crypto: add Hybrid KEMs to Web Cryptography

[panva]

Adds Hybrid KEM algorithms to Web Cryptography.

• webcrypto only
• experimental like the rest of the extension's algorithms
• disabled when FIPS is enabled (because it's composed off of underlying primitives)

The hybrid JS side composition and secondary handle slots will all go away when OpenSSL lands support for these, which would also allow us to add them to node:crypto encap/decap and be a supported KeyObject asymmetric key type. The hybrids are all utilized by https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/ so https://redirect.github.com/openssl/openssl/pull/31326 might be what enables us to get rid of the composition in the future.

The active Chrome origin trial¹² already supports MLKEM768-X25519 (aka X-Wing) and WebKit has also indicated support for it. https://panva.github.io/hpke/?native is opted in to the Chrome origin trial so MLKEM768-X25519 is already available for selection as a KEM when opened in recent Chrom{e|ium-based} browser.

cc @twiss

blocked until WICG/webcrypto-modern-algos#67 lands or chrome support gets unflagged.

Footnotes

1. https://chromestatus.com/feature/5198951632470016 ↩

2. https://developer.chrome.com/origintrials/#/view_trial/1379790335835635713 ↩

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 96.14856% with 56 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.01%. Comparing base (4cd3d98) to head (76f6e0b).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_keys.cc	66.19%	12 Missing and 12 partials ⚠️
lib/internal/crypto/kem_hybrids.js	98.37%	19 Missing ⚠️
lib/internal/crypto/util.js	85.00%	6 Missing ⚠️
lib/internal/crypto/webcrypto.js	96.42%	3 Missing ⚠️
lib/internal/util/comparisons.js	88.23%	2 Missing ⚠️
src/crypto/crypto_util.h	75.00%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65759      +/-   ##
==========================================
+ Coverage   89.96%   90.01%   +0.05%     
==========================================
  Files         757      760       +3     
  Lines      258135   260073    +1938     
  Branches    48969    49201     +232     
==========================================
+ Hits       232234   234111    +1877     
- Misses      16973    17006      +33     
- Partials     8928     8956      +28     

Files with missing lines	Coverage Δ
lib/internal/crypto/keys.js	98.12% <100.00%> (+0.06%)	⬆️
src/crypto/crypto_keys.h	67.92% <100.00%> (+5.70%)	⬆️
lib/internal/util/comparisons.js	99.53% <88.23%> (-0.19%)	⬇️
src/crypto/crypto_util.h	66.66% <75.00%> (+0.18%)	⬆️
lib/internal/crypto/webcrypto.js	97.90% <96.42%> (+0.08%)	⬆️
lib/internal/crypto/util.js	97.40% <85.00%> (-0.34%)	⬇️
lib/internal/crypto/kem_hybrids.js	98.37% <98.37%> (ø)
src/crypto/crypto_keys.cc	69.66% <66.19%> (-0.18%)	⬇️

... and 35 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.