awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-15 15:39:21 +04:00
parent 2c89f8b672
commit 37014bf3f9
36 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/package-lock.json generated
View File

@@ -140,7 +140,7 @@
"@babel/preset-react": "^7.24.7", "@babel/preset-react": "^7.24.7",
"@smithy/types": "^4.3.1", "@smithy/types": "^4.3.1",
"@types/bcrypt": "^5.0.2", "@types/bcrypt": "^5.0.2",
"@types/crypto-js": "^4.2.2", "@types/crypto-js": "4.2.2",
"@types/jmespath": "^0.15.2", "@types/jmespath": "^0.15.2",
"@types/jsonwebtoken": "^9.0.5", "@types/jsonwebtoken": "^9.0.5",
"@types/jsrp": "^0.2.6", "@types/jsrp": "^0.2.6",

2
backend/package.json
View File

@@ -86,7 +86,7 @@
"@babel/preset-react": "^7.24.7", "@babel/preset-react": "^7.24.7",
"@smithy/types": "^4.3.1", "@smithy/types": "^4.3.1",
"@types/bcrypt": "^5.0.2", "@types/bcrypt": "^5.0.2",
"@types/crypto-js": "^4.2.2", "@types/crypto-js": "4.2.2",
"@types/jmespath": "^0.15.2", "@types/jmespath": "^0.15.2",
"@types/jsonwebtoken": "^9.0.5", "@types/jsonwebtoken": "^9.0.5",
"@types/jsrp": "^0.2.6", "@types/jsrp": "^0.2.6",

4
backend/src/db/migrations/20250602155451_fix-secret-versions.ts
View File

@@ -3,12 +3,11 @@ import { Knex } from "knex";
import { chunkArray } from "@app/lib/fn"; import { chunkArray } from "@app/lib/fn";
import { selectAllTableCols } from "@app/lib/knex"; import { selectAllTableCols } from "@app/lib/knex";
import { initLogger, logger } from "@app/lib/logger"; import { logger } from "@app/lib/logger";
import { SecretType, TableName } from "../schemas"; import { SecretType, TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> { export async function up(knex: Knex): Promise<void> {
initLogger();
logger.info("Starting secret version fix migration"); logger.info("Starting secret version fix migration");
// Get all shared secret IDs first to optimize versions query // Get all shared secret IDs first to optimize versions query
@@ -134,7 +133,6 @@ export async function up(knex: Knex): Promise<void> {
} }
export async function down(): Promise<void> { export async function down(): Promise<void> {
initLogger();
logger.info("Rollback not implemented for secret version fix migration"); logger.info("Rollback not implemented for secret version fix migration");
// Note: Rolling back this migration would be complex and potentially destructive // Note: Rolling back this migration would be complex and potentially destructive
// as it would require tracking which version entries were added // as it would require tracking which version entries were added

2
backend/src/ee/services/dynamic-secret/providers/aws-iam.ts
View File

@@ -63,7 +63,7 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
const command = new AssumeRoleCommand({ const command = new AssumeRoleCommand({
RoleArn: providerInputs.roleArn, RoleArn: providerInputs.roleArn,
RoleSessionName: `infisical-dynamic-secret-${crypto.rawCrypto.randomUUID()}`, RoleSessionName: `infisical-dynamic-secret-${crypto.nativeCrypto.randomUUID()}`,
DurationSeconds: 900, // 15 mins DurationSeconds: 900, // 15 mins
ExternalId: projectId ExternalId: projectId
}); });

2
backend/src/ee/services/external-kms/providers/aws-kms.ts
View File

@@ -16,7 +16,7 @@ const getAwsKmsClient = async (providerInputs: TExternalKmsAwsSchema) => {
}); });
const command = new AssumeRoleCommand({ const command = new AssumeRoleCommand({
RoleArn: awsCredential.assumeRoleArn, RoleArn: awsCredential.assumeRoleArn,
RoleSessionName: `infisical-kms-${crypto.rawCrypto.randomUUID()}`, RoleSessionName: `infisical-kms-${crypto.nativeCrypto.randomUUID()}`,
DurationSeconds: 900, // 15mins DurationSeconds: 900, // 15mins
ExternalId: awsCredential.externalId ExternalId: awsCredential.externalId
}); });

