node/test/parallel/test-webcrypto-derivekey.js

// Flags: --expose-internals
'use strict';

const common = require('../common');

if (!common.hasCrypto)
  common.skip('missing crypto');

const { hasFIPS, isBoringSSL } = require('../common/crypto');

const assert = require('assert');
const { subtle } = globalThis.crypto;
const { getCryptoKeyHandle } = require('internal/crypto/keys');
const rejectsXCurves = hasFIPS(3, 5);
const fips4 = hasFIPS(4);

// This is only a partial test. The WebCrypto Web Platform Tests
// will provide much greater coverage.

// Test ECDH key derivation
{
  async function test(namedCurve) {
    const [alice, bob] = await Promise.all([
      subtle.generateKey({ name: 'ECDH', namedCurve }, true, ['deriveKey']),
      subtle.generateKey({ name: 'ECDH', namedCurve }, true, ['deriveKey']),
    ]);

    const [secret1, secret2] = await Promise.all([
      subtle.deriveKey({
        name: 'ECDH', namedCurve, public: alice.publicKey
      }, bob.privateKey, {
        name: 'AES-CBC',
        length: 256
      }, true, ['encrypt']),
      subtle.deriveKey({
        name: 'ECDH', namedCurve, public: bob.publicKey
      }, alice.privateKey, {
        name: 'AES-CBC',
        length: 256
      }, true, ['encrypt']),
    ]);

    const [raw1, raw2] = await Promise.all([
      subtle.exportKey('raw', secret1),
      subtle.exportKey('raw', secret2),
    ]);

    assert.deepStrictEqual(raw1, raw2);
  }

  test('P-521').then(common.mustCall());
}

// Test HKDF key derivation
{
  async function test(pass, info, salt, hash, expected) {
    const ec = new TextEncoder();
    const key = await subtle.importKey(
      'raw',
      ec.encode(pass),
      { name: 'HKDF', hash },
      false, ['deriveKey']);

    const secret = await subtle.deriveKey({
      name: 'HKDF',
      hash,
      salt: ec.encode(salt),
      info: ec.encode(info)
    }, key, {
      name: 'AES-CTR',
      length: 256
    }, true, ['encrypt']);

    const raw = await subtle.exportKey('raw', secret);

    assert.strictEqual(Buffer.from(raw).toString('hex'), expected);
  }

  const kTests = [
    ['hello hello hello', 'there', 'my friend indeed', 'SHA-1',
     'aac1ecdc73147af6a418393da6875bff5f566c0a473e25d54b4dfc3cb7cb2ace'],
    ['hello hello hello', 'there', 'my friend indeed', 'SHA-256',
     'bc2b7841512a6f4563f723c317909ac305ddbfbdec1daf0055d0587b5db8d635'],
    ['hello hello hello', 'there', 'my friend indeed', 'SHA-384',
     'ee2d1d7dc759c26f2ab8ee6d7cfa0c2313e82650a4514673c867063dc1849040'],
    ['hello hello hello', 'there', 'my friend indeed', 'SHA-512',
     'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'],
  ];

  if (!isBoringSSL) {
    kTests.push(
      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256',
       '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'],
      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-384',
       'b4fa7b9929a595bbaa370eb959b194c1232d5a329abd02a5fa166a1424962fcf'],
      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-512',
       'ac5d90a6bc848961e78a491887539b29c532a9c0d0b39cec464df071a63e0061'],
    );
  } else {
    common.printSkipMessage('SHA-3 is only supported for digest operations');
  }

  const tests = Promise.all(kTests.map((args) => test(...args)));

  tests.then(common.mustCall());
}

// Test PBKDF2 key derivation
{
  async function test(pass, salt, iterations, hash, expected) {
    const ec = new TextEncoder();
    const key = await subtle.importKey(
      'raw',
      ec.encode(pass),
      { name: 'PBKDF2', hash },
      false, ['deriveKey']);
    const secret = await subtle.deriveKey({
      name: 'PBKDF2',
      hash,
      salt: ec.encode(salt),
      iterations,
    }, key, {
      name: 'AES-CTR',
      length: 256
    }, true, ['encrypt']);

    const raw = await subtle.exportKey('raw', secret);

    assert.strictEqual(Buffer.from(raw).toString('hex'), expected);
  }

  const kTests = [
    ['hello hello hello', 'my friend indeed', 1000, 'SHA-1',
     'b747604ca226287ccae90d8d8c119645a80d1154625a56b2debb3f9b172eb134'],
    ['hello hello hello', 'my friend indeed', 1000, 'SHA-256',
     '3cc64f6cfcbdb9c42b63b471016f17d1966b70934b4719a12ce95382940252f2'],
    ['hello hello hello', 'my friend indeed', 1000, 'SHA-384',
     '5ce64241beef3a3931dbfac6eef7303b5bdbea13449d4eeb4f89c3e9f9357c65'],
    ['hello hello hello', 'my friend indeed', 1000, 'SHA-512',
     '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'],
  ];

  if (!isBoringSSL) {
    kTests.push(
      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256',
       '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'],
      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-384',
       'a2e86a2d4cdf9844d70ae37f71302356ce2b9a899f5d778fc9af64d32e351d70'],
      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-512',
       '03431052c37d626ae3fc1df582ff2a4d610642fc27e1b8130ca5980c0b0756ac']
    );
  } else {
    common.printSkipMessage('SHA-3 is only supported for digest operations');
  }

  const promises = kTests.map((args) => test(...args));
  if (fips4) {
    promises.push(assert.rejects(
      test('hello', 'there', 5, 'SHA-256', ''),
      { name: 'OperationError' }));
  }
  const tests = Promise.all(promises);

  tests.then(common.mustCall());
}

// Test default key lengths
{
  const vectors = [
    ['PBKDF2', 'deriveKey', 528],
    ['HKDF', 'deriveKey', 528],
    [{ name: 'HMAC', hash: 'SHA-1' }, 'sign', 512],
    [{ name: 'HMAC', hash: 'SHA-256' }, 'sign', 512],
    // Not long enough secret generated by ECDH
    [{ name: 'HMAC', hash: 'SHA-384' }, 'sign', 1024],
    [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
  ];

  if (!isBoringSSL) {
    vectors.push(
      [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
      [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
      [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512]
      // This interaction is not defined for now.
      // https://github.com/WICG/webcrypto-modern-algos/issues/23
      // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
      // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
      // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
    );
  } else {
    common.printSkipMessage('SHA-3 is only supported for digest operations');
  }

  if (!isBoringSSL) {
    vectors.push(
      ['KMAC128', 'sign', 128],
      [{ name: 'KMAC128', length: 384 }, 'sign', 384],
      ['KMAC256', 'sign', 256],
      [{ name: 'KMAC256', length: 384 }, 'sign', 384],
    );
  }

  (async () => {
    const keyPair = await subtle.generateKey({ name: 'ECDH', namedCurve: 'P-521' }, false, ['deriveKey']);
    for (const [derivedKeyAlgorithm, usage, expected] of vectors) {
      const [result] = await Promise.allSettled([subtle.deriveKey(
        { name: 'ECDH', public: keyPair.publicKey },
        keyPair.privateKey,
        derivedKeyAlgorithm,
        false,
        [usage])]);

      if (expected > 528) {
        assert.strictEqual(result.status, 'rejected');
        assert.match(result.reason.message, /derived bit length is too small/);
      } else {
        assert.strictEqual(result.status, 'fulfilled');
        const derived = result.value;
        if (derived.algorithm.name === 'HMAC' || derived.algorithm.name.startsWith('KMAC')) {
          assert.strictEqual(derived.algorithm.length, expected);
        } else {
          // KDFs cannot be exportable and do not indicate their length
          assert.strictEqual(getCryptoKeyHandle(derived).getSymmetricKeySize(),
                             expected / 8);
        }
      }
    }
  })().then(common.mustCall());
}

{
  const vectors = [
    [{ name: 'HMAC', hash: 'SHA-1' }, 'sign', 512],
    [{ name: 'HMAC', hash: 'SHA-256' }, 'sign', 512],
    [{ name: 'HMAC', hash: 'SHA-384' }, 'sign', 1024],
    [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
  ];

  if (!isBoringSSL) {
    vectors.push(
      [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
      [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
      [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512],
      // This interaction is not defined for now.
      // https://github.com/WICG/webcrypto-modern-algos/issues/23
      // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
      // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
      // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
    );
  } else {
    common.printSkipMessage('SHA-3 is only supported for digest operations');
  }

  if (!isBoringSSL) {
    vectors.push(
      ['KMAC128', 'sign', 128],
      [{ name: 'KMAC128', length: 384 }, 'sign', 384],
      ['KMAC256', 'sign', 256],
      [{ name: 'KMAC256', length: 384 }, 'sign', 384],
    );
  }

  (async () => {
    for (const [derivedKeyAlgorithm, usage, expected] of vectors) {
      const derived = await subtle.deriveKey(
        {
          name: 'PBKDF2',
          salt: new Uint8Array(16),
          hash: 'SHA-256',
          iterations: 1000,
        },
        await subtle.importKey(
          'raw',
          new Uint8Array(8),
          { name: 'PBKDF2' },
          false,
          ['deriveKey']),
        derivedKeyAlgorithm,
        false,
        [usage]);

      assert.strictEqual(derived.algorithm.length, expected);
    }
  })().then(common.mustCall());
}

if (!isBoringSSL) {
  (async () => {
    const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
    const usages = ['sign'];
    for (const [algorithm, baseKeyAlgorithm] of [
      [
        {
          name: 'HKDF',
          salt: new Uint8Array(16),
          info: new Uint8Array(),
          hash: 'SHA-256',
        },
        { name: 'HKDF' },
      ],
      [
        {
          name: 'PBKDF2',
          salt: new Uint8Array(16),
          hash: 'SHA-256',
          iterations: 1000,
        },
        { name: 'PBKDF2' },
      ],
    ]) {
      const baseKey = await subtle.importKey(
        'raw',
        new Uint8Array(baseKeyAlgorithm.name === 'HKDF' ? 16 : 8),
        baseKeyAlgorithm,
        false,
        ['deriveKey']);
      await assert.rejects(
        subtle.deriveKey(algorithm, baseKey, derivedKeyAlgorithm, false, usages),
        { name: 'NotSupportedError', message: 'Invalid key length' });
    }
  })().then(common.mustCall());
}

// Test X25519 and X448 key derivation
{
  async function test(name) {
    const [alice, bob] = await Promise.all([
      subtle.generateKey({ name }, true, ['deriveKey']),
      subtle.generateKey({ name }, true, ['deriveKey']),
    ]);

    const [secret1, secret2] = await Promise.all([
      subtle.deriveKey({
        name, public: alice.publicKey
      }, bob.privateKey, {
        name: 'AES-CBC',
        length: 256
      }, true, ['encrypt']),
      subtle.deriveKey({
        name, public: bob.publicKey
      }, alice.privateKey, {
        name: 'AES-CBC',
        length: 256
      }, true, ['encrypt']),
    ]);

    const [raw1, raw2] = await Promise.all([
      subtle.exportKey('raw', secret1),
      subtle.exportKey('raw', secret2),
    ]);

    assert.deepStrictEqual(raw1, raw2);
  }

  if (rejectsXCurves) {
    for (const name of ['X25519', 'X448']) {
      assert.rejects(
        test(name),
        { name: 'NotSupportedError', message: 'Unrecognized algorithm name' })
        .then(common.mustCall());
    }
  } else {
    test('X25519').then(common.mustCall());
    if (!isBoringSSL) {
      test('X448').then(common.mustCall());
    } else {
      common.printSkipMessage('Skipping unsupported X448 test case');
    }
  }
}