script_webcrypto/subtlecrypto/

aes_common.rs

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at https://mozilla.org/MPL/2.0/. */

use aes::cipher::common::{Generate, Key};
use aes::{Aes128, Aes192, Aes256};
use js::context::JSContext;
use script_bindings::codegen::GenericBindings::CryptoKeyBinding::{
    CryptoKeyMethods, KeyType, KeyUsage,
};
use script_bindings::codegen::GenericBindings::SubtleCryptoBinding::{JsonWebKey, KeyFormat};
use script_bindings::error::Error;
use script_bindings::root::DomRoot;
use script_bindings::str::DOMString;
use zeroize::Zeroizing;

use crate::cryptokey::{CryptoKey, Handle, KeyUsageSliceHelper};
use crate::subtlecrypto::{
    AesDerivedKeyParams, AesKeyAlgorithm, AesKeyGenParams, CryptoAlgorithm, ExportedKey,
    JsonWebKeyExt, JwkStringField, KeyAlgorithmAndDerivatives,
};
use crate::traits::Equivalence;

#[expect(clippy::enum_variant_names)]
pub(crate) enum AesAlgorithm {
    AesCtr,
    AesCbc,
    AesGcm,
    AesKw,
    AesOcb,
}

/// <https://w3c.github.io/webcrypto/#aes-ctr-operations-generate-key>
/// <https://w3c.github.io/webcrypto/#aes-cbc-operations-generate-key>
/// <https://w3c.github.io/webcrypto/#aes-gcm-operations-generate-key>
/// <https://w3c.github.io/webcrypto/#aes-kw-operations-generate-key>
/// <https://wicg.github.io/webcrypto-modern-algos/#aes-ocb-operations-generate-key>
///
/// The step order in the specification of AES-OCB is slightly different, but it is equivalent to
/// this implementation.
pub(crate) fn generate_key<D: Equivalence>(
    cx: &mut JSContext,
    global: &D::GlobalScope,
    aes_algorithm: AesAlgorithm,
    normalized_algorithm: &AesKeyGenParams,
    extractable: bool,
    usages: Vec<KeyUsage>,
) -> Result<DomRoot<CryptoKey<D>>, Error> {
    match aes_algorithm {
        AesAlgorithm::AesCtr |
        AesAlgorithm::AesCbc |
        AesAlgorithm::AesGcm |
        AesAlgorithm::AesOcb => {
            // Step 1. If usages contains any entry which is not one of "encrypt", "decrypt",
            // "wrapKey" or "unwrapKey", then throw a SyntaxError.
            usages.ensure_only_contain_entries_from(&[
                KeyUsage::Encrypt,
                KeyUsage::Decrypt,
                KeyUsage::WrapKey,
                KeyUsage::UnwrapKey,
            ])?;
        },
        AesAlgorithm::AesKw => {
            // Step 1. If usages contains any entry which is not one of "wrapKey" or "unwrapKey",
            // then throw a SyntaxError.
            usages.ensure_only_contain_entries_from(&[KeyUsage::WrapKey, KeyUsage::UnwrapKey])?;
        },
    }

    // Step 2. If the length member of normalizedAlgorithm is not equal to one of 128, 192 or 256,
    // then throw an OperationError.
    // Step 3. Generate an AES key of length equal to the length member of normalizedAlgorithm.
    // Step 4. If the key generation step fails, then throw an OperationError.
    let handle =
        match normalized_algorithm.length {
            128 => Handle::Aes128Key(Key::<Aes128>::try_generate().map_err(|_| {
                Error::Operation(Some(
                    "Failed to generate AES key with length 128 bits".into(),
                ))
            })?),
            192 => Handle::Aes192Key(Key::<Aes192>::try_generate().map_err(|_| {
                Error::Operation(Some(
                    "Failed to generate AES key with length 192 bits".into(),
                ))
            })?),
            256 => Handle::Aes256Key(Key::<Aes256>::try_generate().map_err(|_| {
                Error::Operation(Some(
                    "Failed to generate AES key with length 256 bits".into(),
                ))
            })?),
            _ => return Err(Error::Operation(Some(
                "The length member of normalizedAlgorithm is not equal to one of 128, 192 or 256"
                    .to_string(),
            ))),
        };

