feat(ext/crypto): implement AES-GCM encryption (#13119)

5 files changed, 179 insertions, 7 deletions

diff --git a/ext/crypto/00_crypto.js b/ext/crypto/00_crypto.js
index 95eb18daa..f76232136 100644
--- a/ext/crypto/00_crypto.js
+++ b/ext/crypto/00_crypto.js
@@ -54,6 +54,7 @@
   ];
 
   const simpleAlgorithmDictionaries = {
+    AesGcmParams: { iv: "BufferSource", additionalData: "BufferSource" },
     RsaHashedKeyGenParams: { hash: "HashAlgorithmIdentifier" },
     EcKeyGenParams: {},
     HmacKeyGenParams: { hash: "HashAlgorithmIdentifier" },
@@ -123,6 +124,7 @@
     "encrypt": {
       "RSA-OAEP": "RsaOaepParams",
       "AES-CBC": "AesCbcParams",
+      "AES-GCM": "AesGcmParams",
       "AES-CTR": "AesCtrParams",
     },
     "decrypt": {
@@ -3502,6 +3504,69 @@
         // 4.
         return cipherText.buffer;
       }
+      case "AES-GCM": {
+        normalizedAlgorithm.iv = copyBuffer(normalizedAlgorithm.iv);
+
+        // 1.
+        if (data.byteLength > (2 ** 39) - 256) {
+          throw new DOMException(
+            "Plaintext too large",
+            "OperationError",
+          );
+        }
+
+        // 2.
+        // We only support 96-bit nonce for now.
+        if (normalizedAlgorithm.iv.byteLength !== 12) {
+          throw new DOMException(
+            "Initialization vector length not supported",
+            "NotSupportedError",
+          );
+        }
+
+        // 3.
+        if (normalizedAlgorithm.additionalData !== undefined) {
+          if (normalizedAlgorithm.additionalData.byteLength > (2 ** 64) - 1) {
+            throw new DOMException(
+              "Additional data too large",
+              "OperationError",
+            );
+          }
+        }
+
+        // 4.
+        if (normalizedAlgorithm.tagLength == undefined) {
+          normalizedAlgorithm.tagLength = 128;
+        } else if (
+          !ArrayPrototypeIncludes(
+            [32, 64, 96, 104, 112, 120, 128],
+            normalizedAlgorithm.tagLength,
+          )
+        ) {
+          throw new DOMException(
+            "Invalid tag length",
+            "OperationError",
+          );
+        }
+        // 5.
+        if (normalizedAlgorithm.additionalData) {
+          normalizedAlgorithm.additionalData = copyBuffer(
+            normalizedAlgorithm.additionalData,
+          );
+        }
+        // 6-7.
+        const cipherText = await core.opAsync("op_crypto_encrypt", {
+          key: keyData,
+          algorithm: "AES-GCM",
+          length: key[_algorithm].length,
+          iv: normalizedAlgorithm.iv,
+          additionalData: normalizedAlgorithm.additionalData,
+          tagLength: normalizedAlgorithm.tagLength,
+        }, data);
+
+        // 8.
+        return cipherText.buffer;
+      }
       default:
         throw new DOMException("Not implemented", "NotSupportedError");
     }
diff --git a/ext/crypto/01_webidl.js b/ext/crypto/01_webidl.js
index 04315204f..52f212461 100644
--- a/ext/crypto/01_webidl.js
+++ b/ext/crypto/01_webidl.js
@@ -398,11 +398,23 @@
     },
   ];
 
-  webidl.converters.AesDerivedKeyParams = webidl
-    .createDictionaryConverter("AesDerivedKeyParams", dictAesDerivedKeyParams);
-
-  webidl.converters.AesCbcParams = webidl
-    .createDictionaryConverter("AesCbcParams", dictAesCbcParams);
+  const dictAesGcmParams = [
+    ...dictAlgorithm,
+    {
+      key: "iv",
+      converter: webidl.converters["BufferSource"],
+      required: true,
+    },
+    {
+      key: "tagLength",
+      converter: (V, opts) =>
+        webidl.converters["unsigned long"](V, { ...opts, enforceRange: true }),
+    },
+    {
+      key: "additionalData",
+      converter: webidl.converters["BufferSource"],
+    },
+  ];
 
   const dictAesCtrParams = [
     ...dictAlgorithm,
@@ -419,6 +431,15 @@
     },
   ];
 
+  webidl.converters.AesDerivedKeyParams = webidl
+    .createDictionaryConverter("AesDerivedKeyParams", dictAesDerivedKeyParams);
+
+  webidl.converters.AesCbcParams = webidl
+    .createDictionaryConverter("AesCbcParams", dictAesCbcParams);
+
+  webidl.converters.AesGcmParams = webidl
+    .createDictionaryConverter("AesGcmParams", dictAesGcmParams);
+
   webidl.converters.AesCtrParams = webidl
     .createDictionaryConverter("AesCtrParams", dictAesCtrParams);
 
diff --git a/ext/crypto/Cargo.toml b/ext/crypto/Cargo.toml
index 2ab3ff171..26448c1a0 100644
--- a/ext/crypto/Cargo.toml
+++ b/ext/crypto/Cargo.toml
@@ -15,6 +15,7 @@ path = "lib.rs"
 
