Skip to main content

lib_q_core/wasm/
conversions.rs

1//! WASM conversion helpers between Rust buffers and JavaScript [`js_sys::Uint8Array`].
2//!
3//! These are mechanical copies: they do not infer sensitivity. Callers choose [`zeroize::Zeroizing`]
4//! or explicit clearing when handling secrets.
5
6#[cfg(feature = "wasm")]
7extern crate alloc;
8#[cfg(feature = "wasm")]
9use alloc::{
10    format,
11    string::{
12        String,
13        ToString,
14    },
15    vec::Vec,
16};
17
18#[cfg(feature = "wasm")]
19use js_sys::Uint8Array;
20#[cfg(feature = "wasm")]
21use serde_json;
22#[cfg(feature = "wasm")]
23use serde_wasm_bindgen;
24#[cfg(feature = "wasm")]
25use wasm_bindgen::prelude::*;
26
27use crate::api::Algorithm;
28use crate::error::Result;
29
30/// Byte-array conversion helpers for WASM bindings.
31#[cfg(feature = "wasm")]
32pub struct WasmConversions;
33
34#[cfg(feature = "wasm")]
35impl WasmConversions {
36    /// Copy `data` into a new JavaScript `Uint8Array`.
37    ///
38    /// The input slice is not modified; callers that need the source buffer cleared must do so
39    /// separately (for example by holding secrets in [`zeroize::Zeroizing`] and letting it drop
40    /// after this call).
41    pub fn vec_to_uint8array(data: &[u8]) -> Uint8Array {
42        let n = u32::try_from(data.len()).expect("length exceeds JavaScript Uint8Array maximum");
43        let array = Uint8Array::new_with_length(n);
44        array.copy_from(data);
45        array
46    }
47
48    /// Convert WASM Uint8Array to Rust Vec<u8>
49    ///
50    /// Validates input size to limit abuse; copies array contents into a new `Vec`.
51    pub fn uint8array_to_vec(array: &Uint8Array) -> Result<Vec<u8>> {
52        let length = array.length() as usize;
53
54        // Validate size to prevent DoS attacks
55        const MAX_SIZE: usize = 1024 * 1024; // 1MB limit
56        if length > MAX_SIZE {
57            return Err(crate::error::Error::InvalidMessageSize {
58                max: MAX_SIZE,
59                actual: length,
60            });
61        }
62
63        let mut vec = alloc::vec![0u8; length];
64        array.copy_to(&mut vec);
65        Ok(vec)
66    }
67
68    /// Convert algorithm string to Algorithm enum
69    ///
70    /// This function provides secure algorithm parsing with:
71    /// - Input validation to prevent injection attacks
72    /// - Case-insensitive matching for user convenience
73    /// - Clear error messages for unsupported algorithms
74    pub fn string_to_algorithm(algorithm_str: &str) -> Result<Algorithm> {
75        match algorithm_str.to_lowercase().as_str() {
76            // KEM algorithms
77            "mlkem512" | "ml-kem-512" => Ok(Algorithm::MlKem512),
78            "mlkem768" | "ml-kem-768" => Ok(Algorithm::MlKem768),
79            "mlkem1024" | "ml-kem-1024" => Ok(Algorithm::MlKem1024),
80            // Signature algorithms
81            "mldsa44" | "ml-dsa-44" => Ok(Algorithm::MlDsa44),
82            "mldsa65" | "ml-dsa-65" => Ok(Algorithm::MlDsa65),
83            "mldsa87" | "ml-dsa-87" => Ok(Algorithm::MlDsa87),
84            "fndsa" | "fn-dsa" => Ok(Algorithm::FnDsa),
85
86            // SLH-DSA (hyphenated IDs, NIST-style names, and PascalCase `SlhDsa*` lowercased)
87            "slh-dsa-sha256-128f-robust" |
88            "slh-dsa-sha2-128f-robust" |
89            "slhdsasha256128frobust" => Ok(Algorithm::SlhDsaSha256128fRobust),
90            "slh-dsa-sha256-192f-robust" |
91            "slh-dsa-sha2-192f-robust" |
92            "slhdsasha256192frobust" => Ok(Algorithm::SlhDsaSha256192fRobust),
93            "slh-dsa-sha256-256f-robust" |
94            "slh-dsa-sha2-256f-robust" |
95            "slhdsasha256256frobust" => Ok(Algorithm::SlhDsaSha256256fRobust),
96            "slh-dsa-shake256-128f-robust" | "slhdsashake256128frobust" => {
97                Ok(Algorithm::SlhDsaShake256128fRobust)
98            }
99            "slh-dsa-shake256-192f-robust" | "slhdsashake256192frobust" => {
100                Ok(Algorithm::SlhDsaShake256192fRobust)
101            }
102            "slh-dsa-shake256-256f-robust" | "slhdsashake256256frobust" => {
103                Ok(Algorithm::SlhDsaShake256256fRobust)
