lib,crypto: migrate algorithm modules to native CryptoKey

Every Web Crypto algorithm module drops `key[kKeyObject][kHandle]`
symbol access in favor of `getCryptoKey*` accessors and stores the raw
`KeyObjectHandle` directly (no more `SecretKeyObject`/`PublicKeyObject`/
`PrivateKeyObject` wrappers on the CryptoKey slot). Key generation
moves off the promisified `generateKey`/`generateKeyPair` paths onto
ones that return `KeyObjectHandle` (i.e. not wrapped in KeyObject):

  - `SecretKeyGenJob` for AES, ChaCha20-Poly1305, HMAC/CMAC (aes.js,
    chacha20_poly1305.js, mac.js).
  - `EcKeyPairGenJob` for ECDSA, ECDH (ec.js).
  - `NidKeyPairGenJob` for Ed25519/Ed448/X25519/X448, ML-DSA-{44,65,87},
    ML-KEM-{512,768,1024} (cfrg.js, ml_dsa.js, ml_kem.js).
  - `RsaKeyPairGenJob` for RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP (rsa.js).

`webcrypto_util.js` switches its import helpers (`importDerKey`,
`importJwkKey`, `importRawKey`) to return raw `KeyObjectHandle`s and
adds `importSecretKey` / `importJwkSecretKey` helpers for symmetric
imports. `webcrypto.js` follows the same pattern; its `getPublicKey`
builds a temporary wrapper and carries a TODO for future refactor.
`hkdf.js` switches from `promisify(hkdf)` to
`jobPromise(() => new HKDFJob(...))` directly. `diffiehellman.js`,
`argon2.js`, and `pbkdf2.js` are accessor-only migrations (the
`TODO(panva)` notes on argon2/pbkdf2 are orthogonal and left for a later
cleanup).

Signed-off-by: Filip Skokan <[email protected]>

Author: panva

lib/internal/crypto/aes.js

@@ -7,10 +7,7 @@ const {
 
 const {
   AESCipherJob,
-  KeyObjectHandle,
   kCryptoJobAsync,
-  kKeyFormatJWK,
-  kKeyTypeSecret,
   kKeyVariantAES_CTR_128,
   kKeyVariantAES_CBC_128,
   kKeyVariantAES_GCM_128,
@@ -26,37 +23,32 @@ const {
   kKeyVariantAES_GCM_256,
   kKeyVariantAES_KW_256,
   kKeyVariantAES_OCB_256,
+  SecretKeyGenJob,
 } = internalBinding('crypto');
 
 const {
+  getSortedUsages,
   hasAnyNotIn,
   jobPromise,
   kHandle,
-  kKeyObject,
 } = require('internal/crypto/util');
 
 const {
   lazyDOMException,
-  promisify,
 } = require('internal/util');
 
 const {
   InternalCryptoKey,
-  SecretKeyObject,
-  createSecretKey,
-  kAlgorithm,
+  getCryptoKeyAlgorithm,
+  getCryptoKeyHandle,
 } = require('internal/crypto/keys');
 
 const {
+  importJwkSecretKey,
+  importSecretKey,
   validateJwk,
 } = require('internal/crypto/webcrypto_util');
 
-const {
-  generateKey: _generateKey,
-} = require('internal/crypto/keygen');
-
-const generateKey = promisify(_generateKey);
-
 function getAlgorithmName(name, length) {
   switch (name) {
     case 'AES-CBC': return `A${length}CBC`;
@@ -116,9 +108,9 @@ function asyncAesCtrCipher(mode, key, data, algorithm) {
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
     mode,
-    key[kKeyObject][kHandle],
+    getCryptoKeyHandle(key),
     data,
-    getVariant('AES-CTR', key[kAlgorithm].length),
+    getVariant('AES-CTR', getCryptoKeyAlgorithm(key).length),
     algorithm.counter,
     algorithm.length));
 }
@@ -127,19 +119,19 @@ function asyncAesCbcCipher(mode, key, data, algorithm) {
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
     mode,
-    key[kKeyObject][kHandle],
+    getCryptoKeyHandle(key),
     data,
-    getVariant('AES-CBC', key[kAlgorithm].length),
+    getVariant('AES-CBC', getCryptoKeyAlgorithm(key).length),
     algorithm.iv));
 }
 
 function asyncAesKwCipher(mode, key, data) {
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
     mode,
-    key[kKeyObject][kHandle],
+    getCryptoKeyHandle(key),
     data,
-    getVariant('AES-KW', key[kAlgorithm].length)));
+    getVariant('AES-KW', getCryptoKeyAlgorithm(key).length)));
 }
 
