Skip to content

crypto: fix multi-prime RSA JWKs - #65649

Open
panva wants to merge 1 commit into
nodejs:mainfrom
panva:fix-multiprime-rsa-jwk
Open

crypto: fix multi-prime RSA JWKs#65649
panva wants to merge 1 commit into
nodejs:mainfrom
panva:fix-multiprime-rsa-jwk

Conversation

@panva

@panva panva commented Aug 29, 2026

Copy link
Copy Markdown
Member

This fixes inconsistent multi-prime RSA key handling between PKCS#8 and JWK formats.

Operation Node.js 24.x Node.js 26.x / main This PR
PKCS#8 → PKCS#8 Preserves all primes Preserves all primes Preserves all primes
PKCS#8 → JWK Omits oth Omits oth Includes oth
JWK import Accepts but discards oth Rejects because n != p * q Imports all primes
JWK → PKCS#8 Produces an invalid two-prime key Not reachable Preserves the original key
Sign after JWK import Works through OpenSSL's non-CRT fallback Not reachable Works with the complete key

Preserve additional RSA prime information when exporting and importing
private JWKs across supported OpenSSL versions.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva
panva requested a review from jasnell August 29, 2026 20:47
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Aug 29, 2026
@panva
panva requested a review from anonrig August 29, 2026 21:00
@codecov

codecov Bot commented Aug 29, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 61.25000% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.04%. Comparing base (789c7fd) to head (3c56d9f).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
src/crypto/crypto_rsa.cc 61.25% 12 Missing and 19 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #65649      +/-   ##
==========================================
- Coverage   90.05%   90.04%   -0.01%     
==========================================
  Files         754      754              
  Lines      255727   255813      +86     
  Branches    48320    48343      +23     
==========================================
+ Hits       230300   230357      +57     
- Misses      16552    16565      +13     
- Partials     8875     8891      +16     
Files with missing lines Coverage Δ
src/crypto/crypto_rsa.cc 64.21% <61.25%> (-0.94%) ⬇️

... and 34 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@panva panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. labels Aug 30, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 30, 2026
@nodejs-github-bot

This comment has been minimized.

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@panva panva added the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants