Skip to content

crypto.createPrivateKey no longer throws TypeError for missing passphrase #48881

Closed
Closed
crypto.createPrivateKey no longer throws TypeError for missing passphrase#48881
Labels
confirmed-bugIssues and PRs for confirmed bugs.cryptoIssues and PRs related to the crypto subsystem.opensslIssues and PRs related to the OpenSSL dependency.

Description

@westrik
westrik
opened on Jul 21, 2023

Version

v17.9.1

Platform

Darwin mattw-2.local 21.6.0 Darwin Kernel Version 21.6.0: Thu Jun 8 23:56:13 PDT 2023; root:xnu-8020.240.18.701.6~1/RELEASE_ARM64_T6000 arm64

Subsystem

crypto

What steps will reproduce the bug?

const key = `-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIgREdlRIrWeoCAggA
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCHRQNOtlWEzBLuFqR+vOFWBIIE
0IschnCj+ult6XpikcATM43YQPqf7m4OS3o8bsxC2Qb8pFwNbgjN5m9hem8JQnUA
336QVhwrRSkuFy4TCv6rRH5UCUEjNMeuGF0N0036AMqVzkw7KAXm/cecBb62nngz
K/r4Fw4/YIyfmFLILQVnxZ622+XF2WAOtu2VWRP6GGMFO71fZ4CGs+kcn8AN50lh
wOcGGhgeJaN249fhOfUZKSJmvyyneYc5Kzd/9SqVLEt2B5954Ivdqz/HjtQe3jVB
14yOAm3D5c4lkK5qe37LYo9NsI864oH1nt26burUaNMm1AwmPP12/+WSqhS5/o1G
zqSE/PAE16Uh4LgdlzCTgj+yQzJpNmBSePTYxJD5b7EYPAVNQrOIyL8p9d0HXU7b
VVA3PeFRdhGCg6YX4RpjVTyddpm9XuKpXm2xTSGCA/spictEuO9Py2iXH9Uf8VfT
fyK4Sm2TX1+6XtvAv0XMEocJ1lkoB99EuGIbg9zguFTE55hJyfsOlpQPRnlzfvK2
JyeXnLGzyU5g1vCjEJiT6OcLZcRC3u2FyCYnqg1Bgr4RVi9pOaul50GVDUFK2Crn
0lqCS5pPoXGlcoKmPES6/oCV9VEEH9C6BU2N6J+vjcyO/kP7VylbOT33nOkDgkjy
/y8/w/3PqFFLnEyGtIEbVu3oNGepy25WQzkSft2ROUzbCX3puAJpHFPBxcapBHaD
bOWbNc3YITxa9VtRBS/Ws3Lg07siepuBFKx1BF+qTrm3YzKzvov0ijFRDUuVH5sA
A+ggcoms/rjoN5Ubt57lY0cStm1Ot/W52Q/OWoWZj+ZHCNnnAYL7fOqsggPW0Ijb
YDjAs/VkX/cx+QaULNu/wpAOlNPLq+fSSpS1KNh2ajdK0al6FmOdG2OkiaLoJDUo
sV2bSkaMQDmdNjBAr/agyv8K0X9XrMM8ExebARXMOxXClrbZSu+Xy5nu9qxau/nq
u/WDFd561WTp2doHcsTPCALIjAZEDxzLeetPpV7neih1I8KZYQ+8Xve9AEumra7w
+XK2SK0Z1LX4JRG1pPJtEHAqPJ62TtiPONCcZaZTw6hARrm+mnIqTaGDsBEIHaHa
m7hM4E7qmkxn7pRZmkkSckpeBIeuliP444Y/vFKHPOHzdHBKir/QYf8MzfVQ5/1R
H7KvDS+hBDmTtFdRz5qsIRsMtRZfPE9F5chxI2035AsTCBB0WKlJadol7BpJDFjP
FY9AiH+PZF4gJOPnUSt89lnhLh/q6i4q6vYXySTjAV04+sdw+GXBEo3R331MtvRv
HS1LR+xd+uCmtcUfLdGEf6CT706Opd6j9kUtbgF3d1nX8/mE6U/Z5GB+4HPbzZsd
9oTBgMBdNWYKxKMJVfY4G5DE9nLtRd6CZxi6YGU1Jf5wfnkRrlGcv/pKznhcrc9f
UnxcixunUzblTH/9abg3QuvcbdJ+Lt/ACxzh/RVGXemwzwGIaeQs61g5jp9/dmHt
Fviy/kmRB1ktKTVwf8yIvZbMN4ax8W8q0jQa/vHSDToWeCEyRNH+M8OHWRMN1FjP
I23ef66np+xau/KUCZ7Er+POq9NlGHOSgIIiw4vwpiKgFup+EplztAqGdqn6AJBI
m0nlxSfszO2PZ44HYMJAQBZ++tuENwyhYPrs5YW3XV3K
-----END ENCRYPTED PRIVATE KEY-----`

require('crypto').createPrivateKey({ key })

Private key generated with:

  • openssl genrsa -aes256 -out key.pem -passout pass:password 2048

How often does it reproduce? Is there a required condition?

This issue seems to happen for any encrypted key with a missing passphrase.

What is the expected behavior? Why is that the expected behavior?

Expected createPrivateKey to throw TypeError: Passphrase required for encrypted key (ERR_MISSING_PASSPHRASE).

This is the error thrown by Node 16.14.2 when running that code:

node:internal/crypto/keys:620
    handle.init(kKeyTypePrivate, data, format, type, passphrase);
           ^

TypeError: Passphrase required for encrypted key
    at Object.createPrivateKey (node:internal/crypto/keys:620:12)
    at Object.<anonymous> (/Users/matt/repro.js:38:19)
    at Module._compile (node:internal/modules/cjs/loader:1191:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1245:10)
    at Module.load (node:internal/modules/cjs/loader:1069:32)
    at Function.Module._load (node:internal/modules/cjs/loader:904:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)
    at node:internal/main/run_main_module:22:47 {
  code: 'ERR_MISSING_PASSPHRASE'
}

What do you see instead?

createPrivateKey throws ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED instead of ERR_MISSING_PASSPHRASE .

node:internal/crypto/keys:618
    handle.init(kKeyTypePrivate, data, format, type, passphrase);
           ^

Error: error:07880109:common libcrypto routines::interrupted or cancelled
    at Object.createPrivateKey (node:internal/crypto/keys:618:12)
    at Object.<anonymous> (/Users/matt/repro.js:38:19)
    at Module._compile (node:internal/modules/cjs/loader:1099:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1153:10)
    at Module.load (node:internal/modules/cjs/loader:975:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)
    at node:internal/main/run_main_module:17:47 {
  opensslErrorStack: [
    'error:04800068:PEM routines::bad password read',
    'error:07880109:common libcrypto routines::interrupted or cancelled',
    'error:1C80009F:Provider routines::unable to get passphrase',
    'error:07880109:common libcrypto routines::interrupted or cancelled'
  ],
  library: 'common libcrypto routines',
  reason: 'interrupted or cancelled',
  code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED'
}

Node.js v17.9.1

Same thing happens with Node.js v18.17.0.

Additional information

The code path that should be throwing the TypeError still exists: https://github.com/nodejs/node/blob/v18.17.0/src/crypto/crypto_keys.cc#L828C26-L828C49, so it seems like maybe the OpenSSL upgrade changed which ParseKeyResult gets returned.

Activity

  1. bnoordhuis commented on Jul 22, 2023

    @bnoordhuis
    bnoordhuis
    on Jul 22, 2023
    Member

    Can reproduce with v19.x and v20.x. Seems like a backwards incompatible change in openssl 3.0.

    Node's PasswordCallback returns -1 when no passphrase is provided and that's the right return value according to openssl's documentation, but openssl then turns it into that "interrupted or cancelled" error.

    Returning 0 makes it return a "ui lib" error, although I'd hardly call that an improvement.

    Probably needs to be reported upstream because I don't think this is something that node controls.

    One minor weird thing is that our password callback is called twice for your test case:

    * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
  * frame #0: 0x000000010022ce90 node`node::crypto::PasswordCallback(char*, int, int, void*)
    frame #1: 0x0000000100f6ff2d node`ui_read + 141                                                                                                                                   frame #2: 0x0000000100f6eb62 node`UI_process + 290
    frame #3: 0x0000000100f11e65 node`ossl_pw_get_passphrase + 1221
    frame #4: 0x0000000100f12040 node`ossl_pw_pem_password + 112
    frame #5: 0x0000000100f6ff2d node`ui_read + 141
    frame #6: 0x0000000100f6eb62 node`UI_process + 290
    frame #7: 0x0000000100f11e65 node`ossl_pw_get_passphrase + 1221
    frame #8: 0x0000000100fbd43c node`epki2pki_decode + 284
    frame #9: 0x0000000100eb142c node`decoder_process + 924
    frame #10: 0x0000000100fbe2ec node`pem2der_decode + 1164
    frame #11: 0x0000000100eb142c node`decoder_process + 924
    frame #12: 0x0000000100eb0f68 node`OSSL_DECODER_from_bio + 296
    frame #13: 0x0000000100f2d19c node`pem_read_bio_key + 332
    frame #14: 0x0000000100f2d97a node`PEM_read_bio_PrivateKey + 26
    frame #15: 0x000000010023a945 node`node::crypto::(anonymous namespace)::ParsePrivateKey(std::__1::unique_ptr<evp_pkey_st, node::FunctionDeleter<evp_pkey_st, &(EVP_PKEY_free)>
 >*, node::crypto::PrivateKeyEncodingConfig const&, char const*, unsigned long) + 101                                                                                                 frame #16: 0x000000010023a720 node`node::crypto::ManagedEVPPKey::GetPrivateKeyFromJs(v8::FunctionCallbackInfo<v8::Value> const&, unsigned int*, bool) + 464
    frame #17: 0x000000010023bf2d node`node::crypto::KeyObjectHandle::Init(v8::FunctionCallbackInfo<v8::Value> const&) + 461
    frame #18: 0x00000001002ff958 node`v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8:
:internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, unsigned long*, int) + 856
    frame #19: 0x00000001002fef1a node`v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) + 186

    Vs.

    * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
  * frame #0: 0x000000010022ce90 node`node::crypto::PasswordCallback(char*, int, int, void*)
    frame #1: 0x0000000100f6ff2d node`ui_read + 141
    frame #2: 0x0000000100f6eb62 node`UI_process + 290
    frame #3: 0x0000000100f11e65 node`ossl_pw_get_passphrase + 1221                                                                                                                   frame #4: 0x0000000100f12040 node`ossl_pw_pem_password + 112
    frame #5: 0x0000000100f2d53b node`pem_read_bio_key + 1259
    frame #6: 0x0000000100f2d97a node`PEM_read_bio_PrivateKey + 26
    frame #7: 0x000000010023a945 node`node::crypto::(anonymous namespace)::ParsePrivateKey(std::__1::unique_ptr<evp_pkey_st, node::FunctionDeleter<evp_pkey_st, &(EVP_PKEY_free)>
>*, node::crypto::PrivateKeyEncodingConfig const&, char const*, unsigned long) + 101
    frame #8: 0x000000010023a720 node`node::crypto::ManagedEVPPKey::GetPrivateKeyFromJs(v8::FunctionCallbackInfo<v8::Value> const&, unsigned int*, bool) + 464
    frame #9: 0x000000010023bf2d node`node::crypto::KeyObjectHandle::Init(v8::FunctionCallbackInfo<v8::Value> const&) + 461
    frame #10: 0x00000001002ff958 node`v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8:
:internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, unsigned long*, int) + 856
    frame #11: 0x00000001002fef1a node`v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) + 186

    Note how the call stack diverges starting from pem_read_bio_key.

  2. bnoordhuis
    added
    confirmed-bugIssues and PRs for confirmed bugs.
    opensslIssues and PRs related to the OpenSSL dependency.
    on Jul 22, 2023
  3. panva
    added
    cryptoIssues and PRs related to the crypto subsystem.
    on Jul 31, 2023

  4. RaisinTen commented on Aug 2, 2023

    @RaisinTen
    RaisinTen
    on Aug 2, 2023
    Member

    I remember trying to fix this in #42400 but i discontinued it

  5. jasnell commented on Apr 27, 2025

    @jasnell
    jasnell
    on Apr 27, 2025
    Member

    Given that 17.x is no longer supported and this behavior has been around for a while now, closing this in inactionable.

  6. jasnell
    closed this as completedon Apr 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    confirmed-bugIssues and PRs for confirmed bugs.cryptoIssues and PRs related to the crypto subsystem.opensslIssues and PRs related to the OpenSSL dependency.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions