- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Perform the signature generation operation defined in Section 8.2 of [[RFC3447]] with the key represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - as the signer's private key and |message| as - |M| and using the hash function specified in the {{RsaHashedKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option for the EMSA-PKCS1-v1_5 encoding method. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |signature| be the value |S| that results from - performing the operation. -
-- Return |signature|. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Perform the signature verification operation defined in Section 8.2 of - [[RFC3447]] with the key represented by the - {{CryptoKey/[[handle]]}} internal slot of - |key| as the signer's RSA public key and |message| as - |M| and - |signature| as |S| and using the hash function specified - in the {{RsaHashedKeyAlgorithm/hash}} attribute of the - {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option for the EMSA-PKCS1-v1_5 encoding method. -
-- Let |result| be a boolean with value true if the - result of the operation was "valid signature" and the value - false otherwise. -
-Return |result|.
-- If |usages| contains an entry which is not - "`sign`" or "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the - {{RsaKeyGenParams/modulusLength}} attribute of - |normalizedAlgorithm| and RSA public exponent equal to the - {{RsaKeyGenParams/publicExponent}} attribute of - |normalizedAlgorithm|. -
-- If generation of the key pair fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}} - dictionary. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSASSA-PKCS1-v1_5`". -
-- Set the - {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/modulusLength}} - attribute of |normalizedAlgorithm|. -
-- Set the - {{RsaKeyAlgorithm/publicExponent}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/publicExponent}} - attribute of |normalizedAlgorithm|. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute - of |algorithm| to equal the - {{RsaHashedKeyGenParams/hash}} member of - |normalizedAlgorithm|. -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the [= usage - intersection =] of |usages| and `[ "verify" ]`. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the [= usage - intersection =] of |usages| and `[ "sign" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-- Return |result|. -
-Let |keyData| be the key data to be imported.
-- If |usages| contains an entry which is not - "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `rsaEncryption` - object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `subjectPublicKeyInfo` field of |spki|, - |structure| as the `RSAPublicKey` structure - specified in Section A.1.1 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or it can be determined that |publicKey| - is not a valid public key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA public key identified by - |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- If |usages| contains an entry which is not - "`sign`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `rsaEncryption` object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `privateKey` field of |privateKeyInfo|, - |structure| as the `RSAPrivateKey` structure - specified in Section A.1.2 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or if |rsaPrivateKey| is not - a valid RSA private key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA private key identified by - |rsaPrivateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}} -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field of |jwk| is present and - |usages| contains an entry which is not - "`sign`", or, if the {{JsonWebKey/d}} field of |jwk| - is not present and - |usages| contains an entry which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not a - case-sensitive string match to "`RSA`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not a case-sensitive string match to "`sig`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Let |hash| be a be a string whose initial value is - undefined. -
-- Let |hash| be undefined. -
-- Let |hash| be the string "`SHA-1`". -
-- Let |hash| be the string "`SHA-256`". -
-- Let |hash| be the string "`SHA-384`". -
-- Let |hash| be the string "`SHA-512`". -
-- Perform any [= RSASSA-PKCS1-v1_5 key import steps | key - import steps =] defined by - other applicable - specifications, passing |format|, |jwk| - and obtaining |hash|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- Let |normalizedHash| be the result of - normalize an algorithm - with `alg` set to |hash| and `op` set - to `digest`. -
-- If |normalizedHash| is not equal to the - {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.3.2 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |privateKey| represents the - RSA private key identified by interpreting |jwk| - according to Section 6.3.2 of JSON Web - Algorithms [[JWA]]. -
-- If |privateKey| is not a valid RSA private key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents - |privateKey|. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |key| to {{KeyType/"private"}} -
-- If |jwk| does not meet the requirements of Section - 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |publicKey| represent the - RSA public key identified by interpreting |jwk| - according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. -
-- If |publicKey| can be determined to not be a valid RSA public key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} representing |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |key| to "`public`" -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}} dictionary. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSASSA-PKCS1-v1_5`" -
-- Set the {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to the length, in bits, of the RSA public - modulus. -
-- Set the publicExponent - attribute of |algorithm| to the BigInteger - representation of the RSA public exponent. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute of - |algorithm| to the {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-Return |key|.
-- Let |key| be the key to be exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |subjectPublicKey| field to the result of - DER-encoding an `RSAPublicKey` ASN.1 type, as defined - in [[RFC3447]], Appendix A.1.1, that - represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |privateKey| field to the result of DER-encoding - an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the - RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-Let |jwk| be a new {{JsonWebKey}} - dictionary.
-Set the `kty` attribute of |jwk| to the string - "`RSA`".
-- Let |hash| be the {{KeyAlgorithm/name}} - attribute of the {{RsaHashedKeyAlgorithm/hash}} - attribute of the {{CryptoKey/[[algorithm]]}} - internal slot of |key|. -
-- Set the `alg` attribute of |jwk| to the string - "`RS1`". -
-- Set the `alg` attribute of |jwk| to the string - "`RS256`". -
-- Set the `alg` attribute of |jwk| to the string - "`RS384`". -
-- Set the `alg` attribute of |jwk| to the string - "`RS512`". -
-- Perform any [= RSASSA-PKCS1-v1_5 key import steps | key - export steps =] defined by - other applicable - specifications, passing |format|, |key| - and obtaining |alg|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{NotSupportedError}}. -
-- Set the `alg` attribute of |jwk| to |alg|. -
-- Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| - according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. -
-- Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, - {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and - {{JsonWebKey/qi}} of |jwk| according to the - corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. -
-- If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot - of |key| is represented by more than two primes, set - the attribute named {{JsonWebKey/oth}} of |jwk| - according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 -
-- Set the `key_ops` attribute of |jwk| to the usages attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- The "`RSA-PSS`" algorithm identifier is used to perform signing - and verification using the RSASSA-PSS algorithm specified in - [[RFC3447]], using the SHA hash functions defined - in this specification and the mask generation - formula MGF1. -
-- Other specifications - may specify the use of additional hash algorithms with RSASSA-PSS. Such specifications - must define the digest operation for the additional hash algorithms and - key import steps and - key export steps for RSASSA-PSS. -
-- The [= recognized algorithm name =] for - this algorithm is "`RSA-PSS`". -
-| Operation | -Parameters | -Result | -
|---|---|---|
| sign | -{{RsaPssParams}} | -[= byte sequence =] | -
| verify | -{{RsaPssParams}} | -boolean | -
| generateKey | -{{RsaHashedKeyGenParams}} | -{{CryptoKeyPair}} | -
| importKey | -{{RsaHashedImportParams}} | -{{CryptoKey}} | -
| exportKey | -None | -object | -
-dictionary RsaPssParams : Algorithm {
- required [EnforceRange] unsigned long saltLength;
-};
-
- The saltLength member represents the desired length of the random salt in bytes.
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Perform the signature generation operation defined in Section 8.1 of [[RFC3447]] with the key represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - as the signer's private key, |K|, and |message| as - the message to be signed, |M|, and using the hash function specified - by the {{RsaHashedKeyAlgorithm/hash}} attribute of the - {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option, MGF1 (defined in Section B.2.1 of [[RFC3447]]) as the MGF option and the saltLength member of - |normalizedAlgorithm| as the salt length option for the - EMSA-PSS-ENCODE operation. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |signature| be the - signature, S, that results from performing the operation. -
-- Return |signature|. -
-+ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Perform the signature generation operation defined in Section 8.2 of [[RFC3447]] with the key represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + as the signer's private key and |message| as + |M| and using the hash function specified in the {{RsaHashedKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option for the EMSA-PKCS1-v1_5 encoding method. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |signature| be the value |S| that results from + performing the operation. +
++ Return |signature|. +
+- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Perform the signature verification operation defined in Section 8.1 of - [[RFC3447]] with the key represented by the - {{CryptoKey/[[handle]]}} internal slot of - |key| as the signer's RSA public key and |message| as - |M| and - |signature| as |S| and using the hash function specified - by the {{RsaHashedKeyAlgorithm/hash}} attribute of the - {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option, MGF1 (defined in Section B.2.1 of [[RFC3447]]) as the MGF option and the saltLength member of - |normalizedAlgorithm| as the salt length option for the - EMSA-PSS-VERIFY operation. -
-- Let |result| be a boolean with the value true if the - result of the operation was "valid signature" and the value - false otherwise. -
-- If |usages| contains an entry which is not - "`sign`" or "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the - {{RsaKeyGenParams/modulusLength}} member of - |normalizedAlgorithm| and RSA public exponent equal to the - {{RsaKeyGenParams/publicExponent}} member of - |normalizedAlgorithm|. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}} - dictionary. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSA-PSS`". -
-- Set the - {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/modulusLength}} - member of |normalizedAlgorithm|. -
-- Set the - {{RsaKeyAlgorithm/publicExponent}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/publicExponent}} - member of |normalizedAlgorithm|. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute - of |algorithm| to equal the - {{RsaHashedKeyGenParams/hash}} member of - |normalizedAlgorithm|. -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the [= usage - intersection =] of |usages| and `[ "verify" ]`. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the [= usage - intersection =] of |usages| and `[ "sign" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to |privateKey|. -
-- Return |result|. -
-+ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Perform the signature verification operation defined in Section 8.2 of + [[RFC3447]] with the key represented by the + {{CryptoKey/[[handle]]}} internal slot of + |key| as the signer's RSA public key and |message| as + |M| and + |signature| as |S| and using the hash function specified + in the {{RsaHashedKeyAlgorithm/hash}} attribute of the + {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option for the EMSA-PKCS1-v1_5 encoding method. +
++ Let |result| be a boolean with value true if the + result of the operation was "valid signature" and the value + false otherwise. +
+Return |result|.
+Let |keyData| be the key data to be imported.
-- If |usages| contains an entry which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `rsaEncryption` - object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `subjectPublicKeyInfo` field of |spki|, - |structure| as the `RSAPublicKey` structure - specified in Section A.1.1 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or it can be determined that |publicKey| - is not a valid public key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA public key identified by - |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- If |usages| contains an entry which is not - "`sign`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, then [= exception/throw =] a {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `rsaEncryption` object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `privateKey` field of |privateKeyInfo|, - |structure| as the `RSAPrivateKey` structure - specified in Section A.1.2 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or if |rsaPrivateKey| is not - a valid RSA private key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA private key identified by - |rsaPrivateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}} -
-Let |jwk| equal |keyData|.
[= exception/throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field of |jwk| is present and - |usages| contains an entry which is not - "`sign`", or, if the {{JsonWebKey/d}} field of |jwk| - is not present and - |usages| contains an entry which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not a - case-sensitive string match to "`RSA`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not a case-sensitive string match to "`sig`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Let |hash| be undefined. -
-- Let |hash| be the string "`SHA-1`". -
-- Let |hash| be the string "`SHA-256`". -
-- Let |hash| be the string "`SHA-384`". -
-- Let |hash| be the string "`SHA-512`". -
-- Perform any [= RSA-PSS key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |jwk| - and obtaining |hash|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- Let |normalizedHash| be the result of - normalize an algorithm - with `alg` set to |hash| and `op` set - to `digest`. -
-- If |normalizedHash| is not equal to the - {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.3.2 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |privateKey| represent the - RSA private key identified by interpreting |jwk| - according to Section 6.3.2 of JSON Web - Algorithms [[JWA]]. -
-- If |privateKey| can be determined to not be a valid RSA private key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} representing |privateKey|. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |key| to {{KeyType/"private"}} -
-- If |jwk| does not meet the requirements of Section - 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |publicKey| represent the - RSA public key identified by interpreting |jwk| - according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. -
-- If |publicKey| can be determined to not be a valid RSA public key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} representing |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |key| to "`public`" -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}} dictionary. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSA-PSS`" -
-- Set the {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to the length, in bits, of the RSA public - modulus. -
-- Set the {{RsaKeyAlgorithm/publicExponent}} - attribute of |algorithm| to the {{BigInteger}} - representation of the RSA public exponent. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute of - |algorithm| to the {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm| -
-Return |key|.
-- Let |key| be the key to be exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |subjectPublicKey| field to the result of - DER-encoding an `RSAPublicKey` ASN.1 type, as defined - in [[RFC3447]], Appendix A.1.1, that - represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |privateKey| field to the result of DER-encoding - an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the - RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-Let |jwk| be a new {{JsonWebKey}} dictionary.
-Set the `kty` attribute of |jwk| to the string - "`RSA`".
-- Let |hash| be the {{KeyAlgorithm/name}} - attribute of the {{RsaHashedKeyAlgorithm/hash}} - attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key|. -
-- Set the `alg` attribute of |jwk| to the string - "`PS1`". -
-- Set the `alg` attribute of |jwk| to the string - "`PS256`". -
-- Set the `alg` attribute of |jwk| to the string - "`PS384`". -
-- Set the `alg` attribute of |jwk| to the string - "`PS512`". -
-- Perform any [= RSA-PSS key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{RsaHashedKeyAlgorithm/hash}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |alg|. -
-- Set the `alg` attribute of |jwk| to |alg|. -
-- Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| - according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. -
-- Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, - {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and - {{JsonWebKey/qi}} of |jwk| according to the - corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. -
-- If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot - of |key| is represented by more than two primes, set - the attribute named {{JsonWebKey/oth}} of |jwk| - according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 -
-- Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-+ If |usages| contains an entry which is not + "`sign`" or "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the + {{RsaKeyGenParams/modulusLength}} attribute of + |normalizedAlgorithm| and RSA public exponent equal to the + {{RsaKeyGenParams/publicExponent}} attribute of + |normalizedAlgorithm|. +
++ If generation of the key pair fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}} + dictionary. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSASSA-PKCS1-v1_5`". +
++ Set the + {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/modulusLength}} + attribute of |normalizedAlgorithm|. +
++ Set the + {{RsaKeyAlgorithm/publicExponent}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/publicExponent}} + attribute of |normalizedAlgorithm|. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute + of |algorithm| to equal the + {{RsaHashedKeyGenParams/hash}} member of + |normalizedAlgorithm|. +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the [= usage + intersection =] of |usages| and `[ "verify" ]`. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the [= usage + intersection =] of |usages| and `[ "sign" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
+- The "`RSA-OAEP`" algorithm identifier is used to perform encryption - and decryption ordering to the RSAES-OAEP algorithm specified in - [[RFC3447]], using the SHA hash functions defined - in this specification and using the mask - generation function MGF1. -
-- Other specifications - may specify the use of additional hash algorithms with RSAES-OAEP. Such specifications - must define the digest operation for the additional hash algorithm and - key import steps and - key export steps for RSAES-OAEP. -
-- The [= recognized algorithm name =] for - this algorithm is "`RSA-OAEP`". -
-| Operation | -Parameters | -Result | -
|---|---|---|
| encrypt | -{{RsaOaepParams}} | -[= byte sequence =] | -
| decrypt | -{{RsaOaepParams}} | -[= byte sequence =] | -
| generateKey | -{{RsaHashedKeyGenParams}} | -{{CryptoKeyPair}} | -
| importKey | -{{RsaHashedImportParams}} | -{{CryptoKey}} | -
| exportKey | -None | -object | -
-dictionary RsaOaepParams : Algorithm {
- BufferSource label;
-};
-
- The label member represents the optional label/application data to associate with the message.
-- If the {{CryptoKey/[[type]]}} internal slot of |key| - is not "`public`", - then [= exception/throw =] an - {{InvalidAccessError}}. -
-- Let |label| be the {{RsaOaepParams/label}} member of - |normalizedAlgorithm| or the empty byte sequence if the - {{RsaOaepParams/label}} member of - |normalizedAlgorithm| is not present. -
-- Perform the encryption operation defined in Section 7.1 of [[RFC3447]] with the key represented by |key| - as the recipient's RSA public key, |plaintext| - as the message to be encrypted, |M| and |label| - as the label, |L|, and with the hash - function specified by the {{RsaHashedKeyAlgorithm/hash}} - attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option and MGF1 (defined in Section B.2.1 of - [[RFC3447]]) as the MGF option. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |ciphertext| be the value |C| that results from performing the - operation. -
-- Return |ciphertext|. -
-- If the {{CryptoKey/[[type]]}} internal slot of |key| - is not {{KeyType/"private"}}, - then [= exception/throw =] an - {{InvalidAccessError}}. -
-- Let |label| be the {{RsaOaepParams/label}} member of - |normalizedAlgorithm| or the empty byte sequence if the - {{RsaOaepParams/label}} member of - |normalizedAlgorithm| is not present. -
-- Perform the decryption operation defined in Section 7.1 of [[RFC3447]] with the key represented by |key| - as the recipient's RSA private key, |ciphertext| - as the ciphertext to be decrypted, C, and |label| - as the label, |L|, and with the hash - function specified by the {{RsaHashedKeyAlgorithm/hash}} - attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key| as the Hash option and MGF1 (defined in Section B.2.1 of - [[RFC3447]]) as the MGF option. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |plaintext| the value |M| that results from performing the - operation. -
-- Return |plaintext|. -
-- If |usages| contains an entry which is not - "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the - {{RsaKeyGenParams/modulusLength}} member of - |normalizedAlgorithm| and RSA public exponent equal to the - {{RsaKeyGenParams/publicExponent}} member of - |normalizedAlgorithm|. -
-- If performing the operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}} - object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSA-OAEP`". -
-- Set the - {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/modulusLength}} - member of |normalizedAlgorithm|. -
-- Set the - {{RsaKeyAlgorithm/publicExponent}} - attribute of |algorithm| to equal the - {{RsaKeyGenParams/publicExponent}} - member of |normalizedAlgorithm|. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute - of |algorithm| to equal the - {{RsaHashedKeyGenParams/hash}} member of - |normalizedAlgorithm|. -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal slot of - |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal slot of - |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the - [= usage intersection =] of - |usages| and `[ "encrypt", "wrapKey" ]`. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal slot of - |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal slot of - |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the - [= usage intersection =] of - |usages| and `[ "decrypt", "unwrapKey" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-- Return |result|. -
-Let |keyData| be the key data to be imported.
-- If |usages| contains an entry which is not - "`encrypt`" or - "`wrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `rsaEncryption` - object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `subjectPublicKeyInfo` field of |spki|, - |structure| as the `RSAPublicKey` structure - specified in Section A.1.1 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or it can be determined that |publicKey| - is not a valid public key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA public key identified by - |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to "`public`" -
-- If |usages| contains an entry which is not - "`decrypt`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, then [= exception/throw =] a {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `rsaEncryption` object identifier defined in [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the - `privateKey` field of |privateKeyInfo|, - |structure| as the `RSAPrivateKey` structure - specified in Section A.1.2 of [[RFC3447]], and - |exactData| set to true. -
-- If an error occurred while parsing, or if |rsaPrivateKey| is not - a valid RSA private key according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the RSA private key identified by - |rsaPrivateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"private"}} -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field of |jwk| is present and - |usages| contains an entry which is not - "`decrypt`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/d}} field of |jwk| is not present and - |usages| contains an entry which is not - "`encrypt`" or "`wrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not a - case-sensitive string match to "`RSA`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not a case-sensitive string match to "`enc`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Perform any [= RSA-OAEP key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |jwk| - and obtaining |hash|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- Let |normalizedHash| be the result of - normalize an algorithm - with `alg` set to |hash| and `op` set - to `digest`. -
-- If |normalizedHash| is not equal to the - {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If |jwk| does not meet the requirements of Section - 6.3.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |privateKey| represent the - RSA private key identified by interpreting |jwk| - according to Section 6.3.2 of JSON Web Algorithms [[JWA]]. -
-- If |privateKey| can be determined to not be a valid RSA private key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} representing |privateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"private"}} -
-- If |jwk| does not meet the requirements of Section - 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |publicKey| represent the - RSA public key identified by interpreting |jwk| - according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. -
-- If |publicKey| can be determined to not be a valid RSA public key - according to [[RFC3447]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} representing |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to "`public`" -
-- Let |algorithm| be a new - {{RsaHashedKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`RSA-OAEP`" -
-- Set the {{RsaKeyAlgorithm/modulusLength}} - attribute of |algorithm| to the length, in bits, of the RSA public - modulus. -
-- Set the {{RsaKeyAlgorithm/publicExponent}} - attribute of |algorithm| to the {{BigInteger}} - representation of the RSA public exponent. -
-- Set the {{RsaHashedKeyAlgorithm/hash}} attribute of - |algorithm| to the {{RsaHashedImportParams/hash}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal slot of - |key| to |algorithm| -
-Return |key|.
