ISO 19790 Zeroization for v7

linuxkm/lkcapi_sha_glue.c

@@ -932,10 +932,20 @@ struct wc_swallow_the_semicolon
  * substantively implemented.
  */
 #ifndef WC_SHA256_W_SIZE
-    #define WC_SHA256_W_SIZE (sizeof(word32) * WC_SHA256_BLOCK_SIZE)
+    #ifdef WC_SHA256_TSCRATCH_SIZE
+        /* The transform reads W as its full caller-owned scratch. */
+        #define WC_SHA256_W_SIZE WC_SHA256_TSCRATCH_SIZE
+    #else /* old FIPS */
+        #define WC_SHA256_W_SIZE (sizeof(word32) * WC_SHA256_BLOCK_SIZE)
+    #endif
 #endif
 #ifndef WC_SHA512_W_SIZE
-    #define WC_SHA512_W_SIZE ((sizeof(word64) * 16) + WC_SHA512_BLOCK_SIZE)
+    #ifdef WC_SHA512_TSCRATCH_SIZE
+        #define WC_SHA512_W_SIZE \
+            (WC_SHA512_TSCRATCH_SIZE + WC_SHA512_BLOCK_SIZE)
+    #else /* old FIPS */
+        #define WC_SHA512_W_SIZE ((sizeof(word64) * 16) + WC_SHA512_BLOCK_SIZE)
+    #endif
 #endif
 
 #define WC_LINUXKM_SHA2_IMPLEMENT(name, s_name, digest_size, block_size,   \

tests/api/test_aes.c

@@ -14667,3 +14667,59 @@ int test_wc_AesEcb_RetCodeChecked(void)
 
 #endif /* WOLF_CRYPTO_CB && !NO_AES && HAVE_AES_ECB && WOLFSSL_AES_128 &&
         * !WOLF_CRYPTO_CB_ONLY_AES && (WOLFSSL_AES_COUNTER || HAVE_AESGCM) */
+
+/* Exercise the portable block primitive's real KEYUSAGE_E path after GCM
+ * setup. No callback or test-only failure hook is needed. */
+int test_wc_AesGcm_PrimitiveFailureCleanup(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(WOLFSSL_AES_128) && \
+    defined(WOLFSSL_NO_ASM) && !defined(WOLF_CRYPTO_CB_ONLY_AES) && \
+    !defined(HAVE_SELFTEST)
+    Aes aes;
+    const byte key[16] = {0};
+    const byte iv[12] = {0};
+    const byte aad[16] = {0};
+    const byte zeros[5 * WC_AES_BLOCK_SIZE] = {0};
+    byte tag[WC_AES_BLOCK_SIZE];
+    int ret;
+#ifdef WOLFSSL_AESGCM_STREAM
+    byte in[17] = {0};
+    byte out[17];
+#endif
+
+    XMEMSET(&aes, 0, sizeof(aes));
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetKey(&aes, key, sizeof(key)), 0);
+    XMEMSET(tag, 0xa5, sizeof(tag));
+    aes.rounds = 0;
+    /* Empty plaintext reaches GHASH before the first AES block operation. */
+    ret = wc_AesGcmEncrypt(&aes, NULL, NULL, 0, iv, sizeof(iv), tag,
+        sizeof(tag), aad, sizeof(aad));
+    if (ret != WC_NO_ERR_TRACE(KEYUSAGE_E)) {
+        wc_AesFree(&aes);
+        return TEST_SKIPPED; /* backend does not use the portable primitive */
+    }
+    ExpectBufEQ(tag, zeros, sizeof(tag));
+#ifdef WOLFSSL_AESGCM_STREAM
+    ExpectIntEQ(wc_AesGcmEncryptInit(&aes, key, sizeof(key), iv, sizeof(iv)), 0);
+    /* Retain fifteen bytes of keystream, then fail generating the next block. */
+    ExpectIntEQ(wc_AesGcmEncryptUpdate(&aes, out, in, 1, NULL, 0), 0);
+    aes.rounds = 0;
+    ExpectIntEQ(wc_AesGcmEncryptUpdate(&aes, out, in, sizeof(in), NULL, 0),
+        WC_NO_ERR_TRACE(KEYUSAGE_E));
+    ExpectBufEQ(aes.streamData, zeros, sizeof(zeros));
+    ExpectIntEQ(aes.nonceSet, 0);
+    ExpectIntEQ(aes.over, 0);
+    /* A failed stream must require reinitialization. */
+    ExpectIntLT(wc_AesGcmEncryptUpdate(&aes, out, in, 1, NULL, 0), 0);
+    ExpectIntEQ(wc_AesGcmEncryptInit(&aes, key, sizeof(key), iv, sizeof(iv)), 0);
+    ExpectIntEQ(wc_AesGcmEncryptUpdate(&aes, out, in, sizeof(in), NULL, 0), 0);
+    ExpectIntEQ(wc_AesGcmEncryptFinal(&aes, tag, sizeof(tag)), 0);
+#endif
+    wc_AesFree(&aes);
+#else
+    return TEST_SKIPPED;
+#endif
+    return EXPECT_RESULT();
+}

tests/api/test_aes.h

@@ -63,6 +63,7 @@ int test_wc_AesGcmStream_MidStreamState(void);
 int test_wc_AesGcmStream_ReinitAfterFinal(void);
 int test_wc_AesGcmStream_BadAuthTag(void);
 int test_wc_AesGcmDecrypt_WipeOnAuthFail(void);
+int test_wc_AesGcm_PrimitiveFailureCleanup(void);
 int test_wc_AesKeyWrapVectors(void);
 int test_wc_AesKeyWrapDecisionCoverage(void);
 int test_wc_AesGcmDecisionCoverage(void);
@@ -241,6 +242,7 @@ int test_wc_CryptoCb_AesDirect(void);
     TEST_DECL_GROUP("aes", test_wc_AesGcmStream_ReinitAfterFinal), \
     TEST_DECL_GROUP("aes", test_wc_AesGcmStream_BadAuthTag),       \
     TEST_DECL_GROUP("aes", test_wc_AesGcmDecrypt_WipeOnAuthFail),    \
+    TEST_DECL_GROUP("aes", test_wc_AesGcm_PrimitiveFailureCleanup),  \
     TEST_DECL_GROUP("aes", test_wc_AesKeyWrapVectors),          \
     TEST_DECL_GROUP("aes", test_wc_AesKeyWrapDecisionCoverage), \
     TEST_DECL_GROUP("aes", test_wc_AesGcmDecisionCoverage),     \

tests/api/test_ecc.c

@@ -1419,6 +1419,25 @@ int test_wc_ecc_import_private_key(void)
         x963KeySz, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     ExpectIntEQ(wc_ecc_import_private_key(NULL, privKeySz, x963Key, x963KeySz,
         &keyImp), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#if (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && \
+    !defined(HAVE_SELFTEST) && !defined(WOLFSSL_CRYPTOCELL) && \
+    !defined(WOLFSSL_SE050) && !defined(WOLFSSL_SILABS_SE_ACCEL) && \
+    !defined(WOLFSSL_KCAPI_ECC) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
+    !(defined(WOLF_CRYPTO_CB_SETKEY) && defined(WOLF_CRYPTO_CB_FIND))
+    /* Rejecting a private scalar must also revoke private-key capability.
+     * The device set-key path imports into a temporary key first, so a
+     * rejected scalar never touches this key and its type stays as it was.
+     * Use a fresh key: importing over a live one is not a supported path. */
+    wc_ecc_free(&keyImp);
+    ExpectIntEQ(wc_ecc_init(&keyImp), 0);
+    XMEMSET(privKey, 0, privKeySz);
+    ExpectIntEQ(wc_ecc_import_private_key(privKey, privKeySz, x963Key,
+        x963KeySz, &keyImp), WC_NO_ERR_TRACE(ECC_PRIV_KEY_E));
+    ExpectIntEQ(keyImp.type, ECC_PUBLICKEY);
+    ExpectIntEQ(wc_ecc_import_private_key(privKey, privKeySz, NULL, 0,
+        &keyImp), WC_NO_ERR_TRACE(ECC_PRIV_KEY_E));
+    ExpectIntEQ(keyImp.type, 0);
+#endif
     PRIVATE_KEY_LOCK();
 
     DoExpectIntEQ(wc_FreeRng(&rng), 0);

tests/api/test_frodokem.c

@@ -742,7 +742,7 @@ static const FrodoKemKat frodokem_kats[] = {
     FKAT_640_AES FKAT_976_AES FKAT_1344_AES
     FKAT_E640_SHAKE FKAT_E976_SHAKE FKAT_E1344_SHAKE
     FKAT_E640_AES FKAT_E976_AES FKAT_E1344_AES
-    { 0 } /* sentinel so the array is never empty */
+    WC_STATIC_STRUCT_INITIALIZER /* sentinel so the array is never empty */
 };
 
