crypto: support OpenSSL STORE private keys

[panva]

Note

Work in progress

Allow createPrivateKey() to load private keys from WHATWG URL objects through configured OpenSSL STORE providers. Reject built-in STORE loaders so this does not become a generic file or network URL loader, and gate the operation with the crypto.store permission.

Mark resulting private KeyObjects as store-backed. Public rewrapping and private-key export are rejected, while provider-backed private operations use the existing EVP paths.

Add hermetic STORE/keymgmt addon coverage and wire the pkcs11-provider SoftHSM test into shared-library CI for OpenSSL 3 and newer (< 4.0 actually due to current SoftHSM incompatibility with 4.0).

Examples

Load a provider-backed private key and sign with it:

import { createPrivateKey, sign } from 'node:crypto';

const key = createPrivateKey({
  key: new URL('pkcs11:token=node;object=signing-key;type=private'),
  passphrase: process.env.PKCS11_PIN,
});

const signature = sign('sha256', Buffer.from('payload'), key);

Use the Permission Model to bootstrap one signing key and then close the STORE-loading capability:

$ node --permission --allow-crypto-store app.mjs

import { createPrivateKey, sign } from 'node:crypto';

console.log(process.permission.has('crypto.store')); // true

const signingKey = createPrivateKey({
  key: new URL('pkcs11:token=node;object=signing-key;type=private'),
  passphrase: process.env.PKCS11_PIN,
});

process.permission.drop('crypto.store');
console.log(process.permission.has('crypto.store')); // false

export function signPayload(payload) {
  return sign('sha256', payload, signingKey);
}

Use a provider-backed private key with WebCrypto as a non-extractable CryptoKey:

import { createPrivateKey } from 'node:crypto';

const key = createPrivateKey({
  key: new URL('pkcs11:token=node;object=ed25519-key;type=private'),
  passphrase: process.env.PKCS11_PIN,
});

const cryptoKey = key.toCryptoKey('Ed25519', false, ['sign']);

const signature = await crypto.subtle.sign(
  'Ed25519',
  cryptoKey,
  new TextEncoder().encode('payload'),
);

[nodejs-github-bot]

Review requested:

• @nodejs/actions
• @nodejs/config
• @nodejs/crypto
• @nodejs/gyp
• @nodejs/security-wg