diff --git a/Makefile.am b/Makefile.am
index 37ff1b6bc..25c806999 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -128,14 +128,8 @@ src_libbitcoin_network_la_SOURCES = \
src/sessions/session_peer.cpp \
src/sessions/session_seed.cpp \
src/sessions/session_server.cpp \
- src/ssl/wolfssl/crl.c \
- src/ssl/wolfssl/dtls.c \
- src/ssl/wolfssl/dtls13.c \
src/ssl/wolfssl/internal.c \
src/ssl/wolfssl/keys.c \
- src/ssl/wolfssl/ocsp.c \
- src/ssl/wolfssl/quic.c \
- src/ssl/wolfssl/sniffer.c \
src/ssl/wolfssl/ssl.c \
src/ssl/wolfssl/tls.c \
src/ssl/wolfssl/tls13.c \
@@ -155,91 +149,28 @@ src_libbitcoin_network_la_SOURCES = \
src/ssl/wolfssl/src/ssl_sk.c \
src/ssl/wolfssl/src/x509.c \
src/ssl/wolfssl/src/x509_str.c \
- src/ssl/wolfssl/wolfcrypt/aes.c \
- src/ssl/wolfssl/wolfcrypt/arc4.c \
- src/ssl/wolfssl/wolfcrypt/ascon.c \
- src/ssl/wolfssl/wolfcrypt/asm.c \
src/ssl/wolfssl/wolfcrypt/asn.c \
- src/ssl/wolfssl/wolfcrypt/blake2b.c \
- src/ssl/wolfssl/wolfcrypt/blake2s.c \
- src/ssl/wolfssl/wolfcrypt/camellia.c \
src/ssl/wolfssl/wolfcrypt/chacha.c \
src/ssl/wolfssl/wolfcrypt/chacha20_poly1305.c \
- src/ssl/wolfssl/wolfcrypt/cmac.c \
src/ssl/wolfssl/wolfcrypt/coding.c \
- src/ssl/wolfssl/wolfcrypt/compress.c \
- src/ssl/wolfssl/wolfcrypt/cpuid.c \
src/ssl/wolfssl/wolfcrypt/cryptocb.c \
src/ssl/wolfssl/wolfcrypt/curve25519.c \
- src/ssl/wolfssl/wolfcrypt/curve448.c \
- src/ssl/wolfssl/wolfcrypt/des3.c \
- src/ssl/wolfssl/wolfcrypt/dh.c \
- src/ssl/wolfssl/wolfcrypt/dilithium.c \
- src/ssl/wolfssl/wolfcrypt/dsa.c \
src/ssl/wolfssl/wolfcrypt/ecc.c \
- src/ssl/wolfssl/wolfcrypt/eccsi.c \
- src/ssl/wolfssl/wolfcrypt/ed25519.c \
- src/ssl/wolfssl/wolfcrypt/ed448.c \
src/ssl/wolfssl/wolfcrypt/error.c \
- src/ssl/wolfssl/wolfcrypt/ext_lms.c \
- src/ssl/wolfssl/wolfcrypt/ext_mlkem.c \
- src/ssl/wolfssl/wolfcrypt/ext_xmss.c \
- src/ssl/wolfssl/wolfcrypt/falcon.c \
- src/ssl/wolfssl/wolfcrypt/fe_448.c \
- src/ssl/wolfssl/wolfcrypt/fe_low_mem.c \
src/ssl/wolfssl/wolfcrypt/fe_operations.c \
- src/ssl/wolfssl/wolfcrypt/fe_x25519_128.h \
- src/ssl/wolfssl/wolfcrypt/ge_448.c \
- src/ssl/wolfssl/wolfcrypt/ge_low_mem.c \
src/ssl/wolfssl/wolfcrypt/ge_operations.c \
src/ssl/wolfssl/wolfcrypt/hash.c \
src/ssl/wolfssl/wolfcrypt/hmac.c \
- src/ssl/wolfssl/wolfcrypt/hpke.c \
- src/ssl/wolfssl/wolfcrypt/integer.c \
src/ssl/wolfssl/wolfcrypt/kdf.c \
src/ssl/wolfssl/wolfcrypt/logging.c \
- src/ssl/wolfssl/wolfcrypt/md2.c \
- src/ssl/wolfssl/wolfcrypt/md4.c \
- src/ssl/wolfssl/wolfcrypt/md5.c \
src/ssl/wolfssl/wolfcrypt/memory.c \
- src/ssl/wolfssl/wolfcrypt/pkcs12.c \
- src/ssl/wolfssl/wolfcrypt/pkcs7.c \
src/ssl/wolfssl/wolfcrypt/poly1305.c \
- src/ssl/wolfssl/wolfcrypt/pwdbased.c \
src/ssl/wolfssl/wolfcrypt/random.c \
- src/ssl/wolfssl/wolfcrypt/rc2.c \
- src/ssl/wolfssl/wolfcrypt/ripemd.c \
- src/ssl/wolfssl/wolfcrypt/rsa.c \
- src/ssl/wolfssl/wolfcrypt/sakke.c \
- src/ssl/wolfssl/wolfcrypt/sha.c \
src/ssl/wolfssl/wolfcrypt/sha256.c \
- src/ssl/wolfssl/wolfcrypt/sha3.c \
- src/ssl/wolfssl/wolfcrypt/sha512.c \
src/ssl/wolfssl/wolfcrypt/signature.c \
- src/ssl/wolfssl/wolfcrypt/siphash.c \
- src/ssl/wolfssl/wolfcrypt/sp_arm32.c \
- src/ssl/wolfssl/wolfcrypt/sp_arm64.c \
- src/ssl/wolfssl/wolfcrypt/sp_armthumb.c \
- src/ssl/wolfssl/wolfcrypt/sp_c32.c \
- src/ssl/wolfssl/wolfcrypt/sp_c64.c \
- src/ssl/wolfssl/wolfcrypt/sp_cortexm.c \
- src/ssl/wolfssl/wolfcrypt/sp_dsp32.c \
src/ssl/wolfssl/wolfcrypt/sp_int.c \
- src/ssl/wolfssl/wolfcrypt/sp_x86_64.c \
- src/ssl/wolfssl/wolfcrypt/sphincs.c \
- src/ssl/wolfssl/wolfcrypt/srp.c \
- src/ssl/wolfssl/wolfcrypt/tfm.c \
- src/ssl/wolfssl/wolfcrypt/wc_dsp.c \
src/ssl/wolfssl/wolfcrypt/wc_encrypt.c \
- src/ssl/wolfssl/wolfcrypt/wc_lms.c \
- src/ssl/wolfssl/wolfcrypt/wc_lms_impl.c \
- src/ssl/wolfssl/wolfcrypt/wc_mlkem.c \
- src/ssl/wolfssl/wolfcrypt/wc_mlkem_poly.c \
- src/ssl/wolfssl/wolfcrypt/wc_pkcs11.c \
src/ssl/wolfssl/wolfcrypt/wc_port.c \
- src/ssl/wolfssl/wolfcrypt/wc_xmss.c \
- src/ssl/wolfssl/wolfcrypt/wc_xmss_impl.c \
- src/ssl/wolfssl/wolfcrypt/wolfevent.c \
src/ssl/wolfssl/wolfcrypt/wolfmath.c
# local: test/libbitcoin-network-test
@@ -510,8 +441,8 @@ test_libbitcoin_network_test_SOURCES = \
test/ssl/wolfssl/tests/api/test_wolfmath.h \
test/ssl/wolfssl/tests/api/test_x509.c \
test/ssl/wolfssl/tests/api/test_x509.h \
+ test/ssl/wolfssl/testsuite/utils.c \
test/ssl/wolfssl/testsuite/utils.h \
- test/ssl/wolfssl/testsuite/utils1.c \
test/ssl/wolfssl/wolfcrypt/benchmark/benchmark.c \
test/ssl/wolfssl/wolfcrypt/benchmark/benchmark.h \
test/ssl/wolfssl/wolfcrypt/test/test.c \
@@ -776,13 +707,10 @@ include_bitcoin_ssl_wolfssldir = ${includedir}/bitcoin/ssl/wolfssl
include_bitcoin_ssl_wolfssl_HEADERS = \
include/bitcoin/ssl/wolfssl/callbacks.h \
include/bitcoin/ssl/wolfssl/certs_test.h \
- include/bitcoin/ssl/wolfssl/certs_test_sm.h \
- include/bitcoin/ssl/wolfssl/crl.h \
include/bitcoin/ssl/wolfssl/error-ssl.h \
include/bitcoin/ssl/wolfssl/internal.h \
include/bitcoin/ssl/wolfssl/ocsp.h \
include/bitcoin/ssl/wolfssl/options.h \
- include/bitcoin/ssl/wolfssl/quic.h \
include/bitcoin/ssl/wolfssl/ssl.h \
include/bitcoin/ssl/wolfssl/test.h \
include/bitcoin/ssl/wolfssl/version.h \
@@ -793,13 +721,10 @@ include_bitcoin_ssl_wolfssl_openssldir = ${includedir}/bitcoin/ssl/wolfssl/opens
include_bitcoin_ssl_wolfssl_openssl_HEADERS = \
include/bitcoin/ssl/wolfssl/openssl/aes.h \
include/bitcoin/ssl/wolfssl/openssl/asn1.h \
- include/bitcoin/ssl/wolfssl/openssl/asn1t.h \
include/bitcoin/ssl/wolfssl/openssl/bio.h \
include/bitcoin/ssl/wolfssl/openssl/bn.h \
include/bitcoin/ssl/wolfssl/openssl/buffer.h \
- include/bitcoin/ssl/wolfssl/openssl/camellia.h \
include/bitcoin/ssl/wolfssl/openssl/cmac.h \
- include/bitcoin/ssl/wolfssl/openssl/cms.h \
include/bitcoin/ssl/wolfssl/openssl/compat_types.h \
include/bitcoin/ssl/wolfssl/openssl/conf.h \
include/bitcoin/ssl/wolfssl/openssl/crypto.h \
@@ -825,10 +750,7 @@ include_bitcoin_ssl_wolfssl_openssl_HEADERS = \
include/bitcoin/ssl/wolfssl/openssl/modes.h \
include/bitcoin/ssl/wolfssl/openssl/obj_mac.h \
include/bitcoin/ssl/wolfssl/openssl/objects.h \
- include/bitcoin/ssl/wolfssl/openssl/ocsp.h \
- include/bitcoin/ssl/wolfssl/openssl/opensslconf.h \
include/bitcoin/ssl/wolfssl/openssl/opensslv.h \
- include/bitcoin/ssl/wolfssl/openssl/ossl_typ.h \
include/bitcoin/ssl/wolfssl/openssl/pem.h \
include/bitcoin/ssl/wolfssl/openssl/pkcs12.h \
include/bitcoin/ssl/wolfssl/openssl/pkcs7.h \
@@ -836,14 +758,11 @@ include_bitcoin_ssl_wolfssl_openssl_HEADERS = \
include/bitcoin/ssl/wolfssl/openssl/rc4.h \
include/bitcoin/ssl/wolfssl/openssl/ripemd.h \
include/bitcoin/ssl/wolfssl/openssl/rsa.h \
- include/bitcoin/ssl/wolfssl/openssl/safestack.h \
include/bitcoin/ssl/wolfssl/openssl/sha.h \
include/bitcoin/ssl/wolfssl/openssl/sha3.h \
- include/bitcoin/ssl/wolfssl/openssl/srp.h \
include/bitcoin/ssl/wolfssl/openssl/ssl.h \
include/bitcoin/ssl/wolfssl/openssl/stack.h \
include/bitcoin/ssl/wolfssl/openssl/tls1.h \
- include/bitcoin/ssl/wolfssl/openssl/txt_db.h \
include/bitcoin/ssl/wolfssl/openssl/x509.h \
include/bitcoin/ssl/wolfssl/openssl/x509_vfy.h \
include/bitcoin/ssl/wolfssl/openssl/x509v3.h
@@ -855,45 +774,30 @@ include_bitcoin_ssl_wolfssl_wolfcrypt_HEADERS = \
include/bitcoin/ssl/wolfssl/wolfcrypt/ascon.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/asn.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/asn_public.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-impl.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-int.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/blake2.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/camellia.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/chacha.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/chacha20_poly1305.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/cmac.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/coding.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/compress.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/cpuid.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/cryptocb.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/curve25519.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/curve448.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/des3.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/dh.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/dilithium.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/dsa.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/ecc.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/eccsi.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/ed25519.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/ed448.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/error-crypt.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/ext_lms.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/ext_mlkem.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/ext_xmss.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/falcon.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/fe_448.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/fe_operations.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/fips_test.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/ge_448.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/ge_operations.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/hash.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/hmac.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/hpke.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/integer.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/kdf.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/libwolfssl_sources.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/libwolfssl_sources_asm.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/lms.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/logging.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/md2.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/md4.h \
@@ -901,11 +805,7 @@ include_bitcoin_ssl_wolfssl_wolfcrypt_HEADERS = \
include/bitcoin/ssl/wolfssl/wolfcrypt/mem_track.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/memory.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/misc.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/mlkem.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_class.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_superclass.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/oid_sum.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs11.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs12.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs7.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/poly1305.h \
@@ -914,8 +814,6 @@ include_bitcoin_ssl_wolfssl_wolfcrypt_HEADERS = \
include/bitcoin/ssl/wolfssl/wolfcrypt/rc2.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/ripemd.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/rsa.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/sakke.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/selftest.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/settings.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/sha.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/sha256.h \
@@ -923,21 +821,12 @@ include_bitcoin_ssl_wolfssl_wolfcrypt_HEADERS = \
include/bitcoin/ssl/wolfssl/wolfcrypt/sha512.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/signature.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/siphash.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/sp.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/sp_int.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/sphincs.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/srp.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/tfm.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/types.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/user_settings.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/visibility.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/wc_encrypt.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wc_lms.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wc_mlkem.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wc_pkcs11.h \
include/bitcoin/ssl/wolfssl/wolfcrypt/wc_port.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wc_xmss.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wolfevent.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/wolfmath.h \
- include/bitcoin/ssl/wolfssl/wolfcrypt/xmss.h
+ include/bitcoin/ssl/wolfssl/wolfcrypt/wolfmath.h
diff --git a/builds/cmake/CMakeLists.txt b/builds/cmake/CMakeLists.txt
index 98ee77682..91e836500 100644
--- a/builds/cmake/CMakeLists.txt
+++ b/builds/cmake/CMakeLists.txt
@@ -322,14 +322,8 @@ add_library( ${CANONICAL_LIB_NAME}
"../../src/sessions/session_peer.cpp"
"../../src/sessions/session_seed.cpp"
"../../src/sessions/session_server.cpp"
- "../../src/ssl/wolfssl/crl.c"
- "../../src/ssl/wolfssl/dtls.c"
- "../../src/ssl/wolfssl/dtls13.c"
"../../src/ssl/wolfssl/internal.c"
"../../src/ssl/wolfssl/keys.c"
- "../../src/ssl/wolfssl/ocsp.c"
- "../../src/ssl/wolfssl/quic.c"
- "../../src/ssl/wolfssl/sniffer.c"
"../../src/ssl/wolfssl/ssl.c"
"../../src/ssl/wolfssl/tls.c"
"../../src/ssl/wolfssl/tls13.c"
@@ -349,91 +343,28 @@ add_library( ${CANONICAL_LIB_NAME}
"../../src/ssl/wolfssl/src/ssl_sk.c"
"../../src/ssl/wolfssl/src/x509.c"
"../../src/ssl/wolfssl/src/x509_str.c"
- "../../src/ssl/wolfssl/wolfcrypt/aes.c"
- "../../src/ssl/wolfssl/wolfcrypt/arc4.c"
- "../../src/ssl/wolfssl/wolfcrypt/ascon.c"
- "../../src/ssl/wolfssl/wolfcrypt/asm.c"
"../../src/ssl/wolfssl/wolfcrypt/asn.c"
- "../../src/ssl/wolfssl/wolfcrypt/blake2b.c"
- "../../src/ssl/wolfssl/wolfcrypt/blake2s.c"
- "../../src/ssl/wolfssl/wolfcrypt/camellia.c"
"../../src/ssl/wolfssl/wolfcrypt/chacha.c"
"../../src/ssl/wolfssl/wolfcrypt/chacha20_poly1305.c"
- "../../src/ssl/wolfssl/wolfcrypt/cmac.c"
"../../src/ssl/wolfssl/wolfcrypt/coding.c"
- "../../src/ssl/wolfssl/wolfcrypt/compress.c"
- "../../src/ssl/wolfssl/wolfcrypt/cpuid.c"
"../../src/ssl/wolfssl/wolfcrypt/cryptocb.c"
"../../src/ssl/wolfssl/wolfcrypt/curve25519.c"
- "../../src/ssl/wolfssl/wolfcrypt/curve448.c"
- "../../src/ssl/wolfssl/wolfcrypt/des3.c"
- "../../src/ssl/wolfssl/wolfcrypt/dh.c"
- "../../src/ssl/wolfssl/wolfcrypt/dilithium.c"
- "../../src/ssl/wolfssl/wolfcrypt/dsa.c"
"../../src/ssl/wolfssl/wolfcrypt/ecc.c"
- "../../src/ssl/wolfssl/wolfcrypt/eccsi.c"
- "../../src/ssl/wolfssl/wolfcrypt/ed25519.c"
- "../../src/ssl/wolfssl/wolfcrypt/ed448.c"
"../../src/ssl/wolfssl/wolfcrypt/error.c"
- "../../src/ssl/wolfssl/wolfcrypt/ext_lms.c"
- "../../src/ssl/wolfssl/wolfcrypt/ext_mlkem.c"
- "../../src/ssl/wolfssl/wolfcrypt/ext_xmss.c"
- "../../src/ssl/wolfssl/wolfcrypt/falcon.c"
- "../../src/ssl/wolfssl/wolfcrypt/fe_448.c"
- "../../src/ssl/wolfssl/wolfcrypt/fe_low_mem.c"
"../../src/ssl/wolfssl/wolfcrypt/fe_operations.c"
- "../../src/ssl/wolfssl/wolfcrypt/fe_x25519_128.h"
- "../../src/ssl/wolfssl/wolfcrypt/ge_448.c"
- "../../src/ssl/wolfssl/wolfcrypt/ge_low_mem.c"
"../../src/ssl/wolfssl/wolfcrypt/ge_operations.c"
"../../src/ssl/wolfssl/wolfcrypt/hash.c"
"../../src/ssl/wolfssl/wolfcrypt/hmac.c"
- "../../src/ssl/wolfssl/wolfcrypt/hpke.c"
- "../../src/ssl/wolfssl/wolfcrypt/integer.c"
"../../src/ssl/wolfssl/wolfcrypt/kdf.c"
"../../src/ssl/wolfssl/wolfcrypt/logging.c"
- "../../src/ssl/wolfssl/wolfcrypt/md2.c"
- "../../src/ssl/wolfssl/wolfcrypt/md4.c"
- "../../src/ssl/wolfssl/wolfcrypt/md5.c"
"../../src/ssl/wolfssl/wolfcrypt/memory.c"
- "../../src/ssl/wolfssl/wolfcrypt/pkcs12.c"
- "../../src/ssl/wolfssl/wolfcrypt/pkcs7.c"
"../../src/ssl/wolfssl/wolfcrypt/poly1305.c"
- "../../src/ssl/wolfssl/wolfcrypt/pwdbased.c"
"../../src/ssl/wolfssl/wolfcrypt/random.c"
- "../../src/ssl/wolfssl/wolfcrypt/rc2.c"
- "../../src/ssl/wolfssl/wolfcrypt/ripemd.c"
- "../../src/ssl/wolfssl/wolfcrypt/rsa.c"
- "../../src/ssl/wolfssl/wolfcrypt/sakke.c"
- "../../src/ssl/wolfssl/wolfcrypt/sha.c"
"../../src/ssl/wolfssl/wolfcrypt/sha256.c"
- "../../src/ssl/wolfssl/wolfcrypt/sha3.c"
- "../../src/ssl/wolfssl/wolfcrypt/sha512.c"
"../../src/ssl/wolfssl/wolfcrypt/signature.c"
- "../../src/ssl/wolfssl/wolfcrypt/siphash.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_arm32.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_arm64.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_armthumb.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_c32.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_c64.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_cortexm.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_dsp32.c"
"../../src/ssl/wolfssl/wolfcrypt/sp_int.c"
- "../../src/ssl/wolfssl/wolfcrypt/sp_x86_64.c"
- "../../src/ssl/wolfssl/wolfcrypt/sphincs.c"
- "../../src/ssl/wolfssl/wolfcrypt/srp.c"
- "../../src/ssl/wolfssl/wolfcrypt/tfm.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_dsp.c"
"../../src/ssl/wolfssl/wolfcrypt/wc_encrypt.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_lms.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_lms_impl.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_mlkem.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_mlkem_poly.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_pkcs11.c"
"../../src/ssl/wolfssl/wolfcrypt/wc_port.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_xmss.c"
- "../../src/ssl/wolfssl/wolfcrypt/wc_xmss_impl.c"
- "../../src/ssl/wolfssl/wolfcrypt/wolfevent.c"
"../../src/ssl/wolfssl/wolfcrypt/wolfmath.c" )
# ${CANONICAL_LIB_NAME} project specific include directory normalization for build.
@@ -761,8 +692,8 @@ if (with-tests)
"../../test/ssl/wolfssl/tests/api/test_wolfmath.h"
"../../test/ssl/wolfssl/tests/api/test_x509.c"
"../../test/ssl/wolfssl/tests/api/test_x509.h"
+ "../../test/ssl/wolfssl/testsuite/utils.c"
"../../test/ssl/wolfssl/testsuite/utils.h"
- "../../test/ssl/wolfssl/testsuite/utils1.c"
"../../test/ssl/wolfssl/wolfcrypt/benchmark/README.md"
"../../test/ssl/wolfssl/wolfcrypt/benchmark/benchmark.c"
"../../test/ssl/wolfssl/wolfcrypt/benchmark/benchmark.h"
diff --git a/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj b/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj
index 3c33064ea..8f3eb5ec0 100644
--- a/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj
+++ b/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj
@@ -447,7 +447,9 @@
$(IntDir)test_ssl_wolfssl_tests_utils.c.obj
-
+
+ $(IntDir)test_ssl_wolfssl_testsuite_utils.c.obj
+
$(IntDir)test_ssl_wolfssl_wolfcrypt_benchmark_benchmark.c.obj
diff --git a/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj.filters b/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj.filters
index b3b63e611..75edd6cbe 100644
--- a/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj.filters
+++ b/builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.vcxproj.filters
@@ -663,7 +663,7 @@
src\ssl\wolfssl\tests
-
+
src\ssl\wolfssl\testsuite
diff --git a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.props b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.props
index 8b269d475..31159e00a 100644
--- a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.props
+++ b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.props
@@ -40,9 +40,10 @@
/wd4189 /wd4245 /wd4267 /wd4701 /wd4702 /wd4703 %(AdditionalOptions)
-
- true
-
+
+ true
+ true
+
true
diff --git a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj
index 07dba4b11..3cde6396d 100644
--- a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj
+++ b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj
@@ -223,14 +223,8 @@
-
-
-
-
-
-
@@ -249,94 +243,32 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
$(IntDir)src_ssl_wolfssl_wolfcrypt_error.c.obj
-
-
-
-
-
-
-
-
-
-
-
-
-
$(IntDir)src_ssl_wolfssl_wolfcrypt_memory.c.obj
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -502,20 +434,15 @@
-
-
-
-
-
@@ -541,10 +468,7 @@
-
-
-
@@ -552,19 +476,15 @@
-
-
-
-
@@ -573,45 +493,30 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -619,11 +524,7 @@
-
-
-
-
@@ -632,8 +533,6 @@
-
-
@@ -641,26 +540,16 @@
-
-
-
-
-
-
-
-
-
-
diff --git a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj.filters b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj.filters
index 8a58692b0..c8a27b68d 100644
--- a/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj.filters
+++ b/builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj.filters
@@ -450,30 +450,12 @@
src
-
- src\ssl\wolfssl
-
-
- src\ssl\wolfssl
-
-
- src\ssl\wolfssl
-
src\ssl\wolfssl
src\ssl\wolfssl
-
- src\ssl\wolfssl
-
-
- src\ssl\wolfssl
-
-
- src\ssl\wolfssl
-
src\ssl\wolfssl\src
@@ -528,111 +510,33 @@
src\ssl\wolfssl
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
@@ -642,144 +546,36 @@
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
-
- src\ssl\wolfssl\wolfcrypt
-
src\ssl\wolfssl\wolfcrypt
@@ -1271,12 +1067,6 @@
include\bitcoin\ssl\wolfssl
-
- include\bitcoin\ssl\wolfssl
-
-
- include\bitcoin\ssl\wolfssl
-
include\bitcoin\ssl\wolfssl
@@ -1292,9 +1082,6 @@
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
@@ -1304,15 +1091,9 @@
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
@@ -1388,18 +1169,9 @@
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
@@ -1421,18 +1193,12 @@
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
@@ -1442,9 +1208,6 @@
include\bitcoin\ssl\wolfssl\openssl
-
- include\bitcoin\ssl\wolfssl\openssl
-
include\bitcoin\ssl\wolfssl\openssl
@@ -1457,9 +1220,6 @@
include\bitcoin\ssl\wolfssl
-
- include\bitcoin\ssl\wolfssl
-
include\bitcoin\ssl\wolfssl
@@ -1484,12 +1244,6 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1508,9 +1262,6 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1529,18 +1280,12 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1550,33 +1295,12 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1586,21 +1310,12 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1622,21 +1337,9 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1661,12 +1364,6 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1688,21 +1385,12 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
@@ -1715,39 +1403,18 @@
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl\wolfcrypt
-
- include\bitcoin\ssl\wolfssl\wolfcrypt
-
include\bitcoin\ssl\wolfssl
include\bitcoin\ssl\wolfssl
-
- src\ssl\wolfssl\wolfcrypt
-
diff --git a/include/bitcoin/ssl/wolfssl/certs_test_sm.h b/include/bitcoin/ssl/wolfssl/certs_test_sm.h
deleted file mode 100644
index b11c222ab..000000000
--- a/include/bitcoin/ssl/wolfssl/certs_test_sm.h
+++ /dev/null
@@ -1,2913 +0,0 @@
-/* certs_test_sm.h */
-/* This file was generated using: ./gencertbuf.pl */
-
-#ifndef WOLFSSL_CERTS_TEST_SM_H
-#define WOLFSSL_CERTS_TEST_SM_H
-
-#if defined(WOLFSSL_SM2) || defined(WOLFSSL_SM3) || defined(WOLFSSL_SM4)
-
- /* DER Certs Begin */
-
-/* ./certs/sm2/ca-sm2.der */
-static const unsigned char ca_sm2_der[] =
-{
- 0x30, 0x82, 0x02, 0x96, 0x30, 0x82, 0x02, 0x3C, 0xA0, 0x03,
- 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x30, 0x81,
- 0x95, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
- 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03,
- 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61,
- 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04,
- 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C,
- 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x53,
- 0x4D, 0x32, 0x31, 0x11, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x04,
- 0x0B, 0x0C, 0x08, 0x52, 0x6F, 0x6F, 0x74, 0x2D, 0x53, 0x4D,
- 0x32, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03,
- 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66,
- 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30,
- 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01,
- 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x33, 0x30, 0x32, 0x31, 0x35,
- 0x30, 0x36, 0x32, 0x33, 0x30, 0x37, 0x5A, 0x17, 0x0D, 0x32,
- 0x35, 0x31, 0x31, 0x31, 0x31, 0x30, 0x36, 0x32, 0x33, 0x30,
- 0x37, 0x5A, 0x30, 0x81, 0xAC, 0x31, 0x0B, 0x30, 0x09, 0x06,
- 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x10,
- 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D,
- 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E,
- 0x06, 0x03, 0x55, 0x04, 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A,
- 0x65, 0x6D, 0x61, 0x6E, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03,
- 0x55, 0x04, 0x0A, 0x0C, 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53,
- 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x31, 0x0F, 0x30, 0x0D,
- 0x06, 0x03, 0x55, 0x04, 0x0B, 0x0C, 0x06, 0x43, 0x41, 0x2D,
- 0x73, 0x6D, 0x32, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55,
- 0x04, 0x03, 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31,
- 0x1F, 0x30, 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7,
- 0x0D, 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F,
- 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x31, 0x17, 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92,
- 0x26, 0x89, 0x93, 0xF2, 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x30, 0x5A, 0x30,
- 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0x03, 0x42, 0x00, 0x04, 0x21, 0x92, 0xF7, 0xCB, 0x24,
- 0xDF, 0x64, 0x4D, 0xBA, 0xAB, 0x66, 0x7B, 0x83, 0x75, 0xA9,
- 0x29, 0xE7, 0xFF, 0x64, 0x63, 0xB6, 0xD5, 0x42, 0x80, 0x20,
- 0xBD, 0xE2, 0xE2, 0x02, 0x12, 0x3B, 0x8E, 0xB4, 0x00, 0x95,
- 0x09, 0x80, 0xCB, 0x56, 0xED, 0x4B, 0xCA, 0x8D, 0x57, 0xE6,
- 0xAE, 0x05, 0xD3, 0x76, 0x27, 0x63, 0x71, 0x39, 0x89, 0xB7,
- 0x69, 0xE6, 0x48, 0x80, 0xAE, 0xD1, 0xA9, 0x48, 0x12, 0xA3,
- 0x63, 0x30, 0x61, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E,
- 0x04, 0x16, 0x04, 0x14, 0x47, 0x0A, 0x48, 0x7E, 0xBB, 0x02,
- 0xA8, 0x5A, 0x26, 0x57, 0x2B, 0x19, 0xA9, 0x7B, 0x61, 0x8B,
- 0x7F, 0x5D, 0x99, 0x6E, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D,
- 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x34, 0x1D, 0x79,
- 0x44, 0x15, 0x79, 0xA1, 0xB1, 0x63, 0x99, 0xE3, 0xED, 0x65,
- 0x7C, 0x64, 0x89, 0x80, 0xFF, 0xB8, 0xEC, 0x30, 0x0F, 0x06,
- 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30,
- 0x03, 0x01, 0x01, 0xFF, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x1D,
- 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04, 0x03, 0x02, 0x01, 0x86,
- 0x30, 0x0A, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01,
- 0x83, 0x75, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x47,
- 0x4E, 0x00, 0x03, 0xAB, 0x34, 0xA1, 0xAF, 0x59, 0x39, 0x8F,
- 0x60, 0x36, 0xBF, 0x89, 0x88, 0x42, 0x41, 0x27, 0xC1, 0xDD,
- 0x57, 0xC9, 0x79, 0xCB, 0x1F, 0x56, 0x5C, 0x16, 0xB5, 0x28,
- 0xBD, 0x02, 0x21, 0x00, 0x8B, 0x2E, 0x25, 0xEB, 0x21, 0x9B,
- 0xA9, 0x2B, 0xA6, 0x6A, 0x5B, 0xDB, 0xA7, 0xC7, 0x2B, 0x11,
- 0xDF, 0x73, 0x15, 0xAD, 0xE4, 0xC5, 0xC3, 0xC2, 0xF3, 0xB4,
- 0xB4, 0x67, 0xAF, 0xD7, 0x51, 0x1C
-};
-#define sizeof_ca_sm2_der (sizeof(ca_sm2_der))
-
-/* ./certs/sm2/ca-sm2-key.der */
-static const unsigned char ca_sm2_key_der[] =
-{
- 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42, 0x00, 0x04, 0x21, 0x92,
- 0xF7, 0xCB, 0x24, 0xDF, 0x64, 0x4D, 0xBA, 0xAB, 0x66, 0x7B,
- 0x83, 0x75, 0xA9, 0x29, 0xE7, 0xFF, 0x64, 0x63, 0xB6, 0xD5,
- 0x42, 0x80, 0x20, 0xBD, 0xE2, 0xE2, 0x02, 0x12, 0x3B, 0x8E,
- 0xB4, 0x00, 0x95, 0x09, 0x80, 0xCB, 0x56, 0xED, 0x4B, 0xCA,
- 0x8D, 0x57, 0xE6, 0xAE, 0x05, 0xD3, 0x76, 0x27, 0x63, 0x71,
- 0x39, 0x89, 0xB7, 0x69, 0xE6, 0x48, 0x80, 0xAE, 0xD1, 0xA9,
- 0x48, 0x12
-};
-#define sizeof_ca_sm2_key_der (sizeof(ca_sm2_key_der))
-
-/* ./certs/sm2/ca-sm2-priv.der */
-static const unsigned char ca_sm2_priv_der[] =
-{
- 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x8F, 0xB9, 0xB8,
- 0x40, 0x19, 0x0E, 0x21, 0x39, 0xEB, 0xE8, 0x08, 0x7C, 0xFD,
- 0xD8, 0xA1, 0x05, 0x93, 0xA4, 0x35, 0x2C, 0xD1, 0x80, 0xE3,
- 0xBF, 0x7E, 0x48, 0x47, 0xE4, 0x05, 0x0D, 0x09, 0x41, 0xA0,
- 0x0A, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0xA1, 0x44, 0x03, 0x42, 0x00, 0x04, 0x21, 0x92, 0xF7,
- 0xCB, 0x24, 0xDF, 0x64, 0x4D, 0xBA, 0xAB, 0x66, 0x7B, 0x83,
- 0x75, 0xA9, 0x29, 0xE7, 0xFF, 0x64, 0x63, 0xB6, 0xD5, 0x42,
- 0x80, 0x20, 0xBD, 0xE2, 0xE2, 0x02, 0x12, 0x3B, 0x8E, 0xB4,
- 0x00, 0x95, 0x09, 0x80, 0xCB, 0x56, 0xED, 0x4B, 0xCA, 0x8D,
- 0x57, 0xE6, 0xAE, 0x05, 0xD3, 0x76, 0x27, 0x63, 0x71, 0x39,
- 0x89, 0xB7, 0x69, 0xE6, 0x48, 0x80, 0xAE, 0xD1, 0xA9, 0x48,
- 0x12
-};
-#define sizeof_ca_sm2_priv_der (sizeof(ca_sm2_priv_der))
-
-/* ./certs/sm2/client-sm2.der */
-static const unsigned char client_sm2_der[] =
-{
- 0x30, 0x82, 0x03, 0xC9, 0x30, 0x82, 0x03, 0x6E, 0xA0, 0x03,
- 0x02, 0x01, 0x02, 0x02, 0x14, 0x60, 0xA0, 0x4A, 0x0B, 0x36,
- 0xEB, 0x7D, 0xE1, 0x3F, 0x74, 0x29, 0xA9, 0x29, 0xB4, 0x05,
- 0x6C, 0x17, 0xF7, 0xA6, 0xD4, 0x30, 0x0A, 0x06, 0x08, 0x2A,
- 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x30, 0x81, 0xB0,
- 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
- 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55,
- 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E,
- 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x07,
- 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x31,
- 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D,
- 0x32, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0B,
- 0x0C, 0x0A, 0x43, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x2D, 0x73,
- 0x6D, 0x32, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04,
- 0x03, 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F,
- 0x30, 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D,
- 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40,
- 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F,
- 0x6D, 0x31, 0x17, 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92, 0x26,
- 0x89, 0x93, 0xF2, 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07, 0x77,
- 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x30, 0x1E, 0x17, 0x0D,
- 0x32, 0x33, 0x30, 0x32, 0x31, 0x35, 0x30, 0x36, 0x32, 0x33,
- 0x30, 0x37, 0x5A, 0x17, 0x0D, 0x32, 0x35, 0x31, 0x31, 0x31,
- 0x31, 0x30, 0x36, 0x32, 0x33, 0x30, 0x37, 0x5A, 0x30, 0x81,
- 0xB0, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
- 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03,
- 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61,
- 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04,
- 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C,
- 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73,
- 0x6D, 0x32, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
- 0x0B, 0x0C, 0x0A, 0x43, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x2D,
- 0x73, 0x6D, 0x32, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55,
- 0x04, 0x03, 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31,
- 0x1F, 0x30, 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7,
- 0x0D, 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F,
- 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x31, 0x17, 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92,
- 0x26, 0x89, 0x93, 0xF2, 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x30, 0x5A, 0x30,
- 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0x03, 0x42, 0x00, 0x04, 0x3A, 0x1D, 0xE8, 0xCB, 0x4B,
- 0xD3, 0x2E, 0x3F, 0x4B, 0x07, 0x3F, 0xB0, 0x21, 0xFE, 0xC5,
- 0x9E, 0xD9, 0xCA, 0x3A, 0x93, 0x93, 0x95, 0x76, 0x1D, 0x30,
- 0xD9, 0x0B, 0xF5, 0x56, 0xED, 0x19, 0x60, 0xED, 0x01, 0x4C,
- 0xF6, 0x67, 0x1D, 0xF1, 0xAC, 0xA8, 0x74, 0x0D, 0xB2, 0x77,
- 0xC8, 0x49, 0x38, 0xE4, 0xFF, 0x4C, 0xEF, 0x8D, 0x6D, 0x87,
- 0xF6, 0x4E, 0xC7, 0xF8, 0x39, 0x74, 0x70, 0x70, 0xB5, 0xA3,
- 0x82, 0x01, 0x61, 0x30, 0x82, 0x01, 0x5D, 0x30, 0x1D, 0x06,
- 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0xE4, 0x21,
- 0xB2, 0xC5, 0xE5, 0xD4, 0x9E, 0x82, 0xCA, 0xF8, 0x67, 0xF2,
- 0x28, 0x99, 0xF6, 0x85, 0xE8, 0xF1, 0x55, 0xEF, 0x30, 0x81,
- 0xF0, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x81, 0xE8, 0x30,
- 0x81, 0xE5, 0x80, 0x14, 0xE4, 0x21, 0xB2, 0xC5, 0xE5, 0xD4,
- 0x9E, 0x82, 0xCA, 0xF8, 0x67, 0xF2, 0x28, 0x99, 0xF6, 0x85,
- 0xE8, 0xF1, 0x55, 0xEF, 0xA1, 0x81, 0xB6, 0xA4, 0x81, 0xB3,
- 0x30, 0x81, 0xB0, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55,
- 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E,
- 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E,
- 0x74, 0x61, 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03,
- 0x55, 0x04, 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D,
- 0x61, 0x6E, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04,
- 0x0A, 0x0C, 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x5F, 0x73, 0x6D, 0x32, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
- 0x55, 0x04, 0x0B, 0x0C, 0x0A, 0x43, 0x6C, 0x69, 0x65, 0x6E,
- 0x74, 0x2D, 0x73, 0x6D, 0x32, 0x31, 0x18, 0x30, 0x16, 0x06,
- 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E,
- 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F,
- 0x6D, 0x31, 0x1F, 0x30, 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48,
- 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E,
- 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C,
- 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x17, 0x30, 0x15, 0x06, 0x0A,
- 0x09, 0x92, 0x26, 0x89, 0x93, 0xF2, 0x2C, 0x64, 0x01, 0x01,
- 0x0C, 0x07, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x82,
- 0x14, 0x60, 0xA0, 0x4A, 0x0B, 0x36, 0xEB, 0x7D, 0xE1, 0x3F,
- 0x74, 0x29, 0xA9, 0x29, 0xB4, 0x05, 0x6C, 0x17, 0xF7, 0xA6,
- 0xD4, 0x30, 0x0C, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x04, 0x05,
- 0x30, 0x03, 0x01, 0x01, 0xFF, 0x30, 0x1C, 0x06, 0x03, 0x55,
- 0x1D, 0x11, 0x04, 0x15, 0x30, 0x13, 0x82, 0x0B, 0x65, 0x78,
- 0x61, 0x6D, 0x70, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x87,
- 0x04, 0x7F, 0x00, 0x00, 0x01, 0x30, 0x1D, 0x06, 0x03, 0x55,
- 0x1D, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2B, 0x06,
- 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2B, 0x06,
- 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x03, 0x49,
- 0x00, 0x30, 0x46, 0x02, 0x21, 0x00, 0x8F, 0xB2, 0xB5, 0x95,
- 0x8F, 0x79, 0xF6, 0x5E, 0x75, 0xE5, 0xC5, 0xE9, 0x9A, 0x12,
- 0xD2, 0x0F, 0x78, 0x9F, 0xC0, 0x1D, 0x8D, 0x1C, 0xBE, 0x6B,
- 0x0C, 0xF1, 0xF5, 0x57, 0x60, 0xDB, 0x91, 0x4F, 0x02, 0x21,
- 0x00, 0x87, 0x5E, 0x7D, 0xE4, 0xD6, 0x3A, 0xBB, 0x7B, 0x98,
- 0x27, 0x85, 0xDE, 0x7A, 0xF0, 0x21, 0xE2, 0x66, 0xA1, 0x9F,
- 0x26, 0xE0, 0xDD, 0x86, 0x23, 0xB4, 0xC8, 0xC0, 0x46, 0x5A,
- 0xF2, 0x49, 0x8D
-};
-#define sizeof_client_sm2_der (sizeof(client_sm2_der))
-
-/* ./certs/sm2/client-sm2-key.der */
-static const unsigned char client_sm2_key_der[] =
-{
- 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42, 0x00, 0x04, 0x3A, 0x1D,
- 0xE8, 0xCB, 0x4B, 0xD3, 0x2E, 0x3F, 0x4B, 0x07, 0x3F, 0xB0,
- 0x21, 0xFE, 0xC5, 0x9E, 0xD9, 0xCA, 0x3A, 0x93, 0x93, 0x95,
- 0x76, 0x1D, 0x30, 0xD9, 0x0B, 0xF5, 0x56, 0xED, 0x19, 0x60,
- 0xED, 0x01, 0x4C, 0xF6, 0x67, 0x1D, 0xF1, 0xAC, 0xA8, 0x74,
- 0x0D, 0xB2, 0x77, 0xC8, 0x49, 0x38, 0xE4, 0xFF, 0x4C, 0xEF,
- 0x8D, 0x6D, 0x87, 0xF6, 0x4E, 0xC7, 0xF8, 0x39, 0x74, 0x70,
- 0x70, 0xB5
-};
-#define sizeof_client_sm2_key_der (sizeof(client_sm2_key_der))
-
-/* ./certs/sm2/client-sm2-priv.der */
-static const unsigned char client_sm2_priv_der[] =
-{
- 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0xD0, 0xA2, 0xDF,
- 0x49, 0x7A, 0x2D, 0xDF, 0x02, 0xC9, 0xCE, 0xB7, 0xF2, 0x37,
- 0x02, 0x0D, 0xDD, 0xFC, 0x08, 0xB8, 0xDE, 0x14, 0x93, 0x7A,
- 0x53, 0x26, 0x49, 0xD5, 0xFE, 0x02, 0xD9, 0xF3, 0x71, 0xA0,
- 0x0A, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0xA1, 0x44, 0x03, 0x42, 0x00, 0x04, 0x3A, 0x1D, 0xE8,
- 0xCB, 0x4B, 0xD3, 0x2E, 0x3F, 0x4B, 0x07, 0x3F, 0xB0, 0x21,
- 0xFE, 0xC5, 0x9E, 0xD9, 0xCA, 0x3A, 0x93, 0x93, 0x95, 0x76,
- 0x1D, 0x30, 0xD9, 0x0B, 0xF5, 0x56, 0xED, 0x19, 0x60, 0xED,
- 0x01, 0x4C, 0xF6, 0x67, 0x1D, 0xF1, 0xAC, 0xA8, 0x74, 0x0D,
- 0xB2, 0x77, 0xC8, 0x49, 0x38, 0xE4, 0xFF, 0x4C, 0xEF, 0x8D,
- 0x6D, 0x87, 0xF6, 0x4E, 0xC7, 0xF8, 0x39, 0x74, 0x70, 0x70,
- 0xB5
-};
-#define sizeof_client_sm2_priv_der (sizeof(client_sm2_priv_der))
-
-/* ./certs/sm2/root-sm2.der */
-static const unsigned char root_sm2_der[] =
-{
- 0x30, 0x82, 0x02, 0x91, 0x30, 0x82, 0x02, 0x38, 0xA0, 0x03,
- 0x02, 0x01, 0x02, 0x02, 0x14, 0x74, 0x9C, 0xDD, 0xA4, 0xB2,
- 0x67, 0x26, 0x57, 0x29, 0xFB, 0xE9, 0x13, 0x54, 0xE0, 0x34,
- 0x08, 0x03, 0x2B, 0x70, 0xA9, 0x30, 0x0A, 0x06, 0x08, 0x2A,
- 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x30, 0x81, 0x95,
- 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
- 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55,
- 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E,
- 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x07,
- 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x31,
- 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x53, 0x4D,
- 0x32, 0x31, 0x11, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x04, 0x0B,
- 0x0C, 0x08, 0x52, 0x6F, 0x6F, 0x74, 0x2D, 0x53, 0x4D, 0x32,
- 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C,
- 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73,
- 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30, 0x1D,
- 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09,
- 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x30,
- 0x1E, 0x17, 0x0D, 0x32, 0x33, 0x30, 0x32, 0x31, 0x35, 0x30,
- 0x36, 0x32, 0x33, 0x30, 0x37, 0x5A, 0x17, 0x0D, 0x32, 0x35,
- 0x31, 0x31, 0x31, 0x31, 0x30, 0x36, 0x32, 0x33, 0x30, 0x37,
- 0x5A, 0x30, 0x81, 0x95, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03,
- 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30,
- 0x0E, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F,
- 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06,
- 0x03, 0x55, 0x04, 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65,
- 0x6D, 0x61, 0x6E, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
- 0x04, 0x0A, 0x0C, 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53,
- 0x4C, 0x5F, 0x53, 0x4D, 0x32, 0x31, 0x11, 0x30, 0x0F, 0x06,
- 0x03, 0x55, 0x04, 0x0B, 0x0C, 0x08, 0x52, 0x6F, 0x6F, 0x74,
- 0x2D, 0x53, 0x4D, 0x32, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03,
- 0x55, 0x04, 0x03, 0x0C, 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x31, 0x1F, 0x30, 0x1D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
- 0xF7, 0x0D, 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66,
- 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E,
- 0x63, 0x6F, 0x6D, 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08, 0x2A,
- 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08, 0x2A,
- 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42, 0x00,
- 0x04, 0xBB, 0x9C, 0x75, 0x8C, 0xF7, 0x17, 0xF8, 0x48, 0xAB,
- 0xF7, 0xF6, 0xDB, 0x0D, 0x9A, 0x8D, 0x9F, 0xC2, 0xD1, 0x47,
- 0x97, 0x95, 0x0B, 0x4E, 0xE6, 0x57, 0xEC, 0xC5, 0xF8, 0x57,
- 0x54, 0x71, 0x39, 0x3C, 0x79, 0xE1, 0x40, 0x3F, 0xB6, 0x51,
- 0xE9, 0x7C, 0xC7, 0xDA, 0x2D, 0xEF, 0xD2, 0xE8, 0x79, 0x81,
- 0x7B, 0xAB, 0xA3, 0x5F, 0x6B, 0x2A, 0x6C, 0x97, 0x1A, 0x5E,
- 0x8E, 0xD9, 0xD0, 0xCC, 0x04, 0xA3, 0x63, 0x30, 0x61, 0x30,
- 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14,
- 0x34, 0x1D, 0x79, 0x44, 0x15, 0x79, 0xA1, 0xB1, 0x63, 0x99,
- 0xE3, 0xED, 0x65, 0x7C, 0x64, 0x89, 0x80, 0xFF, 0xB8, 0xEC,
- 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18, 0x30,
- 0x16, 0x80, 0x14, 0x34, 0x1D, 0x79, 0x44, 0x15, 0x79, 0xA1,
- 0xB1, 0x63, 0x99, 0xE3, 0xED, 0x65, 0x7C, 0x64, 0x89, 0x80,
- 0xFF, 0xB8, 0xEC, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 0x13,
- 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xFF,
- 0x30, 0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF,
- 0x04, 0x04, 0x03, 0x02, 0x01, 0x86, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x03, 0x47,
- 0x00, 0x30, 0x44, 0x02, 0x20, 0x03, 0x27, 0x29, 0xF0, 0xEF,
- 0x78, 0x26, 0xA1, 0x1A, 0x6A, 0x1E, 0x88, 0x81, 0xE7, 0x83,
- 0x72, 0x5F, 0x3E, 0xE6, 0x08, 0xE8, 0x14, 0x68, 0xBF, 0x4B,
- 0x0F, 0x68, 0x52, 0x92, 0xAA, 0x8F, 0xA1, 0x02, 0x20, 0x0B,
- 0xFE, 0x1B, 0x14, 0xBA, 0x51, 0x82, 0x65, 0x06, 0xBB, 0x22,
- 0xD8, 0x1A, 0xA7, 0x9F, 0x54, 0x62, 0xEB, 0x8D, 0xB2, 0xD5,
- 0x13, 0xB3, 0xB8, 0xA2, 0xF3, 0x14, 0x44, 0xB2, 0xA0, 0x21,
- 0xD0
-};
-#define sizeof_root_sm2_der (sizeof(root_sm2_der))
-
-/* ./certs/sm2/root-sm2-key.der */
-static const unsigned char root_sm2_key_der[] =
-{
- 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42, 0x00, 0x04, 0xBB, 0x9C,
- 0x75, 0x8C, 0xF7, 0x17, 0xF8, 0x48, 0xAB, 0xF7, 0xF6, 0xDB,
- 0x0D, 0x9A, 0x8D, 0x9F, 0xC2, 0xD1, 0x47, 0x97, 0x95, 0x0B,
- 0x4E, 0xE6, 0x57, 0xEC, 0xC5, 0xF8, 0x57, 0x54, 0x71, 0x39,
- 0x3C, 0x79, 0xE1, 0x40, 0x3F, 0xB6, 0x51, 0xE9, 0x7C, 0xC7,
- 0xDA, 0x2D, 0xEF, 0xD2, 0xE8, 0x79, 0x81, 0x7B, 0xAB, 0xA3,
- 0x5F, 0x6B, 0x2A, 0x6C, 0x97, 0x1A, 0x5E, 0x8E, 0xD9, 0xD0,
- 0xCC, 0x04
-};
-#define sizeof_root_sm2_key_der (sizeof(root_sm2_key_der))
-
-/* ./certs/sm2/root-sm2-priv.der */
-static const unsigned char root_sm2_priv_der[] =
-{
- 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0xC6, 0x6B, 0x34,
- 0x4C, 0x33, 0x37, 0x5B, 0x64, 0x16, 0x5A, 0x7F, 0x04, 0xF9,
- 0xFC, 0x87, 0x30, 0xD1, 0x15, 0xBA, 0x58, 0x78, 0xEE, 0x07,
- 0x98, 0x20, 0x26, 0xE1, 0x06, 0x8D, 0x51, 0x8A, 0x28, 0xA0,
- 0x0A, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0xA1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xBB, 0x9C, 0x75,
- 0x8C, 0xF7, 0x17, 0xF8, 0x48, 0xAB, 0xF7, 0xF6, 0xDB, 0x0D,
- 0x9A, 0x8D, 0x9F, 0xC2, 0xD1, 0x47, 0x97, 0x95, 0x0B, 0x4E,
- 0xE6, 0x57, 0xEC, 0xC5, 0xF8, 0x57, 0x54, 0x71, 0x39, 0x3C,
- 0x79, 0xE1, 0x40, 0x3F, 0xB6, 0x51, 0xE9, 0x7C, 0xC7, 0xDA,
- 0x2D, 0xEF, 0xD2, 0xE8, 0x79, 0x81, 0x7B, 0xAB, 0xA3, 0x5F,
- 0x6B, 0x2A, 0x6C, 0x97, 0x1A, 0x5E, 0x8E, 0xD9, 0xD0, 0xCC,
- 0x04
-};
-#define sizeof_root_sm2_priv_der (sizeof(root_sm2_priv_der))
-
-/* ./certs/sm2/server-sm2.der */
-static const unsigned char server_sm2_der[] =
-{
- 0x30, 0x82, 0x02, 0xD8, 0x30, 0x82, 0x02, 0x7E, 0xA0, 0x03,
- 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x30, 0x81,
- 0xAC, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
- 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03,
- 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61,
- 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04,
- 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C,
- 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73,
- 0x6D, 0x32, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04,
- 0x0B, 0x0C, 0x06, 0x43, 0x41, 0x2D, 0x73, 0x6D, 0x32, 0x31,
- 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0F,
- 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30, 0x1D, 0x06,
- 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x01,
- 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x17,
- 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92, 0x26, 0x89, 0x93, 0xF2,
- 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x33, 0x30,
- 0x32, 0x31, 0x35, 0x30, 0x36, 0x32, 0x33, 0x30, 0x37, 0x5A,
- 0x17, 0x0D, 0x32, 0x35, 0x31, 0x31, 0x31, 0x31, 0x30, 0x36,
- 0x32, 0x33, 0x30, 0x37, 0x5A, 0x30, 0x81, 0xB0, 0x31, 0x0B,
- 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
- 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x08,
- 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x31,
- 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0C, 0x07,
- 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x31, 0x14, 0x30,
- 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B, 0x77, 0x6F,
- 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x31,
- 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0B, 0x0C, 0x0A,
- 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2D, 0x73, 0x6D, 0x32,
- 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C,
- 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73,
- 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30, 0x1D,
- 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09,
- 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31,
- 0x17, 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92, 0x26, 0x89, 0x93,
- 0xF2, 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07, 0x77, 0x6F, 0x6C,
- 0x66, 0x53, 0x53, 0x4C, 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42,
- 0x00, 0x04, 0x94, 0x70, 0x2B, 0x46, 0xE4, 0x5E, 0x0F, 0x41,
- 0xFB, 0x8F, 0x2D, 0x34, 0x0A, 0x41, 0x40, 0x19, 0x5E, 0xFB,
- 0xD4, 0x1D, 0x11, 0xAC, 0xFA, 0xF5, 0x93, 0x37, 0xC6, 0xFA,
- 0x87, 0x08, 0xF7, 0x16, 0x1F, 0x2C, 0xCE, 0x30, 0x40, 0x9D,
- 0x4F, 0xA6, 0x2A, 0x0A, 0xA1, 0xD6, 0x95, 0x33, 0xC3, 0xA6,
- 0x03, 0x98, 0xE6, 0x8D, 0x05, 0x34, 0xB0, 0x97, 0x0C, 0xDE,
- 0xA4, 0xC7, 0xCF, 0x53, 0x8F, 0xD1, 0xA3, 0x81, 0x89, 0x30,
- 0x81, 0x86, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04,
- 0x16, 0x04, 0x14, 0x67, 0xAE, 0x60, 0xFF, 0x7E, 0x1B, 0x0F,
- 0x95, 0xAE, 0x1F, 0x82, 0x59, 0xF2, 0x6C, 0x56, 0x2D, 0x93,
- 0xEF, 0x17, 0x32, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23,
- 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x47, 0x0A, 0x48, 0x7E,
- 0xBB, 0x02, 0xA8, 0x5A, 0x26, 0x57, 0x2B, 0x19, 0xA9, 0x7B,
- 0x61, 0x8B, 0x7F, 0x5D, 0x99, 0x6E, 0x30, 0x0C, 0x06, 0x03,
- 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x02, 0x30, 0x00,
- 0x30, 0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF,
- 0x04, 0x04, 0x03, 0x02, 0x03, 0xA8, 0x30, 0x13, 0x06, 0x03,
- 0x55, 0x1D, 0x25, 0x04, 0x0C, 0x30, 0x0A, 0x06, 0x08, 0x2B,
- 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x30, 0x11, 0x06,
- 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x42, 0x01, 0x01,
- 0x04, 0x04, 0x03, 0x02, 0x06, 0x40, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x03, 0x48,
- 0x00, 0x30, 0x45, 0x02, 0x20, 0x1B, 0xCA, 0x94, 0x28, 0x7F,
- 0xF6, 0xB2, 0x0D, 0x31, 0x43, 0x50, 0xE1, 0xD5, 0x34, 0x17,
- 0xDD, 0xAF, 0x3A, 0xDE, 0x81, 0x06, 0x67, 0x9A, 0xB3, 0x06,
- 0x22, 0x7E, 0x64, 0xEC, 0xFD, 0x0E, 0xB9, 0x02, 0x21, 0x00,
- 0xA1, 0x48, 0xA8, 0x32, 0xD1, 0x05, 0x09, 0x6B, 0x1C, 0xEB,
- 0x89, 0x12, 0x66, 0xD8, 0x38, 0xA1, 0xC4, 0x5C, 0x89, 0x09,
- 0x0F, 0xFD, 0xE9, 0xC0, 0x3B, 0x1D, 0xFB, 0xCD, 0xB5, 0x4C,
- 0x31, 0x68
-};
-#define sizeof_server_sm2_der (sizeof(server_sm2_der))
-
-/* ./certs/sm2/server-sm2-cert.der */
-static const unsigned char server_sm2_cert_der[] =
-{
- 0x30, 0x82, 0x02, 0xD8, 0x30, 0x82, 0x02, 0x7E, 0xA0, 0x03,
- 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x30, 0x81,
- 0xAC, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
- 0x13, 0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03,
- 0x55, 0x04, 0x08, 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61,
- 0x6E, 0x61, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04,
- 0x07, 0x0C, 0x07, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C,
- 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73,
- 0x6D, 0x32, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04,
- 0x0B, 0x0C, 0x06, 0x43, 0x41, 0x2D, 0x73, 0x6D, 0x32, 0x31,
- 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0F,
- 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30, 0x1D, 0x06,
- 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x01,
- 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x17,
- 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92, 0x26, 0x89, 0x93, 0xF2,
- 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x33, 0x30,
- 0x32, 0x31, 0x35, 0x30, 0x36, 0x32, 0x33, 0x30, 0x37, 0x5A,
- 0x17, 0x0D, 0x32, 0x35, 0x31, 0x31, 0x31, 0x31, 0x30, 0x36,
- 0x32, 0x33, 0x30, 0x37, 0x5A, 0x30, 0x81, 0xB0, 0x31, 0x0B,
- 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
- 0x53, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x08,
- 0x0C, 0x07, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x31,
- 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0C, 0x07,
- 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x31, 0x14, 0x30,
- 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B, 0x77, 0x6F,
- 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x31,
- 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0B, 0x0C, 0x0A,
- 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2D, 0x73, 0x6D, 0x32,
- 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C,
- 0x0F, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73,
- 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31, 0x1F, 0x30, 0x1D,
- 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09,
- 0x01, 0x16, 0x10, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x31,
- 0x17, 0x30, 0x15, 0x06, 0x0A, 0x09, 0x92, 0x26, 0x89, 0x93,
- 0xF2, 0x2C, 0x64, 0x01, 0x01, 0x0C, 0x07, 0x77, 0x6F, 0x6C,
- 0x66, 0x53, 0x53, 0x4C, 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42,
- 0x00, 0x04, 0x94, 0x70, 0x2B, 0x46, 0xE4, 0x5E, 0x0F, 0x41,
- 0xFB, 0x8F, 0x2D, 0x34, 0x0A, 0x41, 0x40, 0x19, 0x5E, 0xFB,
- 0xD4, 0x1D, 0x11, 0xAC, 0xFA, 0xF5, 0x93, 0x37, 0xC6, 0xFA,
- 0x87, 0x08, 0xF7, 0x16, 0x1F, 0x2C, 0xCE, 0x30, 0x40, 0x9D,
- 0x4F, 0xA6, 0x2A, 0x0A, 0xA1, 0xD6, 0x95, 0x33, 0xC3, 0xA6,
- 0x03, 0x98, 0xE6, 0x8D, 0x05, 0x34, 0xB0, 0x97, 0x0C, 0xDE,
- 0xA4, 0xC7, 0xCF, 0x53, 0x8F, 0xD1, 0xA3, 0x81, 0x89, 0x30,
- 0x81, 0x86, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04,
- 0x16, 0x04, 0x14, 0x67, 0xAE, 0x60, 0xFF, 0x7E, 0x1B, 0x0F,
- 0x95, 0xAE, 0x1F, 0x82, 0x59, 0xF2, 0x6C, 0x56, 0x2D, 0x93,
- 0xEF, 0x17, 0x32, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23,
- 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x47, 0x0A, 0x48, 0x7E,
- 0xBB, 0x02, 0xA8, 0x5A, 0x26, 0x57, 0x2B, 0x19, 0xA9, 0x7B,
- 0x61, 0x8B, 0x7F, 0x5D, 0x99, 0x6E, 0x30, 0x0C, 0x06, 0x03,
- 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x02, 0x30, 0x00,
- 0x30, 0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF,
- 0x04, 0x04, 0x03, 0x02, 0x03, 0xA8, 0x30, 0x13, 0x06, 0x03,
- 0x55, 0x1D, 0x25, 0x04, 0x0C, 0x30, 0x0A, 0x06, 0x08, 0x2B,
- 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x30, 0x11, 0x06,
- 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x42, 0x01, 0x01,
- 0x04, 0x04, 0x03, 0x02, 0x06, 0x40, 0x30, 0x0A, 0x06, 0x08,
- 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x75, 0x03, 0x48,
- 0x00, 0x30, 0x45, 0x02, 0x20, 0x1B, 0xCA, 0x94, 0x28, 0x7F,
- 0xF6, 0xB2, 0x0D, 0x31, 0x43, 0x50, 0xE1, 0xD5, 0x34, 0x17,
- 0xDD, 0xAF, 0x3A, 0xDE, 0x81, 0x06, 0x67, 0x9A, 0xB3, 0x06,
- 0x22, 0x7E, 0x64, 0xEC, 0xFD, 0x0E, 0xB9, 0x02, 0x21, 0x00,
- 0xA1, 0x48, 0xA8, 0x32, 0xD1, 0x05, 0x09, 0x6B, 0x1C, 0xEB,
- 0x89, 0x12, 0x66, 0xD8, 0x38, 0xA1, 0xC4, 0x5C, 0x89, 0x09,
- 0x0F, 0xFD, 0xE9, 0xC0, 0x3B, 0x1D, 0xFB, 0xCD, 0xB5, 0x4C,
- 0x31, 0x68
-};
-#define sizeof_server_sm2_cert_der (sizeof(server_sm2_cert_der))
-
-/* ./certs/sm2/server-sm2-key.der */
-static const unsigned char server_sm2_key_der[] =
-{
- 0x30, 0x5A, 0x30, 0x14, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF,
- 0x55, 0x01, 0x82, 0x2D, 0x03, 0x42, 0x00, 0x04, 0x94, 0x70,
- 0x2B, 0x46, 0xE4, 0x5E, 0x0F, 0x41, 0xFB, 0x8F, 0x2D, 0x34,
- 0x0A, 0x41, 0x40, 0x19, 0x5E, 0xFB, 0xD4, 0x1D, 0x11, 0xAC,
- 0xFA, 0xF5, 0x93, 0x37, 0xC6, 0xFA, 0x87, 0x08, 0xF7, 0x16,
- 0x1F, 0x2C, 0xCE, 0x30, 0x40, 0x9D, 0x4F, 0xA6, 0x2A, 0x0A,
- 0xA1, 0xD6, 0x95, 0x33, 0xC3, 0xA6, 0x03, 0x98, 0xE6, 0x8D,
- 0x05, 0x34, 0xB0, 0x97, 0x0C, 0xDE, 0xA4, 0xC7, 0xCF, 0x53,
- 0x8F, 0xD1
-};
-#define sizeof_server_sm2_key_der (sizeof(server_sm2_key_der))
-
-/* ./certs/sm2/server-sm2-priv.der */
-static const unsigned char server_sm2_priv_der[] =
-{
- 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0xD7, 0x33, 0xC1,
- 0xA1, 0x71, 0x98, 0xDA, 0x43, 0x81, 0x0D, 0x70, 0x42, 0x88,
- 0x63, 0xD0, 0x4C, 0x7E, 0x0F, 0x8A, 0x9B, 0x2D, 0xDA, 0x15,
- 0xAA, 0x0E, 0x5A, 0xFA, 0xED, 0x77, 0x3A, 0x43, 0xA8, 0xA0,
- 0x0A, 0x06, 0x08, 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x82,
- 0x2D, 0xA1, 0x44, 0x03, 0x42, 0x00, 0x04, 0x94, 0x70, 0x2B,
- 0x46, 0xE4, 0x5E, 0x0F, 0x41, 0xFB, 0x8F, 0x2D, 0x34, 0x0A,
- 0x41, 0x40, 0x19, 0x5E, 0xFB, 0xD4, 0x1D, 0x11, 0xAC, 0xFA,
- 0xF5, 0x93, 0x37, 0xC6, 0xFA, 0x87, 0x08, 0xF7, 0x16, 0x1F,
- 0x2C, 0xCE, 0x30, 0x40, 0x9D, 0x4F, 0xA6, 0x2A, 0x0A, 0xA1,
- 0xD6, 0x95, 0x33, 0xC3, 0xA6, 0x03, 0x98, 0xE6, 0x8D, 0x05,
- 0x34, 0xB0, 0x97, 0x0C, 0xDE, 0xA4, 0xC7, 0xCF, 0x53, 0x8F,
- 0xD1
-};
-#define sizeof_server_sm2_priv_der (sizeof(server_sm2_priv_der))
-
- /* DER Certs End */
-
-#ifdef WOLFSSL_NO_PEM
-
- /* SM PEM Certs disabled */
-
-#else
-
-/* ./certs/sm2/ca-sm2.pem */
-static const unsigned char ca_sm2[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x20, 0x31, 0x20, 0x28, 0x30, 0x78, 0x31, 0x29, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D,
- 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x49,
- 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A, 0x20, 0x43, 0x20, 0x3D,
- 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20,
- 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C,
- 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x5F, 0x53, 0x4D, 0x32, 0x2C, 0x20, 0x4F,
- 0x55, 0x20, 0x3D, 0x20, 0x52, 0x6F, 0x6F, 0x74, 0x2D, 0x53,
- 0x4D, 0x32, 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77,
- 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C,
- 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69,
- 0x6C, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D,
- 0x20, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66,
- 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x56, 0x61, 0x6C, 0x69,
- 0x64, 0x69, 0x74, 0x79, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74,
- 0x20, 0x42, 0x65, 0x66, 0x6F, 0x72, 0x65, 0x3A, 0x20, 0x46,
- 0x65, 0x62, 0x20, 0x31, 0x35, 0x20, 0x30, 0x36, 0x3A, 0x32,
- 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32, 0x33, 0x20,
- 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74, 0x20,
- 0x41, 0x66, 0x74, 0x65, 0x72, 0x20, 0x3A, 0x20, 0x4E, 0x6F,
- 0x76, 0x20, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3A, 0x32, 0x33,
- 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32, 0x35, 0x20, 0x47,
- 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x3A, 0x20,
- 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53, 0x54,
- 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61,
- 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A, 0x65,
- 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77,
- 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32,
- 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20, 0x43, 0x41, 0x2D,
- 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20,
- 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61,
- 0x69, 0x6C, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20,
- 0x3D, 0x20, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20,
- 0x55, 0x49, 0x44, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20,
- 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79,
- 0x20, 0x49, 0x6E, 0x66, 0x6F, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50,
- 0x75, 0x62, 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20,
- 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A,
- 0x20, 0x73, 0x6D, 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x2D, 0x4B, 0x65,
- 0x79, 0x3A, 0x20, 0x28, 0x32, 0x35, 0x36, 0x20, 0x62, 0x69,
- 0x74, 0x29, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70,
- 0x75, 0x62, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x30, 0x34, 0x3A, 0x32, 0x31, 0x3A,
- 0x39, 0x32, 0x3A, 0x66, 0x37, 0x3A, 0x63, 0x62, 0x3A, 0x32,
- 0x34, 0x3A, 0x64, 0x66, 0x3A, 0x36, 0x34, 0x3A, 0x34, 0x64,
- 0x3A, 0x62, 0x61, 0x3A, 0x61, 0x62, 0x3A, 0x36, 0x36, 0x3A,
- 0x37, 0x62, 0x3A, 0x38, 0x33, 0x3A, 0x37, 0x35, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x61, 0x39, 0x3A, 0x32, 0x39, 0x3A, 0x65, 0x37, 0x3A, 0x66,
- 0x66, 0x3A, 0x36, 0x34, 0x3A, 0x36, 0x33, 0x3A, 0x62, 0x36,
- 0x3A, 0x64, 0x35, 0x3A, 0x34, 0x32, 0x3A, 0x38, 0x30, 0x3A,
- 0x32, 0x30, 0x3A, 0x62, 0x64, 0x3A, 0x65, 0x32, 0x3A, 0x65,
- 0x32, 0x3A, 0x30, 0x32, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x31, 0x32, 0x3A, 0x33,
- 0x62, 0x3A, 0x38, 0x65, 0x3A, 0x62, 0x34, 0x3A, 0x30, 0x30,
- 0x3A, 0x39, 0x35, 0x3A, 0x30, 0x39, 0x3A, 0x38, 0x30, 0x3A,
- 0x63, 0x62, 0x3A, 0x35, 0x36, 0x3A, 0x65, 0x64, 0x3A, 0x34,
- 0x62, 0x3A, 0x63, 0x61, 0x3A, 0x38, 0x64, 0x3A, 0x35, 0x37,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x65, 0x36, 0x3A, 0x61, 0x65, 0x3A, 0x30, 0x35,
- 0x3A, 0x64, 0x33, 0x3A, 0x37, 0x36, 0x3A, 0x32, 0x37, 0x3A,
- 0x36, 0x33, 0x3A, 0x37, 0x31, 0x3A, 0x33, 0x39, 0x3A, 0x38,
- 0x39, 0x3A, 0x62, 0x37, 0x3A, 0x36, 0x39, 0x3A, 0x65, 0x36,
- 0x3A, 0x34, 0x38, 0x3A, 0x38, 0x30, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x61, 0x65,
- 0x3A, 0x64, 0x31, 0x3A, 0x61, 0x39, 0x3A, 0x34, 0x38, 0x3A,
- 0x31, 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x41,
- 0x53, 0x4E, 0x31, 0x20, 0x4F, 0x49, 0x44, 0x3A, 0x20, 0x53,
- 0x4D, 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x65, 0x78,
- 0x74, 0x65, 0x6E, 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x53,
- 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x4B, 0x65, 0x79,
- 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65,
- 0x72, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x34, 0x37, 0x3A, 0x30, 0x41, 0x3A, 0x34, 0x38, 0x3A, 0x37,
- 0x45, 0x3A, 0x42, 0x42, 0x3A, 0x30, 0x32, 0x3A, 0x41, 0x38,
- 0x3A, 0x35, 0x41, 0x3A, 0x32, 0x36, 0x3A, 0x35, 0x37, 0x3A,
- 0x32, 0x42, 0x3A, 0x31, 0x39, 0x3A, 0x41, 0x39, 0x3A, 0x37,
- 0x42, 0x3A, 0x36, 0x31, 0x3A, 0x38, 0x42, 0x3A, 0x37, 0x46,
- 0x3A, 0x35, 0x44, 0x3A, 0x39, 0x39, 0x3A, 0x36, 0x45, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x41,
- 0x75, 0x74, 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20, 0x4B,
- 0x65, 0x79, 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66,
- 0x69, 0x65, 0x72, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x33, 0x34, 0x3A, 0x31, 0x44, 0x3A, 0x37, 0x39,
- 0x3A, 0x34, 0x34, 0x3A, 0x31, 0x35, 0x3A, 0x37, 0x39, 0x3A,
- 0x41, 0x31, 0x3A, 0x42, 0x31, 0x3A, 0x36, 0x33, 0x3A, 0x39,
- 0x39, 0x3A, 0x45, 0x33, 0x3A, 0x45, 0x44, 0x3A, 0x36, 0x35,
- 0x3A, 0x37, 0x43, 0x3A, 0x36, 0x34, 0x3A, 0x38, 0x39, 0x3A,
- 0x38, 0x30, 0x3A, 0x46, 0x46, 0x3A, 0x42, 0x38, 0x3A, 0x45,
- 0x43, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33,
- 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 0x20, 0x43, 0x6F, 0x6E,
- 0x73, 0x74, 0x72, 0x61, 0x69, 0x6E, 0x74, 0x73, 0x3A, 0x20,
- 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x43, 0x41, 0x3A, 0x54, 0x52,
- 0x55, 0x45, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76,
- 0x33, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x55, 0x73, 0x61, 0x67,
- 0x65, 0x3A, 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61,
- 0x6C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44, 0x69,
- 0x67, 0x69, 0x74, 0x61, 0x6C, 0x20, 0x53, 0x69, 0x67, 0x6E,
- 0x61, 0x74, 0x75, 0x72, 0x65, 0x2C, 0x20, 0x43, 0x65, 0x72,
- 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x53,
- 0x69, 0x67, 0x6E, 0x2C, 0x20, 0x43, 0x52, 0x4C, 0x20, 0x53,
- 0x69, 0x67, 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69,
- 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C,
- 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53,
- 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D,
- 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E,
- 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x56, 0x61, 0x6C, 0x75,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x33, 0x30, 0x3A, 0x34, 0x35, 0x3A, 0x30, 0x32, 0x3A,
- 0x32, 0x30, 0x3A, 0x34, 0x37, 0x3A, 0x34, 0x65, 0x3A, 0x30,
- 0x30, 0x3A, 0x30, 0x33, 0x3A, 0x61, 0x62, 0x3A, 0x33, 0x34,
- 0x3A, 0x61, 0x31, 0x3A, 0x61, 0x66, 0x3A, 0x35, 0x39, 0x3A,
- 0x33, 0x39, 0x3A, 0x38, 0x66, 0x3A, 0x36, 0x30, 0x3A, 0x33,
- 0x36, 0x3A, 0x62, 0x66, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x38, 0x39, 0x3A, 0x38, 0x38, 0x3A,
- 0x34, 0x32, 0x3A, 0x34, 0x31, 0x3A, 0x32, 0x37, 0x3A, 0x63,
- 0x31, 0x3A, 0x64, 0x64, 0x3A, 0x35, 0x37, 0x3A, 0x63, 0x39,
- 0x3A, 0x37, 0x39, 0x3A, 0x63, 0x62, 0x3A, 0x31, 0x66, 0x3A,
- 0x35, 0x36, 0x3A, 0x35, 0x63, 0x3A, 0x31, 0x36, 0x3A, 0x62,
- 0x35, 0x3A, 0x32, 0x38, 0x3A, 0x62, 0x64, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x32, 0x3A,
- 0x32, 0x31, 0x3A, 0x30, 0x30, 0x3A, 0x38, 0x62, 0x3A, 0x32,
- 0x65, 0x3A, 0x32, 0x35, 0x3A, 0x65, 0x62, 0x3A, 0x32, 0x31,
- 0x3A, 0x39, 0x62, 0x3A, 0x61, 0x39, 0x3A, 0x32, 0x62, 0x3A,
- 0x61, 0x36, 0x3A, 0x36, 0x61, 0x3A, 0x35, 0x62, 0x3A, 0x64,
- 0x62, 0x3A, 0x61, 0x37, 0x3A, 0x63, 0x37, 0x3A, 0x32, 0x62,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x31, 0x31, 0x3A, 0x64, 0x66, 0x3A, 0x37, 0x33, 0x3A, 0x31,
- 0x35, 0x3A, 0x61, 0x64, 0x3A, 0x65, 0x34, 0x3A, 0x63, 0x35,
- 0x3A, 0x63, 0x33, 0x3A, 0x63, 0x32, 0x3A, 0x66, 0x33, 0x3A,
- 0x62, 0x34, 0x3A, 0x62, 0x34, 0x3A, 0x36, 0x37, 0x3A, 0x61,
- 0x66, 0x3A, 0x64, 0x37, 0x3A, 0x35, 0x31, 0x3A, 0x31, 0x63,
- 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49,
- 0x4E, 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43,
- 0x41, 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D,
- 0x49, 0x49, 0x43, 0x6C, 0x6A, 0x43, 0x43, 0x41, 0x6A, 0x79,
- 0x67, 0x41, 0x77, 0x49, 0x42, 0x41, 0x67, 0x49, 0x42, 0x41,
- 0x54, 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A,
- 0x50, 0x56, 0x51, 0x47, 0x44, 0x64, 0x54, 0x43, 0x42, 0x6C,
- 0x54, 0x45, 0x4C, 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55,
- 0x45, 0x42, 0x68, 0x4D, 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45,
- 0x44, 0x41, 0x4F, 0x0A, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41,
- 0x67, 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68,
- 0x62, 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67,
- 0x4E, 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76,
- 0x65, 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34, 0x78, 0x46, 0x44,
- 0x41, 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D,
- 0x43, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x0A, 0x55,
- 0x30, 0x78, 0x66, 0x55, 0x30, 0x30, 0x79, 0x4D, 0x52, 0x45,
- 0x77, 0x44, 0x77, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44,
- 0x41, 0x68, 0x53, 0x62, 0x32, 0x39, 0x30, 0x4C, 0x56, 0x4E,
- 0x4E, 0x4D, 0x6A, 0x45, 0x59, 0x4D, 0x42, 0x59, 0x47, 0x41,
- 0x31, 0x55, 0x45, 0x41, 0x77, 0x77, 0x50, 0x64, 0x33, 0x64,
- 0x33, 0x4C, 0x6E, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x7A, 0x63,
- 0x32, 0x77, 0x75, 0x0A, 0x59, 0x32, 0x39, 0x74, 0x4D, 0x52,
- 0x38, 0x77, 0x48, 0x51, 0x59, 0x4A, 0x4B, 0x6F, 0x5A, 0x49,
- 0x68, 0x76, 0x63, 0x4E, 0x41, 0x51, 0x6B, 0x42, 0x46, 0x68,
- 0x42, 0x70, 0x62, 0x6D, 0x5A, 0x76, 0x51, 0x48, 0x64, 0x76,
- 0x62, 0x47, 0x5A, 0x7A, 0x63, 0x32, 0x77, 0x75, 0x59, 0x32,
- 0x39, 0x74, 0x4D, 0x42, 0x34, 0x58, 0x44, 0x54, 0x49, 0x7A,
- 0x4D, 0x44, 0x49, 0x78, 0x4E, 0x54, 0x41, 0x32, 0x0A, 0x4D,
- 0x6A, 0x4D, 0x77, 0x4E, 0x31, 0x6F, 0x58, 0x44, 0x54, 0x49,
- 0x31, 0x4D, 0x54, 0x45, 0x78, 0x4D, 0x54, 0x41, 0x32, 0x4D,
- 0x6A, 0x4D, 0x77, 0x4E, 0x31, 0x6F, 0x77, 0x67, 0x61, 0x77,
- 0x78, 0x43, 0x7A, 0x41, 0x4A, 0x42, 0x67, 0x4E, 0x56, 0x42,
- 0x41, 0x59, 0x54, 0x41, 0x6C, 0x56, 0x54, 0x4D, 0x52, 0x41,
- 0x77, 0x44, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x49, 0x44,
- 0x41, 0x64, 0x4E, 0x0A, 0x62, 0x32, 0x35, 0x30, 0x59, 0x57,
- 0x35, 0x68, 0x4D, 0x52, 0x41, 0x77, 0x44, 0x67, 0x59, 0x44,
- 0x56, 0x51, 0x51, 0x48, 0x44, 0x41, 0x64, 0x43, 0x62, 0x33,
- 0x70, 0x6C, 0x62, 0x57, 0x46, 0x75, 0x4D, 0x52, 0x51, 0x77,
- 0x45, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4B, 0x44, 0x41,
- 0x74, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x55, 0x31, 0x4E, 0x4D,
- 0x58, 0x33, 0x4E, 0x74, 0x4D, 0x6A, 0x45, 0x50, 0x0A, 0x4D,
- 0x41, 0x30, 0x47, 0x41, 0x31, 0x55, 0x45, 0x43, 0x77, 0x77,
- 0x47, 0x51, 0x30, 0x45, 0x74, 0x63, 0x32, 0x30, 0x79, 0x4D,
- 0x52, 0x67, 0x77, 0x46, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51,
- 0x44, 0x44, 0x41, 0x39, 0x33, 0x64, 0x33, 0x63, 0x75, 0x64,
- 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35,
- 0x6A, 0x62, 0x32, 0x30, 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42,
- 0x67, 0x6B, 0x71, 0x0A, 0x68, 0x6B, 0x69, 0x47, 0x39, 0x77,
- 0x30, 0x42, 0x43, 0x51, 0x45, 0x57, 0x45, 0x47, 0x6C, 0x75,
- 0x5A, 0x6D, 0x39, 0x41, 0x64, 0x32, 0x39, 0x73, 0x5A, 0x6E,
- 0x4E, 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32, 0x30, 0x78,
- 0x46, 0x7A, 0x41, 0x56, 0x42, 0x67, 0x6F, 0x4A, 0x6B, 0x69,
- 0x61, 0x4A, 0x6B, 0x2F, 0x49, 0x73, 0x5A, 0x41, 0x45, 0x42,
- 0x44, 0x41, 0x64, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x0A, 0x55,
- 0x31, 0x4E, 0x4D, 0x4D, 0x46, 0x6F, 0x77, 0x46, 0x41, 0x59,
- 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67,
- 0x69, 0x30, 0x47, 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39,
- 0x56, 0x41, 0x59, 0x49, 0x74, 0x41, 0x30, 0x49, 0x41, 0x42,
- 0x43, 0x47, 0x53, 0x39, 0x38, 0x73, 0x6B, 0x33, 0x32, 0x52,
- 0x4E, 0x75, 0x71, 0x74, 0x6D, 0x65, 0x34, 0x4E, 0x31, 0x71,
- 0x53, 0x6E, 0x6E, 0x0A, 0x2F, 0x32, 0x52, 0x6A, 0x74, 0x74,
- 0x56, 0x43, 0x67, 0x43, 0x43, 0x39, 0x34, 0x75, 0x49, 0x43,
- 0x45, 0x6A, 0x75, 0x4F, 0x74, 0x41, 0x43, 0x56, 0x43, 0x59,
- 0x44, 0x4C, 0x56, 0x75, 0x31, 0x4C, 0x79, 0x6F, 0x31, 0x58,
- 0x35, 0x71, 0x34, 0x46, 0x30, 0x33, 0x59, 0x6E, 0x59, 0x33,
- 0x45, 0x35, 0x69, 0x62, 0x64, 0x70, 0x35, 0x6B, 0x69, 0x41,
- 0x72, 0x74, 0x47, 0x70, 0x53, 0x42, 0x4B, 0x6A, 0x0A, 0x59,
- 0x7A, 0x42, 0x68, 0x4D, 0x42, 0x30, 0x47, 0x41, 0x31, 0x55,
- 0x64, 0x44, 0x67, 0x51, 0x57, 0x42, 0x42, 0x52, 0x48, 0x43,
- 0x6B, 0x68, 0x2B, 0x75, 0x77, 0x4B, 0x6F, 0x57, 0x69, 0x5A,
- 0x58, 0x4B, 0x78, 0x6D, 0x70, 0x65, 0x32, 0x47, 0x4C, 0x66,
- 0x31, 0x32, 0x5A, 0x62, 0x6A, 0x41, 0x66, 0x42, 0x67, 0x4E,
- 0x56, 0x48, 0x53, 0x4D, 0x45, 0x47, 0x44, 0x41, 0x57, 0x67,
- 0x42, 0x51, 0x30, 0x0A, 0x48, 0x58, 0x6C, 0x45, 0x46, 0x58,
- 0x6D, 0x68, 0x73, 0x57, 0x4F, 0x5A, 0x34, 0x2B, 0x31, 0x6C,
- 0x66, 0x47, 0x53, 0x4A, 0x67, 0x50, 0x2B, 0x34, 0x37, 0x44,
- 0x41, 0x50, 0x42, 0x67, 0x4E, 0x56, 0x48, 0x52, 0x4D, 0x42,
- 0x41, 0x66, 0x38, 0x45, 0x42, 0x54, 0x41, 0x44, 0x41, 0x51,
- 0x48, 0x2F, 0x4D, 0x41, 0x34, 0x47, 0x41, 0x31, 0x55, 0x64,
- 0x44, 0x77, 0x45, 0x42, 0x2F, 0x77, 0x51, 0x45, 0x0A, 0x41,
- 0x77, 0x49, 0x42, 0x68, 0x6A, 0x41, 0x4B, 0x42, 0x67, 0x67,
- 0x71, 0x67, 0x52, 0x7A, 0x50, 0x56, 0x51, 0x47, 0x44, 0x64,
- 0x51, 0x4E, 0x49, 0x41, 0x44, 0x42, 0x46, 0x41, 0x69, 0x42,
- 0x48, 0x54, 0x67, 0x41, 0x44, 0x71, 0x7A, 0x53, 0x68, 0x72,
- 0x31, 0x6B, 0x35, 0x6A, 0x32, 0x41, 0x32, 0x76, 0x34, 0x6D,
- 0x49, 0x51, 0x6B, 0x45, 0x6E, 0x77, 0x64, 0x31, 0x58, 0x79,
- 0x58, 0x6E, 0x4C, 0x0A, 0x48, 0x31, 0x5A, 0x63, 0x46, 0x72,
- 0x55, 0x6F, 0x76, 0x51, 0x49, 0x68, 0x41, 0x49, 0x73, 0x75,
- 0x4A, 0x65, 0x73, 0x68, 0x6D, 0x36, 0x6B, 0x72, 0x70, 0x6D,
- 0x70, 0x62, 0x32, 0x36, 0x66, 0x48, 0x4B, 0x78, 0x48, 0x66,
- 0x63, 0x78, 0x57, 0x74, 0x35, 0x4D, 0x58, 0x44, 0x77, 0x76,
- 0x4F, 0x30, 0x74, 0x47, 0x65, 0x76, 0x31, 0x31, 0x45, 0x63,
- 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20,
- 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54,
- 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_ca_sm2 (sizeof(ca_sm2))
-
-/* ./certs/sm2/ca-sm2-key.pem */
-static const unsigned char ca_sm2_key[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B, 0x45,
- 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x46, 0x6F,
- 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A,
- 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43, 0x71,
- 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49, 0x74, 0x41,
- 0x30, 0x49, 0x41, 0x42, 0x43, 0x47, 0x53, 0x39, 0x38, 0x73,
- 0x6B, 0x33, 0x32, 0x52, 0x4E, 0x75, 0x71, 0x74, 0x6D, 0x65,
- 0x34, 0x4E, 0x31, 0x71, 0x53, 0x6E, 0x6E, 0x2F, 0x32, 0x52,
- 0x6A, 0x0A, 0x74, 0x74, 0x56, 0x43, 0x67, 0x43, 0x43, 0x39,
- 0x34, 0x75, 0x49, 0x43, 0x45, 0x6A, 0x75, 0x4F, 0x74, 0x41,
- 0x43, 0x56, 0x43, 0x59, 0x44, 0x4C, 0x56, 0x75, 0x31, 0x4C,
- 0x79, 0x6F, 0x31, 0x58, 0x35, 0x71, 0x34, 0x46, 0x30, 0x33,
- 0x59, 0x6E, 0x59, 0x33, 0x45, 0x35, 0x69, 0x62, 0x64, 0x70,
- 0x35, 0x6B, 0x69, 0x41, 0x72, 0x74, 0x47, 0x70, 0x53, 0x42,
- 0x49, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E,
- 0x44, 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_ca_sm2_key (sizeof(ca_sm2_key))
-
-/* ./certs/sm2/ca-sm2-priv.pem */
-static const unsigned char ca_sm2_priv[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x47, 0x49, 0x41, 0x67, 0x45, 0x41, 0x4D, 0x42, 0x51, 0x47,
- 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59,
- 0x49, 0x74, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x43, 0x4C, 0x51, 0x52, 0x74, 0x4D, 0x47,
- 0x73, 0x43, 0x41, 0x51, 0x45, 0x45, 0x49, 0x49, 0x2B, 0x35,
- 0x75, 0x45, 0x41, 0x5A, 0x44, 0x69, 0x45, 0x35, 0x36, 0x2B,
- 0x67, 0x49, 0x0A, 0x66, 0x50, 0x33, 0x59, 0x6F, 0x51, 0x57,
- 0x54, 0x70, 0x44, 0x55, 0x73, 0x30, 0x59, 0x44, 0x6A, 0x76,
- 0x33, 0x35, 0x49, 0x52, 0x2B, 0x51, 0x46, 0x44, 0x51, 0x6C,
- 0x42, 0x6F, 0x55, 0x51, 0x44, 0x51, 0x67, 0x41, 0x45, 0x49,
- 0x5A, 0x4C, 0x33, 0x79, 0x79, 0x54, 0x66, 0x5A, 0x45, 0x32,
- 0x36, 0x71, 0x32, 0x5A, 0x37, 0x67, 0x33, 0x57, 0x70, 0x4B,
- 0x65, 0x66, 0x2F, 0x5A, 0x47, 0x4F, 0x32, 0x0A, 0x31, 0x55,
- 0x4B, 0x41, 0x49, 0x4C, 0x33, 0x69, 0x34, 0x67, 0x49, 0x53,
- 0x4F, 0x34, 0x36, 0x30, 0x41, 0x4A, 0x55, 0x4A, 0x67, 0x4D,
- 0x74, 0x57, 0x37, 0x55, 0x76, 0x4B, 0x6A, 0x56, 0x66, 0x6D,
- 0x72, 0x67, 0x58, 0x54, 0x64, 0x69, 0x64, 0x6A, 0x63, 0x54,
- 0x6D, 0x4A, 0x74, 0x32, 0x6E, 0x6D, 0x53, 0x49, 0x43, 0x75,
- 0x30, 0x61, 0x6C, 0x49, 0x45, 0x67, 0x3D, 0x3D, 0x0A, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x50, 0x52,
- 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B, 0x45, 0x59, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_ca_sm2_priv (sizeof(ca_sm2_priv))
-
-/* ./certs/sm2/client-sm2.pem */
-static const unsigned char client_sm2[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x36, 0x30, 0x3A, 0x61, 0x30, 0x3A, 0x34,
- 0x61, 0x3A, 0x30, 0x62, 0x3A, 0x33, 0x36, 0x3A, 0x65, 0x62,
- 0x3A, 0x37, 0x64, 0x3A, 0x65, 0x31, 0x3A, 0x33, 0x66, 0x3A,
- 0x37, 0x34, 0x3A, 0x32, 0x39, 0x3A, 0x61, 0x39, 0x3A, 0x32,
- 0x39, 0x3A, 0x62, 0x34, 0x3A, 0x30, 0x35, 0x3A, 0x36, 0x63,
- 0x3A, 0x31, 0x37, 0x3A, 0x66, 0x37, 0x3A, 0x61, 0x36, 0x3A,
- 0x64, 0x34, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65,
- 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D,
- 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68,
- 0x2D, 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A,
- 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53,