 #define FRODOKEM_KAT_CNT \

tests/api/test_kdf.c

@@ -929,3 +929,89 @@ int test_wc_KdfFeatureCoverage(void)
 #endif /* !HAVE_FIPS && !HAVE_SELFTEST */
     return EXPECT_RESULT();
 } /* END test_wc_KdfFeatureCoverage */
+
+/* RFC 4253 section 7.2 fixtures computed independently with Python hashlib:
+ * K = a5 * 32 (positive mpint with a leading zero), H = 39 * 32,
+ * session_id = 17 * 32, key ID = A. K1 = HASH(mpint(K)||H||A||session_id),
+ * Kn = HASH(mpint(K)||H||K1||...||K(n-1)). The 133-byte output exercises
+ * repeated Final/reuse and the partial last block for every supported hash.
+ */
+int test_wc_SshKdfReuse(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_WOLFSSH) && !defined(NO_HMAC)
+    static const struct {
+        byte hashId;
+        const char* expected;
+    } vectors[] = {
+#if !defined(NO_SHA)
+        { WC_SHA,
+            "\x1c\x9f\x61\x4a\x3b\xa5\x27\x49\x39\xc0\x53\x1d\x22\xe5\xf3\xa2"
+            "\xe4\x07\xd3\x28\x19\xe0\xc7\xa4\x82\x83\x16\x15\x5c\x0c\x31\xe5"
+            "\x78\xe4\xe8\x24\x70\x0e\xf8\x66\xe2\x66\x9b\x3a\xac\x26\xa1\x2c"
+            "\xd4\x5e\xb7\x58\xeb\xbf\xaf\x6f\xb9\x09\xa2\x25\xe8\xf9\x3c\x1f"
+            "\x23\x3c\x08\xfc\x4e\x78\x5c\x35\x10\x51\x4c\x0a\x6e\x85\xf5\x94"
+            "\xcc\xaf\x3d\xf8\xb5\x61\x79\xd4\x3c\x9e\x3c\x18\xa0\x19\x55\x54"
+            "\xce\x85\x86\xbc\x6e\x74\x30\x4a\xf6\x00\x5a\x08\x15\x70\xeb\x35"
+            "\xb1\x20\xc4\xca\xd7\xc3\x66\xe9\xe0\x83\x38\x61\x34\x39\x36\x2a"
+            "\xda\xaa\x28\xbb\x22"
+        },
+#endif
+#if !defined(NO_SHA256)
+        { WC_SHA256,
+            "\x34\xb2\x16\x40\xeb\x59\x97\x50\x70\x19\x97\x5c\x8c\xc0\x0c\xfb"
+            "\x1a\xef\x39\xcc\x7a\x25\x8a\x6c\x33\xb0\x7b\xe4\xe9\x0f\x81\xfa"
+            "\x20\xed\x94\xb1\xe1\x26\x97\x58\x1d\xe8\x94\x04\xb9\x7e\x52\x03"
+            "\x79\x8a\xf1\x91\x38\x62\x15\x65\xd2\x5e\x9e\xa7\x96\x70\x51\x75"
+            "\x3d\x8a\x11\x41\x77\xdd\x7a\x33\x32\x12\x78\x69\xcd\xfc\x69\x55"
+            "\xed\xa9\xdd\x87\xea\xef\xe1\x0b\x28\xb6\x71\x72\xdb\xc8\x9d\x08"
+            "\x45\xbc\x2d\x85\x9c\x4c\xa0\x33\x80\x99\xcc\x1f\x9f\x23\x82\x68"
+            "\x32\xbf\xad\x27\x1d\x0c\xfe\x43\xa4\xf9\xbc\xb6\xd6\xee\x6a\x70"
+            "\xf9\xdf\x8f\xa1\xe3"
+        },
+#endif
+#if defined(WOLFSSL_SHA384)
+        { WC_SHA384,
+            "\x82\x6a\xb6\x8b\x6d\x81\x42\xa2\x85\x12\x32\x61\x8c\xaf\xf4\x3b"
+            "\xad\xad\x88\x2d\x7f\x9d\xea\x63\x75\x40\x66\xe9\x9f\xb3\x42\x1e"
+            "\x26\x30\x4e\xb2\x99\xda\xe3\x56\x2e\x5a\xde\x44\xc7\x8d\x3d\x59"
+            "\x45\xf9\xe1\x5c\xe8\x8b\x01\x55\xc9\x87\xb7\x95\x74\x32\x9b\xe8"
+            "\xcc\x12\x69\x25\xba\x88\x43\x5f\x27\x78\xc3\x35\x18\x6e\x3d\x32"
+            "\x36\x74\xa0\x44\xd8\x84\xb6\x2a\x1b\xdf\x01\x23\x7f\x62\x38\xb8"
+            "\xca\x9e\x55\x08\xf6\x3b\x60\xce\x1b\x2b\xe1\x0c\xdb\x15\x90\x54"
+            "\x16\x3b\x04\xbb\x71\x98\x6d\x20\xc9\x9e\xd6\x3b\xf2\xd1\x8f\xf4"
+            "\xbb\x0d\xaf\x6a\xf1"
+        },
+#endif
+#if defined(WOLFSSL_SHA512)
+        { WC_SHA512,
+            "\xb9\xcb\x49\xf0\x5f\xac\x25\xca\x6d\x9a\xfa\x68\x87\x57\xa2\x17"
+            "\x2a\x61\xcc\x56\xea\x71\x0f\xef\x07\xac\xb1\x7e\x7e\xaf\x54\x8f"
+            "\x15\x3b\x12\x9f\xbd\x6f\x79\xc9\x89\x14\xe6\x40\x43\x07\x27\x01"
+            "\x93\x1d\xda\xc8\x4b\x8b\xeb\xdf\x6a\xa3\xf8\xed\x8a\x8d\x9d\x49"
+            "\xc4\x5d\x90\xdd\x56\xd3\x64\x83\x5a\x63\x47\x3a\x69\xf9\x11\xaf"
+            "\x50\x7f\x3b\x18\xbc\x37\xec\xf9\xdd\xad\x98\x80\xab\x58\xb5\xd3"
+            "\x72\x6e\x2c\xce\xae\x7f\xde\x5e\x4f\xb9\xf5\x57\x5a\x65\x2d\x88"
+            "\xb0\xc8\xc9\x74\x9e\x75\xec\x51\xb9\x23\x64\x26\xb8\x7c\x05\x74"
+            "\xa2\xe7\x3d\x30\xf8"
+        },
+#endif
+        { 0, NULL }
+    };
+    static const word32 lengths[] = { 1, 32, 64, 96, 128, 133 };
+    byte k[32], h[32], sessionId[32], key[133];
+    word32 i, j;
+
+    XMEMSET(k, 0xa5, sizeof(k));
+    XMEMSET(h, 0x39, sizeof(h));
+    XMEMSET(sessionId, 0x17, sizeof(sessionId));
+    for (i = 0; vectors[i].expected != NULL; i++) {
+        for (j = 0; j < sizeof(lengths) / sizeof(lengths[0]); j++) {
+            ExpectIntEQ(wc_SSH_KDF(vectors[i].hashId, 'A', key, lengths[j],
+                k, sizeof(k), h, sizeof(h), sessionId, sizeof(sessionId)), 0);
+            ExpectBufEQ(key, vectors[i].expected, lengths[j]);
+        }
+    }
+#endif
+    return EXPECT_RESULT();
+}

