crypto: support ML-KEM in Web Cryptography

deps/ncrypto/ncrypto.cc

@@ -2162,21 +2162,34 @@ DataPointer EVPKeyPointer::rawPublicKey() const {
 #if OPENSSL_WITH_PQC
 DataPointer EVPKeyPointer::rawSeed() const {
   if (!pkey_) return {};
+
+  // Determine seed length and parameter name based on key type
+  size_t seed_len;
+  const char* param_name;
+
   switch (id()) {
     case EVP_PKEY_ML_DSA_44:
     case EVP_PKEY_ML_DSA_65:
     case EVP_PKEY_ML_DSA_87:
+      seed_len = 32;  // ML-DSA uses 32-byte seeds
+      param_name = OSSL_PKEY_PARAM_ML_DSA_SEED;
+      break;
+    case EVP_PKEY_ML_KEM_512:
+    case EVP_PKEY_ML_KEM_768:
+    case EVP_PKEY_ML_KEM_1024:
+      seed_len = 64;  // ML-KEM uses 64-byte seeds
+      param_name = OSSL_PKEY_PARAM_ML_KEM_SEED;
       break;
     default:
       unreachable();
   }
 
-  size_t seed_len = 32;
   if (auto data = DataPointer::Alloc(seed_len)) {
     const Buffer<unsigned char> buf = data;
     size_t len = data.size();
+
     if (EVP_PKEY_get_octet_string_param(
-            get(), OSSL_PKEY_PARAM_ML_DSA_SEED, buf.data, len, &seed_len) != 1)
+            get(), param_name, buf.data, len, &seed_len) != 1)
       return {};
     return data;
   }

lib/internal/crypto/keys.js

@@ -308,6 +308,14 @@ const {
           result = require('internal/crypto/ml_dsa')
             .mlDsaImportKey('KeyObject', this, algorithm, extractable, keyUsages);
           break;
+        case 'ML-KEM-512':
+          // Fall through
+        case 'ML-KEM-768':
+          // Fall through
+        case 'ML-KEM-1024':
+          result = require('internal/crypto/ml_kem')
+            .mlKemImportKey('KeyObject', this, algorithm, extractable, keyUsages);
+          break;
         default:
           throw lazyDOMException('Unrecognized algorithm name', 'NotSupportedError');
       }
@@ -568,7 +576,7 @@ function getKeyObjectHandleFromJwk(key, ctx) {
     const handle = new KeyObjectHandle();
 
     const keyType = isPublic ? kKeyTypePublic : kKeyTypePrivate;
-    if (!handle.initMlDsaRaw(key.alg, keyData, keyType)) {
+    if (!handle.initPqcRaw(key.alg, keyData, keyType)) {
       throw new ERR_CRYPTO_INVALID_JWK();
     }
 

lib/internal/crypto/ml_dsa.js

@@ -69,7 +69,7 @@ function verifyAcceptableMlDsaKeyUse(name, isPublic, usages) {
 function createMlDsaRawKey(name, keyData, isPublic) {
   const handle = new KeyObjectHandle();
   const keyType = isPublic ? kKeyTypePublic : kKeyTypePrivate;
-  if (!handle.initMlDsaRaw(name, keyData, keyType)) {
+  if (!handle.initPqcRaw(name, keyData, keyType)) {
     throw lazyDOMException('Invalid keyData', 'DataError');
   }
 
@@ -119,19 +119,16 @@ function mlDsaExportKey(key, format) {
     switch (format) {
       case kWebCryptoKeyFormatRaw: {
         if (key[kKeyType] === 'private') {
-          const { priv } = key[kKeyObject][kHandle].exportJwk({}, false);
-          return Buffer.alloc(32, priv, 'base64url').buffer;
+          return key[kKeyObject][kHandle].rawSeed().buffer;
         }
 
-        const { pub } = key[kKeyObject][kHandle].exportJwk({}, false);
-        return Buffer.alloc(Buffer.byteLength(pub, 'base64url'), pub, 'base64url').buffer;
+        return key[kKeyObject][kHandle].rawPublicKey().buffer;
       }
       case kWebCryptoKeyFormatSPKI: {
         return key[kKeyObject][kHandle].export(kKeyFormatDER, kWebCryptoKeyFormatSPKI).buffer;
       }
       case kWebCryptoKeyFormatPKCS8: {
-        const { priv } = key[kKeyObject][kHandle].exportJwk({}, false);
-        const seed = Buffer.alloc(32, priv, 'base64url');
+        const seed = key[kKeyObject][kHandle].rawSeed();
         const buffer = new Uint8Array(54);
         buffer.set([
           0x30, 0x34, 0x02, 0x01, 0x00, 0x30, 0x0B, 0x06,

