Skip to content

crypto: fix non-multiple of 8 in SubtleCrypto.deriveBits#55296

Closed
panva wants to merge 1 commit intonodejs:mainfrom
panva:non-8-slice
Closed

crypto: fix non-multiple of 8 in SubtleCrypto.deriveBits#55296
panva wants to merge 1 commit intonodejs:mainfrom
panva:non-8-slice

Conversation

@panva
Copy link
Member

@panva panva commented Oct 6, 2024

A WPT update made me look into this.

From the Node.js docs:

The Node.js implementation requires that length, when a number, is a multiple
of 8.

This was never true, instead the implementation returned the closest full byte length.

At the moment the browser implementations do the following

  • Chromium aligns with this PR (and the updated WPTs)
  • Firefox throws DataError
  • Safari aligns with Node.js prior to this PR

There's no interop on this in the first place and there's a pending decision around disallowing truncation in ECDH/X25519/X448 altogether in a future spec update.

Given that this is in my opinion a semver-major PRs that contain breaking changes and should be released in the next major version. change I would rather we only have to do one, i.e. disallow truncation when the spec changes in a major, or fix the implementation with this PR in a major. We've got time to figure out what to do in time for v24.x but i'm opening this to ping @nodejs/crypto and @nodejs/web-standards

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backported-to-v20.x PRs backported to the v20.x-staging branch. backported-to-v22.x PRs backported to the v22.x-staging branch. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. web-standards Issues and PRs related to Web APIs webcrypto

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants