crypto: fix various edge cases - #66237

Use only errors captured by the cipher job when converting its result.
Unrelated errors on the event loop thread must not turn a successful
operation into a failure or trigger an assertion.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Apply Web IDL view conversion before checking the integer array type,
including shared and resizable backing-buffer restrictions.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Check the normalized SHA algorithm instead of reading the caller hash
name before conversion. This prevents changing getters from bypassing
the supported hash check.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Allow nonempty GCM IVs shorter than the default length and let the
underlying cipher enforce its supported range.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Static Web IDL operations do not require an interface receiver.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Convert the third argument before checking the operation, and apply
additional-algorithm checks only for that overload.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Treat detached BufferSource parameters as empty byte sequences during
algorithm normalization, including detached DataViews.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Choose the BufferSource or JsonWebKey branch from the value, then
check the requested format after algorithm normalization.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Allocate byte copies directly so typed-array species cannot replace
normalized parameters or bit-truncated key material.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Reject a supplied JWK alg when no matching identifier exists for the
requested RSA algorithm and hash.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Check all JWK key_ops entries for duplicates before ignoring unknown
usage names.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Report OperationError for unsupported iteration counts and return an
empty result before invoking the backend when no output is requested.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Use the byte-copy helper for truncated ECDH results so ArrayBuffer
species cannot replace or resize the returned key material.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Omit leading zero octets from generated CryptoKey publicExponent
values, matching the BigInteger representation.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Build public usages and JWK key_ops from the native usage mask so
array species cannot replace or mutate internal usage arrays.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Keep Argon2 lane count independent from backend worker availability.
When the OpenSSL thread pool is unavailable, compute lanes serially.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Use the generated key's modulus size for both CryptoKey algorithm
objects. Preserve successful backend generation when it rounds the
requested size, keeping metadata consistent across export and cloning.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Create byte views directly when splitting hybrid KEM keys and seeds,
so typed-array species cannot alter the component key material.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Give generated, imported, converted, and transferred keys the public
interface prototype directly, without an intermediate internal object.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Export Web Crypto EC private keys from a clone with the public point
included, even when the imported encoding omitted it. Preserve the
original KeyObject encoding state.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Map inaccessible key material to the Web Crypto error type, including
seedless ML-DSA and ML-KEM keys converted from KeyObjects.

Assisted-by: Codex
Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Propagate coordinate conversion failures instead of importing an
oversized JWK coordinate as zero. Keep equivalent short and zero-padded
integer encodings accepted by the native decoder.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Compare empty KMAC outputs with empty signatures as equal, as required
by the verification algorithm. Skip CRYPTO_memcmp for zero-length
buffers while retaining the constant-time comparison for other MACs.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: #66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Read buffer lengths and element sizes from internal slots in
randomFillSync() and randomFill(). Shadowed properties can otherwise
skip filling, change the selected range, or fail a native bounds check.

Use the intrinsic byte length for the getRandomValues() quota check and
keep its delegation to randomFillSync().

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: nodejs#66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Reject non-ASCII equivalents of registered Web Crypto algorithm names.
Skip the character scan when the input already uses the canonical name.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: nodejs#66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Enforce the minimum key-wrap input lengths before the empty-input
shortcut, including the integrity-check block when unwrapping.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: nodejs#66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Use only errors captured by the cipher job when converting its result.
Unrelated errors on the event loop thread must not turn a successful
operation into a failure or trigger an assertion.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Codex
PR-URL: nodejs#66237
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>