fix: EC named-curve match, on-curve check, uncompressed SPKI export#1027
Merged
fix: EC named-curve match, on-curve check, uncompressed SPKI export#1027
Conversation
…1005) D.1 — After SPKI/PKCS#8 import, validate the parsed curve OID matches algorithm.namedCurve; reject with DataError('Named curve mismatch'), matching Node's behavior. D.2 — Add KeyObjectHandle.checkEcKeyData() backed by ncrypto's EVPKeyCtxPointer::publicCheck/privateCheck (EVP_PKEY_public_check_quick / EVP_PKEY_check). Called post-import so points are verified to lie on the named curve. D.3 — In subtle.ecExportKey, detect compressed-form SPKI by length and re-export uncompressed: rebuild 0x04||x||y from JWK coordinates and round-trip via initECRaw, so spki output is always WebCrypto-compliant.
…atch test Address review feedback on the #1005 EC export fix: - Replace the silent fallback in ecExportKey when the JWK lacks x/y or initECRaw fails — emit OperationError instead so callers never receive a non-WebCrypto-compliant compressed SPKI. - Drop redundant ArrayBuffer slice on a fresh Uint8Array. - Drop misleading comment on kUncompressedSpkiLength. - Add a PKCS#8 named-curve mismatch test alongside the existing SPKI one.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🤖 End-to-End Test Results - AndroidStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
Contributor
🤖 End-to-End Test Results - iOSStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the three EC-specific WebCrypto gaps tracked in #1005:
algorithm.namedCurveand rejects mismatches withDataError('Named curve mismatch'), matching Node'secImportKey.KeyObjectHandle.checkEcKeyData()Nitro method delegates to ncrypto'sEVPKeyCtxPointer::publicCheck()/privateCheck()(backed byEVP_PKEY_public_check_quick/EVP_PKEY_check) to verify the point lies on the named curve post-import.subtle.ecExportKeydetects compressed-form SPKI by byte length (91/120/158 for P-256/P-384/P-521) and re-exports uncompressed by reconstructing0x04 || x || yfrom the JWK coordinates and round-tripping throughinitECRaw. Falls back toOperationErrorif the rebuild can't be performed.Changes
packages/react-native-quick-crypto/cpp/keys/HybridKeyObjectHandle.{cpp,hpp}—checkEcKeyData()implementation.packages/react-native-quick-crypto/nitrogen/generated/...— regenerated Nitro bindings for the new method.packages/react-native-quick-crypto/src/specs/keyObjectHandle.nitro.ts— TS spec for the new native method.packages/react-native-quick-crypto/src/ec.ts— curve-OID match check after SPKI/PKCS#8 import; on-curve check after all non-JWK imports.packages/react-native-quick-crypto/src/subtle.ts— uncompressed-SPKI re-export path withOperationErroron rebuild failure.example/src/tests/subtle/import_export.ts— three new tests:EC SPKI import rejects named-curve mismatch (#1005)— P-256 SPKI imported as P-384 →DataError.EC PKCS#8 import rejects named-curve mismatch (#1005)— P-256 PKCS#8 imported as P-384 →DataError.EC SPKI export forces uncompressed point (#1005)— hand-rolled compressed P-256 SPKI round-trips to a 91-byte uncompressed SPKI.Test plan
subtle/import_exportsuite passes, including the three new#1005tests.bun tscis clean across packages.Fixes #1005
🤖 Generated with Claude Code