ports/security/wolfssl, branch release/13.3.0

security/wolfssl: Update to 5.6.6

2023-12-25T23:01:02Z

Changes since 5.6.4: wolfSSL Release 5.6.6 (Dec 19, 2023) NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 REMINDER: When working with AES Block Cipher algorithms, wc_AesInit() should always be called first to initialize the Aes structure, before calling other Aes API functions. Recently we found several places in our documentation, comments, and codebase where this pattern was not observed. We have since fixed this omission in several PRs for this release. Vulnerabilities * [Medium] CVE-2023-6935: After review of the previous RSA timing fix in wolfSSL 5.6.4, additional changes were found to be required. A complete resistant change is delivered in this release. This fix is for the Marvin attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a very large number of trial connections. This issue is around RSA decryption and affects the optional static RSA cipher suites on the server side, which are considered weak, not recommended to be used and are off by default in wolfSSL (even with --enable-all). Static RSA cipher suites were also removed from the TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It is recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. Thanks to Hubert Kario for the report. The fix for this issue is located in the following GitHub Pull Request: #6955. * [Low] CVE-2023-6936: A potential heap overflow read is possible in servers connecting over TLS 1.3 when the optional WOLFSSL_CALLBACKS has been defined. The out of bounds read can occur when a server receives a malicious malformed ClientHello. Users should either discontinue use of WOLFSSL_CALLBACKS on the server side or update versions of wolfSSL to 5.6.6. Thanks to the tlspuffin fuzzer team for the report which was designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is located in the following GitHub Pull Request: #6949. * [Low] A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the "--enable-aes-bitsliced" configure option. Thanks to Florian Sieck, Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas Eisenbarth, and Yuval Yarom for the report (Universities of Lübeck, Melbourne, Adelaide and Bochum). The fix for this issue is located in the following GitHub Pull Request: #6854. * [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in a single (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating. Thanks to Johannes Wilson for the report (Sectra Communications and Linköping University). The fix for this issue is located in the following GitHub Pull Request: #7029. New Feature Additions * Build option for disabling CRL date checks (WOLFSSL_NO_CRL_DATE_CHECK) (PR 6927) * Support for STM32WL55 and improvements to PKA ECC support (PR 6937) * Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929) * Add implementation of SRTP KDF and SRTCP KDF (--enable-srtp-kdf) (PR 6888) * Add wolfSSL_EXTENDED_KEY_USAGE_free() (PR 6916) * Add AES bitsliced implementation that is cache attack safe (--enable-aes-bitsliced) (PR 6854) * Add memcached support and automated testing (PR 6430, 7022) * Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990) * Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010) Enhancements and Optimizations * Better built in testing of “--sys-ca-certs” configure option (PR 6910) * Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877) * Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946) * Add “--enable-quic” to “--enable-all” configure option (PR 6957) * Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959) * Add result of “HAVE___UINT128_T” to options.h for CMake builds (PR 6965) * Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967) * Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952) * Add wolfCrypt test and unit test to ctest (PR 6977) * Move OpenSSL compatibility crypto APIs into ssl_crypto.c file (PR 6935) * Validate time generated from XGMTIME() (PR 6958) * Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868) * Add GitHub Actions testing with nginx 1.24.0 (PR 6982) * Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953) * Add CMake option to enable DTLS-SRTP (PR 6991) * Add CMake options for enabling QUIC and cURL (PR 7049) * Improve RSA blinding to make code more constant time (PR 6955) * Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981) * Default to native Windows threading API on MinGW (PR 7015) * Return better error codes from OCSP response check (PR 7028) * Updated Espressif ESP32 TLS client and server examples (PR 6844) * Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037) * Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963) * Improve Arduino IDE 1.5 project file to match recursive style (PR 7007) * Simplify and improve apple-universal build script (PR 7025) Fixes * Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931) * Fix for building PKCS#7 with RSA disabled (PR 6902) * Fix for advancing output pointer in wolfSSL_i2d_X509() (PR 6891) * Fix for EVP_EncodeBlock() appending a newline (PR 6900) * Fix for wolfSSL_RSA_verify_PKCS1_PSS() with RSA_PSS_SALTLEN_AUTO (PR 6938) * Fixes for CODESonar reports around isalpha() and isalnum() calls (PR 6810) * Fix for SP ARM64 integer math to avoid compiler optimization issues (PR 6942) * Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971) * Fix for SP Thumb2 to make functions not inlined (PR 6993) * Fix for SP Cortex-M assembly large build with IAR (PR 6954) * Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947) * Fix for SP ARM64 P-256 for not inlining functions for iOS compatibilit (PR 6979) * Fix for WOLFSSL_CALLBACKS and potential memory error (PR 6949) * Fixes for wolfSSL’s Zephyr OS port (PR 6930) * Fix for build errors when building for NXP mmCAU (FREESCALE_MMCAU) (PR 6970) * Fix for TLS 1.3 SendBuffered() return code in non-blocking mode (PR 7001) * Fix for TLS Hmac_UpdateFinal() when padding byte is invalid (PR 6998) * Fix for ARMv8 AES-GCM streaming to check size of IV before storing (PR 6996) * Add missing calls to wc_AesInit() before wc_AesSetKey() (PR 7011) * Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976) * Fixes for building wolfSSL in Visual Studio (PR 7040)

