Repository navigation
Please port ncrypto from deprecated HMAC_ apis to EVP_MAC apis #59493
Description
deps/ncrypto/ncrypto.cc currently uses HMAC_ apis.
These APIs are widely available in multiple openssl-like implementations.
In OpenSSL however they are deprecated and by-pass provider framework, as well as potentially hardware acceleration.
These APIs will be removed, please consider switching to EVP_MAC APIs instead.
Activity
jasnell commentedon Aug 17, 2025
We have to keep in mind that Node.js still has a requirement to support OpenSSL 1.1.1 for the time being. I think we can certainly support the newer APIs but I'm not sure we can completely eliminate the origin
HMAC_apis just yet. It's something I'll investigate tho.xnox commentedon Aug 17, 2025
Yeah, that is the common theme - dotnet and python are in the same situation.
xnox commentedon Oct 20, 2025
I see that KMAC was added with EVPMAC support; thus it is possible there is enough ncrytpo.cc bits to actually implement crypto_hmac.cc with EVPMac
github-actions commentedon May 19, 2026
This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
xnox commentedon May 19, 2026
this is still desired.
nginx, python, dotnet all moved to support evp mac API in addition to the older HMAC API to gain support for openssl 4.0.
crypto: use EVP_MAC for HMAC on OpenSSL >=3
crypto: use EVP_MAC for HMAC on OpenSSL >=3
crypto: use EVP_MAC for HMAC on OpenSSL >=3
crypto: use EVP_MAC for HMAC on OpenSSL >=3
crypto: use EVP_MAC for HMAC on OpenSSL >=3