fix(ext/node): fix multiple DiffieHellman crypto bugs

[bartlomieju]

Summary

• Fix DH group key generation endianness bug (BigUint::from_slice treating big-endian u32 MODULUS words as little-endian limbs)
• Fix panic when deriving DH public key from private key (implement modular exponentiation g^x mod p)
• Fix PKCS#8 DH private key and SPKI public key parsing to properly decode DER-encoded INTEGERs
• Fix PKCS#8/SPKI export to DER-encode keys as ASN.1 INTEGERs
• Fix ASN.1 prime/generator encoding in key generation paths
• Fix JS-side DiffieHellman: prime conversion from u32 word arrays, generator encoding, computeSecret zero-padding, generateKeys idempotency, ArrayBufferView prime handling, diffieHellman() input validation
• Add modp1 and modp2 groups
• Enable 10 new node_compat DH tests (8 parallel, 2 pummel)

Test plan

• cargo test --test node_compat "parallel::test-crypto-dh-" — 10/13 pass (3 remaining need verifyError and stateless DH param normalization)
• cargo test --test node_compat "pummel::test-crypto-dh-" — 2/2 pass

🤖 Generated with Claude Code

[kajukitli]

Solid fix for the DH endianness and ASN.1 encoding issues. Looked through the changes:

Good stuff:

• The BigUint::from_slice → from_bytes_be fix in dh.rs is correct. The MODULUS words were big-endian but being treated as little-endian limbs.
• Zero-padding computeSecret to prime length per RFC 4346 - this was definitely causing interop issues
• Comparing DH params by integer value instead of byte encoding in op_node_diffie_hellman - handles the leading 0x00 ASN.1 differences correctly
• Proper DER INTEGER encoding/decoding for PKCS#8 and SPKI keys

One bug:
In keys.rs around line 1080 (ID_ED448 branch), there's:

.map_err(|_| X509PublicKeyError::InvalidEd25519Key)?;

Should be InvalidEd448Key - copy/paste error.

Nit:
In diffiehellman.ts, using op_node_dh_compute_secret to derive the public key when private key is set externally works, but the naming is a bit confusing since "compute_secret" usually implies computing the shared secret. A comment would help clarify this is computing g^privateKey mod p.

Otherwise lgtm

[kajukitli]

Suggested fixes as inline diff:

diff --git a/ext/node_crypto/keys.rs b/ext/node_crypto/keys.rs
--- a/ext/node_crypto/keys.rs
+++ b/ext/node_crypto/keys.rs
@@ -1080,9 +1080,9 @@ impl KeyObjectHandle {
           ID_ED448 => {
             let data = spki.subject_public_key.as_ref();
             let point_bytes: &[u8; 57] = data
-              .try_into()
-              .map_err(|_| X509PublicKeyError::InvalidEd25519Key)?;
+              .try_into()
+              .map_err(|_| X509PublicKeyError::InvalidEd448Key)?;
             let vk = ed448_goldilocks::VerifyingKey::from_bytes(point_bytes)
-              .map_err(|_| X509PublicKeyError::InvalidEd25519Key)?;
+              .map_err(|_| X509PublicKeyError::InvalidEd448Key)?;
             AsymmetricPublicKey::Ed448(vk)
           }

[littledivy]

LGTM, with the error variant fix