From 017f931f8bcf998d087827a4796b0a84316574b2 Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 6 Dec 2024 16:45:33 -0800 Subject: [PATCH 1/3] Various cleanups and fixes: * Fix to properly set configure.ac LMS/XMSS enables and build of those code files. * Remove duplicate aes.c `wc_AesSetKeyLocal` call to `wc_AesSetIV`. Moved earlier in function in commit a10260ca5f. * Benchmark missing time.h with NO_ASN_TIME. * Added option to support disabling AES CFB 1/8 `WOLFSSL_NO_AES_CFB_1_8`. * Fixes for building with combinations of `WOLFSSL_RSA_VERIFY_ONLY` and `WOLFSSL_RSA_PUBLIC_ONLY`. * Fix for building `--enable-stacksize=verbose` with single threaded. * Various tab and formatting cleanups. ZD 18996 --- IDE/GCC-ARM/Source/benchmark_main.c | 12 +++--- IDE/GCC-ARM/Source/test_main.c | 12 +++--- configure.ac | 4 +- wolfcrypt/benchmark/benchmark.c | 1 + wolfcrypt/src/aes.c | 8 ++-- wolfcrypt/src/rsa.c | 3 +- wolfcrypt/test/test.c | 61 ++++++++++++++++++----------- wolfssl/wolfcrypt/types.h | 2 +- 8 files changed, 62 insertions(+), 41 deletions(-) diff --git a/IDE/GCC-ARM/Source/benchmark_main.c b/IDE/GCC-ARM/Source/benchmark_main.c index 1151bbc32c..44acc6967a 100644 --- a/IDE/GCC-ARM/Source/benchmark_main.c +++ b/IDE/GCC-ARM/Source/benchmark_main.c @@ -39,16 +39,16 @@ int main(void) { int ret; #ifndef NO_CRYPT_BENCHMARK - wolfCrypt_Init(); + wolfCrypt_Init(); - printf("\nBenchmark Test\n"); - benchmark_test(&args); + printf("\nBenchmark Test\n"); + benchmark_test(&args); ret = args.return_code; - printf("Benchmark Test: Return code %d\n", ret); + printf("Benchmark Test: Return code %d\n", ret); - wolfCrypt_Cleanup(); + wolfCrypt_Cleanup(); #else ret = NOT_COMPILED_IN; #endif - return ret; + return ret; } diff --git a/IDE/GCC-ARM/Source/test_main.c b/IDE/GCC-ARM/Source/test_main.c index c63246368b..2e6236d89a 100644 --- a/IDE/GCC-ARM/Source/test_main.c +++ b/IDE/GCC-ARM/Source/test_main.c @@ -40,16 +40,16 @@ int main(void) { int ret; #ifndef NO_CRYPT_TEST - wolfCrypt_Init(); + wolfCrypt_Init(); - printf("\nCrypt Test\n"); - wolfcrypt_test(&args); + printf("\nCrypt Test\n"); + wolfcrypt_test(&args); ret = args.return_code; - printf("Crypt Test: Return code %d\n", ret); + printf("Crypt Test: Return code %d\n", ret); - wolfCrypt_Cleanup(); + wolfCrypt_Cleanup(); #else ret = NOT_COMPILED_IN; #endif - return ret; + return ret; } diff --git a/configure.ac b/configure.ac index 218b1659b2..9e8b8715a7 100644 --- a/configure.ac +++ b/configure.ac @@ -1492,6 +1492,7 @@ then fi # XMSS +ENABLED_WC_XMSS=no AC_ARG_ENABLE([xmss], [AS_HELP_STRING([--enable-xmss],[Enable stateful XMSS/XMSS^MT signatures (default: disabled)])], [ ENABLED_XMSS=$enableval ], @@ -1583,6 +1584,7 @@ then fi # LMS +ENABLED_WC_LMS=no AC_ARG_ENABLE([lms], [AS_HELP_STRING([--enable-lms],[Enable stateful LMS/HSS signatures (default: disabled)])], [ ENABLED_LMS=$enableval ], @@ -4524,7 +4526,7 @@ fi if test "$ENABLED_STACKSIZE" = "verbose" then - if test "$thread_ls_on" != "yes" + if test "$thread_ls_on" != "yes" && test "x$ENABLED_SINGLETHREADED" = "xno" then AC_MSG_ERROR(stacksize-verbose needs thread-local storage.) fi diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 21b6ff9272..5551d648ff 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -14657,6 +14657,7 @@ void bench_sphincsKeySign(byte level, byte optim) #else + #include #include double current_time(int reset) diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index 7f5e758475..fa57d7685a 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -4662,8 +4662,6 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir) } #endif - ret = wc_AesSetIV(aes, iv); - #if defined(WOLFSSL_DEVCRYPTO) && \ (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC)) aes->ctx.cfd = -1; @@ -11909,7 +11907,8 @@ static WARN_UNUSED_RESULT int wc_AesFeedbackDecrypt( /* consume any unused bytes left in aes->tmp */ processed = min(aes->left, sz); - xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left, processed); + xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left, + processed); aes->left -= processed; out += processed; in += processed; @@ -12003,7 +12002,7 @@ int wc_AesCfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) } #endif /* HAVE_AES_DECRYPT */ - +#ifndef WOLFSSL_NO_AES_CFB_1_8 /* shift the whole WC_AES_BLOCK_SIZE array left by 8 or 1 bits */ static void shiftLeftArray(byte* ary, byte shift) { @@ -12221,6 +12220,7 @@ int wc_AesCfb8Decrypt(Aes* aes, byte* out, const byte* in, word32 sz) return wc_AesFeedbackCFB8(aes, out, in, sz, AES_DECRYPTION); } #endif /* HAVE_AES_DECRYPT */ +#endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #endif /* WOLFSSL_AES_CFB */ #ifdef WOLFSSL_AES_OFB diff --git a/wolfcrypt/src/rsa.c b/wolfcrypt/src/rsa.c index 4f8b31122f..a3c0292484 100644 --- a/wolfcrypt/src/rsa.c +++ b/wolfcrypt/src/rsa.c @@ -3110,7 +3110,8 @@ int cc310_RsaSSL_Verify(const byte* in, word32 inLen, byte* sig, #endif /* WOLFSSL_CRYPTOCELL */ #ifndef WOLF_CRYPTO_CB_ONLY_RSA -#if !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(TEST_UNPAD_CONSTANT_TIME) && !defined(NO_RSA_BOUNDS_CHECK) +#if !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(TEST_UNPAD_CONSTANT_TIME) && \ + !defined(NO_RSA_BOUNDS_CHECK) /* Check that 1 < in < n-1. (Requirement of 800-56B.) */ int RsaFunctionCheckIn(const byte* in, word32 inLen, RsaKey* key, int checkSmallCt) diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index b137df6b85..ccf8b76fc1 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -9926,7 +9926,9 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, return ret; } -#if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) +#if !defined(HAVE_SELFTEST) && \ + (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) && \ + !defined(WOLFSSL_NO_AES_CFB_1_8) static wc_test_ret_t aescfb1_test(void) { #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) @@ -10399,7 +10401,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, return ret; } -#endif /* !HAVE_SELFTEST && !HAVE_FIPS */ +#endif /* !HAVE_SELFTEST && !HAVE_FIPS && !WOLFSSL_NO_AES_CFB_1_8 */ #endif /* WOLFSSL_AES_CFB */ #ifndef HAVE_RENESAS_SYNC @@ -14269,7 +14271,9 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_cfb_test(void) ret = aescfb_test_0(); if (ret != 0) return ret; -#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) +#if !defined(HAVE_SELFTEST) && \ + (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) && \ + !defined(WOLFSSL_NO_AES_CFB_1_8) ret = aescfb1_test(); if (ret != 0) return ret; @@ -21853,8 +21857,8 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rsa_test(void) #endif #if !defined(WC_NO_RNG) && !defined(WC_NO_RSA_OAEP) && \ - ((!defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) || \ - defined(WOLFSSL_PUBLIC_MP)) && !defined(WOLF_CRYPTO_CB_ONLY_RSA) + !defined(WOLFSSL_RSA_VERIFY_ONLY) && defined(WOLFSSL_PUBLIC_MP) && \ + !defined(WOLF_CRYPTO_CB_ONLY_RSA) idx = (word32)ret; XMEMSET(plain, 0, plainSz); do { @@ -54595,17 +54599,20 @@ static wc_test_ret_t mp_test_shift(mp_int* a, mp_int* r1, WC_RNG* rng) return WC_TEST_RET_ENC_EC(ret); for (i = 0; i < 4; i++) { mp_copy(r1, a); +#if !defined(NO_DH) || defined(HAVE_ECC) || (!defined(NO_RSA) && \ + defined(WC_RSA_BLINDING) && !defined(WOLFSSL_RSA_VERIFY_ONLY)) ret = mp_lshd(r1, i); if (ret != MP_OKAY) return WC_TEST_RET_ENC_EC(ret); -#ifndef WOLFSSL_SP_MATH + #ifndef WOLFSSL_SP_MATH mp_rshd(r1, i); -#else + #else mp_rshb(r1, i * SP_WORD_SIZE); -#endif + #endif ret = mp_cmp(a, r1); if (ret != MP_EQ) return WC_TEST_RET_ENC_NC; +#endif } #ifndef WOLFSSL_SP_MATH for (i = 0; i < DIGIT_BIT+1; i++) { @@ -54970,7 +54977,7 @@ static wc_test_ret_t mp_test_param(mp_int* a, mp_int* b, mp_int* r, WC_RNG* rng) mp_zero(NULL); #if !defined(NO_DH) || defined(HAVE_ECC) || defined(WC_RSA_BLINDING) || \ - !defined(WOLFSSL_RSA_VERIFY_ONLY) + !defined(WOLFSSL_RSA_PUBLIC_ONLY) ret = mp_lshd(NULL, 0); if (ret != WC_NO_ERR_TRACE(MP_VAL)) return WC_TEST_RET_ENC_EC(ret); @@ -55299,7 +55306,8 @@ static wc_test_ret_t mp_test_param(mp_int* a, mp_int* b, mp_int* r, WC_RNG* rng) return WC_TEST_RET_ENC_EC(ret); #endif -#if (!defined(NO_RSA) && !defined(WOLFSSL_RSA_VERIFY_ONLY)) || \ +#if (!defined(NO_RSA) && !defined(WOLFSSL_RSA_VERIFY_ONLY) && \ + !defined(WOLFSSL_RSA_PUBLIC_ONLY)) || \ defined(HAVE_ECC) || !defined(NO_DSA) || defined(OPENSSL_EXTRA) ret = mp_invmod(NULL, NULL, NULL); if (ret != WC_NO_ERR_TRACE(MP_VAL)) @@ -56002,7 +56010,8 @@ static wc_test_ret_t mp_test_cmp(mp_int* a, mp_int* b) return 0; } -#if !defined(NO_DH) || defined(HAVE_ECC) || !defined(WOLFSSL_RSA_VERIFY_ONLY) +#if !defined(NO_DH) || defined(HAVE_ECC) || (!defined(NO_RSA) && \ + !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) static wc_test_ret_t mp_test_shbd(mp_int* a, mp_int* b, WC_RNG* rng) { wc_test_ret_t ret; @@ -56071,9 +56080,8 @@ static wc_test_ret_t mp_test_shbd(mp_int* a, mp_int* b, WC_RNG* rng) } #endif -#if defined(WOLFSSL_SP_MATH_ALL) || !defined(NO_DH) || defined(HAVE_ECC) || \ - (!defined(NO_RSA) && !defined(WOLFSSL_RSA_VERIFY_ONLY) && \ - !defined(WOLFSSL_RSA_PUBLIC_ONLY)) +#if !defined(NO_DH) || defined(HAVE_ECC) || \ + (!defined(NO_RSA) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) static wc_test_ret_t mp_test_div(mp_int* a, mp_int* d, mp_int* r, mp_int* rem, WC_RNG* rng) { @@ -56624,8 +56632,9 @@ static wc_test_ret_t mp_test_mul_sqr(mp_int* a, mp_int* b, mp_int* r1, mp_int* r return 0; } -#if !defined(NO_RSA) || defined(HAVE_ECC) || !defined(NO_DSA) || \ - defined(OPENSSL_EXTRA) +#if (!defined(NO_RSA) && \ + !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) || \ + defined(HAVE_ECC) || !defined(NO_DSA) || defined(OPENSSL_EXTRA) static wc_test_ret_t mp_test_invmod(mp_int* a, mp_int* m, mp_int* r) { wc_test_ret_t ret; @@ -57026,7 +57035,14 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mp_test(void) #endif WOLFSSL_ENTER("mp_test"); +#if !defined(WOLFSSL_RSA_PUBLIC_ONLY) || !defined(NO_DH) || defined(HAVE_ECC) ret = mp_init_multi(a, b, r1, r2, NULL, NULL); +#else + ret = mp_init(a); + ret |= mp_init(b); + ret |= mp_init(r1); + ret |= mp_init(r2); +#endif if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done); @@ -57234,7 +57250,8 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mp_test(void) #endif if ((ret = mp_test_cmp(a, r1)) != 0) goto done; -#if !defined(NO_DH) || defined(HAVE_ECC) || !defined(WOLFSSL_RSA_VERIFY_ONLY) +#if !defined(NO_DH) || defined(HAVE_ECC) || (!defined(NO_RSA) && \ + !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) if ((ret = mp_test_shbd(a, b, &rng)) != 0) goto done; #endif @@ -57242,9 +57259,8 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mp_test(void) if ((ret = mp_test_set_is_bit(a)) != 0) goto done; #endif -#if defined(WOLFSSL_SP_MATH_ALL) || !defined(NO_DH) || defined(HAVE_ECC) || \ - (!defined(NO_RSA) && !defined(WOLFSSL_RSA_VERIFY_ONLY) && \ - !defined(WOLFSSL_RSA_PUBLIC_ONLY)) +#if !defined(NO_DH) || defined(HAVE_ECC) || \ + (!defined(NO_RSA) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) if ((ret = mp_test_div(a, b, r1, r2, &rng)) != 0) goto done; #endif @@ -57269,8 +57285,9 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mp_test(void) #endif if ((ret = mp_test_mul_sqr(a, b, r1, r2, &rng)) != 0) goto done; -#if !defined(NO_RSA) || defined(HAVE_ECC) || !defined(NO_DSA) || \ - defined(OPENSSL_EXTRA) +#if (!defined(NO_RSA) && \ + !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)) || \ + defined(HAVE_ECC) || !defined(NO_DSA) || defined(OPENSSL_EXTRA) if ((ret = mp_test_invmod(a, b, r1)) != 0) goto done; #endif diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h index d2a9dc44fb..a8bf61bf70 100644 --- a/wolfssl/wolfcrypt/types.h +++ b/wolfssl/wolfcrypt/types.h @@ -1398,7 +1398,7 @@ typedef struct w64wrapper { #endif #ifdef SINGLE_THREADED - #if defined(WC_32BIT_CPU) + #if defined(WC_32BIT_CPU) || defined(HAVE_STACK_SIZE) typedef void* THREAD_RETURN; #else typedef unsigned int THREAD_RETURN; From 314f7575fa1e8fc305d6f923eb166e25f42e1f93 Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 9 Dec 2024 08:30:47 -0800 Subject: [PATCH 2/3] Fixes for macro names. --- .wolfssl_known_macro_extras | 4 ++-- src/internal.c | 4 ++-- wolfssl/test.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index e691433d8f..0b3b32dc15 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -682,6 +682,7 @@ WOLFSSL_MULTICIRCULATE_ALTNAMELIST WOLFSSL_NONBLOCK_OCSP WOLFSSL_NOSHA3_384 WOLFSSL_NOT_WINDOWS_API +WOLFSSL_NO_AES_CFB_1_8 WOLFSSL_NO_BIO_ADDR_IN WOLFSSL_NO_CLIENT WOLFSSL_NO_CLIENT_CERT_ERROR @@ -723,6 +724,7 @@ WOLFSSL_NRF51_AES WOLFSSL_OLDTLS_AEAD_CIPHERSUITES WOLFSSL_OLDTLS_SHA2_CIPHERSUITES WOLFSSL_OLD_SET_CURVES_LIST +WOLFSSL_OLD_TIMINGPADVERIFY WOLFSSL_OLD_UNSUPPORTED_EXTENSION WOLFSSL_OPTIONS_IGNORE_SYS WOLFSSL_PASSTHRU_ERR @@ -815,7 +817,6 @@ WOLFSSL_XILINX_PATCH WOLFSSL_XIL_MSG_NO_SLEEP WOLFSSL_XMSS_LARGE_SECRET_KEY WOLFSSL_ZEPHYR -WOLFSS_SP_MATH_ALL WOLF_ALLOW_BUILTIN WOLF_CONF_IO WOLF_CONF_KYBER @@ -829,7 +830,6 @@ WOLF_CRYPTO_CB_ONLY_RSA WOLF_CRYPTO_CB_RSA_PAD WOLF_CRYPTO_DEV WOLF_NO_TRAILING_ENUM_COMMAS -WOLSSL_OLD_TIMINGPADVERIFY XGETPASSWD XMSS_CALL_PRF_KEYGEN XPAR_VERSAL_CIPS_0_PSPMC_0_PSV_CORTEXA72_0_TIMESTAMP_CLK_FREQ diff --git a/src/internal.c b/src/internal.c index 10e5867b6b..3297bad27d 100644 --- a/src/internal.c +++ b/src/internal.c @@ -20204,7 +20204,7 @@ static int SanityCheckCipherText(WOLFSSL* ssl, word32 encryptSz) #ifndef WOLFSSL_AEAD_ONLY -#ifdef WOLSSL_OLD_TIMINGPADVERIFY +#ifdef WOLFSSL_OLD_TIMINGPADVERIFY #define COMPRESS_LOWER 64 #define COMPRESS_UPPER 55 #define COMPRESS_CONSTANT 13 @@ -20610,7 +20610,7 @@ int TimingPadVerify(WOLFSSL* ssl, const byte* input, int padLen, int macSz, return ret; } #endif /* !WOLFSSL_NO_TLS12 && !WOLFSSL_AEAD_ONLY */ -#endif /* WOLSSL_OLD_TIMINGPADVERIFY */ +#endif /* WOLFSSL_OLD_TIMINGPADVERIFY */ #endif /* WOLFSSL_AEAD_ONLY */ int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx, int sniff) diff --git a/wolfssl/test.h b/wolfssl/test.h index d4918f5313..478a9056af 100644 --- a/wolfssl/test.h +++ b/wolfssl/test.h @@ -2575,7 +2575,7 @@ static WC_INLINE void CRL_CallBack(const char* url) #endif #ifndef NO_DH -#if defined(WOLFSSL_SP_MATH) && !defined(WOLFSS_SP_MATH_ALL) +#if defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL) /* dh2048 p */ static const unsigned char test_dh_p[] = { From c4e319b09273af947aeab88dad7f6af066473c9c Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 9 Dec 2024 11:05:40 -0800 Subject: [PATCH 3/3] Cleanup the gating for `WOLFSSL_NO_AES_CFB_1_8`. --- wolfcrypt/src/evp.c | 22 +++++++++++++++------- wolfcrypt/test/test.c | 25 ++++++++++++------------- wolfssl/wolfcrypt/settings.h | 7 +++++++ 3 files changed, 34 insertions(+), 20 deletions(-) diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c index 519a56ae82..c3eb12edeb 100644 --- a/wolfcrypt/src/evp.c +++ b/wolfcrypt/src/evp.c @@ -157,6 +157,7 @@ static const struct s_ent { (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */ #ifdef WOLFSSL_AES_CFB + #ifndef WOLFSSL_NO_AES_CFB_1_8 #ifdef WOLFSSL_AES_128 static const char EVP_AES_128_CFB1[] = "AES-128-CFB1"; #endif @@ -176,6 +177,7 @@ static const struct s_ent { #ifdef WOLFSSL_AES_256 static const char EVP_AES_256_CFB8[] = "AES-256-CFB8"; #endif + #endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #ifdef WOLFSSL_AES_128 static const char EVP_AES_128_CFB128[] = "AES-128-CFB128"; @@ -639,7 +641,7 @@ static int evpCipherBlock(WOLFSSL_EVP_CIPHER_CTX *ctx, break; #endif #if defined(WOLFSSL_AES_CFB) - #if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) + #if !defined(WOLFSSL_NO_AES_CFB_1_8) case WC_AES_128_CFB1_TYPE: case WC_AES_192_CFB1_TYPE: case WC_AES_256_CFB1_TYPE: @@ -659,7 +661,7 @@ static int evpCipherBlock(WOLFSSL_EVP_CIPHER_CTX *ctx, else ret = wc_AesCfb8Decrypt(&ctx->cipher.aes, out, in, inl); break; - #endif /* !HAVE_SELFTEST && !HAVE_FIPS */ + #endif /* !WOLFSSL_NO_AES_CFB_1_8 */ case WC_AES_128_CFB128_TYPE: case WC_AES_192_CFB128_TYPE: @@ -1942,6 +1944,7 @@ static unsigned int cipherType(const WOLFSSL_EVP_CIPHER *cipher) #endif #endif /* WOLFSSL_AES_XTS */ #if defined(WOLFSSL_AES_CFB) +#ifndef WOLFSSL_NO_AES_CFB_1_8 #ifdef WOLFSSL_AES_128 else if (EVP_CIPHER_TYPE_MATCHES(cipher, EVP_AES_128_CFB1)) return WC_AES_128_CFB1_TYPE; @@ -1966,6 +1969,7 @@ static unsigned int cipherType(const WOLFSSL_EVP_CIPHER *cipher) else if (EVP_CIPHER_TYPE_MATCHES(cipher, EVP_AES_256_CFB8)) return WC_AES_256_CFB8_TYPE; #endif +#endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #ifdef WOLFSSL_AES_128 else if (EVP_CIPHER_TYPE_MATCHES(cipher, EVP_AES_128_CFB128)) return WC_AES_128_CFB128_TYPE; @@ -4966,6 +4970,7 @@ static const struct cipher{ #endif #ifdef WOLFSSL_AES_CFB + #ifndef WOLFSSL_NO_AES_CFB_1_8 #ifdef WOLFSSL_AES_128 {WC_AES_128_CFB1_TYPE, EVP_AES_128_CFB1, WC_NID_aes_128_cfb1}, #endif @@ -4985,6 +4990,7 @@ static const struct cipher{ #ifdef WOLFSSL_AES_256 {WC_AES_256_CFB8_TYPE, EVP_AES_256_CFB8, WC_NID_aes_256_cfb8}, #endif + #endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #ifdef WOLFSSL_AES_128 {WC_AES_128_CFB128_TYPE, EVP_AES_128_CFB128, WC_NID_aes_128_cfb128}, @@ -4995,7 +5001,7 @@ static const struct cipher{ #ifdef WOLFSSL_AES_256 {WC_AES_256_CFB128_TYPE, EVP_AES_256_CFB128, WC_NID_aes_256_cfb128}, #endif - #endif + #endif /* WOLFSSL_AES_CFB */ #ifdef WOLFSSL_AES_OFB #ifdef WOLFSSL_AES_128 @@ -5622,7 +5628,7 @@ void wolfSSL_EVP_init(void) #endif /* HAVE_AES_CBC */ #ifdef WOLFSSL_AES_CFB -#if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) + #ifndef WOLFSSL_NO_AES_CFB_1_8 #ifdef WOLFSSL_AES_128 const WOLFSSL_EVP_CIPHER* wolfSSL_EVP_aes_128_cfb1(void) { @@ -5670,7 +5676,7 @@ void wolfSSL_EVP_init(void) return EVP_AES_256_CFB8; } #endif /* WOLFSSL_AES_256 */ -#endif /* !HAVE_SELFTEST && !HAVE_FIPS */ + #endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #ifdef WOLFSSL_AES_128 const WOLFSSL_EVP_CIPHER* wolfSSL_EVP_aes_128_cfb128(void) @@ -7249,6 +7255,7 @@ void wolfSSL_EVP_init(void) #endif /* WOLFSSL_AES_256 */ #endif /* HAVE_AES_ECB */ #ifdef WOLFSSL_AES_CFB + #ifndef WOLFSSL_NO_AES_CFB_1_8 #ifdef WOLFSSL_AES_128 if (ctx->cipherType == WC_AES_128_CFB1_TYPE || (type && EVP_CIPHER_TYPE_MATCHES(type, EVP_AES_128_CFB1))) { @@ -7431,6 +7438,7 @@ void wolfSSL_EVP_init(void) } } #endif /* WOLFSSL_AES_256 */ + #endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #ifdef WOLFSSL_AES_128 if (ctx->cipherType == WC_AES_128_CFB128_TYPE || (type && EVP_CIPHER_TYPE_MATCHES(type, EVP_AES_128_CFB128))) { @@ -8317,7 +8325,7 @@ void wolfSSL_EVP_init(void) #endif /* HAVE_AES_CBC */ #ifdef WOLFSSL_AES_CFB -#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) +#if !defined(WOLFSSL_NO_AES_CFB_1_8) case WC_AES_128_CFB1_TYPE: case WC_AES_192_CFB1_TYPE: case WC_AES_256_CFB1_TYPE: @@ -8340,7 +8348,7 @@ void wolfSSL_EVP_init(void) if (ret == 0) ret = (int)len; break; -#endif /* !HAVE_SELFTEST && !HAVE_FIPS */ +#endif /* !WOLFSSL_NO_AES_CFB_1_8 */ case WC_AES_128_CFB128_TYPE: case WC_AES_192_CFB128_TYPE: case WC_AES_256_CFB128_TYPE: diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index ccf8b76fc1..664b175d5b 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -9926,9 +9926,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, return ret; } -#if !defined(HAVE_SELFTEST) && \ - (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) && \ - !defined(WOLFSSL_NO_AES_CFB_1_8) +#if !defined(WOLFSSL_NO_AES_CFB_1_8) static wc_test_ret_t aescfb1_test(void) { #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) @@ -10095,7 +10093,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); - #ifndef WOLFCRYPT_ONLY + #if !defined(WOLFCRYPT_ONLY) && !