Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

expose SSL_export_keying_material via Node API (e.g. like SSL_get_shared_sigalgs) #31802

Closed
simllll opened this issue Feb 14, 2020 · 4 comments
Closed
Labels
crypto Issues and PRs related to the crypto subsystem. feature request Issues that request new features to be added to Node.js.

Comments

@simllll
Copy link
Contributor

simllll commented Feb 14, 2020

Is your feature request related to a problem? Please describe.
I'm trying to generate a check sum that is based on the keying material (https://stackoverflow.com/questions/60232165/ssl-export-keying-material-in-node-js). Right now node has no method to call this function, or any other way of retrieving this information.

Describe the solution you'd like
Expose an api like the GetSharedSigalgs that offers a way to access the native SSL export keying material method.
see https://nodejs.org/api/tls.html#tls_tlssocket_getsharedsigalgs
for the keying material method see https://www.openssl.org/docs/man1.0.2/man3/SSL_export_keying_material.html

Describe alternatives you've considered
I tried to get this kind of information via 'keylog' event, but this is never emitted in my scenario. I also believe (couldn't verify though), that this is something else than the exporting keying material function offers, due to the fact that I cannot provide any label to "keylog" which is mandatory for the keying material method.

Subsystem: tls (tls.TLSSocket)

@jasnell jasnell added crypto Issues and PRs related to the crypto subsystem. feature request Issues that request new features to be added to Node.js. labels Feb 14, 2020
@jasnell
Copy link
Member

jasnell commented Feb 14, 2020

/cc @nodejs/crypto

@sam-github
Copy link
Contributor

keylog is delivered from https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_keylog_callback.html, but if that isn't what you need exposing this new API seems reasonable.

Care to take a shot at it? It seems you've already found the code it would be similar to.

@bnoordhuis
Copy link
Member

There's a mildly slippery slope here in that SSL_export_keying_material_early() is probably also necessary for TLSv1.3 - although that's only relevant with 0-RTT and Node doesn't really support that right now.

(I say "not really" because I think a tls.Server instance still accepts it but then proceeds to terminate the connection. We should probably have a test for that so we'll be aware of behavior changes.)

@simllll
Copy link
Contributor Author

simllll commented Feb 15, 2020

@sam-github I tried my best, do you mind taking a look at it? :-) #31814

bnoordhuis added a commit to bnoordhuis/io.js that referenced this issue Feb 18, 2020
This way we'll know if and when the behavior changes. Right now, early
data should not be sent because Node's built-in TLS server doesn't
support it.

Refs: nodejs#31802 (comment)
codebytere pushed a commit that referenced this issue Feb 27, 2020
Fixes: #31802

PR-URL: #31814
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
targos pushed a commit to targos/node that referenced this issue Apr 25, 2020
Fixes: nodejs#31802

PR-URL: nodejs#31814
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
targos pushed a commit that referenced this issue Apr 28, 2020
Fixes: #31802

PR-URL: #31814
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crypto Issues and PRs related to the crypto subsystem. feature request Issues that request new features to be added to Node.js.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants