Repository navigation
fix(pq): read a named ML-KEM group as post-quantum - #26
Merged
Merged
Conversation
Node 24.21 on OpenSSL 3.5.8 names the hybrid group outright
(X25519MLKEM768) instead of returning an empty object, and
describeKeyExchange read any named group as classical, so post-quantum
sessions were reported as classical. A name carrying ML-KEM or Kyber is now
post-quantum; any other name is classical; {} is still the hybrid on builds
that cannot name it.
Found and fixed by a moshcode work agent (fleet sweep); verify:
node --test ./tests/pq.test.ts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Node 24.21 / OpenSSL 3.5.8,
getEphemeralKeyInfo()names the hybrid group (X25519MLKEM768) instead of returning{}.describeKeyExchangetreated any named group as classical, so post-quantum sessions were reported as classical.tests/pq.test.tswas failing on this box.MLKEMorKyberis post-quantum. Any other name is classical.{}is still read as the hybrid, for builds that can't name it.probeDetector()still proves both halves before enforcement turns on, so on a build where this mapping is wrong, enforcement stays off as before.Found by the fleet-wide
moshcode worksweep: each real test failure went to a claude worker with that test as its verifier. Passed on attempt 1. I reviewed the patch, and the verify passes again on current main.🤖 Generated with Claude Code