fixup! crypto: allow CryptoKeys in create*Key

nodejs · tniessen · Feb 5, 2021 · Feb 5, 2021 · Feb 6, 2021 · Feb 6, 2021
commit 01555406d61ebec838aa446eac1345c5da934c25
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
@@ -72,8 +72,9 @@ const kKeyUsages = Symbol('kKeyUsages');
 // Key input contexts.
 const kConsumePublic = 0;
 const kConsumePrivate = 1;
-const kCreatePublic = 2;
-const kCreatePrivate = 3;
+const kCreateContextFlag = 2;
+const kCreatePublic = kConsumePublic | kCreateContextFlag;
+const kCreatePrivate = kConsumePrivate | kCreateContextFlag;
 
 const encodingNames = [];
 for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
@@ -404,7 +405,7 @@ function prepareAsymmetricKey(key, ctx) {
     // Best case: A key object, as simple as that.
     return { data: getKeyObjectHandle(key, ctx) };
   } else if (isCryptoKey(key)) {
-    const actualCtx = (ctx === kCreatePublic) ? kConsumePublic : ctx;
+    const actualCtx = ctx & ~kCreateContextFlag;
     return { data: getKeyObjectHandle(key[kKeyObject], actualCtx) };
   } else if (isStringOrBuffer(key)) {
     // Expect PEM by default, mostly for backward compatibility.
@@ -416,7 +417,7 @@ function prepareAsymmetricKey(key, ctx) {
     if (isKeyObject(data)) {
       return { data: getKeyObjectHandle(data, ctx) };
     } else if (isCryptoKey(data)) {
-      const actualCtx = (ctx === kCreatePublic) ? kConsumePublic : ctx;
+      const actualCtx = ctx & ~kCreateContextFlag;
       return { data: getKeyObjectHandle(data[kKeyObject], actualCtx) };
     }
     // Either PEM or DER using PKCS#1 or SPKI.
@@ -472,7 +473,7 @@ function prepareSecretKey(key, encoding, bufferOnly = false) {
 }
 
 function createSecretKey(key, encoding) {
-  key = prepareSecretKey(key, encoding, true);
+  key = prepareSecretKey(key, encoding, false);
   if (key.byteLength === 0)
     throw new ERR_OUT_OF_RANGE('key.byteLength', '> 0', key.byteLength);
   const handle = new KeyObjectHandle();

diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
@@ -952,7 +952,7 @@ void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
     CHECK_EQ(args.Length(), 5);
 
     offset = 1;
-    pkey = ManagedEVPPKey::GetPrivateKeyFromJs(args, &offset, false);
+    pkey = ManagedEVPPKey::GetPrivateKeyFromJs(args, &offset, true);
     if (!pkey)
       return;
     key->data_ = KeyObjectData::CreateAsymmetric(type, pkey);

diff --git a/test/parallel/test-webcrypto-to-keyobject.js b/test/parallel/test-webcrypto-to-keyobject.js
@@ -0,0 +1,48 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { Buffer } = require('buffer');
+const {
+  createSecretKey,
+  createPublicKey,
+  createPrivateKey,
+  webcrypto: { subtle }
+} = require('crypto');
+
+(async function() {
+  const { publicKey, privateKey } = await subtle.generateKey({
+    name: 'RSA-OAEP',
+    modulusLength: 1024,
+    publicExponent: Buffer.from([1, 0, 1]),
+    hash: 'SHA-256'
+  }, false, ['encrypt', 'decrypt']);
+
+  const nodePublicKey = createPublicKey(publicKey);
+  assert.strictEqual(nodePublicKey.type, 'public');
+  assert.strictEqual(nodePublicKey.asymmetricKeyType, 'rsa');
+  assert.strictEqual(nodePublicKey.asymmetricKeyDetails.modulusLength, 1024);
+
+  const nodePublicKeyFromPrivate = createPublicKey(privateKey);
+  assert.strictEqual(nodePublicKeyFromPrivate.type, 'public');
+  assert.strictEqual(nodePublicKeyFromPrivate.asymmetricKeyType, 'rsa');
+  assert.strictEqual(
+    nodePublicKeyFromPrivate.asymmetricKeyDetails.modulusLength, 1024);
+
+  const nodePrivateKey = createPrivateKey(privateKey);
+  assert.strictEqual(nodePrivateKey.type, 'private');
+  assert.strictEqual(nodePrivateKey.asymmetricKeyType, 'rsa');
+  assert.strictEqual(nodePrivateKey.asymmetricKeyDetails.modulusLength, 1024);
+
+  const aesKey = await subtle.generateKey({
+    name: 'AES-GCM',
+    length: 256
+  }, false, ['encrypt', 'decrypt']);
+
+  const nodeSecretKey = createSecretKey(aesKey);
+  assert.strictEqual(nodeSecretKey.type, 'secret');
+  assert.strictEqual(nodeSecretKey.symmetricKeySize, 32);
+})().then(common.mustCall());