262613 2023-10-04 06:00:28 -0700 Ed25519 JWK import should ignore the "alg" JWK member 2025-04-01 06:05:23 -0700 1 1 1 Unclassified WebKit WebCore Misc. Safari 17 Unspecified Unspecified RESOLVED WONTFIX https://bugs.chromium.org/p/chromium/issues/detail?id=1489245 InRadar, WPTImpact P2 Normal --- 1 panva.ip jfernandez ahmad.saleem792 jfernandez me nitinmahendru panva.ip pascoe webkit-bug-importer wilander oldest_to_newest 1982413 0 panva.ip 2023-10-04 06:00:28 -0700 As per https://github.com/WICG/webcrypto-secure-curves/pull/24 the "alg" JWK member is now ignored during JWK import, and missing during JWK export for Ed25519 keys. Safari correctly handles the latter but not the former, the "alg" JWK member is not ignored during import. ``` const jwk = { crv: "Ed25519", x: "2OGJY9gJ1IfZVJrMrsZ0Ln7rok2KDTsUt-PK6gaJPcw", kty: "OKP", alg: "this should now be ignored", }; crypto.subtle.importKey("jwk", jwk, "Ed25519", true, ["verify"]).then((key) => { crypto.subtle.exportKey("jwk", key).then((exportedJwk) => { if (exportedJwk.alg) { console.log("❌ alg should be missing"); } }); }); ``` 1982414 1 panva.ip 2023-10-04 06:01:20 -0700 WPT update for the draft spec change https://github.com/web-platform-tests/wpt/pull/42333 1984275 2 webkit-bug-importer 2023-10-11 06:01:15 -0700 <rdar://problem/116806236> 1994970 3 jfernandez 2023-11-27 08:48:50 -0800 I'm working on a patch for this bug. 1995341 4 jfernandez 2023-11-28 10:36:41 -0800 Pull request: https://github.com/WebKit/WebKit/pull/21006 2014417 5 jfernandez 2024-02-16 02:23:33 -0800 It seems Chrome reviewers have doubts regarding the decision to remove the 'alg' field from the JWK import operation's logic. I'd rather wait until there is more consensus before merging the patch. 2070060 6 jfernandez 2024-10-23 05:43:47 -0700 It seems that FF implementation ignores the "alg" JWK member, as it passes the related tests [1]. It'd be useful to know WebKit's position on this regard, given than apparently Chrome's concerns are debatable, from what I could extract from the conversation in the mentioned Chrome bug. [1] https://wpt.fyi/results/WebCryptoAPI/import_export/okp_importKey_Ed25519.https.any.html?label=experimental&label=master&aligned 2101379 7 jfernandez 2025-03-07 08:23:02 -0800 It seems the spec introduced again the "alg" key in the JWK format, see https://github.com/w3c/webcrypto/pull/401 I guess we can close this bug as invalid and perhaps file a new one if the current behavior doesn't match the new possible values of the "alg" member.