Review requested:

• @nodejs/crypto
• @nodejs/security-wg

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @panva.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

Codecov Report

❌ Patch coverage is 84.24242% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.70%. Comparing base (b328bf7) to head (8427faf).
⚠️ Report is 6 commits behind head on main.

@@            Coverage Diff             @@
##             main   #62345      +/-   ##
==========================================
+ Coverage   89.68%   89.70%   +0.01%     
==========================================
  Files         676      676              
  Lines      206689   206807     +118     
  Branches    39579    39611      +32     
==========================================
+ Hits       185370   185507     +137     
- Misses      13450    13457       +7     
+ Partials     7869     7843      -26     

Not entirely certain how this works, will test

Not entirely certain how this works, will test

regular

crypto.sign('sha256', data, key) uses OpenSSL's EVP_DigestSign API, it hashes the input internally, then signs the resulting digest. One call does both steps.

prehashed

crypto.signDigest('sha256', digest, key) uses the lower-level EVP_PKEY_sign API, it receives an already-computed digest and goes straight for the signature. No hashing happens inside OpenSSL.

Even though the digest is already computed, OpenSSL needs to know which digest was used:

• RSA PKCS#1 v1.5, The signed payload isn't just the hash. It's DigestInfo || hash, where DigestInfo is an ASN.1 prefix encoding the digest algorithm OID. Without the algorithm, OpenSSL can't construct DigestInfo, and verifiers wouldn't know what they're looking at.

• RSA-PSS, digest algorithm feeds into both the MGF1 mask generation and the internal padding hash. OpenSSL needs it to build the PSS padding structure correctly.

• ECDSA / DSA, digest bytes are interpreted as a big integer (truncated to the curve order bit-length for ECDSA). EVP_PKEY_CTX_set_signature_md is still required by OpenSSL for consistency, even though the actual ECDSA/DSA math only operates on the raw digest bytes. This is also why signing a SHA-512 digest with P-256 (32-byte order) works fine, the integer just gets truncated.

Other key type dependant cases:

• Ed25519ph / Ed448ph, have fixed prehash requirements (SHA-512 for Ed25519ph, SHAKE256(m, 64) for Ed448ph)

• ML-DSA, has a fixed prehash construction, external mu per FIPS 204

• SLH-DSA (Pure SLH-DSA), not supported

• HashSLH-DSA, not supported