[boorad]

Fix two provider-backed ncrypto behaviors:

• Allow an explicitly empty passphrase when exporting encrypted SEC1 EC PEM by extending the traditional-PEM helper already used for RSA. Include EC domain parameters in the encoder selection, matching the normal SEC1 path.
• Honor requested primality-check counts above the minimum performed by one BN_check_prime() call. Preserve cancellation and error propagation (including a cancellation check between repetitions, since OpenSSL resolves small primes by trial division without invoking the callback), and handle allocation failure.

Adds a public API regression for empty/binary SEC1 passphrases and missing/incorrect passwords, plus cctests for requested prime-check counts, cancellation during a repeated check, and cancellation of a small prime handled by trial division. The new empty-passphrase, count, and repeated-check cancellation assertions fail on the unpatched implementation.

Validation at 1f05382cee77240fe925f17b7f208fc2bbb9131b (rebased on main) on macOS with the built Node v28.0.0-pre and bundled OpenSSL 4.1.0:

• make -j8 node cctest: 306/306 cctests pass.
• out/Release/cctest --gtest_filter='NodeCrypto.BignumPrime*': 3/3 pass.
• Focused test-crypto-key-export-sec1-passphrase and existing test-crypto-keygen-missing-oid JavaScript tests: 2/2 pass; the SEC1 test passes 200/200 repeated runs.
• Scoped JavaScript/C++ lint, changed-line clang-format, and git diff --check pass.

Proposed here first at the request of the ncrypto maintainers in nodejs/ncrypto#54. Explicit EC parameter handling already works on current Node and is excluded from this port.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/security-wg

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.73%. Comparing base (9aa379e) to head (1f05382).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #67039   +/-   ##
=======================================
  Coverage   90.72%   90.73%           
=======================================
  Files         798      798           
  Lines      280015   280015           
  Branches    53858    53848   -10     
=======================================
+ Hits       254046   254059   +13     
+ Misses      16264    16240   -24     
- Partials     9705     9716   +11     

see 28 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

addressed.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78925/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78931/

[nodejs-github-bot]

Landed in f39899d