feat: implement remaining WASI-Crypto function

Summary

Description

This issue tracks the implementation of multiple previously unimplemented WASI-Crypto APIs in WasmEdge as part of #2669. These functions were previously returning __WASI_CRYPTO_ERRNO_NOT_IMPLEMENTED and have now been implemented or replaced with correct OpenSSL-backed or in-memory behavior where appropriate.

The changes span asymmetric cryptography, symmetric cryptography, key exchange handling, secrets management, and improvements to existing cryptographic operations and error handling.

Details

Implemented Changes

Secrets Manager

• Implemented in-memory SecretsManager (plugins/wasi_crypto/common/secrets_manager.h)

• Supports thread-safe storage and retrieval of:

  • Asymmetric key pairs
  • Symmetric keys

• Added key lifecycle operations:

  • invalidate() removes keys by ID and version
  • storeKp() stores key pairs
  • storeSk() stores symmetric keys
  • getKp() / getSk() retrieves stored keys

Context (Secrets Manager API)

plugins/wasi_crypto/common/ctx.cpp

• Context::secretsManagerOpen() now creates a real SecretsManager
• Context::secretsManagerClose() properly closes the manager handle
• Context::secretsManagerInvalidate() delegates to SecretsManager::invalidate

---

Asymmetric Key Management

plugins/wasi_crypto/asymmetric_common/ctx.cpp

• Context::keypairGenerateManaged() implemented using:

  • Options handling
  • Algorithm-based keypair generation
  • Registration in KeyPairManager

• Context::keypairStoreManaged() implemented using SecretsManager

• Context::keypairFromId() implemented to retrieve keypairs from SecretsManager

---

Key Conversion Improvements

• Ecdsa::SecretKey::toKeyPair() implemented using OpenSSL key comparison and validation
• Eddsa::SecretKey::toKeyPair() implemented with key compatibility check
• Rsa::SecretKey::toKeyPair() implemented with key validation
• X25519::SecretKey::toKeyPair() implemented with key comparison validation

---

X25519 Improvements

plugins/wasi_crypto/kx/dh/x25519.cpp

• X25519::PublicKey::verify() implemented using OpenSSL public key check
• X25519::SecretKey::toKeyPair() implemented with key consistency validation

---

Symmetric Key Management

plugins/wasi_crypto/symmetric/ctx.cpp

• Context::symmetricKeyGenerateManaged() implemented with:

  • Options parsing
  • Key generation via Symmetric::generateKey
  • Registration in SymmetricKeyManager

• Context::symmetricKeyStoreManaged() implemented using SecretsManager

• Context::symmetricKeyFromId() implemented for retrieving symmetric keys by ID and version

---

HKDF Improvements

plugins/wasi_crypto/symmetric/kdf.cpp

• Implemented Expand::State::clone() with full state duplication

• Implemented Extract::State::clone() with salt preservation

• Improved internal state tracking:

  • Info buffering
  • Key persistence during state cloning

---

RSA Improvements

plugins/wasi_crypto/signatures/rsa.cpp

• Implemented DER encoding support for:

  • Signature::import() (DER decoding)
  • Signature::exportData() (DER encoding using ASN.1 OCTET STRING)

---

Key Exchange Improvements

plugins/wasi_crypto/kx/kx.cpp

• Replaced NOT_IMPLEMENTED with UNSUPPORTED_FEATURE for:

  • encapsulate()
  • decapsulate()

---

Tests

• Removed outdated notimplement.cpp
• Updated asymmetric tests for managed key generation
• Updated KX tests to expect UNSUPPORTED_FEATURE
• Added validation for HKDF clone behavior
• Improved coverage for secrets manager integration

Appendix

Reference

Tracking issue: #2669