crypto: support JWK objects in create(Public|Private)Key #37254

panva · 2021-02-06T21:49:51Z

This enables create(Public|Private)Key JWK inputs.

crypto.createPublicKey({ key: jwk, format: 'jwk' })

Allows both private and public JWKs, always creates a PublicKeyObject
Enabled key types RSA, EC (P-256, secp256k1, P-384, P-521), OKP (Ed25519, Ed448, X25519, X448)

crypto.createPrivateKey({ key: jwk, format: 'jwk' })

Allows private JWKs, always creates a PrivateKeyObject
Enabled key types RSA, EC (P-256, secp256k1, P-384, P-521), OKP (Ed25519, Ed448, X25519, X448)

~~crypto.createSecretKey(jwk)~~

~~Allows "oct" JWKs, always creates a SecretKeyObject~~
~~Enabled key types oct~~

panva · 2021-02-06T21:50:33Z

I think this will conflict with #37240, but opening here to get early feedback.

panva · 2021-02-08T10:18:00Z

cc @nodejs/crypto

tniessen · 2021-02-09T20:17:39Z

We can also make it work without the ({ key: jwk, format: 'jwk' }) layer, just (jwk) since a JWK will always be an object with a kty property

I don't think we should. What if another "plain object" key type emerges one day and the user passes an object that has both a kty and a somePropertyDefinedByAnotherArbitrarySpec property? The main reason why we support (pem) is for historical reasons and backward compatibility, plus, PEM is still the standard format for HTTPS keys and certificates.

panva · 2021-02-09T20:52:01Z

I've pulled the createSecretKey change. To be done separately if requested. It's as simple to do as createSecretKey(jwk.k, 'base64') anyway.

tniessen · 2021-02-18T11:43:28Z

@panva Is this a WIP or ready to be reviewed?

panva · 2021-02-18T11:47:45Z

@panva Is this a WIP or ready to be reviewed?

To be reviewed please.

doc/api/crypto.md

lib/internal/crypto/keys.js

tniessen · 2021-02-18T13:20:04Z

lib/internal/crypto/keys.js

+    validateString(key.qi, 'key.qi');
+  }
+
+  const handle = new KeyObjectHandle();


Not sure how I feel about creating KeyObjectHandles in more places.

Do you have a concrete suggestion? I'm only using what's available.

Not right now, sorry. We can probably improve that later. I don't think this internal inconsistency has any visible effect to the user, but I'm not entirely sure.

lib/internal/errors.js

panva · 2021-02-26T10:19:43Z

cc @nodejs/crypto

lib/internal/crypto/keys.js

jasnell

LGTM with exception to the use of delete as commented.

nodejs-github-bot · 2021-03-09T08:35:34Z

CI: https://ci.nodejs.org/job/node-test-pull-request/36558/

mcollina

lgtm

PR-URL: #37254 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

panva · 2021-03-10T17:50:36Z

Landed in 117e293

PR-URL: #37254 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

Notable changes: * crypto: * add optional callback to crypto.sign and crypto.verify (Filip Skokan) #37500 * support JWK objects in create\*Key (Filip Skokan) #37254 * deps: * update archs files for OpenSSL-1.1.1+quic (James M Snell) #37601 * switch openssl to quictls/openssl (James M Snell) #37601 * doc: * update maintaining-openssl guide (James M Snell) #37601 * fs: * improve fsPromises writeFile performance (Nitzan Uziely) #37610 * add promisified readFile benchmark (Nitzan Uziely) #37608 * improve fsPromises readFile performance (Nitzan Uziely) #37608 * lib: * implement AbortSignal.abort() (James M Snell) #37693 * node-api: * define version 8 (Gabriel Schulhof) #37652 * test: * update dom/abort tests (James M Snell) #37693 * fixup test to account for quic openssl version (James M Snell) #37601 * worker: * add setEnvironmentData/getEnvironmentData (James M Snell) #37486

PR-URL: #37766 Notable changes: * crypto: * add optional callback to crypto.sign and crypto.verify (Filip Skokan) #37500 * support JWK objects in create\*Key (Filip Skokan) #37254 * deps: * update archs files for OpenSSL-1.1.1+quic (James M Snell) #37601 * switch openssl to quictls/openssl (James M Snell) #37601 * doc: * update maintaining-openssl guide (James M Snell) #37601 * fs: * improve fsPromises writeFile performance (Nitzan Uziely) #37610 * add promisified readFile benchmark (Nitzan Uziely) #37608 * improve fsPromises readFile performance (Nitzan Uziely) #37608 * lib: * implement AbortSignal.abort() (James M Snell) #37693 * node-api: * define version 8 (Gabriel Schulhof) #37652 * test: * update dom/abort tests (James M Snell) #37693 * fixup test to account for quic openssl version (James M Snell) #37601 * worker: * add setEnvironmentData/getEnvironmentData (James M Snell) #37486

PR-URL: #37766 Notable changes: * crypto: * add optional callback to crypto.sign and crypto.verify (Filip Skokan) #37500 * support JWK objects in create\*Key (Filip Skokan) #37254 * deps: * switch openssl to quictls/openssl (James M Snell) #37601 * fs: * improve fsPromises writeFile performance (Nitzan Uziely) #37610 * improve fsPromises readFile performance (Nitzan Uziely) #37608 * lib: * implement AbortSignal.abort() (James M Snell) #37693 * node-api: * define version 8 (Gabriel Schulhof) #37652 * worker: * add setEnvironmentData/getEnvironmentData (James M Snell) #37486

PR-URL: #37766 Notable changes: * crypto: * add optional callback to crypto.sign and crypto.verify (Filip Skokan) #37500 * support JWK objects in create\*Key (Filip Skokan) #37254 * deps: * update to [email protected] (Guy Bedford) #37712 * switch openssl to quictls/openssl (James M Snell) #37601 * fs: * improve fsPromises writeFile performance (Nitzan Uziely) #37610 * improve fsPromises readFile performance (Nitzan Uziely) #37608 * lib: * implement AbortSignal.abort() (James M Snell) #37693 * node-api: * define version 8 (Gabriel Schulhof) #37652 * worker: * add setEnvironmentData/getEnvironmentData (James M Snell) #37486

panva requested review from jasnell and tniessen February 6, 2021 21:49

nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. errors Issues and PRs related to JavaScript errors originated in Node.js core. labels Feb 6, 2021

panva added the semver-minor PRs that contain new features and should be released in the next minor version. label Feb 6, 2021

panva marked this pull request as ready for review February 8, 2021 12:29

panva force-pushed the crypto-jwk-keyobject-import branch from 3f77664 to 42b091a Compare February 8, 2021 12:30