1994770 - crypto.subtle.deriveKey ignores key length if DH alg is X25519 and derived key alg is AES-*

Status: RESOLVED FIXED

(Core :: DOM: Web Crypto, defect, P3)

Description

[sageptr]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36

Steps to reproduce:

1. Generate or import two X25519 keys (private and public)
2. Use crypto.subtle.deriveKey with parameters: ({ name: "X25519", public: publicKey }, privateKey, { name: "AES-GCM", length: 128 }, true, ["encrypt", "decrypt"])

Actual results:

Derived key will have length 256 bits, despite 128 were passed as argument. The length value of third argument is totally ignored.

Expected results:

The function should respect length and return 128 bit key.

Note: if using ECDH keys, the length works correctly. Also, deriveBits isn't affected to, it works with X25519 keys normally. The bug only happens when DH algorithm is X25519 and the function deriveKey is used, not deriveBits.

Here is CodePen showcase of the given bug: https://codepen.io/SagePtr/pen/xbZPLXp?editors=0011

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Crypto' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Anna Weine]

Attachment: Bug 1994770 - [WebCrypto] Get key length for X25519 key derivation

Comment 3

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:keeler, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Dana Keeler (she/her) [:keeler]]

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #3)

The severity field is not set for this bug.
:keeler, could you have a look please?

For more information, please visit BugBot documentation.

Anna, what do you think?

Comment 5

[Anna Weine]

The bug is almost resolved as we have a working patch. The patch still would benefit from a bit of improvement, so I will take care of it as soon as I am back

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/27f4f8868129
https://hg.mozilla.org/integration/autoland/rev/49892a4f7b28
[WebCrypto] Get key length for X25519 key derivation r=nss-reviewers,jschanck

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/49892a4f7b28