webcrypto | A WebCrypto Polyfill for NodeJS | Cryptography library

@Topaco mentioned to use a public key I has to use the spki format. That solves the issue with the import of the public key. This code solves my problem.

PKCS#1 Versus PKCS#8

Note that while private keys generated without pass phrases in PHP are PKCS#1, the private key generated from PHP with a pass phrase is actually PKCS#8 (see this link for how to determine which standard applies to a private key).

Third Party Library Required

In order to work with PEM-format keys, a custom JavaScript library (or other custom code) is required. There are various libraries at this link which you can look at. Many are not maintained anymore.

This example uses the Forge JavaScript library, but you could also use a different library.

Installing/Importing Forge

While there are various ways to build the Forge environment, the easiest is to add the following HTML code prior to where you need to do encryption/decryption:

This is due to your atob() and btoa() methods defined for NodeJS.

Buffer.from() and Buffer#toString() apply UTF-8 by default if no other encoding is specified. However, UTF-8 generally corrupts arbitrary binary data. Instead of UTF-8 use binary as encoding:

Obviously node-webcrypto-ossl requires an older version of glibc.

No. GLIBC is backwards compatible: applications built against older version continue to run fine on newer GLIBC versions.

Your problem is the opposite: you have an application linked against GLIBC_2.32 trying to run against an older version of GLIBC.

The version of glibc installed on my machine is 2.33-5

The application is not using that version; it's using some other GLIBC.

The problem was that I was trying to run my app in docker ...

That's one way running against older than expected GLIBC could happen.

I have also struggled with signing and verifying JWT using jose but was finally able to succeed with HS256 symmetric key encryption. I produced it by following steps (I am using jose-node-cjs-runtime for Node.js only use case. Feel free to replace with desired package. Also please note that I have found that these codes are working for Node.js version 16.7.0, 16.9.0 so please ensure that any of them is installed. If you want to deploy these changes to production environment, then also you have to ensure the deploy environment has the same Node.js version. One way this can be achieved is by mentioning Node.js version in engines key in package.json):

You need to understand getRandomValues is on window.crypto that means it works on browser. To make it work on Node.js you need to install get-random-values

The JavaScript runtime of Cloudflare Workers is not based on Node. So there won't be a pre-bundled module called crypto that you can require or import.

If you start from these template projects with Webpack configured, required/imported modules are typically those which you have installed manually (e.g. via npm install/yarn add foobar and later being listed as dependencies in package.json). In other words, it is somewhat alike to writing front-end JS.

The Workers provides a built-in WebCrypto-compliant cryptography library implementation as documented here: https://developers.cloudflare.com/workers/runtime-apis/web-crypto. According to the doc, crypto is just a global object that can be accessed directly with importing.

Even though I do not have a try, I suppose the link to the example you given is a completed Worker script with no more modifications needed to test. That is, just copy&paste into the online editor of Workers and test.

EC signatures can be specified in two formats: r|s (IEEE P1363) or ASN.1/DER. Both formats are explained here.

WebCrypto uses the r|s format, while MEUCI... has the ASN.1 format. Your signature in r|s format is Base64 encoded:

WebCrypto implicitly generates the hash of the data during signing using the digest SHA-256 specified in the key, so explicit hashing with SHA-256 is not necessary.
Also, the generated signature is directly hashed with MD5, i.e. without prior Base64 encoding.

With these changes, the JavaScript code is (using a test key):