From 0cdf6541f71dbcee49a87bfef412447883e27c78 Mon Sep 17 00:00:00 2001 From: kaleb-himes Date: Mon, 28 Sep 2026 21:30:51 -0600 Subject: [PATCH] aes: refuse the tag association opt-out in FIPS v7 and later --- doc/dox_comments/header_files/aes.h | 2 +- examples/configs/user_settings_template.h | 3 ++- wolfssl/wolfcrypt/aes.h | 7 +++++++ 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/doc/dox_comments/header_files/aes.h b/doc/dox_comments/header_files/aes.h index ed0e597f8c..7e4318e5e8 100644 --- a/doc/dox_comments/header_files/aes.h +++ b/doc/dox_comments/header_files/aes.h @@ -370,7 +370,7 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len); on top of this. WOLFSSL_NO_AES_TAG_ASSOCIATION builds all of this out, which departs from - the requirement above. + the requirement above, so a FIPS v7 or later build refuses it. The first use of a key fixes its tag length even without this call. Set the key again through one of those two, or pass WC_NO_TAG_ASSOCIATION, to diff --git a/examples/configs/user_settings_template.h b/examples/configs/user_settings_template.h index 23f0b119f4..f5f516f279 100644 --- a/examples/configs/user_settings_template.h +++ b/examples/configs/user_settings_template.h @@ -211,7 +211,8 @@ extern "C" { //#define HAVE_AESCCM /* One key carries one tag length, per SP 800-38D 5.2.1.2. Define this - * to let one key use several, which departs from that requirement. */ + * to let one key use several, which departs from that requirement. + * A FIPS v7 or later build refuses it. */ //#define WOLFSSL_NO_AES_TAG_ASSOCIATION #else #define NO_AES diff --git a/wolfssl/wolfcrypt/aes.h b/wolfssl/wolfcrypt/aes.h index 957a7b1d67..28e1f6a062 100644 --- a/wolfssl/wolfcrypt/aes.h +++ b/wolfssl/wolfcrypt/aes.h @@ -36,6 +36,13 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits #include +/* One tag length per key is a shall in SP 800-38D 5.2.1.2, so a FIPS 140-3 + * v7 or later module is not allowed to build it out. */ +#if defined(WOLFSSL_NO_AES_TAG_ASSOCIATION) && defined(HAVE_FIPS) && \ + FIPS_VERSION3_GE(7,0,0) + #error "WOLFSSL_NO_AES_TAG_ASSOCIATION is not allowed in FIPS v7 or later" +#endif + #if defined(WOLFSSL_ARMASM) && !defined(GCM_SMALL) && !defined(GCM_TABLE) && \ !defined(GCM_TABLE_4BIT) #define GCM_TABLE_4BIT