Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using deriveBits (std/crypto) with x25519 crashes #25991

Closed
ChromaLTS opened this issue Oct 2, 2024 · 0 comments · Fixed by #26011
Closed

Using deriveBits (std/crypto) with x25519 crashes #25991

ChromaLTS opened this issue Oct 2, 2024 · 0 comments · Fixed by #26011
Labels
bug Something isn't working correctly crypto Related to node:crypto or WebCrypto

Comments

@ChromaLTS
Copy link

ChromaLTS commented Oct 2, 2024

Describe the bug
crypto.subtle.deriveBits crashes and complains about invalid keys eventho they are correct

Copied the example from mdn

It also seems like the same error happening when using current version chrome without the flag - #enable-experimental-web-platform-features

node also has a fix but behind the flag --experimental-modules

Steps to Reproduce

  1. Create a file "main.ts" with the contents
import { crypto } from "@std/crypto/crypto";

async function deriveSharedSecret(privateKey: any, publicKey: any) {
    return await crypto.subtle.deriveBits(
      {
        name: "X25519",
        public: publicKey,
      },
      privateKey,
      128,
    );
  }
  
async function genKeys() {

    const alicesKeyPair = await crypto.subtle.generateKey(
      {
        name: "X25519",
      },
      false,
      ["deriveBits"],
    )

    const bobsKeyPair = await crypto.subtle.generateKey(
      {
        name: "X25519",
      },
      false,
      ["deriveBits"],
    )


    console.log("Keys changed");
    return {alicesKeyPair, bobsKeyPair}
}


async function runExample(){

  // Generate 2 X25519 key pairs: one for Alice and one for Bob
  // In more normal usage, they would generate their key pairs
  // separately and exchange public keys securely

  // Alice then generates a secret using her private key and Bob's public key.
  // Bob could generate the same secret using his private key and Alice's public key.

  const {alicesKeyPair, bobsKeyPair} = await genKeys()

  const sharedSecretAlice = await deriveSharedSecret(
      //@ts-ignore
    alicesKeyPair.privateKey,
      //@ts-ignore
    bobsKeyPair.publicKey,
  );

  let buffer = new Uint8Array(sharedSecretAlice, 0, 10);
  console.log(`${buffer}…[${sharedSecretAlice.byteLength} bytes total] (Alice secret)`);

  const sharedSecretBob = await deriveSharedSecret(
      //@ts-ignore
    bobsKeyPair.privateKey,
      //@ts-ignore
    alicesKeyPair.publicKey,
  );

  buffer = new Uint8Array(sharedSecretBob, 0, 10);
  console.log(`${buffer}…[${sharedSecretAlice.byteLength} bytes total] (Bob secret)`);
}

if (import.meta.main) {
    runExample()
}
  1. Execute the command deno run main.ts
  2. See error
    -->
error: Uncaught (in promise) OperationError: Invalid key
    return await crypto.subtle.deriveBits(
                               ^
    at deriveBits (ext:deno_crypto/00_crypto.js:4514:15)
    at SubtleCrypto.deriveBits (ext:deno_crypto/00_crypto.js:1151:26)
    at deriveSharedSecret (redacted)
    at Object.redacted (redacted)
    at async redacted 

Expected behavior

234,189,125,157,50,51,232,127,158,251…[16 bytes total] (Alice secret)
234,189,125,157,50,51,232,127,158,251…[16 bytes total] (Bob secret)

Environment

Deno --version
deno 1.46.3 (stable, release, x86_64-pc-windows-msvc)
v8 12.9.202.5-rusty
typescript 5.5.2
  • OS: Windows 10
  • deno version: 1.46.3
  • std version: Whatever version ships with 1.46.3
@ChromaLTS ChromaLTS added bug Something isn't working correctly needs triage labels Oct 2, 2024
@littledivy littledivy transferred this issue from denoland/std Oct 2, 2024
@littledivy littledivy changed the title Using std/crypto with x25519 crashes Using deriveBits (std/crypto) with x25519 crashes Oct 2, 2024
@littledivy littledivy added crypto Related to node:crypto or WebCrypto and removed needs triage labels Oct 2, 2024
littledivy added a commit to littledivy/deno that referenced this issue Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working correctly crypto Related to node:crypto or WebCrypto
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants