[jackctj117]

Companion to wolfSSL/fips#420. FIPS v7 only; non-FIPS and older FIPS builds are unchanged.

What changes

• ECC key generation: refused on curves below 224 bits (SP 800-131A Rev. 2 Table 2).
• ECDSA signing: refused on curves below 224 bits, including through crypto callbacks and hardware backends. Verification on those curves still works (legacy use).
• KCAPI HMAC: adds a KCAPI wc_HmacSetKey_ex() so HKDF and PBKDF2 set the key on the same backend that runs update/final.
• Tests: cover the two ECC refusals, and expect the HKDF SHA-1 refusal only when fips.h defines WC_HAVE_FIPS_INDICATOR.

Testing

--enable-fips=ready on macOS: testwolfcrypt and unit.test pass. The KCAPI change was built and linked on Linux but not run.

[Copilot]

🟡 Changes recommended

The new ECC signing gate returns a misleading error code (SIG_TYPE_E) and the DRBG reseed helper should better align with existing SMALL_STACK_CACHE behavior and optional additional_input semantics.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens FIPS 140-3 / SP 800-131A Rev. 2 enforcement in wolfCrypt (notably for ECC KAS/KeyGen/Sign, HMAC key sizing, and DRBG reseed entropy sourcing) and updates the wolfCrypt test suite to assert the new approved-mode behaviors and expected error codes.

Changes:

• Enforces FIPS v7+ constraints: ECC KAS limited to P-256/P-384/P-521; ECC keygen/signing disallows <224-bit curves; HMAC rejects keys >1024 bits unless explicitly overridden.
• Updates DRBG reseed in FIPS v7+ to always pull entropy from the module seed source and treat caller bytes as additional input.
• Extends test coverage to validate new rejection/acceptance behaviors (HMAC long keys, RSA PKCS#1 v1.5 transport refusal, PBKDF2/HKDF/ECDSA “not approved” signaling).

File summaries

File	Description
wolfssl/wolfcrypt/hmac.h	Adds HMAC_FIPS_MAX_KEY constant for v7+ (1024-bit max) used to enforce approved-mode key-size limits.
wolfcrypt/src/hmac.c	Enforces v7+ maximum HMAC key length when allowFlag is not set.
wolfcrypt/src/random.c	Alters v7+ DRBG reseed to draw entropy internally and treat caller bytes as additional input; adds helper to reseed from seed source.
wolfcrypt/src/ecc.c	Adds v7+ ECC curve gating for shared secret, shared secret (ex), key generation, and signing restrictions.
wolfcrypt/test/test.c	Updates/extends tests for HMAC long-key rejection + override, RSA PKCS#1 v1.5 transport refusal behavior, and other v7+ non-approved indicators.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text -28 B (-0.0%, 71,167 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text -32 B (-0.0%, 132,197 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text -64 B (-0.0%, 209,484 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +512 B (+0.3%, 182,803 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +448 B (+0.2%, 196,952 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +24 B, .text +1,664 B (+0.2%, 803,804 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +640 B (+0.3%, 224,020 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +512 B (+0.2%, 313,936 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +384 B (+0.1%, 344,336 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text -64 B (-0.0%, 132,945 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +512 B (+0.2%, 250,658 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +512 B (+0.2%, 314,768 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +512 B (+0.2%, 250,658 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

• FLASH: .text +952 B (+0.5%, 205,420 B / 2,097,152 B, total: 10% used)

No memory changes detected for:

• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m7

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[jackctj117]

Jenkins retest this please.

[jackctj117]

@claude review

[jackctj117]

Jenkins retest this please.

[jackctj117]

https://github.com/wolfSSL/fips/pull/420 Has to merge first for this PR to pass Jenkins testing.

[Copilot]

🟡 Changes recommended

Critical active findings show that alternate hardware and callback implementations can bypass the new ECC curve-size and HMAC key-length restrictions, leaving the approved-mode enforcement incomplete.

3 open issues

• Enforce the minimum curve size on all signing paths · New
• Enforce the HMAC key maximum in the KCAPI backend · New
• Enforce the HMAC key-size cap in the KCAPI backend · New

3 resolved since last review

• In FIPS v7+ this API now treats the caller-provided bytes as DRBG additional_input rather than…
• Returning SIG_TYPE_E for a too-small ECDSA curve in FIPS v7+ is misleading (SIG_TYPE_E generally…
• Rng_ReseedFromSeedSource() currently allocates a temporary seed buffer on every reseed when…

_{Review effort: Lite}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11359

Scan targets checked: linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 7 of 7 in-scope changed file(s) opened by the reviewer

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[Copilot]

🔵 Needs a closer look

Approval is blocked by two critical correctness issues: the HMAC key-length exemption applies to ordinary setkey calls, and curve validation accepts non-approved curves based solely on byte size.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Self-test build bypasses the HMAC maximum for normal callers

linuxkm/​lkcapi_sha_glue.c:1420

WC_LINUX_CONFIG_SELFTESTS is a compile-time configuration flag, so this path is also used for ordinary crypto_shash_setkey calls after the kernel self-tests finish. In FIPS v7, any key longer than HMAC_FIPS_MAX_KEY is therefore sent through allowFlag = 1, which bypasses the new maximum and lets normal callers use an overlong HMAC key whenever kernel self-tests are enabled. The self-test exemption needs to be scoped to the kernel's self-test invocation (or normal setkey calls must be validated before this override) rather than applied to every call in a self-test-enabled build.

Key-size check permits non-approved ECC curves

wolfcrypt/​src/​ecc.c:6548

Checking only the byte size is not sufficient for the stated FIPS v7 approved-curve restriction. When a non-NIST curve such as ECC_SECP256K1 is compiled, wc_ecc_get_curve_size_from_id() returns 32, so this check passes and _ecc_make_key_ex() generates a key on that non-approved curve. Please gate explicit curve IDs with the module's approved-curve allowlist (while preserving the default-curve resolution).

3 resolved since last review

• Enforce the HMAC key-size cap in the KCAPI backend
• Enforce the HMAC key maximum in the KCAPI backend
• Enforce the minimum curve size on all signing paths

_{Review effort: Lite}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11359

Scan targets checked: linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Failed targets: wolfcrypt-port-bugs
Coverage: 3 of 4 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_ecc.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[jackctj117]

@claude review

[Copilot]

🔵 Needs a closer look

Human assessment is needed because multiple critical hidden findings indicate that the approved-mode restrictions can be bypassed across HMAC, ECC, and KDF paths, with additional backend behavior implications.

No open issues 🎉

_{Review effort: Lite}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11359

Scan targets checked: linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Coverage: 5 of 5 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.