-- Let |key| be the key to be exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |subjectPublicKey| field to the result of - DER-encoding an `RSAPublicKey` ASN.1 type, as defined - in [[RFC3447]], Appendix A.1.1, that - represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| field to the OID - `rsaEncryption` defined in - [[RFC3447]]. -
-- Set the |params| field to the ASN.1 type NULL. -
-- Set the |privateKey| field to the result of DER-encoding - an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the - RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to the string - "`RSA`". -
-- Let |hash| be the {{KeyAlgorithm/name}} - attribute of the {{RsaHashedKeyAlgorithm/hash}} - attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key|. -
-- Set the `alg` attribute of |jwk| to the string - "`RSA-OAEP`". -
-- Set the `alg` attribute of |jwk| to the string - "`RSA-OAEP-256`". -
-- Set the `alg` attribute of |jwk| to the string - "`RSA-OAEP-384`". -
-- Set the `alg` attribute of |jwk| to the string - "`RSA-OAEP-512`". -
-- Perform any [= RSA-OAEP key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{RsaHashedKeyAlgorithm/hash}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |alg|. -
-- Set the `alg` attribute of |jwk| to |alg|. -
-- Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| - according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. -
-- Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, - {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and - {{JsonWebKey/qi}} of |jwk| according to the - corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. -
-- If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot - of |key| is represented by more than two primes, set - the attribute named {{JsonWebKey/oth}} of |jwk| - according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 -
-- Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- The "`ECDSA`" algorithm identifier is used to perform signing - and verification using the ECDSA algorithm specified in - [[RFC6090]] and using the SHA hash functions and elliptic - curves defined in this specification. -
-- Other specifications - may specify the use of additional elliptic curves and hash algorithms with ECDSA. To - specify additional hash algorithms to be used with ECDSA, a specification must define - a registered algorithm that supports the digest operation. - To specify an additional elliptic curve a specification must define - the curve name, - ECDSA signature steps, - ECDSA verification steps, - ECDSA generation steps, - ECDSA key import steps and - ECDSA key export steps. -
-- The [= recognized algorithm name =] for - this algorithm is "`ECDSA`". -
-| Operation | -Parameters | -Result | -
|---|---|---|
| sign | -{{EcdsaParams}} | -[= byte sequence =] | -
| verify | -{{EcdsaParams}} | -boolean | -
| generateKey | -{{EcKeyGenParams}} | -{{CryptoKeyPair}} | -
| importKey | -{{EcKeyImportParams}} | -{{CryptoKey}} | -
| exportKey | -None | -object | -
-dictionary EcdsaParams : Algorithm {
- required HashAlgorithmIdentifier hash;
-};
-
- The hash member represents the hash algorithm to use.
--typedef DOMString NamedCurve; +-+ Import Key
-dictionary EcKeyGenParams : Algorithm { - required NamedCurve namedCurve; -}; -
- The NamedCurve type represents named elliptic curves, - which are a convenient way to specify the domain parameters of well-known elliptic - curves. The following values defined by this specification: -
-- Other specifications may define - additional values. -
-The namedCurve member of the {{EcKeyGenParams}} dictionary represents a named curve.
-
-dictionary EcKeyAlgorithm : KeyAlgorithm {
- required NamedCurve namedCurve;
-};
-
- The namedCurve member represents the named curve that the key uses.
-
-dictionary EcKeyImportParams : Algorithm {
- required NamedCurve namedCurve;
-};
-
- The namedCurve member represents a named curve.
-Let |keyData| be the key data to be imported.
++ If |usages| contains an entry which is not + "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `rsaEncryption` + object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `subjectPublicKeyInfo` field of |spki|, + |structure| as the `RSAPublicKey` structure + specified in Section A.1.1 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or it can be determined that |publicKey| + is not a valid public key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA public key identified by + |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ If |usages| contains an entry which is not + "`sign`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `rsaEncryption` object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `privateKey` field of |privateKeyInfo|, + |structure| as the `RSAPrivateKey` structure + specified in Section A.1.2 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or if |rsaPrivateKey| is not + a valid RSA private key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA private key identified by + |rsaPrivateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}} +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field of |jwk| is present and + |usages| contains an entry which is not + "`sign`", or, if the {{JsonWebKey/d}} field of |jwk| + is not present and + |usages| contains an entry which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not a + case-sensitive string match to "`RSA`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not a case-sensitive string match to "`sig`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |hash| be a be a string whose initial value is + undefined. +
++ Let |hash| be undefined. +
++ Let |hash| be the string "`SHA-1`". +
++ Let |hash| be the string "`SHA-256`". +
++ Let |hash| be the string "`SHA-384`". +
++ Let |hash| be the string "`SHA-512`". +
++ Perform any [= RSASSA-PKCS1-v1_5 key import steps | key + import steps =] defined by + other applicable + specifications, passing |format|, |jwk| + and obtaining |hash|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ Let |normalizedHash| be the result of + normalize an algorithm + with `alg` set to |hash| and `op` set + to `digest`. +
++ If |normalizedHash| is not equal to the + {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.3.2 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |privateKey| represents the + RSA private key identified by interpreting |jwk| + according to Section 6.3.2 of JSON Web + Algorithms [[JWA]]. +
++ If |privateKey| is not a valid RSA private key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents + |privateKey|. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |key| to {{KeyType/"private"}} +
++ If |jwk| does not meet the requirements of Section + 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |publicKey| represent the + RSA public key identified by interpreting |jwk| + according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. +
++ If |publicKey| can be determined to not be a valid RSA public key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} representing |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |key| to "`public`" +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}} dictionary. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSASSA-PKCS1-v1_5`" +
++ Set the {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to the length, in bits, of the RSA public + modulus. +
++ Set the publicExponent + attribute of |algorithm| to the BigInteger + representation of the RSA public exponent. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute of + |algorithm| to the {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
+Return |key|.
+- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |hashAlgorithm| be the {{EcdsaParams/hash}} - member of |normalizedAlgorithm|. -
-- Let |M| be the result of performing the digest operation specified by - |hashAlgorithm| using |message|. -
-- Let |d| be the ECDSA private key associated with |key|. -
-- Let |params| be the EC domain parameters associated with - |key|. -
-- Perform the ECDSA signing process, as specified in [[RFC6090]], - Section 5.4, with |M| as the message, using |params| as the - EC domain parameters, and with |d| as the private key. -
-- Let |r| and |s| be the pair of integers resulting from - performing the ECDSA signing process. -
-- Let |result| be an empty [= byte sequence =]. -
-- Let |n| be the smallest integer such that |n| * 8 is greater than - the logarithm to base 2 of the order of the base point of the elliptic curve identified - by |params|. -
-- Convert |r| to a byte sequence of - length |n| and append it to |result|. -
-- Convert |s| to a byte sequence of - length |n| and append it to |result|. -
-- Perform the [= ECDSA signature steps =] - specified in that specification, passing in |M|, |params| - and |d| and resulting in |result|. -
-- Return |result|. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |hashAlgorithm| be the {{EcdsaParams/hash}} - member of - |normalizedAlgorithm|. -
-- Let |M| be the result of performing the digest operation specified by - |hashAlgorithm| using |message|. -
-- Let |Q| be the ECDSA public key associated with |key|. -
-- Let |params| be the EC domain parameters associated with - |key|. -
-- Perform the ECDSA verifying process, as specified in [[RFC6090]], Section 5.3, with |M| as the received - message, |signature| as the received signature and using - |params| as the EC domain parameters, and - |Q| as the public key. -
-- Perform the [= ECDSA verification steps =] - specified in that specification passing in |M|, |signature|, - |params| and |Q| and resulting in an indication of whether - or not the purported signature is valid. -
-- Let |result| be a boolean with the value `true` if the signature is valid - and the value `false` otherwise. -
-- Return |result|. -
-- If |usages| contains a value which is not - one of "`sign`" or "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an Elliptic Curve key pair, as defined in [[RFC6090]] - with domain parameters for the curve identified by - the {{EcKeyGenParams/namedCurve}} member of - |normalizedAlgorithm|. -
-- Perform the [=ECDSA - generation steps =] specified in that specification, passing in - |normalizedAlgorithm| and resulting in an elliptic curve key pair. -
-- [= exception/throw =] a - {{NotSupportedError}} -
-- If performing the key generation operation results in an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |algorithm| be a new - {{EcKeyAlgorithm}} - object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDSA`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to equal the - {{namedCurve}} member of - |normalizedAlgorithm|. -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the [= usage - intersection =] of |usages| and `[ "verify" ]`. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the [= usage - intersection =] of |usages| and `[ "sign" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-- Return |result|. -
-+ Let |key| be the key to be exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |subjectPublicKey| field to the result of + DER-encoding an `RSAPublicKey` ASN.1 type, as defined + in [[RFC3447]], Appendix A.1.1, that + represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |privateKey| field to the result of DER-encoding + an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the + RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
+Let |jwk| be a new {{JsonWebKey}} + dictionary.
+Set the `kty` attribute of |jwk| to the string + "`RSA`".
++ Let |hash| be the {{KeyAlgorithm/name}} + attribute of the {{RsaHashedKeyAlgorithm/hash}} + attribute of the {{CryptoKey/[[algorithm]]}} + internal slot of |key|. +
++ Set the `alg` attribute of |jwk| to the string + "`RS1`". +
++ Set the `alg` attribute of |jwk| to the string + "`RS256`". +
++ Set the `alg` attribute of |jwk| to the string + "`RS384`". +
++ Set the `alg` attribute of |jwk| to the string + "`RS512`". +
++ Perform any [= RSASSA-PKCS1-v1_5 key import steps | key + export steps =] defined by + other applicable + specifications, passing |format|, |key| + and obtaining |alg|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{NotSupportedError}}. +
++ Set the `alg` attribute of |jwk| to |alg|. +
++ Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| + according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. +
++ Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, + {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and + {{JsonWebKey/qi}} of |jwk| according to the + corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. +
++ If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot + of |key| is represented by more than two primes, set + the attribute named {{JsonWebKey/oth}} of |jwk| + according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 +
++ Set the `key_ops` attribute of |jwk| to the usages attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ The "`RSA-PSS`" algorithm identifier is used to perform signing + and verification using the RSASSA-PSS algorithm specified in + [[RFC3447]], using the SHA hash functions defined + in this specification and the mask generation + formula MGF1. +
++ Other specifications + may specify the use of additional hash algorithms with RSASSA-PSS. Such specifications + must define the digest operation for the additional hash algorithms and + key import steps and + key export steps for RSASSA-PSS. +
++ The [= recognized algorithm name =] for + this algorithm is "`RSA-PSS`". +
+| Operation | +Parameters | +Result | +
|---|---|---|
| sign | +{{RsaPssParams}} | +[= byte sequence =] | +
| verify | +{{RsaPssParams}} | +boolean | +
| generateKey | +{{RsaHashedKeyGenParams}} | +{{CryptoKeyPair}} | +
| importKey | +{{RsaHashedImportParams}} | +{{CryptoKey}} | +
| exportKey | +None | +object | +
+dictionary RsaPssParams : Algorithm {
+ required [EnforceRange] unsigned long saltLength;
+};
+
+ The saltLength member represents the desired length of the random salt in bytes.
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Perform the signature generation operation defined in Section 8.1 of [[RFC3447]] with the key represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + as the signer's private key, |K|, and |message| as + the message to be signed, |M|, and using the hash function specified + by the {{RsaHashedKeyAlgorithm/hash}} attribute of the + {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option, MGF1 (defined in Section B.2.1 of [[RFC3447]]) as the MGF option and the saltLength member of + |normalizedAlgorithm| as the salt length option for the + EMSA-PSS-ENCODE operation. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |signature| be the + signature, S, that results from performing the operation. +
++ Return |signature|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Perform the signature verification operation defined in Section 8.1 of + [[RFC3447]] with the key represented by the + {{CryptoKey/[[handle]]}} internal slot of + |key| as the signer's RSA public key and |message| as + |M| and + |signature| as |S| and using the hash function specified + by the {{RsaHashedKeyAlgorithm/hash}} attribute of the + {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option, MGF1 (defined in Section B.2.1 of [[RFC3447]]) as the MGF option and the saltLength member of + |normalizedAlgorithm| as the salt length option for the + EMSA-PSS-VERIFY operation. +
++ Let |result| be a boolean with the value true if the + result of the operation was "valid signature" and the value + false otherwise. +
++ If |usages| contains an entry which is not + "`sign`" or "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the + {{RsaKeyGenParams/modulusLength}} member of + |normalizedAlgorithm| and RSA public exponent equal to the + {{RsaKeyGenParams/publicExponent}} member of + |normalizedAlgorithm|. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}} + dictionary. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSA-PSS`". +
++ Set the + {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/modulusLength}} + member of |normalizedAlgorithm|. +
++ Set the + {{RsaKeyAlgorithm/publicExponent}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/publicExponent}} + member of |normalizedAlgorithm|. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute + of |algorithm| to equal the + {{RsaHashedKeyGenParams/hash}} member of + |normalizedAlgorithm|. +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the [= usage + intersection =] of |usages| and `[ "verify" ]`. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the [= usage + intersection =] of |usages| and `[ "sign" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to |privateKey|. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains an entry which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `rsaEncryption` + object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `subjectPublicKeyInfo` field of |spki|, + |structure| as the `RSAPublicKey` structure + specified in Section A.1.1 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or it can be determined that |publicKey| + is not a valid public key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA public key identified by + |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ If |usages| contains an entry which is not + "`sign`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, then [= exception/throw =] a {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `rsaEncryption` object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `privateKey` field of |privateKeyInfo|, + |structure| as the `RSAPrivateKey` structure + specified in Section A.1.2 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or if |rsaPrivateKey| is not + a valid RSA private key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA private key identified by + |rsaPrivateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}} +
+Let |jwk| equal |keyData|.
[= exception/throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field of |jwk| is present and + |usages| contains an entry which is not + "`sign`", or, if the {{JsonWebKey/d}} field of |jwk| + is not present and + |usages| contains an entry which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not a + case-sensitive string match to "`RSA`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not a case-sensitive string match to "`sig`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |hash| be undefined. +
++ Let |hash| be the string "`SHA-1`". +
++ Let |hash| be the string "`SHA-256`". +
++ Let |hash| be the string "`SHA-384`". +
++ Let |hash| be the string "`SHA-512`". +
++ Perform any [= RSA-PSS key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |jwk| + and obtaining |hash|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ Let |normalizedHash| be the result of + normalize an algorithm + with `alg` set to |hash| and `op` set + to `digest`. +
++ If |normalizedHash| is not equal to the + {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.3.2 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |privateKey| represent the + RSA private key identified by interpreting |jwk| + according to Section 6.3.2 of JSON Web + Algorithms [[JWA]]. +
++ If |privateKey| can be determined to not be a valid RSA private key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} representing |privateKey|. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |key| to {{KeyType/"private"}} +
++ If |jwk| does not meet the requirements of Section + 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |publicKey| represent the + RSA public key identified by interpreting |jwk| + according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. +
++ If |publicKey| can be determined to not be a valid RSA public key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} representing |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |key| to "`public`" +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}} dictionary. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSA-PSS`" +
++ Set the {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to the length, in bits, of the RSA public + modulus. +
++ Set the {{RsaKeyAlgorithm/publicExponent}} + attribute of |algorithm| to the {{BigInteger}} + representation of the RSA public exponent. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute of + |algorithm| to the {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm| +
+Return |key|.
++ Let |key| be the key to be exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |subjectPublicKey| field to the result of + DER-encoding an `RSAPublicKey` ASN.1 type, as defined + in [[RFC3447]], Appendix A.1.1, that + represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |privateKey| field to the result of DER-encoding + an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the + RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
+Let |jwk| be a new {{JsonWebKey}} dictionary.
+Set the `kty` attribute of |jwk| to the string + "`RSA`".
++ Let |hash| be the {{KeyAlgorithm/name}} + attribute of the {{RsaHashedKeyAlgorithm/hash}} + attribute of the {{CryptoKey/[[algorithm]]}} internal slot of + |key|. +
++ Set the `alg` attribute of |jwk| to the string + "`PS1`". +
++ Set the `alg` attribute of |jwk| to the string + "`PS256`". +
++ Set the `alg` attribute of |jwk| to the string + "`PS384`". +
++ Set the `alg` attribute of |jwk| to the string + "`PS512`". +
++ Perform any [= RSA-PSS key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{RsaHashedKeyAlgorithm/hash}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |alg|. +
++ Set the `alg` attribute of |jwk| to |alg|. +
++ Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| + according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. +
++ Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, + {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and + {{JsonWebKey/qi}} of |jwk| according to the + corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. +
++ If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot + of |key| is represented by more than two primes, set + the attribute named {{JsonWebKey/oth}} of |jwk| + according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 +
++ Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ The "`RSA-OAEP`" algorithm identifier is used to perform encryption + and decryption ordering to the RSAES-OAEP algorithm specified in + [[RFC3447]], using the SHA hash functions defined + in this specification and using the mask + generation function MGF1. +
++ Other specifications + may specify the use of additional hash algorithms with RSAES-OAEP. Such specifications + must define the digest operation for the additional hash algorithm and + key import steps and + key export steps for RSAES-OAEP. +
++ The [= recognized algorithm name =] for + this algorithm is "`RSA-OAEP`". +
+| Operation | +Parameters | +Result | +
|---|---|---|
| encrypt | +{{RsaOaepParams}} | +[= byte sequence =] | +
| decrypt | +{{RsaOaepParams}} | +[= byte sequence =] | +
| generateKey | +{{RsaHashedKeyGenParams}} | +{{CryptoKeyPair}} | +
| importKey | +{{RsaHashedImportParams}} | +{{CryptoKey}} | +
| exportKey | +None | +object | +
+dictionary RsaOaepParams : Algorithm {
+ BufferSource label;
+};
+
+ The label member represents the optional label/application data to associate with the message.
