Skip to content

Boundary checks + zeroization improvements. Fix ed25519 and ECC dispatchers. Make PKCS7 padding checks CT. #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dgarske merged 15 commits into from
Mar 23, 2026
Merged

Boundary checks + zeroization improvements. Fix ed25519 and ECC dispatchers. Make PKCS7 padding checks CT. #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
8affc91
Guard PKCS7 CBC decrypt length underflow
danielinux Mar 23, 2026
6dd7db7
Fix EdDSA PSA dispatch order
danielinux Mar 23, 2026
3ba730c
zero cipher context before free
danielinux Mar 23, 2026
66a24e6
zero import buffer before free
danielinux Mar 23, 2026
996cc15
zeroize MAC context on abort
danielinux Mar 23, 2026
24bbd81
Dispatch Edwards key generation correctly
danielinux Mar 23, 2026
168dcec
Route Twisted Edwards public key export
danielinux Mar 23, 2026
cf32ac0
Make CBC PKCS7 padding check constant time
danielinux Mar 23, 2026
f0965c7
Zero AEAD buffers on abort
danielinux Mar 23, 2026
52b036a
check TLS13 PRF length narrowing
danielinux Mar 23, 2026
9a01ef3
zero MAC stack buffer on exit
danielinux Mar 23, 2026
dc92685
Zero MAC verify stack buffer
danielinux Mar 23, 2026
9148d23
Fix Ed25519-Ed448 import paths
danielinux Mar 23, 2026
8d24359
Zeroize final plaintext block in PKCS7 decrypt
danielinux Mar 23, 2026
7ed7e35
Addressed copilot's comments
danielinux Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/psa_aead.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -840,9 +840,11 @@ psa_status_t psa_aead_abort(psa_aead_operation_t *operation)

if (ctx != NULL) {
if (ctx->aad != NULL) {
wc_ForceZero(ctx->aad, ctx->aad_length);
XFREE(ctx->aad, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
if (ctx->input != NULL) {
wc_ForceZero(ctx->input, ctx->input_length);
XFREE(ctx->input, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
if (ctx->key != NULL) {
Expand Down
58 changes: 30 additions & 28 deletions src/psa_asymmetric_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,13 +310,6 @@ psa_status_t psa_sign_hash(psa_key_id_t key,
signature, signature_size,
signature_length);
}
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_sign_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_size,
signature_length);
}
#if defined(HAVE_ED25519) || defined(HAVE_ED448)
else if (attributes.type == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
#ifdef HAVE_ED25519
Expand Down Expand Up @@ -344,6 +337,13 @@ psa_status_t psa_sign_hash(psa_key_id_t key,
}
}
#endif
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_sign_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_size,
signature_length);
}
else {
status = PSA_ERROR_NOT_SUPPORTED;
}
Expand Down Expand Up @@ -382,14 +382,9 @@ psa_status_t psa_verify_hash(psa_key_id_t key,
alg, hash, hash_length,
signature, signature_length);
}
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_verify_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_length);
}
#if defined(HAVE_ED25519) || defined(HAVE_ED448)
else if (attributes.type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
else if (attributes.type == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS) ||
attributes.type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
#ifdef HAVE_ED25519
if (attributes.bits == 255) {
status = psa_asymmetric_verify_ed25519(attributes.type, attributes.bits,
Expand All @@ -413,6 +408,12 @@ psa_status_t psa_verify_hash(psa_key_id_t key,
}
}
#endif
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_verify_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_length);
}
else {
status = PSA_ERROR_NOT_SUPPORTED;
}
Expand Down Expand Up @@ -478,13 +479,6 @@ psa_status_t psa_sign_message(psa_key_id_t key,
signature, signature_size,
signature_length);
}
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_sign_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_size,
signature_length);
}
#if defined(HAVE_ED25519) || defined(HAVE_ED448)
else if (attributes.type == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
#ifdef HAVE_ED25519
Expand Down Expand Up @@ -512,6 +506,13 @@ psa_status_t psa_sign_message(psa_key_id_t key,
}
}
#endif
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_sign_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_size,
signature_length);
}
else {
status = PSA_ERROR_NOT_SUPPORTED;
}
Expand Down Expand Up @@ -575,14 +576,9 @@ psa_status_t psa_verify_message(psa_key_id_t key,
alg, hash, hash_length,
signature, signature_length);
}
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_verify_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_length);
}
#if defined(HAVE_ED25519) || defined(HAVE_ED448)
else if (attributes.type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
else if (attributes.type == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS) ||
attributes.type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS)) {
#ifdef HAVE_ED25519
if (attributes.bits == 255) {
status = psa_asymmetric_verify_ed25519(attributes.type, attributes.bits,
Expand All @@ -606,6 +602,12 @@ psa_status_t psa_verify_message(psa_key_id_t key,
}
}
#endif
else if (PSA_KEY_TYPE_IS_ECC(attributes.type)) {
status = psa_asymmetric_verify_ecc(attributes.type, attributes.bits,
key_data, key_data_length,
alg, hash, hash_length,
signature, signature_length);
}
else {
status = PSA_ERROR_NOT_SUPPORTED;
}
Expand Down
55 changes: 32 additions & 23 deletions src/psa_cipher.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@
#endif
#include <wolfssl/wolfcrypt/chacha.h>
#include <wolfssl/wolfcrypt/mem_track.h>
#include <wolfssl/wolfcrypt/misc.h>
#ifndef NO_INLINE
#define WOLFSSL_MISC_INCLUDED
#include <wolfcrypt/src/misc.c>
#endif

