diff --git a/backend/package-lock.json b/backend/package-lock.json index 460721966..408ff59f0 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -140,7 +140,7 @@ "@babel/preset-react": "^7.24.7", "@smithy/types": "^4.3.1", "@types/bcrypt": "^5.0.2", - "@types/crypto-js": "^4.2.2", + "@types/crypto-js": "4.2.2", "@types/jmespath": "^0.15.2", "@types/jsonwebtoken": "^9.0.5", "@types/jsrp": "^0.2.6", diff --git a/backend/package.json b/backend/package.json index 2ba9aca52..b1aedbedd 100644 --- a/backend/package.json +++ b/backend/package.json @@ -86,7 +86,7 @@ "@babel/preset-react": "^7.24.7", "@smithy/types": "^4.3.1", "@types/bcrypt": "^5.0.2", - "@types/crypto-js": "^4.2.2", + "@types/crypto-js": "4.2.2", "@types/jmespath": "^0.15.2", "@types/jsonwebtoken": "^9.0.5", "@types/jsrp": "^0.2.6", diff --git a/backend/src/db/migrations/20250602155451_fix-secret-versions.ts b/backend/src/db/migrations/20250602155451_fix-secret-versions.ts index 94be8dad4..f525e85f3 100644 --- a/backend/src/db/migrations/20250602155451_fix-secret-versions.ts +++ b/backend/src/db/migrations/20250602155451_fix-secret-versions.ts @@ -3,12 +3,11 @@ import { Knex } from "knex"; import { chunkArray } from "@app/lib/fn"; import { selectAllTableCols } from "@app/lib/knex"; -import { initLogger, logger } from "@app/lib/logger"; +import { logger } from "@app/lib/logger"; import { SecretType, TableName } from "../schemas"; export async function up(knex: Knex): Promise { - initLogger(); logger.info("Starting secret version fix migration"); // Get all shared secret IDs first to optimize versions query @@ -134,7 +133,6 @@ export async function up(knex: Knex): Promise { } export async function down(): Promise { - initLogger(); logger.info("Rollback not implemented for secret version fix migration"); // Note: Rolling back this migration would be complex and potentially destructive // as it would require tracking which version entries were added diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts index 377e58d33..7bb11b9ae 100644 --- a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts +++ b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts @@ -63,7 +63,7 @@ export const AwsIamProvider = (): TDynamicProviderFns => { const command = new AssumeRoleCommand({ RoleArn: providerInputs.roleArn, - RoleSessionName: `infisical-dynamic-secret-${crypto.rawCrypto.randomUUID()}`, + RoleSessionName: `infisical-dynamic-secret-${crypto.nativeCrypto.randomUUID()}`, DurationSeconds: 900, // 15 mins ExternalId: projectId }); diff --git a/backend/src/ee/services/external-kms/providers/aws-kms.ts b/backend/src/ee/services/external-kms/providers/aws-kms.ts index f9812229f..2c248992f 100644 --- a/backend/src/ee/services/external-kms/providers/aws-kms.ts +++ b/backend/src/ee/services/external-kms/providers/aws-kms.ts @@ -16,7 +16,7 @@ const getAwsKmsClient = async (providerInputs: TExternalKmsAwsSchema) => { }); const command = new AssumeRoleCommand({ RoleArn: awsCredential.assumeRoleArn, - RoleSessionName: `infisical-kms-${crypto.rawCrypto.randomUUID()}`, + RoleSessionName: `infisical-kms-${crypto.nativeCrypto.randomUUID()}`, DurationSeconds: 900, // 15mins ExternalId: awsCredential.externalId }); diff --git a/backend/src/ee/services/gateway/gateway-service.ts b/backend/src/ee/services/gateway/gateway-service.ts index 118bff9bd..762be864d 100644 --- a/backend/src/ee/services/gateway/gateway-service.ts +++ b/backend/src/ee/services/gateway/gateway-service.ts @@ -148,9 +148,9 @@ export const gatewayServiceFactory = ({ const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); // generate root CA - const rootCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const rootCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const rootCaSerialNumber = createSerialNumber(); - const rootCaSkObj = crypto.rawCrypto.KeyObject.from(rootCaKeys.privateKey); + const rootCaSkObj = crypto.nativeCrypto.KeyObject.from(rootCaKeys.privateKey); const rootCaIssuedAt = new Date(); const rootCaKeyAlgorithm = CertKeyAlgorithm.RSA_2048; const rootCaExpiration = new Date(new Date().setFullYear(2045)); @@ -172,8 +172,8 @@ export const gatewayServiceFactory = ({ const clientCaSerialNumber = createSerialNumber(); const clientCaIssuedAt = new Date(); const clientCaExpiration = new Date(new Date().setFullYear(2045)); - const clientCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const clientCaSkObj = crypto.rawCrypto.KeyObject.from(clientCaKeys.privateKey); + const clientCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const clientCaSkObj = crypto.nativeCrypto.KeyObject.from(clientCaKeys.privateKey); const clientCaCert = await x509.X509CertificateGenerator.create({ serialNumber: clientCaSerialNumber, @@ -199,7 +199,7 @@ export const gatewayServiceFactory = ({ ] }); - const clientKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const clientKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const clientCertSerialNumber = createSerialNumber(); const clientCert = await x509.X509CertificateGenerator.create({ serialNumber: clientCertSerialNumber, @@ -225,14 +225,14 @@ export const gatewayServiceFactory = ({ new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.CLIENT_AUTH]], true) ] }); - const clientSkObj = crypto.rawCrypto.KeyObject.from(clientKeys.privateKey); + const clientSkObj = crypto.nativeCrypto.KeyObject.from(clientKeys.privateKey); // generate gateway ca const gatewayCaSerialNumber = createSerialNumber(); const gatewayCaIssuedAt = new Date(); const gatewayCaExpiration = new Date(new Date().setFullYear(2045)); - const gatewayCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const gatewayCaSkObj = crypto.rawCrypto.KeyObject.from(gatewayCaKeys.privateKey); + const gatewayCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const gatewayCaSkObj = crypto.nativeCrypto.KeyObject.from(gatewayCaKeys.privateKey); const gatewayCaCert = await x509.X509CertificateGenerator.create({ serialNumber: gatewayCaSerialNumber, subject: `O=${identityOrg},CN=Gateway CA`, @@ -325,7 +325,7 @@ export const gatewayServiceFactory = ({ ); const gatewayCaAlg = keyAlgorithmToAlgCfg(orgGatewayConfig.rootCaKeyAlgorithm as CertKeyAlgorithm); - const gatewayCaSkObj = crypto.rawCrypto.createPrivateKey({ + const gatewayCaSkObj = crypto.nativeCrypto.createPrivateKey({ key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedGatewayCaPrivateKey }), format: "der", type: "pkcs8" @@ -336,7 +336,7 @@ export const gatewayServiceFactory = ({ }) ); - const gatewayCaPrivateKey = await crypto.rawCrypto.subtle.importKey( + const gatewayCaPrivateKey = await crypto.nativeCrypto.subtle.importKey( "pkcs8", gatewayCaSkObj.export({ format: "der", type: "pkcs8" }), gatewayCaAlg, @@ -345,7 +345,7 @@ export const gatewayServiceFactory = ({ ); const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); - const gatewayKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const gatewayKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const certIssuedAt = new Date(); // then need to periodically init const certExpireAt = new Date(new Date().setMonth(new Date().getMonth() + 1)); @@ -366,7 +366,7 @@ export const gatewayServiceFactory = ({ ]; const serialNumber = createSerialNumber(); - const privateKey = crypto.rawCrypto.KeyObject.from(gatewayKeys.privateKey); + const privateKey = crypto.nativeCrypto.KeyObject.from(gatewayKeys.privateKey); const gatewayCertificate = await x509.X509CertificateGenerator.create({ serialNumber, subject: `CN=${identityId},O=${identityOrg},OU=Gateway`, @@ -453,7 +453,7 @@ export const gatewayServiceFactory = ({ }) ); - const privateKey = crypto.rawCrypto + const privateKey = crypto.nativeCrypto .createPrivateKey({ key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }), format: "der", @@ -587,7 +587,7 @@ export const gatewayServiceFactory = ({ }) ); - const clientSkObj = crypto.rawCrypto.createPrivateKey({ + const clientSkObj = crypto.nativeCrypto.createPrivateKey({ key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }), format: "der", type: "pkcs8" diff --git a/backend/src/ee/services/kmip/kmip-service.ts b/backend/src/ee/services/kmip/kmip-service.ts index c09843120..992b31017 100644 --- a/backend/src/ee/services/kmip/kmip-service.ts +++ b/backend/src/ee/services/kmip/kmip-service.ts @@ -298,7 +298,7 @@ export const kmipServiceFactory = ({ } const alg = keyAlgorithmToAlgCfg(keyAlgorithm); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const extensions: x509.Extension[] = [ new x509.BasicConstraintsExtension(false), @@ -317,13 +317,13 @@ export const kmipServiceFactory = ({ const caAlg = keyAlgorithmToAlgCfg(kmipConfig.caKeyAlgorithm as CertKeyAlgorithm); - const caSkObj = crypto.rawCrypto.createPrivateKey({ + const caSkObj = crypto.nativeCrypto.createPrivateKey({ key: decryptor({ cipherTextBlob: kmipConfig.encryptedClientIntermediateCaPrivateKey }), format: "der", type: "pkcs8" }); - const caPrivateKey = await crypto.rawCrypto.subtle.importKey( + const caPrivateKey = await crypto.nativeCrypto.subtle.importKey( "pkcs8", caSkObj.export({ format: "der", type: "pkcs8" }), caAlg, @@ -344,7 +344,7 @@ export const kmipServiceFactory = ({ extensions }); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const rootCaCert = new x509.X509Certificate(decryptor({ cipherTextBlob: kmipConfig.encryptedRootCaCertificate })); const serverIntermediateCaCert = new x509.X509Certificate( @@ -423,8 +423,8 @@ export const kmipServiceFactory = ({ // generate root CA const rootCaSerialNumber = createSerialNumber(); - const rootCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const rootCaSkObj = crypto.rawCrypto.KeyObject.from(rootCaKeys.privateKey); + const rootCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const rootCaSkObj = crypto.nativeCrypto.KeyObject.from(rootCaKeys.privateKey); const rootCaIssuedAt = new Date(); const rootCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 20)); @@ -446,8 +446,8 @@ export const kmipServiceFactory = ({ const serverIntermediateCaSerialNumber = createSerialNumber(); const serverIntermediateCaIssuedAt = new Date(); const serverIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10)); - const serverIntermediateCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const serverIntermediateCaSkObj = crypto.rawCrypto.KeyObject.from(serverIntermediateCaKeys.privateKey); + const serverIntermediateCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const serverIntermediateCaSkObj = crypto.nativeCrypto.KeyObject.from(serverIntermediateCaKeys.privateKey); const serverIntermediateCaCert = await x509.X509CertificateGenerator.create({ serialNumber: serverIntermediateCaSerialNumber, @@ -477,8 +477,8 @@ export const kmipServiceFactory = ({ const clientIntermediateCaSerialNumber = createSerialNumber(); const clientIntermediateCaIssuedAt = new Date(); const clientIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10)); - const clientIntermediateCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const clientIntermediateCaSkObj = crypto.rawCrypto.KeyObject.from(clientIntermediateCaKeys.privateKey); + const clientIntermediateCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const clientIntermediateCaSkObj = crypto.nativeCrypto.KeyObject.from(clientIntermediateCaKeys.privateKey); const clientIntermediateCaCert = await x509.X509CertificateGenerator.create({ serialNumber: clientIntermediateCaSerialNumber, @@ -644,7 +644,7 @@ export const kmipServiceFactory = ({ const alg = keyAlgorithmToAlgCfg(keyAlgorithm); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const extensions: x509.Extension[] = [ new x509.BasicConstraintsExtension(false), @@ -692,13 +692,13 @@ export const kmipServiceFactory = ({ cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaChain }).toString("utf-8"); - const caSkObj = crypto.rawCrypto.createPrivateKey({ + const caSkObj = crypto.nativeCrypto.createPrivateKey({ key: decryptor({ cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaPrivateKey }), format: "der", type: "pkcs8" }); - const caPrivateKey = await crypto.rawCrypto.subtle.importKey( + const caPrivateKey = await crypto.nativeCrypto.subtle.importKey( "pkcs8", caSkObj.export({ format: "der", type: "pkcs8" }), caAlg, @@ -719,7 +719,7 @@ export const kmipServiceFactory = ({ extensions }); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const certificateChain = `${caCertObj.toString("pem")}\n${decryptedCaCertChain}`.trim(); await kmipOrgServerCertificateDAL.create({ diff --git a/backend/src/ee/services/scim/scim-service.ts b/backend/src/ee/services/scim/scim-service.ts index fc05cd2ce..ecb900e53 100644 --- a/backend/src/ee/services/scim/scim-service.ts +++ b/backend/src/ee/services/scim/scim-service.ts @@ -8,8 +8,8 @@ import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal"; import { TScimDALFactory } from "@app/ee/services/scim/scim-dal"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors"; import { crypto } from "@app/lib/crypto"; +import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { AuthTokenType } from "@app/services/auth/auth-type"; import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal"; diff --git a/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts b/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts index 24b017d98..258fb8ac0 100644 --- a/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts +++ b/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts @@ -66,7 +66,7 @@ export const bitbucketSecretScanningService = ( const credentials = JSON.parse(decryptedCredentials.toString()) as TBitbucketDataSourceCredentials; - const hmac = crypto.rawCrypto.createHmac("sha256", credentials.webhookSecret); + const hmac = crypto.nativeCrypto.createHmac("sha256", credentials.webhookSecret); hmac.update(bodyString); const