crypto: discover hashes and ciphers from providers by panva · Pull Request #65484 · nodejs/node

panva · 2026-08-22T12:47:10Z

OpenSSL 3 provider implementations are not necessarily registered in the legacy digest and cipher tables used by EVP_get_digestbyname() and EVP_get_cipherbyname(). As a result, Node.js can omit usable provider-only algorithms from getHashes() and getCiphers() and reject them in crypto operations even when they match the active OpenSSL property query. The permanently memoized algorithm lists can also remain stale after setFips() changes that query.

This change discovers usable hashes, ciphers, and aliases from activated OpenSSL providers while preserving the legacy registries. Numeric OID aliases, NULL implementations, and cipher implementations unsupported by the Node.js Cipher APIs are excluded.

Resolution and API support

Provider digest resolution now covers streaming and one-shot hashing, HMAC, KDFs, signing, verification, and RSA digest options.
Provider cipher resolution is used for string-based initialization and getCipherInfo() while preserving numeric, WebCrypto, TLS, and predefined-cipher paths.
Provider discovery exposes algorithms including KECCAK-KMAC-128, KECCAK-256, SHA256-192, CBC-CTS variants, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key-wrap implementations when supplied by the active providers.
createHash() and crypto.hash() accept functionName and customization for cSHAKE digests with OpenSSL 4.0 or later.
Cipher construction accepts ctsMode for CBC-CTS and xtsStandard for selecting the provider XTS variant.
CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption enforce the one-shot and authentication constraints required by their provider implementations.

Caching and invalidation

Ordinary hashes and ciphers retain their legacy lookup and direct initialization paths, and the extended native binding arities are used only when the new cSHAKE, CTS, or XTS options are supplied.
Successful provider fetches are cached per Environment under case-insensitive query, canonical, and alias names, with owners deduplicated by provider and canonical identity.
Warm cache hits return borrowed pointers without another explicit fetch or reference increment, and failed lookups are not cached.
A process-wide generation advances only after a successful setFips() call that changes the FIPS state.
Each Environment lazily clears aliases before releasing owning provider references when it observes a new generation.
getHashes() and getCiphers() keep independent generation-aware snapshots, retry enumeration if the generation changes concurrently, return defensive copies, and discard their JavaScript snapshots during snapshot serialization.
Existing hash and cipher contexts retain their implementation and can finish across a FIPS transition, while new contexts resolve against the new property query.
Provider owners are released before worker addon DSOs are unloaded.
Engine registration changes, explicit provider load or unload, and default-property changes made by native addons intentionally do not participate in this invalidation mechanism since engines are on the way out of the codebase (crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183) #63966, crypto,build: drop OpenSSL 1.x and engine support #64777 (comment)).

Fixes: #43040
Fixes: #64866
Refs: #62982

nodejs-github-bot · 2026-08-22T12:47:15Z

Review requested:

@nodejs/crypto
@nodejs/security-wg

codecov · 2026-08-22T14:34:20Z

Codecov Report

❌ Patch coverage is 65.21739% with 192 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.08%. Comparing base (30fe871) to head (cc7f6b4).
⚠️ Report is 70 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_hash.cc	68.72%	45 Missing and 41 partials ⚠️
src/crypto/crypto_util.cc	11.86%	52 Missing ⚠️
lib/internal/crypto/hash.js	39.68%	37 Missing and 1 partial ⚠️
src/crypto/crypto_util.h	0.00%	5 Missing ⚠️
src/crypto/crypto_cipher.cc	94.44%	0 Missing and 3 partials ⚠️
src/crypto/crypto_rsa.cc	70.00%	0 Missing and 3 partials ⚠️
lib/internal/crypto/util.js	95.45%	2 Missing ⚠️
src/crypto/crypto_context.cc	71.42%	0 Missing and 2 partials ⚠️
src/env.cc	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65484      +/-   ##
==========================================
- Coverage   90.11%   90.08%   -0.03%     
==========================================
  Files         751      751              
  Lines      252473   254071    +1598     
  Branches    47487    47919     +432     
==========================================
+ Hits       227517   228884    +1367     
- Misses      16270    16409     +139     
- Partials     8686     8778      +92

Files with missing lines	Coverage Δ
lib/internal/crypto/cipher.js	`98.18% <100.00%> (+0.16%)`	⬆️
src/crypto/crypto_aes.h	`33.33% <ø> (ø)`
src/crypto/crypto_chacha20_poly1305.cc	`52.27% <100.00%> (ø)`
src/crypto/crypto_cipher.h	`68.47% <ø> (ø)`
src/crypto/crypto_hash.h	`25.00% <ø> (ø)`
src/env.h	`98.21% <ø> (ø)`
src/env.cc	`85.28% <75.00%> (-0.21%)`	⬇️
lib/internal/crypto/util.js	`97.45% <95.45%> (+0.34%)`	⬆️
src/crypto/crypto_context.cc	`71.73% <71.42%> (+0.06%)`	⬆️
src/crypto/crypto_cipher.cc	`79.57% <94.44%> (+1.34%)`	⬆️
... and 5 more

... and 86 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: nodejs#62982 Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: nodejs#43040 Fixes: nodejs#64866 Refs: nodejs#62982 Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva · 2026-08-23T12:45:40Z

Compared main with this branch at 54489eb, on macOS arm64 using OpenSSL 3.5.7 Release builds and each result uses 30 runs.

                                                                                        confidence improvement accuracy (*)   (**)  (***)
crypto/aes-gcm-throughput.js len=262144 cipher='aes-128-gcm' n=1000                                     1.30 %       ±1.62% ±2.16% ±2.83%
crypto/create-cipheriv.js operation='decrypt' cipher='aes-128-cbc' n=100000                    ***     -2.16 %       ±1.16% ±1.55% ±2.03%
crypto/create-cipheriv.js operation='encrypt' cipher='aes-128-cbc' n=100000                    ***     -2.00 %       ±1.06% ±1.42% ±1.85%
crypto/create-hash.js n=100000                                                                 ***     -3.52 %       ±1.87% ±2.49% ±3.25%
crypto/create-hmac.js keylen=16 algo='sha256' n=100000                                                 -0.18 %       ±1.46% ±1.94% ±2.54%
crypto/get-ciphers.js v='crypto' n=500000                                                      ***    -41.21 %       ±2.65% ±3.57% ±4.73%
crypto/getcipherinfo.js n=100000 cipher='aes-128-cbc'                                                  -1.16 %       ±1.24% ±1.66% ±2.18%
crypto/hash-stream-throughput.js api='legacy' len=102400 type='buf' algo='sha256' n=500                 0.65 %       ±1.52% ±2.03% ±2.65%
crypto/oneshot-hash.js n=1000 type='buffer' method='sha256' length=100000                               0.98 %       ±3.06% ±4.08% ±5.32%
crypto/oneshot-hash.js n=100000 type='buffer' method='sha256' length=1000                               0.54 %       ±1.77% ±2.36% ±3.08%
crypto/oneshot-sign.js n=1000 keyFormat='keyObject' mode='sync' keyType='rsa'                           0.11 %       ±0.64% ±0.85% ±1.11%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 11 comparisons, you can thus
expect the following amount of false-positive results:
  0.55 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.11 false positives, when considering a   1% risk acceptance (**, ***),
  0.01 false positives, when considering a 0.1% risk acceptance (***)

One-shot hashing, HMAC, signing, getCipherInfo(), and bulk throughput remain within measurement noise. Ordinary hash and cipher construction retain a small fixed-cost regression of approximately 2–3.5%.

