visaljs 0.0.0-stage → 0.0.2

package/runtime/src/crypto_internal.h

@@ -0,0 +1,304 @@
+/* crypto_internal.h — the crypto primitives (ADR 0018), runtime-private: what Web Crypto (the
+ * crypto component) and node:crypto's host primitives share. BearSSL is reached only through
+ * the crypto*.c files, behind these. */
+#ifndef JS_CRYPTO_INTERNAL_H
+#define JS_CRYPTO_INTERNAL_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "bearssl.h"
+#include "js_object.h"
+
+/* ---- Hashes ---------------------------------------------------------------------------------- */
+
+typedef enum JSHashKind {
+    JS_HASH_BEARSSL,  /* a BearSSL hash class */
+    JS_HASH_SHA512T,  /* SHA-512/t: SHA-512 with its own IV, truncated */
+    JS_HASH_KECCAK,   /* SHA-3 and SHAKE (crypto_hash.c's Keccak) */
+} JSHashKind;
+
+typedef struct JSHashAlg {
+    const char          *name;       /* Node's canonical name: "sha256" */
+    const char          *web;        /* Web Crypto's: "SHA-256", or NULL */
+    uint8_t              kind;       /* JSHashKind */
+    bool                 xof;        /* SHAKE: any output length */
+    uint16_t             out_len;    /* digest bytes (SHAKE: the default output length) */
+    uint16_t             block_len;  /* HMAC's block (Keccak: the rate) */
+    const br_hash_class *br;         /* JS_HASH_BEARSSL */
+    const uint64_t      *iv;         /* JS_HASH_SHA512T */
+    uint8_t              suffix;     /* JS_HASH_KECCAK: 0x06 SHA-3, 0x1F SHAKE */
+    /* the DER of its AlgorithmIdentifier's OID (PKCS#1 v1.5 signatures), or NULL */
+    const unsigned char *oid;
+} JSHashAlg;
+
+typedef struct JSKeccak {
+    uint64_t a[25];
+    uint32_t rate, pos;  /* bytes per block; bytes absorbed into this one (or squeezed) */
+    bool     squeezing;
+} JSKeccak;
+
+typedef struct JSHashCtx {
+    const JSHashAlg *alg;
+    union {
+        br_hash_compat_context br;
+        JSKeccak               keccak;
+    } u;
+} JSHashCtx;
+
+/* By Node's (OpenSSL's) name or alias, case-insensitive: "sha256", "SHA-256", "RSA-SHA256", … */
+const JSHashAlg *js_hash_by_name(const char *name);
+/* By Web Crypto's name, case-insensitive: "SHA-1", "SHA-256", "SHA-384", "SHA-512". */
+const JSHashAlg *js_hash_by_web_name(const char *name);
+/* Node's crypto.getHashes(), sorted as Node sorts them. */
+extern const char *const js_hash_names[];
+extern const size_t js_hash_names_count;
+
+void js_hash_init(JSHashCtx *h, const JSHashAlg *alg);
+void js_hash_update(JSHashCtx *h, const void *data, size_t n);
+/* The digest (n bytes; SHAKE: any n, else at most out_len). Leaves h unusable but for copies made before. */
+void js_hash_final(JSHashCtx *h, uint8_t *out, size_t n);
+/* One call: the digest of data, alg->out_len bytes. */
+void js_hash_once(const JSHashAlg *alg, const void *data, size_t n, uint8_t *out);
+
+/* ---- HMAC ------------------------------------------------------------------------------------- */
+
+typedef struct JSHmacCtx {
+    JSHashCtx inner, outer;
+} JSHmacCtx;
+
+/* Any hash but the XOFs. */
+void js_hmac_init(JSHmacCtx *m, const JSHashAlg *alg, const uint8_t *key, size_t key_len);
+void js_hmac_update(JSHmacCtx *m, const void *data, size_t n);
+/* alg->out_len bytes. */
+void js_hmac_final(JSHmacCtx *m, uint8_t *out);
+
+/* ---- Key derivation (crypto_kdf.c) ------------------------------------------------------------ */
+
+/* PBKDF2-HMAC: false for an XOF or no iterations. */
+bool js_pbkdf2(const JSHashAlg *alg, const uint8_t *pw, size_t pw_len, const uint8_t *salt, size_t salt_len,
+               uint32_t iterations, uint8_t *out, size_t n);
