feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

prepare for release 5.7.0

Browse Source
This commit is contained in:
JacobBarthelmeh
2024-03-20 19:32:22 +07:00
parent 3129e29a19
commit e5914effab
7 changed files with 246 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
ChangeLog.md
View File

@ -1,7 +1,97 @@
# wolfSSL Release X.Y.Z (TBD) # wolfSSL Release 5.7.0 (Mar 20, 2024)
Release 5.7.0 has been developed according to wolfSSL's development and QA
process (see link below) and successfully passed the quality criteria.
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
NOTE: * --enable-heapmath is being deprecated and will be removed by end of 2024
NOTE: In future releases, --enable-des3 (which is disabled by default) will be insufficient in itself to enable DES3 in TLS cipher suites. A new option, --enable-des3-tls-suites, will need to be supplied in addition. This option should only be used in backward compatibility scenarios, as it is inherently insecure.
NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199. NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199.
## Vulnerabilities
* [High] CVE-2024-0901 Potential denial of service and out of bounds read. Affects TLS 1.3 on the server side when connecting to a malicious TLS 1.3 client. If using TLS 1.3 on the server side it is recommended to update the version of wolfSSL used. Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7099
* [Med] CVE-2024-1545 Fault Injection vulnerability in RsaPrivateDecryption function that potentially allows an attacker that has access to the same system with a victims process to perform a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia)."
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7167
* [Med] Fault injection attack with EdDSA signature operations. This affects ed25519 sign operations where the system could be susceptible to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia).
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7212
## New Feature Additions
* Added --enable-experimental configure flag to gate out features that are considered to be experimental. Now liboqs, kyber, lms, xmss, and dual-alg-certs require the --enable-experimental flag.
### POST QUANTUM SUPPORT ADDITIONS
* Experimental framework for using wolfSSL’s XMSS implementation (PR 7161)
* Experimental framework for using wolfSSL’s LMS implementation (PR 7283)
* Experimental wolfSSL Kyber implementation and assembly optimizations, enabled with --enable-experimental --enable-kyber (PR 7318)
* Experimental support for post quantum dual key/signature certificates. A few known issues and sanitizer checks are in progress with this feature. Enabled with the configure flags --enable-experimental --enable-dual-alg-certs (PR 7112)
* CryptoCb support for PQC algorithms (PR 7110)
### OTHER FEATURE ADDITIONS
* The Linux kernel module now supports registration of AES-GCM, AES-XTS, AES-CBC, and AES-CFB with the kernel cryptosystem through the new --enable-linuxkm-lkcapi-register option, enabling automatic use of wolfCrypt implementations by the dm-crypt/luks and ESP subsystems. In particular, wolfCrypt AES-XTS with –enable-aesni is faster than the native kernel implementation.
* CryptoCb hook to one-shot CMAC functions (PR 7059)
* BER content streaming support for PKCS7_VerifySignedData and sign/encrypt operations (PR 6961 & 7184)
* IoT-Safe SHA-384 and SHA-512 support (PR 7176)
* I/O callbacks for content and output with PKCS7 bundle sign/encrypt to reduce peak memory usage (PR 7272)
* Microchip PIC24 support and example project (PR 7151)
* AutoSAR shim layer for RNG, SHA256, and AES (PR 7296)
* wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to certificate store (PR 7245)
* Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid (PR 7236)
## Enhancements and Optimizations
* Remove obsolete user-crypto functionality and Intel IPP support (PR 7097)
* Support for RSA-PSS signatures with CRL use (PR 7119)
* Enhancement for AES-GCM use with Xilsecure on Microblaze (PR 7051)
* Support for crypto cb only build with ECC and NXP CAAM (PR 7269)
* Improve liboqs integration adding locking and init/cleanup functions (PR 7026)
