Blame SOURCES/0002-Revert-new-options-using-unsupported-OpenSSL-feature.patch

e23d3e
From 0c7e5df7fecc76f64b45c3267c851eff2ac8c496 Mon Sep 17 00:00:00 2001
e23d3e
From: Zuzana Svetlikova <zsvetlik@redhat.com>
e23d3e
Date: Wed, 19 Feb 2020 09:45:19 +0000
e23d3e
Subject: [PATCH 2/4] revert new features
e23d3e
e23d3e
---
e23d3e
 doc/api/crypto.md                           |  24 ---
e23d3e
 doc/api/errors.md                           |   5 -
e23d3e
 doc/api/https.md                            |  25 ---
e23d3e
 doc/api/tls.md                              | 117 +-----------
e23d3e
 doc/node.1                                  |   5 -
e23d3e
 lib/_http_agent.js                          |  24 +--
e23d3e
 lib/_tls_common.js                          |  13 --
e23d3e
 lib/_tls_wrap.js                            | 143 +--------------
e23d3e
 lib/internal/crypto/cipher.js               |  10 +-
e23d3e
 lib/internal/crypto/sig.js                  |  37 +---
e23d3e
 src/env.h                                   |  13 +-
e23d3e
 src/node_crypto.cc                          | 266 +---------------------------
e23d3e
 src/node_crypto.h                           |  24 +--
e23d3e
 src/node_errors.h                           |   2 -
e23d3e
 src/node_options.cc                         |   4 -
e23d3e
 src/node_options.h                          |   1 -
e23d3e
 src/tls_wrap.cc                             | 134 --------------
e23d3e
 src/tls_wrap.h                              |  17 --
e23d3e
 test/fixtures/rsa-oaep-test-vectors.js      |  30 ----
e23d3e
 test/parallel/test-crypto-rsa-dsa.js        |  65 +++++--
e23d3e
 test/parallel/test-crypto-sign-verify.js    |  90 ++--------
e23d3e
 test/parallel/test-https-agent-keylog.js    |  44 -----
e23d3e
 test/parallel/test-tls-enable-keylog-cli.js |  57 ------
e23d3e
 test/parallel/test-tls-getcipher.js         |   4 -
e23d3e
 test/parallel/test-tls-keylog-tlsv13.js     |  10 +-
e23d3e
 test/parallel/test-tls-multi-key.js         |   2 -
e23d3e
 test/parallel/test-tls-multi-pfx.js         |   2 -
e23d3e
 test/parallel/test-tls-psk-circuit.js       |  72 --------
e23d3e
 test/parallel/test-tls-psk-errors.js        |  32 ----
e23d3e
 test/parallel/test-tls-psk-server.js        |  77 --------
e23d3e
 test/parallel/test-tls-set-sigalgs.js       |  74 --------
e23d3e
 test/sequential/test-tls-psk-client.js      |  96 ----------
e23d3e
 32 files changed, 87 insertions(+), 1432 deletions(-)
e23d3e
 delete mode 100644 test/fixtures/rsa-oaep-test-vectors.js
e23d3e
 delete mode 100644 test/parallel/test-https-agent-keylog.js
e23d3e
 delete mode 100644 test/parallel/test-tls-enable-keylog-cli.js
e23d3e
 delete mode 100644 test/parallel/test-tls-psk-circuit.js
e23d3e
 delete mode 100644 test/parallel/test-tls-psk-errors.js
e23d3e
 delete mode 100644 test/parallel/test-tls-psk-server.js
e23d3e
 delete mode 100644 test/parallel/test-tls-set-sigalgs.js
e23d3e
 delete mode 100644 test/sequential/test-tls-psk-client.js
e23d3e
e23d3e
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
e23d3e
index f727d6f..7e74977 100644
e23d3e
--- a/doc/api/crypto.md
e23d3e
+++ b/doc/api/crypto.md
e23d3e
@@ -1405,7 +1405,6 @@ changes:
e23d3e
 -->
e23d3e
 
e23d3e
 * `privateKey` {Object | string | Buffer | KeyObject}
e23d3e
-  * `dsaEncoding` {string}
e23d3e
   * `padding` {integer}
e23d3e
   * `saltLength` {integer}
e23d3e
 * `outputEncoding` {string} The [encoding][] of the return value.
e23d3e
@@ -1418,10 +1417,6 @@ If `privateKey` is not a [`KeyObject`][], this function behaves as if
e23d3e
 `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an
e23d3e
 object, the following additional properties can be passed:
e23d3e
 
e23d3e
-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the
e23d3e
-  format of the generated signature. It can be one of the following:
e23d3e
-  * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`.
e23d3e
-  * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363.
e23d3e
 * `padding` {integer} Optional padding value for RSA, one of the following:
e23d3e
   * `crypto.constants.RSA_PKCS1_PADDING` (default)
e23d3e
   * `crypto.constants.RSA_PKCS1_PSS_PADDING`
e23d3e
@@ -1518,7 +1513,6 @@ changes:
e23d3e
 -->
e23d3e
 
e23d3e
 * `object` {Object | string | Buffer | KeyObject}
e23d3e
-  * `dsaEncoding` {string}
e23d3e
   * `padding` {integer}
e23d3e
   * `saltLength` {integer}
e23d3e
 * `signature` {string | Buffer | TypedArray | DataView}
e23d3e
@@ -1532,10 +1526,6 @@ If `object` is not a [`KeyObject`][], this function behaves as if
e23d3e
 `object` had been passed to [`crypto.createPublicKey()`][]. If it is an
e23d3e
 object, the following additional properties can be passed:
e23d3e
 
e23d3e
-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the
e23d3e
-  format of the generated signature. It can be one of the following:
e23d3e
-  * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`.
e23d3e
-  * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363.
e23d3e
 * `padding` {integer} Optional padding value for RSA, one of the following:
e23d3e
   * `crypto.constants.RSA_PKCS1_PADDING` (default)
e23d3e
   * `crypto.constants.RSA_PKCS1_PSS_PADDING`
e23d3e
@@ -2427,9 +2417,6 @@ An array of supported digest functions can be retrieved using
e23d3e
 
e23d3e
 added: v0.11.14
e23d3e
 changes:
e23d3e
-  - version: v12.11.0
e23d3e
-    pr-url: https://github.com/nodejs/node/pull/29489
e23d3e
-    description: The `oaepLabel` option was added.
e23d3e
   - version: v12.9.0
e23d3e
     pr-url: https://github.com/nodejs/node/pull/28335
e23d3e
     description: The `oaepHash` option was added.
e23d3e
@@ -2514,9 +2501,6 @@ be passed instead of a public key.
e23d3e
 
e23d3e
 added: v0.11.14
e23d3e
 changes:
e23d3e
-  - version: v12.11.0
e23d3e
-    pr-url: https://github.com/nodejs/node/pull/29489
e23d3e
-    description: The `oaepLabel` option was added.
e23d3e
   - version: v12.9.0
e23d3e
     pr-url: https://github.com/nodejs/node/pull/28335
e23d3e
     description: The `oaepHash` option was added.
e23d3e
@@ -2900,10 +2884,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
e23d3e
 passed to [`crypto.createPrivateKey()`][]. If it is an object, the following
e23d3e
 additional properties can be passed:
e23d3e
 
e23d3e
-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the
e23d3e
-  format of the generated signature. It can be one of the following:
e23d3e
-  * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`.
e23d3e
-  * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363.
e23d3e
 * `padding` {integer} Optional padding value for RSA, one of the following:
e23d3e
   * `crypto.constants.RSA_PKCS1_PADDING` (default)
e23d3e
   * `crypto.constants.RSA_PKCS1_PSS_PADDING`
e23d3e
@@ -2957,10 +2937,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
e23d3e
 passed to [`crypto.createPublicKey()`][]. If it is an object, the following
e23d3e
 additional properties can be passed:
e23d3e
 
e23d3e
-* `dsaEncoding` {string} For DSA and ECDSA, this option specifies the
e23d3e
-  format of the generated signature. It can be one of the following:
e23d3e
-  * `'der'` (default): DER-encoded ASN.1 signature structure encoding `(r, s)`.
e23d3e
-  * `'ieee-p1363'`: Signature format `r || s` as proposed in IEEE-P1363.
e23d3e
 * `padding` {integer} Optional padding value for RSA, one of the following:
e23d3e
   * `crypto.constants.RSA_PKCS1_PADDING` (default)
e23d3e
   * `crypto.constants.RSA_PKCS1_PSS_PADDING`
e23d3e
diff --git a/doc/api/errors.md b/doc/api/errors.md
e23d3e
index 7cf3496..32ba4ec 100644
e23d3e
--- a/doc/api/errors.md
e23d3e
+++ b/doc/api/errors.md
e23d3e
@@ -1849,11 +1849,6 @@ vector for denial-of-service attacks.
e23d3e
 An attempt was made to issue Server Name Indication from a TLS server-side
e23d3e
 socket, which is only valid from a client.
e23d3e
 
e23d3e
-
e23d3e
-### ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED
e23d3e
-
e23d3e
-Failed to set PSK identity hint. Hint may be too long.
e23d3e
-
e23d3e
 
e23d3e
 ### `ERR_TRACE_EVENTS_CATEGORY_REQUIRED`
e23d3e
 
e23d3e
diff --git a/doc/api/https.md b/doc/api/https.md
e23d3e
index bb0322d..e82ffa2 100644
e23d3e
--- a/doc/api/https.md
e23d3e
+++ b/doc/api/https.md
e23d3e
@@ -45,31 +45,6 @@ changes:
e23d3e
 
e23d3e
     See [`Session Resumption`][] for information about TLS session reuse.
e23d3e
 
e23d3e
-#### Event: `'keylog'`
e23d3e
-
e23d3e
-added: v12.16.0
e23d3e
--->
e23d3e
-
e23d3e
-* `line` {Buffer} Line of ASCII text, in NSS `SSLKEYLOGFILE` format.
e23d3e
-* `tlsSocket` {tls.TLSSocket} The `tls.TLSSocket` instance on which it was
e23d3e
-  generated.
e23d3e
-
e23d3e
-The `keylog` event is emitted when key material is generated or received by a
e23d3e
-connection managed by this agent (typically before handshake has completed, but
e23d3e
-not necessarily). This keying material can be stored for debugging, as it
e23d3e
-allows captured TLS traffic to be decrypted. It may be emitted multiple times
e23d3e
-for each socket.
e23d3e
-
e23d3e
-A typical use case is to append received lines to a common text file, which is
e23d3e
-later used by software (such as Wireshark) to decrypt the traffic:
e23d3e
-
e23d3e
-```js
e23d3e
-// ...
e23d3e
-https.globalAgent.on('keylog', (line, tlsSocket) => {
e23d3e
-  fs.appendFileSync('/tmp/ssl-keys.log', line, { mode: 0o600 });
e23d3e
-});
e23d3e
-```
e23d3e
-
e23d3e
 ## Class: `https.Server`
e23d3e
 
e23d3e
 added: v0.3.4
e23d3e
diff --git a/doc/api/tls.md b/doc/api/tls.md
e23d3e
index 2eaaab5..61dc459 100644
e23d3e
--- a/doc/api/tls.md
e23d3e
+++ b/doc/api/tls.md
e23d3e
@@ -118,40 +118,6 @@ SNI (Server Name Indication) are TLS handshake extensions:
e23d3e
 * SNI: Allows the use of one TLS server for multiple hostnames with different
e23d3e
   SSL certificates.
e23d3e
 
e23d3e
-### Pre-shared keys
e23d3e
-
e23d3e
-
e23d3e
-
e23d3e
-TLS-PSK support is available as an alternative to normal certificate-based
e23d3e
-authentication. It uses a pre-shared key instead of certificates to
e23d3e
-authenticate a TLS connection, providing mutual authentication.
e23d3e
-TLS-PSK and public key infrastructure are not mutually exclusive. Clients and
e23d3e
-servers can accommodate both, choosing either of them during the normal cipher
e23d3e
-negotiation step.
e23d3e
-
e23d3e
-TLS-PSK is only a good choice where means exist to securely share a
e23d3e
-key with every connecting machine, so it does not replace PKI
e23d3e
-(Public Key Infrastructure) for the majority of TLS uses.
e23d3e
-The TLS-PSK implementation in OpenSSL has seen many security flaws in
e23d3e
-recent years, mostly because it is used only by a minority of applications.
e23d3e
-Please consider all alternative solutions before switching to PSK ciphers.
e23d3e
-Upon generating PSK it is of critical importance to use sufficient entropy as
e23d3e
-discussed in [RFC 4086][]. Deriving a shared secret from a password or other
e23d3e
-low-entropy sources is not secure.
e23d3e
-
e23d3e
-PSK ciphers are disabled by default, and using TLS-PSK thus requires explicitly
e23d3e
-specifying a cipher suite with the `ciphers` option. The list of available
e23d3e
-ciphers can be retrieved via `openssl ciphers -v 'PSK'`. All TLS 1.3
e23d3e
-ciphers are eligible for PSK but currently only those that use SHA256 digest are
e23d3e
-supported they can be retrieved via `openssl ciphers -v -s -tls1_3 -psk`.
e23d3e
-
e23d3e
-According to the [RFC 4279][], PSK identities up to 128 bytes in length and
e23d3e
-PSKs up to 64 bytes in length must be supported. As of OpenSSL 1.1.0
e23d3e
-maximum identity size is 128 bytes, and maximum PSK length is 256 bytes.
e23d3e
-
e23d3e
-The current implementation doesn't support asynchronous PSK callbacks due to the
e23d3e
-limitations of the underlying OpenSSL API.
e23d3e
-
e23d3e
 ### Client-initiated renegotiation attack mitigation
e23d3e
 
e23d3e
 
e23d3e
@@ -861,27 +827,16 @@ changes:
e23d3e
     pr-url: https://github.com/nodejs/node/pull/26625
e23d3e
     description: Return the minimum cipher version, instead of a fixed string
e23d3e
       (`'TLSv1/SSLv3'`).
e23d3e
-  - version: v12.16.0
e23d3e
-    pr-url: https://github.com/nodejs/node/pull/30637
e23d3e
-    description: Return the IETF cipher name as `standardName`.
e23d3e
 -->
e23d3e
 
e23d3e
 * Returns: {Object}
e23d3e
-  * `name` {string} OpenSSL name for the cipher suite.
e23d3e
-  * `standardName` {string} IETF name for the cipher suite.
e23d3e
+  * `name` {string} The name of the cipher suite.
e23d3e
   * `version` {string} The minimum TLS protocol version supported by this cipher
e23d3e
     suite.
e23d3e
 
e23d3e
 Returns an object containing information on the negotiated cipher suite.
e23d3e
 
e23d3e
-For example:
e23d3e
-```json
e23d3e
-{
e23d3e
-    "name": "AES128-SHA256",
e23d3e
-    "standardName": "TLS_RSA_WITH_AES_128_CBC_SHA256",
e23d3e
-    "version": "TLSv1.2"
e23d3e
-}
e23d3e
-```
e23d3e
+For example: `{ name: 'AES256-SHA', version: 'TLSv1.2' }`.
e23d3e
 
e23d3e
 See
e23d3e
 [SSL_CIPHER_get_name](https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html)
e23d3e
@@ -1082,18 +1037,6 @@ See [Session Resumption][] for more information.
e23d3e
 Note: `getSession()` works only for TLSv1.2 and below. For TLSv1.3, applications
e23d3e
 must use the [`'session'`][] event (it also works for TLSv1.2 and below).
e23d3e
 
e23d3e
-### `tlsSocket.getSharedSigalgs()`
e23d3e
-
e23d3e
-added: v12.11.0
e23d3e
--->
e23d3e
-
e23d3e
-* Returns: {Array} List of signature algorithms shared between the server and
e23d3e
-the client in the order of decreasing preference.
e23d3e
-
e23d3e
-See
e23d3e
-[SSL_get_shared_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html)
e23d3e
-for more information.
e23d3e
-
e23d3e
 ### `tlsSocket.getTLSTicket()`
e23d3e
 
e23d3e
 added: v0.11.4
e23d3e
@@ -1241,9 +1184,6 @@ being issued by trusted CA (`options.ca`).
e23d3e
 
e23d3e
 added: v0.11.3
e23d3e
 changes:
e23d3e
-  - version: v12.16.0
e23d3e
-    pr-url: https://github.com/nodejs/node/pull/23188
e23d3e
-    description: The `pskCallback` option is now supported.
e23d3e
   - version: v12.9.0
e23d3e
     pr-url: https://github.com/nodejs/node/pull/27836
e23d3e
     description: Support the `allowHalfOpen` option.
e23d3e
@@ -1295,23 +1235,6 @@ changes:
e23d3e
     verified against the list of supplied CAs. An `'error'` event is emitted if
e23d3e
     verification fails; `err.code` contains the OpenSSL error code. **Default:**
e23d3e
     `true`.
e23d3e
-  * `pskCallback` {Function}
e23d3e
-    * hint: {string} optional message sent from the server to help client
e23d3e
-      decide which identity to use during negotiation.
e23d3e
-      Always `null` if TLS 1.3 is used.
e23d3e
-    * Returns: {Object} in the form
e23d3e
-      `{ psk: <Buffer|TypedArray|DataView>, identity: <string> }`
e23d3e
-      or `null` to stop the negotiation process. `psk` must be
e23d3e
-      compatible with the selected cipher's digest.
e23d3e
-      `identity` must use UTF-8 encoding.
e23d3e
-    When negotiating TLS-PSK (pre-shared keys), this function is called
e23d3e
-    with optional identity `hint` provided by the server or `null`
e23d3e
-    in case of TLS 1.3 where `hint` was removed.
e23d3e
-    It will be necessary to provide a custom `tls.checkServerIdentity()`
e23d3e
-    for the connection as the default one will try to check hostname/IP
e23d3e
-    of the server against the certificate but that's not applicable for PSK
e23d3e
-    because there won't be a certificate present.
e23d3e
-    More information can be found in the [RFC 4279][].
e23d3e
   * `ALPNProtocols`: {string[]|Buffer[]|TypedArray[]|DataView[]|Buffer|
e23d3e
     TypedArray|DataView}
e23d3e
     An array of strings, `Buffer`s or `TypedArray`s or `DataView`s, or a
e23d3e
@@ -1427,10 +1350,6 @@ changes:
e23d3e
     pr-url: https://github.com/nodejs/node/pull/28973
e23d3e
     description: Added `privateKeyIdentifier` and `privateKeyEngine` options
e23d3e
                  to get private key from an OpenSSL engine.
e23d3e
-  - version: v12.11.0
e23d3e
-    pr-url: https://github.com/nodejs/node/pull/29598
e23d3e
-    description: Added `sigalgs` option to override supported signature
e23d3e
-                 algorithms.
e23d3e
   - version: v12.0.0
e23d3e
     pr-url: https://github.com/nodejs/node/pull/26209
e23d3e
     description: TLSv1.3 support added.
e23d3e
@@ -1491,12 +1410,6 @@ changes:
e23d3e
     order as their private keys in `key`. If the intermediate certificates are
e23d3e
     not provided, the peer will not be able to validate the certificate, and the
e23d3e
     handshake will fail.
e23d3e
-  * `sigalgs` {string} Colon-separated list of supported signature algorithms.
e23d3e
-    The list can contain digest algorithms (`SHA256`, `MD5` etc.), public key
e23d3e
-    algorithms (`RSA-PSS`, `ECDSA` etc.), combination of both (e.g
e23d3e
-    'RSA+SHA384') or TLS v1.3 scheme names (e.g. `rsa_pss_pss_sha512`).
e23d3e
-    See [OpenSSL man pages](https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_sigalgs_list.html)
e23d3e
-    for more info.
e23d3e
   * `ciphers` {string} Cipher suite specification, replacing the default. For
e23d3e
     more information, see [modifying the default cipher suite][]. Permitted
e23d3e
     ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be
e23d3e
@@ -1647,30 +1560,8 @@ changes:
e23d3e
     provided the default callback with high-level API will be used (see below).
e23d3e
   * `ticketKeys`: {Buffer} 48-bytes of cryptographically strong pseudo-random
e23d3e
     data. See [Session Resumption][] for more information.
e23d3e
-  * `pskCallback` {Function}
e23d3e
-    * socket: {tls.TLSSocket} the server [`tls.TLSSocket`][] instance for
e23d3e
-      this connection.
e23d3e
-    * identity: {string} identity parameter sent from the client.
e23d3e
-    * Returns: {Buffer|TypedArray|DataView} pre-shared key that must either be
e23d3e
-      a buffer or `null` to stop the negotiation process. Returned PSK must be
e23d3e
-      compatible with the selected cipher's digest.
e23d3e
-    When negotiating TLS-PSK (pre-shared keys), this function is called
e23d3e
-    with the identity provided by the client.
e23d3e
-    If the return value is `null` the negotiation process will stop and an
e23d3e
-    "unknown_psk_identity" alert message will be sent to the other party.
e23d3e
-    If the server wishes to hide the fact that the PSK identity was not known,
e23d3e
-    the callback must provide some random data as `psk` to make the connection
e23d3e
-    fail with "decrypt_error" before negotiation is finished.
e23d3e
-    PSK ciphers are disabled by default, and using TLS-PSK thus
e23d3e
-    requires explicitly specifying a cipher suite with the `ciphers` option.
e23d3e
-    More information can be found in the [RFC 4279][].
e23d3e
-  * `pskIdentityHint` {string} optional hint to send to a client to help
e23d3e
-    with selecting the identity during TLS-PSK negotiation. Will be ignored
e23d3e
-    in TLS 1.3. Upon failing to set pskIdentityHint `'tlsClientError'` will be
e23d3e
-    emitted with `'ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED'` code.
e23d3e
   * ...: Any [`tls.createSecureContext()`][] option can be provided. For
e23d3e
-    servers, the identity options (`pfx`, `key`/`cert` or `pskCallback`)
e23d3e
-    are usually required.
e23d3e
+    servers, the identity options (`pfx` or `key`/`cert`) are usually required.
e23d3e
   * ...: Any [`net.createServer()`][] option can be provided.
e23d3e
 * `secureConnectionListener` {Function}
e23d3e
 * Returns: {tls.Server}
e23d3e
@@ -1946,5 +1837,3 @@ where `secureSocket` has the same API as `pair.cleartext`.
e23d3e
 [cipher list format]: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html#CIPHER-LIST-FORMAT
e23d3e
 [modifying the default cipher suite]: #tls_modifying_the_default_tls_cipher_suite
e23d3e
 [specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html
e23d3e
-[RFC 4279]: https://tools.ietf.org/html/rfc4279
e23d3e
-[RFC 4086]: https://tools.ietf.org/html/rfc4086
e23d3e
diff --git a/doc/node.1 b/doc/node.1
e23d3e
index 675bfc9..ff31555 100644
e23d3e
--- a/doc/node.1
e23d3e
+++ b/doc/node.1
e23d3e
@@ -330,11 +330,6 @@ Specify process.title on startup.
e23d3e
 Specify an alternative default TLS cipher list.
e23d3e
 Requires Node.js to be built with crypto support. (Default)
e23d3e
 .
e23d3e
-.It Fl -tls-keylog Ns = Ns Ar file
e23d3e
-Log TLS key material to a file. The key material is in NSS SSLKEYLOGFILE
e23d3e
-format and can be used by software (such as Wireshark) to decrypt the TLS
e23d3e
-traffic.
e23d3e
-.
e23d3e
 .It Fl -tls-max-v1.2
e23d3e
 Set default  maxVersion to 'TLSv1.2'. Use to disable support for TLSv1.3.
e23d3e
 .
e23d3e
diff --git a/lib/_http_agent.js b/lib/_http_agent.js
e23d3e
index b3cd60b..d607a97 100644
e23d3e
--- a/lib/_http_agent.js
e23d3e
+++ b/lib/_http_agent.js
e23d3e
@@ -32,7 +32,7 @@ const net = require('net');
e23d3e
 const EventEmitter = require('events');
e23d3e
 const debug = require('internal/util/debuglog').debuglog('http');
e23d3e
 const { async_id_symbol } = require('internal/async_hooks').symbols;
e23d3e
-const kOnKeylog = Symbol('onkeylog');
e23d3e
+
e23d3e
 // New Agent code.
e23d3e
 
e23d3e
 // The largest departure from the previous implementation is that
e23d3e
@@ -125,28 +125,10 @@ function Agent(options) {
e23d3e
       }
e23d3e
     }
e23d3e
   });
e23d3e
-
e23d3e
-  // Don't emit keylog events unless there is a listener for them.
e23d3e
-  this.on('newListener', maybeEnableKeylog);
e23d3e
 }
e23d3e
 ObjectSetPrototypeOf(Agent.prototype, EventEmitter.prototype);
e23d3e
 ObjectSetPrototypeOf(Agent, EventEmitter);
e23d3e
 
e23d3e
-function maybeEnableKeylog(eventName) {
e23d3e
-  if (eventName === 'keylog') {
e23d3e
-    this.removeListener('newListener', maybeEnableKeylog);
e23d3e
-    // Future sockets will listen on keylog at creation.
e23d3e
-    const agent = this;
e23d3e
-    this[kOnKeylog] = function onkeylog(keylog) {
e23d3e
-      agent.emit('keylog', keylog, this);
e23d3e
-    };
e23d3e
-    // Existing sockets will start listening on keylog now.
e23d3e
-    for (const socket of ObjectValues(this.sockets)) {
e23d3e
-      socket.on('keylog', this[kOnKeylog]);
e23d3e
-    }
e23d3e
-  }
e23d3e
-}
e23d3e
-
e23d3e
 Agent.defaultMaxSockets = Infinity;
e23d3e
 
e23d3e
 Agent.prototype.createConnection = net.createConnection;
e23d3e
@@ -320,10 +302,6 @@ function installListeners(agent, s, options) {
e23d3e
     s.removeListener('agentRemove', onRemove);
e23d3e
   }
e23d3e
   s.on('agentRemove', onRemove);
e23d3e
-
e23d3e
-  if (agent[kOnKeylog]) {
e23d3e
-    s.on('keylog', agent[kOnKeylog]);
e23d3e
-  }
e23d3e
 }
e23d3e
 
e23d3e
 Agent.prototype.removeSocket = function removeSocket(s, options) {
e23d3e
diff --git a/lib/_tls_common.js b/lib/_tls_common.js
e23d3e
index 32e4a77..1e36b54 100644
e23d3e
--- a/lib/_tls_common.js
e23d3e
+++ b/lib/_tls_common.js
e23d3e
@@ -150,19 +150,6 @@ exports.createSecureContext = function createSecureContext(options) {
e23d3e
     }
e23d3e
   }
e23d3e
 
e23d3e
-  const sigalgs = options.sigalgs;
e23d3e
-  if (sigalgs !== undefined) {
e23d3e
-    if (typeof sigalgs !== 'string') {
e23d3e
-      throw new ERR_INVALID_ARG_TYPE('options.sigalgs', 'string', sigalgs);
e23d3e
-    }
e23d3e
-
e23d3e
-    if (sigalgs === '') {
e23d3e
-      throw new ERR_INVALID_OPT_VALUE('sigalgs', sigalgs);
e23d3e
-    }
e23d3e
-
e23d3e
-    c.context.setSigalgs(sigalgs);
e23d3e
-  }
e23d3e
-
e23d3e
   const { privateKeyIdentifier, privateKeyEngine } = options;
e23d3e
   if (privateKeyIdentifier !== undefined) {
e23d3e
     if (privateKeyEngine === undefined) {
e23d3e
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
e23d3e
index 0207d9b..0284fb4 100644
e23d3e
--- a/lib/_tls_wrap.js
e23d3e
+++ b/lib/_tls_wrap.js
e23d3e
@@ -49,12 +49,10 @@ const { TCP, constants: TCPConstants } = internalBinding('tcp_wrap');
e23d3e
 const tls_wrap = internalBinding('tls_wrap');
e23d3e
 const { Pipe, constants: PipeConstants } = internalBinding('pipe_wrap');
e23d3e
 const { owner_symbol } = require('internal/async_hooks').symbols;
e23d3e
-const { isArrayBufferView } = require('internal/util/types');
e23d3e
 const { SecureContext: NativeSecureContext } = internalBinding('crypto');
e23d3e
 const { connResetException, codes } = require('internal/errors');
e23d3e
 const {
e23d3e
   ERR_INVALID_ARG_TYPE,
e23d3e
-  ERR_INVALID_ARG_VALUE,
e23d3e
   ERR_INVALID_CALLBACK,
e23d3e
   ERR_MULTIPLE_CALLBACK,
e23d3e
   ERR_SOCKET_CLOSED,
e23d3e
@@ -66,12 +64,9 @@ const {
e23d3e
   ERR_TLS_SESSION_ATTACK,
e23d3e
   ERR_TLS_SNI_FROM_SERVER
e23d3e
 } = codes;
e23d3e
-const { onpskexchange: kOnPskExchange } = internalBinding('symbols');
e23d3e
 const { getOptionValue } = require('internal/options');
e23d3e
-const { validateString, validateBuffer } = require('internal/validators');
e23d3e
+const { validateString } = require('internal/validators');
e23d3e
 const traceTls = getOptionValue('--trace-tls');
e23d3e
-const tlsKeylog = getOptionValue('--tls-keylog');
e23d3e
-const { appendFile } = require('fs');
e23d3e
 const kConnectOptions = Symbol('connect-options');
e23d3e
 const kDisableRenegotiation = Symbol('disable-renegotiation');
e23d3e
 const kErrorEmitted = Symbol('error-emitted');
e23d3e
@@ -79,8 +74,6 @@ const kHandshakeTimeout = Symbol('handshake-timeout');
e23d3e
 const kRes = Symbol('res');
e23d3e
 const kSNICallback = Symbol('snicallback');
e23d3e
 const kEnableTrace = Symbol('enableTrace');
e23d3e
-const kPskCallback = Symbol('pskcallback');
e23d3e
-const kPskIdentityHint = Symbol('pskidentityhint');
e23d3e
 
e23d3e
 const noop = () => {};
e23d3e
 
e23d3e
@@ -300,67 +293,6 @@ function onnewsession(sessionId, session) {
e23d3e
     done();
e23d3e
 }
e23d3e
 
e23d3e
-function onPskServerCallback(identity, maxPskLen) {
e23d3e
-  const owner = this[owner_symbol];
e23d3e
-  const ret = owner[kPskCallback](owner, identity);
e23d3e
-  if (ret == null)
e23d3e
-    return undefined;
e23d3e
-
e23d3e
-  let psk;
e23d3e
-  if (isArrayBufferView(ret)) {
e23d3e
-    psk = ret;
e23d3e
-  } else {
e23d3e
-    if (typeof ret !== 'object') {
e23d3e
-      throw new ERR_INVALID_ARG_TYPE(
e23d3e
-        'ret',
e23d3e
-        ['Object', 'Buffer', 'TypedArray', 'DataView'],
e23d3e
-        ret
e23d3e
-      );
e23d3e
-    }
e23d3e
-    psk = ret.psk;
e23d3e
-    validateBuffer(psk, 'psk');
e23d3e
-  }
e23d3e
-
e23d3e
-  if (psk.length > maxPskLen) {
e23d3e
-    throw new ERR_INVALID_ARG_VALUE(
e23d3e
-      'psk',
e23d3e
-      psk,
e23d3e
-      `Pre-shared key exceeds ${maxPskLen} bytes`
e23d3e
-    );
e23d3e
-  }
e23d3e
-
e23d3e
-  return psk;
e23d3e
-}
e23d3e
-
e23d3e
-function onPskClientCallback(hint, maxPskLen, maxIdentityLen) {
e23d3e
-  const owner = this[owner_symbol];
e23d3e
-  const ret = owner[kPskCallback](hint);
e23d3e
-  if (ret == null)
e23d3e
-    return undefined;
e23d3e
-
e23d3e
-  if (typeof ret !== 'object')
e23d3e
-    throw new ERR_INVALID_ARG_TYPE('ret', 'Object', ret);
e23d3e
-
e23d3e
-  validateBuffer(ret.psk, 'psk');
e23d3e
-  if (ret.psk.length > maxPskLen) {
e23d3e
-    throw new ERR_INVALID_ARG_VALUE(
e23d3e
-      'psk',
e23d3e
-      ret.psk,
e23d3e
-      `Pre-shared key exceeds ${maxPskLen} bytes`
e23d3e
-    );
e23d3e
-  }
e23d3e
-
e23d3e
-  validateString(ret.identity, 'identity');
e23d3e
-  if (Buffer.byteLength(ret.identity) > maxIdentityLen) {
e23d3e
-    throw new ERR_INVALID_ARG_VALUE(
e23d3e
-      'identity',
e23d3e
-      ret.identity,
e23d3e
-      `PSK identity exceeds ${maxIdentityLen} bytes`
e23d3e
-    );
e23d3e
-  }
e23d3e
-
e23d3e
-  return { psk: ret.psk, identity: ret.identity };
e23d3e
-}
e23d3e
 
e23d3e
 function onkeylogclient(line) {
e23d3e
   debug('client onkeylog');
e23d3e
@@ -636,8 +568,6 @@ TLSSocket.prototype._destroySSL = function _destroySSL() {
e23d3e
 };
e23d3e
 
