René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Crypto cant sign/verify prehashed inputs","articleBody":"### Version\n\nNode.js v22.20.0 - Node.js v24.10.0\n\n### Platform\n\n```text\nall\n```\n\n### Subsystem\n\ncrypto\n\n### What steps will reproduce the bug?\n```js\nconst crypto = require('crypto');\n\nconst message\t\t \t= Buffer.from('LmM8PqCO1QIpTse0s+MQEJ7YXOSZuqyjPCJ4tIZ+OrU=', 'base64'),\n\t\t\tprehash \t \t= crypto.createHash('sha256').update(message).digest();\n\nconst namedCurve \t= 'secp256k1',\n\t\t\tkeyPair \t \t= crypto.generateKeyPairSync('ec', { namedCurve }),\n\t\t\tsignature\t\t= crypto.sign(null, prehash, {\n\t\t\t\t\t\t\t\t\t\t\tkey\t\t\t\t\t: keyPair.privateKey,\n\t\t\t\t\t\t\t\t\t\t\tdsaEncoding\t: 'ieee-p1363'\n\t\t\t\t\t\t\t\t\t\t});\n\nconsole.log(crypto.verify(null, message, {\n\tkey\t\t\t\t\t: keyPair.publicKey,\n\tdsaEncoding\t: 'ieee-p1363'\n}, signature), ' message internal-internal (must be false)');\n\nconsole.log(crypto.verify(null, prehash, {\n\tkey\t\t\t\t\t: keyPair.publicKey,\n\tdsaEncoding\t: 'ieee-p1363'\n}, signature), ' prehash internal-internal (must be true)');\n\n// Simple unitary test:\nconst PUBLIC_KEY_PEM = '-----BEGIN PUBLIC KEY-----\\n' +\n\t\t\t\t\t\t\t\t\t\t \t'MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE6Yvel06IICYJZ/XsuPEFTpDt0aU8dwLK\\n' +\n\t\t\t\t\t\t\t\t\t\t \t'jvgxyYTeZ/vlS49/PDRIr5JDz+QNWFB9ZM9tf4i9SdT0LVtlgRj3dQ==\\n' +\n\t\t\t\t\t\t\t\t\t\t \t'-----END PUBLIC KEY-----',\n\t\t\tpublicKey \t\t = crypto.createPublicKey(PUBLIC_KEY_PEM),\n\t\t\tsignOfPreHash  = Buffer.from('Djv4wD3eWu8lHI3DrN2Dypdrirj+J1rfJD5O1B/Tw8sYy38jms77neECQ0S9LHpnWun+Jb9iOZNbYjH+CoVUnA==', 'base64');\n\nconsole.log('== BUG HERE ==');\n\nconsole.log(crypto.verify(null, message, {\n\tkey\t\t\t\t\t: publicKey,\n\tdsaEncoding\t: 'ieee-p1363'\n}, signOfPreHash), ' message external-internal (must be false)');\n\nconsole.log(crypto.verify(null, prehash, {\n\tkey\t\t\t\t\t: publicKey,\n\tdsaEncoding\t: 'ieee-p1363'\n}, signOfPreHash), ' prehash external-internal (must be true)');\n```\n### How often does it reproduce? Is there a required condition?\n\nNo precondition required.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nWhen send null to algorithm param i expect that message payload be raw, prehashed, dont want an additional internal rehash. This make impossible verify or sign keeping compatibility with external systems.\n\n### What do you see instead?\n\ncrypto module ignore my null and place a sha256 algorithm instead, performing a double hash internally.\n\n### Additional information\n\nMany external systems provide hash + signarure to verify, but we cannot do this because the implicit rehash of crypto module.","author":{"url":"https://github.com/codermapuche","@type":"Person","name":"codermapuche"},"datePublished":"2025-10-15T11:36:13.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/60263/node/issues/60263"}