Skip to content

Commit 5e899a1

Browse files
committed
fix: ChaCha20-Poly1305 Final() allow empty plaintext
wc_ChaCha20Poly1305_Final() rejected CHACHA20_POLY1305_STATE_READY, blocking use when no data or AAD was ever provided. RFC 8439 §2.8 permits empty plaintext and produces a well-defined authentication tag. Found via Wycheproof test vectors.
1 parent c4c71ee commit 5e899a1

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

wolfcrypt/src/chacha20_poly1305.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,8 @@ int wc_ChaCha20Poly1305_Final(ChaChaPoly_Aead* aead,
275275
if (aead == NULL || outAuthTag == NULL) {
276276
return BAD_FUNC_ARG;
277277
}
278-
if (aead->state != CHACHA20_POLY1305_STATE_AAD &&
278+
if (aead->state != CHACHA20_POLY1305_STATE_READY &&
279+
aead->state != CHACHA20_POLY1305_STATE_AAD &&
279280
aead->state != CHACHA20_POLY1305_STATE_DATA) {
280281
return BAD_STATE_E;
281282
}

0 commit comments

Comments
 (0)