awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 03:29:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-15 15:39:21 +04:00
parent 2c89f8b672
commit 37014bf3f9
36 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/aws/hashing.ts
+2 -2
View File
@@ -27,9 +27,9 @@ export class CustomAWSHasher {
} else if (ArrayBuffer.isView && ArrayBuffer.isView(this.secret)) {
secretBuffer = Buffer.from(this.secret.buffer, this.secret.byteOffset, this.secret.byteLength);
}
this._hash = crypto.rawCrypto.createHmac(this.algorithmIdentifier, secretBuffer);
this._hash = crypto.nativeCrypto.createHmac(this.algorithmIdentifier, secretBuffer);
} else {
this._hash = crypto.rawCrypto.createHash(this.algorithmIdentifier);
this._hash = crypto.nativeCrypto.createHash(this.algorithmIdentifier);
}
return this;
}
backend/src/lib/crypto/cache.ts
+1 -1
View File
@@ -1,7 +1,7 @@
import { crypto } from "@app/lib/crypto/cryptography";
export const generateCacheKeyFromData = (data: unknown) =>
crypto.rawCrypto
crypto.nativeCrypto
.createHash("sha256")
.update(JSON.stringify(data))
.digest("base64")
backend/src/lib/crypto/cipher/cipher.ts
+2 -2
View File
@@ -11,7 +11,7 @@ export const symmetricCipherService = (
): TSymmetricEncryptionFns => {
const encrypt = (text: Buffer, key: Buffer) => {
const iv = crypto.randomBytes(IV_LENGTH);
const cipher = crypto.rawCrypto.createCipheriv(type, key, iv);
const cipher = crypto.nativeCrypto.createCipheriv(type, key, iv);
let encrypted = cipher.update(text);
encrypted = Buffer.concat([encrypted, cipher.final()]);
@@ -30,7 +30,7 @@ export const symmetricCipherService = (
const tag = ciphertextBlob.subarray(-TAG_LENGTH);
const encrypted = ciphertextBlob.subarray(IV_LENGTH, -TAG_LENGTH);
const decipher = crypto.rawCrypto.createDecipheriv(type, key, iv);
const decipher = crypto.nativeCrypto.createDecipheriv(type, key, iv);
decipher.setAuthTag(tag);
const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
backend/src/lib/crypto/cryptography/crypto.ts
+2 -2
View File
@@ -160,7 +160,7 @@ const cryptographyFactory = () => {
}
if (process.env.FIPS_ENABLED !== "true") {
logger.info("[FIPS]: Instance is running in non-FIPS mode.");
logger.info("Cryptography module initialized in normal operation mode.");
$setFipsModeEnabled(false);
return false;
}
@@ -412,7 +412,7 @@ const cryptographyFactory = () => {
jwt,
randomBytes: crypto.randomBytes,
randomInt: crypto.randomInt,
rawCrypto: {
nativeCrypto: {
createHash: crypto.createHash,
createHmac: crypto.createHmac,
sign: crypto.sign,
backend/src/lib/crypto/sign/signing.ts
+16 -16
View File
@@ -43,19 +43,19 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PSS_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA512_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA256_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA384_DIGEST_LENGTH
};
@@ -63,17 +63,17 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
// ECDSA
@@ -389,7 +389,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signature;
}
const privateKeyObject = crypto.rawCrypto.createPrivateKey({
const privateKeyObject = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
@@ -397,7 +397,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
@@ -408,7 +408,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
if (signingAlgorithm.startsWith("ECDSA")) {
// For ECDSA signatures
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
key: privateKeyObject,
@@ -452,7 +452,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signatureValid;
}
const publicKeyObject = crypto.rawCrypto.createPublicKey({
const publicKeyObject = crypto.nativeCrypto.createPublicKey({
key: publicKey,
format: "der",
type: "spki"
@@ -460,7 +460,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