security/wolfssl: Update to v5.6.4

2023-11-19T10:36:45Z

Changes since v5.6.3: wolfSSL Release 5.6.4 (October 30, 2023) NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 * Old CyaSSL/CtaoCrypt shim layer was removed in this release (5.6.4) Vulnerabilities * [Medium] A fix was added, but still under review for completeness, for a Bleichenbacher style attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a large number of trial connections. This issue is around RSA decryption and affects static RSA cipher suites on the server side, which are not recommended to be used and are off by default. Static RSA cipher suites were also removed from the TLS 1.3 protocol and only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It's recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. The fix is located in this pull request (#6896) New Feature Additions * DTLS 1.3 PQC: support fragmenting the second ClientHello message. This allows arbitrarily long keys to be used, opening up support for all PQC ciphersuites in DTLS 1.3. * SM2/SM3/SM4: Chinese cipher support including TLS 1.3 and 1.2 cipher suites. SM2 SP implementation available. * Ability to parse ASN1 only with SMIME_read_PKCS7 * Added support for MemUse Entropy on Windows * Added Ada Bindings for wolfSSL * Added a PEM example that converts to and from DER/PEM. * Added LMS/HSS and XMSS/XMSS^MT wolfcrypt hooks, both normal and verify-only options. * Added support for the AES EAX mode of operation * Port for use with Hitch (https://github.com/varnish/hitch) added * Add XTS API's to handle multiple sectors in new port ot VeraCrypt Enhancements and Optimizations * Turned on SNI by default on hosts with resources * Improved support for Silicon Labs Simplicity Studio and the ERF32 Gecko SDK * Thumb-2 and ARM32 Curve25519 and Ed25519 assembly have significantly improved performance. * Thumb-2 AES assembly code added. * Thumb-2 and ARM32 SP implementations of RSA, DH and ECC have significantly improved performance. * Minor performance improvements to SP ECC for Intel x64. * AES-XTS assembly code added for Intel x64, Aarch64 and ARM32. * Added support for X963 KDFs to ECIES. * Added 32-bit type only implementation of AES GMULT using tables. * Add support for nginx version 1.25.0 * Add support for Kerberos version 5 1.21.1 * Check all CRL entries in case a single issuer has multiple CRL's loaded * CRL verify the entire chain including loaded CA's * Added example for building wolfSSL as an Apple universal binary framework using configure * Sniffer tool now supports decrypting TLS sessions using secrets obtained from a SSLKEYLOGFILE * Updates made for EBSNET port * Update "--enable-jni" to include additional defines for expanded JNI support. Also includes JCE and JSSE builds under the single enable option now. Fixes * Fixed error handling when decrypted pre-master secret is too long when using static RSA. * Added a fix for keymod use with i.MX RT1170 CAAM blobs * Added a fix for AES-GCM use with Petalinux Xilinx * Fixed wc_SignatureGenerate_ex to not call verify twice * Fixed wolfCrypt FIPS DLL on Win32 * Fixed TFM math library big-endian reading implementation when a zero length buffer is passed in. * Fixed NO_CERT configurations to build correctly. * Fixed ARM AES-GCM streaming assembly when –enable-opensslextra defined. * Added modulus checks to heap math implementation of mp_exptmod(). * Fixed Windows assembly code to handle that certain XMM registers are non-volatile. * Aarch64 SP ECC implementation of sp_256_mont_dbl_4 has the register list for the assembly code fixed to include all used registers. * mp_sqrt_mod_prime fixed to limit the number of iterations of a loop to handle malicious non-prime values being passed in. * Ignore session ID's shorter than 32 bytes instead of erroring out

security/wolfssl: fix packageing (+)

2023-07-02T18:48:43Z

Unbreak packaging after 5638b5ef1ff5d825cda9432d97540fd1fe4caa8c ===> Checking for items in STAGEDIR missing from pkg-plist Error: Orphaned: lib/libwolfssl.so.35.5.1 ===> Checking for items in pkg-plist which are not in STAGEDIR Error: Missing: lib/libwolfssl.so.35.4.0 ===> Error: Plist issues found. Reported by: poudriere fallout Approved by: portmgr blanket

security/wolfssl: Update to v5.6.3

2023-07-01T17:07:46Z

Changes since v5.6.0: wolfSSL Release 5.6.3 (Jun 16, 2023) Release 5.6.3 of wolfSSL embedded TLS has 4 bug fixes: * Fix for setting the atomic macro options introduced in release 5.6.2. This issue affects GNU gcc autoconf builds. The fix resolves a potential mismatch of the generated macros defined in options.h file and the macros used when the wolfSSL library is compiled. In version 5.6.2 this mismatch could result in unstable runtime behavior. * Fix for invalid suffix error with Windows build using the macro GCM_TABLE_4BIT. * Improvements to Encrypted Memory support (WC_PROTECT_ENCRYPTED_MEM) implementations for modular exponentiation in SP math-all (sp_int.c) and TFM (tfm.c). * Improvements to SendAlert for getting output buffer. wolfSSL Release 5.6.2 (Jun 09, 2023) Release 5.6.2 has been developed according to wolfSSL's development and QA process (see link below) and successfully passed the quality criteria. https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 Release 5.6.2 of wolfSSL embedded TLS has bug fixes and new features including: Vulnerabilities * [Low] In cases where a malicious agent could analyze cache timing at a very detailed level, information about the AES key used could be leaked during T/S Box lookups. One such case was shown on RISC-V hardware using the MicroWalk tool (https://github.com/microwalk-project/Microwalk). A hardened version of T/S Box lookups was added in wolfSSL to help mitigate this potential attack and is now on by default with RISC-V builds and can be enabled on other builds if desired by compiling wolfSSL with the macro WOLFSSL_AES_TOUCH_LINES. Thanks to Jan Wichelmann, Christopher Peredy, Florian Sieck, Anna Pätschke, Thomas Eisenbarth (University of Lübeck): MAMBO-V: Dynamic Side-Channel Leakage Analysis on RISC-V. Fixed in the following GitHub pull request https://github.com/wolfSSL/wolfssl/pull/6309 * [High] In previous versions of wolfSSL if a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing surreptitious access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. We recommend that TLS 1.3 client side users update the version of wolfSSL used. Thanks to Johannes from Sectra Communications and Linköping University for the report. Fixed in the following GitHub pull request https://github.com/wolfSSL/wolfssl/pull/6412 New Feature Additions New Ports and Expansions * Add support for STM32H5 * Add support for Renesas TSIP v1.17 * Add Renesas SCE RSA crypto-only support * STARCORE DSP port and example builds added * Add the function wc_PKCS7_SetDefaultSignedAttribs for setting PKCS7 signed attributes to use with PKCS7 bundle creation * NXP IMX6Q CAAM port with QNX and performance optimizations for AES-CTR New Build Options * ASN.1 print utility to decode ASN.1 syntax and print out human readable text --enable-asn-print. Utility app is located in the directory ./examples/asn1/ * Add introspection for math build, wc_GetMathInfo() to get information about the math library compiled into the linked wolfSSL library * Implement TLS recommendations from RFC 9325 for hardening TLS/DTLS security. Enabled with the autoconf flag --enable-harden-tls. * Add option to support disabling thread local storage, --disable-threadlocal * Added wc_DsaSign_ex() and wc_DsaVerify_ex() for handling alternative digest algorithms with DSA Sign/Verify * Implement atomic operations interface. Macros auto-detect if atomic operations are expected to be available, can be turned off with the macro WOLFSSL_NO_ATOMICS * Added support for DTLS 1.3 Authentication and Integrity-Only Cipher Suites * Expand crypto callback to have a device ID find callback function with wc_CryptoCb_SetDeviceFindCb. Enabled with the macro WOLF_CRYPTO_CB_FIND Enhancements and Optimizations Optimizations * Increased performance with ChaCha20 C implementation and general XOR operations * Added integer type to the ASN.1 sequencing with ASN.1 Integer sequence * With wolfSSL_get_x509_next_altname reset alt name list to head once cycled through if compiling with the macro WOLFSSL_MULTICIRCULATE_ALTNAMELIST * Additional key validity sanity checks on input to wolfSSL_EC_KEY_set_private_key * adds support for TLSv1.3 stateful session tickets when using SSL_OP_NO_TICKET Memory Optimizations * Improvements to stack usage and management with SP int math library * Optimization to TLS 1.3 server to remove caching messages for Ed25519/Ed448 * Added a HAVE_CURL macro build for building a subset of the wolfSSL library when linking with cURL * Memory usage improvement with reducing the size of alignment needed with AES * Reduce run time memory used with ECC operations and ALT_ECC_SIZE * Fixes and improvements for building edge cases such as crypto callback without hash-drbg with low footprint options * Support HAVE_SESSION_TICKET build option without depending on realloc Documentation * Instructions for GPDMA on STM32 configuration added * Add in instructions for compiling with zephyr on STM32 * Documentation fixup for wolfSSL_get_chain_cert() * Fix the file pointed to in the TI RTOS documentation that we maintain * Documentation for wolfSSL_CertManagerFreeCRL * Updates made to AES and Chacha documentation * Update Japanese comments for Ed25519, AES, and other miscellaneous items Tests * Add in an option for easily testing malloc failures when building with WOLFSSL_MEM_FAIL_COUNT macro * Updated in process for using Expect vs Assert to facilitate more malloc failure tests * Enhance wolfCrypt test for builds that do not have ECC SECP curves enabled * ESP32 platform-specific VisualGDB test & benchmark projects * Update to dependencies in docker container file used for tests * Fix up for base 10 output with bundled benchmark application Port Updates * Zephyr port update, compile time warning fixes, misc. fixes when used with TLS and update of includes * Update RIOT-OS to not compile out use of writev by default * Update Micrium port to enable use of STM32_RNG * Micrium updates for XMEMOVE and XSTRTOK use * Various Espressif HW crypto, SHA2, AES, MP updates * Added in ASIO build option with CMake builds General Enhancements * Global codebase cleanup for C89 compliance and wolfCrypt -Wconversion hygiene * PKCS#11 enhancement adding a callback for RSA key size when using a hardware key, by default 2048 bit key is used * Allow for unknown OIDs in extensions in wolfSSL_X509_set_ext() * Allow user to override XSTAT by defining the macro XSTAT when compiling * Support UPN and SID with x509 certificate extensions and custom OID build * Write next IV in wolfSSL_DES_ede3_cbc_encrypt for better handling of inline encryption * Adding NO_ASN_TIME_CHECK build option for compiling out certificate before/after checks * Improve different peer recvfrom handling and error reporting with ipv4 vs ipv6 Fixes * Fix for STM32 ECC sign and verify out of bounds buffer write when the hash length passed in is larger than the key size. Thanks to Maximilian for the report. * Fix to skip Async_DevCtxInit when using init rsa/ecc label/id api's * Revert WOLFSSL_NO_ASN_STRICT macro guard around alternate names directory list * In async mode, don't retry decrypting if a valid error is encountered on a packet parse attempt * Add additional sanity check on PKCS7 index value in wc_PKCS7_DecryptKekri * Fix for padding when using an AuthEnvelope PKCS7 type with GCM/CCM stream ciphers * Fix siphash assembly so that no register is left behind * Fix to not send a TLS 1.3 session ID resume response when resuming and downgrading to a protocol less than TLS 1.3 * Fix overwriting serialNumber by favouriteDrink when generating a certificate using Cert struct * Fix for the default realloc used with EspressIf builds * Track SetDigest usage to avoid invalid free under error conditions * DTLS v1.3 fix for epoch 0 check on plaintext message * Fix for session ticket memory leak in wolfSSL_Cleanup * Fixes for propagating SendAlert errors when the peer disconnects * Replace XMEMCPY with XMEMMOVE to fix valgrind-3.15.0 reports "Source and destination overlap in memcpy" when using --enable-aesgcm-stream * Fix for potential out-of-bounds write edge case in fp_mod_2d with --enable-fastmath math library * Fix getting ECC key size in stm32_ecc_sign_hash_ex * Fix for case where wc_PeekErrorNodeLineData was not unlocking error queue on error * Fix for async ECC shared secret state * Fix for better error checking with sp_gcd with SP int math library * Fix memory leak in TLSX_KeyShare_Setup when handling an error case * Fix for double free edge case in InitOCSPRequest when handling a memory allocation failure * X509 NAME Entry fix for leaking memory on error case * Fix wolfssl_asn1_time_to_tm setting unexpected fields in tm struct * Fix for FIPS ECC integrity check with crypto callback set * BN_to_ASN1_INTEGER fix for handling leading zero byte padding when needed * Fix a typo in PP macro and add a ceiling to guard against implementation bugs * DTLS 1.3 fix for using the correct label when deriving the resumption key * OCSP fix for GetDateInfo edge case with non ASN template builds * Allow a user set certificate callback function to override the skipAddCA flag when parsing a certificate * SP int: sp_radix_size when radix 10 fix temp size for handling edge case * Fixes and improvements for handling failures with memory allocations * Fix for DecodeECC_DSA_Sig to handle r and s being initialized * Fix for wc_ecc_is_point to ensure that the x and y are in range [0, p-1] and z is one (affine ordinates) Build Fixes * Fix for building on Windows with CMake and using USER_SETTINGS and fix for options.h creation with CMake when using USER_SETTINGS * CMake fixes and improvements for use with mingw32 * Fix for building with wpas and x509 small options * Check if colrm is available for options.h creation when using autoconf * Clean up NO_BIG_INT build, removing WOLFSSL_SP_MATH macro and heapmath compile * Fix PKCS#7 build with NO_PKCS7_STREAM * Fix compilation error in CC-RX and remove unnecessary public key import * SP Build fixes for ARM assembly with ARMv6 clz and ARM thumb debug build * For to not advertise support for RSA in TLS extensions when compiled with NO_RSA

security/wolfssl: Update to v5.6.0

2023-03-26T09:14:13Z

Changes since v5.5.4: wolfSSL Release 5.6.0 (Mar 24, 2023) Release 5.6.0 has been developed according to wolfSSL's development and QA process (see link below) and successfully passed the quality criteria. https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance NOTE: * --enable-heapmath is being deprecated and will be removed by 2024 * This release makes ASN Template the default with ./configure, the previous ASN parsing can be built with --enable-asn=original Release 5.6.0 of wolfSSL embedded TLS has bug fixes and new features including: New Feature Additions * ASN template is now the default ASN parsing implementation when compiling with configure * Added in support for TLS v1.3 Encrypted Client Hello (ECH) and HPKE (Hybrid Public Key Encryption) * DTLS 1.3 stateless server ClientHello parsing support added Ports * Add RX64/RX71 SHA hardware support * Port to RT1170 and expand NXP CAAM driver support * Add NuttX integration files for ease of use * Updated Stunnel support for version 5.67 Compatibility Layer * Add in support for AES-CCM with EVP * BN compatibility API refactoring and separate API created * Expanding public key type cipher suite list strings support Misc. * Support pthread_rwlock and add enable option * Add wolfSSL_CertManagerLoadCABuffer_ex() that takes a user certificate chain flag and additional verify flag options * Docker build additions for wolfSSL library and wolfCLU application * Add favorite drink pilot attribute type to get it from the encoding * Added in support for indefinite length BER parsing with PKCS12 * Add dynamic session cache which allocates sessions from the heap with macro SESSION_CACHE_DYNAMIC_MEM Improvements / Optimizations Tests * Additional CI (continuous integration) testing and leveraging of GitHub workflows * Add CI testing for wpa_supplicant, OpenWrt and OpenVPN using GitHub workflows * Add compilation of Espressif to GitHub workflows tests * Refactoring and improving error results with wolfCrypt unit test application * Minor warning fixes from Coverity static analysis scan * Add new SHA-512/224 and SHA-512/256 tests * Used codespell and fixed some minor typos Ports * Improve TLS1.2 client authentication to use TSIP * Updated Kyber macro to be WOLFSSL_HAVE_KYBER and made changes that make Kyber work on STM32 * AES-GCM Windows assembly additions * CRLF line endings, trailing spaces for C# Wrapper Projects Compatibility Layer * Update PubKey and Key PEM-to-DER APIs to support return of needed DER size * Allow reading ENC EC PRIVATE KEY as well via wolfSSL_PEM_read_bio_ECPrivateKey * Improve wolfSSL_EC_POINT_cmp to handle Jacobian ordinates * Fix issue with BIO_reset() and add BIO_FLAGS_MEM_RDONLY flag support for read only BIOs SP * In SP math library rework mod 3 and use count leading zero instruction * Fix with SP ECC sign to reject the random k generated when r is 0 * With SP math add better detection of when add won't work and double is needed with point_add_qz1 internal function * With SP int fail when buffer writing to is too small for number rather than discarding the extra values Builds * Define WOLFSSL_SP_SMALL_STACK if wolfSSL is build with --enable-smallstack * Fix CMake to exclude libm when DH is not enabled * Allow building of SAKKE as external non-FIPS algorithm with wolfmikey product * Add option to add library suffix, --with-libsuffix * ASN template compile option WOLFSSL_ASN_INT_LEAD_0_ANY to allow leading zeros * Add user_settings.h template for wolfTPM to examples/configs/user_settings_wolftpm.h * Purge the AES variant of Dilithium * Expand WOLFSSL_NO_ASN_STRICT to allow parsing of explicit ECC public key * Remove relocatable text in ARMv7a AES assembly for use with FIPS builds * Expand checking for hardware that supports ARMv7a neon with autotools configure * Sanity check on allocation fails with DSA and FP_ECC build when zeroizing internal buffer * Additional TLS alerts sent when compiling with WOLFSSL_EXTRA_ALERTS macro defined Benchmarking * Update wolfCrypt benchmark Windows build files to support x64 Platform * Add SHA512/224 and SHA512/256 benchmarks, fixed CVS macro and display sizes * Separate AES-GCM streaming runs when benchmarked * No longer call external implementation of Kyber from benchmark * Fix for benchmarking shake with custom block size * Fixes for benchmark help -alg list and block format Documentation/Examples * Document use of wc_AesFree() and update documentation of Ed25519 with Doxygen * Move the wolfSSL Configuration section higher in QUIC.md * Add Japanese Doxygen documentation for cmac.h, quic.h and remove incomplete Japanese doxygen in asn_public.h * Espressif examples run with local wolfSSL now with no additional setup needed * Added a fix for StartTLS use In the example client * Add a base-line user_settings.h for use with FIPS 140-3 in XCode example app Optimizations * AES-NI usage added for AES modes ECB/CTR/XTS Misc * Update AES-GCM stream decryption to allow long IVs * Internal refactor to use wolfSSL_Ref functions when incrementing or decrementing the structures reference count and fixes for static analysis reports * Cleanup