@encharm/cws 4.4.1 → 4.5.2

package/src/headers/{18 → 24}/crypto/crypto_keygen.h

@@ -11,8 +11,7 @@
 #include "memory_tracker.h"
 #include "v8.h"
 
-namespace node {
-namespace crypto {
+namespace node::crypto {
 namespace Keygen {
 void Initialize(Environment* env, v8::Local<v8::Object> target);
 void RegisterExternalReferences(ExternalReferenceRegistry* registry);
@@ -75,9 +74,6 @@ class KeyGenJob final : public CryptoJob<KeyGenTraits> {
             std::move(params)) {}
 
   void DoThreadPoolWork() override {
-    // Make sure the CSPRNG is properly seeded so the results are secure.
-    CheckEntropy();
-
     AdditionalParams* params = CryptoJob<KeyGenTraits>::params();
 
     switch (KeyGenTraits::DoKeyGen(AsyncWrap::env(), params)) {
@@ -94,26 +90,33 @@ class KeyGenJob final : public CryptoJob<KeyGenTraits> {
     }
   }
 
-  v8::Maybe<bool> ToResult(
-      v8::Local<v8::Value>* err,
-      v8::Local<v8::Value>* result) override {
+  v8::Maybe<void> ToResult(v8::Local<v8::Value>* err,
+                           v8::Local<v8::Value>* result) override {
     Environment* env = AsyncWrap::env();
     CryptoErrorStore* errors = CryptoJob<KeyGenTraits>::errors();
     AdditionalParams* params = CryptoJob<KeyGenTraits>::params();
 
     if (status_ == KeyGenJobStatus::OK) {
-      v8::Maybe<bool> ret = KeyGenTraits::EncodeKey(env, params, result);
-      if (ret.IsJust() && ret.FromJust()) {
+      v8::TryCatch try_catch(env->isolate());
+      if (KeyGenTraits::EncodeKey(env, params).ToLocal(result)) {
         *err = Undefined(env->isolate());
+      } else {
+        CHECK(try_catch.HasCaught());
+        CHECK(try_catch.CanContinue());
+        *result = Undefined(env->isolate());
+        *err = try_catch.Exception();
+      }
+    } else {
+      if (errors->Empty()) errors->Capture();
+      CHECK(!errors->Empty());
+      *result = Undefined(env->isolate());
+      if (!errors->ToException(env).ToLocal(err)) {
+        return v8::Nothing<void>();
       }
-      return ret;
     }
-
-    if (errors->Empty())
-      errors->Capture();
-    CHECK(!errors->Empty());
-    *result = Undefined(env->isolate());
-    return v8::Just(errors->ToException(env).ToLocal(err));
+    CHECK(!result->IsEmpty());
+    CHECK(!err->IsEmpty());
+    return v8::JustVoid();
   }
 
   SET_SELF_SIZE(KeyGenJob)
@@ -132,7 +135,7 @@ struct KeyPairGenTraits final {
       AsyncWrap::PROVIDER_KEYPAIRGENREQUEST;
   static constexpr const char* JobName = KeyPairAlgorithmTraits::JobName;
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
@@ -143,31 +146,23 @@ struct KeyPairGenTraits final {
     // process input parameters. This allows each job to have a variable
     // number of input parameters specific to each job type.
     if (KeyPairAlgorithmTraits::AdditionalConfig(mode, args, offset, params)
-            .IsNothing()) {
-      return v8::Just(false);
+            .IsNothing() ||
+        !KeyObjectData::GetPublicKeyEncodingFromJs(
+             args, offset, kKeyContextGenerate)
+             .To(&params->public_key_encoding) ||
+        !KeyObjectData::GetPrivateKeyEncodingFromJs(
+             args, offset, kKeyContextGenerate)
+             .To(&params->private_key_encoding)) {
+      return v8::Nothing<void>();
     }
 
-    params->public_key_encoding = ManagedEVPPKey::GetPublicKeyEncodingFromJs(
-        args,
-        offset,
-        kKeyContextGenerate);
-
-    auto private_key_encoding =
-        ManagedEVPPKey::GetPrivateKeyEncodingFromJs(
-            args,
-            offset,
-            kKeyContextGenerate);
-
-    if (!private_key_encoding.IsEmpty())
-      params->private_key_encoding = private_key_encoding.Release();
-
-    return v8::Just(true);
+    return v8::JustVoid();
   }
 
   static KeyGenJobStatus DoKeyGen(
       Environment* env,
       AdditionalParameters* params) {
-    EVPKeyCtxPointer ctx = KeyPairAlgorithmTraits::Setup(params);
+    ncrypto::EVPKeyCtxPointer ctx = KeyPairAlgorithmTraits::Setup(params);
 
     if (!ctx)
       return KeyGenJobStatus::FAILED;
@@ -177,35 +172,30 @@ struct KeyPairGenTraits final {
     if (!EVP_PKEY_keygen(ctx.get(), &pkey))
       return KeyGenJobStatus::FAILED;
 
-    params->key = ManagedEVPPKey(EVPKeyPointer(pkey));
+    auto data = KeyObjectData::CreateAsymmetric(KeyType::kKeyTypePrivate,
+                                                ncrypto::EVPKeyPointer(pkey));
+    if (!data) [[unlikely]]
+      return KeyGenJobStatus::FAILED;
+    params->key = std::move(data);
     return KeyGenJobStatus::OK;
   }
 
-  static v8::Maybe<bool> EncodeKey(
-      Environment* env,
-      AdditionalParameters* params,
-      v8::Local<v8::Value>* result) {
+  static v8::MaybeLocal<v8::Value> EncodeKey(Environment* env,
+                                             AdditionalParameters* params) {
     v8::Local<v8::Value> keys[2];
-    if (ManagedEVPPKey::ToEncodedPublicKey(
-            env,
-            std::move(params->key),
-            params->public_key_encoding,
-            &keys[0]).IsNothing() ||
-        ManagedEVPPKey::ToEncodedPrivateKey(
-            env,
-            std::move(params->key),
-            params->private_key_encoding,
-            &keys[1]).IsNothing()) {
-      return v8::Nothing<bool>();
+    if (!params->key.ToEncodedPublicKey(
+            env, params->public_key_encoding, &keys[0]) ||
+        !params->key.ToEncodedPrivateKey(
+            env, params->private_key_encoding, &keys[1])) {
+      return {};
     }
-    *result = v8::Array::New(env->isolate(), keys, arraysize(keys));
-    return v8::Just(true);
+    return v8::Array::New(env->isolate(), keys, arraysize(keys));
   }
 };
 
 struct SecretKeyGenConfig final : public MemoryRetainer {
-  size_t length;  // Expressed a a number of bits
-  char* out = nullptr;  // Placeholder for the generated key bytes
+  size_t length;        // In bytes.
+  ByteSource out;       // Placeholder for the generated key bytes.
 
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(SecretKeyGenConfig)
@@ -218,7 +208,7 @@ struct SecretKeyGenTraits final {
       AsyncWrap::PROVIDER_KEYGENREQUEST;
   static constexpr const char* JobName = "SecretKeyGenJob";
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
@@ -228,28 +218,23 @@ struct SecretKeyGenTraits final {
       Environment* env,
       SecretKeyGenConfig* params);
 
-  static v8::Maybe<bool> EncodeKey(
-      Environment* env,
-      SecretKeyGenConfig* params,
-      v8::Local<v8::Value>* result);
+  static v8::MaybeLocal<v8::Value> EncodeKey(Environment* env,
+                                             SecretKeyGenConfig* params);
 };
 
 template <typename AlgorithmParams>
 struct KeyPairGenConfig final : public MemoryRetainer {
-  PublicKeyEncodingConfig public_key_encoding;
-  PrivateKeyEncodingConfig private_key_encoding;
-  ManagedEVPPKey key;
+  ncrypto::EVPKeyPointer::PublicKeyEncodingConfig public_key_encoding;
+  ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig private_key_encoding;
+  KeyObjectData key;
   AlgorithmParams params;
 
   KeyPairGenConfig() = default;
-  ~KeyPairGenConfig() {
-    Mutex::ScopedLock priv_lock(*key.mutex());
-  }
 
   explicit KeyPairGenConfig(KeyPairGenConfig&& other) noexcept
       : public_key_encoding(other.public_key_encoding),
         private_key_encoding(
-            std::forward<PrivateKeyEncodingConfig>(
+            std::forward<ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig>(
                 other.private_key_encoding)),
         key(std::move(other.key)),
         params(std::move(other.params)) {}
@@ -262,9 +247,10 @@ struct KeyPairGenConfig final : public MemoryRetainer {
 
   void MemoryInfo(MemoryTracker* tracker) const override {
     tracker->TrackField("key", key);
-    if (!private_key_encoding.passphrase_.IsEmpty()) {
+    if (private_key_encoding.passphrase.has_value()) {
+      auto& passphrase = private_key_encoding.passphrase.value();
       tracker->TrackFieldWithSize("private_key_encoding.passphrase",
-                                  private_key_encoding.passphrase_->size());
+                                  passphrase.size());
     }
     tracker->TrackField("params", params);
   }
@@ -286,9 +272,9 @@ struct NidKeyPairGenTraits final {
   using AdditionalParameters = NidKeyPairGenConfig;
   static constexpr const char* JobName = "NidKeyPairGenJob";
 
