Bun throws `OperationError` when using `SubtleCrypto.wrapKey`

[davidebombelli]

What version of Bun is running?

1.3.14+0d9b296af

What platform is your computer?

Linux 6.8.0-124-generic x86_64 x86_64

What steps can reproduce the bug?

const { subtle } = globalThis.crypto;

async function generateAndWrapHmacKey(format = 'jwk', hash = 'SHA-512') {
  const [
    key,
    wrappingKey,
  ] = await Promise.all([
    subtle.generateKey({
      name: 'HMAC', hash,
    }, true, ['sign', 'verify']),
    subtle.generateKey({
      name: 'AES-KW',
      length: 256,
    }, true, ['wrapKey', 'unwrapKey']),
  ]);

  const wrappedKey = await subtle.wrapKey(format, key, wrappingKey, 'AES-KW');

  return { wrappedKey, wrappingKey };
}

async function unwrapHmacKey(
  wrappedKey,
  wrappingKey,
  format = 'jwk',
  hash = 'SHA-512') {

  const key = await subtle.unwrapKey(
    format,
    wrappedKey,
    wrappingKey,
    'AES-KW',
    { name: 'HMAC', hash },
    true,
    ['sign', 'verify']);

  return key;
}

const { wrappedKey, wrappingKey } = await generateAndWrapHmacKey();
const unwrappedKey = await unwrapHmacKey(wrappedKey, wrappingKey);
console.log(wrappedKey, unwrappedKey);

What is the expected behavior?

in Node.js, it outputs:

ArrayBuffer {
  [Uint8Contents]: <db 85 9e 9a 55 33 f9 c7 82 84 c8 2a 81 fa ae 9b 54 8e 50 37 23 fe 51 0d cb 1d 68 db b9 23 ae a8 2e 92 b9 21 17 19 09 cb ab 55 f0 88 6a 2a ec 9f 8d 86 18 c2 53 6e 9a c5 84 65 8e ff 2c d3 4e 52 09 40 2d 0e f7 9c e8 a2 00 fe ef 1d ef 32 b9 8d b2 c4 09 56 9b 87 de 51 49 e4 e2 db 2f e6 eb cd 36 6f 9c 71 ... 156 more bytes>,
  [byteLength]: 256
} CryptoKey {
  type: 'secret',
  extractable: true,
  algorithm: { name: 'HMAC', length: 1024, hash: [Object] },
  usages: [ 'sign', 'verify' ]

What do you see instead?

Bun outputs:

OperationError: The operation failed for an operation-specific reason
DOMException {
  line: 16,
  column: 44,
  sourceURL: "/home/username/test.js",
  stack: "wrapKey@[native code]\ngenerateAndWrapHmacKey@/home/username/test.js:16:44",
  code: 0,
  name: "OperationError",
  message: "The operation failed for an operation-specific reason",
  INDEX_SIZE_ERR: 1,
  DOMSTRING_SIZE_ERR: 2,
  HIERARCHY_REQUEST_ERR: 3,
  WRONG_DOCUMENT_ERR: 4,
  INVALID_CHARACTER_ERR: 5,
  NO_DATA_ALLOWED_ERR: 6,
  NO_MODIFICATION_ALLOWED_ERR: 7,
  NOT_FOUND_ERR: 8,
  NOT_SUPPORTED_ERR: 9,
  INUSE_ATTRIBUTE_ERR: 10,
  INVALID_STATE_ERR: 11,
  SYNTAX_ERR: 12,
  INVALID_MODIFICATION_ERR: 13,
  NAMESPACE_ERR: 14,
  INVALID_ACCESS_ERR: 15,
  VALIDATION_ERR: 16,
  TYPE_MISMATCH_ERR: 17,
  SECURITY_ERR: 18,
  NETWORK_ERR: 19,
  ABORT_ERR: 20,
  URL_MISMATCH_ERR: 21,
  QUOTA_EXCEEDED_ERR: 22,
  TIMEOUT_ERR: 23,
  INVALID_NODE_TYPE_ERR: 24,
  DATA_CLONE_ERR: 25,
  toString: [Function: toString],
}
      at /home/username/test.js:16

Additional information

No response

[robobun]

✅ Reproduced: wrapKey("jwk", hmacKey, aesKwKey, "AES-KW") throws OperationError because the serialized JWK is not a multiple of 8 bytes (AES-KW/RFC 3394 requires that).

Fix pads the JWK JSON with trailing spaces, matching Node.js → #32616