Skip to content

Require fresh IVs for EVP ARIA GCM #11594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidangarske wants to merge 5 commits into
base: master
Choose a base branch
from
+129 −5
Open

Require fresh IVs for EVP ARIA GCM #11594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
17f20f7
Require an IV before EVP ARIA-GCM encryption
aidangarske Sep 29, 2026
02ee068
Require a fresh IV for each EVP ARIA-GCM message
aidangarske Sep 29, 2026
36f06ce
Require a caller IV for EVP ARIA GCM encryption
aidangarske Sep 29, 2026
76f0533
Drop the redundant ARIA GCM IV used update in EVP final
aidangarske Oct 12, 2026
d11376a
Fix HAVE_ARIA endif comment in EVP cipher init
aidangarske Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 96 additions & 0 deletions tests/api/test_evp_cipher.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2151,6 +2151,102 @@ int test_wolfssl_EVP_chacha20_poly1305(void)
return EXPECT_RESULT();
}

int test_evp_cipher_aria_gcm_iv_required(void)
{
EXPECT_DECLS;
#if defined(OPENSSL_EXTRA) && defined(HAVE_ARIA) && \
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
byte key[ARIA_128_KEY_SIZE] = {0};
byte iv[GCM_NONCE_MID_SZ] = {0};
byte input[4] = {1, 2, 3, 4};
byte output[WC_ARIA_GCM_GET_CIPHERTEXT_SIZE(sizeof(input))] = {0};
int len = 0;

ExpectNotNull(ctx);
if (ctx != NULL) {
ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_aria_128_gcm(), NULL,
NULL, NULL), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_FAILURE);
ExpectIntLT(EVP_Cipher(ctx, output, input, sizeof(input)), 0);

ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_FAILURE);
ExpectIntLT(EVP_Cipher(ctx, output, input, sizeof(input)), 0);

iv[0] = 1;
ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_SUCCESS);
EVP_CIPHER_CTX_free(ctx);
}
#endif
return EXPECT_RESULT();
}

int test_evp_cipher_aria_gcm_message_iv(void)
{
EXPECT_DECLS;
#if defined(OPENSSL_EXTRA) && defined(HAVE_ARIA) && \
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
byte key[ARIA_128_KEY_SIZE] = {0};
byte iv[GCM_NONCE_MID_SZ] = {0};
byte input[4] = {1, 2, 3, 4};
byte output[WC_ARIA_GCM_GET_CIPHERTEXT_SIZE(sizeof(input))] = {0};
int len = 0;

iv[sizeof(iv) - 1] = 1;
ExpectNotNull(ctx);
if (ctx != NULL) {
ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_aria_128_gcm(), NULL,
key, iv), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_FAILURE);
ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_FAILURE);

iv[0]++;
ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptUpdate(ctx, output, &len, input,
sizeof(input)), WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_EncryptFinal_ex(ctx, output, &len),
WOLFSSL_SUCCESS);

iv[0]++;
ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv),
WOLFSSL_SUCCESS);
ExpectIntEQ(EVP_Cipher(ctx, output, input, sizeof(input)),
0);
ExpectBufNE(output, input, sizeof(input));
ExpectIntLT(EVP_Cipher(ctx, output, input, sizeof(input)), 0);
EVP_CIPHER_CTX_free(ctx);
}
#endif
return EXPECT_RESULT();
}

int test_wolfssl_EVP_aria_gcm(void)
{
int res = TEST_SKIPPED;
Expand Down
4 changes: 4 additions & 0 deletions tests/api/test_evp_cipher.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,8 @@ int test_wolfssl_EVP_aes_ccm_zeroLen(void);
int test_wolfssl_EVP_chacha20(void);
int test_wolfssl_EVP_chacha20_poly1305(void);
int test_wolfssl_EVP_aria_gcm(void);
int test_evp_cipher_aria_gcm_iv_required(void);
int test_evp_cipher_aria_gcm_message_iv(void);
int test_wolfssl_EVP_sm4_ecb(void);
int test_wolfssl_EVP_sm4_cbc(void);
int test_wolfssl_EVP_sm4_ctr(void);
Expand Down Expand Up @@ -101,6 +103,8 @@ int test_evp_cipher_update_no_padding_buffered(void);
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_chacha20), \
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_chacha20_poly1305), \
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_aria_gcm), \
TEST_DECL_GROUP("evp_cipher", test_evp_cipher_aria_gcm_iv_required), \
TEST_DECL_GROUP("evp_cipher", test_evp_cipher_aria_gcm_message_iv), \
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_sm4_ecb), \
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_sm4_cbc), \
TEST_DECL_GROUP("evp_cipher", test_wolfssl_EVP_sm4_ctr), \
Expand Down
26 changes: 23 additions & 3 deletions wolfcrypt/src/evp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1480,6 +1480,15 @@ int wolfSSL_EVP_CipherFinal(WOLFSSL_EVP_CIPHER_CTX *ctx, unsigned char *out,
case WC_ARIA_128_GCM_TYPE:
case WC_ARIA_192_GCM_TYPE:
case WC_ARIA_256_GCM_TYPE:
if (ctx->enc && (ctx->cipher.aria.nonceSz == 0 ||
Comment thread
aidangarske marked this conversation as resolved.
Resolved
ctx->authIvUsed)) {
XFREE(ctx->authBuffer, NULL, DYNAMIC_TYPE_OPENSSL);
ctx->authBuffer = NULL;
ctx->authBufferLen = 0;
*outl = 0;
ret = WOLFSSL_FAILURE;
break;
}
if ((ctx->authBuffer && ctx->authBufferLen > 0)
|| (ctx->authBufferLen == 0)) {
if (ctx->enc)
Expand Down Expand Up @@ -1520,8 +1529,9 @@ int wolfSSL_EVP_CipherFinal(WOLFSSL_EVP_CIPHER_CTX *ctx, unsigned char *out,
ctx->authIncIv = 0;
}
else {
/* Clear IV, since IV reuse is not recommended for AES GCM. */
/* Clear IV since ARIA GCM must not reuse an IV. */
XMEMSET(ctx->iv, 0, ARIA_BLOCK_SIZE);
ctx->authIvUsed = 1;
}
if (wolfSSL_StoreExternalIV(ctx) != WOLFSSL_SUCCESS) {
ret = WOLFSSL_FAILURE;
Expand Down Expand Up @@ -7635,6 +7645,9 @@ void wolfSSL_EVP_init(void)
const byte* iv, int enc)
{
int ret = 0;
#ifdef HAVE_ARIA
int ivProvided = (iv != NULL);
#endif
(void)key;
(void)iv;
(void)enc;
Expand Down Expand Up @@ -8454,9 +8467,12 @@ void wolfSSL_EVP_init(void)
!= WOLFSSL_SUCCESS) {
return WOLFSSL_FAILURE;
}
if (ivProvided)
ctx->authIvUsed = 0;
Comment thread
aidangarske marked this conversation as resolved.
Resolved
else if (type != NULL)
ctx->authIvUsed = 1;
}

@philljj philljj Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is pre-existing, but while we're here could you correct this endif comment

    #endif /* HAVE_AESGCM && ((!HAVE_FIPS && !HAVE_SELFTEST) ||
            * HAVE_FIPS_VERSION >= 2 */

comment to match the opening

    #if defined(HAVE_ARIA)

Also, this branch is 795 commits behind master, and it's a good excuse to rebase just to be safe.

@aidangarske aidangarske Nov 6, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed the endif comment to HAVE_ARIA and rebased on current master.

#endif /* HAVE_AESGCM && ((!HAVE_FIPS && !HAVE_SELFTEST) ||
* HAVE_FIPS_VERSION >= 2 */
#endif /* HAVE_ARIA */


#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
Expand Down Expand Up @@ -9177,9 +9193,13 @@ void wolfSSL_EVP_init(void)
case WC_ARIA_256_GCM_TYPE :
WOLFSSL_MSG("ARIA GCM");
if (ctx->enc) {
if (ctx->cipher.aria.nonceSz == 0 || ctx->authIvUsed)
return WC_NO_ERR_TRACE(BAD_STATE_E);
ret = wc_AriaEncrypt(&ctx->cipher.aria, dst, src, len,
ctx->iv, ctx->ivSz, NULL, 0,
ctx->authTag, ctx->authTagSz);
if (ret == 0)
ctx->authIvUsed = 1;
}
else {
ret = wc_AriaDecrypt(&ctx->cipher.aria, dst, src, len,
Expand Down
8 changes: 6 additions & 2 deletions wolfssl/openssl/evp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -730,6 +730,8 @@ struct WOLFSSL_EVP_CIPHER_CTX {
#if !defined(NO_AES)
/* working iv pointer into cipher */
ALIGN16 unsigned char iv[WC_AES_BLOCK_SIZE];
#elif defined(HAVE_ARIA)
ALIGN16 unsigned char iv[ARIA_BLOCK_SIZE];
#elif defined(WOLFSSL_SM4)
ALIGN16 unsigned char iv[SM4_BLOCK_SIZE];
#elif defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
Expand All @@ -743,12 +745,13 @@ struct WOLFSSL_EVP_CIPHER_CTX {
ALIGN16 byte lastBlock[WOLFSSL_EVP_BUF_SIZE];
int lastUsed;
#if !defined(NO_AES) || !defined(NO_DES3) || defined(HAVE_AESGCM) || \
defined(HAVE_ARIA) || \
defined (WOLFSSL_AES_XTS) || (defined(HAVE_CHACHA) || \
defined(HAVE_POLY1305) || defined(HAVE_AESCCM)) || \
defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)
#define HAVE_WOLFSSL_EVP_CIPHER_CTX_IV
int ivSz;
#if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) || \
#if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) || defined(HAVE_ARIA) || \
defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)
byte* authBuffer;
int authBufferLen;
Expand All @@ -770,10 +773,11 @@ struct WOLFSSL_EVP_CIPHER_CTX {
#endif
int authTagSz;
#endif
#if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) || \
#if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) || defined(HAVE_ARIA) || \
defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)
WC_BITFIELD authIvGenEnable:1;
WC_BITFIELD authIncIv:1;
WC_BITFIELD authIvUsed:1;
#endif
Comment thread
aidangarske marked this conversation as resolved.
Resolved
#endif
};
Expand Down
Loading