From 6b79b5b11ed76f8cea44afb222163732e0831cab Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Fri, 30 Oct 2026 13:46:26 +1000 Subject: [PATCH] Fix build and test failures found by regression testing NO_AES_DECRYPT: - benchmark.c: bench_aesccm_internal() - mark decLabel as used when AES decrypt is not compiled in. - test.c: aes_no_key_set_test() - only call wc_AesGcmDecrypt() when HAVE_AES_DECRYPT is defined. TLS 1.3 only, client only and server only builds: - internal.c: ReuseKey() - certificate callers need the client or client authentication compiled in; fixes unused function. - test_tls_parse.c: guard the KeyShare tests on !NO_WOLFSSL_CLIENT, the ALPN request direction on !NO_WOLFSSL_SERVER and the PointFormat blocks using a TLS 1.2 server on !WOLFSSL_NO_TLS12. - test_tls_bounds.c: TEST_TLS_BOUNDS_CSR2_REQUESTS requires a client. NO_ASN_TIME: - rng_bank.c: XTIME is not available. Use XTIME when defined, otherwise count retries, with WC_RNG_BANK_NO_CLOCK_RETRIES_PER_SEC (default 1000) retries treated as one second, so a positive timeout still bounds the retry loops. - api.c, test_ssl_cert.c: NO_ASN_TIME implies NO_SESSION_CACHE; guard wolfSSL_SessionIsSetup() and wolfSSL_SESSION_get0_peer() uses. - test_dtls13.c: disable test_dtls13_plaintext_ack_during_handshake as DTLS 1.3 retransmissions are not rate limited without a clock. sp_int.c: _sp_mul_{32,48,64,96}() and _sp_sqr_{32,48,64,96}() (built with WOLFSSL_SP_INT_LARGE_COMBA, e.g. --enable-sp-math-all=huge) computed z1 = z1 - z0 - z2 keeping the borrow from the previous word only in the low word. The plain C add of z1->dp[i] could then drop the borrow, making the product 2^(64*k) too big. Found by the 2048-bit exptmod test added to mp_test(). Add z1->dp[i] with SP_ASM_ADDC and sign-extend the borrow into the high word. test_tls_parse.c: test_TLSX_KeyShare_process() - ctx and ssl are unused when none of X25519, ECC and FFDHE are compiled in (e.g. RSA + curve448 only). --- src/internal.c | 6 +++- tests/api.c | 2 ++ tests/api/test_dtls13.c | 5 +++- tests/api/test_ssl_cert.c | 5 +++- tests/api/test_tls_bounds.c | 3 +- tests/api/test_tls_parse.c | 19 +++++++----- wolfcrypt/benchmark/benchmark.c | 4 ++- wolfcrypt/src/rng_bank.c | 45 ++++++++++++++++++---------- wolfcrypt/src/sp_int.c | 52 ++++++++++++++++++++------------- wolfcrypt/test/test.c | 2 ++ 10 files changed, 94 insertions(+), 49 deletions(-) diff --git a/src/internal.c b/src/internal.c index 1f62c435246..ac6324a60ae 100644 --- a/src/internal.c +++ b/src/internal.c @@ -9955,7 +9955,11 @@ int AllocKey(WOLFSSL* ssl, int type, void** pKey) return ret; } -#if (!defined(NO_CERTS) || !defined(WOLFSSL_NO_TLS12)) && \ +/* Callers: ProcessPeerCerts() (client, or server verifying client certs) and + * the TLS 1.2 key exchange peer keys. */ +#if ((!defined(NO_CERTS) && \ + (!defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH))) || \ + !defined(WOLFSSL_NO_TLS12)) && \ (!defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \ defined(HAVE_CURVE25519) || defined(HAVE_ED448) || \ defined(HAVE_CURVE448) || defined(HAVE_FALCON) || \ diff --git a/tests/api.c b/tests/api.c index 3874969255e..dbd3cf56ca8 100644 --- a/tests/api.c +++ b/tests/api.c @@ -19271,7 +19271,9 @@ static int test_wolfSSL_Tls13_ECH_tls12_downgrade(void) #endif /* session ID and ticket from the rejected connection are ignored */ +#ifndef NO_SESSION_CACHE ExpectIntEQ(wolfSSL_SessionIsSetup(test_ctx.c_ssl->session), 0); +#endif #if defined(HAVE_SESSION_TICKET) && !