* Fix vector register restore on error paths in Sha3Update().
* Add SP 800-185 check against KMAC_FIPS_MIN_KEY in KmacInit() and
KMAC_FIPS_MIN_OUTPUT in KmacFinal(), returning KMAC_MIN_KEYLEN_E and
BAD_LENGTH_E respectively on failure.
* Use word32 rather than byte for wc_Sha3.i, wc_Cshake.count, wc_Kmac.count, and
related, and add explicit range checking where needed, to fix a -Wconversion,
fix possible overruns, obviate 14 casts, and eliminate (negligible) runtime
overhead from masking and promotions.
* add missing null key checks to wc_ed25519_verify_msg_init(), wc_ed25519_verify_msg_update(), and wc_ed25519_verify_msg_final().
* add WC_ARG_NOT_NULL() attributes to args of static functions as appropriate.
* add FIPS >v6 gates to new null key tests and a new invalid hash size test in test_wc_ed25519_sign_verify_ctx_ph() and test_wc_ed25519_verify_streaming().
* also inhibit recursive evaluation midway through random.h, fips.h, and fips_test.h (circular dependencies).
* add WC_FIPS_ENUM_CAST_ID_DEFINED to allow detection of fips_test.h incomplete evaluation.
wolfssl/wolfcrypt/aes.h: if HAVE_FIPS && !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, make wc_AesGcmEncrypt() a WOLFSSL_LOCAL, and if !_WC_BUILDING_AES_C, add a WC_DEPRECATED() attribute to it.
wolfssl/wolfcrypt/wc_compat.h, wolfssl/wolfcrypt/include.am, .wolfssl_known_macro_extras: add wc_compat.h: when HAVE_FIPS and !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, shim wc_AesGcmEncrypt() to remap it to FIPS-allowed APIs.
wolfssl/wolfcrypt/types.h: at the end, #ifndef BUILDING_WOLFSSL, #include <wolfssl/wolfcrypt/wc_compat.h>, to assure transparent shimming of wc_AesGcmEncrypt() for all outside callers.
wolfcrypt/src/evp.c, wolfcrypt/src/hpke.c, wolfcrypt/src/pkcs7.c, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.c, wolfssl/ssl.h: #include <wolfssl/wolfcrypt/wc_compat.h> to shim in-library/in-module calls to wc_AesGcmEncrypt().
src/internal.c: in TicketEncDec(), add const attributes to constable input args, and fix swapped out/in in calls to wc_AesGcmEncrypt().
tests/api/test_aes.c: in test_wc_AesGcmEncryptDecrypt(), skip longIV test if WC_TEST_AES_GCM_ENCRYPT_NO_NONSTD_IV (defined by wc_compat.h when needed).
wolfssl/wolfcrypt/error-crypt.h, wolfssl/error-ssl.h, wolfcrypt/src/error.c, src/internal.c:
* add FIPS_WRONG_API_E;
* put several error codes back into sequence in wc_GetErrorString() switch().
* move wc_static_assert()s from headers to corresponding .c files, to eliminate dependency on wolfcrypt/types.h;
* remove unneeded #include <wolfssl/wolfcrypt/types.h> from error-crypt.h.
The non-recursive automake "distdir" recipe inlines the entire $(DISTFILES)
list into a single shell command. Enumerating every IDE integration file
individually made that list large enough (~123 KB) that the recipe exceeded
the Linux MAX_ARG_STRLEN (128 KB) single-argument exec limit, so "make dist"
failed with:
/bin/bash: Argument list too long
make[2]: *** [distdir-am] Error 127
Replace the per-file EXTRA_DIST enumeration of the IDE directories with one
wholesale "EXTRA_DIST += IDE/<dir>" entry per directory (automake copies the
tree recursively). This collapses ~745 file entries into ~52 directory
entries and shrinks the top-level DISTFILES from ~123 KB to ~97 KB, well
under the limit.
The set of distributed IDE files is unchanged: a before/after "make dist"
diff shows no project file added or removed (only the now-unused include.am
build fragments are gone). Three directories that intentionally omit some
tracked files (apple-universal, MPLABX16, Renesas - private IDE configs,
.gitkeep placeholders, helper scripts) stay enumerated file-by-file.
WOLFSSL_OCSP_SCREEN_RESPONDER (from the OCSP AIA responder SSRF
screening work) is only ever enabled via
CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER, a form the check-source-text
"unknown macros" -D pattern does not match, so the subtest reports it as
an unrecognized macro and fails. Add it to .wolfssl_known_macro_extras.
Also fix the C lexical ordering of HWCAP2_SME, which sorted after
HWCAP_ASIMDRDM ('2' precedes '_' in the C locale) and tripped the "not
in C lexical order" warning.
WOLFSSL_OCSP_CHECKALL is a scope flag ("always leaf, but all ?"), selecting
which certs are checked, not how hard to fail when one advertises no OCSP
responder in its AIA. Treating a missing responder as a hard failure breaks
any chain whose CA publishes no OCSP URI (e.g. Google GTS WR2), a
configuration that only grows as CAs drop responders. Strictness belongs in
its own opt-in flag.
- Keep CHECKALL scope-only; a cert with no responder soft-fails by default.
- Return distinct OCSP_NO_URL for "no responder", separate from a failed
lookup; stapling response handling stays best-effort (mapped to CERT_GOOD).
- Add WOLFSSL_OCSP_FAIL_IF_NOT_SUPPORTED (via OcspNoUrlPolicy) to refuse such
certs; independent of CHECKALL.
- Add test_ocsp_no_url_policy covering both halves.
