Browser without crypto API freezes with high CPU usage

Created on 21 August 2024, 4 months ago
Updated 7 September 2024, 3 months ago

Problem/Motivation

If a browser supports the crypto API, OpenPGP.js will use it to generate RSA keys.

However, If a browser does not support crypto API, OpenPGP.js implements a JS-based RSA algoritm for the keys (starting line 12526 of https://unpkg.com/browse/openpgp@5.0.1/dist/openpgp.js). The algorithm has a statement do {...} while (n.bitLength() !== bits);. Even if n has same number of bits as bits, n.bitLength() returns an integer while bits (set by proc module) is a string, so the loop never ends. As a result, the /proc/generate-keys freezes with high CPU usage.
In my case, this happens both in Chrome and Firefox, under Ubuntu 22.04 (probably because the OS is missing some crypto library that the browsers use).

Steps to reproduce

Try to generate keys on a browser without crypto API (i.e. window.crypto.subtle is undefined). If your browser and OS supports it, you can fake it by running window.crypto = {} in DevTools's Console.

Proposed resolution

Convert procKeySize from string to number.

Remaining tasks

None

User interface changes

Nonew

API changes

None

Data model changes

None

🐛 Bug report
Status

Fixed

Version

10.1

Component

Documentation

Created by

🇷🇴Romania abautu

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024