mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
Enumerate usable ciphers and aliases from activated OpenSSL 3 providers instead of maintaining lists of provider-only algorithms. Skip numeric OID aliases and filter NULL, TLS composite, multiblock, and encrypt-then-MAC implementations that the Cipher APIs cannot use. Preserve the OpenSSL 1.1.1 and BoringSSL paths. Expose CBC-CTS, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key wrap implementations. Add `ctsMode` (CS1/CS2/CS3) and `xtsStandard` (GB/IEEE) options for selecting provider CTS and SM4-XTS variants. Keep ordinary cipher construction on the original binding and legacy lookup paths. Lazily cache successful provider fetches per Environment for string initialization and `getCipherInfo()`. Index entries by case-insensitive query, canonical, and alias names. Deduplicate owners by provider and canonical identity. Return borrowed pointers on warm hits. Use the shared process-wide FIPS-state generation to invalidate per-Environment cipher caches and refresh `getCiphers()` snapshots in the main thread and workers. Existing cipher contexts retain their implementation and can finish across a transition. Release provider owners before unloading worker addon DSOs. Enforce one-shot updates for CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption. Reject finalization without required input or CCM tags, and defer authentication failures to `final()`. Document streaming and XTS data-unit constraints. Add known-answer vectors, option validation, provider round trips, cache, worker, snapshot, FIPS transition, and construction benchmark coverage. Fixes: https://github.com/nodejs/node/issues/43040 Fixes: https://github.com/nodejs/node/issues/64866 Refs: https://github.com/nodejs/node/issues/62982 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: https://github.com/nodejs/node/pull/65484 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
63 lines
1.5 KiB
JavaScript
63 lines
1.5 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common.js');
|
|
const assert = require('node:assert');
|
|
const {
|
|
createCipheriv,
|
|
createDecipheriv,
|
|
getCiphers,
|
|
} = require('node:crypto');
|
|
|
|
const configurations = {
|
|
'aes-128-cbc': { keyLength: 16, ivLength: 16 },
|
|
'aes-128-gcm': { keyLength: 16, ivLength: 12 },
|
|
'aes-128-cbc-cts': { keyLength: 16, ivLength: 16 },
|
|
'aes-128-wrap-inv': { keyLength: 16, ivLength: 8 },
|
|
'aes128-wrap-inv': {
|
|
keyLength: 16,
|
|
ivLength: 8,
|
|
warmupCipher: 'aes-128-wrap-inv',
|
|
},
|
|
};
|
|
|
|
const ciphers = ['aes-128-cbc', 'aes-128-gcm'];
|
|
const availableCiphers = new Set(getCiphers());
|
|
for (const cipher of [
|
|
'aes-128-cbc-cts',
|
|
'aes-128-wrap-inv',
|
|
'aes128-wrap-inv',
|
|
]) {
|
|
if (availableCiphers.has(cipher)) {
|
|
ciphers.push(cipher);
|
|
}
|
|
}
|
|
|
|
const bench = common.createBenchmark(main, {
|
|
n: [1e5],
|
|
cipher: ciphers,
|
|
operation: ['encrypt', 'decrypt'],
|
|
});
|
|
|
|
function main({ n, cipher, operation }) {
|
|
const {
|
|
keyLength,
|
|
ivLength,
|
|
warmupCipher = cipher,
|
|
} = configurations[cipher];
|
|
const key = Buffer.alloc(keyLength);
|
|
const iv = Buffer.alloc(ivLength);
|
|
const results = new Array(n);
|
|
const method = operation === 'encrypt' ? createCipheriv : createDecipheriv;
|
|
|
|
const warmup = method(warmupCipher, key, iv);
|
|
assert.strictEqual(typeof warmup, 'object');
|
|
|
|
bench.start();
|
|
for (let i = 0; i < n; ++i) {
|
|
results[i] = method(cipher, key, iv);
|
|
}
|
|
bench.end(n);
|
|
|
|
assert.strictEqual(typeof results[n - 1], 'object');
|
|
}
|