    // Step 5. Let key be a new CryptoKey object representing the generated AES key.
    // Step 6. Let algorithm be a new AesKeyAlgorithm.
    // Step 8. Set the length attribute of algorithm to equal the length member of
    // normalizedAlgorithm.
    // Step 9. Set the [[type]] internal slot of key to "secret".
    // Step 10. Set the [[algorithm]] internal slot of key to algorithm.
    // Step 11. Set the [[extractable]] internal slot of key to be extractable.
    // Step 12. Set the [[usages]] internal slot of key to be the normalized value of usages.
    let algorithm_name = match aes_algorithm {
        AesAlgorithm::AesCtr => {
            // Step 7. Set the name attribute of algorithm to "AES-CTR".
            CryptoAlgorithm::AesCtr
        },
        AesAlgorithm::AesCbc => {
            // Step 7. Set the name attribute of algorithm to "AES-CBC".
            CryptoAlgorithm::AesCbc
        },
        AesAlgorithm::AesGcm => {
            // Step 7. Set the name attribute of algorithm to "AES-GCM".
            CryptoAlgorithm::AesGcm
        },
        AesAlgorithm::AesKw => {
            // Step 7. Set the name attribute of algorithm to "AES-KW".
            CryptoAlgorithm::AesKw
        },
        AesAlgorithm::AesOcb => {
            // Step 7. Set the name attribute of algorithm to "AES-OCB".
            CryptoAlgorithm::AesOcb
        },
    };
    let algorithm = AesKeyAlgorithm {
        name: algorithm_name,
        length: normalized_algorithm.length,
    };
    let key = CryptoKey::new(
        cx,
        global,
        KeyType::Secret,
        extractable,
        KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm),
        usages.normalized_value(),
        handle,
    );

    // Step 13. Return key.
    Ok(key)
}

/// <https://w3c.github.io/webcrypto/#aes-ctr-operations-import-key>
/// <https://w3c.github.io/webcrypto/#aes-cbc-operations-import-key>
/// <https://w3c.github.io/webcrypto/#aes-gcm-operations-import-key>
/// <https://w3c.github.io/webcrypto/#aes-kw-operations-import-key>
/// <https://wicg.github.io/webcrypto-modern-algos/#aes-ocb-operations-import-key>
///
/// The specification of AES-OCB has one more step at the beginning of the operation:
///
/// > Let keyData be the key data to be imported.
///
/// As it is simply used to name the variable, it is safe to omit it in the implementation below to
/// align with the specification of other AES algorithms.
pub(crate) fn import_key<D: Equivalence>(
    cx: &mut JSContext,
    global: &D::GlobalScope,
    aes_algorithm: AesAlgorithm,
    format: KeyFormat,
    key_data: &[u8],
    extractable: bool,
    usages: Vec<KeyUsage>,
) -> Result<DomRoot<CryptoKey<D>>, Error> {
    match &aes_algorithm {
        AesAlgorithm::AesCtr |
        AesAlgorithm::AesCbc |
        AesAlgorithm::AesGcm |
        AesAlgorithm::AesOcb => {
            // Step 1. If usages contains an entry which is not one of "encrypt", "decrypt",
            // "wrapKey" or "unwrapKey", then throw a SyntaxError.
            usages.ensure_only_contain_entries_from(&[
                KeyUsage::Encrypt,
                KeyUsage::Decrypt,
                KeyUsage::WrapKey,
                KeyUsage::UnwrapKey,
            ])?;
        },
        AesAlgorithm::AesKw => {
            // Step 1. If usages contains an entry which is not one of "wrapKey" or "unwrapKey",
            // then throw a SyntaxError.
            usages.ensure_only_contain_entries_from(&[KeyUsage::WrapKey, KeyUsage::UnwrapKey])?;
        },
    }

    // Step 2.
    let data: Zeroizing<Vec<u8>>;
    match format {
        // If format is "raw": (Only applied to AES-CTR, AES-CBC, AES-GCM, AES-KW)
        KeyFormat::Raw
            if matches!(
                aes_algorithm,
                AesAlgorithm::AesCtr |
                    AesAlgorithm::AesCbc |
                    AesAlgorithm::AesGcm |
                    AesAlgorithm::AesKw
            ) =>
        {
            // Step 2.1. Let data be keyData.
            data = key_data.to_vec().into();

            // Step 2.2. If the length in bits of data is not 128, 192 or 256 then throw a
            // DataError.
            if !matches!(data.len(), 16 | 24 | 32) {
                return Err(Error::Data(Some(
                    "The length in bits of data is not 128, 192 or 256".to_string(),
                )));
            }
        },
        // If format is "raw-secret":
        KeyFormat::Raw_secret => {
            // Step 2.1. Let data be keyData.
            data = key_data.to_vec().into();

            // Step 2.2. If the length in bits of data is not 128, 192 or 256 then throw a
            // DataError.
            if !matches!(data.len(), 16 | 24 | 32) {
                return Err(Error::Data(Some(
                    "The length in bits of key is not 128, 192 or 256".to_string(),
                )));
            }
        },
        // If format is "jwk":
        KeyFormat::Jwk => {
            // Step 2.1.
            // If keyData is a JsonWebKey dictionary:
            //     Let jwk equal keyData.
            // Otherwise:
            //     Throw a DataError.
            let jwk = JsonWebKey::parse(cx, key_data)?;

            // Step 2.2. If the kty field of jwk is not "oct", then throw a DataError.
            if jwk.kty.as_ref().is_none_or(|kty| kty != "oct") {
                return Err(Error::Data(Some(
                    "The kty field of jwk is not \"oct\"".to_string(),
                )));
            }

            // Step 2.3. If jwk does not meet the requirements of Section 6.4 of JSON Web
            // Algorithms [JWA], then throw a DataError.
            // Step 2.4. Let data be the byte sequence obtained by decoding the k field of jwk.
            data = jwk.decode_required_string_field(JwkStringField::K)?;

