Bug 279963 – [WebCrypto] JWK import / export round-trip fails in X25519

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Javier Fernandez]

STEPS TO REPRODUCE THE PROBLEM 

1- Load the importKey.html test case (attached)
2- See the messages in the dev tools console

EXPECTED RESULT: 

The following message should appear:

CONSOLE LOG Import Success !!
CONSOLE LOG Export Success !!
CONSOLE LOG Round trip works 

ACTUAL RESULT:

CONSOLE LOG Import Success !!
CONSOLE LOG Export Success !!
CONSOLE LOG Round trip failed
CONSOLE LOG Expected:
{  
   crv: X25519
   d: yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E
   x: HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY
   kty: OKP
}
CONSOLE LOG Got:
{  
   crv: X25519
   d: yIOOdtBX37fYyVpp4TgWCt1jc_1xpNJ2u1bjqBtk_2E
   ext: true
   key_ops: deriveBits
   kty: OKP
   x: hbrW0bCab1ERDBqLWuWTwnQLzwZcuzYSiYsyGkVcT8A
}

[Javier Fernandez]

The problem seems to be the public key set to the 'x' attribute:

<   x: HPKx5gIuxTc3Htf1PlT6EVTYPpjrZOpR-uWzMHz-lwY
>   x: hbrW0bCab1ERDBqLWuWTwnQLzwZcuzYSiYsyGkVcT8A

This bug happens only in the Mac port; the Gtk+ port produces a successfully round-trip operation. 

Looking that the code, the JWK export operation in X25519 calls to generateJwkX() function [1], which generates the public key bytes from the private key material. 

 
    auto* di = ccsha512_di();
    ccec25519pubkey publicKey;
    cced25519_make_pub(di, publicKey, m_data.data());

The result of this operation is different than the original public key previously imported.

[1] https://github.com/WebKit/WebKit/blob/2d09e4618e7a51850fd9095f908b7683d4c9b7d9/Source/WebCore/crypto/cocoa/CryptoKeyOKPCocoa.cpp#L376

[Radar WebKit Bug Importer]

<rdar://problem/136282739>

[Javier Fernandez]

This bug is the cause of some of the failures in these WPT tests:

https://wpt.fyi/results/WebCryptoAPI/import_export/okp_importKey.https.any.worker.html?label=experimental&label=master&aligned

[Nitin Mahendru]

Pull request: https://github.com/WebKit/WebKit/pull/34393

[EWS]

Committed 284459@main (34986dbe6f18): <https://commits.webkit.org/284459@main>

Reviewed commits have been landed. Closing PR #34393 and removing active labels.