e23d3e
 // Constructor guts, arbitrarily factored out.
e23d3e
-let warnOnTlsKeylog = true;
e23d3e
-let warnOnTlsKeylogError = true;
e23d3e
 TLSSocket.prototype._init = function(socket, wrap) {
e23d3e
   const options = this._tlsOptions;
e23d3e
   const ssl = this._handle;
e23d3e
@@ -721,24 +651,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
e23d3e
     }
e23d3e
   }
e23d3e
 
e23d3e
-  if (tlsKeylog) {
e23d3e
-    if (warnOnTlsKeylog) {
e23d3e
-      warnOnTlsKeylog = false;
e23d3e
-      process.emitWarning('Using --tls-keylog makes TLS connections insecure ' +
e23d3e
-        'by writing secret key material to file ' + tlsKeylog);
e23d3e
-      ssl.enableKeylogCallback();
e23d3e
-      this.on('keylog', (line) => {
e23d3e
-        appendFile(tlsKeylog, line, { mode: 0o600 }, (err) => {
e23d3e
-          if (err && warnOnTlsKeylogError) {
e23d3e
-            warnOnTlsKeylogError = false;
e23d3e
-            process.emitWarning('Failed to write TLS keylog (this warning ' +
e23d3e
-              'will not be repeated): ' + err);
e23d3e
-          }
e23d3e
-        });
e23d3e
-      });
e23d3e
-    }
e23d3e
-  }
e23d3e
-
e23d3e
   ssl.onerror = onerror;
e23d3e
 
e23d3e
   // If custom SNICallback was given, or if
e23d3e
@@ -759,32 +671,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
e23d3e
     ssl.setALPNProtocols(ssl._secureContext.alpnBuffer);
e23d3e
   }
e23d3e
 
e23d3e
-  if (options.pskCallback && ssl.enablePskCallback) {
e23d3e
-    if (typeof options.pskCallback !== 'function') {
e23d3e
-      throw new ERR_INVALID_ARG_TYPE('pskCallback',
e23d3e
-                                     'function',
e23d3e
-                                     options.pskCallback);
e23d3e
-    }
e23d3e
-
e23d3e
-    ssl[kOnPskExchange] = options.isServer ?
e23d3e
-      onPskServerCallback : onPskClientCallback;
e23d3e
-
e23d3e
-    this[kPskCallback] = options.pskCallback;
e23d3e
-    ssl.enablePskCallback();
e23d3e
-
e23d3e
-    if (options.pskIdentityHint) {
e23d3e
-      if (typeof options.pskIdentityHint !== 'string') {
e23d3e
-        throw new ERR_INVALID_ARG_TYPE(
e23d3e
-          'options.pskIdentityHint',
e23d3e
-          'string',
e23d3e
-          options.pskIdentityHint
e23d3e
-        );
e23d3e
-      }
e23d3e
-      ssl.setPskIdentityHint(options.pskIdentityHint);
e23d3e
-    }
e23d3e
-  }
e23d3e
-
e23d3e
-
e23d3e
   if (options.handshakeTimeout > 0)
e23d3e
     this.setTimeout(options.handshakeTimeout, this._handleTimeout);
e23d3e
 
e23d3e
@@ -983,7 +869,6 @@ function makeSocketMethodProxy(name) {
e23d3e
 
e23d3e
 [
e23d3e
   'getCipher',
e23d3e
-  'getSharedSigalgs',
e23d3e
   'getEphemeralKeyInfo',
e23d3e
   'getFinished',
e23d3e
   'getPeerFinished',
e23d3e
@@ -996,7 +881,7 @@ function makeSocketMethodProxy(name) {
e23d3e
   TLSSocket.prototype[method] = makeSocketMethodProxy(method);
e23d3e
 });
e23d3e
 
e23d3e
-// TODO: support anonymous (nocert)
e23d3e
+// TODO: support anonymous (nocert) and PSK
e23d3e
 
e23d3e
 
e23d3e
 function onServerSocketSecure() {
e23d3e
@@ -1052,8 +937,6 @@ function tlsConnectionListener(rawSocket) {
e23d3e
     SNICallback: this[kSNICallback] || SNICallback,
e23d3e
     enableTrace: this[kEnableTrace],
e23d3e
     pauseOnConnect: this.pauseOnConnect,
e23d3e
-    pskCallback: this[kPskCallback],
e23d3e
-    pskIdentityHint: this[kPskIdentityHint],
e23d3e
   });
e23d3e
 
e23d3e
   socket.on('secure', onServerSocketSecure);
e23d3e
@@ -1158,8 +1041,6 @@ function Server(options, listener) {
e23d3e
 
e23d3e
   this[kHandshakeTimeout] = options.handshakeTimeout || (120 * 1000);
e23d3e
   this[kSNICallback] = options.SNICallback;
e23d3e
-  this[kPskCallback] = options.pskCallback;
e23d3e
-  this[kPskIdentityHint] = options.pskIdentityHint;
e23d3e
 
e23d3e
   if (typeof this[kHandshakeTimeout] !== 'number') {
e23d3e
     throw new ERR_INVALID_ARG_TYPE(
e23d3e
@@ -1171,18 +1052,6 @@ function Server(options, listener) {
e23d3e
       'options.SNICallback', 'function', options.SNICallback);
e23d3e
   }
e23d3e
 
e23d3e
-  if (this[kPskCallback] && typeof this[kPskCallback] !== 'function') {
e23d3e
-    throw new ERR_INVALID_ARG_TYPE(
e23d3e
-      'options.pskCallback', 'function', options.pskCallback);
e23d3e
-  }
e23d3e
-  if (this[kPskIdentityHint] && typeof this[kPskIdentityHint] !== 'string') {
e23d3e
-    throw new ERR_INVALID_ARG_TYPE(
e23d3e
-      'options.pskIdentityHint',
e23d3e
-      'string',
e23d3e
-      options.pskIdentityHint
e23d3e
-    );
e23d3e
-  }
e23d3e
-
e23d3e
   // constructor call
e23d3e
   net.Server.call(this, options, tlsConnectionListener);
e23d3e
 
e23d3e
@@ -1255,8 +1124,6 @@ Server.prototype.setSecureContext = function(options) {
e23d3e
   else
e23d3e
     this.crl = undefined;
e23d3e
 
e23d3e
-  this.sigalgs = options.sigalgs;
e23d3e
-
e23d3e
   if (options.ciphers)
e23d3e
     this.ciphers = options.ciphers;
e23d3e
   else
e23d3e
@@ -1298,7 +1165,6 @@ Server.prototype.setSecureContext = function(options) {
e23d3e
     clientCertEngine: this.clientCertEngine,
e23d3e
     ca: this.ca,
e23d3e
     ciphers: this.ciphers,
e23d3e
-    sigalgs: this.sigalgs,
e23d3e
     ecdhCurve: this.ecdhCurve,
e23d3e
     dhparam: this.dhparam,
e23d3e
     minVersion: this.minVersion,
e23d3e
@@ -1379,8 +1245,6 @@ Server.prototype.setOptions = deprecate(function(options) {
e23d3e
                                   .digest('hex')
e23d3e
                                   .slice(0, 32);
e23d3e
   }
e23d3e
-  if (options.pskCallback) this[kPskCallback] = options.pskCallback;
e23d3e
-  if (options.pskIdentityHint) this[kPskIdentityHint] = options.pskIdentityHint;
e23d3e
 }, 'Server.prototype.setOptions() is deprecated', 'DEP0122');
e23d3e
 
e23d3e
 // SNI Contexts High-Level API
e23d3e
@@ -1568,8 +1432,7 @@ exports.connect = function connect(...args) {
e23d3e
     session: options.session,
e23d3e
     ALPNProtocols: options.ALPNProtocols,
e23d3e
     requestOCSP: options.requestOCSP,
e23d3e
-    enableTrace: options.enableTrace,
e23d3e
-    pskCallback: options.pskCallback,
e23d3e
+    enableTrace: options.enableTrace
e23d3e
   });
e23d3e
 
e23d3e
   tlssock[kConnectOptions] = options;
e23d3e
diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
e23d3e
index ee1422d..941ebe0 100644
e23d3e
--- a/lib/internal/crypto/cipher.js
e23d3e
+++ b/lib/internal/crypto/cipher.js
e23d3e
@@ -52,16 +52,10 @@ function rsaFunctionFor(method, defaultPadding, keyType) {
e23d3e
         preparePrivateKey(options) :
e23d3e
         preparePublicOrPrivateKey(options);
e23d3e
     const padding = options.padding || defaultPadding;
e23d3e
-    const { oaepHash, oaepLabel } = options;
e23d3e
+    const { oaepHash } = options;
e23d3e
     if (oaepHash !== undefined && typeof oaepHash !== 'string')
e23d3e
       throw new ERR_INVALID_ARG_TYPE('options.oaepHash', 'string', oaepHash);
e23d3e
-    if (oaepLabel !== undefined && !isArrayBufferView(oaepLabel)) {
e23d3e
-      throw new ERR_INVALID_ARG_TYPE('options.oaepLabel',
e23d3e
-                                     ['Buffer', 'TypedArray', 'DataView'],
e23d3e
-                                     oaepLabel);
e23d3e
-    }
e23d3e
-    return method(data, format, type, passphrase, buffer, padding, oaepHash,
e23d3e
-                  oaepLabel);
e23d3e
+    return method(data, format, type, passphrase, buffer, padding, oaepHash);
e23d3e
   };
e23d3e
 }
e23d3e
 
e23d3e
diff --git a/lib/internal/crypto/sig.js b/lib/internal/crypto/sig.js
e23d3e
index 27930ce..1fd99f9 100644
e23d3e
--- a/lib/internal/crypto/sig.js
e23d3e
+++ b/lib/internal/crypto/sig.js
e23d3e
@@ -13,8 +13,6 @@ const { validateString } = require('internal/validators');
e23d3e
 const {
e23d3e
   Sign: _Sign,
e23d3e
   Verify: _Verify,
e23d3e
-  kSigEncDER,
e23d3e
-  kSigEncP1363,
e23d3e
   signOneShot: _signOneShot,
e23d3e
   verifyOneShot: _verifyOneShot
e23d3e
 } = internalBinding('crypto');
e23d3e
@@ -63,20 +61,6 @@ function getSaltLength(options) {
e23d3e
   return getIntOption('saltLength', options);
e23d3e
 }
e23d3e
 
e23d3e
-function getDSASignatureEncoding(options) {
e23d3e
-  if (typeof options === 'object') {
e23d3e
-    const { dsaEncoding = 'der' } = options;
e23d3e
-    if (dsaEncoding === 'der')
e23d3e
-      return kSigEncDER;
e23d3e
-    else if (dsaEncoding === 'ieee-p1363')
e23d3e
-      return kSigEncP1363;
e23d3e
-    else
e23d3e
-      throw new ERR_INVALID_OPT_VALUE('dsaEncoding', dsaEncoding);
e23d3e
-  }
e23d3e
-
e23d3e
-  return kSigEncDER;
e23d3e
-}
e23d3e
-
e23d3e
 function getIntOption(name, options) {
e23d3e
   const value = options[name];
e23d3e
   if (value !== undefined) {
e23d3e
@@ -99,11 +83,8 @@ Sign.prototype.sign = function sign(options, encoding) {
e23d3e
   const rsaPadding = getPadding(options);
e23d3e
   const pssSaltLength = getSaltLength(options);
e23d3e
 
e23d3e
-  // Options specific to (EC)DSA
e23d3e
-  const dsaSigEnc = getDSASignatureEncoding(options);
e23d3e
-
e23d3e
   const ret = this[kHandle].sign(data, format, type, passphrase, rsaPadding,
e23d3e
-                                 pssSaltLength, dsaSigEnc);
e23d3e
+                                 pssSaltLength);
e23d3e
 
e23d3e
   encoding = encoding || getDefaultEncoding();
e23d3e
   if (encoding && encoding !== 'buffer')
e23d3e
@@ -138,11 +119,8 @@ function signOneShot(algorithm, data, key) {
e23d3e
   const rsaPadding = getPadding(key);
e23d3e
   const pssSaltLength = getSaltLength(key);
e23d3e
 
e23d3e
-  // Options specific to (EC)DSA
e23d3e
-  const dsaSigEnc = getDSASignatureEncoding(key);
e23d3e
-
e23d3e
   return _signOneShot(keyData, keyFormat, keyType, keyPassphrase, data,
e23d3e
-                      algorithm, rsaPadding, pssSaltLength, dsaSigEnc);
e23d3e
+                      algorithm, rsaPadding, pssSaltLength);
e23d3e
 }
e23d3e
 
e23d3e
 function Verify(algorithm, options) {
e23d3e
@@ -173,15 +151,13 @@ Verify.prototype.verify = function verify(options, signature, sigEncoding) {
e23d3e
 
e23d3e
   // Options specific to RSA
e23d3e
   const rsaPadding = getPadding(options);
e23d3e
-  const pssSaltLength = getSaltLength(options);
e23d3e
 
e23d3e
-  // Options specific to (EC)DSA
e23d3e
-  const dsaSigEnc = getDSASignatureEncoding(options);
e23d3e
+  const pssSaltLength = getSaltLength(options);
e23d3e
 
e23d3e
   signature = getArrayBufferView(signature, 'signature', sigEncoding);
e23d3e
 
e23d3e
   return this[kHandle].verify(data, format, type, passphrase, signature,
e23d3e
-                              rsaPadding, pssSaltLength, dsaSigEnc);
e23d3e
+                              rsaPadding, pssSaltLength);
e23d3e
 };
e23d3e
 
e23d3e
 function verifyOneShot(algorithm, data, key, signature) {
e23d3e
@@ -207,9 +183,6 @@ function verifyOneShot(algorithm, data, key, signature) {
e23d3e
   const rsaPadding = getPadding(key);
e23d3e
   const pssSaltLength = getSaltLength(key);
e23d3e
 
e23d3e
-  // Options specific to (EC)DSA
e23d3e
-  const dsaSigEnc = getDSASignatureEncoding(key);
e23d3e
-
e23d3e
   if (!isArrayBufferView(signature)) {
e23d3e
     throw new ERR_INVALID_ARG_TYPE(
e23d3e
       'signature',
e23d3e
@@ -219,7 +192,7 @@ function verifyOneShot(algorithm, data, key, signature) {
e23d3e
   }
e23d3e
 
e23d3e
   return _verifyOneShot(keyData, keyFormat, keyType, keyPassphrase, signature,
e23d3e
-                        data, algorithm, rsaPadding, pssSaltLength, dsaSigEnc);
e23d3e
+                        data, algorithm, rsaPadding, pssSaltLength);
e23d3e
 }
e23d3e
 
e23d3e
 module.exports = {
e23d3e
diff --git a/src/env.h b/src/env.h
e23d3e
index 60b7c4b..5b1884b 100644
e23d3e
--- a/src/env.h
e23d3e
+++ b/src/env.h
e23d3e
@@ -161,12 +161,11 @@ constexpr size_t kFsStatsBufferLength =
e23d3e
 
e23d3e
 // Symbols are per-isolate primitives but Environment proxies them
e23d3e
 // for the sake of convenience.
e23d3e
-#define PER_ISOLATE_SYMBOL_PROPERTIES(V)                                       \
e23d3e
-  V(handle_onclose_symbol, "handle_onclose")                                   \
e23d3e
-  V(no_message_symbol, "no_message_symbol")                                    \
e23d3e
-  V(oninit_symbol, "oninit")                                                   \
e23d3e
-  V(owner_symbol, "owner")                                                     \
e23d3e
-  V(onpskexchange_symbol, "onpskexchange")                                     \
e23d3e
+#define PER_ISOLATE_SYMBOL_PROPERTIES(V)                                      \
e23d3e
+  V(handle_onclose_symbol, "handle_onclose")                                  \
e23d3e
+  V(no_message_symbol, "no_message_symbol")                                   \
e23d3e
+  V(oninit_symbol, "oninit")                                                  \
e23d3e
+  V(owner_symbol, "owner")                                                    \
e23d3e
 
