Repository navigation
fix: export alg in AES, DES and HMAC JWKs again - #101
Merged
Merged
Conversation
Since 1.6.0, exportKey("jwk") returned alg "" for AES, DES and HMAC
keys (1.5.0 returned A256GCM, HS256, ...). The ES2022 build defines
class fields on the instance, so the `alg = ""` field in the base
CryptoKey hid the alg getters of AesCryptoKey, DesCryptoKey and
HmacCryptoKey. The base alg is now an accessor, so the subclass
getters apply again and the @ts-ignore comments are gone.
AES and HMAC values match Node.js WebCrypto (A128CBC, A256GCM, A256KW,
HS256, ...). Key import is unchanged: the JWK alg is still not checked.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 1.6.0,
exportKey("jwk", key)returnsalg: ""for AES, DES and HMAC keys. 1.4.6 and 1.5.0 exportedA256GCM,HS256and so on. Nobody has reported it.A256GCM""A256GCMA256GCMHS256""HS256HS256Cause: the build targets ES2022, which defines class fields on the instance. The
protected alg = ""field in the baseCryptoKey(src/keys/key.ts) therefore became an own property that hid thealggetters ofAesCryptoKey,DesCryptoKeyandHmacCryptoKey.Fix: the base
algis now an accessor (still decorated with@JsonProp), so the subclass getters apply again. The// @ts-ignoreabove those getters is replaced withoverride. RSA, EC and Ed keys build their own JWK and are unaffected. Key import is unchanged: the JWKalgis still not checked against the requested algorithm (#38).Tests:
src/keys/key.spec.tscovers AES-CBC/CTR/GCM/KW/ECB/CMAC, HMAC SHA-1/256/512 and 3DES. It checks generate → export → import → export, and compares against Node.js WebCrypto. All 12 cases fail on master and pass here. I also checked the builtbuild/webcrypto.jsandbuild/webcrypto.es.jsdirectly.Release: this goes in before the v2 stack, so it ships on the 1.x build. The release-please dry run finds v1.7.1 and proposes
chore(release): v1.7.2with this fix. #97 and the rest of the stack get rebased on top afterwards, so the fix is also in 2.0.0.