calculatedSignature = hmac.digest("hex"); diff --git a/backend/src/lib/aws/hashing.ts b/backend/src/lib/aws/hashing.ts index 5ad9d681d..f30f05169 100644 --- a/backend/src/lib/aws/hashing.ts +++ b/backend/src/lib/aws/hashing.ts @@ -27,9 +27,9 @@ export class CustomAWSHasher { } else if (ArrayBuffer.isView && ArrayBuffer.isView(this.secret)) { secretBuffer = Buffer.from(this.secret.buffer, this.secret.byteOffset, this.secret.byteLength); } - this._hash = crypto.rawCrypto.createHmac(this.algorithmIdentifier, secretBuffer); + this._hash = crypto.nativeCrypto.createHmac(this.algorithmIdentifier, secretBuffer); } else { - this._hash = crypto.rawCrypto.createHash(this.algorithmIdentifier); + this._hash = crypto.nativeCrypto.createHash(this.algorithmIdentifier); } return this; } diff --git a/backend/src/lib/crypto/cache.ts b/backend/src/lib/crypto/cache.ts index 7e341a59e..9c6f76aac 100644 --- a/backend/src/lib/crypto/cache.ts +++ b/backend/src/lib/crypto/cache.ts @@ -1,7 +1,7 @@ import { crypto } from "@app/lib/crypto/cryptography"; export const generateCacheKeyFromData = (data: unknown) => - crypto.rawCrypto + crypto.nativeCrypto .createHash("sha256") .update(JSON.stringify(data)) .digest("base64") diff --git a/backend/src/lib/crypto/cipher/cipher.ts b/backend/src/lib/crypto/cipher/cipher.ts index ca5890f87..bdd6a0674 100644 --- a/backend/src/lib/crypto/cipher/cipher.ts +++ b/backend/src/lib/crypto/cipher/cipher.ts @@ -11,7 +11,7 @@ export const symmetricCipherService = ( ): TSymmetricEncryptionFns => { const encrypt = (text: Buffer, key: Buffer) => { const iv = crypto.randomBytes(IV_LENGTH); - const cipher = crypto.rawCrypto.createCipheriv(type, key, iv); + const cipher = crypto.nativeCrypto.createCipheriv(type, key, iv); let encrypted = cipher.update(text); encrypted = Buffer.concat([encrypted, cipher.final()]); @@ -30,7 +30,7 @@ export const symmetricCipherService = ( const tag = ciphertextBlob.subarray(-TAG_LENGTH); const encrypted = ciphertextBlob.subarray(IV_LENGTH, -TAG_LENGTH); - const decipher = crypto.rawCrypto.createDecipheriv(type, key, iv); + const decipher = crypto.nativeCrypto.createDecipheriv(type, key, iv); decipher.setAuthTag(tag); const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]); diff --git a/backend/src/lib/crypto/cryptography/crypto.ts b/backend/src/lib/crypto/cryptography/crypto.ts index 30f00fa4b..c9f5a7bc7 100644 --- a/backend/src/lib/crypto/cryptography/crypto.ts +++ b/backend/src/lib/crypto/cryptography/crypto.ts @@ -160,7 +160,7 @@ const cryptographyFactory = () => { } if (process.env.FIPS_ENABLED !== "true") { - logger.info("[FIPS]: Instance is running in non-FIPS mode."); + logger.info("Cryptography module initialized in normal operation mode."); $setFipsModeEnabled(false); return false; } @@ -412,7 +412,7 @@ const cryptographyFactory = () => { jwt, randomBytes: crypto.randomBytes, randomInt: crypto.randomInt, - rawCrypto: { + nativeCrypto: { createHash: crypto.createHash, createHmac: crypto.createHmac, sign: crypto.sign, diff --git a/backend/src/lib/crypto/sign/signing.ts b/backend/src/lib/crypto/sign/signing.ts index 1864d4be5..474f200f8 100644 --- a/backend/src/lib/crypto/sign/signing.ts +++ b/backend/src/lib/crypto/sign/signing.ts @@ -43,19 +43,19 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi case SigningAlgorithm.RSASSA_PSS_SHA_512: return { hashAlgorithm: SupportedHashAlgorithm.SHA512, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: SHA512_DIGEST_LENGTH }; case SigningAlgorithm.RSASSA_PSS_SHA_256: return { hashAlgorithm: SupportedHashAlgorithm.SHA256, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: SHA256_DIGEST_LENGTH }; case SigningAlgorithm.RSASSA_PSS_SHA_384: return { hashAlgorithm: SupportedHashAlgorithm.SHA384, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: SHA384_DIGEST_LENGTH }; @@ -63,17 +63,17 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512: return { hashAlgorithm: SupportedHashAlgorithm.SHA512, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING }; case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384: return { hashAlgorithm: SupportedHashAlgorithm.SHA384, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING }; case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256: return { hashAlgorithm: SupportedHashAlgorithm.SHA256, - padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING + padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING }; // ECDSA @@ -389,7 +389,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi return signature; } - const privateKeyObject = crypto.rawCrypto.createPrivateKey({ + const privateKeyObject = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "pem", type: "pkcs8" @@ -397,7 +397,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi // For RSA signatures if (signingAlgorithm.startsWith("RSA")) { - const signer = crypto.rawCrypto.createSign(hashAlgorithm); + const signer = crypto.nativeCrypto.createSign(hashAlgorithm); signer.update(data); return signer.sign({ @@ -408,7 +408,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi } if (signingAlgorithm.startsWith("ECDSA")) { // For ECDSA signatures - const signer = crypto.rawCrypto.createSign(hashAlgorithm); + const signer = crypto.nativeCrypto.createSign(hashAlgorithm); signer.update(data); return signer.sign({ key: privateKeyObject, @@ -452,7 +452,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi return signatureValid; } - const publicKeyObject = crypto.rawCrypto.createPublicKey({ + const publicKeyObject = crypto.nativeCrypto.createPublicKey({ key: publicKey, format: "der", type: "spki" @@ -460,7 +460,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi // For RSA signatures if (signingAlgorithm.startsWith("RSA")) { - const verifier = crypto.rawCrypto.createVerify(hashAlgorithm); + const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm); verifier.update(data); return verifier.verify( @@ -474,7 +474,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi } // For ECDSA signatures if (signingAlgorithm.startsWith("ECDSA")) { - const verifier = crypto.rawCrypto.createVerify(hashAlgorithm); + const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm); verifier.update(data); return verifier.verify( { @@ -499,7 +499,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi const generateAsymmetricPrivateKey = async () => { const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => { if (algorithm.startsWith("RSA")) { - crypto.rawCrypto.generateKeyPair( + crypto.nativeCrypto.generateKeyPair( "rsa", { modulusLength: Number(algorithm.split("_")[1]), @@ -517,7 +517,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi } else { const { full: namedCurve } = $getEcCurveName(algorithm); - crypto.rawCrypto.generateKeyPair( + crypto.nativeCrypto.generateKeyPair( "ec", { namedCurve, @@ -541,13 +541,13 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi }; const getPublicKeyFromPrivateKey = (privateKey: Buffer) => { - const privateKeyObj = crypto.rawCrypto.createPrivateKey({ + const privateKeyObj = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "pem", type: "pkcs8" }); - const publicKey = crypto.rawCrypto.createPublicKey(privateKeyObj).export({ + const publicKey = crypto.nativeCrypto.createPublicKey(privateKeyObj).export({ type: "spki", format: "der" }); diff --git a/backend/src/lib/crypto/signing.ts b/backend/src/lib/crypto/signing.ts index a97fe8020..ea32ac9dc 100644 --- a/backend/src/lib/crypto/signing.ts +++ b/backend/src/lib/crypto/signing.ts @@ -5,7 +5,7 @@ import path from "path"; import { crypto } from "./cryptography"; export const verifySignature = (data: string, signature: Buffer, publicKey: KeyObject) => { - const verify = crypto.rawCrypto.createVerify("SHA256"); + const verify = crypto.nativeCrypto.createVerify("SHA256"); verify.update(data); verify.end(); return verify.verify(publicKey, signature); @@ -14,7 +14,7 @@ export const verifySignature = (data: string, signature: Buffer, publicKey: KeyO export const verifyOfflineLicense = async (licenseContents: string, signature: string) => { const publicKeyPem = await fs.readFile(path.join(__dirname, "license_public_key.pem"), "utf8"); - const publicKey = crypto.rawCrypto.createPublicKey({ + const publicKey = crypto.nativeCrypto.createPublicKey({ key: publicKeyPem, format: "pem", type: "pkcs1" diff --git a/backend/src/lib/gateway/gateway.ts b/backend/src/lib/gateway/gateway.ts index 711fee4a0..6bc6e204e 100644 --- a/backend/src/lib/gateway/gateway.ts +++ b/backend/src/lib/gateway/gateway.ts @@ -49,8 +49,8 @@ const createQuicConnection = async ( verifyPeer: true, verifyCallback: async (certs) => { if (!certs || certs.length === 0) return quic.native.CryptoError.CertificateRequired; - const serverCertificate = new crypto.rawCrypto.X509Certificate(Buffer.from(certs[0])); - const caCertificate = new crypto.rawCrypto.X509Certificate(tlsOptions.ca); + const serverCertificate = new crypto.nativeCrypto.X509Certificate(Buffer.from(certs[0])); + const caCertificate = new crypto.nativeCrypto.X509Certificate(tlsOptions.ca); const isValidServerCertificate = serverCertificate.verify(caCertificate.publicKey); if (!isValidServerCertificate) return quic.native.CryptoError.BadCertificate; @@ -73,7 +73,7 @@ const createQuicConnection = async ( crypto: { ops: { randomBytes: async (data) => { - crypto.rawCrypto.getRandomValues(new Uint8Array(data)); + crypto.nativeCrypto.getRandomValues(new Uint8Array(data)); } } } diff --git a/backend/src/lib/red-lock/index.ts b/backend/src/lib/red-lock/index.ts index 64a48fd0c..7db17aa87 100644 --- a/backend/src/lib/red-lock/index.ts +++ b/backend/src/lib/red-lock/index.ts @@ -251,7 +251,7 @@ export class Redlock extends EventEmitter { * Generate a sha1 hash compatible with redis evalsha. */ private _hash(value: string): string { - return crypto.rawCrypto.createHash("sha1").update(value).digest("hex"); + return crypto.nativeCrypto.createHash("sha1").update(value).digest("hex"); } /** diff --git a/backend/src/lib/turn/credentials.ts b/backend/src/lib/turn/credentials.ts index a41624b06..34c30ac8f 100644 --- a/backend/src/lib/turn/credentials.ts +++ b/backend/src/lib/turn/credentials.ts @@ -5,7 +5,7 @@ export const getTurnCredentials = (id: string, authSecret: string, ttl = TURN_TO const timestamp = Math.floor((Date.now() + ttl) / 1000); const username = `${timestamp}:${id}`; - const hmac = crypto.rawCrypto.createHmac("sha1", authSecret); + const hmac = crypto.nativeCrypto.createHmac("sha1", authSecret); hmac.update(username); const password = hmac.digest("base64"); diff --git a/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts b/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts index cecd7f2db..0bb9e08ea 100644 --- a/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts +++ b/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts @@ -27,7 +27,7 @@ const validateCaCertificate = (caCert: string) => { if (!caCert) return true; try { // eslint-disable-next-line no-new - new crypto.rawCrypto.X509Certificate(caCert); + new crypto.nativeCrypto.X509Certificate(caCert); return true; } catch { return false; diff --git a/backend/src/services/app-connection/app-connection-fns.ts b/backend/src/services/app-connection/app-connection-fns.ts index 842931c79..9dadcc4e5 100644 --- a/backend/src/services/app-connection/app-connection-fns.ts +++ b/backend/src/services/app-connection/app-connection-fns.ts @@ -305,7 +305,7 @@ export const decryptAppConnection = async ( orgId: appConnection.orgId, kmsService }), - credentialsHash: crypto.rawCrypto.createHash("sha256").update(appConnection.encryptedCredentials).digest("hex") + credentialsHash: crypto.nativeCrypto.createHash("sha256").update(appConnection.encryptedCredentials).digest("hex") } as TAppConnection; }; diff --git a/backend/src/services/app-connection/app-connection-service.ts b/backend/src/services/app-connection/app-connection-service.ts index bc95c30e6..fdb861b95 100644 --- a/backend/src/services/app-connection/app-connection-service.ts +++ b/backend/src/services/app-connection/app-connection-service.ts @@ -281,7 +281,7 @@ export const appConnectionServiceFactory = ({ return { ...connection, - credentialsHash: crypto.rawCrypto.createHash("sha256").update(connection.encryptedCredentials).digest("hex"), + credentialsHash: crypto.nativeCrypto.createHash("sha256").update(connection.encryptedCredentials).digest("hex"), credentials: validatedCredentials } as TAppConnection; } catch (err) { diff --git a/backend/src/services/app-connection/aws/aws-connection-fns.ts b/backend/src/services/app-connection/aws/aws-connection-fns.ts index c647dc2c2..82a53a1f5 100644 --- a/backend/src/services/app-connection/aws/aws-connection-fns.ts +++ b/backend/src/services/app-connection/aws/aws-connection-fns.ts @@ -49,7 +49,7 @@ export const getAwsConnectionConfig = async (appConnection: TAwsConnectionConfig const command = new AssumeRoleCommand({ RoleArn: credentials.roleArn, - RoleSessionName: `infisical-app-connection-${crypto.rawCrypto.randomUUID()}`, + RoleSessionName: `infisical-app-connection-${crypto.nativeCrypto.randomUUID()}`, DurationSeconds: 900, // 15 mins ExternalId: orgId }); diff --git a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts index d7893779c..f6e77ac8e 100644 --- a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts +++ b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts @@ -414,8 +414,8 @@ export const AcmeCertificateAuthorityFns = ({ const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const [, certificateCsr] = await acme.crypto.createCsr( diff --git a/backend/src/services/certificate-authority/certificate-authority-fns.ts b/backend/src/services/certificate-authority/certificate-authority-fns.ts index 