Tobias Frauenschläger 1faddd640e evp: verify Poly1305 tag on ChaCha20-Poly1305 decrypt ...

EVP_DecryptFinal_ex() called wc_ChaCha20Poly1305_Final() which only
computes the Poly1305 tag, writing it into ctx->authTag and
overwriting the expected tag stored there by EVP_CTRL_AEAD_SET_TAG.
No comparison was ever performed, so any forged tag was accepted.

Fix: save the expected tag before calling Final(), then verify with
wc_ChaCha20Poly1305_CheckTag() on the decrypt path, mirroring the
existing AES-GCM branch. Add a regression test that asserts
EVP_DecryptFinal_ex() rejects an all-zero forged tag.

Reported-by: Nicholas Carlini (Anthropic) & Bronson Yen (Calif.io)

2026-04-02 12:35:15 +02:00

..

benchmark

wolfssl/wolfcrypt/types.h: restore WC_ALLOC_DO_ON_FAILURE fallback definition from 760178c7dc -- reversion in part of 5f4d499df0. fixes optest build failures in all-crypto-only-intelasm-fips-v5-linuxkm-next-insmod-optest, all-crypto-only-intelasm-fips-v6-linuxkm-next-insmod-optest, and all-crypto-only-intelasm-fips-dev-linuxkm-next-insmod-optest.

2026-03-26 16:28:18 -05:00

src

evp: verify Poly1305 tag on ChaCha20-Poly1305 decrypt

2026-04-02 12:35:15 +02:00

test

fixup! Refactor: Use dynamic allocation for RSA test buffers

2026-03-31 12:42:16 +02:00