jordan
842511b0ef
wolfcrypt test: fix ecc521 err msg.
2026-01-05 12:25:53 -06:00
Daniel Pouzzner
cb78341886
Merge pull request #7586 from kareem-wolfssl/gh7197
...
Keep RNG seed file descriptor open until the RNG is freed.
2025-12-30 15:57:25 -06:00
philljj
5fa06818c0
Merge pull request #9595 from douzzer/20251229-linuxkm-rng-wolfentropy
...
20251229-linuxkm-rng-wolfentropy
2025-12-30 14:50:53 -06:00
Daniel Pouzzner
0621615b15
wolfcrypt/src/random.c: remove WC_VERBOSE_RNG messaging from wc_RNG_TestSeed(), which is called by test code with expected failure, and move it to _InitRng() and PollAndReSeed(), where it's always expected to succeed.
2025-12-30 13:27:31 -06:00
Daniel Pouzzner
299ca1cfef
fixes from peer review: added comments for clarity, and remove errant condition added in _InitRng().
2025-12-30 12:13:15 -06:00
JacobBarthelmeh
7a2e1c1dd0
Merge pull request #9585 from dgarske/add-missing-api-docs
...
Add missing API documentation
2025-12-30 09:37:22 -07:00
Daniel Pouzzner
450b0b46c6
wolfcrypt/src/random.c and wolfssl/wolfcrypt/settings.h: add WC_VERBOSE_RNG messages, and activate by default when WOLFSSL_KERNEL_MODE.
2025-12-29 20:55:36 -06:00
Anthony Hu
48ebe99372
Validate asn date based on position of Z ( #8603 )
2025-12-29 16:01:22 -06:00
David Garske
5b5686c53c
Peer review improvements.
2025-12-29 08:37:51 -08:00
Daniel Pouzzner
7bbd28d369
wolfcrypt/src/aes.c: fix clang-diagnostic-unreachable-code in AesSetKey_C().
2025-12-26 18:13:44 -06:00
Daniel Pouzzner
3b3ddd1fb4
wolfcrypt/src/random.c: in wc_GenerateSeed(), move the gate closures for !FORCE_FAILURE_RDSEED and !ENTROPY_MEMUSE_FORCE_FAILURE to follow the /dev/urandom fallback method.
2025-12-26 14:16:11 -06:00
Daniel Pouzzner
b487287abf
wolfcrypt/benchmark/benchmark.c: smallstack refactor of bench_mlkem_encap()
2025-12-26 12:45:26 -06:00
Kareem
0a02f5ef6b
Code review feedback
2025-12-24 17:12:40 -07:00
Kareem
496d124736
Merge remote-tracking branch 'upstream/master' into gh7197
2025-12-24 17:05:04 -07:00
Daniel Pouzzner
a944575e4b
wolfcrypt/src/random.c: fix clang-diagnostic-unreachable-code in wc_GenerateSeed().
2025-12-24 17:48:37 -06:00
Daniel Pouzzner
019a420187
Merge pull request #9568 from kareem-wolfssl/zd20947
...
Add a flag which allows requesting exactly SEED_SZ and using the full seed to instantiate the DRBG during RNG init.
2025-12-24 17:03:26 -06:00
David Garske
18176392fa
Merge pull request #9576 from douzzer/20251222-linuxkm-PK-initrng-optimize
...
20251222-linuxkm-PK-initrng-optimize
2025-12-23 15:02:53 -08:00
Kareem
06d8f69dac
Separate new /dev/urandom opening logic into a new section in wc_GenerateSeed.
2025-12-23 14:52:52 -07:00
Kareem
cb81cc8ce6
Merge remote-tracking branch 'upstream/master' into gh7197
2025-12-23 14:43:57 -07:00
Daniel Pouzzner
b66f1b78a7
peer/Devin review:
...
* in get_crypto_default_rng() (linuxkm/lkcapi_sha_glue.c), sanity check that crypto_default_rng isn't null;
* in wc_InitRsaKey_ex(), remove frivolous NULL/zero assignments (XMEMSET clears them implicitly);
* in wc_CheckRsaKey(), check ret from wc_InitRng() and short circuit return if failed.
2025-12-23 13:05:40 -06:00
Daniel Pouzzner
cd88a8ae88
peer review -- add !WC_NO_RNG gates around WC_RNG changes in wolfcrypt/src/rsa.c and wolfssl/wolfcrypt/rsa.h.
2025-12-23 11:41:59 -06:00
David Garske
8f089cdcfe
Merge pull request #9508 from SparkiDev/ppc32_sha256_asm_pic
...
PPC32 SHA-256 ASM: support compiling for PIC
2025-12-23 08:12:50 -08:00
Daniel Pouzzner
5030484bcf
wolfcrypt/src/random.c and wolfssl/wolfcrypt/random.h:
...
* add WC_DRBG_{NOT_INIT,OK,FAILED,CONT_FAILED} in public header file, and
* move setup for RNG_SECURITY_STRENGTH, ENTROPY_SCALE_FACTOR, SEED_BLOCK_SZ, SEED_SZ, MAX_SEED_SZ, and RNG_HEALTH_TEST_CHECK_SIZE from random.c to random.h, with public WC_DRBG_SEED_SZ and WC_DRBG_MAX_SEED_SZ.
2025-12-22 22:58:29 -06:00
Daniel Pouzzner
b2ef89b2db
wolfcrypt/src/rsa.c and wolfssl/wolfcrypt/rsa.h: make RsaKey.rng and wc_RsaSetRNG() available unconditionally, rather than only if WC_RSA_BLINDING, for use by wc_CheckRsaKey().