* Prevent memory access before clientSession->serverRow and clientSession->serverIdx are sanitized (PR 7096)
* Enhancements to reproducible build (PR 7267)
* Update Arduino example TLS Client/Server and improve support for ESP32 (PR 7304 & 7177)
* XC32 compiler version 4.x compatibility (PR 7128)
* Porting for build on PlayStation 3 and 4 (PR 7072)
* Improvements for Espressif use; SHA HW/SW selection and use on ESP32-C2/ESP8684, wolfSSL_NewThread() type, component cmake fix, and update TLS client example for ESP8266 (PR 7081, 7173, 7077, 7148, 7240)
* Allow crypto callbacks with SHA-1 HW (PR 7087)
* Update OpenSSH port to version 9.6p1(PR 7203)
* ARM Thumb2 enhancements, AES-GCM support for GCM_SMALL, alignment fix on key, fix for ASM clobber list (PR 7291,7301,7221)
* Expand heap hint support for static memory build with more x509 functions (PR 7136)
* Improving ARMv8 ChaCha20 ASM (alignment) (PR 7182)
* Unknown extension callback wolfSSL_CertManagerSetUnknownExtCallback added to CertManager (PR 7194)
* Implement wc_rng_new_ex for use with devID’s with crypto callback (PR 7271)
* Allow reading 0-RTT data after writing 0.5-RTT data (PR 7102)
* Send alert on bad PSK binder error (PR 7235)
* Enhancements to CMake build files for use with cross compiling (PR 7188)
## Fixes
* Fix for checking result of MAC verify when no AAD is used with AES-GCM and Xilinx Xilsecure (PR 7051)
* Fix for Aria sign use (PR 7082)
* Fix for invalid `dh_ffdhe_test` test case using Intel QuickAssist (PR 7085)
*Fixes for TI AES and SHA on TM4C with HW acceleration and add full AES GCM and CCM support with TLS (PR 7018)
* Fixes for STM32 PKA use with ECC (PR 7098)
* Fixes for TLS 1.3 with crypto callbacks to offload KDF / HMAC operation (PR 7070)
* Fix include path for FSP 3.5 on Renesas RA6M4 (PR 7101)
* Siphash x64 asm fix for use with older compilers (PR 7299)
* Fix for SGX build with SP (PR 7308)
* Fix to Make it mandatory that the cookie is sent back in new ClientHello when seen in a HelloRetryRequest with (PR 7190)
* Fix for wrap around behavior with BIO pairs (PR 7169)
* OCSP fixes for parsing of response correctly when there was a revocation reason and returning correct error value with date checks (PR 7241 & 7255)
* Fix build with `NO_STDIO_FILESYSTEM` and improve checks for `XGETENV` (PR 7150)
* Fix for DTLS sequence number and cookie when downgrading DTLS version (PR 7214)
* Fix for write_dup use with chacha-poly cipher suites (PR 7206)
* Fix for multiple handshake messages in one record failing with OUT_OF_ORDER_E when downgrading from TLS 1.3 to TLS 1.2 (PR 7141)
* Fix for AES ECB build with Thumb and alignment (PR 7094)
* Fix for negotiate handshake until the end in wolfSSL_read/wolfSSL_write if hitting an edge case with want read/write (PR 7237)
# wolfSSL Release 5.6.6 (Dec 19, 2023) # wolfSSL Release 5.6.6 (Dec 19, 2023)
Release 5.6.6 has been developed according to wolfSSL's development and QA Release 5.6.6 has been developed according to wolfSSL's development and QA

8
IDE/WIN10/wolfssl-fips.rc
View File

@ -51,8 +51,8 @@ END
// //
VS_VERSION_INFO VERSIONINFO VS_VERSION_INFO VERSIONINFO
FILEVERSION 5,6,6,0 FILEVERSION 5,7,0,0
PRODUCTVERSION 5,6,6,0 PRODUCTVERSION 5,7,0,0
FILEFLAGSMASK 0x3fL FILEFLAGSMASK 0x3fL
#ifdef _DEBUG #ifdef _DEBUG
FILEFLAGS 0x1L FILEFLAGS 0x1L
@ -69,12 +69,12 @@ BEGIN
BEGIN BEGIN
VALUE "CompanyName", "wolfSSL Inc." VALUE "CompanyName", "wolfSSL Inc."
VALUE "FileDescription", "The wolfSSL FIPS embedded SSL library is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set." VALUE "FileDescription", "The wolfSSL FIPS embedded SSL library is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set."
VALUE "FileVersion", "5.6.6.0" VALUE "FileVersion", "5.7.0.0"
VALUE "InternalName", "wolfssl-fips" VALUE "InternalName", "wolfssl-fips"
VALUE "LegalCopyright", "Copyright (C) 2023" VALUE "LegalCopyright", "Copyright (C) 2023"
VALUE "OriginalFilename", "wolfssl-fips.dll" VALUE "OriginalFilename", "wolfssl-fips.dll"
VALUE "ProductName", "wolfSSL FIPS" VALUE "ProductName", "wolfSSL FIPS"
VALUE "ProductVersion", "5.6.6.0" VALUE "ProductVersion", "5.7.0.0"
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"

140
README
View File

@ -70,93 +70,99 @@ should be used for the enum name.