28
backend/src/ee/services/gateway/gateway-service.ts
View File

@@ -148,9 +148,9 @@ export const gatewayServiceFactory = ({
const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
// generate root CA // generate root CA
const rootCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const rootCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const rootCaSerialNumber = createSerialNumber(); const rootCaSerialNumber = createSerialNumber();
const rootCaSkObj = crypto.rawCrypto.KeyObject.from(rootCaKeys.privateKey); const rootCaSkObj = crypto.nativeCrypto.KeyObject.from(rootCaKeys.privateKey);
const rootCaIssuedAt = new Date(); const rootCaIssuedAt = new Date();
const rootCaKeyAlgorithm = CertKeyAlgorithm.RSA_2048; const rootCaKeyAlgorithm = CertKeyAlgorithm.RSA_2048;
const rootCaExpiration = new Date(new Date().setFullYear(2045)); const rootCaExpiration = new Date(new Date().setFullYear(2045));
@@ -172,8 +172,8 @@ export const gatewayServiceFactory = ({
const clientCaSerialNumber = createSerialNumber(); const clientCaSerialNumber = createSerialNumber();
const clientCaIssuedAt = new Date(); const clientCaIssuedAt = new Date();
const clientCaExpiration = new Date(new Date().setFullYear(2045)); const clientCaExpiration = new Date(new Date().setFullYear(2045));
const clientCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const clientCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const clientCaSkObj = crypto.rawCrypto.KeyObject.from(clientCaKeys.privateKey); const clientCaSkObj = crypto.nativeCrypto.KeyObject.from(clientCaKeys.privateKey);
const clientCaCert = await x509.X509CertificateGenerator.create({ const clientCaCert = await x509.X509CertificateGenerator.create({
serialNumber: clientCaSerialNumber, serialNumber: clientCaSerialNumber,
@@ -199,7 +199,7 @@ export const gatewayServiceFactory = ({
] ]
}); });
const clientKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const clientKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const clientCertSerialNumber = createSerialNumber(); const clientCertSerialNumber = createSerialNumber();
const clientCert = await x509.X509CertificateGenerator.create({ const clientCert = await x509.X509CertificateGenerator.create({
serialNumber: clientCertSerialNumber, serialNumber: clientCertSerialNumber,
@@ -225,14 +225,14 @@ export const gatewayServiceFactory = ({
new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.CLIENT_AUTH]], true) new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.CLIENT_AUTH]], true)
] ]
}); });
const clientSkObj = crypto.rawCrypto.KeyObject.from(clientKeys.privateKey); const clientSkObj = crypto.nativeCrypto.KeyObject.from(clientKeys.privateKey);
// generate gateway ca // generate gateway ca
const gatewayCaSerialNumber = createSerialNumber(); const gatewayCaSerialNumber = createSerialNumber();
const gatewayCaIssuedAt = new Date(); const gatewayCaIssuedAt = new Date();
const gatewayCaExpiration = new Date(new Date().setFullYear(2045)); const gatewayCaExpiration = new Date(new Date().setFullYear(2045));
const gatewayCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const gatewayCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const gatewayCaSkObj = crypto.rawCrypto.KeyObject.from(gatewayCaKeys.privateKey); const gatewayCaSkObj = crypto.nativeCrypto.KeyObject.from(gatewayCaKeys.privateKey);
const gatewayCaCert = await x509.X509CertificateGenerator.create({ const gatewayCaCert = await x509.X509CertificateGenerator.create({
serialNumber: gatewayCaSerialNumber, serialNumber: gatewayCaSerialNumber,
subject: `O=${identityOrg},CN=Gateway CA`, subject: `O=${identityOrg},CN=Gateway CA`,
@@ -325,7 +325,7 @@ export const gatewayServiceFactory = ({
); );
const gatewayCaAlg = keyAlgorithmToAlgCfg(orgGatewayConfig.rootCaKeyAlgorithm as CertKeyAlgorithm); const gatewayCaAlg = keyAlgorithmToAlgCfg(orgGatewayConfig.rootCaKeyAlgorithm as CertKeyAlgorithm);
const gatewayCaSkObj = crypto.rawCrypto.createPrivateKey({ const gatewayCaSkObj = crypto.nativeCrypto.createPrivateKey({
key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedGatewayCaPrivateKey }), key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedGatewayCaPrivateKey }),
format: "der", format: "der",
type: "pkcs8" type: "pkcs8"
@@ -336,7 +336,7 @@ export const gatewayServiceFactory = ({
}) })
); );
const gatewayCaPrivateKey = await crypto.rawCrypto.subtle.importKey( const gatewayCaPrivateKey = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
gatewayCaSkObj.export({ format: "der", type: "pkcs8" }), gatewayCaSkObj.export({ format: "der", type: "pkcs8" }),
gatewayCaAlg, gatewayCaAlg,
@@ -345,7 +345,7 @@ export const gatewayServiceFactory = ({
); );
const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
const gatewayKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const gatewayKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const certIssuedAt = new Date(); const certIssuedAt = new Date();
// then need to periodically init // then need to periodically init
const certExpireAt = new Date(new Date().setMonth(new Date().getMonth() + 1)); const certExpireAt = new Date(new Date().setMonth(new Date().getMonth() + 1));
@@ -366,7 +366,7 @@ export const gatewayServiceFactory = ({
]; ];
const serialNumber = createSerialNumber(); const serialNumber = createSerialNumber();
const privateKey = crypto.rawCrypto.KeyObject.from(gatewayKeys.privateKey); const privateKey = crypto.nativeCrypto.KeyObject.from(gatewayKeys.privateKey);
const gatewayCertificate = await x509.X509CertificateGenerator.create({ const gatewayCertificate = await x509.X509CertificateGenerator.create({
serialNumber, serialNumber,
subject: `CN=${identityId},O=${identityOrg},OU=Gateway`, subject: `CN=${identityId},O=${identityOrg},OU=Gateway`,
@@ -453,7 +453,7 @@ export const gatewayServiceFactory = ({
}) })
); );
const privateKey = crypto.rawCrypto const privateKey = crypto.nativeCrypto
.createPrivateKey({ .createPrivateKey({
key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }), key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }),
format: "der", format: "der",
@@ -587,7 +587,7 @@ export const gatewayServiceFactory = ({
}) })
); );
const clientSkObj = crypto.rawCrypto.createPrivateKey({ const clientSkObj = crypto.nativeCrypto.createPrivateKey({
key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }), key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }),
format: "der", format: "der",
type: "pkcs8" type: "pkcs8"

