Mirroristas/openpgpjs
2
0
Fork 0
mirror of https://github.com/openpgpjs/openpgpjs.git synced 2025-11-23 22:15:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1870

Browse Source 
Add workarounds for WebCrypto X25519 bugs on WebKit Linux

At least some of the errors were found to also affect Epiphany ,
not just the playwright built , unlike previously reported (4762d2c) .
This commit is contained in:
larabr 2025-07-14 10:45:25 +02:00 committed by GitHub
commit 24f776a9af
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 45 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.github/workflows/tests.yml vendored
View File

@ -106,7 +106,6 @@ jobs:
npx playwright install --with-deps firefox
- name: Install WebKit # caching not possible, external shared libraries required
if: ${{ matrix.runner == 'macos-latest' }} # do not install on ubuntu, since the X25519 WebCrypto implementation has issues
run: npx playwright install --with-deps webkit
- name: Run browser tests

34
src/crypto/public_key/elliptic/ecdh_x.js
View File

@ -28,11 +28,25 @@ export async function generate(algo) {
case enums.publicKey.x25519:
try {
const webCrypto = util.getWebCrypto();
const webCryptoKey = await webCrypto.generateKey('X25519', true, ['deriveKey', 'deriveBits']);
const webCryptoKey = await webCrypto.generateKey('X25519', true, ['deriveKey', 'deriveBits'])
.catch(err => {
if (err.name === 'OperationError') { // Temporary (hopefully) fix for WebKit on Linux
const newErr = new Error('Unexpected key generation issue');
newErr.name = 'NotSupportedError';
throw newErr;
}
throw err;
});
const privateKey = await webCrypto.exportKey('jwk', webCryptoKey.privateKey);
const publicKey = await webCrypto.exportKey('jwk', webCryptoKey.publicKey);
if (privateKey.x !== publicKey.x) { // Weird issue with Webkit on Linux: https://bugs.webkit.org/show_bug.cgi?id=289693
const err = new Error('Unexpected mismatching public point');
err.name = 'NotSupportedError';
throw err;
}
return {
A: new Uint8Array(b64ToUint8Array(publicKey.x)),
k: b64ToUint8Array(privateKey.d)
@ -190,15 +204,29 @@ export async function generateEphemeralEncryptionMaterial(algo, recipientA) {
case enums.publicKey.x25519:
try {
const webCrypto = util.getWebCrypto();
const ephemeralKeyPair = await webCrypto.generateKey('X25519', true, ['deriveKey', 'deriveBits'])
.catch(err => {
if (err.name === 'OperationError') { // Temporary (hopefully) fix for WebKit on Linux
const newErr = new Error('Unexpected key generation issue');
newErr.name = 'NotSupportedError';
throw newErr;
}
throw err;
});
const ephemeralPublicKeyJwt = await webCrypto.exportKey('jwk', ephemeralKeyPair.publicKey);
const ephemeralPrivateKeyJwt = await webCrypto.exportKey('jwk', ephemeralKeyPair.privateKey);
if (ephemeralPrivateKeyJwt.x !== ephemeralPublicKeyJwt.x) { // Weird issue with Webkit on Linux: https://bugs.webkit.org/show_bug.cgi?id=289693
const err = new Error('Unexpected mismatching public point');
err.name = 'NotSupportedError';
throw err;
}
const jwk = publicKeyToJWK(algo, recipientA);
const ephemeralKeyPair = await webCrypto.generateKey('X25519', true, ['deriveKey', 'deriveBits']);
const recipientPublicKey = await webCrypto.importKey('jwk', jwk, 'X25519', false, []);
const sharedSecretBuffer = await webCrypto.deriveBits(
{ name: 'X25519', public: recipientPublicKey },
ephemeralKeyPair.privateKey,
getPayloadSize(algo) * 8 // in bits
);
const ephemeralPublicKeyJwt = await webCrypto.exportKey('jwk', ephemeralKeyPair.publicKey);
return {
sharedSecret: new Uint8Array(sharedSecretBuffer),
ephemeralPublicKey: new Uint8Array(b64ToUint8Array(ephemeralPublicKeyJwt.x))

12
src/crypto/public_key/elliptic/eddsa.js
View File

@ -38,7 +38,15 @@ export async function generate(algo) {
case enums.publicKey.ed25519:
try {
const webCrypto = util.getWebCrypto();
const webCryptoKey = await webCrypto.generateKey('Ed25519', true, ['sign', 'verify']);
const webCryptoKey = await webCrypto.generateKey('Ed25519', true, ['sign', 'verify'])
.catch(err => {
if (err.name === 'OperationError') { // Temporary (hopefully) fix for WebKit on Linux
const newErr = new Error('Unexpected key generation issue');
newErr.name = 'NotSupportedError';
throw newErr;
}
throw err;
});
const privateKey = await webCrypto.exportKey('jwk', webCryptoKey.privateKey);
const publicKey = await webCrypto.exportKey('jwk', webCryptoKey.publicKey);
@ -48,7 +56,7 @@ export async function generate(algo) {
seed: b64ToUint8Array(privateKey.d, true)
};
} catch (err) {
if (err.name !== 'NotSupportedError' && err.name !== 'OperationError') { // Temporary (hopefully) fix for WebKit on Linux
if (err.name !== 'NotSupportedError') {
throw err;
}
const seed = getRandomBytes(getPayloadSize(algo));

10
test/web-test-runner.config.js
View File

@ -1,10 +1,10 @@
import { existsSync } from 'fs';
import { playwrightLauncher, playwright } from '@web/test-runner-playwright';
import { playwrightLauncher } from '@web/test-runner-playwright';
const sharedPlaywrightCIOptions = {
// createBrowserContext: ({ browser }) => browser.newContext({ ignoreHTTPSErrors: true }),
headless: true
};
export default {
nodeResolve: true, // to resolve npm module imports in `unittests.html`
files: './test/unittests.html',
@ -29,13 +29,11 @@ export default {
...sharedPlaywrightCIOptions,
product: 'firefox'
}),
// try setting up webkit, but ignore if not available
// (e.g. on ubuntu, where we don't want to test webkit as the WebCrypto X25519 implementation has issues)
existsSync(playwright.webkit.executablePath()) && playwrightLauncher({
playwrightLauncher({
...sharedPlaywrightCIOptions,
product: 'webkit'
})
].filter(Boolean)
]
}
]
};