From 67d36ca015c8e9d53c5fc622da6df137f879604f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Sun, 10 May 2020 15:37:09 +0000
Subject: [PATCH 1/6] src: rename internal key handles to KeyObjectHandle

---
 lib/internal/crypto/keys.js |  2 +-
 src/env.h                   |  1 +
 src/node_crypto.cc          | 89 ++++++++++++++++++++-----------------
 src/node_crypto.h           | 12 ++---
 4 files changed, 56 insertions(+), 48 deletions(-)

diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index bfb30dda3fd752..09e8f54bfa85d6 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -6,7 +6,7 @@ const {
 } = primordials;
 
 const {
-  KeyObject: KeyObjectHandle,
+  KeyObjectHandle,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
diff --git a/src/env.h b/src/env.h
index ba3306a43347b8..35d1cb2724de88 100644
--- a/src/env.h
+++ b/src/env.h
@@ -486,6 +486,7 @@ constexpr size_t kFsStatsBufferLength =
   V(async_hooks_promise_resolve_function, v8::Function)                        \
   V(buffer_prototype_object, v8::Object)                                       \
   V(crypto_key_object_constructor, v8::Function)                               \
+  V(crypto_key_object_handle_constructor, v8::Function)                        \
   V(domexception_function, v8::Function)                                       \
   V(enhance_fatal_stack_after_inspector, v8::Function)                         \
   V(enhance_fatal_stack_before_inspector, v8::Function)                        \
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index ca394f2e24e4bb..6967f1719d2ef1 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -2925,9 +2925,9 @@ ByteSource ByteSource::NullTerminatedCopy(Environment* env,
                                     : FromString(env, value.As<String>(), true);
 }
 
-ByteSource ByteSource::FromSymmetricKeyObject(Local<Value> handle) {
+ByteSource ByteSource::FromSymmetricKeyObjectHandle(Local<Value> handle) {
   CHECK(handle->IsObject());
-  KeyObject* key = Unwrap<KeyObject>(handle.As<Object>());
+  KeyObjectHandle* key = Unwrap<KeyObjectHandle>(handle.As<Object>());
   CHECK_NOT_NULL(key);
   return Foreign(key->GetSymmetricKey(), key->GetSymmetricKeySize());
 }
@@ -3073,7 +3073,7 @@ static ManagedEVPPKey GetPrivateKeyFromJs(
                         "Failed to read private key");
   } else {
     CHECK(args[*offset]->IsObject() && allow_key_object);
-    KeyObject* key;
+    KeyObjectHandle* key;
     ASSIGN_OR_RETURN_UNWRAP(&key, args[*offset].As<Object>(), ManagedEVPPKey());
     CHECK_EQ(key->GetKeyType(), kKeyTypePrivate);
     (*offset) += 4;
@@ -3133,7 +3133,7 @@ static ManagedEVPPKey GetPublicOrPrivateKeyFromJs(
                         "Failed to read asymmetric key");
   } else {
     CHECK(args[*offset]->IsObject());
-    KeyObject* key = Unwrap<KeyObject>(args[*offset].As<Object>());
+    KeyObjectHandle* key = Unwrap<KeyObjectHandle>(args[*offset].As<Object>());
     CHECK_NOT_NULL(key);
     CHECK_NE(key->GetKeyType(), kKeyTypeSecret);
     (*offset) += 4;
@@ -3243,10 +3243,11 @@ EVP_PKEY* ManagedEVPPKey::get() const {
   return pkey_.get();
 }
 
-Local<Function> KeyObject::Initialize(Environment* env, Local<Object> target) {
+Local<Function> KeyObjectHandle::Initialize(Environment* env,
+                                            Local<Object> target) {
   Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
   t->InstanceTemplate()->SetInternalFieldCount(
-      KeyObject::kInternalFieldCount);
+      KeyObjectHandle::kInternalFieldCount);
   t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", Init);
@@ -3258,25 +3259,25 @@ Local<Function> KeyObject::Initialize(Environment* env, Local<Object> target) {
 
   auto function = t->GetFunction(env->context()).ToLocalChecked();
   target->Set(env->context(),
-              FIXED_ONE_BYTE_STRING(env->isolate(), "KeyObject"),
+              FIXED_ONE_BYTE_STRING(env->isolate(), "KeyObjectHandle"),
               function).Check();
 
   return function;
 }
 
-MaybeLocal<Object> KeyObject::Create(Environment* env,
-                                     KeyType key_type,
-                                     const ManagedEVPPKey& pkey) {
+MaybeLocal<Object> KeyObjectHandle::Create(Environment* env,
+                                           KeyType key_type,
+                                           const ManagedEVPPKey& pkey) {
   CHECK_NE(key_type, kKeyTypeSecret);
   Local<Value> type = Integer::New(env->isolate(), key_type);
   Local<Object> obj;
-  if (!env->crypto_key_object_constructor()
+  if (!env->crypto_key_object_handle_constructor()
            ->NewInstance(env->context(), 1, &type)
            .ToLocal(&obj)) {
     return MaybeLocal<Object>();
   }
 
-  KeyObject* key = Unwrap<KeyObject>(obj);
+  KeyObjectHandle* key = Unwrap<KeyObjectHandle>(obj);
   CHECK_NOT_NULL(key);
   if (key_type == kKeyTypePublic)
     key->InitPublic(pkey);
@@ -3285,44 +3286,44 @@ MaybeLocal<Object> KeyObject::Create(Environment* env,
   return obj;
 }
 
-ManagedEVPPKey KeyObject::GetAsymmetricKey() const {
+ManagedEVPPKey KeyObjectHandle::GetAsymmetricKey() const {
   CHECK_NE(key_type_, kKeyTypeSecret);
   return this->asymmetric_key_;
 }
 
-const char* KeyObject::GetSymmetricKey() const {
+const char* KeyObjectHandle::GetSymmetricKey() const {
   CHECK_EQ(key_type_, kKeyTypeSecret);
   return this->symmetric_key_.get();
 }
 
-size_t KeyObject::GetSymmetricKeySize() const {
+size_t KeyObjectHandle::GetSymmetricKeySize() const {
   CHECK_EQ(key_type_, kKeyTypeSecret);
   return this->symmetric_key_len_;
 }
 
-void KeyObject::New(const FunctionCallbackInfo<Value>& args) {
+void KeyObjectHandle::New(const FunctionCallbackInfo<Value>& args) {
   CHECK(args.IsConstructCall());
   CHECK(args[0]->IsInt32());
   KeyType key_type = static_cast<KeyType>(args[0].As<Uint32>()->Value());
   Environment* env = Environment::GetCurrent(args);
-  new KeyObject(env, args.This(), key_type);
+  new KeyObjectHandle(env, args.This(), key_type);
 }
 
-KeyType KeyObject::GetKeyType() const {
+KeyType KeyObjectHandle::GetKeyType() const {
   return this->key_type_;
 }
 
-KeyObject::KeyObject(Environment* env,
-                     Local<Object> wrap,
-                     KeyType key_type)
+KeyObjectHandle::KeyObjectHandle(Environment* env,
+                                 Local<Object> wrap,
+                                 KeyType key_type)
     : BaseObject(env, wrap),
       key_type_(key_type),
       symmetric_key_(nullptr, nullptr) {
   MakeWeak();
 }
 
-void KeyObject::Init(const FunctionCallbackInfo<Value>& args) {
-  KeyObject* key;
+void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
+  KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
@@ -3358,7 +3359,7 @@ void KeyObject::Init(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-void KeyObject::InitSecret(Local<ArrayBufferView> abv) {
+void KeyObjectHandle::InitSecret(Local<ArrayBufferView> abv) {
   CHECK_EQ(this->key_type_, kKeyTypeSecret);
 
   size_t key_len = abv->ByteLength();
@@ -3371,19 +3372,19 @@ void KeyObject::InitSecret(Local<ArrayBufferView> abv) {
   this->symmetric_key_len_ = key_len;
 }
 
-void KeyObject::InitPublic(const ManagedEVPPKey& pkey) {
+void KeyObjectHandle::InitPublic(const ManagedEVPPKey& pkey) {
   CHECK_EQ(this->key_type_, kKeyTypePublic);
   CHECK(pkey);
   this->asymmetric_key_ = pkey;
 }
 
-void KeyObject::InitPrivate(const ManagedEVPPKey& pkey) {
+void KeyObjectHandle::InitPrivate(const ManagedEVPPKey& pkey) {
   CHECK_EQ(this->key_type_, kKeyTypePrivate);
   CHECK(pkey);
   this->asymmetric_key_ = pkey;
 }
 
-Local<Value> KeyObject::GetAsymmetricKeyType() const {
+Local<Value> KeyObjectHandle::GetAsymmetricKeyType() const {
   CHECK_NE(this->key_type_, kKeyTypeSecret);
   switch (EVP_PKEY_id(this->asymmetric_key_.get())) {
   case EVP_PKEY_RSA:
@@ -3409,21 +3410,23 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
   }
 }
 
-void KeyObject::GetAsymmetricKeyType(const FunctionCallbackInfo<Value>& args) {
-  KeyObject* key;
+void KeyObjectHandle::GetAsymmetricKeyType(
+    const FunctionCallbackInfo<Value>& args) {
+  KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
 
   args.GetReturnValue().Set(key->GetAsymmetricKeyType());
 }
 
-void KeyObject::GetSymmetricKeySize(const FunctionCallbackInfo<Value>& args) {
-  KeyObject* key;
+void KeyObjectHandle::GetSymmetricKeySize(
+    const FunctionCallbackInfo<Value>& args) {
+  KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
   args.GetReturnValue().Set(static_cast<uint32_t>(key->GetSymmetricKeySize()));
 }
 
-void KeyObject::Export(const FunctionCallbackInfo<Value>& args) {
-  KeyObject* key;
+void KeyObjectHandle::Export(const FunctionCallbackInfo<Value>& args) {
+  KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
 
   MaybeLocal<Value> result;
@@ -3450,17 +3453,17 @@ void KeyObject::Export(const FunctionCallbackInfo<Value>& args) {
     args.GetReturnValue().Set(result.ToLocalChecked());
 }
 
-Local<Value> KeyObject::ExportSecretKey() const {
+Local<Value> KeyObjectHandle::ExportSecretKey() const {
   return Buffer::Copy(env(), symmetric_key_.get(), symmetric_key_len_)
       .ToLocalChecked();
 }
 
-MaybeLocal<Value> KeyObject::ExportPublicKey(
+MaybeLocal<Value> KeyObjectHandle::ExportPublicKey(
     const PublicKeyEncodingConfig& config) const {
   return WritePublicKey(env(), asymmetric_key_.get(), config);
 }
 
-MaybeLocal<Value> KeyObject::ExportPrivateKey(
+MaybeLocal<Value> KeyObjectHandle::ExportPrivateKey(
     const PrivateKeyEncodingConfig& config) const {
   return WritePrivateKey(env(), asymmetric_key_.get(), config);
 }
@@ -3663,7 +3666,7 @@ static ByteSource GetSecretKeyBytes(Environment* env, Local<Value> value) {
   // in JS to avoid creating an unprotected copy on the heap.
   return value->IsString() || Buffer::HasInstance(value) ?
            ByteSource::FromStringOrBuffer(env, value) :
-           ByteSource::FromSymmetricKeyObject(value);
+           ByteSource::FromSymmetricKeyObjectHandle(value);
 }
 
 void CipherBase::InitIv(const FunctionCallbackInfo<Value>& args) {
@@ -6277,7 +6280,8 @@ class GenerateKeyPairJob : public CryptoJob {
     if (public_key_encoding_.output_key_object_) {
       // Note that this has the downside of containing sensitive data of the
       // private key.
-      if (!KeyObject::Create(env(), kKeyTypePublic, pkey_).ToLocal(pubkey))
+      if (!KeyObjectHandle::Create(env(), kKeyTypePublic, pkey_)
+               .ToLocal(pubkey))
         return false;
     } else {
       if (!WritePublicKey(env(), pkey_.get(), public_key_encoding_)
@@ -6287,7 +6291,7 @@ class GenerateKeyPairJob : public CryptoJob {
 
     // Now do the same for the private key.
     if (private_key_encoding_.output_key_object_) {
-      if (!KeyObject::Create(env(), kKeyTypePrivate, pkey_)
+      if (!KeyObjectHandle::Create(env(), kKeyTypePrivate, pkey_)
               .ToLocal(privkey))
         return false;
     } else {
@@ -6731,10 +6735,10 @@ void StatelessDiffieHellman(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
   CHECK(args[0]->IsObject() && args[1]->IsObject());
-  KeyObject* our_key_object;
+  KeyObjectHandle* our_key_object;
   ASSIGN_OR_RETURN_UNWRAP(&our_key_object, args[0].As<Object>());
   CHECK_EQ(our_key_object->GetKeyType(), kKeyTypePrivate);
-  KeyObject* their_key_object;
+  KeyObjectHandle* their_key_object;
   ASSIGN_OR_RETURN_UNWRAP(&their_key_object, args[1].As<Object>());
   CHECK_NE(their_key_object->GetKeyType(), kKeyTypeSecret);
 
@@ -6865,7 +6869,8 @@ void Initialize(Local<Object> target,
 
   Environment* env = Environment::GetCurrent(context);
   SecureContext::Initialize(env, target);
-  env->set_crypto_key_object_constructor(KeyObject::Initialize(env, target));
+  env->set_crypto_key_object_handle_constructor(
+      KeyObjectHandle::Initialize(env, target));
   CipherBase::Initialize(env, target);
   DiffieHellman::Initialize(env, target);
   ECDH::Initialize(env, target);
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 1eea1239f1956d..b3f3c2133c0ba4 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -343,7 +343,7 @@ class ByteSource {
   static ByteSource NullTerminatedCopy(Environment* env,
                                        v8::Local<v8::Value> value);
 
-  static ByteSource FromSymmetricKeyObject(v8::Local<v8::Value> handle);
+  static ByteSource FromSymmetricKeyObjectHandle(v8::Local<v8::Value> handle);
 
   ByteSource(const ByteSource&) = delete;
   ByteSource& operator=(const ByteSource&) = delete;
@@ -408,7 +408,7 @@ class ManagedEVPPKey {
   EVPKeyPointer pkey_;
 };
 
-class KeyObject : public BaseObject {
+class KeyObjectHandle : public BaseObject {
  public:
   static v8::Local<v8::Function> Initialize(Environment* env,
                                             v8::Local<v8::Object> target);
@@ -419,8 +419,8 @@ class KeyObject : public BaseObject {
 
   // TODO(tniessen): track the memory used by OpenSSL types
   SET_NO_MEMORY_INFO()
-  SET_MEMORY_INFO_NAME(KeyObject)
-  SET_SELF_SIZE(KeyObject)
+  SET_MEMORY_INFO_NAME(KeyObjectHandle)
+  SET_SELF_SIZE(KeyObjectHandle)
 
   KeyType GetKeyType() const;
 
@@ -452,7 +452,9 @@ class KeyObject : public BaseObject {
   v8::MaybeLocal<v8::Value> ExportPrivateKey(
       const PrivateKeyEncodingConfig& config) const;
 
-  KeyObject(Environment* env, v8::Local<v8::Object> wrap, KeyType key_type);
+  KeyObjectHandle(Environment* env,
+                  v8::Local<v8::Object> wrap,
+                  KeyType key_type);
 
  private:
   const KeyType key_type_;

From be4f6868d047cb0a2e1e1ddeecd7914fee8e234d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Sun, 10 May 2020 18:09:18 +0000
Subject: [PATCH 2/6] src: add NativeKeyObject base class

             +---------------------+
             |     BaseObject      |
             +---------------------+
                        |
                        |
                        |
             +---------------------+
             |   NativeKeyObject   |
             +---------------------+
                        |
                        |
                        |
             +---------------------+
             |      KeyObject      |
             +---------------------+
               /                 \
              /                   \
             /                     \
            /                       \
+---------------------+    +---------------------+
|   SecretKeyObject   |    | AsymmetricKeyObject |
+---------------------+    +---------------------+
                             /                 \
                            /                   \
                           /                     \
                          /                       \
              +---------------------+   +---------------------+
              |   PublicKeyObject   |   |   PrivateKeyObject  |
              +---------------------+   +---------------------+
---
 lib/internal/crypto/keys.js | 135 ++++++++++++++++++++----------------
 src/node_crypto.cc          |  27 ++++++++
 src/node_crypto.h           |   9 +++
 3 files changed, 112 insertions(+), 59 deletions(-)

diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 09e8f54bfa85d6..99cff1891b0b01 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -7,6 +7,7 @@ const {
 
 const {
   KeyObjectHandle,
+  createNativeKeyObjectClass,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
@@ -42,80 +43,96 @@ for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
                  [kKeyEncodingSPKI, 'spki'], [kKeyEncodingSEC1, 'sec1']])
   encodingNames[m[0]] = m[1];
 
