GeezerVison is showing github.com — crypto: default ML-KEM and ML-DSA pkcs8 export to seed-only format · nodejs/node@da5843b
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: doc/api/crypto.md +5Lines changed: 5 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -2121,6 +2121,11 @@ type, value, and parameters. This method is not | 2121 | 2121 | <!-- YAML | 2122 | 2122 | added: v11.6.0 | 2123 | 2123 | changes: | | 2124 | + - version: REPLACEME | | 2125 | + pr-url: https://github.com/nodejs/node/pull/62178 | | 2126 | + description: ML-KEM and ML-DSA private key `'pkcs8'` export now | | 2127 | + uses seed-only format by default when a seed is | | 2128 | + available. | 2124 | 2129 | - version: v15.9.0 | 2125 | 2130 | pr-url: https://github.com/nodejs/node/pull/37081 | 2126 | 2131 | description: Added support for `'jwk'` format. | |
Collapse file Copy file name to clipboardExpand all lines: src/crypto/crypto_util.cc +17Lines changed: 17 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -138,6 +138,23 @@ void InitCryptoOnce() { | 138 | 138 | #endif | 139 | 139 |
| 140 | 140 | OPENSSL_init_ssl(0, settings); | | 141 | + | | 142 | +#if OPENSSL_WITH_PQC | | 143 | + // Configure all loaded providers to prefer seed-only format for ML-KEM and | | 144 | + // ML-DSA private keys in PKCS#8 export, falling back to priv-only when a | | 145 | + // seed is not available. The provider encoder reads these parameters at | | 146 | + // encoding time via ossl_prov_ctx_get_param(). | | 147 | + OSSL_PROVIDER_do_all( | | 148 | + nullptr, | | 149 | + [](OSSL_PROVIDER* provider, void*) -> int { | | 150 | + OSSL_PROVIDER_add_conf_parameter( | | 151 | + provider, "ml-kem.output_formats", "seed-only,priv-only"); | | 152 | + OSSL_PROVIDER_add_conf_parameter( | | 153 | + provider, "ml-dsa.output_formats", "seed-only,priv-only"); | | 154 | + return 1; | | 155 | + }, | | 156 | + nullptr); | | 157 | +#endif | 141 | 158 | OPENSSL_INIT_free(settings); | 142 | 159 | settings = nullptr; | 143 | 160 |
| |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-crypto-pqc-key-objects-ml-dsa.js +1-1Lines changed: 1 addition & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -69,7 +69,7 @@ for (const [asymmetricKeyType, pubLen] of [ | 69 | 69 | assertPublicKey(createPublicKey(key)); | 70 | 70 | key.export({ format: 'der', type: 'pkcs8' }); | 71 | 71 | if (hasSeed) { | 72 | | - assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private); | | 72 | + assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only); | 73 | 73 | } else { | 74 | 74 | assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_priv_only); | 75 | 75 | } | |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-crypto-pqc-key-objects-ml-kem.js +1-1Lines changed: 1 addition & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -48,7 +48,7 @@ for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) { | 48 | 48 | assertPublicKey(createPublicKey(key)); | 49 | 49 | key.export({ format: 'der', type: 'pkcs8' }); | 50 | 50 | if (hasSeed) { | 51 | | - assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private); | | 51 | + assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only); | 52 | 52 | } else { | 53 | 53 | assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_priv_only); | 54 | 54 | } | |
|