Skip to content

Commit 1bff901

Browse files
panvasxa
panva
authored and
sxa
committed
crypto: wire AES-KW in Web Cryptography when using BoringSSL
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Backport-PR-URL: #63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent 677ca7e commit 1bff901

12 files changed

Lines changed: 136 additions & 100 deletions

‎lib/internal/crypto/util.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,6 @@ const kAlgorithmDefinitions = {
395395

396396
// Conditionally supported algorithms
397397
const conditionalAlgorithms = {
398-
'AES-KW': !process.features.openssl_is_boringssl,
399398
'AES-OCB': !!hasAesOcbMode,
400399
'Argon2d': !!Argon2Job,
401400
'Argon2i': !!Argon2Job,

‎src/crypto/crypto_aes.cc‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,68 @@ WebCryptoCipherStatus AES_Cipher(Environment* env,
191191
return WebCryptoCipherStatus::OK;
192192
}
193193

194+
#ifdef OPENSSL_IS_BORINGSSL
195+
// AES Key Wrap using BoringSSL's low-level AES_wrap_key / AES_unwrap_key.
196+
// BoringSSL does not expose EVP_aes_*_wrap via the
197+
// EVP_CIPHER registry, so the EVP-based AES_Cipher path is unusable for
198+
// AES-KW. This matches Chromium's WebCrypto AES-KW implementation.
199+
WebCryptoCipherStatus AES_KW_Cipher(Environment* env,
200+
const KeyObjectData& key_data,
201+
WebCryptoCipherMode cipher_mode,
202+
const AESCipherConfig& params,
203+
const ByteSource& in,
204+
ByteSource* out) {
205+
CHECK_EQ(key_data.GetKeyType(), kKeyTypeSecret);
206+
207+
const unsigned key_bits =
208+
static_cast<unsigned>(key_data.GetSymmetricKeySize()) * 8;
209+
const auto key_bytes =
210+
reinterpret_cast<const unsigned char*>(key_data.GetSymmetricKey());
211+
const bool encrypt = cipher_mode == kWebCryptoCipherEncrypt;
212+
213+
AES_KEY aes_key;
214+
if (encrypt) {
215+
// Input must be a multiple of 8 bytes and at least 16 bytes.
216+
if (in.size() < 16 || in.size() % 8 != 0) {
217+
return WebCryptoCipherStatus::FAILED;
218+
}
219+
if (AES_set_encrypt_key(key_bytes, key_bits, &aes_key) != 0) {
220+
return WebCryptoCipherStatus::FAILED;
221+
}
222+
auto buf = DataPointer::Alloc(in.size() + 8);
223+
int len = AES_wrap_key(&aes_key,
224+
nullptr,
225+
static_cast<unsigned char*>(buf.get()),
226+
in.data<unsigned char>(),
227+
in.size());
228+
if (len < 0 || static_cast<size_t>(len) != in.size() + 8) {
229+
return WebCryptoCipherStatus::FAILED;
230+
}
231+
*out = ByteSource::Allocated(buf.release());
232+
} else {
233+
// Input must be a multiple of 8 bytes and at least 24 bytes.
234+
if (in.size() < 24 || in.size() % 8 != 0) {
235+
return WebCryptoCipherStatus::FAILED;
236+
}
237+
if (AES_set_decrypt_key(key_bytes, key_bits, &aes_key) != 0) {
238+
return WebCryptoCipherStatus::FAILED;
239+
}
240+
auto buf = DataPointer::Alloc(in.size() - 8);
241+
int len = AES_unwrap_key(&aes_key,
242+
nullptr,
243+
static_cast<unsigned char*>(buf.get()),
244+
in.data<unsigned char>(),
245+
in.size());
246+
if (len < 0 || static_cast<size_t>(len) != in.size() - 8) {
247+
return WebCryptoCipherStatus::FAILED;
248+
}
249+
*out = ByteSource::Allocated(buf.release());
250+
}
251+
252+
return WebCryptoCipherStatus::OK;
253+
}
254+
#endif // OPENSSL_IS_BORINGSSL
255+
194256
// The AES_CTR implementation here takes it's inspiration from the chromium
195257
// implementation here:
196258
// https://github.com/chromium/chromium/blob/7af6cfd/components/webcrypto/algorithms/aes_ctr.cc
@@ -475,6 +537,19 @@ Maybe<void> AESCipherTraits::AdditionalConfig(
475537
}
476538
#undef V
477539

540+
#ifdef OPENSSL_IS_BORINGSSL
541+
// On BoringSSL the KW variants have no backing EVP_CIPHER; they use
542+
// low-level AES_wrap_key / AES_unwrap_key instead.
543+
const bool is_kw = params->variant == AESKeyVariant::KW_128 ||
544+
params->variant == AESKeyVariant::KW_192 ||
545+
params->variant == AESKeyVariant::KW_256;
546+
547+
if (is_kw) {
548+
UseDefaultIV(params);
549+
return JustVoid();
550+
}
551+
#endif
552+
478553
if (!params->cipher) {
479554
THROW_ERR_CRYPTO_UNKNOWN_CIPHER(env);
480555
return Nothing<void>();

‎src/crypto/crypto_aes.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,21 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
2222
V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM) \
2323
V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM) \
2424
V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM) \
25+
VARIANTS_KW(V)
26+
27+
#ifdef OPENSSL_IS_BORINGSSL
28+
// BoringSSL does not expose EVP_aes_*_wrap via the EVP_CIPHER registry.
29+
// Route AES-KW through low-level AES_wrap_key / AES_unwrap_key instead.
30+
#define VARIANTS_KW(V) \
31+
V(KW_128, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr)) \
32+
V(KW_192, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr)) \
33+
V(KW_256, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr))
34+
#else
35+
#define VARIANTS_KW(V) \
2536
V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW) \
2637
V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW) \
2738
V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
39+
#endif
2840

2941
#if OPENSSL_WITH_AES_OCB
3042
#define VARIANTS_OCB(V) \

‎test/fixtures/webcrypto/supports-level-2.mjs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ export const vectors = {
7474
[false, { name: 'AES-CBC', length: 25 }],
7575
[true, { name: 'AES-GCM', length: 128 }],
7676
[false, { name: 'AES-GCM', length: 25 }],
77-
[!boringSSL, { name: 'AES-KW', length: 128 }],
77+
[true, { name: 'AES-KW', length: 128 }],
7878
[false, { name: 'AES-KW', length: 25 }],
7979
[true, { name: 'HMAC', hash: 'SHA-256' }],
8080
[true, { name: 'HMAC', hash: 'SHA-256', length: 256 }],
@@ -166,7 +166,7 @@ export const vectors = {
166166
[true, 'AES-CTR'],
167167
[true, 'AES-CBC'],
168168
[true, 'AES-GCM'],
169-
[!boringSSL, 'AES-KW'],
169+
[true, 'AES-KW'],
170170
[true, { name: 'HMAC', hash: 'SHA-256' }],
171171
[true, { name: 'HMAC', hash: 'SHA-256', length: 256 }],
172172
[false, { name: 'HMAC', hash: 'SHA-256', length: 25 }],
@@ -188,18 +188,18 @@ export const vectors = {
188188
[true, 'AES-CTR'],
189189
[true, 'AES-CBC'],
190190
[true, 'AES-GCM'],
191-
[!boringSSL, 'AES-KW'],
191+
[true, 'AES-KW'],
192192
[true, 'Ed25519'],
193193
[true, 'X25519'],
194194
],
195195
'wrapKey': [
196196
[false, 'AES-KW'],
197-
[!boringSSL, 'AES-KW', 'AES-CTR'],
198-
[!boringSSL, 'AES-KW', 'HMAC'],
197+
[true, 'AES-KW', 'AES-CTR'],
198+
[true, 'AES-KW', 'HMAC'],
199199
],
200200
'unwrapKey': [
201201
[false, 'AES-KW'],
202-
[!boringSSL, 'AES-KW', 'AES-CTR'],
202+
[true, 'AES-KW', 'AES-CTR'],
203203
],
204204
'unsupported operation': [
205205
[false, ''],

‎test/parallel/test-crypto-key-objects-to-crypto-key.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ function assertCryptoKey(cryptoKey, keyObject, algorithm, extractable, usages) {
3131
algorithms.push('ChaCha20-Poly1305');
3232

3333
if (process.features.openssl_is_boringssl) {
34-
algorithms = algorithms.filter((a) => a !== 'AES-KW' && a !== 'ChaCha20-Poly1305');
35-
common.printSkipMessage('Skipping unsupported AES-KW/ChaCha20-Poly1305 test cases');
34+
algorithms = algorithms.filter((a) => a !== 'ChaCha20-Poly1305');
35+
common.printSkipMessage('Skipping unsupported ChaCha20-Poly1305 test case');
3636
}
3737

3838
for (const algorithm of algorithms) {

‎test/parallel/test-webcrypto-deduplicate-usages.js‎

Lines changed: 9 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -42,17 +42,10 @@ function assertSameSet(actual, expected, msg) {
4242
{ algorithm: { name: 'AES-GCM', length: 128 },
4343
usages: ['decrypt', 'encrypt', 'decrypt'],
4444
expected: ['encrypt', 'decrypt'] },
45-
];
46-
47-
if (!process.features.openssl_is_boringssl) {
48-
symmetric.push({
49-
algorithm: { name: 'AES-KW', length: 128 },
45+
{ algorithm: { name: 'AES-KW', length: 128 },
5046
usages: ['wrapKey', 'unwrapKey', 'wrapKey', 'unwrapKey'],
51-
expected: ['wrapKey', 'unwrapKey'],
52-
});
53-
} else {
54-
common.printSkipMessage('AES-KW is not supported in BoringSSL');
55-
}
47+
expected: ['wrapKey', 'unwrapKey'] },
48+
];
5649

5750
if (hasOpenSSL(3)) {
5851
symmetric.push({
@@ -172,17 +165,10 @@ function assertSameSet(actual, expected, msg) {
172165
{ algorithm: { name: 'HMAC', hash: 'SHA-256' }, keyData: new Uint8Array(32),
173166
usages: ['verify', 'sign', 'verify', 'sign'],
174167
expected: ['sign', 'verify'] },
175-
];
176-
177-
if (!process.features.openssl_is_boringssl) {
178-
rawSymmetric.push({
179-
algorithm: { name: 'AES-KW' }, keyData: new Uint8Array(16),
168+
{ algorithm: { name: 'AES-KW' }, keyData: new Uint8Array(16),
180169
usages: ['wrapKey', 'unwrapKey', 'wrapKey'],
181-
expected: ['wrapKey', 'unwrapKey'],
182-
});
183-
} else {
184-
common.printSkipMessage('AES-KW is not supported in BoringSSL');
185-
}
170+
expected: ['wrapKey', 'unwrapKey'] },
171+
];
186172

187173
if (hasOpenSSL(3)) {
188174
// KMAC does not support `raw` format, only `raw-secret` and `jwk`.
@@ -441,17 +427,10 @@ function assertSameSet(actual, expected, msg) {
441427
{ algorithm: { name: 'AES-GCM', length: 128 },
442428
usages: ['decrypt', 'encrypt', 'decrypt'],
443429
expected: ['encrypt', 'decrypt'] },
444-
];
445-
446-
if (!process.features.openssl_is_boringssl) {
447-
jwkVectors.push({
448-
algorithm: { name: 'AES-KW', length: 128 },
430+
{ algorithm: { name: 'AES-KW', length: 128 },
449431
usages: ['wrapKey', 'unwrapKey', 'wrapKey', 'unwrapKey'],
450-
expected: ['wrapKey', 'unwrapKey'],
451-
});
452-
} else {
453-
common.printSkipMessage('AES-KW is not supported in BoringSSL');
454-
}
432+
expected: ['wrapKey', 'unwrapKey'] },
433+
];
455434

456435
if (hasOpenSSL(3)) {
457436
jwkVectors.push({

‎test/parallel/test-webcrypto-derivebits-hkdf.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ const kDerivedKeyTypes = [
2424
['HMAC', 256, 'SHA-256', 'sign', 'verify'],
2525
['HMAC', 256, 'SHA-384', 'sign', 'verify'],
2626
['HMAC', 256, 'SHA-512', 'sign', 'verify'],
27+
['AES-KW', 128, undefined, 'wrapKey', 'unwrapKey'],
28+
['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'],
2729
];
2830

2931
if (!process.features.openssl_is_boringssl) {
3032
kDerivedKeyTypes.push(
31-
['AES-KW', 128, undefined, 'wrapKey', 'unwrapKey'],
32-
['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'],
3333
['HMAC', 256, 'SHA3-256', 'sign', 'verify'],
3434
['HMAC', 256, 'SHA3-384', 'sign', 'verify'],
3535
['HMAC', 256, 'SHA3-512', 'sign', 'verify'],

‎test/parallel/test-webcrypto-keygen.js‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,14 @@ const vectors = {
135135
'deriveBits',
136136
],
137137
},
138+
'AES-KW': {
139+
algorithm: { length: 256 },
140+
result: 'CryptoKey',
141+
usages: [
142+
'wrapKey',
143+
'unwrapKey',
144+
],
145+
}
138146
};
139147

