crypto: harden KeyObject internal slots and CryptoKey algorithm slots

lib/eslint.config_partial.mjs

@@ -75,6 +75,10 @@ export default [
           selector: "VariableDeclarator[init.type='CallExpression'][init.callee.name='internalBinding'][init.arguments.0.value='crypto'] > ObjectPattern > Property[key.name='getCryptoKeySlots']",
           message: "Use `const { getCryptoKeySlots } = require('internal/crypto/keys');` instead of destructuring it from `internalBinding('crypto')`.",
         },
+        {
+          selector: "VariableDeclarator[init.type='CallExpression'][init.callee.name='internalBinding'][init.arguments.0.value='crypto'] > ObjectPattern > Property[key.name='getKeyObjectSlots']",
+          message: "Use `const { getKeyObjectSlots } = require('internal/crypto/keys');` instead of destructuring it from `internalBinding('crypto')`.",
+        },
       ],
       'no-restricted-globals': [
         'error',
@@ -420,6 +424,9 @@ export default [
       'node-core/lowercase-name-for-primitive': 'error',
       'node-core/non-ascii-character': 'error',
       'node-core/no-array-destructuring': 'error',
+      'node-core/no-cryptokey-public-accessors': 'error',
+      'node-core/no-keyobject-cryptokey-instanceof': 'error',
+      'node-core/no-keyobject-public-accessors': 'error',
       'node-core/prefer-primordials': [
         'error',
         { name: 'AggregateError' },

lib/internal/crypto/aes.js

@@ -30,7 +30,6 @@ const {
   getUsagesMask,
   hasAnyNotIn,
   jobPromise,
-  kHandle,
 } = require('internal/crypto/util');
 
 const {
@@ -41,6 +40,8 @@ const {
   InternalCryptoKey,
   getCryptoKeyAlgorithm,
   getCryptoKeyHandle,
+  getKeyObjectHandle,
+  getKeyObjectSymmetricKeySize,
 } = require('internal/crypto/keys');
 
 const {
@@ -219,9 +220,9 @@ function aesImportKey(
   let length;
   switch (format) {
     case 'KeyObject': {
-      length = keyData.symmetricKeySize * 8;
+      length = getKeyObjectSymmetricKeySize(keyData) * 8;
       validateKeyLength(length);
-      handle = keyData[kHandle];
+      handle = getKeyObjectHandle(keyData);
       break;
     }
     case 'raw-secret':

lib/internal/crypto/cfrg.js

@@ -28,7 +28,6 @@ const {
   getUsagesUnion,
   hasAnyNotIn,
   jobPromise,
-  kHandle,
 } = require('internal/crypto/util');
 
 const {
@@ -38,6 +37,8 @@ const {
 const {
   getCryptoKeyHandle,
   getCryptoKeyType,
+  getKeyObjectHandle,
+  getKeyObjectType,
   InternalCryptoKey,
 } = require('internal/crypto/keys');
 
@@ -188,8 +189,9 @@ function cfrgImportKey(
   const usagesSet = new SafeSet(keyUsages);
   switch (format) {
     case 'KeyObject': {
-      verifyAcceptableCfrgKeyUse(name, keyData.type === 'public', usagesSet);
-      handle = keyData[kHandle];
+      verifyAcceptableCfrgKeyUse(
+        name, getKeyObjectType(keyData) === 'public', usagesSet);
+      handle = getKeyObjectHandle(keyData);
       break;
     }
     case 'spki': {

lib/internal/crypto/chacha20_poly1305.js

@@ -14,7 +14,6 @@ const {
   getUsagesMask,
   hasAnyNotIn,
   jobPromise,
-  kHandle,
 } = require('internal/crypto/util');
 
 const {
@@ -24,6 +23,7 @@ const {
 const {
   InternalCryptoKey,
   getCryptoKeyHandle,
+  getKeyObjectHandle,
 } = require('internal/crypto/keys');
 
 const {
@@ -87,7 +87,7 @@ function c20pImportKey(
   let handle;
   switch (format) {
     case 'KeyObject': {
-      handle = keyData[kHandle];
+      handle = getKeyObjectHandle(keyData);
       break;
     }
     case 'raw-secret': {

lib/internal/crypto/ec.js

@@ -34,7 +34,6 @@ const {
   hasAnyNotIn,
   jobPromise,
   normalizeHashName,
-  kHandle,
   kNamedCurveAliases,
 } = require('internal/crypto/util');
 
@@ -47,6 +46,8 @@ const {
   getCryptoKeyAlgorithm,
   getCryptoKeyHandle,
   getCryptoKeyType,
+  getKeyObjectHandle,
+  getKeyObjectType,
 } = require('internal/crypto/keys');
 
 const {
@@ -189,8 +190,9 @@ function ecImportKey(
   const usagesSet = new SafeSet(keyUsages);
   switch (format) {
     case 'KeyObject': {
-      verifyAcceptableEcKeyUse(name, keyData.type === 'public', usagesSet);
-      handle = keyData[kHandle];
+      verifyAcceptableEcKeyUse(
+        name, getKeyObjectType(keyData) === 'public', usagesSet);
+      handle = getKeyObjectHandle(keyData);
       break;
     }
     case 'spki': {

lib/internal/crypto/hkdf.js

@@ -29,6 +29,7 @@ const {
 const {
   createSecretKey,
   getCryptoKeyHandle,
+  getKeyObjectHandle,
   isKeyObject,
 } = require('internal/crypto/keys');
 
@@ -75,10 +76,10 @@ const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
 
 function prepareKey(key) {
   if (isKeyObject(key))
-    return key;
+    return getKeyObjectHandle(key);
 
   if (isAnyArrayBuffer(key))
-    return createSecretKey(key);
+    return getKeyObjectHandle(createSecretKey(key));
 
   key = toBuf(key);
 
@@ -96,7 +97,7 @@ function prepareKey(key) {
       key);
   }
 
-  return createSecretKey(key);
+  return getKeyObjectHandle(createSecretKey(key));
 }
 
 function hkdf(hash, key, salt, info, length, callback) {