test: use 2048 bit RSA keys #44498

mmomtchev · 2022-09-02T19:35:00Z

OpenSSL now requires at least 2048
Refs: #44497

lpinca · 2022-09-03T08:45:36Z

Are you planning to update certs and keys in a follow-up PR?

mmomtchev · 2022-09-03T11:21:37Z

@lpinca Just realized that these were comitted too, done

nodejs-github-bot · 2022-09-03T11:33:42Z

CI: https://ci.nodejs.org/job/node-test-pull-request/46399/

mmomtchev · 2022-09-04T00:09:11Z

@lpinca This turned to be much more laborious that I previously thought so I scaled it back to simply replacing all 1024 bit keys with 2048 bit keys, I am leaving the 2048->4096 transition to the next unlucky soul because there is a list of hard-coded test vectors produced with another crypto system meant for testing compatibility.

There is also the DH512 keys which have been blocked (?) because of the logjam attack, I will do them separately

nodejs-github-bot · 2022-09-05T19:15:57Z

CI: https://ci.nodejs.org/job/node-test-pull-request/46427/

mmomtchev · 2022-09-05T20:58:45Z

node-test-commit-linuxone-rhel8-s390x is an abort on an out of memory condition - is this a flaky test?

nodejs-github-bot · 2022-09-17T19:12:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/46641/

* nodejs/node#49492 * nodejs/node#44498

* chore: upgrade to Node.js v20 * src: allow embedders to override NODE_MODULE_VERSION nodejs/node#49279 * src: fix missing trailing , nodejs/node#46909 * src,tools: initialize cppgc nodejs/node#45704 * tools: allow passing absolute path of config.gypi in js2c nodejs/node#49162 * tools: port js2c.py to C++ nodejs/node#46997 * doc,lib: disambiguate the old term, NativeModule nodejs/node#45673 * chore: fixup Node.js BSSL tests * nodejs/node#49492 * nodejs/node#44498 * deps: upgrade to libuv 1.45.0 nodejs/node#48078 * deps: update V8 to 10.7 nodejs/node#44741 * test: use gcUntil() in test-v8-serialize-leak nodejs/node#49168 * module: make CJS load from ESM loader nodejs/node#47999 * src: make BuiltinLoader threadsafe and non-global nodejs/node#45942 * chore: address changes to CJS/ESM loading * module: make CJS load from ESM loader (nodejs/node#47999) * lib: improve esm resolve performance (nodejs/node#46652) * bootstrap: optimize modules loaded in the built-in snapshot nodejs/node#45849 * test: mark test-runner-output as flaky nodejs/node#49854 * lib: lazy-load deps in modules/run_main.js nodejs/node#45849 * url: use private properties for brand check nodejs/node#46904 * test: refactor `test-node-output-errors` nodejs/node#48992 * assert: deprecate callTracker nodejs/node#47740 * src: cast v8::Object::GetInternalField() return value to v8::Value nodejs/node#48943 * test: adapt test-v8-stats for V8 update nodejs/node#45230 * tls: ensure TLS Sockets are closed if the underlying wrap closes nodejs/node#49327 * test: deflake test-tls-socket-close nodejs/node#49575 * net: fix crash due to simultaneous close/shutdown on JS Stream Sockets nodejs/node#49400 * net: use asserts in JS Socket Stream to catch races in future nodejs/node#49400 * lib: fix BroadcastChannel initialization location nodejs/node#46864 * src: create BaseObject with node::Realm nodejs/node#44348 * src: implement DataQueue and non-memory resident Blob nodejs/node#45258 * sea: add support for V8 bytecode-only caching nodejs/node#48191 * chore: fixup patch indices * gyp: put filenames in variables nodejs/node#46965 * build: modify js2c.py into GN executable * fix: (WIP) handle string replacement of fs -> original-fs * [v20.x] backport vm-related memory fixes nodejs/node#49874 * src: make BuiltinLoader threadsafe and non-global nodejs/node#45942 * src: avoid copying string in fs_permission nodejs/node#47746 * look upon my works ye mighty and dispair * chore: patch cleanup * [api] Remove AllCan Read/Write https://chromium-review.googlesource.com/c/v8/v8/+/5006387 * fix: missing include for NODE_EXTERN * chore: fixup patch indices * fix: fail properly when js2c fails in Node.js * build: fix js2c root_gen_dir * fix: lib/fs.js -> lib/original-fs.js * build: fix original-fs file xforms * fixup! module: make CJS load from ESM loader * build: get rid of CppHeap for now * build: add patch to prevent extra fs lookup on esm load * build: greatly simplify js2c modifications Moves our original-fs modifications back into a super simple python script action, wires up the output of that action into our call to js2c * chore: update to handle moved internal/modules/helpers file * test: update @types/node test * feat: enable preventing cppgc heap creation * feat: optionally prevent calling V8::EnableWebAssemblyTrapHandler * fix: no cppgc initialization in the renderer * gyp: put filenames in variables nodejs/node#46965 * test: disable single executable tests * fix: nan tests failing on node headers missing file * tls,http2: send fatal alert on ALPN mismatch nodejs/node#44031 * test: disable snapshot tests * nodejs/node#47887 * nodejs/node#49684 * nodejs/node#44193 * build: use deps/v8 for v8/tools Node.js hard depends on these in their builtins * test: fix edge snapshot stack traces nodejs/node#49659 * build: remove js2c //base dep * build: use electron_js2c_toolchain to build node_js2c * fix: don't create SafeSet outside packageResolve Fixes failure in parallel/test-require-delete-array-iterator: === release test-require-delete-array-iterator === Path: parallel/test-require-delete-array-iterator node:internal/per_context/primordials:426 constructor(i) { super(i); } // eslint-disable-line no-useless-constructor ^ TypeError: object is not iterable (cannot read property Symbol(Symbol.iterator)) at new Set (<anonymous>) at new SafeSet (node:internal/per_context/primordials:426:22) * fix: failing crashReporter tests on Linux These were failing because our change from node::InitializeNodeWithArgs to node::InitializeOncePerProcess meant that we now inadvertently called PlatformInit, which reset signal handling. This meant that our intentional crash function ElectronBindings::Crash no longer worked and the renderer process no longer crashed when process.crash() was called. We don't want to use Node.js' default signal handling in the renderer process, so we disable it by passing kNoDefaultSignalHandling to node::InitializeOncePerProcess. * build: only create cppgc heap on non-32 bit platforms * chore: clean up util:CompileAndCall * src: fix compatility with upcoming V8 12.1 APIs nodejs/node#50709 * fix: use thread_local BuiltinLoader * chore: fixup v8 patch indices --------- Co-authored-by: Keeley Hammond <[email protected]> Co-authored-by: Samuel Attard <[email protected]>

