crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4

Reverts: #56160Fixes: #56159Fixes: #58913
Refs: #58121
PR-URL: #58942
Backport-PR-URL: #58960
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Author: panva

doc/api/deprecations.md

@@ -3850,6 +3850,21 @@ To make [`child_process.exec`][] invoke the default shell, either omit the
 `shell` option, or set it to a nullish value. If the intention is not to invoke
 a shell, use [`child_process.execFile`][] instead.
 
+<!-- md-lint skip-deprecation DEP0197 -->
+
+### DEP0198: Creating SHAKE-128 and SHAKE-256 digests without an explicit `options.outputLength`
+
+<!-- YAML
+changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/58942
+ description: Documentation-only deprecation with support for `--pending-deprecation`.
+-->
+
+Type: Documentation-only (supports [`--pending-deprecation`][])
+
+Creating SHAKE-128 and SHAKE-256 digests without an explicit `options.outputLength` is deprecated.
+
 [DEP0142]: #dep0142-repl_builtinlibs
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3

lib/internal/crypto/hash.js

@@ -3,6 +3,7 @@
 const{
  ObjectSetPrototypeOf,
  ReflectApply,
+ StringPrototypeReplace,
  StringPrototypeToLowerCase,
  Symbol,
 }=primordials;
@@ -33,6 +34,8 @@ const {
  lazyDOMException,
  normalizeEncoding,
  encodingsMap,
+ isPendingDeprecation,
+ getDeprecationWarningEmitter,
 }=require('internal/util');
 
 const{
@@ -63,6 +66,25 @@ const LazyTransform = require('internal/streams/lazy_transform');
 constkState=Symbol('kState');
 constkFinalized=Symbol('kFinalized');
 
+/**
+ * @param {string} name
+ */
+functionnormalizeAlgorithm(name){
+returnStringPrototypeReplace(StringPrototypeToLowerCase(name),'-','');
+}
+
+constmaybeEmitDeprecationWarning=getDeprecationWarningEmitter(
+'DEP0198',
+'Creating SHAKE128/256 digests without an explicit options.outputLength is deprecated.',
+undefined,
+false,
+(algorithm)=>{
+if(!isPendingDeprecation())returnfalse;
+constnormalized=normalizeAlgorithm(algorithm);
+returnnormalized==='shake128'||normalized==='shake256';
+},
+);
+
 functionHash(algorithm,options){
 if(!new.target)
 returnnewHash(algorithm,options);
@@ -80,6 +102,9 @@ function Hash(algorithm, options) {
 this[kState]={
 [kFinalized]: false,
 };
+if(!isCopy&&xofLen===undefined){
+maybeEmitDeprecationWarning(algorithm);
+}
 ReflectApply(LazyTransform,this,[options]);
 }
 
@@ -213,6 +238,12 @@ function hash(algorithm, input, outputEncoding = 'hex') {
 }
 }
 }
+// TODO: ideally we have to ship https://github.com/nodejs/node/pull/58121 so
+// that a proper DEP0198 deprecation can be done here as well.
+constnormalizedAlgorithm=normalizeAlgorithm(algorithm);
+if(normalizedAlgorithm==='shake128'||normalizedAlgorithm==='shake256'){
+returnnewHash(algorithm).update(input).digest(normalized);
+}
 returnoneShotDigest(algorithm,getCachedHashId(algorithm),getHashCache(),
 input,normalized,encodingsMap[normalized]);
 }

lib/internal/util.js

@@ -110,8 +110,8 @@ function getDeprecationWarningEmitter(
 shouldEmitWarning=()=>true,
 ){
 letwarned=false;
-returnfunction(){
-if(!warned&&shouldEmitWarning()){
+returnfunction(arg){
+if(!warned&&shouldEmitWarning(arg)){
 warned=true;
 if(code==='ExperimentalWarning'){
 process.emitWarning(msg,code,deprecated);
@@ -998,4 +998,6 @@ module.exports = {
  setOwnProperty,
  pendingDeprecate,
  WeakReference,
+ isPendingDeprecation,
+ getDeprecationWarningEmitter,
 };

src/crypto/crypto_hash.cc

@@ -345,10 +345,22 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
  }
 
  md_len_ = EVP_MD_size(md);
+bool is_xof = (EVP_MD_flags(md) & EVP_MD_FLAG_XOF) != 0;
+if (is_xof && !xof_md_len.IsJust() && md_len_ == 0) {
+constchar* name = OBJ_nid2sn(EVP_MD_type(md));
+if (name != nullptr) {
+if (strcmp(name, "SHAKE128") == 0) {
+ md_len_ = 16;
+ } elseif (strcmp(name, "SHAKE256") == 0) {
+ md_len_ = 32;
+ }
+ }
+ }
+
 if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
 // This is a little hack to cause createHash to fail when an incorrect
 // hashSize option was passed for a non-XOF hash function.
-if ((EVP_MD_flags(md) & EVP_MD_FLAG_XOF) == 0) {
+if (!is_xof) {
 EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
 returnfalse;
  }

test/parallel/test-crypto-default-shake-lengths.js

@@ -0,0 +1,18 @@
+// Flags: --pending-deprecation
+'use strict';
+
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+const{ createHash }=require('crypto');
+
+common.expectWarning({
+DeprecationWarning: {
+DEP0198: 'Creating SHAKE128/256 digests without an explicit options.outputLength is deprecated.',
+}
+});
+
+{
+createHash('shake128').update('test').digest();
+}

test/parallel/test-crypto-hash.js

@@ -8,7 +8,6 @@ const assert = require('assert');
 constcrypto=require('crypto');
 constfs=require('fs');
 
-const{ hasOpenSSL }=require('../common/crypto');
 constfixtures=require('../common/fixtures');
 
 letcryptoType;
@@ -184,21 +183,19 @@ assert.throws(
 
 // Test XOF hash functions and the outputLength option.
 {
-// Default outputLengths. Since OpenSSL 3.4 an outputLength is mandatory
-if(!hasOpenSSL(3,4)){
-assert.strictEqual(crypto.createHash('shake128').digest('hex'),
-'7f9c2ba4e88f827d616045507605853e');
-assert.strictEqual(crypto.createHash('shake128',null).digest('hex'),
-'7f9c2ba4e88f827d616045507605853e');
-assert.strictEqual(crypto.createHash('shake256').digest('hex'),
-'46b9dd2b0ba88d13233b3feb743eeb24'+
-'3fcd52ea62b81b82b50c27646ed5762f');
-assert.strictEqual(crypto.createHash('shake256',{outputLength: 0})
-.copy()// Default outputLength.
-.digest('hex'),
-'46b9dd2b0ba88d13233b3feb743eeb24'+
-'3fcd52ea62b81b82b50c27646ed5762f');
-}
+// Default outputLengths.
+assert.strictEqual(crypto.createHash('shake128').digest('hex'),
+'7f9c2ba4e88f827d616045507605853e');
+assert.strictEqual(crypto.createHash('shake128',null).digest('hex'),
+'7f9c2ba4e88f827d616045507605853e');
+assert.strictEqual(crypto.createHash('shake256').digest('hex'),
+'46b9dd2b0ba88d13233b3feb743eeb24'+
+'3fcd52ea62b81b82b50c27646ed5762f');
+assert.strictEqual(crypto.createHash('shake256',{outputLength: 0})
+.copy()// Default outputLength.
+.digest('hex'),
+'46b9dd2b0ba88d13233b3feb743eeb24'+
+'3fcd52ea62b81b82b50c27646ed5762f');
 
 // Short outputLengths.
 assert.strictEqual(crypto.createHash('shake128',{outputLength: 0})

test/parallel/test-crypto-oneshot-hash.js

@@ -8,7 +8,6 @@ if (!common.hasCrypto)
 constassert=require('assert');
 constcrypto=require('crypto');
 constfixtures=require('../common/fixtures');
-const{ hasOpenSSL }=require('../common/crypto');
 constfs=require('fs');
 
 // Test errors for invalid arguments.
@@ -32,9 +31,6 @@ const methods = crypto.getHashes();
 constinput=fs.readFileSync(fixtures.path('utf8_test_text.txt'));
 
 for(constmethodofmethods){
-// Skip failing tests on OpenSSL 3.4.0
-if(method.startsWith('shake')&&hasOpenSSL(3,4))
-continue;
 for(constoutputEncodingof['buffer','hex','base64',undefined]){
 constoldDigest=crypto.createHash(method).update(input).digest(outputEncoding||'hex');
 constdigestFromBuffer=crypto.hash(method,input,outputEncoding);