-
Notifications
You must be signed in to change notification settings - Fork 30k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
doc: public keys don't accept passphrases #16087
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While crypto.publicDecrypt() and crypto.publicEncrypt() do accept a passphrase option, the C++ code simply ignores it because OpenSSL does not support it for public keys.
It does support it for private keys, and you can call both crypto.publicDecrypt()
and crypto.publicEncrypt()
with a private key, which will fail if it's encrypted and you don't provide a passphrase.
> var key = fs.readFileSync('private.pem', {encoding: 'ascii'});
> var data = new Buffer(15)
> crypto.publicEncrypt(key, data)
Error: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
at Object.publicEncrypt (crypto.js:388:12)
at repl:1:8
at ContextifyScript.Script.runInThisContext (vm.js:44:33)
at REPLServer.defaultEval (repl.js:239:29)
at bound (domain.js:301:14)
at REPLServer.runBound [as eval] (domain.js:314:12)
at REPLServer.onLine (repl.js:433:10)
at emitOne (events.js:120:20)
at REPLServer.emit (events.js:210:7)
at REPLServer.Interface._onLine (readline.js:278:10)
> crypto.publicEncrypt({ key: key, passphrase: 'whatever'}, data)
<Buffer 74 49 d9 b7 6b fe 8a 1a 53 0d c2 46 8f 75 7c b4 34 cf f0 4a b6 11 df 43 c8 8b e2 bc 1c f1 30 cd 95 2a 19 2f 82 87 4f 4f 6a 15 ca b5 16 9c 23 1c f5 8f ... >
>
Since `crypto.publicDecrypt()` and `crypto.publicEncrypt()` accept both public and private keys, make it clear that the `passphrase` option only applies to private keys. Refs: nodejs#16038
b60a804
to
3cdd070
Compare
Okay, fair enough. I rewrote it more rigorously, PTAL. |
Since `crypto.publicDecrypt()` and `crypto.publicEncrypt()` accept both public and private keys, make it clear that the `passphrase` option only applies to private keys. PR-URL: #16087 Ref: #16038 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Landed in 3469eb9 |
Since `crypto.publicDecrypt()` and `crypto.publicEncrypt()` accept both public and private keys, make it clear that the `passphrase` option only applies to private keys. PR-URL: #16087 Ref: #16038 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Since `crypto.publicDecrypt()` and `crypto.publicEncrypt()` accept both public and private keys, make it clear that the `passphrase` option only applies to private keys. PR-URL: nodejs/node#16087 Ref: nodejs/node#16038 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Since `crypto.publicDecrypt()` and `crypto.publicEncrypt()` accept both public and private keys, make it clear that the `passphrase` option only applies to private keys. PR-URL: nodejs/node#16087 Ref: nodejs/node#16038 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
While
crypto.publicDecrypt()
andcrypto.publicEncrypt()
do accept apassphrase
option, the C++ code simply ignores it because OpenSSL doesnot support it for public keys. Undocument the option.
Refs: #16038