Skip to content

crypto: disable non-FIPS WebCrypto paths in FIPS mode - #65172

Open
panva wants to merge 2 commits into
nodejs:mainfrom
panva:hide-non-fips
Open

crypto: disable non-FIPS WebCrypto paths in FIPS mode#65172
panva wants to merge 2 commits into
nodejs:mainfrom
panva:hide-non-fips

Conversation

@panva

@panva panva commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Disable Web Cryptography's hand rolled XOF digests and reject cSHAKE and KMAC parameters that work around the OpenSSL FIPS provider's capability when FIPS mode is enabled.

These are all experimental Issues and PRs related to experimental features. .

@panva panva added experimental Issues and PRs related to experimental features. webcrypto labels Aug 9, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/web-standards

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Aug 9, 2026
@panva
panva marked this pull request as draft August 9, 2026 20:15
@panva
crypto: disable non-FIPS WebCrypto paths in FIPS mode
b6252b1 
Hide TurboSHAKE and KangarooTwelve when FIPS is enabled. Reject cSHAKE
and KMAC parameters that require implementations outside the OpenSSL
provider, while keeping provider-backed paths available.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva
panva marked this pull request as ready for review August 9, 2026 20:51
mcollina
mcollina approved these changes Aug 9, 2026
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@panva panva added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Aug 9, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75714/

@codecov

codecov Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 73.13433% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.32%. Comparing base (8c8190f) to head (1a460d2).
⚠️ Report is 7 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/crypto/webidl.js 79.41% 7 Missing ⚠️
src/crypto/crypto_turboshake.cc 0.00% 4 Missing and 2 partials ⚠️
src/crypto/crypto_hash.cc 0.00% 2 Missing and 1 partial ⚠️
lib/internal/crypto/util.js 92.85% 1 Missing ⚠️
src/crypto/crypto_kmac.cc 0.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #65172      +/-   ##
==========================================
- Coverage   90.33%   90.32%   -0.01%     
==========================================
  Files         759      759              
  Lines      248456   248504      +48     
  Branches    46871    46881      +10     
==========================================
+ Hits       224439   224465      +26     
- Misses      15454    15469      +15     
- Partials     8563     8570       +7
Files with missing lines Coverage Δ
lib/internal/crypto/mac.js 99.01% <100.00%> (+0.01%) ⬆️
src/crypto/crypto_util.cc 71.95% <100.00%> (+0.17%) ⬆️
src/crypto/crypto_util.h 67.43% <ø> (ø)
lib/internal/crypto/util.js 97.10% <92.85%> (-0.06%) ⬇️
src/crypto/crypto_kmac.cc 61.68% <0.00%> (-0.41%) ⬇️
src/crypto/crypto_hash.cc 72.96% <0.00%> (-0.61%) ⬇️
src/crypto/crypto_turboshake.cc 78.61% <0.00%> (-1.34%) ⬇️
lib/internal/crypto/webidl.js 97.42% <79.41%> (-0.83%) ⬇️

... and 23 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollina mcollina mcollina approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. experimental Issues and PRs related to experimental features. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. webcrypto

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@panva @nodejs-github-bot @mcollina