-class KeyObject {
-  constructor(type, handle) {
-    if (type !== 'secret' && type !== 'public' && type !== 'private')
-      throw new ERR_INVALID_ARG_VALUE('type', type);
-    if (typeof handle !== 'object')
-      throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
-
-    this[kKeyType] = type;
-
-    ObjectDefineProperty(this, kHandle, {
-      value: handle,
-      enumerable: false,
-      configurable: false,
-      writable: false
-    });
-  }
+// Creating the KeyObject class is a little complicated due to inheritance
+// and that fact that KeyObjects should be transferrable between threads,
+// which requires the KeyObject base class to be implemented in C++.
+// The creation requires a callback to make sure that the NativeKeyObject
+// base class cannot exist without the other KeyObject implementations.
+const [
+  KeyObject,
+  SecretKeyObject,
+  PublicKeyObject,
+  PrivateKeyObject
+] = createNativeKeyObjectClass((NativeKeyObject) => {
+  // Publicly visible KeyObject class.
+  class KeyObject extends NativeKeyObject {
+    constructor(type, handle) {
+      super();
+      if (type !== 'secret' && type !== 'public' && type !== 'private')
+        throw new ERR_INVALID_ARG_VALUE('type', type);
+      if (typeof handle !== 'object')
+        throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
+
+      this[kKeyType] = type;
+
+      ObjectDefineProperty(this, kHandle, {
+        value: handle,
+        enumerable: false,
+        configurable: false,
+        writable: false
+      });
+    }
 
-  get type() {
-    return this[kKeyType];
+    get type() {
+      return this[kKeyType];
+    }
   }
-}
 
-class SecretKeyObject extends KeyObject {
-  constructor(handle) {
-    super('secret', handle);
-  }
+  class SecretKeyObject extends KeyObject {
+    constructor(handle) {
+      super('secret', handle);
+    }
 
-  get symmetricKeySize() {
-    return this[kHandle].getSymmetricKeySize();
-  }
+    get symmetricKeySize() {
+      return this[kHandle].getSymmetricKeySize();
+    }
 
-  export() {
-    return this[kHandle].export();
+    export() {
+      return this[kHandle].export();
+    }
   }
-}
 
-const kAsymmetricKeyType = Symbol('kAsymmetricKeyType');
+  const kAsymmetricKeyType = Symbol('kAsymmetricKeyType');
 
-class AsymmetricKeyObject extends KeyObject {
-  get asymmetricKeyType() {
-    return this[kAsymmetricKeyType] ||
-           (this[kAsymmetricKeyType] = this[kHandle].getAsymmetricKeyType());
+  class AsymmetricKeyObject extends KeyObject {
+    get asymmetricKeyType() {
+      return this[kAsymmetricKeyType] ||
+             (this[kAsymmetricKeyType] = this[kHandle].getAsymmetricKeyType());
+    }
   }
-}
 
-class PublicKeyObject extends AsymmetricKeyObject {
-  constructor(handle) {
-    super('public', handle);
-  }
+  class PublicKeyObject extends AsymmetricKeyObject {
+    constructor(handle) {
+      super('public', handle);
+    }
 
-  export(encoding) {
-    const {
-      format,
-      type
-    } = parsePublicKeyEncoding(encoding, this.asymmetricKeyType);
-    return this[kHandle].export(format, type);
+    export(encoding) {
+      const {
+        format,
+        type
+      } = parsePublicKeyEncoding(encoding, this.asymmetricKeyType);
+      return this[kHandle].export(format, type);
+    }
   }
-}
 
-class PrivateKeyObject extends AsymmetricKeyObject {
-  constructor(handle) {
-    super('private', handle);
-  }
+  class PrivateKeyObject extends AsymmetricKeyObject {
+    constructor(handle) {
+      super('private', handle);
+    }
 
-  export(encoding) {
-    const {
-      format,
-      type,
-      cipher,
-      passphrase
-    } = parsePrivateKeyEncoding(encoding, this.asymmetricKeyType);
-    return this[kHandle].export(format, type, cipher, passphrase);
+    export(encoding) {
+      const {
+        format,
+        type,
+        cipher,
+        passphrase
+      } = parsePrivateKeyEncoding(encoding, this.asymmetricKeyType);
+      return this[kHandle].export(format, type, cipher, passphrase);
+    }
   }
-}
+
+  return [KeyObject, SecretKeyObject, PublicKeyObject, PrivateKeyObject];
+});
 
 function parseKeyFormat(formatStr, defaultFormat, optionName) {
   if (formatStr === undefined && defaultFormat !== undefined)
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 6967f1719d2ef1..42cfe138c32d9a 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -3468,6 +3468,31 @@ MaybeLocal<Value> KeyObjectHandle::ExportPrivateKey(
   return WritePrivateKey(env(), asymmetric_key_.get(), config);
 }
 
+void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK_EQ(args.Length(), 0);
+}
+
+static void CreateNativeKeyObjectClass(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+
+  CHECK_EQ(args.Length(), 1);
+  Local<Value> callback = args[0];
+  CHECK(callback->IsFunction());
+
+  Local<FunctionTemplate> t = env->NewFunctionTemplate(NativeKeyObject::New);
+  t->InstanceTemplate()->SetInternalFieldCount(
+      KeyObjectHandle::kInternalFieldCount);
+
+  Local<Value> ctor = t->GetFunction(env->context()).ToLocalChecked();
+
+  Local<Value> recv = Undefined(env->isolate());
+  Local<Value> ret =
+      callback.As<Function>()->Call(env->context(), recv, 1, &ctor)
+      .ToLocalChecked();
+  args.GetReturnValue().Set(ret);
+}
+
 CipherBase::CipherBase(Environment* env,
                        Local<Object> wrap,
                        CipherKind kind)
@@ -6871,6 +6896,8 @@ void Initialize(Local<Object> target,
   SecureContext::Initialize(env, target);
   env->set_crypto_key_object_handle_constructor(
       KeyObjectHandle::Initialize(env, target));
+  env->SetMethod(target, "createNativeKeyObjectClass",
+                 CreateNativeKeyObjectClass);
   CipherBase::Initialize(env, target);
   DiffieHellman::Initialize(env, target);
   ECDH::Initialize(env, target);
diff --git a/src/node_crypto.h b/src/node_crypto.h
index b3f3c2133c0ba4..f95ea64e973007 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -463,6 +463,15 @@ class KeyObjectHandle : public BaseObject {
   ManagedEVPPKey asymmetric_key_;
 };
 
+class NativeKeyObject : public BaseObject {
+ public:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(NativeKeyObject)
+  SET_SELF_SIZE(NativeKeyObject)
+};
+
 class CipherBase : public BaseObject {
  public:
   static void Initialize(Environment* env, v8::Local<v8::Object> target);

From 023856d907a6155a43d5ca4870cf2159faae66a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Mon, 11 May 2020 13:05:38 +0000
Subject: [PATCH 3/6] src: store key data in separate class

This separates key handles from the actual key data:

+-----------------+
| NativeKeyObject |
+-----------------+
        ^
     extends
        |
+-----------------+    +-----------------+    +---------------+
| KeyObject  (JS) | -> | KeyObjectHandle | -> | KeyObjectData |
+-----------------+    +-----------------+    +---------------+
---
 lib/internal/crypto/keys.js |  12 +--
 src/node_crypto.cc          | 169 ++++++++++++++++++------------------
 src/node_crypto.h           |  40 +++++----
 3 files changed, 116 insertions(+), 105 deletions(-)

diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 99cff1891b0b01..61d3859553230d 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -331,23 +331,23 @@ function createSecretKey(key) {
   key = prepareSecretKey(key, true);
   if (key.byteLength === 0)
     throw new ERR_OUT_OF_RANGE('key.byteLength', '> 0', key.byteLength);
-  const handle = new KeyObjectHandle(kKeyTypeSecret);
-  handle.init(key);
+  const handle = new KeyObjectHandle();
+  handle.init(kKeyTypeSecret, key);
   return new SecretKeyObject(handle);
 }
 
 function createPublicKey(key) {
   const { format, type, data } = prepareAsymmetricKey(key, kCreatePublic);
-  const handle = new KeyObjectHandle(kKeyTypePublic);
-  handle.init(data, format, type);
+  const handle = new KeyObjectHandle();
+  handle.init(kKeyTypePublic, data, format, type);
   return new PublicKeyObject(handle);
 }
 
 function createPrivateKey(key) {
   const { format, type, data, passphrase } =
     prepareAsymmetricKey(key, kCreatePrivate);
-  const handle = new KeyObjectHandle(kKeyTypePrivate);
-  handle.init(data, format, type, passphrase);
+  const handle = new KeyObjectHandle();
+  handle.init(kKeyTypePrivate, data, format, type, passphrase);
   return new PrivateKeyObject(handle);
 }
 
