Skip to content

Support the FIPS v5.2.3 module #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
holtrop-wolfssl merged 1 commit into from
Oct 26, 2026
Merged

Support the FIPS v5.2.3 module #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions rustls-wolfcrypt-provider/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,10 @@ fn main() {
if std::env::var("DEP_WOLFSSL_FIPS").as_deref() == Ok("1") {
println!("cargo::rustc-cfg=fips");
}
// The FIPS v5.2.3 module has no Ed25519, published as FIPS_V5_2_3=1.
println!("cargo::rustc-check-cfg=cfg(fips_v5_2_3)");
println!("cargo::rerun-if-env-changed=DEP_WOLFSSL_FIPS_V5_2_3");
if std::env::var("DEP_WOLFSSL_FIPS_V5_2_3").as_deref() == Ok("1") {
println!("cargo::rustc-cfg=fips_v5_2_3");
}
}
2 changes: 1 addition & 1 deletion rustls-wolfcrypt-provider/src/aead/aes128gcm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,7 +389,7 @@ mod tests {

match &test.result {
TestResult::Invalid => {
if test.flags.iter().any(|flag| *flag == TestFlag::ModifiedTag) {
if test.flags.contains(&TestFlag::ModifiedTag) {
assert_ne!(
actual_tag[..],
test.tag[..],
Expand Down
2 changes: 1 addition & 1 deletion rustls-wolfcrypt-provider/src/aead/aes256gcm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@ mod tests {

match &test.result {
TestResult::Invalid => {
if test.flags.iter().any(|flag| *flag == TestFlag::ModifiedTag) {
if test.flags.contains(&TestFlag::ModifiedTag) {
assert_ne!(
actual_tag[..],
test.tag[..],
Expand Down
2 changes: 1 addition & 1 deletion rustls-wolfcrypt-provider/src/aead/chacha20.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,7 +377,7 @@ mod tests {

match &test.result {
TestResult::Invalid => {
if test.flags.iter().any(|flag| *flag == TestFlag::ModifiedTag) {
if test.flags.contains(&TestFlag::ModifiedTag) {
assert_ne!(
actual_tag[..],
test.tag[..],
Expand Down
25 changes: 14 additions & 11 deletions rustls-wolfcrypt-provider/src/aead/quic.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,8 @@ fn init_hp_aes_cipher(key: &[u8]) -> Result<Cipher, Error> {
}

fn generate_mask_aes(hp_cipher: &Cipher, sample: &[u8]) -> Result<[u8; MASK_LEN], Error> {
// FIPS builds have AES only, so the match has one arm there.
#[cfg_attr(fips, allow(clippy::infallible_destructuring_match))]
let aes_cipher = match hp_cipher {
Cipher::Aes(c) => c,
#[cfg(not(fips))]
Expand Down Expand Up @@ -346,6 +348,7 @@ fn encrypt_aes_gcm(
aad: &[u8],
in_out: &mut [u8],
) -> Result<Tag, Error> {
#[cfg_attr(fips, allow(clippy::infallible_destructuring_match))]
let aes_cipher = match packet_cipher {
Cipher::Aes(c) => c,
#[cfg(not(fips))]
Expand All @@ -360,6 +363,7 @@ pub(super) fn decrypt_aes_gcm(
aad: &[u8],
in_out: &mut [u8],
) -> Result<(), Error> {
#[cfg_attr(fips, allow(clippy::infallible_destructuring_match))]
let aes_cipher = match packet_cipher {
Cipher::Aes(aes_key) => aes_key,
#[cfg(not(fips))]
Expand Down Expand Up @@ -832,12 +836,11 @@ mod tests {
let root_store =
rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());

let config = rustls::ClientConfig::builder_with_provider(default_provider().into())
rustls::ClientConfig::builder_with_provider(default_provider().into())
.with_safe_default_protocol_versions()
.unwrap()
.with_root_certificates(root_store)
.with_no_client_auth();
config
.with_no_client_auth()
}

fn make_default_server_config() -> ServerConfig {
Expand Down Expand Up @@ -970,7 +973,7 @@ mod tests {
rustls::ProtocolVersion::TLSv1_2.encode(&mut ch);
ch.extend_from_slice(&[0u8; 32]); // Encode random
ch.extend_from_slice(&[0u8; 1]); // Encode session_id
vec![
[
rustls::CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
rustls::CipherSuite::TLS13_AES_128_GCM_SHA256,
]
Expand Down Expand Up @@ -1023,7 +1026,7 @@ mod tests {