            match aes_algorithm {
                AesAlgorithm::AesCtr => {
                    // Step 2.5.
                    // If data has length 128 bits:
                    //     If the alg field of jwk is present, and is not "A128CTR", then throw a
                    //     DataError.
                    // If data has length 192 bits:
                    //     If the alg field of jwk is present, and is not "A192CTR", then throw a
                    //     DataError.
                    // If data has length 256 bits:
                    //     If the alg field of jwk is present, and is not "A256CTR", then throw a
                    //     DataError.
                    // Otherwise:
                    //     throw a DataError.
                    let expected_alg = match data.len() {
                        16 => "A128CTR",
                        24 => "A192CTR",
                        32 => "A256CTR",
                        _ => {
                            return Err(Error::Data(Some(
                                "The length in bits of data is not 128, 192 or 256".to_string(),
                            )));
                        },
                    };
                    if jwk.alg.as_ref().is_none_or(|alg| alg != expected_alg) {
                        return Err(Error::Data(Some(format!(
                            "The alg field of jwk is present, and is not {}",
                            expected_alg
                        ))));
                    }
                },
                AesAlgorithm::AesCbc => {
                    // Step 2.5.
                    // If data has length 128 bits:
                    //     If the alg field of jwk is present, and is not "A128CBC", then throw a
                    //     DataError.
                    // If data has length 192 bits:
                    //     If the alg field of jwk is present, and is not "A192CBC", then throw a
                    //     DataError.
                    // If data has length 256 bits:
                    //     If the alg field of jwk is present, and is not "A256CBC", then throw a
                    //     DataError.
                    // Otherwise:
                    //     throw a DataError.
                    let expected_alg = match data.len() {
                        16 => "A128CBC",
                        24 => "A192CBC",
                        32 => "A256CBC",
                        _ => {
                            return Err(Error::Data(Some(
                                "The length in bits of data is not 128, 192 or 256".to_string(),
                            )));
                        },
                    };
                    if jwk.alg.as_ref().is_none_or(|alg| alg != expected_alg) {
                        return Err(Error::Data(Some(format!(
                            "The alg field of jwk is present, and is not {}",
                            expected_alg
                        ))));
                    }
                },
                AesAlgorithm::AesGcm => {
                    // Step 2.5.
                    // If data has length 128 bits:
                    //     If the alg field of jwk is present, and is not "A128GCM", then throw a
                    //     DataError.
                    // If data has length 192 bits:
                    //     If the alg field of jwk is present, and is not "A192GCM", then throw a
                    //     DataError.
                    // If data has length 256 bits:
                    //     If the alg field of jwk is present, and is not "A256GCM", then throw a
                    //     DataError.
                    // Otherwise:
                    //     throw a DataError.
                    let expected_alg = match data.len() {
                        16 => "A128GCM",
                        24 => "A192GCM",
                        32 => "A256GCM",
                        _ => {
                            return Err(Error::Data(Some(
                                "The length in bits of data is not 128, 192 or 256".to_string(),
                            )));
                        },
                    };
                    if jwk.alg.as_ref().is_none_or(|alg| alg != expected_alg) {
                        return Err(Error::Data(Some(format!(
                            "The alg field of jwk is present, and is not {}",
                            expected_alg
                        ))));
                    }
                },
                AesAlgorithm::AesKw => {
                    // Step 2.5.
                    // If data has length 128 bits:
                    //     If the alg field of jwk is present, and is not "A128KW", then throw a
                    //     DataError.
                    // If data has length 192 bits:
                    //     If the alg field of jwk is present, and is not "A192KW", then throw a
                    //     DataError.
                    // If data has length 256 bits:
                    //     If the alg field of jwk is present, and is not "A256KW", then throw a
                    //     DataError.
                    // Otherwise:
                    //     throw a DataError.
                    let expected_alg = match data.len() {
                        16 => "A128KW",
                        24 => "A192KW",
                        32 => "A256KW",
                        _ => {
                            return Err(Error::Data(Some(
                                "The length in bits of data is not 128, 192 or 256".to_string(),
                            )));
                        },
                    };
                    if jwk.alg.as_ref().is_none_or(|alg| alg != expected_alg) {
                        return Err(Error::Data(Some(format!(
                            "The alg field of jwk is present, and is not {}",
                            expected_alg
                        ))));
                    }
                },
                AesAlgorithm::AesOcb => {
                    // Step 2.5.
                    // If data has length 128 bits:
                    //     If the alg field of jwk is present, and is not "A128OCB", then throw a
                    //     DataError.
                    // If data has length 192 bits:
                    //     If the alg field of jwk is present, and is not "A192OCB", then throw a
                    //     DataError.
                    // If data has length 256 bits:
                    //     If the alg field of jwk is present, and is not "A256OCB", then throw a
                    //     DataError.
                    // Otherwise:
                    //     throw a DataError.
                    let expected_alg = match data.len() {
                        16 => "A128OCB",
                        24 => "A192OCB",
                        32 => "A256OCB",
                        _ => {
                            return Err(Error::Data(Some(
                                "The length in bits of key is not 128, 192 or 256".to_string(),
                            )));
                        },
                    };
                    if jwk.alg.as_ref().is_none_or(|alg| alg != expected_alg) {
                        return Err(Error::Data(Some(format!(
                            "The alg field of jwk is present, and is not {}",
                            expected_alg
                        ))));
                    }
                },
            }

            // Step 2.6. If usages is non-empty and the use field of jwk is present and is not
            // "enc", then throw a DataError.
            if !usages.is_empty() && jwk.use_.as_ref().is_some_and(|use_| use_ != "enc") {
                return Err(Error::Data(Some(
                    "Usages is non-empty and the use field of jwk is present and is not \"enc\""
                        .to_string(),
                )));
            }

            // Step 2.7. If the key_ops field of jwk is present, and is invalid according to the
            // requirements of JSON Web Key [JWK] or does not contain all of the specified usages
            // values, then throw a DataError.
            jwk.check_key_ops(&usages)?;

            // Step 2.8. If the ext field of jwk is present and has the value false and extractable
            // is true, then throw a DataError.
            if jwk.ext.is_some_and(|ext| !ext) && extractable {
                return Err(Error::Data(Some(
                    "The ext field of jwk is present and has the value false and \
                    extractable is true"
                        .to_string(),
                )));
            }
        },
        // Otherwise:
        _ => {
            // throw a NotSupportedError.
            return Err(Error::NotSupported(Some(
                "Unupported import key format for AES key".to_string(),
            )));
        },
    }

