Fenrir fixes 2026 08 26

.github/workflows/test-psa-api.yml

@@ -44,6 +44,28 @@ jobs:
           psa_ascon_xchacha_test
           psa_sp800_108_test
           psa_14_misc_test
+          psa_xof_input_wrap_test
+          psa_pbkdf2_cmac_test
+          psa_kdf_input_key_test
+          psa_ecc_verify_curve_test
+          psa_ecc_ecdh_curve_test
+          psa_xof_output_wrap_test
+          psa_kdf_length_check_test
+          psa_mldsa_det_sign_test
+          psa_mldsa_any_hash_test
+          psa_ecc_curve_caps_test
+          psa_xof_no_backend_test
+          psa_ecc_sig_len_test
+          psa_xof_set_context_test
+          psa_cipher_inplace_test
+          psa_cipher_overlap_test
+          psa_des3_pkcs7_test
+          psa_eddsa_mont_export_test
+          psa_eddsa_mont_gen_test
+          psa_key_infer_bits_test
+          psa_cipher_oneshot_len_test
+          psa_pqc_export_seed_test
+          psa_key_declared_bits_test
 
       - name: Run PSA API tests
         env:
@@ -63,7 +85,29 @@ jobs:
                    psa_lms_xmss_verify_test \
                    psa_ascon_xchacha_test \
                    psa_sp800_108_test \
-                   psa_14_misc_test; do
+                   psa_14_misc_test \
+                   psa_xof_input_wrap_test \
+                   psa_pbkdf2_cmac_test \
+                   psa_kdf_input_key_test \
+                   psa_ecc_verify_curve_test \
+                   psa_ecc_ecdh_curve_test \
+                   psa_xof_output_wrap_test \
+                   psa_kdf_length_check_test \
+                   psa_mldsa_det_sign_test \
+                   psa_mldsa_any_hash_test \
+                   psa_ecc_curve_caps_test \
+                   psa_xof_no_backend_test \
+                   psa_ecc_sig_len_test \
+                   psa_xof_set_context_test \
+                   psa_cipher_inplace_test \
+                   psa_cipher_overlap_test \
+                   psa_des3_pkcs7_test \
+                   psa_eddsa_mont_export_test \
+                   psa_eddsa_mont_gen_test \
+                   psa_key_infer_bits_test \
+                   psa_cipher_oneshot_len_test \
+                   psa_pqc_export_seed_test \
+                   psa_key_declared_bits_test; do
             echo "=== $t ==="
             rm -rf test/.store
             ./test/$t

src/psa_asymmetric.c

@@ -698,13 +698,21 @@ int wc_psa_get_ecc_curve_id(psa_key_type_t type, size_t bits)
                 #endif
 
                 case 256:
+                    /* Honour the compile-time capability flags so
+                     * callers can rely on ECC_CURVE_INVALID to reject
+                     * unsupported curves. */
+                #if defined(HAVE_ECC_KOBLITZ)
                     return ECC_SECP256K1;
+                #else
+                    return ECC_CURVE_INVALID;
+                #endif
 
                 default:
                     return ECC_CURVE_INVALID;
             }
 
         case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
+        #if defined(HAVE_ECC_BRAINPOOL)
             switch (bits) {
                 case 256:
                     return ECC_BRAINPOOLP256R1;
@@ -718,6 +726,9 @@ int wc_psa_get_ecc_curve_id(psa_key_type_t type, size_t bits)
                 default:
                     return ECC_CURVE_INVALID;
             }
+        #else
+            return ECC_CURVE_INVALID;
+        #endif
 