- Add wolfIO_OcspDestAllowed(); block internal-range responder hosts
- Call it in EmbedOcspLookup before connect (CWE-918)
- Gate on WOLFSSL_OCSP_SCREEN_RESPONDER (off by default)
- Add unit tests and CI for both resolver paths
Added support for encoding and decoding keys in ASN.1.
Added support for X.509 certificates and CSRs.
Generated certificates and CSRs. Not fo FrodoKEM-640 as is not in the specs.
Regenerated the single-precision C sources so that sp_<N>_from_mp() converts
secret inputs (ECDH/ECDSA private keys and nonces) in constant time: a
fixed-count loop bounded by the output size with masked reads at/after
a->used, instead of looping a->used times (which leaked the value's
magnitude through the executed-instruction count).
Fixes the ct-callgrind constant-time failures for P-521 (ec_p521_kex,
ec_p521_sign) and hardens the same pattern across all curves and key sizes
(108 sp_*_from_mp functions in sp_c32/sp_c64, sp_arm32/sp_arm64/sp_armthumb/
sp_cortexm and sp_x86_64).
Verified (--enable-sp, gcc 15.2): ec_p521_kex diff 156 -> 0, ec_p521_sign
diff 367 -> 55 (tol 300); testwolfcrypt RSA/ECC KATs pass.
Generated by https://github.com/wolfSSL/scripts/pull/626
check-source-text (rule I) flags error-code identifiers used as comparison
operands even inside comments. Reword three comments so the code name is no
longer written as "(ret == PUBLIC_KEY_E)" / "(ret != CRYPTOCB_UNAVAILABLE)"
(test_kdf.c, test_ed448.c); the bare token on its own is fine.
clang-tidy reported a possible 0-byte malloc in test_mlkem.c: the ML-KEM
key/ciphertext sizes come from wc_MlKemKey_*Size() queries, which the analyzer
cannot prove nonzero. Guard each XMALLOC with a >0 check so the allocation
size is provably positive; the ExpectNotNull() checks still catch a 0-size
query at runtime.
The FIPS build diverges from the OPEN build on KDF behavior these exhaustive
MC/DC probes assert: wc_HmacSetKey enforces the 14-byte HMAC_FIPS_MIN_KEY, so
wc_Tls13_HKDF_Extract with the short salt/ikm here returns HMAC_MIN_KEYLEN_E
(-200) instead of 0 (test_kdf.c:766), and wc_PRF with resLen==0 returns 0
instead of BAD_FUNC_ARG (test_kdf.c:118). kdf.c coverage is measured only in
non-FIPS campaign variants, so guard both test_wc_KdfDecisionCoverage and
test_wc_KdfFeatureCoverage bodies with !HAVE_FIPS && !HAVE_SELFTEST; they run
in full in OPEN builds and skip cleanly under FIPS/selftest. Verified against
a --enable-fips=v5 build (both now skip, 0 failures).
kdf: wc_Tls13_HKDF_Extract_ex / wc_Tls13_HKDF_Expand_Label_ex postdate the
frozen FIPS/selftest kdf.h and are undeclared there. Gate every _ex call site
behind WOLFSSL_TEST_HKDF_EX (!HAVE_FIPS && !HAVE_SELFTEST); the thin non-_ex
wrappers, which exist everywhere, keep their coverage.
wolfmath: test_wc_TfmDecisionCoverage / test_wc_TfmExptModDecisionCoverage /
test_wc_IntegerDecisionCoverage called library-internal fp_* and s_mp_*
functions that carry no MP_API decoration, so under -fvisibility=hidden they
are not exported from the shared library and unit.test failed to link them
(undefined reference to fp_set / s_mp_mul_digs / ...) in the default shared CI
build. Relocate those decision drivers into the tests/unit-mcdc white-boxes,
which reach the internals legally by #including tfm.c / integer.c; tests/api
now uses only the public mp_* interface. mp_rand_prime calls are gated by
WOLFSSL_KEY_GEN (and, for integer, !NO_DH || !NO_DSA) to match where the
library declares and defines it.
Under DEBUG_WOLFSSL, wc_HashUpdate/Final/Free first check (hash->type != type)
and return BAD_FUNC_ARG before the switch, so the "unsupported type ->
HASH_TYPE_E" arm is unreachable on an uninitialized hash (wc_HashInit refuses
those types). Guard those Update/Final/Free assertions with #ifndef
DEBUG_WOLFSSL; the arm's coverage comes from non-DEBUG variants in the union.
Fixes the cmake (old-TLS/debug) build failure. wc_HashInit assertions keep
running (Init has no such type check).
This bug is fixed in PR #10927
test_wolfSSL_read_write_ex hard-coded the close-notify exchange as
NOT_DONE/NOT_DONE/SUCCESS/SUCCESS, which is protocol-version/config dependent
and fails under the cmake old-TLS build. Loop wolfSSL_shutdown on each side
until WOLFSSL_SUCCESS (pre-existing flake, not from this PR's new tests).
Merge the _gap white-box drivers into their base file (tfm, integer, ed448,
mldsa, mlkem_poly, slhdsa, xmss_impl) and delete the _gap copies; a single
binary per source also satisfies more MC/DC independence pairs (tfm 89->91,
integer 92->100, mlkem_poly 25->27, mldsa 252->256). LMS is kept as two files:
its sign-side drivers reference internals absent under verify-only/small
builds and use per-driver state that does not share one main() safely.
night1rider
Daniel Pouzzner
JacobBarthelmeh
Tobias Frauenschläger
Sean Parkinson
philljj
John Safranek
Paul Adelsbach
Daniele Lacamera