Web Crypto

avril exposes crypto, Crypto, SubtleCrypto, and CryptoKey. Random values and UUIDs use the operating system's cryptographic random source. SubtleCrypto implements hashing, key generation/import/export, encryption, signatures, derivation, and key wrapping.

Implemented algorithm families:

• SHA-1, SHA-256, SHA-384, SHA-512, and HMAC
• AES-CBC, AES-CTR, AES-GCM, and AES-KW
• HKDF and PBKDF2
• RSA-OAEP, RSA-PSS, and RSASSA-PKCS1-v1_5
• ECDSA and ECDH with P-256, P-384, and P-521
• Ed25519 and X25519

Key formats are raw, JWK, SPKI, and PKCS8 where applicable. Native key stores enforce usages and extractability independently of JavaScript metadata. Structured cloning preserves key policy without exporting key material. Stores belong to individual runtime extensions; in-flight jobs retain their keys, and destroying a runtime releases its store even if JS finalizers never run.

CPU-intensive operations use four process-wide worker threads. Buffer inputs are snapshotted before asynchronous work. Implementations use maintained RustCrypto libraries and vendored OpenSSL; RSA private operations use OpenSSL.

Known deviations

This extension is not yet a claim of full Web Crypto conformance.

• OpenSSL's GCM provider limits IVs to 64 bytes. Longer IVs throw a NotSupportedError containing "not yet implemented". Normal 12-byte IVs and other nonempty IVs up to 64 bytes are supported.
• RSA generation accepts byte-aligned modulus lengths from 512 through 8192 bits.
• HMAC generation and HMAC derivation currently limit key lengths to 65536 bits.
• Full WebIDL conversion and error-ordering coverage remains part of the ECMA-429 conformance audit.