28
backend/src/ee/services/kmip/kmip-service.ts
View File

@@ -298,7 +298,7 @@ export const kmipServiceFactory = ({
} }
const alg = keyAlgorithmToAlgCfg(keyAlgorithm); const alg = keyAlgorithmToAlgCfg(keyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const extensions: x509.Extension[] = [ const extensions: x509.Extension[] = [
new x509.BasicConstraintsExtension(false), new x509.BasicConstraintsExtension(false),
@@ -317,13 +317,13 @@ export const kmipServiceFactory = ({
const caAlg = keyAlgorithmToAlgCfg(kmipConfig.caKeyAlgorithm as CertKeyAlgorithm); const caAlg = keyAlgorithmToAlgCfg(kmipConfig.caKeyAlgorithm as CertKeyAlgorithm);
const caSkObj = crypto.rawCrypto.createPrivateKey({ const caSkObj = crypto.nativeCrypto.createPrivateKey({
key: decryptor({ cipherTextBlob: kmipConfig.encryptedClientIntermediateCaPrivateKey }), key: decryptor({ cipherTextBlob: kmipConfig.encryptedClientIntermediateCaPrivateKey }),
format: "der", format: "der",
type: "pkcs8" type: "pkcs8"
}); });
const caPrivateKey = await crypto.rawCrypto.subtle.importKey( const caPrivateKey = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
caSkObj.export({ format: "der", type: "pkcs8" }), caSkObj.export({ format: "der", type: "pkcs8" }),
caAlg, caAlg,
@@ -344,7 +344,7 @@ export const kmipServiceFactory = ({
extensions extensions
}); });
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const rootCaCert = new x509.X509Certificate(decryptor({ cipherTextBlob: kmipConfig.encryptedRootCaCertificate })); const rootCaCert = new x509.X509Certificate(decryptor({ cipherTextBlob: kmipConfig.encryptedRootCaCertificate }));
const serverIntermediateCaCert = new x509.X509Certificate( const serverIntermediateCaCert = new x509.X509Certificate(
@@ -423,8 +423,8 @@ export const kmipServiceFactory = ({
// generate root CA // generate root CA
const rootCaSerialNumber = createSerialNumber(); const rootCaSerialNumber = createSerialNumber();
const rootCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const rootCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const rootCaSkObj = crypto.rawCrypto.KeyObject.from(rootCaKeys.privateKey); const rootCaSkObj = crypto.nativeCrypto.KeyObject.from(rootCaKeys.privateKey);
const rootCaIssuedAt = new Date(); const rootCaIssuedAt = new Date();
const rootCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 20)); const rootCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 20));
@@ -446,8 +446,8 @@ export const kmipServiceFactory = ({
const serverIntermediateCaSerialNumber = createSerialNumber(); const serverIntermediateCaSerialNumber = createSerialNumber();
const serverIntermediateCaIssuedAt = new Date(); const serverIntermediateCaIssuedAt = new Date();
const serverIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10)); const serverIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10));
const serverIntermediateCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const serverIntermediateCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const serverIntermediateCaSkObj = crypto.rawCrypto.KeyObject.from(serverIntermediateCaKeys.privateKey); const serverIntermediateCaSkObj = crypto.nativeCrypto.KeyObject.from(serverIntermediateCaKeys.privateKey);
const serverIntermediateCaCert = await x509.X509CertificateGenerator.create({ const serverIntermediateCaCert = await x509.X509CertificateGenerator.create({
serialNumber: serverIntermediateCaSerialNumber, serialNumber: serverIntermediateCaSerialNumber,
@@ -477,8 +477,8 @@ export const kmipServiceFactory = ({
const clientIntermediateCaSerialNumber = createSerialNumber(); const clientIntermediateCaSerialNumber = createSerialNumber();
const clientIntermediateCaIssuedAt = new Date(); const clientIntermediateCaIssuedAt = new Date();
const clientIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10)); const clientIntermediateCaExpiration = new Date(new Date().setFullYear(new Date().getFullYear() + 10));
const clientIntermediateCaKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const clientIntermediateCaKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const clientIntermediateCaSkObj = crypto.rawCrypto.KeyObject.from(clientIntermediateCaKeys.privateKey); const clientIntermediateCaSkObj = crypto.nativeCrypto.KeyObject.from(clientIntermediateCaKeys.privateKey);
const clientIntermediateCaCert = await x509.X509CertificateGenerator.create({ const clientIntermediateCaCert = await x509.X509CertificateGenerator.create({
serialNumber: clientIntermediateCaSerialNumber, serialNumber: clientIntermediateCaSerialNumber,
@@ -644,7 +644,7 @@ export const kmipServiceFactory = ({
const alg = keyAlgorithmToAlgCfg(keyAlgorithm); const alg = keyAlgorithmToAlgCfg(keyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const extensions: x509.Extension[] = [ const extensions: x509.Extension[] = [
new x509.BasicConstraintsExtension(false), new x509.BasicConstraintsExtension(false),
@@ -692,13 +692,13 @@ export const kmipServiceFactory = ({
cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaChain cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaChain
}).toString("utf-8"); }).toString("utf-8");
const caSkObj = crypto.rawCrypto.createPrivateKey({ const caSkObj = crypto.nativeCrypto.createPrivateKey({
key: decryptor({ cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaPrivateKey }), key: decryptor({ cipherTextBlob: kmipOrgConfig.encryptedServerIntermediateCaPrivateKey }),
format: "der", format: "der",
type: "pkcs8" type: "pkcs8"
}); });
const caPrivateKey = await crypto.rawCrypto.subtle.importKey( const caPrivateKey = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
caSkObj.export({ format: "der", type: "pkcs8" }), caSkObj.export({ format: "der", type: "pkcs8" }),
caAlg, caAlg,
@@ -719,7 +719,7 @@ export const kmipServiceFactory = ({
extensions extensions
}); });
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const certificateChain = `${caCertObj.toString("pem")}\n${decryptedCaCertChain}`.trim(); const certificateChain = `${caCertObj.toString("pem")}\n${decryptedCaCertChain}`.trim();
await kmipOrgServerCertificateDAL.create({ await kmipOrgServerCertificateDAL.create({

2
backend/src/ee/services/scim/scim-service.ts
View File

@@ -8,8 +8,8 @@ import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee
import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal"; import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
import { TScimDALFactory } from "@app/ee/services/scim/scim-dal"; import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
import { getConfig } from "@app/lib/config/env"; import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors";
import { crypto } from "@app/lib/crypto"; import { crypto } from "@app/lib/crypto";
import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid"; import { alphaNumericNanoId } from "@app/lib/nanoid";
import { AuthTokenType } from "@app/services/auth/auth-type"; import { AuthTokenType } from "@app/services/auth/auth-type";
import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal"; import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";

2
backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts
View File

@@ -66,7 +66,7 @@ export const bitbucketSecretScanningService = (
const credentials = JSON.parse(decryptedCredentials.toString()) as TBitbucketDataSourceCredentials; const credentials = JSON.parse(decryptedCredentials.toString()) as TBitbucketDataSourceCredentials;
const hmac = crypto.rawCrypto.createHmac("sha256", credentials.webhookSecret); const hmac = crypto.nativeCrypto.createHmac("sha256", credentials.webhookSecret);
hmac.update(bodyString); hmac.update(bodyString);
const calculatedSignature = hmac.digest("hex"); const calculatedSignature = hmac.digest("hex");

4
backend/src/lib/aws/hashing.ts
View File

@@ -27,9 +27,9 @@ export class CustomAWSHasher {
} else if (ArrayBuffer.isView && ArrayBuffer.isView(this.secret)) { } else if (ArrayBuffer.isView && ArrayBuffer.isView(this.secret)) {
secretBuffer = Buffer.from(this.secret.buffer, this.secret.byteOffset, this.secret.byteLength); secretBuffer = Buffer.from(this.secret.buffer, this.secret.byteOffset, this.secret.byteLength);
} }
this._hash = crypto.rawCrypto.createHmac(this.algorithmIdentifier, secretBuffer); this._hash = crypto.nativeCrypto.createHmac(this.algorithmIdentifier, secretBuffer);
} else { } else {
this._hash = crypto.rawCrypto.createHash(this.algorithmIdentifier); this._hash = crypto.nativeCrypto.createHash(this.algorithmIdentifier);
} }
return this; return this;
} }

2
backend/src/lib/crypto/cache.ts
View File

@@ -1,7 +1,7 @@
import { crypto } from "@app/lib/crypto/cryptography"; import { crypto } from "@app/lib/crypto/cryptography";
export const generateCacheKeyFromData = (data: unknown) => export const generateCacheKeyFromData = (data: unknown) =>
crypto.rawCrypto crypto.nativeCrypto
.createHash("sha256") .createHash("sha256")
.update(JSON.stringify(data)) .update(JSON.stringify(data))
.digest("base64") .digest("base64")

4
backend/src/lib/crypto/cipher/cipher.ts
View File

@@ -11,7 +11,7 @@ export const symmetricCipherService = (
): TSymmetricEncryptionFns => { ): TSymmetricEncryptionFns => {
const encrypt = (text: Buffer, key: Buffer) => { const encrypt = (text: Buffer, key: Buffer) => {
const iv = crypto.randomBytes(IV_LENGTH); const iv = crypto.randomBytes(IV_LENGTH);
const cipher = crypto.rawCrypto.createCipheriv(type, key, iv); const cipher = crypto.nativeCrypto.createCipheriv(type, key, iv);
let encrypted = cipher.update(text); let encrypted = cipher.update(text);
encrypted = Buffer.concat([encrypted, cipher.final()]); encrypted = Buffer.concat([encrypted, cipher.final()]);
@@ -30,7 +30,7 @@ export const symmetricCipherService = (
const tag = ciphertextBlob.subarray(-TAG_LENGTH); const tag = ciphertextBlob.subarray(-TAG_LENGTH);
const encrypted = ciphertextBlob.subarray(IV_LENGTH, -TAG_LENGTH); const encrypted = ciphertextBlob.subarray(IV_LENGTH, -TAG_LENGTH);
const decipher = crypto.rawCrypto.createDecipheriv(type, key, iv); const decipher = crypto.nativeCrypto.createDecipheriv(type, key, iv);
decipher.setAuthTag(tag); decipher.setAuthTag(tag);
const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]); const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);

4
backend/src/lib/crypto/cryptography/crypto.ts
View File

@@ -160,7 +160,7 @@ const cryptographyFactory = () => {
} }
if (process.env.FIPS_ENABLED !== "true") { if (process.env.FIPS_ENABLED !== "true") {
logger.info("[FIPS]: Instance is running in non-FIPS mode."); logger.info("Cryptography module initialized in normal operation mode.");
$setFipsModeEnabled(false); $setFipsModeEnabled(false);
return false; return false;
} }
@@ -412,7 +412,7 @@ const cryptographyFactory = () => {
jwt, jwt,
randomBytes: crypto.randomBytes, randomBytes: crypto.randomBytes,
randomInt: crypto.randomInt, randomInt: crypto.randomInt,
rawCrypto: { nativeCrypto: {
createHash: crypto.createHash, createHash: crypto.createHash,
createHmac: crypto.createHmac, createHmac: crypto.createHmac,
sign: crypto.sign, sign: crypto.sign,

32
backend/src/lib/crypto/sign/signing.ts
View File

@@ -43,19 +43,19 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PSS_SHA_512: case SigningAlgorithm.RSASSA_PSS_SHA_512:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA512, hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA512_DIGEST_LENGTH saltLength: SHA512_DIGEST_LENGTH
}; };
case SigningAlgorithm.RSASSA_PSS_SHA_256: case SigningAlgorithm.RSASSA_PSS_SHA_256:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA256, hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA256_DIGEST_LENGTH saltLength: SHA256_DIGEST_LENGTH
}; };
case SigningAlgorithm.RSASSA_PSS_SHA_384: case SigningAlgorithm.RSASSA_PSS_SHA_384:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA384, hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PSS_PADDING, padding: crypto.nativeCrypto.constants.RSA_PKCS1_PSS_PADDING,
saltLength: SHA384_DIGEST_LENGTH saltLength: SHA384_DIGEST_LENGTH
}; };
@@ -63,17 +63,17 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512: case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_512:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA512, hashAlgorithm: SupportedHashAlgorithm.SHA512,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
}; };
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384: case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_384:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA384, hashAlgorithm: SupportedHashAlgorithm.SHA384,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
}; };
case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256: case SigningAlgorithm.RSASSA_PKCS1_V1_5_SHA_256:
return { return {
hashAlgorithm: SupportedHashAlgorithm.SHA256, hashAlgorithm: SupportedHashAlgorithm.SHA256,
padding: crypto.rawCrypto.constants.RSA_PKCS1_PADDING padding: crypto.nativeCrypto.constants.RSA_PKCS1_PADDING
}; };
// ECDSA // ECDSA
@@ -389,7 +389,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signature; return signature;
} }
const privateKeyObject = crypto.rawCrypto.createPrivateKey({ const privateKeyObject = crypto.nativeCrypto.createPrivateKey({
key: privateKey, key: privateKey,
format: "pem", format: "pem",
type: "pkcs8" type: "pkcs8"
@@ -397,7 +397,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures // For RSA signatures
if (signingAlgorithm.startsWith("RSA")) { if (signingAlgorithm.startsWith("RSA")) {
const signer = crypto.rawCrypto.createSign(hashAlgorithm); const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data); signer.update(data);
return signer.sign({ return signer.sign({
@@ -408,7 +408,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} }
if (signingAlgorithm.startsWith("ECDSA")) { if (signingAlgorithm.startsWith("ECDSA")) {
// For ECDSA signatures // For ECDSA signatures
const signer = crypto.rawCrypto.createSign(hashAlgorithm); const signer = crypto.nativeCrypto.createSign(hashAlgorithm);
signer.update(data); signer.update(data);
return signer.sign({ return signer.sign({
key: privateKeyObject, key: privateKeyObject,
@@ -452,7 +452,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
return signatureValid; return signatureValid;
} }
const publicKeyObject = crypto.rawCrypto.createPublicKey({ const publicKeyObject = crypto.nativeCrypto.createPublicKey({
key: publicKey, key: publicKey,
format: "der", format: "der",
type: "spki" type: "spki"
@@ -460,7 +460,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
// For RSA signatures // For RSA signatures
if (signingAlgorithm.startsWith("RSA")) { if (signingAlgorithm.startsWith("RSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm); const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data); verifier.update(data);
return verifier.verify( return verifier.verify(
@@ -474,7 +474,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} }
// For ECDSA signatures // For ECDSA signatures
if (signingAlgorithm.startsWith("ECDSA")) { if (signingAlgorithm.startsWith("ECDSA")) {
const verifier = crypto.rawCrypto.createVerify(hashAlgorithm); const verifier = crypto.nativeCrypto.createVerify(hashAlgorithm);
verifier.update(data); verifier.update(data);
return verifier.verify( return verifier.verify(
{ {
@@ -499,7 +499,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
const generateAsymmetricPrivateKey = async () => { const generateAsymmetricPrivateKey = async () => {
const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => { const { privateKey } = await new Promise<{ privateKey: string }>((resolve, reject) => {
if (algorithm.startsWith("RSA")) { if (algorithm.startsWith("RSA")) {
crypto.rawCrypto.generateKeyPair( crypto.nativeCrypto.generateKeyPair(
"rsa", "rsa",
{ {
modulusLength: Number(algorithm.split("_")[1]), modulusLength: Number(algorithm.split("_")[1]),
@@ -517,7 +517,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} else { } else {
const { full: namedCurve } = $getEcCurveName(algorithm); const { full: namedCurve } = $getEcCurveName(algorithm);
crypto.rawCrypto.generateKeyPair( crypto.nativeCrypto.generateKeyPair(
"ec", "ec",
{ {
namedCurve, namedCurve,
@@ -541,13 +541,13 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}; };
const getPublicKeyFromPrivateKey = (privateKey: Buffer) => { const getPublicKeyFromPrivateKey = (privateKey: Buffer) => {
const privateKeyObj = crypto.rawCrypto.createPrivateKey({ const privateKeyObj = crypto.nativeCrypto.createPrivateKey({
key: privateKey, key: privateKey,
format: "pem", format: "pem",
type: "pkcs8" type: "pkcs8"
}); });
const publicKey = crypto.rawCrypto.createPublicKey(privateKeyObj).export({ const publicKey = crypto.nativeCrypto.createPublicKey(privateKeyObj).export({
type: "spki", type: "spki",
format: "der" format: "der"
}); });

4
backend/src/lib/crypto/signing.ts
View File

@@ -5,7 +5,7 @@ import path from "path";
import { crypto } from "./cryptography"; import { crypto } from "./cryptography";
export const verifySignature = (data: string, signature: Buffer, publicKey: KeyObject) => { export const verifySignature = (data: string, signature: Buffer, publicKey: KeyObject) => {
const verify = crypto.rawCrypto.createVerify("SHA256"); const verify = crypto.nativeCrypto.createVerify("SHA256");
verify.update(data); verify.update(data);
verify.end(); verify.end();
return verify.verify(publicKey, signature); return verify.verify(publicKey, signature);
@@ -14,7 +14,7 @@ export const verifySignature = (data: string, signature: Buffer, publicKey: KeyO
export const verifyOfflineLicense = async (licenseContents: string, signature: string) => { export const verifyOfflineLicense = async (licenseContents: string, signature: string) => {
const publicKeyPem = await fs.readFile(path.join(__dirname, "license_public_key.pem"), "utf8"); const publicKeyPem = await fs.readFile(path.join(__dirname, "license_public_key.pem"), "utf8");
const publicKey = crypto.rawCrypto.createPublicKey({ const publicKey = crypto.nativeCrypto.createPublicKey({
key: publicKeyPem, key: publicKeyPem,
format: "pem", format: "pem",
type: "pkcs1" type: "pkcs1"

6
backend/src/lib/gateway/gateway.ts
View File

@@ -49,8 +49,8 @@ const createQuicConnection = async (
verifyPeer: true, verifyPeer: true,
verifyCallback: async (certs) => { verifyCallback: async (certs) => {
if (!certs || certs.length === 0) return quic.native.CryptoError.CertificateRequired; if (!certs || certs.length === 0) return quic.native.CryptoError.CertificateRequired;
const serverCertificate = new crypto.rawCrypto.X509Certificate(Buffer.from(certs[0])); const serverCertificate = new crypto.nativeCrypto.X509Certificate(Buffer.from(certs[0]));
const caCertificate = new crypto.rawCrypto.X509Certificate(tlsOptions.ca); const caCertificate = new crypto.nativeCrypto.X509Certificate(tlsOptions.ca);
const isValidServerCertificate = serverCertificate.verify(caCertificate.publicKey); const isValidServerCertificate = serverCertificate.verify(caCertificate.publicKey);
if (!isValidServerCertificate) return quic.native.CryptoError.BadCertificate; if (!isValidServerCertificate) return quic.native.CryptoError.BadCertificate;
@@ -73,7 +73,7 @@ const createQuicConnection = async (
crypto: { crypto: {
ops: { ops: {
randomBytes: async (data) => { randomBytes: async (data) => {
crypto.rawCrypto.getRandomValues(new Uint8Array(data)); crypto.nativeCrypto.getRandomValues(new Uint8Array(data));
} }
} }
} }

2
backend/src/lib/red-lock/index.ts
View File

@@ -251,7 +251,7 @@ export class Redlock extends EventEmitter {
* Generate a sha1 hash compatible with redis evalsha. * Generate a sha1 hash compatible with redis evalsha.
*/ */
private _hash(value: string): string { private _hash(value: string): string {
return crypto.rawCrypto.createHash("sha1").update(value).digest("hex"); return crypto.nativeCrypto.createHash("sha1").update(value).digest("hex");
} }
/** /**

