FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: default ML-KEM and ML-DSA pkcs8 export to seed-only format · nodejs/node@da5843b · GitHub

/ node Public

Commit da5843b

Browse files
panva
authored
crypto: default ML-KEM and ML-DSA pkcs8 export to seed-only format
Configure OpenSSL provider parameters to prefer seed-only format when exporting ML-KEM and ML-DSA private keys that contain a seed. Keys without a seed continue to use the private-only format. PR-URL: #62178 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Michaël Zasso <targos@protonmail.com>
1 parent 66a687f commit da5843b

4 files changed

Lines changed: 24 additions & 2 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2121,6 +2121,11 @@ type, value, and parameters. This method is not
21212121
<!-- YAML
21222122
added: v11.6.0
21232123
changes:
2124+
- version: REPLACEME
2125+
pr-url: https://github.com/nodejs/node/pull/62178
2126+
description: ML-KEM and ML-DSA private key `'pkcs8'` export now
2127+
uses seed-only format by default when a seed is
2128+
available.
21242129
- version: v15.9.0
21252130
pr-url: https://github.com/nodejs/node/pull/37081
21262131
description: Added support for `'jwk'` format.

‎src/crypto/crypto_util.cc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,23 @@ void InitCryptoOnce() {
138138
#endif
139139

140140
OPENSSL_init_ssl(0, settings);
141+
142+
#if OPENSSL_WITH_PQC
143+
// Configure all loaded providers to prefer seed-only format for ML-KEM and
144+
// ML-DSA private keys in PKCS#8 export, falling back to priv-only when a
145+
// seed is not available. The provider encoder reads these parameters at
146+
// encoding time via ossl_prov_ctx_get_param().
147+
OSSL_PROVIDER_do_all(
148+
nullptr,
149+
[](OSSL_PROVIDER* provider, void*) -> int {
150+
OSSL_PROVIDER_add_conf_parameter(
151+
provider, "ml-kem.output_formats", "seed-only,priv-only");
152+
OSSL_PROVIDER_add_conf_parameter(
153+
provider, "ml-dsa.output_formats", "seed-only,priv-only");
154+
return 1;
155+
},
156+
nullptr);
157+
#endif
141158
OPENSSL_INIT_free(settings);
142159
settings = nullptr;
143160

‎test/parallel/test-crypto-pqc-key-objects-ml-dsa.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ for (const [asymmetricKeyType, pubLen] of [
6969
assertPublicKey(createPublicKey(key));
7070
key.export({ format: 'der', type: 'pkcs8' });
7171
if (hasSeed) {
72-
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private);
72+
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only);
7373
} else {
7474
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_priv_only);
7575
}

‎test/parallel/test-crypto-pqc-key-objects-ml-kem.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
4848
assertPublicKey(createPublicKey(key));
4949
key.export({ format: 'der', type: 'pkcs8' });
5050
if (hasSeed) {
51-
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private);
51+
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only);
5252
} else {
5353
assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_priv_only);
5454
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL