Repository navigation

ISO 19790 Zeroization for v7 - #11434

Merged

philljj merged 74 commits into

wolfSSL:masterfrom

jackctj117:ISO-19790-FIPS-PQ

Oct 29, 2026

Merged

ISO 19790 Zeroization for v7#11434
philljj merged 74 commits into
wolfSSL:masterfrom
jackctj117:ISO-19790-FIPS-PQ

Commits on Oct 28, 2026
- Zeroize EdDSA scalars and KDF blocks; reject non-canonical Ed448 keys
  
  jackctj117
  authored and
  douzzer
  committed
  b60019f
- Zeroize temporary SSPs in the FIPS v7 boundary
  
  jackctj117
  authored and
  douzzer
  committed
  b0ab8eb
- Zeroize remaining temporaries and failure paths
  
  jackctj117
  authored and
  douzzer
  committed
  40b4981
- SHA Free: release msg and W before the callback-path wipe
  
  jackctj117
  authored and
  douzzer
  committed
  daa8e9b
- Address review: keep destructors off caller-owned contexts, fix entropy include
  
  jackctj117
  authored and
  douzzer
  committed
  0be88ba
- Use ForceZero where XMEMSET wiped sensitive data
  
  jackctj117
  authored and
  douzzer
  committed
  ff7a795
- NoiseSrc: ForceZero the health-test state on free
  
  jackctj117
  authored and
  douzzer
  committed
  b1e61de
- SHA-3 Free: wipe state only; RSA even-mod test expects the wiped buffer
  
  jackctj117
  authored and
  douzzer
  committed
  126044a
- RSA even-mod test: only expect the wiped buffer from FIPS v7 or non-FIPS builds
  
  jackctj117
  authored and
  douzzer
  committed
  46bded1
- SHA-3: keep the C Keccak round scratch in the context
  
  jackctj117
  authored and
  douzzer
  committed
  ab22392
- ML-KEM: add basemul products into r without staging them
  
  jackctj117
  authored and
  douzzer
  committed
  09fa6f7
- ForceZero: use volatile stores where no data barrier backs the wipe
  
  jackctj117
  authored and
  douzzer
  committed
  10de57e
- SHA-1, SHA-256: keep the C transform message schedule in the context
  
  jackctj117
  authored and
  douzzer
  committed
  09bf95c
- openssl compat: size the SHA and SHA-224 contexts from the native structs
  
  jackctj117
  authored and
  douzzer
  committed
  85b9a44
- mcapi: grow the SHA and SHA-256 context holders
  
  jackctj117
  authored and
  douzzer
  committed
  a8a55f7
- SHA-1: wipe the GetHash copy; SHA-256: wipe the many-registers stack W
  
  jackctj117
  authored and
  douzzer
  committed
  c56f8a7
- SHA-3: ForceZero in InitSha3, wipe KMAC key staging and keyed sponge
  
  jackctj117
  authored and
  douzzer
  committed
  fe9456d
- EdDSA and X25519/X448: wipe ladder, scalar and key temporaries
  
  jackctj117
  authored and
  douzzer
  committed
  11220d4
- rsa: wipe the PSS salt, the OAEP unpad temp and the keygen blind
  
  jackctj117
  authored and
  douzzer
  committed
  3dfc04c
- dh: wipe the previous private key in wc_DhKeyCopy and the nb context
  
  jackctj117
  authored and
  douzzer
  committed
  afc37ca
- ecc: wipe the unblinded scalar copy, ladder state and nb context
  
  jackctj117
  authored and
  douzzer
  committed
  10e7278
- HMAC, HKDF: wipe key on SetKey failure, inner digest, partial OKM
  
  jackctj117
  authored and
  douzzer
  committed
  d1b776b
- KDF, PBKDF: wipe partial derived output on failure
  
  jackctj117
  authored and
  douzzer
  committed
  6c06a1e
- SE050 hash: wipe the buffered message and the SHA-512 context
  
  jackctj117
  authored and
  douzzer
  committed
  28c39b9
- ML-KEM: wipe hash state on failure and the old key before re-keying
  
  jackctj117
  authored and
  douzzer
  committed
  cd41592
- ML-DSA: wipe rho', rejected candidates and keys left by failures
  
  jackctj117
  authored and
  douzzer
  committed
  a8c90d3
- AES: wipe GCM, CFB and XTS temporaries, finished streams and failed keys
  
  jackctj117
  authored and
  douzzer
  committed
  397d67b
- random: uninstantiate the DRBG after any failed instantiate
  
  jackctj117
  authored and
  douzzer
  committed
  07ff724
- random, wolfentropy: wipe seed, stir and output temporaries
  
  jackctj117
  authored and
  douzzer
  committed
  5e7dac3
- SLH-DSA: wipe secret hash state and scratch once per operation
  
  jackctj117
  authored and
  douzzer
  committed
  b17a4bf
- LMS: wipe the private key on failed keygen, reload and sign
  
  jackctj117
  authored and
  douzzer
  committed
  447da79
- ML-KEM: wipe the implicit-rejection flag in decapsulation
  
  jackctj117
  authored and
  douzzer
  committed
  da225ca
- HMAC: clear the key when async hardware key setup fails
  
  jackctj117
  authored and
  douzzer
  committed
  6b5101c
- AES-GCM, CMAC, ECIES, X9.63: wipe expected tags, H copies and KDF blocks
  
  jackctj117
  authored and
  douzzer
  committed
  3d7a339
- EdDSA, X25519: wipe the projective points of the scalar multiplication
  
  jackctj117
  authored and
  douzzer
  committed
  7721535
- RSA, ML-DSA, entropy: clear padding flags, rejected hint count, raw sample
  
  jackctj117
  authored and
  douzzer
  committed
  0982e40
- Drop changes outside the FIPS boundary
  
  jackctj117
  authored and
  douzzer
  committed
  5dad1d1
- AES: drop wc_GmacFree
  
  jackctj117
  authored and
  douzzer
  committed
  5d73720
- ECC, X25519, DH, RSA: leave the caller's non-blocking context alone at free
  
  jackctj117
  authored and
  douzzer
  committed
  8850f57
- ML-KEM: read the key type only after encapsulate's checks pass
  
  jackctj117
  authored and
  douzzer
  committed
  c7f70dd
- SHA-256: keep one context layout under WC_SHA2_NO_SMALL_STACK
  
  jackctj117
  authored and
  douzzer
  committed
  9306081
- wolfentropy: drop the out-of-boundary entropy source changes
  
  jackctj117
  authored and
  douzzer
  committed
  afccfc7
- ML-KEM, ML-DSA: fix wipe helper guards and SHA-3 scratch layout
  
  jackctj117
  authored and
  douzzer
  committed
  6acca4f
- SHA-256: keep W on the stack in kernel builds
  
  jackctj117
  authored and
  douzzer
  committed
  ca21dd5
- RSA: leave the caller's output alone when public encrypt fails
  
  jackctj117
  authored and
  douzzer
  committed
  834aa36
- RSA: wipe the OAEP block in out when public encrypt fails
  
  jackctj117
  authored and
  douzzer
  committed
  1af6717
- Fix remaining FIPS v7 C zeroization gaps
  
  jackctj117
  authored and
  douzzer
  committed
  827807d
- Drop zeroization outside the FIPS v7 services
  
  jackctj117
  authored and
  douzzer
  committed
  b2fd466
- Fix the zeroization gaps from the round-2 review
  
  jackctj117
  authored and
  douzzer
  committed
  387faeb
- tests: cover the round-2 zeroization fixes
  
  jackctj117
  authored and
  douzzer
  committed
  4b427b2
- tests: guard the new zeroization tests for builds that swap the sources
  
  jackctj117
  authored and
  douzzer
  committed
  2c0e1cf
- ecc: free the old key contents before an import re-inits them
  
  jackctj117
  authored and
  douzzer
  committed
  c228159
- ecc: do not read the key before an import re-inits it
  
  jackctj117
  authored and
  douzzer
  committed
  b4e0e1b
- Wipe HMAC and SHAKE object state at Free, not per Final or absorb
  
  jackctj117
  authored and
  douzzer
  committed
  920170c
- random: drop the Hash_gen digest wipes duplicated by the rebase
  
  jackctj117
  authored and
  douzzer
  committed
  2950254
- aes: restore the 4-bit GHASH multiply from master
  
  jackctj117
  authored and
  douzzer
  committed
  1708a7f
- Add WOLFSSL_CHECK_MEM_ZERO coverage for the new SSP wipes
  
  jackctj117
  authored and
  douzzer
  committed
  aadd47a
- sha3: drop the KMAC Final wipe so a reused object stays keyed
  
  jackctj117
  authored and
  douzzer
  committed
  f09453e
- sha3: restore plain zeroing in InitSha3
  
  jackctj117
  authored and
  douzzer
  committed
  d464f6a
- rng_bank: restore master's scratch clear in the pre-v7 reseed path
  
  jackctj117
  authored and
  douzzer
  committed
  7f261dd
- SHA-3: drop the Keccak round scratch from the context
  
  jackctj117
  authored and
  douzzer
  committed
  517eb2b
- SHA-1 and SHA-256: keep the message schedule on the stack and wipe it per block
  
  jackctj117
  authored and
  douzzer
  committed
  5b9dee9
- ForceZero: escape the buffer through an out-of-line sink instead of volatile stores
  
  jackctj117
  authored and
  douzzer
  committed
  ac30b2b
- SLH-DSA: cast the FORS signature wipe length to size_t
  
  jackctj117
  authored and
  douzzer
  committed
  eae3ac9
- SLH-DSA: compile the secret hash wipe helpers without SHAKE
  
  jackctj117
  authored and
  douzzer
  committed
  be71ea1
- wolfcrypt/src/random.c: harden NextStirPurge() sentinel handling, complete zeroization coverage in wc_RNG_TestSeed() and _InitRng().
  douzzer
  committed
  6199ab1
- wolfssl/wolfcrypt/wc_port.h: add WC_RESTRICT.
  douzzer
  committed
  3e235ae
- ML-DSA: don't destroy an exact-alias source in raw private import
  douzzer
  committed
  166c7c8
- SHA-2: caller-owned transform scratch buffer, wiped once per public call
  douzzer
  committed
  bc84b67
- tests/api/test_frodokem.c: in frodokem_kats[] definition, use WC_STATIC_STRUCT_INITIALIZER, not ad hoc { 0 }, for warning-free build in C++ mode.
  douzzer
  committed
  7889674
- wolfcrypt/src/aes.c, wolfcrypt/src/ed25519.c, wolfcrypt/src/sha.c: zero stack buffers before WOLFSSL_CHECK_MEM_ZERO registration.
  douzzer
  committed
  cf64372
- wolfcrypt/src/sha256.c: use WC_SHA256_TSCRATCH_SIZE. not sizeof(Sha256TScratch), as allocation operand in smallstack wc_Sha{224,256}Copy().
  douzzer
  committed
  1b01509
- wolfcrypt/src/aes.c, wolfcrypt/src/wc_mlkem_poly.c, wolfcrypt/src/wc_frodokem_mat.c: refactor ad-hoc __restrict macros using WC_RESTRICT (no functional changes).
  douzzer
  committed
  2911a85
- mcapi/crypto.h: revert changes (none needed versus the branch base).
  douzzer
  committed
  4ec705f

Commits

Commits on Oct 28, 2026