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 42cfe138c32d9a..57c4764e39d0af 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -2929,7 +2929,8 @@ ByteSource ByteSource::FromSymmetricKeyObjectHandle(Local<Value> handle) {
   CHECK(handle->IsObject());
   KeyObjectHandle* key = Unwrap<KeyObjectHandle>(handle.As<Object>());
   CHECK_NOT_NULL(key);
-  return Foreign(key->GetSymmetricKey(), key->GetSymmetricKeySize());
+  return Foreign(key->Data()->GetSymmetricKey(),
+                 key->Data()->GetSymmetricKeySize());
 }
 
 ByteSource::ByteSource(const char* data, char* allocated_data, size_t size)
@@ -3075,9 +3076,9 @@ static ManagedEVPPKey GetPrivateKeyFromJs(
     CHECK(args[*offset]->IsObject() && allow_key_object);
     KeyObjectHandle* key;
     ASSIGN_OR_RETURN_UNWRAP(&key, args[*offset].As<Object>(), ManagedEVPPKey());
-    CHECK_EQ(key->GetKeyType(), kKeyTypePrivate);
+    CHECK_EQ(key->Data()->GetKeyType(), kKeyTypePrivate);
     (*offset) += 4;
-    return key->GetAsymmetricKey();
+    return key->Data()->GetAsymmetricKey();
   }
 }
 
@@ -3135,9 +3136,9 @@ static ManagedEVPPKey GetPublicOrPrivateKeyFromJs(
     CHECK(args[*offset]->IsObject());
     KeyObjectHandle* key = Unwrap<KeyObjectHandle>(args[*offset].As<Object>());
     CHECK_NOT_NULL(key);
-    CHECK_NE(key->GetKeyType(), kKeyTypeSecret);
+    CHECK_NE(key->Data()->GetKeyType(), kKeyTypeSecret);
     (*offset) += 4;
-    return key->GetAsymmetricKey();
+    return key->Data()->GetAsymmetricKey();
   }
 }
 
@@ -3243,6 +3244,48 @@ EVP_PKEY* ManagedEVPPKey::get() const {
   return pkey_.get();
 }
 
+KeyObjectData* KeyObjectData::CreateSecret(v8::Local<v8::ArrayBufferView> abv) {
+  size_t key_len = abv->ByteLength();
+  char* mem = MallocOpenSSL<char>(key_len);
+  abv->CopyContents(mem, key_len);
+  KeyObjectData* data = new KeyObjectData();
+  data->key_type_ = kKeyTypeSecret;
+  data->symmetric_key_ = std::unique_ptr<char, std::function<void(char*)>>(mem,
+          [key_len](char* p) {
+            OPENSSL_clear_free(p, key_len);
+          });
+  data->symmetric_key_len_ = key_len;
+  return data;
+}
+
+KeyObjectData* KeyObjectData::CreateAsymmetric(KeyType key_type,
+                                               const ManagedEVPPKey& pkey) {
+  CHECK(pkey);
+  KeyObjectData* data = new KeyObjectData();
+  data->key_type_ = key_type;
+  data->asymmetric_key_ = pkey;
+  return data;
+}
+
+KeyType KeyObjectData::GetKeyType() const {
+  return key_type_;
+}
+
+ManagedEVPPKey KeyObjectData::GetAsymmetricKey() const {
+  CHECK_NE(key_type_, kKeyTypeSecret);
+  return asymmetric_key_;
+}
+
+const char* KeyObjectData::GetSymmetricKey() const {
+  CHECK_EQ(key_type_, kKeyTypeSecret);
+  return symmetric_key_.get();
+}
+
+size_t KeyObjectData::GetSymmetricKeySize() const {
+  CHECK_EQ(key_type_, kKeyTypeSecret);
+  return symmetric_key_len_;
+}
+
 Local<Function> KeyObjectHandle::Initialize(Environment* env,
                                             Local<Object> target) {
   Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
@@ -3279,46 +3322,23 @@ MaybeLocal<Object> KeyObjectHandle::Create(Environment* env,
 
   KeyObjectHandle* key = Unwrap<KeyObjectHandle>(obj);
   CHECK_NOT_NULL(key);
-  if (key_type == kKeyTypePublic)
-    key->InitPublic(pkey);
-  else
-    key->InitPrivate(pkey);
+  key->data_.reset(KeyObjectData::CreateAsymmetric(key_type, pkey));
   return obj;
 }
 
-ManagedEVPPKey KeyObjectHandle::GetAsymmetricKey() const {
-  CHECK_NE(key_type_, kKeyTypeSecret);
-  return this->asymmetric_key_;
-}
-
-const char* KeyObjectHandle::GetSymmetricKey() const {
-  CHECK_EQ(key_type_, kKeyTypeSecret);
-  return this->symmetric_key_.get();
-}
-
-size_t KeyObjectHandle::GetSymmetricKeySize() const {
-  CHECK_EQ(key_type_, kKeyTypeSecret);
-  return this->symmetric_key_len_;
+const KeyObjectData* KeyObjectHandle::Data() {
+  return data_.get();
 }
 
 void KeyObjectHandle::New(const FunctionCallbackInfo<Value>& args) {
   CHECK(args.IsConstructCall());
-  CHECK(args[0]->IsInt32());
-  KeyType key_type = static_cast<KeyType>(args[0].As<Uint32>()->Value());
   Environment* env = Environment::GetCurrent(args);
-  new KeyObjectHandle(env, args.This(), key_type);
-}
-
-KeyType KeyObjectHandle::GetKeyType() const {
-  return this->key_type_;
+  new KeyObjectHandle(env, args.This());
 }
 
 KeyObjectHandle::KeyObjectHandle(Environment* env,
-                                 Local<Object> wrap,
-                                 KeyType key_type)
-    : BaseObject(env, wrap),
-      key_type_(key_type),
-      symmetric_key_(nullptr, nullptr) {
+                                 Local<Object> wrap)
+    : BaseObject(env, wrap) {
   MakeWeak();
 }
 
@@ -3327,66 +3347,45 @@ void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
+  CHECK(args[0]->IsInt32());
+  KeyType type = static_cast<KeyType>(args[0].As<Uint32>()->Value());
+
   unsigned int offset;
   ManagedEVPPKey pkey;
 
-  switch (key->key_type_) {
+  switch (type) {
   case kKeyTypeSecret:
-    CHECK_EQ(args.Length(), 1);
-    CHECK(args[0]->IsArrayBufferView());
-    key->InitSecret(args[0].As<ArrayBufferView>());
+    CHECK_EQ(args.Length(), 2);
+    CHECK(args[1]->IsArrayBufferView());
+    key->data_.reset(
+        KeyObjectData::CreateSecret(args[1].As<ArrayBufferView>()));
     break;
   case kKeyTypePublic:
-    CHECK_EQ(args.Length(), 3);
+    CHECK_EQ(args.Length(), 4);
 
-    offset = 0;
+    offset = 1;
     pkey = GetPublicOrPrivateKeyFromJs(args, &offset);
     if (!pkey)
       return;
-    key->InitPublic(pkey);
+    key->data_.reset(KeyObjectData::CreateAsymmetric(type, pkey));
     break;
   case kKeyTypePrivate:
-    CHECK_EQ(args.Length(), 4);
+    CHECK_EQ(args.Length(), 5);
 
-    offset = 0;
+    offset = 1;
     pkey = GetPrivateKeyFromJs(args, &offset, false);
     if (!pkey)
       return;
-    key->InitPrivate(pkey);
+    key->data_.reset(KeyObjectData::CreateAsymmetric(type, pkey));
     break;
   default:
     CHECK(false);
   }
 }
 
