Support for Curve25519 (Ed25519 X25519) in Web Cryptography APIs

[lidel]

We are collaborating with Igalia on this.
Filling issue so folks can subscribe for updates – I will edit details below to reflect current state.

• Meta / specs
  • Add Curve25519 w3c/webcrypto#362
  • Implementation status WICG/webcrypto-secure-curves#20
  • working on the issue about the deriveBits inconsistencies in the spec (deriveBits length idl does not allow null w3c/webcrypto#322)
  • blogpost: https://blogs.igalia.com/jfernandez/2023/06/20/secure-curves-in-the-web-cryptography-api/
  • interoperability issues related to the deriveKey length
    • deriveBits length idl does not allow null w3c/webcrypto#322
    • Consider making the deriveBits length argument optional w3c/webcrypto#329
    • https://chromium-review.googlesource.com/c/chromium/src/+/5328466
  • Web Platform Tests
    • Tests for the deriveBits operation with extreme values in the 'length' parameter web-platform-tests/wpt#43400
    • Refactoring of the EdDSA tests web-platform-tests/wpt#44719
    • Test Ed25519 with small- and mixed-order points web-platform-tests/wpt#43751
• Chromium
  • [blink-dev] Intent to Prototype: Curve25519 in Web Cryptography
  • Initial implementation of the Ed25519 algorithm
  • Issue 1370697: Implement safe curves Ed25519 and X25510
  • Change X25519´s behavior to match the current spec
  • https://issues.chromium.org/issues/40074061 → https://chromium-review.googlesource.com/c/chromium/src/+/5054207
  • enable by default
• Firefox
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1804788
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1889153 might be related, adds extra checks on "small order" detail mentioned in Ed25519 signature usage prone to inconsistent peer views between LibP2p implementations libp2p/specs#593 (tbd if this is tested by WPT or not)
  • may be delayed by necessary NSS prework (https://bugzilla.mozilla.org/show_bug.cgi?id=1325335#c18)
    • NSS work wip: https://bugzilla.mozilla.org/show_bug.cgi?id=1325335
• WebKit
  • https://bugs.webkit.org/show_bug.cgi?id=246145
  • https://bugs.webkit.org/show_bug.cgi?id=262613 → Ignore the "alg" member in JWK import operation WebKit/WebKit#21006
  • Support for the Curve 25519 in order to be able to work with such type of curves and implementation of X25519 Algorithm WebKit/WebKit#5811
  • Support https://wicg.github.io/webcrypto-secure-curves/#ed25519 WebKit/WebKit#8691
  • Safari 17.0 includes "Support for Ed25519 cryptography." https://webkit.org/blog/14445/webkit-features-in-safari-17-0/

[lidel]

Igalia posted a fantastic blog post about current progress on Secure Curves in the Web Cryptography API:

• https://blogs.igalia.com/jfernandez/2023/06/20/secure-curves-in-the-web-cryptography-api/

[javifernandez]

• Chromium
  • Both Ed25519 and X25519 implementation are completed, although behind a runtime flag
• WebKit
  • Both Ed25519 and X25519 implementation are completed, although behind a runtime flag