+/* HKDF: false for an XOF or more than 255 blocks. An empty salt is the hash's length of zeros. */
+bool js_hkdf(const JSHashAlg *alg, const uint8_t *ikm, size_t ikm_len, const uint8_t *salt, size_t salt_len,
+             const uint8_t *info, size_t info_len, uint8_t *out, size_t n);
+/* scrypt's parameters as OpenSSL checks them: 0, or why not. */
+enum { JS_SCRYPT_INVALID = 1, JS_SCRYPT_MEMORY = 2 };
+int js_scrypt_check(uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem);
+/* scrypt with checked parameters: false when its memory can't be allocated. */
+bool js_scrypt(const uint8_t *pw, size_t pw_len, const uint8_t *salt, size_t salt_len, uint64_t N, uint32_t r,
+               uint32_t p, uint8_t *out, size_t n);
+
+/* ---- Ciphers (crypto_cipher.c) ---------------------------------------------------------------- */
+
+typedef enum JSCipherMode {
+    JS_CIPHER_ECB, JS_CIPHER_CBC, JS_CIPHER_CFB, JS_CIPHER_CFB1, JS_CIPHER_CFB8, JS_CIPHER_OFB, JS_CIPHER_CTR, JS_CIPHER_GCM,
+    JS_CIPHER_CCM, JS_CIPHER_WRAP, JS_CIPHER_WRAP_PAD, JS_CIPHER_CHACHA20, JS_CIPHER_CHACHA20_POLY1305,
+} JSCipherMode;
+
+typedef struct JSCipherAlg {
+    const char *name;       /* as getCiphers lists it */
+    const char *info_name;  /* getCipherInfo's name (OpenSSL's canonical one) */
+    const char *mode_name;  /* getCipherInfo's mode */
+    uint16_t    nid;
+    uint8_t     mode;       /* JSCipherMode */
+    uint8_t     prim;       /* 0 AES, 1 DES-EDE, 2 ChaCha20 */
+    uint8_t     key_len;
+    uint8_t     iv_len;     /* the default (AEAD) or only length; 0 for none */
+    uint8_t     block_size; /* getCipherInfo's blockSize; 0 for none */
+} JSCipherAlg;
+
+extern const size_t js_cipher_count;
+const JSCipherAlg *js_cipher_at(size_t i);
+/* By a name getCiphers lists, or getCipherInfo's, case-insensitive. */
+const JSCipherAlg *js_cipher_by_name(const char *name);
+const JSCipherAlg *js_cipher_by_nid(int nid);
+/* The AES cipher of a mode and key length (Web Crypto's), or NULL. */
+const JSCipherAlg *js_cipher_aes(uint8_t mode, size_t key_len);
+
+/* A growing byte buffer (malloc'd; the owner frees p). */
+typedef struct JSBytesOut {
+    uint8_t *p;
+    size_t   n, cap;
+} JSBytesOut;
+
+enum { JS_CIPHER_INIT, JS_CIPHER_UPDATED, JS_CIPHER_FINAL };
+
+/* Why an operation failed (each is one of Node's errors) */
+enum {
+    JS_CIPHER_ERR_KEYLEN = 1, JS_CIPHER_ERR_IV, JS_CIPHER_ERR_TAG_REQUIRED, JS_CIPHER_ERR_TAG_LENGTH, JS_CIPHER_ERR_STATE,
+    JS_CIPHER_ERR_FINALIZED, JS_CIPHER_ERR_FINAL_BLOCK, JS_CIPHER_ERR_BAD_DECRYPT, JS_CIPHER_ERR_AUTH, JS_CIPHER_ERR_TAG_NOT_SET,
+    JS_CIPHER_ERR_MESSAGE_LENGTH, JS_CIPHER_ERR_PLAINTEXT_LENGTH,
+};
+
+typedef struct JSCipherCtx {
+    const JSCipherAlg *alg;
+    bool     encrypt, padding;
+    uint8_t  state;            /* JS_CIPHER_INIT, … */
+    uint8_t  blk;              /* the block cipher's block: 16, or 8 for DES */
+    union { const br_block_cbcenc_class *vtable; br_aes_gen_cbcenc_keys aes; br_des_gen_cbcenc_keys des; } enc;
+    union { const br_block_cbcdec_class *vtable; br_aes_gen_cbcdec_keys aes; br_des_gen_cbcdec_keys des; } dec;
+    br_aes_gen_ctr_keys    ctr;     /* GCM's */
+    br_aes_gen_ctrcbc_keys ctrcbc;  /* CCM's */
+    br_gcm_context gcm;
+    br_ccm_context ccm;
+    uint8_t  key[32];          /* ChaCha20's */
+    uint8_t  iv[16];           /* the chaining value, counter or feedback register; key wrap's IV */
+    uint8_t  nonce[16];        /* CCM's and ChaCha20's */
+    size_t   nonce_len;
+    uint8_t  buf[16];          /* ECB and CBC: input waiting for a whole block */
