Skip to content

crypto: Resolve FIPS test failures and API issues #3760

Closed
@stefanmb

Description

@stefanmb

Issue Overview

The issue of FIPS-compliant encryption in Node.js has been brought up before and support for compiling with FIPS-compliant OpenSSL was added. The FIPS build instructions have recently been modified to insure compliance with FIPS 140-2 requirements.

However, running the Node.js test suite (“tools/test.py --verbose”) with the FIPS-compliant OpenSSL crypto module produces a large number of test failures. These failures are a significant roadblock to adoption of Node.js in real life applications requiring FIPS compliance, because it is unclear to prospective users if Node.js can actually work correctly in this mode.

I have spent some time debugging the test failures and have produced a series of pull requests to address them. These pull requests are split up under several “themes” below.

Pull Requests

Documentation Update

#3752 (Landed)

Error Checking

#3753 (Landed)

FIPS-incompatible API

#3754 (Landed)

TLS Wrap

#3755 (Landed)

OpenSSL Known Bug Workaround

#3756 (Landed)

Avoid use of disallowed Crypto (e.g. MD5, RC4)

#3757 (Landed)

Boost Strength of “Arbitrary” Crypto

#3758 (Landed)

Update Test Fixtures with FIPS Compatible Crypto

#3759 (Landed)

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions