crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

aes: refuse the tag association opt-out in FIPS v7 and later

Browse Source
This commit is contained in:
kaleb-himes
2026-09-28 21:30:51 -06:00
parent 255602ee85
commit 0cdf6541f7
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/dox_comments/header_files/aes.h
View File

@@ -370,7 +370,7 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len);
on top of this.
WOLFSSL_NO_AES_TAG_ASSOCIATION builds all of this out, which departs from
the requirement above.
the requirement above, so a FIPS v7 or later build refuses it.
The first use of a key fixes its tag length even without this call. Set
the key again through one of those two, or pass WC_NO_TAG_ASSOCIATION, to

3
examples/configs/user_settings_template.h
View File

@@ -211,7 +211,8 @@ extern "C" {
//#define HAVE_AESCCM
/* One key carries one tag length, per SP 800-38D 5.2.1.2. Define this
* to let one key use several, which departs from that requirement. */
* to let one key use several, which departs from that requirement.
* A FIPS v7 or later build refuses it. */
//#define WOLFSSL_NO_AES_TAG_ASSOCIATION
#else
#define NO_AES

7
wolfssl/wolfcrypt/aes.h
View File

@@ -36,6 +36,13 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
#include <wolfssl/wolfcrypt/types.h>
/* One tag length per key is a shall in SP 800-38D 5.2.1.2, so a FIPS 140-3
* v7 or later module is not allowed to build it out. */
#if defined(WOLFSSL_NO_AES_TAG_ASSOCIATION) && defined(HAVE_FIPS) && \
FIPS_VERSION3_GE(7,0,0)
#error "WOLFSSL_NO_AES_TAG_ASSOCIATION is not allowed in FIPS v7 or later"
#endif
#if defined(WOLFSSL_ARMASM) && !defined(GCM_SMALL) && !defined(GCM_TABLE) && \
!defined(GCM_TABLE_4BIT)
#define GCM_TABLE_4BIT