crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL by panva · Pull Request #63255 · nodejs/node · GitHub

This PR wires up the following when using BoringSSL:

AES-KW in Web Cryptography
ChaCha20-Poly1305 in Web Cryptography experimental Issues and PRs related to experimental features.
ML-DSA and ML-KEM in Web Cryptography experimental Issues and PRs related to experimental features.
ML-DSA and ML-KEM in node:crypto

Refs: electron/electron#36256
Refs: electron/electron#41720
Refs: electron/electron#51127

Review requested:

@nodejs/crypto
@nodejs/performance
@nodejs/security-wg

Codecov Report

❌ Patch coverage is 90.24390% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.05%. Comparing base (6482073) to head (a1d227f).
⚠️ Report is 24 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/crypto/webidl.js	50.00%	5 Missing ⚠️
src/crypto/crypto_pqc.cc	92.00%	0 Missing and 2 partials ⚠️
src/crypto/crypto_keys.cc	97.61%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #63255      +/-   ##
==========================================
+ Coverage   90.04%   90.05%   +0.01%     
==========================================
  Files         714      714              
  Lines      225352   225371      +19     
  Branches    42605    42621      +16     
==========================================
+ Hits       202909   202954      +45     
+ Misses      14234    14191      -43     
- Partials     8209     8226      +17

Files with missing lines	Coverage Δ
lib/internal/crypto/util.js	97.08% <100.00%> (+0.10%)	⬆️
src/crypto/crypto_aes.cc	54.16% <ø> (+0.34%)	⬆️
src/crypto/crypto_aes.h	33.33% <ø> (ø)
src/crypto/crypto_argon2.cc	64.13% <ø> (ø)
src/crypto/crypto_argon2.h	50.00% <ø> (ø)
src/crypto/crypto_chacha20_poly1305.cc	58.13% <ø> (ø)
src/crypto/crypto_cipher.cc	77.43% <ø> (ø)
src/crypto/crypto_kem.cc	80.74% <ø> (ø)
src/crypto/crypto_kem.h	33.33% <ø> (ø)
src/crypto/crypto_kmac.cc	56.66% <ø> (ø)
... and 7 more

... and 34 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

CI: https://ci.nodejs.org/job/node-test-pull-request/73471/ 💚

More importantly for the change here: https://github.com/nodejs/node/actions/runs/25911580593/job/76158001919?pr=63255 💚

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Backport-PR-URL: nodejs#63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Backport-PR-URL: nodejs#63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

panva requested review from anonrig, codebytere and jasnell May 11, 2026 16:17

panva added crypto Issues and PRs related to the crypto subsystem. webcrypto commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. labels May 11, 2026

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 11, 2026

panva requested a review from addaleax May 11, 2026 16:17

panva mentioned this pull request May 11, 2026

chore: add Phase Three (node smoke tests) to Node.js upgrade skill electron/electron#51127

Merged

5 tasks

panva added 3 commits May 15, 2026 09:47

src: simplify OpenSSL feature gates

45d5040

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

crypto: wire AES-KW in Web Cryptography when using BoringSSL

9a007e4

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL

556bcb3

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva force-pushed the make-crypto-boring-again branch from 96d0932 to fbb81c2 Compare May 15, 2026 07:47

crypto: wire ML-DSA and ML-KEM for use when using BoringSSL

a1d227f

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva force-pushed the make-crypto-boring-again branch from fbb81c2 to a1d227f Compare May 15, 2026 09:51

jasnell approved these changes May 15, 2026

View reviewed changes

panva added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels May 15, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 15, 2026

This comment was marked as outdated.

Sign in to view

panva added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v25.x labels May 16, 2026

anonrig approved these changes May 17, 2026

View reviewed changes

panva added the commit-queue Add this label to land a pull request using GitHub Actions. label May 17, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 17, 2026

sxa mentioned this pull request Jun 22, 2026

2026-06-23, Version 24.18.0 'Krypton' (LTS) #64062

Merged

This was referenced Jul 27, 2026

chore(mise): upgrade local tools jylenhof/mise-update-tool#18

Closed

chore(mise): upgrade local tools jylenhof/mise-update-tool#23

Closed

ghappforreleaseplease Bot mentioned this pull request Aug 10, 2026

chore(mise): upgrade local tools jylenhof/mise-update-tool#28

Closed

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL by panva · Pull Request #63255 · nodejs/node · GitHub

Uh oh!

Uh oh!

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL - #63255

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL#63255
panva wants to merge 4 commits into
nodejs:mainfrom
panva:make-crypto-boring-again

panva commented May 11, 2026 •
edited
Loading

Uh oh!

Uh oh!

nodejs-github-bot commented May 11, 2026

Uh oh!

codecov Bot commented May 11, 2026 •
edited
Loading

Uh oh!

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented May 15, 2026 •
edited by panva
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL by panva · Pull Request #63255 · nodejs/node · GitHub

Uh oh!

Uh oh!

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL - #63255

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL#63255panva wants to merge 4 commits intonodejs:mainnodejs/node:mainfrom panva:make-crypto-boring-againpanva/node:make-crypto-boring-againCopy head branch name to clipboard

Conversation

panva commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented May 11, 2026

Uh oh!

codecov Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented May 15, 2026 • edited by panva Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL#63255
panva wants to merge 4 commits into
nodejs:mainfrom
panva:make-crypto-boring-again

panva commented May 11, 2026 •
edited
Loading

codecov Bot commented May 11, 2026 •
edited
Loading

nodejs-github-bot commented May 15, 2026 •
edited by panva
Loading