SIGN IN SIGN UP

crypto: discover hashes from OpenSSL providers

Enumerate usable digests and aliases from activated OpenSSL 3 providers
rather than relying only on the legacy digest registry. Normalize
provider aliases, omit numeric OIDs and NULL, and validate them against
the active default property query. Preserve legacy names and the OpenSSL
1.1.1 and BoringSSL paths.

Expose KECCAK-KMAC-128, KECCAK-256, SHA256-192, and other provider
digests. Add `functionName` and `customization` options for cSHAKE
digests in `createHash()` and `crypto.hash()` with OpenSSL 4.0 or later.

Resolve provider-only digest names across hashing, HMAC, KDF, signing,
verification, and RSA digest options. Keep ordinary hash construction
and one-shot hashing on the original binding arities and direct
initialization paths. Use parameterized setup only when cSHAKE options
are supplied.

Lazily cache successful provider fetches per Environment.
Index entries by case-insensitive query, canonical, and alias names.
Deduplicate owners by provider and canonical identity. Return borrowed
pointers on warm hits.

Introduce a process-wide FIPS-state generation that advances only after
successful, state-changing `setFips()` calls. Use it to invalidate
per-Environment digest caches and refresh `getHashes()` snapshots in the
main thread and workers. Keep cache IDs monotonic across invalidation
because JavaScript Realms can retain them. Existing hash contexts can
finish across a transition.

Release provider owners before unloading worker addon DSOs. Document
provider-dependent availability and operation-specific restrictions.
Add known-answer vectors, option validation, provider resolution,
property-query, FIPS transition, worker, snapshot, and cross-API
coverage.

Refs: https://github.com/nodejs/node/issues/62982
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65484
Fixes: https://github.com/nodejs/node/issues/43040
Fixes: https://github.com/nodejs/node/issues/64866
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
F
Filip Skokan committed
025e88f981fde833920756b22a031305d260e175
Parent: ef4a636
Committed by Node.js GitHub Bot <github-bot@iojs.org> on 8/25/2026, 11:11:05 PM