e23d3e
 // Strings are per-isolate primitives but Environment proxies them
e23d3e
 // for the sake of convenience.  Strings should be ASCII-only.
e23d3e
@@ -325,7 +324,6 @@ constexpr size_t kFsStatsBufferLength =
e23d3e
   V(priority_string, "priority")                                               \
e23d3e
   V(process_string, "process")                                                 \
e23d3e
   V(promise_string, "promise")                                                 \
e23d3e
-  V(psk_string, "psk")                                                         \
e23d3e
   V(pubkey_string, "pubkey")                                                   \
e23d3e
   V(query_string, "query")                                                     \
e23d3e
   V(raw_string, "raw")                                                         \
e23d3e
@@ -353,7 +351,6 @@ constexpr size_t kFsStatsBufferLength =
e23d3e
   V(sni_context_string, "sni_context")                                         \
e23d3e
   V(source_string, "source")                                                   \
e23d3e
   V(stack_string, "stack")                                                     \
e23d3e
-  V(standard_name_string, "standardName")                                      \
e23d3e
   V(start_time_string, "startTime")                                            \
e23d3e
   V(status_string, "status")                                                   \
e23d3e
   V(stdio_string, "stdio")                                                     \
e23d3e
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
e23d3e
index 332b6f3..934c17c 100644
e23d3e
--- a/src/node_crypto.cc
e23d3e
+++ b/src/node_crypto.cc
e23d3e
@@ -737,7 +737,6 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
e23d3e
   env->SetProtoMethod(t, "addRootCerts", AddRootCerts);
e23d3e
   env->SetProtoMethod(t, "setCipherSuites", SetCipherSuites);
e23d3e
   env->SetProtoMethod(t, "setCiphers", SetCiphers);
e23d3e
-  env->SetProtoMethod(t, "setSigalgs", SetSigalgs);
e23d3e
   env->SetProtoMethod(t, "setECDHCurve", SetECDHCurve);
e23d3e
   env->SetProtoMethod(t, "setDHParam", SetDHParam);
e23d3e
   env->SetProtoMethod(t, "setMaxProto", SetMaxProto);
e23d3e
@@ -1021,23 +1020,6 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
e23d3e
   }
e23d3e
 }
e23d3e
 
e23d3e
-void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
e23d3e
-  SecureContext* sc;
e23d3e
-  ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());
e23d3e
-  Environment* env = sc->env();
e23d3e
-  ClearErrorOnReturn clear_error_on_return;
e23d3e
-
e23d3e
-  CHECK_EQ(args.Length(), 1);
e23d3e
-  CHECK(args[0]->IsString());
e23d3e
-
e23d3e
-  const node::Utf8Value sigalgs(env->isolate(), args[0]);
e23d3e
-
e23d3e
-  int rv = SSL_CTX_set1_sigalgs_list(sc->ctx_.get(), *sigalgs);
e23d3e
-
e23d3e
-  if (rv == 0) {
e23d3e
-    return ThrowCryptoError(env, ERR_get_error());
e23d3e
-  }
e23d3e
-}
e23d3e
 
e23d3e
 #ifndef OPENSSL_NO_ENGINE
e23d3e
 // Helpers for the smart pointer.
e23d3e
@@ -2080,7 +2062,6 @@ void SSLWrap<Base>::AddMethods(Environment* env, Local<FunctionTemplate> t) {
e23d3e
   env->SetProtoMethodNoSideEffect(t, "isSessionReused", IsSessionReused);
e23d3e
   env->SetProtoMethodNoSideEffect(t, "verifyError", VerifyError);
e23d3e
   env->SetProtoMethodNoSideEffect(t, "getCipher", GetCipher);
e23d3e
-  env->SetProtoMethodNoSideEffect(t, "getSharedSigalgs", GetSharedSigalgs);
e23d3e
   env->SetProtoMethod(t, "endParser", EndParser);
e23d3e
   env->SetProtoMethod(t, "certCbDone", CertCbDone);
e23d3e
   env->SetProtoMethod(t, "renegotiate", Renegotiate);
e23d3e
@@ -2987,16 +2968,6 @@ void SSLWrap<Base>::VerifyError(const FunctionCallbackInfo<Value>& args) {
e23d3e
   if (X509* peer_cert = SSL_get_peer_certificate(w->ssl_.get())) {
e23d3e
     X509_free(peer_cert);
e23d3e
     x509_verify_error = SSL_get_verify_result(w->ssl_.get());
e23d3e
-  } else {
e23d3e
-    const SSL_CIPHER* curr_cipher = SSL_get_current_cipher(w->ssl_.get());
e23d3e
-    const SSL_SESSION* sess = SSL_get_session(w->ssl_.get());
e23d3e
-    // Allow no-cert for PSK authentication in TLS1.2 and lower.
e23d3e
-    // In TLS1.3 check that session was reused because TLS1.3 PSK
e23d3e
-    // looks like session resumption. Is there a better way?
e23d3e
-    if (SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
e23d3e
-        (SSL_SESSION_get_protocol_version(sess) == TLS1_3_VERSION &&
e23d3e
-         SSL_session_reused(w->ssl_.get())))
e23d3e
-      return args.GetReturnValue().SetNull();
e23d3e
   }
e23d3e
 
e23d3e
   if (x509_verify_error == X509_V_OK)
e23d3e
@@ -3062,9 +3033,6 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
e23d3e
   const char* cipher_name = SSL_CIPHER_get_name(c);
e23d3e
   info->Set(context, env->name_string(),
e23d3e
             OneByteString(args.GetIsolate(), cipher_name)).Check();
e23d3e
-  const char* cipher_standard_name = SSL_CIPHER_standard_name(c);
e23d3e
-  info->Set(context, env->standard_name_string(),
e23d3e
-            OneByteString(args.GetIsolate(), cipher_standard_name)).Check();
e23d3e
   const char* cipher_version = SSL_CIPHER_get_version(c);
e23d3e
   info->Set(context, env->version_string(),
e23d3e
             OneByteString(args.GetIsolate(), cipher_version)).Check();
e23d3e
@@ -3073,87 +3041,6 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
e23d3e
 
e23d3e
 
e23d3e
 template <class Base>
e23d3e
-void SSLWrap<Base>::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
e23d3e
-  Base* w;
e23d3e
-  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
e23d3e
-  Environment* env = w->ssl_env();
e23d3e
-
e23d3e
-  SSL* ssl = w->ssl_.get();
e23d3e
-  int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
e23d3e
-                                    nullptr);
e23d3e
-  MaybeStackBuffer<Local<Value>, 16> ret_arr(nsig);
e23d3e
-
e23d3e
-  for (int i = 0; i < nsig; i++) {
e23d3e
-    int hash_nid;
e23d3e
-    int sign_nid;
e23d3e
-    std::string sig_with_md;
e23d3e
-
e23d3e
-    SSL_get_shared_sigalgs(ssl, i, &sign_nid, &hash_nid, nullptr, nullptr,
e23d3e
-                           nullptr);
e23d3e
-
e23d3e
-    switch (sign_nid) {
e23d3e
-      case EVP_PKEY_RSA:
e23d3e
-        sig_with_md = "RSA+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case EVP_PKEY_RSA_PSS:
e23d3e
-        sig_with_md = "RSA-PSS+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case EVP_PKEY_DSA:
e23d3e
-        sig_with_md = "DSA+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case EVP_PKEY_EC:
e23d3e
-        sig_with_md = "ECDSA+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case NID_ED25519:
e23d3e
-        sig_with_md = "Ed25519+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case NID_ED448:
e23d3e
-        sig_with_md = "Ed448+";
e23d3e
-        break;
e23d3e
-#ifndef OPENSSL_NO_GOST
e23d3e
-      case NID_id_GostR3410_2001:
e23d3e
-        sig_with_md = "gost2001+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case NID_id_GostR3410_2012_256:
e23d3e
-        sig_with_md = "gost2012_256+";
e23d3e
-        break;
e23d3e
-
e23d3e
-      case NID_id_GostR3410_2012_512:
e23d3e
-        sig_with_md = "gost2012_512+";
e23d3e
-        break;
e23d3e
-#endif  // !OPENSSL_NO_GOST
e23d3e
-      default:
e23d3e
-        const char* sn = OBJ_nid2sn(sign_nid);
e23d3e
-
e23d3e
-        if (sn != nullptr) {
e23d3e
-          sig_with_md = std::string(sn) + "+";
e23d3e
-        } else {
e23d3e
-          sig_with_md = "UNDEF+";
e23d3e
-        }
e23d3e
-        break;
e23d3e
-    }
e23d3e
-
e23d3e
-    const char* sn_hash = OBJ_nid2sn(hash_nid);
e23d3e
-    if (sn_hash != nullptr) {
e23d3e
-      sig_with_md += std::string(sn_hash);
e23d3e
-    } else {
e23d3e
-      sig_with_md += "UNDEF";
e23d3e
-    }
e23d3e
-    ret_arr[i] = OneByteString(env->isolate(), sig_with_md.c_str());
e23d3e
-  }
e23d3e
-
e23d3e
-  args.GetReturnValue().Set(
e23d3e
-                 Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
e23d3e
-}
e23d3e
-
e23d3e
-
e23d3e
-template <class Base>
e23d3e
 void SSLWrap<Base>::GetProtocol(const FunctionCallbackInfo<Value>& args) {
e23d3e
   Base* w;
e23d3e
   ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
e23d3e
@@ -5300,9 +5187,6 @@ void CheckThrow(Environment* env, SignBase::Error error) {
e23d3e
     case SignBase::Error::kSignNotInitialised:
e23d3e
       return env->ThrowError("Not initialised");
e23d3e
 
e23d3e
-    case SignBase::Error::kSignMalformedSignature:
e23d3e
-      return env->ThrowError("Malformed signature");
e23d3e
-
e23d3e
     case SignBase::Error::kSignInit:
e23d3e
     case SignBase::Error::kSignUpdate:
e23d3e
     case SignBase::Error::kSignPrivateKey:
e23d3e
@@ -5409,85 +5293,6 @@ static int GetDefaultSignPadding([[maybe_unused]] const ManagedEVPPKey& key) {
e23d3e
 #endif // OPENSSL_VERSION_NUMBER < 0x10100000L
e23d3e
 }
e23d3e
 
e23d3e
-static const unsigned int kNoDsaSignature = static_cast<unsigned int>(-1);
e23d3e
-
e23d3e
-// Returns the maximum size of each of the integers (r, s) of the DSA signature.
e23d3e
-static unsigned int GetBytesOfRS(const ManagedEVPPKey& pkey) {
e23d3e
-  int bits, base_id = EVP_PKEY_base_id(pkey.get());
e23d3e
-
e23d3e
-  if (base_id == EVP_PKEY_DSA) {
e23d3e
-    DSA* dsa_key = EVP_PKEY_get0_DSA(pkey.get());
e23d3e
-    // Both r and s are computed mod q, so their width is limited by that of q.
e23d3e
-    bits = BN_num_bits(DSA_get0_q(dsa_key));
e23d3e
-  } else if (base_id == EVP_PKEY_EC) {
e23d3e
-    EC_KEY* ec_key = EVP_PKEY_get0_EC_KEY(pkey.get());
e23d3e
-    const EC_GROUP* ec_group = EC_KEY_get0_group(ec_key);
e23d3e
-    bits = EC_GROUP_order_bits(ec_group);
e23d3e
-  } else {
e23d3e
-    return kNoDsaSignature;
e23d3e
-  }
e23d3e
-
e23d3e
-  return (bits + 7) / 8;
e23d3e
-}
e23d3e
-
e23d3e
-static AllocatedBuffer ConvertSignatureToP1363(Environment* env,
e23d3e
-                                               const ManagedEVPPKey& pkey,
e23d3e
-                                               AllocatedBuffer&& signature) {
e23d3e
-  unsigned int n = GetBytesOfRS(pkey);
e23d3e
-  if (n == kNoDsaSignature)
e23d3e
-    return std::move(signature);
e23d3e
-
e23d3e
-  const unsigned char* sig_data =
e23d3e
-      reinterpret_cast<unsigned char*>(signature.data());
e23d3e
-
e23d3e
-  ECDSASigPointer asn1_sig(d2i_ECDSA_SIG(nullptr, &sig_data, signature.size()));
e23d3e
-  if (!asn1_sig)
e23d3e
-    return AllocatedBuffer();
e23d3e
-
e23d3e
-  AllocatedBuffer buf = env->AllocateManaged(2 * n);
e23d3e
-  unsigned char* data = reinterpret_cast<unsigned char*>(buf.data());
e23d3e
-
e23d3e
-  const BIGNUM* r = ECDSA_SIG_get0_r(asn1_sig.get());
e23d3e
-  const BIGNUM* s = ECDSA_SIG_get0_s(asn1_sig.get());
e23d3e
-  CHECK_EQ(n, static_cast<unsigned int>(BN_bn2binpad(r, data, n)));
e23d3e
-  CHECK_EQ(n, static_cast<unsigned int>(BN_bn2binpad(s, data + n, n)));
e23d3e
-
e23d3e
-  return buf;
e23d3e
-}
e23d3e
-
e23d3e
-static ByteSource ConvertSignatureToDER(
e23d3e
-      const ManagedEVPPKey& pkey,
e23d3e
-      const ArrayBufferViewContents<char>& signature) {
e23d3e
-  unsigned int n = GetBytesOfRS(pkey);
e23d3e
-  if (n == kNoDsaSignature)
e23d3e
-    return ByteSource::Foreign(signature.data(), signature.length());
e23d3e
-
e23d3e
-  const unsigned char* sig_data =
e23d3e
-      reinterpret_cast<const  unsigned char*>(signature.data());
e23d3e
-
e23d3e
-  if (signature.length() != 2 * n)
e23d3e
-    return ByteSource();
e23d3e
-
e23d3e
-  ECDSASigPointer asn1_sig(ECDSA_SIG_new());
e23d3e
-  CHECK(asn1_sig);
e23d3e
-  BIGNUM* r = BN_new();
e23d3e
-  CHECK_NOT_NULL(r);
e23d3e
-  BIGNUM* s = BN_new();
e23d3e
-  CHECK_NOT_NULL(s);
e23d3e
-  CHECK_EQ(r, BN_bin2bn(sig_data, n, r));
e23d3e
-  CHECK_EQ(s, BN_bin2bn(sig_data + n, n, s));
e23d3e
-  CHECK_EQ(1, ECDSA_SIG_set0(asn1_sig.get(), r, s));
e23d3e
-
e23d3e
-  unsigned char* data = nullptr;
e23d3e
-  int len = i2d_ECDSA_SIG(asn1_sig.get(), &data);
e23d3e
-
e23d3e
-  if (len <= 0)
e23d3e
-    return ByteSource();
e23d3e
-
e23d3e
-  CHECK_NOT_NULL(data);
e23d3e
-
e23d3e
-  return ByteSource::Allocated(reinterpret_cast<char*>(data), len);
e23d3e
-}
e23d3e
 
e23d3e
 static AllocatedBuffer Node_SignFinal(Environment* env,
e23d3e
                                       EVPMDPointer&& mdctx,
e23d3e
@@ -5548,8 +5353,7 @@ static inline bool ValidateDSAParameters(EVP_PKEY* key) {
e23d3e
 Sign::SignResult Sign::SignFinal(
e23d3e
     const ManagedEVPPKey& pkey,
e23d3e
     int padding,
e23d3e
-    const Maybe<int>& salt_len,
e23d3e
-    DSASigEnc dsa_sig_enc) {
e23d3e
+    const Maybe<int>& salt_len) {
e23d3e
   if (!mdctx_)
e23d3e
     return SignResult(kSignNotInitialised);
e23d3e
 
e23d3e
@@ -5561,10 +5365,6 @@ Sign::SignResult Sign::SignFinal(
e23d3e
   AllocatedBuffer buffer =
e23d3e
       Node_SignFinal(env(), std::move(mdctx), pkey, padding, salt_len);
e23d3e
   Error error = buffer.data() == nullptr ? kSignPrivateKey : kSignOk;
e23d3e
-  if (error == kSignOk && dsa_sig_enc == kSigEncP1363) {
e23d3e
-    buffer = ConvertSignatureToP1363(env(), pkey, std::move(buffer));
e23d3e
-    CHECK_NOT_NULL(buffer.data());
e23d3e
-  }
e23d3e
   return SignResult(error, std::move(buffer));
e23d3e
 }
e23d3e
 
e23d3e
@@ -5592,15 +5392,10 @@ void Sign::SignFinal(const FunctionCallbackInfo<Value>& args) {
e23d3e
     salt_len = Just<int>(args[offset + 1].As<Int32>()->Value());
e23d3e
   }
e23d3e
 
e23d3e
-  CHECK(args[offset + 2]->IsInt32());
e23d3e
-  DSASigEnc dsa_sig_enc =
e23d3e
-      static_cast<DSASigEnc>(args[offset + 2].As<Int32>()->Value());
e23d3e
-
e23d3e
   SignResult ret = sign->SignFinal(
e23d3e
       key,
e23d3e
       padding,
e23d3e
-      salt_len,
e23d3e
-      dsa_sig_enc);
e23d3e
+      salt_len);
e23d3e
 
e23d3e
   if (ret.error != kSignOk)
e23d3e
     return sign->CheckThrow(ret.error);
e23d3e
@@ -5644,10 +5439,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
e23d3e
     rsa_salt_len = Just<int>(args[offset + 3].As<Int32>()->Value());
e23d3e
   }
e23d3e
 
