setFips() / setEngine do not evict ciphers cache
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 122k
- Forks
- 37.3k
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 283
Description
> require('crypto').getCiphers().length
130
> require('crypto').setFips(true)
undefined
> require('crypto').getCiphers().length
130
but
> require('crypto').setFips(true)
undefined
> require('crypto').getCiphers().length
0
Also (unverified):
getCiphersmemoizes the cipher name list forever (cachedResult(() => filterDuplicateStrings(_getCiphers()))). WhensetEngine(id, flags)(also exported from this module) successfully loads an OpenSSL engine that registers additional ciphers, those new ciphers are not reflected in subsequentgetCiphers()results because the cache is never invalidated. Similarly, on BoringSSL builds the cache is force-populated during module initialization viaconditionalAlgorithms(the'ChaCha20-Poly1305'probe callsgetCiphers()), freezing the answer before any user code runs. The sibling_hashCachehelper in the same file explicitly clears on snapshot build / dynamic-link scenarios viaaddSerializeCallback;getCiphershas no such mechanism.
getHashesreturns a permanently-cached list from_getHashes()(viacachedResult). After a successfulsetEngine(id, flags)call (exported from this same module) loads an OpenSSL engine that registers new digest algorithms,getHashes()will continue to return the pre-engine snapshot. Downstream consumers — including this file's ownconditionalAlgorithmsgates forcSHAKE*/SHA3-*/ChaCha20-Poly1305 (evaluated once at module-load, so already locked in) and any external callers usingcrypto.getHashes()— will not observe engine-provided hashes. Contrast with the siblinggetHashCache(line 81–91) which is explicitly designed to be refreshed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the crypto module file containing cachedResult, setFips, setEngine, conditionalAlgorithms, and the getHashCache helper at lines 81–91. Trace how getCiphers and getHashes are cached and how existing cache-refresh behavior works; done means successful FIPS or engine changes are reflected in subsequent algorithm-list results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100