awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-19 16:01:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-15 15:39:21 +04:00
parent 2c89f8b672
commit 37014bf3f9
36 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/crypto/sign/signing.ts
+16 -16
View File
@@ -43,19 +43,19 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PSS_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA512_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA256_DIGEST_LENGTH
};
case SigningAlgorithm.RSASSA_PSS_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING,
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA384_DIGEST_LENGTH
};
@@ -63,17 +63,17 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256:
return {
hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING
padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
};
// ECDSA
@@ -389,7 +389,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signature;
}
const privateKeyObject = crypto.rawCrypto.createPrivateKey({
const privateKeyObject = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
@@ -397,7 +397,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
@@ -408,7 +408,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
if (signingAlgorithm.startsWith("ECDSA")) {
// For ECDSA signatures
const signer = crypto.rawCrypto.createSign(hashAlgorithm);
const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data);
return signer.sign({
key: privateKeyObject,
@@ -452,7 +452,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signatureValid;
}
const publicKeyObject = crypto.rawCrypto.createPublicKey({
const publicKeyObject = crypto.nativeCrypto.createPublicKey({
key: publicKey,
format: "der",
type: "spki"
@@ -460,7 +460,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures
if (signingAlgorithm.startsWith("RSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
@@ -474,7 +474,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}
// For ECDSA signatures
if (signingAlgorithm.startsWith("ECDSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm);
const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data);
return verifier.verify(
{
@@ -499,7 +499,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
const generateAsymmetricPrivateKey = async () => {
const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => {
if (algorithm.startsWith("RSA")) {
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"rsa",
{
modulusLength: Number(algorithm.split("_")[1]),
@@ -517,7 +517,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} else {
const { full: namedCurve } = $getEcCurveName(algorithm);
crypto.rawCrypto.generateKeyPair(
crypto.nativeCrypto.generateKeyPair(
"ec",
{
namedCurve,
@@ -541,13 +541,13 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
};
const getPublicKeyFromPrivateKey = (privateKey: Buffer) => {
const privateKeyObj = crypto.rawCrypto.createPrivateKey({
const privateKeyObj = crypto.nativeCrypto.createPrivateKey({
key: privateKey,
format: "pem",
type: "pkcs8"
});
const publicKey = crypto.rawCrypto.createPublicKey(privateKeyObj).export({
const publicKey = crypto.nativeCrypto.createPublicKey(privateKeyObj).export({
type: "spki",
format: "der"
});