e23d3e
-  CHECK(args[offset + 4]->IsInt32());
e23d3e
-  DSASigEnc dsa_sig_enc =
e23d3e
-      static_cast<DSASigEnc>(args[offset + 4].As<Int32>()->Value());
e23d3e
-
e23d3e
   EVP_PKEY_CTX* pkctx = nullptr;
e23d3e
   EVPMDPointer mdctx(EVP_MD_CTX_new());
e23d3e
   if (!mdctx ||
e23d3e
@@ -5675,10 +5466,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
e23d3e
 
e23d3e
   signature.Resize(sig_len);
e23d3e
 
e23d3e
-  if (dsa_sig_enc == kSigEncP1363) {
e23d3e
-    signature = ConvertSignatureToP1363(env, key, std::move(signature));
e23d3e
-  }
e23d3e
-
e23d3e
   args.GetReturnValue().Set(signature.ToBuffer().ToLocalChecked());
e23d3e
 }
e23d3e
 
e23d3e
@@ -5784,17 +5571,6 @@ void Verify::VerifyFinal(const FunctionCallbackInfo<Value>& args) {
e23d3e
     salt_len = Just<int>(args[offset + 2].As<Int32>()->Value());
e23d3e
   }
e23d3e
 
e23d3e
-  CHECK(args[offset + 3]->IsInt32());
e23d3e
-  DSASigEnc dsa_sig_enc =
e23d3e
-      static_cast<DSASigEnc>(args[offset + 3].As<Int32>()->Value());
e23d3e
-
e23d3e
-  ByteSource signature = ByteSource::Foreign(hbuf.data(), hbuf.length());
e23d3e
-  if (dsa_sig_enc == kSigEncP1363) {
e23d3e
-    signature = ConvertSignatureToDER(pkey, hbuf);
e23d3e
-    if (signature.get() == nullptr)
e23d3e
-      return verify->CheckThrow(Error::kSignMalformedSignature);
e23d3e
-  }
e23d3e
-
e23d3e
   bool verify_result;
e23d3e
   Error err = verify->VerifyFinal(pkey, hbuf.data(), hbuf.length(), padding,
e23d3e
                                   salt_len, &verify_result);
e23d3e
@@ -5838,10 +5614,6 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
e23d3e
     rsa_salt_len = Just<int>(args[offset + 4].As<Int32>()->Value());
e23d3e
   }
e23d3e
 
e23d3e
-  CHECK(args[offset + 5]->IsInt32());
e23d3e
-  DSASigEnc dsa_sig_enc =
e23d3e
-      static_cast<DSASigEnc>(args[offset + 5].As<Int32>()->Value());
e23d3e
-
e23d3e
   EVP_PKEY_CTX* pkctx = nullptr;
e23d3e
   EVPMDPointer mdctx(EVP_MD_CTX_new());
e23d3e
   if (!mdctx ||
e23d3e
@@ -5852,18 +5624,11 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
e23d3e
   if (!ApplyRSAOptions(key, pkctx, rsa_padding, rsa_salt_len))
e23d3e
     return CheckThrow(env, SignBase::Error::kSignPublicKey);
e23d3e
 
e23d3e
-  ByteSource sig_bytes = ByteSource::Foreign(sig.data(), sig.length());
e23d3e
-  if (dsa_sig_enc == kSigEncP1363) {
e23d3e
-    sig_bytes = ConvertSignatureToDER(key, sig);
e23d3e
-    if (!sig_bytes)
e23d3e
-      return CheckThrow(env, SignBase::Error::kSignMalformedSignature);
e23d3e
-  }
e23d3e
-
e23d3e
   bool verify_result;
e23d3e
   const int r = EVP_DigestVerify(
e23d3e
     mdctx.get(),
e23d3e
-    reinterpret_cast<const unsigned char*>(sig_bytes.get()),
e23d3e
-    sig_bytes.size(),
e23d3e
+    reinterpret_cast<const unsigned char*>(sig.data()),
e23d3e
+    sig.length(),
e23d3e
     reinterpret_cast<const unsigned char*>(data.data()),
e23d3e
     data.length());
e23d3e
   switch (r) {
e23d3e
@@ -5887,8 +5652,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
e23d3e
                              const ManagedEVPPKey& pkey,
e23d3e
                              int padding,
e23d3e
                              const EVP_MD* digest,
e23d3e
-                             const void* oaep_label,
e23d3e
-                             size_t oaep_label_len,
e23d3e
                              const unsigned char* data,
e23d3e
                              int len,
e23d3e
                              AllocatedBuffer* out) {
e23d3e
@@ -5905,17 +5668,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
e23d3e
       return false;
e23d3e
   }
e23d3e
 
e23d3e
-  if (oaep_label_len != 0) {
e23d3e
-    // OpenSSL takes ownership of the label, so we need to create a copy.
e23d3e
-    void* label = OPENSSL_memdup(oaep_label, oaep_label_len);
e23d3e
-    CHECK_NOT_NULL(label);
e23d3e
-    if (0 >= EVP_PKEY_CTX_set0_rsa_oaep_label(ctx.get(),
e23d3e
-                reinterpret_cast<unsigned char*>(label),
e23d3e
-                                      oaep_label_len)) {
e23d3e
-      OPENSSL_free(label);
e23d3e
-      return false;
e23d3e
-    }
e23d3e
-  }
e23d3e
 
e23d3e
   size_t out_len = 0;
e23d3e
   if (EVP_PKEY_cipher(ctx.get(), nullptr, &out_len, data, len) <= 0)
e23d3e
@@ -5962,12 +5714,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
e23d3e
       return THROW_ERR_OSSL_EVP_INVALID_DIGEST(env);
e23d3e
   }
e23d3e
 
e23d3e
-  ArrayBufferViewContents<unsigned char> oaep_label;
e23d3e
-  if (!args[offset + 3]->IsUndefined()) {
e23d3e
-    CHECK(args[offset + 3]->IsArrayBufferView());
e23d3e
-    oaep_label.Read(args[offset + 3].As<ArrayBufferView>());
e23d3e
-  }
e23d3e
-
e23d3e
   AllocatedBuffer out;
e23d3e
 
e23d3e
   ClearErrorOnReturn clear_error_on_return;
e23d3e
@@ -5977,8 +5723,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
e23d3e
       pkey,
e23d3e
       padding,
e23d3e
       digest,
e23d3e
-      oaep_label.data(),
e23d3e
-      oaep_label.length(),
e23d3e
       buf.data(),
e23d3e
       buf.length(),
e23d3e
       &out;;
e23d3e
@@ -7709,8 +7453,6 @@ void Initialize(Local<Object> target,
e23d3e
   NODE_DEFINE_CONSTANT(target, kKeyTypeSecret);
e23d3e
   NODE_DEFINE_CONSTANT(target, kKeyTypePublic);
e23d3e
   NODE_DEFINE_CONSTANT(target, kKeyTypePrivate);
e23d3e
-  NODE_DEFINE_CONSTANT(target, kSigEncDER);
e23d3e
-  NODE_DEFINE_CONSTANT(target, kSigEncP1363);
e23d3e
   env->SetMethod(target, "randomBytes", RandomBytes);
e23d3e
   env->SetMethod(target, "signOneShot", SignOneShot);
e23d3e
   env->SetMethod(target, "verifyOneShot", VerifyOneShot);
e23d3e
diff --git a/src/node_crypto.h b/src/node_crypto.h
e23d3e
index 580ca6a..18ac9b5 100644
e23d3e
--- a/src/node_crypto.h
e23d3e
+++ b/src/node_crypto.h
e23d3e
@@ -171,7 +171,6 @@ class SecureContext : public BaseObject {
e23d3e
   static void AddRootCerts(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void SetCipherSuites(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
-  static void SetSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void SetDHParam(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void SetOptions(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
@@ -304,7 +303,6 @@ class SSLWrap {
e23d3e
   static void IsSessionReused(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void GetCipher(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
-  static void GetSharedSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void EndParser(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
@@ -375,13 +373,6 @@ class ByteSource {
e23d3e
   const char* get() const;
e23d3e
   size_t size() const;
e23d3e
 
e23d3e
-  inline operator bool() const {
e23d3e
-    return data_ != nullptr;
e23d3e
-  }
e23d3e
-
e23d3e
-  static ByteSource Allocated(char* data, size_t size);
e23d3e
-  static ByteSource Foreign(const char* data, size_t size);
e23d3e
-
e23d3e
   static ByteSource FromStringOrBuffer(Environment* env,
e23d3e
                                        v8::Local<v8::Value> value);
e23d3e
 
e23d3e
@@ -406,6 +397,9 @@ class ByteSource {
e23d3e
   size_t size_ = 0;
e23d3e
 
e23d3e
   ByteSource(const char* data, char* allocated_data, size_t size);
e23d3e
+
e23d3e
+  static ByteSource Allocated(char* data, size_t size);
e23d3e
+  static ByteSource Foreign(const char* data, size_t size);
e23d3e
 };
e23d3e
 
e23d3e
 enum PKEncodingType {
e23d3e
@@ -681,8 +675,7 @@ class SignBase : public BaseObject {
e23d3e
     kSignNotInitialised,
e23d3e
     kSignUpdate,
e23d3e
     kSignPrivateKey,
e23d3e
-    kSignPublicKey,
e23d3e
-    kSignMalformedSignature
e23d3e
+    kSignPublicKey
e23d3e
   } Error;
e23d3e
 
e23d3e
   SignBase(Environment* env, v8::Local<v8::Object> wrap)
e23d3e
@@ -703,10 +696,6 @@ class SignBase : public BaseObject {
e23d3e
   EVPMDPointer mdctx_;
e23d3e
 };
e23d3e
 
e23d3e
-enum DSASigEnc {
e23d3e
-  kSigEncDER, kSigEncP1363
e23d3e
-};
e23d3e
-
e23d3e
 class Sign : public SignBase {
e23d3e
  public:
e23d3e
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
e23d3e
@@ -724,8 +713,7 @@ class Sign : public SignBase {
e23d3e
   SignResult SignFinal(
e23d3e
       const ManagedEVPPKey& pkey,
e23d3e
       int padding,
e23d3e
-      const v8::Maybe<int>& saltlen,
e23d3e
-      DSASigEnc dsa_sig_enc);
e23d3e
+      const v8::Maybe<int>& saltlen);
e23d3e
 
e23d3e
  protected:
e23d3e
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
@@ -779,8 +767,6 @@ class PublicKeyCipher {
e23d3e
                      const ManagedEVPPKey& pkey,
e23d3e
                      int padding,
e23d3e
                      const EVP_MD* digest,
e23d3e
-                     const void* oaep_label,
e23d3e
-                     size_t oaep_label_size,
e23d3e
                      const unsigned char* data,
e23d3e
                      int len,
e23d3e
                      AllocatedBuffer* out);
e23d3e
diff --git a/src/node_errors.h b/src/node_errors.h
e23d3e
index 426b059..48ae915 100644
e23d3e
--- a/src/node_errors.h
e23d3e
+++ b/src/node_errors.h
e23d3e
@@ -58,7 +58,6 @@ void PrintErrorString(const char* format, ...);
e23d3e
   V(ERR_STRING_TOO_LONG, Error)                                              \
e23d3e
   V(ERR_TLS_INVALID_PROTOCOL_METHOD, TypeError)                              \
e23d3e
   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER, TypeError)              \
e23d3e
-  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, Error)                              \
e23d3e
 
e23d3e
 #define V(code, type)                                                         \
e23d3e
   inline v8::Local<v8::Value> code(v8::Isolate* isolate,                      \
e23d3e
@@ -102,7 +101,6 @@ void PrintErrorString(const char* format, ...);
e23d3e
     "Script execution was interrupted by `SIGINT`")                          \
e23d3e
   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER,                         \
e23d3e
     "Cannot serialize externalized SharedArrayBuffer")                       \
e23d3e
-  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, "Failed to set PSK identity hint")  \
e23d3e
 
e23d3e
 #define V(code, message)                                                     \
e23d3e
   inline v8::Local<v8::Value> code(v8::Isolate* isolate) {                   \
e23d3e
diff --git a/src/node_options.cc b/src/node_options.cc
e23d3e
index 4e473ca..710d794 100644
e23d3e
--- a/src/node_options.cc
e23d3e
+++ b/src/node_options.cc
e23d3e
@@ -572,10 +572,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
e23d3e
 
e23d3e
   AddOption("--napi-modules", "", NoOp{}, kAllowedInEnvironment);
e23d3e
 
e23d3e
-  AddOption("--tls-keylog",
e23d3e
-            "log TLS decryption keys to named file for traffic analysis",
e23d3e
-            &EnvironmentOptions::tls_keylog, kAllowedInEnvironment);
e23d3e
-
e23d3e
   AddOption("--tls-min-v1.0",
e23d3e
             "set default TLS minimum to TLSv1.0 (default: TLSv1.2)",
e23d3e
             &EnvironmentOptions::tls_min_v1_0,
e23d3e
diff --git a/src/node_options.h b/src/node_options.h
e23d3e
index 60daf36..0d9aa34 100644
e23d3e
--- a/src/node_options.h
e23d3e
+++ b/src/node_options.h
e23d3e
@@ -167,7 +167,6 @@ class EnvironmentOptions : public Options {
e23d3e
   bool tls_min_v1_3 = false;
e23d3e
   bool tls_max_v1_2 = false;
e23d3e
   bool tls_max_v1_3 = false;
e23d3e
-  std::string tls_keylog;
e23d3e
 
e23d3e
   std::vector<std::string> preload_modules;
e23d3e
 
e23d3e
diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
e23d3e
index 75cfddd..b8a55c6 100644
e23d3e
--- a/src/tls_wrap.cc
e23d3e
+++ b/src/tls_wrap.cc
e23d3e
@@ -28,7 +28,6 @@
e23d3e
 #include "node_crypto_bio.h"  // NodeBIO
e23d3e
 // ClientHelloParser
e23d3e
 #include "node_crypto_clienthello-inl.h"
e23d3e
-#include "node_errors.h"
e23d3e
 #include "stream_base-inl.h"
e23d3e
 #include "util-inl.h"
e23d3e
 
e23d3e
@@ -43,11 +42,8 @@ using v8::Exception;
e23d3e
 using v8::Function;
e23d3e
 using v8::FunctionCallbackInfo;
e23d3e
 using v8::FunctionTemplate;
e23d3e
-using v8::Integer;
e23d3e
 using v8::Isolate;
e23d3e
 using v8::Local;
e23d3e
-using v8::Maybe;
e23d3e
-using v8::MaybeLocal;
e23d3e
 using v8::Object;
e23d3e
 using v8::ReadOnly;
e23d3e
 using v8::Signature;
e23d3e
@@ -1076,131 +1072,6 @@ int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
e23d3e
   return SSL_TLSEXT_ERR_OK;
e23d3e
 }
e23d3e
 
e23d3e
-#ifndef OPENSSL_NO_PSK
e23d3e
-
e23d3e
-void TLSWrap::SetPskIdentityHint(const FunctionCallbackInfo<Value>& args) {
e23d3e
-  TLSWrap* p;
e23d3e
-  ASSIGN_OR_RETURN_UNWRAP(&p, args.Holder());
e23d3e
-  CHECK_NOT_NULL(p->ssl_);
e23d3e
-
e23d3e
-  Environment* env = p->env();
e23d3e
-  Isolate* isolate = env->isolate();
e23d3e
-
e23d3e
-  CHECK(args[0]->IsString());
e23d3e
-  node::Utf8Value hint(isolate, args[0].As<String>());
e23d3e
-
e23d3e
-  if (!SSL_use_psk_identity_hint(p->ssl_.get(), *hint)) {
e23d3e
-    Local<Value> err = node::ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED(isolate);
e23d3e
-    p->MakeCallback(env->onerror_string(), 1, &err;;
e23d3e
-  }
e23d3e
-}
e23d3e
-
e23d3e
-void TLSWrap::EnablePskCallback(const FunctionCallbackInfo<Value>& args) {
e23d3e
-  TLSWrap* wrap;
e23d3e
-  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
e23d3e
-  CHECK_NOT_NULL(wrap->ssl_);
e23d3e
-
e23d3e
-  SSL_set_psk_server_callback(wrap->ssl_.get(), PskServerCallback);
e23d3e
-  SSL_set_psk_client_callback(wrap->ssl_.get(), PskClientCallback);
e23d3e
-}
e23d3e
-
e23d3e
-unsigned int TLSWrap::PskServerCallback(SSL* s,
e23d3e
-                                        const char* identity,
e23d3e
-                                        unsigned char* psk,
e23d3e
-                                        unsigned int max_psk_len) {
e23d3e
-  TLSWrap* p = static_cast<TLSWrap*>(SSL_get_app_data(s));
e23d3e
-
e23d3e
-  Environment* env = p->env();
e23d3e
-  Isolate* isolate = env->isolate();
e23d3e
-  HandleScope scope(isolate);
e23d3e
-
e23d3e
-  MaybeLocal<String> maybe_identity_str =
e23d3e
-      v8::String::NewFromUtf8(isolate, identity, v8::NewStringType::kNormal);
e23d3e
-
e23d3e
-  v8::Local<v8::String> identity_str;
e23d3e
-  if (!maybe_identity_str.ToLocal(&identity_str)) return 0;
e23d3e
-
e23d3e
-  // Make sure there are no utf8 replacement symbols.
e23d3e
-  v8::String::Utf8Value identity_utf8(isolate, identity_str);
e23d3e
-  if (strcmp(*identity_utf8, identity) != 0) return 0;
e23d3e
-
e23d3e
-  Local<Value> argv[] = {identity_str,
e23d3e
-                         Integer::NewFromUnsigned(isolate, max_psk_len)};
e23d3e
-
e23d3e
-  MaybeLocal<Value> maybe_psk_val =
e23d3e
-      p->MakeCallback(env->onpskexchange_symbol(), arraysize(argv), argv);
e23d3e
-  Local<Value> psk_val;
e23d3e
-  if (!maybe_psk_val.ToLocal(&psk_val) || !psk_val->IsArrayBufferView())
e23d3e
-    return 0;
e23d3e
-
e23d3e
-  char* psk_buf = Buffer::Data(psk_val);
e23d3e
-  size_t psk_buflen = Buffer::Length(psk_val);
e23d3e
-
e23d3e
-  if (psk_buflen > max_psk_len) return 0;
e23d3e
-
e23d3e
-  memcpy(psk, psk_buf, psk_buflen);
e23d3e
-  return psk_buflen;
e23d3e
-}
e23d3e
-
e23d3e
-unsigned int TLSWrap::PskClientCallback(SSL* s,
e23d3e
-                                        const char* hint,
e23d3e
-                                        char* identity,
e23d3e
-                                        unsigned int max_identity_len,
e23d3e
-                                        unsigned char* psk,
e23d3e
-                                        unsigned int max_psk_len) {
e23d3e
-  TLSWrap* p = static_cast<TLSWrap*>(SSL_get_app_data(s));
e23d3e
-
e23d3e
-  Environment* env = p->env();
e23d3e
-  Isolate* isolate = env->isolate();
e23d3e
-  HandleScope scope(isolate);
e23d3e
-
e23d3e
-  Local<Value> argv[] = {Null(isolate),
e23d3e
-                         Integer::NewFromUnsigned(isolate, max_psk_len),
e23d3e
-                         Integer::NewFromUnsigned(isolate, max_identity_len)};
e23d3e
-  if (hint != nullptr) {
e23d3e
-    MaybeLocal<String> maybe_hint = String::NewFromUtf8(isolate, hint);
e23d3e
-
e23d3e
-    Local<String> local_hint;
e23d3e
-    if (!maybe_hint.ToLocal(&local_hint)) return 0;
e23d3e
-
e23d3e
-    argv[0] = local_hint;
e23d3e
-  }
e23d3e
-  MaybeLocal<Value> maybe_ret =
e23d3e
-      p->MakeCallback(env->onpskexchange_symbol(), arraysize(argv), argv);
e23d3e
-  Local<Value> ret;
e23d3e
-  if (!maybe_ret.ToLocal(&ret) || !ret->IsObject()) return 0;
e23d3e
-  Local<Object> obj = ret.As<Object>();
e23d3e
-
e23d3e
-  MaybeLocal<Value> maybe_psk_val = obj->Get(env->context(), env->psk_string());
e23d3e
-
e23d3e
-  Local<Value> psk_val;
e23d3e
-  if (!maybe_psk_val.ToLocal(&psk_val) || !psk_val->IsArrayBufferView())
e23d3e
-    return 0;
e23d3e
-
e23d3e
-  char* psk_buf = Buffer::Data(psk_val);
e23d3e
-  size_t psk_buflen = Buffer::Length(psk_val);
e23d3e
-
e23d3e
-  if (psk_buflen > max_psk_len) return 0;
e23d3e
-
e23d3e
-  MaybeLocal<Value> maybe_identity_val =
e23d3e
-      obj->Get(env->context(), env->identity_string());
e23d3e
-  Local<Value> identity_val;
e23d3e
-  if (!maybe_identity_val.ToLocal(&identity_val) || !identity_val->IsString())
e23d3e
-    return 0;
e23d3e
-  Local<String> identity_str = identity_val.As<String>();
e23d3e
-
e23d3e
-  String::Utf8Value identity_buf(isolate, identity_str);
e23d3e
-  size_t identity_len = identity_buf.length();
e23d3e
-
e23d3e
-  if (identity_len > max_identity_len) return 0;
e23d3e
-
e23d3e
-  memcpy(identity, *identity_buf, identity_len);
e23d3e
-  memcpy(psk, psk_buf, psk_buflen);
e23d3e
-
e23d3e
-  return psk_buflen;
e23d3e
-}
e23d3e
-
e23d3e
-#endif
e23d3e
 
e23d3e
 void TLSWrap::GetWriteQueueSize(const FunctionCallbackInfo<Value>& info) {
e23d3e
   TLSWrap* wrap;
e23d3e
@@ -1266,11 +1137,6 @@ void TLSWrap::Initialize(Local<Object> target,
e23d3e
   env->SetProtoMethod(t, "destroySSL", DestroySSL);
e23d3e
   env->SetProtoMethod(t, "enableCertCb", EnableCertCb);
e23d3e
 
e23d3e
-#ifndef OPENSSL_NO_PSK
e23d3e
-  env->SetProtoMethod(t, "setPskIdentityHint", SetPskIdentityHint);
e23d3e
-  env->SetProtoMethod(t, "enablePskCallback", EnablePskCallback);
e23d3e
-#endif
e23d3e
-
e23d3e
   StreamBase::AddMethods(env, t);
e23d3e
   SSLWrap<TLSWrap>::AddMethods(env, t);
e23d3e
 
e23d3e
diff --git a/src/tls_wrap.h b/src/tls_wrap.h
e23d3e
index 7bb33b4..14b7327 100644
e23d3e
--- a/src/tls_wrap.h
e23d3e
+++ b/src/tls_wrap.h
e23d3e
@@ -169,23 +169,6 @@ class TLSWrap : public AsyncWrap,
e23d3e
   static void SetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
   static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
e23d3e
 
e23d3e
-#ifndef OPENSSL_NO_PSK
e23d3e
-  static void SetPskIdentityHint(
e23d3e
-      const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
-  static void EnablePskCallback(
e23d3e
-      const v8::FunctionCallbackInfo<v8::Value>& args);
e23d3e
-  static unsigned int PskServerCallback(SSL* s,
e23d3e
-                                        const char* identity,
e23d3e
-                                        unsigned char* psk,
e23d3e
-                                        unsigned int max_psk_len);
e23d3e
-  static unsigned int PskClientCallback(SSL* s,
e23d3e
-                                        const char* hint,
e23d3e
-                                        char* identity,
e23d3e
-                                        unsigned int max_identity_len,
e23d3e
-                                        unsigned char* psk,
e23d3e
-                                        unsigned int max_psk_len);
e23d3e
-#endif
e23d3e
-
e23d3e
   crypto::SecureContext* sc_;
e23d3e
   // BIO buffers hold encrypted data.
e23d3e
   BIO* enc_in_ = nullptr;   // StreamListener fills this for SSL_read().
e23d3e
diff --git a/test/fixtures/rsa-oaep-test-vectors.js b/test/fixtures/rsa-oaep-test-vectors.js
e23d3e
deleted file mode 100644
e23d3e
index 47e681f..0000000
e23d3e
--- a/test/fixtures/rsa-oaep-test-vectors.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,30 +0,0 @@
e23d3e
-{
e23d3e
-  "comment": "RSA-OAEP test vectors for test-crypto-rsa-dsa.js",
e23d3e
-  "decryptionTests": [
e23d3e
-    {
e23d3e
-      "ct": "16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc7943f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad0598ea6d21c900f3957b65400612306a9bebae441f005646f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee774926ded7910e8768f92db76f63107338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b30"
e23d3e
-    },
e23d3e
-    {
e23d3e
-      "ct": "16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc7943f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad0598ea6d21c900f3957b65400612306a9bebae441f005646f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee774926ded7910e8768f92db76f63107338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b30",
e23d3e
-      "oaepHash": "sha1"
e23d3e
-    },
e23d3e
-    {
e23d3e
-      "ct": "16ccf09afe5eb0130182b9fc1ca4af61a38e772047cac42146bfa0fa5879aa9639203e4d01442d212ff95bddfbe4661222215a2e91908c37ab926edea7cfc53f83357bc27f86af0f5f2818ae141f4e9e934d4e66189aff30f062c9c3f6eb9bc495a59082cb978f99b56ce5fa530a8469e46129258e5c42897cb194b6805e936e5cbbeaa535bad6b1d3cdfc92119b7dd325a2e6d2979e316bdacc9f80e29c7bbdf6846d738e380deadcb48df8c1e8aabf7a9dd2f8c71d6681dbec7dcadc01887c51288674268796bc77fdf8f1c94c9ca50b1cc7cddbaf4e56cb151d23e2c699d2844c0104ee2e7e9dcdb907cfab43339120a40c59ca54f32b8d21b48a29656c77",
e23d3e
-      "oaepHash": "sha256"
e23d3e
-    },
e23d3e
-    {
e23d3e
-      "ct": "831b72e8dd91841729ecbddf2647d6f19dc0094734f8803d8c651b5655a12ae6156b74d9b594bcc0eacd002728380b94f46e8657f130f354e03b6e7815ee257eda78dba296d67d24410c31c48e5875cc79e4bde594b412be5f357f57a7ac1f1d18b718e408df162d1795508e6a0616192b647ad942ea068a44fb2b323d35a3a61b926feb105d6c0b2a8fc8050222d1cf4a9e44da1f95bbc677fd643749c6c89ac551d072f04cd9320c97a8d94755c8a804954c082bed7fa59199a00aca154c14a7b584b63c538daf9b9c7c90abfca19387d2131f9d9b9ecfc8672249c33144d1be3bfc41558a13f994663661a3af24fd0a97619d508db36f5fc131af86fc68cf",
e23d3e
-      "oaepHash": "sha512"
e23d3e
-    },
e23d3e
-    {
e23d3e
-      "ct": "04a25a3dbe0a44b10b7dde19632ce0963e7a7e9876905cd4a4f68ba8e0bda593a738847235df4494f9c28927b165511d22006ef6fae0eb7fe01883e4ae495643328d21e13dad65e71e45f885c7e1e2fe77c39fa84b8bbd2d7d3ed72fea2bf3c87a5c864bdc41b45caa3d668ca3f35297f43dc97950fa959ee88031c8385da7628d03923dfd26a7e0568c95a2f38ec5760335b00fa30935abdd9ab5b3581fc319ff787c59930319707caa24fe9e5d0ce6c48eff4ee6e124fd6c595353acc29a194863dbf7b74d08edf7129ca52eb5f4ccf3888311e97602fcd37b476c41749b260efad4e0760064082f7c9ea0f8704134936b2e38fd0f82886486b5f7e5fb9696",
e23d3e
-      "oaepHash": "sha384",
e23d3e
-      "oaepLabel": "01020304"
e23d3e
-    },
e23d3e
-    {
e23d3e
-      "ct": "678f9ff724e0f48b48e6ff3cbdac5eb995d263da1c23f948d8d09411131f69f40da07f0c650e1aedc82fbaf0972a5d3b3e8f1f82cc4fa1780abfebb4e06b6827a52bf768b12388817c1e3ee1324342e05135733a4056a6cc02f5211172c338eb96e5e33c1d6f53560e3f3aab2419c13a600c4e67648088ffe8aac2cea8bce78e2ab899741cf7c9a9d5246cde6ce97aae0157f42db68eea380dec6dcd842c1e6900ae21d5275c4bf21810b5e1b0e1bc0441cbce34e00a31b9e857f6f2c791257d45997c278ea928f42e8cb6476f633f5de102fa0c4af964a9c4f4336869509e933ebc0aa94ad16b0b1db2aaa924f409a5f9f29dfbd88849c5eaa4818e1c3e335e",
e23d3e
-      "oaepHash": "sha1",
e23d3e
-      "oaepLabel": "00112233445566778899"
e23d3e
-    }
e23d3e
-  ]
e23d3e
-}
e23d3e
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
e23d3e
index 30ef7ec..c773aae 100644
e23d3e
--- a/test/parallel/test-crypto-rsa-dsa.js
e23d3e
+++ b/test/parallel/test-crypto-rsa-dsa.js
e23d3e
@@ -202,21 +202,59 @@ common.expectsError(() => {
e23d3e
 // The following RSA-OAEP test cases were created using the WebCrypto API to
e23d3e
 // ensure compatibility when using non-SHA1 hash functions.
e23d3e
 {
e23d3e
-  const { decryptionTests } =
e23d3e
-      JSON.parse(fixtures.readSync('rsa-oaep-test-vectors.js', 'utf8'));
e23d3e
-
e23d3e
-  for (const { ct, oaepHash, oaepLabel } of decryptionTests) {
e23d3e
+  function testDecrypt(oaepHash, ciphertext) {
e23d3e
     const decrypted = crypto.privateDecrypt({
e23d3e
       key: rsaPkcs8KeyPem,
e23d3e
-      oaepHash,
e23d3e
-      oaepLabel: oaepLabel ? Buffer.from(oaepLabel, 'hex') : undefined
e23d3e
-    }, Buffer.from(ct, 'hex'));
e23d3e
+      oaepHash
e23d3e
+    }, Buffer.from(ciphertext, 'hex'));
e23d3e
 
e23d3e
     assert.strictEqual(decrypted.toString('utf8'), 'Hello Node.js');
e23d3e
   }
e23d3e
+
e23d3e
+  testDecrypt(undefined, '16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc' +
e23d3e
+                         '7943f4136899348c54116d15b2c17563b9c7143f9d5b85b4561' +
e23d3e
+                         '5ad0598ea6d21c900f3957b65400612306a9bebae441f005646' +
e23d3e
+                         'f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff4' +
e23d3e
+                         '30a524904c4a11c683764b7c8dbb60df0952768381cdba4d665' +
e23d3e
+                         'e5006034393a10d56d33e75b2714db824a18da46441ef7f94a3' +
e23d3e
+                         '4a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b2' +
e23d3e
+                         '96fc51d77da44799e4ee774926ded7910e8768f92db76f63107' +
e23d3e
+                         '338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a64' +
e23d3e
+                         '62849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b' +
e23d3e
+                         '30');
e23d3e
+  testDecrypt('sha1', '16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc794' +
e23d3e
+                      '3f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad059' +
e23d3e
+                      '8ea6d21c900f3957b65400612306a9bebae441f005646f7a7c9712' +
e23d3e
+                      '9a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a' +
e23d3e
+                      '11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d' +
e23d3e
+                      '56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad039408' +
e23d3e
+                      '3a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee7' +
e23d3e
+                      '74926ded7910e8768f92db76f63107338d33354b735d3ad094240d' +
e23d3e
+                      'bd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87' +
e23d3e
+                      'c4d2ec89866c5cdbb696bd2b30');
e23d3e
+  testDecrypt('sha256', '16ccf09afe5eb0130182b9fc1ca4af61a38e772047cac42146bf' +
e23d3e
+                        'a0fa5879aa9639203e4d01442d212ff95bddfbe4661222215a2e' +
e23d3e
+                        '91908c37ab926edea7cfc53f83357bc27f86af0f5f2818ae141f' +
e23d3e
+                        '4e9e934d4e66189aff30f062c9c3f6eb9bc495a59082cb978f99' +
e23d3e
+                        'b56ce5fa530a8469e46129258e5c42897cb194b6805e936e5cbb' +
e23d3e
+                        'eaa535bad6b1d3cdfc92119b7dd325a2e6d2979e316bdacc9f80' +
e23d3e
+                        'e29c7bbdf6846d738e380deadcb48df8c1e8aabf7a9dd2f8c71d' +
e23d3e
+                        '6681dbec7dcadc01887c51288674268796bc77fdf8f1c94c9ca5' +
e23d3e
+                        '0b1cc7cddbaf4e56cb151d23e2c699d2844c0104ee2e7e9dcdb9' +
e23d3e
+                        '07cfab43339120a40c59ca54f32b8d21b48a29656c77');
e23d3e
+  testDecrypt('sha512', '831b72e8dd91841729ecbddf2647d6f19dc0094734f8803d8c65' +
e23d3e
+                        '1b5655a12ae6156b74d9b594bcc0eacd002728380b94f46e8657' +
e23d3e
+                        'f130f354e03b6e7815ee257eda78dba296d67d24410c31c48e58' +
e23d3e
+                        '75cc79e4bde594b412be5f357f57a7ac1f1d18b718e408df162d' +
e23d3e
+                        '1795508e6a0616192b647ad942ea068a44fb2b323d35a3a61b92' +
e23d3e
+                        '6feb105d6c0b2a8fc8050222d1cf4a9e44da1f95bbc677fd6437' +
e23d3e
+                        '49c6c89ac551d072f04cd9320c97a8d94755c8a804954c082bed' +
e23d3e
+                        '7fa59199a00aca154c14a7b584b63c538daf9b9c7c90abfca193' +
e23d3e
+                        '87d2131f9d9b9ecfc8672249c33144d1be3bfc41558a13f99466' +
e23d3e
+                        '3661a3af24fd0a97619d508db36f5fc131af86fc68cf');
e23d3e
 }
e23d3e
 