         case PSA_ECC_FAMILY_MONTGOMERY:
             switch (bits) {

src/psa_asymmetric_api.c

@@ -222,12 +222,16 @@ static int wolfpsa_sign_alg_permitted(psa_algorithm_t key_alg,
         return (PSA_ALG_SIGN_GET_HASH(alg) != PSA_ALG_ANY_HASH) &&
                ((key_alg & ~PSA_ALG_HASH_MASK) == (alg & ~PSA_ALG_HASH_MASK));
     }
-    /* PSA_ALG_ANY_HASH wildcard for HashML-DSA and DeterministicHashML-DSA */
-    if (PSA_ALG_IS_HASH_ML_DSA(alg) &&
-        PSA_ALG_IS_HASH_ML_DSA(key_alg) &&
+    /* PSA_ALG_ANY_HASH wildcard for HashML-DSA and DeterministicHashML-DSA.
+     * PSA_ALG_IS_HASH_ML_DSA matches both families (its mask covers the
+     * 0x100 family selector bit), so gate on the hedged predicate and
+     * compare with the hash-only mask: a wildcard policy must not cross
+     * the hedged/deterministic boundary. */
+    if (PSA_ALG_IS_HEDGED_HASH_ML_DSA(alg) &&
+        PSA_ALG_IS_HEDGED_HASH_ML_DSA(key_alg) &&
         PSA_ALG_GET_HASH(key_alg) == PSA_ALG_ANY_HASH) {
         return (PSA_ALG_GET_HASH(alg) != PSA_ALG_ANY_HASH) &&
-               ((key_alg & ~0x000001ffU) == (alg & ~0x000001ffU));
+               ((key_alg & ~0x000000ffU) == (alg & ~0x000000ffU));
     }
     if (PSA_ALG_IS_DETERMINISTIC_HASH_ML_DSA(alg) &&
         PSA_ALG_IS_DETERMINISTIC_HASH_ML_DSA(key_alg) &&
@@ -1273,6 +1277,12 @@ psa_status_t wolfpsa_key_agreement_secret(psa_algorithm_t alg,
     int ret;
     ecc_key priv;
     ecc_key pub;
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG)
+    /* Attached to the private key for blinding in wc_ecc_shared_secret;
+     * only needed when wolfCrypt blinding is compiled in and an RNG
+     * exists. */
+    WC_RNG rng;
+#endif
     int curve_id;
     word32 out_len;
 #endif
@@ -1376,15 +1386,40 @@ psa_status_t wolfpsa_key_agreement_secret(psa_algorithm_t alg,
         return wc_error_to_psa_status(ret);
     }
 
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG)
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        wc_ecc_free(&pub);
+        wc_ecc_free(&priv);
+        wolfpsa_forcezero_free_key_data(key_data, key_data_length);
+        return wc_error_to_psa_status(ret);
+    }
+#endif
+
     ret = wc_ecc_import_private_key_ex(key_data, (word32)key_data_length,
                                        NULL, 0, &priv, curve_id);
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG)
+    if (ret == 0) {
+        /* The ECDH scalar multiplication uses the key's RNG for blinding
+         * under ECC_TIMING_RESISTANT, so the imported private key needs
+         * one attached. */
+        ret = wc_ecc_set_rng(&priv, &rng);
+    }
+#endif
     if (ret == 0) {
         ret = wc_ecc_make_pub_ex(&priv, NULL, NULL);
     }
     if (ret == 0) {
-        ret = wc_ecc_import_x963(peer_key, (word32)peer_key_length, &pub);
+        /* Pin the peer point to the local key's curve: a point that is
+         * not on this curve must fail, not be reinterpreted on the
+         * default curve for the coordinate size. */
+        ret = wc_ecc_import_x963_ex(peer_key, (word32)peer_key_length,
+                                    &pub, curve_id);
     }
     if (ret != 0) {
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG)
+        wc_FreeRng(&rng);
+#endif
         wc_ecc_free(&pub);
         wc_ecc_free(&priv);
         wolfpsa_forcezero_free_key_data(key_data, key_data_length);
@@ -1393,6 +1428,9 @@ psa_status_t wolfpsa_key_agreement_secret(psa_algorithm_t alg,
 
     out_len = (word32)output_size;
     ret = wc_ecc_shared_secret(&priv, &pub, output, &out_len);
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG)
+    wc_FreeRng(&rng);
+#endif
     wc_ecc_free(&pub);
     wc_ecc_free(&priv);
     wolfpsa_forcezero_free_key_data(key_data, key_data_length);

src/psa_cipher.c

@@ -185,7 +185,10 @@ static psa_status_t wolfpsa_cipher_check_key(
         }
     }
     else if (attributes->type == PSA_KEY_TYPE_DES) {
-        if (alg != PSA_ALG_CBC_NO_PADDING && alg != PSA_ALG_ECB_NO_PADDING) {
+        /* The update/finish block and padding logic is generic over
+         * block_size, so CBC_PKCS7 works for DES exactly as for AES. */
+        if (alg != PSA_ALG_CBC_NO_PADDING && alg != PSA_ALG_ECB_NO_PADDING &&
+            alg != PSA_ALG_CBC_PKCS7) {
             wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
             *key_data = NULL;
             *key_data_length = 0;
@@ -740,6 +743,23 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
         return wolfpsa_cipher_fail(operation, PSA_ERROR_INVALID_ARGUMENT);
     }
 
