# Web Crypto

avril exposes `crypto`, `Crypto`, `SubtleCrypto`, and `CryptoKey`. Random values
and UUIDs use the operating system's cryptographic random source. SubtleCrypto
implements hashing, key generation/import/export, encryption, signatures,
derivation, and key wrapping.

Implemented algorithm families:

- SHA-1, SHA-256, SHA-384, SHA-512, and HMAC
- AES-CBC, AES-CTR, AES-GCM, and AES-KW
- HKDF and PBKDF2
- RSA-OAEP, RSA-PSS, and RSASSA-PKCS1-v1_5
- ECDSA and ECDH with P-256, P-384, and P-521
- Ed25519 and X25519

Key formats are raw, JWK, SPKI, and PKCS8 where applicable. Native key stores
enforce usages and extractability independently of JavaScript metadata.
Structured cloning preserves key policy without exporting key material. Stores
belong to individual runtime extensions; in-flight jobs retain their keys, and
destroying a runtime releases its store even if JS finalizers never run.

CPU-intensive operations use four process-wide worker threads. Buffer inputs are
snapshotted before asynchronous work. Implementations use maintained RustCrypto
libraries and vendored OpenSSL; RSA private operations use OpenSSL.

## Known deviations

This extension is not yet a claim of full Web Crypto conformance.

- OpenSSL's GCM provider limits IVs to 64 bytes. Longer IVs throw a
  `NotSupportedError` containing `"not yet implemented"`. Normal 12-byte IVs and
  other nonempty IVs up to 64 bytes are supported.
- RSA generation accepts byte-aligned modulus lengths from 512 through 8192
  bits.
- HMAC generation and HMAC derivation currently limit key lengths to 65536 bits.
- Full WebIDL conversion and error-ordering coverage remains part of the
  ECMA-429 conformance audit.