Throw on truncation in the X25519 and X448 derive bits operation

[javifernandez]

We have been discussing in webcrypto issue 369 about the possibility of throwing an OperationError exception when the ECDH deriveBits operation receives 'length' value that implies truncate the derived key material.

There is a PR 351 to implement that change in the Web Cryptography AP spec and this is a similar change for X25519 and X448.

---

Preview | Diff

[twiss]

Thanks! Yeah, seems reasonable to me.

Since the length of the derived bits is fixed for both algorithms (256 for X25519 and 448 for X448) and doesn't depend on the algorithm's parameters like with ECDH, perhaps we could hoist this step up to be the first step in the algorithm, and just check that length is null or equal to that value?

(Otherwise I can also do so but next week, I'm officially speaking off this week ^.^)

[javifernandez]

Thanks! Yeah, seems reasonable to me.

Since the length of the derived bits is fixed for both algorithms (256 for X25519 and 448 for X448) and doesn't depend on the algorithm's parameters like with ECDH, perhaps we could hoist this step up to be the first step in the algorithm, and just check that length is null or equal to that value?

Yeah, that's precisely how I've implemented it.

[panva]

Please see w3c/webcrypto#351 (comment), this should not land in this state.

[javifernandez]

Please see w3c/webcrypto#351 (comment), this should not land in this state.

The idea is that this PR is dependent on the result of the discussion in issue #351.