Skip to content

ForceZero: inline stores for short wipes on x86, XMEMSET elsewhere #11809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
julek-wolfssl wants to merge 7 commits into
base: master
Choose a base branch
from
+285 −52
Open

ForceZero: inline stores for short wipes on x86, XMEMSET elsewhere #11809

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f5d9f2d
ForceZero: inline stores for short wipes on x86, XMEMSET elsewhere
julek-wolfssl Oct 19, 2026
ea62af6
ForceZero: fix CCM mem-zero build, AVX2 loop bound, cpuid cache race
julek-wolfssl Oct 19, 2026
7817098
ForceZero: one atomic load of the cached cpuid flags
julek-wolfssl Oct 19, 2026
b9e57ce
PBKDF2, KDA one-step KDF: wipe the whole digest buffer
julek-wolfssl Oct 19, 2026
755da05
asm.c: undefine cpuid.h macro names before defining them
julek-wolfssl Oct 19, 2026
7c13fab
Fix CI: skip PollAndReSeed newSeed wipe when NULL
julek-wolfssl Oct 27, 2026
6ae5d9b
AES-CCM: keep the A and B names
julek-wolfssl Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .wolfssl_known_macro_extras
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,6 +833,8 @@ WC_FIPS_ED25519CTX_NOT_APPROVED
WC_FIPS_RSA_VERIFY_MIN_2048
WC_FLAG_DONT_USE_AESNI
WC_FORCE_LINUXKM_FORTIFY_SOURCE
WC_FORCE_ZERO_LOOP
WC_FORCE_ZERO_SHOW_LEN
WC_HASH_CUSTOM_MAX_BLOCK_SIZE
WC_HASH_CUSTOM_MAX_DIGEST_SIZE
WC_HASH_CUSTOM_MIN_DIGEST_SIZE
Expand All @@ -848,6 +850,7 @@ WC_MLKEM_KERNEL_ASM
WC_MPFS_ATHENA_NO_BASE_ADDR
WC_MPFS_ATHENA_NO_HW_INIT
WC_MPFS_ATHENA_NO_HW_MUTEX
WC_NO_ASSUME
WC_NO_ASYNC_SLEEP
WC_NO_RNG_SIMPLE
WC_NO_STATIC_ASSERT
Expand Down Expand Up @@ -1421,6 +1424,7 @@ __MINGW64__
__MSYS__
__MWERKS__
__NT__
__OPTIMIZE__
__OS2__
__OpenBSD__
__PIC__
Expand Down
21 changes: 21 additions & 0 deletions tests/api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32615,6 +32615,7 @@ static int test_ForceZero(void)
{
EXPECT_DECLS;
unsigned char data[32];
unsigned char big[32 + 300 + 16];
unsigned int i, j, len;

/* Test case with 0 length */
Expand All @@ -32639,6 +32640,26 @@ static int test_ForceZero(void)
}
}

/* Longer wipes take other paths. Test each len from 32 to 300 bytes at
* 16 start offsets, with guard bytes on both sides. */
for (i = 16; i < 32; i++) {
for (len = 32; len <= 300; len++) {
for (j = 0; j < sizeof(big); j++)
big[j] = (unsigned char)(j % 255 + 1);

ForceZero(big + i, len);

for (j = 0; j < sizeof(big); j++) {
if (j < i || j >= i + len) {
ExpectIntNE(big[j], 0x00);
}
else {
ExpectIntEQ(big[j], 0x00);
}
}
}
}

return EXPECT_RESULT();
}

Expand Down
52 changes: 30 additions & 22 deletions wolfcrypt/src/aes.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16282,13 +16282,18 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz)
{
/* A and B in one struct, so one wipe clears both. */
struct {
#ifdef WOLFSSL_AESNI
ALIGN128 byte A[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte B[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte a[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte b[WC_AES_BLOCK_SIZE * 4];
#else
byte A[WC_AES_BLOCK_SIZE];
byte B[WC_AES_BLOCK_SIZE];
byte a[WC_AES_BLOCK_SIZE];
byte b[WC_AES_BLOCK_SIZE];
#endif
} ab;
byte* A = ab.a;
byte* B = ab.b;
byte lenSz;
word32 i;
byte mask = 0xFF;
Expand Down Expand Up @@ -16346,7 +16351,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
return MISSING_KEY;
}

XMEMSET(A, 0, sizeof(A));
XMEMSET(A, 0, sizeof(ab.a));
XMEMCPY(B+1, nonce, nonceSz);

B[0] = (byte)((authInSz > 0 ? 64 : 0)
Expand All @@ -16359,7 +16364,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
}

#ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(B));
wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(ab.b));
#endif

VECTOR_REGISTERS_PUSH;
Expand All @@ -16369,7 +16374,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
ret = wc_AesEncrypt(aes, B, A);
#ifdef WOLFSSL_CHECK_MEM_ZERO
if (ret == 0)
wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(A));
wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(ab.a));
#endif

if ((ret == 0) && (authInSz > 0))
Expand Down Expand Up @@ -16432,12 +16437,11 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
XMEMCPY(out, A, inSz);
}

ForceZero(A, sizeof(A));
ForceZero(B, sizeof(B));
ForceZero(&ab, sizeof(ab));

#ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Check(A, sizeof(A));
wc_MemZero_Check(B, sizeof(B));
wc_MemZero_Check(A, sizeof(ab.a));
wc_MemZero_Check(B, sizeof(ab.b));
#endif

VECTOR_REGISTERS_POP;
Expand All @@ -16452,13 +16456,18 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
const byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz)
{
/* A and B in one struct, so one wipe clears both. */
struct {
#ifdef WOLFSSL_AESNI
ALIGN128 byte B[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte A[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte a[WC_AES_BLOCK_SIZE * 4];
ALIGN128 byte b[WC_AES_BLOCK_SIZE * 4];
#else
byte A[WC_AES_BLOCK_SIZE];
byte B[WC_AES_BLOCK_SIZE];
byte a[WC_AES_BLOCK_SIZE];
byte b[WC_AES_BLOCK_SIZE];
#endif
} ab;
byte* A = ab.a;
byte* B = ab.b;
byte* o;
byte lenSz;
word32 i, oSz;
Expand Down Expand Up @@ -16522,7 +16531,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,

o = out;
oSz = inSz;
XMEMSET(A, 0, sizeof A);
XMEMSET(A, 0, sizeof ab.a);
XMEMCPY(B+1, nonce, nonceSz);

B[0] = (byte)(lenSz - 1U);
Expand All @@ -16531,8 +16540,8 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
B[15] = 1;

#ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(A));
wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(B));
wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(ab.a));
wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(ab.b));
#endif

VECTOR_REGISTERS_PUSH;
Expand Down Expand Up @@ -16627,13 +16636,12 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
}
}

ForceZero(A, sizeof(A));
ForceZero(B, sizeof(B));
ForceZero(&ab, sizeof(ab));
o = NULL;

#ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Check(A, sizeof(A));
wc_MemZero_Check(B, sizeof(B));
wc_MemZero_Check(A, sizeof(ab.a));
wc_MemZero_Check(B, sizeof(ab.b));
#endif

VECTOR_REGISTERS_POP;
Expand Down
14 changes: 14 additions & 0 deletions wolfcrypt/src/asm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,20 @@
#define ECX 2
#define EDX 3

/* misc.c may include cpuid.h, which uses these names with other values. */
#undef CPUID_AVX1
#undef CPUID_AVX2
#undef CPUID_RDRAND
#undef CPUID_RDSEED
#undef CPUID_BMI2
#undef CPUID_ADX
#undef IS_INTEL_AVX1
#undef IS_INTEL_AVX2
#undef IS_INTEL_BMI2
#undef IS_INTEL_ADX
#undef IS_INTEL_RDRAND
#undef IS_INTEL_RDSEED

#define CPUID_AVX1 0x1
#define CPUID_AVX2 0x2
#define CPUID_RDRAND 0x4
Expand Down
3 changes: 2 additions & 1 deletion wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10046,7 +10046,8 @@ int wc_CheckPrivateKey(const byte* privKey, word32 privKeySz,
WOLFSSL_ERROR_VERBOSE(ret);
}
}
ForceZero(privDer, privSz);
/* All of privDer, so the compiler knows the length fits. */
ForceZero(privDer, MAX_ECC_BYTES);
}
}
else {
Expand Down
3 changes: 2 additions & 1 deletion wolfcrypt/src/kdf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1458,7 +1458,8 @@ int wc_KDA_KDF_onestep(const byte* z, word32 zSz, const byte* fixedInfo,
if (ret == 0) {
XMEMCPY(output + outIdx, hashTempBuf, derivedSecretSz - outIdx);
}
ForceZero(hashTempBuf, (word32) hashOutSz);
/* All of hashTempBuf, so the compiler knows the length fits. */
ForceZero(hashTempBuf, sizeof(hashTempBuf));
#ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Check(hashTempBuf, (word32) hashOutSz);
#endif
Expand Down
Loading
Loading