++ If the {{CryptoKey/[[type]]}} internal slot of |key| + is not "`public`", + then [= exception/throw =] an + {{InvalidAccessError}}. +
++ Let |label| be the {{RsaOaepParams/label}} member of + |normalizedAlgorithm| or the empty byte sequence if the + {{RsaOaepParams/label}} member of + |normalizedAlgorithm| is not present. +
++ Perform the encryption operation defined in Section 7.1 of [[RFC3447]] with the key represented by |key| + as the recipient's RSA public key, |plaintext| + as the message to be encrypted, |M| and |label| + as the label, |L|, and with the hash + function specified by the {{RsaHashedKeyAlgorithm/hash}} + attribute of the {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option and MGF1 (defined in Section B.2.1 of + [[RFC3447]]) as the MGF option. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |ciphertext| be the value |C| that results from performing the + operation. +
++ Return |ciphertext|. +
++ If the {{CryptoKey/[[type]]}} internal slot of |key| + is not {{KeyType/"private"}}, + then [= exception/throw =] an + {{InvalidAccessError}}. +
++ Let |label| be the {{RsaOaepParams/label}} member of + |normalizedAlgorithm| or the empty byte sequence if the + {{RsaOaepParams/label}} member of + |normalizedAlgorithm| is not present. +
++ Perform the decryption operation defined in Section 7.1 of [[RFC3447]] with the key represented by |key| + as the recipient's RSA private key, |ciphertext| + as the ciphertext to be decrypted, C, and |label| + as the label, |L|, and with the hash + function specified by the {{RsaHashedKeyAlgorithm/hash}} + attribute of the {{CryptoKey/[[algorithm]]}} internal slot of + |key| as the Hash option and MGF1 (defined in Section B.2.1 of + [[RFC3447]]) as the MGF option. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |plaintext| the value |M| that results from performing the + operation. +
++ Return |plaintext|. +
++ If |usages| contains an entry which is not + "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an RSA key pair, as defined in [[RFC3447]], with RSA modulus length equal to the + {{RsaKeyGenParams/modulusLength}} member of + |normalizedAlgorithm| and RSA public exponent equal to the + {{RsaKeyGenParams/publicExponent}} member of + |normalizedAlgorithm|. +
++ If performing the operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}} + object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSA-OAEP`". +
++ Set the + {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/modulusLength}} + member of |normalizedAlgorithm|. +
++ Set the + {{RsaKeyAlgorithm/publicExponent}} + attribute of |algorithm| to equal the + {{RsaKeyGenParams/publicExponent}} + member of |normalizedAlgorithm|. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute + of |algorithm| to equal the + {{RsaHashedKeyGenParams/hash}} member of + |normalizedAlgorithm|. +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal slot of + |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal slot of + |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the + [= usage intersection =] of + |usages| and `[ "encrypt", "wrapKey" ]`. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal slot of + |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal slot of + |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the + [= usage intersection =] of + |usages| and `[ "decrypt", "unwrapKey" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains an entry which is not + "`encrypt`" or + "`wrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `rsaEncryption` + object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |publicKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `subjectPublicKeyInfo` field of |spki|, + |structure| as the `RSAPublicKey` structure + specified in Section A.1.1 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or it can be determined that |publicKey| + is not a valid public key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA public key identified by + |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to "`public`" +
++ If |usages| contains an entry which is not + "`decrypt`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, then [= exception/throw =] a {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `rsaEncryption` object identifier defined in [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |rsaPrivateKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the + `privateKey` field of |privateKeyInfo|, + |structure| as the `RSAPrivateKey` structure + specified in Section A.1.2 of [[RFC3447]], and + |exactData| set to true. +
++ If an error occurred while parsing, or if |rsaPrivateKey| is not + a valid RSA private key according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the RSA private key identified by + |rsaPrivateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"private"}} +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field of |jwk| is present and + |usages| contains an entry which is not + "`decrypt`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/d}} field of |jwk| is not present and + |usages| contains an entry which is not + "`encrypt`" or "`wrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not a + case-sensitive string match to "`RSA`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not a case-sensitive string match to "`enc`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Perform any [= RSA-OAEP key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |jwk| + and obtaining |hash|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ Let |normalizedHash| be the result of + normalize an algorithm + with `alg` set to |hash| and `op` set + to `digest`. +
++ If |normalizedHash| is not equal to the + {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If |jwk| does not meet the requirements of Section + 6.3.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |privateKey| represent the + RSA private key identified by interpreting |jwk| + according to Section 6.3.2 of JSON Web Algorithms [[JWA]]. +
++ If |privateKey| can be determined to not be a valid RSA private key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} representing |privateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"private"}} +
++ If |jwk| does not meet the requirements of Section + 6.3.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |publicKey| represent the + RSA public key identified by interpreting |jwk| + according to Section 6.3.1 of JSON Web Algorithms [[JWA]]. +
++ If |publicKey| can be determined to not be a valid RSA public key + according to [[RFC3447]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} representing |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to "`public`" +
++ Let |algorithm| be a new + {{RsaHashedKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`RSA-OAEP`" +
++ Set the {{RsaKeyAlgorithm/modulusLength}} + attribute of |algorithm| to the length, in bits, of the RSA public + modulus. +
++ Set the {{RsaKeyAlgorithm/publicExponent}} + attribute of |algorithm| to the {{BigInteger}} + representation of the RSA public exponent. +
++ Set the {{RsaHashedKeyAlgorithm/hash}} attribute of + |algorithm| to the {{RsaHashedImportParams/hash}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal slot of + |key| to |algorithm| +
+Return |key|.
++ Let |key| be the key to be exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |subjectPublicKey| field to the result of + DER-encoding an `RSAPublicKey` ASN.1 type, as defined + in [[RFC3447]], Appendix A.1.1, that + represents the RSA public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| field to the OID + `rsaEncryption` defined in + [[RFC3447]]. +
++ Set the |params| field to the ASN.1 type NULL. +
++ Set the |privateKey| field to the result of DER-encoding + an `RSAPrivateKey` ASN.1 type, as defined in [[RFC3447]], Appendix A.1.2, that represents the + RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to the string + "`RSA`". +
++ Let |hash| be the {{KeyAlgorithm/name}} + attribute of the {{RsaHashedKeyAlgorithm/hash}} + attribute of the {{CryptoKey/[[algorithm]]}} internal slot of + |key|. +
++ Set the `alg` attribute of |jwk| to the string + "`RSA-OAEP`". +
++ Set the `alg` attribute of |jwk| to the string + "`RSA-OAEP-256`". +
++ Set the `alg` attribute of |jwk| to the string + "`RSA-OAEP-384`". +
++ Set the `alg` attribute of |jwk| to the string + "`RSA-OAEP-512`". +
++ Perform any [= RSA-OAEP key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{RsaHashedKeyAlgorithm/hash}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |alg|. +
++ Set the `alg` attribute of |jwk| to |alg|. +
++ Set the attributes {{JsonWebKey/n}} and {{JsonWebKey/e}} of |jwk| + according to the corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.1. +
++ Set the attributes named {{JsonWebKey/d}}, {{JsonWebKey/p}}, + {{JsonWebKey/q}}, {{JsonWebKey/dp}}, {{JsonWebKey/dq}}, and + {{JsonWebKey/qi}} of |jwk| according to the + corresponding definitions in JSON Web Algorithms [[JWA]], Section 6.3.2. +
++ If the underlying RSA private key represented by the {{CryptoKey/[[handle]]}} internal slot + of |key| is represented by more than two primes, set + the attribute named {{JsonWebKey/oth}} of |jwk| + according to the corresponding definition in JSON Web Algorithms [[JWA]], Section 6.3.2.7 +
++ Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ The "`ECDSA`" algorithm identifier is used to perform signing + and verification using the ECDSA algorithm specified in + [[RFC6090]] and using the SHA hash functions and elliptic + curves defined in this specification. +
++ Other specifications + may specify the use of additional elliptic curves and hash algorithms with ECDSA. To + specify additional hash algorithms to be used with ECDSA, a specification must define + a registered algorithm that supports the digest operation. + To specify an additional elliptic curve a specification must define + the curve name, + ECDSA signature steps, + ECDSA verification steps, + ECDSA generation steps, + ECDSA key import steps and + ECDSA key export steps. +
++ The [= recognized algorithm name =] for + this algorithm is "`ECDSA`". +
+| Operation | +Parameters | +Result | +
|---|---|---|
| sign | +{{EcdsaParams}} | +[= byte sequence =] | +
| verify | +{{EcdsaParams}} | +boolean | +
| generateKey | +{{EcKeyGenParams}} | +{{CryptoKeyPair}} | +
| importKey | +{{EcKeyImportParams}} | +{{CryptoKey}} | +
| exportKey | +None | +object | +
+dictionary EcdsaParams : Algorithm {
+ required HashAlgorithmIdentifier hash;
+};
+
+ The hash member represents the hash algorithm to use.
+
+typedef DOMString NamedCurve;
+
+dictionary EcKeyGenParams : Algorithm {
+ required NamedCurve namedCurve;
+};
+
+ + The NamedCurve type represents named elliptic curves, + which are a convenient way to specify the domain parameters of well-known elliptic + curves. The following values defined by this specification: +
++ Other specifications may define + additional values. +
+The namedCurve member of the {{EcKeyGenParams}} dictionary represents a named curve.
+
+dictionary EcKeyAlgorithm : KeyAlgorithm {
+ required NamedCurve namedCurve;
+};
+
+ The namedCurve member represents the named curve that the key uses.
+
+dictionary EcKeyImportParams : Algorithm {
+ required NamedCurve namedCurve;
+};
+
+ The namedCurve member represents a named curve.
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |hashAlgorithm| be the {{EcdsaParams/hash}} + member of |normalizedAlgorithm|. +
++ Let |M| be the result of performing the digest operation specified by + |hashAlgorithm| using |message|. +
++ Let |d| be the ECDSA private key associated with |key|. +
++ Let |params| be the EC domain parameters associated with + |key|. +
++ Perform the ECDSA signing process, as specified in [[RFC6090]], + Section 5.4, with |M| as the message, using |params| as the + EC domain parameters, and with |d| as the private key. +
++ Let |r| and |s| be the pair of integers resulting from + performing the ECDSA signing process. +
++ Let |result| be an empty [= byte sequence =]. +
++ Let |n| be the smallest integer such that |n| * 8 is greater than + the logarithm to base 2 of the order of the base point of the elliptic curve identified + by |params|. +
++ Convert |r| to a byte sequence of + length |n| and append it to |result|. +
++ Convert |s| to a byte sequence of + length |n| and append it to |result|. +
++ Perform the [= ECDSA signature steps =] + specified in that specification, passing in |M|, |params| + and |d| and resulting in |result|. +
++ Return |result|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |hashAlgorithm| be the {{EcdsaParams/hash}} + member of + |normalizedAlgorithm|. +
++ Let |M| be the result of performing the digest operation specified by + |hashAlgorithm| using |message|. +
++ Let |Q| be the ECDSA public key associated with |key|. +
++ Let |params| be the EC domain parameters associated with + |key|. +
++ Perform the ECDSA verifying process, as specified in [[RFC6090]], Section 5.3, with |M| as the received + message, |signature| as the received signature and using + |params| as the EC domain parameters, and + |Q| as the public key. +
++ Perform the [= ECDSA verification steps =] + specified in that specification passing in |M|, |signature|, + |params| and |Q| and resulting in an indication of whether + or not the purported signature is valid. +
++ Let |result| be a boolean with the value `true` if the signature is valid + and the value `false` otherwise. +
++ Return |result|. +
++ If |usages| contains a value which is not + one of "`sign`" or "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an Elliptic Curve key pair, as defined in [[RFC6090]] + with domain parameters for the curve identified by + the {{EcKeyGenParams/namedCurve}} member of + |normalizedAlgorithm|. +
++ Perform the [=ECDSA + generation steps =] specified in that specification, passing in + |normalizedAlgorithm| and resulting in an elliptic curve key pair. +
++ [= exception/throw =] a + {{NotSupportedError}} +
++ If performing the key generation operation results in an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |algorithm| be a new + {{EcKeyAlgorithm}} + object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDSA`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to equal the + {{namedCurve}} member of + |normalizedAlgorithm|. +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the [= usage + intersection =] of |usages| and `[ "verify" ]`. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the [= usage + intersection =] of |usages| and `[ "sign" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData| +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `id-ecPublicKey` + object identifier defined in [[RFC5480]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the `algorithm` + AlgorithmIdentifier field of |spki| is absent, + then [= exception/throw =] a + {{DataError}}. +
++ Let |params| be the `parameters` field of the + `algorithm` AlgorithmIdentifier field of |spki|. +
++ If |params| is not an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] that specifies a + `namedCurve`, then [= exception/throw =] a {{DataError}}. +
++ Let |namedCurve| be a string whose initial value is + undefined. +
++ Set |namedCurve| "`P-256`". +
++ Set |namedCurve| "`P-384`". +
++ Set |namedCurve| "`P-521`". +
++ Let |publicKey| be the Elliptic Curve public key identified by + performing the conversion steps defined in Section 2.3.4 of [[SEC1]] using the `subjectPublicKey` + field of |spki|. +
++ The uncompressed point format MUST be supported. +
++ If the implementation does not support the compressed point format and + a compressed point is provided, + [= exception/throw =] a + {{DataError}}. +
++ If a decode error occurs or an identity point is found, + [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents |publicKey|. +
++ Perform any [= ECDSA key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |spki| + and obtaining |namedCurve| and |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If the public key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Let |algorithm| be a new {{EcKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDSA`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| contains a value which is not + "`sign`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurs while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `id-ecPublicKey` object identifier defined in [[RFC5480]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo| is not present, + then [= exception/throw =] a + {{DataError}}. +
++ Let |params| be the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo|. +
++ If |params| is not an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] that specifies a + `namedCurve`, then [= exception/throw =] a {{DataError}}. +
++ Let |namedCurve| be a string whose initial value is + undefined. +
++ Set |namedCurve| "`P-256`". +
++ Set |namedCurve| "`P-384`". +
++ Set |namedCurve| "`P-521`". +
++ Let |ecPrivateKey| be the result of performing the [= parse an ASN.1 structure =] + algorithm, with |data| as the `privateKey` field + of |privateKeyInfo|, |structure| as the ASN.1 + `ECPrivateKey` structure specified in Section 3 of [[RFC5915]], and |exactData| set to true. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of |ecPrivateKey| is + present, and is not an instance of the `namedCurve` ASN.1 + type defined in [[RFC5480]], or does not contain + the same object identifier as the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo|, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the Elliptic Curve private key identified by + performing the conversion steps defined in Section 3 of [[RFC5915]] using |ecPrivateKey|. +
++ Perform any [= ECDSA key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |privateKeyInfo| + and obtaining |namedCurve| and |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If the private key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}} +
++ Let |algorithm| be a new {{EcKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDSA`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field is present and |usages| contains + a value which is not + "`sign`", or, + if the {{JsonWebKey/d}} field is not present and |usages| contains + a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not + "`EC`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`sig`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of JSON Web + Key [[JWK]], or it does not contain all of the specified |usages| + values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |namedCurve| be a string whose value is equal to the + {{JsonWebKey/crv}} field of |jwk|. +
++ If |namedCurve| is not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ Let |algNamedCurve| be a string whose initial value is + undefined. +
++ If |algNamedCurve| is defined, and is not equal to + |namedCurve|, [= exception/throw =] a {{DataError}}. +
++ If |jwk| does not meet the requirements of Section + 6.2.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Elliptic Curve private key identified by interpreting + |jwk| according to Section 6.2.2 of JSON Web Algorithms [[JWA]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"private"}}. +
++ If |jwk| does not meet the requirements of Section + 6.2.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Elliptic Curve public key identified by interpreting + |jwk| according to Section 6.2.1 of JSON Web Algorithms [[JWA]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to "`public`". +
++ Perform any [= ECDSA key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |jwk| + and obtaining |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If the key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Let |algorithm| be a new instance of an {{EcKeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDSA`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If the {{EcKeyImportParams/namedCurve}} + member of |normalizedAlgorithm| is not a + named curve, + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| contains a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |Q| be the elliptic curve point on the curve identified + by the {{EcKeyImportParams/namedCurve}} + member of |normalizedAlgorithm| identified by performing + the conversion steps defined in Section 2.3.4 of [[SEC1]] on |keyData|. +
++ The uncompressed point format MUST be supported. +
++ If the implementation does not support the compressed point format and + a compressed point is provided, + [= exception/throw =] a + {{DataError}}. +
++ If a decode error occurs or an identity point is found, + [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents |Q|. +
++ Perform any [= ECDH key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |keyData| + and obtaining |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ Let |algorithm| be a new {{EcKeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDSA`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to equal the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |key| +
++ Let |key| be the {{CryptoKey}} to be + exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| field to the OID + `id-ecPublicKey` defined in + [[RFC5480]]. +
++ Set the |parameters| field to an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] as follows: +
++ Let |keyData| be the + [= byte sequence =] that + represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| according to the encoding rules specified in + Section 2.2 of [[RFC5480]] and using the + uncompressed form. and |keyData|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp256r1` defined in [[RFC5480]] +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp384r1` defined in [[RFC5480]] +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp521r1` defined in [[RFC5480]] +
++ Perform any [= ECDSA key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurveOid| and |keyData|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier |namedCurveOid|. +
++ Set the |subjectPublicKey| field to |keyData|. +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| field to the OID + `id-ecPublicKey` defined in + [[RFC5480]]. +
++ Set the |parameters| field to an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] as follows: +
++ Let |keyData| be the result of DER-encoding + an instance of the `ECPrivateKey` structure defined in + Section 3 of [[RFC5915]] for the Elliptic + Curve private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| and that conforms to the following: +
++ The |parameters| field is present, and is equivalent + to the |parameters| field of the + |privateKeyAlgorithm| field of this + `PrivateKeyInfo` ASN.1 structure. +
++ The |publicKey| field is present and represents the + Elliptic Curve public key associated with the Elliptic Curve + private key represented by the {{CryptoKey/[[handle]]}} internal slot + of |key|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp256r1` defined in [[RFC5480]] +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp384r1` defined in [[RFC5480]] +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier + `secp521r1` defined in [[RFC5480]] +
++ Perform any [= ECDSA key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurveOid| and |keyData|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier |namedCurveOid|. +
++ Set the |privateKey| field to |keyData|. +
++ Let |result| be the result of DER-encoding |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to + "`EC`". +
++ Set the {{JsonWebKey/x}} attribute of |jwk| according to the + definition in Section 6.2.1.2 of JSON Web Algorithms [[JWA]]. +
++ Set the {{JsonWebKey/y}} attribute of |jwk| according to the + definition in Section 6.2.1.3 of JSON Web Algorithms [[JWA]]. +
++ Set the {{JsonWebKey/d}} attribute of |jwk| according to + the definition in Section 6.2.2.1 of JSON Web Algorithms [[JWA]]. +
++ Perform any [= ECDSA key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurve| and a new value of |jwk|. +
++ Set the {{JsonWebKey/crv}} attribute of |jwk| to + |namedCurve|. +
++ Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be a [= byte sequence =] representing the Elliptic Curve + point |Q| represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| according to [[SEC1]] 2.3.3 using the uncompressed format. +
++ Perform any [= ECDH key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurve| and |data|. +
++ Let |result| be |data|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ This describes using Elliptic Curve Diffie-Hellman (ECDH) for key generation and key + agreement, as specified by [[RFC6090]]. +
++ Other specifications + may specify the use of additional elliptic curves with ECDH. + To specify an additional elliptic curve a specification must define + the curve name, + ECDH generation steps, + ECDH derivation steps, + ECDH key import steps and + ECDH key export steps. +
++ The [= recognized algorithm name =] for + this algorithm is "`ECDH`". +
+| Operation | +Parameters | +Result | +
|---|---|---|
| generateKey | +{{EcKeyGenParams}} | +{{CryptoKeyPair}} | +
| deriveBits | +{{EcdhKeyDeriveParams}} | +[= byte sequence =] | +
| importKey | +{{EcKeyImportParams}} | +{{CryptoKey}} | +
| exportKey | +None | +object | +
+dictionary EcdhKeyDeriveParams : Algorithm {
+ required CryptoKey public;
+};
+
+ The public member represents the peer's EC public key.
