Skip to content

Commit 91681f3

Browse files
douzzerdouzzer
committed
configure.ac:
* add srtp to enable-all * add srtp-kdf to enable-all-crypto * fix typo in enable-all[-crypto] where ENABLED_FIPS was used when FIPS_VERSION was needed. * in enable-all[-crypto], conditionalize aesxts on !FIPS || FIPS_VERSION == dev. * move AES-XTS CFLAG setup after FIPS settings, to allow non-dev FIPS to force it off, and add clause to FIPS v5 setup to do that. * in FIPS v5 setup, add AES-XTS to the list of modes that forces -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB. wolfcrypt/src/kdf.c: fix several benign -Wconversions. wolfcrypt/test/test.c: add aes_cfb_test() and aes_xts_test() as top-level tests with separate "pass" messages, for transparency that those modes have indeed been tested in builds that activate them.
1 parent 14830d0 commit 91681f3

3 files changed

Lines changed: 104 additions & 60 deletions

File tree

‎configure.ac‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,6 @@ then
745745
test "$enable_psk" = "" && enable_psk=yes
746746
test "$enable_cmac" = "" && enable_cmac=yes
747747
test "$enable_siphash" = "" && enable_siphash=yes
748-
test "$enable_aesxts" = "" && enable_aesxts=yes
749748
test "$enable_ocsp" = "" && enable_ocsp=yes
750749
test "$enable_ocspstapling" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling=yes
751750
test "$enable_ocspstapling2" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling2=yes
@@ -787,6 +786,7 @@ then
787786
test "$enable_session_ticket" = "" && enable_session_ticket=yes
788787
test "$enable_earlydata" = "" && enable_earlydata=yes
789788
test "$enable_ech" = "" && enable_ech=yes
789+
test "$enable_srtp" = "" && enable_srtp=yes
790790

791791
if test "$ENABLED_32BIT" != "yes"
792792
then
@@ -861,7 +861,8 @@ then
861861
fi
862862
fi
863863

864-
if test "$ENABLED_FIPS" = "no" || test "$ENABLED_FIPS" = "dev"; then
864+
if test "$ENABLED_FIPS" = "no" || test "$FIPS_VERSION" = "dev"; then
865+
test "$enable_aesxts" = "" && enable_aesxts=yes
865866
test "$enable_aessiv" = "" && enable_aessiv=yes
866867
fi
867868

@@ -933,7 +934,6 @@ then
933934
test "$enable_psk" = "" && enable_psk=yes
934935
test "$enable_cmac" = "" && enable_cmac=yes
935936
test "$enable_siphash" = "" && enable_siphash=yes
936-
test "$enable_aesxts" = "" && enable_aesxts=yes
937937
test "$enable_ocsp" = "" && enable_ocsp=yes
938938
test "$enable_ocspstapling" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling=yes
939939
test "$enable_ocspstapling2" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling2=yes
@@ -959,6 +959,7 @@ then
959959
test "$enable_cryptocb" = "" && enable_cryptocb=yes
960960
test "$enable_anon" = "" && enable_anon=yes
961961
test "$enable_ssh" = "" && test "$enable_hmac" != "no" && enable_ssh=yes
962+
test "$enable_srtp_kdf" = "" && enable_srtp_kdf=yes
962963

963964
if test "$ENABLED_32BIT" != "yes"
964965
then
@@ -1001,7 +1002,8 @@ then
10011002
fi
10021003
fi
10031004

1004-
if test "$ENABLED_FIPS" = "no" || test "$ENABLED_FIPS" = "dev"; then
1005+
if test "$ENABLED_FIPS" = "no" || test "$FIPS_VERSION" = "dev"; then
1006+
test "$enable_aesxts" = "" && enable_aesxts=yes
10051007
test "$enable_aessiv" = "" && enable_aessiv=yes
10061008
fi
10071009

@@ -4848,13 +4850,6 @@ AC_ARG_ENABLE([xts],
48484850
[ ENABLED_AESXTS=$enableval ]
48494851
)
48504852

