Add AES-GCM (128/256) as an ECIES DEM next to the AES-CBC/CTR+HMAC modes. Only the encryption key comes from the KDF; the mac salt is bound as GCM AAD and the 16-byte tag replaces the HMAC. The GCM DEM honors all three IV build modes, and default fixed-nonce GCM is gated behind the new WOLFSSL_ECIES_STATIC_GCM_NONCE opt-in. Adds ECIES CryptoCb encrypt/decrypt, the WOLF_CRYPTO_CB ctx getters, devId/heap threading into the DEM primitives, and test/benchmark/CI coverage.
wolfSSL removed liboqs: Falcon is now provided natively by wolfCrypt, and
--with-liboqs is a deprecated no-op (configure.ac). A build therefore no
longer links liboqs, so recording it as an SBOM dependency is dead code and
the SBOM integration CI (which asserted a liboqs dep package) failed.
Remove the liboqs dependency throughout:
- scripts/gen-sbom: drop DEP_META['liboqs'] and the --dep-liboqs flag.
- Makefile.am / configure.ac: drop --dep-liboqs "$(ENABLED_LIBOQS)" and the
now-unused AC_SUBST([ENABLED_LIBOQS]).
- .github/workflows/sbom.yml: drop the liboqs install / --with-liboqs steps
and the liboqs dep assertion; keep the native-Falcon build so the
HAVE_FALCON build-property capture is still exercised.
- scripts/test_gen_sbom.py: drop the liboqs-specific tests, guard against
the key reappearing, and use openssl as the example dep elsewhere.
- doc/SBOM.md: drop the --dep-liboqs / liboqs dependency references.
Use Automake's $(docdir) for sbomdir so a --docdir override is honoured,
match tab/space in the wolfSSL version parse ([[:space:]]), document the
GNU-make requirement and the intentional install/uninstall-sbom
asymmetry, and widen the SBOM workflow pull_request filter to '**' so PRs
onto release/** base branches also run.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
- gen-advisory: honour explicit per-version status when defaultStatus is
"affected", so unaffected/fixed releases are no longer marked vulnerable
- gen-advisory: fail loudly when a CVE record has no non-empty English
description (CSAF/CycloneDX note text is required, minLength 1)
- gen-advisory: note that --cve-id fetches from the CVE Services API
- bomsh_verify: scope the object-store shape check to sha1, matching the
sha1 gitoid hashing (drop the unreachable sha256-length branch)
- Makefile.am: fail `make bomsh` early when python3/pyspdxtools are absent;
quote $(ENABLED_LIBZ)/$(ENABLED_LIBOQS); consolidate clean-local so the
omnibor/ and advisories/out/ build dirs are removed on clean
- tests: cover the defaultStatus fix, the _bucket_for unknown-state
hard-fail, and a csaf_validate.mjs runner self-test wired into CI
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Add tooling to produce Software Bills of Materials and build provenance
for wolfSSL, supporting EU Cyber Resilience Act (CRA) obligations.
SBOM generation:
- New `make sbom` target producing SPDX 2.3 output with NTIA minimum
elements, urn:uuid document namespaces, and SPDX LicenseRef compliance.
- Reproducible library discovery across autotools and CMake builds, with
liboqs recorded as a linked artefact.
- Standalone `scripts/gen-sbom` for embedded / RTOS / custom-builder
flows that do not use the main build system, plus --srcs-file,
--no-artifact-hash, and hash-source options.
Build provenance (OmniBOR / bomsh):
- End-to-end bomsh tracing of the built binaries with ArtifactID
insertion, snapshotting the traced library before libtool relink and
hashing the bomsh-traced binary.
- `scripts/bomsh_verify.py` to validate provenance against the traced
gitoid.
Security advisories:
- `scripts/gen-advisory` generating CSAF 2.0 and CycloneDX VEX, with a
`make` target, VEX overlay schema/example, and CWE name data.
Docs, tests, and CI:
- doc/SBOM.md and doc/CRA.md, plus README/INSTALL updates.
- Unit and regression tests for gen-sbom and gen-advisory.
- New sbom.yml and advisory.yml workflows: SPDX validation via
pyspdxtools, CSAF validation, bomsh provenance verification, SBOM
artifact archiving, macOS coverage, and actions pinned to SHAs.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
A few socat core tests intermittently fail the interop job with diff or
timeout mismatches. They exercise socat's own system()/socket/exec-pty
plumbing, not the wolfSSL backend, and race under the deliberate CPU
oversubscription of the parallel shard scheduling. With parallel-make-check
running fail-fast, one such flake in any shard aborts the whole job.
Add the observed offenders to the per-version socat test.sh --expect-fail
list: 23 (DUALSYSTEMFDSFLUSH) on 1.8.0.3, and 205 (TCP4ENDCLOSE) and 227
(EXECPTYKILL) on 1.8.0.0. test.sh keys its exit status only on unexpected
failures, so a listed test that later passes is reported as "OK unexpected"
and does not fail the job. Numbers come from each version's own test output,
so they match that version's numbering.
parallel-make-check.py schedules configs longest-first by their "minutes"
weight, but five of the seven trackmemory configs were weighted well below
their real runtime, which the run summary flags every time ("ran X min but
minutes says Y (>50% off)"). The underweighted configs include the two
wolfEntropy jitter configs, whose runtime already varies severalfold with
runner contention. Scheduling them last, on stale short weights, is what
lets a contended run drift into the 40-minute timeout.
Update the five flagged weights to the durations reported by the run
summary and re-sort the list descending so the slowest, most variable
configs start in the first scheduling wave and get the full time budget.
Config coverage is unchanged.
The libssh2 integration tests start a fresh OpenSSH-server container per
test with "docker run -d -p 22" and then immediately open the SSH
connection. Docker maps the port as soon as the container starts, so the
TCP connect succeeds before sshd inside the container is ready to send its
banner, and the handshake fails with "Failed getting banner" (-43). This
shows up as an intermittent failure of a single test, most often
test_read, on unrelated pull requests.
Fall back to "make recheck" when "make check" fails. The automake parallel
test harness re-runs only the tests that did not pass, so a transient
container-readiness race no longer fails the job while a genuine failure
still does.
OpenVPN master keeps CRLs in its own stack and passes them to each
verification with X509_STORE_CTX_set0_crls from its cert verify
callback. CRLs are no longer loaded into the store.
- Add wolfSSL_X509_STORE_CTX_set0_crls. The ctx borrows the stack.
- Check the ctx CRLs in X509StoreVerifyCert. They can revoke a cert the
CertManager accepted and can satisfy the CRL requirement when the
CertManager has no CRL loaded. The check runs after the date override
handling so that a revocation is not masked by an overridden date
error. A stale CRL in the stack does not fail the check when another
CRL vouches for the cert.
- Add CheckCertCRLFromCm to check a cert against a caller-owned CRL
using the cm of the store for CRL signature verification. The CRL
object is not modified and the cached verification result of the
entries is not used because it is only valid for the owning cm.
- Pass the good result of the cert verify callback to the following
verify callbacks in DoVerifyCallback. In OpenSSL the cert verify
callback replaces chain verification so the verify callbacks only see
its result. OpenVPN needs this to run its per-cert verification.
- Re-add OpenVPN master to CI testing.
Fail the shard loudly if socat's test.sh no longer contains the
fork,retry=2 pattern, instead of letting sed silently no-op and
reintroduce the hang while the run still looks green.
The inverted testserversec OPENSSL tests (OPENSSLCERTCLIENT, the
commonname test and the fips test) run a foreground one-shot SSL
listener with no port-wait; their background connector exits after 2s
(retry=2, 1s apart). On a loaded runner the listener can bind after the
connector is already gone and then blocks in accept() forever, stalling
the shard until the job-level 15-minute timeout kills the run with no
diagnosable output. Seen once on a run whose re-run passed; reproduced
deterministically by delaying the listener past the retry budget.
- Widen the connector budget to retry=30. Retries only happen while the
listener is not yet up and testserversec kills the connector as soon
as the client returns, so passing runs are unaffected.
- Bound each shard with timeout(1) at 10 minutes (normal shard time is
~2 min) so any future hang fails fast and the shard output names the
test that was running.
The Falcon workflow only built --enable-falcon (default integer fpr). Add a
falcon_backends matrix that builds and runs testwolfcrypt for asm, double, avx2,
small-mem and avx2+small-mem on ubuntu-latest, and neon on the free ubuntu-24.04-arm
runner -- the SIMD/asm backends are the highest-risk code and now execute in CI.
verify-only is a build/link-only leg (its self-test needs signing). An AVX2 leg
guards on /proc/cpuinfo since backend dispatch is compile-time.
The falcon_interop job restored/untarred liboqs into the workspace and only
then ran actions/checkout, whose "git clean -ffdx" deleted the untracked
oqs-install/ directory. The interop harness build then failed with
"oqs/oqs.h: No such file or directory".
Move the wolfSSL checkout ahead of the cache-restore / artifact-download /
untar steps so the liboqs install lands after the clean and survives.
The harness itself is fine: built locally against liboqs it passes all eight
interop cells (liboqs<->native, both directions, levels 1 and 5).
- codespell.yml: add "fpr"/"FPR" to ignore_words_list. "fpr" is the Falcon
reference's canonical name for the floating-point primitive seam and
appears hundreds of times across the sources; it is not a typo.
- wc_falcon.c: rename local "clen" -> "compLen" (codespell flagged clen)
and replace a non-ASCII em-dash in a comment with "--" (check-source-text
8-bit byte violation).
- wc_falcon_bigint.c: fix typos "morever" -> "moreover", "Mutiply" ->
"Multiply".
- wc_falcon_codec.c: reword "are statics in" -> "are static functions in"
(codespell flagged "statics").
Scrub the temporary "FN-DSA" name and the "FIPS 206" designation from all
in-tree comments, build text, and message strings, leaving the algorithm
named only as "Falcon". The eventual standardized name is not announced.
