awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-19 09:12:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-15 15:39:21 +04:00
parent 2c89f8b672
commit 37014bf3f9
36 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/crypto/cache.ts
+1 -1
View File
@@ -1,7 +1,7 @@
import { crypto } from "@app/lib/crypto/cryptography";
export const generateCacheKeyFromData = (data: unknown) =>
crypto.rawCrypto
crypto.nativeCrypto
.createHash("sha256")
.update(JSON.stringify(data))
.digest("base64")
backend/src/lib/crypto/cipher/cipher.ts
+2 -2
View File
@@ -11,7 +11,7 @@ export const symmetricCipherService = (
): TSymmetricEncryptionFns => {
const encrypt = (text: Buffer, key: Buffer) => {
const iv = crypto.randomBytes(IV_LENGTH);
const cipher = crypto.rawCrypto.createCipheriv(type, key, iv);
const cipher = crypto.nativeCrypto.createCipheriv(type, key, iv);
let encrypted = cipher.update(text);
encrypted = Buffer.concat([encrypted, cipher.final()]);
@@ -30,7 +30,7 @@ export const symmetricCipherService = (
const tag = ciphertextBlob.subarray(-TAG_LENGTH);
const encrypted = ciphertextBlob.subarray(IV_LENGTH, -TAG_LENGTH);
const decipher = crypto.rawCrypto.createDecipheriv(type, key, iv);
const decipher = crypto.nativeCrypto.createDecipheriv(type, key, iv);
decipher.setAuthTag(tag);
const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
backend/src/lib/crypto/cryptography/crypto.ts
+2 -2
View File
@@ -160,7 +160,7 @@ const cryptographyFactory = () => {
}
if (process.env.FIPS_ENABLED !== "true") {
logger.info("[FIPS]: Instance is running in non-FIPS mode.");
logger.info("Cryptography module initialized in normal operation mode.");
$setFipsModeEnabled(false);
return false;
}
@@ -412,7 +412,7 @@ const cryptographyFactory = () => {
jwt,
randomBytes: crypto.randomBytes,
randomInt: crypto.randomInt,
rawCrypto: {
nativeCrypto: {
createHash: crypto.createHash,
createHmac: crypto.createHmac,
sign: crypto.sign,
backend/src/lib/crypto/sign/signing.ts
+16 -16
View File
@@ -43,19 +43,19 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PSS_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA512_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA256_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA384_DIGEST_LENGTH
};
@@ -63,17 +63,17 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
// ECDSA
@@ -389,7 +389,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signature;
}
const privateKeyObject = crypto.rawCrypto.createPrivateKey({
const privateKeyObject = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
@@ -397,7 +397,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
@@ -408,7 +408,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
if (signingAlgorithm.startsWith("ECDSA")) {
// For ECDSA signatures
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
key: privateKeyObject,
@@ -452,7 +452,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signatureValid;
}
const publicKeyObject = crypto.rawCrypto.createPublicKey({
const publicKeyObject = crypto.nativeCrypto.createPublicKey({
key: publicKey,
format: "der",
type: "spki"
@@ -460,7 +460,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
@@ -474,7 +474,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
// For ECDSA signatures
if (signingAlgorithm.startsWith("ECDSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
{
@@ -499,7 +499,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
const generateAsymmetricPrivateKey = async () => {
const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => {
if (algorithm.startsWith("RSA")) {
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"rsa",
{
modulusLength: Number(algorithm.split("_")[1]),
@@ -517,7 +517,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} else {
const { full: namedCurve } = $getEcCurveName(algorithm);
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"ec",
{
namedCurve,
@@ -541,13 +541,13 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
};
const getPublicKeyFromPrivateKey = (privateKey: Buffer) => {
const privateKeyObj = crypto.rawCrypto.createPrivateKey({
const privateKeyObj = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
});
const publicKey = crypto.rawCrypto.createPublicKey(privateKeyObj).export({
const publicKey = crypto.nativeCrypto.createPublicKey(privateKeyObj).export({
type: "spki",
format: "der"
});
backend/src/lib/crypto/signing.ts
+2 -2
View File
@@ -5,7 +5,7 @@ import path from "path";
import { crypto } from "./cryptography";
export const verifySignature = (data: string, signature: Buffer, publicKey: KeyObject) => {
const verify = crypto.rawCrypto.createVerify("SHA256");
const verify = crypto.nativeCrypto.createVerify("SHA256");
verify.update(data);
verify.end();
return verify.verify(publicKey, signature);
@@ -14,7 +14,7 @@ export const verifySignature = (data: string, signature: Buffer, publicKey: KeyO
export const verifyOfflineLicense = async (licenseContents: string, signature: string) => {
const publicKeyPem = await fs.readFile(path.join(__dirname, "license_public_key.pem"), "utf8");
const publicKey = crypto.rawCrypto.createPublicKey({
const publicKey = crypto.nativeCrypto.createPublicKey({
key: publicKeyPem,
format: "pem",
type: "pkcs1"