breaks on Node 17.x

[belveder79]

After moving forward with the Armbian installation, the flow is broken on a newer Node version. The crypto modules seems to require a different setup and I don't really know how to fix it.

In the init node, this line gives an error (round line 585 or so):
ccm.sdh = crypto.createDiffieHellman(ccm.primehex, 'hex', 5);

"Error: error:0280007E:Diffie-Hellman routines::modulus too small"

This seems to be related to a comment I found about new requirement from openssl regarding key length:

https://www.mail-archive.com/[email protected]/msg1822399.html

Since I don't exactly know what this prime stuff is, I was not able to fix it. Any ideas?

[belveder79]

just as a note on the side, I tried to use a different library following this link but I greatly failed...

[btsimonh]

does it work on, e.g. node 12?
Or is it the underlying libraries, installed with the OS?

[belveder79]

I suspect it works even with node 14, but I'm reluctant to try without breaking the system-wide distributor-driven installation. As far as I understand it has to do with the underlying crypto library linked into node, which has undergone some adaptions to comply with openssl 3.0.

I'm not a crypto-guy whatsoever, but this is what I understand:
The major requirement with respect to the Handshake to these camera APIs is that you need to use Diffie-Hellman with 120-bit primes (that's why you have the leading zeros 00 to make them 128-bit in the code). It seems that they finally dropped support for this and that for DH you now need at least 248-bit primes. That's why DH-related codes fail and - again to my limited understanding - it would be required to change the DH-computation to a different library, as simply increasing the keys with leading zeros does not work with the current and future crypto libs...

[belveder79]

btw, using something like passing --openssl-legacy-provider as argument to node when starting does not work for me...

[btsimonh]

maybe try using https://github.com/brix/crypto-js - as long it's not going to just pass through ALL the native functions, it may just solve it.