Repository navigation
Conversation
Implement the PBKDF2 slice of WebCrypto on StarlingMonkey: - CryptoAlgorithmPBKDF2_Import: importKey for 'raw' PBKDF2 password material, producing a non-extractable secret CryptoKey usable for deriveBits (and, once implemented, deriveKey). - CryptoAlgorithmDeriveBits: new base class for algorithms that support the deriveBits operation. - CryptoAlgorithmPBKDF2_DeriveBits: PBKDF2 deriveBits backed by OpenSSL PKCS5_PBKDF2_HMAC, supporting SHA-1/256/384/512. - SubtleCrypto.deriveBits entry point following the WebCrypto algorithm steps, including [EnforceRange] coercion of the optional length parameter. - Shared CryptoKey helpers: createSymmetric (refactored out of createHMAC), canEncrypt/canDecrypt/canDeriveBits usage checks, and canOnlyDeriveBitsOrKey. hmacKeyData is renamed to keyData. Enables use cases such as the HUMAN Security _px3 cookie scheme on Fastly Compute, which requires PBKDF2-HMAC-SHA256 key derivation before AES-256-CBC decryption. Integration tests cover SHA-1/256/384/512 vectors (including an RFC 7914 4096-iteration vector), zero and non-multiple-of-8 lengths, empty password import, usage checks, and parameter coercion. WPT pbkdf2.https.any.js is enabled with recorded expectations; deriveKey and wrong-ECDH-key subtests are expected-fail until deriveKey and ECDH are implemented.
Author
|
Will create another PR to Add AES-CBC importKey and SubtleCrypto encrypt/decrypt (draco2003#2) if / when the current PR gets feedback/is acceptable. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implement the PBKDF2 slice of WebCrypto on StarlingMonkey:
Integration tests cover SHA-1/256/384/512 vectors (including an RFC 7914 4096-iteration vector), zero and non-multiple-of-8 lengths, empty password import, usage checks, and parameter coercion. WPT pbkdf2.https.any.js is enabled with recorded expectations; deriveKey and wrong-ECDH-key subtests are expected-fail until deriveKey and ECDH are implemented.