[v24.x backport] more (web)crypto by panva · Pull Request #64629 · nodejs/node

panva · 2026-07-20T13:50:31Z

backports of:

As requested by @aduh95

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63104 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63134 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

Move KeyObject.prototype.toCryptoKey() onto the base KeyObject class and dispatch from the cached native key type. Both secret and asymmetric conversions now pass a KeyObjectHandle through the Web Crypto import paths. Expose KeyObjectHandle.prototype.getKeyType() so asymmetric importers can validate public/private usages without wrapping the handle back into a KeyObject. Secret importers likewise consume KeyObjectHandle directly. Use the shared asymmetric conversion helper to derive public CryptoKeys for SubtleCrypto.getPublicKey(), avoiding the temporary PrivateKeyObject/createPublicKey round trip while keeping usage validation in the import path. Update getPublicKey and KeyObject.toCryptoKey tests to be driven from the Web Crypto supported-algorithm registry so new algorithms require either coverage or an explicit skip. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63622 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

nodejs-github-bot · 2026-07-20T13:50:37Z

Review requested:

@nodejs/crypto

codecov · 2026-07-20T16:18:07Z

Codecov Report

❌ Patch coverage is 89.97883% with 142 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.89%. Comparing base (b881658) to head (1526f76).
⚠️ Report is 406 commits behind head on v24.x-staging.

Files with missing lines	Patch %	Lines
src/crypto/crypto_hash.cc	67.14%	33 Missing and 35 partials ⚠️
src/crypto/crypto_keys.cc	63.33%	2 Missing and 20 partials ⚠️
src/crypto/crypto_kmac.cc	71.42%	4 Missing and 10 partials ⚠️
src/crypto/crypto_util.cc	42.85%	7 Missing and 5 partials ⚠️
src/crypto/crypto_sig.cc	75.00%	2 Missing and 6 partials ⚠️
lib/internal/crypto/hash.js	89.58%	5 Missing ⚠️
lib/internal/crypto/util.js	90.90%	5 Missing ⚠️
lib/internal/crypto/keys.js	97.91%	4 Missing ⚠️
lib/internal/crypto/webidl.js	96.42%	2 Missing ⚠️
src/crypto/crypto_hash.h	33.33%	2 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##           v24.x-staging   #64629      +/-   ##
=================================================
- Coverage          89.92%   89.89%   -0.03%     
=================================================
  Files                686      695       +9     
  Lines             208389   213817    +5428     
  Branches           40077    41063     +986     
=================================================
+ Hits              187387   192207    +4820     
- Misses             13238    13671     +433     
- Partials            7764     7939     +175

Files with missing lines	Coverage Δ
lib/internal/crypto/aes.js	`93.72% <100.00%> (+5.30%)`	⬆️
lib/internal/crypto/cfrg.js	`96.03% <100.00%> (-0.24%)`	⬇️
lib/internal/crypto/chacha20_poly1305.js	`98.23% <100.00%> (+5.50%)`	⬆️
lib/internal/crypto/cipher.js	`98.31% <100.00%> (+0.04%)`	⬆️
lib/internal/crypto/diffiehellman.js	`97.69% <100.00%> (+0.27%)`	⬆️
lib/internal/crypto/ec.js	`96.88% <100.00%> (+0.67%)`	⬆️
lib/internal/crypto/hkdf.js	`100.00% <100.00%> (+4.02%)`	⬆️
lib/internal/crypto/keygen.js	`98.43% <100.00%> (+0.29%)`	⬆️
lib/internal/crypto/mac.js	`98.99% <100.00%> (+7.90%)`	⬆️
lib/internal/crypto/ml_dsa.js	`97.52% <100.00%> (+2.33%)`	⬆️
... and 20 more

... and 194 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-07-20T17:25:06Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74920/

aduh95 · 2026-07-20T21:15:40Z

wpt.test-webcrypto is failing on OpenSSL 1.1.1 and OpenSSL 3.0

panva added the commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. label

You might already know that, but there's no CQ on staging branches

PR-URL: nodejs#63900 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Introduce prepareSubtleMethod() and convertSubtleArgument() for the common SubtleCrypto call prelude. Methods now reuse the same receiver check, required-argument check, error prefix construction, argument context selection, and WebIDL conversion path. Introduce WebCrypto key usage helpers for common usage validation and key pair usage splitting. Algorithm modules now define their allowed public, private, and key generation usages once, then call the shared helpers from generateKey() and importKey() paths. This removes repeated function-invocation setup in webcrypto.js and repeated key usage checks across the WebCrypto algorithm modules while preserving the existing validation behavior. Mark normalized-algorithm fallback branches as unreachable assertions. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63975 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add shared bit-length helpers for WebCrypto operations that accept bit sequences whose length is not byte-aligned. Use the helpers for cSHAKE output, ECDH-derived bits, HMAC/KMAC key generation/import/derivation, and KMAC sign/verify output. Preserve the requested bit length in CryptoKey algorithm metadata while storing and exporting rounded-up byte material with unused low bits cleared. Keep byte-multiple validation for algorithms whose specs require it. Extend the lower-end of KMAC's key length support. Enable cSHAKE customization and functionName parameters. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63988 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Return false for Ed25519 and Ed448 one-shot verification when the public key or signature R component is a known low-order point. This keeps key import behavior unchanged while making WebCrypto verification match WPT expectations across OpenSSL variants. Remove the stale WPT expected-failure entry and add focused regression coverage for both curves. Closes: nodejs#54572 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64026 Fixes: nodejs#54572 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64033 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

nodejs-github-bot · 2026-07-21T05:34:35Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74938/

panva · 2026-07-21T05:35:27Z

You might already know that, but there's no CQ on staging branches

🤷

panva · 2026-07-21T07:36:20Z

wpt.test-webcrypto is failing on OpenSSL 1.1.1 and OpenSSL 3.0

fixed

panva added 4 commits July 20, 2026 15:37

crypto: improve accuracy of SubtleCrypto.supports

5a064fd

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63104 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

crypto: reject invalid raw key imports

cbcbcd7

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63134 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com>

crypto: coerce -0 to +0 before native calls

d72b7e7

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

panva requested a review from aduh95 July 20, 2026 13:50

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Jul 20, 2026

aduh95 approved these changes Jul 20, 2026

View reviewed changes

aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 20, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 20, 2026

panva added the commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. label Jul 20, 2026

nodejs-github-bot and others added 5 commits July 21, 2026 02:56

test: update WPT for WebCryptoAPI to 03a1476844

532597c

PR-URL: nodejs#63900 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

lib: fix missing lazyDOMException import

1526f76

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64033 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

panva force-pushed the backport-webcrypto-24 branch from 8274402 to 1526f76 Compare July 21, 2026 00:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[v24.x backport] more (web)crypto#64629

[v24.x backport] more (web)crypto#64629
panva wants to merge 9 commits into
nodejs:v24.x-stagingfrom
panva:backport-webcrypto-24

panva commented Jul 20, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 20, 2026

Uh oh!

codecov Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 20, 2026

Uh oh!

aduh95 commented Jul 20, 2026

Uh oh!

nodejs-github-bot commented Jul 21, 2026

Uh oh!

panva commented Jul 21, 2026

Uh oh!

panva commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

panva commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 20, 2026

Uh oh!

codecov Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Jul 20, 2026

Uh oh!

aduh95 commented Jul 20, 2026

Uh oh!

nodejs-github-bot commented Jul 21, 2026

Uh oh!

panva commented Jul 21, 2026

Uh oh!

panva commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

panva commented Jul 20, 2026 •

edited

Loading

codecov Bot commented Jul 20, 2026 •

edited

Loading