Skip to content

Fix HMAC JWK import length handling#303

Open
harrshita123 wants to merge 3 commits into
google:masterfrom
harrshita123:codex/hmac-jwk-length
Open

Fix HMAC JWK import length handling#303
harrshita123 wants to merge 3 commits into
google:masterfrom
harrshita123:codex/hmac-jwk-length

Conversation

@harrshita123

@harrshita123 harrshita123 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Fixes #302.

What changed

  • Treat length on HMAC JWK import as an expected key length, not as a request to alter key material.
  • Validate decoded jwk.k length and reject non-zero unused trailing bits when length is not byte-aligned.
  • Keep raw HMAC import behavior unchanged.
  • Add regression coverage for matching JWK length, non-zero unused bits, and invalid expected length.

Testing

  • /Users/apple/flutter/bin/dart run lib/src/testing/regression/issue_302_hmac_jwk_length.dart
  • /Users/apple/flutter/bin/dart test test/webcrypto_test.dart
  • /Users/apple/flutter/bin/dart analyze (existing info-level lints only)

Comment thread lib/src/webcrypto/webcrypto.hmac.dart Outdated
Comment thread lib/src/testing/regression/issue_302_hmac_jwk_length.dart Outdated
@harrshita123 harrshita123 force-pushed the codex/hmac-jwk-length branch from 8e351d9 to 554da8c Compare July 8, 2026 09:08
@harrshita123 harrshita123 force-pushed the codex/hmac-jwk-length branch from 554da8c to b22f865 Compare July 8, 2026 09:10
@harrshita123 harrshita123 deleted the codex/hmac-jwk-length branch July 8, 2026 09:21
@harrshita123 harrshita123 restored the codex/hmac-jwk-length branch July 8, 2026 09:24
@harrshita123 harrshita123 reopened this Jul 8, 2026
@harrshita123

Copy link
Copy Markdown
Contributor Author

Sorry, I accidentally clicked the close button. I have reopened the PR.

Keep both the upstream js_interop import and the HMAC JWK base64Url import in the JS implementation.
@harrshita123 harrshita123 force-pushed the codex/hmac-jwk-length branch from c8c9ea2 to c4479da Compare July 8, 2026 16:55
@harrshita123

Copy link
Copy Markdown
Contributor Author

@jonasfj I resolved all conflicts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HmacSecretKey.importJsonWebKey ignores length

2 participants