From 2beb6a8a781bf5426b6f8570a760214dff2ebbfd Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Tue, 3 Nov 2026 16:36:35 +0000 Subject: [PATCH] DTLS 1.3: fix AEAD limits that were half the RFC 9147 values DTLS_AEAD_AES_CCM_LIMIT, DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT and DTLS_AEAD_AES_CCM_8_FAIL_LIMIT were shifted one bit short, giving 2^22, 2^35 and 2^6 instead of 2^23, 2^36 and 2^7. Their key update limits stay at half the hard limit. --- tests/api/test_tls13.c | 22 ++++++++++++++++++++++ wolfssl/internal.h | 14 +++++++------- 2 files changed, 29 insertions(+), 7 deletions(-) diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c index de4322db6c9..c90ee6d4dc7 100644 --- a/tests/api/test_tls13.c +++ b/tests/api/test_tls13.c @@ -13301,6 +13301,28 @@ int test_tls13_AEAD_limit_macros(void) limit = DTLS_AEAD_AES_CCM_FAIL_KU_LIMIT; ExpectIntEQ(w64GetHigh32(limit), 0); ExpectIntEQ(w64GetLow32(limit), 0x005A8279); + + /* RFC 9147 (AES-CCM confidentiality): 2^23 (0x00800000). */ + limit = DTLS_AEAD_AES_CCM_LIMIT; + ExpectIntEQ(w64GetHigh32(limit), 0); + ExpectIntEQ(w64GetLow32(limit), 0x00800000); + + /* RFC 9147 (AES-GCM, ChaCha20-Poly1305 integrity): 2^36, key update at + * 2^35. */ + limit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT; + ExpectIntEQ(w64GetHigh32(limit), 0x10); + ExpectIntEQ(w64GetLow32(limit), 0); + limit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT; + ExpectIntEQ(w64GetHigh32(limit), 0x08); + ExpectIntEQ(w64GetLow32(limit), 0); + + /* RFC 9147 (AES-CCM-8 integrity): 2^7, key update at 2^6. */ + limit = DTLS_AEAD_AES_CCM_8_FAIL_LIMIT; + ExpectIntEQ(w64GetHigh32(limit), 0); + ExpectIntEQ(w64GetLow32(limit), 0x80); + limit = DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT; + ExpectIntEQ(w64GetHigh32(limit), 0); + ExpectIntEQ(w64GetLow32(limit), 0x40); #endif #endif return EXPECT_RESULT(); diff --git a/wolfssl/internal.h b/wolfssl/internal.h index d293decb603..e554cb35411 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -1456,17 +1456,17 @@ enum { * Without the fraction is 23726566 (0x016A09E6) */ #define AEAD_AES_LIMIT w64From32(0, 0x016A09E6) /* Limit is 2^23 - * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits */ -#define DTLS_AEAD_AES_CCM_LIMIT w64From32(0, 1 << 22) + * https://www.rfc-editor.org/rfc/rfc9147.html#name-confidentiality-limits */ +#define DTLS_AEAD_AES_CCM_LIMIT w64From32(0, 1 << 23) -/* Limit is 2^36 +/* Limit is 2^36 (2^4 in the high 32 bits) * https://www.rfc-editor.org/rfc/rfc9147.html#name-aead-limits */ -#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT w64From32(1 << 3, 0) -#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT w64From32(1 << 2, 0) +#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT w64From32(1 << 4, 0) +#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT w64From32(1 << 3, 0) /* Limit is 2^7 * https://www.rfc-editor.org/rfc/rfc9147.html#name-limits-for-aead_aes_128_ccm */ -#define DTLS_AEAD_AES_CCM_8_FAIL_LIMIT w64From32(0, 1 << 6) -#define DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT w64From32(0, 1 << 5) +#define DTLS_AEAD_AES_CCM_8_FAIL_LIMIT w64From32(0, 1 << 7) +#define DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT w64From32(0, 1 << 6) /* Limit is 2^23.5. * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits * Without the fraction is 11863283 (0x00B504F3)