Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
crypto: support ML-DSA KeyObject, sign, and verify #59259
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
panva
added
crypto
|
Review requested:
|
panva
force-pushed
the
crypto-pqc-keyobjects
branch
from
18133e1 to
2f37933
Compare
This comment was marked as outdated.
This comment was marked as outdated.
|
cc @nodejs/cpp-reviewers 🙏 |
panva
added
the
semver-minor
panva
force-pushed
the
crypto-pqc-keyobjects
branch
from
521deae to
7a6c57c
Compare
|
CI: https://ci.nodejs.org/job/node-test-pull-request/68271/ (This run doesn't have 3.5 #59234 landed, but nicely showcases that linked OpenSSL 3.5 gets the support from this PR) ubuntu2204_sharedlibs_openssl35_x64 |
panva
commented
Jul 28, 2025
panva
commented
Jul 28, 2025
panva
commented
Jul 28, 2025
panva
changed the title
panva
force-pushed
the
crypto-pqc-keyobjects
branch
3 times, most recently
from
7c37a1c to
3c220b4
Compare
panva
changed the title
panva
force-pushed
the
crypto-pqc-keyobjects
branch
from
3c220b4 to
7bd6d1e
Compare
panva
added
commit-queue-squash
panva
force-pushed
the
crypto-pqc-keyobjects
branch
from
7bd6d1e to
a08d556
Compare
panva
added
the
notable-change
|
The
notable-change
Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section. |
panva
force-pushed
the
crypto-pqc-keyobjects
branch
3 times, most recently
from
99ed3b4 to
2739dba
Compare
panva
force-pushed
the
crypto-pqc-keyobjects
branch
from
2739dba to
69fc44e
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #59259 +/- ##
==========================================
- Coverage 89.97% 89.96% -0.01%
==========================================
Files 649 650 +1
Lines 192131 192307 +176
Branches 37653 37699 +46
==========================================
+ Hits 172864 173015 +151
- Misses 11883 11895 +12
- Partials 7384 7397 +13
🚀 New features to boost your workflow:
|
jasnell
reviewed
Jul 29, 2025
| @@ -1942,7 +1942,16 @@ EVP_PKEY* EVPKeyPointer::release() { | |||
|
|
|||
| int EVPKeyPointer::id(const EVP_PKEY* key) { | |||
| if (key == nullptr) return 0; | |||
| return EVP_PKEY_id(key); | |||
| int type = EVP_PKEY_id(key); | |||
| #if OPENSSL_VERSION_MAJOR >= 3 && OPENSSL_VERSION_MINOR >= 5 | |||
There was a problem hiding this comment.
Not a blocker but, does this also need to have a OPENSSL_IS_BORING guard? I doubt boring would end up duplicating these version values but just want to be cautious.
/cc @codebytere
jasnell
reviewed
Jul 29, 2025
|
first view pass looks good but there's a lot here so I want to take a second pass through before signing off. |
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
jasnell
reviewed
Jul 29, 2025
jasnell
reviewed
Jul 29, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This allows
node:cryptoto recognize the following asymmetric KeyObject types (keyObject.asymmetricKeyType) when built with or linked to OpenSSL 3.5 (#59234):'ml-dsa-44','ml-dsa-65','ml-dsa-87'(https://docs.openssl.org/3.5/man7/EVP_PKEY-ML-DSA/)And the following functionality for them:
crypto.createPublicKey()SPKI/JWKcrypto.createPrivateKey()PKCS#8/JWKkeyObject.export()SPKI/PKCS#8/JWKcrypto.generateKeyPair(Sync)()into KeyObject, PEM, DER, JWKcrypto.sign()and signature verification viacrypto.verify()notable-changePRs with changes that should be highlighted in changelogs.
ML-DSA support in
node:cryptokicks off post-quantum cryptography efforts in Node.js. This is part of a broader effort to support NIST's post-quantum cryptography standards for future-proofing applications against quantum computing threats.TODO:
crypto.createPublicKey()andcrypto.createPrivateKey()context-stringas an option fromcrypto.sign()andcrypto.verify()