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) ExpectIntEQ(test_ctx.c_ssl->msgsReceived.got_session_ticket, 1); ExpectIntEQ(wolfSSL_get_SessionTicket(test_ctx.c_ssl, NULL, &ticketLen), diff --git a/tests/api/test_dtls13.c b/tests/api/test_dtls13.c index 240080bcfab..f377fb5c5bd 100644 --- a/tests/api/test_dtls13.c +++ b/tests/api/test_dtls13.c @@ -2615,7 +2615,10 @@ int test_dtls13_plaintext_ack_after_handshake(void) int test_dtls13_plaintext_ack_during_handshake(void) { EXPECT_DECLS; -#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13) +/* Without a clock (NO_ASN_TIME) retransmissions are not rate limited, so the + * server flight is resent at points this sequence does not expect. */ +#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13) && \ + !defined(NO_ASN_TIME) struct test_memio_ctx test_ctx; WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; WOLFSSL *ssl_c = NULL, *ssl_s = NULL; diff --git a/tests/api/test_ssl_cert.c b/tests/api/test_ssl_cert.c index 51d37f9001c..e07fa99e356 100644 --- a/tests/api/test_ssl_cert.c +++ b/tests/api/test_ssl_cert.c @@ -4059,11 +4059,13 @@ static int test_chain_holds_only_peer(WOLFSSL* ssl) (XMEMCMP(der, wolfSSL_get_chain_cert(chain, 0), (size_t)derSz) == 0); } +#ifndef NO_SESSION_CACHE /* Before the stack: building it on a server replaces the session peer. */ if (ret) { ret = test_chain_x509_is(wolfSSL_SESSION_get0_peer(ssl->session), der, derSz); } +#endif if (ret && (ssl->options.side == WOLFSSL_CLIENT_END)) { ret = test_chain_x509_is(wolfSSL_sk_X509_value( wolfSSL_get_peer_cert_chain(ssl), 0), der, derSz); @@ -4251,7 +4253,8 @@ int test_wolfSSL_SESSION_get0_peer_full_chain(void) { EXPECT_DECLS; #if defined(OPENSSL_EXTRA) && defined(SESSION_CERTS) && \ - defined(USE_CERT_BUFFERS_2048) && !defined(NO_RSA) + defined(USE_CERT_BUFFERS_2048) && !defined(NO_RSA) && \ + !defined(NO_SESSION_CACHE) WOLFSSL_SESSION* sess = NULL; WOLFSSL_X509* peer = NULL; const byte* der = NULL; diff --git a/tests/api/test_tls_bounds.c b/tests/api/test_tls_bounds.c index b4720b23f47..86fc1f98c0f 100644 --- a/tests/api/test_tls_bounds.c +++ b/tests/api/test_tls_bounds.c @@ -31,7 +31,8 @@ * fixture plus the test(s) that use it, so the condition is written once * and the region and the in-body guard cannot drift apart. */ #if defined(WOLFSSL_TEST_STATIC_BUILD) && \ - defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && !defined(NO_CERTS) + defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && !defined(NO_CERTS) && \ + !defined(NO_WOLFSSL_CLIENT) #define TEST_TLS_BOUNDS_CSR2_REQUESTS #endif #if defined(WOLFSSL_TEST_STATIC_BUILD) && defined(WOLFSSL_TLS13) && \ diff --git a/tests/api/test_tls_parse.c b/tests/api/test_tls_parse.c index 0a6541c5057..f25310a6ae9 100644 --- a/tests/api/test_tls_parse.c +++ b/tests/api/test_tls_parse.c @@ -443,6 +443,7 @@ int test_TLSX_ALPN_parse(void) wolfSSL_CTX_free(ctx); ctx = NULL; +#ifndef NO_WOLFSSL_SERVER /* Request direction: server parses and stores a client_hello ALPN * list. Exercises TLSX_ALPN_ParseAndSet()'s length bookkeeping (shared * with the response direction) on the request side, including the @@ -503,6 +504,7 @@ int test_TLSX_ALPN_parse(void) ssl = NULL; wolfSSL_CTX_free(ctx); ctx = NULL; +#endif /* !NO_WOLFSSL_SERVER */ #endif return EXPECT_RESULT(); } @@ -1572,9 +1574,8 @@ int test_TLSX_PointFormat_parse(void) (defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && \ !defined(WOLFSSL_NO_SERVER_GROUPS_EXT) && !defined(NO_TLS) && \ !defined(NO_WOLFSSL_SERVER) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - (!defined(NO_RSA) || defined(HAVE_ECC)) && \ - ((!defined(NO_DH) && !defined(WOLFSSL_NO_TLS12)) || \ - defined(HAVE_CURVE25519))) + (!defined(NO_RSA) || defined(HAVE_ECC)) && !defined(WOLFSSL_NO_TLS12) && \ + (!defined(NO_DH) || defined(HAVE_CURVE25519))) byte ext[16]; word16 extLen; #endif @@ -1618,7 +1619,7 @@ int test_TLSX_PointFormat_parse(void) #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && \ !defined(WOLFSSL_NO_SERVER_GROUPS_EXT) && !defined(NO_TLS) && \ !defined(NO_WOLFSSL_SERVER) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - (!defined(NO_RSA) || defined(HAVE_ECC)) + (!defined(NO_RSA) || defined(HAVE_ECC)) && !defined(WOLFSSL_NO_TLS12) /* TLSX_SupportedCurve_Preferred(): checkSupported gating and the * TLSX_IsGroupSupported() result, driven by a raw (unfiltered) offered * groups list -- TLSX_SupportedCurve_Parse() records whatever the peer @@ -1686,7 +1687,7 @@ int test_TLSX_PointFormat_parse(void) #if defined(HAVE_SUPPORTED_CURVES) && !defined(NO_TLS) && \ !defined(NO_WOLFSSL_SERVER) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - (!defined(NO_RSA) || defined(HAVE_ECC)) + (!defined(NO_RSA) || defined(HAVE_ECC)) && !defined(WOLFSSL_NO_TLS12) /* TLSX_PointFormat_ValidateResponse(): reached while sizing/writing a * ServerHello, through the WOLFSSL_LOCAL TLSX_GetResponseSize() rather * than TLSX_Parse() (there is no wire input on this side). A cipher @@ -2658,7 +2659,7 @@ int test_TLSX_KeyShare_gen(void) { EXPECT_DECLS; #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - defined(HAVE_TLS_EXTENSIONS) && \ + defined(HAVE_TLS_EXTENSIONS) && !defined(NO_WOLFSSL_CLIENT) && \ defined(USE_WOLFSSL_MEMORY) WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; @@ -2972,7 +2973,7 @@ int test_TLSX_KeyShare_freesizewrite(void) { EXPECT_DECLS; #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && !defined(NO_DH) && defined(HAVE_FFDHE_2048) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - defined(HAVE_TLS_EXTENSIONS) + defined(HAVE_TLS_EXTENSIONS) && !defined(NO_WOLFSSL_CLIENT) WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; @@ -3128,7 +3129,7 @@ int test_TLSX_KeyShare_process(void) { EXPECT_DECLS; #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && defined(WOLFSSL_TEST_STATIC_BUILD) && \ - defined(HAVE_TLS_EXTENSIONS) + defined(HAVE_TLS_EXTENSIONS) && !defined(NO_WOLFSSL_CLIENT) WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; @@ -3436,6 +3437,8 @@ int test_TLSX_KeyShare_process(void) wolfSSL_CTX_free(ctx); ctx = NULL; #endif /* !NO_DH && HAVE_FFDHE_2048 */ + (void)ctx; + (void)ssl; #endif return EXPECT_RESULT(); } diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 0833afb7921..87fd83daf1b 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -7365,7 +7365,9 @@ static void bench_aesccm_internal(int useDeviceID, word32 nonceSz, printf("wc_AesCcmEncrypt failed, ret = %d\n", ret); goto exit; } -#endif +#endif /* HAVE_AES_DECRYPT */ + + (void)decLabel; exit: diff --git a/wolfcrypt/src/rng_bank.c b/wolfcrypt/src/rng_bank.c index 4ce65e8237a..4901857162b 100644 --- a/wolfcrypt/src/rng_bank.c +++ b/wolfcrypt/src/rng_bank.c @@ -26,6 +26,25 @@ #include #include +/* Retry timeouts. WC_RNG_BANK_TS_START() is taken before a retry loop and + * WC_RNG_BANK_TS_ELAPSED() is checked once per retry and compared against + * timeout_secs. Without a wall clock (no XTIME, e.g. NO_ASN_TIME) each check + * instead counts one retry, and WC_RNG_BANK_NO_CLOCK_RETRIES_PER_SEC retries + * stand in for a second, so a positive timeout_secs still bounds the loop. + * USER_TIME declares XTIME as a function rather than defining a macro. + */ +#if defined(XTIME) || (defined(USER_TIME) && !defined(NO_ASN_TIME)) + #define WC_RNG_BANK_TS_START() XTIME(0) + #define WC_RNG_BANK_TS_ELAPSED(ts1) (XTIME(0) - (ts1)) +#else + #ifndef WC_RNG_BANK_NO_CLOCK_RETRIES_PER_SEC + #define WC_RNG_BANK_NO_CLOCK_RETRIES_PER_SEC 1000 + #endif + #define WC_RNG_BANK_TS_START() 0 + #define WC_RNG_BANK_TS_ELAPSED(ts1) \ + (++(ts1) / WC_RNG_BANK_NO_CLOCK_RETRIES_PER_SEC) +#endif + #ifndef WC_RNG_HAVE_LOCK /* feature-gap helper declarations */ static int wc_rng_bank_inst_recovery_enter( @@ -205,10 +224,9 @@ WOLFSSL_API int wc_rng_bank_init_nonce( #ifdef WC_VERBOSE_RNG int nretries = 0; #endif - time_t ts1 = XTIME(0); + time_t ts1 = WC_RNG_BANK_TS_START(); rng_inst->bank = ctx; for (;;) { - time_t ts2; if (flags & WC_RNG_BANK_FLAG_NO_VECTOR_OPS) need_reenable_vec = (DISABLE_VECTOR_REGISTERS() == 0); @@ -264,8 +282,8 @@ WOLFSSL_API int wc_rng_bank_init_nonce( ret = WC_CHECK_FOR_INTR_SIGNALS(); if (ret == WC_NO_ERR_TRACE(INTERRUPTED_E)) break; - ts2 = XTIME(0); - if ((timeout_secs > 0) && (ts2 - ts1 > timeout_secs)) { + if ((timeout_secs > 0) && + (WC_RNG_BANK_TS_ELAPSED(ts1) > timeout_secs)) { ret = WC_TIMEOUT_E; break; } @@ -781,7 +799,7 @@ WOLFSSL_API int wc_rng_bank_checkout( { WC_RNG_lock_arg_t lock_extra_bits = 0; int ret = 0; - time_t ts1, ts2; + time_t ts1; int n_rngs_tried = 0; int diverted_unusable = 0; WC_ATOMIC_INT_ARG new_refcount; @@ -874,7 +892,7 @@ WOLFSSL_API int wc_rng_bank_checkout( } if ((timeout_secs > 0) && (flags & WC_RNG_BANK_FLAG_CAN_WAIT)) - ts1 = XTIME(0); + ts1 = WC_RNG_BANK_TS_START(); else ts1 = 0; /* mollify -Wmaybe-uninitialized... */ @@ -1275,8 +1293,7 @@ WOLFSSL_API int wc_rng_bank_checkout( break; if (timeout_secs > 0) { - ts2 = XTIME(0); - if (ts2 - ts1 >= timeout_secs) { + if (WC_RNG_BANK_TS_ELAPSED(ts1) >= timeout_secs) { ret = WC_TIMEOUT_E; break; } @@ -2077,7 +2094,7 @@ WOLFSSL_API int wc_rng_bank_inst_reinit( * it is a safe no-op when called on an already-freed instance. */ if ((timeout_secs > 0) && (flags & WC_RNG_BANK_FLAG_CAN_WAIT)) - ts1 = XTIME(0); + ts1 = WC_RNG_BANK_TS_START(); #if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLF_CRYPTO_CB) devId = rng_inst->rng.devId; @@ -2264,8 +2281,7 @@ WOLFSSL_API int wc_rng_bank_inst_reinit( } if (timeout_secs > 0) { - time_t ts2 = XTIME(0); - if (ts2 - ts1 >= timeout_secs) { + if (WC_RNG_BANK_TS_ELAPSED(ts1) >= timeout_secs) { #ifdef WC_VERBOSE_RNG if (! (bank->flags & WC_RNG_BANK_FLAG_QUIET)) WOLFSSL_DEBUG_PRINTF( @@ -2759,7 +2775,7 @@ WOLFSSL_API int wc_rng_bank_reseed_range(struct wc_rng_bank *bank, #endif if ((timeout_secs > 0) && (flags & WC_RNG_BANK_FLAG_CAN_WAIT)) - ts1 = XTIME(0); + ts1 = WC_RNG_BANK_TS_START(); for (n = last_inst; n >= first_inst; --n) { struct wc_rng_bank_inst *drbg; @@ -2792,8 +2808,6 @@ WOLFSSL_API int wc_rng_bank_reseed_range(struct wc_rng_bank *bank, if (flags & WC_RNG_BANK_FLAG_CAN_WAIT) { for (;;) { - time_t ts2; - #ifndef WC_RNG_HAVE_LOCK /* the pre-lock boundary can't see the inst-side latch: * mirror the in-boundary _RECOVERING protocol around the @@ -2888,8 +2902,7 @@ WOLFSSL_API int wc_rng_bank_reseed_range(struct wc_rng_bank *bank, if (timeout_secs == 0) break; if (timeout_secs > 0) { - ts2 = XTIME(0); - if ((ts2 - ts1 > timeout_secs) && + if ((WC_RNG_BANK_TS_ELAPSED(ts1) > timeout_secs) && !((flags | bank->flags) & WC_RNG_BANK_FLAG_QUIET)) { #ifdef WC_VERBOSE_RNG diff --git a/wolfcrypt/src/sp_int.c b/wolfcrypt/src/sp_int.c index d6a4bebd4e1..ab1c4d72042 100644 --- a/wolfcrypt/src/sp_int.c +++ b/wolfcrypt/src/sp_int.c @@ -11603,12 +11603,13 @@ static int _sp_mul_32(const sp_int* a, const sp_int* b, sp_int* r) l = 0; h = 0; for (i = 0; i < 32; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 16 */ @@ -11769,12 +11770,13 @@ static int _sp_mul_48(const sp_int* a, const sp_int* b, sp_int* r) l = 0; h = 0; for (i = 0; i < 48; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 24 */ @@ -11935,12 +11937,13 @@ static int _sp_mul_64(const sp_int* a, const sp_int* b, sp_int* r) l = 0; h = 0; for (i = 0; i < 64; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 32 */ @@ -12101,12 +12104,13 @@ static int _sp_mul_96(const sp_int* a, const sp_int* b, sp_int* r) l = 0; h = 0; for (i = 0; i < 96; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 48 */ @@ -16919,14 +16923,16 @@ static int _sp_sqr_32(const sp_int* a, sp_int* r) SP_ASM_SUBB(l, h, z2->dp[0]); z1->dp[0] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); for (i = 1; i < 32; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 16 */ @@ -17058,14 +17064,16 @@ static int _sp_sqr_48(const sp_int* a, sp_int* r) SP_ASM_SUBB(l, h, z2->dp[0]); z1->dp[0] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); for (i = 1; i < 48; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 24 */ @@ -17197,14 +17205,16 @@ static int _sp_sqr_64(const sp_int* a, sp_int* r) SP_ASM_SUBB(l, h, z2->dp[0]); z1->dp[0] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); for (i = 1; i < 64; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 32 */ @@ -17336,14 +17346,16 @@ static int _sp_sqr_96(const sp_int* a, sp_int* r) SP_ASM_SUBB(l, h, z2->dp[0]); z1->dp[0] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); for (i = 1; i < 96; i++) { - l += z1->dp[i]; + SP_ASM_ADDC(l, h, z1->dp[i]); SP_ASM_SUBB(l, h, z0->dp[i]); SP_ASM_SUBB(l, h, z2->dp[i]); z1->dp[i] = l; l = h; - h = 0; + /* Sign extend borrow into high word. */ + h = (sp_int_digit)0 - (l >> (SP_WORD_SIZE - 1)); } z1->dp[i] += l; /* r += z1 << 48 */ diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 8f9cd7acda9..45d757b3e35 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -19412,10 +19412,12 @@ static wc_test_ret_t aes_no_key_set_test(void) if (wc_AesGcmEncrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, sizeof(iv), tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); +#ifdef HAVE_AES_DECRYPT if (wc_AesGcmDecrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, sizeof(iv), tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); #endif +#endif #ifdef HAVE_AESCCM if (wc_AesCcmEncrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, 13,