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_128_cfb1(), key1, iv, msg1, sizeof(msg1), cipher, sizeof(msg1)); if (ret != 0) { @@ -10128,7 +10126,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); - #ifndef WOLFCRYPT_ONLY + #if !defined(WOLFCRYPT_ONLY) && !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_192_cfb1(), key2, iv2, msg2, sizeof(msg2), cipher, sizeof(msg2)); if (ret != 0) { @@ -10162,7 +10160,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); - #ifndef WOLFCRYPT_ONLY + #if !defined(WOLFCRYPT_ONLY) && !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_256_cfb1(), key3, iv3, msg3, sizeof(msg3), cipher, sizeof(msg3)); if (ret != 0) { @@ -10306,7 +10304,8 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, #ifdef WOLFSSL_AES_128 /* 128 key tests */ - #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) + #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) && \ + !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_128_cfb8(), key1, iv, msg1, sizeof(msg1), cipher1, sizeof(cipher1)); if (ret != 0) { @@ -10352,7 +10351,8 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); if (XMEMCMP(cipher, cipher2, sizeof(msg2)) != 0) ERROR_OUT(WC_TEST_RET_ENC_NC, out); -#if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) +#if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) && \ + !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_192_cfb8(), key2, iv2, msg2, sizeof(msg2), cipher2, sizeof(msg2)); if (ret != 0) { @@ -10375,7 +10375,8 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, if (XMEMCMP(cipher, cipher3, sizeof(cipher3)) != 0) ERROR_OUT(WC_TEST_RET_ENC_NC, out); - #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) + #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY) && \ + !defined(HAVE_FIPS) ret = EVP_test(wolfSSL_EVP_aes_256_cfb8(), key3, iv3, msg3, sizeof(msg3), cipher3, sizeof(msg3)); if (ret != 0) { @@ -10401,7 +10402,7 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key, return ret; } -#endif /* !HAVE_SELFTEST && !HAVE_FIPS && !WOLFSSL_NO_AES_CFB_1_8 */ +#endif /* !WOLFSSL_NO_AES_CFB_1_8 */ #endif /* WOLFSSL_AES_CFB */ #ifndef HAVE_RENESAS_SYNC @@ -14271,9 +14272,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_cfb_test(void) ret = aescfb_test_0(); if (ret != 0) return ret; -#if !defined(HAVE_SELFTEST) && \ - (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)) && \ - !defined(WOLFSSL_NO_AES_CFB_1_8) +#if !defined(WOLFSSL_NO_AES_CFB_1_8) ret = aescfb1_test(); if (ret != 0) return ret; diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index d5459ae3b9..9d74d9dc58 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3076,6 +3076,13 @@ extern void uITRON4_free(void *p) ; #endif #endif /* HAVE_ED448 */ +/* FIPS does not support CFB1 or CFB8 */ +#if !defined(WOLFSSL_NO_AES_CFB_1_8) && \ + (defined(HAVE_SELFTEST) || \ + (defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0))) + #define WOLFSSL_NO_AES_CFB_1_8 +#endif + /* AES Config */ #ifndef NO_AES /* By default enable all AES key sizes, decryption and CBC */