Fix alert type for missing cert. Prevent building with RNG disabled and blinding enabled by default. Enforce bounds for AES CMAC size in verify.#10462

Merged

dgarske merged 7 commits into

wolfSSL:masterfrom

kareem-wolfssl:zd21507

May 18, 2026

Commits on May 14, 2026

Send correct alert type when server requests certificate and client has none set.
kareem-wolfssl
committed
Prevent building with RNG disabled and RSA blinding enabled by default.
kareem-wolfssl
committed
Extend check to cover ECC and Curve25519 blinding + no RNG as well.
kareem-wolfssl
committed
Require that the AES CMAC mac size is inside of the range [WC_CMAC_TAG_MIN_SZ, WC_AES_BLOCK_SIZE].
kareem-wolfssl
committed
Code review feedback. Don't error out if WOLFSSL_RSA_PUBLIC_ONLY or WOLFSSL_RSA_VERIFY_ONLY are defined as they don't use blinding.
kareem-wolfssl
committed
Update new AES-CMAC bounds test to account for FIPS still using the old code.
kareem-wolfssl
committed
Gate out all of the newly added AES-CMAC tests for FIPS as none of them will apply to the old FIPS AES-CMAC code.
kareem-wolfssl
committed