web crypto error importing ECDH public key with key usages
Reported by
gogg...@idupree.com,
Feb 9 2018
|
|
Issue description
UserAgent: Mozilla/5.0 (X11; CrOS armv7l 10032.86.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.140 Safari/537.36
Platform: 10032.86.0 (Official Build) stable-channel veyron_minnie
Steps to reproduce the problem:
1. Run the attached code
2. Look in the web console
What is the expected behavior?
It should log
generated { publicKey: CryptoKey {}, privateKey: CryptoKey {} }
exported ArrayBuffer { byteLength: 65 }
imported CryptoKey {}
What went wrong?
Instead of logging the "imported" line, it shows an error
> Uncaught (in promise) DOMException: Cannot create a key using the specified key usages.
Did this work before? N/A
Does this work in other browsers? N/A
Chrome version: 63.0.3239.140 Channel: stable
OS Version: 10032.86.0
Flash Version:
This code works in Firefox. In Chrome, the importKey() line fails if you specify any key usages. Although, maybe it shouldn't work in Firefox, and this should be a Firefox bug instead of a Chrome bug? Specifying 'deriveBits' on the public key is not actually needed for ECDH deriveBits() in either browser (or deriveKey() likewise).
( I found this browser difference in the wild, causing this test-page by a mozilla person failing in Chrome: https://mozilla-services.github.io/WebPushDataTestPage/ )
If it were possible for the error message to say that specifying key usages is not actually necessary for public keys, that would also help. (I would have spent less time barking up the wrong tree when investigating this error.)
|
|
►
Sign in to add a comment |
|
Comment 1 by eroman@chromium.org
, Feb 9 2018Thanks for the report. Chrome's behavior here is correct, and Firefox accepting this is in violation of the Web Crypto spec. Step 2.1 of ECDH's "Import Key" operation states [*]: 2. If format is "spki": 1. If usages is not empty then throw a SyntaxError. The error messaging could certainly be improved to help debug this -- for instance state what set of key usages would have been acceptable. I will make note of that for any future improvements to the text message, thanks! [*] https://www.w3.org/TR/WebCryptoAPI/#ecdh-operations