+    size_t   buf_len;
+    uint8_t  ks[64];           /* keystream not used yet */
+    size_t   ks_pos;
+    uint32_t counter;          /* ChaCha20's block counter */
+    uint8_t  tag[16];
+    size_t   tag_len, given_tag_len;
+    bool     tag_len_given, tag_set, tag_ready, ccm_length_set, auth_failed;
+    size_t   ccm_length;
+    JSBytesOut aad, data;      /* CCM's AAD, ChaCha20-Poly1305's AAD and ciphertext */
+} JSCipherCtx;
+
+/* tag_len: the authTagLength option, -1 for none. 0, or a JS_CIPHER_ERR_*. */
+int js_cipher_init(JSCipherCtx *c, const JSCipherAlg *alg, bool encrypt, const uint8_t *key, size_t key_len, const uint8_t *iv,
+                   size_t iv_len, bool has_iv, long tag_len);
+void js_cipher_free(JSCipherCtx *c);
+int js_cipher_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out);
+int js_cipher_final(JSCipherCtx *c, JSBytesOut *out);
+/* plaintext_length: CCM's, -1 for none. */
+int js_cipher_set_aad(JSCipherCtx *c, const uint8_t *p, size_t n, long plaintext_length);
+int js_cipher_set_auth_tag(JSCipherCtx *c, const uint8_t *p, size_t n);
+bool js_cipher_get_auth_tag(JSCipherCtx *c, const uint8_t **p, size_t *n);
+bool js_cipher_set_padding(JSCipherCtx *c, bool padding);
+/* Web Crypto's AES-CTR: `bits` counter bits, the rest of the block fixed. False when it would repeat. */
+bool js_aes_ctr_masked(const uint8_t *key, size_t key_len, const uint8_t counter[16], unsigned bits, const uint8_t *in, size_t n,
+                       uint8_t *out);
+
+/* ---- Random bytes ------------------------------------------------------------------------------ */
+
+/* Cryptographically secure: an HMAC_DRBG (SHA-256) seeded from the system's entropy. */
+void js_crypto_random(void *out, size_t n);
+
+/* Constant time over n bytes: whether they're equal. */
+bool js_crypto_equal(const uint8_t *a, const uint8_t *b, size_t n);
+
+/* ---- Keys (crypto_key.c) ------------------------------------------------------------------------ */
+
+typedef enum JSKeyType { JS_KEY_SECRET, JS_KEY_PUBLIC, JS_KEY_PRIVATE } JSKeyType;
+
+typedef enum JSAsymKind { JS_ASYM_NONE, JS_ASYM_RSA, JS_ASYM_RSA_PSS, JS_ASYM_EC, JS_ASYM_X25519 } JSAsymKind;
+
+/* The parts of an asymmetric key, by index: RSA's integers (big-endian, minimal), an EC or X25519
+ * key's public point (uncompressed for EC) and private scalar. */
+enum { JS_RSA_N, JS_RSA_E, JS_RSA_D, JS_RSA_P, JS_RSA_Q, JS_RSA_DP, JS_RSA_DQ, JS_RSA_QI, JS_KEY_PARTS };
+enum { JS_EC_PUB, JS_EC_PRIV };
+
+typedef struct JSKeyPart {
+    uint8_t *p;
+    size_t   n;
+} JSKeyPart;
+
+/* Key material: a handle that CryptoKey and node:crypto's KeyObject share. Every buffer is
+ * malloc'd and wiped when the handle is collected. */
+typedef struct JSKeyData {
+    JSObject  obj;
+    uint8_t   type;     /* JSKeyType */
+    uint8_t   kind;     /* JSAsymKind; NONE for a secret key */
+    uint8_t  *bytes;    /* a secret key's */
+    size_t    len;
+    JSKeyPart part[JS_KEY_PARTS];
+    int       curve;    /* EC and X25519: BR_EC_* */
+    /* RSA-PSS keys restricted to parameters (their AlgorithmIdentifier has them) */
+    bool             pss_params;
+    const JSHashAlg *pss_hash, *pss_mgf1;
+    uint32_t         pss_salt;
+} JSKeyData;
+
+JSKeyData *js_key_data(JSValue v);
+/* A secret key holding a copy of the bytes. */
+JSValue js_new_secret_key(JSContext *ctx, const uint8_t *p, size_t n);
+/* An empty asymmetric key of a type and kind, for crypto_pkey.c to fill. */
+JSKeyData *js_new_asym_key(JSContext *ctx, uint8_t type, uint8_t kind);
+void js_key_part_set(JSKeyPart *part, const uint8_t *p, size_t n);
