Skip to content

Commit 588e7a0

Browse files
committed
Phase 3: Security and FIPS Compliance Audit
1 parent 8fca95c commit 588e7a0

20 files changed

Lines changed: 1201 additions & 108 deletions

configure.ac

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6313,13 +6313,7 @@ AS_CASE([$FIPS_VERSION],
63136313
-DWC_RSA_NO_PADDING \
63146314
-DECC_USER_CURVES \
63156315
-DHAVE_ECC384 \
6316-
-DHAVE_ECC521 \
6317-
-DWOLFSSL_VALIDATE_FFC_IMPORT \
6318-
-DHAVE_FFDHE_Q \
6319-
-DHAVE_FFDHE_3072 \
6320-
-DHAVE_FFDHE_4096 \
6321-
-DHAVE_FFDHE_6144 \
6322-
-DHAVE_FFDHE_8192"
6316+
-DHAVE_ECC521"
63236317
63246318
# KCAPI API does not support custom k for sign, don't force enable ECC key sizes and don't use seed callback
63256319
AS_IF([test "x$ENABLED_KCAPI_ECC" = "xno"],
@@ -6333,6 +6327,20 @@ AS_CASE([$FIPS_VERSION],
63336327
-DHAVE_ECC256"])
63346328
63356329
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=8192
6330+
6331+
# Classic DH and DSA are OUT OF SCOPE for the FIPS 140-3 v7 PQ module.
6332+
# (FIPS 186-5 retires DSA; v7 boundary keeps only ECDH/ECDSA + PQ KEM/DSA.)
6333+
# Hard-error if explicitly enabled; otherwise force off and add NO_DH/NO_DSA.
6334+
AS_IF([test "$enable_dh" = "yes"],
6335+
[AC_MSG_ERROR([--enable-dh is not supported with --enable-fips=$FIPS_VERSION. Classic finite-field DH is out of scope for the FIPS 140-3 v7 PQ module. Use --enable-fips=v6 if you need DH support.])],
6336+
[test "$ENABLED_DH" != "no"],
6337+
[ENABLED_DH="no"; enable_dh="no"; AM_CFLAGS="$AM_CFLAGS -DNO_DH"])
6338+
6339+
AS_IF([test "$enable_dsa" = "yes"],
6340+
[AC_MSG_ERROR([--enable-dsa is not supported with --enable-fips=$FIPS_VERSION. DSA is retired by FIPS 186-5 and is out of scope for the FIPS 140-3 v7 PQ module. Use --enable-fips=v6 if you need DSA support.])],
6341+
[test "$ENABLED_DSA" != "no"],
6342+
[ENABLED_DSA="no"; enable_dsa="no"; AM_CFLAGS="$AM_CFLAGS -DNO_DSA"])
6343+
63366344
# optimizations section
63376345
63386346
# protocol section
@@ -8887,8 +8895,17 @@ then
88878895
fi
88888896
if test "x$ENABLED_DH" = "xno"
88898897
then
8890-
ENABLED_DH="yes"
8891-
AM_CFLAGS="$AM_CFLAGS -DHAVE_DH"
8898+
# Classic DH is out of scope for the FIPS 140-3 v7 PQ module.
8899+
# JNI normally auto-enables DH for legacy TLS suites; with FIPS v7+
8900+
# we report and skip the auto-enable rather than silently turning DH
8901+
# back on (which would conflict with the boundary).
8902+
if test "$FIPS_VERSION" = "v7" || test "$FIPS_VERSION" = "ready" || test "$FIPS_VERSION" = "dev"
8903+
then
8904+
AC_MSG_NOTICE([JNI enabled but FIPS is $FIPS_VERSION, NOT turning on DH with this module])
8905+
else
8906+
ENABLED_DH="yes"
8907+
AM_CFLAGS="$AM_CFLAGS -DHAVE_DH"
8908+
fi
88928909
fi
88938910
if test "x$ENABLED_PSK" = "xno"
88948911
then

fips-hash.sh

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,11 @@ then
1313
fi
1414

1515
OUT=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p')
16-
NEWHASH=$(echo "$OUT" | cut -c1-64)
16+
# FIPS v7.0.0+ uses HMAC-SHA-512 (128 hex chars); older FIPS versions
17+
# use HMAC-SHA-256 (64 hex chars). Take the whole captured hash; the
18+
# static_assert on sizeof(verifyCore) guards against wrong length at
19+
# compile time after this script runs.
20+
NEWHASH=$(echo "$OUT" | head -n1 | tr -d '[:space:]')
1721
if test -n "$NEWHASH"
1822
then
1923
cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak

tests/api/test_aes.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -693,7 +693,14 @@ static int test_wc_AesCbcEncryptDecrypt_WithKey(Aes* aes, byte* key,
693693
ExpectIntEQ(wc_AesCbcEncrypt(aes, cipher, vector, vector_len),
694694
0);
695695
ExpectBufEQ(cipher, vector_enc, vector_len);
696-
#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
696+
/* The BAD_LENGTH_E enforcement is in the non-FIPS aes.c implementation
697+
* (see WOLFSSL_AES_CBC_LENGTH_CHECKS guard there). FIPSv2 (cert3389)
698+
* routes through its own historical wc_AesCbcEncrypt_fips wrapper that
699+
* predates this check and silently returns 0 on unaligned input. Only
700+
* v5.x and newer FIPS modules carry the wrapper-level check. Skip the
701+
* assertion for FIPSv2 builds. */
702+
#if defined(WOLFSSL_AES_CBC_LENGTH_CHECKS) && \
703+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,0))
697704
ExpectIntEQ(wc_AesCbcEncrypt(aes, cipher, vector, vector_len - 1),
698705
WC_NO_ERR_TRACE(BAD_LENGTH_E));
699706
#endif
@@ -703,7 +710,9 @@ static int test_wc_AesCbcEncryptDecrypt_WithKey(Aes* aes, byte* key,
703710
ExpectIntEQ(wc_AesCbcDecrypt(aes, decrypted, cipher,
704711
WC_AES_BLOCK_SIZE * 2), 0);
705712
ExpectBufEQ(decrypted, vector, vector_len);
706-
#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
713+
#if defined(WOLFSSL_AES_CBC_LENGTH_CHECKS) && \
714+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,0))
715+
/* Same FIPSv2 vs v5+ rationale as the encrypt assertion above. */
707716
ExpectIntEQ(wc_AesCbcDecrypt(aes, decrypted, cipher,
708717
WC_AES_BLOCK_SIZE * 2 - 1), WC_NO_ERR_TRACE(BAD_LENGTH_E));
709718
#else

tests/api/test_evp_pkey.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1526,7 +1526,7 @@ static int test_wolfSSL_EVP_PKEY_sign_verify(int keyType)
15261526
!defined(HAVE_SELFTEST)
15271527
#if !defined(HAVE_FIPS) || (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION>2))
15281528
{
1529-
ExpectNotNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
1529+
ExpectNotNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
15301530
ExpectIntEQ(EVP_PKEY_assign_RSA(pkey, rsa), WOLFSSL_SUCCESS);
15311531
}
15321532
#endif
@@ -2159,7 +2159,7 @@ int test_wolfSSL_EVP_PKEY_encrypt(void)
21592159
XMEMSET(outDec, 0, rsaKeySz);
21602160
}
21612161

2162-
ExpectNotNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
2162+
ExpectNotNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
21632163
ExpectNotNull(pkey = wolfSSL_EVP_PKEY_new());
21642164
ExpectIntEQ(EVP_PKEY_assign_RSA(pkey, rsa), WOLFSSL_SUCCESS);
21652165
if (EXPECT_FAIL()) {

tests/api/test_ossl_rsa.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ int test_wolfSSL_RSA(void)
6565

6666
RSA_free(rsa);
6767
rsa = NULL;
68-
ExpectNotNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
68+
ExpectNotNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
6969
ExpectIntEQ(RSA_size(rsa), 256);
7070

7171
#if (!defined(HAVE_FIPS) || FIPS_VERSION3_GT(6,0,0)) && !defined(HAVE_SELFTEST)
@@ -306,7 +306,7 @@ int test_wolfSSL_RSA(void)
306306
rsa = NULL;
307307

308308
#if !defined(USE_FAST_MATH) || (FP_MAX_BITS >= (3072*2))
309-
ExpectNotNull(rsa = RSA_generate_key(3072, 17, NULL, NULL));
309+
ExpectNotNull(rsa = RSA_generate_key(3072, 65537, NULL, NULL));
310310
ExpectIntEQ(RSA_size(rsa), 384);
311311
ExpectIntEQ(RSA_bits(rsa), 3072);
312312
RSA_free(rsa);
@@ -461,7 +461,7 @@ int test_wolfSSL_RSA_print(void)
461461

462462
RSA_free(rsa);
463463
rsa = NULL;
464-
ExpectNotNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
464+
ExpectNotNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
465465

466466
ExpectIntEQ(RSA_print(bio, rsa, 0), 1);
467467
ExpectIntEQ(RSA_print(bio, rsa, 4), 1);
@@ -626,11 +626,11 @@ int test_wolfSSL_RSA_meth(void)
626626
RSA_METHOD *rsa_meth = NULL;
627627

628628
#ifdef WOLFSSL_KEY_GEN
629-
ExpectNotNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
629+
ExpectNotNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
630630
RSA_free(rsa);
631631
rsa = NULL;
632632
#else
633-
ExpectNull(rsa = RSA_generate_key(2048, 3, NULL, NULL));
633+
ExpectNull(rsa = RSA_generate_key(2048, 65537, NULL, NULL));
634634
#endif
635635

636636
ExpectNotNull(RSA_get_default_method());

tests/api/test_slhdsa.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1081,12 +1081,14 @@ int test_wc_slhdsa_sign_hash(void)
10811081
WC_HASH_TYPE_SHA256, sig, sigLen),
10821082
WC_NO_ERR_TRACE(BAD_LENGTH_E));
10831083

1084-
/* Unsupported hashType (FIPS 205 doesn't list WC_HASH_TYPE_NONE) hits
1085-
* the default branch of slhdsakey_validate_prehash. */
1084+
/* WC_HASH_TYPE_NONE is the "pure SLH-DSA" sentinel and is never a valid
1085+
* pre-hash algorithm (FIPS 205 Section 10.2.2 / Table 9). HashSLH-DSA
1086+
* signing rejects it with an explicit early check (BAD_FUNC_ARG), not via
1087+
* the slhdsa_check_hash_for_n() switch default. */
10861088
sigLen = WC_SLHDSA_MAX_SIG_LEN;
10871089
ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
10881090
WC_HASH_TYPE_NONE, sig, &sigLen, &rng),
1089-
WC_NO_ERR_TRACE(NOT_COMPILED_IN));
1091+
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
10901092

10911093
/* Test SignHash with SHA-256. */
10921094
sigLen = WC_SLHDSA_MAX_SIG_LEN;

0 commit comments

Comments
 (0)