crypto: validate JWK usages before key_ops

Check requested usages against the JWK public or private key type
before validating key_ops. This preserves the SyntaxError precedence
specified for RSA, EC, CFRG, ML-DSA, and ML-KEM imports.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65550
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: panva

lib/internal/crypto/cfrg.js

@@ -146,6 +146,12 @@ function cfrgImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = (name === 'X25519' || name === 'X448') ? 'enc' : 'sig';
       validateJwk(keyData, 'OKP', extractable, usagesSet, expectedUse);
 
@@ -159,11 +165,6 @@ function cfrgImportKey(
             'JWK "alg" does not match the requested algorithm', 'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }

lib/internal/crypto/ec.js

@@ -164,6 +164,12 @@ function ecImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = name === 'ECDH' ? 'enc' : 'sig';
       validateJwk(keyData, 'EC', extractable, usagesSet, expectedUse);
 
@@ -185,11 +191,6 @@ function ecImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }

lib/internal/crypto/ml_dsa.js

@@ -158,17 +158,18 @@ function mlDsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'sig');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }

lib/internal/crypto/ml_kem.js

@@ -169,17 +169,18 @@ function mlKemImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'enc');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }

lib/internal/crypto/rsa.js

@@ -186,6 +186,12 @@ function rsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        algorithm.name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = algorithm.name === 'RSA-OAEP' ? 'enc' : 'sig';
       validateJwk(keyData, 'RSA', extractable, usagesSet, expectedUse);
 
@@ -202,11 +208,6 @@ function rsaImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        algorithm.name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }

test/parallel/test-webcrypto-export-import-cfrg.js

@@ -432,6 +432,41 @@ async function testImportRaw({ name, publicUsages }) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const jwk = keyData[name].jwk;
+    const publicJwk = {
+      kty: jwk.kty,
+      crv: jwk.crv,
+      x: jwk.x,
+    };
+    const isKeyAgreement = name.startsWith('X');
+    const invalidUsage = isKeyAgreement ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = isKeyAgreement ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const rsaPublic = crypto.createPublicKey(
     fixtures.readKey('rsa_public_2048.pem'));

test/parallel/test-webcrypto-export-import-ec.js

@@ -412,6 +412,42 @@ async function testImportRaw({ name, publicUsages }, namedCurve) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const jwk = keyData['P-256'].jwk;
+  const publicJwk = {
+    kty: jwk.kty,
+    crv: jwk.crv,
+    x: jwk.x,
+    y: jwk.y,
+  };
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const invalidUsage = name === 'ECDH' ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = name === 'ECDH' ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 
 // https://github.com/nodejs/node/issues/45859
 (async function() {

test/parallel/test-webcrypto-export-import-ml-dsa.js

@@ -491,6 +491,40 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   });
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData['ML-DSA-65'].jwk;
+  const publicJwk = { ...privateJwk, priv: undefined };
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'verify'],
+    [publicJwk, 'sign'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'sign'],
+    [publicJwk, 'verify'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+})().then(common.mustCall());
+
 if (!process.features.openssl_is_boringssl) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {

test/parallel/test-webcrypto-export-import-ml-kem.js

@@ -496,13 +496,29 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
   });
 })().then(common.mustCall());
 
-// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
-// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
-// duplicate entries are rejected
+// JWK key usage validation precedes `key_ops` validation.
 (async function() {
-  for (const op of ['encapsulateKey', 'encapsulateBits',
-                    'decapsulateKey', 'decapsulateBits']) {
-    const jwk = { ...keyData['ML-KEM-768'].jwk, key_ops: [op, op] };
+  const privateJwk = keyData['ML-KEM-768'].jwk;
+  const encapsulationOps = ['encapsulateKey', 'encapsulateBits'];
+  const decapsulationOps = ['decapsulateKey', 'decapsulateBits'];
+
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  // Duplicate entries are still rejected when the requested usages are valid.
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, priv: undefined, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+
+  for (const op of decapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
     await assert.rejects(
       subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
       { name: 'DataError', message: /Duplicate key operation/ });

test/parallel/test-webcrypto-export-import-rsa.js

@@ -651,6 +651,35 @@ const testVectors = [
   await Promise.all(variations);
 })().then(common.mustCall());
 
+// Type-specific JWK usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData[1024].jwk;
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const algorithm = { name, hash: 'SHA-256' };
+    const invalidUsage = publicUsages[0];
+    const validUsage = privateUsages[0];
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [invalidUsage, invalidUsage] },
+        algorithm,
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [validUsage, validUsage] },
+        algorithm,
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const ecPublic = crypto.createPublicKey(
     fixtures.readKey('ec_p256_public.pem'));