+/* The key encodings (the node:crypto primitives' codes too), and DER in and out (crypto_pkey.c):
+ * 0, or an error code (1 not decodable, 2 bad DER, 3 a key type not provided, 4 an encoding
+ * the key can't have). */
+enum { JS_KEY_ENC_SPKI, JS_KEY_ENC_PKCS1, JS_KEY_ENC_PKCS8, JS_KEY_ENC_SEC1, JS_KEY_ENC_CERT };
+int js_key_parse_der(JSContext *ctx, const uint8_t *p, size_t n, int enc, bool priv, JSValue *out);
+int js_key_export_der(const JSKeyData *k, int enc, JSBytesOut *o);
+/* A key from its parts (RSA's integers; EC's uncompressed point and scalar; X25519's): only the
+ * public ones when !priv; an EC curve as BR_EC_*. */
+int js_key_from_parts(JSContext *ctx, int kind, bool priv, int curve, const JSKeyPart parts[JS_KEY_PARTS], JSValue *out);
+int js_ec_curve_by_jwk(const char *crv);
+/* The public key of a private one (a new handle). */
+JSValue js_key_public(JSContext *ctx, JSValue private_key);
+/* New private keys: 0, or an error code (5: parameters BearSSL rejects). */
+int js_key_generate_rsa(JSContext *ctx, bool pss, uint32_t bits, uint32_t e, JSValue *out);
+int js_key_generate_ec(JSContext *ctx, int curve, JSValue *out);
+const char *js_ec_curve_jwk(int curve);
+/* An EC or X25519 private scalar in BearSSL's byte order (out: the scalar's length). */
+void js_ec_scalar_for_bearssl(const JSKeyData *k, uint8_t *out);
+/* A cryptographically secure PRNG for BearSSL's key generation (crypto_hash.c's DRBG). */
+const br_prng_class **js_crypto_prng(void);
+
+/* Web Crypto's key algorithms */
+typedef enum JSWebAlg {
+    JS_WEB_HMAC = 1, JS_WEB_PBKDF2, JS_WEB_HKDF, JS_WEB_AES_CTR, JS_WEB_AES_CBC, JS_WEB_AES_GCM, JS_WEB_AES_KW,
+    JS_WEB_RSASSA, JS_WEB_RSA_PSS, JS_WEB_RSA_OAEP, JS_WEB_ECDSA, JS_WEB_ECDH, JS_WEB_X25519,
+} JSWebAlg;
+
+/* KeyUsage, as bits in this order */
+enum {
+    JS_USAGE_ENCRYPT = 1 << 0, JS_USAGE_DECRYPT = 1 << 1, JS_USAGE_SIGN = 1 << 2, JS_USAGE_VERIFY = 1 << 3,
+    JS_USAGE_DERIVE_KEY = 1 << 4, JS_USAGE_DERIVE_BITS = 1 << 5, JS_USAGE_WRAP_KEY = 1 << 6, JS_USAGE_UNWRAP_KEY = 1 << 7,
+};
+
+typedef struct JSCryptoKey {
+    JSObject         obj;
+    JSValue          data;         /* a JSKeyData */
+    JSValue          algorithm;    /* what `algorithm` returns (the same object each time) */
+    JSValue          usages;       /* what `usages` returns: an array of strings */
+    uint16_t         usage_mask;   /* JS_USAGE_* */
+    uint8_t          alg;          /* JSWebAlg */
+    bool             extractable;
+    const JSHashAlg *hash;         /* HMAC's and RSA's */
+    uint32_t         length;       /* HMAC's and AES's, in bits; RSA's modulus length */
+} JSCryptoKey;
+
+JSCryptoKey *js_as_crypto_key(JSValue v);
+JSValue js_new_crypto_key(JSContext *ctx, JSValue data, uint8_t alg, const JSHashAlg *hash, uint32_t length, JSValue algorithm,
+                          JSValue usages, uint16_t mask, bool extractable);
+
+/* ---- Asymmetric operations (crypto_asym.c) ------------------------------------------------------ */
+
+/* RSA paddings and PSS salt lengths: Node's (OpenSSL's) constants */
+enum { JS_PADDING_PKCS1 = 1, JS_PADDING_NONE = 3, JS_PADDING_OAEP = 4, JS_PADDING_PSS = 6 };
+enum { JS_SALT_DIGEST = -1, JS_SALT_MAX = -2, JS_SALT_AUTO = -2 };  /* -2: the most when signing, any when verifying */
+enum { JS_RSA_PUBLIC_ENCRYPT, JS_RSA_PRIVATE_DECRYPT, JS_RSA_PRIVATE_ENCRYPT, JS_RSA_PUBLIC_DECRYPT };
+/* why an operation failed (each one of Node's errors) */
+enum {
+    JS_ASYM_ERR_KEY_TYPE = 1, JS_ASYM_ERR_DIGEST, JS_ASYM_ERR_FAILED, JS_ASYM_ERR_SALT, JS_ASYM_ERR_TOO_LARGE, JS_ASYM_ERR_TOO_SMALL,