-  static EVPKeyCtxPointer Setup(NidKeyPairGenConfig* params);
+  static ncrypto::EVPKeyCtxPointer Setup(NidKeyPairGenConfig* params);
 
-  static v8::Maybe<bool> AdditionalConfig(
+  static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
@@ -297,8 +283,7 @@ struct NidKeyPairGenTraits final {
 
 using NidKeyPairGenJob = KeyGenJob<KeyPairGenTraits<NidKeyPairGenTraits>>;
 using SecretKeyGenJob = KeyGenJob<SecretKeyGenTraits>;
-}  // namespace crypto
-}  // namespace node
+}  // namespace node::crypto
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 #endif  // SRC_CRYPTO_CRYPTO_KEYGEN_H_

package/src/headers/{16 → 24}/crypto/crypto_keys.h

@@ -16,25 +16,7 @@
 #include <memory>
 #include <string>
 
-namespace node {
-namespace crypto {
-enum PKEncodingType {
-  // RSAPublicKey / RSAPrivateKey according to PKCS#1.
-  kKeyEncodingPKCS1,
-  // PrivateKeyInfo or EncryptedPrivateKeyInfo according to PKCS#8.
-  kKeyEncodingPKCS8,
-  // SubjectPublicKeyInfo according to X.509.
-  kKeyEncodingSPKI,
-  // ECPrivateKey according to SEC1.
-  kKeyEncodingSEC1
-};
-
-enum PKFormatType {
-  kKeyFormatDER,
-  kKeyFormatPEM,
-  kKeyFormatJWK
-};
-
+namespace node::crypto {
 enum KeyType {
   kKeyTypeSecret,
   kKeyTypePublic,
@@ -48,137 +30,121 @@ enum KeyEncodingContext {
 };
 
 enum class ParseKeyResult {
+  kParseKeyNotRecognized =
+      static_cast<int>(ncrypto::EVPKeyPointer::PKParseError::NOT_RECOGNIZED),
+  kParseKeyNeedPassphrase =
+      static_cast<int>(ncrypto::EVPKeyPointer::PKParseError::NEED_PASSPHRASE),
+  kParseKeyFailed =
+      static_cast<int>(ncrypto::EVPKeyPointer::PKParseError::FAILED),
   kParseKeyOk,
-  kParseKeyNotRecognized,
-  kParseKeyNeedPassphrase,
-  kParseKeyFailed
 };
 
-struct AsymmetricKeyEncodingConfig {
-  bool output_key_object_ = false;
-  PKFormatType format_ = kKeyFormatDER;
-  v8::Maybe<PKEncodingType> type_ = v8::Nothing<PKEncodingType>();
-};
-
-using PublicKeyEncodingConfig = AsymmetricKeyEncodingConfig;
+// Objects of this class can safely be shared among threads.
+class KeyObjectData final : public MemoryRetainer {
+ public:
+  static KeyObjectData CreateSecret(ByteSource key);
 
-struct PrivateKeyEncodingConfig : public AsymmetricKeyEncodingConfig {
-  const EVP_CIPHER* cipher_;
-  // The ByteSource alone is not enough to distinguish between "no passphrase"
-  // and a zero-length passphrase (which can be a null pointer), therefore, we
-  // use a NonCopyableMaybe.
-  NonCopyableMaybe<ByteSource> passphrase_;
-};
+  static KeyObjectData CreateAsymmetric(KeyType type,
+                                        ncrypto::EVPKeyPointer&& pkey);
 
-// This uses the built-in reference counter of OpenSSL to manage an EVP_PKEY
-// which is slightly more efficient than using a shared pointer and easier to
-// use.
-class ManagedEVPPKey : public MemoryRetainer {
- public:
-  ManagedEVPPKey() : mutex_(std::make_shared<Mutex>()) {}
-  explicit ManagedEVPPKey(EVPKeyPointer&& pkey);
-  ManagedEVPPKey(const ManagedEVPPKey& that);
-  ManagedEVPPKey& operator=(const ManagedEVPPKey& that);
+  KeyObjectData(std::nullptr_t = nullptr);
 
