1553372 - Can't derive more than 576 bytes of output using HKDF

Status: RESOLVED FIXED

(Core :: DOM: Web Crypto, defect, P3)

Description

[Ryan Kelly [:rfkelly]]

Attachment: testcase for deriving large number of bytes via HKDF

Firefox's implementation of crypto.subtle.deriveBits({ name: "HKDF" }) seems to be limited to producing 576 bytes of output, despite RFC5869 allowing HKDF to derive up to (255 * HashLen) output bytes.

Attached is a simple example script that tries to derive both a 576 byte array and a 577 byte array. On Chrome, both of these succeed. On Firefox, the second fails with "The operation failed for an operation-specific reason".

This seems like it might be a limitation of NSS's HKDF implementation, thanks to the check for keySize > sizeof key_block here:

https://dxr.mozilla.org/mozilla-central/rev/3c0f78074b727fbae112b6eda111d4c4d30cc3ec/security/nss/lib/softoken/pkcs11c.c#7758

I don't really need this for anything and will totally understand if you WONTFIX it, I just noticed the inconsistent behaviour compared to Chrome and wanted to report it for completeness...

Comment 1

[J.C. Jones [:jcj] (he/they)]

Thanks for the report! It's worth fixing, but WebCrypto is currently underneath WebAuthn in terms of priorities, so it'l have to hold for a bit.

Comment 2

[Ethan Glasser-Camp (:glasserc)]

I think the linked check might have gotten removed in https://hg.mozilla.org/mozilla-central/diff/5ad3cfbe42f65ff59c245418d05feca58a580d47/security/nss/lib/softoken/pkcs11c.c, corresponding to nss 3.46.1, which includes https://hg.mozilla.org/projects/nss/rev/c0913ad7a5609751a8dfc37ae2e0a7a0cd6a42dd.

Comment 3

[Ryan Kelly [:rfkelly]]

The attached testcase now works fine for me in latest Nightly, so I think we can call this fixed.