Skip to content

Commit c1b5135

Browse files
douzzerdouzzer
committed
wolfcrypt/src/evp.c and wolfcrypt/test/test.c: in FIPS builds <5.3, gate out AES-XTS functionality that depends on new APIs added in #7031 (b14aba4 and 931ac4e) (AES-XTS is non-FIPS in FIPS <5.3).
1 parent 9c17d5d commit c1b5135

2 files changed

Lines changed: 34 additions & 33 deletions

File tree

‎wolfcrypt/src/evp.c‎

Lines changed: 30 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -146,14 +146,16 @@ static const struct s_ent {
146146
#endif
147147
#endif /* WOLFSSL_AES_OFB */
148148

149-
#ifdef WOLFSSL_AES_XTS
149+
#if defined(WOLFSSL_AES_XTS) && \
150+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
150151
#ifdef WOLFSSL_AES_128
151152
static const char EVP_AES_128_XTS[] = "AES-128-XTS";
152153
#endif
153154
#ifdef WOLFSSL_AES_256
154155
static const char EVP_AES_256_XTS[] = "AES-256-XTS";
155156
#endif
156-
#endif /* WOLFSSL_AES_XTS */
157+
#endif /* WOLFSSL_AES_XTS &&
158+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
157159

158160
#ifdef WOLFSSL_AES_CFB
159161
#ifdef WOLFSSL_AES_128
@@ -330,7 +332,7 @@ int wolfSSL_EVP_Cipher_key_length(const WOLFSSL_EVP_CIPHER* c)
330332
case AES_192_OFB_TYPE: return 24;
331333
case AES_256_OFB_TYPE: return 32;
332334
#endif
333-
#if defined(WOLFSSL_AES_XTS)
335+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
334336
/* Two keys for XTS. */
335337
case AES_128_XTS_TYPE: return 16 * 2;
336338
case AES_256_XTS_TYPE: return 32 * 2;
@@ -632,7 +634,7 @@ static int evpCipherBlock(WOLFSSL_EVP_CIPHER_CTX *ctx,
632634
ret = wc_AesCfbDecrypt(&ctx->cipher.aes, out, in, inl);
633635
break;
634636
#endif
635-
#if defined(WOLFSSL_AES_XTS)
637+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
636638
case AES_128_XTS_TYPE:
637639
case AES_256_XTS_TYPE:
638640
if (ctx->enc)
@@ -1703,7 +1705,7 @@ int wolfSSL_EVP_CIPHER_CTX_block_size(const WOLFSSL_EVP_CIPHER_CTX *ctx)
17031705
case AES_192_OFB_TYPE:
17041706
case AES_256_OFB_TYPE:
17051707
#endif
1706-
#if defined(WOLFSSL_AES_XTS)
1708+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
17071709
case AES_128_XTS_TYPE:
17081710
case AES_256_XTS_TYPE:
17091711
#endif
@@ -1831,7 +1833,7 @@ static unsigned int cipherType(const WOLFSSL_EVP_CIPHER *cipher)
18311833
return AES_256_ECB_TYPE;
18321834
#endif
18331835
#endif /*HAVE_AES_CBC */
1834-
#if defined(WOLFSSL_AES_XTS)
1836+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
18351837
#ifdef WOLFSSL_AES_128
18361838
else if (EVP_CIPHER_TYPE_MATCHES(cipher, EVP_AES_128_XTS))
18371839
return AES_128_XTS_TYPE;
@@ -1997,7 +1999,8 @@ int wolfSSL_EVP_CIPHER_block_size(const WOLFSSL_EVP_CIPHER *cipher)
19971999
case AES_256_OFB_TYPE:
19982000
return 1;
19992001
#endif
2000-
#if defined(WOLFSSL_AES_XTS)
2002+
#if defined(WOLFSSL_AES_XTS) && \
2003+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
20012004
case AES_128_XTS_TYPE:
20022005
case AES_256_XTS_TYPE:
20032006
return 1;
@@ -2106,7 +2109,8 @@ unsigned long WOLFSSL_CIPHER_mode(const WOLFSSL_EVP_CIPHER *cipher)
21062109
case AES_256_OFB_TYPE:
21072110
return WOLFSSL_EVP_CIPH_OFB_MODE;
21082111
#endif
2109-
#if defined(WOLFSSL_AES_XTS)
2112+
#if defined(WOLFSSL_AES_XTS) && \
2113+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
21102114
case AES_128_XTS_TYPE:
21112115
case AES_256_XTS_TYPE:
21122116
return WOLFSSL_EVP_CIPH_XTS_MODE;
@@ -4852,7 +4856,8 @@ static const struct cipher{
48524856
#endif
48534857
#endif
48544858

