1 year ago
#332925
Patrik Šimunič
Extracting a private key buffer from WebCrypto generated CryptoKey (private)
I probably already know the answer (ie. not possible), but hopefully I overlooked something, because otherwise the WebCrypto implementation is truly unbelievably crap..
Basically the problem is this:
I need to import/export ECDH (P-256) private keys using WebCrypto - and I don't mean the stupid high-level PKCS8 (PEM) format, that encodes a bunch of other data as well (such as version, public key, etc.), I mean a pure key, as 32-byte buffer. This is really easy to do with the public key, I only set the format to 'raw' and get (or import) 64-byte buffer public key. This however does not work for private key (which doesn't support the 'raw' format), instead I have to export/import the key as PKCS8, then parse the key according to its ASN.1 schema (twice actually - the private key buffer encoded in rfc5915 structure, which is in turn encoded within the pkcs8 structure).
This is an extremely painful process that involves ASN.1 implementation libraries (or god forbid an in-house impl.) and the definitions of appropriate ASN.1 structures (templates). All I need is a way to simply extract a 32-byte private key buffer from generated CryptoKey and vice versa (import 32-byte private key buffer into a CryptoKey).
I'm hoping there's a simple way to do so using only WebCrypto that I overlooked (since I can't see a single rational, security reason why CryptoKey supports the raw format for public keys and not private - after all, you can export it as pkcs8. The only reason I could think of is, that WebCrypto was designed by a sadist with a thing for torturing developers).
If not, then I'd really appreciate if you'd point me to some good, working ASN.1 library written for JS, or even better, TS. So far I tried at least 10 different ASN.1 libraries and only one that worked (with at least some documentation), worked only in Node and not browser, which is kinda pointless.
Thank you for any pointers and/or advice if you had to deal with issue like this before...
asn.1
webcrypto-api
pkcs#8
0 Answers
Your Answer