Algorithm Updates in WebCrypto

at a glance

Syntax

The update extends SubtleCrypto with four key-encapsulation methods (KEM support for ML-KEM), a public-key derivation helper, and a static feature-detection method. IDL from the WICG draft:

[SecureContext, Exposed=(Window,Worker)]
partial interface SubtleCrypto {
  Promise<EncapsulatedKey> encapsulateKey(
    AlgorithmIdentifier encapsulationAlgorithm,
    CryptoKey encapsulationKey,
    AlgorithmIdentifier sharedKeyAlgorithm,
    boolean extractable,
    sequence<KeyUsage> keyUsages
  );
  Promise<EncapsulatedBits> encapsulateBits(
    AlgorithmIdentifier encapsulationAlgorithm,
    CryptoKey encapsulationKey
  );

  Promise<CryptoKey> decapsulateKey(
    AlgorithmIdentifier decapsulationAlgorithm,
    CryptoKey decapsulationKey,
    BufferSource ciphertext,
    AlgorithmIdentifier sharedKeyAlgorithm,
    boolean extractable,
    sequence<KeyUsage> keyUsages
  );
  Promise<ArrayBuffer> decapsulateBits(
    AlgorithmIdentifier decapsulationAlgorithm,
    CryptoKey decapsulationKey,
    BufferSource ciphertext
  );

  Promise<CryptoKey> getPublicKey(
    CryptoKey key,
    sequence<KeyUsage> keyUsages
  );

  static boolean supports(DOMString operation,
                   AlgorithmIdentifier algorithm,
                   optional unsigned long? length = null);
  static boolean supports(DOMString operation,
                   AlgorithmIdentifier algorithm,
                   AlgorithmIdentifier additionalAlgorithm);
};

enum KeyFormat { "raw-public", "raw-private", "raw-seed", "raw-secret",
                 "raw", "spki", "pkcs8", "jwk" };

enum KeyUsage { "encrypt", "decrypt", "sign", "verify", "deriveKey", "deriveBits",
                "wrapKey", "unwrapKey",
                "encapsulateKey", "encapsulateBits",
                "decapsulateKey", "decapsulateBits" };

dictionary EncapsulatedKey {
  CryptoKey sharedKey;
  ArrayBuffer ciphertext;
};

dictionary EncapsulatedBits {
  ArrayBuffer sharedKey;
  ArrayBuffer ciphertext;
};

The new algorithm roster

Eleven algorithm families are registered, each with its own operations section in the spec (key generation, import/export, and the operations below). All are optional to implement per the spec — use SubtleCrypto.supports() to detect them.

Examples

// 1. Feature-detect first — the method and every algorithm are optional
const kemOK = SubtleCrypto.supports?.("encapsulateKey", "ML-KEM-768") ?? false;
if (!kemOK) throw new DOMException("ML-KEM-768 is unavailable", "NotSupportedError");

// 2. Recipient generates an ML-KEM key pair
const pair = await crypto.subtle.generateKey("ML-KEM-768", true, [
  "encapsulateKey", "decapsulateKey",
]);

// 3. Sender encapsulates a shared secret against the recipient public key
const { sharedKey, ciphertext } = await crypto.subtle.encapsulateKey(
  "ML-KEM-768", pair.publicKey, "AES-GCM", true, ["encrypt", "decrypt"],
);
// -> send { ciphertext } to the recipient; keep sharedKey local

// 4. Recipient decapsulates with the private key — same shared secret
const recovered = await crypto.subtle.decapsulateKey(
  "ML-KEM-768", pair.privateKey, ciphertext, "AES-GCM", true, ["encrypt", "decrypt"],
);

Browser compatibility

There is no browser-compat-data (BCD) entry for these methods and algorithms yet, so the table below is an interim view built from ChromeStatus ship data and public vendor signals — not from BCD.

Specifications

See also

• Origin trial documentation — WebCrypto Additional Algorithms
• blink-dev intent thread
• Chrome origin trials — registration
• Chrome Platform Showcase — Algorithm Updates in WebCrypto (also: capability matrix, ML-DSA signatures, ChaCha20-Poly1305, hybrid session key)