    // Step 3. Let key be a new CryptoKey object representing an AES key with value data.
    // Step 4. Set the [[type]] internal slot of key to "secret".
    // Step 5. Let algorithm be a new AesKeyAlgorithm.
    // Step 7. Set the length attribute of algorithm to the length, in bits, of data.
    // Step 8. Set the [[algorithm]] internal slot of key to algorithm.
    let handle = match data.len() {
        16 => Handle::Aes128Key(
            Key::<Aes128>::try_from(data.as_slice())
                .map_err(|_| Error::Operation(Some("Invalid AES-128 key".into())))?,
        ),
        24 => Handle::Aes192Key(
            Key::<Aes192>::try_from(data.as_slice())
                .map_err(|_| Error::Operation(Some("Invalid AES-192 key".into())))?,
        ),
        32 => Handle::Aes256Key(
            Key::<Aes256>::try_from(data.as_slice())
                .map_err(|_| Error::Operation(Some("Invalid AES-256 key".into())))?,
        ),
        _ => {
            return Err(Error::Data(Some(
                "The length in bits of data is not 128, 192 or 256".to_string(),
            )));
        },
    };
    let algorithm = AesKeyAlgorithm {
        name: match &aes_algorithm {
            AesAlgorithm::AesCtr => {
                // Step 6. Set the name attribute of algorithm to "AES-CTR".
                CryptoAlgorithm::AesCtr
            },
            AesAlgorithm::AesCbc => {
                // Step 6. Set the name attribute of algorithm to "AES-CBC".
                CryptoAlgorithm::AesCbc
            },
            AesAlgorithm::AesGcm => {
                // Step 6. Set the name attribute of algorithm to "AES-GCM".
                CryptoAlgorithm::AesGcm
            },
            AesAlgorithm::AesKw => {
                // Step 6. Set the name attribute of algorithm to "AES-KW".
                CryptoAlgorithm::AesKw
            },
            AesAlgorithm::AesOcb => {
                // Step 6. Set the name attribute of algorithm to "AES-OCB".
                CryptoAlgorithm::AesOcb
            },
        },
        length: data.len() as u16 * 8,
    };
    let key = CryptoKey::new(
        cx,
        global,
        KeyType::Secret,
        extractable,
        KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm),
        usages.normalized_value(),
        handle,
    );

    // Step 9. Return key.
    Ok(key)
}

/// <https://w3c.github.io/webcrypto/#aes-ctr-operations-export-key>
/// <https://w3c.github.io/webcrypto/#aes-cbc-operations-export-key>
/// <https://w3c.github.io/webcrypto/#aes-gcm-operations-export-key>
/// <https://w3c.github.io/webcrypto/#aes-kw-operations-export-key>
/// <https://wicg.github.io/webcrypto-modern-algos/#aes-ocb-operations-export-key>
pub(crate) fn export_key<D: Equivalence>(
    aes_algorithm: AesAlgorithm,
    format: KeyFormat,
    key: &CryptoKey<D>,
) -> Result<ExportedKey, Error> {
    // Step 1. If the underlying cryptographic key material represented by the [[handle]] internal
    // slot of key cannot be accessed, then throw an OperationError.

    // Step 2.
    let result = match format {
        // If format is "raw": (Only applied to AES-CTR, AES-CBC, AES-GCM, AES-KW)
        KeyFormat::Raw
            if matches!(
                aes_algorithm,
                AesAlgorithm::AesCtr |
                    AesAlgorithm::AesCbc |
                    AesAlgorithm::AesGcm |
                    AesAlgorithm::AesKw
            ) =>
        {
            // Step 2.1. Let data be a byte sequence containing the raw octets of the key
            // represented by [[handle]] internal slot of key.
            let data = match key.handle() {
                Handle::Aes128Key(key) => key.to_vec(),
                Handle::Aes192Key(key) => key.to_vec(),
                Handle::Aes256Key(key) => key.to_vec(),
                _ => {
                    return Err(Error::Operation(Some(
                        "The key handle is not representing an AES key".to_string(),
                    )));
                },
            };

            // Step 2.2. Let result be data.
            ExportedKey::new_bytes(data)
        },
        // If format is "raw-secret":
        KeyFormat::Raw_secret => {
            // Step 2.1. Let data be a byte sequence containing the raw octets of the key
            // represented by [[handle]] internal slot of key.
            let data = match key.handle() {
                Handle::Aes128Key(key) => key.to_vec(),
                Handle::Aes192Key(key) => key.to_vec(),
                Handle::Aes256Key(key) => key.to_vec(),
                _ => {
                    return Err(Error::Operation(Some(
                        "The key handle is not representing an AES key".to_string(),
                    )));
                },
            };

            // Step 2.2. Let result be data.
            ExportedKey::new_bytes(data)
        },
        // If format is "jwk":
        KeyFormat::Jwk => {
            // Step 2.1. Let jwk be a new JsonWebKey dictionary.
            let mut jwk = JsonWebKey::default();

            // Step 2.2. Set the kty attribute of jwk to the string "oct".
            jwk.kty = Some(DOMString::from_static("oct"));

            // Step 2.3. Set the k attribute of jwk to be a string containing the raw octets of the
            // key represented by [[handle]] internal slot of key, encoded according to Section 6.4
            // of JSON Web Algorithms [JWA].
            let key_bytes = match key.handle() {
                Handle::Aes128Key(key) => key.as_slice(),
                Handle::Aes192Key(key) => key.as_slice(),
                Handle::Aes256Key(key) => key.as_slice(),
                _ => {
                    return Err(Error::Operation(Some(
                        "The key handle is not representing an AES key".to_string(),
                    )));
                },
            };
            jwk.encode_string_field(JwkStringField::K, key_bytes);

            match aes_algorithm {
                AesAlgorithm::AesCtr => {
                    // Step 2.4.
                    // If the length attribute of key is 128:
                    //     Set the alg attribute of jwk to the string "A128CTR".
                    // If the length attribute of key is 192:
                    //     Set the alg attribute of jwk to the string "A192CTR".
                    // If the length attribute of key is 256:
                    //     Set the alg attribute of jwk to the string "A256CTR".
                    let KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm) = key.algorithm()
                    else {
                        return Err(Error::Operation(Some(
                            "The key is not an AES-CTR key".to_string(),
                        )));
                    };
                    let alg = match algorithm.length {
                        128 => "A128CTR",
                        192 => "A192CTR",
                        256 => "A256CTR",
                        _ => return Err(Error::Operation(Some(
                            "The length attribute of the [[algorithm]] internal slot of key is not \
                            128, 192 or 256".to_string(),
                        )))
                    };
                    jwk.alg = Some(DOMString::from(alg));
                },
                AesAlgorithm::AesCbc => {
                    // Step 2.4.
                    // If the length attribute of key is 128:
                    //     Set the alg attribute of jwk to the string "A128CBC".
                    // If the length attribute of key is 192:
                    //     Set the alg attribute of jwk to the string "A192CBC".
                    // If the length attribute of key is 256:
                    //     Set the alg attribute of jwk to the string "A256CBC".
                    let KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm) = key.algorithm()
                    else {
                        return Err(Error::Operation(Some(
                            "The key is not an AES-CBC key".to_string(),
                        )));
                    };
                    let alg = match algorithm.length {
                        128 => "A128CBC",
                        192 => "A192CBC",
                        256 => "A256CBC",
                        _ => return Err(Error::Operation(Some(
                            "The length attribute of the [[algorithm]] internal slot of key is not \
                            128, 192 or 256".to_string(),
                        )))
                    };
                    jwk.alg = Some(DOMString::from(alg));
                },
                AesAlgorithm::AesGcm => {
                    // Step 2.4.
                    // If the length attribute of key is 128:
                    //     Set the alg attribute of jwk to the string "A128GCM".
                    // If the length attribute of key is 192:
                    //     Set the alg attribute of jwk to the string "A192GCM".
                    // If the length attribute of key is 256:
                    //     Set the alg attribute of jwk to the string "A256GCM".
                    let KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm) = key.algorithm()
                    else {
                        return Err(Error::Operation(Some(
                            "The key is not an AES-GCM key".to_string(),
                        )));
                    };
                    let alg = match algorithm.length {
                        128 => "A128GCM",
                        192 => "A192GCM",
                        256 => "A256GCM",
                        _ => return Err(Error::Operation(Some(
                            "The length attribute of the [[algorithm]] internal slot of key is not \
                            128, 192 or 256".to_string(),
                        )))
                    };
                    jwk.alg = Some(DOMString::from(alg));
                },
                AesAlgorithm::AesKw => {
                    // Step 2.4.
                    // If the length attribute of key is 128:
                    //     Set the alg attribute of jwk to the string "A128KW".
                    // If the length attribute of key is 192:
                    //     Set the alg attribute of jwk to the string "A192KW".
                    // If the length attribute of key is 256:
                    //     Set the alg attribute of jwk to the string "A256KW".
                    let KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm) = key.algorithm()
                    else {
                        return Err(Error::Operation(Some(
                            "The key is not an AES-KW key".to_string(),
                        )));
                    };
                    let alg = match algorithm.length {
                        128 => "A128KW",
                        192 => "A192KW",
                        256 => "A256KW",
                        _ => return Err(Error::Operation(Some(
                            "The length attribute of the [[algorithm]] internal slot of key is not \
                            128, 192 or 256".to_string(),
                        )))
                    };
                    jwk.alg = Some(DOMString::from(alg));
                },
                AesAlgorithm::AesOcb => {
                    // Step 2.4.
                    // If the length attribute of key is 128:
                    //     Set the alg attribute of jwk to the string "A128OCB".
                    // If the length attribute of key is 192:
                    //     Set the alg attribute of jwk to the string "A192OCB".
                    // If the length attribute of key is 256:
                    //     Set the alg attribute of jwk to the string "A256OCB".
                    let KeyAlgorithmAndDerivatives::AesKeyAlgorithm(algorithm) = key.algorithm()
                    else {
                        return Err(Error::Operation(Some(
                            "The key is not an AES-OCB key".to_string(),
                        )));
                    };
                    let alg = match algorithm.length {
                        128 => "A128OCB",
                        192 => "A192OCB",
                        256 => "A256OCB",
                        _ => return Err(Error::Operation(Some(
                            "The length attribute of the [[algorithm]] internal slot of key is not \
                            128, 192 or 256".to_string(),
                        )))
                    };
                    jwk.alg = Some(DOMString::from(alg));
                },
            }

