Pq fips fenrir - #11359
Open
jackctj117 wants to merge 12 commits into
Open
Conversation
…since FIPS 198-1 Section 4 folds them to K0 = H(K) but they fall outside the module's CAVP-tested key range (Fenrir F-9546).
…elow 224 bits under FIPS v7 per SP 800-131A Rev. 2 Table 2, leaving signature verification with those curves available as legacy use (Fenrir F-7359).
…lidated curves P-256, P-384 and P-521 ahead of every crypto-callback and hardware dispatch (Fenrir F-9544).
… the caller's bytes as additional_input under FIPS v7, because SP 800-90A Rev. 1 Section 9.2 forbids consuming-application entropy input (Fenrir F-9547).
…tyle test vectors and keep them covered through the wc_HmacSetKey_ex allowFlag escape (Fenrir F-9546).
…vector under FIPS v7 per SP 800-132 Section 5.1 (Fenrir F-7779).
… wc_ecc_sign_set_k staging and for the signatures that consume the staged k per FIPS 186-5 Section 6.3 (Fenrir F-7778).
…6C Rev. 2 Section 4 (Fenrir F-7758).
…idated KAS-ECC-SSC set and skip the composite flow for them like the existing key-size mismatch path (Fenrir F-9544).
…h under FIPS v7 per SP 800-131A Rev. 2 Section 6 (Table 5) (Fenrir F-7361).
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new ECC signing gate returns a misleading error code (SIG_TYPE_E) and the DRBG reseed helper should better align with existing SMALL_STACK_CACHE behavior and optional additional_input semantics.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR tightens FIPS 140-3 / SP 800-131A Rev. 2 enforcement in wolfCrypt (notably for ECC KAS/KeyGen/Sign, HMAC key sizing, and DRBG reseed entropy sourcing) and updates the wolfCrypt test suite to assert the new approved-mode behaviors and expected error codes.
Changes:
- Enforces FIPS v7+ constraints: ECC KAS limited to P-256/P-384/P-521; ECC keygen/signing disallows <224-bit curves; HMAC rejects keys >1024 bits unless explicitly overridden.
- Updates DRBG reseed in FIPS v7+ to always pull entropy from the module seed source and treat caller bytes as additional input.
- Extends test coverage to validate new rejection/acceptance behaviors (HMAC long keys, RSA PKCS#1 v1.5 transport refusal, PBKDF2/HKDF/ECDSA “not approved” signaling).
File summaries
| File | Description |
|---|---|
| wolfssl/wolfcrypt/hmac.h | Adds HMAC_FIPS_MAX_KEY constant for v7+ (1024-bit max) used to enforce approved-mode key-size limits. |
| wolfcrypt/src/hmac.c | Enforces v7+ maximum HMAC key length when allowFlag is not set. |
| wolfcrypt/src/random.c | Alters v7+ DRBG reseed to draw entropy internally and treat caller bytes as additional input; adds helper to reseed from seed source. |
| wolfcrypt/src/ecc.c | Adds v7+ ECC curve gating for shared secret, shared secret (ex), key generation, and signing restrictions. |
| wolfcrypt/test/test.c | Updates/extends tests for HMAC long-key rejection + override, RSA PKCS#1 v1.5 transport refusal behavior, and other v7+ non-approved indicators. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+7739
to
+7748
| #if FIPS_VERSION3_GE(7,0,0) | ||
| /* SP 800-131A Rev. 2 Table 2: ECDSA digital signature generation with | ||
| * len(n) < 224 is disallowed, while signature verification with those | ||
| * curves remains legacy use, so only the signing path is gated. The | ||
| * curve is resolved from key->dp, never from ecc_sets[key->idx], so a | ||
| * custom-curve key (idx == ECC_CUSTOM_IDX) cannot index out of range. */ | ||
| if (key->dp->size < WC_ECC_FIPS_GEN_MIN) { | ||
| return SIG_TYPE_E; | ||
| } | ||
| #endif |
Comment on lines
+787
to
+790
| #if FIPS_VERSION3_GE(7,0,0) | ||
| /* Caller bytes become additional_input; entropy comes from the | ||
| * module's seed source (SP 800-90A Rev. 1 Section 9.2). */ | ||
| return Rng_ReseedFromSeedSource(rng, seed, seedSz); |
Comment on lines
+713
to
+722
| int ret; | ||
| #ifdef WOLFSSL_SMALL_STACK | ||
| byte* newSeed = (byte*)XMALLOC(SEED_SZ + SEED_BLOCK_SZ, rng->heap, | ||
| DYNAMIC_TYPE_SEED); | ||
| if (newSeed == NULL) { | ||
| return MEMORY_E; | ||
| } | ||
| #else | ||
| byte newSeed[SEED_SZ + SEED_BLOCK_SZ]; | ||
| #endif |
…e the software-only module cannot offload to an implementation that has not been CAVP tested per FIPS 140-3 IG C.B, leaving a hybrid software-plus-hardware module configuration to reintroduce it under its own build option (Fenrir F-9544).
…_NOT_APPROVED indicator is not delivered to the caller, instead of absorbing it wherever it appears, so the tests prove the module surfaces the FIPS 140-3 IG 2.4.C indicator (Fenrir F-7778, F-7779).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several FIPS 140-3 and SP 800-131A Rev. 2 compliance checks and test updates for cryptographic operations, mainly affecting ECC, HMAC, RNG/DRBG, and RSA code paths. The changes ensure that only CAVP-tested and standards-approved parameters, key sizes, and algorithms are permitted in approved mode, and that test suites properly verify these constraints.
FIPS 140-3 and SP 800-131A Compliance Enforcement
ECC Algorithm Restrictions:
HMAC Key Length Enforcement:
RNG/DRBG Entropy Source Enforcement:
Test Suite Updates for Compliance
HMAC Test Enhancements:
RSA Test Adjustments:
These changes collectively ensure that cryptographic operations are restricted to approved parameters and algorithms in FIPS 140-3 approved mode and that the test suite robustly verifies these restrictions.