#[cfg(not(fips))]
fn hkdf_expand_label(
expander: &Box<dyn HkdfExpander>,
expander: &dyn HkdfExpander,
label: &[u8],
context: &[u8],
n: usize,
Expand Down Expand Up @@ -1075,7 +1078,7 @@ mod tests {
.expander_for_okm(&secret);
//Derive hp key
hkdf_expand_label(
&expander,
&*expander,
match version {
rustls::quic::Version::V1Draft | rustls::quic::Version::V1 => b"quic hp",
rustls::quic::Version::V2 => b"quicv2 hp",
Expand All @@ -1086,7 +1089,7 @@ mod tests {
&mut output,
);

let hp_aead_key = AeadKey::from(output.clone());
let hp_aead_key = AeadKey::from(output);
let header_protection_key = TLS13_CHACHA20_POLY1305_SHA256
.tls13()
.unwrap()
Expand All @@ -1096,7 +1099,7 @@ mod tests {

// Derive packet protection key and iv
hkdf_expand_label(
&expander,
&*expander,
match version {
rustls::quic::Version::V1Draft | rustls::quic::Version::V1 => b"quic key",
rustls::quic::Version::V2 => b"quicv2 key",
Expand All @@ -1110,7 +1113,7 @@ mod tests {
let pkt_aead_key = AeadKey::from(output);

hkdf_expand_label(
&expander,
&*expander,
match version {
rustls::quic::Version::V1Draft | rustls::quic::Version::V1 => b"quic iv",
rustls::quic::Version::V2 => b"quicv2 iv",
Expand Down Expand Up @@ -1392,7 +1395,7 @@ mod tests {
let header_len = PLAIN_HEADER.len();
let tag_len = client_keys.local.packet.tag_len();
let padding_len = 1200 - header_len - PAYLOAD.len() - tag_len;
buf.extend(std::iter::repeat(0).take(padding_len));
buf.extend(std::iter::repeat_n(0, padding_len));
let (header, payload) = buf.split_at_mut(header_len);
let tag = client_keys
.local
Expand Down Expand Up @@ -1610,7 +1613,7 @@ mod tests {
#[cfg(not(fips))]
&aead::quic::CHACHA20,
];
let mut first = vec![0u8; 1];
let mut first = [0u8; 1];
let mut packet_number = vec![0u8; 4];
for alg in hp_algs {
let key_len = alg.key_len();
Expand Down
19 changes: 16 additions & 3 deletions rustls-wolfcrypt-provider/src/hkdf.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,9 @@ mod tests {

/// Tests the HKDF implementation against RFC 5869 test vector A.1
/// This is the primary compliance test using SHA-256
/// Its 13 byte salt is under FIPS v5.2.3's 14 byte HMAC key minimum.
#[test]
#[cfg(not(fips_v5_2_3))]
fn test_hkdf_sha256() {
// Test vectors from RFC 5869 Appendix A.1
let ikm = hex!("0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b");
Expand All @@ -164,7 +166,8 @@ mod tests {
fn test_hkdf_sha384() {
// Test with SHA384
let ikm = hex!("0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b");
let salt = hex!("000102030405060708090a0b0c");
// At least 14 bytes, FIPS v5.2.3's HMAC key minimum.
let salt = hex!("000102030405060708090a0b0c0d0e0f");
let info = hex!("f0f1f2f3f4f5f6f7f8f9");

let hkdf = WCHkdfUsingHmac(WCShaHmac::Sha384);
Expand Down Expand Up @@ -199,7 +202,8 @@ mod tests {
#[test]
fn test_hkdf_zero_ikm() {
let hkdf = WCHkdfUsingHmac(WCShaHmac::Sha256);
let salt = hex!("000102030405060708090a0b0c");
// At least 14 bytes, FIPS v5.2.3's HMAC key minimum.
let salt = hex!("000102030405060708090a0b0c0d0e0f");
let info = hex!("f0f1f2f3f4f5f6f7f8f9");

