GeezerVison is showing github.com — crypto: fix Argon2 bypassing FIPS mode · nodejs/node@ba27e72
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.cc +17-8Lines changed: 17 additions & 8 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -1996,15 +1996,24 @@ DataPointer argon2(const Buffer<const char>& pass, |
1996 | 1996 | return {}; |
1997 | 1997 | } |
1998 | 1998 |
|
1999 | | - // creates a new library context to avoid locking when running concurrently |
2000 | | - auto ctx = DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free>{OSSL_LIB_CTX_new()}; |
2001 | | - if (!ctx) { |
2002 | | - return {}; |
2003 | | - } |
| 1999 | + // A new library context is only needed for OSSL_set_max_threads(), which is |
| 2000 | + // per-context. It inherits no configuration, so availability is checked |
| 2001 | + // against the default context, otherwise Argon2 works in FIPS mode. |
| 2002 | + DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> ctx; |
| 2003 | + if (lanes > 1) { |
| 2004 | + if (!DeleteFnPtr<EVP_KDF, EVP_KDF_free>{ |
| 2005 | + EVP_KDF_fetch(nullptr, algorithm.data(), nullptr)}) { |
| 2006 | + return {}; |
| 2007 | + } |
2004 | 2008 |
|
2005 | | - // required if threads > 1 |
2006 | | - if (lanes > 1 && OSSL_set_max_threads(ctx.get(), lanes) != 1) { |
2007 | | - return {}; |
| 2009 | + ctx.reset(OSSL_LIB_CTX_new()); |
| 2010 | + if (!ctx) { |
| 2011 | + return {}; |
| 2012 | + } |
| 2013 | + |
| 2014 | + if (OSSL_set_max_threads(ctx.get(), lanes) != 1) { |
| 2015 | + return {}; |
| 2016 | + } |
2008 | 2017 | } |
2009 | 2018 |
|
2010 | 2019 | auto kdf = DeleteFnPtr<EVP_KDF, EVP_KDF_free>{ |
|