104            }
105
106            // Hash algorithms
107            "sha3_224" | "sha3-224" => Ok(Algorithm::Sha3_224),
108            "sha3_256" | "sha3-256" => Ok(Algorithm::Sha3_256),
109            "sha3_384" | "sha3-384" => Ok(Algorithm::Sha3_384),
110            "sha3_512" | "sha3-512" => Ok(Algorithm::Sha3_512),
111            "shake128" => Ok(Algorithm::Shake128),
112            "shake256" => Ok(Algorithm::Shake256),
113            "sha224" | "sha-224" => Ok(Algorithm::Sha224),
114            "sha256" | "sha-256" => Ok(Algorithm::Sha256),
115            "sha384" | "sha-384" => Ok(Algorithm::Sha384),
116            "sha512" | "sha-512" => Ok(Algorithm::Sha512),
117            "sha512_224" | "sha512-224" | "sha-512/224" => Ok(Algorithm::Sha512_224),
118            "sha512_256" | "sha512-256" | "sha-512/256" => Ok(Algorithm::Sha512_256),
119            "cshake128" | "cshake-128" => Ok(Algorithm::CShake128),
120            "cshake256" | "cshake-256" => Ok(Algorithm::CShake256),
121            "keccak224" | "keccak-224" => Ok(Algorithm::Keccak224),
122            "keccak256" | "keccak-256" => Ok(Algorithm::Keccak256),
123            "keccak384" | "keccak-384" => Ok(Algorithm::Keccak384),
124            "keccak512" | "keccak-512" => Ok(Algorithm::Keccak512),
125            "kangarootwelve" | "kt128" | "k12" => Ok(Algorithm::Kt128),
126            "kt256" => Ok(Algorithm::Kt256),
127            "turboshake128" | "turboshake-128" => Ok(Algorithm::TurboShake128),
128            "turboshake256" | "turboshake-256" => Ok(Algorithm::TurboShake256),
129            "kmac128" | "kmac-128" => Ok(Algorithm::Kmac128),
130            "kmac256" | "kmac-256" => Ok(Algorithm::Kmac256),
131            "tuplehash128" | "tuplehash-128" => Ok(Algorithm::TupleHash128),
132            "tuplehash256" | "tuplehash-256" => Ok(Algorithm::TupleHash256),
133            "parallelhash128" | "parallelhash-128" => Ok(Algorithm::ParallelHash128),
134            "parallelhash256" | "parallelhash-256" => Ok(Algorithm::ParallelHash256),
135
136            // AEAD algorithms
137            "saturnin" => Ok(Algorithm::Saturnin),
138            "shake256aead" | "shake256-aead" => Ok(Algorithm::Shake256Aead),
139            "duplexspongeaead" | "duplex-sponge-aead" => Ok(Algorithm::DuplexSpongeAead),
140            "tweakaead" | "tweak-aead" => Ok(Algorithm::TweakAead),
141            "romulus-n" | "romulusn" => Ok(Algorithm::RomulusN),
142            "romulus-m" | "romulusm" => Ok(Algorithm::RomulusM),
143
144            _ => Err(crate::error::Error::UnsupportedAlgorithm {
145                algorithm: algorithm_str.to_string(),
146            }),
147        }
148    }
149
150    /// Convert Algorithm enum to string
151    ///
152    /// This function provides consistent algorithm naming for JavaScript
153    pub fn algorithm_to_string(algorithm: Algorithm) -> String {
154        match algorithm {
155            // KEM algorithms
156            Algorithm::MlKem512 => "ml-kem-512".to_string(),
157            Algorithm::MlKem768 => "ml-kem-768".to_string(),
158            Algorithm::MlKem1024 => "ml-kem-1024".to_string(),
159            // Signature algorithms
160            Algorithm::MlDsa44 => "ml-dsa-44".to_string(),
161            Algorithm::MlDsa65 => "ml-dsa-65".to_string(),
162            Algorithm::MlDsa87 => "ml-dsa-87".to_string(),
163            Algorithm::FnDsa => "fn-dsa".to_string(),
164
165            Algorithm::SlhDsaSha256128fRobust => "slh-dsa-sha256-128f-robust".to_string(),
166            Algorithm::SlhDsaSha256192fRobust => "slh-dsa-sha256-192f-robust".to_string(),
167            Algorithm::SlhDsaSha256256fRobust => "slh-dsa-sha256-256f-robust".to_string(),
168            Algorithm::SlhDsaShake256128fRobust => "slh-dsa-shake256-128f-robust".to_string(),
169            Algorithm::SlhDsaShake256192fRobust => "slh-dsa-shake256-192f-robust".to_string(),
170            Algorithm::SlhDsaShake256256fRobust => "slh-dsa-shake256-256f-robust".to_string(),
171
172            // Hash algorithms
173            Algorithm::Sha3_224 => "sha3-224".to_string(),
174            Algorithm::Sha3_256 => "sha3-256".to_string(),
175            Algorithm::Sha3_384 => "sha3-384".to_string(),
