You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This pull request introduces several FIPS 140-3 and SP 800-131A Rev. 2 compliance checks and test updates for cryptographic operations, mainly affecting ECC, HMAC, RNG/DRBG, and RSA code paths. The changes ensure that only CAVP-tested and standards-approved parameters, key sizes, and algorithms are permitted in approved mode, and that test suites properly verify these constraints.
FIPS 140-3 and SP 800-131A Compliance Enforcement
ECC Algorithm Restrictions:
Added checks to restrict ECC shared secret computation and key generation to only approved curves (P-256, P-384, P-521) and key sizes (≥224 bits) in FIPS v7+ mode, per SP 800-131A and FIPS 140-3 IG C.B. ECDSA signing is also gated to disallow curves with fewer than 224 bits. [1][2][3][4][5]
HMAC Key Length Enforcement:
Enforced a maximum HMAC key length of 1024 bits in FIPS v7+ mode, matching the module's CAVP-tested range, unless an explicit override is provided.
RNG/DRBG Entropy Source Enforcement:
Modified DRBG reseeding in FIPS v7+ mode to always obtain entropy from the module's internal seed source, per SP 800-90A, treating caller-supplied bytes as additional input only. [1][2][3]
Test Suite Updates for Compliance
HMAC Test Enhancements:
Updated HMAC test cases to verify rejection of overlong keys in FIPS v7+ mode and acceptance only when explicitly allowed, across all SHA and SHA3 variants. [1][2][3][4][5][6]
RSA Test Adjustments:
Updated RSA test cases to expect and handle new FIPS_WRONG_API_E errors for disallowed PKCS#1 v1.5 key transport in FIPS v7+ mode, ensuring tests reflect current compliance rules. [1][2][3][4][5][6]
These changes collectively ensure that cryptographic operations are restricted to approved parameters and algorithms in FIPS 140-3 approved mode and that the test suite robustly verifies these restrictions.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The new ECC signing gate returns a misleading error code (SIG_TYPE_E) and the DRBG reseed helper should better align with existing SMALL_STACK_CACHE behavior and optional additional_input semantics.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR tightens FIPS 140-3 / SP 800-131A Rev. 2 enforcement in wolfCrypt (notably for ECC KAS/KeyGen/Sign, HMAC key sizing, and DRBG reseed entropy sourcing) and updates the wolfCrypt test suite to assert the new approved-mode behaviors and expected error codes.
Changes:
Enforces FIPS v7+ constraints: ECC KAS limited to P-256/P-384/P-521; ECC keygen/signing disallows <224-bit curves; HMAC rejects keys >1024 bits unless explicitly overridden.
Updates DRBG reseed in FIPS v7+ to always pull entropy from the module seed source and treat caller bytes as additional input.
Extends test coverage to validate new rejection/acceptance behaviors (HMAC long keys, RSA PKCS#1 v1.5 transport refusal, PBKDF2/HKDF/ECDSA “not approved” signaling).
File summaries
File
Description
wolfssl/wolfcrypt/hmac.h
Adds HMAC_FIPS_MAX_KEY constant for v7+ (1024-bit max) used to enforce approved-mode key-size limits.
wolfcrypt/src/hmac.c
Enforces v7+ maximum HMAC key length when allowFlag is not set.
wolfcrypt/src/random.c
Alters v7+ DRBG reseed to draw entropy internally and treat caller bytes as additional input; adds helper to reseed from seed source.
wolfcrypt/src/ecc.c
Adds v7+ ECC curve gating for shared secret, shared secret (ex), key generation, and signing restrictions.
wolfcrypt/test/test.c
Updates/extends tests for HMAC long-key rejection + override, RSA PKCS#1 v1.5 transport refusal behavior, and other v7+ non-approved indicators.
The PKCS#1 v1.5 refusal, the HKDF SHA-1 refusal and the WC_FIPS_NOT_APPROVED
indicator come from the fips.c wrappers, which --enable-fips=dev-no-post
builds without (and without fips.h, so WC_FIPS_NOT_APPROVED is undeclared).
wc_PRF keys HMAC with the pre-master secret, which is 256 bytes for a 2048-bit
DHE group, so the 1024-bit cap broke TLS 1.2 DHE handshakes. Like HKDF and
PBKDF2, the PRF's HMAC key is covered by its KDF validation. Also expect the
OpenSSL-compat HMAC_Init long-key (160 byte) case to be refused under v7.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Critical active findings show that alternate hardware and callback implementations can bypass the new ECC curve-size and HMAC key-length restrictions, leaving the approved-mode enforcement incomplete.