+    JS_ASYM_ERR_OAEP, JS_ASYM_ERR_PADDING, JS_ASYM_ERR_POINT, JS_ASYM_ERR_CURVE,
+};
+
+/* A signature of a digest (alg->out_len bytes) into out (malloc'd). 0, or an error. */
+int js_asym_sign(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
+                 JSBytesOut *out);
+int js_asym_verify(const JSKeyData *k, const JSHashAlg *h, const uint8_t *digest, int padding, long salt_len, bool p1363,
+                   const uint8_t *sig, size_t sig_len, bool *valid);
+int js_rsa_crypt(const JSKeyData *k, int op, int padding, const JSHashAlg *oaep_hash, const uint8_t *label, size_t label_len,
+                 const uint8_t *in, size_t n, JSBytesOut *out);
+/* The shared secret of a private key and a peer's point (any encoding for EC). */
+int js_ecdh(const JSKeyData *k, const uint8_t *peer, size_t peer_len, uint8_t *secret, size_t *secret_len);
+int js_ec_curve_by_name(const char *name);
+size_t js_ec_field_size(int curve);
+bool js_ec_point_uncompressed(int curve, const uint8_t *in, size_t n, uint8_t *out);
+size_t js_ec_point_format(int curve, const uint8_t *point, int format, uint8_t *out);
+
+/* subtle.importKey's steps, without the promise: a CryptoKey, or JS_EXCEPTION. */
+JSValue js_crypto_import_key_steps(JSContext *ctx, uint32_t argc, const JSValue *argv);
+
+/* The crypto component's parts, installed by crypto.c */
+void js_crypto_install_key(JSContext *ctx, JSObject *global);
+void js_crypto_install_subtle(JSContext *ctx, JSObject *global);
+
+#endif /* JS_CRYPTO_INTERNAL_H */

package/runtime/src/crypto_kdf.c

@@ -0,0 +1,143 @@
+/* The crypto primitives' key derivation (ADR 0018): PBKDF2 (RFC 8018) and HKDF (RFC 5869) over
+ * crypto_hash.c's HMAC, so any of its hashes works; scrypt (RFC 7914) with its Salsa20/8 core. */
+#include <stdlib.h>
+#include <string.h>
+
+#include "crypto_internal.h"
+
+/* ---- PBKDF2 ------------------------------------------------------------------------------------ */
+
+bool js_pbkdf2(const JSHashAlg *alg, const uint8_t *pw, size_t pw_len, const uint8_t *salt, size_t salt_len,
+               uint32_t iterations, uint8_t *out, size_t n) {
+    if (alg->xof || iterations == 0) return false;
+    JSHmacCtx keyed;  /* the password's inner and outer states, copied for each HMAC */
+    js_hmac_init(&keyed, alg, pw, pw_len);
+    size_t hlen = alg->out_len;
+    for (uint32_t block = 1; n > 0; block++) {
+        uint8_t u[64], t[64], be[4] = { (uint8_t)(block >> 24), (uint8_t)(block >> 16), (uint8_t)(block >> 8), (uint8_t)block };
+        JSHmacCtx m = keyed;
+        js_hmac_update(&m, salt, salt_len);
+        js_hmac_update(&m, be, 4);
+        js_hmac_final(&m, u);
+        memcpy(t, u, hlen);
+        for (uint32_t i = 1; i < iterations; i++) {
+            m = keyed;
+            js_hmac_update(&m, u, hlen);
+            js_hmac_final(&m, u);
+            for (size_t j = 0; j < hlen; j++) t[j] ^= u[j];
+        }
+        size_t take = n < hlen ? n : hlen;
+        memcpy(out, t, take);
+        out += take;
+        n -= take;
+    }
+    return true;
+}
+
+/* ---- HKDF -------------------------------------------------------------------------------------- */
+
+bool js_hkdf(const JSHashAlg *alg, const uint8_t *ikm, size_t ikm_len, const uint8_t *salt, size_t salt_len,
+             const uint8_t *info, size_t info_len, uint8_t *out, size_t n) {
+    size_t hlen = alg->out_len;
+    if (alg->xof || n > 255 * hlen) return false;
+    uint8_t zeros[64] = { 0 }, prk[64], t[64];
+    JSHmacCtx m;
+    js_hmac_init(&m, alg, salt_len ? salt : zeros, salt_len ? salt_len : hlen);  /* extract */
+    js_hmac_update(&m, ikm, ikm_len);