++ If |usages| contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an Elliptic Curve key pair, as defined in [[RFC6090]] with domain parameters for the curve identified by + the {{EcKeyGenParams/namedCurve}} member of + |normalizedAlgorithm|. +
++ Perform the [= ECDH + generation steps =] specified in that specification, passing in + |normalizedAlgorithm| and resulting in an elliptic curve key pair. +
++ [= exception/throw =] a + {{NotSupportedError}} +
++ If performing the operation results in an error, + then [= exception/throw =] a + {{OperationError}}. +
++ Let |algorithm| be a new + {{EcKeyAlgorithm}} + object. +
++ Set the {{Algorithm/name}} member of + |algorithm| to "`ECDH`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to equal the + {{namedCurve}} member of + |normalizedAlgorithm|. +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the empty list. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the + [= usage intersection =] of + |usages| and `[ "deriveKey", "deriveBits" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |publicKey| be the + {{EcdhKeyDeriveParams/public}} member of + |normalizedAlgorithm|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |publicKey| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ If the {{KeyAlgorithm/name}} attribute of + the {{CryptoKey/[[algorithm]]}} internal slot of + |publicKey| is not equal to the {{KeyAlgorithm/name}} property of the {{CryptoKey/[[algorithm]]}} internal slot of + |key|, then [= exception/throw =] an {{InvalidAccessError}}. +
++ If the {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} internal slot of + |publicKey| is not equal to the {{EcKeyAlgorithm/namedCurve}} property of the {{CryptoKey/[[algorithm]]}} internal slot of + |key|, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Perform the ECDH primitive specified in [[RFC6090]] Section + 4 with |key| as the EC private key |d| and the EC public + key represented by the {{CryptoKey/[[handle]]}} + internal slot of |publicKey| as the EC public key. +
++ Let |secret| be a [= byte sequence =] containing + the result of applying the field element to + octet string conversion defined in Section + 6.2 of [[RFC6090]] + to the output of the ECDH primitive. +
++ Perform the [= ECDH + derivation steps =] specified in that specification, passing in + |key| and |publicKey| and resulting in |secret|. +
++ [= exception/throw =] a + {{NotSupportedError}} +
++ If performing the operation results in an error, + then [= exception/throw =] a + {{OperationError}}. +
+Let |keyData| be the key data to be imported.
++ If |usages| is not empty + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData| +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `id-ecPublicKey` + object identifier defined in [[RFC5480]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the `algorithm` + AlgorithmIdentifier field of |spki| is absent, + then [= exception/throw =] a + {{DataError}}. +
++ Let |params| be the `parameters` field of the + `algorithm` AlgorithmIdentifier field of |spki|. +
++ If |params| is not an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] that specifies a + `namedCurve`, then [= exception/throw =] a {{DataError}}. +
++ Let |namedCurve| be a string whose initial value is + undefined. +
++ Set |namedCurve| "`P-256`". +
++ Set |namedCurve| "`P-384`". +
++ Set |namedCurve| "`P-521`". +
++ Let |publicKey| be the Elliptic Curve public key identified by + performing the conversion steps defined in Section 2.3.4 of [[SEC1]] to the `subjectPublicKey` field of + |spki|. +
++ The uncompressed point format MUST be supported. +
++ If the implementation does not support the compressed point format and + a compressed point is provided, + [= exception/throw =] a + {{DataError}}. +
++ If a decode error occurs or an identity point is found, + [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents |publicKey|. +
++ Perform any [= ECDH key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |spki| + and obtaining |namedCurve| and |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If the key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Let |algorithm| be a new {{EcKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDH`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurs while parsing, + [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `id-ecPublicKey` object identifier + defined in [[RFC5480]], + [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo| is not present, + [= exception/throw =] a + {{DataError}}. +
++ Let |params| be the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo|. +
++ If |params| is not an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] that specifies a + `namedCurve`, then [= exception/throw =] a {{DataError}}. +
++ Let |namedCurve| be a string whose initial value is + undefined. +
++ Set |namedCurve| to "`P-256`". +
++ Set |namedCurve| to "`P-384`". +
++ Set |namedCurve| to "`P-521`". +
++ Let |ecPrivateKey| be the result of performing the + [= parse an ASN.1 structure =] + algorithm, with |data| as the `privateKey` field + of |privateKeyInfo|, |structure| as the ASN.1 + `ECPrivateKey` structure specified in Section 3 of + [[RFC5915]], and |exactData| set to true. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of |ecPrivateKey| is + present, and is not an instance of the `namedCurve` ASN.1 + type defined in [[RFC5480]], or does not contain + the same object identifier as the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo|, + [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the Elliptic Curve private key identified by + performing the conversion steps defined in Section 3 of [[RFC5915]] using |ecPrivateKey|. +
++ Perform any [= ECDH key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |privateKeyInfo| + and obtaining |namedCurve| and |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If the key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}}. +
++ Let |algorithm| be a new {{EcKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDH`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field is present and if |usages| + contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/d}} field is not present and if |usages| is not + empty + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is + not "`EC`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present + and is not equal to "`enc`" then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of JSON Web + Key [[JWK]], or it does not contain all of the specified |usages| + values, then [= exception/throw =] a {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |namedCurve| be a string whose value is equal to the + {{JsonWebKey/crv}} field of |jwk|. +
++ If |namedCurve| is not equal to the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. +
++ If |jwk| does not meet the requirements of Section + 6.2.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Elliptic Curve private key identified by interpreting + |jwk| according to Section 6.2.2 of JSON Web Algorithms [[JWA]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"private"}}. +
++ If |jwk| does not meet the requirements of Section + 6.2.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Elliptic Curve public key identified by interpreting + |jwk| according to Section 6.2.1 of JSON Web Algorithms [[JWA]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to "`public`". +
++ Perform any [= ECDH key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |jwk| + and obtaining |key|. +
++ If an error occurred or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ If the key value is not a valid point on the Elliptic Curve + identified by the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. +
++ Let |algorithm| be a new instance of an {{EcKeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDH`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to |namedCurve|. +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If the {{EcKeyImportParams/namedCurve}} + member of |normalizedAlgorithm| is not a + named curve, + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is not the empty list, + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |Q| be the Elliptic Curve public key on the curve identified + by the {{EcKeyImportParams/namedCurve}} + member of |normalizedAlgorithm| identified by performing + the conversion steps defined in Section 2.3.4 of [[SEC1]] to |keyData|. +
++ The uncompressed point format MUST be supported. +
++ If the implementation does not support the compressed point format and + a compressed point is provided, + [= exception/throw =] a + {{DataError}}. +
++ If a decode error occurs or an identity point is found, + [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents |Q|. +
++ Perform any [= ECDH key import steps | key import steps =] defined by + other applicable + specifications, passing |format|, |keyData| + and obtaining |key|. +
++ If an error occured or there are no + applicable + specifications, + [= exception/throw =] a + {{DataError}}. +
++ Let |algorithm| be a new {{EcKeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`ECDH`". +
++ Set the {{EcKeyAlgorithm/namedCurve}} + attribute of |algorithm| to equal the {{EcKeyImportParams/namedCurve}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ Return |key| +
+Let |keyData| be the key data to be imported.
-- If |usages| contains a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData| -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `id-ecPublicKey` - object identifier defined in [[RFC5480]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the `algorithm` - AlgorithmIdentifier field of |spki| is absent, - then [= exception/throw =] a - {{DataError}}. -
-- Let |params| be the `parameters` field of the - `algorithm` AlgorithmIdentifier field of |spki|. -
-- If |params| is not an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] that specifies a - `namedCurve`, then [= exception/throw =] a {{DataError}}. -
-- Let |namedCurve| be a string whose initial value is - undefined. -
-- Set |namedCurve| "`P-256`". -
-- Set |namedCurve| "`P-384`". -
-- Set |namedCurve| "`P-521`". -
-- Let |publicKey| be the Elliptic Curve public key identified by - performing the conversion steps defined in Section 2.3.4 of [[SEC1]] using the `subjectPublicKey` - field of |spki|. -
-- The uncompressed point format MUST be supported. -
-- If the implementation does not support the compressed point format and - a compressed point is provided, - [= exception/throw =] a - {{DataError}}. -
-- If a decode error occurs or an identity point is found, - [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents |publicKey|. -
-- Perform any [= ECDSA key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |spki| - and obtaining |namedCurve| and |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If the public key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Let |algorithm| be a new {{EcKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDSA`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| contains a value which is not - "`sign`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurs while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `id-ecPublicKey` object identifier defined in [[RFC5480]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo| is not present, - then [= exception/throw =] a - {{DataError}}. -
-- Let |params| be the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo|. -
-- If |params| is not an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] that specifies a - `namedCurve`, then [= exception/throw =] a {{DataError}}. -
-- Let |namedCurve| be a string whose initial value is - undefined. -
-- Set |namedCurve| "`P-256`". -
-- Set |namedCurve| "`P-384`". -
-- Set |namedCurve| "`P-521`". -
-- Let |ecPrivateKey| be the result of performing the [= parse an ASN.1 structure =] - algorithm, with |data| as the `privateKey` field - of |privateKeyInfo|, |structure| as the ASN.1 - `ECPrivateKey` structure specified in Section 3 of [[RFC5915]], and |exactData| set to true. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of |ecPrivateKey| is - present, and is not an instance of the `namedCurve` ASN.1 - type defined in [[RFC5480]], or does not contain - the same object identifier as the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo|, - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the Elliptic Curve private key identified by - performing the conversion steps defined in Section 3 of [[RFC5915]] using |ecPrivateKey|. -
-- Perform any [= ECDSA key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |privateKeyInfo| - and obtaining |namedCurve| and |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If the private key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}} -
-- Let |algorithm| be a new {{EcKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDSA`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field is present and |usages| contains - a value which is not - "`sign`", or, - if the {{JsonWebKey/d}} field is not present and |usages| contains - a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not - "`EC`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`sig`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of JSON Web - Key [[JWK]], or it does not contain all of the specified |usages| - values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Let |namedCurve| be a string whose value is equal to the - {{JsonWebKey/crv}} field of |jwk|. -
-- If |namedCurve| is not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- Let |algNamedCurve| be a string whose initial value is - undefined. -
-- If |algNamedCurve| is defined, and is not equal to - |namedCurve|, [= exception/throw =] a {{DataError}}. -
-- If |jwk| does not meet the requirements of Section - 6.2.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Elliptic Curve private key identified by interpreting - |jwk| according to Section 6.2.2 of JSON Web Algorithms [[JWA]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"private"}}. -
-- If |jwk| does not meet the requirements of Section - 6.2.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Elliptic Curve public key identified by interpreting - |jwk| according to Section 6.2.1 of JSON Web Algorithms [[JWA]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to "`public`". -
-- Perform any [= ECDSA key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |jwk| - and obtaining |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If the key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Let |algorithm| be a new instance of an {{EcKeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDSA`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If the {{EcKeyImportParams/namedCurve}} - member of |normalizedAlgorithm| is not a - named curve, - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| contains a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |Q| be the elliptic curve point on the curve identified - by the {{EcKeyImportParams/namedCurve}} - member of |normalizedAlgorithm| identified by performing - the conversion steps defined in Section 2.3.4 of [[SEC1]] on |keyData|. -
-- The uncompressed point format MUST be supported. -
-- If the implementation does not support the compressed point format and - a compressed point is provided, - [= exception/throw =] a - {{DataError}}. -
-- If a decode error occurs or an identity point is found, - [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents |Q|. -
-- Perform any [= ECDH key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |keyData| - and obtaining |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- Let |algorithm| be a new {{EcKeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDSA`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to equal the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |key| -
-- Let |key| be the {{CryptoKey}} to be - exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| field to the OID - `id-ecPublicKey` defined in - [[RFC5480]]. -
-- Set the |parameters| field to an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] as follows: -
-- Let |keyData| be the - [= byte sequence =] that - represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| according to the encoding rules specified in - Section 2.2 of [[RFC5480]] and using the - uncompressed form. and |keyData|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp256r1` defined in [[RFC5480]] -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp384r1` defined in [[RFC5480]] -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp521r1` defined in [[RFC5480]] -
-- Perform any [= ECDSA key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurveOid| and |keyData|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier |namedCurveOid|. -
-- Set the |subjectPublicKey| field to |keyData|. -
-- Let |result| be the result of DER-encoding |data|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| field to the OID - `id-ecPublicKey` defined in - [[RFC5480]]. -
-- Set the |parameters| field to an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] as follows: -
-- Let |keyData| be the result of DER-encoding - an instance of the `ECPrivateKey` structure defined in - Section 3 of [[RFC5915]] for the Elliptic - Curve private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| and that conforms to the following: -
-- The |parameters| field is present, and is equivalent - to the |parameters| field of the - |privateKeyAlgorithm| field of this - `PrivateKeyInfo` ASN.1 structure. -
-- The |publicKey| field is present and represents the - Elliptic Curve public key associated with the Elliptic Curve - private key represented by the {{CryptoKey/[[handle]]}} internal slot - of |key|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp256r1` defined in [[RFC5480]] -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp384r1` defined in [[RFC5480]] -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier - `secp521r1` defined in [[RFC5480]] -
-- Perform any [= ECDSA key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurveOid| and |keyData|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier |namedCurveOid|. -
-- Set the |privateKey| field to |keyData|. -
-- Let |result| be the result of DER-encoding |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to - "`EC`". -
-- Set the {{JsonWebKey/x}} attribute of |jwk| according to the - definition in Section 6.2.1.2 of JSON Web Algorithms [[JWA]]. -
-- Set the {{JsonWebKey/y}} attribute of |jwk| according to the - definition in Section 6.2.1.3 of JSON Web Algorithms [[JWA]]. -
-- Set the {{JsonWebKey/d}} attribute of |jwk| according to - the definition in Section 6.2.2.1 of JSON Web Algorithms [[JWA]]. -
-- Perform any [= ECDSA key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurve| and a new value of |jwk|. -
-+
+ Let |key| be the {{CryptoKey}} to be + exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| field to the OID + `id-ecPublicKey` defined in + [[RFC5480]]. +
++ Set the |parameters| field to an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] as follows: +
++ Let |keyData| be the [= byte sequence =] that + represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| according to the encoding rules specified in + Section 2.3.3 of [[SEC1]] and using the + uncompressed form. +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp256r1` defined in [[RFC5480]] +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp384r1` defined in [[RFC5480]] +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp521r1` defined in [[RFC5480]] +
++ Perform any [= ECDH key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurveOid| and |keyData|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier |namedCurveOid|. +
++ Set the |subjectPublicKey| field to |keyData| +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| field to the OID + `id-ecPublicKey` defined in + [[RFC5480]]. +
++ Set the |parameters| field to an instance of the + `ECParameters` ASN.1 type defined in + [[RFC5480]] as follows: +
++ Let |keyData| be the result of DER-encoding + an instance of the `ECPrivateKey` structure defined in + Section 3 of [[RFC5915]] for the Elliptic + Curve private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| and that conforms to the following: +
++ The |parameters| field is present, and is equivalent + to the |parameters| field of the + |privateKeyAlgorithm| field of this + `PrivateKeyInfo` ASN.1 structure. +
++ The |publicKey| field is present and represents the + Elliptic Curve public key associated with the Elliptic Curve + private key represented by the {{CryptoKey/[[handle]]}} internal slot + of |key|. +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp256r1` defined in [[RFC5480]] +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp384r1` defined in [[RFC5480]] +
++ Set |parameters| to the |namedCurve| choice + with value equal to the object identifier + `secp521r1` defined in [[RFC5480]] +
++ Perform any [= ECDH key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurveOid| and |keyData|. +
++ Set |parameters| to the `namedCurve` choice + with value equal to the object identifier |namedCurveOid|. +
++ Set the |privateKey| field to |keyData|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to + "`EC`". +
+- Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be a [= byte sequence =] representing the Elliptic Curve - point |Q| represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| according to [[SEC1]] 2.3.3 using the uncompressed format. -
-- Perform any [= ECDH key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurve| and |data|. -
-- Let |result| be |data|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-+ Set the {{JsonWebKey/x}} attribute of |jwk| according to the + definition in Section 6.2.1.2 of JSON Web Algorithms [[JWA]]. +
++ Set the {{JsonWebKey/y}} attribute of |jwk| according to the + definition in Section 6.2.1.3 of JSON Web Algorithms [[JWA]]. +
++ Set the {{JsonWebKey/d}} attribute of |jwk| according to the + definition in Section 6.2.2.1 of JSON Web Algorithms [[JWA]]. +
++ Perform any [= ECDH key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurve| and a new value of |jwk|. +
++ Set the {{JsonWebKey/crv}} attribute of |jwk| to + |namedCurve|. +
++ Set the `key_ops` attribute of |jwk| to the + {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be the [= byte sequence =] that + represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| according to the encoding rules specified in + Section 2.3.3 of [[SEC1]] and using the + uncompressed form. +
++ Perform any [= ECDH key export steps | key export steps =] + defined by other applicable + specifications, passing |format| and the + {{EcKeyAlgorithm/namedCurve}} attribute of + the {{CryptoKey/[[algorithm]]}} + internal slot of |key| + and obtaining |namedCurve| and |data|. +
++ Let |result| be |data|. +
++ Return |result|. +
+- This describes using Elliptic Curve Diffie-Hellman (ECDH) for key generation and key - agreement, as specified by [[RFC6090]]. -
-- Other specifications - may specify the use of additional elliptic curves with ECDH. - To specify an additional elliptic curve a specification must define - the curve name, - ECDH generation steps, - ECDH derivation steps, - ECDH key import steps and - ECDH key export steps. + The "`Ed25519`" algorithm identifier is used to perform signing + and verification using the Ed25519 algorithm specified in + [[RFC8032]].
The [= recognized algorithm name =] for - this algorithm is "`ECDH`". + this algorithm is "`Ed25519`".
| generateKey | -{{EcKeyGenParams}} | -{{CryptoKeyPair}} | +sign | +None | +[= byte sequence =] |
| deriveBits | -{{EcdhKeyDeriveParams}} | -[= byte sequence =] | +verify | +None | +boolean | +
| generateKey | +None | +{{CryptoKeyPair}} | |||
| importKey | -{{EcKeyImportParams}} | +None | {{CryptoKey}} | ||
-dictionary EcdhKeyDeriveParams : Algorithm {
- required CryptoKey public;
-};
-
- The public member represents the peer's EC public key.
-- If |usages| contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an Elliptic Curve key pair, as defined in [[RFC6090]] with domain parameters for the curve identified by - the {{EcKeyGenParams/namedCurve}} member of - |normalizedAlgorithm|. -
-- Perform the [= ECDH - generation steps =] specified in that specification, passing in - |normalizedAlgorithm| and resulting in an elliptic curve key pair. -
-- [= exception/throw =] a - {{NotSupportedError}} -
-- If performing the operation results in an error, - then [= exception/throw =] a - {{OperationError}}. -
-- Let |algorithm| be a new - {{EcKeyAlgorithm}} - object. -
-- Set the {{Algorithm/name}} member of - |algorithm| to "`ECDH`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to equal the - {{namedCurve}} member of - |normalizedAlgorithm|. -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the empty list. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the - [= usage intersection =] of - |usages| and `[ "deriveKey", "deriveBits" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-+ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |result| be the result of performing the Ed25519 + signing process, as specified in [[RFC8032]], + Section 5.1.6, with |message| as |M|, + using the Ed25519 private key associated with |key|. +
+- Return |result|. + Some implementations may (wish to) generate randomized signatures + as per draft-irtf-cfrg-det-sigs-with-noise + instead of deterministic signatures as per [[RFC8032]].
- - - -- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. + See WICG/webcrypto-secure-curves issue 28.
-+ Return |result|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"public"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ If the key data of |key| represents an invalid point or a small-order element + on the Elliptic Curve of Ed25519, return `false`. +
+- Let |publicKey| be the - {{EcdhKeyDeriveParams/public}} member of - |normalizedAlgorithm|. + Not all implementations perform this check.
- -- If the {{CryptoKey/[[type]]}} internal slot of - |publicKey| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. + See WICG/webcrypto-secure-curves issue 27.
-+ If the point R, encoded in the first half of |signature|, + represents an invalid point or a small-order element + on the Elliptic Curve of Ed25519, return `false`. +
+- If the {{KeyAlgorithm/name}} attribute of - the {{CryptoKey/[[algorithm]]}} internal slot of - |publicKey| is not equal to the {{KeyAlgorithm/name}} property of the {{CryptoKey/[[algorithm]]}} internal slot of - |key|, then [= exception/throw =] an {{InvalidAccessError}}. + Not all implementations perform this check.
