Repository navigation
crypto.generateKeyPairSync() silently returns a P-256 EC key for 'rsa', 'x25519', 'dsa' and unknown types #58
Description
Test I ran
node crypto_keygen.ts
slice run crypto_keygen.tscrypto_keygen.ts
import * as crypto from "node:crypto";
const show = async (k: string, f: () => unknown) => { let v; try { v = await Promise.race([Promise.resolve().then(f), new Promise((r) => setTimeout(() => r("NEVER SETTLED (2000 ms)"), 2000))]); } catch (e: any) { v = "THROWS " + e.name + ": " + String(e.message).slice(0, 100); } console.log(k.padEnd(52) + JSON.stringify(v)); };
(async () => {
await show("generateKeyPairSync('rsa',{modulusLength:2048})", () => { const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 }); const sig = crypto.createSign("RSA-SHA256").update("m").sign(privateKey); return { asymmetricKeyType: publicKey.asymmetricKeyType, signatureBytes: sig.length, spkiDerBytes: publicKey.export({ type: "spki", format: "der" }).length, pemHeader: String(publicKey.export({ type: "spki", format: "pem" })).split("\n")[0] }; });
await show("generateKeyPairSync('ed25519') (claimed)", () => crypto.generateKeyPairSync("ed25519").publicKey.asymmetricKeyType);
await show("generateKeyPairSync('ec',{namedCurve:'P-256'}) (claimed)", () => crypto.generateKeyPairSync("ec", { namedCurve: "P-256" }).publicKey.asymmetricKeyType);
await show("generateKeyPairSync('x25519')", () => crypto.generateKeyPairSync("x25519").publicKey.asymmetricKeyType);
await show("generateKeyPairSync('dsa',{modulusLength:2048,divisorLength:256})", () => crypto.generateKeyPairSync("dsa", { modulusLength: 2048, divisorLength: 256 }).publicKey.asymmetricKeyType);
await show("generateKeyPairSync('no-such-type')", () => (crypto as any).generateKeyPairSync("no-such-type").publicKey.asymmetricKeyType);
})();Result
Node v24.22.2:
generateKeyPairSync('rsa',{modulusLength:2048}) {"asymmetricKeyType":"rsa","signatureBytes":256,"spkiDerBytes":294,"pemHeader":"-----BEGIN PUBLIC KEY-----"}
generateKeyPairSync('ed25519') (claimed) "ed25519"
generateKeyPairSync('ec',{namedCurve:'P-256'}) (claimed)"ec"
generateKeyPairSync('x25519') "x25519"
generateKeyPairSync('dsa',{modulusLength:2048,divisorLength:256})"dsa"
generateKeyPairSync('no-such-type') "THROWS TypeError: The argument 'type' must be a supported key type. Received 'no-such-type'"
Slice v0.10.7:
generateKeyPairSync('rsa',{modulusLength:2048}) {"asymmetricKeyType":"ec","signatureBytes":72,"spkiDerBytes":91,"pemHeader":"-----BEGIN PUBLIC KEY-----"}
generateKeyPairSync('ed25519') (claimed) "ed25519"
generateKeyPairSync('ec',{namedCurve:'P-256'}) (claimed)"ec"
generateKeyPairSync('x25519') "ec"
generateKeyPairSync('dsa',{modulusLength:2048,divisorLength:256})"ec"
generateKeyPairSync('no-such-type') "ec"
What is wrong
generateKeyPairSync only implements ed25519 and ec (which is what COMPATIBILITY.md claims), but for every other type it returns an EC P-256 key pair instead of throwing: 'rsa' (the ~71-byte DER signature and 91-byte SPKI are P-256), 'x25519', 'dsa', and even 'no-such-type'.
A caller that asks for an RSA-2048 key and signs with RSA-SHA256 gets an ECDSA signature that verifies locally but that no RS256 consumer (JWT libraries, webhooks, TLS tooling) will accept, with nothing indicating why. Unsupported key types should throw, as Node does for an unknown type (TypeError: The argument 'type' must be a supported key type).
Environment
- Slice
v0.10.7, commitea7c70c, built withcargo +1.96.0 build --release --locked --bin slice - Reference: Node.js
v24.22.2(same script, same machine) - Ubuntu 26.04, Linux 7.0, x86_64
- The
v0.10.5tag behaves the same.
Activity
siktec-lab commentedon Nov 11, 2026
Addressed in #67 (�0.10.11): added
sa /
sa-pss (2048-bit PKCS#8 & 294-byte SPKI DER + 256-byte RSA-SHA256 sign/verify via
ing), x25519, and dsa support to crypto.generateKeyPairSync / generateKeyPair, and added ERR_INVALID_ARG_VALUE (TypeError) validation for unsupported key types.