Skip to content

Lower node:crypto RSA public-key encryption and the introspection statics - #3522

Open
ctate wants to merge 2 commits into
mainfrom
ctate/lower-node-crypto-01a8b0
Open

ctate wants to merge 2 commits into
mainfrom
ctate/lower-node-crypto-01a8b0

Conversation

@ctate

@ctate ctate commented Nov 11, 2026

Copy link
Copy Markdown
Collaborator
  • Move 9 crypto rows to supported: publicEncrypt, privateDecrypt, privateEncrypt, publicDecrypt, getFips, getMacs, secureHeapUsed, setEngine, and the deprecated crypto.fips.
  • Match Node 24's padding coercions, OAEP handling, error codes, and implicit-rejection bytes, pinned by seven new differential corpus programs.
  • Regenerate the compatibility matrix and record the new TS7 order-parity baselines.

crypto.publicEncrypt, privateDecrypt, privateEncrypt and publicDecrypt
had no lowering. They run through mbedTLS's RSA context on key material,
KeyObjects, and option records, matching Node's padding coercions, OAEP
hash and label handling, and OpenSSL's error codes and messages for
every rejected key, padding and ciphertext shape. privateDecrypt and
publicDecrypt also answer the implicit-rejection block Node's OpenSSL
builds produce, byte for byte.

The introspection statics lower too: getMacs answers the provider MAC
list, secureHeapUsed a fresh all-zero usage record, setEngine accepts
"dynamic" and reports ERR_CRYPTO_ENGINE_UNKNOWN for every other engine,
and the deprecated crypto.fips read reports DEP0093 once per process as
the CommonJS exports getter (the ES module namespace does not export it,
as in Node).

Each behavior is pinned by differential corpus programs that run the
same input under Node 24 and the compiled binary.
@vercel

vercel Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
scriptc Ready Ready Preview, v0 Nov 11, 2026 4:49am UTC

@vercel-internal-security-reviewer

Copy link
Copy Markdown

Security review details

Comment thread packages/runtime/src/scr_pki.c Resolved
Comment thread packages/runtime/src/scr_pki.c Resolved

This branch was successfully deployed

1 active deployment
Preview — 3cecef10 Deployed Nov 11, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant