SubtleCrypto.deriveBits() with PBKDF2 and output length > 2048 bits about content HOT 4 CLOSED

I’ve opened #5529 with a fix that documents the requirements for the length parameter.

@juanelas, @Gu7z — since per #1671 (comment) throwing for input > 256 bytes is not conformant with the spec requirements, if Firefox is throwing in that case, then the appropriate place to raise an issue for getting that (browser-specific) problem documented is in the https://github.com/mdn/browser-compat-data/issues issue tracker.

from content.

Hey 👋

If that is in fact a requirement that implementations are required to enforce, should it be specified — or at last mentioned — in the WebCrypto spec itself? Or is it instead in fact the case that that requirement is normatively defined in RFC 2898, and so the WebCrypto spec should not try to also normatively (re)define it?

Yeah, this is required here: https://w3c.github.io/webcrypto/#pbkdf2-operations

Can you confirm that “Length argument does not accept an input > 256 bytes” requirement is in fact not an actual requirement in any of the relevant specifications?

This is indeed not a requirement, and Chrome and Safari allow this.

However, I can't actually find this requirement mentioned on MDN - I think this issue was meant to be a bug report in Firefox? So I assume this is a duplicate of https://bugzilla.mozilla.org/show_bug.cgi?id=1469482.

from content.

Any updates? 👀 @chrisdavidmills

from content.

@twiss, The example code in the issue description seems to confirm that the assertions in the issue description are true — but can you please confirm? I mean specifically the following:

SubtleCrypto.deriveBits() with PBKDF2:

• Length argument must be a multiple of 8. This is congruent with the RFC but should be documented

If that is in fact a requirement that implementations are required to enforce, should it be specified — or at last mentioned — in the WebCrypto spec itself? Or is it instead in fact the case that that requirement is normatively defined in RFC 2898, and so the WebCrypto spec should not try to also normatively (re)define it?

• Length argument does not accept an input > 256 bytes. This constraint is not defined in the original PBKDF2 and should be considered to be removed.

Can you confirm that “Length argument does not accept an input > 256 bytes” requirement is in fact not an actual requirement in any of the relevant specifications?

from content.