- 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E,
- 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A,
- 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D,
- 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20, 0x43, 0x6C,
- 0x69, 0x65, 0x6E, 0x74, 0x2D, 0x73, 0x6D, 0x32, 0x2C, 0x20,
- 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64,
- 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E, 0x66,
- 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E,
- 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44, 0x20, 0x3D,
- 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x56, 0x61, 0x6C,
- 0x69, 0x64, 0x69, 0x74, 0x79, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x6F,
- 0x74, 0x20, 0x42, 0x65, 0x66, 0x6F, 0x72, 0x65, 0x3A, 0x20,
- 0x46, 0x65, 0x62, 0x20, 0x31, 0x35, 0x20, 0x30, 0x36, 0x3A,
- 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32, 0x33,
- 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74,
- 0x20, 0x41, 0x66, 0x74, 0x65, 0x72, 0x20, 0x3A, 0x20, 0x4E,
- 0x6F, 0x76, 0x20, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3A, 0x32,
- 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32, 0x35, 0x20,
- 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x3A,
- 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53,
- 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E,
- 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A,
- 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D,
- 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20, 0x43, 0x6C,
- 0x69, 0x65, 0x6E, 0x74, 0x2D, 0x73, 0x6D, 0x32, 0x2C, 0x20,
- 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64,
- 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E, 0x66,
- 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E,
- 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44, 0x20, 0x3D,
- 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x75, 0x62,
- 0x6A, 0x65, 0x63, 0x74, 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69,
- 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x6E, 0x66, 0x6F,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63,
- 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72,
- 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x73, 0x6D, 0x32, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C,
- 0x69, 0x63, 0x2D, 0x4B, 0x65, 0x79, 0x3A, 0x20, 0x28, 0x32,
- 0x35, 0x36, 0x20, 0x62, 0x69, 0x74, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x70, 0x75, 0x62, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30,
- 0x34, 0x3A, 0x33, 0x61, 0x3A, 0x31, 0x64, 0x3A, 0x65, 0x38,
- 0x3A, 0x63, 0x62, 0x3A, 0x34, 0x62, 0x3A, 0x64, 0x33, 0x3A,
- 0x32, 0x65, 0x3A, 0x33, 0x66, 0x3A, 0x34, 0x62, 0x3A, 0x30,
- 0x37, 0x3A, 0x33, 0x66, 0x3A, 0x62, 0x30, 0x3A, 0x32, 0x31,
- 0x3A, 0x66, 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x35, 0x3A, 0x39, 0x65,
- 0x3A, 0x64, 0x39, 0x3A, 0x63, 0x61, 0x3A, 0x33, 0x61, 0x3A,
- 0x39, 0x33, 0x3A, 0x39, 0x33, 0x3A, 0x39, 0x35, 0x3A, 0x37,
- 0x36, 0x3A, 0x31, 0x64, 0x3A, 0x33, 0x30, 0x3A, 0x64, 0x39,
- 0x3A, 0x30, 0x62, 0x3A, 0x66, 0x35, 0x3A, 0x35, 0x36, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x65, 0x64, 0x3A, 0x31, 0x39, 0x3A, 0x36, 0x30, 0x3A,
- 0x65, 0x64, 0x3A, 0x30, 0x31, 0x3A, 0x34, 0x63, 0x3A, 0x66,
- 0x36, 0x3A, 0x36, 0x37, 0x3A, 0x31, 0x64, 0x3A, 0x66, 0x31,
- 0x3A, 0x61, 0x63, 0x3A, 0x61, 0x38, 0x3A, 0x37, 0x34, 0x3A,
- 0x30, 0x64, 0x3A, 0x62, 0x32, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x37, 0x37, 0x3A,
- 0x63, 0x38, 0x3A, 0x34, 0x39, 0x3A, 0x33, 0x38, 0x3A, 0x65,
- 0x34, 0x3A, 0x66, 0x66, 0x3A, 0x34, 0x63, 0x3A, 0x65, 0x66,
- 0x3A, 0x38, 0x64, 0x3A, 0x36, 0x64, 0x3A, 0x38, 0x37, 0x3A,
- 0x66, 0x36, 0x3A, 0x34, 0x65, 0x3A, 0x63, 0x37, 0x3A, 0x66,
- 0x38, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x33, 0x39, 0x3A, 0x37, 0x34, 0x3A, 0x37,
- 0x30, 0x3A, 0x37, 0x30, 0x3A, 0x62, 0x35, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x41, 0x53, 0x4E, 0x31, 0x20, 0x4F,
- 0x49, 0x44, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39,
- 0x76, 0x33, 0x20, 0x65, 0x78, 0x74, 0x65, 0x6E, 0x73, 0x69,
- 0x6F, 0x6E, 0x73, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30,
- 0x39, 0x76, 0x33, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63,
- 0x74, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64, 0x65, 0x6E,
- 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x45, 0x34, 0x3A, 0x32, 0x31,
- 0x3A, 0x42, 0x32, 0x3A, 0x43, 0x35, 0x3A, 0x45, 0x35, 0x3A,
- 0x44, 0x34, 0x3A, 0x39, 0x45, 0x3A, 0x38, 0x32, 0x3A, 0x43,
- 0x41, 0x3A, 0x46, 0x38, 0x3A, 0x36, 0x37, 0x3A, 0x46, 0x32,
- 0x3A, 0x32, 0x38, 0x3A, 0x39, 0x39, 0x3A, 0x46, 0x36, 0x3A,
- 0x38, 0x35, 0x3A, 0x45, 0x38, 0x3A, 0x46, 0x31, 0x3A, 0x35,
- 0x35, 0x3A, 0x45, 0x46, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30,
- 0x39, 0x76, 0x33, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6F, 0x72,
- 0x69, 0x74, 0x79, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64,
- 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6B, 0x65, 0x79,
- 0x69, 0x64, 0x3A, 0x45, 0x34, 0x3A, 0x32, 0x31, 0x3A, 0x42,
- 0x32, 0x3A, 0x43, 0x35, 0x3A, 0x45, 0x35, 0x3A, 0x44, 0x34,
- 0x3A, 0x39, 0x45, 0x3A, 0x38, 0x32, 0x3A, 0x43, 0x41, 0x3A,
- 0x46, 0x38, 0x3A, 0x36, 0x37, 0x3A, 0x46, 0x32, 0x3A, 0x32,
- 0x38, 0x3A, 0x39, 0x39, 0x3A, 0x46, 0x36, 0x3A, 0x38, 0x35,
- 0x3A, 0x45, 0x38, 0x3A, 0x46, 0x31, 0x3A, 0x35, 0x35, 0x3A,
- 0x45, 0x46, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44,
- 0x69, 0x72, 0x4E, 0x61, 0x6D, 0x65, 0x3A, 0x2F, 0x43, 0x3D,
- 0x55, 0x53, 0x2F, 0x53, 0x54, 0x3D, 0x4D, 0x6F, 0x6E, 0x74,
- 0x61, 0x6E, 0x61, 0x2F, 0x4C, 0x3D, 0x42, 0x6F, 0x7A, 0x65,
- 0x6D, 0x61, 0x6E, 0x2F, 0x4F, 0x3D, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x2F, 0x4F, 0x55,
- 0x3D, 0x43, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x2D, 0x73, 0x6D,
- 0x32, 0x2F, 0x43, 0x4E, 0x3D, 0x77, 0x77, 0x77, 0x2E, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x2F, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64, 0x72,
- 0x65, 0x73, 0x73, 0x3D, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x2F, 0x55, 0x49, 0x44, 0x3D, 0x77, 0x6F, 0x6C, 0x66, 0x53,
- 0x53, 0x4C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x73,
- 0x65, 0x72, 0x69, 0x61, 0x6C, 0x3A, 0x36, 0x30, 0x3A, 0x41,
- 0x30, 0x3A, 0x34, 0x41, 0x3A, 0x30, 0x42, 0x3A, 0x33, 0x36,
- 0x3A, 0x45, 0x42, 0x3A, 0x37, 0x44, 0x3A, 0x45, 0x31, 0x3A,
- 0x33, 0x46, 0x3A, 0x37, 0x34, 0x3A, 0x32, 0x39, 0x3A, 0x41,
- 0x39, 0x3A, 0x32, 0x39, 0x3A, 0x42, 0x34, 0x3A, 0x30, 0x35,
- 0x3A, 0x36, 0x43, 0x3A, 0x31, 0x37, 0x3A, 0x46, 0x37, 0x3A,
- 0x41, 0x36, 0x3A, 0x44, 0x34, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35,
- 0x30, 0x39, 0x76, 0x33, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63,
- 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6E,
- 0x74, 0x73, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x43, 0x41, 0x3A, 0x54, 0x52, 0x55, 0x45, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x53, 0x75,
- 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x41, 0x6C, 0x74, 0x65,
- 0x72, 0x6E, 0x61, 0x74, 0x69, 0x76, 0x65, 0x20, 0x4E, 0x61,
- 0x6D, 0x65, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x44, 0x4E, 0x53, 0x3A, 0x65, 0x78, 0x61, 0x6D, 0x70,
- 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x49, 0x50,
- 0x20, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x3A, 0x31,
- 0x32, 0x37, 0x2E, 0x30, 0x2E, 0x30, 0x2E, 0x31, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x45, 0x78,
- 0x74, 0x65, 0x6E, 0x64, 0x65, 0x64, 0x20, 0x4B, 0x65, 0x79,
- 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x3A, 0x20, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x54, 0x4C, 0x53, 0x20, 0x57,
- 0x65, 0x62, 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20,
- 0x41, 0x75, 0x74, 0x68, 0x65, 0x6E, 0x74, 0x69, 0x63, 0x61,
- 0x74, 0x69, 0x6F, 0x6E, 0x2C, 0x20, 0x54, 0x4C, 0x53, 0x20,
- 0x57, 0x65, 0x62, 0x20, 0x43, 0x6C, 0x69, 0x65, 0x6E, 0x74,
- 0x20, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6E, 0x74, 0x69, 0x63,
- 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20,
- 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A,
- 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D,
- 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69,
- 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x56, 0x61,
- 0x6C, 0x75, 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x33, 0x30, 0x3A, 0x34, 0x36, 0x3A, 0x30,
- 0x32, 0x3A, 0x32, 0x31, 0x3A, 0x30, 0x30, 0x3A, 0x38, 0x66,
- 0x3A, 0x62, 0x32, 0x3A, 0x62, 0x35, 0x3A, 0x39, 0x35, 0x3A,
- 0x38, 0x66, 0x3A, 0x37, 0x39, 0x3A, 0x66, 0x36, 0x3A, 0x35,
- 0x65, 0x3A, 0x37, 0x35, 0x3A, 0x65, 0x35, 0x3A, 0x63, 0x35,
- 0x3A, 0x65, 0x39, 0x3A, 0x39, 0x61, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x31, 0x32, 0x3A, 0x64,
- 0x32, 0x3A, 0x30, 0x66, 0x3A, 0x37, 0x38, 0x3A, 0x39, 0x66,
- 0x3A, 0x63, 0x30, 0x3A, 0x31, 0x64, 0x3A, 0x38, 0x64, 0x3A,
- 0x31, 0x63, 0x3A, 0x62, 0x65, 0x3A, 0x36, 0x62, 0x3A, 0x30,
- 0x63, 0x3A, 0x66, 0x31, 0x3A, 0x66, 0x35, 0x3A, 0x35, 0x37,
- 0x3A, 0x36, 0x30, 0x3A, 0x64, 0x62, 0x3A, 0x39, 0x31, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34,
- 0x66, 0x3A, 0x30, 0x32, 0x3A, 0x32, 0x31, 0x3A, 0x30, 0x30,
- 0x3A, 0x38, 0x37, 0x3A, 0x35, 0x65, 0x3A, 0x37, 0x64, 0x3A,
- 0x65, 0x34, 0x3A, 0x64, 0x36, 0x3A, 0x33, 0x61, 0x3A, 0x62,
- 0x62, 0x3A, 0x37, 0x62, 0x3A, 0x39, 0x38, 0x3A, 0x32, 0x37,
- 0x3A, 0x38, 0x35, 0x3A, 0x64, 0x65, 0x3A, 0x37, 0x61, 0x3A,
- 0x66, 0x30, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x32, 0x31, 0x3A, 0x65, 0x32, 0x3A, 0x36, 0x36,
- 0x3A, 0x61, 0x31, 0x3A, 0x39, 0x66, 0x3A, 0x32, 0x36, 0x3A,
- 0x65, 0x30, 0x3A, 0x64, 0x64, 0x3A, 0x38, 0x36, 0x3A, 0x32,
- 0x33, 0x3A, 0x62, 0x34, 0x3A, 0x63, 0x38, 0x3A, 0x63, 0x30,
- 0x3A, 0x34, 0x36, 0x3A, 0x35, 0x61, 0x3A, 0x66, 0x32, 0x3A,
- 0x34, 0x39, 0x3A, 0x38, 0x64, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x20, 0x43, 0x45, 0x52,
- 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49, 0x49, 0x44, 0x79, 0x54,
- 0x43, 0x43, 0x41, 0x32, 0x36, 0x67, 0x41, 0x77, 0x49, 0x42,
- 0x41, 0x67, 0x49, 0x55, 0x59, 0x4B, 0x42, 0x4B, 0x43, 0x7A,
- 0x62, 0x72, 0x66, 0x65, 0x45, 0x2F, 0x64, 0x43, 0x6D, 0x70,
- 0x4B, 0x62, 0x51, 0x46, 0x62, 0x42, 0x66, 0x33, 0x70, 0x74,
- 0x51, 0x77, 0x43, 0x67, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63,
- 0x7A, 0x31, 0x55, 0x42, 0x67, 0x33, 0x55, 0x77, 0x0A, 0x67,
- 0x62, 0x41, 0x78, 0x43, 0x7A, 0x41, 0x4A, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x59, 0x54, 0x41, 0x6C, 0x56, 0x54, 0x4D,
- 0x52, 0x41, 0x77, 0x44, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51,
- 0x49, 0x44, 0x41, 0x64, 0x4E, 0x62, 0x32, 0x35, 0x30, 0x59,
- 0x57, 0x35, 0x68, 0x4D, 0x52, 0x41, 0x77, 0x44, 0x67, 0x59,
- 0x44, 0x56, 0x51, 0x51, 0x48, 0x44, 0x41, 0x64, 0x43, 0x62,
- 0x33, 0x70, 0x6C, 0x0A, 0x62, 0x57, 0x46, 0x75, 0x4D, 0x52,
- 0x51, 0x77, 0x45, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4B,
- 0x44, 0x41, 0x74, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x55, 0x31,
- 0x4E, 0x4D, 0x58, 0x33, 0x4E, 0x74, 0x4D, 0x6A, 0x45, 0x54,
- 0x4D, 0x42, 0x45, 0x47, 0x41, 0x31, 0x55, 0x45, 0x43, 0x77,
- 0x77, 0x4B, 0x51, 0x32, 0x78, 0x70, 0x5A, 0x57, 0x35, 0x30,
- 0x4C, 0x58, 0x4E, 0x74, 0x4D, 0x6A, 0x45, 0x59, 0x0A, 0x4D,
- 0x42, 0x59, 0x47, 0x41, 0x31, 0x55, 0x45, 0x41, 0x77, 0x77,
- 0x50, 0x64, 0x33, 0x64, 0x33, 0x4C, 0x6E, 0x64, 0x76, 0x62,
- 0x47, 0x5A, 0x7A, 0x63, 0x32, 0x77, 0x75, 0x59, 0x32, 0x39,
- 0x74, 0x4D, 0x52, 0x38, 0x77, 0x48, 0x51, 0x59, 0x4A, 0x4B,
- 0x6F, 0x5A, 0x49, 0x68, 0x76, 0x63, 0x4E, 0x41, 0x51, 0x6B,
- 0x42, 0x46, 0x68, 0x42, 0x70, 0x62, 0x6D, 0x5A, 0x76, 0x51,
- 0x48, 0x64, 0x76, 0x0A, 0x62, 0x47, 0x5A, 0x7A, 0x63, 0x32,
- 0x77, 0x75, 0x59, 0x32, 0x39, 0x74, 0x4D, 0x52, 0x63, 0x77,
- 0x46, 0x51, 0x59, 0x4B, 0x43, 0x5A, 0x49, 0x6D, 0x69, 0x5A,
- 0x50, 0x79, 0x4C, 0x47, 0x51, 0x42, 0x41, 0x51, 0x77, 0x48,
- 0x64, 0x32, 0x39, 0x73, 0x5A, 0x6C, 0x4E, 0x54, 0x54, 0x44,
- 0x41, 0x65, 0x46, 0x77, 0x30, 0x79, 0x4D, 0x7A, 0x41, 0x79,
- 0x4D, 0x54, 0x55, 0x77, 0x4E, 0x6A, 0x49, 0x7A, 0x0A, 0x4D,
- 0x44, 0x64, 0x61, 0x46, 0x77, 0x30, 0x79, 0x4E, 0x54, 0x45,
- 0x78, 0x4D, 0x54, 0x45, 0x77, 0x4E, 0x6A, 0x49, 0x7A, 0x4D,
- 0x44, 0x64, 0x61, 0x4D, 0x49, 0x47, 0x77, 0x4D, 0x51, 0x73,
- 0x77, 0x43, 0x51, 0x59, 0x44, 0x56, 0x51, 0x51, 0x47, 0x45,
- 0x77, 0x4A, 0x56, 0x55, 0x7A, 0x45, 0x51, 0x4D, 0x41, 0x34,
- 0x47, 0x41, 0x31, 0x55, 0x45, 0x43, 0x41, 0x77, 0x48, 0x54,
- 0x57, 0x39, 0x75, 0x0A, 0x64, 0x47, 0x46, 0x75, 0x59, 0x54,
- 0x45, 0x51, 0x4D, 0x41, 0x34, 0x47, 0x41, 0x31, 0x55, 0x45,
- 0x42, 0x77, 0x77, 0x48, 0x51, 0x6D, 0x39, 0x36, 0x5A, 0x57,
- 0x31, 0x68, 0x62, 0x6A, 0x45, 0x55, 0x4D, 0x42, 0x49, 0x47,
- 0x41, 0x31, 0x55, 0x45, 0x43, 0x67, 0x77, 0x4C, 0x64, 0x32,
- 0x39, 0x73, 0x5A, 0x6C, 0x4E, 0x54, 0x54, 0x46, 0x39, 0x7A,
- 0x62, 0x54, 0x49, 0x78, 0x45, 0x7A, 0x41, 0x52, 0x0A, 0x42,
- 0x67, 0x4E, 0x56, 0x42, 0x41, 0x73, 0x4D, 0x43, 0x6B, 0x4E,
- 0x73, 0x61, 0x57, 0x56, 0x75, 0x64, 0x43, 0x31, 0x7A, 0x62,
- 0x54, 0x49, 0x78, 0x47, 0x44, 0x41, 0x57, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x4D, 0x4D, 0x44, 0x33, 0x64, 0x33, 0x64,
- 0x79, 0x35, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x63, 0x33, 0x4E,
- 0x73, 0x4C, 0x6D, 0x4E, 0x76, 0x62, 0x54, 0x45, 0x66, 0x4D,
- 0x42, 0x30, 0x47, 0x0A, 0x43, 0x53, 0x71, 0x47, 0x53, 0x49,
- 0x62, 0x33, 0x44, 0x51, 0x45, 0x4A, 0x41, 0x52, 0x59, 0x51,
- 0x61, 0x57, 0x35, 0x6D, 0x62, 0x30, 0x42, 0x33, 0x62, 0x32,
- 0x78, 0x6D, 0x63, 0x33, 0x4E, 0x73, 0x4C, 0x6D, 0x4E, 0x76,
- 0x62, 0x54, 0x45, 0x58, 0x4D, 0x42, 0x55, 0x47, 0x43, 0x67,
- 0x6D, 0x53, 0x4A, 0x6F, 0x6D, 0x54, 0x38, 0x69, 0x78, 0x6B,
- 0x41, 0x51, 0x45, 0x4D, 0x42, 0x33, 0x64, 0x76, 0x0A, 0x62,
- 0x47, 0x5A, 0x54, 0x55, 0x30, 0x77, 0x77, 0x57, 0x6A, 0x41,
- 0x55, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50, 0x56,
- 0x51, 0x47, 0x43, 0x4C, 0x51, 0x59, 0x49, 0x4B, 0x6F, 0x45,
- 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x44, 0x51,
- 0x67, 0x41, 0x45, 0x4F, 0x68, 0x33, 0x6F, 0x79, 0x30, 0x76,
- 0x54, 0x4C, 0x6A, 0x39, 0x4C, 0x42, 0x7A, 0x2B, 0x77, 0x49,
- 0x66, 0x37, 0x46, 0x0A, 0x6E, 0x74, 0x6E, 0x4B, 0x4F, 0x70,
- 0x4F, 0x54, 0x6C, 0x58, 0x59, 0x64, 0x4D, 0x4E, 0x6B, 0x4C,
- 0x39, 0x56, 0x62, 0x74, 0x47, 0x57, 0x44, 0x74, 0x41, 0x55,
- 0x7A, 0x32, 0x5A, 0x78, 0x33, 0x78, 0x72, 0x4B, 0x68, 0x30,
- 0x44, 0x62, 0x4A, 0x33, 0x79, 0x45, 0x6B, 0x34, 0x35, 0x50,
- 0x39, 0x4D, 0x37, 0x34, 0x31, 0x74, 0x68, 0x2F, 0x5A, 0x4F,
- 0x78, 0x2F, 0x67, 0x35, 0x64, 0x48, 0x42, 0x77, 0x0A, 0x74,
- 0x61, 0x4F, 0x43, 0x41, 0x57, 0x45, 0x77, 0x67, 0x67, 0x46,
- 0x64, 0x4D, 0x42, 0x30, 0x47, 0x41, 0x31, 0x55, 0x64, 0x44,
- 0x67, 0x51, 0x57, 0x42, 0x42, 0x54, 0x6B, 0x49, 0x62, 0x4C,
- 0x46, 0x35, 0x64, 0x53, 0x65, 0x67, 0x73, 0x72, 0x34, 0x5A,
- 0x2F, 0x49, 0x6F, 0x6D, 0x66, 0x61, 0x46, 0x36, 0x50, 0x46,
- 0x56, 0x37, 0x7A, 0x43, 0x42, 0x38, 0x41, 0x59, 0x44, 0x56,
- 0x52, 0x30, 0x6A, 0x0A, 0x42, 0x49, 0x48, 0x6F, 0x4D, 0x49,
- 0x48, 0x6C, 0x67, 0x42, 0x54, 0x6B, 0x49, 0x62, 0x4C, 0x46,
- 0x35, 0x64, 0x53, 0x65, 0x67, 0x73, 0x72, 0x34, 0x5A, 0x2F,
- 0x49, 0x6F, 0x6D, 0x66, 0x61, 0x46, 0x36, 0x50, 0x46, 0x56,
- 0x37, 0x36, 0x47, 0x42, 0x74, 0x71, 0x53, 0x42, 0x73, 0x7A,
- 0x43, 0x42, 0x73, 0x44, 0x45, 0x4C, 0x4D, 0x41, 0x6B, 0x47,
- 0x41, 0x31, 0x55, 0x45, 0x42, 0x68, 0x4D, 0x43, 0x0A, 0x56,
- 0x56, 0x4D, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x67, 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62,
- 0x6E, 0x52, 0x68, 0x62, 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41,
- 0x4F, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42,
- 0x30, 0x4A, 0x76, 0x65, 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34,
- 0x78, 0x46, 0x44, 0x41, 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42,
- 0x41, 0x6F, 0x4D, 0x0A, 0x43, 0x33, 0x64, 0x76, 0x62, 0x47,
- 0x5A, 0x54, 0x55, 0x30, 0x78, 0x66, 0x63, 0x32, 0x30, 0x79,
- 0x4D, 0x52, 0x4D, 0x77, 0x45, 0x51, 0x59, 0x44, 0x56, 0x51,
- 0x51, 0x4C, 0x44, 0x41, 0x70, 0x44, 0x62, 0x47, 0x6C, 0x6C,
- 0x62, 0x6E, 0x51, 0x74, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52,
- 0x67, 0x77, 0x46, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x44,
- 0x44, 0x41, 0x39, 0x33, 0x64, 0x33, 0x63, 0x75, 0x0A, 0x64,
- 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35,
- 0x6A, 0x62, 0x32, 0x30, 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42,
- 0x67, 0x6B, 0x71, 0x68, 0x6B, 0x69, 0x47, 0x39, 0x77, 0x30,
- 0x42, 0x43, 0x51, 0x45, 0x57, 0x45, 0x47, 0x6C, 0x75, 0x5A,
- 0x6D, 0x39, 0x41, 0x64, 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E,
- 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32, 0x30, 0x78, 0x46,
- 0x7A, 0x41, 0x56, 0x0A, 0x42, 0x67, 0x6F, 0x4A, 0x6B, 0x69,
- 0x61, 0x4A, 0x6B, 0x2F, 0x49, 0x73, 0x5A, 0x41, 0x45, 0x42,
- 0x44, 0x41, 0x64, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x55, 0x31,
- 0x4E, 0x4D, 0x67, 0x68, 0x52, 0x67, 0x6F, 0x45, 0x6F, 0x4C,
- 0x4E, 0x75, 0x74, 0x39, 0x34, 0x54, 0x39, 0x30, 0x4B, 0x61,
- 0x6B, 0x70, 0x74, 0x41, 0x56, 0x73, 0x46, 0x2F, 0x65, 0x6D,
- 0x31, 0x44, 0x41, 0x4D, 0x42, 0x67, 0x4E, 0x56, 0x0A, 0x48,
- 0x52, 0x4D, 0x45, 0x42, 0x54, 0x41, 0x44, 0x41, 0x51, 0x48,
- 0x2F, 0x4D, 0x42, 0x77, 0x47, 0x41, 0x31, 0x55, 0x64, 0x45,
- 0x51, 0x51, 0x56, 0x4D, 0x42, 0x4F, 0x43, 0x43, 0x32, 0x56,
- 0x34, 0x59, 0x57, 0x31, 0x77, 0x62, 0x47, 0x55, 0x75, 0x59,
- 0x32, 0x39, 0x74, 0x68, 0x77, 0x52, 0x2F, 0x41, 0x41, 0x41,
- 0x42, 0x4D, 0x42, 0x30, 0x47, 0x41, 0x31, 0x55, 0x64, 0x4A,
- 0x51, 0x51, 0x57, 0x0A, 0x4D, 0x42, 0x51, 0x47, 0x43, 0x43,
- 0x73, 0x47, 0x41, 0x51, 0x55, 0x46, 0x42, 0x77, 0x4D, 0x42,
- 0x42, 0x67, 0x67, 0x72, 0x42, 0x67, 0x45, 0x46, 0x42, 0x51,
- 0x63, 0x44, 0x41, 0x6A, 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71,
- 0x67, 0x52, 0x7A, 0x50, 0x56, 0x51, 0x47, 0x44, 0x64, 0x51,
- 0x4E, 0x4A, 0x41, 0x44, 0x42, 0x47, 0x41, 0x69, 0x45, 0x41,
- 0x6A, 0x37, 0x4B, 0x31, 0x6C, 0x59, 0x39, 0x35, 0x0A, 0x39,
- 0x6C, 0x35, 0x31, 0x35, 0x63, 0x58, 0x70, 0x6D, 0x68, 0x4C,
- 0x53, 0x44, 0x33, 0x69, 0x66, 0x77, 0x42, 0x32, 0x4E, 0x48,
- 0x4C, 0x35, 0x72, 0x44, 0x50, 0x48, 0x31, 0x56, 0x32, 0x44,
- 0x62, 0x6B, 0x55, 0x38, 0x43, 0x49, 0x51, 0x43, 0x48, 0x58,
- 0x6E, 0x33, 0x6B, 0x31, 0x6A, 0x71, 0x37, 0x65, 0x35, 0x67,
- 0x6E, 0x68, 0x64, 0x35, 0x36, 0x38, 0x43, 0x48, 0x69, 0x5A,
- 0x71, 0x47, 0x66, 0x0A, 0x4A, 0x75, 0x44, 0x64, 0x68, 0x69,
- 0x4F, 0x30, 0x79, 0x4D, 0x42, 0x47, 0x57, 0x76, 0x4A, 0x4A,
- 0x6A, 0x51, 0x3D, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x45, 0x4E, 0x44, 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46,
- 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x0A
-};
-#define sizeof_client_sm2 (sizeof(client_sm2))
-
-/* ./certs/sm2/client-sm2-key.pem */
-static const unsigned char client_sm2_key[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B, 0x45,
- 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x46, 0x6F,
- 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A,
- 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43, 0x71,
- 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49, 0x74, 0x41,
- 0x30, 0x49, 0x41, 0x42, 0x44, 0x6F, 0x64, 0x36, 0x4D, 0x74,
- 0x4C, 0x30, 0x79, 0x34, 0x2F, 0x53, 0x77, 0x63, 0x2F, 0x73,
- 0x43, 0x48, 0x2B, 0x78, 0x5A, 0x37, 0x5A, 0x79, 0x6A, 0x71,
- 0x54, 0x0A, 0x6B, 0x35, 0x56, 0x32, 0x48, 0x54, 0x44, 0x5A,
- 0x43, 0x2F, 0x56, 0x57, 0x37, 0x52, 0x6C, 0x67, 0x37, 0x51,
- 0x46, 0x4D, 0x39, 0x6D, 0x63, 0x64, 0x38, 0x61, 0x79, 0x6F,
- 0x64, 0x41, 0x32, 0x79, 0x64, 0x38, 0x68, 0x4A, 0x4F, 0x4F,
- 0x54, 0x2F, 0x54, 0x4F, 0x2B, 0x4E, 0x62, 0x59, 0x66, 0x32,
- 0x54, 0x73, 0x66, 0x34, 0x4F, 0x58, 0x52, 0x77, 0x63, 0x4C,
- 0x55, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E,
- 0x44, 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_client_sm2_key (sizeof(client_sm2_key))
-
-/* ./certs/sm2/client-sm2-priv.pem */
-static const unsigned char client_sm2_priv[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x47, 0x49, 0x41, 0x67, 0x45, 0x41, 0x4D, 0x42, 0x51, 0x47,
- 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59,
- 0x49, 0x74, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x43, 0x4C, 0x51, 0x52, 0x74, 0x4D, 0x47,
- 0x73, 0x43, 0x41, 0x51, 0x45, 0x45, 0x49, 0x4E, 0x43, 0x69,
- 0x33, 0x30, 0x6C, 0x36, 0x4C, 0x64, 0x38, 0x43, 0x79, 0x63,
- 0x36, 0x33, 0x0A, 0x38, 0x6A, 0x63, 0x43, 0x44, 0x64, 0x33,
- 0x38, 0x43, 0x4C, 0x6A, 0x65, 0x46, 0x4A, 0x4E, 0x36, 0x55,
- 0x79, 0x5A, 0x4A, 0x31, 0x66, 0x34, 0x43, 0x32, 0x66, 0x4E,
- 0x78, 0x6F, 0x55, 0x51, 0x44, 0x51, 0x67, 0x41, 0x45, 0x4F,
- 0x68, 0x33, 0x6F, 0x79, 0x30, 0x76, 0x54, 0x4C, 0x6A, 0x39,
- 0x4C, 0x42, 0x7A, 0x2B, 0x77, 0x49, 0x66, 0x37, 0x46, 0x6E,
- 0x74, 0x6E, 0x4B, 0x4F, 0x70, 0x4F, 0x54, 0x0A, 0x6C, 0x58,
- 0x59, 0x64, 0x4D, 0x4E, 0x6B, 0x4C, 0x39, 0x56, 0x62, 0x74,
- 0x47, 0x57, 0x44, 0x74, 0x41, 0x55, 0x7A, 0x32, 0x5A, 0x78,
- 0x33, 0x78, 0x72, 0x4B, 0x68, 0x30, 0x44, 0x62, 0x4A, 0x33,
- 0x79, 0x45, 0x6B, 0x34, 0x35, 0x50, 0x39, 0x4D, 0x37, 0x34,
- 0x31, 0x74, 0x68, 0x2F, 0x5A, 0x4F, 0x78, 0x2F, 0x67, 0x35,
- 0x64, 0x48, 0x42, 0x77, 0x74, 0x51, 0x3D, 0x3D, 0x0A, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x50, 0x52,
- 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B, 0x45, 0x59, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_client_sm2_priv (sizeof(client_sm2_priv))
-
-/* ./certs/sm2/root-sm2.pem */
-static const unsigned char root_sm2[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x37, 0x34, 0x3A, 0x39, 0x63, 0x3A, 0x64,
- 0x64, 0x3A, 0x61, 0x34, 0x3A, 0x62, 0x32, 0x3A, 0x36, 0x37,
- 0x3A, 0x32, 0x36, 0x3A, 0x35, 0x37, 0x3A, 0x32, 0x39, 0x3A,
- 0x66, 0x62, 0x3A, 0x65, 0x39, 0x3A, 0x31, 0x33, 0x3A, 0x35,
- 0x34, 0x3A, 0x65, 0x30, 0x3A, 0x33, 0x34, 0x3A, 0x30, 0x38,
- 0x3A, 0x30, 0x33, 0x3A, 0x32, 0x62, 0x3A, 0x37, 0x30, 0x3A,
- 0x61, 0x39, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65,
- 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D,
- 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68,
- 0x2D, 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A,
- 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53,
- 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E,
- 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A,
- 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20,
- 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F, 0x53, 0x4D,
- 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20, 0x52, 0x6F,
- 0x6F, 0x74, 0x2D, 0x53, 0x4D, 0x32, 0x2C, 0x20, 0x43, 0x4E,
- 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20,
- 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64, 0x72, 0x65,
- 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E, 0x66, 0x6F, 0x40,
- 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F,
- 0x6D, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x56, 0x61, 0x6C, 0x69, 0x64, 0x69, 0x74, 0x79, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x4E, 0x6F, 0x74, 0x20, 0x42, 0x65, 0x66, 0x6F, 0x72,
- 0x65, 0x3A, 0x20, 0x46, 0x65, 0x62, 0x20, 0x31, 0x35, 0x20,
- 0x30, 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32,
- 0x30, 0x32, 0x33, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x4E, 0x6F, 0x74, 0x20, 0x41, 0x66, 0x74, 0x65, 0x72, 0x20,
- 0x3A, 0x20, 0x4E, 0x6F, 0x76, 0x20, 0x31, 0x31, 0x20, 0x30,
- 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30,
- 0x32, 0x35, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65,
- 0x63, 0x74, 0x3A, 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53,
- 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E,
- 0x74, 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20,
- 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x5F, 0x53, 0x4D, 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D,
- 0x20, 0x52, 0x6F, 0x6F, 0x74, 0x2D, 0x53, 0x4D, 0x32, 0x2C,
- 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E,
- 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F,
- 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64,
- 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E,
- 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C,
- 0x2E, 0x63, 0x6F, 0x6D, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74,
- 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65,
- 0x79, 0x20, 0x49, 0x6E, 0x66, 0x6F, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79,
- 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D,
- 0x3A, 0x20, 0x73, 0x6D, 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x2D, 0x4B,
- 0x65, 0x79, 0x3A, 0x20, 0x28, 0x32, 0x35, 0x36, 0x20, 0x62,
- 0x69, 0x74, 0x29, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x70, 0x75, 0x62, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x34, 0x3A, 0x62, 0x62,
- 0x3A, 0x39, 0x63, 0x3A, 0x37, 0x35, 0x3A, 0x38, 0x63, 0x3A,
- 0x66, 0x37, 0x3A, 0x31, 0x37, 0x3A, 0x66, 0x38, 0x3A, 0x34,
- 0x38, 0x3A, 0x61, 0x62, 0x3A, 0x66, 0x37, 0x3A, 0x66, 0x36,
- 0x3A, 0x64, 0x62, 0x3A, 0x30, 0x64, 0x3A, 0x39, 0x61, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x38, 0x64, 0x3A, 0x39, 0x66, 0x3A, 0x63, 0x32, 0x3A,
- 0x64, 0x31, 0x3A, 0x34, 0x37, 0x3A, 0x39, 0x37, 0x3A, 0x39,
- 0x35, 0x3A, 0x30, 0x62, 0x3A, 0x34, 0x65, 0x3A, 0x65, 0x36,
- 0x3A, 0x35, 0x37, 0x3A, 0x65, 0x63, 0x3A, 0x63, 0x35, 0x3A,
- 0x66, 0x38, 0x3A, 0x35, 0x37, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x35, 0x34, 0x3A,
- 0x37, 0x31, 0x3A, 0x33, 0x39, 0x3A, 0x33, 0x63, 0x3A, 0x37,
- 0x39, 0x3A, 0x65, 0x31, 0x3A, 0x34, 0x30, 0x3A, 0x33, 0x66,
- 0x3A, 0x62, 0x36, 0x3A, 0x35, 0x31, 0x3A, 0x65, 0x39, 0x3A,
- 0x37, 0x63, 0x3A, 0x63, 0x37, 0x3A, 0x64, 0x61, 0x3A, 0x32,
- 0x64, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x65, 0x66, 0x3A, 0x64, 0x32, 0x3A, 0x65,
- 0x38, 0x3A, 0x37, 0x39, 0x3A, 0x38, 0x31, 0x3A, 0x37, 0x62,
- 0x3A, 0x61, 0x62, 0x3A, 0x61, 0x33, 0x3A, 0x35, 0x66, 0x3A,
- 0x36, 0x62, 0x3A, 0x32, 0x61, 0x3A, 0x36, 0x63, 0x3A, 0x39,
- 0x37, 0x3A, 0x31, 0x61, 0x3A, 0x35, 0x65, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x38,
- 0x65, 0x3A, 0x64, 0x39, 0x3A, 0x64, 0x30, 0x3A, 0x63, 0x63,
- 0x3A, 0x30, 0x34, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x41, 0x53, 0x4E, 0x31, 0x20, 0x4F, 0x49, 0x44, 0x3A, 0x20,
- 0x53, 0x4D, 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x65,
- 0x78, 0x74, 0x65, 0x6E, 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20,
- 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x4B, 0x65,
- 0x79, 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69,
- 0x65, 0x72, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x33, 0x34, 0x3A, 0x31, 0x44, 0x3A, 0x37, 0x39, 0x3A,
- 0x34, 0x34, 0x3A, 0x31, 0x35, 0x3A, 0x37, 0x39, 0x3A, 0x41,
- 0x31, 0x3A, 0x42, 0x31, 0x3A, 0x36, 0x33, 0x3A, 0x39, 0x39,
- 0x3A, 0x45, 0x33, 0x3A, 0x45, 0x44, 0x3A, 0x36, 0x35, 0x3A,
- 0x37, 0x43, 0x3A, 0x36, 0x34, 0x3A, 0x38, 0x39, 0x3A, 0x38,
- 0x30, 0x3A, 0x46, 0x46, 0x3A, 0x42, 0x38, 0x3A, 0x45, 0x43,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20,
- 0x41, 0x75, 0x74, 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20,
- 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69,
- 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x33, 0x34, 0x3A, 0x31, 0x44, 0x3A, 0x37,
- 0x39, 0x3A, 0x34, 0x34, 0x3A, 0x31, 0x35, 0x3A, 0x37, 0x39,
- 0x3A, 0x41, 0x31, 0x3A, 0x42, 0x31, 0x3A, 0x36, 0x33, 0x3A,
- 0x39, 0x39, 0x3A, 0x45, 0x33, 0x3A, 0x45, 0x44, 0x3A, 0x36,
- 0x35, 0x3A, 0x37, 0x43, 0x3A, 0x36, 0x34, 0x3A, 0x38, 0x39,
- 0x3A, 0x38, 0x30, 0x3A, 0x46, 0x46, 0x3A, 0x42, 0x38, 0x3A,
- 0x45, 0x43, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76,
- 0x33, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 0x20, 0x43, 0x6F,
- 0x6E, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6E, 0x74, 0x73, 0x3A,
- 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x43, 0x41, 0x3A, 0x54,
- 0x52, 0x55, 0x45, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39,
- 0x76, 0x33, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x55, 0x73, 0x61,
- 0x67, 0x65, 0x3A, 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63,
- 0x61, 0x6C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44,
- 0x69, 0x67, 0x69, 0x74, 0x61, 0x6C, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x2C, 0x20, 0x43, 0x65,
- 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20,
- 0x53, 0x69, 0x67, 0x6E, 0x2C, 0x20, 0x43, 0x52, 0x4C, 0x20,
- 0x53, 0x69, 0x67, 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53,
- 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41,
- 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20,
- 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53,
- 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x56, 0x61, 0x6C,
- 0x75, 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x33, 0x30, 0x3A, 0x34, 0x34, 0x3A, 0x30, 0x32,
- 0x3A, 0x32, 0x30, 0x3A, 0x30, 0x33, 0x3A, 0x32, 0x37, 0x3A,
- 0x32, 0x39, 0x3A, 0x66, 0x30, 0x3A, 0x65, 0x66, 0x3A, 0x37,
- 0x38, 0x3A, 0x32, 0x36, 0x3A, 0x61, 0x31, 0x3A, 0x31, 0x61,
- 0x3A, 0x36, 0x61, 0x3A, 0x31, 0x65, 0x3A, 0x38, 0x38, 0x3A,
- 0x38, 0x31, 0x3A, 0x65, 0x37, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x38, 0x33, 0x3A, 0x37, 0x32,
- 0x3A, 0x35, 0x66, 0x3A, 0x33, 0x65, 0x3A, 0x65, 0x36, 0x3A,
- 0x30, 0x38, 0x3A, 0x65, 0x38, 0x3A, 0x31, 0x34, 0x3A, 0x36,
- 0x38, 0x3A, 0x62, 0x66, 0x3A, 0x34, 0x62, 0x3A, 0x30, 0x66,
- 0x3A, 0x36, 0x38, 0x3A, 0x35, 0x32, 0x3A, 0x39, 0x32, 0x3A,
- 0x61, 0x61, 0x3A, 0x38, 0x66, 0x3A, 0x61, 0x31, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x32,
- 0x3A, 0x32, 0x30, 0x3A, 0x30, 0x62, 0x3A, 0x66, 0x65, 0x3A,
- 0x31, 0x62, 0x3A, 0x31, 0x34, 0x3A, 0x62, 0x61, 0x3A, 0x35,
- 0x31, 0x3A, 0x38, 0x32, 0x3A, 0x36, 0x35, 0x3A, 0x30, 0x36,
- 0x3A, 0x62, 0x62, 0x3A, 0x32, 0x32, 0x3A, 0x64, 0x38, 0x3A,
- 0x31, 0x61, 0x3A, 0x61, 0x37, 0x3A, 0x39, 0x66, 0x3A, 0x35,
- 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x36, 0x32, 0x3A, 0x65, 0x62, 0x3A, 0x38, 0x64, 0x3A,
- 0x62, 0x32, 0x3A, 0x64, 0x35, 0x3A, 0x31, 0x33, 0x3A, 0x62,
- 0x33, 0x3A, 0x62, 0x38, 0x3A, 0x61, 0x32, 0x3A, 0x66, 0x33,
- 0x3A, 0x31, 0x34, 0x3A, 0x34, 0x34, 0x3A, 0x62, 0x32, 0x3A,
- 0x61, 0x30, 0x3A, 0x32, 0x31, 0x3A, 0x64, 0x30, 0x0A, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x20,
- 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54,
- 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49, 0x49,
- 0x43, 0x6B, 0x54, 0x43, 0x43, 0x41, 0x6A, 0x69, 0x67, 0x41,
- 0x77, 0x49, 0x42, 0x41, 0x67, 0x49, 0x55, 0x64, 0x4A, 0x7A,
- 0x64, 0x70, 0x4C, 0x4A, 0x6E, 0x4A, 0x6C, 0x63, 0x70, 0x2B,
- 0x2B, 0x6B, 0x54, 0x56, 0x4F, 0x41, 0x30, 0x43, 0x41, 0x4D,
- 0x72, 0x63, 0x4B, 0x6B, 0x77, 0x43, 0x67, 0x59, 0x49, 0x4B,
- 0x6F, 0x45, 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67, 0x33, 0x55,
- 0x77, 0x0A, 0x67, 0x5A, 0x55, 0x78, 0x43, 0x7A, 0x41, 0x4A,
- 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x59, 0x54, 0x41, 0x6C,
- 0x56, 0x54, 0x4D, 0x52, 0x41, 0x77, 0x44, 0x67, 0x59, 0x44,
- 0x56, 0x51, 0x51, 0x49, 0x44, 0x41, 0x64, 0x4E, 0x62, 0x32,
- 0x35, 0x30, 0x59, 0x57, 0x35, 0x68, 0x4D, 0x52, 0x41, 0x77,
- 0x44, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x48, 0x44, 0x41,
- 0x64, 0x43, 0x62, 0x33, 0x70, 0x6C, 0x0A, 0x62, 0x57, 0x46,
- 0x75, 0x4D, 0x52, 0x51, 0x77, 0x45, 0x67, 0x59, 0x44, 0x56,
- 0x51, 0x51, 0x4B, 0x44, 0x41, 0x74, 0x33, 0x62, 0x32, 0x78,
- 0x6D, 0x55, 0x31, 0x4E, 0x4D, 0x58, 0x31, 0x4E, 0x4E, 0x4D,
- 0x6A, 0x45, 0x52, 0x4D, 0x41, 0x38, 0x47, 0x41, 0x31, 0x55,
- 0x45, 0x43, 0x77, 0x77, 0x49, 0x55, 0x6D, 0x39, 0x76, 0x64,
- 0x43, 0x31, 0x54, 0x54, 0x54, 0x49, 0x78, 0x47, 0x44, 0x41,
- 0x57, 0x0A, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x4D, 0x4D,
- 0x44, 0x33, 0x64, 0x33, 0x64, 0x79, 0x35, 0x33, 0x62, 0x32,
- 0x78, 0x6D, 0x63, 0x33, 0x4E, 0x73, 0x4C, 0x6D, 0x4E, 0x76,
- 0x62, 0x54, 0x45, 0x66, 0x4D, 0x42, 0x30, 0x47, 0x43, 0x53,
- 0x71, 0x47, 0x53, 0x49, 0x62, 0x33, 0x44, 0x51, 0x45, 0x4A,
- 0x41, 0x52, 0x59, 0x51, 0x61, 0x57, 0x35, 0x6D, 0x62, 0x30,
- 0x42, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x0A, 0x63, 0x33, 0x4E,
- 0x73, 0x4C, 0x6D, 0x4E, 0x76, 0x62, 0x54, 0x41, 0x65, 0x46,
- 0x77, 0x30, 0x79, 0x4D, 0x7A, 0x41, 0x79, 0x4D, 0x54, 0x55,
- 0x77, 0x4E, 0x6A, 0x49, 0x7A, 0x4D, 0x44, 0x64, 0x61, 0x46,
- 0x77, 0x30, 0x79, 0x4E, 0x54, 0x45, 0x78, 0x4D, 0x54, 0x45,
- 0x77, 0x4E, 0x6A, 0x49, 0x7A, 0x4D, 0x44, 0x64, 0x61, 0x4D,
- 0x49, 0x47, 0x56, 0x4D, 0x51, 0x73, 0x77, 0x43, 0x51, 0x59,
- 0x44, 0x0A, 0x56, 0x51, 0x51, 0x47, 0x45, 0x77, 0x4A, 0x56,
- 0x55, 0x7A, 0x45, 0x51, 0x4D, 0x41, 0x34, 0x47, 0x41, 0x31,
- 0x55, 0x45, 0x43, 0x41, 0x77, 0x48, 0x54, 0x57, 0x39, 0x75,
- 0x64, 0x47, 0x46, 0x75, 0x59, 0x54, 0x45, 0x51, 0x4D, 0x41,
- 0x34, 0x47, 0x41, 0x31, 0x55, 0x45, 0x42, 0x77, 0x77, 0x48,
- 0x51, 0x6D, 0x39, 0x36, 0x5A, 0x57, 0x31, 0x68, 0x62, 0x6A,
- 0x45, 0x55, 0x4D, 0x42, 0x49, 0x47, 0x0A, 0x41, 0x31, 0x55,
- 0x45, 0x43, 0x67, 0x77, 0x4C, 0x64, 0x32, 0x39, 0x73, 0x5A,
- 0x6C, 0x4E, 0x54, 0x54, 0x46, 0x39, 0x54, 0x54, 0x54, 0x49,
- 0x78, 0x45, 0x54, 0x41, 0x50, 0x42, 0x67, 0x4E, 0x56, 0x42,
- 0x41, 0x73, 0x4D, 0x43, 0x46, 0x4A, 0x76, 0x62, 0x33, 0x51,
- 0x74, 0x55, 0x30, 0x30, 0x79, 0x4D, 0x52, 0x67, 0x77, 0x46,
- 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x44, 0x44, 0x41, 0x39,
- 0x33, 0x0A, 0x64, 0x33, 0x63, 0x75, 0x64, 0x32, 0x39, 0x73,
- 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32,
- 0x30, 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42, 0x67, 0x6B, 0x71,
- 0x68, 0x6B, 0x69, 0x47, 0x39, 0x77, 0x30, 0x42, 0x43, 0x51,
- 0x45, 0x57, 0x45, 0x47, 0x6C, 0x75, 0x5A, 0x6D, 0x39, 0x41,
- 0x64, 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43,
- 0x35, 0x6A, 0x62, 0x32, 0x30, 0x77, 0x0A, 0x57, 0x6A, 0x41,
- 0x55, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50, 0x56,
- 0x51, 0x47, 0x43, 0x4C, 0x51, 0x59, 0x49, 0x4B, 0x6F, 0x45,
- 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x44, 0x51,
- 0x67, 0x41, 0x45, 0x75, 0x35, 0x78, 0x31, 0x6A, 0x50, 0x63,
- 0x58, 0x2B, 0x45, 0x69, 0x72, 0x39, 0x2F, 0x62, 0x62, 0x44,
- 0x5A, 0x71, 0x4E, 0x6E, 0x38, 0x4C, 0x52, 0x52, 0x35, 0x65,
- 0x56, 0x0A, 0x43, 0x30, 0x37, 0x6D, 0x56, 0x2B, 0x7A, 0x46,
- 0x2B, 0x46, 0x64, 0x55, 0x63, 0x54, 0x6B, 0x38, 0x65, 0x65,
- 0x46, 0x41, 0x50, 0x37, 0x5A, 0x52, 0x36, 0x58, 0x7A, 0x48,
- 0x32, 0x69, 0x33, 0x76, 0x30, 0x75, 0x68, 0x35, 0x67, 0x58,
- 0x75, 0x72, 0x6F, 0x31, 0x39, 0x72, 0x4B, 0x6D, 0x79, 0x58,
- 0x47, 0x6C, 0x36, 0x4F, 0x32, 0x64, 0x44, 0x4D, 0x42, 0x4B,
- 0x4E, 0x6A, 0x4D, 0x47, 0x45, 0x77, 0x0A, 0x48, 0x51, 0x59,
- 0x44, 0x56, 0x52, 0x30, 0x4F, 0x42, 0x42, 0x59, 0x45, 0x46,
- 0x44, 0x51, 0x64, 0x65, 0x55, 0x51, 0x56, 0x65, 0x61, 0x47,
- 0x78, 0x59, 0x35, 0x6E, 0x6A, 0x37, 0x57, 0x56, 0x38, 0x5A,
- 0x49, 0x6D, 0x41, 0x2F, 0x37, 0x6A, 0x73, 0x4D, 0x42, 0x38,
- 0x47, 0x41, 0x31, 0x55, 0x64, 0x49, 0x77, 0x51, 0x59, 0x4D,
- 0x42, 0x61, 0x41, 0x46, 0x44, 0x51, 0x64, 0x65, 0x55, 0x51,
- 0x56, 0x0A, 0x65, 0x61, 0x47, 0x78, 0x59, 0x35, 0x6E, 0x6A,
- 0x37, 0x57, 0x56, 0x38, 0x5A, 0x49, 0x6D, 0x41, 0x2F, 0x37,
- 0x6A, 0x73, 0x4D, 0x41, 0x38, 0x47, 0x41, 0x31, 0x55, 0x64,
- 0x45, 0x77, 0x45, 0x42, 0x2F, 0x77, 0x51, 0x46, 0x4D, 0x41,