*** end Notes *** *** end Notes ***
# wolfSSL Release 5.6.6 (Dec 19, 2023) # wolfSSL Release 5.7.0 (Mar 20, 2024)
Release 5.6.6 has been developed according to wolfSSL's development and QA Release 5.7.0 has been developed according to wolfSSL's development and QA
process (see link below) and successfully passed the quality criteria. process (see link below) and successfully passed the quality criteria.
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 NOTE: * --enable-heapmath is being deprecated and will be removed by end of 2024
NOTE: In future releases, --enable-des3 (which is disabled by default) will be insufficient in itself to enable DES3 in TLS cipher suites. A new option, --enable-des3-tls-suites, will need to be supplied in addition. This option should only be used in backward compatibility scenarios, as it is inherently insecure.
NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199.
REMINDER: When working with AES Block Cipher algorithms, wc_AesInit() should
always be called first to initialize the `Aes` structure, before calling other
Aes API functions. Recently we found several places in our documentation,
comments, and codebase where this pattern was not observed. We have since
fixed this omission in several PRs for this release.
## Vulnerabilities ## Vulnerabilities
* [High] CVE-2024-0901 Potential denial of service and out of bounds read. Affects TLS 1.3 on the server side when connecting to a malicious TLS 1.3 client. If using TLS 1.3 on the server side it is recommended to update the version of wolfSSL used. Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7099
* [Medium] CVE-2023-6935: After review of the previous RSA timing fix in wolfSSL 5.6.4, additional changes were found to be required. A complete resistant change is delivered in this release. This fix is for the Marvin attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a very large number of trial connections. This issue is around RSA decryption and affects the optional static RSA cipher suites on the server side, which are considered weak, not recommended to be used and are off by default in wolfSSL (even with --enable-all). Static RSA cipher suites were also removed from the TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It is recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. Thanks to Hubert Kario for the report. The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6955.
* [Low] CVE-2023-6936: A potential heap overflow read is possible in servers connecting over TLS 1.3 when the optional WOLFSSL_CALLBACKS has been defined. The out of bounds read can occur when a server receives a malicious malformed ClientHello. Users should either discontinue use of WOLFSSL_CALLBACKS on the server side or update versions of wolfSSL to 5.6.6. Thanks to the tlspuffin fuzzer team for the report which was designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6949. * [Med] CVE-2024-1545 Fault Injection vulnerability in RsaPrivateDecryption function that potentially allows an attacker that has access to the same system with a victims process to perform a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia)."
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7167
* [Low] A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the “--enable-aes-bitsliced” configure option. Thanks to Florian Sieck, Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas Eisenbarth, and Yuval Yarom for the report (Universities of Lübeck, Melbourne, Adelaide and Bochum). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6854.
* [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in a single (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating. Thanks to Johannes Wilson for the report (Sectra Communications and Linköping University). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/7029. * [Med] Fault injection attack with EdDSA signature operations. This affects ed25519 sign operations where the system could be susceptible to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia).
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7212
## New Feature Additions ## New Feature Additions
* Build option for disabling CRL date checks (WOLFSSL_NO_CRL_DATE_CHECK) (PR 6927) * Added --enable-experimental configure flag to gate out features that are considered to be experimental. Now liboqs, kyber, lms, xmss, and dual-alg-certs require the --enable-experimental flag.
* Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
* Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929) ### POST QUANTUM SUPPORT ADDITIONS
* Add implementation of SRTP KDF and SRTCP KDF (--enable-srtp-kdf) (PR 6888) * Experimental framework for using wolfSSL’s XMSS implementation (PR 7161)
* Add wolfSSL_EXTENDED_KEY_USAGE_free() (PR 6916) * Experimental framework for using wolfSSL’s LMS implementation (PR 7283)
* Add AES bitsliced implementation that is cache attack safe (--enable-aes-bitsliced) (PR 6854) * Experimental wolfSSL Kyber implementation and assembly optimizations, enabled with --enable-experimental --enable-kyber (PR 7318)
* Add memcached support and automated testing (PR 6430, 7022) * Experimental support for post quantum dual key/signature certificates. A few known issues and sanitizer checks are in progress with this feature. Enabled with the configure flags --enable-experimental --enable-dual-alg-certs (PR 7112)
* Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990) * CryptoCb support for PQC algorithms (PR 7110)
* Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)
### OTHER FEATURE ADDITIONS
* The Linux kernel module now supports registration of AES-GCM, AES-XTS, AES-CBC, and AES-CFB with the kernel cryptosystem through the new --enable-linuxkm-lkcapi-register option, enabling automatic use of wolfCrypt implementations by the dm-crypt/luks and ESP subsystems. In particular, wolfCrypt AES-XTS with –enable-aesni is faster than the native kernel implementation.
* CryptoCb hook to one-shot CMAC functions (PR 7059)
* BER content streaming support for PKCS7_VerifySignedData and sign/encrypt operations (PR 6961 & 7184)
* IoT-Safe SHA-384 and SHA-512 support (PR 7176)
* I/O callbacks for content and output with PKCS7 bundle sign/encrypt to reduce peak memory usage (PR 7272)
* Microchip PIC24 support and example project (PR 7151)
* AutoSAR shim layer for RNG, SHA256, and AES (PR 7296)
* wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to certificate store (PR 7245)
* Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid (PR 7236)
## Enhancements and Optimizations ## Enhancements and Optimizations
* Better built in testing of “--sys-ca-certs” configure option (PR 6910) * Remove obsolete user-crypto functionality and Intel IPP support (PR 7097)
* Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877) * Support for RSA-PSS signatures with CRL use (PR 7119)
* Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946) * Enhancement for AES-GCM use with Xilsecure on Microblaze (PR 7051)
* Add “--enable-quic” to “--enable-all” configure option (PR 6957) * Support for crypto cb only build with ECC and NXP CAAM (PR 7269)
* Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959) * Improve liboqs integration adding locking and init/cleanup functions (PR 7026)
* Add result of “HAVE___UINT128_T” to options.h for CMake builds (PR 6965) * Prevent memory access before clientSession->serverRow and clientSession->serverIdx are sanitized (PR 7096)
* Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967) * Enhancements to reproducible build (PR 7267)
* Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952) * Update Arduino example TLS Client/Server and improve support for ESP32 (PR 7304 & 7177)
* Add wolfCrypt test and unit test to ctest (PR 6977) * XC32 compiler version 4.x compatibility (PR 7128)
* Move OpenSSL compatibility crypto APIs into ssl_crypto.c file (PR 6935) * Porting for build on PlayStation 3 and 4 (PR 7072)
* Validate time generated from XGMTIME() (PR 6958) * Improvements for Espressif use; SHA HW/SW selection and use on ESP32-C2/ESP8684, wolfSSL_NewThread() type, component cmake fix, and update TLS client example for ESP8266 (PR 7081, 7173, 7077, 7148, 7240)
* Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868) * Allow crypto callbacks with SHA-1 HW (PR 7087)
* Add GitHub Actions testing with nginx 1.24.0 (PR 6982) * Update OpenSSH port to version 9.6p1(PR 7203)
* Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953) * ARM Thumb2 enhancements, AES-GCM support for GCM_SMALL, alignment fix on key, fix for ASM clobber list (PR 7291,7301,7221)
* Add CMake option to enable DTLS-SRTP (PR 6991) * Expand heap hint support for static memory build with more x509 functions (PR 7136)
* Add CMake options for enabling QUIC and cURL (PR 7049) * Improving ARMv8 ChaCha20 ASM (alignment) (PR 7182)
* Improve RSA blinding to make code more constant time (PR 6955) * Unknown extension callback wolfSSL_CertManagerSetUnknownExtCallback added to CertManager (PR 7194)
* Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981) * Implement wc_rng_new_ex for use with devID’s with crypto callback (PR 7271)
* Default to native Windows threading API on MinGW (PR 7015) * Allow reading 0-RTT data after writing 0.5-RTT data (PR 7102)
* Return better error codes from OCSP response check (PR 7028) * Send alert on bad PSK binder error (PR 7235)
* Updated Espressif ESP32 TLS client and server examples (PR 6844) * Enhancements to CMake build files for use with cross compiling (PR 7188)
* Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037)
* Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
* Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
* Simplify and improve apple-universal build script (PR 7025)
## Fixes ## Fixes
* Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931) * Fix for checking result of MAC verify when no AAD is used with AES-GCM and Xilinx Xilsecure (PR 7051)
* Fix for building PKCS#7 with RSA disabled (PR 6902) * Fix for Aria sign use (PR 7082)
* Fix for advancing output pointer in wolfSSL_i2d_X509() (PR 6891) * Fix for invalid `dh_ffdhe_test` test case using Intel QuickAssist (PR 7085)
* Fix for EVP_EncodeBlock() appending a newline (PR 6900) *Fixes for TI AES and SHA on TM4C with HW acceleration and add full AES GCM and CCM support with TLS (PR 7018)
* Fix for wolfSSL_RSA_verify_PKCS1_PSS() with RSA_PSS_SALTLEN_AUTO (PR 6938) * Fixes for STM32 PKA use with ECC (PR 7098)
* Fixes for CODESonar reports around isalpha() and isalnum() calls (PR 6810) * Fixes for TLS 1.3 with crypto callbacks to offload KDF / HMAC operation (PR 7070)
* Fix for SP ARM64 integer math to avoid compiler optimization issues (PR 6942) * Fix include path for FSP 3.5 on Renesas RA6M4 (PR 7101)
* Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971) * Siphash x64 asm fix for use with older compilers (PR 7299)
* Fix for SP Thumb2 to make functions not inlined (PR 6993) * Fix for SGX build with SP (PR 7308)
* Fix for SP Cortex-M assembly large build with IAR (PR 6954) * Fix to Make it mandatory that the cookie is sent back in new ClientHello when seen in a HelloRetryRequest with (PR 7190)
* Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947) * Fix for wrap around behavior with BIO pairs (PR 7169)
* Fix for SP ARM64 P-256 for not inlining functions for iOS compatibility (PR 6979) * OCSP fixes for parsing of response correctly when there was a revocation reason and returning correct error value with date checks (PR 7241 & 7255)
* Fix for WOLFSSL_CALLBACKS and potential memory error (PR 6949) * Fix build with `NO_STDIO_FILESYSTEM` and improve checks for `XGETENV` (PR 7150)
* Fixes for wolfSSL’s Zephyr OS port (PR 6930) * Fix for DTLS sequence number and cookie when downgrading DTLS version (PR 7214)
* Fix for build errors when building for NXP mmCAU (FREESCALE_MMCAU) (PR 6970) * Fix for write_dup use with chacha-poly cipher suites (PR 7206)
* Fix for TLS 1.3 SendBuffered() return code in non-blocking mode (PR 7001) * Fix for multiple handshake messages in one record failing with OUT_OF_ORDER_E when downgrading from TLS 1.3 to TLS 1.2 (PR 7141)
* Fix for TLS Hmac_UpdateFinal() when padding byte is invalid (PR 6998) * Fix for AES ECB build with Thumb and alignment (PR 7094)
* Fix for ARMv8 AES-GCM streaming to check size of IV before storing (PR 6996) * Fix for negotiate handshake until the end in wolfSSL_read/wolfSSL_write if hitting an edge case with want read/write (PR 7237)
* Add missing calls to wc_AesInit() before wc_AesSetKey() (PR 7011)
* Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976)
* Fixes for building wolfSSL in Visual Studio (PR 7040)
For additional vulnerability information visit the vulnerability page at: For additional vulnerability information visit the vulnerability page at:
https://www.wolfssl.com/docs/security-vulnerabilities/ https://www.wolfssl.com/docs/security-vulnerabilities/

141
README.md
View File

@ -75,93 +75,98 @@ single call hash function. Instead the name `WC_SHA`, `WC_SHA256`, `WC_SHA384` a
`WC_SHA512` should be used for the enum name. `WC_SHA512` should be used for the enum name.
# wolfSSL Release 5.6.6 (Dec 19, 2023) # wolfSSL Release 5.7.0 (Mar 20, 2024)
Release 5.6.6 has been developed according to wolfSSL's development and QA Release 5.7.0 has been developed according to wolfSSL's development and QA
process (see link below) and successfully passed the quality criteria. process (see link below) and successfully passed the quality criteria.
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 NOTE: * --enable-heapmath is being deprecated and will be removed by end of 2024
REMINDER: When working with AES Block Cipher algorithms, `wc_AesInit()` should NOTE: In future releases, --enable-des3 (which is disabled by default) will be insufficient in itself to enable DES3 in TLS cipher suites. A new option, --enable-des3-tls-suites, will need to be supplied in addition. This option should only be used in backward compatibility scenarios, as it is inherently insecure.
always be called first to initialize the `Aes` structure, before calling other
Aes API functions. Recently we found several places in our documentation, NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199.
comments, and codebase where this pattern was not observed. We have since
fixed this omission in several PRs for this release.