176            Algorithm::Sha3_512 => "sha3-512".to_string(),
177            Algorithm::Shake128 => "shake128".to_string(),
178            Algorithm::Shake256 => "shake256".to_string(),
179            Algorithm::Sha224 => "sha-224".to_string(),
180            Algorithm::Sha256 => "sha-256".to_string(),
181            Algorithm::Sha384 => "sha-384".to_string(),
182            Algorithm::Sha512 => "sha-512".to_string(),
183            Algorithm::Sha512_224 => "sha-512/224".to_string(),
184            Algorithm::Sha512_256 => "sha-512/256".to_string(),
185            Algorithm::CShake128 => "cshake128".to_string(),
186            Algorithm::CShake256 => "cshake256".to_string(),
187            Algorithm::Keccak224 => "keccak-224".to_string(),
188            Algorithm::Keccak256 => "keccak-256".to_string(),
189            Algorithm::Keccak384 => "keccak-384".to_string(),
190            Algorithm::Keccak512 => "keccak-512".to_string(),
191            Algorithm::Kt128 => "kt128".to_string(),
192            Algorithm::Kt256 => "kt256".to_string(),
193            Algorithm::TurboShake128 => "turboshake128".to_string(),
194            Algorithm::TurboShake256 => "turboshake256".to_string(),
195            Algorithm::Kmac128 => "kmac128".to_string(),
196            Algorithm::Kmac256 => "kmac256".to_string(),
197            Algorithm::TupleHash128 => "tuplehash128".to_string(),
198            Algorithm::TupleHash256 => "tuplehash256".to_string(),
199            Algorithm::ParallelHash128 => "parallelhash128".to_string(),
200            Algorithm::ParallelHash256 => "parallelhash256".to_string(),
201
202            // AEAD algorithms
203            Algorithm::Saturnin => "saturnin".to_string(),
204            Algorithm::Shake256Aead => "shake256-aead".to_string(),
205            Algorithm::DuplexSpongeAead => "duplex-sponge-aead".to_string(),
206            Algorithm::TweakAead => "tweak-aead".to_string(),
207            Algorithm::RomulusN => "romulus-n".to_string(),
208            Algorithm::RomulusM => "romulus-m".to_string(),
209
210            // Other algorithms (add as needed)
211            _ => format!("{:?}", algorithm).to_lowercase().replace('_', "-"),
212        }
213    }
214
215    /// Convert KEM keypair to JavaScript object
216    ///
217    /// This function securely serializes keypair data for JavaScript consumption
218    pub fn kem_keypair_to_js(public_key: &[u8], secret_key: &[u8]) -> Result<JsValue> {
219        let result = serde_json::json!({
220            "public_key": public_key,
221            "secret_key": secret_key,
222            "algorithm": "kem"
223        });
224
225        serde_wasm_bindgen::to_value(&result).map_err(|e| crate::error::Error::NotImplemented {
226            feature: format!("Serialization error: {:?}", e),
227        })
228    }
229
230    /// Convert signature keypair to JavaScript object
231    ///
232    /// This function securely serializes keypair data for JavaScript consumption
233    pub fn sig_keypair_to_js(public_key: &[u8], secret_key: &[u8]) -> Result<JsValue> {
234        let result = serde_json::json!({
235            "public_key": public_key,
236            "secret_key": secret_key,
237            "algorithm": "signature"
238        });
239
240        serde_wasm_bindgen::to_value(&result).map_err(|e| crate::error::Error::NotImplemented {
241            feature: format!("Serialization error: {:?}", e),
242        })
243    }
244
245    /// Convert hash result to JavaScript object
246    ///
247    /// This function securely serializes hash data for JavaScript consumption
248    pub fn hash_result_to_js(hash: &[u8], algorithm: Algorithm) -> Result<JsValue> {
249        let result = serde_json::json!({
250            "hash": hash,
251            "algorithm": Self::algorithm_to_string(algorithm),
252            "length": hash.len()
253        });
254
255        serde_wasm_bindgen::to_value(&result).map_err(|e| crate::error::Error::NotImplemented {
256            feature: format!("Serialization error: {:?}", e),
257        })
258    }
259
260    /// Convert error to JavaScript error
261    ///
262    /// This function provides secure error conversion that doesn't leak sensitive information
