Skip to content

crypto: support ML-KEM KeyObject #59461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Conversation

panva
Copy link
Member

@panva panva commented Aug 13, 2025

This allows node:crypto to recognize the ML-KEM KeyObject types (keyObject.asymmetricKeyType) when built with or linked to OpenSSL 3.5 and the following functionality for them:

  • import crypto.createPublicKey() SPKI
  • import crypto.createPrivateKey() PKCS#8
  • export keyObject.export() SPKI/PKCS#8
  • keygen crypto.generateKeyPair(Sync)() into KeyObject, PEM, DER

JWK import/export is not implemented because it has not been standardized yet

Edit: I've dropped SLH-DSA from this PR because testing its higher level of security variants was intermittenly grinding CI to a halt. I might reintroduce it separately. For now i'm just looking to add ML-KEM to be able to introduce key encapsulation in a follow up PR.

@panva panva requested review from jasnell and tniessen August 13, 2025 16:00
@panva panva added crypto Issues and PRs related to the crypto subsystem. semver-minor PRs that contain new features and should be released in the next minor version. notable-change PRs with changes that should be highlighted in changelogs. commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. labels Aug 13, 2025
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Aug 13, 2025
Copy link
Contributor

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @panva.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

Copy link

codecov bot commented Aug 13, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.86%. Comparing base (abb1f92) to head (2f07d66).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #59461      +/-   ##
==========================================
- Coverage   89.88%   89.86%   -0.02%     
==========================================
  Files         656      656              
  Lines      193068   193083      +15     
  Branches    37871    37876       +5     
==========================================
- Hits       173534   173514      -20     
- Misses      12079    12083       +4     
- Partials     7455     7486      +31     
Files with missing lines Coverage Δ
lib/internal/crypto/keygen.js 92.10% <100.00%> (+0.17%) ⬆️
src/crypto/crypto_keys.cc 72.91% <100.00%> (+0.33%) ⬆️

... and 29 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Member

@tniessen tniessen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing work @panva!

@nodejs-github-bot

This comment was marked as outdated.

@nodejs-github-bot

This comment was marked as outdated.

@panva panva added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Aug 14, 2025
@nodejs-github-bot

This comment was marked as outdated.

@nodejs-github-bot

This comment was marked as outdated.

@panva panva removed the notable-change PRs with changes that should be highlighted in changelogs. label Aug 14, 2025
@nodejs-github-bot

This comment was marked as outdated.

@panva panva added the review wanted PRs that need reviews. label Aug 15, 2025
@nodejs-github-bot

This comment was marked as outdated.

Copy link
Contributor

@Ethan-Arrowood Ethan-Arrowood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@nodejs-github-bot

This comment was marked as outdated.

@panva panva changed the title crypto: support ML-KEM and SLH-DSA KeyObject crypto: support ML-KEM KeyObject Aug 16, 2025
@panva
Copy link
Member Author

panva commented Aug 16, 2025

I've dropped SLH-DSA from this PR because testing its higher level of security variants was intermittenly grinding CI to a halt. I might reintroduce it separately. For now i'm just looking to add ML-KEM to be able to introduce key encapsulation in a follow up PR.

@nodejs-github-bot
Copy link
Collaborator

@panva panva removed the commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. label Aug 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. crypto Issues and PRs related to the crypto subsystem. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. review wanted PRs that need reviews. semver-minor PRs that contain new features and should be released in the next minor version.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants