{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/3759","labels_url":"https://api.github.com/repos/nodejs/node/issues/3759/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/3759/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/3759/events","html_url":"https://github.com/nodejs/node/pull/3759","id":116231203,"number":3759,"title":"test: Stronger crypto in test fixtures","user":{"login":"stefanmb","id":1356314,"avatar_url":"https://avatars.githubusercontent.com/u/1356314?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanmb","html_url":"https://github.com/stefanmb","followers_url":"https://api.github.com/users/stefanmb/followers","following_url":"https://api.github.com/users/stefanmb/following{/other_user}","gists_url":"https://api.github.com/users/stefanmb/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanmb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanmb/subscriptions","organizations_url":"https://api.github.com/users/stefanmb/orgs","repos_url":"https://api.github.com/users/stefanmb/repos","events_url":"https://api.github.com/users/stefanmb/events{/privacy}","received_events_url":"https://api.github.com/users/stefanmb/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/test","name":"test","color":"990099"},{"url":"https://api.github.com/repos/nodejs/node/labels/tls","name":"tls","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-11T00:05:18Z","updated_at":"2015-11-12T17:03:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/3759","html_url":"https://github.com/nodejs/node/pull/3759","diff_url":"https://github.com/nodejs/node/pull/3759.diff","patch_url":"https://github.com/nodejs/node/pull/3759.patch"},"body":"A number of pre-generated text fixtures are used in the crypto/tls tests, for example certificate files. The test fixtures in the test\\fixtures\\keys\\ folder are generated by a Makefile, but those in the parent folder (test\\fixtures) are not.\r\n\r\nIn many cases these test fixtures were generated using default (or deprecated) options with an old version of OpenSSL, which means that they use weak crypto (e.g. RC40). I have regenerated the test fixtures to be compatible with FIPS mode. The following are notes on the manual steps used to regenerate the fixtures, where applicable:\r\n\r\n### test/fixtures/test_cert.pfx\r\n\r\n#### Problem:\r\nopenssl pkcs12 -info -in test/fixtures/test_cert.pfx\r\nEnter Import Password:\r\nMAC Iteration 2048\r\nMAC verified OK\r\nPKCS7 Encrypted data: pbeWithSHA1And**40BitRC2-CBC**, Iteration 2048\r\n\r\n#### Solution:\r\nExtract and decrypt the existing private key:\r\nopenssl pkcs12 -in test_cert.pfx -nocerts -out extracted_key.pem -nodes\r\nExtract the certificate:\r\nopenssl pkcs12 -in test_cert.pfx -nokeys -out extracted_cert.pem\r\nPackage as PFX with 3DES encryption for the certificate (instead of 40bit RC2):\r\nopenssl pkcs12 -descert -export -out test_cert.pfx -inkey extracted_key.pem -in extracted_cert.pem\r\n(n.b. password is 'sample', this is hardcoded in test-crypto.js)\r\n\r\n### test/fixtures/test_dsa(priv|pub)key.pem\r\n\r\n#### Problem:\r\nBad length in test_dsa_privkey.pem:  \r\n0x0000000000b821c1 in fips_check_dsa_prng (dsa=0x1f28570, L=2048, N=160) at dsa_gen.c:426\r\n\r\nIt’s unclear how the initial test_dsa_privkey.pem was created, because it has a key of 2048 bits length generated using a prime number of 160 bits. This is not the default behaviour of openssl, which will use a 256 bit prime for keys of 2048 bits or more. See: https://www.openssl.org/docs/manmaster/crypto/DSA_generate_parameters_ex.html\r\n\r\n#### Solution:\r\nWe regenerate the key as such:\r\nopenssl dsaparam 2048 -out params.pem\r\nopenssl gendsa -out test_dsa_privkey.pem params.pem\r\nopenssl dsa -in test_dsa_privkey.pem -pubout -out test_dsa_pubkey.pem\r\n\r\n### test/fixtures/test_rsa_privkey_encrypted.pem\r\n\r\n#### Problem:\r\nPath: parallel/test-crypto-rsa-dsa\r\ncrypto.js:324\r\n    return method(toBuf(key), buffer, padding, passphrase);\r\n           ^\r\nError: error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips\r\n    at Error (native)\r\n    at Object.privateDecrypt (crypto.js:324:12)\r\n    atnode/test/parallel/test-crypto-rsa-dsa.js:39:44\r\n\r\n#### Solution:\r\nConvert the private key to PKCS#8 using a PKCS#12 compatible algorithm (3DES).\r\nopenssl rsa  -in test_rsa_privkey_encrypted.pem -out test_rsa_privkey_unencrypted.pem\r\nopenssl pkcs8 -in ./test_rsa_privkey_unencrypted.pem -topk8 -out ./test_rsa_privkey_encrypted.pem -v1 PBE-SHA1-3DES \r\nN.B. password = ‘password’\r\n\r\n### test/fixtures/test_dsa_privkey_encrypted.pem\r\n\r\n#### Problem:\r\nError: error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips\r\n    at Error (native)\r\n    at Sign.sign (crypto.js:279:26)\r\n    at/node/test/parallel/test-crypto-rsa-dsa.js:247:22\r\n\r\n#### Solution:\r\nopenssl pkcs8 -v1 PBE-SHA1-3DES  -in test_dsa_privkey.pem -topk8 -out test_dsa_privkey_encrypted.pemtest_dsa_privkey_encrypted.pem \r\nN.B. password = ‘password’\r\n\r\n### test/fixtures/pass-key.pem\r\n\r\n#### Problem:\r\nPath: parallel/test-tls-passphrase\r\n_tls_common.js:85\r\n        c.context.setKey(options.key, options.passphrase);\r\n                  ^\r\nError: error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips\r\n    at Error (native)\r\n    at Object.createSecureContext (_tls_common.js:85:19)\r\n    at new Server (_tls_wrap.js:718:25)\r\n    at Object.Server (_tls_wrap.js:709:41)\r\n    at Object.<anonymous> (node/test/parallel/test-tls-passphrase.js:17:18)\r\n    at Module._compile (module.js:434:26)\r\n    at Object.Module._extensions..js (module.js:452:10)\r\n    at Module.load (module.js:355:32)\r\n    at Function.Module._load (module.js:310:12)\r\n    at Function.Module.runMain (module.js:475:10)\r\nCommand: out/Debug/node\r\nnode.js/fips/node/test/parallel/test-tls-passphrase.js\r\n\r\n#### Solution:\r\nResolve by converting to PCKS8.\r\nopenssl rsa -in pass-key.pem -out pass-key-unencrypted.pem\r\nopenssl pkcs8 -in pass-key-unencrypted.pem -topk8 -out pass-key.pem -v1 PBE-SHA1-3DES\r\nN.B. password = ‘passphrase’\r\n\r\n### test/fixtures/keys/ca2*\r\n\r\n#### Problem:\r\nopenssl crl -text -in ca2-crl.pem\r\nCertificate Revocation List (CRL):\r\n        Version 1 (0x0)\r\n    Signature Algorithm: **md5**WithRSAEncryption\r\n        Issuer: /C=US/ST=CA/L=SF/O=Joyent/OU=Node.js/CN=ca2/emailAddress=ry@tinyclouds.org\r\n        Last Update: Aug  1 11:19:01 2013 GMT\r\n        Next Update: Apr 26 11:19:01 2016 GMT\r\nRevoked Certificates:\r\n    Serial Number: EEBE2CE5211A12F7\r\n        Revocation Date: Aug  1 11:19:01 2013 GMT\r\n    Signature Algorithm: **md5**WithRSAEncryption\r\n\r\n#### Solution:\r\nUse sha1 message digest instead of md5."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/156167038","html_url":"https://github.com/nodejs/node/pull/3759#issuecomment-156167038","issue_url":"https://api.github.com/repos/nodejs/node/issues/3759","id":156167038,"user":{"login":"jasnell","id":439929,"avatar_url":"https://avatars.githubusercontent.com/u/439929?v=3","gravatar_id":"","url":"https://api.github.com/users/jasnell","html_url":"https://github.com/jasnell","followers_url":"https://api.github.com/users/jasnell/followers","following_url":"https://api.github.com/users/jasnell/following{/other_user}","gists_url":"https://api.github.com/users/jasnell/gists{/gist_id}","starred_url":"https://api.github.com/users/jasnell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasnell/subscriptions","organizations_url":"https://api.github.com/users/jasnell/orgs","repos_url":"https://api.github.com/users/jasnell/repos","events_url":"https://api.github.com/users/jasnell/events{/privacy}","received_events_url":"https://api.github.com/users/jasnell/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T17:03:07Z","updated_at":"2015-11-12T17:03:07Z","body":"Love the detailed PR description, btw. Very nice."}}