-  operator bool() const;
-  EVP_PKEY* get() const;
-  Mutex* mutex() const;
+  inline operator bool() const { return data_ != nullptr; }
 
-  void MemoryInfo(MemoryTracker* tracker) const override;
-  SET_MEMORY_INFO_NAME(ManagedEVPPKey)
-  SET_SELF_SIZE(ManagedEVPPKey)
+  KeyType GetKeyType() const;
 
-  static PublicKeyEncodingConfig GetPublicKeyEncodingFromJs(
-      const v8::FunctionCallbackInfo<v8::Value>& args,
-      unsigned int* offset,
-      KeyEncodingContext context);
+  // These functions allow unprotected access to the raw key material and should
+  // only be used to implement cryptographic operations requiring the key.
+  const ncrypto::EVPKeyPointer& GetAsymmetricKey() const;
+  const char* GetSymmetricKey() const;
+  size_t GetSymmetricKeySize() const;
 
-  static NonCopyableMaybe<PrivateKeyEncodingConfig> GetPrivateKeyEncodingFromJs(
-      const v8::FunctionCallbackInfo<v8::Value>& args,
-      unsigned int* offset,
-      KeyEncodingContext context);
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(KeyObjectData)
+  SET_SELF_SIZE(KeyObjectData)
 
-  static ManagedEVPPKey GetParsedKey(Environment* env,
-                                     EVPKeyPointer&& pkey,
-                                     ParseKeyResult ret,
-                                     const char* default_msg);
+  Mutex& mutex() const;
 
-  static ManagedEVPPKey GetPublicOrPrivateKeyFromJs(
-    const v8::FunctionCallbackInfo<v8::Value>& args,
-    unsigned int* offset);
+  static v8::Maybe<ncrypto::EVPKeyPointer::PublicKeyEncodingConfig>
+  GetPublicKeyEncodingFromJs(const v8::FunctionCallbackInfo<v8::Value>& args,
+                             unsigned int* offset,
+                             KeyEncodingContext context);
 
-  static ManagedEVPPKey GetPrivateKeyFromJs(
+  static KeyObjectData GetPrivateKeyFromJs(
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
       bool allow_key_object);
 
-  static v8::Maybe<bool> ToEncodedPublicKey(
+  static KeyObjectData GetPublicOrPrivateKeyFromJs(
+      const v8::FunctionCallbackInfo<v8::Value>& args, unsigned int* offset);
+
+  static v8::Maybe<ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig>
+  GetPrivateKeyEncodingFromJs(const v8::FunctionCallbackInfo<v8::Value>& args,
+                              unsigned int* offset,
+                              KeyEncodingContext context);
+
+  bool ToEncodedPublicKey(
       Environment* env,
-      ManagedEVPPKey key,
-      const PublicKeyEncodingConfig& config,
+      const ncrypto::EVPKeyPointer::PublicKeyEncodingConfig& config,
       v8::Local<v8::Value>* out);
 
-  static v8::Maybe<bool> ToEncodedPrivateKey(
+  bool ToEncodedPrivateKey(
       Environment* env,
-      ManagedEVPPKey key,
-      const PrivateKeyEncodingConfig& config,
+      const ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig& config,
       v8::Local<v8::Value>* out);
 
- private:
-  size_t size_of_private_key() const;
-  size_t size_of_public_key() const;
-
-  EVPKeyPointer pkey_;
-  std::shared_ptr<Mutex> mutex_;
-};
-
-// Objects of this class can safely be shared among threads.
-class KeyObjectData : public MemoryRetainer {
- public:
-  static std::shared_ptr<KeyObjectData> CreateSecret(ByteSource key);
-
-  static std::shared_ptr<KeyObjectData> CreateAsymmetric(
-      KeyType type,
-      const ManagedEVPPKey& pkey);
-
-  KeyType GetKeyType() const;
-
-  // These functions allow unprotected access to the raw key material and should
-  // only be used to implement cryptographic operations requiring the key.
-  ManagedEVPPKey GetAsymmetricKey() const;
-  const char* GetSymmetricKey() const;
-  size_t GetSymmetricKeySize() const;
+  inline KeyObjectData addRef() const {
+    return KeyObjectData(key_type_, mutex_, data_);
+  }
 
-  void MemoryInfo(MemoryTracker* tracker) const override;
-  SET_MEMORY_INFO_NAME(KeyObjectData)
-  SET_SELF_SIZE(KeyObjectData)
+  inline KeyObjectData addRefWithType(KeyType type) const {
+    return KeyObjectData(type, mutex_, data_);
+  }
 
  private:
   explicit KeyObjectData(ByteSource symmetric_key);
+  explicit KeyObjectData(KeyType type, ncrypto::EVPKeyPointer&& pkey);
+
+  static KeyObjectData GetParsedKey(KeyType type,
+                                    Environment* env,
+                                    ncrypto::EVPKeyPointer&& pkey,
+                                    ParseKeyResult ret,
+                                    const char* default_msg);
+
+  KeyType key_type_;
+  mutable std::shared_ptr<Mutex> mutex_;
+
+  struct Data {
+    const ByteSource symmetric_key;
+    const ncrypto::EVPKeyPointer asymmetric_key;
+    explicit Data(ByteSource symmetric_key)
+        : symmetric_key(std::move(symmetric_key)) {}
+    explicit Data(ncrypto::EVPKeyPointer asymmetric_key)
+        : asymmetric_key(std::move(asymmetric_key)) {}
+  };
+  std::shared_ptr<Data> data_;
 
-  KeyObjectData(
-      KeyType type,
-      const ManagedEVPPKey& pkey);
-
-  const KeyType key_type_;
-  const ByteSource symmetric_key_;
-  const unsigned int symmetric_key_len_;
-  const ManagedEVPPKey asymmetric_key_;
+  KeyObjectData(KeyType type,
+                std::shared_ptr<Mutex> mutex,
+                std::shared_ptr<Data> data)
+      : key_type_(type), mutex_(std::move(mutex)), data_(std::move(data)) {}
 };
 
 class KeyObjectHandle : public BaseObject {
  public:
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
   static v8::Local<v8::Function> Initialize(Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   static v8::MaybeLocal<v8::Object> Create(Environment* env,
-                                           std::shared_ptr<KeyObjectData> data);
+                                           const KeyObjectData& data);
 
   // TODO(tniessen): track the memory used by OpenSSL types
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(KeyObjectHandle)
   SET_SELF_SIZE(KeyObjectHandle)
 
-  const std::shared_ptr<KeyObjectData>& Data();
+  const KeyObjectData& Data();
 
  protected:
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -188,6 +154,7 @@ class KeyObjectHandle : public BaseObject {
   static void InitEDRaw(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void InitJWK(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetKeyDetail(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Equals(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void ExportJWK(const v8::FunctionCallbackInfo<v8::Value>& args);
 
@@ -195,27 +162,37 @@ class KeyObjectHandle : public BaseObject {
       const v8::FunctionCallbackInfo<v8::Value>& args);
   v8::Local<v8::Value> GetAsymmetricKeyType() const;
 
+  static void CheckEcKeyData(const v8::FunctionCallbackInfo<v8::Value>& args);
+  bool CheckEcKeyData() const;
+
   static void GetSymmetricKeySize(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void Export(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+#if OPENSSL_WITH_PQC
+  static void InitPqcRaw(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RawPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void RawSeed(const v8::FunctionCallbackInfo<v8::Value>& args);
+#endif
+
   v8::MaybeLocal<v8::Value> ExportSecretKey() const;
   v8::MaybeLocal<v8::Value> ExportPublicKey(
-      const PublicKeyEncodingConfig& config) const;
+      const ncrypto::EVPKeyPointer::PublicKeyEncodingConfig& config) const;
   v8::MaybeLocal<v8::Value> ExportPrivateKey(
-      const PrivateKeyEncodingConfig& config) const;
+      const ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig& config) const;
 
   KeyObjectHandle(Environment* env,
                   v8::Local<v8::Object> wrap);
 
  private:
-  std::shared_ptr<KeyObjectData> data_;
+  KeyObjectData data_;
 };
 
 class NativeKeyObject : public BaseObject {
  public:
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateNativeKeyObjectClass(
@@ -227,8 +204,8 @@ class NativeKeyObject : public BaseObject {
 
   class KeyObjectTransferData : public worker::TransferData {
    public:
-    explicit KeyObjectTransferData(const std::shared_ptr<KeyObjectData>& data)
-        : data_(data) {}
+    explicit KeyObjectTransferData(const KeyObjectData& data)
+        : data_(data.addRef()) {}
 
     BaseObjectPtr<BaseObject> Deserialize(
         Environment* env,
@@ -240,7 +217,7 @@ class NativeKeyObject : public BaseObject {
     SET_NO_MEMORY_INFO()
 
    private:
-    std::shared_ptr<KeyObjectData> data_;
+    KeyObjectData data_;
   };
 
   BaseObject::TransferMode GetTransferMode() const override;
@@ -249,13 +226,12 @@ class NativeKeyObject : public BaseObject {
  private:
   NativeKeyObject(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const std::shared_ptr<KeyObjectData>& handle_data)
-    : BaseObject(env, wrap),
-      handle_data_(handle_data) {
+                  const KeyObjectData& handle_data)
+      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
     MakeWeak();
   }
 
-  std::shared_ptr<KeyObjectData> handle_data_;
+  KeyObjectData handle_data_;
 };
 
 enum WebCryptoKeyFormat {
@@ -316,20 +292,22 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
     CryptoJob<KeyExportTraits>::Initialize(New, env, target);
   }
 
-  KeyExportJob(
-      Environment* env,
-      v8::Local<v8::Object> object,
-      CryptoJobMode mode,
-      std::shared_ptr<KeyObjectData> key,
-      WebCryptoKeyFormat format,
-      AdditionalParams&& params)
-      : CryptoJob<KeyExportTraits>(
-            env,
-            object,
-            AsyncWrap::PROVIDER_KEYEXPORTREQUEST,
-            mode,
-            std::move(params)),
-        key_(key),
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+    CryptoJob<KeyExportTraits>::RegisterExternalReferences(New, registry);
+  }
+
+  KeyExportJob(Environment* env,
+               v8::Local<v8::Object> object,
+               CryptoJobMode mode,
+               const KeyObjectData& key,
+               WebCryptoKeyFormat format,
+               AdditionalParams&& params)
+      : CryptoJob<KeyExportTraits>(env,
+                                   object,
+                                   AsyncWrap::PROVIDER_KEYEXPORTREQUEST,
+                                   mode,
+                                   std::move(params)),
+        key_(key.addRef()),
         format_(format) {}
 
   WebCryptoKeyFormat format() const { return format_; }
@@ -362,23 +340,28 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
     }
   }
 
-  v8::Maybe<bool> ToResult(
-      v8::Local<v8::Value>* err,
-      v8::Local<v8::Value>* result) override {
+  v8::Maybe<void> ToResult(v8::Local<v8::Value>* err,
+                           v8::Local<v8::Value>* result) override {
     Environment* env = AsyncWrap::env();
     CryptoErrorStore* errors = CryptoJob<KeyExportTraits>::errors();
     if (out_.size() > 0) {
       CHECK(errors->Empty());
       *err = v8::Undefined(env->isolate());
       *result = out_.ToArrayBuffer(env);
-      return v8::Just(!result->IsEmpty());
+      if (result->IsEmpty()) {
+        return v8::Nothing<void>();
+      }
+    } else {
+      if (errors->Empty()) errors->Capture();
+      CHECK(!errors->Empty());
+      *result = v8::Undefined(env->isolate());
+      if (!errors->ToException(env).ToLocal(err)) {
+        return v8::Nothing<void>();
+      }
     }
-
-    if (errors->Empty())
-      errors->Capture();
-    CHECK(!errors->Empty());
-    *result = v8::Undefined(env->isolate());
-    return v8::Just(errors->ToException(env).ToLocal(err));
+    CHECK(!result->IsEmpty());
+    CHECK(!err->IsEmpty());
+    return v8::JustVoid();
   }
 
   SET_SELF_SIZE(KeyExportJob)
@@ -388,25 +371,22 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
   }
 
  private:
-  std::shared_ptr<KeyObjectData> key_;
+  KeyObjectData key_;
   WebCryptoKeyFormat format_;
   ByteSource out_;
 };
 
-WebCryptoKeyExportStatus PKEY_SPKI_Export(
-    KeyObjectData* key_data,
-    ByteSource* out);
+WebCryptoKeyExportStatus PKEY_SPKI_Export(const KeyObjectData& key_data,
+                                          ByteSource* out);
 
-WebCryptoKeyExportStatus PKEY_PKCS8_Export(
-    KeyObjectData* key_data,
-    ByteSource* out);
+WebCryptoKeyExportStatus PKEY_PKCS8_Export(const KeyObjectData& key_data,
+                                           ByteSource* out);
 
 namespace Keys {
 void Initialize(Environment* env, v8::Local<v8::Object> target);
+void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 }  // namespace Keys
-
-}  // namespace crypto
-}  // namespace node
+}  // namespace node::crypto
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 #endif  // SRC_CRYPTO_CRYPTO_KEYS_H_