2025-12-22 22:58:29 -06:00
Sean Parkinson
59f84355a5
Merge pull request #9573 from night1rider/aes-free-callbacks
...
Aes Free callback support
2025-12-23 08:47:05 +10:00
Sean Parkinson
c8f2cc5b43
Merge pull request #9566 from dgarske/ca_skid_cert_akid
...
Added build option to allow certificate CA matching using AKID with signers SKDI
2025-12-23 08:40:14 +10:00
night1rider
afbc65a6c3
Aes Free callback support
2025-12-22 12:39:41 -07:00
Sean Parkinson
da06e1aeea
Merge pull request #9558 from kareem-wolfssl/zd20944_2
...
Move Curve25519 public key check to make_pub/make_pub_blind to cover the case where they are called directly by an application.
2025-12-22 19:38:42 +10:00
Sean Parkinson
7a326ef43f
Merge pull request #9553 from julek-wolfssl/ed25519-export-key-check
...
ed25519: validate presence of keys in export functions
2025-12-22 19:31:14 +10:00
JacobBarthelmeh
0a0c43054f
Merge pull request #9564 from douzzer/20251219-fixes
...
20251219-fixes
2025-12-19 16:24:20 -07:00
Kareem
3e59b83727
Only keep /dev/urandom open, close /dev/random after each use.
...
Improve logic for opening RNG seed FD.
2025-12-19 15:57:49 -07:00
Kareem
fe105d4b48
Add a flag which allows requesting exactly SEED_SZ and using the full seed to instantiate the DRBG during RNG init.
...
This flag can not be used with FIPS.
2025-12-19 15:25:15 -07:00
David Garske
1cb2231ff5
Added build option to allow certificate CA matching using AKID with signers SKID ( WOLFSSL_ALLOW_AKID_SKID_MATCH). Fixed issue with cert->extAuthKeyIdSz not being set with ASN template code.
2025-12-19 14:14:39 -08:00
Daniel Pouzzner
a7550346dd
wolfcrypt/test/test.c: in rng_seed_test(), fix gates for FIPS 5.2.4.
2025-12-19 15:50:27 -06:00
Daniel Pouzzner
d3f74557fe
wolfcrypt/src/wolfentropy.c: add volatile attribute to entropy_memuse_initialized declaration; in wc_Entropy_Get(), if HAVE_FIPS, call Entropy_Init() if necessary, to accommodate FIPS KATs; in Entropy_Init(), add thread safety.
2025-12-19 15:45:17 -06:00
David Garske
1825bd86f5
Merge pull request #9550 from JacobBarthelmeh/caam
...
sanity checks on buffer size with AES and CAAM Integrity use
2025-12-19 11:03:40 -08:00
JacobBarthelmeh
8153ea6189
Merge pull request #9559 from cconlon/pkcs7SignedNonOctet
...
Fix PKCS#7 SignedData parsing for non-OCTET_STRING content types
2025-12-19 11:12:06 -07:00
Daniel Pouzzner
6f95a9c58e
wolfcrypt/src/random.c: in _InitRng(), remove "drbg_instantiated" conditional cleanup logic (Coverity true-benign-positive: DEADCODE because drbg_instantiated is always false when ret != DRBG_SUCCESS).
2025-12-19 10:30:14 -06:00
Daniel Pouzzner
fb26b2dfe1
wolfcrypt/test/test.c: in HMAC tests, initialize ret, to silence uninitvar from cppcheck-force-source.
2025-12-19 09:07:14 -06:00
Daniel Pouzzner
96c47cd18c
wolfcrypt/test/test.c: in _rng_test(), inhibit the WC_RESEED_INTERVAL subtest if an rng callback is installed.
2025-12-19 08:55:35 -06:00
Juliusz Sosinowicz
dd35f10b57
ed25519: validate presence of keys in export functions
2025-12-19 10:14:26 +01:00
Chris Conlon
afe82b9512
Fix PKCS#7 degenerate detection based on signerInfos length
2025-12-18 16:28:03 -07:00
Chris Conlon
d6dcd30736
Fix PKCS#7 streaming for non OCTET STRING content types
2025-12-18 16:28:01 -07:00
Kareem
b0b840aa0f
Rename fdOpen to seedFdOpen to avoid potential conflicts.
...
Gate keeping the seed FD open behind WOLFSSL_KEEP_RNG_SEED_FD_OPEN and only
enable by default for HAProxy. It is causing issues on OS X and may
cause issues on other OSes, and is generally a major behavior change.
2025-12-18 15:55:35 -07:00
Kareem
c238defe23
Add cast for public_size
2025-12-18 15:32:59 -07:00
Kareem
755097d512
Track if RNG seed FD was opened and only close it if it was already open. This fixes the case where wc_FreeRng is called when _InitRng was not called on the RNG. Since the FD value defaults to 0 before _InitRng was called, and 0 is potentially a valid FD, it was being closed.
2025-12-18 15:27:00 -07:00
JacobBarthelmeh
4162f24434
Merge pull request #9555 from embhorn/zd20964
...
Null deref check in Pkcs11ECDH
2025-12-18 15:14:35 -07:00
Kareem
81d32f4fe6
Move Curve25519 public key check to make_pub/make_pub_blind to cover the case where they are called directly by an application.
2025-12-18 14:37:59 -07:00
Kareem
0420c942a0
Only use -1 for uninitialized fds as 0 is a valid fd.
2025-12-18 11:22:22 -07:00
Kareem
2e83b97909
Only attempt to close RNG file descriptor on platforms with XCLOSE.
2025-12-18 11:15:33 -07:00