140148
if (!process.features.openssl_is_boringssl) {
@@ -152,14 +160,6 @@ if (!process.features.openssl_is_boringssl) {
152160
'deriveBits',
153161
],
154162
};
155-
vectors['AES-KW'] = {
156-
algorithm: { length: 256 },
157-
result: 'CryptoKey',
158-
usages: [
159-
'wrapKey',
160-
'unwrapKey',
161-
],
162-
};
163163
vectors['ChaCha20-Poly1305'] = {
164164
result: 'CryptoKey',
165165
usages: [
@@ -606,17 +606,10 @@ if (hasOpenSSL(3, 5)) {
606606
[ 'AES-CBC', 256, ['encrypt', 'decrypt']],
607607
[ 'AES-GCM', 128, ['encrypt', 'decrypt']],
608608
[ 'AES-GCM', 256, ['encrypt', 'decrypt']],
609+
[ 'AES-KW', 128, ['wrapKey', 'unwrapKey']],
610+
[ 'AES-KW', 256, ['wrapKey', 'unwrapKey']],
609611
];
610612

611-
if (!process.features.openssl_is_boringssl) {
612-
kTests.push(
613-
[ 'AES-KW', 128, ['wrapKey', 'unwrapKey']],
614-
[ 'AES-KW', 256, ['wrapKey', 'unwrapKey']],
615-
);
616-
} else {
617-
common.printSkipMessage('Skipping unsupported AES-KW test cases');
618-
}
619-
620613
const tests = Promise.all(kTests.map((args) => test(...args)));
621614

622615
tests.then(common.mustCall());

‎test/parallel/test-webcrypto-promise-prototype-pollution.mjs‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -59,21 +59,17 @@ await subtle.deriveKey(
5959
true,
6060
['encrypt', 'decrypt']);
6161

62-
if (!process.features.openssl_is_boringssl) {
63-
const wrappingKey = await subtle.generateKey(
64-
{ name: 'AES-KW', length: 256 }, true, ['wrapKey', 'unwrapKey']);
62+
const wrappingKey = await subtle.generateKey(
63+
{ name: 'AES-KW', length: 256 }, true, ['wrapKey', 'unwrapKey']);
6564

66-
const keyToWrap = await subtle.generateKey(
67-
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
65+
const keyToWrap = await subtle.generateKey(
66+
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
6867

69-
const wrapped = await subtle.wrapKey('raw', keyToWrap, wrappingKey, 'AES-KW');
68+
const wrapped = await subtle.wrapKey('raw', keyToWrap, wrappingKey, 'AES-KW');
7069

71-
await subtle.unwrapKey(
72-
'raw', wrapped, wrappingKey, 'AES-KW',
73-
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
74-
} else {
75-
common.printSkipMessage('Skipping unsupported AES-KW test case');
76-
}
70+
await subtle.unwrapKey(
71+
'raw', wrapped, wrappingKey, 'AES-KW',
72+
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
7773

7874
const { privateKey } = await subtle.generateKey(
7975
{ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);

‎test/parallel/test-webcrypto-wrap-unwrap.js‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,15 @@ const kWrappingData = {
3939
},
4040
pair: false
4141
},
42-
};
43-
44-
if (!process.features.openssl_is_boringssl) {
45-
kWrappingData['AES-KW'] = {
42+
'AES-KW': {
4643
generate: { length: 128 },
4744
wrap: { },
4845
pair: false
49-
};
46+
},
47+
};
48+
49+
50+
if (!process.features.openssl_is_boringssl) {
5051
kWrappingData['ChaCha20-Poly1305'] = {
5152
wrap: {
5253
iv: new Uint8Array(12),
@@ -56,7 +57,7 @@ if (!process.features.openssl_is_boringssl) {
5657
pair: false
5758
};
5859
} else {
59-
common.printSkipMessage('Skipping unsupported AES-KW test case');
60+
common.printSkipMessage('Skipping unsupported ChaCha20-Poly1305 test case');
6061
}
6162

6263
if (hasOpenSSL(3)) {
@@ -188,20 +189,15 @@ async function generateKeysToWrap() {
188189
usages: ['sign', 'verify'],
189190
pair: false,
190191
},
191-
];
192-
193-
if (!process.features.openssl_is_boringssl) {
194-
parameters.push({
192+
{
195193
algorithm: {
196194
name: 'AES-KW',
197195
length: 128
198196
},
199197
usages: ['wrapKey', 'unwrapKey'],
200198
pair: false,
201-
});
202-
} else {
203-
common.printSkipMessage('Skipping unsupported AES-KW test case');
204-
}
199+
},
200+
];
205201

206202
if (!process.features.openssl_is_boringssl) {
207203
parameters.push({

0 commit comments

Comments
 (0)