4851-
AS_IF([test "x$ENABLED_AESXTS" = "xyes"],
4852-
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_XTS -DWOLFSSL_AES_DIRECT"])
4853-
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_INTELASM" = "xyes"],
4854-
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
4855-
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_AESNI" = "xyes"],
4856-
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
4857-
48584853
# Web Server Build
48594854
AC_ARG_ENABLE([webserver],
48604855
[AS_HELP_STRING([--enable-webserver],[Enable Web Server (default: disabled)])],
@@ -4953,6 +4948,9 @@ AS_CASE([$FIPS_VERSION],
49534948
AS_IF([test "$ENABLED_AESCCM" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesccm" != "no")],
49544949
[ENABLED_AESCCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
49554950
4951+
AS_IF([test "$ENABLED_AESXTS" = "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesxts" != "yes")],
4952+
[ENABLED_AESXTS="no"])
4953+
49564954
AS_IF([test "$ENABLED_RSAPSS" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_rsapss" != "no")],
49574955
[ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
49584956
@@ -4994,7 +4992,8 @@ AS_CASE([$FIPS_VERSION],
49944992
AS_IF([(test "$ENABLED_AESCCM" = "yes" && test "$HAVE_AESCCM_PORT" != "yes") ||
49954993
(test "$ENABLED_AESCTR" = "yes" && test "$HAVE_AESCTR_PORT" != "yes") ||
49964994
(test "$ENABLED_AESGCM" = "yes" && test "$HAVE_AESGCM_PORT" != "yes") ||
4997-
(test "$ENABLED_AESOFB" = "yes" && test "$HAVE_AESOFB_PORT" != "yes")],
4995+
(test "$ENABLED_AESOFB" = "yes" && test "$HAVE_AESOFB_PORT" != "yes") ||
4996+
(test "$ENABLED_AESXTS" = "yes" && test "$HAVE_AESXTS_PORT" != "yes")],
49984997
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
49994998
],
50004999

@@ -5100,6 +5099,14 @@ AS_CASE([$SELFTEST_VERSION],
51005099
])
51015100

51025101

5102+
AS_IF([test "x$ENABLED_AESXTS" = "xyes"],
5103+
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_XTS -DWOLFSSL_AES_DIRECT"])
5104+
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_INTELASM" = "xyes"],
5105+
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
5106+
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_AESNI" = "xyes"],
5107+
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
5108+
5109+
51035110
# Set SHA-3 flags
51045111
if test "$ENABLED_SHA3" != "no" && test "$ENABLED_32BIT" = "no"
51055112
then

‎wolfcrypt/src/kdf.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -888,12 +888,12 @@ int wc_SSH_KDF(byte hashId, byte keyId, byte* key, word32 keySz,
888888
* @param [out] block First block to encrypt.
889889
*/
890890
static void wc_srtp_kdf_first_block(const byte* salt, word32 saltSz, int kdrIdx,
891-
const byte* index, byte indexSz, unsigned char* block)
891+
const byte* index, int indexSz, unsigned char* block)
892892
{
893-
word32 i;
893+
int i;
894894

895895
/* XOR salt into zeroized buffer. */
896-
for (i = 0; i < WC_SRTP_MAX_SALT - saltSz; i++) {
896+
for (i = 0; i < WC_SRTP_MAX_SALT - (int)saltSz; i++) {
897897
block[i] = 0;
898898
}
899899
XMEMCPY(block + WC_SRTP_MAX_SALT - saltSz, salt, saltSz);
@@ -942,13 +942,13 @@ static int wc_srtp_kdf_derive_key(byte* block, byte indexSz, byte label,
942942
int i;
943943
int ret = 0;
944944
/* Calculate the number of full blocks needed for derived key. */
945-
int blocks = keySz / AES_BLOCK_SIZE;
945+
int blocks = (int)(keySz / AES_BLOCK_SIZE);
946946

947947
/* XOR in label. */
948948
block[WC_SRTP_MAX_SALT - indexSz - 1] ^= label;
949949
for (i = 0; (ret == 0) && (i < blocks); i++) {
950950
/* Set counter. */
951-
block[15] = i;
951+
block[15] = (byte)i;
952952
/* Encrypt block into key buffer. */
953953
ret = wc_AesEcbEncrypt(aes, key, block, AES_BLOCK_SIZE);
954954
/* Reposition for more derived key. */
@@ -960,7 +960,7 @@ static int wc_srtp_kdf_derive_key(byte* block, byte indexSz, byte label,
960960
if ((ret == 0) && (keySz > 0)) {
961961
byte enc[AES_BLOCK_SIZE];
962962
/* Set counter. */
963-
block[15] = i;
963+
block[15] = (byte)i;
964964
/* Encrypt block into temporary. */
965965
ret = wc_AesEcbEncrypt(aes, enc, block, AES_BLOCK_SIZE);
966966
if (ret == 0) {

‎wolfcrypt/test/test.c‎

Lines changed: 79 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -536,6 +536,12 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t XChaCha20Poly1305_test(void);
536536
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t des_test(void);
537537
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t des3_test(void);
538538
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_test(void);
539+
#if defined(WOLFSSL_AES_CFB)
540+
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_cfb_test(void);
541+
#endif
542+
#ifdef WOLFSSL_AES_XTS
543+
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_xts_test(void);
544+
#endif
539545
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes192_test(void);
540546
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes256_test(void);
541547
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aesofb_test(void);
@@ -1463,7 +1469,7 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
14631469
if ( (ret = aesofb_test()) != 0)
14641470
TEST_FAIL("AES-OFB test failed!\n", ret);
14651471
else
1466-
TEST_PASS("AESOFB test passed!\n");
1472+
TEST_PASS("AES-OFB test passed!\n");
14671473
#endif
14681474

14691475
#ifdef HAVE_AESGCM
@@ -1490,6 +1496,21 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
14901496
else
14911497
TEST_PASS("AES-CCM test passed!\n");
14921498
#endif
1499+
1500+
#ifdef WOLFSSL_AES_CFB
1501+
if ( (ret = aes_cfb_test()) != 0)
1502+
TEST_FAIL("AES-CFB test failed!\n", ret);
1503+
else
1504+
TEST_PASS("AES-CFB test passed!\n");
1505+
#endif
1506+
1507+
#ifdef WOLFSSL_AES_XTS
1508+
if ( (ret = aes_xts_test()) != 0)
1509+
TEST_FAIL("AES-XTS test failed!\n", ret);
1510+
else
1511+
TEST_PASS("AES-XTS test passed!\n");
1512+
#endif
1513+
14931514
#ifdef HAVE_AES_KEYWRAP
14941515
if ( (ret = aeskeywrap_test()) != 0)
14951516
TEST_FAIL("AES Key Wrap test failed!\n", ret);
@@ -8433,8 +8454,10 @@ static wc_test_ret_t EVP_test(const WOLFSSL_EVP_CIPHER* type, const byte* key,
84338454
#endif /* WOLFSSL_AES_OFB */
84348455

84358456
#if defined(WOLFSSL_AES_CFB)
8436-
/* Test cases from NIST SP 800-38A, Recommendation for Block Cipher Modes of Operation Methods an*/
8437-
static wc_test_ret_t aescfb_test(void)
8457+
/* Test cases from NIST SP 800-38A, Recommendation for Block Cipher Modes of
8458+
* Operation Methods and Techniques
8459+
*/
8460+
static wc_test_ret_t aescfb_test_0(void)
84388461
{
84398462
#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
84408463
Aes *enc = NULL;
@@ -9360,7 +9383,7 @@ static wc_test_ret_t aes_key_size_test(void)
93609383
return ret;
93619384
}
93629385

9363-
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
9386+
#if defined(WOLFSSL_AES_XTS)
93649387