-void KeyObjectHandle::InitSecret(Local<ArrayBufferView> abv) {
-  CHECK_EQ(this->key_type_, kKeyTypeSecret);
-
-  size_t key_len = abv->ByteLength();
-  char* mem = MallocOpenSSL<char>(key_len);
-  abv->CopyContents(mem, key_len);
-  this->symmetric_key_ = std::unique_ptr<char, std::function<void(char*)>>(mem,
-      [key_len](char* p) {
-        OPENSSL_clear_free(p, key_len);
-      });
-  this->symmetric_key_len_ = key_len;
-}
-
-void KeyObjectHandle::InitPublic(const ManagedEVPPKey& pkey) {
-  CHECK_EQ(this->key_type_, kKeyTypePublic);
-  CHECK(pkey);
-  this->asymmetric_key_ = pkey;
-}
-
-void KeyObjectHandle::InitPrivate(const ManagedEVPPKey& pkey) {
-  CHECK_EQ(this->key_type_, kKeyTypePrivate);
-  CHECK(pkey);
-  this->asymmetric_key_ = pkey;
-}
-
 Local<Value> KeyObjectHandle::GetAsymmetricKeyType() const {
-  CHECK_NE(this->key_type_, kKeyTypeSecret);
-  switch (EVP_PKEY_id(this->asymmetric_key_.get())) {
+  const ManagedEVPPKey& key = data_->GetAsymmetricKey();
+  switch (EVP_PKEY_id(key.get())) {
   case EVP_PKEY_RSA:
     return env()->crypto_rsa_string();
   case EVP_PKEY_RSA_PSS:
@@ -3422,24 +3421,27 @@ void KeyObjectHandle::GetSymmetricKeySize(
     const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
-  args.GetReturnValue().Set(static_cast<uint32_t>(key->GetSymmetricKeySize()));
+  args.GetReturnValue().Set(
+      static_cast<uint32_t>(key->Data()->GetSymmetricKeySize()));
 }
 
 void KeyObjectHandle::Export(const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
 
+  KeyType type = key->Data()->GetKeyType();
+
   MaybeLocal<Value> result;
-  if (key->key_type_ == kKeyTypeSecret) {
+  if (type == kKeyTypeSecret) {
     result = key->ExportSecretKey();
-  } else if (key->key_type_ == kKeyTypePublic) {
+  } else if (type == kKeyTypePublic) {
     unsigned int offset = 0;
     PublicKeyEncodingConfig config =
         GetPublicKeyEncodingFromJs(args, &offset, kKeyContextExport);
     CHECK_EQ(offset, static_cast<unsigned int>(args.Length()));
     result = key->ExportPublicKey(config);
   } else {
-    CHECK_EQ(key->key_type_, kKeyTypePrivate);
+    CHECK_EQ(type, kKeyTypePrivate);
     unsigned int offset = 0;
     NonCopyableMaybe<PrivateKeyEncodingConfig> config =
         GetPrivateKeyEncodingFromJs(args, &offset, kKeyContextExport);
@@ -3454,18 +3456,19 @@ void KeyObjectHandle::Export(const FunctionCallbackInfo<Value>& args) {
 }
 
 Local<Value> KeyObjectHandle::ExportSecretKey() const {
-  return Buffer::Copy(env(), symmetric_key_.get(), symmetric_key_len_)
-      .ToLocalChecked();
+  const char* buf = data_->GetSymmetricKey();
+  unsigned int len = data_->GetSymmetricKeySize();
+  return Buffer::Copy(env(), buf, len).ToLocalChecked();
 }
 
 MaybeLocal<Value> KeyObjectHandle::ExportPublicKey(
     const PublicKeyEncodingConfig& config) const {
-  return WritePublicKey(env(), asymmetric_key_.get(), config);
+  return WritePublicKey(env(), data_->GetAsymmetricKey().get(), config);
 }
 
 MaybeLocal<Value> KeyObjectHandle::ExportPrivateKey(
     const PrivateKeyEncodingConfig& config) const {
-  return WritePrivateKey(env(), asymmetric_key_.get(), config);
+  return WritePrivateKey(env(), data_->GetAsymmetricKey().get(), config);
 }
 
 void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
@@ -6762,13 +6765,13 @@ void StatelessDiffieHellman(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsObject() && args[1]->IsObject());
   KeyObjectHandle* our_key_object;
   ASSIGN_OR_RETURN_UNWRAP(&our_key_object, args[0].As<Object>());
-  CHECK_EQ(our_key_object->GetKeyType(), kKeyTypePrivate);
+  CHECK_EQ(our_key_object->Data()->GetKeyType(), kKeyTypePrivate);
   KeyObjectHandle* their_key_object;
   ASSIGN_OR_RETURN_UNWRAP(&their_key_object, args[1].As<Object>());
-  CHECK_NE(their_key_object->GetKeyType(), kKeyTypeSecret);
+  CHECK_NE(their_key_object->Data()->GetKeyType(), kKeyTypeSecret);
 
-  ManagedEVPPKey our_key = our_key_object->GetAsymmetricKey();
-  ManagedEVPPKey their_key = their_key_object->GetAsymmetricKey();
+  ManagedEVPPKey our_key = our_key_object->Data()->GetAsymmetricKey();
+  ManagedEVPPKey their_key = their_key_object->Data()->GetAsymmetricKey();
 
   AllocatedBuffer out = StatelessDiffieHellman(env, our_key, their_key);
   if (out.size() == 0)
diff --git a/src/node_crypto.h b/src/node_crypto.h
index f95ea64e973007..9aaa188baa99ec 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -408,6 +408,27 @@ class ManagedEVPPKey {
   EVPKeyPointer pkey_;
 };
 
+class KeyObjectData {
+ public:
+  static KeyObjectData* CreateSecret(v8::Local<v8::ArrayBufferView> abv);
+  static KeyObjectData* CreateAsymmetric(KeyType type,
+                                         const ManagedEVPPKey& pkey);
+
+  KeyType GetKeyType() const;
+
+  // These functions allow unprotected access to the raw key material and should
+  // only be used to implement cryptograohic operations requiring the key.
+  ManagedEVPPKey GetAsymmetricKey() const;
+  const char* GetSymmetricKey() const;
+  size_t GetSymmetricKeySize() const;
+
+ private:
+  KeyType key_type_;
+  std::unique_ptr<char, std::function<void(char*)>> symmetric_key_;
+  unsigned int symmetric_key_len_;
+  ManagedEVPPKey asymmetric_key_;
+};
+
 class KeyObjectHandle : public BaseObject {
  public:
   static v8::Local<v8::Function> Initialize(Environment* env,
@@ -422,21 +443,12 @@ class KeyObjectHandle : public BaseObject {
   SET_MEMORY_INFO_NAME(KeyObjectHandle)
   SET_SELF_SIZE(KeyObjectHandle)
 
-  KeyType GetKeyType() const;
-
-  // These functions allow unprotected access to the raw key material and should
-  // only be used to implement cryptograohic operations requiring the key.
-  ManagedEVPPKey GetAsymmetricKey() const;
-  const char* GetSymmetricKey() const;
-  size_t GetSymmetricKeySize() const;
+  const KeyObjectData* Data();
 
  protected:
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void Init(const v8::FunctionCallbackInfo<v8::Value>& args);
-  void InitSecret(v8::Local<v8::ArrayBufferView> abv);
-  void InitPublic(const ManagedEVPPKey& pkey);
-  void InitPrivate(const ManagedEVPPKey& pkey);
 
   static void GetAsymmetricKeyType(
       const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -453,14 +465,10 @@ class KeyObjectHandle : public BaseObject {
       const PrivateKeyEncodingConfig& config) const;
 
   KeyObjectHandle(Environment* env,
-                  v8::Local<v8::Object> wrap,
-                  KeyType key_type);
+                  v8::Local<v8::Object> wrap);
 
  private:
-  const KeyType key_type_;
-  std::unique_ptr<char, std::function<void(char*)>> symmetric_key_;
-  unsigned int symmetric_key_len_;
-  ManagedEVPPKey asymmetric_key_;
+  std::unique_ptr<KeyObjectData> data_;
 };
 
 class NativeKeyObject : public BaseObject {

From 43a87c7262b38ed99a43bbf5015298fd92e9eca0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Mon, 11 May 2020 17:55:37 +0000
Subject: [PATCH 4/6] crypto: allow KeyObjects in postMessage

This change allows sharing KeyObjects between threads via postMessage.
The receiver acquires a new KeyObject and a new KeyObjectHandle, but
refers to the same KeyObjectData:

