nodejs · panva · Sep 3, 2026
diff --git a/benchmark/crypto/create-keyobject.js b/benchmark/crypto/create-keyobject.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 

diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -24,7 +24,7 @@ if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-kem-512'] = readKeyPair('ml_kem_512_public', 'ml_kem_512_private');
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private_seed_only');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private_seed_only');
 }

diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const assert = require('node:assert');
 const {
   createHmac,
@@ -10,7 +10,7 @@ const {
 } = require('node:crypto');
 
 if (!hasOpenSSL(3) ||
-    process.features.openssl_is_boringssl ||
+    isBoringSSL ||
     typeof createMac !== 'function' ||
     typeof getMacs !== 'function') {
   console.log('Skipping: generic MAC API requires OpenSSL >= 3');

diff --git a/benchmark/crypto/oneshot-sign.js b/benchmark/crypto/oneshot-sign.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -19,7 +19,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private_seed_only');
 }
 

diff --git a/benchmark/crypto/oneshot-verify.js b/benchmark/crypto/oneshot-verify.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 

diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
@@ -4,9 +4,9 @@ const common = require('../../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../../common/crypto');
+const { hasOpenSSL } = require('../../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');

diff --git a/test/common/crypto.js b/test/common/crypto.js
@@ -123,6 +123,8 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const isBoringSSL = process.features.openssl_is_boringssl;
+
 const hasFIPS = (major = 0, minor = 0, patch = 0) => {
   return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
 };
@@ -144,6 +146,7 @@ module.exports = {
   sec1EncExp,
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },

diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = {
     'P-256': Buffer.from(
@@ -72,7 +74,7 @@ module.exports = function() {
         'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' +
         'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
           '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
@@ -104,7 +106,7 @@ module.exports = function() {
         '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' +
         '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' +
         '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
           'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
@@ -144,7 +146,7 @@ module.exports = function() {
         '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' +
         '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
           '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
@@ -170,7 +172,7 @@ module.exports = function() {
   const curves = ['P-256', 'P-384', 'P-521'];
   const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512');
   }
 

diff --git a/test/fixtures/crypto/eddsa.js b/test/fixtures/crypto/eddsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 const common = require('../../common');
 
 module.exports = function() {
@@ -46,7 +48,7 @@ module.exports = function() {
   const algorithms = ['Ed25519'];
   const contexts = [new Uint8Array(0), new Uint8Array(32), new Uint8Array(255)];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     algorithms.push('Ed448')
   } else {
     common.printSkipMessage(`Skipping unsupported Ed448 test cases`);

diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const plaintext = Buffer.from(
     '5f4dba4f320c0ce876725afce5fbd25bf83e5a7125a08cafe73c3ebac421779df9d55d' +
@@ -22,7 +24,7 @@ module.exports = function () {
       '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
       '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
         'hex'),
@@ -48,7 +50,7 @@ module.exports = function () {
       '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' +
       'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
         'hex'),

diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a50201000282' +
@@ -97,7 +99,7 @@ module.exports = function () {
       '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' +
       'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' +
       '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-256': Buffer.from(
         'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
         'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
@@ -161,7 +163,7 @@ module.exports = function () {
       plaintext,
       signature: signatures['sha-512']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,

diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
@@ -150,7 +152,7 @@ module.exports = function() {
       'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' +
       '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' +
       '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-512, no salt': Buffer.from(
         'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
         '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
@@ -255,7 +257,7 @@ module.exports = function() {
       plaintext,
       signature: signatures['sha-512, salted']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,

diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -13,8 +13,6 @@ const [ECDH, X25519] = await Promise.all([
   subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']),
 ]);
 
-const boringSSL = process.features.openssl_is_boringssl;
-
 export const vectors = {
   'encrypt': [
     [false, 'Invalid'],

diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -1,8 +1,8 @@
 import * as crypto from 'node:crypto'
 
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');

diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs
@@ -1,10 +1,10 @@
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
 const supportsContext = hasOpenSSL(3, 2);
 
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
 let X448;

diff --git a/test/fixtures/webcrypto/supports-sha3.mjs b/test/fixtures/webcrypto/supports-sha3.mjs
@@ -1,6 +1,8 @@
+import { isBoringSSL } from '../../common/crypto.js'
+
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,

diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!hasOpenSSL3)
+  if (!hasOpenSSL(3))
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
   if (common.isMacOS) {
     expect('--use-system-ca', 'B\n');

diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
@@ -10,9 +10,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 

diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
@@ -100,7 +100,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
 // ED25519
 test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // ED448
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
@@ -173,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 
   let expected = /no default digest/;
   let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || isBoringSSL) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
     expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
   }