fixup! crypto: add raw key formats support to the KeyObject APIs

Author: panva

doc/api/crypto.md

@@ -3785,7 +3785,7 @@ changes:
 
 * `key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView}
   * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|Object} The key
-    material, either in PEM, DER, or JWK format.
+    material, either in PEM, DER, JWK, or raw format.
   * `format` {string} Must be `'pem'`, `'der'`, `'jwk'`, `'raw-private'`,
     or `'raw-seed'`. **Default:** `'pem'`.
   * `type` {string} Must be `'pkcs1'`, `'pkcs8'` or `'sec1'`. This option is
@@ -3839,7 +3839,7 @@ changes:
 
 * `key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView}
   * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|Object} The key
-    material, either in PEM, DER, or JWK format.
+    material, either in PEM, DER, JWK, or raw format.
   * `format` {string} Must be `'pem'`, `'der'`, `'jwk'`, or `'raw-public'`.
     **Default:** `'pem'`.
   * `type` {string} Must be `'pkcs1'` or `'spki'`. This option is

test/parallel/test-crypto-key-objects-raw.js

@@ -318,6 +318,11 @@ if (hasOpenSSL(3, 5)) {
   });
   const derivedPub = crypto.createPublicKey(importedPriv);
   assert.strictEqual(derivedPub.equals(edPub), true);
+  // Private key must not be extractable from the derived public key.
+  assert.throws(() => derivedPub.export({ format: 'pem', type: 'pkcs8' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => derivedPub.export({ format: 'der', type: 'pkcs8' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
 
   // EC raw-private -> createPublicKey
   const ecPriv = crypto.createPrivateKey(
@@ -331,6 +336,11 @@ if (hasOpenSSL(3, 5)) {
   });
   const ecDerivedPub = crypto.createPublicKey(ecImportedPriv);
   assert.strictEqual(ecDerivedPub.equals(ecPub), true);
+  // Private key must not be extractable from the derived public key.
+  assert.throws(() => ecDerivedPub.export({ format: 'pem', type: 'pkcs8' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ecDerivedPub.export({ format: 'pem', type: 'sec1' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
 
   // PQC raw-seed -> createPublicKey
   if (hasOpenSSL(3, 5)) {
@@ -344,6 +354,9 @@ if (hasOpenSSL(3, 5)) {
     });
     const mlDsaDerivedPub = crypto.createPublicKey(mlDsaImportedPriv);
     assert.strictEqual(mlDsaDerivedPub.equals(mlDsaPub), true);
+    // Private key must not be extractable from the derived public key.
+    assert.throws(() => mlDsaDerivedPub.export({ format: 'pem', type: 'pkcs8' }),
+                  { code: 'ERR_INVALID_ARG_VALUE' });
   }
 }
 

test/parallel/test-crypto-key-objects.js

@@ -170,6 +170,23 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   assert.strictEqual(derivedPublicKey.asymmetricKeyType, 'rsa');
   assert.strictEqual(derivedPublicKey.symmetricKeySize, undefined);
 
+  // The private key should not be extractable from the derived public key.
+  assert.throws(() => derivedPublicKey.export({ format: 'pem', type: 'pkcs8' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => derivedPublicKey.export({ format: 'der', type: 'pkcs8' }),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // JWK export should only contain public components, no 'd'.
+  {
+    const jwkExport = derivedPublicKey.export({ format: 'jwk' });
+    assert.strictEqual(jwkExport.kty, 'RSA');
+    assert.strictEqual(jwkExport.d, undefined);
+    assert.strictEqual(jwkExport.dp, undefined);
+    assert.strictEqual(jwkExport.dq, undefined);
+    assert.strictEqual(jwkExport.qi, undefined);
+    assert.strictEqual(jwkExport.p, undefined);
+    assert.strictEqual(jwkExport.q, undefined);
+  }
+
   const publicKeyFromJwk = createPublicKey({ key: publicJwk, format: 'jwk' });
   assert.strictEqual(publicKeyFromJwk.type, 'public');
   assert.strictEqual(publicKeyFromJwk.toString(), '[object KeyObject]');
@@ -533,6 +550,16 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       delete jwk.d;
       assert.deepStrictEqual(
         key.export({ format: 'jwk' }), jwk);
+
+      // Private key material must not be extractable from a derived public key.
+      assert.throws(() => key.export({ format: 'pem', type: 'pkcs8' }),
+                    { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => key.export({ format: 'pem', type: 'sec1' }),
+                    { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => key.export({ format: 'der', type: 'pkcs8' }),
+                    { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => key.export({ format: 'der', type: 'sec1' }),
+                    { code: 'ERR_INVALID_ARG_VALUE' });
     }
   }