crypto: discover hashes and ciphers from providers

[panva]

OpenSSL 3 provider implementations are not necessarily registered in the legacy digest and cipher tables used by EVP_get_digestbyname() and EVP_get_cipherbyname(). As a result, Node.js can omit usable provider-only algorithms from getHashes() and getCiphers() and reject them in crypto operations even when they match the active OpenSSL property query. The permanently memoized algorithm lists can also remain stale after setFips() changes that query.

This change discovers usable hashes, ciphers, and aliases from activated OpenSSL providers while preserving the legacy registries. Numeric OID aliases, NULL implementations, and cipher implementations unsupported by the Node.js Cipher APIs are excluded.

Resolution and API support

• Provider digest resolution now covers streaming and one-shot hashing, HMAC, KDFs, signing, verification, and RSA digest options.
• Provider cipher resolution is used for string-based initialization and getCipherInfo() while preserving numeric, WebCrypto, TLS, and predefined-cipher paths.
• Provider discovery exposes algorithms including KECCAK-KMAC-128, KECCAK-256, SHA256-192, CBC-CTS variants, SM4-GCM, SM4-CCM, SM4-XTS, and additional AES key-wrap implementations when supplied by the active providers.
• createHash() and crypto.hash() accept functionName and customization for cSHAKE digests with OpenSSL 4.0 or later.
• Cipher construction accepts ctsMode for CBC-CTS and xtsStandard for selecting the provider XTS variant.
• CBC-CTS, AES key wrap, SIV/GCM-SIV, and CCM decryption enforce the one-shot and authentication constraints required by their provider implementations.

Caching and invalidation

• Ordinary hashes and ciphers retain their legacy lookup and direct initialization paths, and the extended native binding arities are used only when the new cSHAKE, CTS, or XTS options are supplied.
• Successful provider fetches are cached per Environment under case-insensitive query, canonical, and alias names, with owners deduplicated by provider and canonical identity.
• Warm cache hits return borrowed pointers without another explicit fetch or reference increment, and failed lookups are not cached.
• A process-wide generation advances only after a successful setFips() call that changes the FIPS state.
• Each Environment lazily clears aliases before releasing owning provider references when it observes a new generation.
• getHashes() and getCiphers() keep independent generation-aware snapshots, retry enumeration if the generation changes concurrently, return defensive copies, and discard their JavaScript snapshots during snapshot serialization.
• Existing hash and cipher contexts retain their implementation and can finish across a FIPS transition, while new contexts resolve against the new property query.
• Provider owners are released before worker addon DSOs are unloaded.
• Engine registration changes, explicit provider load or unload, and default-property changes made by native addons intentionally do not participate in this invalidation mechanism since engines are on the way out of the codebase (crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183) #63966, crypto,build: require OpenSSL 3, drop the bundled FIPS provider build #64777 (comment)).

Fixes: #43040
Fixes: #64866
Refs: #62982

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/security-wg

[codecov]

Codecov Report

❌ Patch coverage is 65.93002% with 185 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.09%. Comparing base (30fe871) to head (ac4548f).
⚠️ Report is 34 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_hash.cc	70.30%	44 Missing and 35 partials ⚠️
src/crypto/crypto_util.cc	11.86%	52 Missing ⚠️
lib/internal/crypto/hash.js	39.68%	37 Missing and 1 partial ⚠️
src/crypto/crypto_util.h	0.00%	5 Missing ⚠️
src/crypto/crypto_cipher.cc	94.44%	0 Missing and 3 partials ⚠️
src/crypto/crypto_rsa.cc	70.00%	0 Missing and 3 partials ⚠️
lib/internal/crypto/util.js	95.45%	2 Missing ⚠️
src/crypto/crypto_context.cc	71.42%	0 Missing and 2 partials ⚠️
src/env.cc	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65484      +/-   ##
==========================================
- Coverage   90.11%   90.09%   -0.03%     
==========================================
  Files         751      751              
  Lines      252473   253124     +651     
  Branches    47487    47659     +172     
==========================================
+ Hits       227517   228040     +523     
- Misses      16270    16351      +81     
- Partials     8686     8733      +47     

Files with missing lines	Coverage Δ
lib/internal/crypto/cipher.js	98.18% <100.00%> (+0.16%)	⬆️
src/crypto/crypto_aes.h	33.33% <ø> (ø)
src/crypto/crypto_chacha20_poly1305.cc	52.27% <100.00%> (ø)
src/crypto/crypto_cipher.h	68.47% <ø> (ø)
src/crypto/crypto_hash.h	25.00% <ø> (ø)
src/env.h	98.21% <ø> (ø)
src/env.cc	85.20% <75.00%> (-0.28%)	⬇️
lib/internal/crypto/util.js	97.45% <95.45%> (+0.34%)	⬆️
src/crypto/crypto_context.cc	71.73% <71.42%> (+0.06%)	⬆️
src/crypto/crypto_cipher.cc	79.73% <94.44%> (+1.51%)	⬆️
... and 5 more

... and 62 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[panva]

Compared main with this branch at 54489eb, on macOS arm64 using OpenSSL 3.5.7 Release builds and each result uses 30 runs.

                                                                                        confidence improvement accuracy (*)   (**)  (***)
crypto/aes-gcm-throughput.js len=262144 cipher='aes-128-gcm' n=1000                                     1.30 %       ±1.62% ±2.16% ±2.83%
crypto/create-cipheriv.js operation='decrypt' cipher='aes-128-cbc' n=100000                    ***     -2.16 %       ±1.16% ±1.55% ±2.03%
crypto/create-cipheriv.js operation='encrypt' cipher='aes-128-cbc' n=100000                    ***     -2.00 %       ±1.06% ±1.42% ±1.85%
crypto/create-hash.js n=100000                                                                 ***     -3.52 %       ±1.87% ±2.49% ±3.25%
crypto/create-hmac.js keylen=16 algo='sha256' n=100000                                                 -0.18 %       ±1.46% ±1.94% ±2.54%
crypto/get-ciphers.js v='crypto' n=500000                                                      ***    -41.21 %       ±2.65% ±3.57% ±4.73%
crypto/getcipherinfo.js n=100000 cipher='aes-128-cbc'                                                  -1.16 %       ±1.24% ±1.66% ±2.18%
crypto/hash-stream-throughput.js api='legacy' len=102400 type='buf' algo='sha256' n=500                 0.65 %       ±1.52% ±2.03% ±2.65%
crypto/oneshot-hash.js n=1000 type='buffer' method='sha256' length=100000                               0.98 %       ±3.06% ±4.08% ±5.32%
crypto/oneshot-hash.js n=100000 type='buffer' method='sha256' length=1000                               0.54 %       ±1.77% ±2.36% ±3.08%
crypto/oneshot-sign.js n=1000 keyFormat='keyObject' mode='sync' keyType='rsa'                           0.11 %       ±0.64% ±0.85% ±1.11%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 11 comparisons, you can thus
expect the following amount of false-positive results:
  0.55 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.11 false positives, when considering a   1% risk acceptance (**, ***),
  0.01 false positives, when considering a 0.1% risk acceptance (***)

One-shot hashing, HMAC, signing, getCipherInfo(), and bulk throughput remain within measurement noise. Ordinary hash and cipher construction retain a small fixed-cost regression of approximately 2–3.5%.

The getCiphers() (and getHashes()) dip (41,780,884 ops/s down to 23,969,006 ops/s) is large but these are introspection APIs called infrequently, and the generation check prevents them from returning stale results after setFips() changes the active property query. Hashing and encryption throughput are unaffected by the getCiphers() (and getHashes()) dip.