Skip to content

crypto: reject Ed25519/Ed448 in Sign/Verify prototypes - #52340

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
panva:fix-oneshot-signer
Apr 8, 2024
Merged

crypto: reject Ed25519/Ed448 in Sign/Verify prototypes#52340
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
panva:fix-oneshot-signer

Conversation

@panva

@panvapanva commented Apr 3, 2024•
edited
Loading

Copy link
Copy Markdown
Member

It is possible to slip Ed25519/Ed448 keys to Sign.prototype.sign and Verify.prototype.sign given you provide a valid openssl digest and the result is an empty signature.

This PR checks for the key being a oneshot only key and throws a generic ERR_CRYPTO_UNSUPPORTED_OPERATION

fixes: #52097

@nodejs-github-bot

nodejs-github-bot commented Apr 3, 2024

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto

@nodejs-github-botnodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Apr 3, 2024
@panva
panvaforce-pushed the fix-oneshot-signer branch from c27f7b0 to ab86d4dCompareApril 3, 2024 08:47
@panvapanva changed the title crypto: reject Ed25519/Ed448 in crypto.sign and crypto.verifycrypto: reject Ed25519/Ed448 in Sign/Verify prototypesApr 3, 2024
@panvapanva added request-ci Add this label to start a Jenkins CI on a PR. author ready PRs that have at least one approval, no pending requests for changes, and a CI started. labels Apr 3, 2024
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Apr 3, 2024
@nodejs-github-bot

nodejs-github-bot commented Apr 3, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58076/

@nodejs-github-bot

nodejs-github-bot commented Apr 4, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58095/

@nodejs-github-bot

nodejs-github-bot commented Apr 4, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58106/

@aduh95

aduh95 commented Apr 4, 2024

Copy link
Copy Markdown
Contributor

It looks like this change is consistently failing to build on win-vs2022-arm64 for some reason.

@panva

panva commented Apr 4, 2024•
edited
Loading

Copy link
Copy Markdown
MemberAuthor

It looks like this change is consistently failing to build on win-vs2022-arm64 for some reason.

fatal error C1060: compiler is out of heap space [C:\workspace\node-compile-windows\node\tools\v8_gypfiles\v8_initializers.vcxproj]

Seems unrelated to me. If it happens to be related I'm not able to debug it and would appreciate help.

@panva

panva commented Apr 4, 2024

Copy link
Copy Markdown
MemberAuthor

Let's see if rebasing does anything.

@panva
panvaforce-pushed the fix-oneshot-signer branch from ab86d4d to 40487f2CompareApril 4, 2024 13:32
@tniessen

tniessen commented Apr 4, 2024•
edited
Loading

Copy link
Copy Markdown
Member

The error was: fatal error C1060: compiler is out of heap space, so almost certainly unrelated. (Or a bug in MSVC.)

@panvapanva added the request-ci Add this label to start a Jenkins CI on a PR. label Apr 4, 2024
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Apr 4, 2024
@nodejs-github-bot

nodejs-github-bot commented Apr 4, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58112/

@panva

panva commented Apr 4, 2024

Copy link
Copy Markdown
MemberAuthor

Well, nothing much I can do about fatal error C1060: compiler is out of heap space.

@aduh95

aduh95 commented Apr 4, 2024

Copy link
Copy Markdown
Contributor

/cc @nodejs/platform-windows-arm

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58128/

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58132/

@StefanStojanovic

StefanStojanovic commented Apr 5, 2024

Copy link
Copy Markdown
Contributor

Well, nothing much I can do about fatal error C1060: compiler is out of heap space.

This error happens occasionally, but shouldn't happen as often as it did on this PR. One thing that comes to mind is that the V8 update landed recently in the main branch and that is something that could increase the frequency of this. I'll monitor ARM64 builds closely for the next few days to see if this is a rising concern.

@panva

panva commented Apr 5, 2024

Copy link
Copy Markdown
MemberAuthor

@StefanStojanovic thank you for looking into it

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58135/

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58139/

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58144/

@nodejs-github-bot

nodejs-github-bot commented Apr 5, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58145/

@nodejs-github-bot

nodejs-github-bot commented Apr 6, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58151/

@nodejs-github-bot

nodejs-github-bot commented Apr 7, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58174/

@nodejs-github-bot

nodejs-github-bot commented Apr 8, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/58201/

@panvapanva added the commit-queue Add this label to land a pull request using GitHub Actions. label Apr 8, 2024
@nodejs-github-botnodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Apr 8, 2024
@nodejs-github-bot
nodejs-github-bot merged commit 9f939f5 into nodejs:mainApr 8, 2024
@nodejs-github-bot

nodejs-github-bot commented Apr 8, 2024

Copy link
Copy Markdown
Collaborator

Landed in 9f939f5

@panva
panva deleted the fix-oneshot-signer branch April 8, 2024 06:31
@RafaelGSSRafaelGSS mentioned this pull request Apr 15, 2024
Merged
marco-ippolito pushed a commit that referenced this pull request May 2, 2024
@panva@marco-ippolito
crypto: reject Ed25519/Ed448 in Sign/Verify prototypes
c877bb2
fixes: #52097
PR-URL: #52340Fixes: #52097
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@marco-ippolitomarco-ippolito mentioned this pull request May 2, 2024
Merged
marco-ippolito pushed a commit that referenced this pull request May 3, 2024
@panva@marco-ippolito
crypto: reject Ed25519/Ed448 in Sign/Verify prototypes
739958e
fixes: #52097
PR-URL: #52340Fixes: #52097
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
richardlau pushed a commit to aduh95/node that referenced this pull request Sep 27, 2024
@panva@richardlau
crypto: reject Ed25519/Ed448 in Sign/Verify prototypes
d244204
fixes: nodejs#52097
PR-URL: nodejs#52340Fixes: nodejs#52097
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@aduh95aduh95 mentioned this pull request Nov 7, 2024
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpincalpincalpinca approved these changes
@tniessentniessentniessen approved these changes
@aduh95aduh95aduh95 approved these changes

Assignees

No one assigned

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.c++Issues and PRs that require attention from people who are familiar with C++.cryptoIssues and PRs related to the crypto subsystem.needs-ciPRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Ed25519/Ed448 does not throw when used with invalid digest in crypto.createSign

6 participants

@panva@nodejs-github-bot@aduh95@tniessen@StefanStojanovic@lpinca