Refs: nodejs#44498 Refs: nodejs#53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in nodejs#53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]>

Refs: #44498 Refs: #53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in #53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: #54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: nodejs#44498 Refs: nodejs#53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in nodejs#53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: nodejs#54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: #44498 Refs: #53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in #53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: #54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: nodejs#44498 Refs: nodejs#53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in nodejs#53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: nodejs#54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: #44498 Refs: #53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in #53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: #54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: nodejs#44498 Refs: nodejs#53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in nodejs#53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: nodejs#54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

since 1024 is already deprecated by OpenSSL and causes "too small key" issues on systems enforcing a minimum size. Similar issue here: nodejs/node#44498 The minimum key size is not yet changed from 1024, this will require more effort for deprecation. BUG=webrtc:364338811 Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128 Reviewed-by: David Benjamin <[email protected]> Reviewed-by: Harald Alvestrand <[email protected]> Commit-Queue: Philipp Hancke <[email protected]> Cr-Commit-Position: refs/heads/main@{#43110}

Refs: #44498 Refs: #53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in #53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: #54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Refs: nodejs#44498 Refs: nodejs#53382 Key sizes were increased to 2048 in PR 44498 including the configuration file for the generation of ca2-cert.pem. However, it seems like updating ca2-cert.pem and related files themselves were missed as they were not updated in the PR and the ca2-cert.pem reported as being associated with a 1024 bit key. I believe that was the cause of some of the failures mentioned in nodejs#53382 as OpenSSL 3.2 increased the default security level from 1 to 2 and that would mean that certificates associated with keys of 1024 bits would no longer be accepted. This PR updates the key size for ca2-cert.pem. It was not necessary to change the config, only run the generation for the ca2-cert.pem and related files. Signed-off-by: Michael Dawson <[email protected]> PR-URL: nodejs#54599 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]>

Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79 ssl: increase default RSA key size to 2048 bits since 1024 is already deprecated by OpenSSL and causes "too small key" issues on systems enforcing a minimum size. Similar issue here: nodejs/node#44498 The minimum key size is not yet changed from 1024, this will require more effort for deprecation. BUG=webrtc:364338811 Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128 Reviewed-by: David Benjamin <[email protected]> Reviewed-by: Harald Alvestrand <[email protected]> Commit-Queue: Philipp Hancke <[email protected]> Cr-Commit-Position: refs/heads/main@{#43110}

Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79 ssl: increase default RSA key size to 2048 bits since 1024 is already deprecated by OpenSSL and causes "too small key" issues on systems enforcing a minimum size. Similar issue here: nodejs/node#44498 The minimum key size is not yet changed from 1024, this will require more effort for deprecation. BUG=webrtc:364338811 Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128 Reviewed-by: David Benjamin <davidbenwebrtc.org> Reviewed-by: Harald Alvestrand <htawebrtc.org> Commit-Queue: Philipp Hancke <phanckemeta.com> Cr-Commit-Position: refs/heads/main{#43110} UltraBlame original commit: a674447f7a1f2d87718780cf2311b324c10f5384

nodejs-github-bot added needs-ci PRs that need a full CI run. test Issues and PRs related to the tests. labels Sep 2, 2022

lpinca approved these changes Sep 3, 2022

View reviewed changes

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Sep 3, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Sep 3, 2022

mmomtchev marked this pull request as draft September 3, 2022 12:18

mmomtchev force-pushed the rsa-key-length branch 2 times, most recently from ccdd394 to 814ebc5 Compare September 3, 2022 16:43

mmomtchev marked this pull request as ready for review September 4, 2022 00:09

github-actions bot mentioned this pull request Sep 4, 2022

CI Reliability 2022-09-04 nodejs/reliability#367

Open

24 tasks

mmomtchev force-pushed the rsa-key-length branch from bdd42cc to a27d6ae Compare September 4, 2022 16:07

github-actions bot mentioned this pull request Sep 5, 2022

CI Reliability 2022-09-05 nodejs/reliability#368

Open

17 tasks

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Sep 5, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Sep 5, 2022

This was referenced Sep 6, 2022

CI Reliability 2022-09-06 nodejs/reliability#369

Open

CI Reliability 2022-09-07 nodejs/reliability#370

Open

mmomtchev changed the title ~~test: use 4096 bit RSA keys~~ test: use 2048 bit RSA keys Sep 7, 2022

This was referenced Sep 8, 2022

CI Reliability 2022-09-08 nodejs/reliability#371

Open

CI Reliability 2022-09-09 nodejs/reliability#372

Open

CI Reliability 2022-09-10 nodejs/reliability#373

Open

CI Reliability 2022-09-11 nodejs/reliability#374

Open

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Sep 17, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Sep 17, 2022

codebytere added a commit to electron/electron that referenced this pull request Nov 6, 2023

chore: fixup Node.js BSSL tests

422032e

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 14, 2023

chore: fixup Node.js BSSL tests

703ddf9

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 15, 2023

chore: fixup Node.js BSSL tests

bc150a5

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 16, 2023

chore: fixup Node.js BSSL tests

59671c0

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 21, 2023

chore: fixup Node.js BSSL tests

9ce7e8c

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 22, 2023

chore: fixup Node.js BSSL tests

f3b52dc

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 28, 2023

chore: fixup Node.js BSSL tests

927e565

* nodejs/node#49492 * nodejs/node#44498

codebytere added a commit to electron/electron that referenced this pull request Nov 29, 2023

chore: fixup Node.js BSSL tests

40a8636

* nodejs/node#49492 * nodejs/node#44498

mhdawson mentioned this pull request Aug 27, 2024

test: increase key size for ca2-cert.pem #54599

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

test: use 2048 bit RSA keys #44498

test: use 2048 bit RSA keys #44498

mmomtchev commented Sep 2, 2022

lpinca commented Sep 3, 2022 •

edited

Loading

mmomtchev commented Sep 3, 2022

nodejs-github-bot commented Sep 3, 2022

mmomtchev commented Sep 4, 2022

nodejs-github-bot commented Sep 5, 2022

mmomtchev commented Sep 5, 2022 •

edited

Loading

nodejs-github-bot commented Sep 17, 2022

test: use 2048 bit RSA keys #44498

test: use 2048 bit RSA keys #44498

Conversation

mmomtchev commented Sep 2, 2022

lpinca commented Sep 3, 2022 • edited Loading

mmomtchev commented Sep 3, 2022

nodejs-github-bot commented Sep 3, 2022

mmomtchev commented Sep 4, 2022

nodejs-github-bot commented Sep 5, 2022

mmomtchev commented Sep 5, 2022 • edited Loading

nodejs-github-bot commented Sep 17, 2022

lpinca commented Sep 3, 2022 •

edited

Loading

mmomtchev commented Sep 5, 2022 •

edited

Loading