wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-11 04:10:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10374 from kareem-wolfssl/zd21699

Browse Source 
Enable all-zero shared secret check for Curve448/25519 by default.  Ensure post_handshake_auth extension was sent before accepting post-handshake CertificateRequest message.
This commit is contained in:
Sean Parkinson
2026-05-28 09:29:49 +10:00
committed by GitHub
parent eaadfb12ed bd95858a95
commit c92208076f
11 changed files with 272 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wolfcrypt/src/curve25519.c
+27 -16
View File
@@ -633,39 +633,50 @@ static int wc_curve25519_shared_secret_nb(curve25519_key* privKey,
switch (privKey->nb_ctx->ssState) {
case 0:
XMEMSET(&privKey->nb_ctx->o, 0, sizeof(privKey->nb_ctx->o));
privKey->nb_ctx->ssState = 1;
break;
case 1:
ret = curve25519_nb(privKey->nb_ctx->o.point, privKey->k,
pubKey->p.point, privKey->nb_ctx);
/* Write the result directly into the caller's 'out' buffer.
* curve25519_nb() zeroes the non-blocking context on completion,
* so any output buffer that lives inside nb_ctx (e.g.
* nb_ctx->o.point) would be clobbered to zero before we could
* read it. The output is little-endian; case 2 handles the
* optional byte-reversal for EC25519_BIG_ENDIAN. */
ret = curve25519_nb(out, privKey->k, pubKey->p.point,
privKey->nb_ctx);
if (ret == 0) {
ret = FP_WOULDBLOCK;
privKey->nb_ctx->ssState = 2;
}
break;
case 2:
#ifdef WOLFSSL_ECDHX_SHARED_NOT_ZERO
#ifndef WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
{
int i;
byte t = 0;
for (i = 0; i < CURVE25519_KEYSIZE; i++) {
t |= privKey->nb_ctx->o.point[i];
t |= out[i];
}
if (t == 0) {
ForceZero(out, CURVE25519_KEYSIZE);
ret = ECC_OUT_OF_RANGE_E;
break;
}
else
#endif /* WOLFSSL_ECDHX_SHARED_NOT_ZERO */
{
curve25519_copy_point(out, privKey->nb_ctx->o.point, endian);
*outlen = CURVE25519_KEYSIZE;
ret = 0;
}
#ifdef WOLFSSL_ECDHX_SHARED_NOT_ZERO
}
#endif
#endif /* !WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK */
if (endian == EC25519_BIG_ENDIAN) {
/* Reverse the little-endian result in place. */
int i;
byte tmp;
for (i = 0; i < CURVE25519_KEYSIZE / 2; i++) {
tmp = out[i];
out[i] = out[CURVE25519_KEYSIZE - 1 - i];
out[CURVE25519_KEYSIZE - 1 - i] = tmp;
}
}
*outlen = CURVE25519_KEYSIZE;
ret = 0;
break;
}
@@ -769,7 +780,7 @@ int wc_curve25519_shared_secret_ex(curve25519_key* private_key,
#endif
}
#endif /* FREESCALE_LTC_ECC */
#ifdef WOLFSSL_ECDHX_SHARED_NOT_ZERO
#ifndef WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
if (ret == 0) {
int i;
byte t = 0;
@@ -780,7 +791,7 @@ int wc_curve25519_shared_secret_ex(curve25519_key* private_key,
ret = ECC_OUT_OF_RANGE_E;
}
}
#endif /* WOLFSSL_ECDHX_SHARED_NOT_ZERO */
#endif /* !WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK */
if (ret == 0) {
curve25519_copy_point(out, o.point, endian);
*outlen = CURVE25519_KEYSIZE;
wolfcrypt/src/curve448.c
+3 -2
View File
@@ -33,7 +33,8 @@
* (when HAVE_CURVE448 is enabled)
* HAVE_CURVE448_KEY_EXPORT: Enable Curve448 key export default: on
* HAVE_CURVE448_KEY_IMPORT: Enable Curve448 key import default: on
* WOLFSSL_ECDHX_SHARED_NOT_ZERO: Check ECDH shared secret != 0 default: off
* WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK: Skip ECDH shared secret != 0 check
* default: off
*/
#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
@@ -176,7 +177,7 @@ int wc_curve448_shared_secret_ex(curve448_key* private_key,
if (ret == 0) {
ret = curve448(o, private_key->k, public_key->p);
}
#ifdef WOLFSSL_ECDHX_SHARED_NOT_ZERO
#ifndef WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
if (ret == 0) {
byte t = 0;
for (i = 0; i < CURVE448_PUB_KEY_SIZE; i++) {