let expander = hkdf.extract_from_zero_ikm(Some(&salt));
Expand All @@ -220,7 +224,8 @@ mod tests {
#[test]
fn test_hkdf_multiple_info_components() {
let hkdf = WCHkdfUsingHmac(WCShaHmac::Sha256);
let salt = hex!("000102030405060708090a0b0c");
// At least 14 bytes, FIPS v5.2.3's HMAC key minimum.
let salt = hex!("000102030405060708090a0b0c0d0e0f");
let info1 = hex!("f0f1f2f3");
let info2 = hex!("f4f5f6f7");
let info3 = hex!("f8f9");
Expand Down Expand Up @@ -266,6 +271,10 @@ mod tests {
for test_group in test_groups {
let tests = &test_group.tests;
for test in tests {
// FIPS v5.2.3 refuses HMAC keys, so HKDF salts, under 14 bytes.
if cfg!(fips_v5_2_3) && test.salt.len() < 14 {
continue;
}
let pseudorandom_key_expander =
hkdf_provider.extract_from_secret(Some(&test.salt), &test.ikm);
let mut outputkey_material = vec![0; test.size];
Expand Down Expand Up @@ -307,6 +316,10 @@ mod tests {
for test_group in test_groups {
let tests = &test_group.tests;
for test in tests {
// FIPS v5.2.3 refuses HMAC keys, so HKDF salts, under 14 bytes.
if cfg!(fips_v5_2_3) && test.salt.len() < 14 {
continue;
}
let pseudorandom_key_expander =
hkdf_provider.extract_from_secret(Some(&test.salt), &test.ikm);
let mut outputkey_material = vec![0; test.size];
Expand Down
3 changes: 3 additions & 0 deletions rustls-wolfcrypt-provider/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ pub mod aead {
}
pub mod sign {
pub mod ecdsa;
#[cfg(not(fips_v5_2_3))]
pub mod eddsa;
pub mod rsa;
}
Expand Down Expand Up @@ -137,6 +138,7 @@ impl rustls::crypto::KeyProvider for Provider {
let algorithms: SigningAlgorithms = vec![
Box::new(|key| sign::ecdsa::EcdsaSigningKey::try_from(key).map(|x| Arc::new(x) as _)),
Box::new(|key| sign::rsa::RsaPrivateKey::try_from(key).map(|x| Arc::new(x) as _)),
#[cfg(not(fips_v5_2_3))]
Box::new(|key| sign::eddsa::Ed25519PrivateKey::try_from(key).map(|x| Arc::new(x) as _)),
];

Expand Down Expand Up @@ -182,6 +184,7 @@ static ALL_ECDSA_SCHEMES: &[rustls::SignatureScheme] = &[
rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
rustls::SignatureScheme::ECDSA_NISTP521_SHA512,
#[cfg(not(fips_v5_2_3))]
rustls::SignatureScheme::ED25519,
];

Expand Down
4 changes: 4 additions & 0 deletions rustls-wolfcrypt-provider/src/verify.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ use rustls::SignatureScheme;
use wolfssl_wolfcrypt::sha::{SHA256, SHA384, SHA512};

mod ecdsa;
#[cfg(not(fips_v5_2_3))]
pub mod eddsa;
mod rsapkcs1;
mod rsapss;
Expand Down Expand Up @@ -61,6 +62,7 @@ pub static ALGORITHMS: WebPkiSupportedAlgorithms = WebPkiSupportedAlgorithms {
ECDSA_P256_SHA256,
ECDSA_P384_SHA384,
ECDSA_P521_SHA512,
#[cfg(not(fips_v5_2_3))]
ED25519,
],
mapping: &[
Expand All @@ -73,6 +75,7 @@ pub static ALGORITHMS: WebPkiSupportedAlgorithms = WebPkiSupportedAlgorithms {
(SignatureScheme::ECDSA_NISTP256_SHA256, &[ECDSA_P256_SHA256]),
(SignatureScheme::ECDSA_NISTP384_SHA384, &[ECDSA_P384_SHA384]),
(SignatureScheme::ECDSA_NISTP521_SHA512, &[ECDSA_P521_SHA512]),
#[cfg(not(fips_v5_2_3))]
(SignatureScheme::ED25519, &[ED25519]),
],
};
Expand All @@ -86,4 +89,5 @@ static RSA_PKCS1_SHA512: &dyn SignatureVerificationAlgorithm = &rsapkcs1::RsaPkc
static ECDSA_P256_SHA256: &dyn SignatureVerificationAlgorithm = &ecdsa::EcdsaVerifier::P256_SHA256;
static ECDSA_P384_SHA384: &dyn SignatureVerificationAlgorithm = &ecdsa::EcdsaVerifier::P384_SHA384;
static ECDSA_P521_SHA512: &dyn SignatureVerificationAlgorithm = &ecdsa::EcdsaVerifier::P521_SHA512;
#[cfg(not(fips_v5_2_3))]
static ED25519: &dyn SignatureVerificationAlgorithm = &eddsa::Ed25519;
Loading
Loading