wolfCrypt security hardening, portability fixes, and negative test coverage

doc/dox_comments/header_files-ja/chacha.h

@@ -33,6 +33,7 @@ int wc_Chacha_SetIV(ChaCha* ctx, const byte* inIv, word32 counter);
 
     \return 0 入力の暗号化または復号に成功した場合に返されます
     \return BAD_FUNC_ARG ctx入力引数の処理中にエラーが発生した場合に返されます
+    \return MISSING_KEY 処理前にwc_Chacha_SetKeyでキーが設定されていない場合に返されます
 
     \param ctx ivを設定するChaCha構造体へのポインタ
     \param output 出力暗号文または復号された平文を格納するバッファへのポインタ

doc/dox_comments/header_files/chacha.h

@@ -41,6 +41,8 @@ int wc_Chacha_SetIV(ChaCha* ctx, const byte* inIv, word32 counter);
     \return 0 Returned upon successfully encrypting or decrypting the input
     \return BAD_FUNC_ARG returned if there is an error processing the ctx
     input argument
+    \return MISSING_KEY returned if wc_Chacha_SetKey was not called to set a
+    key before processing
 
     \param ctx pointer to the ChaCha structure on which to set the iv
     \param output pointer to a buffer in which to store the output ciphertext

doc/dox_comments/header_files/ecc.h

@@ -316,6 +316,8 @@ void wc_ecc_key_free(ecc_key* key);
     shared key
     \return MP_MEM may be returned if there is an error while computing the
     shared key
+    \return ECC_INF_E returned when the computed shared secret is the point at
+    infinity
 
     \param private_key pointer to the ecc_key structure containing the local
     private key

tests/api/test_chacha.c

@@ -703,3 +703,28 @@ int test_wc_Chacha_XChachaSetKey(void)
 #endif
     return EXPECT_RESULT();
 } /* END test_wc_Chacha_XChachaSetKey */
+
+/*
+ * A zero-initialized context that only receives a nonce, with the key setup
+ * omitted, must not silently encrypt with an all-zero key. wc_Chacha_Process
+ * has to reject the missing key instead of returning success.
+ */
+int test_wc_Chacha_MissingKey(void)
+{
+    EXPECT_DECLS;
+#ifdef HAVE_CHACHA
+    ChaCha      ctx;
+    const byte  iv[CHACHA_IV_BYTES] = { 0 };
+    const byte  input[32] = { 0 };
+    byte        cipher[32];
+
+    XMEMSET(&ctx, 0, sizeof(ctx));
+    XMEMSET(cipher, 0, sizeof(cipher));
+
+    /* Nonce set, but wc_Chacha_SetKey() deliberately skipped. */
+    ExpectIntEQ(wc_Chacha_SetIV(&ctx, iv, 0), 0);
+    ExpectIntEQ(wc_Chacha_Process(&ctx, cipher, input, sizeof(input)),
+        WC_NO_ERR_TRACE(MISSING_KEY));
+#endif
+    return EXPECT_RESULT();
+} /* END test_wc_Chacha_MissingKey */

tests/api/test_chacha.h

@@ -32,6 +32,7 @@ int test_wc_Chacha_CounterOverflow(void);
 int test_wc_Chacha_InPlace(void);
 int test_wc_Chacha_UnalignedBuffers(void);
 int test_wc_Chacha_XChachaSetKey(void);
+int test_wc_Chacha_MissingKey(void);
 
 #define TEST_CHACHA_DECLS                                               \
     TEST_DECL_GROUP("chacha", test_wc_Chacha_SetKey),                   \
@@ -41,6 +42,7 @@ int test_wc_Chacha_XChachaSetKey(void);
     TEST_DECL_GROUP("chacha", test_wc_Chacha_CounterOverflow),          \
     TEST_DECL_GROUP("chacha", test_wc_Chacha_InPlace),                  \
     TEST_DECL_GROUP("chacha", test_wc_Chacha_UnalignedBuffers),         \
-    TEST_DECL_GROUP("chacha", test_wc_Chacha_XChachaSetKey)
+    TEST_DECL_GROUP("chacha", test_wc_Chacha_XChachaSetKey),            \
+    TEST_DECL_GROUP("chacha", test_wc_Chacha_MissingKey)
 