+-------------------+
| NativeKeyObject 1 | ------------------------------------------+
+-------------------+                                           |
        ^                                                       |
     extends                                                    |
        |                                                       |
+-------------------+    +-------------------+                  |
| KeyObject 1  (JS) | -> | KeyObjectHandle 1 | --------------+  |
+-------------------+    +-------------------+               |  |
                                                             |  |
                                                             |  |
                                                             |  |
                                                             |  |
                                                             |  |
+-------------------+                                        |  |
| NativeKeyObject 2 | ------------------------------------+  |  |
+-------------------+                                     |  |  |
        ^                                                 |  |  |
     extends                                              |  |  |
        |                                                 |  |  |
+-------------------+    +-------------------+            |  |  |
| KeyObject 2  (JS) | -> | KeyObjectHandle 2 | --------+  |  |  |
+-------------------+    +-------------------+         |  |  |  |
                                                       |  |  |  |
                                                       |  |  |  |
                                                       |  |  |  |
                                                       |  |  |  |
                                                       |  |  |  |
+-------------------+                                  |  |  |  |
| NativeKeyObject 3 | ------------------------------+  |  |  |  |
+-------------------+                               |  |  |  |  |
        ^                                           |  |  |  |  |
     extends                                        |  |  |  |  |
        |                                           v  v  v  v  v
+-------------------+    +-------------------+    +---------------+
| KeyObject 3  (JS) | -> | KeyObjectHandle 3 | -> | KeyObjectData |
+-------------------+    +-------------------+    +---------------+

Co-authored-by: Anna Henningsen <anna@addaleax.net>
---
 doc/api/crypto.md                             |   9 ++
 doc/api/worker_threads.md                     |   8 +-
 lib/internal/crypto/keys.js                   |  13 +-
 src/env.h                                     |   3 +
 src/node_crypto.cc                            | 118 +++++++++++++-----
 src/node_crypto.h                             |  67 ++++++++--
 .../test-crypto-key-objects-messageport.js    |  85 +++++++++++++
 7 files changed, 251 insertions(+), 52 deletions(-)
 create mode 100644 test/parallel/test-crypto-key-objects-messageport.js

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 2e1f2981ee7232..6439608cfd80ff 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -1214,6 +1214,10 @@ This can be called many times with new data as it is streamed.
 <!-- YAML
 added: v11.6.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/33360
+    description: Instances of this class can now be passed to worker threads
+                 using `postMessage`.
   - version: v11.13.0
     pr-url: https://github.com/nodejs/node/pull/26438
     description: This class is now exported.
@@ -1229,6 +1233,10 @@ keyword.
 Most applications should consider using the new `KeyObject` API instead of
 passing keys as strings or `Buffer`s due to improved security features.
 
+`KeyObject` instances can be passed to other threads via [`postMessage()`][].
+The receiver obtains a cloned `KeyObject`, and the `KeyObject` does not need to
+be listed in the `transferList` argument.
+
 ### `keyObject.asymmetricKeyType`
 <!-- YAML
 added: v11.6.0
@@ -3518,6 +3526,7 @@ the `crypto`, `tls`, and `https` modules and are generally specific to OpenSSL.
 [`hmac.digest()`]: #crypto_hmac_digest_encoding
 [`hmac.update()`]: #crypto_hmac_update_data_inputencoding
 [`keyObject.export()`]: #crypto_keyobject_export_options
+[`postMessage()`]: worker_threads.html#worker_threads_port_postmessage_value_transferlist
 [`sign.sign()`]: #crypto_sign_sign_privatekey_outputencoding
 [`sign.update()`]: #crypto_sign_update_data_inputencoding
 [`stream.Writable` options]: stream.html#stream_new_stream_writable_options
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index 67823a527509fb..a91a824c7d723b 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -328,6 +328,9 @@ are part of the channel.
 <!-- YAML
 added: v10.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/33360
+    description: Added `KeyObject` to the list of cloneable types.
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/33772
     description: Added `FileHandle` to the list of transferable types.
@@ -348,8 +351,8 @@ In particular, the significant differences to `JSON` are:
 * `value` may contain typed arrays, both using `ArrayBuffer`s
    and `SharedArrayBuffer`s.
 * `value` may contain [`WebAssembly.Module`][] instances.
-* `value` may not contain native (C++-backed) objects other than `MessagePort`s
-  and [`FileHandle`][]s.
+* `value` may not contain native (C++-backed) objects other than `MessagePort`s,
+  [`FileHandle`][]s, and [`KeyObject`][]s.
 
 ```js
 const { MessageChannel } = require('worker_threads');
@@ -849,6 +852,7 @@ active handle in the event system. If the worker is already `unref()`ed calling
 [`EventEmitter`]: events.html
 [`EventTarget`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget
 [`FileHandle`]: fs.html#fs_class_filehandle
+[`KeyObject`]: crypto.html#crypto_class_keyobject
 [`MessagePort`]: #worker_threads_class_messageport
 [`SharedArrayBuffer`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer
 [`Uint8Array`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 61d3859553230d..889c3763b965df 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -43,6 +43,13 @@ for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
                  [kKeyEncodingSPKI, 'spki'], [kKeyEncodingSEC1, 'sec1']])
   encodingNames[m[0]] = m[1];
 
+function checkKeyTypeAndHandle(type, handle) {
+  if (type !== 'secret' && type !== 'public' && type !== 'private')
+    throw new ERR_INVALID_ARG_VALUE('type', type);
+  if (typeof handle !== 'object' || !(handle instanceof KeyObjectHandle))
+    throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
+}
+
 // Creating the KeyObject class is a little complicated due to inheritance
 // and that fact that KeyObjects should be transferrable between threads,
 // which requires the KeyObject base class to be implemented in C++.
@@ -57,11 +64,7 @@ const [
   // Publicly visible KeyObject class.
   class KeyObject extends NativeKeyObject {
     constructor(type, handle) {
-      super();
-      if (type !== 'secret' && type !== 'public' && type !== 'private')
-        throw new ERR_INVALID_ARG_VALUE('type', type);
-      if (typeof handle !== 'object')
-        throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
+      super(checkKeyTypeAndHandle(type, handle) || handle);
 
       this[kKeyType] = type;
 
diff --git a/src/env.h b/src/env.h
index 35d1cb2724de88..65163ec30fbc96 100644
--- a/src/env.h
+++ b/src/env.h
@@ -487,6 +487,9 @@ constexpr size_t kFsStatsBufferLength =
   V(buffer_prototype_object, v8::Object)                                       \
   V(crypto_key_object_constructor, v8::Function)                               \
   V(crypto_key_object_handle_constructor, v8::Function)                        \
+  V(crypto_key_object_private_constructor, v8::Function)                       \
+  V(crypto_key_object_public_constructor, v8::Function)                        \
+  V(crypto_key_object_secret_constructor, v8::Function)                        \
   V(domexception_function, v8::Function)                                       \
   V(enhance_fatal_stack_after_inspector, v8::Function)                         \
   V(enhance_fatal_stack_before_inspector, v8::Function)                        \
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 57c4764e39d0af..f86a27d01b9f0b 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -3244,27 +3244,24 @@ EVP_PKEY* ManagedEVPPKey::get() const {
   return pkey_.get();
 }
 
-KeyObjectData* KeyObjectData::CreateSecret(v8::Local<v8::ArrayBufferView> abv) {
+std::shared_ptr<KeyObjectData> KeyObjectData::CreateSecret(
+    Local<ArrayBufferView> abv) {
   size_t key_len = abv->ByteLength();
   char* mem = MallocOpenSSL<char>(key_len);
   abv->CopyContents(mem, key_len);
-  KeyObjectData* data = new KeyObjectData();
-  data->key_type_ = kKeyTypeSecret;
-  data->symmetric_key_ = std::unique_ptr<char, std::function<void(char*)>>(mem,
+  return std::shared_ptr<KeyObjectData>(new KeyObjectData(
+      std::unique_ptr<char, std::function<void(char*)>>(mem,
           [key_len](char* p) {
             OPENSSL_clear_free(p, key_len);
-          });
-  data->symmetric_key_len_ = key_len;
-  return data;
+          }),
+      key_len));
 }
 
-KeyObjectData* KeyObjectData::CreateAsymmetric(KeyType key_type,
-                                               const ManagedEVPPKey& pkey) {
+std::shared_ptr<KeyObjectData> KeyObjectData::CreateAsymmetric(
+    KeyType key_type,
+    const ManagedEVPPKey& pkey) {
   CHECK(pkey);
-  KeyObjectData* data = new KeyObjectData();
-  data->key_type_ = key_type;
-  data->asymmetric_key_ = pkey;
-  return data;
+  return std::shared_ptr<KeyObjectData>(new KeyObjectData(key_type, pkey));
 }
 
 KeyType KeyObjectData::GetKeyType() const {
@@ -3308,26 +3305,24 @@ Local<Function> KeyObjectHandle::Initialize(Environment* env,
   return function;
 }
 
-MaybeLocal<Object> KeyObjectHandle::Create(Environment* env,
-                                           KeyType key_type,
-                                           const ManagedEVPPKey& pkey) {
-  CHECK_NE(key_type, kKeyTypeSecret);
-  Local<Value> type = Integer::New(env->isolate(), key_type);
+MaybeLocal<Object> KeyObjectHandle::Create(
+    Environment* env,
+    std::shared_ptr<KeyObjectData> data) {
   Local<Object> obj;
   if (!env->crypto_key_object_handle_constructor()
-           ->NewInstance(env->context(), 1, &type)
+           ->NewInstance(env->context(), 0, nullptr)
            .ToLocal(&obj)) {
     return MaybeLocal<Object>();
   }
 
   KeyObjectHandle* key = Unwrap<KeyObjectHandle>(obj);
   CHECK_NOT_NULL(key);
-  key->data_.reset(KeyObjectData::CreateAsymmetric(key_type, pkey));
+  key->data_ = data;
   return obj;
 }
 
-const KeyObjectData* KeyObjectHandle::Data() {
-  return data_.get();
+const std::shared_ptr<KeyObjectData>& KeyObjectHandle::Data() {
+  return data_;
 }
 
 void KeyObjectHandle::New(const FunctionCallbackInfo<Value>& args) {
@@ -3357,8 +3352,7 @@ void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
   case kKeyTypeSecret:
     CHECK_EQ(args.Length(), 2);
     CHECK(args[1]->IsArrayBufferView());
-    key->data_.reset(
-        KeyObjectData::CreateSecret(args[1].As<ArrayBufferView>()));
+    key->data_ = KeyObjectData::CreateSecret(args[1].As<ArrayBufferView>());
     break;
   case kKeyTypePublic:
     CHECK_EQ(args.Length(), 4);
@@ -3367,7 +3361,7 @@ void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
     pkey = GetPublicOrPrivateKeyFromJs(args, &offset);
     if (!pkey)
       return;
-    key->data_.reset(KeyObjectData::CreateAsymmetric(type, pkey));
+    key->data_ = KeyObjectData::CreateAsymmetric(type, pkey);
     break;
   case kKeyTypePrivate:
     CHECK_EQ(args.Length(), 5);
@@ -3376,7 +3370,7 @@ void KeyObjectHandle::Init(const FunctionCallbackInfo<Value>& args) {
     pkey = GetPrivateKeyFromJs(args, &offset, false);
     if (!pkey)
       return;
-    key->data_.reset(KeyObjectData::CreateAsymmetric(type, pkey));
+    key->data_ = KeyObjectData::CreateAsymmetric(type, pkey);
     break;
   default:
     CHECK(false);
@@ -3472,7 +3466,50 @@ MaybeLocal<Value> KeyObjectHandle::ExportPrivateKey(
 }
 
 void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
-  CHECK_EQ(args.Length(), 0);
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  CHECK(args[0]->IsObject());
+  KeyObjectHandle* handle = Unwrap<KeyObjectHandle>(args[0].As<Object>());
+  new NativeKeyObject(env, args.This(), handle->Data());
+}
+
+BaseObjectPtr<BaseObject> NativeKeyObject::KeyObjectTransferData::Deserialize(
+        Environment* env,
+        Local<Context> context,
+        std::unique_ptr<worker::TransferData> self) {
+  if (context != env->context()) {
+    THROW_ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE(env);
+    return {};
+  }
+
+  Local<Value> handle = KeyObjectHandle::Create(env, data_).ToLocalChecked();
+  Local<Function> key_ctor;
+  switch (data_->GetKeyType()) {
+    case kKeyTypeSecret:
+      key_ctor = env->crypto_key_object_secret_constructor();
+      break;
+    case kKeyTypePublic:
+      key_ctor = env->crypto_key_object_public_constructor();
+      break;
+    case kKeyTypePrivate:
+      key_ctor = env->crypto_key_object_private_constructor();
+      break;
+    default:
+      CHECK(false);
+  }
+
+  Local<Value> key =
+      key_ctor->NewInstance(context, 1, &handle).ToLocalChecked();
+  return BaseObjectPtr<BaseObject>(Unwrap<KeyObjectHandle>(key.As<Object>()));
+}
+
+BaseObject::TransferMode NativeKeyObject::GetTransferMode() const {
+  return BaseObject::TransferMode::kCloneable;
+}
+
+std::unique_ptr<worker::TransferData> NativeKeyObject::CloneForMessaging()
+    const {
+  return std::make_unique<KeyObjectTransferData>(handle_data_);
 }
 
 static void CreateNativeKeyObjectClass(
@@ -3486,13 +3523,24 @@ static void CreateNativeKeyObjectClass(
   Local<FunctionTemplate> t = env->NewFunctionTemplate(NativeKeyObject::New);
   t->InstanceTemplate()->SetInternalFieldCount(
       KeyObjectHandle::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   Local<Value> ctor = t->GetFunction(env->context()).ToLocalChecked();
 
   Local<Value> recv = Undefined(env->isolate());
-  Local<Value> ret =
-      callback.As<Function>()->Call(env->context(), recv, 1, &ctor)
-      .ToLocalChecked();
+  Local<Value> ret_v;
+  if (callback.As<Function>()->Call(
+          env->context(), recv, 1, &ctor).ToLocal(&ret)) {
+    return;
+  }
