1545813 - Can't Clone CryptoKey when algorithm is ECDSA

Status: RESOLVED INCOMPLETE

(Core :: DOM: Web Crypto, defect, P2)

Description

[qmatillat]

Attachment: index.html

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

Generate an ECDSA key
Save it in indexedDB
(see index.html that reproduce this issue)

Actual results:

The keys are not stored in database, with the error "DataCloneError: The object could not be cloned."

Expected results:

The keys should be stored in database (as it occur with other keys type, like RSA-PSS)

Comment 1

[Alin Ilea, Desktop QA]

tested on Ubuntu 16.04 with:
66.0.3 20190409155332
68.0a1 20190423095327

I can see the reported console error using the index.html test scenario, but I cannot say if the test case is valid or not. Let's move out of untriaged for a better informed opinion.

Comment 2

[J.C. Jones [:jcj] (he/him)]

Yep. WebCrypto work is not high priority presently, but this should be something we fix as soon as we've time to touch WebCrypto again.

Comment 3

[kll]

According to this comment PKCS is used internally while it is not supported. Why not simply use JWK for the time being? It would avoid application developers to have to use exportable keys, and it could be changed in a later release.

Comment 4

[mrboothstutoringschool]

he Web Cryptography API defines a low-level interface to interacting with cryptographic key material that is managed or exposed by user agents. The API itself is agnostic of the underlying implementation of key storage, but provides a common set of interfaces that allow rich web applications to perform operations such as signature generation and verification, hashing and verification, encryption and decryption, without requiring access to the raw keying material. Cryptographic transformations are exposed via the SubtleCrypto interface, which defines a set of methods for performing common cryptographic operations. In addition to operations such as signature generation and verification, hashing and verification, and encryption and decryption, the API provides interfaces for key generation, key derivation and key import and export.
A web application may wish to extend or replace existing username/password based authentication schemes with authentication methods based on proving that the user has access to some secret keying material. Rather than using transport-layer authentication, such as TLS client certificates, the web application may prefer the richer user experience provided by authenticating within the application itself.
Using the Web Cryptography API, the application could locate suitable client keys, which may have been previously generated via the user agent or pre-provisioned out-of-band by the web application. It could then perform cryptographic operations such as decrypting an authentication challenge followed by signing an authentication response.
This exchange could be further strengthened by binding the authentication to the TLS session over which the client is authenticating, by deriving a key based on properties of the underlying transport. https://nodejs.org/api/webcrypto.html https://docs.google.com/presentation/d/1LbJcPulQ_a4utqNCUoGCk8GTQbchN2BL_kAF3DNJQbo/htmlpresent https://bit.ly/3nWKqa9 https://bit.ly/3FUtpnb https://www.cryptomathic.com/news-events/blog/classification-of-cryptographic-keys-functions-and-properties

Comment 5

[Dana Keeler (she/her) (use needinfo) (:keeler for reviews)]

The example in comment 0 works for me now. I imagine this was fixed by bug 1133698 and/or related work. Are you still having issues with this?