 #endif /* WOLFCRYPT_TEST_CHACHA_H */

tests/api/test_dh.c

@@ -316,6 +316,37 @@ int test_wc_DhSetKey(void)
     return EXPECT_RESULT();
 }
 
+/*
+ * wc_DhSetKey_ex validates untrusted parameters, so it must reject a composite
+ * modulus even when that composite is a strong pseudoprime to the fixed
+ * small-prime Miller-Rabin bases. n = 341550071728321 = 10670053 * 32010157 is
+ * a strong pseudoprime to bases 2, 3, 5, 7, 11, 13, 17 and 19, which the
+ * deterministic fixed-base test wrongly accepts as prime. Random-witness
+ * testing rejects it. As with the library's own primality check, rejection is
+ * probabilistic: eight random Miller-Rabin rounds leave a negligible
+ * (well under 1e-4) chance of accepting the composite, so a one-off failure
+ * here is statistical, not a regression.
+ */
+int test_wc_DhSetKey_ex_pseudoprime(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_DH) && !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) && \
+    !defined(WC_NO_RNG)
+    DhKey key;
+    /* n = 341550071728321, big-endian. */
+    byte p[] = { 0x01, 0x36, 0xA3, 0x52, 0xB2, 0xC8, 0xC1 };
+    byte g[] = { 0x02 };
+
+    XMEMSET(&key, 0, sizeof(key));
+
+    ExpectIntEQ(wc_InitDhKey(&key), 0);
+    ExpectIntEQ(wc_DhSetKey_ex(&key, p, sizeof(p), g, sizeof(g), NULL, 0),
+        WC_NO_ERR_TRACE(DH_CHECK_PUB_E));
+    wc_FreeDhKey(&key);
+#endif
+    return EXPECT_RESULT();
+}
+
 /*
  * Testing wc_DhSetNamedKey(), wc_DhGetNamedKeyParamSize(),
  * wc_DhCopyNamedKey() and wc_DhCmpNamedKey().

tests/api/test_dh.h

@@ -27,6 +27,7 @@
 int test_wc_DhPublicKeyDecode(void);
 int test_wc_DhAgree_subgroup_check(void);
 int test_wc_DhSetKey(void);
+int test_wc_DhSetKey_ex_pseudoprime(void);
 int test_wc_DhSetNamedKey_and_helpers(void);
 int test_wc_DhGenerateKeyPair_bad_args(void);
 int test_wc_DhGenerateKeyPair_and_Agree(void);
@@ -42,6 +43,7 @@ int test_wc_DhGenerateKeyPair_CheckDhLN(void);
     TEST_DECL_GROUP("dh", test_wc_DhPublicKeyDecode),               \
     TEST_DECL_GROUP("dh", test_wc_DhAgree_subgroup_check),          \
     TEST_DECL_GROUP("dh", test_wc_DhSetKey),                        \
+    TEST_DECL_GROUP("dh", test_wc_DhSetKey_ex_pseudoprime),         \
     TEST_DECL_GROUP("dh", test_wc_DhSetNamedKey_and_helpers),       \
     TEST_DECL_GROUP("dh", test_wc_DhGenerateKeyPair_bad_args),      \
     TEST_DECL_GROUP("dh", test_wc_DhGenerateKeyPair_and_Agree),     \

tests/api/test_ecc.c

@@ -295,6 +295,66 @@ int test_wc_ecc_check_key(void)
     return EXPECT_RESULT();
 } /* END test_wc_ecc_check_key */
 
+/*
+ * Negative coverage for the public-key checks in wc_ecc_check_key. A point off
+ * the curve must be rejected with IS_POINT_E, and a coordinate outside
+ * [0, p-1] with ECC_OUT_OF_RANGE_E. Uses secp224r1, which is not single
+ * precision accelerated, so the software validation path runs even in SP
+ * builds that offload P-256.
+ */
+int test_wc_ecc_check_key_invalid_pubkey(void)
+{
+    EXPECT_DECLS;
+    /* Older FIPS-certified modules ship a frozen source tree where these
+     * imports and checks behave differently, so restrict to non-FIPS or
+     * FIPS v7 and later, and skip the CAVP selftest build. */
+#if (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && \
+    !defined(HAVE_SELFTEST) && \
+    defined(HAVE_ECC) && defined(HAVE_ECC_KEY_IMPORT) && \
+    !defined(NO_ECC_CHECK_PUBKEY_ORDER) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
+    (defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)) && \
+    (ECC_MIN_KEY_SZ <= 224) && \
+    !defined(WOLFSSL_VALIDATE_ECC_IMPORT) && !defined(WOLFSSL_SP_MATH) && \
+    !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
+    !defined(WOLFSSL_MICROCHIP_TA100) && !defined(WOLFSSL_CRYPTOCELL) && \
+    !defined(WOLFSSL_SILABS_SE_ACCEL) && !defined(WOLFSSL_SE050) && \
+    !defined(WOLFSSL_STM32_PKA) && !defined(WOLFSSL_KCAPI_ECC)
+    ecc_key key;
+    const char* qx =
+        "b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21";
+    const char* qy =
+        "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34";
+    /* Qy with its low bit flipped: still less than p, but not on the curve. */
+    const char* qyOffCurve =
+        "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e35";
+    /* p, the SECP224R1 field prime, used as an out-of-range coordinate. */
+    const char* pModulus =
+        "ffffffffffffffffffffffffffffffff000000000000000000000001";
+
+    /* Point not on the curve: rejected by the on-curve check. */
+    XMEMSET(&key, 0, sizeof(key));
+    ExpectIntEQ(wc_ecc_init(&key), 0);
+    ExpectIntEQ(wc_ecc_import_raw(&key, qx, qyOffCurve, NULL, "SECP224R1"), 0);
+    ExpectIntEQ(wc_ecc_check_key(&key), WC_NO_ERR_TRACE(IS_POINT_E));
+    wc_ecc_free(&key);
+
+    /* Qx == p: rejected by the coordinate-range check. */
+    XMEMSET(&key, 0, sizeof(key));
+    ExpectIntEQ(wc_ecc_init(&key), 0);
+    ExpectIntEQ(wc_ecc_import_raw(&key, pModulus, qy, NULL, "SECP224R1"), 0);
+    ExpectIntEQ(wc_ecc_check_key(&key), WC_NO_ERR_TRACE(ECC_OUT_OF_RANGE_E));
+    wc_ecc_free(&key);
+
+    /* Qy == p: rejected by the coordinate-range check. */
+    XMEMSET(&key, 0, sizeof(key));
+    ExpectIntEQ(wc_ecc_init(&key), 0);
+    ExpectIntEQ(wc_ecc_import_raw(&key, qx, pModulus, NULL, "SECP224R1"), 0);
+    ExpectIntEQ(wc_ecc_check_key(&key), WC_NO_ERR_TRACE(ECC_OUT_OF_RANGE_E));
+    wc_ecc_free(&key);
+#endif
+    return EXPECT_RESULT();
+} /* END test_wc_ecc_check_key_invalid_pubkey */
+
 /*
  * Testing wc_ecc_get_generator()
  */
@@ -578,6 +638,77 @@ int test_wc_ecc_shared_secret(void)
     return EXPECT_RESULT();
 } /* END tests_wc_ecc_shared_secret */
 
