubtleCrypto.prototype.verify with the following algorithms: - RSASSA_PKCS1_v1_5 - RSA_OAEP and the following digest algorithms: - SHA_1 - SHA_224 - SHA_256 - SHA_384 - SHA_512 Work in the future will be done to add the remaining algorithms and SubtleCrypto method implementations

elliottt · 2023-03-21T17:28:29Z

c-dependencies/js-compute-runtime/js-compute-builtins.h

+
+constexpr uint8_t nonAlphabet = 255;
+
+static const uint8_t base64DecodeTable[] = {


Could you move this back to js-compute-builtins.cpp and make this declaration extern const uint8_t base64DecodeTable[]; instead? Otherwise this constant will be inlined into every file that includes it, adding a lot of duplicate declarations of the same data that won't inline.

elliottt · 2023-03-21T17:30:01Z

c-dependencies/js-compute-runtime/js-compute-builtins.cpp

+inline JS::Result<mozilla::Ok> base64Decode4to3(std::string_view input, std::string &output,
+                                                const uint8_t *decodeTable) {


What drove making the decode table a parameter here?

elliottt · 2023-03-21T21:22:14Z

tests/wpt-harness/expectations/WebCryptoAPI/algorithm-discards-context.https.window.js.json

+  "Context is discarded in generateKey": {
+    "status": "FAIL"
+  },


Are these all expected to fail with this pr?

elliottt

Would you mind pulling out all the new json test results into a separate pr? That way we could see what the diff in behavior between main and this pr is.

elliottt · 2023-03-21T21:29:22Z

c-dependencies/js-compute-runtime/builtins/crypto-key.h

@@ -0,0 +1,942 @@
+#pragma once


Could you switch to header guards? If we ever change build systems, #pragma once could become problematic.

JakeChampion · 2023-03-22T15:37:53Z

Changing this to a draft as I will be breaking the PR up into a bunch of smaller PRs

panva · 2023-05-04T20:00:26Z

If I could lobby for a few more algorithms to be supported 🙏

RSA-PSS
ECDSA (at least P-256, but ideally all three curves)
Ed25519 from https://wicg.github.io/webcrypto-secure-curves/
almost forgot, the goto JWS algorithm - HMAC

Also pkcs8 and spki key format import/export are not to be overlooked. Developers LOOOVE to use in favour of JWKs.

I have a comprehensive test suite for different runtimes' webcrypto implementations that I could unload on js-compute-runtime eventually.

stefan-guggisberg · 2023-05-15T11:37:44Z

@JakeChampion We are using 3rd party dependencies relying on subtle.crypto, e.g. for signing AWS requests.

We're still getting errors like Supplied algorithm is not yet supported.

Here's a code fragment from https://github.com/mhart/aws4fetch which seems to trigger this error:

async function hmac(key2, string3) {
  const cryptoKey = await crypto.subtle.importKey(
    "raw",
    typeof key2 === "string" ? encoder2.encode(key2) : key2,
    { name: "HMAC", hash: { name: "SHA-256" } },
    false,
    ["sign"]
  );
  return crypto.subtle.sign("HMAC", cryptoKey, encoder2.encode(string3));
}

It seems like the lack of HMAC support is causing the error.

This is a blocker for us. Without this support we won't be able to use C@E.

Can you give us an ETA when this PR finally lands in production?

mlegenhausen · 2023-05-17T08:28:15Z

For a complete move to compute edge we would need support for the following API

SubtleCrypto.prototype.encrypt
SubtleCrypto.prototype.decrypt

Both with support for AES-CBC and AES-GCM

JakeChampion · 2023-07-10T13:42:00Z

Thanks all -- we've added HMAC and raw importkey support and I have opened issues for the other requests which have been added to this draft pull-request.

I will be closing this pull-request as it is never going to be merged, all the work is happening in other, smaller pull-requests 👍

JakeChampion force-pushed the jake/subtlecrypto-verify branch from 0b8af04 to b2083a0 Compare March 20, 2023 18:03

JakeChampion requested a review from elliottt March 20, 2023 18:03

JakeChampion force-pushed the jake/subtlecrypto-verify branch 2 times, most recently from 5500fba to ad97434 Compare March 20, 2023 18:08

JakeChampion force-pushed the jake/subtlecrypto-verify branch from ad97434 to 328fab3 Compare March 20, 2023 18:10

JakeChampion marked this pull request as ready for review March 20, 2023 18:11

Jake Champion added 3 commits March 20, 2023 18:17

merge origin/main into jake/subtlecrypto-verify

b1d9ba5

chore: make format

7af561a

Merge remote-tracking branch 'origin/main' into jake/subtlecrypto-verify

cf698d1

elliottt reviewed Mar 21, 2023

View reviewed changes

JakeChampion marked this pull request as draft March 22, 2023 15:37

JakeChampion added 2 commits March 24, 2023 16:18

Delete failures_X25519.https.any.js.json

a8834a6

Delete wrapKey_unwrapKey.https.any.js.json

ea56e46

stefan-guggisberg mentioned this pull request Apr 11, 2023

feat: Implement subset of crypto.subtle.importKey which can import a JSONWebKey using RSASSA-PKCS1-v1_5 #472

Merged

JakeChampion force-pushed the main branch 7 times, most recently from 9d26f5a to 5198884 Compare May 11, 2023 10:14

This was referenced Jul 10, 2023

feature-request: support for SubtleCrypto encrypt and decrypt for AES-CBC and AES-GCM #578

Closed

Feature request: SubtleCrypto support for RSA-PSS, ECDSA, ED25519, pkcs8 and spki #579

Closed

JakeChampion closed this Jul 10, 2023

JakeChampion deleted the jake/subtlecrypto-verify branch August 9, 2023 23:31

This was referenced Aug 27, 2024

SubtleCrypto Algorithms bytecodealliance/StarlingMonkey#123

Open

SubtleCrypto encrypt and decrypt for AES-CBC and AES-GCM bytecodealliance/StarlingMonkey#124

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add support for SubtleCrypto #440

feat: Add support for SubtleCrypto #440

Uh oh!

JakeChampion commented Mar 8, 2023

Uh oh!

elliottt Mar 21, 2023 •

edited

Loading

Uh oh!

elliottt Mar 21, 2023

Uh oh!

elliottt Mar 21, 2023

Uh oh!

elliottt left a comment

Uh oh!

elliottt Mar 21, 2023

Uh oh!

JakeChampion commented Mar 22, 2023

Uh oh!

panva commented May 4, 2023 •

edited

Loading

Uh oh!

stefan-guggisberg commented May 15, 2023 •

edited

Loading

Uh oh!

mlegenhausen commented May 17, 2023 •

edited

Loading

Uh oh!

JakeChampion commented Jul 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		constexpr uint8_t nonAlphabet = 255;

		static const uint8_t base64DecodeTable[] = {

		inline JS::Result<mozilla::Ok> base64Decode4to3(std::string_view input, std::string &output,
		const uint8_t *decodeTable) {

feat: Add support for SubtleCrypto #440

feat: Add support for SubtleCrypto #440

Uh oh!

Conversation

JakeChampion commented Mar 8, 2023

Uh oh!

elliottt Mar 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elliottt Mar 21, 2023

Choose a reason for hiding this comment

Uh oh!

elliottt Mar 21, 2023

Choose a reason for hiding this comment

Uh oh!

elliottt left a comment

Choose a reason for hiding this comment

Uh oh!

elliottt Mar 21, 2023

Choose a reason for hiding this comment

Uh oh!

JakeChampion commented Mar 22, 2023

Uh oh!

panva commented May 4, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stefan-guggisberg commented May 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mlegenhausen commented May 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JakeChampion commented Jul 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

elliottt Mar 21, 2023 •

edited

Loading

panva commented May 4, 2023 •

edited

Loading

stefan-guggisberg commented May 15, 2023 •

edited

Loading

mlegenhausen commented May 17, 2023 •

edited

Loading