1906602 - WebCrypto: Key derivation improvement - checking the length to be modulo 8

Status: RESOLVED FIXED

(Core :: DOM: Web Crypto, enhancement)

Comment 1

[Anna Weine]

Attachment: Bug 1906602 - WebCrypto: removing % 8 check from ECDH and adding to HKDF

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/20c7da53c4f1
WebCrypto: removing % 8 check from ECDH and adding to HKDF r=keeler

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/20c7da53c4f1

Comment 4

[Hamish Willee]

Hi Anna,
Based on the text, it sounds like when you're calling SubtleCrypto.deriveBits(), if you're using HKDF the length of bits derived must be a multiple of 8 or the method will throw an OperationError exception.
Previously you would be fine with any non-null length, but you had to use a multiple of 8 for the length with ECDH.

1. Is that about right?
2. This change doesn't affect deriveKeys() - correct?

If so, then I think no change is needed. If you look at the docs for length and the error (linked above). They say that you should use a multiple of 8 for compatibility, without specifying the exact algorithm affected.

To me that is helpful for developers -unless there is a specific reason not to use 8.
Because otherwise they'll have to carefully check what algorithm to use AND the browser version to know what is safe.

3. Does that seem reasonable? Or should we be stating the limitations on each browser and algorithm? If we need to, can you tell me what the spec requires for each vs what we do?

This is being looked at as part of https://github.com/mdn/content/issues/35280

Comment 5

[Hamish Willee]

Note that MDN docs work for X25519 has mostly been done in https://github.com/mdn/content/issues/35280. I don't think anything needs to be done for this issue (see comment ^^^^) but leaving this open while waiting a response.

Comment 6

[Anna Weine]

Hi,

1. It's right!

HKDF requirement of the length to be non-null comes from https://w3c.github.io/webcrypto/#hkdf-operations (Look for 31.4 Operation). It states If length is null or zero, or is not a multiple of 8, then throw an OperationError. It was removed from the requirement for ECDH.

2. it does not affect deriveKeys.

3. I think it's ok to leave it like this (with the 'should use a multiple of 8', with specifically the word 'should') for exactly the reason you mentioned.
   I will try to further investigate where the %8 requirement is coming from and if it's indeed crucial :)

Comment 7

[Hamish Willee]

Thank you!