#define WOLFPSA_CHACHA20_IV_BYTES 12

Expand Down Expand Up @@ -867,7 +872,7 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
return PSA_SUCCESS;
}
else {
size_t bytes_to_process;
size_t process_len;
size_t full_blocks_len;

if (total < block_size) {
Expand All @@ -878,21 +883,15 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
return PSA_SUCCESS;
}

bytes_to_process = total - block_size;
if (bytes_to_process == 0) {
if (ctx->partial_len > 0) {
size_t needed = block_size - ctx->partial_len;
XMEMCPY(ctx->partial + ctx->partial_len, input, needed);
ctx->partial_len = block_size;
}
else {
XMEMCPY(ctx->partial, input, block_size);
ctx->partial_len = block_size;
}
/* Decrypt whole blocks while retaining the final ciphertext block. */
process_len = ((total - 1U) / block_size) * block_size;
if (process_len == 0) {
XMEMCPY(ctx->partial + ctx->partial_len, input, input_length);
ctx->partial_len += input_length;
return PSA_SUCCESS;
}

if (output_size < bytes_to_process) {
if (output_size < process_len) {
return PSA_ERROR_BUFFER_TOO_SMALL;
}

Expand Down Expand Up @@ -921,10 +920,9 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
output_offset += block_size;
input_offset += needed;
ctx->partial_len = 0;
bytes_to_process -= block_size;
}

full_blocks_len = bytes_to_process;
full_blocks_len = process_len - output_offset;
if (full_blocks_len > 0) {
if (ctx->is_des3) {
#ifndef NO_DES3
Expand Down Expand Up @@ -1229,8 +1227,10 @@ psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
}
else {
uint8_t block[AES_BLOCK_SIZE];
byte invalid;
size_t pad_len;
size_t plain_len;
psa_status_t status = PSA_SUCCESS;

if (ctx->partial_len != block_size) {
return PSA_ERROR_INVALID_PADDING;
Expand All @@ -1249,29 +1249,37 @@ psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
(word32)block_size);
}
if (ret != 0) {
wc_ForceZero(block, sizeof(block));
return wc_error_to_psa_status(ret);
}

pad_len = block[block_size - 1];
if (pad_len == 0 || pad_len > block_size) {
return PSA_ERROR_INVALID_PADDING;
invalid = ctMaskEq((int)pad_len, 0);
invalid |= ctMaskGT((int)pad_len, (int)block_size);
for (size_t i = 0; i < block_size; i++) {
volatile byte mask = ctMaskLT((int)i, (int)pad_len);
invalid |= mask & (byte)(block[block_size - 1 - i] ^
(byte)pad_len);
}
for (size_t i = 0; i < pad_len; i++) {
if (block[block_size - 1 - i] != pad_len) {
return PSA_ERROR_INVALID_PADDING;
}
if (invalid != 0) {
status = PSA_ERROR_INVALID_PADDING;
goto cbc_pkcs7_decrypt_done;
}
Comment thread
danielinux marked this conversation as resolved.

plain_len = block_size - pad_len;
if (output_size < plain_len) {
return PSA_ERROR_BUFFER_TOO_SMALL;
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto cbc_pkcs7_decrypt_done;
}
if (plain_len > 0) {
XMEMCPY(output, block, plain_len);
}
ctx->partial_len = 0;
*output_length = plain_len;
return PSA_SUCCESS;

cbc_pkcs7_decrypt_done:
wc_ForceZero(block, sizeof(block));
return status;
}
}

Expand Down Expand Up @@ -1302,6 +1310,7 @@ psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
else if (!ctx->is_chacha) {
wc_AesFree(&ctx->aes);
}
wc_ForceZero(ctx, sizeof(*ctx));
XFREE(ctx, NULL, DYNAMIC_TYPE_TMP_BUFFER);
operation->opaque = (uintptr_t)NULL;
}
Expand Down
Loading
Loading