[kaleb-himes]

Description

wolfSSL half of the FIPS v7 service-indicator and curve-policy fixes in wolfSSL/fips#424. Code outside the module now handles the new indicator, and the tests expect the v7 module's behavior. There are no Jenkins tests for the v7 module yet so these should be fine to merge ahead of fips PR #424. The new checks build only for FIPS v7 with the indicator (FIPS_VERSION3_GE(7,0,0) && WC_HAVE_FIPS_INDICATOR && !FIPS_NO_WRAPPERS), so other builds are unchanged apart from the PBES2 default salt.

Fenrir findings addressed (the module fix for each is in wolfSSL/fips#424):

Fenrir ID	Finding	Change in this PR
F-7779, F-9549	PBKDF2 accepted a salt under 128 bits (SP 800-132 Section 5.1)	pbkdf2: 16-byte PBES2 default salt; callers accept the v7 short-salt indicator. When the caller passes no salt, wc_EncryptPKCS8Key_ex now uses 16 bytes (PKCS5V2_SALT_SZ) for PBES2; PBES1 keeps 8. wc_CryptKey and wolfSSL_PKCS5_PBKDF2_HMAC accept WC_FIPS_NOT_APPROVED because the key has been derived. wc_EncryptPKCS8Key_ex now returns BUFFER_E before writing if *outSz is too small, since the longer salt grows the output by 8 bytes. The expected sizes in test_wolfSSL_PKCS8_d2i change from 1834 to 1846 and from 379 to 391.
F-15971	ECC curve policy: ECDH limited to P-256 to P-521, custom curves refused	tests: expect the FIPS v7 ECDH curve refusal (from wolfssl#11359). On P-224 the test records the ECDH refusal and skips only the three ECDH steps. Export/import, compressed keys, sign/verify and private export still run on P-224, which the module allows. The ecc.c side of 15971 is in #12058.
F-7778, F-16583	A signature made with a caller-supplied ECDSA k was not flagged	tests: expect the FIPS v7 indicator for a caller-set ECDSA k (wolfssl#11359). The test expects the non-approved indicator on that path.
F-7039	wc_HmacSizeByType returned HMAC_KAT_FIPS_E for an unsupported type	tests: expect BAD_FUNC_ARG from wc_HmacSizeByType on FIPS v7

The ECDH and caller-set k tests are based on the test changes in wolfSSL/wolfssl #11359.

PR 12057 now clears the PBKDF2 indicator only for salts under 16 bytes; any other indicator fails. New tests and negative controls pass on FIPS v7 with fips#424 and on non-FIPS builds.

Testing

FIPS v7 with wolfSSL/fips#424 (32eb789d): testwolfcrypt passes and make check is 6/6.

Negative controls. Each one breaks the code on purpose and checks that the new test fails:

Broken on purpose	Result
Module without the ECDH curve check	ECDH refusal test fails at the probe
Module that refuses P-224 signing	New test fails at the P-224 sign call. The old test still passed, so it hid this.
*outSz check removed from asn.c	New BUFFER_E row fails: 136 returned

PKCS#8 salt and buffer check, before and after:

	Before	After
Default PBES2 salt	8 bytes, 225-byte output	16 bytes, 233-byte output
Output buffer 1 byte short	returns 225 and writes past the end	returns BUFFER_E, buffer untouched
Output buffer size 0		returns BUFFER_E, buffer untouched
Exact size		succeeds, writes nothing past the returned length

Other configurations (make check):

Configuration	Result
Default	6/6
--enable-all	18/18
--enable-all + smallstack	18/18
--enable-all + async	18/18
CI's NO_PBKDF2 configuration	7/7
No-SHA cryptonly	1/1
cmake -DWOLFSSL_ENTERPRISE=yes (ctest)	2/2

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata -8 B, text +3,856 B (+1.4%, 286,320 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

🔵 Needs a closer look

The FIPS v7 indicator and curve-policy contracts depend on inaccessible companion wolfSSL/fips#424, requiring a maintainer with module access to confirm those contracts and the reported paired-module validation.

No open issues 🎉

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12057

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Coverage: 3 of 4 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_pwdbased.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite