pbkdf2: 16-byte PBES2 default salt; callers accept the v7 short-salt indicator

Author: kaleb-himes

tests/api.c

@@ -21812,7 +21812,7 @@ static int test_wolfSSL_PKCS8_d2i(void)
 #if !defined(NO_DES3) && !defined(NO_SHA) && defined(HAVE_PBKDF2)
     ExpectNotNull(bio = BIO_new(BIO_s_mem()));
     /* Write Encrypted PKCS#8 PEM to BIO. */
-    bytes = 1834;
+    bytes = 1846;
     ExpectIntEQ(PEM_write_bio_PKCS8PrivateKey(bio, pkey, EVP_des_ede3_cbc(),
         NULL, 0, PasswordCallBack, (void*)"yassl123"), bytes);
     ExpectIntEQ(PEM_write_PKCS8PrivateKey(stderr, pkey, EVP_des_ede3_cbc(),
@@ -21895,8 +21895,8 @@ static int test_wolfSSL_PKCS8_d2i(void)
     bio = NULL;
 #ifdef HAVE_PBKDF2
     ExpectNotNull(bio = BIO_new(BIO_s_mem()));
-    /* Write Encrypted PKCS#8 PEM to BIO (test write 0 then 379) */
-    bytes = 379;
+    /* Write Encrypted PKCS#8 PEM to BIO (test write 0 then 391) */
+    bytes = 391;
     ExpectIntEQ(PEM_write_bio_PKCS8PrivateKey(bio, pkey, EVP_aes_256_cbc(),
         NULL, 0, NoPasswordCallBack, (void*)"yassl123"), 0);
     ExpectIntEQ(PEM_write_bio_PKCS8PrivateKey(bio, pkey, EVP_aes_256_cbc(),

tests/api/test_asn.c

@@ -6923,8 +6923,10 @@ int test_wc_Pkcs8EncryptDecisionCoverage(void)
     WC_RNG rng;
     byte   key[32];
     byte   out[512];
+    byte   fill[512];
     byte   salt[8];
     word32 outSz;
+    word32 need = 0;
 
     XMEMSET(key, 3, sizeof(key));
     XMEMSET(salt, 4, sizeof(salt));
@@ -6949,6 +6951,34 @@ int test_wc_Pkcs8EncryptDecisionCoverage(void)
         "pw", 2, PKCS5, PBES2, AES128CBCb, salt, sizeof(salt), 1000,
         0x7FFFFFFF, &rng, HEAP_HINT), WC_NO_ERR_TRACE(ALGO_ID_E));
 
+    /* Zero and one byte short return BUFFER_E and leave the buffer
+     * untouched; the queried size succeeds. */
+    outSz = 0;
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), NULL, &outSz,
+        "pw", 2, PKCS5, PBES2, AES128CBCb, NULL, 0, 1000, 0, &rng,
+        HEAP_HINT), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
+    need = outSz;
+    ExpectIntGT(need, 1);
+    ExpectIntLE(need, sizeof(out));
+    XMEMSET(out, 0xA5, sizeof(out));
+    XMEMSET(fill, 0xA5, sizeof(fill));
+    outSz = 0;
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), out, &outSz,
+        "pw", 2, PKCS5, PBES2, AES128CBCb, NULL, 0, 1000, 0, &rng,
+        HEAP_HINT), WC_NO_ERR_TRACE(BUFFER_E));
+    outSz = need - 1;
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), out, &outSz,
+        "pw", 2, PKCS5, PBES2, AES128CBCb, NULL, 0, 1000, 0, &rng,
+        HEAP_HINT), WC_NO_ERR_TRACE(BUFFER_E));
+    ExpectBufEQ(out, fill, sizeof(out));
+#if defined(HAVE_PBKDF2) && !defined(NO_HMAC) && !defined(NO_SHA)
+    outSz = need;
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), out, &outSz,
+        "pw", 2, PKCS5, PBES2, AES128CBCb, NULL, 0, 1000, 0, &rng,
+        HEAP_HINT), (int)need);
+    ExpectBufEQ(out + need, fill + need, sizeof(out) - need);
+#endif
+
     ExpectIntEQ(wc_FreeRng(&rng), 0);
 #endif /* HAVE_AES_CBC && !NO_AES && WOLFSSL_AES_128 && !FIPS */
     return EXPECT_RESULT();

tests/api/test_pwdbased.c

@@ -200,9 +200,18 @@ int test_wc_PBKDF2DecisionCoverage(void)
                 WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 
     /* valid derivation */
+#if FIPS_VERSION3_GE(7,0,0) && defined(WC_HAVE_FIPS_INDICATOR) && \
+    !defined(FIPS_NO_WRAPPERS)
+    /* The 8-byte salt is below the SP 800-132 Section 5.1 minimum of 128
+     * bits, so the v7 module derives the key and flags it not approved. */
+    ExpectIntEQ(wc_PBKDF2_ex(derived, passwd, (int)sizeof(passwd),
+                    salt, (int)sizeof(salt), 2, (int)sizeof(derived),
+                    WC_SHA256, HEAP_HINT, INVALID_DEVID), WC_FIPS_NOT_APPROVED);
+#else
     ExpectIntEQ(wc_PBKDF2_ex(derived, passwd, (int)sizeof(passwd),
                     salt, (int)sizeof(salt), 2, (int)sizeof(derived),
                     WC_SHA256, HEAP_HINT, INVALID_DEVID), 0);
+#endif
 #endif
     return EXPECT_RESULT();
 }

wolfcrypt/src/asn.c

@@ -11213,6 +11213,7 @@ int wc_EncryptPKCS8Key_ex(byte* key, word32 keySz, byte* out, word32* outSz,
     word32 pbeLen = 0;
     word32 kdfLen = 0;
     word32 encLen = 0;
+    word32 outerLen = 0;
     byte cbcIv[MAX_IV_SIZE];
     word32 idx = 0;
     word32 encIdx = 0;
@@ -11234,7 +11235,7 @@ int wc_EncryptPKCS8Key_ex(byte* key, word32 keySz, byte* out, word32* outSz,
     }
     if (ret == 0 && (salt == NULL || saltSz == 0)) {
         genSalt = 1;
-        saltSz = 8;
+        saltSz = (version == PKCS5v2) ? PKCS5V2_SALT_SZ : PKCS5_SALT_SZ;
     }
     if (ret == 0 && version == PKCS5v2) {
         ret = GetAlgoV2(encAlgId, &encOid, &encOidSz, &pbeId, &blockSz);
@@ -11296,7 +11297,7 @@ int wc_EncryptPKCS8Key_ex(byte* key, word32 keySz, byte* out, word32* outSz,
     if (ret == 0) {
         /* outerLen = length of PBE encoding + octet string data */
         /* Plus 2 for tag and length for pbe */
-        word32 outerLen = 2 + pbeLen;
+        outerLen = 2 + pbeLen;
         /* Octet string tag, length */
         outerLen += 1 + SetLength(keySz + padSz, NULL);
         /* Octet string bytes */
@@ -11306,6 +11307,10 @@ int wc_EncryptPKCS8Key_ex(byte* key, word32 keySz, byte* out, word32* outSz,
             *outSz = 1 + SetLength(outerLen, NULL) + outerLen;
             return WC_NO_ERR_TRACE(LENGTH_ONLY_E);
         }
+        if (*outSz < 1 + SetLength(outerLen, NULL) + outerLen)
+            ret = BUFFER_E;
+    }
+    if (ret == 0) {
         SetOctetString(keySz + padSz, out);
 
         idx += SetSequence(outerLen, out + idx);

wolfcrypt/src/evp.c

@@ -5537,6 +5537,12 @@ int wolfSSL_PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
 
     ret = wc_PBKDF2((byte*)out, (byte*)pass, passlen, (byte*)salt, saltlen,
                     iter, keylen, WC_SHA);
+#if FIPS_VERSION3_GE(7,0,0) && defined(WC_HAVE_FIPS_INDICATOR) && \
+    !defined(FIPS_NO_WRAPPERS)
+    /* The key is derived; the module only flags a salt under 128 bits. */
+    if (ret == WC_FIPS_NOT_APPROVED)
+        ret = 0;
+#endif
     if (ret == 0)
         return WOLFSSL_SUCCESS;
     else
@@ -5566,6 +5572,12 @@ int wolfSSL_PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
 
     ret = wc_PBKDF2((byte*)out, (byte*)pass, passlen, (byte*)salt, saltlen,
                     iter, keylen, pbkdf2HashType);
+#if FIPS_VERSION3_GE(7,0,0) && defined(WC_HAVE_FIPS_INDICATOR) && \
+    !defined(FIPS_NO_WRAPPERS)
+    /* The key is derived; the module only flags a salt under 128 bits. */
+    if (ret == WC_FIPS_NOT_APPROVED)
+        ret = 0;
+#endif
     if (ret == 0)
         return WOLFSSL_SUCCESS;
     else

wolfcrypt/src/wc_encrypt.c

@@ -480,6 +480,17 @@ int wc_CryptKey(const char* password, int passwordSz, const byte* salt,
                 ret = wc_PBKDF2(key, (const byte*)password, passwordSz,
                                 salt, saltSz, iterations, (int)derivedLen, typeH);
                 PRIVATE_KEY_LOCK();
+            #if FIPS_VERSION3_GE(7,0,0) && defined(WC_HAVE_FIPS_INDICATOR) && \
+                !defined(FIPS_NO_WRAPPERS)
+                /* The module derives the key and then returns the
+                 * WC_FIPS_NOT_APPROVED indicator for a salt shorter than
+                 * 128 bits (SP 800-132 Section 5.1).  The key is valid, so
+                 * carry on to the cipher: left positive, ret would skip the
+                 * encryption below while callers read it as success, leaving
+                 * the input in the clear. */
+                if (ret == WC_FIPS_NOT_APPROVED)
+                    ret = 0;
+            #endif
                 break;
     #endif
     #ifndef NO_SHA

wolfcrypt/test/test.c

@@ -49611,6 +49611,16 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t pbkdf2_test(void)
                        salt, (int)sizeof(salt), iterations,
                        kLen, WC_SHA256, HEAP_HINT, devId);
     PRIVATE_KEY_LOCK();
+#if FIPS_VERSION3_GE(7,0,0) && defined(WC_HAVE_FIPS_INDICATOR) && \
+    !defined(FIPS_NO_WRAPPERS)
+    /* 8-byte salt: computed, but the module must deliver the
+     * WC_FIPS_NOT_APPROVED indicator to the caller per SP 800-132
+     * Section 5.1 ("shall be at least 128 bits") and FIPS 140-3 IG 2.4.C;
+     * the test fails if the indicator is missing. */
+    if (ret != WC_FIPS_NOT_APPROVED)
+        return WC_TEST_RET_ENC_EC(ret);
+    ret = 0;
+#endif
     if (ret != 0)
         return WC_TEST_RET_ENC_EC(ret);