More peer review fixes

Author: dgarske

wrapper/CSharp/README.md

@@ -77,7 +77,9 @@ Run with system-wide install:
 mono wolfcrypttest.exe
 ```
 
-Run with local-only install (from the wolfSSL root directory):
+Run with local-only install. The compile step above produced
+`wolfcrypttest.exe` inside `wrapper/CSharp/`; this run command is invoked
+from the wolfSSL project root so the relative paths line up:
 
 ```
 LD_LIBRARY_PATH=./install/lib mono wrapper/CSharp/wolfcrypttest.exe

wrapper/CSharp/wolfCrypt-Test/wolfCrypt-Test.cs

@@ -1019,6 +1019,22 @@ private static void hpke_test(wolfcrypt.HpkeKem kem,
             }
             Console.WriteLine("Mismatched AAD test PASSED (correctly rejected).");
 
+            /* Null info/aad round-trip - exercises the null-marshaling path through P/Invoke */
+            Console.WriteLine("Testing HpkeSealBase/OpenBase with null info and aad...");
+            byte[] encNull = wolfcrypt.HpkeSealBase(hpke, receiverKey,
+                null, null, plaintext, kem);
+            if (encNull == null)
+            {
+                throw new Exception("HpkeSealBase with null info/aad failed");
+            }
+            byte[] decNull = wolfcrypt.HpkeOpenBase(hpke, receiverKey,
+                encNull, null, null, kem);
+            if (decNull == null || !wolfcrypt.ByteArrayVerify(plaintext, decNull))
+            {
+                throw new Exception("HpkeOpenBase with null info/aad: round-trip failed");
+            }
+            Console.WriteLine("Null info/aad round-trip test PASSED.");
+
             /* Negative test: invalid ptLen should fail */
             Console.WriteLine("Testing HpkeOpenBase with invalid ptLen...");
             badResult = wolfcrypt.HpkeOpenBase(hpke, receiverKey,

wrapper/CSharp/wolfSSL_CSharp/wolfCrypt.cs

@@ -20,6 +20,7 @@
  */
 
 using System;
+using System.Collections.Concurrent;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using System.Text;
@@ -361,6 +362,10 @@ public class wolfcrypt
         private extern static int wc_curve25519_make_key(IntPtr rng, int keysize, IntPtr key);
         [DllImport(wolfssl_dll)]
         private extern static int wc_curve25519_shared_secret(IntPtr privateKey, IntPtr publicKey, byte[] outSharedSecret, ref int outlen);
+        /* Only available when wolfSSL is built with WOLFSSL_CURVE25519_BLINDING.
+         * Calls are wrapped in try/catch to tolerate builds without it. */
+        [DllImport(wolfssl_dll)]
+        private extern static int wc_curve25519_set_rng(IntPtr key, IntPtr rng);
 
         /* ASN.1 DER format */
         [DllImport(wolfssl_dll)]
@@ -400,6 +405,10 @@ public class wolfcrypt
         private extern static int wc_curve25519_make_key(IntPtr rng, int keysize, IntPtr key);
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
         private extern static int wc_curve25519_shared_secret(IntPtr privateKey, IntPtr publicKey, byte[] outSharedSecret, ref int outlen);
+        /* Only available when wolfSSL is built with WOLFSSL_CURVE25519_BLINDING.
+         * Calls are wrapped in try/catch to tolerate builds without it. */
+        [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
+        private extern static int wc_curve25519_set_rng(IntPtr key, IntPtr rng);
 
         /* ASN.1 DER format */
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
@@ -3257,13 +3266,31 @@ public enum HpkeAead : ushort {
         }
 
         /* HPKE Nt (GCM tag length) */
-        private static readonly int HPKE_Nt = 16;
+        private const int HPKE_Nt = 16;
+
+        /* HPKE max encoded public-key length (matches HPKE_Npk_MAX in hpke.h) */
+        private const int HPKE_Npk_MAX = 133;
 
         /* Hpke struct is ~80 bytes on 64-bit (see hpke.h). Allocate 512 bytes
          * (6x headroom) to accommodate platform alignment and future growth.
          * If the native struct ever exceeds this, wc_HpkeInit will write OOB —
          * keep in sync with hpke.h if the struct grows significantly. */
-        private static readonly int HPKE_STRUCT_SZ = 512;
+        private const int HPKE_STRUCT_SZ = 512;
+
+        /* Per-Hpke-context state owned by the C# wrapper.
+         * The RNG must outlive any keypair created with this context: when
+         * wolfSSL is built with WOLFSSL_CURVE25519_BLINDING, wc_curve25519_make_key
+         * stores the rng pointer inside the keypair (via wc_curve25519_set_rng)
+         * and re-uses it for blinding during shared-secret operations. If the
+         * wrapper freed the rng after key generation, that pointer would dangle
+         * and the next seal/open would fail with RNG_FAILURE_E (-199). */
+        private struct HpkeContextState
+        {
+            public IntPtr rng;
+            public HpkeKem kem;
+        }
+        private static readonly ConcurrentDictionary<IntPtr, HpkeContextState> hpkeContexts =
+            new ConcurrentDictionary<IntPtr, HpkeContextState>();
 
         /// <summary>
         /// Get the enc (encapsulated key) length for a given KEM
@@ -3272,13 +3299,15 @@ public enum HpkeAead : ushort {
         /// <returns>Length in bytes</returns>
         private static ushort HpkeEncLen(HpkeKem kem)
         {
+            /* Values must match DHKEM_*_ENC_LEN macros in wolfssl/wolfcrypt/hpke.h.
+             * Not P/Invoked because wc_HpkeKemGetEncLen is currently WOLFSSL_LOCAL. */
             switch (kem)
             {
-                case HpkeKem.DHKEM_P256_HKDF_SHA256:  return 65;
-                case HpkeKem.DHKEM_P384_HKDF_SHA384:  return 97;
-                case HpkeKem.DHKEM_P521_HKDF_SHA512:  return 133;
-                case HpkeKem.DHKEM_X25519_HKDF_SHA256: return 32;
-                case HpkeKem.DHKEM_X448_HKDF_SHA512:  return 56;
+                case HpkeKem.DHKEM_P256_HKDF_SHA256:   return 65;  /* DHKEM_P256_ENC_LEN */
+                case HpkeKem.DHKEM_P384_HKDF_SHA384:   return 97;  /* DHKEM_P384_ENC_LEN */
+                case HpkeKem.DHKEM_P521_HKDF_SHA512:   return 133; /* DHKEM_P521_ENC_LEN */
+                case HpkeKem.DHKEM_X25519_HKDF_SHA256: return 32;  /* DHKEM_X25519_ENC_LEN */
+                case HpkeKem.DHKEM_X448_HKDF_SHA512:   return 56;  /* DHKEM_X448_ENC_LEN */
                 default: return 0;
             }
         }
@@ -3293,6 +3322,7 @@ private static ushort HpkeEncLen(HpkeKem kem)
         public static IntPtr HpkeInit(HpkeKem kem, HpkeKdf kdf, HpkeAead aead)
         {
             IntPtr hpke = IntPtr.Zero;
+            IntPtr rng = IntPtr.Zero;
 
             try
             {
@@ -3313,10 +3343,27 @@ public static IntPtr HpkeInit(HpkeKem kem, HpkeKdf kdf, HpkeAead aead)
                     Marshal.FreeHGlobal(hpke);
                     return IntPtr.Zero;
                 }
+
+                /* Allocate a persistent RNG that lives as long as this context.
+                 * Required so curve25519 keypairs (with blinding) retain a valid
+                 * rng pointer for shared-secret operations. */
+                rng = RandomNew();
+                if (rng == IntPtr.Zero)
+                {
+                    log(ERROR_LOG, "HPKE init: RNG allocation failed");
+                    Marshal.FreeHGlobal(hpke);
+                    return IntPtr.Zero;
+                }
+
+                hpkeContexts[hpke] = new HpkeContextState { rng = rng, kem = kem };
             }
             catch (Exception e)
             {
                 log(ERROR_LOG, "HPKE init exception " + e.ToString());
+                if (rng != IntPtr.Zero)
+                {
+                    RandomFree(rng);
+                }
                 if (hpke != IntPtr.Zero)
                 {
                     Marshal.FreeHGlobal(hpke);
@@ -3335,7 +3382,6 @@ public static IntPtr HpkeInit(HpkeKem kem, HpkeKdf kdf, HpkeAead aead)
         public static IntPtr HpkeGenerateKeyPair(IntPtr hpke)
         {
             IntPtr keypair = IntPtr.Zero;
-            IntPtr rng = IntPtr.Zero;
 
             try
             {
@@ -3345,29 +3391,43 @@ public static IntPtr HpkeGenerateKeyPair(IntPtr hpke)
                     return IntPtr.Zero;
                 }
 
-                rng = RandomNew();
-                if (rng == IntPtr.Zero)
+                HpkeContextState state;
+                if (!hpkeContexts.TryGetValue(hpke, out state) || state.rng == IntPtr.Zero)
                 {
-                    log(ERROR_LOG, "HPKE generate keypair: RNG init failed");
+                    log(ERROR_LOG, "HPKE generate keypair: no RNG associated with context");
                     return IntPtr.Zero;
                 }
 
-                int ret = wc_HpkeGenerateKeyPair(hpke, ref keypair, rng);
+                int ret = wc_HpkeGenerateKeyPair(hpke, ref keypair, state.rng);
                 if (ret != 0)
                 {
                     log(ERROR_LOG, "HPKE generate keypair failed " + ret + ": " + GetError(ret));
-                    keypair = IntPtr.Zero;
+                    return IntPtr.Zero;
+                }
+
+                /* For X25519, explicitly bind the persistent rng to the keypair.
+                 * wc_curve25519_make_key already does this internally when wolfSSL
+                 * is built with WOLFSSL_CURVE25519_BLINDING, but the explicit call
+                 * here documents the lifetime requirement and is defensive against
+                 * future changes. The function only exists when blinding is built
+                 * in, so swallow EntryPointNotFoundException for builds without it. */
+                if (state.kem == HpkeKem.DHKEM_X25519_HKDF_SHA256 && keypair != IntPtr.Zero)
+                {
+                    try
+                    {
+                        wc_curve25519_set_rng(keypair, state.rng);
+                    }
+                    catch (EntryPointNotFoundException)
+                    {
+                        /* wolfSSL built without WOLFSSL_CURVE25519_BLINDING; nothing to do */
+                    }
                 }
             }
             catch (Exception e)
             {
                 log(ERROR_LOG, "HPKE generate keypair exception " + e.ToString());
                 keypair = IntPtr.Zero;
             }
-            finally
-            {
-                if (rng != IntPtr.Zero) RandomFree(rng);
-            }
 
             return keypair;
         }
@@ -3388,7 +3448,7 @@ public static byte[] HpkeSerializePublicKey(IntPtr hpke, IntPtr keypair)
                     return null;
                 }
 
-                ushort outSz = 133; /* HPKE_Npk_MAX */
+                ushort outSz = (ushort)HPKE_Npk_MAX;
                 byte[] outBuf = new byte[outSz];
 
                 int ret = wc_HpkeSerializePublicKey(hpke, keypair, outBuf, ref outSz);
@@ -3466,6 +3526,11 @@ public static void HpkeFree(IntPtr hpke)
         {
             if (hpke != IntPtr.Zero)
             {
+                HpkeContextState state;
+                if (hpkeContexts.TryRemove(hpke, out state) && state.rng != IntPtr.Zero)
+                {
+                    RandomFree(state.rng);
+                }
                 Marshal.FreeHGlobal(hpke);
             }
         }