93659388
/* test vectors from http://csrc.nist.gov/groups/STM/cavp/block-cipher-modes.html */
93669389
#ifdef WOLFSSL_AES_128
@@ -11770,44 +11793,6 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_test(void)
1177011793
goto out;
1177111794
#endif
1177211795

11773-
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
11774-
#ifdef WOLFSSL_AES_128
11775-
ret = aes_xts_128_test();
11776-
if (ret != 0)
11777-
goto out;
11778-
#endif
11779-
#ifdef WOLFSSL_AES_256
11780-
ret = aes_xts_256_test();
11781-
if (ret != 0)
11782-
goto out;
11783-
#endif
11784-
#if defined(WOLFSSL_AES_128) && defined(WOLFSSL_AES_256)
11785-
ret = aes_xts_sector_test();
11786-
if (ret != 0)
11787-
goto out;
11788-
#endif
11789-
#ifdef WOLFSSL_AES_128
11790-
ret = aes_xts_args_test();
11791-
if (ret != 0)
11792-
goto out;
11793-
#endif
11794-
#endif
11795-
11796-
#if defined(WOLFSSL_AES_CFB)
11797-
ret = aescfb_test();
11798-
if (ret != 0)
11799-
goto out;
11800-
#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
11801-
ret = aescfb1_test();
11802-
if (ret != 0)
11803-
goto out;
11804-
11805-
ret = aescfb8_test();
11806-
if (ret != 0)
11807-
goto out;
11808-
#endif
11809-
#endif
11810-
1181111796
#if defined(HAVE_AES_ECB) && !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
1181211797
ret = aesecb_test();
1181311798
if (ret != 0)
@@ -11846,6 +11831,54 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_test(void)
1184611831
return ret;
1184711832
}
1184811833

11834+
#if defined(WOLFSSL_AES_CFB)
11835+
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_cfb_test(void)
11836+
{
11837+
int ret;
11838+
ret = aescfb_test_0();
11839+
if (ret != 0)
11840+
return ret;
11841+
#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
11842+
ret = aescfb1_test();
11843+
if (ret != 0)
11844+
return ret;
11845+
11846+
ret = aescfb8_test();
11847+
if (ret != 0)
11848+
return ret;
11849+
#endif
11850+
return 0;
11851+
}
11852+
#endif
11853+
11854+
#if defined(WOLFSSL_AES_XTS)
11855+
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_xts_test(void)
11856+
{
11857+
int ret = 0;
11858+
#ifdef WOLFSSL_AES_128
11859+
ret = aes_xts_128_test();
11860+
if (ret != 0)
11861+
return ret;
11862+
#endif
11863+
#ifdef WOLFSSL_AES_256
11864+
ret = aes_xts_256_test();
11865+
if (ret != 0)
11866+
return ret;
11867+
#endif
11868+
#if defined(WOLFSSL_AES_128) && defined(WOLFSSL_AES_256)
11869+
ret = aes_xts_sector_test();
11870+
if (ret != 0)
11871+
return ret;
11872+
#endif
11873+
#ifdef WOLFSSL_AES_128
11874+
ret = aes_xts_args_test();
11875+
if (ret != 0)
11876+
return ret;
11877+
#endif
11878+
return 0;
11879+
}
11880+
#endif
11881+
1184911882
#ifdef WOLFSSL_AES_192
1185011883
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes192_test(void)
1185111884
{
@@ -49672,6 +49705,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cryptocb_test(void)
4967249705
if (ret == 0)
4967349706
ret = aes_test();
4967449707
#endif
49708+
#ifdef WOLFSSL_AES_XTS
49709+
if (ret == 0)
49710+
ret = aes_xts_test();
49711+
#endif
4967549712
#if defined(HAVE_AESCCM) && defined(WOLFSSL_AES_128)
4967649713
if (ret == 0)
4967749714
ret = aesccm_test();

0 commit comments

Comments
 (0)