- -- If the {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} internal slot of - |publicKey| is not equal to the {{EcKeyAlgorithm/namedCurve}} property of the {{CryptoKey/[[algorithm]]}} internal slot of - |key|, then [= exception/throw =] an {{InvalidAccessError}}. + See WICG/webcrypto-secure-curves issue 27.
-- Perform the ECDH primitive specified in [[RFC6090]] Section - 4 with |key| as the EC private key |d| and the EC public - key represented by the {{CryptoKey/[[handle]]}} - internal slot of |publicKey| as the EC public key. -
-- Let |secret| be a [= byte sequence =] containing - the result of applying the field element to - octet string conversion defined in Section - 6.2 of [[RFC6090]] - to the output of the ECDH primitive. -
-- Perform the [= ECDH - derivation steps =] specified in that specification, passing in - |key| and |publicKey| and resulting in |secret|. -
-- [= exception/throw =] a - {{NotSupportedError}} -
-+ Perform the Ed25519 verification steps, as specified in [[RFC8032]], + Section 5.1.7, using the cofactorless (unbatched) equation, + `[S]B = R + [k]A'`, on the |signature|, with |message| as |M|, + using the Ed25519 public key associated with |key|. +
++ Let |result| be a boolean with the value `true` if the signature is valid + and the value `false` otherwise. +
++ Return |result|. +
+- If performing the operation results in an error, - then [= exception/throw =] a - {{OperationError}}. -
-+ If |usages| contains a value which is not + one of "`sign`" or "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an Ed25519 key pair, as defined in [[RFC8032]], section 5.1.5. +
++ Let |algorithm| be a new {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`Ed25519`". +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the [= usage intersection =] + of |usages| and `[ "verify" ]`. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the [= usage intersection =] + of |usages| and `[ "sign" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `id-Ed25519` + object identifier defined in [[RFC8410]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the `algorithm` + AlgorithmIdentifier field of |spki| is present, + then [= exception/throw =] a + {{DataError}}. +
++ Let |publicKey| be the Ed25519 public key identified by + the `subjectPublicKey` field of |spki|. +
++ Let |key| be a new {{CryptoKey}} + that represents |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Let |algorithm| be a new {{KeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`Ed25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| contains a value which is not + "`sign`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurs while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `id-Ed25519` object identifier defined in [[RFC8410]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo| is present, + then [= exception/throw =] a + {{DataError}}. +
++ Let |curvePrivateKey| be the result of performing the + [= parse an ASN.1 structure =] + algorithm, with |data| as the `privateKey` field + of |privateKeyInfo|, |structure| as the ASN.1 + `CurvePrivateKey` structure specified in Section 7 of [[RFC8410]], and |exactData| set to true. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the Ed25519 private key identified by |curvePrivateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}} +
++ Let |algorithm| be a new {{KeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`Ed25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field is present and |usages| contains + a value which is not + "`sign`", or, + if the {{JsonWebKey/d}} field is not present and |usages| contains + a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not + "`OKP`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/crv}} field of |jwk| is not + "`Ed25519`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/alg}} field of |jwk| is present and is + not "`Ed25519`" or "`EdDSA`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`sig`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of JSON Web + Key [[JWK]], or it does not contain all of the specified |usages| + values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + the JWK private key format described in Section 2 + of [[RFC8037]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Ed25519 private key identified by interpreting + |jwk| according to Section 2 of [[RFC8037]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"private"}}. +
++ If |jwk| does not meet the requirements of + the JWK public key format described in Section 2 + of [[RFC8037]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + Ed25519 public key identified by interpreting + |jwk| according to Section 2 of [[RFC8037]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"public"}}. +
++ Let |algorithm| be a new instance of a {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`Ed25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| contains a value which is not + "`verify`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |algorithm| be a new {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`Ed25519`". +
++ Let |key| be a new {{CryptoKey}} + representing the key data provided in |keyData|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |key| +
+Let |keyData| be the key data to be imported.
-- If |usages| is not empty - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData| -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `id-ecPublicKey` - object identifier defined in [[RFC5480]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the `algorithm` - AlgorithmIdentifier field of |spki| is absent, - then [= exception/throw =] a - {{DataError}}. -
-- Let |params| be the `parameters` field of the - `algorithm` AlgorithmIdentifier field of |spki|. -
-- If |params| is not an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] that specifies a - `namedCurve`, then [= exception/throw =] a {{DataError}}. -
-- Let |namedCurve| be a string whose initial value is - undefined. -
-- Set |namedCurve| "`P-256`". -
-- Set |namedCurve| "`P-384`". -
-- Set |namedCurve| "`P-521`". -
-- Let |publicKey| be the Elliptic Curve public key identified by - performing the conversion steps defined in Section 2.3.4 of [[SEC1]] to the `subjectPublicKey` field of - |spki|. -
-- The uncompressed point format MUST be supported. -
-- If the implementation does not support the compressed point format and - a compressed point is provided, - [= exception/throw =] a - {{DataError}}. -
-- If a decode error occurs or an identity point is found, - [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents |publicKey|. -
-- Perform any [= ECDH key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |spki| - and obtaining |namedCurve| and |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If the key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Let |algorithm| be a new {{EcKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDH`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurs while parsing, - [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `id-ecPublicKey` object identifier - defined in [[RFC5480]], - [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo| is not present, - [= exception/throw =] a - {{DataError}}. -
-- Let |params| be the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo|. -
-- If |params| is not an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] that specifies a - `namedCurve`, then [= exception/throw =] a {{DataError}}. -
-- Let |namedCurve| be a string whose initial value is - undefined. -
-- Set |namedCurve| to "`P-256`". -
-- Set |namedCurve| to "`P-384`". -
-- Set |namedCurve| to "`P-521`". -
-- Let |ecPrivateKey| be the result of performing the - [= parse an ASN.1 structure =] - algorithm, with |data| as the `privateKey` field - of |privateKeyInfo|, |structure| as the ASN.1 - `ECPrivateKey` structure specified in Section 3 of - [[RFC5915]], and |exactData| set to true. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of |ecPrivateKey| is - present, and is not an instance of the `namedCurve` ASN.1 - type defined in [[RFC5480]], or does not contain - the same object identifier as the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo|, - [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the Elliptic Curve private key identified by - performing the conversion steps defined in Section 3 of [[RFC5915]] using |ecPrivateKey|. -
-- Perform any [= ECDH key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |privateKeyInfo| - and obtaining |namedCurve| and |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If |namedCurve| is defined, and not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If the key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}}. -
-- Let |algorithm| be a new {{EcKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDH`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field is present and if |usages| - contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/d}} field is not present and if |usages| is not - empty - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is - not "`EC`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present - and is not equal to "`enc`" then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of JSON Web - Key [[JWK]], or it does not contain all of the specified |usages| - values, then [= exception/throw =] a {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Let |namedCurve| be a string whose value is equal to the - {{JsonWebKey/crv}} field of |jwk|. -
-- If |namedCurve| is not equal to the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|, [= exception/throw =] a {{DataError}}. -
-- If |jwk| does not meet the requirements of Section - 6.2.2 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Elliptic Curve private key identified by interpreting - |jwk| according to Section 6.2.2 of JSON Web Algorithms [[JWA]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"private"}}. -
-- If |jwk| does not meet the requirements of Section - 6.2.1 of JSON Web Algorithms [[JWA]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Elliptic Curve public key identified by interpreting - |jwk| according to Section 6.2.1 of JSON Web Algorithms [[JWA]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to "`public`". -
-- Perform any [= ECDH key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |jwk| - and obtaining |key|. -
-- If an error occurred or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- If the key value is not a valid point on the Elliptic Curve - identified by the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm| [= exception/throw =] a {{DataError}}. -
-- Let |algorithm| be a new instance of an {{EcKeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDH`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to |namedCurve|. -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If the {{EcKeyImportParams/namedCurve}} - member of |normalizedAlgorithm| is not a - named curve, - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is not the empty list, - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |Q| be the Elliptic Curve public key on the curve identified - by the {{EcKeyImportParams/namedCurve}} - member of |normalizedAlgorithm| identified by performing - the conversion steps defined in Section 2.3.4 of [[SEC1]] to |keyData|. -
-- The uncompressed point format MUST be supported. -
-- If the implementation does not support the compressed point format and - a compressed point is provided, - [= exception/throw =] a - {{DataError}}. -
-- If a decode error occurs or an identity point is found, - [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents |Q|. -
-- Perform any [= ECDH key import steps | key import steps =] defined by - other applicable - specifications, passing |format|, |keyData| - and obtaining |key|. -
-- If an error occured or there are no - applicable - specifications, - [= exception/throw =] a - {{DataError}}. -
-- Let |algorithm| be a new {{EcKeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`ECDH`". -
-- Set the {{EcKeyAlgorithm/namedCurve}} - attribute of |algorithm| to equal the {{EcKeyImportParams/namedCurve}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- Return |key| -
-- Let |key| be the {{CryptoKey}} to be - exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| field to the OID - `id-ecPublicKey` defined in - [[RFC5480]]. -
-- Set the |parameters| field to an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] as follows: -
-- Let |keyData| be the [= byte sequence =] that - represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| according to the encoding rules specified in - Section 2.3.3 of [[SEC1]] and using the - uncompressed form. -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp256r1` defined in [[RFC5480]] -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp384r1` defined in [[RFC5480]] -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp521r1` defined in [[RFC5480]] -
-- Perform any [= ECDH key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurveOid| and |keyData|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier |namedCurveOid|. -
-- Set the |subjectPublicKey| field to |keyData| -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| field to the OID - `id-ecPublicKey` defined in - [[RFC5480]]. -
-- Set the |parameters| field to an instance of the - `ECParameters` ASN.1 type defined in - [[RFC5480]] as follows: -
-- Let |keyData| be the result of DER-encoding - an instance of the `ECPrivateKey` structure defined in - Section 3 of [[RFC5915]] for the Elliptic - Curve private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| and that conforms to the following: -
-- The |parameters| field is present, and is equivalent - to the |parameters| field of the - |privateKeyAlgorithm| field of this - `PrivateKeyInfo` ASN.1 structure. -
-- The |publicKey| field is present and represents the - Elliptic Curve public key associated with the Elliptic Curve - private key represented by the {{CryptoKey/[[handle]]}} internal slot - of |key|. -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp256r1` defined in [[RFC5480]] -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp384r1` defined in [[RFC5480]] -
-- Set |parameters| to the |namedCurve| choice - with value equal to the object identifier - `secp521r1` defined in [[RFC5480]] -
-- Perform any [= ECDH key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurveOid| and |keyData|. -
-- Set |parameters| to the `namedCurve` choice - with value equal to the object identifier |namedCurveOid|. -
-- Set the |privateKey| field to |keyData|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to - "`EC`". -
-- Set the {{JsonWebKey/x}} attribute of |jwk| according to the - definition in Section 6.2.1.2 of JSON Web Algorithms [[JWA]]. -
-- Set the {{JsonWebKey/y}} attribute of |jwk| according to the - definition in Section 6.2.1.3 of JSON Web Algorithms [[JWA]]. -
-- Set the {{JsonWebKey/d}} attribute of |jwk| according to the - definition in Section 6.2.2.1 of JSON Web Algorithms [[JWA]]. -
-- Perform any [= ECDH key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurve| and a new value of |jwk|. -
-- Set the {{JsonWebKey/crv}} attribute of |jwk| to - |namedCurve|. -
-- Set the `key_ops` attribute of |jwk| to the - {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-+
+ Let |key| be the {{CryptoKey}} to be + exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| object identifier to the + `id-Ed25519` OID defined in [[RFC8410]]. +
++ Set the |subjectPublicKey| field to |keyData|. +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| object identifier to the + `id-Ed25519` OID defined in [[RFC8410]]. +
++ Set the |privateKey| field to the result of DER-encoding + a `CurvePrivateKey` ASN.1 type, as defined in Section 7 of [[RFC8410]], that represents the + Ed25519 private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to + "`OKP`". +
++ Set the `alg` attribute of |jwk| to + "`Ed25519`". +
++ Set the `crv` attribute of |jwk| to + "`Ed25519`". +
++ Set the {{JsonWebKey/x}} attribute of |jwk| according to the + definition in Section 2 of [[RFC8037]]. +
+- Let |data| be the [= byte sequence =] that - represents the Elliptic Curve public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| according to the encoding rules specified in - Section 2.3.3 of [[SEC1]] and using the - uncompressed form. -
-- Perform any [= ECDH key export steps | key export steps =] - defined by other applicable - specifications, passing |format| and the - {{EcKeyAlgorithm/namedCurve}} attribute of - the {{CryptoKey/[[algorithm]]}} - internal slot of |key| - and obtaining |namedCurve| and |data|. -
-- Let |result| be |data|. -
-- Return |result|. -
-+ Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be a [= byte sequence =] representing the Ed25519 + public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
+- The "`Ed25519`" algorithm identifier is used to perform signing - and verification using the Ed25519 algorithm specified in - [[RFC8032]]. + The "`X25519`" algorithm identifier is used to perform + key agreement using the X25519 algorithm specified in + [[RFC7748]].
The [= recognized algorithm name =] for - this algorithm is "`Ed25519`". + this algorithm is "`X25519`".
| sign | -None | +deriveBits | +{{EcdhKeyDeriveParams}} | [= byte sequence =] |
| verify | -None | -boolean | -||
| generateKey | None | @@ -10318,841 +11213,810 @@
- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |result| be the result of performing the Ed25519 - signing process, as specified in [[RFC8032]], - Section 5.1.6, with |message| as |M|, - using the Ed25519 private key associated with |key|. -
-- Some implementations may (wish to) generate randomized signatures - as per draft-irtf-cfrg-det-sigs-with-noise - instead of deterministic signatures as per [[RFC8032]]. -
- -- Return |result|. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"public"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- If the key data of |key| represents an invalid point or a small-order element - on the Elliptic Curve of Ed25519, return `false`. -
-- Not all implementations perform this check. -
- -- If the point R, encoded in the first half of |signature|, - represents an invalid point or a small-order element - on the Elliptic Curve of Ed25519, return `false`. -
-- Not all implementations perform this check. -
- -- Perform the Ed25519 verification steps, as specified in [[RFC8032]], - Section 5.1.7, using the cofactorless (unbatched) equation, - `[S]B = R + [k]A'`, on the |signature|, with |message| as |M|, - using the Ed25519 public key associated with |key|. -
-- Let |result| be a boolean with the value `true` if the signature is valid - and the value `false` otherwise. -
-- Return |result|. -
-- If |usages| contains a value which is not - one of "`sign`" or "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an Ed25519 key pair, as defined in [[RFC8032]], section 5.1.5. -
-- Let |algorithm| be a new {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`Ed25519`". -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the [= usage intersection =] - of |usages| and `[ "verify" ]`. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the [= usage intersection =] - of |usages| and `[ "sign" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-- Return |result|. -
-+ If the {{CryptoKey/[[type]]}} internal slot of + |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |publicKey| be the + {{EcdhKeyDeriveParams/public}} member of + |normalizedAlgorithm|. +
++ If the {{CryptoKey/[[type]]}} internal slot of + |publicKey| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ If the {{KeyAlgorithm/name}} attribute of + the {{CryptoKey/[[algorithm]]}} internal slot of + |publicKey| is not equal to the {{KeyAlgorithm/name}} property of the {{CryptoKey/[[algorithm]]}} internal slot of + |key|, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |secret| be the result of performing the X25519 function specified in + [[RFC7748]] Section 5 with |key| as the X25519 private key |k| + and the X25519 public key represented by the {{CryptoKey/[[handle]]}} + internal slot of |publicKey| as the X25519 public key |u|. +
++ If |secret| is the all-zero value, + then [= exception/throw =] a {{OperationError}}. + This check must be performed in constant-time, as per [[RFC7748]] Section 6.1. +
++ If |usages| contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Generate an X25519 key pair, with the private key being 32 random bytes, + and the public key being `X25519(a, 9)`, + as defined in [[RFC7748]], section 6.1. +
++ Let |algorithm| be a new {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`X25519`". +
++ Let |publicKey| be a new {{CryptoKey}} + representing the public key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |publicKey| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |publicKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |publicKey| to true. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |publicKey| to be the empty list. +
++ Let |privateKey| be a new {{CryptoKey}} + representing the private key of the generated key pair. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |privateKey| to {{KeyType/"private"}} +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |privateKey| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |privateKey| to |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |privateKey| to be the + [= usage intersection =] of + |usages| and `[ "deriveKey", "deriveBits" ]`. +
++ Let |result| be a new {{CryptoKeyPair}} + dictionary. +
++ Set the {{CryptoKeyPair/publicKey}} attribute + of |result| to be |publicKey|. +
++ Set the {{CryptoKeyPair/privateKey}} attribute + of |result| to be |privateKey|. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| is not empty + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |spki| be the result of running the + [= parse a subjectPublicKeyInfo =] + algorithm over |keyData|. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `algorithm` AlgorithmIdentifier field of |spki| is + not equal to the `id-X25519` + object identifier defined in [[RFC8410]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the `algorithm` + AlgorithmIdentifier field of |spki| is present, + then [= exception/throw =] a + {{DataError}}. +
++ Let |publicKey| be the X25519 public key identified by + the `subjectPublicKey` field of |spki|. +
++ Let |key| be a new {{CryptoKey}} + that represents |publicKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Let |algorithm| be a new {{KeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`X25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |privateKeyInfo| be the result of running the + [= parse a privateKeyInfo =] + algorithm over |keyData|. +
++ If an error occurs while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ If the `algorithm` object identifier field of the + `privateKeyAlgorithm` PrivateKeyAlgorithm field of + |privateKeyInfo| is not equal to the + `id-X25519` object identifier defined in [[RFC8410]], + then [= exception/throw =] a + {{DataError}}. +
++ If the `parameters` field of the + `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field + of |privateKeyInfo| is present, + then [= exception/throw =] a + {{DataError}}. +
++ Let |curvePrivateKey| be the result of performing the + [= parse an ASN.1 structure =] + algorithm, with |data| as the `privateKey` field + of |privateKeyInfo|, |structure| as the ASN.1 + `CurvePrivateKey` structure specified in Section 7 of [[RFC8410]], and |exactData| set to true. +
++ If an error occurred while parsing, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + that represents the X25519 private key identified by |curvePrivateKey|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to {{KeyType/"private"}} +
++ Let |algorithm| be a new {{KeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`X25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/d}} field is present and if |usages| + contains an entry which is not + "`deriveKey`" or "`deriveBits`" + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/d}} field is not present and if |usages| is not + empty + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{JsonWebKey/kty}} field of |jwk| is not + "`OKP`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/crv}} field of |jwk| is not + "`X25519`", + then [= exception/throw =] a + {{DataError}}. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present + and is not equal to "`enc`" then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of JSON Web + Key [[JWK]], or it does not contain all of the specified |usages| + values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + the JWK private key format described in Section 2 + of [[RFC8037]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + X25519 private key identified by interpreting + |jwk| according to Section 2 of [[RFC8037]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"private"}}. +
++ If |jwk| does not meet the requirements of + the JWK public key format described in Section 2 + of [[RFC8037]], then [= exception/throw =] a {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object that represents the + X25519 public key identified by interpreting + |jwk| according to Section 2 of [[RFC8037]]. +
++ Set the {{CryptoKey/[[type]]}} + internal slot of |Key| to {{KeyType/"public"}}. +
++ Let |algorithm| be a new instance of a {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`X25519`". +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ If |usages| is not empty + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |algorithm| be a new {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`X25519`". +
++ Let |key| be a new {{CryptoKey}} + representing the key data provided in |keyData|. +
++ Set the {{CryptoKey/[[type]]}} internal slot + of |key| to "`public`" +
++ Set the {{CryptoKey/[[algorithm]]}} + internal slot of |key| to |algorithm|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |key| +
+Let |keyData| be the key data to be imported.
