fix(ext/node): decrypt encrypted private keys in publicEncrypt/privateDecrypt and ignore passphrase#33770
Merged
bartlomieju merged 1 commit intoMay 1, 2026
Conversation
…eDecrypt and ignore passphrase Enables tests/node_compat/runner/suite/test/parallel/test-crypto-keygen-async-encrypted-private-key.js Co-authored-by: Divy Srivastava <[email protected]>
fibibot
approved these changes
May 1, 2026
fibibot
left a comment
fibibot
left a comment
Contributor
There was a problem hiding this comment.
LGTM. Two-sided fix that lines up well:
- JS side
prepareKey(cipher.ts:760–786): when the user supplies{ key, passphrase }topublicEncrypt/privateDecryptwith raw key material, build aKeyObjectviaop_node_create_private_key(key, format, type, passphrase)and re-export as unencrypted PKCS#8 PEM, then hand that to the existing downstream RSA op. Default-format inference (format ?? (typeof data === "string" ? "pem" : "der")) matches Node's owncrypto.createPrivateKeydefaulting. - Rust side
KeyObjectHandle::*PKCS#8 DER + passphrase (keys.rs:903–916): when both passphrase and key arrive, branch onEncryptedPrivateKeyInfo::try_from(key).is_ok()— if actually encrypted, decrypt; if the key isn't encrypted, ignore the passphrase and parse as plain PKCS#8. Comment is exactly right: Node treats a passphrase on an unencrypted key as a no-op rather than rejecting, so this matches the semantics CryptoKey/createPrivateKeyusers rely on. - The new
EncryptedPkcs8DerRequiresPassphrasevariant is reused from #33756, so the encrypted-without-passphrase path stays on theERR_MISSING_PASSPHRASEbranch — depends on #33756 landing first (which is already approved). - All 48
test node_compat+test unit_nodeshards across 4 platforms × debug/release are SUCCESS atbdc8371. Onlywpt release linux-x86_64is still in flight, and WPT doesn't exercise crypto in any way relevant to this change.
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables
test-crypto-keygen-async-encrypted-private-keyin node_compat suite.Test plan
cargo test --test node_compat -- test-crypto-keygen-async-encrypted-private-key