René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"tlsSocket.getEphemeralKeyInfo() - doesn't display information for hybrid groups","articleBody":"### Version\n\n22.16.0\n\n### Platform\n\n```text\nLinux x 6.12.0-116.el10.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug  1 19:40:37 EDT 2025 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nTLS\n\n### What steps will reproduce the bug?\n\nBy creating a simple client and server script.\n\nCode for server.js:\n```\nconst tls = require(\"tls\");\nconst fs = require(\"fs\");\n\nconst options = {\n  key: fs.readFileSync(\"key.pem\"),\n  cert: fs.readFileSync(\"cert.pem\"),\n  maxVersion: \"TLSv1.3\",\n  ciphers: \"\", \n  ecdhCurve: \"SecP384r1MLKEM1024\",\n};\n\nconst server = tls.createServer(options, (socket) =\u003e {\n});\n\nserver.listen(8000, () =\u003e {\n});\n```\nCode for client.js:\n\n```\nconst tls = require(\"tls\");\nconst fs = require(\"fs\");\n\nconst options = {\n  ca: fs.readFileSync(\"cert.pem\"),\n  rejectUnauthorized: true,\n  servername: \"localhost\",\n  maxVersion: \"TLSv1.3\",\n  ciphers: \"\",\n  ecdhCurve: \"X25519:secp256r1:SecP384r1MLKEM1024\",\n};\n\nconst client = tls.connect(8000, \"localhost\", options, () =\u003e {\n  const ephemeralKeyInfo = client.getEphemeralKeyInfo();\n  console.log(\"Client - Ephemeral Key Info:\", ephemeralKeyInfo);\n});\n\nclient.on(\"data\", (data) =\u003e {\n  client.end();\n});\n\nclient.on(\"close\", () =\u003e {\n});\n```\n\nCommands used for generating key/cert:\n```\nopenssl genpkey -algorithm ML-DSA-44 -out key.pem\nopenssl req -x509 -new -key key.pem -out cert.pem -nodes -days 365 -subj \"/CN=localhost\"\n```\n\nand then starting the server and connecting with the client:\n```\nnode server.js \u0026 \nnode client.js\n```\n\n\n### How often does it reproduce? Is there a required condition?\n\nAlways, when following reproduction steps.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nThe standard output of getEphemeralKeyInfo() as is for non-hybrid groups.\n\nFor example if this would be the ecdhCurve option specified in the server.js:\n```\necdhCurve: 'X25519'\n```\nwhich returns this result:\n```\n[root@kvm-08-guest21 ~]# node client.js \nClient - Ephemeral Key Info: { type: 'ECDH', name: 'X25519', size: 253 }\n```\n\nSo for a hybrid-key something like this:\n`Client - Ephemeral Key Info: { type: 'Hybrid', name: 'SecP384r1MLKEM1024', size: \u003ccombined-size\u003e }\n`\n\n### What do you see instead?\n\nAn empty object is returned.\n\n```\n[root@kvm-08-guest21 ~]# node client.js \nClient - Ephemeral Key Info: {}\n```\n\n\n### Additional information\n\nI have been recently trying to verify the usage of hybrid-groups in nodejs component. Trying to verify used groups I couldn't access the information through TLS module itself and had to use openssl client.\n\nI'm testing this on distribution in which nodejs is build with the --shared-openssl configuration. \n\nSystems openssl:\n\n```\nopenssl -v\nOpenSSL 3.5.1 1 Jul 2025 (Library: OpenSSL 3.5.1 1 Jul 2025)\n```\n","author":{"url":"https://github.com/tjuhaszrh","@type":"Person","name":"tjuhaszrh"},"datePublished":"2025-08-12T10:59:27.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/59452/node/issues/59452"}