2
backend/src/lib/turn/credentials.ts
View File

@@ -5,7 +5,7 @@ export const getTurnCredentials = (id: string, authSecret: string, ttl = TURN_TO
const timestamp = Math.floor((Date.now() + ttl) / 1000); const timestamp = Math.floor((Date.now() + ttl) / 1000);
const username = `${timestamp}:${id}`; const username = `${timestamp}:${id}`;
const hmac = crypto.rawCrypto.createHmac("sha1", authSecret); const hmac = crypto.nativeCrypto.createHmac("sha1", authSecret);
hmac.update(username); hmac.update(username);
const password = hmac.digest("base64"); const password = hmac.digest("base64");

2
backend/src/server/routes/v1/identity-tls-cert-auth-router.ts
View File

@@ -27,7 +27,7 @@ const validateCaCertificate = (caCert: string) => {
if (!caCert) return true; if (!caCert) return true;
try { try {
// eslint-disable-next-line no-new // eslint-disable-next-line no-new
new crypto.rawCrypto.X509Certificate(caCert); new crypto.nativeCrypto.X509Certificate(caCert);
return true; return true;
} catch { } catch {
return false; return false;

2
backend/src/services/app-connection/app-connection-fns.ts
View File

@@ -305,7 +305,7 @@ export const decryptAppConnection = async (
orgId: appConnection.orgId, orgId: appConnection.orgId,
kmsService kmsService
}), }),
credentialsHash: crypto.rawCrypto.createHash("sha256").update(appConnection.encryptedCredentials).digest("hex") credentialsHash: crypto.nativeCrypto.createHash("sha256").update(appConnection.encryptedCredentials).digest("hex")
} as TAppConnection; } as TAppConnection;
}; };

2
backend/src/services/app-connection/app-connection-service.ts
View File

@@ -281,7 +281,7 @@ export const appConnectionServiceFactory = ({
return { return {
...connection, ...connection,
credentialsHash: crypto.rawCrypto.createHash("sha256").update(connection.encryptedCredentials).digest("hex"), credentialsHash: crypto.nativeCrypto.createHash("sha256").update(connection.encryptedCredentials).digest("hex"),
credentials: validatedCredentials credentials: validatedCredentials
} as TAppConnection; } as TAppConnection;
} catch (err) { } catch (err) {

2
backend/src/services/app-connection/aws/aws-connection-fns.ts
View File

@@ -49,7 +49,7 @@ export const getAwsConnectionConfig = async (appConnection: TAwsConnectionConfig
const command = new AssumeRoleCommand({ const command = new AssumeRoleCommand({
RoleArn: credentials.roleArn, RoleArn: credentials.roleArn,
RoleSessionName: `infisical-app-connection-${crypto.rawCrypto.randomUUID()}`, RoleSessionName: `infisical-app-connection-${crypto.nativeCrypto.randomUUID()}`,
DurationSeconds: 900, // 15 mins DurationSeconds: 900, // 15 mins
ExternalId: orgId ExternalId: orgId
}); });

4
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
View File

@@ -414,8 +414,8 @@ export const AcmeCertificateAuthorityFns = ({
const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048); const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
const [, certificateCsr] = await acme.crypto.createCsr( const [, certificateCsr] = await acme.crypto.createCsr(

12
backend/src/services/certificate-authority/certificate-authority-fns.ts
View File

@@ -133,8 +133,8 @@ export const getCaCredentials = async ({
}); });
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const skObj = crypto.rawCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" }); const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" });
const caPrivateKey = await crypto.rawCrypto.subtle.importKey( const caPrivateKey = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
skObj.export({ format: "der", type: "pkcs8" }), skObj.export({ format: "der", type: "pkcs8" }),
alg, alg,
@@ -142,8 +142,8 @@ export const getCaCredentials = async ({
["sign"] ["sign"]
); );
const pkObj = crypto.rawCrypto.createPublicKey(skObj); const pkObj = crypto.nativeCrypto.createPublicKey(skObj);
const caPublicKey = await crypto.rawCrypto.subtle.importKey( const caPublicKey = await crypto.nativeCrypto.subtle.importKey(
"spki", "spki",
pkObj.export({ format: "der", type: "spki" }), pkObj.export({ format: "der", type: "spki" }),
alg, alg,
@@ -281,8 +281,8 @@ export const rebuildCaCrl = async ({
cipherTextBlob: caSecret.encryptedPrivateKey cipherTextBlob: caSecret.encryptedPrivateKey
}); });
const skObj = crypto.rawCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); const skObj = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" });
const sk = await crypto.rawCrypto.subtle.importKey( const sk = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
skObj.export({ format: "der", type: "pkcs8" }), skObj.export({ format: "der", type: "pkcs8" }),
alg, alg,

4
backend/src/services/certificate-authority/certificate-authority-queue.ts
View File

@@ -198,8 +198,8 @@ export const certificateAuthorityQueueFactory = ({
cipherTextBlob: caSecret.encryptedPrivateKey cipherTextBlob: caSecret.encryptedPrivateKey
}); });
const skObj = crypto.rawCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); const skObj = crypto.nativeCrypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" });
const sk = await crypto.rawCrypto.subtle.importKey( const sk = await crypto.nativeCrypto.subtle.importKey(
"pkcs8", "pkcs8",
skObj.export({ format: "der", type: "pkcs8" }), skObj.export({ format: "der", type: "pkcs8" }),
alg, alg,

8
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
View File

@@ -99,7 +99,7 @@ export const InternalCertificateAuthorityFns = ({
} }
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
name: `CN=${subscriber.commonName}`, name: `CN=${subscriber.commonName}`,
@@ -184,7 +184,7 @@ export const InternalCertificateAuthorityFns = ({
extensions extensions
}); });
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
const kmsEncryptor = await kmsService.encryptWithKmsKey({ const kmsEncryptor = await kmsService.encryptWithKmsKey({
@@ -331,7 +331,7 @@ export const InternalCertificateAuthorityFns = ({
}); });
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
name: `CN=${commonName}`, name: `CN=${commonName}`,
@@ -450,7 +450,7 @@ export const InternalCertificateAuthorityFns = ({
extensions extensions
}); });
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
const kmsEncryptor = await kmsService.encryptWithKmsKey({ const kmsEncryptor = await kmsService.encryptWithKmsKey({

14
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
View File

@@ -171,7 +171,7 @@ export const internalCertificateAuthorityServiceFactory = ({
}); });
const alg = keyAlgorithmToAlgCfg(keyAlgorithm); const alg = keyAlgorithmToAlgCfg(keyAlgorithm);
const keys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const keys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const newCa = await certificateAuthorityDAL.transaction(async (tx) => { const newCa = await certificateAuthorityDAL.transaction(async (tx) => {
const notBeforeDate = notBefore ? new Date(notBefore) : new Date(); const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
@@ -226,7 +226,7 @@ export const internalCertificateAuthorityServiceFactory = ({
}); });
// https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey
const skObj = crypto.rawCrypto.KeyObject.from(keys.privateKey); const skObj = crypto.nativeCrypto.KeyObject.from(keys.privateKey);
const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({ const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
plainText: skObj.export({ plainText: skObj.export({
@@ -1102,9 +1102,9 @@ export const internalCertificateAuthorityServiceFactory = ({
kmsService kmsService
}); });
const isCaAndCertPublicKeySame = Buffer.from(await crypto.rawCrypto.subtle.exportKey("spki", caPublicKey)).equals( const isCaAndCertPublicKeySame = Buffer.from(
Buffer.from(certObj.publicKey.rawData) await crypto.nativeCrypto.subtle.exportKey("spki", caPublicKey)
); ).equals(Buffer.from(certObj.publicKey.rawData));
if (!isCaAndCertPublicKeySame) { if (!isCaAndCertPublicKeySame) {
throw new BadRequestError({ message: "CA and certificate public key do not match" }); throw new BadRequestError({ message: "CA and certificate public key do not match" });
@@ -1265,7 +1265,7 @@ export const internalCertificateAuthorityServiceFactory = ({
} }
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm); const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
name: `CN=${commonName}`, name: `CN=${commonName}`,
@@ -1412,7 +1412,7 @@ export const internalCertificateAuthorityServiceFactory = ({
extensions extensions
}); });
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey); const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
const kmsEncryptor = await kmsService.encryptWithKmsKey({ const kmsEncryptor = await kmsService.encryptWithKmsKey({

4
backend/src/services/certificate/certificate-fns.ts
View File

@@ -86,10 +86,10 @@ export const getCertificateCredentials = async ({
}); });
try { try {
const skObj = crypto.rawCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "pem", type: "pkcs8" }); const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "pem", type: "pkcs8" });
const certPrivateKey = skObj.export({ format: "pem", type: "pkcs8" }).toString(); const certPrivateKey = skObj.export({ format: "pem", type: "pkcs8" }).toString();
const pkObj = crypto.rawCrypto.createPublicKey(skObj); const pkObj = crypto.nativeCrypto.createPublicKey(skObj);
const certPublicKey = pkObj.export({ format: "pem", type: "spki" }).toString(); const certPublicKey = pkObj.export({ format: "pem", type: "spki" }).toString();
return { return {

8
backend/src/services/certificate/certificate-service.ts
View File

@@ -373,16 +373,16 @@ export const certificateServiceFactory = ({
// Verify private key matches the certificate // Verify private key matches the certificate
let privateKey; let privateKey;
try { try {
privateKey = crypto.rawCrypto.createPrivateKey(privateKeyPem); privateKey = crypto.nativeCrypto.createPrivateKey(privateKeyPem);
} catch (err) { } catch (err) {
throw new BadRequestError({ message: "Invalid private key format" }); throw new BadRequestError({ message: "Invalid private key format" });
} }
try { try {
const message = Buffer.from(Buffer.alloc(32)); const message = Buffer.from(Buffer.alloc(32));
const publicKey = crypto.rawCrypto.createPublicKey(certificatePem); const publicKey = crypto.nativeCrypto.createPublicKey(certificatePem);
const signature = crypto.rawCrypto.sign(null, message, privateKey); const signature = crypto.nativeCrypto.sign(null, message, privateKey);
const isValid = crypto.rawCrypto.verify(null, message, publicKey, signature); const isValid = crypto.nativeCrypto.verify(null, message, publicKey, signature);
if (!isValid) { if (!isValid) {
throw new BadRequestError({ message: "Private key does not match certificate" }); throw new BadRequestError({ message: "Private key does not match certificate" });

12
backend/src/services/external-migration/external-migration-fns.ts
View File

@@ -228,7 +228,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
} }
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secretName, name: secretName,
environmentId: matchingAppEnv.id, environmentId: matchingAppEnv.id,
value: resolvedSecret.val || "", value: resolvedSecret.val || "",
@@ -261,7 +261,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
} }
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secretName, name: secretName,
environmentId: matchingAppEnv.id, environmentId: matchingAppEnv.id,
value: secretData.val || "", value: secretData.val || "",
@@ -348,7 +348,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
} }
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secret, name: secret,
environmentId: matchingEnv.id, environmentId: matchingEnv.id,
value: resolvedSecret.val || "", value: resolvedSecret.val || "",
@@ -380,7 +380,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
} }
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secret, name: secret,
environmentId: matchingEnv.id, environmentId: matchingEnv.id,
value: selectedSecret.val || "", value: selectedSecret.val || "",
@@ -461,7 +461,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
} }
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secretName, name: secretName,
environmentId: subEnv ? subEnv.parentEnvironmentId : env, environmentId: subEnv ? subEnv.parentEnvironmentId : env,
value: resolvedSecret.val || "", value: resolvedSecret.val || "",
@@ -487,7 +487,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
const folderId = targetIdToFolderIdsMap.get(subEnv?.id || "") || subEnv?.id; const folderId = targetIdToFolderIdsMap.get(subEnv?.id || "") || subEnv?.id;
infisicalImportData.secrets.push({ infisicalImportData.secrets.push({
id: crypto.rawCrypto.randomUUID(), id: crypto.nativeCrypto.randomUUID(),
name: secretName, name: secretName,
environmentId: subEnv ? subEnv.parentEnvironmentId : env, environmentId: subEnv ? subEnv.parentEnvironmentId : env,
value: secretData.val || "", value: secretData.val || "",

4
backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
View File

@@ -85,8 +85,8 @@ export const identityTlsCertAuthServiceFactory = ({
throw new BadRequestError({ message: "Missing client certificate" }); throw new BadRequestError({ message: "Missing client certificate" });
} }
const clientCertificateX509 = new crypto.rawCrypto.X509Certificate(leafCertificate); const clientCertificateX509 = new crypto.nativeCrypto.X509Certificate(leafCertificate);
const caCertificateX509 = new crypto.rawCrypto.X509Certificate(caCertificate); const caCertificateX509 = new crypto.nativeCrypto.X509Certificate(caCertificate);
const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey); const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey);
if (!isValidCertificate) if (!isValidCertificate)

2
backend/src/services/identity-ua/identity-ua-service.ts
View File

@@ -248,7 +248,7 @@ export const identityUaServiceFactory = ({
const doc = await identityUaDAL.create( const doc = await identityUaDAL.create(
{ {
identityId: identityMembershipOrg.identityId, identityId: identityMembershipOrg.identityId,
clientId: crypto.rawCrypto.randomUUID(), clientId: crypto.nativeCrypto.randomUUID(),
clientSecretTrustedIps: JSON.stringify(reformattedClientSecretTrustedIps), clientSecretTrustedIps: JSON.stringify(reformattedClientSecretTrustedIps),
accessTokenMaxTTL, accessTokenMaxTTL,
accessTokenTTL, accessTokenTTL,

4
backend/src/services/integration-auth/integration-sync-secret.ts
View File

@@ -809,7 +809,7 @@ const syncSecretsAWSParameterStore = async ({
}); });
const command = new AssumeRoleCommand({ const command = new AssumeRoleCommand({
RoleArn: awsAssumeRoleArn, RoleArn: awsAssumeRoleArn,
RoleSessionName: `infisical-parameter-store-${crypto.rawCrypto.randomUUID()}`, RoleSessionName: `infisical-parameter-store-${crypto.nativeCrypto.randomUUID()}`,
DurationSeconds: 900, // 15mins DurationSeconds: 900, // 15mins
ExternalId: projectId ExternalId: projectId
}); });
@@ -1129,7 +1129,7 @@ const syncSecretsAWSSecretManager = async ({
}); });
const command = new AssumeRoleCommand({ const command = new AssumeRoleCommand({
RoleArn: awsAssumeRoleArn, RoleArn: awsAssumeRoleArn,
RoleSessionName: `infisical-sm-${crypto.rawCrypto.randomUUID()}`, RoleSessionName: `infisical-sm-${crypto.nativeCrypto.randomUUID()}`,
DurationSeconds: 900, // 15mins DurationSeconds: 900, // 15mins
ExternalId: projectId ExternalId: projectId
}); });

4
backend/src/services/kms/kms-service.ts
View File

@@ -994,7 +994,7 @@ export const kmsServiceFactory = ({
"base64" "base64"
)}`; )}`;
const verificationHash = crypto.rawCrypto.createHash("sha256").update(secretManagerBackup).digest("hex"); const verificationHash = crypto.nativeCrypto.createHash("sha256").update(secretManagerBackup).digest("hex");
secretManagerBackup = `${secretManagerBackup}.${verificationHash}`; secretManagerBackup = `${secretManagerBackup}.${verificationHash}`;
return { return {
@@ -1012,7 +1012,7 @@ export const kmsServiceFactory = ({
const [, backupProjectId, , backupKmsKeyId, backupBase64EncryptedDataKey, backupHash] = backup.split("."); const [, backupProjectId, , backupKmsKeyId, backupBase64EncryptedDataKey, backupHash] = backup.split(".");
const computedHash = crypto.rawCrypto const computedHash = crypto.nativeCrypto
.createHash("sha256") .createHash("sha256")
.update(backup.substring(0, backup.lastIndexOf("."))) .update(backup.substring(0, backup.lastIndexOf(".")))
.digest("hex"); .digest("hex");

4
backend/src/services/telemetry/telemetry-service.ts
View File

@@ -42,7 +42,7 @@ export type TTelemetryServiceFactoryDep = {
const getBucketForDistinctId = (distinctId: string): string => { const getBucketForDistinctId = (distinctId: string): string => {
// Use SHA-256 hash for consistent distribution // Use SHA-256 hash for consistent distribution
const hash = crypto.rawCrypto.createHash("sha256").update(distinctId).digest("hex"); const hash = crypto.nativeCrypto.createHash("sha256").update(distinctId).digest("hex");
// Take first 8 characters and convert to number for better distribution // Take first 8 characters and convert to number for better distribution
const hashNumber = parseInt(hash.substring(0, 8), 16); const hashNumber = parseInt(hash.substring(0, 8), 16);
@@ -53,7 +53,7 @@ const getBucketForDistinctId = (distinctId: string): string => {
export const createTelemetryEventKey = (event: string, distinctId: string): string => { export const createTelemetryEventKey = (event: string, distinctId: string): string => {
const bucketId = getBucketForDistinctId(distinctId); const bucketId = getBucketForDistinctId(distinctId);
return `telemetry-event-${event}-${bucketId}-${distinctId}-${crypto.rawCrypto.randomUUID()}`; return `telemetry-event-${event}-${bucketId}-${distinctId}-${crypto.nativeCrypto.randomUUID()}`;
}; };
export const telemetryServiceFactory = ({ keyStore, licenseService }: TTelemetryServiceFactoryDep) => { export const telemetryServiceFactory = ({ keyStore, licenseService }: TTelemetryServiceFactoryDep) => {

5
backend/src/services/webhook/webhook-fns.ts
View File

@@ -41,7 +41,10 @@ export const triggerWebhookRequest = async (
const payload = { ...data, timestamp: Date.now() }; const payload = { ...data, timestamp: Date.now() };
const { secretKey, url } = decryptWebhookDetails(webhook, decryptor); const { secretKey, url } = decryptWebhookDetails(webhook, decryptor);
if (secretKey) { if (secretKey) {
const webhookSign = crypto.rawCrypto.createHmac("sha256", secretKey).update(JSON.stringify(payload)).digest("hex"); const webhookSign = crypto.nativeCrypto
.createHmac("sha256", secretKey)
.update(JSON.stringify(payload))
.digest("hex");
headers["x-infisical-signature"] = `t=${payload.timestamp};${webhookSign}`; headers["x-infisical-signature"] = `t=${payload.timestamp};${webhookSign}`;
} }