e23d3e
-// Test invalid oaepHash and oaepLabel options.
e23d3e
+// Test invalid oaepHash options.
e23d3e
 for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
e23d3e
   assert.throws(() => {
e23d3e
     fn({
e23d3e
@@ -237,17 +275,6 @@ for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
e23d3e
       code: 'ERR_INVALID_ARG_TYPE'
e23d3e
     });
e23d3e
   }
e23d3e
-
e23d3e
-  for (const oaepLabel of [0, false, null, Symbol(), () => {}, {}, 'foo']) {
e23d3e
-    common.expectsError(() => {
e23d3e
-      fn({
e23d3e
-        key: rsaPubPem,
e23d3e
-        oaepLabel
e23d3e
-      }, Buffer.alloc(10));
e23d3e
-    }, {
e23d3e
-      code: 'ERR_INVALID_ARG_TYPE'
e23d3e
-    });
e23d3e
-  }
e23d3e
 }
e23d3e
 
e23d3e
 // Test RSA key signing/verification
e23d3e
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
e23d3e
index d98317a..b3861dd 100644
e23d3e
--- a/test/parallel/test-crypto-sign-verify.js
e23d3e
+++ b/test/parallel/test-crypto-sign-verify.js
e23d3e
@@ -501,91 +501,21 @@ common.expectsError(
e23d3e
 });
e23d3e
 
e23d3e
 {
e23d3e
+  const privKey = fixtures.readKey('ec-key.pem');
e23d3e
   const data = Buffer.from('Hello world');
e23d3e
-  const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
e23d3e
-
e23d3e
-  for (const [file, length] of keys) {
e23d3e
-    const privKey = fixtures.readKey(file);
e23d3e
-    [
e23d3e
-      crypto.createSign('sha1').update(data).sign(privKey),
e23d3e
-      crypto.sign('sha1', data, privKey),
e23d3e
-      crypto.sign('sha1', data, { key: privKey, dsaEncoding: 'der' })
e23d3e
-    ].forEach((sig) => {
e23d3e
-      // Signature length variability due to DER encoding
e23d3e
-      assert(sig.length >= length + 4 && sig.length <= length + 8);
e23d3e
-
e23d3e
-      assert.strictEqual(
e23d3e
-        crypto.createVerify('sha1').update(data).verify(privKey, sig),
e23d3e
-        true
e23d3e
-      );
e23d3e
-      assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
e23d3e
-    });
e23d3e
-
e23d3e
-    // Test (EC)DSA signature conversion.
e23d3e
-    const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
e23d3e
-    let sig = crypto.sign('sha1', data, opts);
e23d3e
-    // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
e23d3e
-    assert.strictEqual(sig.length, length);
e23d3e
-    assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
e23d3e
-
e23d3e
-    // Test invalid signature lengths.
e23d3e
-    for (const i of [-2, -1, 1, 2, 4, 8]) {
e23d3e
-      sig = crypto.randomBytes(length + i);
e23d3e
-      common.expectsError(() => {
e23d3e
-        crypto.verify('sha1', data, opts, sig);
e23d3e
-      }, {
e23d3e
-        message: 'Malformed signature'
e23d3e
-      });
e23d3e
-    }
e23d3e
-  }
e23d3e
+  [
e23d3e
+    crypto.createSign('sha1').update(data).sign(privKey),
e23d3e
+    crypto.sign('sha1', data, privKey)
e23d3e
+  ].forEach((sig) => {
e23d3e
+    // Signature length variability due to DER encoding
e23d3e
+    assert.strictEqual(sig.length >= 68, true);
e23d3e
 
e23d3e
-  // Test verifying externally signed messages.
e23d3e
-  const extSig = Buffer.from('494c18ab5c8a62a72aea5041966902bcfa229821af2bf65' +
e23d3e
-                             '0b5b4870d1fe6aebeaed9460c62210693b5b0a300033823' +
e23d3e
-                             '33d9529c8abd8c5948940af944828be16c', 'hex');
e23d3e
-  for (const ok of [true, false]) {
e23d3e
     assert.strictEqual(
e23d3e
-      crypto.verify('sha256', data, {
e23d3e
-        key: fixtures.readKey('ec-key.pem'),
e23d3e
-        dsaEncoding: 'ieee-p1363'
e23d3e
-      }, extSig),
e23d3e
-      ok
e23d3e
+      crypto.createVerify('sha1').update(data).verify(privKey, sig),
e23d3e
+      true
e23d3e
     );
e23d3e
-
e23d3e
-    extSig[Math.floor(Math.random() * extSig.length)] ^= 1;
e23d3e
-  }
e23d3e
-
e23d3e
-  // Non-(EC)DSA keys should ignore the option.
e23d3e
-  const sig = crypto.sign('sha1', data, {
e23d3e
-    key: keyPem,
e23d3e
-    dsaEncoding: 'ieee-p1363'
e23d3e
+    assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
e23d3e
   });
e23d3e
-  assert.strictEqual(crypto.verify('sha1', data, certPem, sig), true);
e23d3e
-  assert.strictEqual(
e23d3e
-    crypto.verify('sha1', data, {
e23d3e
-      key: certPem,
e23d3e
-      dsaEncoding: 'ieee-p1363'
e23d3e
-    }, sig),
e23d3e
-    true
e23d3e
-  );
e23d3e
-  assert.strictEqual(
e23d3e
-    crypto.verify('sha1', data, {
e23d3e
-      key: certPem,
e23d3e
-      dsaEncoding: 'der'
e23d3e
-    }, sig),
e23d3e
-    true
e23d3e
-  );
e23d3e
-
e23d3e
-  for (const dsaEncoding of ['foo', null, {}, 5, true, NaN]) {
e23d3e
-    common.expectsError(() => {
e23d3e
-      crypto.sign('sha1', data, {
e23d3e
-        key: certPem,
e23d3e
-        dsaEncoding
e23d3e
-      });
e23d3e
-    }, {
e23d3e
-      code: 'ERR_INVALID_OPT_VALUE'
e23d3e
-    });
e23d3e
-  }
e23d3e
 }
e23d3e
 
e23d3e
 
e23d3e
diff --git a/test/parallel/test-https-agent-keylog.js b/test/parallel/test-https-agent-keylog.js
e23d3e
deleted file mode 100644
e23d3e
index 2fc13cb..0000000
e23d3e
--- a/test/parallel/test-https-agent-keylog.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,44 +0,0 @@
e23d3e
-'use strict';
e23d3e
-
e23d3e
-const common = require('../common');
e23d3e
-if (!common.hasCrypto)
e23d3e
-  common.skip('missing crypto');
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-const https = require('https');
e23d3e
-const fixtures = require('../common/fixtures');
e23d3e
-
e23d3e
-const server = https.createServer({
e23d3e
-  key: fixtures.readKey('agent2-key.pem'),
e23d3e
-  cert: fixtures.readKey('agent2-cert.pem'),
e23d3e
-  // Amount of keylog events depends on negotiated protocol
e23d3e
-  // version, so force a specific one:
e23d3e
-  minVersion: 'TLSv1.3',
e23d3e
-  maxVersion: 'TLSv1.3',
e23d3e
-}, (req, res) => {
e23d3e
-  res.end('bye');
e23d3e
-}).listen(() => {
e23d3e
-  https.get({
e23d3e
-    port: server.address().port,
e23d3e
-    rejectUnauthorized: false,
e23d3e
-  }, (res) => {
e23d3e
-    res.resume();
e23d3e
-    res.on('end', () => {
e23d3e
-      // Trigger TLS connection reuse
e23d3e
-      https.get({
e23d3e
-        port: server.address().port,
e23d3e
-        rejectUnauthorized: false,
e23d3e
-      }, (res) => {
e23d3e
-        server.close();
e23d3e
-        res.resume();
e23d3e
-      });
e23d3e
-    });
e23d3e
-  });
e23d3e
-});
e23d3e
-
e23d3e
-const verifyKeylog = (line, tlsSocket) => {
e23d3e
-  assert(Buffer.isBuffer(line));
e23d3e
-  assert.strictEqual(tlsSocket.encrypted, true);
e23d3e
-};
e23d3e
-server.on('keylog', common.mustCall(verifyKeylog, 10));
e23d3e
-https.globalAgent.on('keylog', common.mustCall(verifyKeylog, 10));
e23d3e
diff --git a/test/parallel/test-tls-enable-keylog-cli.js b/test/parallel/test-tls-enable-keylog-cli.js
e23d3e
deleted file mode 100644
e23d3e
index 5d05069..0000000
e23d3e
--- a/test/parallel/test-tls-enable-keylog-cli.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,57 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-if (!common.hasCrypto) common.skip('missing crypto');
e23d3e
-const fixtures = require('../common/fixtures');
e23d3e
-
e23d3e
-// Test --tls-keylog CLI flag.
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-const path = require('path');
e23d3e
-const fs = require('fs');
e23d3e
-const { fork } = require('child_process');
e23d3e
-
e23d3e
-if (process.argv[2] === 'test')
e23d3e
-  return test();
e23d3e
-
e23d3e
-const tmpdir = require('../common/tmpdir');
e23d3e
-tmpdir.refresh();
e23d3e
-const file = path.resolve(tmpdir.path, 'keylog.log');
e23d3e
-
e23d3e
-const child = fork(__filename, ['test'], {
e23d3e
-  execArgv: ['--tls-keylog=' + file]
e23d3e
-});
e23d3e
-
e23d3e
-child.on('close', common.mustCall((code, signal) => {
e23d3e
-  assert.strictEqual(code, 0);
e23d3e
-  assert.strictEqual(signal, null);
e23d3e
-  const log = fs.readFileSync(file, 'utf8');
e23d3e
-  assert(/SECRET/.test(log));
e23d3e
-}));
e23d3e
-
e23d3e
-function test() {
e23d3e
-  const {
e23d3e
-    connect, keys
e23d3e
-  } = require(fixtures.path('tls-connect'));
e23d3e
-
e23d3e
-  connect({
e23d3e
-    client: {
e23d3e
-      checkServerIdentity: (servername, cert) => { },
e23d3e
-      ca: `${keys.agent1.cert}\n${keys.agent6.ca}`,
e23d3e
-    },
e23d3e
-    server: {
e23d3e
-      cert: keys.agent6.cert,
e23d3e
-      key: keys.agent6.key
e23d3e
-    },
e23d3e
-  }, common.mustCall((err, pair, cleanup) => {
e23d3e
-    if (pair.server.err) {
e23d3e
-      console.trace('server', pair.server.err);
e23d3e
-    }
e23d3e
-    if (pair.client.err) {
e23d3e
-      console.trace('client', pair.client.err);
e23d3e
-    }
e23d3e
-    assert.ifError(pair.server.err);
e23d3e
-    assert.ifError(pair.client.err);
e23d3e
-
e23d3e
-    return cleanup();
e23d3e
-  }));
e23d3e
-}
e23d3e
diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
e23d3e
index 744276a..624f8ef 100644
e23d3e
--- a/test/parallel/test-tls-getcipher.js
e23d3e
+++ b/test/parallel/test-tls-getcipher.js
e23d3e
@@ -52,7 +52,6 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
e23d3e
   }, common.mustCall(function() {
e23d3e
     const cipher = this.getCipher();
e23d3e
     assert.strictEqual(cipher.name, 'AES128-SHA256');
e23d3e
-    assert.strictEqual(cipher.standardName, 'TLS_RSA_WITH_AES_128_CBC_SHA256');
e23d3e
     assert.strictEqual(cipher.version, 'TLSv1.2');
e23d3e
     this.end();
e23d3e
   }));
e23d3e
@@ -66,8 +65,6 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
e23d3e
   }, common.mustCall(function() {
e23d3e
     const cipher = this.getCipher();
e23d3e
     assert.strictEqual(cipher.name, 'ECDHE-RSA-AES128-GCM-SHA256');
e23d3e
-    assert.strictEqual(cipher.standardName,
e23d3e
-                       'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256');
e23d3e
     assert.strictEqual(cipher.version, 'TLSv1.2');
e23d3e
     this.end();
e23d3e
   }));
e23d3e
@@ -89,7 +86,6 @@ tls.createServer({
e23d3e
   }, common.mustCall(() => {
e23d3e
     const cipher = client.getCipher();
e23d3e
     assert.strictEqual(cipher.name, 'TLS_AES_128_CCM_8_SHA256');
e23d3e
-    assert.strictEqual(cipher.standardName, cipher.name);
e23d3e
     assert.strictEqual(cipher.version, 'TLSv1.3');
e23d3e
     client.end();
e23d3e
   }));
e23d3e
diff --git a/test/parallel/test-tls-keylog-tlsv13.js b/test/parallel/test-tls-keylog-tlsv13.js
e23d3e
index f26dece..0f65564 100644
e23d3e
--- a/test/parallel/test-tls-keylog-tlsv13.js
e23d3e
+++ b/test/parallel/test-tls-keylog-tlsv13.js
e23d3e
@@ -21,13 +21,9 @@ const server = tls.createServer({
e23d3e
     rejectUnauthorized: false,
e23d3e
   });
e23d3e
 
e23d3e
-  server.on('keylog', common.mustCall((line, tlsSocket) => {
e23d3e
-    assert(Buffer.isBuffer(line));
e23d3e
-    assert.strictEqual(tlsSocket.encrypted, true);
e23d3e
-  }, 5));
e23d3e
-  client.on('keylog', common.mustCall((line) => {
e23d3e
-    assert(Buffer.isBuffer(line));
e23d3e
-  }, 5));
e23d3e
+  const verifyBuffer = (line) => assert(Buffer.isBuffer(line));
e23d3e
+  server.on('keylog', common.mustCall(verifyBuffer, 5));
e23d3e
+  client.on('keylog', common.mustCall(verifyBuffer, 5));
e23d3e
 