function logging making adjustments to the debug log print outs * Remove realloc dependency in DtlsMsgCombineFragBuckets function * Refactor to use WOLFSSL_CTX’s cipher suite list when possible * Update internal padding of 0’s with DSA sign and additional tests with mp_to_unsigned_bin_len function * With DTLS SRTP use wolfSSL_export_keying_material instead of wc_PRF_TLS * Updated macro naming from HAVE_KYBER to be WOLFSSL_HAVE_KYBER * Update AES XTS encrypt to handle in-place encryption properly * With TLS 1.3 add option to require only PSK with DHE Fixes Ports * Fix for AES use with CAAM on imx8qxp with SECO builds * Fix for PIC32 crypto HW and unused TLSX_SetResponse * Fix warning if ltime is unsigned seen with QNX build * Updates and fix for Zephyr project support * Include sys/time.h for WOLFSSL_RIOT_OS * Move X509_V errors from enums to defines for use with HAProxy CLI * Fix IAR compiler warnings resolved * Fix for STM32 Hash peripherals (like on F437) with FIFO depth = 1 * ESP32 fix for SHA384 init with hardware acceleration Builds * Add WOLFSSL_IP_ALT_NAME macro define to --enable-curl * Fixes for building with C++17 and avoiding clashing with byte naming * Fixes SP math all build issue with small-stack and no hardening * Fix for building with ASN template with NO_ASN_TIME defined * Fix building FIPSv2 with WOLFSSL_ECDSA_SET_K defined * Don't allow aesgcm-stream option with kcapi * Fix DTLS test case for when able to read peers close notify alert on FreeBSD systems * Fix for "expression must have a constant value" in tls13.c with Green Hills compiler * Fixes for building KCAPI with opensslextra enabled * Fix warnings of shadows min and subscript with i486-netbsd-gcc compiler * Fix issue with async and WOLFSSL_CHECK_ALERT_ON_ERR * Fix for PKCS7 with asynchronous crypto enabled Math Library * SP Aarch64 fix for conditional changed in asm needing "cc" and fix for ECC P256 mont reduce * In SP builds add sanity check with DH exp. to check the output length for minimum size * In SP math fix scalar length check with EC scalar multiply * With SP int fix handling negative character properly with read radix * Add error checks before setting variable err in SP int with the function sp_invmod_mont_ct * Fix to add sanity check for malloc of zero size in fastmath builds * In fastmath fix a possible overflow in fp_to_unsigned_bin_len length check * Heapmath fast mod. reduce fix Compatibility Layer * Fixes for encoding/decoding ecc public keys and ensure i2d public key functions do not include any private key information * Fix for EVP_EncryptUpdate to update outl on empty input * Fix SE050 RSA public key loading and RSA/ECC SE050 TLS Compatibility * Rework EC API and validate point after setting it * Fix for X509 RSA PSS with compatibility layer functions * Fix size of structures used with SHA operations when built with opensslextra for Espressif hardware accelerated hashing * Added sanity check on key length with wolfSSL_CMAC_Init function * Fix for return value type conversion of bad mutex error in logging function * Fix NID conflict NID_givenName and NID_md5WithRSAEncryption * Fix unguarded XFPRINTF calls with opensslextra build * Fix wolfSSL_ASN1_INTEGER_to_BN for negative values * Fix for potential ASN1_STRING leak in wolfSSL_X509_NAME_ENTRY_create_by_txt and wolfSSL_X509_NAME_ENTRY_create_by_NID when memory allocation fails Misc. * Add sanity check to prevent an out of bounds read with OCSP response decoding * Sanity check to not allow 0 length with bit string and integer when parsing ASN1 syntax * Adjust RNG sanity checks and remove error prone first byte comparison * With PKCS7 add a fix for GetAsnTimeString() to correctly increment internal data pointer * PKCS7 addition of sequence around algo parameters with authenvelop * DSA fixes for clearing mp_int before re-reading data and avoid mp_clear without first calling mp_init * Fix for SRTP setting bitfield when it is encoded for the TLS extension * Fix for handling small http headers when doing CRL verification * Fix for ECCSI hash function to validate the output size and curve size * Fix for value of givenName and name being reversed with CSR generation * Fix for error type returned (OCSP_CERT_UNKNOWN) with OCSP verification * Fix for a potential memory leak with ProcessCSR when handling OCSP responses * Fix for VERIFY_SKIP_DATE flag not ignoring date errors when set * Fix for zlib decompression buffer issue with PKCS7 * Fix for DTLS message pool send size used and DTLS server saving of the handshake sequence * Fix to propagate WOLFSSL_TICKET_RET_CREATE error return value from DoDecryptTicket() * Fix for handling long session IDs with TLS 1.3 session tickets * Fix for AES-GCM streaming when caching an IV * Fix for test case with older selftest that returns bad padding instead of salt len error * Add fix for siphash cache and added in additional tests * Fix potential out of bounds memset to 0 in error case with session export function used with --enable-sessionexport builds * Fix possible NULL dereference in TLSX_CSR_Parse with TLS 1.3 * Fix for sanity check on RSA pad length with no padding using the build macro WC_RSA_NO_PADDING