            // Step 2.5. Set the key_ops attribute of jwk to equal the usages attribute of key.
            jwk.set_key_ops(key.usages());

            // Step 2.6. Set the ext attribute of jwk to equal the [[extractable]] internal slot of
            // key.
            jwk.ext = Some(key.Extractable());

            // Step 2.7. Let result be jwk.
            ExportedKey::new_jwk(jwk)
        },
        _ => {
            // throw a NotSupportedError.
            return Err(Error::NotSupported(Some(
                "Unsupported import key format for AES key".to_string(),
            )));
        },
    };

    // Step 3. Return result.
    Ok(result)
}

/// <https://w3c.github.io/webcrypto/#aes-ctr-operations-get-key-length>
/// <https://w3c.github.io/webcrypto/#aes-cbc-operations-get-key-length>
/// <https://w3c.github.io/webcrypto/#aes-gcm-operations-get-key-length>
/// <https://w3c.github.io/webcrypto/#aes-kw-operations-get-key-length>
/// <https://wicg.github.io/webcrypto-modern-algos/#aes-ocb-operations-get-key-length>
pub(crate) fn get_key_length(
    normalized_derived_key_algorithm: &AesDerivedKeyParams,
) -> Result<Option<u32>, Error> {
    // Step 1. If the length member of normalizedDerivedKeyAlgorithm is not 128, 192 or 256, then
    // throw an OperationError.
    if !matches!(normalized_derived_key_algorithm.length, 128 | 192 | 256) {
        return Err(Error::Operation(Some(
            "The length member of normalizedDerivedKeyAlgorithm is not 128, 192 or 256".to_string(),
        )));
    }

    // Step 2. Return the length member of normalizedDerivedKeyAlgorithm.
    Ok(Some(normalized_derived_key_algorithm.length as u32))
}