e23d3e
   client.once('secureConnect', () => {
e23d3e
     server.close();
e23d3e
diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
e23d3e
index b9eaa05..c5e66f3 100644
e23d3e
--- a/test/parallel/test-tls-multi-key.js
e23d3e
+++ b/test/parallel/test-tls-multi-key.js
e23d3e
@@ -157,7 +157,6 @@ function test(options) {
e23d3e
     }, common.mustCall(function() {
e23d3e
       assert.deepStrictEqual(ecdsa.getCipher(), {
e23d3e
         name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
e23d3e
-        standardName: 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
e23d3e
         version: 'TLSv1.2'
e23d3e
       });
e23d3e
       assert.strictEqual(ecdsa.getPeerCertificate().subject.CN, eccCN);
e23d3e
@@ -176,7 +175,6 @@ function test(options) {
e23d3e
     }, common.mustCall(function() {
e23d3e
       assert.deepStrictEqual(rsa.getCipher(), {
e23d3e
         name: 'ECDHE-RSA-AES256-GCM-SHA384',
e23d3e
-        standardName: 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
e23d3e
         version: 'TLSv1.2'
e23d3e
       });
e23d3e
       assert.strictEqual(rsa.getPeerCertificate().subject.CN, rsaCN);
e23d3e
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
e23d3e
index c20376a..3b0c059 100644
e23d3e
--- a/test/parallel/test-tls-multi-pfx.js
e23d3e
+++ b/test/parallel/test-tls-multi-pfx.js
e23d3e
@@ -42,11 +42,9 @@ const server = tls.createServer(options, function(conn) {
e23d3e
 process.on('exit', function() {
e23d3e
   assert.deepStrictEqual(ciphers, [{
e23d3e
     name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
e23d3e
-    standardName: 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
e23d3e
     version: 'TLSv1.2'
e23d3e
   }, {
e23d3e
     name: 'ECDHE-RSA-AES256-GCM-SHA384',
e23d3e
-    standardName: 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
e23d3e
     version: 'TLSv1.2'
e23d3e
   }]);
e23d3e
 });
e23d3e
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
e23d3e
deleted file mode 100644
e23d3e
index 4bcdf36..0000000
e23d3e
--- a/test/parallel/test-tls-psk-circuit.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,72 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-
e23d3e
-if (!common.hasCrypto)
e23d3e
-  common.skip('missing crypto');
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-const tls = require('tls');
e23d3e
-
e23d3e
-const CIPHERS = 'PSK+HIGH:TLS_AES_128_GCM_SHA256';
e23d3e
-const USERS = {
e23d3e
-  UserA: Buffer.allocUnsafe(128),
e23d3e
-  UserB: Buffer.from('82072606b502b0f4025e90eb75fe137d', 'hex'),
e23d3e
-};
e23d3e
-const TEST_DATA = 'x';
e23d3e
-
e23d3e
-const serverOptions = {
e23d3e
-  ciphers: CIPHERS,
e23d3e
-  pskCallback(socket, id) {
e23d3e
-    assert.ok(socket instanceof tls.TLSSocket);
e23d3e
-    assert.ok(typeof id === 'string');
e23d3e
-    return USERS[id];
e23d3e
-  },
e23d3e
-};
e23d3e
-
e23d3e
-function test(secret, opts, error) {
e23d3e
-  const cb = !error ?
e23d3e
-    common.mustCall((c) => { c.pipe(c); }) :
e23d3e
-    common.mustNotCall();
e23d3e
-  const server = tls.createServer(serverOptions, cb);
e23d3e
-  server.listen(0, common.mustCall(() => {
e23d3e
-    const options = {
e23d3e
-      port: server.address().port,
e23d3e
-      ciphers: CIPHERS,
e23d3e
-      checkServerIdentity: () => {},
e23d3e
-      pskCallback: common.mustCall(() => secret),
e23d3e
-      ...opts,
e23d3e
-    };
e23d3e
-
e23d3e
-    if (!error) {
e23d3e
-      const client = tls.connect(options, common.mustCall(() => {
e23d3e
-        client.end(TEST_DATA);
e23d3e
-
e23d3e
-        client.on('data', common.mustCall((data) => {
e23d3e
-          assert.strictEqual(data.toString(), TEST_DATA);
e23d3e
-        }));
e23d3e
-        client.on('close', common.mustCall(() => server.close()));
e23d3e
-      }));
e23d3e
-    } else {
e23d3e
-      const client = tls.connect(options, common.mustNotCall());
e23d3e
-      client.on('error', common.mustCall((err) => {
e23d3e
-        assert.strictEqual(err.message, error);
e23d3e
-        server.close();
e23d3e
-      }));
e23d3e
-    }
e23d3e
-  }));
e23d3e
-}
e23d3e
-
e23d3e
-const DISCONNECT_MESSAGE =
e23d3e
-  'Client network socket disconnected before ' +
e23d3e
-  'secure TLS connection was established';
e23d3e
-
e23d3e
-test({ psk: USERS.UserA, identity: 'UserA' });
e23d3e
-test({ psk: USERS.UserA, identity: 'UserA' }, { maxVersion: 'TLSv1.2' });
e23d3e
-test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
e23d3e
-test({ psk: USERS.UserB, identity: 'UserB' });
e23d3e
-test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
e23d3e
-// Unrecognized user should fail handshake
e23d3e
-test({ psk: USERS.UserB, identity: 'UserC' }, {}, DISCONNECT_MESSAGE);
e23d3e
-// Recognized user but incorrect secret should fail handshake
e23d3e
-test({ psk: USERS.UserA, identity: 'UserB' }, {}, DISCONNECT_MESSAGE);
e23d3e
-test({ psk: USERS.UserB, identity: 'UserB' });
e23d3e
diff --git a/test/parallel/test-tls-psk-errors.js b/test/parallel/test-tls-psk-errors.js
e23d3e
deleted file mode 100644
e23d3e
index 4864a66..0000000
e23d3e
--- a/test/parallel/test-tls-psk-errors.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,32 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-
e23d3e
-if (!common.hasCrypto)
e23d3e
-  common.skip('missing crypto');
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-const tls = require('tls');
e23d3e
-
e23d3e
-{
e23d3e
-  // Check tlsClientError on invalid pskIdentityHint.
e23d3e
-
e23d3e
-  const server = tls.createServer({
e23d3e
-    ciphers: 'PSK+HIGH',
e23d3e
-    pskCallback: () => {},
e23d3e
-    pskIdentityHint: 'a'.repeat(512), // Too long identity hint.
e23d3e
-  });
e23d3e
-  server.on('tlsClientError', (err) => {
e23d3e
-    assert.ok(err instanceof Error);
e23d3e
-    assert.strictEqual(err.code, 'ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED');
e23d3e
-    server.close();
e23d3e
-  });
e23d3e
-  server.listen(0, () => {
e23d3e
-    const client = tls.connect({
e23d3e
-      port: server.address().port,
e23d3e
-      ciphers: 'PSK+HIGH',
e23d3e
-      checkServerIdentity: () => {},
e23d3e
-      pskCallback: () => {},
e23d3e
-    }, () => {});
e23d3e
-    client.on('error', common.expectsError({ code: 'ECONNRESET' }));
e23d3e
-  });
e23d3e
-}
e23d3e
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
e23d3e
deleted file mode 100644
e23d3e
index 69b850c..0000000
e23d3e
--- a/test/parallel/test-tls-psk-server.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,77 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-
e23d3e
-if (!common.hasCrypto)
e23d3e
-  common.skip('missing crypto');
e23d3e
-if (!common.opensslCli)
e23d3e
-  common.skip('missing openssl cli');
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-
e23d3e
-const tls = require('tls');
e23d3e
-const spawn = require('child_process').spawn;
e23d3e
-
e23d3e
-const CIPHERS = 'PSK+HIGH';
e23d3e
-const KEY = 'd731ef57be09e5204f0b205b60627028';
e23d3e
-const IDENTITY = 'TestUser';
e23d3e
-
e23d3e
-const server = tls.createServer({
e23d3e
-  ciphers: CIPHERS,
e23d3e
-  pskIdentityHint: IDENTITY,
e23d3e
-  pskCallback(socket, identity) {
e23d3e
-    assert.ok(socket instanceof tls.TLSSocket);
e23d3e
-    assert.ok(typeof identity === 'string');
e23d3e
-    if (identity === IDENTITY)
e23d3e
-      return Buffer.from(KEY, 'hex');
e23d3e
-  }
e23d3e
-});
e23d3e
-
e23d3e
-server.on('connection', common.mustCall());
e23d3e
-
e23d3e
-server.on('secureConnection', (socket) => {
e23d3e
-  socket.write('hello\r\n');
e23d3e
-
e23d3e
-  socket.on('data', (data) => {
e23d3e
-    socket.write(data);
e23d3e
-  });
e23d3e
-});
e23d3e
-
e23d3e
-let gotHello = false;
e23d3e
-let sentWorld = false;
e23d3e
-let gotWorld = false;
e23d3e
-
e23d3e
-server.listen(0, () => {
e23d3e
-  const client = spawn(common.opensslCli, [
e23d3e
-    's_client',
e23d3e
-    '-connect', '127.0.0.1:' + server.address().port,
e23d3e
-    '-cipher', CIPHERS,
e23d3e
-    '-psk', KEY,
e23d3e
-    '-psk_identity', IDENTITY
e23d3e
-  ]);
e23d3e
-
e23d3e
-  let out = '';
e23d3e
-
e23d3e
-  client.stdout.setEncoding('utf8');
e23d3e
-  client.stdout.on('data', (d) => {
e23d3e
-    out += d;
e23d3e
-
e23d3e
-    if (!gotHello && /hello/.test(out)) {
e23d3e
-      gotHello = true;
e23d3e
-      client.stdin.write('world\r\n');
e23d3e
-      sentWorld = true;
e23d3e
-    }
e23d3e
-
e23d3e
-    if (!gotWorld && /world/.test(out)) {
e23d3e
-      gotWorld = true;
e23d3e
-      client.stdin.end();
e23d3e
-    }
e23d3e
-  });
e23d3e
-
e23d3e
-  client.on('exit', common.mustCall((code) => {
e23d3e
-    assert.ok(gotHello);
e23d3e
-    assert.ok(sentWorld);
e23d3e
-    assert.ok(gotWorld);
e23d3e
-    assert.strictEqual(code, 0);
e23d3e
-    server.close();
e23d3e
-  }));
e23d3e
-});
e23d3e
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
e23d3e
deleted file mode 100644
e23d3e
index 59dc2ca..0000000
e23d3e
--- a/test/parallel/test-tls-set-sigalgs.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,74 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-if (!common.hasCrypto) common.skip('missing crypto');
e23d3e
-const fixtures = require('../common/fixtures');
e23d3e
-
e23d3e
-// Test sigalgs: option for TLS.
e23d3e
-
e23d3e
-const {
e23d3e
-  assert, connect, keys
e23d3e
-} = require(fixtures.path('tls-connect'));
e23d3e
-
e23d3e
-function assert_arrays_equal(left, right) {
e23d3e
-  assert.strictEqual(left.length, right.length);
e23d3e
-  for (let i = 0; i < left.length; i++) {
e23d3e
-    assert.strictEqual(left[i], right[i]);
e23d3e
-  }
e23d3e
-}
e23d3e
-
e23d3e
-function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) {
e23d3e
-  assert(shared_sigalgs || serr || cerr, 'test missing any expectations');
e23d3e
-  connect({
e23d3e
-    client: {
e23d3e
-      checkServerIdentity: (servername, cert) => { },
e23d3e
-      ca: `${keys.agent1.cert}\n${keys.agent6.ca}`,
e23d3e
-      cert: keys.agent2.cert,
e23d3e
-      key: keys.agent2.key,
e23d3e
-      sigalgs: csigalgs
e23d3e
-    },
e23d3e
-    server: {
e23d3e
-      cert: keys.agent6.cert,
e23d3e
-      key: keys.agent6.key,
e23d3e
-      ca: keys.agent2.ca,
e23d3e
-      context: {
e23d3e
-        requestCert: true,
e23d3e
-        rejectUnauthorized: true
e23d3e
-      },
e23d3e
-      sigalgs: ssigalgs
e23d3e
-    },
e23d3e
-  }, common.mustCall((err, pair, cleanup) => {
e23d3e
-    if (shared_sigalgs) {
e23d3e
-      assert.ifError(err);
e23d3e
-      assert.ifError(pair.server.err);
e23d3e
-      assert.ifError(pair.client.err);
e23d3e
-      assert(pair.server.conn);
e23d3e
-      assert(pair.client.conn);
e23d3e
-      assert_arrays_equal(pair.server.conn.getSharedSigalgs(), shared_sigalgs);
e23d3e
-    } else {
e23d3e
-      if (serr) {
e23d3e
-        assert(pair.server.err);
e23d3e
-        assert(pair.server.err.code, serr);
e23d3e
-      }
e23d3e
-
e23d3e
-      if (cerr) {
e23d3e
-        assert(pair.client.err);
e23d3e
-        assert(pair.client.err.code, cerr);
e23d3e
-      }
e23d3e
-    }
e23d3e
-
e23d3e
-    return cleanup();
e23d3e
-  }));
e23d3e
-}
e23d3e
-
e23d3e
-// Have shared sigalgs
e23d3e
-test('RSA-PSS+SHA384', 'RSA-PSS+SHA384', ['RSA-PSS+SHA384']);
e23d3e
-test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
e23d3e
-     'RSA-PSS+SHA256:ECDSA+SHA256',
e23d3e
-     ['RSA-PSS+SHA256', 'ECDSA+SHA256']);
e23d3e
-
e23d3e
-// Do not have shared sigalgs.
e23d3e
-test('RSA-PSS+SHA384', 'ECDSA+SHA256',
e23d3e
-     undefined, 'ECONNRESET', 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITMS');
e23d3e
-
e23d3e
-test('RSA-PSS+SHA384:ECDSA+SHA256', 'ECDSA+SHA384:RSA-PSS+SHA256',
e23d3e
-     undefined, 'ECONNRESET', 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITMS');
e23d3e
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
e23d3e
deleted file mode 100644
e23d3e
index 7c9fb93..0000000
e23d3e
--- a/test/sequential/test-tls-psk-client.js
e23d3e
+++ /dev/null
e23d3e
@@ -1,96 +0,0 @@
e23d3e
-'use strict';
e23d3e
-const common = require('../common');
e23d3e
-
e23d3e
-if (!common.hasCrypto)
e23d3e
-  common.skip('missing crypto');
e23d3e
-if (!common.opensslCli)
e23d3e
-  common.skip('missing openssl cli');
e23d3e
-
e23d3e
-const assert = require('assert');
e23d3e
-const tls = require('tls');
e23d3e
-const net = require('net');
e23d3e
-const { spawn } = require('child_process');
e23d3e
-
e23d3e
-const CIPHERS = 'PSK+HIGH';
e23d3e
-const KEY = 'd731ef57be09e5204f0b205b60627028';
e23d3e
-const IDENTITY = 'Client_identity';  // Hardcoded by `openssl s_server`
e23d3e
-
e23d3e
-const server = spawn(common.opensslCli, [
e23d3e
-  's_server',
e23d3e
-  '-accept', common.PORT,
e23d3e
-  '-cipher', CIPHERS,
e23d3e
-  '-psk', KEY,
e23d3e
-  '-psk_hint', IDENTITY,
e23d3e
-  '-nocert',
e23d3e
-  '-rev',
e23d3e
-]);
e23d3e
-
e23d3e
-const cleanUp = (err) => {
e23d3e
-  clearTimeout(timeout);
e23d3e
-  if (err)
e23d3e
-    console.log('Failed:', err);
e23d3e
-  server.kill();
e23d3e
-  process.exitCode = err ? 1 : 0;
e23d3e
-};
e23d3e
-
e23d3e
-const timeout = setTimeout(() => cleanUp('Timeouted'), 5000);
e23d3e
-
e23d3e
-function waitForPort(port, cb) {
e23d3e
-  const socket = net.connect(common.PORT, () => {
e23d3e
-    socket.end();
e23d3e
-    socket.on('end', cb);
e23d3e
-  });
e23d3e
-  socket.on('error', (e) => {
e23d3e
-    if (e.code === 'ENOENT' || e.code === 'ECONNREFUSED') {
e23d3e
-      setTimeout(() => waitForPort(port, cb), 1000);
e23d3e
-    } else {
e23d3e
-      cb(e);
e23d3e
-    }
e23d3e
-  });
e23d3e
-}
e23d3e
-
e23d3e
-waitForPort(common.PORT, common.mustCall((err) => {
e23d3e
-  if (err) {
e23d3e
-    cleanUp(err);
e23d3e
-    return;
e23d3e
-  }
e23d3e
-
e23d3e
-  const message = 'hello';
e23d3e
-  const reverse = message.split('').reverse().join('');
e23d3e
-  runClient(message, common.mustCall((err, data) => {
e23d3e
-    try {
e23d3e
-      if (!err) assert.strictEqual(data.trim(), reverse);
e23d3e
-    } finally {
e23d3e
-      cleanUp(err);
e23d3e
-    }
e23d3e
-  }));
e23d3e
-}));
e23d3e
-
e23d3e
-function runClient(message, cb) {
e23d3e
-  const s = tls.connect(common.PORT, {
e23d3e
-    ciphers: CIPHERS,
e23d3e
-    checkServerIdentity: () => {},
e23d3e
-    pskCallback(hint) {
e23d3e
-      // 'hint' will be null in TLS1.3.
e23d3e
-      if (hint === null || hint === IDENTITY) {
e23d3e
-        return {
e23d3e
-          identity: IDENTITY,
e23d3e
-          psk: Buffer.from(KEY, 'hex')
e23d3e
-        };
e23d3e
-      }
e23d3e
-    }
e23d3e
-  });
e23d3e
-  s.on('secureConnect', common.mustCall(() => {
e23d3e
-    let data = '';
e23d3e
-    s.on('data', common.mustCallAtLeast((d) => {
e23d3e
-      data += d;
e23d3e
-    }));
e23d3e
-    s.on('end', common.mustCall(() => {
e23d3e
-      cb(null, data);
e23d3e
-    }));
e23d3e
-    s.end(message);
e23d3e
-  }));
e23d3e
-  s.on('error', (e) => {
e23d3e
-    cb(e);
e23d3e
-  });
e23d3e
-}
e23d3e
-- 
e23d3e
1.8.3.1
e23d3e