3x compliance items (CBC, ECDH, DSA)

[kaleb-himes]

Description

1. AES-CBC: FIPS v7 builds now define WOLFSSL_AES_CBC_LENGTH_CHECKS (SP 800-38A sec 5.2). A partial-block CBC call returns BAD_LENGTH_E instead of silently dropping the tail.

2. ECDH raw point: wc_ecc_shared_secret_ex takes a bare ecc_point that no import path validates, so it accepted off-curve and wrong-curve points. It now runs full public key validation (wc_ecc_check_key, SP 800-56Ar3 sec 5.6.2.3.3) first.

   • wc_ecc_shared_secret (the key form, used by TLS) skips this, because its key was validated at import.
   • Non-blocking calls validate once per operation.
   • test_wc_ecc_shared_secret_ssh now uses one curve for both keys.

3. HashML-DSA: sign and verify reject a pre-hash weaker than the parameter set's lambda (FIPS 204 sec 5.4). This matches the existing SLH-DSA check. The crypto-callback test now pre-hashes with SHAKE256.

Testing

• Passing configurations:
  • FIPS v7 and FIPS-ready: full make check, plus the new tests run one at a time.
  • Non-FIPS: --enable-all (with WOLFSSL_DEBUG_MEMORY, and with --enable-mldsa), default ./configure, P-256 only, NO_ECC_CHECK_PUBKEY_ORDER, ECC/SP non-blocking, and --enable-asynccrypt-sw.
  • C89 builds: gcc declaration-after-statement, and clang -std=c89 -Wunreachable-code -Werror.
• Negative control: master plus only these tests fails test_wc_ecc_shared_secret_ex_peer_point (5 builds) and test_mldsa_prehash_strength.
• Probes:
  • Off-curve point: master accepts it on P-256, P-384 and P-521; this branch rejects it.
  • CBC: a 31-byte encrypt returns BAD_LENGTH_E.
  • Disassembly: confirms only wc_ecc_shared_secret_ex reaches wc_ecc_check_key.
• Performance: FIPS v7, default and sp-asm builds, 5 reps, control measured before and after.
  • TLS 1.2 and 1.3 handshakes, the record layer and wc_ecc_shared_secret are within noise.
  • wc_ecc_shared_secret_ex costs about 2x, from the added n·Q check.
  • The check runs once per non-blocking operation: 1.55 ms, against 7.57 s if it ran per slice.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +156 B (+0.2%, 69,347 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +192 B (+0.1%, 129,257 B / 262,144 B, total: 49% used)

gcc-arm-cortex-m4

• FLASH: .text +192 B (+0.1%, 208,044 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +192 B (+0.3%, 71,779 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +192 B (+0.1%, 181,085 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +192 B (+0.1%, 192,644 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +192 B (+0.3%, 66,565 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +192 B (+0.0%, 792,604 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +192 B (+0.1%, 221,982 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +256 B (+0.1%, 308,912 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +192 B (+0.3%, 66,565 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +192 B (+0.1%, 130,045 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +192 B (+0.1%, 247,262 B / 262,144 B, total: 94% used)

gcc-arm-cortex-m7

• FLASH: .text +192 B (+0.1%, 208,044 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +320 B (+0.1%, 309,872 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +192 B (+0.1%, 247,262 B / 262,144 B, total: 94% used)

linuxkm-pie

• Data: __patchable_function_entries +24 B (+0.1%, 28,688 B)

linuxkm-standard

• Data: __patchable_function_entries +24 B (+0.0%, 51,624 B)
  No memory changes detected for:
• gcc-arm-cortex-m4-rsa-only
• stm32-sim-stm32h753

[lealem47]

Great changes Kaleb! One small suggestion: we could make sure the ECC point we validate is exactly the one we use. The SP check sp_ecc_check_key_ validates (x, y) with Z = 1, but sp_ecc_secret_gen_* uses the caller's Z, and the non-SP path also doesn't check it. Rejecting !mp_isone(point->z) in _ecc_validate_public_key should close that gap