+  Local<Array> ret = ret_v.As<Array>();
+  Local<Value> ctor;
+  if (!ret->Get(env->context(), 1).ToLocal(&ctor)) return;
+  env->set_crypto_key_object_secret_constructor(ctor.As<Function>());
+  if (!ret->Get(env->context(), 2).ToLocal(&ctor)) return;
+  env->set_crypto_key_object_public_constructor(ctor.As<Function>());
+  if (!ret->Get(env->context(), 3).ToLocal(&ctor)) return;
+  env->set_crypto_key_object_private_constructor(ctor.As<Function>());
   args.GetReturnValue().Set(ret);
 }
 
@@ -6308,8 +6356,9 @@ class GenerateKeyPairJob : public CryptoJob {
     if (public_key_encoding_.output_key_object_) {
       // Note that this has the downside of containing sensitive data of the
       // private key.
-      if (!KeyObjectHandle::Create(env(), kKeyTypePublic, pkey_)
-               .ToLocal(pubkey))
+      std::shared_ptr<KeyObjectData> data =
+          KeyObjectData::CreateAsymmetric(kKeyTypePublic, pkey_);
+      if (!KeyObjectHandle::Create(env(), data).ToLocal(pubkey))
         return false;
     } else {
       if (!WritePublicKey(env(), pkey_.get(), public_key_encoding_)
@@ -6319,8 +6368,9 @@ class GenerateKeyPairJob : public CryptoJob {
 
     // Now do the same for the private key.
     if (private_key_encoding_.output_key_object_) {
-      if (!KeyObjectHandle::Create(env(), kKeyTypePrivate, pkey_)
-              .ToLocal(privkey))
+      std::shared_ptr<KeyObjectData> data =
+          KeyObjectData::CreateAsymmetric(kKeyTypePrivate, pkey_);
+      if (!KeyObjectHandle::Create(env(), data).ToLocal(privkey))
         return false;
     } else {
       if (!WritePrivateKey(env(), pkey_.get(), private_key_encoding_)
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 9aaa188baa99ec..a61089f0f131c0 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -31,6 +31,7 @@
 #include "env.h"
 #include "base_object.h"
 #include "util.h"
+#include "node_messaging.h"
 
 #include "v8.h"
 
@@ -408,11 +409,13 @@ class ManagedEVPPKey {
   EVPKeyPointer pkey_;
 };
 
+// Objects of this class can safely be shared among threads.
 class KeyObjectData {
  public:
-  static KeyObjectData* CreateSecret(v8::Local<v8::ArrayBufferView> abv);
-  static KeyObjectData* CreateAsymmetric(KeyType type,
-                                         const ManagedEVPPKey& pkey);
+  static std::shared_ptr<KeyObjectData> CreateSecret(
+      v8::Local<v8::ArrayBufferView> abv);
+  static std::shared_ptr<KeyObjectData> CreateAsymmetric(
+      KeyType type, const ManagedEVPPKey& pkey);
 
   KeyType GetKeyType() const;
 
@@ -423,10 +426,23 @@ class KeyObjectData {
   size_t GetSymmetricKeySize() const;
 
  private:
-  KeyType key_type_;
-  std::unique_ptr<char, std::function<void(char*)>> symmetric_key_;
-  unsigned int symmetric_key_len_;
-  ManagedEVPPKey asymmetric_key_;
+  KeyObjectData(std::unique_ptr<char, std::function<void(char*)>> symmetric_key,
+                unsigned int symmetric_key_len)
+      : key_type_(KeyType::kKeyTypeSecret),
+        symmetric_key_(std::move(symmetric_key)),
+        symmetric_key_len_(symmetric_key_len),
+        asymmetric_key_() {}
+
+  KeyObjectData(KeyType type, const ManagedEVPPKey& pkey)
+      : key_type_(type),
+        symmetric_key_(),
+        symmetric_key_len_(0),
+        asymmetric_key_{pkey} {}
+
+  const KeyType key_type_;
+  const std::unique_ptr<char, std::function<void(char*)>> symmetric_key_;
+  const unsigned int symmetric_key_len_;
+  const ManagedEVPPKey asymmetric_key_;
 };
 
 class KeyObjectHandle : public BaseObject {
@@ -435,15 +451,14 @@ class KeyObjectHandle : public BaseObject {
                                             v8::Local<v8::Object> target);
 
   static v8::MaybeLocal<v8::Object> Create(Environment* env,
-                                           KeyType type,
-                                           const ManagedEVPPKey& pkey);
+                                           std::shared_ptr<KeyObjectData> data);
 
   // TODO(tniessen): track the memory used by OpenSSL types
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(KeyObjectHandle)
   SET_SELF_SIZE(KeyObjectHandle)
 
-  const KeyObjectData* Data();
+  const std::shared_ptr<KeyObjectData>& Data();
 
  protected:
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -468,7 +483,7 @@ class KeyObjectHandle : public BaseObject {
                   v8::Local<v8::Object> wrap);
 
  private:
-  std::unique_ptr<KeyObjectData> data_;
+  std::shared_ptr<KeyObjectData> data_;
 };
 
 class NativeKeyObject : public BaseObject {
@@ -478,6 +493,36 @@ class NativeKeyObject : public BaseObject {
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(NativeKeyObject)
   SET_SELF_SIZE(NativeKeyObject)
+
+  class KeyObjectTransferData : public worker::TransferData {
+   public:
+    explicit KeyObjectTransferData(const std::shared_ptr<KeyObjectData>& data)
+        : data_(data) {}
+
+    BaseObjectPtr<BaseObject> Deserialize(
+        Environment* env,
+        v8::Local<v8::Context> context,
+        std::unique_ptr<worker::TransferData> self) override;
+
+    SET_MEMORY_INFO_NAME(KeyObjectTransferData)
+    SET_SELF_SIZE(KeyObjectTransferData)
+    SET_NO_MEMORY_INFO()
+
+   private:
+    std::shared_ptr<KeyObjectData> data_;
+  };
+
+  BaseObject::TransferMode GetTransferMode() const override;
+  std::unique_ptr<worker::TransferData> CloneForMessaging() const override;
+
+ private:
+  NativeKeyObject(Environment* env,
+                  v8::Local<v8::Object> wrap,
+                  const std::shared_ptr<KeyObjectData>& handle_data)
+    : BaseObject(env, wrap),
+      handle_data_(handle_data) {}
+
+  std::shared_ptr<KeyObjectData> handle_data_;
 };
 
 class CipherBase : public BaseObject {
diff --git a/test/parallel/test-crypto-key-objects-messageport.js b/test/parallel/test-crypto-key-objects-messageport.js
new file mode 100644
index 00000000000000..618623243f54a7
--- /dev/null
+++ b/test/parallel/test-crypto-key-objects-messageport.js
@@ -0,0 +1,85 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { createSecretKey, generateKeyPairSync, randomBytes } = require('crypto');
+const { createContext } = require('vm');
+const {
+  MessageChannel,
+  Worker,
+  isMainThread,
+  moveMessagePortToContext,
+  parentPort
+} = require('worker_threads');
+
+function keyToString(key) {
+  let ret;
+  if (key.type === 'secret') {
+    ret = key.export().toString('hex');
+  } else {
+    ret = key.export({ type: 'pkcs1', format: 'pem' });
+  }
+  return ret;
+}
+
+// Worker threads simply reply with their representation of the received key.
+if (!isMainThread) {
+  return parentPort.once('message', ({ key }) => {
+    parentPort.postMessage(keyToString(key));
+  });
+}
+
+// The main thread generates keys and passes them to worker threads.
+const secretKey = createSecretKey(randomBytes(32));
+const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+  modulusLength: 1024
+});
+
+// Get immutable representations of all keys.
+const keys = [secretKey, publicKey, privateKey]
+             .map((key) => [key, keyToString(key)]);
+
+for (const [key, repr] of keys) {
+  {
+    // Test 1: No context change.
+    const { port1, port2 } = new MessageChannel();
+
+    port1.postMessage({ key });
+    assert.strictEqual(keyToString(key), repr);
+
+    port2.once('message', common.mustCall(({ key }) => {
+      assert.strictEqual(keyToString(key), repr);
+    }));
+  }
+
+  {
+    // Test 2: Across threads.
+    const worker = new Worker(__filename);
+    worker.once('message', common.mustCall((receivedRepresentation) => {
+      assert.strictEqual(receivedRepresentation, repr);
+    }));
+    worker.on('disconnect', () => console.log('disconnect'));
+    worker.postMessage({ key });
+  }
+
+  {
+    // Test 3: Across contexts (should not work).
+    const { port1, port2 } = new MessageChannel();
+    const context = createContext();
+    const port2moved = moveMessagePortToContext(port2, context);
+    assert(!(port2moved instanceof Object));
+
+    // TODO(addaleax): Switch this to a 'messageerror' event once MessagePort
+    // implements EventTarget fully and in a cross-context manner.
+    port2moved.emit = common.mustCall((name, err) => {
+      assert.strictEqual(name, 'messageerror');
+      assert.strictEqual(err.code, 'ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE');
+    });
+
+    port2moved.start();
+    port1.postMessage({ key });
+    port1.close();
+  }
+}

From 94b74e509b72d47720d4912cfe0dffdd094d9165 Mon Sep 17 00:00:00 2001
From: Anna Henningsen <anna@addaleax.net>
Date: Sat, 20 Jun 2020 20:59:41 +0200
Subject: [PATCH 5/6] fixup! crypto: allow KeyObjects in postMessage

---
 src/node_crypto.cc | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index f86a27d01b9f0b..e34b27b166c5d3 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -3529,12 +3529,11 @@ static void CreateNativeKeyObjectClass(
 
   Local<Value> recv = Undefined(env->isolate());
   Local<Value> ret_v;
-  if (callback.As<Function>()->Call(
-          env->context(), recv, 1, &ctor).ToLocal(&ret)) {
+  if (!callback.As<Function>()->Call(
+          env->context(), recv, 1, &ctor).ToLocal(&ret_v)) {
     return;
   }
   Local<Array> ret = ret_v.As<Array>();
-  Local<Value> ctor;
   if (!ret->Get(env->context(), 1).ToLocal(&ctor)) return;
   env->set_crypto_key_object_secret_constructor(ctor.As<Function>());
   if (!ret->Get(env->context(), 2).ToLocal(&ctor)) return;

From c5d802450c2b8c18f0ad70a4d1dba529d83087ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Mon, 22 Jun 2020 17:40:52 +0200
Subject: [PATCH 6/6] fixup! crypto: allow KeyObjects in postMessage

---
 test/parallel/test-crypto-key-objects-messageport.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-crypto-key-objects-messageport.js b/test/parallel/test-crypto-key-objects-messageport.js
index 618623243f54a7..1b910b571f77fc 100644
--- a/test/parallel/test-crypto-key-objects-messageport.js
+++ b/test/parallel/test-crypto-key-objects-messageport.js
@@ -9,7 +9,6 @@ const { createContext } = require('vm');
 const {
   MessageChannel,
   Worker,
-  isMainThread,
   moveMessagePortToContext,
   parentPort
 } = require('worker_threads');
@@ -25,12 +24,15 @@ function keyToString(key) {
 }
 
 // Worker threads simply reply with their representation of the received key.
-if (!isMainThread) {
+if (process.env.HAS_STARTED_WORKER) {
   return parentPort.once('message', ({ key }) => {
     parentPort.postMessage(keyToString(key));
   });
 }
 
+// Don't use isMainThread to allow running this test inside a worker.
+process.env.HAS_STARTED_WORKER = 1;
+
 // The main thread generates keys and passes them to worker threads.
 const secretKey = createSecretKey(randomBytes(32));
 const { publicKey, privateKey } = generateKeyPairSync('rsa', {