diff --git a/wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md b/wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md index 58e7493c9d9..26b21ddf431 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md +++ b/wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md @@ -80,8 +80,8 @@ New features: for prehash signing and verification - Publish build metadata to dependent crates' build scripts: the directory of a shared wolfSSL library as DEP_WOLFSSL_LIBDIRS (e.g. to set an rpath), and - DEP_WOLFSSL_FIPS and DEP_WOLFSSL_FIPS_V5_2_3 when wolfSSL is a FIPS build or - specifically the FIPS v5.2.3 module + DEP_WOLFSSL_FIPS and DEP_WOLFSSL_FIPS_V5 when wolfSSL is a FIPS build or + specifically a FIPS v5.x.x module - build.rs looks for the library under either lib or lib64 in WOLFSSL_PREFIX, recognizes MinGW, Cygwin and MSVC library file names, and reruns when WOLFSSL_PREFIX changes diff --git a/wrapper/rust/wolfssl-wolfcrypt/README.md b/wrapper/rust/wolfssl-wolfcrypt/README.md index 78dc175f92a..05545f165a2 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/README.md +++ b/wrapper/rust/wolfssl-wolfcrypt/README.md @@ -163,7 +163,7 @@ the build scripts of crates that depend on it directly: | ------------------------- | ----- | | `DEP_WOLFSSL_LIBDIRS` | Directory containing a shared wolfSSL library (e.g. to set an rpath) | | `DEP_WOLFSSL_FIPS` | `1` when wolfSSL is a FIPS build | -| `DEP_WOLFSSL_FIPS_V5_2_3` | `1` when wolfSSL is the FIPS v5.2.3 module | +| `DEP_WOLFSSL_FIPS_V5` | `1` when wolfSSL is the FIPS v5 module | ### Cross-Compiling diff --git a/wrapper/rust/wolfssl-wolfcrypt/build.rs b/wrapper/rust/wolfssl-wolfcrypt/build.rs index 971f32f369d..ffe28b2e8dc 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/build.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/build.rs @@ -665,19 +665,17 @@ fn scan_cfg() -> Result<()> { // Crates that depend on this one see it as DEP_WOLFSSL_FIPS. println!("cargo::metadata=FIPS=1"); } - // FIPS v5.2.3 builds without RSA blinding, so it has no wc_RsaSetRNG(), + // FIPS v5 builds without RSA blinding, so it has no wc_RsaSetRNG(), // and keeps wc_RNG_DRBG_Reseed() internal though the header declares it. - println!("cargo::rustc-check-cfg=cfg(fips_v5_2_3)"); + println!("cargo::rustc-check-cfg=cfg(fips_v5)"); let version = |name: &str| { Regex::new(&format!(r"pub const {}: u32 = (\d+);", name)).unwrap() .captures(&binding).and_then(|cap| cap[1].parse::().ok()) }; - if fips && version("HAVE_FIPS_VERSION_MAJOR") == Some(5) - && version("HAVE_FIPS_VERSION_MINOR") == Some(2) - && version("HAVE_FIPS_VERSION_PATCH") == Some(3) { - println!("cargo::rustc-cfg=fips_v5_2_3"); - // Crates that depend on this one see it as DEP_WOLFSSL_FIPS_V5_2_3. - println!("cargo::metadata=FIPS_V5_2_3=1"); + if fips && version("HAVE_FIPS_VERSION_MAJOR").or_else(|| version("HAVE_FIPS_VERSION")) == Some(5) { + println!("cargo::rustc-cfg=fips_v5"); + // Crates that depend on this one see it as DEP_WOLFSSL_FIPS_V5. + println!("cargo::metadata=FIPS_V5=1"); } /* hkdf */ diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/dh.rs b/wrapper/rust/wolfssl-wolfcrypt/src/dh.rs index 520b0d55d03..b4480c7a491 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/dh.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/dh.rs @@ -1170,6 +1170,11 @@ impl DH { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::dh::DH; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let p = [ /// 0xc5u8, 0x7c, 0xa2, 0x4f, 0x4b, 0xd6, 0x8c, 0x3c, /// 0xda, 0xc7, 0xba, 0xaa, 0xea, 0x2e, 0x5c, 0x1e, @@ -1337,6 +1342,11 @@ impl DH { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::dh::DH; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let p = [ /// 0xc5u8, 0x7c, 0xa2, 0x4f, 0x4b, 0xd6, 0x8c, 0x3c, /// 0xda, 0xc7, 0xba, 0xaa, 0xea, 0x2e, 0x5c, 0x1e, diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs b/wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs index 3e3254a875d..5c5a6fb7462 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs @@ -726,6 +726,11 @@ impl ECC { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = RNG::new().expect("Failed to create RNG"); /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()"); /// let hash = [0x42u8; 32]; @@ -791,6 +796,11 @@ impl ECC { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = RNG::new().expect("Failed to create RNG"); /// let curve_id = ECC::SECP256R1; /// let curve_size = ECC::get_curve_size_from_id(curve_id).expect("Error with get_curve_size_from_id()"); @@ -1030,6 +1040,11 @@ impl ECC { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = RNG::new().expect("Failed to create RNG"); /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()"); /// let mut x963 = [0u8; 128]; @@ -1084,6 +1099,11 @@ impl ECC { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = RNG::new().expect("Failed to create RNG"); /// let curve_id = ECC::SECP256R1; /// let curve_size = ECC::get_curve_size_from_id(curve_id).expect("Error with get_curve_size_from_id()"); @@ -1542,6 +1562,11 @@ impl ECC { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = RNG::new().expect("Failed to create RNG"); /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()"); /// let mut x963 = [0u8; 128]; @@ -1781,6 +1806,11 @@ impl ECC { /// use std::rc::Rc; /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = Rc::new(RNG::new().expect("Failed to create RNG")); /// let mut ecc0 = ECC::generate(32, &rng, None, None).expect("Error with generate()"); /// let mut ecc1 = ECC::generate(32, &rng, None, None).expect("Error with generate()"); @@ -1831,6 +1861,11 @@ impl ECC { /// use std::rc::Rc; /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::ecc::ECC; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// let rng = Rc::new(RNG::new().expect("Failed to create RNG")); /// let mut ecc0 = ECC::generate(32, &rng, None, None).expect("Error with generate()"); /// let mut ecc1 = ECC::generate(32, &rng, None, None).expect("Error with generate()"); diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs b/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs index 6e3d48484a6..787b92d61f7 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs @@ -52,6 +52,11 @@ use crate::hmac::HMAC; /// use wolfssl_wolfcrypt::hkdf::*; /// use wolfssl_wolfcrypt::hmac::HMAC; /// use wolfssl_wolfcrypt::sha::SHA256; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let ikm = b"MyPassword0"; /// let salt = b"12345678ABCDEFGH"; /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE]; @@ -87,6 +92,11 @@ pub fn hkdf_extract(typ: i32, salt: Option<&[u8]>, key: &[u8], out: &mut [u8]) - /// use wolfssl_wolfcrypt::hkdf::*; /// use wolfssl_wolfcrypt::hmac::HMAC; /// use wolfssl_wolfcrypt::sha::SHA256; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let ikm = b"MyPassword0"; /// let salt = b"12345678ABCDEFGH"; /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE]; @@ -146,6 +156,11 @@ pub fn hkdf_extract_ex(typ: i32, salt: Option<&[u8]>, key: &[u8], out: &mut [u8] /// use wolfssl_wolfcrypt::hkdf::*; /// use wolfssl_wolfcrypt::hmac::HMAC; /// use wolfssl_wolfcrypt::sha::SHA256; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let ikm = b"MyPassword0"; /// let salt = b"12345678ABCDEFGH"; /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE]; @@ -185,6 +200,11 @@ pub fn hkdf_expand(typ: i32, key: &[u8], info: Option<&[u8]>, out: &mut [u8]) -> /// use wolfssl_wolfcrypt::hkdf::*; /// use wolfssl_wolfcrypt::hmac::HMAC; /// use wolfssl_wolfcrypt::sha::SHA256; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let ikm = b"MyPassword0"; /// let salt = b"12345678ABCDEFGH"; /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE]; @@ -247,6 +267,11 @@ pub fn hkdf_expand_ex(typ: i32, key: &[u8], info: Option<&[u8]>, out: &mut [u8], /// ```rust /// use wolfssl_wolfcrypt::hkdf::*; /// use wolfssl_wolfcrypt::hmac::HMAC; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let ikm = b"MyPassword0"; /// let salt = b"12345678ABCDEFGH"; /// let info = b"0"; diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/kdf.rs b/wrapper/rust/wolfssl-wolfcrypt/src/kdf.rs index bd9379c5abb..d98a2fd8ed3 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/kdf.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/kdf.rs @@ -634,6 +634,11 @@ pub fn tls13_hkdf_expand_label_ex(typ: i32, key: &[u8], protocol: &[u8], label: /// { /// use wolfssl_wolfcrypt::hmac::HMAC; /// use wolfssl_wolfcrypt::kdf::*; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let k = [0x42u8; 256]; /// let h = [0x43u8; 32]; /// let sid = [0x44u8; 32]; diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/pbkdf2_password_hash.rs b/wrapper/rust/wolfssl-wolfcrypt/src/pbkdf2_password_hash.rs index d1e9c5df393..5cd1afa1a70 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/pbkdf2_password_hash.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/pbkdf2_password_hash.rs @@ -199,7 +199,7 @@ impl TryFrom<&PasswordHash> for Params { /// /// let hasher = Pbkdf2::default(); /// let salt = b"0123456789abcdef"; // 16 bytes -/// let hash = hasher.hash_password_with_salt(b"password", salt) +/// let hash = hasher.hash_password_with_salt(b"correct horse battery staple", salt) /// .expect("hashing failed"); /// ``` #[derive(Clone, Debug, Default)] diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/prf.rs b/wrapper/rust/wolfssl-wolfcrypt/src/prf.rs index 2358c28f477..f1e2e604a56 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/prf.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/prf.rs @@ -58,6 +58,11 @@ pub const PRF_HASH_SM3: i32 = sys::wc_MACAlgorithm_sm3_mac as i32; /// #[cfg(sha384)] /// { /// use wolfssl_wolfcrypt::prf::*; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let secret = [0x10u8, 0xbc, 0xb4, 0xa2, 0xe8, 0xdc, 0xf1, 0x9b, 0x4c, /// 0x51, 0x9c, 0xed, 0x31, 0x1b, 0x51, 0x57, 0x02, 0x3f, /// 0xa1, 0x7d, 0xfb, 0x0e, 0xf3, 0x4e, 0x8f, 0x6f, 0x71, @@ -102,6 +107,11 @@ pub fn prf(secret: &[u8], seed: &[u8], hash_type: i32, dout: &mut [u8]) -> Resul /// #[cfg(sha384)] /// { /// use wolfssl_wolfcrypt::prf::*; +/// #[cfg(fips)] +/// { +/// use wolfssl_wolfcrypt::fips; +/// fips::set_private_key_read_enable(1); +/// } /// let secret = [0x10u8, 0xbc, 0xb4, 0xa2, 0xe8, 0xdc, 0xf1, 0x9b, 0x4c, /// 0x51, 0x9c, 0xed, 0x31, 0x1b, 0x51, 0x57, 0x02, 0x3f, /// 0xa1, 0x7d, 0xfb, 0x0e, 0xf3, 0x4e, 0x8f, 0x6f, 0x71, diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/random.rs b/wrapper/rust/wolfssl-wolfcrypt/src/random.rs index a01dccd27bb..02171631bb4 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/random.