- 0x4D, 0x42, 0x41, 0x66, 0x38, 0x77, 0x44, 0x67, 0x59, 0x44,
- 0x56, 0x52, 0x30, 0x50, 0x41, 0x51, 0x48, 0x2F, 0x42, 0x41,
- 0x51, 0x44, 0x41, 0x67, 0x47, 0x47, 0x0A, 0x4D, 0x41, 0x6F,
- 0x47, 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41,
- 0x59, 0x4E, 0x31, 0x41, 0x30, 0x63, 0x41, 0x4D, 0x45, 0x51,
- 0x43, 0x49, 0x41, 0x4D, 0x6E, 0x4B, 0x66, 0x44, 0x76, 0x65,
- 0x43, 0x61, 0x68, 0x47, 0x6D, 0x6F, 0x65, 0x69, 0x49, 0x48,
- 0x6E, 0x67, 0x33, 0x4A, 0x66, 0x50, 0x75, 0x59, 0x49, 0x36,
- 0x42, 0x52, 0x6F, 0x76, 0x30, 0x73, 0x50, 0x61, 0x46, 0x4B,
- 0x53, 0x0A, 0x71, 0x6F, 0x2B, 0x68, 0x41, 0x69, 0x41, 0x4C,
- 0x2F, 0x68, 0x73, 0x55, 0x75, 0x6C, 0x47, 0x43, 0x5A, 0x51,
- 0x61, 0x37, 0x49, 0x74, 0x67, 0x61, 0x70, 0x35, 0x39, 0x55,
- 0x59, 0x75, 0x75, 0x4E, 0x73, 0x74, 0x55, 0x54, 0x73, 0x37,
- 0x69, 0x69, 0x38, 0x78, 0x52, 0x45, 0x73, 0x71, 0x41, 0x68,
- 0x30, 0x41, 0x3D, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x45, 0x4E, 0x44, 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46,
- 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x0A
-};
-#define sizeof_root_sm2 (sizeof(root_sm2))
-
-/* ./certs/sm2/root-sm2-key.pem */
-static const unsigned char root_sm2_key[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B, 0x45,
- 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x46, 0x6F,
- 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A,
- 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43, 0x71,
- 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49, 0x74, 0x41,
- 0x30, 0x49, 0x41, 0x42, 0x4C, 0x75, 0x63, 0x64, 0x59, 0x7A,
- 0x33, 0x46, 0x2F, 0x68, 0x49, 0x71, 0x2F, 0x66, 0x32, 0x32,
- 0x77, 0x32, 0x61, 0x6A, 0x5A, 0x2F, 0x43, 0x30, 0x55, 0x65,
- 0x58, 0x0A, 0x6C, 0x51, 0x74, 0x4F, 0x35, 0x6C, 0x66, 0x73,
- 0x78, 0x66, 0x68, 0x58, 0x56, 0x48, 0x45, 0x35, 0x50, 0x48,
- 0x6E, 0x68, 0x51, 0x44, 0x2B, 0x32, 0x55, 0x65, 0x6C, 0x38,
- 0x78, 0x39, 0x6F, 0x74, 0x37, 0x39, 0x4C, 0x6F, 0x65, 0x59,
- 0x46, 0x37, 0x71, 0x36, 0x4E, 0x66, 0x61, 0x79, 0x70, 0x73,
- 0x6C, 0x78, 0x70, 0x65, 0x6A, 0x74, 0x6E, 0x51, 0x7A, 0x41,
- 0x51, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E,
- 0x44, 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_root_sm2_key (sizeof(root_sm2_key))
-
-/* ./certs/sm2/root-sm2-priv.pem */
-static const unsigned char root_sm2_priv[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x47, 0x49, 0x41, 0x67, 0x45, 0x41, 0x4D, 0x42, 0x51, 0x47,
- 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59,
- 0x49, 0x74, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x43, 0x4C, 0x51, 0x52, 0x74, 0x4D, 0x47,
- 0x73, 0x43, 0x41, 0x51, 0x45, 0x45, 0x49, 0x4D, 0x5A, 0x72,
- 0x4E, 0x45, 0x77, 0x7A, 0x4E, 0x31, 0x74, 0x6B, 0x46, 0x6C,
- 0x70, 0x2F, 0x0A, 0x42, 0x50, 0x6E, 0x38, 0x68, 0x7A, 0x44,
- 0x52, 0x46, 0x62, 0x70, 0x59, 0x65, 0x4F, 0x34, 0x48, 0x6D,
- 0x43, 0x41, 0x6D, 0x34, 0x51, 0x61, 0x4E, 0x55, 0x59, 0x6F,
- 0x6F, 0x6F, 0x55, 0x51, 0x44, 0x51, 0x67, 0x41, 0x45, 0x75,
- 0x35, 0x78, 0x31, 0x6A, 0x50, 0x63, 0x58, 0x2B, 0x45, 0x69,
- 0x72, 0x39, 0x2F, 0x62, 0x62, 0x44, 0x5A, 0x71, 0x4E, 0x6E,
- 0x38, 0x4C, 0x52, 0x52, 0x35, 0x65, 0x56, 0x0A, 0x43, 0x30,
- 0x37, 0x6D, 0x56, 0x2B, 0x7A, 0x46, 0x2B, 0x46, 0x64, 0x55,
- 0x63, 0x54, 0x6B, 0x38, 0x65, 0x65, 0x46, 0x41, 0x50, 0x37,
- 0x5A, 0x52, 0x36, 0x58, 0x7A, 0x48, 0x32, 0x69, 0x33, 0x76,
- 0x30, 0x75, 0x68, 0x35, 0x67, 0x58, 0x75, 0x72, 0x6F, 0x31,
- 0x39, 0x72, 0x4B, 0x6D, 0x79, 0x58, 0x47, 0x6C, 0x36, 0x4F,
- 0x32, 0x64, 0x44, 0x4D, 0x42, 0x41, 0x3D, 0x3D, 0x0A, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x50, 0x52,
- 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B, 0x45, 0x59, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_root_sm2_priv (sizeof(root_sm2_priv))
-
-/* ./certs/sm2/self-sm2-cert.pem */
-static const unsigned char self_sm2_cert[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x30, 0x36, 0x3A, 0x37, 0x62, 0x3A, 0x33,
- 0x61, 0x3A, 0x35, 0x64, 0x3A, 0x63, 0x66, 0x3A, 0x32, 0x32,
- 0x3A, 0x61, 0x39, 0x3A, 0x36, 0x64, 0x3A, 0x36, 0x64, 0x3A,
- 0x37, 0x38, 0x3A, 0x32, 0x62, 0x3A, 0x31, 0x30, 0x3A, 0x30,
- 0x31, 0x3A, 0x35, 0x31, 0x3A, 0x62, 0x36, 0x3A, 0x34, 0x63,
- 0x3A, 0x64, 0x34, 0x3A, 0x38, 0x32, 0x3A, 0x61, 0x32, 0x3A,
- 0x61, 0x31, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65,
- 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D,
- 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68,
- 0x2D, 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A,
- 0x20, 0x43, 0x20, 0x3D, 0x20, 0x41, 0x55, 0x2C, 0x20, 0x53,
- 0x54, 0x20, 0x3D, 0x20, 0x51, 0x4C, 0x44, 0x2C, 0x20, 0x4F,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20, 0x54, 0x65, 0x73,
- 0x74, 0x69, 0x6E, 0x67, 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D,
- 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2D, 0x64,
- 0x65, 0x76, 0x2D, 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x65, 0x6D,
- 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
- 0x20, 0x3D, 0x20, 0x69, 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F,
- 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C,
- 0x20, 0x55, 0x49, 0x44, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C,
- 0x66, 0x53, 0x53, 0x4C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x56, 0x61, 0x6C, 0x69, 0x64, 0x69, 0x74,
- 0x79, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74, 0x20, 0x42, 0x65,
- 0x66, 0x6F, 0x72, 0x65, 0x3A, 0x20, 0x4E, 0x6F, 0x76, 0x20,
- 0x32, 0x32, 0x20, 0x32, 0x31, 0x3A, 0x32, 0x38, 0x3A, 0x33,
- 0x37, 0x20, 0x32, 0x30, 0x32, 0x33, 0x20, 0x47, 0x4D, 0x54,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74, 0x20, 0x41, 0x66, 0x74,
- 0x65, 0x72, 0x20, 0x3A, 0x20, 0x41, 0x75, 0x67, 0x20, 0x31,
- 0x38, 0x20, 0x32, 0x31, 0x3A, 0x32, 0x38, 0x3A, 0x33, 0x37,
- 0x20, 0x32, 0x30, 0x32, 0x36, 0x20, 0x47, 0x4D, 0x54, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x75,
- 0x62, 0x6A, 0x65, 0x63, 0x74, 0x3A, 0x20, 0x43, 0x20, 0x3D,
- 0x20, 0x41, 0x55, 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20,
- 0x51, 0x4C, 0x44, 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77,
- 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x2C, 0x20, 0x4F, 0x55,
- 0x20, 0x3D, 0x20, 0x54, 0x65, 0x73, 0x74, 0x69, 0x6E, 0x67,
- 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C,
- 0x66, 0x73, 0x73, 0x6C, 0x2D, 0x64, 0x65, 0x76, 0x2D, 0x73,
- 0x6D, 0x32, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41,
- 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69,
- 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53,
- 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x50, 0x75, 0x62,
- 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x6E,
- 0x66, 0x6F, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C,
- 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x69, 0x64,
- 0x2D, 0x65, 0x63, 0x50, 0x75, 0x62, 0x6C, 0x69, 0x63, 0x4B,
- 0x65, 0x79, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50,
- 0x75, 0x62, 0x6C, 0x69, 0x63, 0x2D, 0x4B, 0x65, 0x79, 0x3A,
- 0x20, 0x28, 0x32, 0x35, 0x36, 0x20, 0x62, 0x69, 0x74, 0x29,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x75, 0x62,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x30, 0x34, 0x3A, 0x64, 0x38, 0x3A, 0x63, 0x34,
- 0x3A, 0x61, 0x31, 0x3A, 0x66, 0x31, 0x3A, 0x30, 0x62, 0x3A,
- 0x38, 0x62, 0x3A, 0x38, 0x64, 0x3A, 0x63, 0x34, 0x3A, 0x37,
- 0x64, 0x3A, 0x64, 0x63, 0x3A, 0x64, 0x34, 0x3A, 0x36, 0x35,
- 0x3A, 0x62, 0x39, 0x3A, 0x61, 0x35, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x35, 0x35,
- 0x3A, 0x34, 0x65, 0x3A, 0x66, 0x62, 0x3A, 0x61, 0x63, 0x3A,
- 0x33, 0x33, 0x3A, 0x61, 0x62, 0x3A, 0x39, 0x62, 0x3A, 0x34,
- 0x33, 0x3A, 0x39, 0x34, 0x3A, 0x34, 0x63, 0x3A, 0x34, 0x38,
- 0x3A, 0x34, 0x30, 0x3A, 0x31, 0x62, 0x3A, 0x33, 0x33, 0x3A,
- 0x64, 0x39, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x31, 0x62, 0x3A, 0x63, 0x63, 0x3A,
- 0x33, 0x31, 0x3A, 0x63, 0x31, 0x3A, 0x38, 0x32, 0x3A, 0x35,
- 0x36, 0x3A, 0x33, 0x66, 0x3A, 0x62, 0x30, 0x3A, 0x63, 0x30,
- 0x3A, 0x36, 0x62, 0x3A, 0x39, 0x35, 0x3A, 0x34, 0x30, 0x3A,
- 0x35, 0x31, 0x3A, 0x66, 0x64, 0x3A, 0x38, 0x38, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x30, 0x32, 0x3A, 0x30, 0x31, 0x3A, 0x62, 0x31, 0x3A, 0x62,
- 0x30, 0x3A, 0x39, 0x34, 0x3A, 0x36, 0x63, 0x3A, 0x30, 0x36,
- 0x3A, 0x65, 0x62, 0x3A, 0x61, 0x37, 0x3A, 0x64, 0x61, 0x3A,
- 0x38, 0x65, 0x3A, 0x65, 0x65, 0x3A, 0x37, 0x30, 0x3A, 0x62,
- 0x36, 0x3A, 0x65, 0x35, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62, 0x62, 0x3A, 0x62,
- 0x34, 0x3A, 0x31, 0x65, 0x3A, 0x65, 0x37, 0x3A, 0x62, 0x34,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x41, 0x53, 0x4E,
- 0x31, 0x20, 0x4F, 0x49, 0x44, 0x3A, 0x20, 0x53, 0x4D, 0x32,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x65, 0x78, 0x74, 0x65,
- 0x6E, 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x53, 0x75, 0x62,
- 0x6A, 0x65, 0x63, 0x74, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49,
- 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A,
- 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x36, 0x45,
- 0x3A, 0x39, 0x37, 0x3A, 0x45, 0x38, 0x3A, 0x39, 0x38, 0x3A,
- 0x42, 0x36, 0x3A, 0x35, 0x42, 0x3A, 0x42, 0x36, 0x3A, 0x41,
- 0x45, 0x3A, 0x38, 0x37, 0x3A, 0x30, 0x34, 0x3A, 0x44, 0x42,
- 0x3A, 0x31, 0x34, 0x3A, 0x35, 0x36, 0x3A, 0x36, 0x36, 0x3A,
- 0x31, 0x36, 0x3A, 0x46, 0x34, 0x3A, 0x42, 0x38, 0x3A, 0x32,
- 0x44, 0x3A, 0x38, 0x43, 0x3A, 0x46, 0x32, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x41, 0x75, 0x74,
- 0x68, 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20, 0x4B, 0x65, 0x79,
- 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65,
- 0x72, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x36, 0x45, 0x3A, 0x39, 0x37, 0x3A, 0x45, 0x38, 0x3A, 0x39,
- 0x38, 0x3A, 0x42, 0x36, 0x3A, 0x35, 0x42, 0x3A, 0x42, 0x36,
- 0x3A, 0x41, 0x45, 0x3A, 0x38, 0x37, 0x3A, 0x30, 0x34, 0x3A,
- 0x44, 0x42, 0x3A, 0x31, 0x34, 0x3A, 0x35, 0x36, 0x3A, 0x36,
- 0x36, 0x3A, 0x31, 0x36, 0x3A, 0x46, 0x34, 0x3A, 0x42, 0x38,
- 0x3A, 0x32, 0x44, 0x3A, 0x38, 0x43, 0x3A, 0x46, 0x32, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x42,
- 0x61, 0x73, 0x69, 0x63, 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x74,
- 0x72, 0x61, 0x69, 0x6E, 0x74, 0x73, 0x3A, 0x20, 0x63, 0x72,
- 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x43, 0x41, 0x3A, 0x54, 0x52, 0x55, 0x45,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20,
- 0x4B, 0x65, 0x79, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x3A,
- 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44, 0x69, 0x67, 0x69,
- 0x74, 0x61, 0x6C, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74,
- 0x75, 0x72, 0x65, 0x2C, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69,
- 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x2C, 0x20, 0x43, 0x52, 0x4C, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E,
- 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67, 0x6F,
- 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D, 0x32,
- 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74,
- 0x75, 0x72, 0x65, 0x20, 0x56, 0x61, 0x6C, 0x75, 0x65, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x33,
- 0x30, 0x3A, 0x34, 0x34, 0x3A, 0x30, 0x32, 0x3A, 0x32, 0x30,
- 0x3A, 0x30, 0x66, 0x3A, 0x63, 0x33, 0x3A, 0x32, 0x63, 0x3A,
- 0x33, 0x36, 0x3A, 0x65, 0x33, 0x3A, 0x39, 0x66, 0x3A, 0x31,
- 0x63, 0x3A, 0x65, 0x39, 0x3A, 0x36, 0x38, 0x3A, 0x31, 0x63,
- 0x3A, 0x33, 0x62, 0x3A, 0x34, 0x33, 0x3A, 0x31, 0x38, 0x3A,
- 0x35, 0x62, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x63, 0x39, 0x3A, 0x38, 0x66, 0x3A, 0x65, 0x34,
- 0x3A, 0x66, 0x61, 0x3A, 0x64, 0x64, 0x3A, 0x33, 0x33, 0x3A,
- 0x63, 0x31, 0x3A, 0x62, 0x38, 0x3A, 0x31, 0x63, 0x3A, 0x64,
- 0x33, 0x3A, 0x64, 0x34, 0x3A, 0x36, 0x31, 0x3A, 0x33, 0x33,
- 0x3A, 0x66, 0x38, 0x3A, 0x33, 0x37, 0x3A, 0x39, 0x64, 0x3A,
- 0x35, 0x61, 0x3A, 0x66, 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x32, 0x3A, 0x32, 0x30,
- 0x3A, 0x33, 0x61, 0x3A, 0x62, 0x39, 0x3A, 0x61, 0x38, 0x3A,
- 0x34, 0x33, 0x3A, 0x38, 0x30, 0x3A, 0x63, 0x66, 0x3A, 0x33,
- 0x38, 0x3A, 0x32, 0x35, 0x3A, 0x65, 0x39, 0x3A, 0x36, 0x34,
- 0x3A, 0x64, 0x38, 0x3A, 0x32, 0x36, 0x3A, 0x34, 0x37, 0x3A,
- 0x39, 0x64, 0x3A, 0x35, 0x30, 0x3A, 0x30, 0x34, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x63,
- 0x3A, 0x38, 0x61, 0x3A, 0x65, 0x38, 0x3A, 0x61, 0x32, 0x3A,
- 0x34, 0x32, 0x3A, 0x65, 0x38, 0x3A, 0x36, 0x33, 0x3A, 0x64,
- 0x64, 0x3A, 0x35, 0x33, 0x3A, 0x39, 0x34, 0x3A, 0x37, 0x64,
- 0x3A, 0x33, 0x38, 0x3A, 0x36, 0x64, 0x3A, 0x35, 0x32, 0x3A,
- 0x37, 0x30, 0x3A, 0x66, 0x64, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D,
- 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x20, 0x43, 0x45, 0x52,
- 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49, 0x49, 0x43, 0x6A, 0x44,
- 0x43, 0x43, 0x41, 0x6A, 0x4F, 0x67, 0x41, 0x77, 0x49, 0x42,
- 0x41, 0x67, 0x49, 0x55, 0x42, 0x6E, 0x73, 0x36, 0x58, 0x63,
- 0x38, 0x69, 0x71, 0x57, 0x31, 0x74, 0x65, 0x43, 0x73, 0x51,
- 0x41, 0x56, 0x47, 0x32, 0x54, 0x4E, 0x53, 0x43, 0x6F, 0x71,
- 0x45, 0x77, 0x43, 0x67, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63,
- 0x7A, 0x31, 0x55, 0x42, 0x67, 0x33, 0x55, 0x77, 0x0A, 0x67,
- 0x5A, 0x4D, 0x78, 0x43, 0x7A, 0x41, 0x4A, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x59, 0x54, 0x41, 0x6B, 0x46, 0x56, 0x4D,
- 0x51, 0x77, 0x77, 0x43, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51,
- 0x49, 0x44, 0x41, 0x4E, 0x52, 0x54, 0x45, 0x51, 0x78, 0x45,
- 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F,
- 0x4D, 0x42, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x55,
- 0x30, 0x77, 0x78, 0x0A, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67,
- 0x4E, 0x56, 0x42, 0x41, 0x73, 0x4D, 0x42, 0x31, 0x52, 0x6C,
- 0x63, 0x33, 0x52, 0x70, 0x62, 0x6D, 0x63, 0x78, 0x47, 0x44,
- 0x41, 0x57, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x4D, 0x4D,
- 0x44, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x7A, 0x63, 0x32,
- 0x77, 0x74, 0x5A, 0x47, 0x56, 0x32, 0x4C, 0x58, 0x4E, 0x74,
- 0x4D, 0x6A, 0x45, 0x66, 0x4D, 0x42, 0x30, 0x47, 0x0A, 0x43,
- 0x53, 0x71, 0x47, 0x53, 0x49, 0x62, 0x33, 0x44, 0x51, 0x45,
- 0x4A, 0x41, 0x52, 0x59, 0x51, 0x61, 0x57, 0x35, 0x6D, 0x62,
- 0x30, 0x42, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x63, 0x33, 0x4E,
- 0x73, 0x4C, 0x6D, 0x4E, 0x76, 0x62, 0x54, 0x45, 0x58, 0x4D,
- 0x42, 0x55, 0x47, 0x43, 0x67, 0x6D, 0x53, 0x4A, 0x6F, 0x6D,
- 0x54, 0x38, 0x69, 0x78, 0x6B, 0x41, 0x51, 0x45, 0x4D, 0x42,
- 0x33, 0x64, 0x76, 0x0A, 0x62, 0x47, 0x5A, 0x54, 0x55, 0x30,
- 0x77, 0x77, 0x48, 0x68, 0x63, 0x4E, 0x4D, 0x6A, 0x4D, 0x78,
- 0x4D, 0x54, 0x49, 0x79, 0x4D, 0x6A, 0x45, 0x79, 0x4F, 0x44,
- 0x4D, 0x33, 0x57, 0x68, 0x63, 0x4E, 0x4D, 0x6A, 0x59, 0x77,
- 0x4F, 0x44, 0x45, 0x34, 0x4D, 0x6A, 0x45, 0x79, 0x4F, 0x44,
- 0x4D, 0x33, 0x57, 0x6A, 0x43, 0x42, 0x6B, 0x7A, 0x45, 0x4C,
- 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55, 0x45, 0x0A, 0x42,
- 0x68, 0x4D, 0x43, 0x51, 0x56, 0x55, 0x78, 0x44, 0x44, 0x41,
- 0x4B, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67, 0x4D, 0x41,
- 0x31, 0x46, 0x4D, 0x52, 0x44, 0x45, 0x51, 0x4D, 0x41, 0x34,
- 0x47, 0x41, 0x31, 0x55, 0x45, 0x43, 0x67, 0x77, 0x48, 0x64,
- 0x32, 0x39, 0x73, 0x5A, 0x6C, 0x4E, 0x54, 0x54, 0x44, 0x45,
- 0x51, 0x4D, 0x41, 0x34, 0x47, 0x41, 0x31, 0x55, 0x45, 0x43,
- 0x77, 0x77, 0x48, 0x0A, 0x56, 0x47, 0x56, 0x7A, 0x64, 0x47,
- 0x6C, 0x75, 0x5A, 0x7A, 0x45, 0x59, 0x4D, 0x42, 0x59, 0x47,
- 0x41, 0x31, 0x55, 0x45, 0x41, 0x77, 0x77, 0x50, 0x64, 0x32,
- 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x31, 0x6B,
- 0x5A, 0x58, 0x59, 0x74, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52,
- 0x38, 0x77, 0x48, 0x51, 0x59, 0x4A, 0x4B, 0x6F, 0x5A, 0x49,
- 0x68, 0x76, 0x63, 0x4E, 0x41, 0x51, 0x6B, 0x42, 0x0A, 0x46,
- 0x68, 0x42, 0x70, 0x62, 0x6D, 0x5A, 0x76, 0x51, 0x48, 0x64,
- 0x76, 0x62, 0x47, 0x5A, 0x7A, 0x63, 0x32, 0x77, 0x75, 0x59,
- 0x32, 0x39, 0x74, 0x4D, 0x52, 0x63, 0x77, 0x46, 0x51, 0x59,
- 0x4B, 0x43, 0x5A, 0x49, 0x6D, 0x69, 0x5A, 0x50, 0x79, 0x4C,
- 0x47, 0x51, 0x42, 0x41, 0x51, 0x77, 0x48, 0x64, 0x32, 0x39,
- 0x73, 0x5A, 0x6C, 0x4E, 0x54, 0x54, 0x44, 0x42, 0x5A, 0x4D,
- 0x42, 0x4D, 0x47, 0x0A, 0x42, 0x79, 0x71, 0x47, 0x53, 0x4D,
- 0x34, 0x39, 0x41, 0x67, 0x45, 0x47, 0x43, 0x43, 0x71, 0x42,
- 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49, 0x74, 0x41, 0x30,
- 0x49, 0x41, 0x42, 0x4E, 0x6A, 0x45, 0x6F, 0x66, 0x45, 0x4C,
- 0x69, 0x34, 0x33, 0x45, 0x66, 0x64, 0x7A, 0x55, 0x5A, 0x62,
- 0x6D, 0x6C, 0x56, 0x55, 0x37, 0x37, 0x72, 0x44, 0x4F, 0x72,
- 0x6D, 0x30, 0x4F, 0x55, 0x54, 0x45, 0x68, 0x41, 0x0A, 0x47,
- 0x7A, 0x50, 0x5A, 0x47, 0x38, 0x77, 0x78, 0x77, 0x59, 0x4A,
- 0x57, 0x50, 0x37, 0x44, 0x41, 0x61, 0x35, 0x56, 0x41, 0x55,
- 0x66, 0x32, 0x49, 0x41, 0x67, 0x47, 0x78, 0x73, 0x4A, 0x52,
- 0x73, 0x42, 0x75, 0x75, 0x6E, 0x32, 0x6F, 0x37, 0x75, 0x63,
- 0x4C, 0x62, 0x6C, 0x75, 0x37, 0x51, 0x65, 0x35, 0x37, 0x53,
- 0x6A, 0x59, 0x7A, 0x42, 0x68, 0x4D, 0x42, 0x30, 0x47, 0x41,
- 0x31, 0x55, 0x64, 0x0A, 0x44, 0x67, 0x51, 0x57, 0x42, 0x42,
- 0x52, 0x75, 0x6C, 0x2B, 0x69, 0x59, 0x74, 0x6C, 0x75, 0x32,
- 0x72, 0x6F, 0x63, 0x45, 0x32, 0x78, 0x52, 0x57, 0x5A, 0x68,
- 0x62, 0x30, 0x75, 0x43, 0x32, 0x4D, 0x38, 0x6A, 0x41, 0x66,
- 0x42, 0x67, 0x4E, 0x56, 0x48, 0x53, 0x4D, 0x45, 0x47, 0x44,
- 0x41, 0x57, 0x67, 0x42, 0x52, 0x75, 0x6C, 0x2B, 0x69, 0x59,
- 0x74, 0x6C, 0x75, 0x32, 0x72, 0x6F, 0x63, 0x45, 0x0A, 0x32,
- 0x78, 0x52, 0x57, 0x5A, 0x68, 0x62, 0x30, 0x75, 0x43, 0x32,
- 0x4D, 0x38, 0x6A, 0x41, 0x50, 0x42, 0x67, 0x4E, 0x56, 0x48,
- 0x52, 0x4D, 0x42, 0x41, 0x66, 0x38, 0x45, 0x42, 0x54, 0x41,
- 0x44, 0x41, 0x51, 0x48, 0x2F, 0x4D, 0x41, 0x34, 0x47, 0x41,