security/wolfssl: Update to v5.5.4

2023-02-04T15:44:24Z

Changes since v5.5.3: wolfSSL Release 5.5.4 (Dec 21, 2022) Release 5.5.4 of wolfSSL embedded TLS has bug fixes and new features including: New Feature Additions * QUIC related changes for HAProxy integration and config option * Support for Analog Devices MAXQ1080 and MAXQ1065 * Testing and build of wolfSSL with NuttX * New software based entropy gatherer with configure option --enable-entropy-memuseOP * NXP SE050 feature expansion and fixes, adding in RSA support and conditional compile of AES and CMAC * Support for multi-threaded sniffer Improvements / Optimizations Benchmark and Tests * Add alternate test case for unsupported static memory API when testing mutex allocations * Additional unit test cases added for AES CCM 256-bit * Initialize and free AES object with benchmarking AES-OFB * Kyber with DTLS 1.3 tests added * Tidy up Espressif ESP32 test and benchmark examples * Rework to be able to run API tests individually and add display of time taken per test Build and Port Improvements * Add check for 64-bit ABI on MIPS64 before declaring a 64-bit CPU * Add support to detect SIZEOF_LONG in armclang and diab * Added in a simple example working on Rx72n * Update azsphere support to prevent compilation of file included inline * --enable-brainpool configure option added and default to on when custom curves are also on * Add RSA PSS salt defines to engine builds if not FIPS v2 Post Quantum * Remove kyber-90s and route all Kyber through wolfcrypt * Purge older version of NTRU and SABER from wolfSSL SP Math * Support static memory build with sp-math * SP C, SP int: improve performance * SP int: support mingw64 again * SP int: enhancements to guess 64-bit type and check on NO_64BIT macro set before using long long * SP int: check size required when using sp_int on stack * SP: --enable-sp-asm now enables SP by default if not set * SP: support aarch64 big endian DTLS * Allow DTLS 1.3 to compile when FIPS is enabled * Allow for stateless DTLS client hello parsing Misc. * Easier detection of DRBG health when using Intel’s RDRAND by updating the structures status value * Detection of duplicate known extensions with TLS * PKCS#11 handle a user PIN that is a NULL_PTR, compile time check in finding keys, add initialization API * Update max Cert Policy size based on RFC 5280 * Add Android CA certs path for wolfSSL_CTX_load_system_CA_certs() * Improve logic for enabling system CA certs on Apple devices * Stub functions to allow for cpuid public functions with non-intel builds * Increase RNG_SECURITY_STRENGTH for FIPS * Improvements in OpenSSL Compat ERR Queue handling * Support ASN1/DER CRLs in LoadCertByIssuer * Expose more ECC math functions and improve async shared secret * Improvement for sniffer error messages * Warning added that renegotiation in TLS 1.3 requires session ticket * Adjustment for TLS 1.3 post auth support * Rework DH API and improve PEM read/write Build Fixes * Fix --enable-devcrypto build error for sys without u_int8_t type * Fix casts in evp.c and build issue in ParseCRL * Fixes for compatibility layer building with heap hint and OSSL callbacks * fix compile error due to Werro=undef on gcc-4.8 * Fix mingw-w64 build issues on windows * Xcode project fixes for different build settings * Initialize variable causing failures with gcc-11 and gcc-12 with a unique wolfSSL build configuration * Prevent WOLFSSL_NO_MALLOC from breaking RSA certificate verification * Fixes for various tests that do not properly handle `WC_PENDING_E` with async. builds * Fix for misc `HashObject` to be excluded for `WOLFCRYPT_ONLY` OCSP Fixes * Correctly save next status with OCSP response verify * When the OCSP responder returns an unknown exception, continue through to checking the CRL Math Fixes * Fix for implicit conversion with 32-bit in SP math * Fix for error checks when modulus is even with SP int build * Fix for checking of err in _sp_exptmod_nct with SP int build * ECC cofactor fix when checking scalar bits * ARM32 ASM: don't use ldrd on user data * SP int, fix when ECC specific size code included Port Fixes * Fixes for STM32 PKA ECC (not 256-bit) and improvements for AES-GCM * Fix for cryptocell signature verification with ECC * Benchmark devid changes, CCM with SECO fix, set IV on AES import into SECO Compat. Layer Fixes * Fix for handling DEFAULT:... cipher suite list * Fix memory leak in wolfSSL_X509_NAME_ENTRY_get_object * Set alt name type to V_ASN1_IA5STRING * Update name hash functions wolfSSL_X509_subject_name_hash and wolfSSL_X509_issuer_name_hash to hash the canonical form of subject * Fix wolfSSL_set_SSL_CTX() to be usable during handshake * Fix X509_get1_ocsp to set num of elements in stack * X509v3 EXT d2i: fix freeing of aia * Fix to remove recreation of certificate with wolfSSL_PEM_write_bio_X509() * Link newly created x509 store's certificate manager to self by default to assist with CRL verification * Fix for compatibility `EC_KEY_new_by_curve_name` to not create a key if the curve is not found Misc. * Free potential signer malloc in a fail case * fix other name san parsing and add RID cert to test parsing * WOLFSSL_OP_NO_TICKET fix for TLSv1.2 * fix ASN template parsing of X509 subject directory attribute * Fix the wrong IV size with the cipher suite TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 * Fix incorrect self signed error return when compiled with certreq and certgen. * Fix wrong function name in debug comment with wolfSSL_X509_get_name_oneline() * Fix for decryption after second handshake with async sniffer * Allow session tickets to properly resume when using PQ KEMs * Add sanity overflow check to DecodeAltNames input buffer access

security/wolfssl: Update the description.

2022-11-26T21:08:47Z

Update the supported TLS version in description. PR: 267737 Reported by: Yonas Yanfa