## Vulnerabilities ## Vulnerabilities
* [High] CVE-2024-0901 Potential denial of service and out of bounds read. Affects TLS 1.3 on the server side when connecting to a malicious TLS 1.3 client. If using TLS 1.3 on the server side it is recommended to update the version of wolfSSL used. Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7099
* [Medium] CVE-2023-6935: After review of the previous RSA timing fix in wolfSSL 5.6.4, additional changes were found to be required. A complete resistant change is delivered in this release. This fix is for the Marvin attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a very large number of trial connections. This issue is around RSA decryption and affects the optional static RSA cipher suites on the server side, which are considered weak, not recommended to be used and are off by default in wolfSSL (even with `--enable-all`). Static RSA cipher suites were also removed from the TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It is recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. Thanks to Hubert Kario for the report. The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6955.
* [Low] CVE-2023-6936: A potential heap overflow read is possible in servers connecting over TLS 1.3 when the optional `WOLFSSL_CALLBACKS` has been defined. The out of bounds read can occur when a server receives a malicious malformed ClientHello. Users should either discontinue use of `WOLFSSL_CALLBACKS` on the server side or update versions of wolfSSL to 5.6.6. Thanks to the tlspuffin fuzzer team for the report which was designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6949. * [Med] CVE-2024-1545 Fault Injection vulnerability in RsaPrivateDecryption function that potentially allows an attacker that has access to the same system with a victims process to perform a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia)."
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7167
* [Low] A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the “`--enable-aes-bitsliced`” configure option. Thanks to Florian Sieck, Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas Eisenbarth, and Yuval Yarom for the report (Universities of Lübeck, Melbourne, Adelaide and Bochum). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6854.
* [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in a single (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating. Thanks to Johannes Wilson for the report (Sectra Communications and Linköping University). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/7029. * [Med] Fault injection attack with EdDSA signature operations. This affects ed25519 sign operations where the system could be susceptible to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia).
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7212
## New Feature Additions ## New Feature Additions
* Build option for disabling CRL date checks (`WOLFSSL_NO_CRL_DATE_CHECK`) (PR 6927) * Added --enable-experimental configure flag to gate out features that are considered to be experimental. Now liboqs, kyber, lms, xmss, and dual-alg-certs require the --enable-experimental flag.
* Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
* Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929) ### POST QUANTUM SUPPORT ADDITIONS
* Add implementation of SRTP KDF and SRTCP KDF (`--enable-srtp-kdf`) (PR 6888) * Experimental framework for using wolfSSL’s XMSS implementation (PR 7161)
* Add `wolfSSL_EXTENDED_KEY_USAGE_free()` (PR 6916) * Experimental framework for using wolfSSL’s LMS implementation (PR 7283)
* Add AES bitsliced implementation that is cache attack safe (`--enable-aes-bitsliced`) (PR 6854) * Experimental wolfSSL Kyber implementation and assembly optimizations, enabled with --enable-experimental --enable-kyber (PR 7318)
* Add memcached support and automated testing (PR 6430, 7022) * Experimental support for post quantum dual key/signature certificates. A few known issues and sanitizer checks are in progress with this feature. Enabled with the configure flags --enable-experimental --enable-dual-alg-certs (PR 7112)
* Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990) * CryptoCb support for PQC algorithms (PR 7110)
* Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)
### OTHER FEATURE ADDITIONS
* The Linux kernel module now supports registration of AES-GCM, AES-XTS, AES-CBC, and AES-CFB with the kernel cryptosystem through the new --enable-linuxkm-lkcapi-register option, enabling automatic use of wolfCrypt implementations by the dm-crypt/luks and ESP subsystems. In particular, wolfCrypt AES-XTS with –enable-aesni is faster than the native kernel implementation.