4855-
#ifdef WOLFSSL_AES_XTS
4859+
#if defined(WOLFSSL_AES_XTS) && \
4860+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
48564861
#ifdef WOLFSSL_AES_128
48574862
{AES_128_XTS_TYPE, EVP_AES_128_XTS, NID_aes_128_xts},
48584863
#endif
@@ -5565,7 +5570,8 @@ void wolfSSL_EVP_init(void)
55655570
#endif /* WOLFSSL_AES_256 */
55665571
#endif /* WOLFSSL_AES_OFB */
55675572

5568-
#ifdef WOLFSSL_AES_XTS
5573+
#if defined(WOLFSSL_AES_XTS) && \
5574+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
55695575
#ifdef WOLFSSL_AES_128
55705576
const WOLFSSL_EVP_CIPHER* wolfSSL_EVP_aes_128_xts(void)
55715577
{
@@ -5581,7 +5587,8 @@ void wolfSSL_EVP_init(void)
55815587
return EVP_AES_256_XTS;
55825588
}
55835589
#endif /* WOLFSSL_AES_256 */
5584-
#endif /* WOLFSSL_AES_XTS */
5590+
#endif /* WOLFSSL_AES_XTS &&
5591+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
55855592

55865593
#ifdef HAVE_AESGCM
55875594
#ifdef WOLFSSL_AES_128
@@ -6135,7 +6142,8 @@ void wolfSSL_EVP_init(void)
61356142
wc_AesFree(&ctx->cipher.aes);
61366143
ctx->flags &= ~WOLFSSL_EVP_CIPH_LOW_LEVEL_INITED;
61376144
break;
6138-
#ifdef WOLFSSL_AES_XTS
6145+
#if defined(WOLFSSL_AES_XTS) && \
6146+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
61396147
case AES_128_XTS_TYPE:
61406148
case AES_256_XTS_TYPE:
61416149
wc_AesXtsFree(&ctx->cipher.xts);
@@ -7465,7 +7473,8 @@ void wolfSSL_EVP_init(void)
74657473
}
74667474
#endif /* WOLFSSL_AES_256 */
74677475
#endif /* WOLFSSL_AES_OFB */
7468-
#ifdef WOLFSSL_AES_XTS
7476+
#if defined(WOLFSSL_AES_XTS) && \
7477+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
74697478
#ifdef WOLFSSL_AES_128
74707479
if (ctx->cipherType == AES_128_XTS_TYPE ||
74717480
(type && EVP_CIPHER_TYPE_MATCHES(type, EVP_AES_128_XTS))) {
@@ -7548,7 +7557,8 @@ void wolfSSL_EVP_init(void)
75487557
}
75497558
}
75507559
#endif /* WOLFSSL_AES_256 */
7551-
#endif /* WOLFSSL_AES_XTS */
7560+
#endif /* WOLFSSL_AES_XTS &&
7561+
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
75527562
#endif /* NO_AES */
75537563
#if defined(HAVE_ARIA)
75547564
if (ctx->cipherType == ARIA_128_GCM_TYPE ||
@@ -8210,7 +8220,7 @@ void wolfSSL_EVP_init(void)
82108220
ret = (int)len;
82118221
break;
82128222
#endif /* WOLFSSL_AES_OFB */
8213-
#if defined(WOLFSSL_AES_XTS)
8223+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
82148224
case AES_128_XTS_TYPE:
82158225
case AES_256_XTS_TYPE:
82168226
WOLFSSL_MSG("AES XTS");
@@ -8223,7 +8233,7 @@ void wolfSSL_EVP_init(void)
82238233
if (ret == 0)
82248234
ret = (int)len;
82258235
break;
8226-
#endif /* WOLFSSL_AES_XTS */
8236+
#endif /* WOLFSSL_AES_XTS && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
82278237

82288238
#if defined(HAVE_AESGCM) && ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) \
82298239
|| FIPS_VERSION_GE(2,0))
@@ -9309,12 +9319,12 @@ int wolfSSL_EVP_CIPHER_CTX_iv_length(const WOLFSSL_EVP_CIPHER_CTX* ctx)
93099319
WOLFSSL_MSG("AES OFB");
93109320
return AES_BLOCK_SIZE;
93119321
#endif /* WOLFSSL_AES_OFB */
9312-
#ifdef WOLFSSL_AES_XTS
9322+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
93139323
case AES_128_XTS_TYPE:
93149324
case AES_256_XTS_TYPE:
93159325
WOLFSSL_MSG("AES XTS");
93169326
return AES_BLOCK_SIZE;
9317-
#endif /* WOLFSSL_AES_XTS */
9327+
#endif /* WOLFSSL_AES_XTS && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
93189328
#ifdef HAVE_ARIA
93199329
case ARIA_128_GCM_TYPE :
93209330
case ARIA_192_GCM_TYPE :
@@ -9438,7 +9448,7 @@ int wolfSSL_EVP_CIPHER_iv_length(const WOLFSSL_EVP_CIPHER* cipher)
94389448
return AES_BLOCK_SIZE;
94399449
#endif
94409450
#endif
9441-
#ifdef WOLFSSL_AES_XTS
9451+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
94429452
#ifdef WOLFSSL_AES_128
94439453
if (XSTRCMP(name, EVP_AES_128_XTS) == 0)
94449454
return AES_BLOCK_SIZE;
@@ -9448,7 +9458,7 @@ int wolfSSL_EVP_CIPHER_iv_length(const WOLFSSL_EVP_CIPHER* cipher)
94489458
if (XSTRCMP(name, EVP_AES_256_XTS) == 0)
94499459
return AES_BLOCK_SIZE;
94509460
#endif /* WOLFSSL_AES_256 */
9451-
#endif /* WOLFSSL_AES_XTS */
9461+
#endif /* WOLFSSL_AES_XTS && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) */
94529462

