crypto: use names for asymmetric key algorithms - #65966
Merged
Merged
Conversation
Provider-backed keys can have no numeric OpenSSL ID. Identify and construct asymmetric keys by algorithm name, replacing the custom PQC name-to-NID substitution with provider-aware matching in ncrypto. Centralize known algorithm names, public key-type names, capabilities, and backend compatibility in ncrypto. Use named key generation jobs and remove asymmetric EVP_PKEY constants from the internal JavaScript binding. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
Collaborator
|
Review requested:
|
nodejs-github-bot
added
lib / src
Member
Author
|
Benchmark GHA (crypto / keyobject): https://github.com/nodejs/node/actions/runs/34348821454 Results
Benchmark results:
Benchmark GHA (crypto / oneshot-sign.js): https://github.com/nodejs/node/actions/runs/34348824410 Results
Benchmark results:
Benchmark GHA (crypto / oneshot-verify.js): https://github.com/nodejs/node/actions/runs/34348827543 Results
Benchmark results:
Benchmark GHA (crypto / webcrypto-sign.js): https://github.com/nodejs/node/actions/runs/34348830291 Results
Benchmark results:
Benchmark GHA (crypto / webcrypto-verify.js): https://github.com/nodejs/node/actions/runs/34348833659 Results
Benchmark results:
Benchmark GHA (crypto / keygen.js): https://github.com/nodejs/node/actions/runs/34348840314 Results
Benchmark results:
Benchmark GHA (crypto / rsa-encrypt-decrypt-throughput.js): https://github.com/nodejs/node/actions/runs/34348843444 Results
Benchmark results:
Benchmark GHA (tls / tls-connect.js): https://github.com/nodejs/node/actions/runs/34348846429 Results
Benchmark results:
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #65966 +/- ##
==========================================
- Coverage 92.41% 90.21% -2.21%
==========================================
Files 417 771 +354
Lines 189029 265161 +76132
Branches 28953 50392 +21439
==========================================
+ Hits 174685 239203 +64518
- Misses 14011 16977 +2966
- Partials 333 8981 +8648
🚀 New features to boost your workflow:
|
Member
Author
|
@jasnell please take a look, this is a step towards moving more things to the openssl provider model |
jasnell
reviewed
Sep 15, 2026
| static EVPKeyCtxPointer New(const EVPKeyPointer& key); | ||
| static EVPKeyCtxPointer NewFromID(int id); | ||
| static EVPKeyCtxPointer NewFromName(const char* name); | ||
| static EVPKeyCtxPointer NewFromAlgorithm(const KeyAlgorithm& algorithm); |
Member
There was a problem hiding this comment.
While I'm +1 on the change overall, removing the current NID apis means anyone else using ncrypto will be forced to transition immediately to the new api. I'd prefer to deprecate first for a short time before removing them to give some flexibility in the transition if possible.
Member
Author
There was a problem hiding this comment.
IIRC all ncrypto consumers use BoringSSL which has its own compatibility branch here. We have not established any intent to maintain ncrypto API compatibility, right now it is merely a snapshot of node's own ncrypto state.
Member
Author
There was a problem hiding this comment.
+ restoring the APIs in nodejs/ncrypto can be done as part of resolving the sync workflow, I don't see why we should subject maintainers of node's crypto with the burden of maintaining compatibility modes for other runtimes.
Collaborator
jasnell
reviewed
Sep 17, 2026
jasnell
left a comment
jasnell
left a comment
Member
There was a problem hiding this comment.
LGTM So long as the update into ncrypto either gates these or waits on downstream consumers to be able to update. I'd still prefer the parallel api approach (either with deprecated apis or IFDEF gates)
jasnell
approved these changes
Sep 17, 2026
panva
added
author ready
nodejs-github-bot
added
the
lacks-second-approval
Collaborator
|
Landed in 1a3712d |
nodejs-github-bot
removed
commit-queue
aduh95
pushed a commit
that referenced
this pull request
Sep 18, 2026
Provider-backed keys can have no numeric OpenSSL ID. Identify and construct asymmetric keys by algorithm name, replacing the custom PQC name-to-NID substitution with provider-aware matching in ncrypto. Centralize known algorithm names, public key-type names, capabilities, and backend compatibility in ncrypto. Use named key generation jobs and remove asymmetric EVP_PKEY constants from the internal JavaScript binding. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #65966 Reviewed-By: James M Snell <jasnell@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provider-backed keys can have no numeric OpenSSL ID. Identify and construct asymmetric keys by algorithm name, replacing the custom PQC name-to-NID substitution with provider-aware matching in ncrypto.
Centralize known algorithm names, public key-type names, capabilities, and backend compatibility in ncrypto. Use named key generation jobs and remove asymmetric EVP_PKEY constants from the internal JavaScript binding.
Assisted-by: Codex