chore: block js RSA-OAEP padding combination on FIPS

Author: adamjmcgrath

lib/oaep.js

@@ -1,5 +1,19 @@
 var crypto = require('crypto');
 
+// CRYPTO MODULE (non-FIPS-validated)
+// This file hand-rolls the RSA-OAEP padding (EME-OAEP encode/decode, RFC 8017
+// §7.1) in JavaScript. It exists only to express the OAEP-digest / MGF1-digest combinations
+// that Node's `crypto` cannot. Because the padding is computed here rather than inside OpenSSL,
+// this is not a FIPS valid code path.
+
+function assertShimAllowed() {
+  if (typeof crypto.getFips === 'function' && crypto.getFips()) {
+    var err = new Error('unsupported cryptographic operation');
+    err.code = 'ERR_XMLENC_FIPS_UNSUPPORTED';
+    throw err;
+  }
+}
+
 // MGF1 mask generation function (RFC 8017 B.2.1).
 function mgf1(seed, length, hash) {
   var hLen = crypto.createHash(hash).digest().length;
@@ -30,6 +44,7 @@ function decodingError() {
 // chosen independently. Node's privateDecrypt cannot express that combination:
 // it only sets the OAEP digest, and OpenSSL then defaults MGF1 to match it.
 function privateDecryptOaep(privateKey, ciphertext, options) {
+  assertShimAllowed();
   var opts = options || {};
   var oaepHash = opts.oaepHash || 'sha1';
   var mgf1Hash = opts.mgf1Hash || oaepHash;
@@ -84,6 +99,7 @@ function privateDecryptOaep(privateKey, ciphertext, options) {
 
 // EME-OAEP-ENCODE (RFC 8017 7.1.1) followed by the raw RSA public operation.
 function publicEncryptOaep(publicKey, message, options) {
+  assertShimAllowed();
   var opts = options || {};
   var oaepHash = opts.oaepHash || 'sha1';
   var mgf1Hash = opts.mgf1Hash || oaepHash;

test/oaep.js

@@ -1,5 +1,6 @@
 var assert = require('assert');
 var crypto = require('crypto');
+var sinon = require('sinon');
 var oaep = require('../lib/oaep');
 
 // Throwaway 2048-bit key + ciphertext from the ESD-63620 repro. Produced by:
@@ -148,6 +149,39 @@ describe('oaep', function () {
     });
   });
 
+  describe('FIPS mode gate', function () {
+    var fs = require('fs');
+    var pub = fs.readFileSync(__dirname + '/test-auth0_rsa.pub');
+    var key = fs.readFileSync(__dirname + '/test-auth0.key');
+
+    afterEach(function () {
+      sinon.restore();
+    });
+
+    it('refuses publicEncryptOaep when FIPS mode is enabled', function () {
+      sinon.stub(crypto, 'getFips').returns(1);
+      assert.throws(function () {
+        oaep.publicEncryptOaep(pub, Buffer.from('test'), { oaepHash: 'sha256', mgf1Hash: 'sha1' });
+      }, function (e) { return e.code === 'ERR_XMLENC_FIPS_UNSUPPORTED'; });
+    });
+
+    it('refuses privateDecryptOaep when FIPS mode is enabled', function () {
+      // Encrypt outside FIPS, then assert decrypt is blocked under FIPS.
+      var ct = oaep.publicEncryptOaep(pub, Buffer.from('test'), { oaepHash: 'sha256', mgf1Hash: 'sha1' });
+      sinon.stub(crypto, 'getFips').returns(1);
+      assert.throws(function () {
+        oaep.privateDecryptOaep(key, ct, { oaepHash: 'sha256', mgf1Hash: 'sha1' });
+      }, function (e) { return e.code === 'ERR_XMLENC_FIPS_UNSUPPORTED'; });
+    });
+
+    it('runs normally when FIPS mode is disabled', function () {
+      sinon.stub(crypto, 'getFips').returns(0);
+      var ct = oaep.publicEncryptOaep(pub, Buffer.from('test'), { oaepHash: 'sha256', mgf1Hash: 'sha1' });
+      var pt = oaep.privateDecryptOaep(key, ct, { oaepHash: 'sha256', mgf1Hash: 'sha1' });
+      assert.equal(pt.toString(), 'test');
+    });
+  });
+
   describe('mgf1', function () {
     it('matches the RFC 8017 counter construction for one block', function () {
       var seed = Buffer.from('abc');