263    pub fn error_to_js(error: &crate::error::Error) -> JsValue {
264        // Only expose safe error information to JavaScript
265        let safe_message = match error {
266            crate::error::Error::NotImplemented { feature } => {
267                format!("Feature not implemented: {}", feature)
268            }
269            crate::error::Error::InvalidAlgorithm { algorithm } => {
270                format!("Invalid algorithm: {}", algorithm)
271            }
272            crate::error::Error::InvalidKey { key_type, reason } => {
273                format!("Invalid {}: {}", key_type, reason)
274            }
275            crate::error::Error::InvalidMessageSize { max, actual } => {
276                format!("Message size {} exceeds maximum {}", actual, max)
277            }
278            crate::error::Error::InvalidNonceSize { expected, actual } => {
279                format!("Nonce size {} does not match expected {}", actual, expected)
280            }
281            _ => "Cryptographic operation failed".to_string(),
282        };
283
284        JsValue::from_str(&safe_message)
285    }
286}
287
288/// Canonical WASM signature algorithm id strings for listings (`WasmSignatureContext`,
289/// `WasmProviderManager`, JSON summaries). Matches [`WasmConversions::algorithm_to_string`] for SLH.
290#[cfg(feature = "wasm")]
291pub const WASM_SIGNATURE_ALGORITHM_IDS: &[&str] = &[
292    "ml-dsa-44",
293    "ml-dsa-65",
294    "ml-dsa-87",
295    "fn-dsa",
296    "slh-dsa-sha256-128f-robust",
297    "slh-dsa-sha256-192f-robust",
298    "slh-dsa-sha256-256f-robust",
299    "slh-dsa-shake256-128f-robust",
300    "slh-dsa-shake256-192f-robust",
301    "slh-dsa-shake256-256f-robust",
302];
303
304#[cfg(test)]
305mod tests {
306    use super::*;
307
308    #[test]
309    fn test_algorithm_conversion() {
310        // Test string to algorithm conversion
311        assert_eq!(
312            WasmConversions::string_to_algorithm("ml-kem-512").unwrap(),
313            Algorithm::MlKem512
314        );
315        assert_eq!(
316            WasmConversions::string_to_algorithm("ML-KEM-512").unwrap(),
317            Algorithm::MlKem512
318        );
319        assert_eq!(
320            WasmConversions::string_to_algorithm("sha3-256").unwrap(),
321            Algorithm::Sha3_256
322        );
323
324        // Test unsupported algorithm
325        assert!(WasmConversions::string_to_algorithm("unsupported").is_err());
326
327        // Test algorithm to string conversion
328        assert_eq!(
329            WasmConversions::algorithm_to_string(Algorithm::MlKem512),
330            "ml-kem-512"
331        );
332        assert_eq!(
333            WasmConversions::algorithm_to_string(Algorithm::Sha3_256),
334            "sha3-256"
335        );
336
337        assert_eq!(
338            WasmConversions::string_to_algorithm("slh-dsa-shake256-128f-robust").unwrap(),
339            Algorithm::SlhDsaShake256128fRobust
340        );
341        assert_eq!(
342            WasmConversions::string_to_algorithm("SLH-DSA-SHAKE256-128f-Robust").unwrap(),
343            Algorithm::SlhDsaShake256128fRobust
344        );
345        assert_eq!(
346            WasmConversions::string_to_algorithm("SlhDsaShake256128fRobust").unwrap(),
347            Algorithm::SlhDsaShake256128fRobust
348        );
349        assert_eq!(
350            WasmConversions::string_to_algorithm("slh-dsa-sha256-128f-robust").unwrap(),
351            Algorithm::SlhDsaSha256128fRobust
352        );
353        assert_eq!(
354            WasmConversions::algorithm_to_string(Algorithm::SlhDsaShake256128fRobust),
355            "slh-dsa-shake256-128f-robust"
356        );
357    }
358
359    #[test]
360    #[cfg(target_arch = "wasm32")]
361    fn test_error_conversion() {
362        let error = crate::error::Error::NotImplemented {
363            feature: "test feature".to_string(),
364        };
365        let js_error = WasmConversions::error_to_js(&error);
366        // In a real WASM environment, we would test the JsValue
367        // For now, we just ensure the function doesn't panic
368        assert!(!js_error.is_undefined());
369    }
370}