lib/internal/crypto/ml_kem.js

@@ -0,0 +1,287 @@
+'use strict';
+
+const {
+  PromiseWithResolvers,
+  SafeSet,
+  Uint8Array,
+} = primordials;
+
+const {
+  kCryptoJobAsync,
+  KEMDecapsulateJob,
+  KEMEncapsulateJob,
+  KeyObjectHandle,
+  kKeyFormatDER,
+  kKeyTypePrivate,
+  kKeyTypePublic,
+  kWebCryptoKeyFormatPKCS8,
+  kWebCryptoKeyFormatRaw,
+  kWebCryptoKeyFormatSPKI,
+} = internalBinding('crypto');
+
+const {
+  getUsagesUnion,
+  hasAnyNotIn,
+  kHandle,
+  kKeyObject,
+} = require('internal/crypto/util');
+
+const {
+  lazyDOMException,
+  promisify,
+} = require('internal/util');
+
+const {
+  generateKeyPair: _generateKeyPair,
+} = require('internal/crypto/keygen');
+
+const {
+  InternalCryptoKey,
+  PrivateKeyObject,
+  PublicKeyObject,
+  createPrivateKey,
+  createPublicKey,
+  kAlgorithm,
+  kKeyType,
+} = require('internal/crypto/keys');
+
+const generateKeyPair = promisify(_generateKeyPair);
+
+async function mlKemGenerateKey(algorithm, extractable, keyUsages) {
+  const { name } = algorithm;
+
+  const usageSet = new SafeSet(keyUsages);
+  if (hasAnyNotIn(usageSet, ['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits'])) {
+    throw lazyDOMException(
+      `Unsupported key usage for an ${name} key`,
+      'SyntaxError');
+  }
+
+  const keyPair = await generateKeyPair(name.toLowerCase()).catch((err) => {
+    throw lazyDOMException(
+      'The operation failed for an operation-specific reason',
+      { name: 'OperationError', cause: err });
+  });
+
+  const publicUsages = getUsagesUnion(usageSet, 'encapsulateBits', 'encapsulateKey');
+  const privateUsages = getUsagesUnion(usageSet, 'decapsulateBits', 'decapsulateKey');
+
+  const keyAlgorithm = { name };
+
+  const publicKey =
+    new InternalCryptoKey(
+      keyPair.publicKey,
+      keyAlgorithm,
+      publicUsages,
+      true);
+
+  const privateKey =
+    new InternalCryptoKey(
+      keyPair.privateKey,
+      keyAlgorithm,
+      privateUsages,
+      extractable);
+
+  return { __proto__: null, privateKey, publicKey };
+}
+
+function mlKemExportKey(key, format) {
+  try {
+    switch (format) {
+      case kWebCryptoKeyFormatRaw: {
+        if (key[kKeyType] === 'private') {
+          return key[kKeyObject][kHandle].rawSeed().buffer;
+        }
+
+        return key[kKeyObject][kHandle].rawPublicKey().buffer;
+      }
+      case kWebCryptoKeyFormatSPKI: {
+        return key[kKeyObject][kHandle].export(kKeyFormatDER, kWebCryptoKeyFormatSPKI).buffer;
+      }
+      case kWebCryptoKeyFormatPKCS8: {
+        const seed = key[kKeyObject][kHandle].rawSeed();
+        const buffer = new Uint8Array(86);
+        buffer.set([
+          0x30, 0x54, 0x02, 0x01, 0x00, 0x30, 0x0B, 0x06,
+          0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04,
+          0x04, 0x00, 0x04, 0x42, 0x80, 0x40,
+        ], 0);
+        switch (key[kAlgorithm].name) {
+          case 'ML-KEM-512':
+            buffer.set([0x01], 17);
+            break;
+          case 'ML-KEM-768':
+            buffer.set([0x02], 17);
+            break;
+          case 'ML-KEM-1024':
+            buffer.set([0x03], 17);
+            break;
+        }
+        buffer.set(seed, 22);
+        return buffer.buffer;
+      }
+      default:
+        return undefined;
+    }
+  } catch (err) {
+    throw lazyDOMException(
+      'The operation failed for an operation-specific reason',
+      { name: 'OperationError', cause: err });
+  }
+}
+
+function verifyAcceptableMlKemKeyUse(name, isPublic, usages) {
+  const checkSet = isPublic ? ['encapsulateKey', 'encapsulateBits'] : ['decapsulateKey', 'decapsulateBits'];
+  if (hasAnyNotIn(usages, checkSet)) {
+    throw lazyDOMException(
+      `Unsupported key usage for a ${name} key`,
+      'SyntaxError');
+  }
+}
+
+function createMlKemRawKey(name, keyData, isPublic) {
+  const handle = new KeyObjectHandle();
+  const keyType = isPublic ? kKeyTypePublic : kKeyTypePrivate;
+  if (!handle.initPqcRaw(name, keyData, keyType)) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+
+  return isPublic ? new PublicKeyObject(handle) : new PrivateKeyObject(handle);
+}
+
+function mlKemImportKey(
+  format,
+  keyData,
+  algorithm,
+  extractable,
+  keyUsages) {
+
+  const { name } = algorithm;
+  let keyObject;
+  const usagesSet = new SafeSet(keyUsages);
+  switch (format) {
+    case 'KeyObject': {
+      verifyAcceptableMlKemKeyUse(name, keyData.type === 'public', usagesSet);
+      keyObject = keyData;
+      break;
+    }
+    case 'spki': {
+      verifyAcceptableMlKemKeyUse(name, true, usagesSet);
+      try {
+        keyObject = createPublicKey({
+          key: keyData,
+          format: 'der',
+          type: 'spki',
+        });
+      } catch (err) {
+        throw lazyDOMException(
+          'Invalid keyData', { name: 'DataError', cause: err });
+      }
+      break;
+    }
+    case 'pkcs8': {
+      verifyAcceptableMlKemKeyUse(name, false, usagesSet);
+      try {
+        keyObject = createPrivateKey({
+          key: keyData,
+          format: 'der',
+          type: 'pkcs8',
+        });
+      } catch (err) {
+        throw lazyDOMException(
+          'Invalid keyData', { name: 'DataError', cause: err });
+      }
+      break;
+    }
+    case 'raw-public':
+    case 'raw-seed': {
+      const isPublic = format === 'raw-public';
+      verifyAcceptableMlKemKeyUse(name, isPublic, usagesSet);
+
+      try {
+        keyObject = createMlKemRawKey(name, keyData, isPublic);
+      } catch (err) {
+        throw lazyDOMException('Invalid keyData', { name: 'DataError', cause: err });
+      }
+      break;
+    }
+    default:
+      return undefined;
+  }
+
+  if (keyObject.asymmetricKeyType !== name.toLowerCase()) {
+    throw lazyDOMException('Invalid key type', 'DataError');
+  }
+
+  return new InternalCryptoKey(
+    keyObject,
+    { name },
+    keyUsages,
+    extractable);
+}
+
+function mlKemEncapsulate(encapsulationKey) {
+  if (encapsulationKey[kKeyType] !== 'public') {
+    throw lazyDOMException(`Key must be a public key`, 'InvalidAccessError');
+  }
+
+  const { promise, resolve, reject } = PromiseWithResolvers();
+
+  const job = new KEMEncapsulateJob(
+    kCryptoJobAsync,
+    encapsulationKey[kKeyObject][kHandle],
+    undefined,
+    undefined,
+    undefined);
+
+  job.ondone = (error, result) => {
+    if (error) {
+      reject(lazyDOMException(
+        'The operation failed for an operation-specific reason',
+        { name: 'OperationError', cause: error }));
+    } else {
+      const { 0: sharedKey, 1: ciphertext } = result;
+      resolve({ sharedKey: sharedKey.buffer, ciphertext: ciphertext.buffer });
+    }
+  };
+  job.run();
+
+  return promise;
+}
+
+function mlKemDecapsulate(decapsulationKey, ciphertext) {
+  if (decapsulationKey[kKeyType] !== 'private') {
+    throw lazyDOMException(`Key must be a private key`, 'InvalidAccessError');
+  }
+
+  const { promise, resolve, reject } = PromiseWithResolvers();
+
+  const job = new KEMDecapsulateJob(
+    kCryptoJobAsync,
+    decapsulationKey[kKeyObject][kHandle],
+    undefined,
+    undefined,
+    undefined,
+    ciphertext);
+
+  job.ondone = (error, result) => {
+    if (error) {
+      reject(lazyDOMException(
+        'The operation failed for an operation-specific reason',
+        { name: 'OperationError', cause: error }));
+    } else {
+      resolve(result.buffer);
+    }
+  };
+  job.run();
+
+  return promise;
+}
+
+module.exports = {
+  mlKemExportKey,
+  mlKemImportKey,
+  mlKemEncapsulate,
+  mlKemDecapsulate,
+  mlKemGenerateKey,
+};