René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Accepting `CryptoKey` in `node:crypto` APIs","articleBody":"The following APIs accept a `CryptoKey` instance and process the operation despite the restrictions put forth on the `CryptoKey` instance (e.g. algorithm, usages, extractable)\r\n\r\n- KeyObject.from (ignores `extractable`)\r\n- crypto.publicDecrypt\r\n- crypto.publicEncrypt\r\n- crypto.privateDecrypt\r\n- crypto.privateEncrypt\r\n- crypto.sign\r\n- crypto.verify\r\n- Sign.sign\r\n- Verify.verify\r\n- Cipher.final\r\n- Decipher.final\r\n- Hmac.digest\r\n\r\nThis list is according to the docs, but i suspect it's possible that hkdf and pbkdf2 allow this too.\r\n\r\nThis issue is to discuss a way forward to deal with this issues.\r\n\r\n## KeyObject.from\r\n\r\nhttps://github.com/nodejs/node/pull/37240 attempted to do something about KeyObject.from but i think the outcome would not solve the issues above.\r\n\r\nI believe that converting key representations is not an issue so long as the more restrictive key representation's properties are upheld.\r\n\r\nWe can take a drastic stance and deprecate / in due time remove KeyObject.from entirely, or make KeyObject.from respect the `extractable` property and duly document that once the key is converted the CryptoKey restrictions are not upheld anymore. I'd much rather see the latter.\r\n\r\nAnother possible approach would be to disable KeyObject.export on keys that came from non-extractable CryptoKey.\r\n\r\n## APIs accepting CryptoKey but ignoring its parameters.\r\n\r\nWe could deprecate the use of CryptoKey in these APIs entirely or emulate WebCryptoAPI behaviour and check the CryptoKey usages and algorithm slots, either way this would be a doc-only deprecation at first, then --pending-deprecation, runtime deprecation, throw behaviour at the end.","author":{"url":"https://github.com/panva","@type":"Person","name":"panva"},"datePublished":"2024-10-06T13:00:46.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/55293/node/issues/55293"}