The differential known-answer test message ("wolfSSL FN-DSA differential
KAT") is a signed input, so the Falcon-512/1024 public keys and signatures
in wolfcrypt/test/test.c (and the mirrored Falcon-512 vector in
IDE/m33mu-falcon-verify/kat.h) were regenerated with liboqs over the new
message "wolfSSL Falcon differential KAT", preserving the differential
property (liboqs-produced signatures verified by the native verifier).
Verified: testwolfcrypt Falcon test passes; the m33mu verify-only harness
passes (BKPT 0x7f) with the regenerated vector.
Falcon was the last algorithm backed by liboqs; now that wolfCrypt has a
native Falcon implementation, liboqs is no longer needed. Remove the
integration entirely so liboqs does not appear as a build or SBOM dependency:
- configure: drop --with-liboqs (and the -loqs link), the BUILD_LIBOQS
conditional and the summary line.
- CMake: drop WOLFSSL_OQS, the duplicate liboqs-backed WOLFSSL_FALCON
option, the OQS cross-validation / find_package(OQS) block, the
FindOQS.cmake module, BUILD_OQS_HELPER, and HAVE_LIBOQS from options.h.in.
- Remove the wolfcrypt/src/port/liboqs port layer (liboqs.c/.h) and its
wolfSSL_liboqsInit/Close calls in wc_port.c.
- settings.h: drop HAVE_LIBOQS from the asym key import/export aggregates
(HAVE_FALCON already covers them) and from the experimental gate; add
HAVE_FALCON to the experimental gate so the unstandardized Falcon requires
WOLFSSL_EXPERIMENTAL_SETTINGS in every build system.
- Drop liboqs.c from the VS/Zephyr/INTIME project files, remove the liboqs
install from Docker, and update INSTALL/tls.c text (Falcon is native now).
No functional change to non-Falcon builds; the library links no liboqs.
Add a complete native Falcon post-quantum lattice signature implementation to
wolfCrypt, replacing the liboqs wrapper. Full key generation, signing and
verification for Falcon-512 (level 1) and Falcon-1024 (level 5).
- Public API wc_falcon_* / falcon_key in falcon.c wraps the native core
(falcon_native_* in wc_falcon.c) plus wc_falcon_{fpr,fft,poly,sampler,
codec,keygen,sign,bigint}.c. No liboqs dependency.
- Portable, constant-time integer-emulated floating-point (fpr) backend is
the default; opt-in per-architecture acceleration:
--enable-falcon-double inline native double
--enable-falcon-asm x86-64 SSE2 out-of-line fpr asm
--enable-falcon-avx2 x86-64 AVX2 (4-wide) FFT
- Division-free (Barrett) integer NTT on the verify path, so no hardware
divide is required on Cortex-M / embedded targets.
- Verify uses a cached twiddle-factor NTT; signing uses the FFT / ffLDL tree
and discrete Gaussian sampler over the abstract fpr seam.
- test.c falcon_test (KAT verify + native keygen/sign/verify roundtrip);
scripts/falcon-interop.c and a CI workflow cross-check native<->liboqs in
both directions.
- Add wolfIO_OcspDestAllowed(); block internal-range responder hosts
- Call it in EmbedOcspLookup before connect (CWE-918)
- Gate on WOLFSSL_OCSP_SCREEN_RESPONDER (off by default)
- Add unit tests and CI for both resolver paths
CMake accepted -DWOLFSSL_XMSS=1 but never emitted WOLFSSL_HAVE_XMSS, so
wc_xmss.c compiled empty and options.h advertised no XMSS support. Add the
missing definition block (mirroring LMS) plus WOLFSSL_XMSSVERIFYONLY and
WOLFSSL_XMSSSMALL sub-options for parity with autotools --enable-xmss=
verify-only,small, and expose all three in the generated options.h.
Also enable WOLFSSL_XMSS in the cmake.yml CI build, which tested LMS but
not XMSS -- the blind spot that let this regression through.
- *_wire_sni test is now more efficient
- openssl-ech workflow now does interop with ECH rejection
extra improvements:
- tested TLSX_EchSwapExtensions
- added ctx level SNI to padding calculation
- Improvement of SNI handling for ECH
- Changed EchSwapExtensions to append instead of prepend
- Reworked ECH testing
Address review feedback (dgarske):
- Restore SECURITY-POLICY.md instead of deleting it. The full policy
(severity rubric, scope, coordinated disclosure, credit) stays in-repo;
the canonical website URL is now presented as a mirror of it, not a
replacement, so other repos can still reference one copy.
- SECURITY.md: prefer support@wolfssl.com, offer secure@wolfssl.com with
the PGP key as an option, and drop the phone number.
- Restore the mandatory report-template requirement and the "keep the
vulnerability private until a fix is released" guidance, resolving the
contradiction between the intro and the template section.
David GarskeandGitHub
Sean ParkinsonandGitHub
night1rider
JacobBarthelmehandGitHub
Mark Atwood
Sameeh JubranandMark Atwood
Brett NicholasandGitHub
Tobias Frauenschläger
Juliusz Sosinowicz
Daniele Lacamera
Marco Oliverio
John Safranek
Paul Adelsbach
philljjandGitHub
aidan garske
sebastian-carpenter
ZackeryandGitHub