javascript - Chrome 中的 crypto.subtle.importKey 抛出 DOMException，而 Firefox 运行良好

Question

我正尝试按如下方式导入 ECDSA 公钥:

ua8 = new Uint8Array( [48, 86, 48, 16, 6, 4, 43, 129, 4, 112, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 124, 78, 186, 4, 136, 215, 226, 113, 200, 80, 93, 199, 105, 63, 47, 60, 193, 162, 180, 226, 160, 164, 9, 183, 122, 42, 97, 201, 99, 128, 54, 227, 193, 220, 229, 75, 186, 223, 201, 227, 229, 159, 159, 67, 205, 3, 126, 74, 211, 202, 122, 66, 185, 150, 74, 152, 192, 177, 81, 155, 106, 237, 212, 146] );
crypto.subtle.importKey( "spki", ua8, { name: "ECDSA", namedCurve: "P-256", }, false, ["verify"] );

在 Firefox 中，这很好用，但在 Chrome 中我得到一个 DOMException。

我希望它能在两种浏览器中运行。我该如何解决？

Answer 1

根据 the Chromium WebCrypto documentation :

Chromium's WebCrypto implementation supports all of the key formats - "raw", "spki", "pkcs8", "jwk", with the following caveats:

• There are differences in DER key format handling between Web Crypto implementations. Where possible for compatibility prefer using "raw" keys or "jwk" which have better interoperability.

• When importing/exporting "spki" and "pkcs8" formats, the only OIDs supported by Chromiumare those recognized by OpenSSL/BoringSSL.

特别是，它说:

• Importing ECDH keys does not accept id-ecDH. The OID must instead be id-ecPublicKey (This can cause problems importing keys generated by Firefox; use "raw" EC keys as a workaround; Chromium in this case is not spec compliant)

^{(错误跟踪器链接给我一个 500 内部服务器错误，但这可能是暂时的。)}

Looking at your key in an ASN.1 decoder ，它包含以下数据:

SEQUENCE (2 elem)
    SEQUENCE (2 elem)
        OBJECT IDENTIFIER 1.3.132.112
        OBJECT IDENTIFIER 1.2.840.10045.3.1.7 prime256v1 (ANSI X9.62 named elliptic curve)
    BIT STRING (520 bit) 0000010001111100010011101011101000000100100010001101011111100010011100…

对象标识符1.3.132.112正是Chrome无法识别的“id-ecDH”标识符。对于它的值(value)，a key exported from Chrome取而代之的是 OID 1.2.840.10045.2.1(“ecPublicKey”)。

正如链接的文档页面所建议的那样，作为一种变通方法，您可能希望从“spki”格式切换到“原始”格式(或切换到基于 JSON 的 "jwk")。