René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`crypto`: SM4-GCM and SM4-CCM not available despite OpenSSL 3.5 bundling the implementation","articleBody":"### What is the problem this feature will solve?\n\nSM4-GCM and SM4-CCM are documented as available in OpenSSL 3.x default provider ([EVP_CIPHER-SM4](https://docs.openssl.org/3.5/man7/EVP_CIPHER-SM4/)), and the source files (`cipher_sm4_gcm.c`, `cipher_sm4_ccm.c`) are included in Node.js's OpenSSL build (`deps/openssl/config/archs/*/openssl.gypi` and `providers/implementations/ciphers/build.info`). However, these ciphers are not registered at runtime.\n\nThis affects cross-language interoperability for projects using SM4-GCM (e.g., Java BouncyCastle) that need Node.js decryption support, and China compliance (GM/T 0002) scenarios requiring authenticated encryption with SM4.\n\n### Reproduction\n\n```javascript\nconst crypto = require('node:crypto');\n\nconsole.log('Node.js:', process.version);           // v24.18.0\nconsole.log('OpenSSL:', process.versions.openssl);   // 3.5.7\nconsole.log('FIPS:', crypto.getFips());              // 0\n\n// SM4-GCM not in getCiphers()\nconsole.log(crypto.getCiphers().filter(c => c.includes('sm4')));\n// → [ 'sm4', 'sm4-cbc', 'sm4-cfb', 'sm4-ctr', 'sm4-ecb', 'sm4-ofb' ]\n// Missing: sm4-gcm, sm4-ccm, sm4-xts\n\n// getCipherInfo returns undefined\nconsole.log(crypto.getCipherInfo('sm4-gcm'));   // → undefined\nconsole.log(crypto.getCipherInfo('sm4-cbc'));   // → { mode: 'cbc', nid: 1134, ... }\n\n// createCipheriv throws\ntry {\n  crypto.createCipheriv('sm4-gcm', Buffer.alloc(16), Buffer.alloc(12));\n} catch (e) {\n  console.log(e.message); // → \"Unknown cipher\"\n}\n```\n\n### Evidence that this is a Node.js build issue (not OpenSSL)\n\n1. **OpenSSL docs** list SM4-GCM/CCM/XTS as available in the default provider since 3.1+.\n2. **Python `cryptography` library** (linking system OpenSSL 3.x) supports SM4-GCM.\n3. **Source files are compiled**: `deps/openssl/config/archs/VC-WAN64A/no-asm/openssl.gypi` includes:\n   ```\n   'openssl/providers/implementations/ciphers/cipher_sm4_gcm.c',\n   'openssl/providers/implementations/ciphers/cipher_sm4_gcm_hw.c',\n   'openssl/providers/implementations/ciphers/cipher_sm4_ccm.c',\n   'openssl/providers/implementations/ciphers/cipher_sm4_ccm_hw.c',\n   'openssl/providers/implementations/ciphers/cipher_sm4_xts.c',\n   'openssl/providers/implementations/ciphers/cipher_sm4_xts_hw.c',\n   ```\n4. **`build.info`** includes them unconditionally (given `!$disabled{sm4}`, and SM4-CBC works).\n5. **No `no-sm4` in Configure options** (`deps/openssl/config/Makefile` COPTS).\n\n### Suspected root cause\n\nNode.js builds OpenSSL with `enable-fips`. The FIPS module build process may regenerate or filter the default provider's `OSSL_ALGORITHM` dispatch table, causing SM4-GCM/CCM/XTS registration entries to be dropped while basic SM4 modes (CBC, CTR, ECB, OFB, CFB) are retained.\n\nAdditionally, `deps/ncrypto/ncrypto.cc` line 4304 uses the legacy API:\n```cpp\nconst Cipher Cipher::FromName(const char* name) {\n  return Cipher(EVP_get_cipherbyname(name));\n}\n```\nEven if the provider registration is fixed, `EVP_get_cipherbyname()` may not resolve provider-only ciphers that lack a legacy `EVP_CIPHER` object (per [openssl/openssl#13667](https://github.com/openssl/openssl/issues/13667): \"There never will be an `evp_sm4_gcm()` function\"). A fallback to `EVP_CIPHER_fetch(NULL, name, NULL)` may be needed.\n\n### What is the feature you are proposing?\n\n1. Investigate why SM4-GCM/CCM/XTS are not registered in the default provider at runtime despite being compiled.\n2. If the `enable-fips` build path is the cause, ensure non-FIPS algorithms remain registered in the default provider.\n3. Consider adding an `EVP_CIPHER_fetch` fallback in `Cipher::FromName()` for forward compatibility with provider-only ciphers.\n\n### Environment\n\n- Node.js: v24.18.0\n- OpenSSL: 3.5.7\n- OS: Windows 11 24H2\n- FIPS mode: disabled (0)\n\n---","author":{"url":"https://github.com/emmansun","@type":"Person","name":"emmansun"},"datePublished":"2026-07-31T10:03:14Z","url":"https://github.com/nodejs/node/issues/64866"}