Skip to content

Commit 4634717

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request wolfSSL#9034 from holtrop/allow-pkcs7-without-x963-kdf
Allow building with HAVE_PKCS7 set and HAVE_X963_KDF unset
2 parents 09dd519 + df7e105 commit 4634717

5 files changed

Lines changed: 32 additions & 25 deletions

File tree

‎doc/dox_comments/header_files/pkcs7.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,8 @@ int wc_PKCS7_SetAESKeyWrapUnwrapCb(wc_PKCS7* pkcs7,
532532
number generator for encryption
533533
\return DRBG_FAILED Returned if there is an error generating numbers with
534534
the random number generator used for encryption
535+
\return NOT_COMPILED_IN may be returned if using an ECC key and wolfssl was
536+
built without HAVE_X963_KDF support
535537
536538
\param pkcs7 pointer to the PKCS7 structure to encode
537539
\param output pointer to the buffer in which to store the encoded
@@ -617,6 +619,8 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7,
617619
verification
618620
\return MP_MEM may be returned if there is an error during signature
619621
verification
622+
\return NOT_COMPILED_IN may be returned if the EnvelopedData is encrypted
623+
using an ECC key and wolfssl was built without HAVE_X963_KDF support
620624
621625
\param pkcs7 pointer to the PKCS7 structure containing the private key with
622626
which to decode the enveloped data package

‎tests/api.c‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17714,8 +17714,8 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1771417714
rsaPrivKeySz = (word32)sizeof(rsaClientKey);
1771517715
#endif
1771617716
#endif
17717-
#if defined(HAVE_ECC) && (!defined(NO_AES) || (!defined(NO_SHA) ||\
17718-
!defined(NO_SHA256) || defined(WOLFSSL_SHA512)))
17717+
#if defined(HAVE_ECC) && defined(HAVE_X963_KDF) && (!defined(NO_AES) || \
17718+
!defined(NO_SHA) || !defined(NO_SHA256) || defined(WOLFSSL_SHA512))
1771917719
byte* eccCert = NULL;
1772017720
byte* eccPrivKey = NULL;
1772117721
word32 eccCertSz;
@@ -17793,8 +17793,8 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1779317793
#endif /* NO_RSA */
1779417794

1779517795
/* ECC */
17796-
#if defined(HAVE_ECC) && (!defined(NO_AES) || (!defined(NO_SHA) ||\
17797-
!defined(NO_SHA256) || defined(WOLFSSL_SHA512)))
17796+
#if defined(HAVE_ECC) && defined(HAVE_X963_KDF) && (!defined(NO_AES) || \
17797+
!defined(NO_SHA) || !defined(NO_SHA256) || defined(WOLFSSL_SHA512))
1779817798

1779917799
#ifdef USE_CERT_BUFFERS_256
1780017800
ExpectNotNull(eccCert = (byte*)XMALLOC(TWOK_BUF, HEAP_HINT,
@@ -17862,7 +17862,7 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1786217862
#endif /* NO_AES && HAVE_AES_CBC */
1786317863

1786417864
#endif /* NO_RSA */
17865-
#if defined(HAVE_ECC)
17865+
#if defined(HAVE_ECC) && defined(HAVE_X963_KDF)
1786617866
#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(HAVE_AES_KEYWRAP)
1786717867
#if !defined(NO_SHA) && defined(WOLFSSL_AES_128)
1786817868
{(byte*)input, (word32)(sizeof(input)/sizeof(char)), DATA,
@@ -18036,7 +18036,7 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1803618036
(word32)sizeof(decoded)), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1803718037
/* Should get a return of BAD_FUNC_ARG with structure data. Order matters.*/
1803818038
#if defined(HAVE_ECC) && !defined(NO_AES) && defined(HAVE_AES_CBC) && \
18039-
defined(HAVE_AES_KEYWRAP)
18039+
defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
1804018040
/* only a failure for KARI test cases */
1804118041
if (pkcs7 != NULL) {
1804218042
tempWrd32 = pkcs7->singleCertSz;
@@ -18137,7 +18137,7 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1813718137
XFREE(rsaCert, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
1813818138
XFREE(rsaPrivKey, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
1813918139
#endif /* NO_RSA */
18140-
#ifdef HAVE_ECC
18140+
#if defined(HAVE_ECC) && defined(HAVE_X963_KDF)
1814118141
XFREE(eccCert, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
1814218142
XFREE(eccPrivKey, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
1814318143
#endif /* HAVE_ECC */
@@ -18186,7 +18186,8 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
1818618186
} /* END test_wc_PKCS7_EncodeDecodeEnvelopedData() */
1818718187

1818818188

18189-
#if defined(HAVE_PKCS7) && defined(HAVE_ECC) && !defined(NO_SHA256) && defined(WOLFSSL_AES_256)
18189+
#if defined(HAVE_PKCS7) && defined(HAVE_ECC) && defined(HAVE_X963_KDF) && \
18190+
!defined(NO_SHA256) && defined(WOLFSSL_AES_256)
1819018191
static int wasAESKeyWrapCbCalled = 0;
1819118192
static int wasAESKeyUnwrapCbCalled = 0;
1819218193

@@ -18215,7 +18216,8 @@ static int testAESKeyWrapUnwrapCb(const byte* key, word32 keySz,
1821518216
static int test_wc_PKCS7_SetAESKeyWrapUnwrapCb(void)
1821618217
{
1821718218
EXPECT_DECLS;
18218-
#if defined(HAVE_PKCS7) && defined(HAVE_ECC) && !defined(NO_SHA256) && defined(WOLFSSL_AES_256)
18219+
#if defined(HAVE_PKCS7) && defined(HAVE_ECC) && defined(HAVE_X963_KDF) && \
18220+
!defined(NO_SHA256) && defined(WOLFSSL_AES_256)
1821918221
static const char input[] = "Test input for AES key wrapping";
1822018222
PKCS7 * pkcs7 = NULL;
1822118223
byte * eccCert = NULL;
@@ -18321,8 +18323,8 @@ static int test_wc_PKCS7_GetEnvelopedDataKariRid(void)
1832118323
{
1832218324
EXPECT_DECLS;
1832318325
#if defined(HAVE_PKCS7)
18324-
#if defined(HAVE_ECC) && (!defined(NO_AES) || (!defined(NO_SHA) || \
18325-
!defined(NO_SHA256) || defined(WOLFSSL_SHA512)))
18326+
#if defined(HAVE_ECC) && defined(HAVE_X963_KDF) && (!defined(NO_AES) || \
18327+
!defined(NO_SHA) || !defined(NO_SHA256) || defined(WOLFSSL_SHA512))
1832618328
/* The kari-keyid-cms.msg generated by openssl has a 68 byte RID structure.
1832718329
* Reserve a bit more than that in case it might grow. */
1832818330
byte rid[256];

‎wolfcrypt/src/pkcs7.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7372,16 +7372,16 @@ static int wc_PKCS7_KariGenerateKEK(WC_PKCS7_KARI* kari, WC_RNG* rng,
73727372
return BAD_FUNC_ARG;
73737373
};
73747374

7375+
#ifdef HAVE_X963_KDF
73757376
ret = wc_X963_KDF(kdfType, secret, secretSz, kari->sharedInfo,
73767377
kari->sharedInfoSz, kari->kek, kari->kekSz);
7377-
if (ret != 0) {
7378-
XFREE(secret, kari->heap, DYNAMIC_TYPE_PKCS7);
7379-
return ret;
7380-
}
7378+
#else
7379+
(void)kdfType;
7380+
ret = NOT_COMPILED_IN;
7381+
#endif
73817382

73827383
XFREE(secret, kari->heap, DYNAMIC_TYPE_PKCS7);
7383-
7384-
return 0;
7384+
return ret;
73857385
}
73867386

73877387

‎wolfcrypt/test/test.c‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52135,7 +52135,8 @@ static wc_test_ret_t pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
5213552135
};
5213652136

5213752137
#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256) && \
52138-
defined(HAVE_ECC) && defined(WOLFSSL_SHA512) && defined(HAVE_AES_KEYWRAP)
52138+
defined(HAVE_ECC) && defined(WOLFSSL_SHA512) && \
52139+
defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
5213952140
byte optionalUkm[] = {
5214052141
0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07
5214152142
};
@@ -52244,7 +52245,7 @@ static wc_test_ret_t pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
5224452245
#endif
5224552246

5224652247
/* key agreement key encryption technique*/
52247-
#if defined(HAVE_ECC) && defined(HAVE_AES_KEYWRAP)
52248+
#if defined(HAVE_ECC) && defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
5224852249
#if !defined(NO_AES) && defined(HAVE_AES_CBC)
5224952250
#if !defined(NO_SHA) && defined(WOLFSSL_AES_128)
5225052251
ADD_PKCS7ENVELOPEDVECTOR(
@@ -52755,7 +52756,8 @@ static wc_test_ret_t pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCer
5275552756
};
5275652757
byte senderNonce[PKCS7_NONCE_SZ + 2];
5275752758
#ifdef HAVE_ECC
52758-
#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(HAVE_AES_KEYWRAP)
52759+
#if !defined(NO_AES) && defined(HAVE_AESGCM) && \
52760+
defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
5275952761
#if !defined(NO_SHA256) && defined(WOLFSSL_AES_256)
5276052762
WOLFSSL_SMALL_STACK_STATIC const byte senderNonceOid[] =
5276152763
{ 0x06, 0x0a, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01,
@@ -52771,7 +52773,8 @@ static wc_test_ret_t pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCer
5277152773
#endif
5277252774

5277352775
#if !defined(NO_AES) && defined(WOLFSSL_AES_256) && defined(HAVE_ECC) && \
52774-
defined(WOLFSSL_SHA512) && defined(HAVE_AESGCM) && defined(HAVE_AES_KEYWRAP)
52776+
defined(WOLFSSL_SHA512) && defined(HAVE_AESGCM) && \
52777+
defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
5277552778
WOLFSSL_SMALL_STACK_STATIC const byte optionalUkm[] = {
5277652779
0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07
5277752780
};
@@ -52886,7 +52889,8 @@ static wc_test_ret_t pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCer
5288652889

5288752890
/* key agreement key encryption technique*/
5288852891
#ifdef HAVE_ECC
52889-
#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(HAVE_AES_KEYWRAP)
52892+
#if !defined(NO_AES) && defined(HAVE_AESGCM) && \
52893+
defined(HAVE_AES_KEYWRAP) && defined(HAVE_X963_KDF)
5289052894
#if !defined(NO_SHA) && defined(WOLFSSL_AES_128)
5289152895
ADD_PKCS7AUTHENVELOPEDVECTOR(
5289252896
data, (word32)sizeof(data), DATA, AES128GCMb, AES128_WRAP,

‎wolfssl/wolfcrypt/settings.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3416,9 +3416,6 @@ extern void uITRON4_free(void *p) ;
34163416
#if defined(NO_AES) && defined(NO_DES3)
34173417
#error PKCS7 needs either AES or 3DES enabled, please enable one
34183418
#endif
3419-
#if defined(HAVE_ECC) && !defined(HAVE_X963_KDF)
3420-
#error PKCS7 requires X963 KDF please define HAVE_X963_KDF
3421-
#endif
34223419
#endif
34233420

34243421
#ifndef NO_PKCS12

0 commit comments

Comments
 (0)