镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

setFips() / setEngine do not evict ciphers cache #62982

Description

@ChALkeR
> require('crypto').getCiphers().length
130
> require('crypto').setFips(true)
undefined
> require('crypto').getCiphers().length
130

but

> require('crypto').setFips(true)
undefined
> require('crypto').getCiphers().length
0

Also (unverified):

getCiphers memoizes the cipher name list forever (cachedResult(() => filterDuplicateStrings(_getCiphers()))). When setEngine(id, flags) (also exported from this module) successfully loads an OpenSSL engine that registers additional ciphers, those new ciphers are not reflected in subsequent getCiphers() results because the cache is never invalidated. Similarly, on BoringSSL builds the cache is force-populated during module initialization via conditionalAlgorithms (the 'ChaCha20-Poly1305' probe calls getCiphers()), freezing the answer before any user code runs. The sibling _hashCache helper in the same file explicitly clears on snapshot build / dynamic-link scenarios via addSerializeCallback; getCiphers has no such mechanism.

getHashes returns a permanently-cached list from _getHashes() (via cachedResult). After a successful setEngine(id, flags) call (exported from this same module) loads an OpenSSL engine that registers new digest algorithms, getHashes() will continue to return the pre-engine snapshot. Downstream consumers — including this file's own conditionalAlgorithms gates for cSHAKE*/SHA3-*/ChaCha20-Poly1305 (evaluated once at module-load, so already locked in) and any external callers using crypto.getHashes() — will not observe engine-provided hashes. Contrast with the sibling getHashCache (line 81–91) which is explicitly designed to be refreshed.

Activity

  1. changed the title [-]setFips() / setEngine do not evict cache[/-] [+]setFips() / setEngine do not evict ciphers cache[/+] on Apr 27, 2026
  2. added
    cryptoIssues and PRs related to the crypto subsystem.
    on Apr 27, 2026
  3. github-actions commented on Jul 27, 2026

    @github-actions
    Contributor

    This issue has been marked as stale due to 90 days of inactivity.
    It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

  4. added
    staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.
    and removed
    staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.
    on Jul 27, 2026
  5. panva commented on Sep 23, 2026

    @panva
    Member

    This is resolved for FIPS mode transitions for all of getCiphers(), getHashes(), getCurves(), the new getMacs() also gets the same treatment, SubtleCrypto.supports() and Web Cryptography algorithm registrations also respect FIPS transitions now.

    We will not be accomodating setEngine() since it's deprecated and will be removed in 27.x

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions