Time-Stamp Protocol (RFC 3161) by SparkiDev · Pull Request #10778 · wolfSSL/wolfssl

SparkiDev · 2026-06-25T12:17:36Z

Description

Implementation in wolfCrypt
OpenSSL compatibility layer in wolfSSL
Added tests, certificates, examples.

Testing

Different configuration with --enable-tsp.

github-actions · 2026-06-25T12:31:56Z

MemBrowse Memory Report

gcc-arm-cortex-m0plus

FLASH: .text +40 B (+0.1%, 64,131 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

FLASH: .text +28 B (+0.0%, 122,137 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +64 B (+0.1%, 199,882 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

FLASH: .text +64 B (+0.1%, 66,763 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-crypto-only

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +64 B (+0.1%, 174,440 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .rodata +56 B, .text +64 B (+0.0%, 769,020 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +64 B (+0.1%, 212,203 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

FLASH: .rodata +68 B (+0.0%, 278,708 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

FLASH: .rodata +64 B (+0.0%, 324,240 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B (+0.0%, 235,452 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B (+0.0%, 199,818 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

FLASH: .rodata +68 B (+0.0%, 279,284 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +64 B (+0.1%, 235,516 B / 262,144 B, total: 90% used)

linuxkm-standard

Data: __patchable_function_entries +8 B (+0.0%, 47,864 B)

stm32-sim-stm32h753

FLASH: .text +256 B (+0.1%, 183,396 B / 2,097,152 B, total: 9% used)
No memory changes detected for:
gcc-arm-cortex-m4-dtls13
gcc-arm-cortex-m4-min-ecc
gcc-arm-cortex-m4-sp-math
gcc-arm-cortex-m4-tls12
linuxkm-pie

SparkiDev · 2026-06-26T01:31:59Z

Jenkins: retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10778

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Low (1)

asn_orig.c DecodeExtKeyUsage skips counting unrecognized OIDs

File: wolfcrypt/src/asn_orig.c:3959
Function: DecodeExtKeyUsage
Category: Copy-paste errors

The original-parser DecodeExtKeyUsage does continue on ASN_UNKNOWN_OID_E, bypassing the extExtKeyUsageOidCnt increment, so unknown KeyPurposeIds are not counted — contradicting its own comment and diverging from the template version in asn.c which does count them. A cert with timeStamping plus an extra unknown EKU would report count 1 and wrongly pass Tsp_CheckSignerCert's extExtKeyUsageOidCnt != 1 gate.

Recommendation: Count the OID before continue (or increment in the unknown-OID branch) so the original parser matches the template version's count semantics.

Referenced code: wolfcrypt/src/asn_orig.c:3959-3965 (7 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

SparkiDev · 2026-06-26T07:22:13Z

DecodeExtKeyUsage fixed

SparkiDev · 2026-06-26T10:33:25Z

Jenkins: retest this please

Visual Studio Build: CRL script
generic aborted

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10778

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

dgarske

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Low] [review-security] wolfssl_asn1_integer_new_buf() builds a negative-looking DER INTEGER when the value's MSB is set — src/ssl_asn1.c:1186-1206
[Low] [review] Possible shift-by-32 (undefined behavior) when decoding an empty PKIFailureInfo BIT STRING — wolfcrypt/src/asn_tsp.c:wc_TspResponse_Decode
[Low] [review] ssl_tsp.c depends on ssl_asn1.c but the latter is conditionally excluded by OPENSSL_EXTRA_NO_ASN1 — src/ssl.c:453-459
[Low] [review+review-security] Large 2048-byte on-stack request buffer in new responder path does not use WOLFSSL_SMALL_STACK pattern — src/ssl_tsp.c:2243

Review generated by Skoll

SparkiDev · 2026-06-30T03:47:12Z

Jenkins: retest this please

dgarske

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: COMMENT
Findings: 3 total — 2 posted, 1 skipped
2 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Low] [review] TS_REQ_to_TS_VERIFY_CTX leaves imprintSz set when imprint allocation fails on a reused ctx — src/ssl_tsp.c:1645-1653
[Low] [review] Stale 'not supported' comment for TS_VFY_DATA contradicts the implemented behavior — src/ssl_tsp.c:1751-1807

Skipped findings

[Low] ~~TSA responder private key DER freed without zeroization~~

Review generated by Skoll

SparkiDev · 2026-07-01T00:52:13Z

Jenkins: retest this please

FIPS fails
fips-ready fail x2

Frauschi

Some smaller issues only

Frauschi

LGTM!

SparkiDev · 2026-07-02T07:48:09Z

Jenkins: retest this please

Tiny TLS1.3 Tests

Frauschi · 2026-07-02T08:11:27Z

the tiny-tls failures are unrelated and will be fixed by #10835

SparkiDev · 2026-07-02T10:28:40Z

I rebased and it went crazy.

Frauschi · 2026-07-02T12:15:31Z

Jenkins retest this please.

dgarske

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: COMMENT
Findings: 5 total — 4 posted, 1 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Low] [review] TS_REQ_set_policy_id accepts empty OID and reports success (inconsistent with set_def_policy) — src/ssl_tsp.c:~830-865
[Info] [review-security] wc_TspResponse_Verify with NULL cert and no CM establishes no trust — wolfcrypt/src/tsp.c:2162
[Info] [review] TSP_RESP_REQ_DER_SZ macro defined between the doxygen comment and the function signature — src/ssl_tsp.c:2238-2254
[Info] [review] wolfssl_asn1_integer_new_buf relies solely on len0 guard, no defensive val NULL check — src/ssl_asn1.c:1187-1216

Skipped findings

[Low] ~~TSA private key DER not zeroized before free in responder context~~

Review generated by Skoll

dgarske

#10778 (review)

Implementation in wolfCrypt OpenSSL compatibility layer in wolfSSL Added tests, certificates, examples.

SparkiDev self-assigned this Jun 25, 2026

SparkiDev force-pushed the time_stamp_protocol branch from 76af38a to dc97de1 Compare June 25, 2026 12:23

SparkiDev force-pushed the time_stamp_protocol branch 3 times, most recently from 2a0657a to 0d3affa Compare June 25, 2026 21:51

SparkiDev requested a review from wolfSSL-Fenrir-bot June 26, 2026 06:18

wolfSSL-Fenrir-bot reviewed Jun 26, 2026

View reviewed changes

Comment thread wolfcrypt/src/tsp.c

SparkiDev force-pushed the time_stamp_protocol branch from 0d3affa to 0b151dc Compare June 26, 2026 07:21

SparkiDev commented Jun 26, 2026

View reviewed changes

Comment thread wolfcrypt/src/tsp.c

SparkiDev requested a review from wolfSSL-Bot June 26, 2026 12:10

SparkiDev assigned wolfSSL-Bot and unassigned SparkiDev Jun 26, 2026

SparkiDev requested a review from wolfSSL-Fenrir-bot June 26, 2026 12:10

wolfSSL-Fenrir-bot reviewed Jun 26, 2026

View reviewed changes

dgarske self-requested a review June 29, 2026 18:43

dgarske reviewed Jun 29, 2026

View reviewed changes

Comment thread src/ssl_asn1.c

Comment thread wolfcrypt/src/asn_tsp.c

Comment thread src/ssl.c

Comment thread src/ssl_tsp.c Outdated

dgarske requested changes Jun 29, 2026

View reviewed changes

Comment thread src/ssl_tsp.c

dgarske assigned SparkiDev Jun 29, 2026

dgarske removed the request for review from wolfSSL-Bot June 29, 2026 21:01

SparkiDev force-pushed the time_stamp_protocol branch 2 times, most recently from 151e6c8 to 6cec72d Compare June 30, 2026 00:57

SparkiDev assigned dgarske and unassigned SparkiDev Jun 30, 2026

dgarske self-requested a review June 30, 2026 22:23

dgarske reviewed Jun 30, 2026

View reviewed changes

Comment thread src/ssl_tsp.c

Comment thread src/ssl_tsp.c

dgarske removed their assignment Jun 30, 2026

dgarske requested a review from Frauschi June 30, 2026 22:57

Frauschi requested changes Jul 1, 2026

View reviewed changes

Comment thread gencertbuf.pl Outdated

Comment thread src/ssl_tsp.c

Comment thread tests/api/test_ossl_tsp.c

SparkiDev force-pushed the time_stamp_protocol branch from f9fd6dc to 2e8168b Compare July 1, 2026 23:13

SparkiDev assigned Frauschi and unassigned SparkiDev Jul 1, 2026

SparkiDev force-pushed the time_stamp_protocol branch from 2e8168b to c90d41e Compare July 2, 2026 01:53

Frauschi previously approved these changes Jul 2, 2026

View reviewed changes

SparkiDev force-pushed the time_stamp_protocol branch from c90d41e to 9b5df72 Compare July 2, 2026 10:26

SparkiDev dismissed Frauschi’s stale review via 3b0b84b July 2, 2026 10:45

SparkiDev force-pushed the time_stamp_protocol branch from 9b5df72 to 3b0b84b Compare July 2, 2026 10:45

SparkiDev assigned dgarske and unassigned Frauschi Jul 2, 2026

Frauschi previously approved these changes Jul 2, 2026

View reviewed changes

dgarske self-requested a review July 2, 2026 18:02

dgarske reviewed Jul 2, 2026

View reviewed changes

Comment thread src/ssl_tsp.c

Comment thread wolfcrypt/src/tsp.c

Comment thread src/ssl_tsp.c

Comment thread src/ssl_asn1.c

dgarske requested changes Jul 2, 2026

View reviewed changes

dgarske assigned SparkiDev and unassigned dgarske Jul 2, 2026

SparkiDev dismissed Frauschi’s stale review via f4971f4 July 2, 2026 23:31

SparkiDev force-pushed the time_stamp_protocol branch from 3b0b84b to f4971f4 Compare July 2, 2026 23:31

Time-Stamp Protocol (RFC 3161)

4889089

Implementation in wolfCrypt OpenSSL compatibility layer in wolfSSL Added tests, certificates, examples.

SparkiDev force-pushed the time_stamp_protocol branch from f4971f4 to 4889089 Compare July 3, 2026 01:01

SparkiDev assigned dgarske and unassigned SparkiDev Jul 3, 2026

Uh oh!

Conversation

SparkiDev commented Jun 25, 2026

Description

Testing

Uh oh!

github-actions Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

SparkiDev commented Jun 26, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10778

Low (1)

asn_orig.c DecodeExtKeyUsage skips counting unrecognized OIDs

Uh oh!

Uh oh!

Uh oh!

SparkiDev commented Jun 26, 2026

Uh oh!

SparkiDev commented Jun 26, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10778

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Multi-Scan Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SparkiDev commented Jun 30, 2026

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Multi-Scan Review

Posted findings

Skipped findings

Uh oh!

Uh oh!

Uh oh!

SparkiDev commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

Uh oh!

SparkiDev commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Frauschi commented Jul 2, 2026

Uh oh!

SparkiDev commented Jul 2, 2026

Uh oh!

Frauschi commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Multi-Scan Review

Posted findings

Skipped findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 25, 2026 •

edited

Loading

SparkiDev commented Jul 1, 2026 •

edited

Loading

SparkiDev commented Jul 2, 2026 •

edited

Loading

Frauschi commented Jul 2, 2026 •

edited

Loading