The getCiphers() (and getHashes()) dip (41,780,884 ops/s down to 23,969,006 ops/s) is large but these are introspection APIs called infrequently, and the generation check prevents them from returning stale results after setFips() changes the active property query. Hashing and encryption throughput are unaffected by the getCiphers() (and getHashes()) dip.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: nodejs#62982 PR-URL: nodejs#65484 Backport-PR-URL: nodejs#65596 Fixes: nodejs#43040 Fixes: nodejs#64866 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: nodejs#43040 Fixes: nodejs#64866 Refs: nodejs#62982 PR-URL: nodejs#65484 Backport-PR-URL: nodejs#65596 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: nodejs#62982 PR-URL: nodejs#65484 Backport-PR-URL: nodejs#65596 Fixes: nodejs#43040 Fixes: nodejs#64866 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: nodejs#43040 Fixes: nodejs#64866 Refs: nodejs#62982 PR-URL: nodejs#65484 Backport-PR-URL: nodejs#65596 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: nodejs#62982 PR-URL: nodejs#65484 Fixes: nodejs#43040 Fixes: nodejs#64866 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: nodejs#43040 Fixes: nodejs#64866 Refs: nodejs#62982 PR-URL: nodejs#65484 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Enumerate usable digests and aliases from activated OpenSSL 3 providers rather than relying only on the legacy digest registry. Normalize provider aliases, omit numeric OIDs and NULL, and validate them against the active default property query. Preserve legacy names and the OpenSSL 1.1.1 and BoringSSL paths. Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider digests. Add `functionName` and `customization` options for cSHAKE digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later. Resolve provider-only digest names across hashing, HMAC, KDF, signing, verification, and RSA digest options. Keep ordinary hash construction and one-shot hashing on the original binding arities and direct initialization paths. Use parameterized setup only when cSHAKE options are supplied. Lazily cache successful provider fetches per Environment. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Introduce a process-wide FIPS-state generation that advances only after successful, state-changing `setFips()` calls. Use it to invalidate per-Environment digest caches and refresh `getHashes()` snapshots in the main thread and workers. Keep cache IDs monotonic across invalidation because JavaScript Realms can retain them. Existing hash contexts can finish across a transition. Release provider owners before unloading worker addon DSOs. Document provider-dependent availability and operation-specific restrictions. Add known-answer vectors, option validation, provider resolution, property-query, FIPS transition, worker, snapshot, and cross-API coverage. Refs: #62982 PR-URL: #65484 Backport-PR-URL: #66128 Fixes: #43040 Fixes: #64866 Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: #43040 Fixes: #64866 Refs: #62982 PR-URL: #65484 Backport-PR-URL: #66128 Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Notable changes: crypto: * (SEMVER-MINOR) add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) #65553 * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411 doc: * add araujogui to collaborators (Guilherme Araújo) #66090 * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) #65593 net: * (SEMVER-MINOR) support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725 perf_hooks: * (SEMVER-MINOR) implement SlidingWindowHistogram (James M Snell) #65825 * (SEMVER-MINOR) implement qrde analysis support in Histogram (James M Snell) #65806 * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) #65606 * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) #65434 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.close() (Guilherme Araújo) #64232 * (SEMVER-MINOR) add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232 src,lib: * (SEMVER-MINOR) add util.markPromiseAsHandled (James M Snell) #65805 test: * (SEMVER-MINOR) expand histogram test coverage (James M Snell) #65825 util: * (SEMVER-MINOR) implement util.throttle (James M Snell) #65899 * (SEMVER-MINOR) implement debounce (James M Snell) #65899 PR-URL: #66667

Notable changes: crypto: * (SEMVER-MINOR) add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) #65553 * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411 doc: * add araujogui to collaborators (Guilherme Araújo) #66090 * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) #65593 net: * (SEMVER-MINOR) support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725 perf_hooks: * (SEMVER-MINOR) implement SlidingWindowHistogram (James M Snell) #65825 * (SEMVER-MINOR) implement qrde analysis support in Histogram (James M Snell) #65806 * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) #65606 * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) #65434 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.close() (Guilherme Araújo) #64232 * (SEMVER-MINOR) add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232 src,lib: * (SEMVER-MINOR) add util.markPromiseAsHandled (James M Snell) #65805 util: * (SEMVER-MINOR) implement util.throttle (James M Snell) #65899 * (SEMVER-MINOR) implement debounce (James M Snell) #65899 PR-URL: #66667

Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484

ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484

Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484

ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484

Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484

ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484

Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484

ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * chore: remove obsolete TLS external-memory accounting patch Upstream moved the SecureContext external-memory Increase() into Init() and guards the Decrease() on ctx_, so the leak this patch fixed is gone. The patch's removal of that guard now double-decrements when v24.22.0's TLSSocket closes a single-use context before the wrapper is destroyed, tripping V8's ExternalMemoryAccounter DCHECK in every TLS test. Already dropped on main in #53524. * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * chore: remove obsolete TLS external-memory accounting patch Upstream moved the SecureContext external-memory Increase() into Init() and guards the Decrease() on ctx_, so the leak this patch fixed is gone. The patch's removal of that guard now double-decrements when v24.22.0's TLSSocket closes a single-use context before the wrapper is destroyed, tripping V8's ExternalMemoryAccounter DCHECK in every TLS test. Already dropped on main in #53524. * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

* chore: bump node in DEPS to v24.22.0 * fix(patch): enable the V8 sandbox in shared-cage builds Upstream now enables the V8 sandbox only for shared-cage builds. Keep Electron's behaviour of enabling it whenever pointer compression is on, matching Chromium's V8. The unofficial.gni x86 hunk landed upstream. Ref: nodejs/node#62237 Ref: nodejs/node#65491 * fix(patch): use names for asymmetric key algorithms Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h> from env.h, so those hunks are no longer needed. Ref: nodejs/node#65966 Ref: nodejs/node#66108 Ref: nodejs/node#65484 * fix(patch): skip RSA-PSS keygen deprecation tests with BoringSSL The skip is now upstream. Ref: nodejs/node#65808 * fix(patch): detach cppgc wrappers from their Realm before it is freed Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the wrapper owns and frees its list node, so the local PopFront/delete hunk is dropped. Ref: nodejs/node#65778 * fix(patch): gate jspi flag on V8_ENABLE_WEBASSEMBLY Ref: nodejs/node#66082 * chore: remove upstreamed patches - nodejs/node#63985 - nodejs/node#65630 - nodejs/node#64453 - nodejs/node#65778 * chore: update patches (trivial only) * chore: update filenames.auto.gni * fix(patch): discover hashes from OpenSSL providers ncrypto's DigestCache::aliases() now has a function-local static, so ncrypto needs the no_exit_time_destructors config too. Ref: nodejs/node#65484 * fix(patch): read the peer certificate chain without consuming it sk_X509_num() returns size_t in BoringSSL. Ref: nodejs/node#65602 * fix(patch): fix shared buffer growability validation Ref: nodejs/node#65845 * chore: update patches (trivial only) * node#65820: src: fix null pointer call when running without a startup snapshot SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData(). Ref: nodejs/node#65820 * node#65407: src: apply IsolateSettings when using a snapshot node::CreateEnvironment() no longer installs the per-isolate message listener when it builds the environment from a snapshot, so stop compensating for that and let SetIsolateUpForNode() add it. Ref: nodejs/node#65407 * test: drop removed wasm rab integration flag from webidl buffer source test Chromium's V8 removed --experimental-wasm-rab-integration after shipping it; the new test-internal-webidl-buffer-source.js passes it. Ref: nodejs/node#65845 Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297 * test: skip new rmSync permission error test when the Node suite runs as root test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and relies on a read-only directory blocking removal, which root bypasses; the Linux Node.js test job runs as root. Ref: nodejs/node#64453 --------- Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Sam Attard <sattard@anthropic.com>

panva requested a review from jasnell August 22, 2026 12:47

nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Aug 22, 2026

panva requested a review from tniessen August 22, 2026 12:47

panva mentioned this pull request Aug 22, 2026

crypto: support provider-only SM4 cipher modes #65399

Closed

panva added the crypto Issues and PRs related to the crypto subsystem. label Aug 22, 2026

panva marked this pull request as draft August 22, 2026 18:56

panva force-pushed the crypto-provider-ciphers branch from 9242acf to 2cebe48 Compare August 22, 2026 20:11

panva marked this pull request as ready for review August 22, 2026 20:12

jasnell approved these changes Aug 22, 2026

View reviewed changes

panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Aug 22, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 22, 2026

This comment was marked as outdated.

Sign in to view

panva marked this pull request as draft August 23, 2026 09:57

panva added 2 commits August 23, 2026 14:07

panva force-pushed the crypto-provider-ciphers branch from 4bca8c4 to 54489eb Compare August 23, 2026 12:14

panva changed the title ~~crypto: discover ciphers from OpenSSL providers~~ crypto: discover hashes and ciphers from providers Aug 23, 2026

panva marked this pull request as ready for review August 23, 2026 12:17

panva requested a review from jasnell August 23, 2026 12:17

panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Aug 23, 2026

panva mentioned this pull request Aug 23, 2026

crypto: evict getCiphers/getHashes cache on setFips/setEngine #62985

Closed

panva removed the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Aug 23, 2026

panva added 2 commits August 23, 2026 15:41

fixup! crypto: discover ciphers from OpenSSL providers

7011e8c

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

fixup! crypto: discover hashes from OpenSSL providers

ac4548f

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva added the backport-open-v24.x Indicate that the PR has an open backport label Sep 19, 2026

panva added backported-to-v24.x PRs backported to the v24.x-staging branch. and removed backport-open-v24.x Indicate that the PR has an open backport labels Sep 21, 2026

github-actions Bot mentioned this pull request Oct 11, 2026

2026-10-14, Version 24.22.0 'Krypton' (LTS) #66667

Merged

Navigation Menu

Repository navigation

crypto: discover hashes and ciphers from providers - #65484

crypto: discover hashes and ciphers from providers#65484
panva wants to merge 6 commits into
nodejs:mainfrom
panva:crypto-provider-ciphers

panva commented Aug 22, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Aug 22, 2026

Uh oh!

codecov Bot commented Aug 22, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

panva commented Aug 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

panva commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resolution and API support

Caching and invalidation

Uh oh!

nodejs-github-bot commented Aug 22, 2026

Uh oh!

codecov Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

panva commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

panva commented Aug 22, 2026 •

edited

Loading

codecov Bot commented Aug 22, 2026 •

edited

Loading

panva commented Aug 23, 2026 •

edited

Loading