 function asyncAesGcmCipher(mode, key, data, algorithm) {
@@ -149,9 +141,9 @@ function asyncAesGcmCipher(mode, key, data, algorithm) {
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
     mode,
-    key[kKeyObject][kHandle],
+    getCryptoKeyHandle(key),
     data,
-    getVariant('AES-GCM', key[kAlgorithm].length),
+    getVariant('AES-GCM', getCryptoKeyAlgorithm(key).length),
     algorithm.iv,
     tagByteLength,
     algorithm.additionalData));
@@ -164,9 +156,9 @@ function asyncAesOcbCipher(mode, key, data, algorithm) {
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
     mode,
-    key[kKeyObject][kHandle],
+    getCryptoKeyHandle(key),
     data,
-    getVariant('AES-OCB', key.algorithm.length),
+    getVariant('AES-OCB', getCryptoKeyAlgorithm(key).length),
     algorithm.iv,
     tagByteLength,
     algorithm.additionalData));
@@ -196,20 +188,12 @@ async function aesGenerateKey(algorithm, extractable, keyUsages) {
       'SyntaxError');
   }
 
-  let key;
-  try {
-    key = await generateKey('aes', { length });
-  } catch (err) {
-    throw lazyDOMException(
-      'The operation failed for an operation-specific reason' +
-      `[${err.message}]`,
-      { name: 'OperationError', cause: err });
-  }
+  const handle = await jobPromise(() => new SecretKeyGenJob(kCryptoJobAsync, length));
 
   return new InternalCryptoKey(
-    key,
+    handle,
     { name, length },
-    usagesSet,
+    getSortedUsages(usagesSet),
     extractable);
 }
 
@@ -231,60 +215,46 @@ function aesImportKey(
       'SyntaxError');
   }
 
-  let keyObject;
+  let handle;
   let length;
   switch (format) {
     case 'KeyObject': {
-      validateKeyLength(keyData.symmetricKeySize * 8);
-      keyObject = keyData;
+      length = keyData.symmetricKeySize * 8;
+      validateKeyLength(length);
+      handle = keyData[kHandle];
       break;
     }
     case 'raw-secret':
     case 'raw': {
       if (format === 'raw' && name === 'AES-OCB') {
         return undefined;
       }
-      validateKeyLength(keyData.byteLength * 8);
-      keyObject = createSecretKey(keyData);
+      length = keyData.byteLength * 8;
+      validateKeyLength(length);
+      handle = importSecretKey(keyData);
       break;
     }
     case 'jwk': {
       validateJwk(keyData, 'oct', extractable, usagesSet, 'enc');
-
-      const handle = new KeyObjectHandle();
-      try {
-        handle.init(kKeyTypeSecret, keyData, kKeyFormatJWK, null, null);
-      } catch (err) {
-        throw lazyDOMException(
-          'Invalid keyData', { name: 'DataError', cause: err });
-      }
-
-      ({ length } = handle.keyDetail({ }));
+      handle = importJwkSecretKey(keyData);
+      length = handle.getSymmetricKeySize() * 8;
       validateKeyLength(length);
-
       if (keyData.alg !== undefined) {
         if (keyData.alg !== getAlgorithmName(algorithm.name, length))
           throw lazyDOMException(
             'JWK "alg" does not match the requested algorithm',
             'DataError');
       }
-
-      keyObject = new SecretKeyObject(handle);
       break;
     }
     default:
       return undefined;
   }
 
-  if (length === undefined) {
-    ({ length } = keyObject[kHandle].keyDetail({ }));
-    validateKeyLength(length);
-  }
-
   return new InternalCryptoKey(
-    keyObject,
+    handle,
     { name, length },
-    usagesSet,
+    getSortedUsages(usagesSet),
     extractable);
 }
 

lib/internal/crypto/argon2.js

@@ -24,9 +24,12 @@ const {
   promisify,
 } = require('internal/util');
 
+const {
+  getCryptoKeyHandle,
+} = require('internal/crypto/keys');
+
 const {
   getArrayBufferOrView,
-  kKeyObject,
 } = require('internal/crypto/util');
 
 const {
@@ -216,7 +219,8 @@ async function argon2DeriveBits(algorithm, baseKey, length) {
     result = await argon2Promise(
       StringPrototypeToLowerCase(algorithm.name),
       {
-        message: baseKey[kKeyObject].export(),
+        // TODO(panva): call the job directly without needing to re-export the handle
+        message: getCryptoKeyHandle(baseKey).export(),
         nonce: algorithm.nonce,
         parallelism: algorithm.parallelism,
         tagLength: length / 8,