* CryptoCb hook to one-shot CMAC functions (PR 7059)
* BER content streaming support for PKCS7_VerifySignedData and sign/encrypt operations (PR 6961 & 7184)
* IoT-Safe SHA-384 and SHA-512 support (PR 7176)
* I/O callbacks for content and output with PKCS7 bundle sign/encrypt to reduce peak memory usage (PR 7272)
* Microchip PIC24 support and example project (PR 7151)
* AutoSAR shim layer for RNG, SHA256, and AES (PR 7296)
* wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to certificate store (PR 7245)
* Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid (PR 7236)
## Enhancements and Optimizations ## Enhancements and Optimizations
* Better built in testing of “`--sys-ca-certs`” configure option (PR 6910) * Remove obsolete user-crypto functionality and Intel IPP support (PR 7097)
* Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877) * Support for RSA-PSS signatures with CRL use (PR 7119)
* Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946) * Enhancement for AES-GCM use with Xilsecure on Microblaze (PR 7051)
* Add “`--enable-quic`” to “`--enable-all`” configure option (PR 6957) * Support for crypto cb only build with ECC and NXP CAAM (PR 7269)
* Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959) * Improve liboqs integration adding locking and init/cleanup functions (PR 7026)
* Add result of “`HAVE___UINT128_T`” to options.h for CMake builds (PR 6965) * Prevent memory access before clientSession->serverRow and clientSession->serverIdx are sanitized (PR 7096)
* Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967) * Enhancements to reproducible build (PR 7267)
* Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952) * Update Arduino example TLS Client/Server and improve support for ESP32 (PR 7304 & 7177)
* Add wolfCrypt test and unit test to ctest (PR 6977) * XC32 compiler version 4.x compatibility (PR 7128)
* Move OpenSSL compatibility crypto APIs into `ssl_crypto.c` file (PR 6935) * Porting for build on PlayStation 3 and 4 (PR 7072)
* Validate time generated from XGMTIME() (PR 6958) * Improvements for Espressif use; SHA HW/SW selection and use on ESP32-C2/ESP8684, wolfSSL_NewThread() type, component cmake fix, and update TLS client example for ESP8266 (PR 7081, 7173, 7077, 7148, 7240)
* Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868) * Allow crypto callbacks with SHA-1 HW (PR 7087)
* Add GitHub Actions testing with nginx 1.24.0 (PR 6982) * Update OpenSSH port to version 9.6p1(PR 7203)
* Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953) * ARM Thumb2 enhancements, AES-GCM support for GCM_SMALL, alignment fix on key, fix for ASM clobber list (PR 7291,7301,7221)
* Add CMake option to enable DTLS-SRTP (PR 6991) * Expand heap hint support for static memory build with more x509 functions (PR 7136)
* Add CMake options for enabling QUIC and cURL (PR 7049) * Improving ARMv8 ChaCha20 ASM (alignment) (PR 7182)
* Improve RSA blinding to make code more constant time (PR 6955) * Unknown extension callback wolfSSL_CertManagerSetUnknownExtCallback added to CertManager (PR 7194)
* Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981) * Implement wc_rng_new_ex for use with devID’s with crypto callback (PR 7271)
* Default to native Windows threading API on MinGW (PR 7015) * Allow reading 0-RTT data after writing 0.5-RTT data (PR 7102)
* Return better error codes from OCSP response check (PR 7028) * Send alert on bad PSK binder error (PR 7235)
* Updated Espressif ESP32 TLS client and server examples (PR 6844) * Enhancements to CMake build files for use with cross compiling (PR 7188)
* Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037)
* Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
* Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
* Simplify and improve apple-universal build script (PR 7025)
## Fixes ## Fixes
* Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931) * Fix for checking result of MAC verify when no AAD is used with AES-GCM and Xilinx Xilsecure (PR 7051)
* Fix for building PKCS#7 with RSA disabled (PR 6902) * Fix for Aria sign use (PR 7082)
* Fix for advancing output pointer in `wolfSSL_i2d_X509()` (PR 6891) * Fix for invalid `dh_ffdhe_test` test case using Intel QuickAssist (PR 7085)
* Fix for `EVP_EncodeBlock()` appending a newline (PR 6900) *Fixes for TI AES and SHA on TM4C with HW acceleration and add full AES GCM and CCM support with TLS (PR 7018)
* Fix for `wolfSSL_RSA_verify_PKCS1_PSS()` with `RSA_PSS_SALTLEN_AUTO` (PR 6938) * Fixes for STM32 PKA use with ECC (PR 7098)
