15398c26d0
ML-KEM: fix comments, API signatures, minor issues
...
More checks for public or private key not set.
wc_MlKemKey_Free clears key->flags
wc_MlKemKey_DecodePrivateKey now checks the public key is valid.
wc_MlKemKey_EncodePrivateKey doesn't need calculate hash of public key
as encoding the public key will do this.
EncodePrivateKey/EncodePublicKey now return BAD_STATE_E when flags not
set.
mlkem_kdf, mlkem_check_public, mlkem_xof_absorb pointer parameters are
now const.
Now all mlkem_redistribute_*_rand_avx2 functions are WOLFSSL_LOCAL.
Changed Kyber uses to MlKem.
2026-05-07 08:17:27 +10:00
3f1c6bdac8
Code review feedback.
2026-05-06 15:13:48 -07:00
d1b6ddca75
Properly handle fallback cipher type case in wc_Pkcs11_CryptoDevCb.
...
Thanks to Zou Dikai for the report.
2026-05-06 15:12:09 -07:00
f6019467fa
add unit test for NULL SHAKE parameters
2026-05-06 15:25:06 -06:00
38dfa91a7b
Fix include for errno in Microchip port settings
2026-05-06 16:14:59 -05:00
e085d468d8
clear potential null dereference
2026-05-06 14:33:14 -06:00
a3799cffda
fix: guard wc_Ed448PublicKeyToDer ed448_export_public call for FIPS<7
2026-05-06 14:09:56 -06:00
980fc51ea7
Merge pull request #10275 from twcook86/make_rpm_fix
...
Fix a few issues with "make rpm"
2026-05-06 13:06:42 -07:00
03cee6f2bf
tests/api/test_ed25519.c and tests/api/test_ed448.c: add missing FIPS v7+ gating in test_wc_ed25519_export() and test_wc_ed448_export().
...
wolfcrypt/test/test.c: in aes_cbc_test(), use unconditional static on msg4 and verify4 to work around gcc optimizer bug (probably same bug as noted in ac11279c60
2026-05-06 14:24:18 -05:00
490c1062e4
Merge pull request #10274 from gasbytes/crl-idp-extension-fix-follow-up
...
Reject CRLs with unrecognized critical entry extensions per RFC 5280 section 5.3
2026-05-06 12:13:28 -07:00
545376c477
Merge pull request #10279 from julek-wolfssl/zd/21661
...
zd/21661: harden X.509 chain validation, session ticket identity binding, and peer cert restore
2026-05-06 11:59:55 -07:00
27413e0a3f
Merge pull request #10403 from Frauschi/hostap_interal_retry
...
hostap CI tests: incorporate internal retries
2026-05-06 11:59:49 -07:00
c38e6cac36
Merge pull request #10414 from night1rider/zephyr/4.x-workflow-fixes
...
Zephyr 4.x workflow: stabilize CI for renamed forks and slashed branch names
2026-05-06 11:58:19 -07:00
2cdbd25a64
asn: restore serial-0 rejection in DecodeCertInternal for pubkey-extraction paths
2026-05-06 12:53:46 -06:00
0f2c526ee2
Add missing WC_NO_ERR_TRACE
2026-05-06 11:22:47 -07:00
80f971cd6d
clears dereference before null check
2026-05-06 11:22:47 -06:00
8c2bf1dfd4
Remove wc_*Key_HashMsg functions and PKCS#11 references
2026-05-06 09:56:22 -07:00
682b628eed
remove redundant, always true, checks
2026-05-06 10:51:00 -06:00
dc3ba1e299
stabilize CI for renamed forks and slashed branch names
2026-05-06 10:04:33 -06:00
d960d02c80
compare against MAX_UNICODE_SZ, readability change
2026-05-06 09:28:43 -06:00
dbdd066737
remove dead length check
2026-05-06 09:24:01 -06:00
061311d6ca
zd/21661: harden X.509 chain validation, session ticket identity binding, and peer cert restore
...
- x509_str: require CA:TRUE unconditionally in wolfSSL_X509_verify_cert;
verify leaf signature even when verify_cb overrides INVALID_CA
- x509_str: align WOLFSSL_X509_V_ERR_INVALID_CA with OpenSSL value (79)
so OPENSSL_COEXIST builds compile; bump WC_OSSL_V509_V_ERR_MAX to 80
and extend error_test() missing-value table for the new gaps
- asn: reject embedded NUL in dNSName / rfc822Name / URI SAN entries
- internal: re-verify restored ticket peer cert against trust store with
CRL/OCSP checks; clear stale state from session cache on verification
failure
- ticket: bind SNI and ALPN into session ticket via compile-time selected
hash (TICKET_BINDING_HASH_TYPE); reject resumption on mismatch in both
TLS 1.3 and TLS 1.2 paths
- ticket: defer SNI/ALPN binding check until after extensions are parsed
by consolidating into VerifyTicketBinding(), called once after
ALPN_Select in DoTls13ClientHello and DoClientHello; the early
per-call sites ran before extensions were parsed and rejected valid
resumptions in nginx, haproxy, grpc, and CPython integration tests
- ssl_sess: free previous session in wolfSSL_d2i_SSL_SESSION before
overwrite
- examples/client: increase SESSION_TICKET_LEN fallback from 256 to 2048
to support larger tickets
- tests: update SAN NUL fixtures and add parse-time rejection coverage;
add test_tls13_ticket_peer_cert_reverify for CA-removal scenario; skip
it under WOLFSSL_NO_DEF_TICKET_ENC_CB
2026-05-06 16:45:58 +02:00
f140546ba1
add sanity check of hash to atmel port
2026-05-06 08:34:50 -06:00
50da0c0a26
Merge pull request #10390 from Frauschi/lms_Wconversion
...
LMS Wconversion fixes
2026-05-06 09:16:23 -05:00
29343708df
Merge pull request #10391 from Frauschi/xmss_Wconversion
...
XMSS Wconversion fixes
2026-05-06 09:15:59 -05:00
01f500b938
Merge pull request #10399 from Frauschi/mldsa_Wconversion
...
ML-DSA Wconversion fixes
2026-05-06 09:15:53 -05:00
2833a4b1e8
ML-DSA Wconversion fixes
2026-05-06 15:33:17 +02:00
40b583fbcb
Wconversion fixes for LMS
2026-05-06 15:31:00 +02:00
fe353af409
XMSS Wconversion fixes
2026-05-06 15:29:08 +02:00
57f4b231c4
hostap CI tests: incorporate internal retries
2026-05-06 10:36:19 +02:00
7906e67c14
Address PR comments
2026-05-05 13:46:45 -07:00
b9eb7c1ff8
Add crypto callbacks for LMS and XMSS
2026-05-05 13:46:41 -07:00
6a3eb6f0a8
Merge pull request #10360 from gasbytes/cipher-init-dtls13-fix
...
dtls13: free and null the cipher slot on init failure in Dtls13InitAesCipher and ChaCha equivalent
2026-05-05 13:08:06 -07:00
13f459127c
Merge pull request #10372 from MarkAtwood/fix/ed448-der-const
...
fix: add const to wc_Ed448 DER export function key parameters
2026-05-05 12:49:30 -07:00
44564dd5fd
Merge pull request #10368 from holtrop-wolfssl/gh10359
...
Allow SubjectInfoAccess extension without id-ad-caRepository entry
2026-05-05 12:49:19 -07:00
e3a195d394
Merge pull request #10075 from josepho0918/mqx
...
Improve compatibility for XINET_PTON
2026-05-05 12:47:45 -07:00
e3285850f9
Merge pull request #10289 from julek-wolfssl/zd/21652
...
TLS 1.3: gate 0-RTT on a cache-backed resumption ticket
2026-05-05 12:46:26 -07:00
5da6625a10
tests/api.c, certs/test-serial0/include.am: drop em dash and trailing blank line
2026-05-05 13:46:05 -06:00
7647da47c3
tests/api.c: gate test_ParseSerial0FixtureMatrix on (fixtures are RSA)
2026-05-05 13:46:05 -06:00
bb59678627
tests/api.c: assert serial-0 policy outcome, not specific rejection error code
2026-05-05 13:46:05 -06:00
2cd42c9e16
Skoll review
2026-05-05 13:46:05 -06:00
5f1e0d0f0d
Merge pull request #10314 from night1rider/zephyr-4.x-workflows
...
workflow tests for zephyr 4.3 and 4.1
2026-05-05 12:46:00 -07:00
f31ef9e233
asn: drop redundant serial-0 check in DecodeCertInternal to avoid fail-open on forged isC
2026-05-05 13:44:47 -06:00
ee744b1f0b
Allow serial number 0 for root CA certificates
2026-05-05 13:44:47 -06:00
976e4b2d15
add test case for build with WC_ALLOW_ECC_ZERO_HASH
2026-05-05 13:39:10 -06:00
c73f431687
Merge pull request #10392 from JeremiahM37/fenrir-5
...
wolfCrypt input validation and side-channel hardening
2026-05-05 12:24:17 -07:00
c1b2660a08
Merge pull request #10396 from douzzer/20260501-fips-v7-fixes
...
20260501-fips-v7-fixes -- reviewed+approved by @Frauschi
2026-05-05 14:20:49 -05:00
b47f71678d
Merge pull request #10363 from MarkAtwood/fix/curve25519-clamp-check-rule3
...
fix: curve25519 clamp check missing rule 3 (bit 6 of byte 31) (ZD-21731)
2026-05-05 12:16:06 -07:00
3147a10f23
Merge pull request #10141 from sebastian-carpenter/tls-ech-downgrade
...
TLS ECH Compliance Fixes
2026-05-05 12:14:20 -07:00
00abce3474
Merge pull request #10310 from cconlon/d2iMLDSA
...
Add ML-DSA SPKI/PKCS#8 DER support to d2i_PUBKEY and d2i_PrivateKey
2026-05-05 12:11:49 -07:00
Sean Parkinson
Kareem
Ruby Martin
Eric Blankenhorn
jackctj117
David Garske
Daniel Pouzzner
Paul Adelsbach
night1rider
Juliusz Sosinowicz
JacobBarthelmeh
Tobias Frauenschläger