| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
There was a problem hiding this comment.
/cc @nodejs/crypto
Sorry, something went wrong.
|
Thank you for your contribution, @3nprob! As far as I know, SHA-512 is highly unusual for fingerprinting certificates, whereas SHA-1 and SHA-256 are very commonly used for this purpose (e.g., by browsers such as Firefox, Chrome, by CAs such as digicert, by existing software such as .NET and Node.js, etc.). As far as I can tell, SHA-512 has no real advantages over SHA-256 for fingerprinting X509 certificates. There is little to no security benefit. The hashes are even longer and impractical for humans (128 hexadecimal characters). Storing and transmitting longer hashes effectively wastes storage and bandwidth. (Also, most X509 certificates use SHA-256 as part of their signature algorithm. Therefore, if someone does break SHA-256 at some point in the future, they will be able to spoof X509 certificates anyway, rendering fingerprinting pointless.) The other concern is that, if SHA-512 is a non-standard way of fingerprinting certificates, there could be ten more PRs tomorrow adding fingerprint* properties for literally all hash functions supported by Node.js/OpenSSL. For example, despite being insecure, MD5 is still commonly used for fingerprinting. It is simple enough for Node.js applications to calculate other hash values using the .raw property of certificate objects, if necessary. |
Sorry, something went wrong.
There was a problem hiding this comment.
Making my concerns explicit.
Sorry, something went wrong.
For example: tls.connect({
host: 'nodejs.org',
port: 443,
checkServerIdentity(h, cert) {
const fingerprint512 = crypto.createHash('sha512').update(cert.raw).digest();
console.log(fingerprint512);
return tls.checkServerIdentity(h, cert);
}
}); |
Sorry, something went wrong.
|
@tniessen For one, it's used for SASL CertFP authentication on major IRC networks like Libera and Freenode. In fact, it's what's provided in NickServ/SaslServ. In practice any IRC user doing certificate auth will need to supply their sha512 fingerprint to nickserv. So any complete IRC client (and some servers) will want this, for example. It's also used for TOFU on Gemini and is not an uncommon choice for SAML implementations. I don't think any other hash algorithm comes even close in adoption. Thanks for the example, it does work for my personal use-case but still think this could be considered for inclusion. |
Sorry, something went wrong.
I stand corrected :)
It's still questionable if SHA-512 has any real benefit over SHA-256 and neither IRC nor Gemini are primary domains of Node.js, but since this is apparently being used in the wild, I don't see much harm in adding it as long as it doesn't act as a precedence for adding other digests that are being used by other small domains. |
Sorry, something went wrong.
|
I would also suggest improving the documentation for fingerprint to mention the alternative code. Something like:
So that users can easily derive the code for other algorithms they may need. |
Sorry, something went wrong.
I'll add that in a separate PR, I'd also like to add a few details regarding the format. |
Sorry, something went wrong.
|
@3nprob However, this does need an update to the YAML block around line 1091 in tls.md (not needed in crypto.md). |
Sorry, something went wrong.
I assume you're talking about the example cert? Good catch, just added a bogus fingerprint line |
Sorry, something went wrong.
|
@3nprob No, I was referring to the YAML block around line 1091, which tracks changes that were made to the API: changes:
- version: v11.4.0
pr-url: https://github.com/nodejs/node/pull/24358
description: Support Elliptic Curve public key info.(Unfortunately, GitHub doesn't let me add comments to lines that you did not change in this PR.) |
Sorry, something went wrong.
Right! Should be addressed now |
Sorry, something went wrong.
|
I am not sure why this stalled. @3nprob, would you mind rebasing and fixing the conflict in tls.md? (Feel free to @ ping me, I might miss the notification otherwise.) |
Sorry, something went wrong.
PR-URL: #39809 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #39809 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Notable changes * async_hooks: * (SEMVER-MINOR) expose async\_wrap providers (Rafael Gonzaga) #40760 * child_process: * (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225 * doc: * add @Mesteery to collaborators (Mestery) #41543 * add @bnb as a collaborator (Tierney Cyren) #41100 * esm: * (SEMVER-MINOR) add support for JSON import assertion (Antoine du Hamel) #40250 * (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267 * (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246 * events: * (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899 * lib: * (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050 * (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899 * (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807 * (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433 * (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433 * perf_hooks: * (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153 * process: * (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813 * src: * (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809 * (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339 * stream: * (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354 * (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199 * (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815 * deprecate thenable support (Antoine du Hamel) #40860 * util: * (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019 * (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003 * (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002 * timers: * (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909 * v8: * (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283 PR-URL: #41804
Notable changes * async_hooks: * (SEMVER-MINOR) expose async\_wrap providers (Rafael Gonzaga) #40760 * child_process: * (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225 * doc: * add @Mesteery to collaborators (Mestery) #41543 * add @bnb as a collaborator (Tierney Cyren) #41100 * esm: * (SEMVER-MINOR) add support for JSON import assertion (Antoine du Hamel) #40250 * (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267 * (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246 * events: * (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899 * lib: * (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050 * (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899 * (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807 * (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433 * (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433 * perf_hooks: * (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153 * process: * (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813 * src: * (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809 * (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339 * stream: * (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354 * (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199 * (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815 * deprecate thenable support (Antoine du Hamel) #40860 * util: * (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019 * (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003 * (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002 * timers: * (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909 * v8: * (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283 PR-URL: #41804
Notable changes * async_hooks: * (SEMVER-MINOR) expose async\_wrap providers (Rafael Gonzaga) #40760 * child_process: * (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225 * doc: * add @Mesteery to collaborators (Mestery) #41543 * add @bnb as a collaborator (Tierney Cyren) #41100 * esm: * (SEMVER-MINOR) add support for JSON import assertion (Antoine du Hamel) #40250 * (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267 * (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246 * events: * (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899 * lib: * (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050 * (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899 * (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807 * (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433 * (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433 * perf_hooks: * (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153 * process: * (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813 * src: * (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809 * (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339 * stream: * (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354 * (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199 * (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815 * deprecate thenable support (Antoine du Hamel) #40860 * util: * (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019 * (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003 * (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002 * timers: * (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909 * v8: * (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283 PR-URL: #41804
Notable changes:
Importing JSON modules now requires experimental import assertions
syntax
This release adds experimental support for the import assertions stage 3
proposal.
To keep Node.js ESM implementation as compatible as possible with the
HTML spec, import assertions are now required to import JSON modules
(still behind the `--experimental-json-modules` CLI flag):
```mjs
import info from './package.json' assert { type: 'json' };
```
Or use dynamic import:
```mjs
const info = await import('./package.json', {
assert: { type: 'json' }
});
```
Contributed by Antoine du Hamel and Geoffrey Booth #40250
Other notable changes:
* async_hooks:
* (SEMVER-MINOR) expose async_wrap providers (Rafael Gonzaga) #40760
* child_process:
* (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225
* doc:
* add @Mesteery to collaborators (Mestery) #41543
* add @bnb as a collaborator (Tierney Cyren) #41100
* esm:
* (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267
* (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246
* events:
* (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899
* fs:
* (SEMVER-MINOR) accept URL as argument for `fs.rm` and `fs.rmSync` (Antoine du Hamel) #41132
* lib:
* (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050
* (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899
* (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807
* (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433
* (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433
* loader:
* (SEMVER-MINOR) return package format from defaultResolve if known (Gabriel Bota) #40980
* perf_hooks:
* (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153
* process:
* (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813
* src:
* (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809
* (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339
* stream:
* (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354
* (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199
* (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815
* deprecate thenable support (Antoine du Hamel) #40860
* util:
* (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019
* (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003
* (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002
* timers:
* (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909
* v8:
* (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283
PR-URL: #41804
Notable changes:
Importing JSON modules now requires experimental import assertions
syntax
This release adds experimental support for the import assertions stage 3
proposal.
To keep Node.js ESM implementation as compatible as possible with the
HTML spec, import assertions are now required to import JSON modules
(still behind the `--experimental-json-modules` CLI flag):
```mjs
import info from './package.json' assert { type: 'json' };
```
Or use dynamic import:
```mjs
const info = await import('./package.json', {
assert: { type: 'json' }
});
```
Contributed by Antoine du Hamel and Geoffrey Booth #40250
Other notable changes:
* async_hooks:
* (SEMVER-MINOR) expose async_wrap providers (Rafael Gonzaga) #40760
* child_process:
* (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225
* doc:
* add @Mesteery to collaborators (Mestery) #41543
* add @bnb as a collaborator (Tierney Cyren) #41100
* esm:
* (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267
* (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246
* events:
* (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899
* fs:
* (SEMVER-MINOR) accept URL as argument for `fs.rm` and `fs.rmSync` (Antoine du Hamel) #41132
* lib:
* (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050
* (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899
* (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807
* (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433
* (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433
* loader:
* (SEMVER-MINOR) return package format from defaultResolve if known (Gabriel Bota) #40980
* perf_hooks:
* (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153
* process:
* (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813
* src:
* (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809
* (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339
* stream:
* (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354
* (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199
* (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815
* deprecate thenable support (Antoine du Hamel) #40860
* util:
* (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019
* (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003
* (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002
* timers:
* (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909
* v8:
* (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283
PR-URL: #41804
Notable changes:
Importing JSON modules now requires experimental import assertions
syntax
This release adds experimental support for the import assertions stage 3
proposal.
To keep Node.js ESM implementation as compatible as possible with the
HTML spec, import assertions are now required to import JSON modules
(still behind the `--experimental-json-modules` CLI flag):
```mjs
import info from './package.json' assert { type: 'json' };
```
Or use dynamic import:
```mjs
const info = await import('./package.json', {
assert: { type: 'json' }
});
```
Contributed by Antoine du Hamel and Geoffrey Booth #40250
Other notable changes:
* async_hooks:
* (SEMVER-MINOR) expose async_wrap providers (Rafael Gonzaga) #40760
* child_process:
* (SEMVER-MINOR) add support for URL to `cp.fork` (Antoine du Hamel) #41225
* doc:
* add @Mesteery to collaborators (Mestery) #41543
* add @bnb as a collaborator (Tierney Cyren) #41100
* esm:
* (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267
* (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246
* events:
* (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899
* fs:
* (SEMVER-MINOR) accept URL as argument for `fs.rm` and `fs.rmSync` (Antoine du Hamel) #41132
* lib:
* (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050
* (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899
* (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807
* (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433
* (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433
* loader:
* (SEMVER-MINOR) return package format from defaultResolve if known (Gabriel Bota) #40980
* perf_hooks:
* (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153
* process:
* (SEMVER-MINOR) add `getActiveResourcesInfo()` (Darshan Sen) #40813
* src:
* (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809
* (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339
* stream:
* (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354
* (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199
* (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815
* deprecate thenable support (Antoine du Hamel) #40860
* util:
* (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019
* (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003
* (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002
* timers:
* (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909
* v8:
* (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283
PR-URL: #41804
* chore: bump node in DEPS to v16.14.0 * src: add flags for controlling process behavior nodejs/node#40339 * src: add x509.fingerprint512 to crypto module nodejs/node#39809 * deps: upgrade to libuv 1.43.0 nodejs/node#41398 * chore: fixup patch indices * chore: add missing filenames nodejs/node#39283 nodejs/node#40665 * crypto: trim input for NETSCAPE_SPKI_b64_decode nodejs/node#40757 * chore: update patches * chore: bump node in DEPS to v16.14.1 * tools: enable no-empty ESLint rule nodejs/node#41831 * chore: update patches * chore: update patches * chore: bump node in DEPS to v16.14.2 * chore: update patches Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com> Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
* chore: bump node in DEPS to v16.14.0 * src: add flags for controlling process behavior nodejs/node#40339 * src: add x509.fingerprint512 to crypto module nodejs/node#39809 * deps: upgrade to libuv 1.43.0 nodejs/node#41398 * chore: fixup patch indices * chore: add missing filenames nodejs/node#39283 nodejs/node#40665 * crypto: trim input for NETSCAPE_SPKI_b64_decode nodejs/node#40757 * chore: update patches * chore: bump node in DEPS to v16.14.1 * tools: enable no-empty ESLint rule nodejs/node#41831 * chore: update patches * chore: update patches * chore: bump node in DEPS to v16.14.2 * chore: update patches Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com> Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
* chore: bump node in DEPS to v16.14.0 * src: add flags for controlling process behavior nodejs/node#40339 * src: add x509.fingerprint512 to crypto module nodejs/node#39809 * deps: upgrade to libuv 1.43.0 nodejs/node#41398 * chore: fixup patch indices * chore: add missing filenames nodejs/node#39283 nodejs/node#40665 * crypto: trim input for NETSCAPE_SPKI_b64_decode nodejs/node#40757 * chore: update patches * chore: bump node in DEPS to v16.14.1 * tools: enable no-empty ESLint rule nodejs/node#41831 * chore: update patches * chore: update patches * chore: bump node in DEPS to v16.14.2 * chore: update patches Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com> Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com> Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Refs: nodejs#39809 Refs: nodejs#40239 PR-URL: nodejs#47892 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
| Back | FazBrowse Home | New Git URL |
SHA-512 equivalent of fingerprint256.
I am working on an integration with a protocol where by convention SHA512 fingerprints of certificates are used and I feel this belongs better here than in a module.