Review requested:

• @nodejs/crypto
• @nodejs/security-wg

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @panva.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

Codecov Report

❌ Patch coverage is 87.58170% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.69%. Comparing base (abff716) to head (38b4d03).
⚠️ Report is 57 commits behind head on main.

@@            Coverage Diff             @@
##             main   #62345      +/-   ##
==========================================
- Coverage   91.60%   89.69%   -1.92%     
==========================================
  Files         337      676     +339     
  Lines      140745   206795   +66050     
  Branches    21807    39615   +17808     
==========================================
+ Hits       128933   185485   +56552     
- Misses      11588    13443    +1855     
- Partials      224     7867    +7643     

... and 457 files with indirect coverage changes

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Not entirely certain how this works, will test

Not entirely certain how this works, will test

regular

crypto.sign('sha256', data, key) uses OpenSSL's EVP_DigestSign API, it hashes the input internally, then signs the resulting digest. One call does both steps.

prehashed

crypto.signDigest('sha256', digest, key) uses the lower-level EVP_PKEY_sign API, it receives an already-computed digest and goes straight for the signature. No hashing happens inside OpenSSL.

Even though the digest is already computed, OpenSSL needs to know which digest was used:

• RSA PKCS#1 v1.5, The signed payload isn't just the hash. It's DigestInfo || hash, where DigestInfo is an ASN.1 prefix encoding the digest algorithm OID. Without the algorithm, OpenSSL can't construct DigestInfo, and verifiers wouldn't know what they're looking at.

• RSA-PSS, digest algorithm feeds into both the MGF1 mask generation and the internal padding hash. OpenSSL needs it to build the PSS padding structure correctly.

• ECDSA / DSA, digest bytes are interpreted as a big integer (truncated to the curve order bit-length for ECDSA). EVP_PKEY_CTX_set_signature_md is still required by OpenSSL for consistency, even though the actual ECDSA/DSA math only operates on the raw digest bytes. This is also why signing a SHA-512 digest with P-256 (32-byte order) works fine, the integer just gets truncated.

Other key type dependant cases:

• Ed25519ph / Ed448ph, have fixed prehash requirements (SHA-512 for Ed25519ph, SHAKE256(m, 64) for Ed448ph)

• ML-DSA, has a fixed prehash construction, external mu per FIPS 204 not supported

• SLH-DSA (Pure SLH-DSA), not supported

• HashSLH-DSA, not supported

(nothing changed about the implementation, just extended test coverage)

(I've removed ML-DSA from this PR for now until I figure if and how to make both external mu and HashML-DSA work)

w3c/webcrypto#431 is related

This pull request has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.