Scan targets checked:linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs Coverage: 7 of 7 in-scope changed file(s) opened by the reviewer
Findings: 3 3 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
…k and hardware dispatch
The gate sat only in the software wc_ecc_sign_hash_ex(), so wc_ecc_sign_hash() could hand a sub-224-bit key to a crypto callback or hardware backend first, and the STM32 PKA wc_ecc_sign_hash_ex() had no check at all. All three entry points now share one check.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Approval is blocked by two critical correctness issues: the HMAC key-length exemption applies to ordinary setkey calls, and curve validation accepts non-approved curves based solely on byte size.
No open issues 🎉
2 previously missed issues
In code that hasn't changed since last review
Self-test build bypasses the HMAC maximum for normal callers
linuxkm/lkcapi_sha_glue.c:1420
WC_LINUX_CONFIG_SELFTESTS is a compile-time configuration flag, so this path is also used for ordinary crypto_shash_setkey calls after the kernel self-tests finish. In FIPS v7, any key longer than HMAC_FIPS_MAX_KEY is therefore sent through allowFlag = 1, which bypasses the new maximum and lets normal callers use an overlong HMAC key whenever kernel self-tests are enabled. The self-test exemption needs to be scoped to the kernel's self-test invocation (or normal setkey calls must be validated before this override) rather than applied to every call in a self-test-enabled build.
Key-size check permits non-approved ECC curves
wolfcrypt/src/ecc.c:6548
Checking only the byte size is not sufficient for the stated FIPS v7 approved-curve restriction. When a non-NIST curve such as ECC_SECP256K1 is compiled, wc_ecc_get_curve_size_from_id() returns 32, so this check passes and _ecc_make_key_ex() generates a key on that non-approved curve. Please gate explicit curve IDs with the module's approved-curve allowlist (while preserving the default-curve resolution).
Scan targets checked:linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs Failed targets:wolfcrypt-port-bugs Coverage: 3 of 4 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_ecc.c
Findings: 1 1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
The reason will be displayed to describe this comment to others. Learn more.
linuxkm HMAC setkey skips the FIPS v7 key-length cap for every kernel caller, not only testmgr · Cryptographic correctness
WC_LINUX_CONFIG_SELFTESTS is a compile-time kernel config, and the kernel's CRYPTO_FIPS option requires it. On every FIPS-capable kernel, all in-kernel HMAC users (IPsec, dm-verity and others) can set keys longer than HMAC_FIPS_MAX_KEY with allowFlag=1. That undoes the v7 1024-bit cap this PR adds for F-9546.
Suggested fix: Fix needs a design decision: allow the long key only while the kernel self-test runs (as in the registration-time test window), or mark the result non-approved, per the module's FIPS 140-3 security policy.
Related known findings(similar but distinct; listed for context, not part of this finding)
Earlier finding on this pull request: (1) File/function: both are in linuxkm_hmac_setkey_common in lkcapi_sha_glue.c, so this part matches. (2) Faulting operation: both involve the wc_HmacSetKey_ex(..., 1) exemption for keys longer than HMAC_FIPS_MAX_KEY, so this part also matches. (3) Root cause: the historical issue is that the exemption applied in builds without WC_LINUX_CONFIG_SELFTESTS, where testmgr never runs. The candidate is the residual case. In builds with WC_LINUX_CONFIG_SELFTESTS, which every FIPS-capable kernel needs,
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
wolfSSL-Fenrir-bot
left a comment
This pull request introduces several FIPS 140-3 and SP 800-131A Rev. 2 compliance checks and test updates for cryptographic operations, mainly affecting ECC, HMAC, RNG/DRBG, and RSA code paths. The changes ensure that only CAVP-tested and standards-approved parameters, key sizes, and algorithms are permitted in approved mode, and that test suites properly verify these constraints.
FIPS 140-3 and SP 800-131A Compliance Enforcement
ECC Algorithm Restrictions:
HMAC Key Length Enforcement:
RNG/DRBG Entropy Source Enforcement:
Test Suite Updates for Compliance
HMAC Test Enhancements:
RSA Test Adjustments:
These changes collectively ensure that cryptographic operations are restricted to approved parameters and algorithms in FIPS 140-3 approved mode and that the test suite robustly verifies these restrictions.