[wasm][crypto] RandomNumberGenerator mapped to Web Crypto getRandomValues

[kjpou1]

• Uses Web Crypto API getRandomValues if available.

• Add javascript bridge implementation library to Native source tree. …

  • Javascript checks for crypto interface and uses crypto.getRandomValues
  • Add api bridge call when building for emscripten browser.
  • If we couldn't find a proper implementation, as Math.random() is not suitable we will abort.

ABORT: no cryptographic support found getRandomValues. Consider polyfilling it if you want to use something insecure like Math.random(), e.g. put this in a --pre-js: var crypto = { getRandomValues: function(array) { for (var i = 0; i < array.length; i++) array[i] = (Math.random()*256)|0 } };

closes #42727

Part of #40074 and #40074 (comment)

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @jeffhandley
See info in area-owners.md if you want to be subscribed.

[steveisok]

Doesn't /dev/urandom result in a call to Crypto.getRandomValues via the emscripten implementation?

[kjpou1]

Looks like it does: https://github.com/paulshapiro/emscripten/blob/master/src/library_fs.js#L1296

We can close this if we want to continue using the default implementation

[GrabYourPitchforks]

Falls back to /dev/urandom as default if the crypto library is missing.

Is this even possible? Is there any wasm host which does not provide a subtle crypto implementation? And if there is, why not force the host to polyfill as in #42731?

[steveisok]

Falls back to /dev/urandom as default if the crypto library is missing.

Is this even possible? Is there any wasm host which does not provide a subtle crypto implementation? And if there is, why not force the host to polyfill as in #42731?

This is just about the best way to call https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues. It's the only API that isn't promised based and we can actually invoke.

To be honest, this already works and unless I'm missing something, I would recommend we close the PR.

[GrabYourPitchforks]

Let me rephrase the requirement:

RandomNumberGenerator's built-in implementation must call Crypto.getRandomValues or otherwise use a high-quality source of entropy. It would be better if it made this call directly, but it would also be acceptable to make this call indirectly, assuming there's no low-quality entropy fallback code path. The emscripten implementation doesn't seem to fulfill this latter requirement.

[lewing]

emscripten-core/emscripten#12240 landed recently which will expose getentropy as a very thin wrapper over subtle crypto which is what the existing wasm /dev/random uses. The code does fall back to requiring crypto.randomBytes on node and fails if that is not supported. I propose we stick with using /dev/random until we update emscripten then call getentropy from pal_random for wasm. Does this satisfy all the requirements?

[lewing]

Falls back to /dev/urandom as default if the crypto library is missing.

Is this even possible? Is there any wasm host which does not provide a subtle crypto implementation? And if there is, why not force the host to polyfill as in #42731?

This just works because emscripten falls back to node's crypto.randomBytes for both /dev/random and /dev/urandom any code should handle the node case and not fall back to /dev/urandom

[lewing]

This has several issues, it should be implemented in terms of calling getentropy regardless of where the implementation lives.

[jkotas]

I do not think we should be suggesting an unsecure polyfill in the error message.

I think we should leave it for the documentation to discuss the polyfill workarounds. The recommended workaround should be something that tries to be secure as much as possible, like the MSR library discussed in the other PR. If somebody wants to use insecure polyfill, I would leave it up to them to figure out how to do it.

cc @GrabYourPitchforks

[kjpou1]

Changed to let normal managed exception to handle error.

WASM-ERR: 
WASM-ERR: Unhandled Exception:
WASM-ERR: System.Security.Cryptography.CryptographicException: Error occurred during a cryptographic operation.
WASM-ERR:    at Interop.GetCryptographicallySecureRandomBytes(Byte* buffer, Int32 length)
WASM-ERR:    at System.Security.Cryptography.RandomNumberGeneratorImplementation.GetBytes(Byte* pbBuffer, Int32 count)
WASM-ERR:    at System.Security.Cryptography.RandomNumberGeneratorImplementation.GetBytes(Span`1 data)
WASM-ERR:    at System.Security.Cryptography.RandomNumberGeneratorImplementation.GetNonZeroBytes(Span`1 data)
WASM-ERR:    at System.Security.Cryptography.RandomNumberGeneratorImplementation.GetNonZeroBytes(Byte[] data)

Does this work?

[CoffeeFlux]

LGTM modulo the things Jan mentioned. Thanks!

[lewing]

Address the open reviews and this looks good.