+    /* The block-cipher paths write completed blocks to the output before
+     * all of the input has been read (the partial-block assembly reads
+     * only the first bytes of the input, then the full-block pass reads
+     * the rest), so overlapping input and output ranges would corrupt
+     * unread input. The stream modes buffer nothing in the operation and
+     * read each input byte before writing the output byte, so in-place
+     * updates are safe there. Overlap is not supported in the block
+     * modes; reject it only for those. */
+    if ((ctx->alg == PSA_ALG_CBC_NO_PADDING ||
+         ctx->alg == PSA_ALG_CBC_PKCS7 ||
+         ctx->alg == PSA_ALG_ECB_NO_PADDING) &&
+        input != NULL && output != NULL && input_length > 0 &&
+        output_size > 0 &&
+        input < output + output_size && output < input + input_length) {
+        return wolfpsa_cipher_fail(operation, PSA_ERROR_NOT_SUPPORTED);
+    }
+
     if (input_length == 0) {
         return PSA_SUCCESS;
     }
@@ -772,6 +792,7 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
             if (ctx->partial_len > 0) {
                 size_t needed = block_size - ctx->partial_len;
                 uint8_t block[AES_BLOCK_SIZE];
+                psa_status_t status = PSA_SUCCESS;
 
                 XMEMCPY(block, ctx->partial, ctx->partial_len);
                 XMEMCPY(block + ctx->partial_len, input, needed);
@@ -787,7 +808,8 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                                                 (word32)block_size);
                     }
 #else
-                    return wolfpsa_cipher_fail(operation, PSA_ERROR_NOT_SUPPORTED);
+                    status = PSA_ERROR_NOT_SUPPORTED;
+                    goto cbc_nopad_partial_done;
 #endif
                 }
                 else {
@@ -801,13 +823,18 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                     }
                 }
                 if (ret != 0) {
-                    return wolfpsa_cipher_fail(operation,
-                                               wc_error_to_psa_status(ret));
+                    status = wc_error_to_psa_status(ret);
+                    goto cbc_nopad_partial_done;
                 }
-                wc_ForceZero(block, sizeof(block));
                 output_offset += block_size;
                 input_offset += needed;
                 ctx->partial_len = 0;
+
+cbc_nopad_partial_done:
+                wc_ForceZero(block, sizeof(block));
+                if (status != PSA_SUCCESS) {
+                    return wolfpsa_cipher_fail(operation, status);
+                }
             }
 
             if (input_length > input_offset) {
@@ -896,6 +923,7 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                 if (ctx->partial_len > 0) {
                     size_t needed = block_size - ctx->partial_len;
                     uint8_t block[AES_BLOCK_SIZE];
+                    psa_status_t status = PSA_SUCCESS;
 
                     XMEMCPY(block, ctx->partial, ctx->partial_len);
                     XMEMCPY(block + ctx->partial_len, input, needed);
@@ -905,22 +933,27 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                         ret = wc_Des3_CbcEncrypt(&ctx->des3, output, block,
                                                 (word32)block_size);
 #else
-                        return wolfpsa_cipher_fail(operation,
-                                                   PSA_ERROR_NOT_SUPPORTED);
+                        status = PSA_ERROR_NOT_SUPPORTED;
+                        goto pkcs7_enc_partial_done;
 #endif
                     }
                     else {
                         ret = wc_AesCbcEncrypt(&ctx->aes, output, block,
                                                (word32)block_size);
                     }
                     if (ret != 0) {
-                        return wolfpsa_cipher_fail(operation,
-                                                   wc_error_to_psa_status(ret));
+                        status = wc_error_to_psa_status(ret);
+                        goto pkcs7_enc_partial_done;
                     }
-                    wc_ForceZero(block, sizeof(block));
                     output_offset += block_size;
                     input_offset += needed;
                     ctx->partial_len = 0;
+
+pkcs7_enc_partial_done:
+                    wc_ForceZero(block, sizeof(block));
+                    if (status != PSA_SUCCESS) {
+                        return wolfpsa_cipher_fail(operation, status);
+                    }
                 }
 
