Modes (CTR, GCM, CCM, etc.) can be supported either directly or fallback
to invoking the crypto callback with a "direct" (ECB) mode.
Software implementation and AES tables are stripped under CB_ONLY_AES.
wc_swdev gains AES support so WOLF_CRYPTO_CB_ONLY_AES builds can be
tested.
crypto find cb support added to wc_AesSetKey in order to support current
CI tests that use INVALID_DEVID.
Add WOLF_CRYPTO_CB_ONLY_SHA256: when set, the SHA-256 software.
wc_Sha256FinalRaw is reduced to a stub returning NO_VALID_DEVID, and
sha256.h force-defines WOLFSSL_NO_HASH_RAW so the constant-time TLS HMAC
path falls back to its backend-opaque variant.
Incompatible with
WOLFSSL_SHA224, which aliases the SHA-256 statics; #error guard added.
Add wc_swdev support for SHA-256 for testing.
Follow up to PR #10450 with some minor fixes:
* FIPS 205 numbering: slh_sign is §10.2.1 Alg 22; slh_verify is Alg 24;
hash_slh_verify is Alg 25 (impl comments and doxygen).
* Widen wc_SlhDsaKey_SignHashWithRandom's addRnd to const byte* to
match wc_SlhDsaKey_SignWithRandom.
* Make the SLHDSA_PHMSG_MAX_LEN invariant explicit with a named
SLHDSA_LARGEST_APPROVED_PHM_LEN constant and a wc_static_assert.
* SHAKE128/SHAKE256 round-trip and length-rejection coverage for both
SignHash and VerifyHash.
* Doxygen: briefs for the five DER encode/decode APIs; accurate
decoder failure-rollback wording; tighter return-code lists for
Verify and VerifyMsg.
* ChangeLog: silent-failure caveat for raw messages whose length
happens to equal the digest size of the chosen hashType.
On CHERI casting mp_int pointers to wc_ptr_t for the bitmask
arithmetic strips the hardware capability tag. The reconstructed
pointer won't have a valid tag and will cause a tag violation when it
is dereferenced.
Under __CHERI_PURE_CAPABILITY__, replace the pointer arithmetic with
four mp_cond_copy calls that operate on the digit data directly.
This preserves the capability tags and accesses both accumulators
unconditionally.
Non-CHERI builds retain the original wc_off_on_addr path unchanged.
Signed-off-by: William Beasley (The Capable Hub) <wbeasley@thegoodpenguin.co.uk>
The branchless code in casts sp_int pointers to size_t for bitmask
arithmetic, then casts the result back to sp_int*.
On CHERI, pointer-to-integer casts strip the hardware capability tag.
The reconstructed pointer is tagless and cannot be dereferenced,
causing a tag-violation fault.
Add _sp_cond_copy that uses the bitmask on the digit data itself rather
than the addresses, this avoids needed to do pointer arithmetic.
On non-CHERI targets the behaviour is the same.
Signed-off-by: William Beasley (The Capable Hub) <wbeasley@thegoodpenguin.co.uk>
AVX2 not decompressing 5-bit values correctly.
AVX2 not comparing last 32 bytes of ciphertext.
Protect mlkemkey_get_k to only be compiled when make key is compiled in.
Octeon_AesGcm_SetAAD unconditionally ran XOR0/XORMUL1 on the partial-block
buffer after the main loop, which processed an extra all-zero block when
aadSz was a non-zero multiple of 16, corrupting the GCM tag. Guard the
trailing XOR/MUL with `if (remainder > 0)`.
Issue: F-3335
* fix typography of wc_PBKDF_max_iterations_set() and wc_PBKDF_max_iterations_get() (peer review).
* refactor overflow prevention in wc_PKCS12_PBKDF_ex() to use WC_SAFE_SUM_UNSIGNED().
wolfcrypt/test/test.c: in pwdbased_test(), omit "INT_MAX MAC iterations" test if WOLFSSL_NO_MALLOC (uses wc_PKCS12_new_ex()).
David Garske
Daniel Pouzzner
Sean Parkinson
Jeremiah Mackey
JeremiahM37
rizlik
JacobBarthelmeh
Juliusz Sosinowicz
Tobias Frauenschläger
William Beasley (The Capable Hub)
jordan
John Safranek
Anthony Hu
Paul Adelsbach