crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL by panva · Pull Request #63255 · nodejs/node

panva · 2026-05-11T16:17:09Z

This PR wires up the following when using BoringSSL:

AES-KW in Web Cryptography
ChaCha20-Poly1305 in Web Cryptography experimentalIssues and PRs related to experimental features.
ML-DSA and ML-KEM in Web Cryptography experimentalIssues and PRs related to experimental features.
ML-DSA and ML-KEM in node:crypto

Refs: electron/electron#36256
Refs: electron/electron#41720
Refs: electron/electron#51127

nodejs-github-bot · 2026-05-11T16:17:15Z

Review requested:

@nodejs/crypto
@nodejs/performance
@nodejs/security-wg

codecov · 2026-05-11T17:45:17Z

Codecov Report

❌ Patch coverage is 90.24390% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.05%. Comparing base (6482073) to head (a1d227f).
⚠️ Report is 24 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/crypto/webidl.js	50.00%	5 Missing ⚠️
src/crypto/crypto_pqc.cc	92.00%	0 Missing and 2 partials ⚠️
src/crypto/crypto_keys.cc	97.61%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #63255 +/- ##
==========================================
+ Coverage 90.04% 90.05% +0.01% 
==========================================
Files 714 714 Lines 225352 225371 +19 Branches 42605 42621 +16 ==========================================
+ Hits 202909 202954 +45 + Misses 14234 14191 -43 - Partials 8209 8226 +17

Files with missing lines	Coverage Δ
lib/internal/crypto/util.js	`97.08% <100.00%> (+0.10%)`	⬆️
src/crypto/crypto_aes.cc	`54.16% <ø> (+0.34%)`	⬆️
src/crypto/crypto_aes.h	`33.33% <ø> (ø)`
src/crypto/crypto_argon2.cc	`64.13% <ø> (ø)`
src/crypto/crypto_argon2.h	`50.00% <ø> (ø)`
src/crypto/crypto_chacha20_poly1305.cc	`58.13% <ø> (ø)`
src/crypto/crypto_cipher.cc	`77.43% <ø> (ø)`
src/crypto/crypto_kem.cc	`80.74% <ø> (ø)`
src/crypto/crypto_kem.h	`33.33% <ø> (ø)`
src/crypto/crypto_kmac.cc	`56.66% <ø> (ø)`
... and 7 more

... and 34 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-05-15T17:26:03Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73471/ 💚

More importantly for the change here: https://github.com/nodejs/node/actions/runs/25911580593/job/76158001919?pr=63255 💚

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Backport-PR-URL: nodejs#63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Backport-PR-URL: nodejs#63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

panva requested review from anonrig, codebytere and jasnell May 11, 2026 16:17

panva added crypto Issues and PRs related to the crypto subsystem. webcrypto commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. labels May 11, 2026

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 11, 2026

panva requested a review from addaleax May 11, 2026 16:17

panva mentioned this pull request May 11, 2026
chore: add Phase Three (node smoke tests) to Node.js upgrade skill electron/electron#51127
Merged
5 tasks

panva added 3 commits May 15, 2026 09:47

src: simplify OpenSSL feature gates
45d5040
Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

crypto: wire AES-KW in Web Cryptography when using BoringSSL
9a007e4
Signed-off-by: Filip Skokan <panva.ip@gmail.com>

crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL
556bcb3
Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva force-pushed the make-crypto-boring-again branch from 96d0932 to fbb81c2Compare May 15, 2026 07:47

crypto: wire ML-DSA and ML-KEM for use when using BoringSSL
a1d227f
Signed-off-by: Filip Skokan <panva.ip@gmail.com>

panva force-pushed the make-crypto-boring-again branch from fbb81c2 to a1d227fCompare May 15, 2026 09:51

jasnell approved these changes May 15, 2026
View reviewed changes

panva added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels May 15, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 15, 2026

This comment was marked as outdated.
Sign in to view

panva added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v25.x labels May 16, 2026

anonrig approved these changes May 17, 2026
View reviewed changes

panva added the commit-queue Add this label to land a pull request using GitHub Actions. label May 17, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 17, 2026

sxa mentioned this pull request Jun 22, 2026
2026-06-23, Version 24.18.0 'Krypton' (LTS) #64062
Merged

This was referenced Jul 27, 2026
chore(mise): upgrade local tools jylenhof/mise-update-tool#18
Closed
chore(mise): upgrade local tools jylenhof/mise-update-tool#23
Closed

Navigation Menu

Uh oh!

Uh oh!

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL - #63255

crypto: enable ML-DSA, ML-KEM, AES-KW, and ChaCha20-Poly1305 on BoringSSL#63255
panva wants to merge 4 commits into
nodejs:mainfrom
panva:make-crypto-boring-again

panva commented May 11, 2026•
edited
Loading

Uh oh!

nodejs-github-bot commented May 11, 2026

Uh oh!

codecovBot commented May 11, 2026•
edited
Loading

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented May 15, 2026•
edited by panva
Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

panva commented May 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented May 11, 2026

Uh oh!

codecovBot commented May 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented May 15, 2026• edited by panva Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

panva commented May 11, 2026•
edited
Loading

codecovBot commented May 11, 2026•
edited
Loading

nodejs-github-bot commented May 15, 2026•
edited by panva
Loading