+    js_hmac_final(&m, prk);
+    size_t t_len = 0;
+    for (uint8_t i = 1; n > 0; i++) {  /* expand */
+        js_hmac_init(&m, alg, prk, hlen);
+        js_hmac_update(&m, t, t_len);
+        js_hmac_update(&m, info, info_len);
+        js_hmac_update(&m, &i, 1);
+        js_hmac_final(&m, t);
+        t_len = hlen;
+        size_t take = n < hlen ? n : hlen;
+        memcpy(out, t, take);
+        out += take;
+        n -= take;
+    }
+    return true;
+}
+
+/* ---- scrypt ------------------------------------------------------------------------------------ */
+
+static inline uint32_t rotl32(uint32_t x, unsigned n) { return (x << n) | (x >> (32 - n)); }
+
+static void salsa20_8(uint32_t b[16]) {
+    uint32_t x[16];
+    memcpy(x, b, sizeof x);
+    for (int i = 0; i < 8; i += 2) {
+#define QR(a, b, c, d) \
+    x[b] ^= rotl32(x[a] + x[d], 7), x[c] ^= rotl32(x[b] + x[a], 9), x[d] ^= rotl32(x[c] + x[b], 13), x[a] ^= rotl32(x[d] + x[c], 18)
+        QR(0, 4, 8, 12); QR(5, 9, 13, 1); QR(10, 14, 2, 6); QR(15, 3, 7, 11);    /* columns */
+        QR(0, 1, 2, 3); QR(5, 6, 7, 4); QR(10, 11, 8, 9); QR(15, 12, 13, 14);   /* rows */
+#undef QR
+    }
+    for (int i = 0; i < 16; i++) b[i] += x[i];
+}
+
+/* BlockMix (RFC 7914 §4): b is 2r 64-byte blocks, y scratch of the same size. */
+static void block_mix(uint32_t *b, uint32_t *y, uint32_t r) {
+    uint32_t x[16];
+    memcpy(x, &b[(2 * r - 1) * 16], 64);
+    for (uint32_t i = 0; i < 2 * r; i++) {
+        for (int j = 0; j < 16; j++) x[j] ^= b[i * 16 + j];
+        salsa20_8(x);
+        /* even blocks to the first half, odd to the second */
+        memcpy(&y[((i & 1) * r + i / 2) * 16], x, 64);
+    }
+    memcpy(b, y, 128 * (size_t)r);
+}
+
+static void romix(uint8_t *block, uint32_t r, uint64_t N, uint32_t *v, uint32_t *x, uint32_t *y) {
+    size_t words = 32 * (size_t)r;
+    for (size_t i = 0; i < words; i++) {
+        const uint8_t *p = block + 4 * i;
+        x[i] = (uint32_t)p[0] | (uint32_t)p[1] << 8 | (uint32_t)p[2] << 16 | (uint32_t)p[3] << 24;
+    }
+    for (uint64_t i = 0; i < N; i++) {
+        memcpy(&v[i * words], x, 4 * words);
+        block_mix(x, y, r);
+    }
+    for (uint64_t i = 0; i < N; i++) {
+        uint64_t j = x[(2 * r - 1) * 16] & (N - 1);
+        for (size_t k = 0; k < words; k++) x[k] ^= v[j * words + k];
+        block_mix(x, y, r);
+    }
+    for (size_t i = 0; i < words; i++) {
+        uint8_t *p = block + 4 * i;
+        p[0] = (uint8_t)x[i], p[1] = (uint8_t)(x[i] >> 8), p[2] = (uint8_t)(x[i] >> 16), p[3] = (uint8_t)(x[i] >> 24);
+    }
+}
+
+int js_scrypt_check(uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem) {
+    /* OpenSSL's checks (EVP_PBE_scrypt_ex), so the same parameters fail */
+    if (r == 0 || p == 0 || N < 2 || (N & (N - 1))) return JS_SCRYPT_INVALID;
+    /* OpenSSL reports these as its memory limit too */
+    if (p > ((1ULL << 30) - 1) / r) return JS_SCRYPT_MEMORY;
+    if (16 * r <= 63 && N >= (1ULL << (16 * r))) return JS_SCRYPT_MEMORY;
+    uint64_t blen = p * 128 * r;
+    if (N + 2 > UINT64_MAX / (32 * r * 4)) return JS_SCRYPT_MEMORY;
+    uint64_t vlen = 32 * r * (N + 2) * 4;
+    if (blen > UINT64_MAX - vlen || blen + vlen > maxmem) return JS_SCRYPT_MEMORY;
+    return 0;
+}
+
+bool js_scrypt(const uint8_t *pw, size_t pw_len, const uint8_t *salt, size_t salt_len, uint64_t N, uint32_t r,
+               uint32_t p, uint8_t *out, size_t n) {
+    const JSHashAlg *sha256 = js_hash_by_name("sha256");
+    size_t blen = (size_t)p * 128 * r;
+    uint8_t *b = malloc(blen);
+    uint32_t *v = malloc((size_t)N * 128 * r), *xy = malloc(256 * (size_t)r);
+    if (!b || !v || !xy) {
+        free(b), free(v), free(xy);
+        return false;
+    }
+    js_pbkdf2(sha256, pw, pw_len, salt, salt_len, 1, b, blen);
+    for (uint32_t i = 0; i < p; i++) romix(b + (size_t)i * 128 * r, r, N, v, xy, xy + 32 * r);
+    js_pbkdf2(sha256, pw, pw_len, b, blen, 1, out, n);
+    free(b), free(v), free(xy);
+    return true;
+}

package/runtime/src/crypto_key.c

@@ -0,0 +1,171 @@
+/* Keys (ADR 0018): the key material, a C record both Web Crypto's CryptoKey and node:crypto's
+ * KeyObject hold (so converting between them shares it), and CryptoKey itself: Node's class,
+ * its attributes (type, extractable, algorithm, usages: the same objects on every read) and
+ * its inspection. */
+#include <stdlib.h>
+#include <string.h>
+
+#include "builtins_util.h"
+#include "crypto_internal.h"
+#include "internal.h"
+#include "js_atoms.h"
+#include "js_exception.h"
+#include "js_web.h"
+#include "jscontext.h"
+#include "jsstring.h"
+
+/* ---- Key material ------------------------------------------------------------------------------ */
+
+static void wipe(uint8_t *p, size_t n) {
+    if (!p) return;
+    memset(p, 0, n);
+    free(p);
+}
+
+static void key_data_finalize(JSRuntime *rt, JSCell *c) {
+    (void)rt;
+    JSKeyData *k = (JSKeyData *)c;
+    wipe(k->bytes, k->len);
+    for (int i = 0; i < JS_KEY_PARTS; i++) wipe(k->part[i].p, k->part[i].n);
+}
+
+static const JSClass key_data_class = { "KeyData", sizeof(JSKeyData), NULL, NULL, NULL, NULL, NULL, key_data_finalize, NULL };
+
+JSKeyData *js_key_data(JSValue v) {
+    return js_is_object(v) && js_as_object(v)->shape->cls == &key_data_class ? (JSKeyData *)js_as_object(v) : NULL;
+}
+
+JSKeyData *js_new_asym_key(JSContext *ctx, uint8_t type, uint8_t kind) {
+    JSKeyData *k = (JSKeyData *)js_alloc_object(ctx, JS_CELL_OBJECT, js_shape_root(ctx, &key_data_class, JS_NULL, 0));
+    k->type = type;
+    k->kind = kind;
+    return k;
+}
+
+void js_key_part_set(JSKeyPart *part, const uint8_t *p, size_t n) {
+    wipe(part->p, part->n);
+    part->p = malloc(n ? n : 1);
+    if (!part->p) js_fatal("out of memory in crypto");
+    if (n) memcpy(part->p, p, n);
+    part->n = n;
+}
+
+JSValue js_new_secret_key(JSContext *ctx, const uint8_t *p, size_t n) {
+    uint8_t *copy = malloc(n ? n : 1);
+    if (!copy) js_fatal("out of memory in crypto");
+    if (n) memcpy(copy, p, n);
+    JSKeyData *k = (JSKeyData *)js_alloc_object(ctx, JS_CELL_OBJECT, js_shape_root(ctx, &key_data_class, JS_NULL, 0));
+    k->type = JS_KEY_SECRET;
+    k->bytes = copy;
+    k->len = n;
+    return js_object_value(&k->obj);
+}
+
+/* ---- CryptoKey --------------------------------------------------------------------------------- */
+
+static void crypto_key_visit(JSCell *c, JSTracer *trc) {
+    JSCryptoKey *k = (JSCryptoKey *)c;
+    js_trace_value(trc, k->data);
+    js_trace_value(trc, k->algorithm);
+    js_trace_value(trc, k->usages);
+}
+
+static const JSClass crypto_key_class = { "CryptoKey", sizeof(JSCryptoKey), NULL, NULL, NULL, NULL, crypto_key_visit, NULL, NULL };
+
+JSCryptoKey *js_as_crypto_key(JSValue v) {
+    return js_is_object(v) && js_as_object(v)->shape->cls == &crypto_key_class ? (JSCryptoKey *)js_as_object(v) : NULL;
+}
+
+JSValue js_new_crypto_key(JSContext *ctx, JSValue data, uint8_t alg, const JSHashAlg *hash, uint32_t length, JSValue algorithm,
+                          JSValue usages, uint16_t mask, bool extractable) {
+    JSCryptoKey *k = (JSCryptoKey *)js_alloc_object(ctx, JS_CELL_OBJECT,
+                                                    js_shape_root(ctx, &crypto_key_class, ctx->intrinsics[JS_INTRINSIC_CRYPTO_KEY_PROTOTYPE], 0));
+    js_init_slot(&k->data, data);
+    js_init_slot(&k->algorithm, algorithm);
+    js_init_slot(&k->usages, usages);
+    k->usage_mask = mask;
+    k->alg = alg;
+    k->hash = hash;
+    k->length = length;
+    k->extractable = extractable;
+    return js_object_value(&k->obj);
+}
+
+static const char *const KEY_TYPES[] = { "secret", "public", "private" };
+
+BUILTIN(crypto_key_ctor) {
+    UNUSED_ARGS;
+    return js_throw_node_error(ctx, JS_TYPE_ERROR, "ERR_ILLEGAL_CONSTRUCTOR", "Illegal constructor");
+}
+
+#define THIS_KEY()                                       \
+    JSCryptoKey *k = js_as_crypto_key(this_val);         \
+    if (!k) return js_throw_invalid_this(ctx, "CryptoKey")
+
+BUILTIN(crypto_key_type) {
+    UNUSED_ARGS;
+    THIS_KEY();
+    return js_new_string_cstr(ctx, KEY_TYPES[js_key_data(k->data)->type]);
+}
+
+BUILTIN(crypto_key_extractable) {
+    UNUSED_ARGS;
+    THIS_KEY();
+    return js_bool(k->extractable);
+}
+
+BUILTIN(crypto_key_algorithm) {
+    UNUSED_ARGS;
+    THIS_KEY();
+    return k->algorithm;
+}
+
+BUILTIN(crypto_key_usages) {
+    UNUSED_ARGS;
+    THIS_KEY();
+    return k->usages;
+}
+
+/* [nodejs.util.inspect.custom](depth, options): CryptoKey { type, extractable, algorithm, usages } */
+BUILTIN(crypto_key_inspect) {
+    (void)callee, (void)new_target;
+    JSCryptoKey *k = js_as_crypto_key(this_val);
+    if (!k) return this_val;
+    JSValue o = js_new_object(ctx);
+    static const char *const names[] = { "type", "extractable", "algorithm", "usages" };
+    JSValue values[4] = { js_new_string_cstr(ctx, KEY_TYPES[js_key_data(k->data)->type]), js_bool(k->extractable), k->algorithm, k->usages };
+    for (int i = 0; i < 4; i++) js_define_data(ctx, js_as_object(o), js_atom_from_cstr(ctx, names[i]), values[i], JS_PROP_DEFAULT);
+    return js_inspect_named(ctx, "CryptoKey", o, ARG(0), ARG(1));
+}
+
+static const JSBuiltin crypto_key_proto[] = {
+    WEBIDL_ATTRIBUTE("type", crypto_key_type, NULL),
+    WEBIDL_ATTRIBUTE("extractable", crypto_key_extractable, NULL),
+    WEBIDL_ATTRIBUTE("algorithm", crypto_key_algorithm, NULL),
+    WEBIDL_ATTRIBUTE("usages", crypto_key_usages, NULL),
+};
+
+void js_crypto_install_key(JSContext *ctx, JSObject *global) {
+    js_define_web_class(ctx, global, "CryptoKey", crypto_key_ctor, 0, ctx->intrinsics[JS_INTRINSIC_OBJECT_PROTOTYPE],
+                        JS_INTRINSIC_CRYPTO_KEY_PROTOTYPE);
+    JSValue kp = ctx->intrinsics[JS_INTRINSIC_CRYPTO_KEY_PROTOTYPE];
+    js_define_builtins(ctx, js_as_object(kp), crypto_key_proto, JS_COUNTOF(crypto_key_proto));
+    js_define_inspect(ctx, kp, crypto_key_inspect, "CryptoKey");
+}
+
+/* ---- KeyObject and CryptoKey (node:crypto's primitives) ----------------------------------------- */
+
+/* cryptoKeyHandleOf(value): a CryptoKey's key handle, or undefined for anything else. */
+JSValue js_crypto_key_handle_of(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
+    (void)ctx, (void)callee, (void)this_val, (void)new_target;
+    JSCryptoKey *k = js_as_crypto_key(ARG(0));
+    return k ? k->data : JS_UNDEFINED;
+}
+
+/* cryptoToCryptoKey(format, keyData, algorithm, extractable, usages): importKey's steps, at once
+ * (keyObject.toCryptoKey is synchronous): a CryptoKey, or the error thrown. */
+JSValue js_crypto_to_crypto_key(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
+    (void)callee, (void)this_val, (void)new_target;
+    JSValue args[5] = { ARG(0), ARG(1), ARG(2), ARG(3), ARG(4) };
+    return js_crypto_import_key_steps(ctx, 5, args);
+}