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/random.rs @@ -404,7 +404,7 @@ impl RNG { /// let seed = [1u8, 2, 3, 4]; /// rng.reseed(&seed).expect("Error with reseed()"); /// ``` - #[cfg(all(random_hashdrbg, not(fips_v5_2_3)))] + #[cfg(all(random_hashdrbg, not(fips_v5)))] pub fn reseed(&self, seed: &[u8]) -> Result<(), i32> { let seed_size = crate::buffer_len_to_u32(seed.len())?; let rc = unsafe { diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs b/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs index 799534f0576..39ffc9a3936 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs @@ -575,6 +575,11 @@ impl RSA { /// { /// use wolfssl_wolfcrypt::random::RNG; /// use wolfssl_wolfcrypt::rsa::RSA; + /// #[cfg(fips)] + /// { + /// use wolfssl_wolfcrypt::fips; + /// fips::set_private_key_read_enable(1); + /// } /// /// let rng = RNG::new().expect("Error creating RNG"); /// let mut rsa = RSA::generate(2048, 65537, &rng).expect("Error with generate()"); @@ -1034,7 +1039,7 @@ impl RSA { /// # Example /// /// ```rust - /// #[cfg(all(random, rsa_pss, rsa_private, rsa_sign, feature = "alloc"))] + /// #[cfg(all(random, rsa_pss, rsa_const_api, rsa_private, rsa_sign, feature = "alloc"))] /// { /// use std::fs; /// use wolfssl_wolfcrypt::random::RNG; @@ -1261,13 +1266,13 @@ impl RSA { /// rsa.pss_verify_check(signature, &mut verify_out, msg, RSA::HASH_TYPE_SHA256, RSA::MGF1SHA256).expect("Error with pss_verify_check()"); /// } /// ``` - #[cfg(all(rsa_pss, any(rsa_const_api, fips_v5_2_3)))] + #[cfg(all(rsa_pss, any(rsa_const_api, fips_v5)))] pub fn pss_verify_check(&mut self, din: &[u8], dout: &mut [u8], digest: &[u8], hash_algo: u32, mgf: i32) -> Result { let din_size = crate::buffer_len_to_u32(din.len())?; let dout_size = crate::buffer_len_to_u32(dout.len())?; let digest_size = crate::buffer_len_to_u32(digest.len())?; let rc = unsafe { - // FIPS v5.2.3 declares the input non const but only reads it. + // FIPS v5 declares the input non const but only reads it. sys::wc_RsaPSS_VerifyCheck(din.as_ptr().cast_mut(), din_size, dout.as_mut_ptr(), dout_size, digest.as_ptr(), digest_size, hash_algo, mgf, &mut self.wc_rsakey) @@ -1405,11 +1410,9 @@ impl RSA { /// Point the wolfCrypt key at `rng` for blinding. #[cfg(random)] - #[cfg_attr(fips_v5_2_3, allow(unused_variables))] + #[cfg_attr(not(rsa_setrng), allow(unused_variables))] fn set_wc_rng(&mut self, rng: &RNG) -> Result<(), i32> { - // FIPS v5.2.3 builds without RSA blinding, so there is no - // wc_RsaSetRNG() and private operations need no RNG. - #[cfg(not(fips_v5_2_3))] + #[cfg(rsa_setrng)] { let rc = unsafe { sys::wc_RsaSetRNG(&mut self.wc_rsakey, rng.wc_rng) diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs b/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs index dfc5673ca3a..5b90a342f93 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs @@ -17,8 +17,3 @@ include!(concat!(env!("OUT_DIR"), "/bindings.rs")); /* Include generated FIPS symbol aliases. */ include!(concat!(env!("OUT_DIR"), "/fips_aliases.rs")); - -#[cfg(all(rsa,not(rsa_setrng),not(fips_v5_2_3)))] -unsafe extern "C" { - pub fn wc_RsaSetRNG(key: *mut RsaKey, rng: *mut WC_RNG) -> core::ffi::c_int; -} diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs index 7fd3c9358ce..607a7115abf 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs @@ -10,7 +10,7 @@ use password_hash::phc::{Output, PasswordHash}; use password_hash::{CustomizedPasswordHasher, PasswordHasher, PasswordVerifier}; use wolfssl_wolfcrypt::pbkdf2_password_hash::*; -// FIPS v5.2.3 refuses HMAC keys under 14 bytes, and PBKDF2 uses the password as +// FIPS v5 refuses HMAC keys under 14 bytes, and PBKDF2 uses the password as // its HMAC key. const PASSWORD: &[u8] = b"correct horse battery staple"; diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs index 82ef36eecbf..60d227b5858 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs @@ -109,7 +109,7 @@ fn test_rng_generate_block_large() { } #[test] -#[cfg(all(random_hashdrbg, not(fips_v5_2_3)))] +#[cfg(all(random_hashdrbg, not(fips_v5)))] fn test_rng_reseed() { let rng = RNG::new().expect("Failed to create RNG"); let seed = [1u8, 2, 3, 4];