security/wolfssl: Update to v5.5.3

2022-11-12T05:55:40Z

Changes since v5.5.1: wolfSSL Release 5.5.3 (Nov 2, 2022) Release 5.5.3 of wolfSSL embedded TLS has the following bug fix: Fixes * Fix for possible buffer zeroization overrun introduced at the end of v5.5.2 release cycle in GitHub pull request 5743 (https://github.com/wolfSSL/wolfssl/pull/5743) and fixed in pull request 5757 (https://github.com/wolfSSL/wolfssl/pull/5757). In the case where a specific memory allocation failed or a hardware fault happened there was the potential for an overrun of 0’s when masking the buffer used for (D)TLS 1.2 and lower operations. (D)TLS 1.3 only and crypto only users are not affected by the issue. This is not related in any way to recent issues reported in OpenSSL. wolfSSL Release 5.5.2 (Oct 28, 2022) Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including: Vulnerabilities * [Med] In the case that the WOLFSSL_CALLBACKS macro is set when building wolfSSL, there is a potential heap over read of 5 bytes when handling TLS 1.3 client connections. This heap over read is limited to wolfSSL builds explicitly setting the macro WOLFSSL_CALLBACKS, the feature does not get turned on by any other build options. The macro WOLFSSL_CALLBACKS is intended for debug use only, but if having it enabled in production, users are recommended to disable WOLFSSL_CALLBACKS. Users enabling WOLFSSL_CALLBACKS are recommended to update their version of wolfSSL. Thanks to Lucca Hirschi and Steve Kremer from LORIA, Inria and Max Ammann from Trail of Bits for finding and reporting the bug with the tlspuffin tool developed partly at LORIA and Trail of Bits. CVE 2022-42905 Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including: New Feature Additions * Add function wolfSSL_CTX_load_system_CA_certs to load system CA certs into a WOLFSSL_CTX and --sys-ca-certs option to example client * Add wolfSSL_set1_host to OpenSSL compatible API * Added the function sk_X509_shift * AES x86 ASM for AES-CBC and GCM performance enhancements * Add assembly for AES for ARM32 without using crypto hardware instructions * Xilinx Versal port and hardware acceleration tie in * SP Cortex-M support for ICCARM Enhancements * Add snifftest vcxproj file and documentation * Nucleus Thread Types supported * Handle certificates with RSA-PSS signature that have RSAk public keys * Small stack build improvements * DTLS 1.3 improvements for Alerts and unit tests * Add a binary search for CRL * Improvement of SSL/CTX_set_max_early_data() for client side * Remove unused ASN1_GENERALIZEDTIME enum value from wolfssl/ssl.h * Add user_settings.h for Intel/M1 FIPSv2 macOS C++ projects * Add dtlscid.test to ‘make check’ unit testing * Generate an assembler-safe user_settings.h in configure.ac and CMakeLists.txt * ForceZero enabled with USE_FAST_MATH * Add TLS 1.3 support of ticketNonce sizes bigger than MAX_TICKET_NONCE_SZ * FIPSv2 builds on win10 adjust for new fastmath default in settings.h * Add IRQ install for Aruix example Fixes * When looking up the session by ID on the server, check that the protocol version of the SSL and session match on TLS 1.3 or not * Fix for potential EVP_PKEY_DH memory leak with OPENSSL_EXTRA * Curve448 32-bit C code: handle corner case * Fixup builds using WOLFSSL_LOG_PRINTF * Correct DIST_POINT_NAME type value * Do not perform IV Wrap test when using cert3389 inlined armasm * Fix for Linux kernel module and stdio.h * (D)TLS: send alert on version mismatch * Fix PKCS#7 SignedData verification when signer cert is not first in SET * Fix bug with wolfIO_TcpConnect not working with timeout on Windows * Fix output length bug in SP non-blocking ECC shared secret gen * Fix build with enable-fastmath and disable-rsa * Correct wolfSSL_sk_X509_new in OpenSSL compatible API * Fixes for SP and x86_64 with MSVC * Fix wrong size using DTLSv1.3 in RestartHandshakeHashWithCookie * Fix redundant file include with TI RTOS build * Fix wolfCrypt only build with wincrypt.h * DTLS 1.2: Reset state when sending HelloVerifyRequest

security/wolfssl: Update to v5.5.1

2022-10-01T11:55:13Z

Changes since v5.5.0: wolfSSL Release 5.5.1 (Sep 28, 2022) Latest Vulnerabilities * [Med] Denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. New Feature Additions * Add support for non-blocking ECC key gen and shared secret gen for P-256/384/521 * Add support for non-blocking ECDHE/ECDSA in TLS/DTLS layer. * Port to NXP RT685 with FreeRTOS * Add option to build post quantum Kyber API (--enable-kyber) * Add post quantum algorithm sphincs to wolfCrypt * Config. option to force no asm with SP build (--enable-sp=noasm) * Allow post quantum keyshare for DTLS 1.3 Enhancements * DTLSv1.3: Do HRR Cookie exchange by default * Add wolfSSL_EVP_PKEY_new_CMAC_key to OpenSSL compatible API * Update ide win10 build files to add missing sp source files * Improve Workbench docs * Improve EVP support for CHACHA20_POLY1305 * Improve wc_SetCustomExtension documentation * RSA-PSS with OCSP and add simple OCSP response DER verify test case * Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h * Don't over-allocate memory for DTLS fragments * Add WOLFSSL_ATECC_TFLXTLS for Atmel port * SHA-3 performance improvements with x86_64 assembly * Add code to fallback to S/W if TSIP cannot handle * Improves entropy with VxWorks * Make time in milliseconds 64-bits for longer session ticket lives * Support for setting cipher list with bytes * wolfSSL_set1_curves_list(), wolfSSL_CTX_set1_curves_list() improvements * Add to RSAES-OAEP key parsing for pkcs7 * Add missing DN nid to work with PrintName() * SP int: default to 16 bit word size when NO_64BIT defined * Limit the amount of fragments we store per a DTLS connection and error out when max limit is reached * Detect when certificate's RSA public key size is too big and fail on loading of certificate Fixes * Fix for async with OCSP non-blocking in ProcessPeerCerts * Fixes for building with 32-bit and socket size sign/unsigned mismatch * Fix Windows CMakeList compiler options * TLS 1.3 Middle-Box compat: fix missing brace * Configuration consistency fixes for RSA keys and way to force disable of private keys * Fix for Aarch64 Mac M1 SP use * Fix build errors and warnings for MSVC with DTLS 1.3 * Fix HMAC compat layer function for SHA-1 * Fix DTLS 1.3 do not negotiate ConnectionID in HelloRetryRequest * Check return from call to wc_Time * SP math: fix build configuration with opensslall * Fix for async session tickets * SP int mp_init_size fixes when SP_WORD_SIZE == 8 * Ed. function to make public key now checks for if the private key flag is set * Fix HashRaw WC_SHA256_DIGEST_SIZE for wc_Sha256GetHash * Fix for building with PSK only * Set correct types in wolfSSL_sk_*_new functions * Sanity check that size passed to mp_init_size() is no more than SP_INT_DIGITS

Remove WWW entries moved into port Makefiles

2022-09-07T21:58:51Z

Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)