@@ -474,7 +474,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
// For ECDSA signatures
if (signingAlgorithm.startsWith("ECDSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
{
@@ -499,7 +499,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
const generateAsymmetricPrivateKey = async () => {
const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => {
if (algorithm.startsWith("RSA")) {
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"rsa",
{
modulusLength: Number(algorithm.split("_")[1]),
@@ -517,7 +517,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} else {
const { full: namedCurve } = $getEcCurveName(algorithm);
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"ec",
{
namedCurve,
@@ -541,13 +541,13 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
};
const getPublicKeyFromPrivateKey = (privateKey: Buffer) => {
const privateKeyObj = crypto.rawCrypto.createPrivateKey({
const privateKeyObj = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
});
const publicKey = crypto.rawCrypto.createPublicKey(privateKeyObj).export({
const publicKey = crypto.nativeCrypto.createPublicKey(privateKeyObj).export({
type: "spki",
format: "der"
});
backend/src/lib/crypto/signing.ts
+2 -2
View File
@@ -5,7 +5,7 @@ import path from "path";
import { crypto } from "./cryptography";
export const verifySignature = (data: string, signature: Buffer, publicKey: KeyObject) => {
const verify = crypto.rawCrypto.createVerify("SHA256");
const verify = crypto.nativeCrypto.createVerify("SHA256");
verify.update(data);
verify.end();
return verify.verify(publicKey, signature);
@@ -14,7 +14,7 @@ export const verifySignature = (data: string, signature: Buffer, publicKey: KeyO
export const verifyOfflineLicense = async (licenseContents: string, signature: string) => {
const publicKeyPem = await fs.readFile(path.join(__dirname, "license_public_key.pem"), "utf8");
const publicKey = crypto.rawCrypto.createPublicKey({
const publicKey = crypto.nativeCrypto.createPublicKey({
key: publicKeyPem,
format: "pem",
type: "pkcs1"
backend/src/lib/gateway/gateway.ts
+3 -3
View File
@@ -49,8 +49,8 @@ const createQuicConnection = async (
verifyPeer: true,
verifyCallback: async (certs) => {
if (!certs || certs.length === 0) return quic.native.CryptoError.CertificateRequired;
const serverCertificate = new crypto.rawCrypto.X509Certificate(Buffer.from(certs[0]));
const caCertificate = new crypto.rawCrypto.X509Certificate(tlsOptions.ca);
const serverCertificate = new crypto.nativeCrypto.X509Certificate(Buffer.from(certs[0]));
const caCertificate = new crypto.nativeCrypto.X509Certificate(tlsOptions.ca);
const isValidServerCertificate = serverCertificate.verify(caCertificate.publicKey);
if (!isValidServerCertificate) return quic.native.CryptoError.BadCertificate;
@@ -73,7 +73,7 @@ const createQuicConnection = async (
crypto: {
ops: {
randomBytes: async (data) => {
crypto.rawCrypto.getRandomValues(new Uint8Array(data));
crypto.nativeCrypto.getRandomValues(new Uint8Array(data));
}
}
}
backend/src/lib/red-lock/index.ts
+1 -1
View File
@@ -251,7 +251,7 @@ export class Redlock extends EventEmitter {
* Generate a sha1 hash compatible with redis evalsha.
*/
private _hash(value: string): string {
return crypto.rawCrypto.createHash("sha1").update(value).digest("hex");
return crypto.nativeCrypto.createHash("sha1").update(value).digest("hex");
}
/**
backend/src/lib/turn/credentials.ts
+1 -1
View File
@@ -5,7 +5,7 @@ export const getTurnCredentials = (id: string, authSecret: string, ttl = TURN_TO
const timestamp = Math.floor((Date.now() + ttl) / 1000);
const username = `${timestamp}:${id}`;
const hmac = crypto.rawCrypto.createHmac("sha1", authSecret);
const hmac = crypto.nativeCrypto.createHmac("sha1", authSecret);
hmac.update(username);
const password = hmac.digest("base64");