crypto: use provider APIs for key operations by panva · Pull Request #66108 · nodejs/node

panva · 2026-09-18T14:16:20Z

Use EVP_KDF for HKDF expansion, PBKDF2 and scrypt, sharing the wrapper with Argon2. Use provider APIs for PKCS#1 public-key decoding, private-key cipher lookup and EC group names.

Read RSA key details without fetching private components or serializing RSA-PSS keys. Filter built-in curves by provider availability and consolidate cache/FIPS coverage across the algorithm-list getters.

Use one owning KDF interface for HKDF expansion, PBKDF2 and scrypt, sharing provider setup with Argon2. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Import RSA public keys through OSSL_DECODER on OpenSSL 3 so the resulting keys stay provider-backed. Preserve the PKCS#1 input structure and the ASN.1 encodings accepted by the legacy decoder. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Resolve provider ciphers before serializing private keys and retain the fetched implementation across encoding configuration copies and async key generation. Keep format-specific restrictions in the serializers. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Pass group names through EC key generation and report provider names in key details without requiring an OpenSSL NID. Preserve established curve aliases and synchronous invalid-curve errors. Filter built-in curves through EC parameter generation and refresh getCurves() results when FIPS properties change. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Retrieving asymmetricKeyDetails only needs the modulus, public exponent, and RSA-PSS restrictions. Add a public-only Rsa view so provider-backed keys do not also extract private components or probe additional primes. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

nodejs-github-bot · 2026-09-18T14:16:25Z

Review requested:

@nodejs/crypto
@nodejs/performance
@nodejs/security-wg

github-actions · 2026-09-18T14:21:12Z

Benchmark GHA (crypto / hkdf.js): https://github.com/nodejs/node/actions/runs/35355635938

Results

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

Benchmark results:

                                                                                                                 confidence improvement accuracy (*)    (**)   (***)
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=10 sync=0                                                     -4.79 %      ±10.79% ±14.23% ±18.26%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=10 sync=1                                             ***     24.21 %      ±10.17% ±13.40% ±17.20%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=1024 sync=0                                                   -2.12 %      ±11.28% ±14.87% ±19.08%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=1024 sync=1                                            **     14.97 %      ±10.17% ±13.41% ±17.20%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=64 sync=0                                                     -3.08 %      ±10.85% ±14.31% ±18.36%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='a' size=64 sync=1                                             ***     26.09 %      ±10.23% ±13.49% ±17.31%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=10 sync=0                                                -3.17 %      ±10.90% ±14.37% ±18.43%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=10 sync=1                                        ***     25.81 %       ±9.85% ±12.98% ±16.66%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=1024 sync=0                                              -1.66 %      ±11.56% ±15.24% ±19.55%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=1024 sync=1                                       **     14.83 %      ±10.24% ±13.50% ±17.32%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=64 sync=0                                                -1.99 %      ±10.53% ±13.88% ±17.82%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='secret' size=64 sync=1                                        ***     26.68 %       ±9.97% ±13.14% ±16.87%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=10 sync=0                           0.96 %      ±10.86% ±14.31% ±18.36%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=10 sync=1                  ***     25.31 %      ±10.10% ±13.31% ±17.08%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=1024 sync=0                        -0.29 %      ±11.10% ±14.63% ±18.78%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=1024 sync=1                 **     14.74 %      ±10.29% ±13.57% ±17.41%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=64 sync=0                          -3.33 %      ±10.75% ±14.17% ±18.19%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='' key='this-is-a-much-longer-secret' size=64 sync=1                  ***     23.48 %       ±9.99% ±13.17% ±16.90%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=10 sync=0                                                 -1.29 %      ±10.10% ±13.31% ±17.08%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=10 sync=1                                         ***     23.07 %       ±9.58% ±12.62% ±16.20%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=1024 sync=0                                               -2.70 %      ±10.42% ±13.74% ±17.63%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=1024 sync=1                                        **     14.89 %       ±9.98% ±13.15% ±16.88%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=64 sync=0                                                 -2.01 %       ±9.90% ±13.05% ±16.75%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='a' size=64 sync=1                                         ***     24.35 %       ±9.61% ±12.66% ±16.25%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=10 sync=0                                            -1.78 %       ±9.82% ±12.94% ±16.61%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=10 sync=1                                    ***     22.97 %       ±9.57% ±12.61% ±16.18%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=1024 sync=0                                          -2.07 %      ±10.26% ±13.52% ±17.35%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=1024 sync=1                                   **     13.74 %      ±10.15% ±13.38% ±17.18%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=64 sync=0                                            -3.75 %      ±10.04% ±13.24% ±16.98%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='secret' size=64 sync=1                                    ***     22.73 %       ±9.61% ±12.66% ±16.25%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=0                      -1.92 %       ±9.99% ±13.17% ±16.90%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=1              ***     22.57 %       ±9.77% ±12.88% ±16.53%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=0                    -5.79 %      ±10.08% ±13.28% ±17.05%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=1             **     15.70 %      ±10.30% ±13.58% ±17.43%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=0                      -3.22 %      ±10.19% ±13.43% ±17.23%
crypto/hkdf.js n=10000 hash='sha256' info='' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=1              ***     22.02 %       ±9.49% ±12.51% ±16.05%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=10 sync=0                                                 -4.58 %      ±10.44% ±13.76% ±17.66%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=10 sync=1                                         ***     26.67 %      ±10.04% ±13.24% ±16.99%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=1024 sync=0                                               -6.23 %      ±10.23% ±13.48% ±17.30%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=1024 sync=1                                       ***     17.34 %      ±10.18% ±13.42% ±17.22%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=64 sync=0                                                 -1.87 %      ±10.35% ±13.65% ±17.51%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='a' size=64 sync=1                                         ***     27.94 %      ±10.27% ±13.54% ±17.37%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=10 sync=0                                            -3.64 %      ±10.46% ±13.79% ±17.69%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=10 sync=1                                    ***     25.61 %       ±9.85% ±12.99% ±16.67%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=1024 sync=0                                          -4.97 %      ±10.03% ±13.22% ±16.96%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=1024 sync=1                                   **     16.37 %      ±10.21% ±13.46% ±17.27%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=64 sync=0                                            -1.57 %      ±10.07% ±13.27% ±17.03%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='secret' size=64 sync=1                                    ***     26.60 %       ±9.78% ±12.89% ±16.54%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=10 sync=0                      -3.29 %      ±10.38% ±13.69% ±17.56%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=10 sync=1              ***     28.13 %       ±9.96% ±13.13% ±16.85%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=1024 sync=0                    -6.44 %       ±9.95% ±13.12% ±16.84%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=1024 sync=1             **     16.41 %      ±10.41% ±13.72% ±17.60%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=64 sync=0                      -1.92 %      ±10.46% ±13.78% ±17.68%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='' key='this-is-a-much-longer-secret' size=64 sync=1              ***     26.01 %       ±9.95% ±13.12% ±16.84%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=10 sync=0                                             -2.87 %       ±9.39% ±12.37% ±15.88%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=10 sync=1                                     ***     23.96 %       ±9.51% ±12.54% ±16.09%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=1024 sync=0                                           -2.48 %       ±9.23% ±12.17% ±15.61%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=1024 sync=1                                    **     16.21 %      ±10.21% ±13.46% ±17.28%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=64 sync=0                                             -3.00 %       ±9.61% ±12.66% ±16.25%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='a' size=64 sync=1                                     ***     28.26 %       ±9.58% ±12.63% ±16.22%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=10 sync=0                                        -2.03 %       ±9.48% ±12.49% ±16.03%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=10 sync=1                                ***     26.49 %       ±9.35% ±12.33% ±15.82%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=1024 sync=0                                      -4.02 %       ±9.14% ±12.05% ±15.46%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=1024 sync=1                               **     15.28 %       ±9.91% ±13.06% ±16.76%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=64 sync=0                                        -2.66 %       ±9.60% ±12.65% ±16.23%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='secret' size=64 sync=1                                ***     24.90 %       ±9.44% ±12.45% ±15.97%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=0                  -3.16 %       ±9.95% ±13.12% ±16.84%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=1          ***     25.89 %       ±9.81% ±12.93% ±16.60%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=0                -4.00 %       ±9.62% ±12.69% ±16.28%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=1         **     15.48 %      ±10.12% ±13.34% ±17.12%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=0                  -2.25 %      ±10.07% ±13.28% ±17.04%
crypto/hkdf.js n=10000 hash='sha256' info='info' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=1          ***     24.38 %       ±9.64% ±12.70% ±16.30%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=10 sync=0                                                     -4.16 %      ±10.82% ±14.26% ±18.30%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=10 sync=1                                             ***     22.88 %       ±9.82% ±12.95% ±16.62%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=1024 sync=0                                                   -0.06 %      ±10.74% ±14.16% ±18.17%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=1024 sync=1                                            **     14.75 %       ±9.51% ±12.54% ±16.09%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=64 sync=0                                                     -4.31 %      ±10.95% ±14.43% ±18.51%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='a' size=64 sync=1                                             ***     25.62 %      ±10.28% ±13.55% ±17.39%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=10 sync=0                                                -2.13 %      ±11.12% ±14.66% ±18.81%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=10 sync=1                                        ***     23.76 %       ±9.90% ±13.04% ±16.74%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=1024 sync=0                                              -3.33 %      ±10.11% ±13.33% ±17.11%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=1024 sync=1                                       **     14.57 %       ±9.50% ±12.52% ±16.07%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=64 sync=0                                                 0.63 %      ±10.82% ±14.27% ±18.31%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='secret' size=64 sync=1                                        ***     26.18 %       ±9.71% ±12.80% ±16.42%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=10 sync=0                          -0.69 %      ±11.17% ±14.72% ±18.89%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=10 sync=1                  ***     23.49 %      ±10.00% ±13.18% ±16.91%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=1024 sync=0                        -2.20 %      ±10.74% ±14.16% ±18.17%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=1024 sync=1                 **     14.78 %       ±9.64% ±12.70% ±16.30%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=64 sync=0                          -0.26 %      ±11.34% ±14.94% ±19.17%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='' key='this-is-a-much-longer-secret' size=64 sync=1                  ***     22.06 %       ±9.69% ±12.78% ±16.40%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=10 sync=0                                                 -4.27 %      ±10.42% ±13.73% ±17.62%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=10 sync=1                                         ***     20.80 %       ±9.47% ±12.48% ±16.01%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=1024 sync=0                                               -5.57 %       ±9.63% ±12.70% ±16.30%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=1024 sync=1                                        **     13.82 %       ±9.43% ±12.43% ±15.95%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=64 sync=0                                                 -3.25 %      ±10.15% ±13.38% ±17.16%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='a' size=64 sync=1                                         ***     23.96 %       ±9.52% ±12.55% ±16.10%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=10 sync=0                                            -2.29 %      ±10.20% ±13.45% ±17.26%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=10 sync=1                                    ***     20.69 %       ±9.35% ±12.32% ±15.81%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=1024 sync=0                                          -2.80 %       ±9.82% ±12.94% ±16.61%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=1024 sync=1                                   **     13.37 %       ±9.33% ±12.30% ±15.79%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=64 sync=0                                            -2.06 %      ±10.19% ±13.43% ±17.23%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='secret' size=64 sync=1                                    ***     21.28 %       ±9.56% ±12.60% ±16.17%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=0                      -0.35 %      ±10.25% ±13.52% ±17.34%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=1              ***     20.59 %       ±9.65% ±12.73% ±16.33%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=0                    -5.46 %       ±9.81% ±12.93% ±16.59%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=1             **     14.86 %       ±9.65% ±12.72% ±16.32%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=0                      -3.79 %      ±10.95% ±14.44% ±18.53%
crypto/hkdf.js n=10000 hash='sha512' info='' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=1              ***     22.45 %       ±9.30% ±12.26% ±15.73%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=10 sync=0                                                 -4.20 %      ±10.35% ±13.64% ±17.50%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=10 sync=1                                         ***     25.07 %       ±9.75% ±12.86% ±16.50%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=1024 sync=0                                               -2.36 %      ±10.19% ±13.43% ±17.23%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=1024 sync=1                                        **     16.07 %       ±9.50% ±12.52% ±16.07%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=64 sync=0                                                 -2.61 %      ±10.17% ±13.40% ±17.20%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='a' size=64 sync=1                                         ***     25.71 %       ±9.76% ±12.87% ±16.52%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=10 sync=0                                            -3.47 %      ±10.30% ±13.57% ±17.42%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=10 sync=1                                    ***     24.85 %       ±9.59% ±12.64% ±16.22%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=1024 sync=0                                          -0.74 %       ±9.91% ±13.07% ±16.77%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=1024 sync=1                                   **     15.71 %       ±9.58% ±12.63% ±16.20%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=64 sync=0                                            -2.17 %      ±10.78% ±14.21% ±18.24%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='secret' size=64 sync=1                                    ***     22.99 %       ±9.44% ±12.44% ±15.97%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=10 sync=0                      -1.64 %      ±10.36% ±13.66% ±17.52%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=10 sync=1              ***     24.84 %       ±9.74% ±12.84% ±16.48%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=1024 sync=0                    -6.29 %       ±9.88% ±13.02% ±16.70%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=1024 sync=1             **     15.22 %       ±9.91% ±13.06% ±16.76%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=64 sync=0                      -0.98 %      ±10.28% ±13.55% ±17.38%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='' key='this-is-a-much-longer-secret' size=64 sync=1              ***     25.14 %       ±9.81% ±12.93% ±16.59%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=10 sync=0                                             -3.42 %      ±10.29% ±13.56% ±17.40%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=10 sync=1                                     ***     26.18 %       ±9.34% ±12.31% ±15.80%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=1024 sync=0                                           -3.97 %       ±9.04% ±11.92% ±15.29%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=1024 sync=1                                   ***     16.35 %       ±9.55% ±12.59% ±16.16%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=64 sync=0                                             -5.18 %       ±9.53% ±12.56% ±16.11%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='a' size=64 sync=1                                     ***     25.58 %       ±9.21% ±12.14% ±15.58%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=10 sync=0                                        -2.62 %       ±9.98% ±13.15% ±16.87%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=10 sync=1                                ***     25.66 %       ±9.25% ±12.20% ±15.66%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=1024 sync=0                                      -1.32 %       ±9.39% ±12.37% ±15.88%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=1024 sync=1                              ***     15.85 %       ±9.21% ±12.14% ±15.58%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=64 sync=0                                        -0.49 %       ±9.63% ±12.70% ±16.29%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='secret' size=64 sync=1                                ***     24.63 %       ±9.21% ±12.14% ±15.58%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=0                  -2.72 %       ±9.71% ±12.79% ±16.42%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=10 sync=1          ***     25.64 %       ±9.65% ±12.72% ±16.32%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=0                -5.55 %       ±9.48% ±12.49% ±16.03%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=1024 sync=1         **     15.31 %       ±9.57% ±12.61% ±16.19%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=0                  -1.45 %       ±9.97% ±13.14% ±16.86%
crypto/hkdf.js n=10000 hash='sha512' info='info' salt='salt' key='this-is-a-much-longer-secret' size=64 sync=1          ***     24.82 %       ±9.29% ±12.25% ±15.72%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 144 comparisons, you can thus
expect the following amount of false-positive results:
  7.20 false positives, when considering a   5% risk acceptance (*, **, ***),
  1.44 false positives, when considering a   1% risk acceptance (**, ***),
  0.14 false positives, when considering a 0.1% risk acceptance (***)

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

github-actions · 2026-09-18T14:21:42Z

Benchmark GHA (crypto / key-details): https://github.com/nodejs/node/actions/runs/35355599035

Results

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

Benchmark results:

                                                                   confidence improvement accuracy (*)    (**)   (***)
crypto/ec-key-details.js n=10000 type='private' namedCurve='P-256'                -7.24 %       ±9.59% ±12.64% ±16.22%
crypto/ec-key-details.js n=10000 type='private' namedCurve='P-384'                -8.88 %       ±9.35% ±12.33% ±15.82%
crypto/ec-key-details.js n=10000 type='private' namedCurve='P-521'                -6.27 %       ±9.51% ±12.54% ±16.09%
crypto/ec-key-details.js n=10000 type='public' namedCurve='P-256'                 -7.29 %       ±9.61% ±12.67% ±16.26%
crypto/ec-key-details.js n=10000 type='public' namedCurve='P-384'           *    -10.09 %       ±9.39% ±12.38% ±15.89%
crypto/ec-key-details.js n=10000 type='public' namedCurve='P-521'                 -8.64 %       ±9.48% ±12.50% ±16.04%
crypto/rsa-key-details.js n=10000 type='private'                          ***    187.52 %      ±10.53% ±13.91% ±17.91%
crypto/rsa-key-details.js n=10000 type='public'                           ***    186.02 %      ±10.54% ±13.92% ±17.91%
crypto/rsa-pss-key-details.js n=5000 restrictions='absent'                ***    331.51 %      ±16.50% ±21.80% ±28.07%
crypto/rsa-pss-key-details.js n=5000 restrictions='defaults'              ***    291.62 %      ±15.79% ±20.86% ±26.85%
crypto/rsa-pss-key-details.js n=5000 restrictions='sha256'                ***    285.46 %      ±15.95% ±21.07% ±27.12%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 11 comparisons, you can thus
expect the following amount of false-positive results:
  0.55 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.11 false positives, when considering a   1% risk acceptance (**, ***),
  0.01 false positives, when considering a 0.1% risk acceptance (***)

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

codecov · 2026-09-18T15:53:37Z

Codecov Report

❌ Patch coverage is 66.66667% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.29%. Comparing base (d56d2ec) to head (6515be8).
⚠️ Report is 18 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_ec.cc	55.55%	3 Missing and 1 partial ⚠️
src/crypto/crypto_keys.cc	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66108      +/-   ##
==========================================
- Coverage   92.75%   90.29%   -2.47%     
==========================================
  Files         421      790     +369     
  Lines      190416   271652   +81236     
  Branches    29161    51850   +22689     
==========================================
+ Hits       176627   245280   +68653     
- Misses      13461    16910    +3449     
- Partials      328     9462    +9134

Files with missing lines	Coverage Δ
lib/internal/crypto/util.js	`97.80% <100.00%> (+1.05%)`	⬆️
src/crypto/crypto_ec.h	`42.85% <ø> (ø)`
src/crypto/crypto_rsa.cc	`64.56% <100.00%> (ø)`
src/crypto/crypto_keys.cc	`72.65% <66.66%> (ø)`
src/crypto/crypto_ec.cc	`69.57% <55.55%> (ø)`

... and 491 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Query salt length and digest restrictions instead of serializing the key to SPKI and parsing its algorithm identifier. A readable salt length distinguishes restricted keys, including empty parameter sequences, from unrestricted keys. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Exercise getCiphers(), getHashes(), getMacs() and getCurves() through one shared cache/FIPS driver and one snapshot fixture. Keep defensive copies, generation changes, rejected and idempotent toggles, and cross-worker invalidation consistent across the lists. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

nodejs-github-bot · 2026-09-18T18:25:14Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77619/

nodejs-github-bot · 2026-09-19T05:38:55Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77629/

panva added 5 commits September 18, 2026 15:49

crypto: derive keys through EVP_KDF

b1e6340

Use one owning KDF interface for HKDF expansion, PBKDF2 and scrypt, sharing provider setup with Argon2. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Sep 18, 2026

nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Sep 18, 2026

panva added 2 commits September 18, 2026 18:33

panva force-pushed the crypto-provider-api-followups branch from 46845b9 to 6515be8 Compare September 18, 2026 16:34

jasnell approved these changes Sep 18, 2026

View reviewed changes

panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 18, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 18, 2026

Navigation Menu

Uh oh!

crypto: use provider APIs for key operations - #66108

crypto: use provider APIs for key operations#66108
panva wants to merge 7 commits into
nodejs:mainfrom
panva:crypto-provider-api-followups

panva commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

panva commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Sep 18, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Sep 18, 2026 •

edited

Loading

github-actions Bot commented Sep 18, 2026 •

edited

Loading

codecov Bot commented Sep 18, 2026 •

edited

Loading