fixup! crypto: support OpenSSL STORE private keys

Author: panva

deps/ncrypto/ncrypto.cc

@@ -4784,9 +4784,14 @@ DataPointer EVPMDCtxPointer::sign(
 
 bool EVPMDCtxPointer::verify(const Buffer<const unsigned char>& buf,
                              const Buffer<const unsigned char>& sig) const {
-  if (!ctx_) return false;
-  int ret = EVP_DigestVerify(ctx_.get(), sig.data, sig.len, buf.data, buf.len);
-  return ret == 1;
+  return verifyOneShot(buf, sig) == 1;
+}
+
+int EVPMDCtxPointer::verifyOneShot(
+    const Buffer<const unsigned char>& buf,
+    const Buffer<const unsigned char>& sig) const {
+  if (!ctx_) return -1;
+  return EVP_DigestVerify(ctx_.get(), sig.data, sig.len, buf.data, buf.len);
 }
 
 EVPMDCtxPointer EVPMDCtxPointer::New() {

deps/ncrypto/ncrypto.h

@@ -1531,6 +1531,8 @@ class EVPMDCtxPointer final {
   DataPointer sign(const Buffer<const unsigned char>& buf) const;
   bool verify(const Buffer<const unsigned char>& buf,
               const Buffer<const unsigned char>& sig) const;
+  int verifyOneShot(const Buffer<const unsigned char>& buf,
+                    const Buffer<const unsigned char>& sig) const;
 
   const EVP_MD* getDigest() const;
   size_t getDigestSize() const;

src/crypto/crypto_sig.cc

@@ -391,12 +391,12 @@ bool SupportsContextString(const EVPKeyPointer& key) {
   return false;
 }
 
-bool UsePrehashedSignVerify(const EVPKeyPointer& key,
-                            const Digest& digest,
-                            bool has_context) {
-  // Match streaming sign/verify for digest-based keys: hash locally, then ask
-  // the key implementation to sign or verify the digest. Some providers only
-  // expose token-backed keys through that lower-level operation.
+bool CanFallbackToPrehashedSignVerify(const EVPKeyPointer& key,
+                                      const Digest& digest,
+                                      bool has_context) {
+  // The primary path is OpenSSL's digest-sign operation. Fall back to hashing
+  // locally only when that path fails; some providers expose token-backed keys
+  // through the lower-level prehashed sign/verify operation only.
   return digest && !has_context && !key.isOneShotVariant();
 }
 
@@ -901,32 +901,8 @@ bool SignTraits::DeriveBits(Environment* env,
       params.flags & SignConfiguration::kHasSaltLength
           ? std::optional<int>(params.salt_length)
           : std::nullopt;
-
-  if (UsePrehashedSignVerify(key, params.digest, has_context)) {
-    switch (params.mode) {
-      case SignConfiguration::Mode::Sign: {
-        *out = SignPrehashed(env,
-                             key,
-                             params.digest,
-                             params.data,
-                             padding,
-                             salt_length,
-                             params.dsa_encoding);
-        return static_cast<bool>(*out);
-      }
-      case SignConfiguration::Mode::Verify: {
-        auto buf = DataPointer::Alloc(1);
-        static_cast<char*>(buf.get())[0] = VerifyPrehashed(key,
-                                                           params.digest,
-                                                           params.data,
-                                                           params.signature,
-                                                           padding,
-                                                           salt_length);
-        *out = ByteSource::Allocated(buf.release());
-        return true;
-      }
-    }
-  }
+  bool can_fallback_to_prehash =
+      CanFallbackToPrehashedSignVerify(key, params.digest, has_context);
 
   auto context = EVPMDCtxPointer::New();
   if (!context) [[unlikely]]
@@ -975,6 +951,16 @@ bool SignTraits::DeriveBits(Environment* env,
         *out = ByteSource::Allocated(data.release());
       } else {
         auto data = context.sign(params.data);
+        if (!data && can_fallback_to_prehash) {
+          *out = SignPrehashed(env,
+                               key,
+                               params.digest,
+                               params.data,
+                               padding,
+                               salt_length,
+                               params.dsa_encoding);
+          return static_cast<bool>(*out);
+        }
         if (!data) [[unlikely]] {
           return false;
         }
@@ -992,9 +978,18 @@ bool SignTraits::DeriveBits(Environment* env,
     case SignConfiguration::Mode::Verify: {
       auto buf = DataPointer::Alloc(1);
       static_cast<char*>(buf.get())[0] = 0;
-      if (context.verify(params.data, params.signature) &&
+      int verify_result = context.verifyOneShot(params.data, params.signature);
+      if (verify_result == 1 &&
           !HasSmallOrderEdDsaPoint(key, params.signature)) {
         static_cast<char*>(buf.get())[0] = 1;
+      } else if (verify_result < 0 && can_fallback_to_prehash &&
+                 VerifyPrehashed(key,
+                                 params.digest,
+                                 params.data,
+                                 params.signature,
+                                 padding,
+                                 salt_length)) {
+        static_cast<char*>(buf.get())[0] = 1;
       }
       *out = ByteSource::Allocated(buf.release());
     }

test/parallel/test-crypto-sign-verify.js

@@ -625,6 +625,44 @@ if (hasOpenSSL(3, 2)) {
   assert.throws(() => crypto.verify(null, data, 'test', input), errObj);
 });
 
+// Preserve the current behavior from https://github.com/nodejs/node/issues/53761:
+// one-shot verify does not accept SM2 signatures produced by the streaming path.
+if (hasOpenSSL(3) && crypto.getHashes().includes('sm3')) {
+  const data = Buffer.from('AABB');
+  const privateKey = crypto.createPrivateKey(`-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgbjCNHopgvyGVfLaP
+PamI9E9lf6jXT+xm1Pns1t/xQTihRANCAATV+I7HUGF2gC+miVl3JfjpoZaU2hrZ
+QqHwKUNtIDE/uxxWNLBbYKaiLOWrbYA8skrWQWl3RkbXW4ZI28afRw9g
+-----END PRIVATE KEY-----
+`);
+  const publicKey = crypto.createPublicKey(`-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
+2UKh8ClDbSAxP7scVjSwW2Cmoizlq22APLJK1kFpd0ZG11uGSNvGn0cPYA==
+-----END PUBLIC KEY-----`);
+  const validOneShotSignature = Buffer.from(
+    '3045022100cf800e13a0ead14be0ec9d614257fb6f409187642404dccb3a43' +
+    '74ace9fc162602206bf6820b8902ae9ce4cd10708f188fddd5bc2a41db2c47' +
+    'c003ca8265a00396ae',
+    'hex');
+  const streamingOnlySignature = Buffer.from(
+    '3044022056cc3567aa4842c4b1c5f9de75059dbaf63efab5aa34097e5a85' +
+    '47419aa3175e02206deb865046f12b25f111922da6858c7e97e475b656604' +
+    '679bcd4a0b05d8c76f1',
+    'hex');
+
+  assert.strictEqual(
+    crypto.verify('sm3', data, publicKey, validOneShotSignature),
+    true);
+  assert.strictEqual(
+    crypto.verify('sm3', data, publicKey, streamingOnlySignature),
+    false);
+
+  const generatedSignature = crypto.sign('sm3', data, privateKey);
+  assert.strictEqual(
+    crypto.verify('sm3', data, publicKey, generatedSignature),
+    true);
+}
+
 {
   const data = Buffer.from('Hello world');
   const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];