 [dependencies]
 aes = "0.7.5"
+aes-gcm = "0.9.4"
 base64 = "0.13.0"
 block-modes = "0.8.1"
 ctr = "0.8.0"
diff --git a/ext/crypto/encrypt.rs b/ext/crypto/encrypt.rs
index 99f4762d0..f1d88438b 100644
--- a/ext/crypto/encrypt.rs
+++ b/ext/crypto/encrypt.rs
@@ -6,6 +6,13 @@ use crate::shared::*;
 use aes::cipher::NewCipher;
 use aes::BlockEncrypt;
 use aes::NewBlockCipher;
+use aes_gcm::aead::generic_array::typenum::U12;
+use aes_gcm::aes::Aes192;
+use aes_gcm::AeadInPlace;
+use aes_gcm::Aes128Gcm;
+use aes_gcm::Aes256Gcm;
+use aes_gcm::NewAead;
+use aes_gcm::Nonce;
 use ctr::Ctr;
 
 use block_modes::BlockMode;
@@ -53,6 +60,15 @@ pub enum EncryptAlgorithm {
     iv: Vec<u8>,
     length: usize,
   },
+  #[serde(rename = "AES-GCM", rename_all = "camelCase")]
+  AesGcm {
+    #[serde(with = "serde_bytes")]
+    iv: Vec<u8>,
+    #[serde(with = "serde_bytes")]
+    additional_data: Option<Vec<u8>>,
+    length: usize,
+    tag_length: usize,
+  },
   #[serde(rename = "AES-CTR", rename_all = "camelCase")]
   AesCtr {
     #[serde(with = "serde_bytes")]
@@ -74,6 +90,12 @@ pub async fn op_crypto_encrypt(
     EncryptAlgorithm::AesCbc { iv, length } => {
       encrypt_aes_cbc(key, length, iv, &data)
     }
+    EncryptAlgorithm::AesGcm {
+      iv,
+      additional_data,
+      length,
+      tag_length,
+    } => encrypt_aes_gcm(key, length, tag_length, iv, additional_data, &data),
     EncryptAlgorithm::AesCtr {
       counter,
       ctr_length,
@@ -89,7 +111,7 @@ fn encrypt_rsa_oaep(
   hash: ShaHash,
   label: Vec<u8>,
   data: &[u8],
-) -> Result<Vec<u8>, deno_core::anyhow::Error> {
+) -> Result<Vec<u8>, AnyError> {
   let label = String::from_utf8_lossy(&label).to_string();
 
   let public_key = key.as_rsa_public_key()?;
@@ -129,7 +151,7 @@ fn encrypt_aes_cbc(
   length: usize,
   iv: Vec<u8>,
   data: &[u8],
-) -> Result<Vec<u8>, deno_core::anyhow::Error> {
+) -> Result<Vec<u8>, AnyError> {
   let key = key.as_secret_key()?;
   let ciphertext = match length {
     128 => {
@@ -161,6 +183,62 @@ fn encrypt_aes_cbc(
   Ok(ciphertext)
 }
 
+fn encrypt_aes_gcm(
+  key: RawKeyData,
+  length: usize,
+  tag_length: usize,
+  iv: Vec<u8>,
+  additional_data: Option<Vec<u8>>,
+  data: &[u8],
+) -> Result<Vec<u8>, AnyError> {
+  let key = key.as_secret_key()?;
+  let additional_data = additional_data.unwrap_or_default();
+
+  // Fixed 96-bit nonce
+  if iv.len() != 12 {
+    return Err(type_error("iv length not equal to 12"));
+  }
+
+  let nonce = Nonce::from_slice(&iv);
+
+  let mut ciphertext = data.to_vec();
+  let tag = match length {
+    128 => {
+      let cipher = Aes128Gcm::new_from_slice(key)
+        .map_err(|_| operation_error("Encryption failed"))?;
+      cipher
+        .encrypt_in_place_detached(nonce, &additional_data, &mut ciphertext)
+        .map_err(|_| operation_error("Encryption failed"))?
+    }
+    192 => {
+      type Aes192Gcm = aes_gcm::AesGcm<Aes192, U12>;
+
+      let cipher = Aes192Gcm::new_from_slice(key)
+        .map_err(|_| operation_error("Encryption failed"))?;
+      cipher
+        .encrypt_in_place_detached(nonce, &additional_data, &mut ciphertext)
+        .map_err(|_| operation_error("Encryption failed"))?
+    }
+    256 => {
+      let cipher = Aes256Gcm::new_from_slice(key)
+        .map_err(|_| operation_error("Encryption failed"))?;
+      cipher
+        .encrypt_in_place_detached(nonce, &additional_data, &mut ciphertext)
+        .map_err(|_| operation_error("Encryption failed"))?
+    }
+    _ => return Err(type_error("invalid length")),
+  };
+
+  // Truncated tag to the specified tag length.
+  // `tag` is fixed to be 16 bytes long and (tag_length / 8) is always <= 16
+  let tag = &tag[..(tag_length / 8)];
+
+  // C | T
+  ciphertext.extend_from_slice(tag);
+
+  Ok(ciphertext)
+}
+
 fn encrypt_aes_ctr_gen<B, F>(
   key: &[u8],
   counter: &[u8],
diff --git a/ext/crypto/lib.deno_crypto.d.ts b/ext/crypto/lib.deno_crypto.d.ts
index f7d735721..9c7386dc9 100644
--- a/ext/crypto/lib.deno_crypto.d.ts
+++ b/ext/crypto/lib.deno_crypto.d.ts
@@ -62,6 +62,12 @@ interface AesCbcParams extends Algorithm {
   iv: BufferSource;
 }
 
+interface AesGcmParams extends Algorithm {
+  iv: BufferSource;
+  additionalData?: BufferSource;
+  tagLength?: number;
+}
+
 interface AesCtrParams extends Algorithm {
   counter: BufferSource;
   length: number;
@@ -248,6 +254,7 @@ interface SubtleCrypto {
       | AlgorithmIdentifier
       | RsaOaepParams
       | AesCbcParams
+      | AesGcmParams
       | AesCtrParams,
     key: CryptoKey,
     data: BufferSource,