                 if (input_length > input_offset) {
@@ -1106,6 +1139,7 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
             if (ctx->partial_len > 0) {
                 size_t needed = block_size - ctx->partial_len;
                 uint8_t block[AES_BLOCK_SIZE];
+                psa_status_t status = PSA_SUCCESS;
 
                 XMEMCPY(block, ctx->partial, ctx->partial_len);
                 XMEMCPY(block + ctx->partial_len, input, needed);
@@ -1121,7 +1155,8 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                                                 (word32)block_size);
                     }
 #else
-                    return wolfpsa_cipher_fail(operation, PSA_ERROR_NOT_SUPPORTED);
+                    status = PSA_ERROR_NOT_SUPPORTED;
+                    goto ecb_partial_done;
 #endif
                 }
                 else {
@@ -1135,17 +1170,23 @@ psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                                                (word32)block_size);
                     }
 #else
-                    return wolfpsa_cipher_fail(operation, PSA_ERROR_NOT_SUPPORTED);
+                    status = PSA_ERROR_NOT_SUPPORTED;
+                    goto ecb_partial_done;
 #endif
                 }
                 if (ret != 0) {
-                    return wolfpsa_cipher_fail(operation,
-                                               wc_error_to_psa_status(ret));
+                    status = wc_error_to_psa_status(ret);
+                    goto ecb_partial_done;
                 }
-                wc_ForceZero(block, sizeof(block));
                 output_offset += block_size;
                 input_offset += needed;
                 ctx->partial_len = 0;
+
+ecb_partial_done:
+                wc_ForceZero(block, sizeof(block));
+                if (status != PSA_SUCCESS) {
+                    return wolfpsa_cipher_fail(operation, status);
+                }
             }
 
             if (input_length > input_offset) {
@@ -1322,12 +1363,17 @@ psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
         }
         if (ctx->direction == AES_ENCRYPTION) {
             uint8_t block[AES_BLOCK_SIZE];
-            size_t pad_len = block_size - ctx->partial_len;
+            size_t pad_len;
             psa_status_t status = PSA_SUCCESS;
 
-            if (pad_len == 0) {
-                pad_len = block_size;
+            /* psa_cipher_update keeps the encrypt-path residue strictly
+             * below one full block, so pad_len always lands in
+             * [1, block_size]. Fail loudly if that invariant ever breaks
+             * instead of guessing a padding length. */
+            if (ctx->partial_len >= block_size) {
+                return wolfpsa_cipher_fail(operation, PSA_ERROR_BAD_STATE);
             }
+            pad_len = block_size - ctx->partial_len;
             if (output_size < block_size) {
                 return wolfpsa_cipher_fail(operation, PSA_ERROR_BUFFER_TOO_SMALL);
             }
@@ -1479,6 +1525,19 @@ psa_status_t psa_cipher_encrypt(psa_key_id_t key,
     size_t offset = 0;
     wolfpsa_cipher_ctx_t *ctx;
 
+    if (output_length == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
+    /* The generated IV is written to the output before the input is
+     * consumed, so overlapping input and output buffers would clobber
+     * unread plaintext. Overlap is not supported; reject it. */
+    if (input != NULL && output != NULL && input_length > 0 &&
+        output_size > 0 &&
+        input < output + output_size && output < input + input_length) {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
     status = psa_cipher_encrypt_setup(&operation, key, alg);
     if (status != PSA_SUCCESS) {
         return status;
@@ -1541,6 +1600,10 @@ psa_status_t psa_cipher_decrypt(psa_key_id_t key,
     size_t offset = 0;
     wolfpsa_cipher_ctx_t *ctx;
 
+    if (output_length == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
     status = psa_cipher_decrypt_setup(&operation, key, alg);
     if (status != PSA_SUCCESS) {
         return status;