94539463
#endif
94549464
#ifdef HAVE_ARIA

‎wolfcrypt/test/test.c‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9358,7 +9358,8 @@ static wc_test_ret_t aes_key_size_test(void)
93589358
return ret;
93599359
}
93609360

9361-
#if defined(WOLFSSL_AES_XTS)
9361+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
9362+
93629363
/* test vectors from http://csrc.nist.gov/groups/STM/cavp/block-cipher-modes.html */
93639364
#ifdef WOLFSSL_AES_128
93649365
static wc_test_ret_t aes_xts_128_test(void)
@@ -9435,8 +9436,6 @@ static wc_test_ret_t aes_xts_128_test(void)
94359436
0x77, 0x8a, 0xe8, 0xb4, 0x3c, 0xb9, 0x8d, 0x5a
94369437
};
94379438

9438-
#if !defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)
9439-
94409439
WOLFSSL_SMALL_STACK_STATIC unsigned char k3[] = {
94419440
0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
94429441
0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
@@ -9462,8 +9461,6 @@ static wc_test_ret_t aes_xts_128_test(void)
94629461
0xB5, 0x5A, 0xDD, 0xCB, 0x80, 0xE0, 0xFC, 0xCD
94639462
};
94649463

9465-
#endif /* !HAVE_FIPS || FIPS_VERSION_GE(5,3) */
9466-
94679464
#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
94689465
if ((aes = (XtsAes *)XMALLOC(sizeof *aes, HEAP_HINT, DYNAMIC_TYPE_AES)) == NULL)
94699466
ERROR_OUT(WC_TEST_RET_ENC_ERRNO, out);
@@ -9641,8 +9638,6 @@ static wc_test_ret_t aes_xts_128_test(void)
96419638
if (XMEMCMP(p2, buf, sizeof(p2)))
96429639
ERROR_OUT(WC_TEST_RET_ENC_NC, out);
96439640

9644-
#if !defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)
9645-
96469641
/* Test ciphertext stealing in-place. */
96479642
XMEMCPY(buf, p3, sizeof(p3));
96489643
ret = wc_AesXtsSetKeyNoInit(aes, k3, sizeof(k3), AES_ENCRYPTION);
@@ -9670,10 +9665,7 @@ static wc_test_ret_t aes_xts_128_test(void)
96709665
if (XMEMCMP(p3, buf, sizeof(p3)))
96719666
ERROR_OUT(WC_TEST_RET_ENC_NC, out);
96729667

9673-
#endif /* !HAVE_FIPS || FIPS_VERSION_GE(5,3) */
9674-
96759668
#if !defined(BENCH_EMBEDDED) && !defined(HAVE_CAVIUM) && \
9676-
(!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3)) && \
96779669
!defined(WOLFSSL_AFALG)
96789670
{
96799671
#define LARGE_XTS_SZ 1024
@@ -9726,7 +9718,6 @@ static wc_test_ret_t aes_xts_128_test(void)
97269718
#endif
97279719
}
97289720
#endif /* !BENCH_EMBEDDED && !HAVE_CAVIUM &&
9729-
* (!HAVE_FIPS || FIPS_VERSION_GE(5,3)) &&
97309721
* !WOLFSSL_AFALG
97319722
*/
97329723

@@ -10332,7 +10323,7 @@ static wc_test_ret_t aes_xts_args_test(void)
1033210323
return ret;
1033310324
}
1033410325
#endif /* WOLFSSL_AES_128 */
10335-
#endif /* WOLFSSL_AES_XTS */
10326+
#endif /* WOLFSSL_AES_XTS && (!HAVE_FIPS || FIPS_VERSION_GE(5,3)) */
1033610327

1033710328
#if defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128)
1033810329
static wc_test_ret_t aes_cbc_test(void)
@@ -11706,7 +11697,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t aes_test(void)
1170611697
goto out;
1170711698
#endif
1170811699

11709-
#if defined(WOLFSSL_AES_XTS)
11700+
#if defined(WOLFSSL_AES_XTS) && (!defined(HAVE_FIPS) || FIPS_VERSION_GE(5,3))
1171011701
#ifdef WOLFSSL_AES_128
1171111702
ret = aes_xts_128_test();
1171211703
if (ret != 0)

0 commit comments

Comments
 (0)