+/*
+ * A shared secret that computes to the point at infinity must be rejected
+ * (SP 800-56Ar3 5.7.1.2), not returned as an all-zero secret. Setting the
+ * private scalar to the curve order makes k times the peer point the identity
+ * for any peer point. Uses secp224r1, which is not single precision
+ * accelerated, so the non-SP ECDH path runs even in SP builds that offload
+ * P-256.
+ */
+int test_wc_ecc_shared_secret_at_infinity(void)
+{
+    EXPECT_DECLS;
+    /* ECC_INF_E rejection is not present in the frozen ecc.c of older
+     * FIPS-certified modules, so restrict to non-FIPS or FIPS v7 and later,
+     * and skip the CAVP selftest build. */
+#if (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && \
+    !defined(HAVE_SELFTEST) && \
+    defined(HAVE_ECC) && defined(HAVE_ECC_DHE) && !defined(WC_NO_RNG) && \
+    (defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)) && \
+    (ECC_MIN_KEY_SZ <= 224) && \
+    !defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_VALIDATE_ECC_IMPORT) && \
+    !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
+    !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLFSSL_SE050) && \
+    !defined(WOLFSSL_KCAPI_ECC) && !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+    ecc_key key;
+    ecc_key pubKey;
+    WC_RNG  rng;
+    byte    out[MAX_ECC_BYTES];
+    word32  outlen = (word32)sizeof(out);
+    /* A valid SECP224R1 public point. */
+    const char* qx =
+        "b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21";
+    const char* qy =
+        "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34";
+    /* Order n of SECP224R1. Every valid point has order n on this curve, so
+     * a private scalar equal to n makes n times the peer point the identity. */
+    const char* order =
+        "ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d";
+
+    XMEMSET(&key, 0, sizeof(key));
+    XMEMSET(&pubKey, 0, sizeof(pubKey));
+    XMEMSET(&rng, 0, sizeof(rng));
+
+    PRIVATE_KEY_UNLOCK();
+
+    ExpectIntEQ(wc_ecc_init(&key), 0);
+    ExpectIntEQ(wc_ecc_init(&pubKey), 0);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+
+    ExpectIntEQ(wc_ecc_import_raw(&key, qx, qy, order, "SECP224R1"), 0);
+    ExpectIntEQ(wc_ecc_import_raw(&pubKey, qx, qy, NULL, "SECP224R1"), 0);
+
+#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
+    !defined(HAVE_SELFTEST)
+    ExpectIntEQ(wc_ecc_set_rng(&key, &rng), 0);
+#endif
+
+    ExpectIntEQ(wc_ecc_shared_secret(&key, &pubKey, out, &outlen),
+        WC_NO_ERR_TRACE(ECC_INF_E));
+
+    DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    wc_ecc_free(&pubKey);
+    wc_ecc_free(&key);
+#ifdef FP_ECC
+    wc_ecc_fp_free();
+#endif
+    PRIVATE_KEY_LOCK();
+#endif
+    return EXPECT_RESULT();
+} /* END test_wc_ecc_shared_secret_at_infinity */
+
 #if defined(HAVE_ECC) && defined(HAVE_ECC_DHE) && !defined(WC_NO_RNG) && \
     (defined(HAVE_ECC384) || defined(HAVE_ECC521) || \
      defined(HAVE_ALL_CURVES)) && \

tests/api/test_ecc.h

@@ -31,11 +31,13 @@ int test_wc_ecc_get_curve_id_from_dp_params(void);
 int test_wc_ecc_make_key(void);
 int test_wc_ecc_init(void);
 int test_wc_ecc_check_key(void);
+int test_wc_ecc_check_key_invalid_pubkey(void);
 int test_wc_ecc_get_generator(void);
 int test_wc_ecc_size(void);
 int test_wc_ecc_params(void);
 int test_wc_ecc_signVerify_hash(void);
 int test_wc_ecc_shared_secret(void);
+int test_wc_ecc_shared_secret_at_infinity(void);
 int test_wc_ecc_shared_secret_size_bounds(void);
 int test_wc_ecc_export_x963(void);
 int test_wc_ecc_export_x963_ex(void);
@@ -74,11 +76,13 @@ int test_wc_EccDecisionCoverage4(void);
     TEST_DECL_GROUP("ecc", test_wc_ecc_make_key),                       \
     TEST_DECL_GROUP("ecc", test_wc_ecc_init),                           \
     TEST_DECL_GROUP("ecc", test_wc_ecc_check_key),                      \
+    TEST_DECL_GROUP("ecc", test_wc_ecc_check_key_invalid_pubkey),       \
     TEST_DECL_GROUP("ecc", test_wc_ecc_get_generator),                  \
     TEST_DECL_GROUP("ecc", test_wc_ecc_size),                           \
     TEST_DECL_GROUP("ecc", test_wc_ecc_params),                         \
     TEST_DECL_GROUP("ecc", test_wc_ecc_signVerify_hash),                \
     TEST_DECL_GROUP("ecc", test_wc_ecc_shared_secret),                  \
+    TEST_DECL_GROUP("ecc", test_wc_ecc_shared_secret_at_infinity),      \
     TEST_DECL_GROUP("ecc", test_wc_ecc_shared_secret_size_bounds),      \
     TEST_DECL_GROUP("ecc", test_wc_ecc_export_x963),                    \
     TEST_DECL_GROUP("ecc", test_wc_ecc_export_x963_ex),                 \