* Fixes for CODESonar reports around `isalpha()` and `isalnum()` calls (PR 6810) * Fixes for TLS 1.3 with crypto callbacks to offload KDF / HMAC operation (PR 7070)
* Fix for SP ARM64 integer math to avoid compiler optimization issues (PR 6942) * Fix include path for FSP 3.5 on Renesas RA6M4 (PR 7101)
* Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971) * Siphash x64 asm fix for use with older compilers (PR 7299)
* Fix for SP Thumb2 to make functions not inlined (PR 6993) * Fix for SGX build with SP (PR 7308)
* Fix for SP Cortex-M assembly large build with IAR (PR 6954) * Fix to Make it mandatory that the cookie is sent back in new ClientHello when seen in a HelloRetryRequest with (PR 7190)
* Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947) * Fix for wrap around behavior with BIO pairs (PR 7169)
* Fix for SP ARM64 P-256 for not inlining functions for iOS compatibility (PR 6979) * OCSP fixes for parsing of response correctly when there was a revocation reason and returning correct error value with date checks (PR 7241 & 7255)
* Fix for `WOLFSSL_CALLBACKS` and potential memory error (PR 6949) * Fix build with `NO_STDIO_FILESYSTEM` and improve checks for `XGETENV` (PR 7150)
* Fixes for wolfSSL’s Zephyr OS port (PR 6930) * Fix for DTLS sequence number and cookie when downgrading DTLS version (PR 7214)
* Fix for build errors when building for NXP mmCAU (`FREESCALE_MMCAU`) (PR 6970) * Fix for write_dup use with chacha-poly cipher suites (PR 7206)
* Fix for TLS 1.3 `SendBuffered()` return code in non-blocking mode (PR 7001) * Fix for multiple handshake messages in one record failing with OUT_OF_ORDER_E when downgrading from TLS 1.3 to TLS 1.2 (PR 7141)
* Fix for TLS `Hmac_UpdateFinal()` when padding byte is invalid (PR 6998) * Fix for AES ECB build with Thumb and alignment (PR 7094)
* Fix for ARMv8 AES-GCM streaming to check size of IV before storing (PR 6996) * Fix for negotiate handshake until the end in wolfSSL_read/wolfSSL_write if hitting an edge case with want read/write (PR 7237)
* Add missing calls to `wc_AesInit()` before `wc_AesSetKey()` (PR 7011)
* Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976)
* Fixes for building wolfSSL in Visual Studio (PR 7040)
For additional vulnerability information visit the vulnerability page at: For additional vulnerability information visit the vulnerability page at:
https://www.wolfssl.com/docs/security-vulnerabilities/ https://www.wolfssl.com/docs/security-vulnerabilities/
@ -237,4 +242,4 @@ More info can be found on-line at: https://wolfssl.com/wolfSSL/Docs.html
│   └── wolfcrypt [Header files] │   └── wolfcrypt [Header files]
├── wrapper [wolfSSL language wrappers] ├── wrapper [wolfSSL language wrappers]
└── zephyr [Port of wolfSSL for Zephyr RTOS] └── zephyr [Port of wolfSSL for Zephyr RTOS]
``` ```

6
configure.ac
View File

@ -7,7 +7,7 @@
# #
AC_COPYRIGHT([Copyright (C) 2006-2023 wolfSSL Inc.]) AC_COPYRIGHT([Copyright (C) 2006-2023 wolfSSL Inc.])
AC_PREREQ([2.69]) AC_PREREQ([2.69])
AC_INIT([wolfssl],[5.6.6],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com]) AC_INIT([wolfssl],[5.7.0],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com])
AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_AUX_DIR([build-aux])
# The following sets CFLAGS to empty if unset on command line. We do not # The following sets CFLAGS to empty if unset on command line. We do not
@ -47,9 +47,9 @@ AC_SUBST([WOLFSSL_CONFIG_ARGS])
# The three numbers in the libwolfssl.so.*.*.* file name. Unfortunately # The three numbers in the libwolfssl.so.*.*.* file name. Unfortunately
# these numbers don't always line up nicely with the library version. # these numbers don't always line up nicely with the library version.
WOLFSSL_LIBRARY_VERSION_FIRST=42 WOLFSSL_LIBRARY_VERSION_FIRST=42
WOLFSSL_LIBRARY_VERSION_SECOND=0 WOLFSSL_LIBRARY_VERSION_SECOND=1
WOLFSSL_LIBRARY_VERSION_THIRD=0 WOLFSSL_LIBRARY_VERSION_THIRD=0
WOLFSSL_LIBRARY_VERSION=42:0:0 WOLFSSL_LIBRARY_VERSION=43:0:1
# | | | # | | |
# +------+ | +---+ # +------+ | +---+
# | | | # | | |

BIN
wolfssl.rc
View File

Binary file not shown.

4
wolfssl/version.h
View File

@ -28,8 +28,8 @@
extern "C" { extern "C" {
#endif #endif
#define LIBWOLFSSL_VERSION_STRING "5.6.6" #define LIBWOLFSSL_VERSION_STRING "5.7.0"
#define LIBWOLFSSL_VERSION_HEX 0x05006006 #define LIBWOLFSSL_VERSION_HEX 0x05007000
#ifdef __cplusplus #ifdef __cplusplus
} }