mirror of
https://github.com/nodejs/node.git
synced 2024-12-01 16:10:02 +01:00
6ebdb69472
PR #11705 switched Node away from using using OpenSSL's legacy EVP_Sign* and EVP_Verify* APIs. Instead, it computes a hash normally via EVP_Digest* and then uses EVP_PKEY_sign and EVP_PKEY_verify to verify the hash directly. This change corrects two problems: 1. The documentation still recommends the signature algorithm EVP_MD names of OpenSSL's legacy APIs. OpenSSL has since moved away from thosee, which is why ECDSA was strangely inconsistent. (This is why "ecdsa-with-SHA256" was missing.) 2. Node_SignFinal copied some code from EVP_SignFinal's internals. This is problematic for OpenSSL 1.1.0 and is missing a critical check that prevents pkey->pkey.ptr from being cast to the wrong type. To resolve this, remove the non-EVP_PKEY_sign codepath. This codepath is no longer necessary. PR #11705's verify half was already assuming all EVP_PKEYs supported EVP_PKEY_sign and EVP_PKEY_verify. Also, in the documentation, point users towards using hash function names which are more consisent. This avoids an ECDSA special-case and some strangeness around RSA-PSS ("RSA-SHA256" is the OpenSSL name of the sha256WithRSAEncryption OID which is not used for RSA-PSS). PR-URL: https://github.com/nodejs/node/pull/15024 Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> |
||
|---|---|---|
| .. | ||
| _toc.md | ||
| addons.md | ||
| all.md | ||
| assert.md | ||
| async_hooks.md | ||
| buffer.md | ||
| child_process.md | ||
| cli.md | ||
| cluster.md | ||
| console.md | ||
| crypto.md | ||
| debugger.md | ||
| deprecations.md | ||
| dgram.md | ||
| dns.md | ||
| documentation.md | ||
| domain.md | ||
| errors.md | ||
| esm.md | ||
| events.md | ||
| fs.md | ||
| globals.md | ||
| http2.md | ||
| http.md | ||
| https.md | ||
| index.md | ||
| inspector.md | ||
| intl.md | ||
| modules.md | ||
| n-api.md | ||
| net.md | ||
| os.md | ||
| path.md | ||
| perf_hooks.md | ||
| process.md | ||
| punycode.md | ||
| querystring.md | ||
| readline.md | ||
| repl.md | ||
| stream.md | ||
| string_decoder.md | ||
| synopsis.md | ||
| timers.md | ||
| tls.md | ||
| tracing.md | ||
| tty.md | ||
| url.md | ||
| util.md | ||
| v8.md | ||
| vm.md | ||
| zlib.md | ||