tests/api/test_kdf.h

@@ -26,9 +26,11 @@
 
 int test_wc_KdfDecisionCoverage(void);
 int test_wc_KdfFeatureCoverage(void);
+int test_wc_SshKdfReuse(void);
 
 #define TEST_KDF_DECLS                                       \
     TEST_DECL_GROUP("kdf", test_wc_KdfDecisionCoverage),      \
-    TEST_DECL_GROUP("kdf", test_wc_KdfFeatureCoverage)
+    TEST_DECL_GROUP("kdf", test_wc_KdfFeatureCoverage),     \
+    TEST_DECL_GROUP("kdf", test_wc_SshKdfReuse)
 
 #endif /* WOLFCRYPT_TEST_KDF_H */

tests/api/test_mlkem.c

@@ -5599,3 +5599,81 @@ int test_wc_mlkem_make_key_id_dev(void)
 #endif
     return EXPECT_RESULT();
 }
+
+/* FIPS 203 3.3: retain the key and designated output, but no hash or PRF
+ * intermediates, when a complete ML-KEM operation returns. */
+int test_wc_mlkem_operation_cleanup(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_MLKEM) && defined(WC_MLKEM_HAVE_NATIVE) && \
+    !defined(WOLFSSL_NO_ML_KEM) && !defined(PSOC6_HASH_SHA3) && \
+    !defined(WOLFSSL_MLKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_MLKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_MLKEM_NO_DECAPSULATE)
+    static const int types[] = {
+#ifndef WOLFSSL_NO_ML_KEM_512
+        WC_ML_KEM_512,
+#endif
+#ifndef WOLFSSL_NO_ML_KEM_768
+        WC_ML_KEM_768,
+#endif
+#ifndef WOLFSSL_NO_ML_KEM_1024
+        WC_ML_KEM_1024,
+#endif
+        -1
+    };
+    static const byte zero[sizeof(wc_Sha3)] = {0};
+    MlKemKey* key = NULL;
+    byte seeds[WC_ML_KEM_MAKEKEY_RAND_SZ];
+    byte ct[WC_ML_KEM_MAX_CIPHER_TEXT_SIZE];
+    byte ss[WC_ML_KEM_SS_SZ];
+    byte recovered[WC_ML_KEM_SS_SZ];
+    word32 ctSz = 0;
+    int t, repeat, op, h;
+
+    key = (MlKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    XMEMSET(seeds, 0x71, sizeof(seeds));
+    PRIVATE_KEY_UNLOCK();
+    for (t = 0; EXPECT_SUCCESS() && types[t] != -1; t++) {
+        ExpectIntEQ(wc_MlKemKey_Init(key, types[t], NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_MlKemKey_CipherTextSize(key, &ctSz), 0);
+        for (repeat = 0; EXPECT_SUCCESS() && repeat < 2; repeat++) {
+            for (op = 0; EXPECT_SUCCESS() && op < 5; op++) {
+                if (op == 0) {
+                    ExpectIntEQ(wc_MlKemKey_MakeKeyWithRandom(key, seeds,
+                        sizeof(seeds)), SEED_OK);
+                }
+                else if (op == 1) {
+                    ExpectIntEQ(wc_MlKemKey_EncapsulateWithRandom(key, ct, ss,
+                        seeds, WC_ML_KEM_ENC_RAND_SZ), SEED_OK);
+                }
+                else if (op == 2) {
+                    ExpectIntEQ(wc_MlKemKey_Decapsulate(key, recovered, ct,
+                        ctSz), 0);
+                    ExpectBufEQ(ss, recovered, sizeof(ss));
+                }
+                else if (op == 3) {
+                    ExpectIntEQ(wc_MlKemKey_Decapsulate(key, recovered, ct,
+                        ctSz - 1), WC_NO_ERR_TRACE(BUFFER_E));
+                }
+                else {
+                    ct[32] ^= 1;
+                    ExpectIntEQ(wc_MlKemKey_Decapsulate(key, recovered, ct,
+                        ctSz), 0);
+                }
+                for (h = 0; h < 2; h++) {
+                    const wc_Sha3* hash = h == 0 ? &key->hash : &key->prf;
+                    ExpectBufEQ(hash->s, zero, sizeof(hash->s));
+                    ExpectBufEQ(hash->t, zero, sizeof(hash->t));
+                    ExpectIntEQ(hash->i, 0);
+                }
+            }
+        }
+        wc_MlKemKey_Free(key);
+    }
+    PRIVATE_KEY_LOCK();
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}

tests/api/test_mlkem.h

@@ -45,6 +45,7 @@ int test_wc_mlkem_decode_pubkey_refused_save(void);
 int test_wc_mlkem_decode_reused_key(void);
 int test_wc_mlkem_decode_alloc_fail(void);
 int test_wc_mlkem_make_key_id_dev(void);
+int test_wc_mlkem_operation_cleanup(void);
 
 #define TEST_MLKEM_DECLS                                                \
     TEST_DECL_GROUP("mlkem", test_wc_mlkem_make_key_kats),              \
@@ -67,6 +68,7 @@ int test_wc_mlkem_make_key_id_dev(void);
     TEST_DECL_GROUP("mlkem", test_wc_mlkem_decode_pubkey_refused_save), \
     TEST_DECL_GROUP("mlkem", test_wc_mlkem_decode_reused_key), \
     TEST_DECL_GROUP("mlkem", test_wc_mlkem_decode_alloc_fail), \
-    TEST_DECL_GROUP("mlkem", test_wc_mlkem_make_key_id_dev)
+    TEST_DECL_GROUP("mlkem", test_wc_mlkem_make_key_id_dev), \
+    TEST_DECL_GROUP("mlkem", test_wc_mlkem_operation_cleanup)
 
 #endif /* WOLFCRYPT_TEST_MLKEM_H */