456d81d93..9991e462e 100644 --- a/backend/src/services/certificate-authority/certificate-authority-fns.ts +++ b/backend/src/services/certificate-authority/certificate-authority-fns.ts @@ -133,8 +133,8 @@ export const getCaCredentials = async ({ }); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); - const skObj = crypto.rawCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" }); - const caPrivateKey = await crypto.rawCrypto.subtle.importKey( + const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" }); + const caPrivateKey = await crypto.nativeCrypto.subtle.importKey( "pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, @@ -142,8 +142,8 @@ export const getCaCredentials = async ({ ["sign"] ); - const pkObj = crypto.rawCrypto.createPublicKey(skObj); - const caPublicKey = await crypto.rawCrypto.subtle.importKey( + const pkObj = crypto.nativeCrypto.createPublicKey(skObj); + const caPublicKey = await crypto.nativeCrypto.subtle.importKey( "spki", pkObj.export({ format: "der", type: "spki" }), alg, @@ -281,8 +281,8 @@ export const rebuildCaCrl = async ({ cipherTextBlob: caSecret.encryptedPrivateKey }); - const skObj = crypto.rawCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); - const sk = await crypto.rawCrypto.subtle.importKey( + const skObj = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); + const sk = await crypto.nativeCrypto.subtle.importKey( "pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, diff --git a/backend/src/services/certificate-authority/certificate-authority-queue.ts b/backend/src/services/certificate-authority/certificate-authority-queue.ts index 32471a0e3..afe17ec5f 100644 --- a/backend/src/services/certificate-authority/certificate-authority-queue.ts +++ b/backend/src/services/certificate-authority/certificate-authority-queue.ts @@ -198,8 +198,8 @@ export const certificateAuthorityQueueFactory = ({ cipherTextBlob: caSecret.encryptedPrivateKey }); - const skObj = crypto.rawCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); - const sk = await crypto.rawCrypto.subtle.importKey( + const skObj = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); + const sk = await crypto.nativeCrypto.subtle.importKey( "pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts index 13084c5a8..80d2842fa 100644 --- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts +++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts @@ -99,7 +99,7 @@ export const InternalCertificateAuthorityFns = ({ } const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ name: `CN=${subscriber.commonName}`, @@ -184,7 +184,7 @@ export const InternalCertificateAuthorityFns = ({ extensions }); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const kmsEncryptor = await kmsService.encryptWithKmsKey({ @@ -331,7 +331,7 @@ export const InternalCertificateAuthorityFns = ({ }); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ name: `CN=${commonName}`, @@ -450,7 +450,7 @@ export const InternalCertificateAuthorityFns = ({ extensions }); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const kmsEncryptor = await kmsService.encryptWithKmsKey({ diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts index f6370db61..6668c806c 100644 --- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts @@ -171,7 +171,7 @@ export const internalCertificateAuthorityServiceFactory = ({ }); const alg = keyAlgorithmToAlgCfg(keyAlgorithm); - const keys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const keys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const newCa = await certificateAuthorityDAL.transaction(async (tx) => { const notBeforeDate = notBefore ? new Date(notBefore) : new Date(); @@ -226,7 +226,7 @@ export const internalCertificateAuthorityServiceFactory = ({ }); // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey - const skObj = crypto.rawCrypto.KeyObject.from(keys.privateKey); + const skObj = crypto.nativeCrypto.KeyObject.from(keys.privateKey); const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({ plainText: skObj.export({ @@ -1102,9 +1102,9 @@ export const internalCertificateAuthorityServiceFactory = ({ kmsService }); - const isCaAndCertPublicKeySame = Buffer.from(await crypto.rawCrypto.subtle.exportKey("spki", caPublicKey)).equals( - Buffer.from(certObj.publicKey.rawData) - ); + const isCaAndCertPublicKeySame = Buffer.from( + await crypto.nativeCrypto.subtle.exportKey("spki", caPublicKey) + ).equals(Buffer.from(certObj.publicKey.rawData)); if (!isCaAndCertPublicKeySame) { throw new BadRequestError({ message: "CA and certificate public key do not match" }); @@ -1265,7 +1265,7 @@ export const internalCertificateAuthorityServiceFactory = ({ } const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); - const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); + const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ name: `CN=${commonName}`, @@ -1412,7 +1412,7 @@ export const internalCertificateAuthorityServiceFactory = ({ extensions }); - const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); + const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey); const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const kmsEncryptor = await kmsService.encryptWithKmsKey({ diff --git a/backend/src/services/certificate/certificate-fns.ts b/backend/src/services/certificate/certificate-fns.ts index 652974584..eee220ce9 100644 --- a/backend/src/services/certificate/certificate-fns.ts +++ b/backend/src/services/certificate/certificate-fns.ts @@ -86,10 +86,10 @@ export const getCertificateCredentials = async ({ }); try { - const skObj = crypto.rawCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "pem", type: "pkcs8" }); + const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "pem", type: "pkcs8" }); const certPrivateKey = skObj.export({ format: "pem", type: "pkcs8" }).toString(); - const pkObj = crypto.rawCrypto.createPublicKey(skObj); + const pkObj = crypto.nativeCrypto.createPublicKey(skObj); const certPublicKey = pkObj.export({ format: "pem", type: "spki" }).toString(); return { diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 753ee0cda..541bddac7 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -373,16 +373,16 @@ export const certificateServiceFactory = ({ // Verify private key matches the certificate let privateKey; try { - privateKey = crypto.rawCrypto.createPrivateKey(privateKeyPem); + privateKey = crypto.nativeCrypto.createPrivateKey(privateKeyPem); } catch (err) { throw new BadRequestError({ message: "Invalid private key format" }); } try { const message = Buffer.from(Buffer.alloc(32)); - const publicKey = crypto.rawCrypto.createPublicKey(certificatePem); - const signature = crypto.rawCrypto.sign(null, message, privateKey); - const isValid = crypto.rawCrypto.verify(null, message, publicKey, signature); + const publicKey = crypto.nativeCrypto.createPublicKey(certificatePem); + const signature = crypto.nativeCrypto.sign(null, message, privateKey); + const isValid = crypto.nativeCrypto.verify(null, message, publicKey, signature); if (!isValid) { throw new BadRequestError({ message: "Private key does not match certificate" }); diff --git a/backend/src/services/external-migration/external-migration-fns.ts b/backend/src/services/external-migration/external-migration-fns.ts index 08ee02a2b..8af22d858 100644 --- a/backend/src/services/external-migration/external-migration-fns.ts +++ b/backend/src/services/external-migration/external-migration-fns.ts @@ -228,7 +228,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise { // Use SHA-256 hash for consistent distribution - const hash = crypto.rawCrypto.createHash("sha256").update(distinctId).digest("hex"); + const hash = crypto.nativeCrypto.createHash("sha256").update(distinctId).digest("hex"); // Take first 8 characters and convert to number for better distribution const hashNumber = parseInt(hash.substring(0, 8), 16); @@ -53,7 +53,7 @@ const getBucketForDistinctId = (distinctId: string): string => { export const createTelemetryEventKey = (event: string, distinctId: string): string => { const bucketId = getBucketForDistinctId(distinctId); - return `telemetry-event-${event}-${bucketId}-${distinctId}-${crypto.rawCrypto.randomUUID()}`; + return `telemetry-event-${event}-${bucketId}-${distinctId}-${crypto.nativeCrypto.randomUUID()}`; }; export const telemetryServiceFactory = ({ keyStore, licenseService }: TTelemetryServiceFactoryDep) => { diff --git a/backend/src/services/webhook/webhook-fns.ts b/backend/src/services/webhook/webhook-fns.ts index 9aaf9b525..d7e07ae28 100644 --- a/backend/src/services/webhook/webhook-fns.ts +++ b/backend/src/services/webhook/webhook-fns.ts @@ -41,7 +41,10 @@ export const triggerWebhookRequest = async ( const payload = { ...data, timestamp: Date.now() }; const { secretKey, url } = decryptWebhookDetails(webhook, decryptor); if (secretKey) { - const webhookSign = crypto.rawCrypto.createHmac("sha256", secretKey).update(JSON.stringify(payload)).digest("hex"); + const webhookSign = crypto.nativeCrypto + .createHmac("sha256", secretKey) + .update(JSON.stringify(payload)) + .digest("hex"); headers["x-infisical-signature"] = `t=${payload.timestamp};${webhookSign}`; }