You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SubtleCrypto.importKey invokes the algorithm's importKey operation in step 3, and overwrites the [[extractable]] internal slot in step 10, regardless what the algorithm wrote into that slot:
So why does HKDF's importKey operation write false into that slot?
I'm not sure what happened here, and therefore not sure how to resolve this issue:
Option 1: There's a good reason why it should be [[extractable]] = false;, the key should not be extractable. In this case, SubtleCrypto.importKey must be changed in order to preserve that flag.
Option 2: It's just a dead write that nobody noticed before. In this case, it might be nice to remove the dead write.
EDIT: Also affects PBKDF2's importKey.
Found while combing through the docs for #376, which I in turn found while implementing this from scratch. Shameless plug: Ladybird :)
The text was updated successfully, but these errors were encountered:
BenWiederhake
changed the title
HKDF: Dead write to "extractable" bit during importKey operation
HKDF&PBKDF2: Dead write to "extractable" bit during importKey operation
Oct 25, 2024
So both options are essentially true: extractable must be false, but also the write is dead and can be removed in favor of the one in importKey() as you noted.
SubtleCrypto.importKey invokes the algorithm's importKey operation in step 3, and overwrites the
[[extractable]]
internal slot in step 10, regardless what the algorithm wrote into that slot:So why does HKDF's importKey operation write
false
into that slot?I'm not sure what happened here, and therefore not sure how to resolve this issue:
[[extractable]] = false;
, the key should not be extractable. In this case, SubtleCrypto.importKey must be changed in order to preserve that flag.EDIT: Also affects PBKDF2's importKey.
Found while combing through the docs for #376, which I in turn found while implementing this from scratch. Shameless plug: Ladybird :)
The text was updated successfully, but these errors were encountered: