Skip to content

crypto: unify asymmetric key import through KeyObjectHandle::Init#62499

Merged
nodejs-github-bot merged 1 commit intonodejs:mainfrom
panva:key-refactor
Mar 31, 2026
Merged

crypto: unify asymmetric key import through KeyObjectHandle::Init#62499
nodejs-github-bot merged 1 commit intonodejs:mainfrom
panva:key-refactor

Conversation

@panva
Copy link
Copy Markdown
Member

@panva panva commented Mar 29, 2026

Consolidate all asymmetric key import paths (DER/PEM, JWK, raw) into a single KeyObjectHandle::Init() entry point with a uniform signature.

Remove the per-type C++ init methods (InitECRaw, InitEDRaw, InitPqcRaw, InitJwk, InitECPrivateRaw) and their JS-side callers, replacing them with shared C++ and JS helpers.

createPublicKey, createPrivateKey, sign, verify, and other operations that accept key material now handle JWK and raw formats directly in C++, removing redundant JS-to-C++ key handle round-trips.

This also makes JWK import error for keys when their private and public components don't match, this aligns with the behaviour present in other runtimes, most notably browser webcrypto APIs. It was already present in our WebCryptoAPI for some keys but not all, this makes it all as well as node:crypto, this behaviour was useful for bypassing the inability to import "raw" private keys but that affordance is also coming with 26.x through its own recognized key format (#62455).

@panva panva added crypto Issues and PRs related to the crypto subsystem. webcrypto dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v25.x PRs that should not land on the v25.x-staging branch and should not be released in v25.x. labels Mar 29, 2026
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Mar 29, 2026
@panva panva marked this pull request as ready for review March 29, 2026 21:29
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 29, 2026

Codecov Report

❌ Patch coverage is 88.16667% with 71 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.70%. Comparing base (c3042c6) to head (e862156).
⚠️ Report is 21 commits behind head on main.

Files with missing lines Patch % Lines
src/crypto/crypto_keys.cc 76.47% 22 Missing and 30 partials ⚠️
src/crypto/crypto_ec.cc 81.81% 3 Missing and 7 partials ⚠️
src/crypto/crypto_ml_dsa.cc 88.67% 1 Missing and 5 partials ⚠️
lib/internal/crypto/keys.js 95.83% 1 Missing ⚠️
lib/internal/crypto/webcrypto_util.js 98.92% 0 Missing and 1 partial ⚠️
src/crypto/crypto_rsa.cc 90.90% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #62499      +/-   ##
==========================================
- Coverage   89.70%   89.70%   -0.01%     
==========================================
  Files         692      693       +1     
  Lines      214167   213849     -318     
  Branches    41113    40957     -156     
==========================================
- Hits       192121   191830     -291     
+ Misses      14116    14080      -36     
- Partials     7930     7939       +9     
Files with missing lines Coverage Δ
lib/internal/crypto/aes.js 89.89% <100.00%> (+1.43%) ⬆️
lib/internal/crypto/cfrg.js 93.23% <100.00%> (-1.24%) ⬇️
lib/internal/crypto/chacha20_poly1305.js 92.05% <100.00%> (-0.72%) ⬇️
lib/internal/crypto/cipher.js 97.94% <100.00%> (ø)
lib/internal/crypto/ec.js 94.17% <100.00%> (-0.61%) ⬇️
lib/internal/crypto/kem.js 97.41% <100.00%> (+0.09%) ⬆️
lib/internal/crypto/mac.js 92.70% <100.00%> (+1.57%) ⬆️
lib/internal/crypto/ml_dsa.js 95.39% <100.00%> (+0.35%) ⬆️
lib/internal/crypto/ml_kem.js 92.45% <100.00%> (+0.56%) ⬆️
lib/internal/crypto/rsa.js 94.51% <100.00%> (+2.10%) ⬆️
... and 11 more

... and 24 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Consolidate all asymmetric key import paths (DER/PEM, JWK, raw) into
a single KeyObjectHandle::Init() entry point with a uniform signature.

Remove the per-type C++ init methods (InitECRaw, InitEDRaw, InitPqcRaw,
InitJwk, InitECPrivateRaw) and their JS-side callers, replacing them
with shared C++ and JS helpers.

createPublicKey, createPrivateKey, sign, verify, and other operations
that accept key material now handle JWK and raw formats directly in
C++, removing redundant JS-to-C++ key handle round-trips.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva panva requested review from anonrig and jasnell March 30, 2026 19:37
@panva panva added request-ci Add this label to start a Jenkins CI on a PR. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Mar 31, 2026
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@panva panva requested review from anonrig and tniessen March 31, 2026 14:20
@anonrig anonrig added the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 31, 2026
@panva panva added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. semver-major PRs that contain breaking changes and should be released in the next major version. and removed commit-queue Add this label to land a pull request using GitHub Actions. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v25.x PRs that should not land on the v25.x-staging branch and should not be released in v25.x. labels Mar 31, 2026
@panva
Copy link
Copy Markdown
Member Author

panva commented Mar 31, 2026

cc @nodejs/tsc for semver-major PRs that contain breaking changes and should be released in the next major version.

@panva panva added the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 31, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 31, 2026
@nodejs-github-bot nodejs-github-bot merged commit 1ccae7c into nodejs:main Mar 31, 2026
78 checks passed
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Landed in 1ccae7c

@panva panva deleted the key-refactor branch March 31, 2026 19:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. crypto Issues and PRs related to the crypto subsystem. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. semver-major PRs that contain breaking changes and should be released in the next major version. webcrypto

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants