Consider using SHA-256 over MD5 for the config file
silverwind opened this issue · comments
https://github.com/gulpjs/v8flags/blob/master/index.js#L19 contains a MD5 usage. When Node.js is built with FIPS compliance, that line triggers below error because MD5 is disabled in those builds:
Error: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
at new Hash (internal/crypto/hash.js:48:19)
at Object.createHash (crypto.js:109:10)
at Object.<anonymous> (node_modules/v8flags/index.js:19:89)
Consider using something more collision-resistant like SHA-256 instead.
@silverwind I'm down for that. I also assume our cacheing is fragile here because we are supposed to continue even if a cache error occurs, but that's a different problem.
It should be a simple swap of createHash('md5')
to createHash('sha256')
. SHA-256 hashes are a bit longer but you could just trim it down to the same size of MD5 if necessary using .substring(0,32)
or similar.
This seems like a reasonable request - want to send a PR @silverwind ? Should be non-breaking.
Bump, I could really use this fix in a project. It is breaking the project when enforcing FIPS when enforcing FIPS because MD5 is not FIPS compliant @silverwind @phated