-- If |usages| contains a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `id-Ed25519` - object identifier defined in [[RFC8410]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the `algorithm` - AlgorithmIdentifier field of |spki| is present, - then [= exception/throw =] a - {{DataError}}. -
-- Let |publicKey| be the Ed25519 public key identified by - the `subjectPublicKey` field of |spki|. -
-- Let |key| be a new {{CryptoKey}} - that represents |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Let |algorithm| be a new {{KeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`Ed25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| contains a value which is not - "`sign`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurs while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `id-Ed25519` object identifier defined in [[RFC8410]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo| is present, - then [= exception/throw =] a - {{DataError}}. -
-- Let |curvePrivateKey| be the result of performing the - [= parse an ASN.1 structure =] - algorithm, with |data| as the `privateKey` field - of |privateKeyInfo|, |structure| as the ASN.1 - `CurvePrivateKey` structure specified in Section 7 of [[RFC8410]], and |exactData| set to true. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the Ed25519 private key identified by |curvePrivateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}} -
-- Let |algorithm| be a new {{KeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`Ed25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field is present and |usages| contains - a value which is not - "`sign`", or, - if the {{JsonWebKey/d}} field is not present and |usages| contains - a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not - "`OKP`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/crv}} field of |jwk| is not - "`Ed25519`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/alg}} field of |jwk| is present and is - not "`Ed25519`" or "`EdDSA`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`sig`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of JSON Web - Key [[JWK]], or it does not contain all of the specified |usages| - values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - the JWK private key format described in Section 2 - of [[RFC8037]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Ed25519 private key identified by interpreting - |jwk| according to Section 2 of [[RFC8037]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"private"}}. -
-- If |jwk| does not meet the requirements of - the JWK public key format described in Section 2 - of [[RFC8037]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - Ed25519 public key identified by interpreting - |jwk| according to Section 2 of [[RFC8037]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"public"}}. -
-- Let |algorithm| be a new instance of a {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`Ed25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| contains a value which is not - "`verify`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |algorithm| be a new {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`Ed25519`". -
-- Let |key| be a new {{CryptoKey}} - representing the key data provided in |keyData|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |key| -
-- Let |key| be the {{CryptoKey}} to be - exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| object identifier to the - `id-Ed25519` OID defined in [[RFC8410]]. -
-- Set the |subjectPublicKey| field to |keyData|. -
-- Let |result| be the result of DER-encoding |data|. -
-+
+ Let |key| be the {{CryptoKey}} to be + exported. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `SubjectPublicKeyInfo` + ASN.1 structure defined in [[RFC5280]] + with the following properties: +
++ Set the |algorithm| field to an + `AlgorithmIdentifier` ASN.1 type with the following + properties: +
++ Set the |algorithm| object identifier to the + `id-X25519` OID defined in [[RFC8410]]. +
++ Set the |subjectPublicKey| field to |keyData|. +
++ Let |result| be the result of DER-encoding |data|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be an instance of the `PrivateKeyInfo` + ASN.1 structure defined in [[RFC5208]] + with the following properties: +
++ Set the |version| field to `0`. +
++ Set the |privateKeyAlgorithm| field to a + `PrivateKeyAlgorithmIdentifier` ASN.1 type with the + following properties: +
++ Set the |algorithm| object identifier to the + `id-X25519` OID defined in [[RFC8410]]. +
++ Set the |privateKey| field to the result of DER-encoding + a `CurvePrivateKey` ASN.1 type, as defined in Section 7 of [[RFC8410]], that represents the + X25519 private key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key| +
++ Let |result| be the result of DER-encoding |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to + "`OKP`". +
++ Set the `crv` attribute of |jwk| to + "`X25519`". +
++ Set the {{JsonWebKey/x}} attribute of |jwk| according to the + definition in Section 2 of [[RFC8037]]. +
+- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| object identifier to the - `id-Ed25519` OID defined in [[RFC8410]]. -
-- Set the |privateKey| field to the result of DER-encoding - a `CurvePrivateKey` ASN.1 type, as defined in Section 7 of [[RFC8410]], that represents the - Ed25519 private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to - "`OKP`". -
-- Set the `alg` attribute of |jwk| to - "`Ed25519`". -
-- Set the `crv` attribute of |jwk| to - "`Ed25519`". -
-- Set the {{JsonWebKey/x}} attribute of |jwk| according to the + of |key| is {{KeyType/"private"}} + +
- Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be a [= byte sequence =] representing the Ed25519 - public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-+ Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ If the {{CryptoKey/[[type]]}} internal slot + of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. +
++ Let |data| be a [= byte sequence =] representing the X25519 + public key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
+- The "`X25519`" algorithm identifier is used to perform - key agreement using the X25519 algorithm specified in - [[RFC7748]]. + The "`AES-CTR`" algorithm identifier is used to perform + encryption and decryption using AES in Counter mode, + as described in [[NIST-SP800-38A]].
The [= recognized algorithm name =] for - this algorithm is "`X25519`". + this algorithm is "`AES-CTR`".
| deriveBits | -{{EcdhKeyDeriveParams}} | +encrypt | +{{AesCtrParams}} | +[= byte sequence =] | +
| decrypt | +{{AesCtrParams}} | [= byte sequence =] | ||
| generateKey | -None | -{{CryptoKeyPair}} | +{{AesKeyGenParams}} | +{{CryptoKey}} |
| importKey | @@ -11183,810 +12052,558 @@None | object | ||
| get key length | +{{AesDerivedKeyParams}} | +Integer | +
+dictionary AesCtrParams : Algorithm {
+ required BufferSource counter;
+ required [EnforceRange] octet length;
+};
+
+ The counter member contains the initial value of the counter block. {{AesCtrParams/counter}} MUST be 16 bytes (the AES block size). The counter bits are the rightmost length + bits of the counter block. The rest of the counter block is for + the nonce. The counter bits are incremented using the standard + incrementing function specified in NIST SP 800-38A Appendix B.1: + the counter bits are interpreted as a big-endian integer and + incremented by one.
+The length member contains the length, in bits, of the rightmost part of the counter block that is incremented.
+
+dictionary AesKeyAlgorithm : KeyAlgorithm {
+ required unsigned short length;
+};
+
+ The length member represents the length, in bits, of the key.
+
+dictionary AesKeyGenParams : Algorithm {
+ required [EnforceRange] unsigned short length;
+};
+
+ The length member represents the length, in bits, of the key.
+
+dictionary AesDerivedKeyParams : Algorithm {
+ required [EnforceRange] unsigned short length;
+};
+
+ The length member represents the length, in bits, of the key.
+- If the {{CryptoKey/[[type]]}} internal slot of - |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |publicKey| be the - {{EcdhKeyDeriveParams/public}} member of - |normalizedAlgorithm|. -
-- If the {{CryptoKey/[[type]]}} internal slot of - |publicKey| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- If the {{KeyAlgorithm/name}} attribute of - the {{CryptoKey/[[algorithm]]}} internal slot of - |publicKey| is not equal to the {{KeyAlgorithm/name}} property of the {{CryptoKey/[[algorithm]]}} internal slot of - |key|, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |secret| be the result of performing the X25519 function specified in - [[RFC7748]] Section 5 with |key| as the X25519 private key |k| - and the X25519 public key represented by the {{CryptoKey/[[handle]]}} - internal slot of |publicKey| as the X25519 public key |u|. -
-- If |secret| is the all-zero value, - then [= exception/throw =] a {{OperationError}}. - This check must be performed in constant-time, as per [[RFC7748]] Section 6.1. -
-- If |usages| contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Generate an X25519 key pair, with the private key being 32 random bytes, - and the public key being `X25519(a, 9)`, - as defined in [[RFC7748]], section 6.1. -
-- Let |algorithm| be a new {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`X25519`". -
-- Let |publicKey| be a new {{CryptoKey}} - representing the public key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |publicKey| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |publicKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |publicKey| to true. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |publicKey| to be the empty list. -
-- Let |privateKey| be a new {{CryptoKey}} - representing the private key of the generated key pair. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |privateKey| to {{KeyType/"private"}} -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |privateKey| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |privateKey| to |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |privateKey| to be the - [= usage intersection =] of - |usages| and `[ "deriveKey", "deriveBits" ]`. -
-- Let |result| be a new {{CryptoKeyPair}} - dictionary. -
-- Set the {{CryptoKeyPair/publicKey}} attribute - of |result| to be |publicKey|. -
-- Set the {{CryptoKeyPair/privateKey}} attribute - of |result| to be |privateKey|. -
-- Return |result|. -
-Let |keyData| be the key data to be imported.
-- If |usages| is not empty - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |spki| be the result of running the - [= parse a subjectPublicKeyInfo =] - algorithm over |keyData|. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `algorithm` AlgorithmIdentifier field of |spki| is - not equal to the `id-X25519` - object identifier defined in [[RFC8410]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the `algorithm` - AlgorithmIdentifier field of |spki| is present, - then [= exception/throw =] a - {{DataError}}. -
-- Let |publicKey| be the X25519 public key identified by - the `subjectPublicKey` field of |spki|. -
-- Let |key| be a new {{CryptoKey}} - that represents |publicKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Let |algorithm| be a new {{KeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`X25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |privateKeyInfo| be the result of running the - [= parse a privateKeyInfo =] - algorithm over |keyData|. -
-- If an error occurs while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- If the `algorithm` object identifier field of the - `privateKeyAlgorithm` PrivateKeyAlgorithm field of - |privateKeyInfo| is not equal to the - `id-X25519` object identifier defined in [[RFC8410]], - then [= exception/throw =] a - {{DataError}}. -
-- If the `parameters` field of the - `privateKeyAlgorithm` PrivateKeyAlgorithmIdentifier field - of |privateKeyInfo| is present, - then [= exception/throw =] a - {{DataError}}. -
-- Let |curvePrivateKey| be the result of performing the - [= parse an ASN.1 structure =] - algorithm, with |data| as the `privateKey` field - of |privateKeyInfo|, |structure| as the ASN.1 - `CurvePrivateKey` structure specified in Section 7 of [[RFC8410]], and |exactData| set to true. -
-- If an error occurred while parsing, - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - that represents the X25519 private key identified by |curvePrivateKey|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to {{KeyType/"private"}} -
-- Let |algorithm| be a new {{KeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`X25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/d}} field is present and if |usages| - contains an entry which is not - "`deriveKey`" or "`deriveBits`" - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/d}} field is not present and if |usages| is not - empty - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{JsonWebKey/kty}} field of |jwk| is not - "`OKP`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/crv}} field of |jwk| is not - "`X25519`", - then [= exception/throw =] a - {{DataError}}. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present - and is not equal to "`enc`" then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of JSON Web - Key [[JWK]], or it does not contain all of the specified |usages| - values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - the JWK private key format described in Section 2 - of [[RFC8037]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - X25519 private key identified by interpreting - |jwk| according to Section 2 of [[RFC8037]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"private"}}. -
-- If |jwk| does not meet the requirements of - the JWK public key format described in Section 2 - of [[RFC8037]], then [= exception/throw =] a {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object that represents the - X25519 public key identified by interpreting - |jwk| according to Section 2 of [[RFC8037]]. -
-- Set the {{CryptoKey/[[type]]}} - internal slot of |Key| to {{KeyType/"public"}}. -
-- Let |algorithm| be a new instance of a {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`X25519`". -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- If |usages| is not empty - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |algorithm| be a new {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`X25519`". -
-- Let |key| be a new {{CryptoKey}} - representing the key data provided in |keyData|. -
-- Set the {{CryptoKey/[[type]]}} internal slot - of |key| to "`public`" -
-- Set the {{CryptoKey/[[algorithm]]}} - internal slot of |key| to |algorithm|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |key| -
-+ If the {{AesCtrParams/counter}} member of + |normalizedAlgorithm| does not have + a [= byte sequence/length =] of 16 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ If the {{AesCtrParams/length}} member of + |normalizedAlgorithm| is zero or is greater + than 128, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |ciphertext| be the result of performing the CTR Encryption + operation described in Section 6.5 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCtrParams/counter}} member of + |normalizedAlgorithm| as the initial value of the counter block, the + {{AesCtrParams/length}} member of + |normalizedAlgorithm| as the input parameter |m| to the + standard counter block incrementing function defined in Appendix B.1 of + [[NIST-SP800-38A]] and + |plaintext| as the input plaintext. +
++ Return |ciphertext|. +
++ If the {{AesCtrParams/counter}} member of + |normalizedAlgorithm| does not have + a [= byte sequence/length =] of 16 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ If the {{AesCtrParams/length}} member of + |normalizedAlgorithm| is zero or is greater + than 128, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |plaintext| be the result of performing the CTR Decryption + operation described in Section 6.5 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCtrParams/counter}} member of + |normalizedAlgorithm| as the initial value of the counter block, the + {{AesCtrParams/length}} member of + |normalizedAlgorithm| as the input parameter |m| to the + standard counter block incrementing function defined in Appendix B.1 of + [[NIST-SP800-38A]] and + |ciphertext| as the input ciphertext. +
++ Return |plaintext|. +
++ If |usages| contains any entry which is not + one of "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm| is not equal to one of + 128, 192 or 256, + then [= exception/throw =] an + {{OperationError}}. +
++ Generate an AES key of length + equal to the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ If the key generation step fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |key| be a new + {{CryptoKey}} object representing the + generated AES key. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-CTR`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to equal the + {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |key| to be |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |key| to be |usages|. +
++ Return |key|. +
++ If |usages| contains an entry which is not + one of "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |data| be |keyData|. +
++ If the [= length in bits =] of |data| is not 128, 192 or 256 + then [= exception/throw =] a + {{DataError}}. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/kty}} field of |jwk| is not + "`oct`", + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.4 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |data| be the [= byte sequence =] obtained by decoding the + {{JsonWebKey/k}} field of |jwk|. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`enc`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} object representing an AES key with + value |data|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-CTR`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to the length, in bits, of |data|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
+- Let |key| be the {{CryptoKey}} to be - exported. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `SubjectPublicKeyInfo` - ASN.1 structure defined in [[RFC5280]] - with the following properties: -
-- Set the |algorithm| field to an - `AlgorithmIdentifier` ASN.1 type with the following - properties: -
-- Set the |algorithm| object identifier to the - `id-X25519` OID defined in [[RFC8410]]. -
-- Set the |subjectPublicKey| field to |keyData|. -
-- Let |result| be the result of DER-encoding |data|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not {{KeyType/"private"}}, then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be an instance of the `PrivateKeyInfo` - ASN.1 structure defined in [[RFC5208]] - with the following properties: -
-- Set the |version| field to `0`. -
-- Set the |privateKeyAlgorithm| field to a - `PrivateKeyAlgorithmIdentifier` ASN.1 type with the - following properties: -
-- Set the |algorithm| object identifier to the - `id-X25519` OID defined in [[RFC8410]]. -
-- Set the |privateKey| field to the result of DER-encoding - a `CurvePrivateKey` ASN.1 type, as defined in Section 7 of [[RFC8410]], that represents the - X25519 private key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key| -
-- Let |result| be the result of DER-encoding |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to - "`OKP`". -
-- Set the `crv` attribute of |jwk| to - "`X25519`". -
-- Set the {{JsonWebKey/x}} attribute of |jwk| according to the - definition in Section 2 of [[RFC8037]]. -
-- Set the `key_ops` attribute of |jwk| to the {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- If the {{CryptoKey/[[type]]}} internal slot - of |key| is not "`public`", then [= exception/throw =] an {{InvalidAccessError}}. -
-- Let |data| be a [= byte sequence =] representing the X25519 - public key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-+ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ Let |data| be a [= byte sequence =] containing + the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to the + string "`oct`". +
++ Set the {{JsonWebKey/k}} attribute of |jwk| to be a string + containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. +
++ Set the `key_ops` attribute of |jwk| to equal the + {{CryptoKey/[[usages]]}} internal slot of + |key|. +
++ Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ If the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, + then [= exception/throw =] a + {{OperationError}}. +
++ Return the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm|. +
+- The "`AES-CTR`" algorithm identifier is used to perform - encryption and decryption using AES in Counter mode, + The "`AES-CBC`" algorithm identifier is used to perform + encryption and decryption using AES in Cipher Block Chaining mode, as described in [[NIST-SP800-38A]].
++ When operating in CBC mode, messages that are not exact multiples + of the AES block size (16 bytes) can be padded under a variety of + padding schemes. In the Web Crypto API, the only padding mode that + is supported is that of PKCS#7, as described by + Section 10.3, step 2, of [[RFC2315]]. +
The [= recognized algorithm name =] for - this algorithm is "`AES-CTR`". + this algorithm is "`AES-CBC`".
| encrypt | -{{AesCtrParams}} | -[= byte sequence =] | -
| decrypt | -{{AesCtrParams}} | -[= byte sequence =] | -
| generateKey | -{{AesKeyGenParams}} | -{{CryptoKey}} | -
| importKey | -None | -{{CryptoKey}} | -
| exportKey | -None | -object | -
| get key length | -{{AesDerivedKeyParams}} | -Integer | -
-dictionary AesCtrParams : Algorithm {
- required BufferSource counter;
- required [EnforceRange] octet length;
-};
-
- The counter member contains the initial value of the counter block. {{AesCtrParams/counter}} MUST be 16 bytes (the AES block size). The counter bits are the rightmost length - bits of the counter block. The rest of the counter block is for - the nonce. The counter bits are incremented using the standard - incrementing function specified in NIST SP 800-38A Appendix B.1: - the counter bits are interpreted as a big-endian integer and - incremented by one.
-The length member contains the length, in bits, of the rightmost part of the counter block that is incremented.
-
-dictionary AesKeyAlgorithm : KeyAlgorithm {
- required unsigned short length;
-};
-
- The length member represents the length, in bits, of the key.
-
-dictionary AesKeyGenParams : Algorithm {
- required [EnforceRange] unsigned short length;
-};
-
- The length member represents the length, in bits, of the key.
+
-dictionary AesDerivedKeyParams : Algorithm {
- required [EnforceRange] unsigned short length;
+dictionary AesCbcParams : Algorithm {
+ required BufferSource iv;
};
- The length member represents the length, in bits, of the key.
+The iv member represents the initialization vector. It MUST be 16 bytes.
- If the {{AesCtrParams/counter}} member of - |normalizedAlgorithm| does not have - a [= byte sequence/length =] of 16 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- If the {{AesCtrParams/length}} member of - |normalizedAlgorithm| is zero or is greater - than 128, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |ciphertext| be the result of performing the CTR Encryption - operation described in Section 6.5 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCtrParams/counter}} member of - |normalizedAlgorithm| as the initial value of the counter block, the - {{AesCtrParams/length}} member of - |normalizedAlgorithm| as the input parameter |m| to the - standard counter block incrementing function defined in Appendix B.1 of - [[NIST-SP800-38A]] and - |plaintext| as the input plaintext. -
-- Return |ciphertext|. -
-- If the {{AesCtrParams/counter}} member of - |normalizedAlgorithm| does not have - a [= byte sequence/length =] of 16 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- If the {{AesCtrParams/length}} member of - |normalizedAlgorithm| is zero or is greater - than 128, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |plaintext| be the result of performing the CTR Decryption - operation described in Section 6.5 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCtrParams/counter}} member of - |normalizedAlgorithm| as the initial value of the counter block, the - {{AesCtrParams/length}} member of - |normalizedAlgorithm| as the input parameter |m| to the - standard counter block incrementing function defined in Appendix B.1 of - [[NIST-SP800-38A]] and - |ciphertext| as the input ciphertext. -
-- Return |plaintext|. -
-- If |usages| contains any entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm| is not equal to one of - 128, 192 or 256, - then [= exception/throw =] an - {{OperationError}}. -
-- Generate an AES key of length - equal to the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- If the key generation step fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |key| be a new - {{CryptoKey}} object representing the - generated AES key. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-CTR`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to equal the - {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |key| to be |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |key| to be |usages|. -
-- Return |key|. -
-- If |usages| contains an entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |data| be |keyData|. -
-- If the [= length in bits =] of |data| is not 128, 192 or 256 - then [= exception/throw =] a - {{DataError}}. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/kty}} field of |jwk| is not - "`oct`", - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.4 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |data| be the [= byte sequence =] obtained by decoding the - {{JsonWebKey/k}} field of |jwk|. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`enc`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} object representing an AES key with - value |data|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-CTR`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to the length, in bits, of |data|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- Let |data| be a [= byte sequence =] containing - the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to the - string "`oct`". -
-- Set the {{JsonWebKey/k}} attribute of |jwk| to be a string - containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. -
-- Set the `key_ops` attribute of |jwk| to equal the - {{CryptoKey/[[usages]]}} internal slot of - |key|. -
-- Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- If the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, - then [= exception/throw =] a - {{OperationError}}. -
-- Return the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm|. -
-+ If the {{AesCbcParams/iv}} member of + |normalizedAlgorithm| does not have + a [= byte sequence/length =] of 16 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |paddedPlaintext| be the result of adding padding octets to + |plaintext| + according to the procedure defined in Section 10.3 + of [[RFC2315]], step 2, with a value of + |k| of 16. +
++ Let |ciphertext| be the result of performing the CBC Encryption + operation described in Section 6.2 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCbcParams/iv}} member of |normalizedAlgorithm| as + the |IV| input parameter and |paddedPlaintext| + as the input plaintext. +
++ Return |ciphertext|. +
++ If the {{AesCbcParams/iv}} member of + |normalizedAlgorithm| does not have + a [= byte sequence/length =] of 16 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |paddedPlaintext| be the result of performing the CBC Decryption + operation described in Section 6.2 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCbcParams/iv}} member of |normalizedAlgorithm| as + the |IV| input parameter and + |ciphertext| as the input ciphertext. +
++ Let |p| be the value of the last octet of |paddedPlaintext|. +
++ If |p| is zero or greater than 16, or if any of the last |p| + octets of |paddedPlaintext| have a value which is not |p|, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |plaintext| be the result of removing |p| octets from + the end of |paddedPlaintext|. +
++ Return |plaintext|. +
++ If |usages| contains any entry which is not + one of "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm| is not equal to one of + 128, 192 or 256, + then [= exception/throw =] an + {{OperationError}}. +
++ Generate an AES key of length + equal to the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ If the key generation step fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |key| be a new + {{CryptoKey}} object representing the + generated AES key. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-CBC`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to equal the + {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |key| to be |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |key| to be |usages|. +
++ Return |key|. +
+- The "`AES-CBC`" algorithm identifier is used to perform - encryption and decryption using AES in Cipher Block Chaining mode, - as described in [[NIST-SP800-38A]]. -
-- When operating in CBC mode, messages that are not exact multiples - of the AES block size (16 bytes) can be padded under a variety of - padding schemes. In the Web Crypto API, the only padding mode that - is supported is that of PKCS#7, as described by - Section 10.3, step 2, of [[RFC2315]]. -
-- The [= recognized algorithm name =] for - this algorithm is "`AES-CBC`". -
-| Operation | -Parameters | -Result | -
|---|---|---|
| encrypt | -{{AesCbcParams}} | -[= byte sequence =] | -
| decrypt | -{{AesCbcParams}} | -[= byte sequence =] | -
| generateKey | -{{AesKeyGenParams}} | -{{CryptoKey}} | -
| importKey | -None | -{{CryptoKey}} | -
| exportKey | -None | -object | -
| get key length | -{{AesDerivedKeyParams}} | -Integer | -
-dictionary AesCbcParams : Algorithm {
- required BufferSource iv;
-};
-
- The iv member represents the initialization vector. It MUST be 16 bytes.
-- If the {{AesCbcParams/iv}} member of - |normalizedAlgorithm| does not have - a [= byte sequence/length =] of 16 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |paddedPlaintext| be the result of adding padding octets to - |plaintext| - according to the procedure defined in Section 10.3 - of [[RFC2315]], step 2, with a value of - |k| of 16. -
-- Let |ciphertext| be the result of performing the CBC Encryption - operation described in Section 6.2 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCbcParams/iv}} member of |normalizedAlgorithm| as - the |IV| input parameter and |paddedPlaintext| - as the input plaintext. -
-- Return |ciphertext|. -
-- If the {{AesCbcParams/iv}} member of - |normalizedAlgorithm| does not have - a [= byte sequence/length =] of 16 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |paddedPlaintext| be the result of performing the CBC Decryption - operation described in Section 6.2 of [[NIST-SP800-38A]] using AES as the block cipher, the {{AesCbcParams/iv}} member of |normalizedAlgorithm| as - the |IV| input parameter and - |ciphertext| as the input ciphertext. -
-- Let |p| be the value of the last octet of |paddedPlaintext|. -
-- If |p| is zero or greater than 16, or if any of the last |p| - octets of |paddedPlaintext| have a value which is not |p|, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |plaintext| be the result of removing |p| octets from - the end of |paddedPlaintext|. -
-- Return |plaintext|. -
-- If |usages| contains any entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm| is not equal to one of - 128, 192 or 256, - then [= exception/throw =] an - {{OperationError}}. -
-- Generate an AES key of length - equal to the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- If the key generation step fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |key| be a new - {{CryptoKey}} object representing the - generated AES key. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-CBC`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to equal the - {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |key| to be |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |key| to be |usages|. -
-- Return |key|. -
-- If |usages| contains an entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |data| be |keyData|. -
-- If the [= length in bits =] of |data| is not 128, 192 or 256 - then [= exception/throw =] a - {{DataError}}. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/kty}} field of |jwk| is not - "`oct`", - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.4 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |data| be the [= byte sequence =] obtained by decoding the - {{JsonWebKey/k}} field of |jwk|. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`enc`", +
+ If |usages| contains an entry which is not + one of "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |data| be |keyData|. +
++ If the [= length in bits =] of |data| is not 128, 192 or 256 + then [= exception/throw =] a + {{DataError}}. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/kty}} field of |jwk| is not + "`oct`", + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.4 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |data| be the [= byte sequence =] obtained by decoding the + {{JsonWebKey/k}} field of |jwk|. +
+- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, + {{DataError}}.
- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, + {{DataError}}.
+ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`enc`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + object representing an AES key with value |data|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-CBC`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to the length, in bits, of |data|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ Let |data| be a [= byte sequence =] containing + the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
+Let |jwk| be a new {{JsonWebKey}} dictionary.
++ Set the `kty` attribute of |jwk| to the + string "`oct`". +
++ Set the {{JsonWebKey/k}} attribute of |jwk| to be a string + containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. +
++ Set the `key_ops` attribute of |jwk| to equal the + {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
+[= exception/throw =] a - {{NotSupportedError}} -
- Let |key| be a new {{CryptoKey}} - object representing an AES key with value |data|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-CBC`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to the length, in bits, of |data|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- Let |data| be a [= byte sequence =] containing - the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-Let |jwk| be a new {{JsonWebKey}} dictionary.
-- Set the `kty` attribute of |jwk| to the - string "`oct`". -
-- Set the {{JsonWebKey/k}} attribute of |jwk| to be a string - containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. -
-- Set the `key_ops` attribute of |jwk| to equal the - {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- If the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, - then [= exception/throw =] an - {{OperationError}}. -
-- Return the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm|. -
-+ Return |result|. +
++ If the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, + then [= exception/throw =] an + {{OperationError}}. +
++ Return the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm|. +
+- If |plaintext| has a [= byte sequence/length =] - greater than 2^39 - 256 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- If the {{AesGcmParams/iv}} member of - |normalizedAlgorithm| has a [= byte sequence/length =] - greater than 2^64 - 1 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- If the {{AesGcmParams/additionalData}} member - of |normalizedAlgorithm| is present and has a - [= byte sequence/length =] - greater than 2^64 - 1 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |additionalData| be the {{AesGcmParams/additionalData}} member of - |normalizedAlgorithm| if present or an empty [= byte sequence =] - otherwise. -
-- Let |C| and |T| be the outputs that result from performing - the Authenticated Encryption Function described in Section 7.1 of - [[NIST-SP800-38D]] using AES as the block cipher, the {{AesGcmParams/iv}} member of |normalizedAlgorithm| as - the |IV| input parameter, - |additionalData| as the |A| input parameter, - |tagLength| as the |t| pre-requisite and - |plaintext| as the input plaintext. -
-- Let |ciphertext| be equal to |C| | |T|, - where '|' denotes concatenation. -
-- Return |ciphertext|. -
-- If |ciphertext| has a [= length in bits =] less than |tagLength|, - then [= exception/throw =] an - {{OperationError}}. -
-- If the {{AesGcmParams/iv}} member of - |normalizedAlgorithm| has a [= byte sequence/length =] - greater than 2^64 - 1 bytes, - then [= exception/throw =] an - {{OperationError}}. -
-
- If the {{AesGcmParams/additionalData}} member
- of |normalizedAlgorithm| is present and has a
- [= byte sequence/length =]
- greater than 2^64 - 1 bytes,
- then [= exception/throw =] an
+
+
+ If |plaintext| has a [= byte sequence/length =]
+ greater than 2^39 - 256 bytes,
+ then [= exception/throw =] an
+ {{OperationError}}.
+
+ If the {{AesGcmParams/iv}} member of
+ |normalizedAlgorithm| has a [= byte sequence/length =]
+ greater than 2^64 - 1 bytes,
+ then [= exception/throw =] an
+ {{OperationError}}.
+
+ If the {{AesGcmParams/additionalData}} member
+ of |normalizedAlgorithm| is present and has a
+ [= byte sequence/length =]
+ greater than 2^64 - 1 bytes,
+ then [= exception/throw =] an
+ {{OperationError}}.
+ Encrypt
+
+
+
+
- Let |tag| be the last |tagLength| bits of - |ciphertext|. -
-- Let |actualCiphertext| be the result of removing the last |tagLength| bits - from |ciphertext|. -
-- Let |additionalData| be the {{AesGcmParams/additionalData}} member of - |normalizedAlgorithm| if present or an empty [= byte sequence =] - otherwise. -
-- Perform the Authenticated Decryption Function described in Section 7.2 of - [[NIST-SP800-38D]] using AES as the block cipher, - the {{AesGcmParams/iv}} member of |normalizedAlgorithm| as - the |IV| input parameter, - |additionalData| as the |A| input parameter, - |tagLength| as the |t| pre-requisite, - |actualCiphertext| as the input ciphertext, |C| and |tag| as - the authentication tag, |T|. -
-- Return |plaintext|. -
-- If |usages| contains any entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- If the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm| is not equal to one of - 128, 192 or 256, - then [= exception/throw =] an +
+ Let |additionalData| be the {{AesGcmParams/additionalData}} member of + |normalizedAlgorithm| if present or an empty [= byte sequence =] + otherwise. +
++ Let |C| and |T| be the outputs that result from performing + the Authenticated Encryption Function described in Section 7.1 of + [[NIST-SP800-38D]] using AES as the block cipher, the {{AesGcmParams/iv}} member of |normalizedAlgorithm| as + the |IV| input parameter, + |additionalData| as the |A| input parameter, + |tagLength| as the |t| pre-requisite and + |plaintext| as the input plaintext. +
++ Let |ciphertext| be equal to |C| | |T|, + where '|' denotes concatenation. +
++ Return |ciphertext|. +
++ If |ciphertext| has a [= length in bits =] less than |tagLength|, + then [= exception/throw =] an + {{OperationError}}. +
++ If the {{AesGcmParams/iv}} member of + |normalizedAlgorithm| has a [= byte sequence/length =] + greater than 2^64 - 1 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ If the {{AesGcmParams/additionalData}} member + of |normalizedAlgorithm| is present and has a + [= byte sequence/length =] + greater than 2^64 - 1 bytes, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |tag| be the last |tagLength| bits of + |ciphertext|. +
++ Let |actualCiphertext| be the result of removing the last |tagLength| bits + from |ciphertext|. +
++ Let |additionalData| be the {{AesGcmParams/additionalData}} member of + |normalizedAlgorithm| if present or an empty [= byte sequence =] + otherwise. +
++ Perform the Authenticated Decryption Function described in Section 7.2 of + [[NIST-SP800-38D]] using AES as the block cipher, + the {{AesGcmParams/iv}} member of |normalizedAlgorithm| as + the |IV| input parameter, + |additionalData| as the |A| input parameter, + |tagLength| as the |t| pre-requisite, + |actualCiphertext| as the input ciphertext, |C| and |tag| as + the authentication tag, |T|. +
++ Return |plaintext|. +
++ If |usages| contains any entry which is not + one of "`encrypt`", "`decrypt`", + "`wrapKey`" or "`unwrapKey`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ If the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm| is not equal to one of + 128, 192 or 256, + then [= exception/throw =] an + {{OperationError}}. +
++ Generate an AES key of length + equal to the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ If the key generation step fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |key| be a new + {{CryptoKey}} object representing the + generated AES key. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-GCM`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to equal the + {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |key| to be |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |key| to be |usages|. +
++ Return |key|. +
+- Generate an AES key of length - equal to the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- If the key generation step fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |key| be a new - {{CryptoKey}} object representing the - generated AES key. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-GCM`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to equal the - {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |key| to be |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |key| to be |usages|. -
-- Return |key|. -
-- If |usages| contains an entry which is not - one of "`encrypt`", "`decrypt`", - "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |data| be |keyData|. -
-- If the [= length in bits =] of |data| is not 128, 192 or 256 - then [= exception/throw =] a - {{DataError}}. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/kty}} field of |jwk| is not - "`oct`", - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.4 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |data| be the [= byte sequence =] obtained by decoding the - {{JsonWebKey/k}} field of |jwk|. -
-
- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is
- not "`enc`",
+
+ If |usages| contains an entry which is not
+ one of "`encrypt`", "`decrypt`",
+ "`wrapKey`" or "`unwrapKey`",
+ then [= exception/throw =] a
+ {{SyntaxError}}.
+
+ Let |data| be |keyData|.
+
+ If the [= length in bits =] of |data| is not 128, 192 or 256
+ then [= exception/throw =] a
+ {{DataError}}.
+ Let |jwk| equal |keyData|. [= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/kty}} field of |jwk| is not
+ "`oct`",
+ then [= exception/throw =] a
+ {{DataError}}.
+
+ If |jwk| does not meet the requirements of
+ Section 6.4 of JSON Web Algorithms [[JWA]],
+ then [= exception/throw =] a
+ {{DataError}}.
+
+ Let |data| be the [= byte sequence =] obtained by decoding the
+ {{JsonWebKey/k}} field of |jwk|.
+ Import Key
+
+
+
+
+
+
+
+
+
+
- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, + {{DataError}}.
- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, + {{DataError}}.
- Let |key| be a new {{CryptoKey}} - object representing an AES key with value |data|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-GCM`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to the length, in bits, of |data|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- Let |data| be a [= byte sequence =] containing - the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to the - string "`oct`". -
-- Set the {{JsonWebKey/k}} attribute of |jwk| to be a string - containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. -
-- Set the `key_ops` attribute of |jwk| to equal the - {{CryptoKey/usages}} attribute of - |key|. -
-- Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- If the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. -
-- Return the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm|. -
-+ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`enc`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + object representing an AES key with value |data|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-GCM`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to the length, in bits, of |data|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ Let |data| be a [= byte sequence =] containing + the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to the + string "`oct`". +
++ Set the {{JsonWebKey/k}} attribute of |jwk| to be a string + containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. +
++ Set the `key_ops` attribute of |jwk| to equal the + {{CryptoKey/usages}} attribute of + |key|. +
++ Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
++ [= exception/throw =] a + {{NotSupportedError}}. +
++ Return |result|. +
++ If the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. +
++ Return the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm|. +
+- If |plaintext| is not a multiple of 64 bits in length, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |ciphertext| be the result of performing the Key Wrap - operation described in Section 2.2.1 of [[RFC3394]] - with |plaintext| as the plaintext to be wrapped and using the default - Initial Value defined in Section 2.2.3.1 of the same document. -
-- Return |ciphertext|. -
-- Let |plaintext| be the result of performing the Key Unwrap - operation described in Section 2.2.2 of [[RFC3394]] with - |ciphertext| as the input ciphertext and using the default Initial - Value defined in Section 2.2.3.1 of the same document. -
-- If the Key Unwrap operation returns an error, - then [= exception/throw =] an - {{OperationError}}. -
-- Return |plaintext|. -
-- If |usages| contains any entry which is not one of - "`wrapKey`" or "`unwrapKey`", then [= exception/throw =] a {{SyntaxError}}. -
-- If the {{AesKeyGenParams/length}} property of - |normalizedAlgorithm| is not equal to one of 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. -
-- Generate an AES key of length - equal to the {{AesKeyGenParams/length}} member of - |normalizedAlgorithm|. -
-- If the key generation step fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |key| be a new - {{CryptoKey}} object representing the - generated AES key. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-KW`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to equal the - {{AesKeyGenParams/length}} property of - |normalizedAlgorithm|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |key| to be |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |key| to be |usages|. -
-- Return |key|. -
-- If |usages| contains an entry which is not - one of "`wrapKey`" or "`unwrapKey`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |data| be |keyData|. -
-- If the [= length in bits =] of |data| is not 128, 192 or 256 - then [= exception/throw =] a - {{DataError}}. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/kty}} field of |jwk| is not - "`oct`", - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.4 of JSON Web Algorithms [[JWA]], - then [= exception/throw =] a - {{DataError}}. -
-- Let |data| be the [= byte sequence =] obtained by decoding the - {{JsonWebKey/k}} field of |jwk|. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`enc`", - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, - then [= exception/throw =] a - {{DataError}}. -
-- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, - then [= exception/throw =] a - {{DataError}}.
-+ If |plaintext| is not a multiple of 64 bits in length, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |ciphertext| be the result of performing the Key Wrap + operation described in Section 2.2.1 of [[RFC3394]] + with |plaintext| as the plaintext to be wrapped and using the default + Initial Value defined in Section 2.2.3.1 of the same document. +
++ Return |ciphertext|. +
++ Let |plaintext| be the result of performing the Key Unwrap + operation described in Section 2.2.2 of [[RFC3394]] with + |ciphertext| as the input ciphertext and using the default Initial + Value defined in Section 2.2.3.1 of the same document. +
++ If the Key Unwrap operation returns an error, + then [= exception/throw =] an + {{OperationError}}. +
++ Return |plaintext|. +
++ If |usages| contains any entry which is not one of + "`wrapKey`" or "`unwrapKey`", then [= exception/throw =] a {{SyntaxError}}. +
++ If the {{AesKeyGenParams/length}} property of + |normalizedAlgorithm| is not equal to one of 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. +
++ Generate an AES key of length + equal to the {{AesKeyGenParams/length}} member of + |normalizedAlgorithm|. +
++ If the key generation step fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |key| be a new + {{CryptoKey}} object representing the + generated AES key. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-KW`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to equal the + {{AesKeyGenParams/length}} property of + |normalizedAlgorithm|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |key| to be |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |key| to be |usages|. +
++ Return |key|. +
++ If |usages| contains an entry which is not + one of "`wrapKey`" or "`unwrapKey`", + + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |data| be |keyData|. +
++ If the [= length in bits =] of |data| is not 128, 192 or 256 + then [= exception/throw =] a + {{DataError}}. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/kty}} field of |jwk| is not + "`oct`", + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.4 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |data| be the [= byte sequence =] obtained by decoding the + {{JsonWebKey/k}} field of |jwk|. +
++ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`enc`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}.
++ Let |key| be a new {{CryptoKey}} + representing an AES key with value |data|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{AesKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`AES-KW`". +
++ Set the {{AesKeyAlgorithm/length}} attribute of + |algorithm| to the length, in bits, of |data|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ Let |data| be a [= byte sequence =] containing + the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |result| be |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to the + string "`oct`". +
++ Set the {{JsonWebKey/k}} attribute of |jwk| to be a string + containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. +
++ Set the `key_ops` attribute of |jwk| to equal the + {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
+[= exception/throw =] a {{NotSupportedError}}. -
- Let |key| be a new {{CryptoKey}} - representing an AES key with value |data|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{AesKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`AES-KW`". -
-- Set the {{AesKeyAlgorithm/length}} attribute of - |algorithm| to the length, in bits, of |data|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- Let |data| be a [= byte sequence =] containing - the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |result| be |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to the - string "`oct`". -
-- Set the {{JsonWebKey/k}} attribute of |jwk| to be a string - containing the raw octets of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. -
-- Set the `key_ops` attribute of |jwk| to equal the - {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- If the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. -
-- Return the {{AesDerivedKeyParams/length}} member of - |normalizedDerivedKeyAlgorithm|. -
-+ Return |result|. +
++ If the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm| is not 128, 192 or 256, then [= exception/throw =] an {{OperationError}}. +
++ Return the {{AesDerivedKeyParams/length}} member of + |normalizedDerivedKeyAlgorithm|. +
+- Let |mac| be the result of performing the MAC Generation operation - described in Section 4 of [[FIPS-198-1]] using - the key represented by the {{CryptoKey/[[handle]]}} - internal slot of |key|, the hash function identified by the {{HmacKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key| and |message| as the input data |text|. -
-- Return |mac|. -
-- Let |mac| be the result of performing the MAC Generation operation - described in Section 4 of [[FIPS-198-1]] using - the key represented by the {{CryptoKey/[[handle]]}} - internal slot of |key|, the hash function identified by the {{HmacKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of - |key| and |message| as the input data |text|. -
-- Return true if |mac| is equal to |signature| and false - otherwise. -
-- If |usages| contains any entry which is not "`sign`" or - "`verify`", then [= exception/throw =] a {{SyntaxError}}. -
-- Generate a key of length |length| bits. -
-- If the key generation step fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Let |key| be a new - {{CryptoKey}} object representing the - generated key. -
-- Let |algorithm| be a new - {{HmacKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`HMAC`". -
-- Set the {{HmacKeyAlgorithm/length}} attribute of - |algorithm| to |length|. -
-- Let |hash| be a new - {{KeyAlgorithm}}. -
-
- Set the {{KeyAlgorithm/name}} attribute of
- |hash| to equal the {{Algorithm/name}}
- member of the {{HmacKeyGenParams/hash}}
+
+
+ Let |mac| be the result of performing the MAC Generation operation
+ described in Section 4 of [[FIPS-198-1]] using
+ the key represented by the {{CryptoKey/[[handle]]}}
+ internal slot of |key|, the hash function identified by the {{HmacKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of
+ |key| and |message| as the input data |text|.
+
+ Return |mac|.
+
+ Let |mac| be the result of performing the MAC Generation operation
+ described in Section 4 of [[FIPS-198-1]] using
+ the key represented by the {{CryptoKey/[[handle]]}}
+ internal slot of |key|, the hash function identified by the {{HmacKeyAlgorithm/hash}} attribute of the {{CryptoKey/[[algorithm]]}} internal slot of
+ |key| and |message| as the input data |text|.
+
+ Return true if |mac| is equal to |signature| and false
+ otherwise.
+
+ If |usages| contains any entry which is not "`sign`" or
+ "`verify`", then [= exception/throw =] a {{SyntaxError}}.
+ Sign
+
+
+
+ Verify
+
+
+
+ Generate Key
+
+
+
+
- Set the {{HmacKeyAlgorithm/hash}} attribute - of |algorithm| to |hash|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Set the {{CryptoKey/[[extractable]]}} internal - slot of |key| to be |extractable|. -
-- Set the {{CryptoKey/[[usages]]}} internal slot of - |key| to be |usages|. -
-- Return |key|. -
-Let |keyData| be the key data to be imported.
-- If |usages| contains an entry which is not - "`sign`" or "`verify`", - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |hash| be a new {{KeyAlgorithm}}. -
-- Let |data| be |keyData|. -
-- Set |hash| to equal the {{HmacImportParams/hash}} - member of |normalizedAlgorithm|. -
-Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
- If the {{JsonWebKey/kty}} field of |jwk| is not - "`oct`", - then [= exception/throw =] a - {{DataError}}. -
-- If |jwk| does not meet the requirements of - Section 6.4 of JSON Web Algorithms [[JWA]], +
+ Generate a key of length |length| bits. +
++ If the key generation step fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Let |key| be a new + {{CryptoKey}} object representing the + generated key. +
++ Let |algorithm| be a new + {{HmacKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`HMAC`". +
++ Set the {{HmacKeyAlgorithm/length}} attribute of + |algorithm| to |length|. +
++ Let |hash| be a new + {{KeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |hash| to equal the {{Algorithm/name}} + member of the {{HmacKeyGenParams/hash}} + member of |normalizedAlgorithm|. +
++ Set the {{HmacKeyAlgorithm/hash}} attribute + of |algorithm| to |hash|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Set the {{CryptoKey/[[extractable]]}} internal + slot of |key| to be |extractable|. +
++ Set the {{CryptoKey/[[usages]]}} internal slot of + |key| to be |usages|. +
++ Return |key|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains an entry which is not + "`sign`" or "`verify`", + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |hash| be a new {{KeyAlgorithm}}. +
++ Let |data| be |keyData|. +
++ Set |hash| to equal the {{HmacImportParams/hash}} + member of |normalizedAlgorithm|. +
+Let |jwk| equal |keyData|.
[= exception/Throw =] a {{DataError}}.
+ If the {{JsonWebKey/kty}} field of |jwk| is not + "`oct`", + then [= exception/throw =] a + {{DataError}}. +
++ If |jwk| does not meet the requirements of + Section 6.4 of JSON Web Algorithms [[JWA]], + then [= exception/throw =] a + {{DataError}}. +
++ Let |data| be the [= byte sequence =] obtained by decoding the + {{JsonWebKey/k}} field of |jwk|. +
++ Set the |hash| to equal the {{HmacImportParams/hash}} member of + |normalizedAlgorithm|. +
+- Let |data| be the [= byte sequence =] obtained by decoding the - {{JsonWebKey/k}} field of |jwk|. -
-- Set the |hash| to equal the {{HmacImportParams/hash}} member of - |normalizedAlgorithm|. -
-- If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is - not "`sign`", +
- If the {{JsonWebKey/key_ops}} field of |jwk| is present, and - is invalid according to the requirements of - JSON Web Key [[JWK]] or - does not contain all of the specified |usages| values, + +
- If the {{JsonWebKey/ext}} field of |jwk| is present and - has the value false and |extractable| is true, + +
+ If |usages| is non-empty and the {{JsonWebKey/use}} field of |jwk| is present and is + not "`sign`", + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/key_ops}} field of |jwk| is present, and + is invalid according to the requirements of + JSON Web Key [[JWK]] or + does not contain all of the specified |usages| values, + then [= exception/throw =] a + {{DataError}}. +
++ If the {{JsonWebKey/ext}} field of |jwk| is present and + has the value false and |extractable| is true, + then [= exception/throw =] a + {{DataError}}. +
++ Let |length| be the [= length in bits =] of + |data|. +
++ If |length| is zero + then [= exception/throw =] a + {{DataError}}. +
++ Let |key| be a new {{CryptoKey}} + object representing an HMAC key with the first |length| + bits of |data|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{HmacKeyAlgorithm}}. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`HMAC`". +
++ Set the {{HmacKeyAlgorithm/length}} attribute of + |algorithm| to |length|. +
++ Set the {{HmacKeyAlgorithm/hash}} attribute of + |algorithm| to |hash|. +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + cannot be accessed, then [= exception/throw =] an {{OperationError}}. +
++ Let |bits| be the raw bits of the key represented by the {{CryptoKey/[[handle]]}} internal slot of + |key|. +
++ Let |data| be a [= byte sequence containing =] |bits|. +
++ Let |result| be |data|. +
++ Let |jwk| be a new {{JsonWebKey}} + dictionary. +
++ Set the `kty` attribute of |jwk| to the + string "`oct`". +
++ Set the {{JsonWebKey/k}} attribute of |jwk| to be a string + containing |data|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. +
++ Let |algorithm| be the {{CryptoKey/[[algorithm]]}} internal slot of + |key|. +
++ Let |hash| be the + {{HmacKeyAlgorithm/hash}} attribute of + |algorithm|. +
++ Perform any [= HMAC key export steps | key export steps =] defined by + other applicable + specifications, passing |format| and |key| + and obtaining |alg|. +
++ Set the `alg` attribute of |jwk| to + |alg|. +
++ Set the `key_ops` attribute of |jwk| to equal the + {{CryptoKey/usages}} attribute of |key|. +
++ Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot + of |key|. +
++ Let |result| be |jwk|. +
+[= exception/throw =] a {{NotSupportedError}}. -
- Let |length| be the [= length in bits =] of - |data|. -
-- If |length| is zero - then [= exception/throw =] a - {{DataError}}. -
-- Let |key| be a new {{CryptoKey}} - object representing an HMAC key with the first |length| - bits of |data|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{HmacKeyAlgorithm}}. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`HMAC`". -
-- Set the {{HmacKeyAlgorithm/length}} attribute of - |algorithm| to |length|. -
-- Set the {{HmacKeyAlgorithm/hash}} attribute of - |algorithm| to |hash|. -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- If the underlying cryptographic key material represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - cannot be accessed, then [= exception/throw =] an {{OperationError}}. -
-- Let |bits| be the raw bits of the key represented by the {{CryptoKey/[[handle]]}} internal slot of - |key|. -
-- Let |data| be a [= byte sequence containing =] |bits|. -
-- Let |result| be |data|. -
-- Let |jwk| be a new {{JsonWebKey}} - dictionary. -
-- Set the `kty` attribute of |jwk| to the - string "`oct`". -
-- Set the {{JsonWebKey/k}} attribute of |jwk| to be a string - containing |data|, encoded according to Section 6.4 of JSON Web Algorithms [[JWA]]. -
-- Let |algorithm| be the {{CryptoKey/[[algorithm]]}} internal slot of - |key|. -
-- Let |hash| be the - {{HmacKeyAlgorithm/hash}} attribute of - |algorithm|. -
-- Perform any [= HMAC key export steps | key export steps =] defined by - other applicable - specifications, passing |format| and |key| - and obtaining |alg|. -
-- Set the `alg` attribute of |jwk| to - |alg|. -
-- Set the `key_ops` attribute of |jwk| to equal the - {{CryptoKey/usages}} attribute of |key|. -
-- Set the `ext` attribute of |jwk| to equal the {{CryptoKey/[[extractable]]}} internal slot - of |key|. -
-- Let |result| be |jwk|. -
-- [= exception/throw =] a - {{NotSupportedError}}. -
-- Return |result|. -
-- Let |length| be the block size in bits of the hash function - identified by the {{HmacImportParams/hash}} member - of |normalizedDerivedKeyAlgorithm|. -
-- Return |length|. -
-+ Return |result|. +
++ Let |length| be the block size in bits of the hash function + identified by the {{HmacImportParams/hash}} member + of |normalizedDerivedKeyAlgorithm|. +
++ Return |length|. +
+- If performing the operation results in an error, then [= exception/throw =] an {{OperationError}}. -
-- Return |result|. -
-+ If performing the operation results in an error, then [= exception/throw =] an {{OperationError}}. +
++ Return |result|. +
+- The "`HKDF`" algorithm identifier is used to - perform key derivation using the extraction-then-expansion approach described in - [[RFC5869]] and - using the SHA hash functions defined in this specification. -
-- Other specifications - may specify the use of additional hash algorithms with HKDF. - Such specifications must define the digest operation for the additional hash algorithms. -
-- The [= recognized algorithm name =] - for this algorithm is "`HKDF`". -
-| Operation | -Parameters | -Result | -
|---|---|---|
| deriveBits | -{{HkdfParams}} | -[= byte sequence =] | -
| importKey | -None | -{{CryptoKey}} | -
| Get key length | -None | -null | -
-dictionary HkdfParams : Algorithm {
- required HashAlgorithmIdentifier hash;
- required BufferSource salt;
- required BufferSource info;
-};
-
- The hash member represents the algorithm to use with HMAC (e.g.: SHA-256).
-The salt member represents the salt used in the extract step.
-The info member represents application specific context for the derived keying material.
-- If |length| is null or is not a multiple of 8, then [= exception/throw =] an {{OperationError}}. -
-- Let |keyDerivationKey| be the secret represented by the {{CryptoKey/[[handle]]}} internal slot of |key|. -
-- Let |result| be the result of performing the HKDF extract and then - the HKDF expand step described in Section 2 of - [[RFC5869]] using: -
-- the {{HkdfParams/hash}} member of - |normalizedAlgorithm| as |Hash|, -
-- |keyDerivationKey| as the input keying material, - |IKM|, -
-- the {{HkdfParams/salt}} member of - |normalizedAlgorithm| as |salt|, -
-- the {{HkdfParams/info}} member of - |normalizedAlgorithm| as |info|, -
-- |length| divided by 8 as the value of |L|, -
-- If the key derivation operation fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Return |result|. -
-Let |keyData| be the key data to be imported.
-- If |usages| contains a value that is not - "`deriveKey`" or "`deriveBits`", - - then [= exception/throw =] a - {{SyntaxError}}. -
-- If |extractable| is not `false`, - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |key| be a new {{CryptoKey}} - representing the key data provided in |keyData|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new - {{KeyAlgorithm}} object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`HKDF`". -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- Return null. -
-+ The "`HKDF`" algorithm identifier is used to + perform key derivation using the extraction-then-expansion approach described in + [[RFC5869]] and + using the SHA hash functions defined in this specification. +
++ Other specifications + may specify the use of additional hash algorithms with HKDF. + Such specifications must define the digest operation for the additional hash algorithms. +
++ The [= recognized algorithm name =] + for this algorithm is "`HKDF`". +
+| Operation | +Parameters | +Result | +
|---|---|---|
| deriveBits | +{{HkdfParams}} | +[= byte sequence =] | +
| importKey | +None | +{{CryptoKey}} | +
| Get key length | +None | +null | +
+dictionary HkdfParams : Algorithm {
+ required HashAlgorithmIdentifier hash;
+ required BufferSource salt;
+ required BufferSource info;
+};
+
+ The hash member represents the algorithm to use with HMAC (e.g.: SHA-256).
+The salt member represents the salt used in the extract step.
+The info member represents application specific context for the derived keying material.
++ If |length| is null or is not a multiple of 8, then [= exception/throw =] an {{OperationError}}. +
++ Let |keyDerivationKey| be the secret represented by the {{CryptoKey/[[handle]]}} internal slot of |key|. +
++ Let |result| be the result of performing the HKDF extract and then + the HKDF expand step described in Section 2 of + [[RFC5869]] using: +
++ the {{HkdfParams/hash}} member of + |normalizedAlgorithm| as |Hash|, +
++ |keyDerivationKey| as the input keying material, + |IKM|, +
++ the {{HkdfParams/salt}} member of + |normalizedAlgorithm| as |salt|, +
++ the {{HkdfParams/info}} member of + |normalizedAlgorithm| as |info|, +
++ |length| divided by 8 as the value of |L|, +
++ If the key derivation operation fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Return |result|. +
+Let |keyData| be the key data to be imported.
++ If |usages| contains a value that is not + "`deriveKey`" or "`deriveBits`", + + then [= exception/throw =] a + {{SyntaxError}}. +
++ If |extractable| is not `false`, + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |key| be a new {{CryptoKey}} + representing the key data provided in |keyData|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new + {{KeyAlgorithm}} object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`HKDF`". +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ Return null. +
+- If |length| is null or is not a multiple of 8, then [= exception/throw =] an {{OperationError}}. -
-- If the {{Pbkdf2Params/iterations}} member of |normalizedAlgorithm| is zero, - then [= exception/throw =] an {{OperationError}}. -
-- If |length| is zero, return an empty [= byte sequence =]. -
-- Let |prf| be the MAC Generation function described in Section 4 of - [[FIPS-198-1]] using the hash function - described by the {{Pbkdf2Params/hash}} member of - |normalizedAlgorithm|. -
-- Let |result| be the result of performing the PBKDF2 operation defined - in Section 5.2 of [[RFC8018]] using |prf| as the - pseudo-random function, |PRF|, the password represented by the {{CryptoKey/[[handle]]}} internal slot of |key| - as the password, |P|, - the {{Pbkdf2Params/salt}} attribute of - |normalizedAlgorithm| as the salt, |S|, the value of the {{Pbkdf2Params/iterations}} attribute of - |normalizedAlgorithm| as the iteration count, |c|, and - |length| divided by 8 as the intended key length, |dkLen|. -
-- If the key derivation operation fails, - then [= exception/throw =] an - {{OperationError}}. -
-- Return |result|. -
-- If |format| is not {{KeyFormat/"raw"}}, [= exception/throw =] a {{NotSupportedError}} -
-- If |usages| contains a value that is not - "`deriveKey`" or "`deriveBits`", then - [= exception/throw =] a {{SyntaxError}}. -
-- If |extractable| is not `false`, - then [= exception/throw =] a - {{SyntaxError}}. -
-- Let |key| be a new {{CryptoKey}} - representing |keyData|. -
-- Set the {{CryptoKey/[[type]]}} internal slot of - |key| to {{KeyType/"secret"}}. -
-- Let |algorithm| be a new {{KeyAlgorithm}} - object. -
-- Set the {{KeyAlgorithm/name}} attribute of - |algorithm| to "`PBKDF2`". -
-- Set the {{CryptoKey/[[algorithm]]}} internal - slot of |key| to |algorithm|. -
-- Return |key|. -
-- Return null. -
-+ If |length| is null or is not a multiple of 8, then [= exception/throw =] an {{OperationError}}. +
++ If the {{Pbkdf2Params/iterations}} member of |normalizedAlgorithm| is zero, + then [= exception/throw =] an {{OperationError}}. +
++ If |length| is zero, return an empty [= byte sequence =]. +
++ Let |prf| be the MAC Generation function described in Section 4 of + [[FIPS-198-1]] using the hash function + described by the {{Pbkdf2Params/hash}} member of + |normalizedAlgorithm|. +
++ Let |result| be the result of performing the PBKDF2 operation defined + in Section 5.2 of [[RFC8018]] using |prf| as the + pseudo-random function, |PRF|, the password represented by the {{CryptoKey/[[handle]]}} internal slot of |key| + as the password, |P|, + the {{Pbkdf2Params/salt}} attribute of + |normalizedAlgorithm| as the salt, |S|, the value of the {{Pbkdf2Params/iterations}} attribute of + |normalizedAlgorithm| as the iteration count, |c|, and + |length| divided by 8 as the intended key length, |dkLen|. +
++ If the key derivation operation fails, + then [= exception/throw =] an + {{OperationError}}. +
++ Return |result|. +
++ If |format| is not {{KeyFormat/"raw"}}, [= exception/throw =] a {{NotSupportedError}} +
++ If |usages| contains a value that is not + "`deriveKey`" or "`deriveBits`", then + [= exception/throw =] a {{SyntaxError}}. +
++ If |extractable| is not `false`, + then [= exception/throw =] a + {{SyntaxError}}. +
++ Let |key| be a new {{CryptoKey}} + representing |keyData|. +
++ Set the {{CryptoKey/[[type]]}} internal slot of + |key| to {{KeyType/"secret"}}. +
++ Let |algorithm| be a new {{KeyAlgorithm}} + object. +
++ Set the {{KeyAlgorithm/name}} attribute of + |algorithm| to "`PBKDF2`". +
++ Set the {{CryptoKey/[[algorithm]]}} internal + slot of |key| to |algorithm|. +
++ Return |key|. +
++ Return null. +
+