- 0x31, 0x55, 0x64, 0x44, 0x77, 0x45, 0x42, 0x2F, 0x77, 0x51,
- 0x45, 0x41, 0x77, 0x49, 0x42, 0x68, 0x6A, 0x41, 0x4B, 0x42,
- 0x67, 0x67, 0x71, 0x0A, 0x67, 0x52, 0x7A, 0x50, 0x56, 0x51,
- 0x47, 0x44, 0x64, 0x51, 0x4E, 0x48, 0x41, 0x44, 0x42, 0x45,
- 0x41, 0x69, 0x41, 0x50, 0x77, 0x79, 0x77, 0x32, 0x34, 0x35,
- 0x38, 0x63, 0x36, 0x57, 0x67, 0x63, 0x4F, 0x30, 0x4D, 0x59,
- 0x57, 0x38, 0x6D, 0x50, 0x35, 0x50, 0x72, 0x64, 0x4D, 0x38,
- 0x47, 0x34, 0x48, 0x4E, 0x50, 0x55, 0x59, 0x54, 0x50, 0x34,
- 0x4E, 0x35, 0x31, 0x61, 0x39, 0x41, 0x49, 0x67, 0x0A, 0x4F,
- 0x72, 0x6D, 0x6F, 0x51, 0x34, 0x44, 0x50, 0x4F, 0x43, 0x58,
- 0x70, 0x5A, 0x4E, 0x67, 0x6D, 0x52, 0x35, 0x31, 0x51, 0x42,
- 0x41, 0x79, 0x4B, 0x36, 0x4B, 0x4A, 0x43, 0x36, 0x47, 0x50,
- 0x64, 0x55, 0x35, 0x52, 0x39, 0x4F, 0x47, 0x31, 0x53, 0x63,
- 0x50, 0x30, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45,
- 0x4E, 0x44, 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49,
- 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-
-};
-#define sizeof_self_sm2_cert (sizeof(self_sm2_cert))
-
-/* ./certs/sm2/self-sm2-key.pem */
-static const unsigned char self_sm2_key[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B, 0x45,
- 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x46, 0x6B,
- 0x77, 0x45, 0x77, 0x59, 0x48, 0x4B, 0x6F, 0x5A, 0x49, 0x7A,
- 0x6A, 0x30, 0x43, 0x41, 0x51, 0x59, 0x49, 0x4B, 0x6F, 0x45,
- 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x44, 0x51,
- 0x67, 0x41, 0x45, 0x32, 0x4D, 0x53, 0x68, 0x38, 0x51, 0x75,
- 0x4C, 0x6A, 0x63, 0x52, 0x39, 0x33, 0x4E, 0x52, 0x6C, 0x75,
- 0x61, 0x56, 0x56, 0x54, 0x76, 0x75, 0x73, 0x4D, 0x36, 0x75,
- 0x62, 0x0A, 0x51, 0x35, 0x52, 0x4D, 0x53, 0x45, 0x41, 0x62,
- 0x4D, 0x39, 0x6B, 0x62, 0x7A, 0x44, 0x48, 0x42, 0x67, 0x6C,
- 0x59, 0x2F, 0x73, 0x4D, 0x42, 0x72, 0x6C, 0x55, 0x42, 0x52,
- 0x2F, 0x59, 0x67, 0x43, 0x41, 0x62, 0x47, 0x77, 0x6C, 0x47,
- 0x77, 0x47, 0x36, 0x36, 0x66, 0x61, 0x6A, 0x75, 0x35, 0x77,
- 0x74, 0x75, 0x57, 0x37, 0x74, 0x42, 0x37, 0x6E, 0x74, 0x41,
- 0x3D, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E,
- 0x44, 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_self_sm2_key (sizeof(self_sm2_key))
-
-/* ./certs/sm2/self-sm2-priv.pem */
-static const unsigned char self_sm2_priv[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x47, 0x54, 0x41, 0x67, 0x45, 0x41, 0x4D, 0x42, 0x4D, 0x47,
- 0x42, 0x79, 0x71, 0x47, 0x53, 0x4D, 0x34, 0x39, 0x41, 0x67,
- 0x45, 0x47, 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56,
- 0x41, 0x59, 0x49, 0x74, 0x42, 0x48, 0x6B, 0x77, 0x64, 0x77,
- 0x49, 0x42, 0x41, 0x51, 0x51, 0x67, 0x30, 0x4A, 0x77, 0x6F,
- 0x57, 0x68, 0x58, 0x57, 0x4A, 0x51, 0x32, 0x32, 0x58, 0x39,
- 0x47, 0x68, 0x0A, 0x41, 0x57, 0x36, 0x30, 0x44, 0x74, 0x41,
- 0x32, 0x2B, 0x68, 0x58, 0x38, 0x71, 0x51, 0x54, 0x6C, 0x46,
- 0x36, 0x48, 0x51, 0x4C, 0x79, 0x6E, 0x57, 0x2F, 0x6D, 0x71,
- 0x67, 0x43, 0x67, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A,
- 0x31, 0x55, 0x42, 0x67, 0x69, 0x32, 0x68, 0x52, 0x41, 0x4E,
- 0x43, 0x41, 0x41, 0x54, 0x59, 0x78, 0x4B, 0x48, 0x78, 0x43,
- 0x34, 0x75, 0x4E, 0x78, 0x48, 0x33, 0x63, 0x0A, 0x31, 0x47,
- 0x57, 0x35, 0x70, 0x56, 0x56, 0x4F, 0x2B, 0x36, 0x77, 0x7A,
- 0x71, 0x35, 0x74, 0x44, 0x6C, 0x45, 0x78, 0x49, 0x51, 0x42,
- 0x73, 0x7A, 0x32, 0x52, 0x76, 0x4D, 0x4D, 0x63, 0x47, 0x43,
- 0x56, 0x6A, 0x2B, 0x77, 0x77, 0x47, 0x75, 0x56, 0x51, 0x46,
- 0x48, 0x39, 0x69, 0x41, 0x49, 0x42, 0x73, 0x62, 0x43, 0x55,
- 0x62, 0x41, 0x62, 0x72, 0x70, 0x39, 0x71, 0x4F, 0x37, 0x6E,
- 0x43, 0x32, 0x0A, 0x35, 0x62, 0x75, 0x30, 0x48, 0x75, 0x65,
- 0x30, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_self_sm2_priv (sizeof(self_sm2_priv))
-
-/* ./certs/sm2/server-sm2.pem */
-static const unsigned char server_sm2[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x20, 0x31, 0x20, 0x28, 0x30, 0x78, 0x31, 0x29, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D,
- 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x49,
- 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A, 0x20, 0x43, 0x20, 0x3D,
- 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20,
- 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C,
- 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x4F,
- 0x55, 0x20, 0x3D, 0x20, 0x43, 0x41, 0x2D, 0x73, 0x6D, 0x32,
- 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77,
- 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41,
- 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69,
- 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x56,
- 0x61, 0x6C, 0x69, 0x64, 0x69, 0x74, 0x79, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x4E, 0x6F, 0x74, 0x20, 0x42, 0x65, 0x66, 0x6F, 0x72, 0x65,
- 0x3A, 0x20, 0x46, 0x65, 0x62, 0x20, 0x31, 0x35, 0x20, 0x30,
- 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30,
- 0x32, 0x33, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E,
- 0x6F, 0x74, 0x20, 0x41, 0x66, 0x74, 0x65, 0x72, 0x20, 0x3A,
- 0x20, 0x4E, 0x6F, 0x76, 0x20, 0x31, 0x31, 0x20, 0x30, 0x36,
- 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32,
- 0x35, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63,
- 0x74, 0x3A, 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C,
- 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74,
- 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42,
- 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20,
- 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F,
- 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20,
- 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2D, 0x73, 0x6D, 0x32,
- 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77,
- 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41,
- 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69,
- 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53,
- 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x50, 0x75, 0x62,
- 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x6E,
- 0x66, 0x6F, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C,
- 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x73, 0x6D,
- 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75,
- 0x62, 0x6C, 0x69, 0x63, 0x2D, 0x4B, 0x65, 0x79, 0x3A, 0x20,
- 0x28, 0x32, 0x35, 0x36, 0x20, 0x62, 0x69, 0x74, 0x29, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x75, 0x62, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x30, 0x34, 0x3A, 0x39, 0x34, 0x3A, 0x37, 0x30, 0x3A,
- 0x32, 0x62, 0x3A, 0x34, 0x36, 0x3A, 0x65, 0x34, 0x3A, 0x35,
- 0x65, 0x3A, 0x30, 0x66, 0x3A, 0x34, 0x31, 0x3A, 0x66, 0x62,
- 0x3A, 0x38, 0x66, 0x3A, 0x32, 0x64, 0x3A, 0x33, 0x34, 0x3A,
- 0x30, 0x61, 0x3A, 0x34, 0x31, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34, 0x30, 0x3A,
- 0x31, 0x39, 0x3A, 0x35, 0x65, 0x3A, 0x66, 0x62, 0x3A, 0x64,
- 0x34, 0x3A, 0x31, 0x64, 0x3A, 0x31, 0x31, 0x3A, 0x61, 0x63,
- 0x3A, 0x66, 0x61, 0x3A, 0x66, 0x35, 0x3A, 0x39, 0x33, 0x3A,
- 0x33, 0x37, 0x3A, 0x63, 0x36, 0x3A, 0x66, 0x61, 0x3A, 0x38,
- 0x37, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x30, 0x38, 0x3A, 0x66, 0x37, 0x3A, 0x31,
- 0x36, 0x3A, 0x31, 0x66, 0x3A, 0x32, 0x63, 0x3A, 0x63, 0x65,
- 0x3A, 0x33, 0x30, 0x3A, 0x34, 0x30, 0x3A, 0x39, 0x64, 0x3A,
- 0x34, 0x66, 0x3A, 0x61, 0x36, 0x3A, 0x32, 0x61, 0x3A, 0x30,
- 0x61, 0x3A, 0x61, 0x31, 0x3A, 0x64, 0x36, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x39,
- 0x35, 0x3A, 0x33, 0x33, 0x3A, 0x63, 0x33, 0x3A, 0x61, 0x36,
- 0x3A, 0x30, 0x33, 0x3A, 0x39, 0x38, 0x3A, 0x65, 0x36, 0x3A,
- 0x38, 0x64, 0x3A, 0x30, 0x35, 0x3A, 0x33, 0x34, 0x3A, 0x62,
- 0x30, 0x3A, 0x39, 0x37, 0x3A, 0x30, 0x63, 0x3A, 0x64, 0x65,
- 0x3A, 0x61, 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x37, 0x3A, 0x63, 0x66,
- 0x3A, 0x35, 0x33, 0x3A, 0x38, 0x66, 0x3A, 0x64, 0x31, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x41, 0x53, 0x4E, 0x31,
- 0x20, 0x4F, 0x49, 0x44, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35,
- 0x30, 0x39, 0x76, 0x33, 0x20, 0x65, 0x78, 0x74, 0x65, 0x6E,
- 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x53, 0x75, 0x62, 0x6A,
- 0x65, 0x63, 0x74, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64,
- 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x36, 0x37, 0x3A,
- 0x41, 0x45, 0x3A, 0x36, 0x30, 0x3A, 0x46, 0x46, 0x3A, 0x37,
- 0x45, 0x3A, 0x31, 0x42, 0x3A, 0x30, 0x46, 0x3A, 0x39, 0x35,
- 0x3A, 0x41, 0x45, 0x3A, 0x31, 0x46, 0x3A, 0x38, 0x32, 0x3A,
- 0x35, 0x39, 0x3A, 0x46, 0x32, 0x3A, 0x36, 0x43, 0x3A, 0x35,
- 0x36, 0x3A, 0x32, 0x44, 0x3A, 0x39, 0x33, 0x3A, 0x45, 0x46,
- 0x3A, 0x31, 0x37, 0x3A, 0x33, 0x32, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x41, 0x75, 0x74, 0x68,
- 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20, 0x4B, 0x65, 0x79, 0x20,
- 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
- 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34,
- 0x37, 0x3A, 0x30, 0x41, 0x3A, 0x34, 0x38, 0x3A, 0x37, 0x45,
- 0x3A, 0x42, 0x42, 0x3A, 0x30, 0x32, 0x3A, 0x41, 0x38, 0x3A,
- 0x35, 0x41, 0x3A, 0x32, 0x36, 0x3A, 0x35, 0x37, 0x3A, 0x32,
- 0x42, 0x3A, 0x31, 0x39, 0x3A, 0x41, 0x39, 0x3A, 0x37, 0x42,
- 0x3A, 0x36, 0x31, 0x3A, 0x38, 0x42, 0x3A, 0x37, 0x46, 0x3A,
- 0x35, 0x44, 0x3A, 0x39, 0x39, 0x3A, 0x36, 0x45, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x42, 0x61,
- 0x73, 0x69, 0x63, 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x74, 0x72,
- 0x61, 0x69, 0x6E, 0x74, 0x73, 0x3A, 0x20, 0x63, 0x72, 0x69,
- 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x43, 0x41, 0x3A, 0x46, 0x41, 0x4C, 0x53, 0x45,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20,
- 0x4B, 0x65, 0x79, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x3A,
- 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44, 0x69, 0x67, 0x69,
- 0x74, 0x61, 0x6C, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74,
- 0x75, 0x72, 0x65, 0x2C, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x45,
- 0x6E, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x6D, 0x65, 0x6E,
- 0x74, 0x2C, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x67, 0x72,
- 0x65, 0x65, 0x6D, 0x65, 0x6E, 0x74, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x45, 0x78, 0x74, 0x65,
- 0x6E, 0x64, 0x65, 0x64, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x55,
- 0x73, 0x61, 0x67, 0x65, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x54, 0x4C, 0x53, 0x20, 0x57, 0x65, 0x62,
- 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x41, 0x75,
- 0x74, 0x68, 0x65, 0x6E, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69,
- 0x6F, 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x65, 0x74, 0x73, 0x63,
- 0x61, 0x70, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x20, 0x54,
- 0x79, 0x70, 0x65, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x53, 0x4C, 0x20, 0x53, 0x65, 0x72, 0x76,
- 0x65, 0x72, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D,
- 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61,
- 0x74, 0x75, 0x72, 0x65, 0x20, 0x56, 0x61, 0x6C, 0x75, 0x65,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x33, 0x30, 0x3A, 0x34, 0x35, 0x3A, 0x30, 0x32, 0x3A, 0x32,
- 0x30, 0x3A, 0x31, 0x62, 0x3A, 0x63, 0x61, 0x3A, 0x39, 0x34,
- 0x3A, 0x32, 0x38, 0x3A, 0x37, 0x66, 0x3A, 0x66, 0x36, 0x3A,
- 0x62, 0x32, 0x3A, 0x30, 0x64, 0x3A, 0x33, 0x31, 0x3A, 0x34,
- 0x33, 0x3A, 0x35, 0x30, 0x3A, 0x65, 0x31, 0x3A, 0x64, 0x35,
- 0x3A, 0x33, 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x31, 0x37, 0x3A, 0x64, 0x64, 0x3A, 0x61,
- 0x66, 0x3A, 0x33, 0x61, 0x3A, 0x64, 0x65, 0x3A, 0x38, 0x31,
- 0x3A, 0x30, 0x36, 0x3A, 0x36, 0x37, 0x3A, 0x39, 0x61, 0x3A,
- 0x62, 0x33, 0x3A, 0x30, 0x36, 0x3A, 0x32, 0x32, 0x3A, 0x37,
- 0x65, 0x3A, 0x36, 0x34, 0x3A, 0x65, 0x63, 0x3A, 0x66, 0x64,
- 0x3A, 0x30, 0x65, 0x3A, 0x62, 0x39, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x32, 0x3A, 0x32,
- 0x31, 0x3A, 0x30, 0x30, 0x3A, 0x61, 0x31, 0x3A, 0x34, 0x38,
- 0x3A, 0x61, 0x38, 0x3A, 0x33, 0x32, 0x3A, 0x64, 0x31, 0x3A,
- 0x30, 0x35, 0x3A, 0x30, 0x39, 0x3A, 0x36, 0x62, 0x3A, 0x31,
- 0x63, 0x3A, 0x65, 0x62, 0x3A, 0x38, 0x39, 0x3A, 0x31, 0x32,
- 0x3A, 0x36, 0x36, 0x3A, 0x64, 0x38, 0x3A, 0x33, 0x38, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x61,
- 0x31, 0x3A, 0x63, 0x34, 0x3A, 0x35, 0x63, 0x3A, 0x38, 0x39,
- 0x3A, 0x30, 0x39, 0x3A, 0x30, 0x66, 0x3A, 0x66, 0x64, 0x3A,
- 0x65, 0x39, 0x3A, 0x63, 0x30, 0x3A, 0x33, 0x62, 0x3A, 0x31,
- 0x64, 0x3A, 0x66, 0x62, 0x3A, 0x63, 0x64, 0x3A, 0x62, 0x35,
- 0x3A, 0x34, 0x63, 0x3A, 0x33, 0x31, 0x3A, 0x36, 0x38, 0x0A,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41,
- 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x49, 0x43, 0x32, 0x44, 0x43, 0x43, 0x41, 0x6E, 0x36, 0x67,
- 0x41, 0x77, 0x49, 0x42, 0x41, 0x67, 0x49, 0x42, 0x41, 0x54,
- 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x44, 0x64, 0x54, 0x43, 0x42, 0x72, 0x44,
- 0x45, 0x4C, 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55, 0x45,
- 0x42, 0x68, 0x4D, 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45, 0x44,
- 0x41, 0x4F, 0x0A, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67,
- 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68, 0x62,
- 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76, 0x65,
- 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34, 0x78, 0x46, 0x44, 0x41,
- 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D, 0x43,
- 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x0A, 0x55, 0x30,
- 0x78, 0x66, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x51, 0x38, 0x77,
- 0x44, 0x51, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44, 0x41,
- 0x5A, 0x44, 0x51, 0x53, 0x31, 0x7A, 0x62, 0x54, 0x49, 0x78,
- 0x47, 0x44, 0x41, 0x57, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41,
- 0x4D, 0x4D, 0x44, 0x33, 0x64, 0x33, 0x64, 0x79, 0x35, 0x33,
- 0x62, 0x32, 0x78, 0x6D, 0x63, 0x33, 0x4E, 0x73, 0x4C, 0x6D,
- 0x4E, 0x76, 0x0A, 0x62, 0x54, 0x45, 0x66, 0x4D, 0x42, 0x30,
- 0x47, 0x43, 0x53, 0x71, 0x47, 0x53, 0x49, 0x62, 0x33, 0x44,
- 0x51, 0x45, 0x4A, 0x41, 0x52, 0x59, 0x51, 0x61, 0x57, 0x35,
- 0x6D, 0x62, 0x30, 0x42, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x63,
- 0x33, 0x4E, 0x73, 0x4C, 0x6D, 0x4E, 0x76, 0x62, 0x54, 0x45,
- 0x58, 0x4D, 0x42, 0x55, 0x47, 0x43, 0x67, 0x6D, 0x53, 0x4A,
- 0x6F, 0x6D, 0x54, 0x38, 0x69, 0x78, 0x6B, 0x0A, 0x41, 0x51,
- 0x45, 0x4D, 0x42, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54,
- 0x55, 0x30, 0x77, 0x77, 0x48, 0x68, 0x63, 0x4E, 0x4D, 0x6A,
- 0x4D, 0x77, 0x4D, 0x6A, 0x45, 0x31, 0x4D, 0x44, 0x59, 0x79,
- 0x4D, 0x7A, 0x41, 0x33, 0x57, 0x68, 0x63, 0x4E, 0x4D, 0x6A,
- 0x55, 0x78, 0x4D, 0x54, 0x45, 0x78, 0x4D, 0x44, 0x59, 0x79,
- 0x4D, 0x7A, 0x41, 0x33, 0x57, 0x6A, 0x43, 0x42, 0x73, 0x44,
- 0x45, 0x4C, 0x0A, 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55,
- 0x45, 0x42, 0x68, 0x4D, 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45,
- 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67,
- 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68, 0x62,
- 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76, 0x65,
- 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34, 0x78, 0x0A, 0x46, 0x44,
- 0x41, 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D,
- 0x43, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x55, 0x30,
- 0x78, 0x66, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52, 0x4D, 0x77,
- 0x45, 0x51, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44, 0x41,
- 0x70, 0x54, 0x5A, 0x58, 0x4A, 0x32, 0x5A, 0x58, 0x49, 0x74,
- 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52, 0x67, 0x77, 0x46, 0x67,
- 0x59, 0x44, 0x0A, 0x56, 0x51, 0x51, 0x44, 0x44, 0x41, 0x39,
- 0x33, 0x64, 0x33, 0x63, 0x75, 0x64, 0x32, 0x39, 0x73, 0x5A,
- 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32, 0x30,
- 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42, 0x67, 0x6B, 0x71, 0x68,
- 0x6B, 0x69, 0x47, 0x39, 0x77, 0x30, 0x42, 0x43, 0x51, 0x45,
- 0x57, 0x45, 0x47, 0x6C, 0x75, 0x5A, 0x6D, 0x39, 0x41, 0x64,
- 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x0A, 0x62, 0x43,
- 0x35, 0x6A, 0x62, 0x32, 0x30, 0x78, 0x46, 0x7A, 0x41, 0x56,
- 0x42, 0x67, 0x6F, 0x4A, 0x6B, 0x69, 0x61, 0x4A, 0x6B, 0x2F,
- 0x49, 0x73, 0x5A, 0x41, 0x45, 0x42, 0x44, 0x41, 0x64, 0x33,
- 0x62, 0x32, 0x78, 0x6D, 0x55, 0x31, 0x4E, 0x4D, 0x4D, 0x46,
- 0x6F, 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63,
- 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43,
- 0x71, 0x42, 0x0A, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49,
- 0x74, 0x41, 0x30, 0x49, 0x41, 0x42, 0x4A, 0x52, 0x77, 0x4B,
- 0x30, 0x62, 0x6B, 0x58, 0x67, 0x39, 0x42, 0x2B, 0x34, 0x38,
- 0x74, 0x4E, 0x41, 0x70, 0x42, 0x51, 0x42, 0x6C, 0x65, 0x2B,
- 0x39, 0x51, 0x64, 0x45, 0x61, 0x7A, 0x36, 0x39, 0x5A, 0x4D,
- 0x33, 0x78, 0x76, 0x71, 0x48, 0x43, 0x50, 0x63, 0x57, 0x48,
- 0x79, 0x7A, 0x4F, 0x4D, 0x45, 0x43, 0x64, 0x0A, 0x54, 0x36,
- 0x59, 0x71, 0x43, 0x71, 0x48, 0x57, 0x6C, 0x54, 0x50, 0x44,
- 0x70, 0x67, 0x4F, 0x59, 0x35, 0x6F, 0x30, 0x46, 0x4E, 0x4C,
- 0x43, 0x58, 0x44, 0x4E, 0x36, 0x6B, 0x78, 0x38, 0x39, 0x54,
- 0x6A, 0x39, 0x47, 0x6A, 0x67, 0x59, 0x6B, 0x77, 0x67, 0x59,
- 0x59, 0x77, 0x48, 0x51, 0x59, 0x44, 0x56, 0x52, 0x30, 0x4F,
- 0x42, 0x42, 0x59, 0x45, 0x46, 0x47, 0x65, 0x75, 0x59, 0x50,
- 0x39, 0x2B, 0x0A, 0x47, 0x77, 0x2B, 0x56, 0x72, 0x68, 0x2B,
- 0x43, 0x57, 0x66, 0x4A, 0x73, 0x56, 0x69, 0x32, 0x54, 0x37,
- 0x78, 0x63, 0x79, 0x4D, 0x42, 0x38, 0x47, 0x41, 0x31, 0x55,
- 0x64, 0x49, 0x77, 0x51, 0x59, 0x4D, 0x42, 0x61, 0x41, 0x46,
- 0x45, 0x63, 0x4B, 0x53, 0x48, 0x36, 0x37, 0x41, 0x71, 0x68,
- 0x61, 0x4A, 0x6C, 0x63, 0x72, 0x47, 0x61, 0x6C, 0x37, 0x59,
- 0x59, 0x74, 0x2F, 0x58, 0x5A, 0x6C, 0x75, 0x0A, 0x4D, 0x41,
- 0x77, 0x47, 0x41, 0x31, 0x55, 0x64, 0x45, 0x77, 0x45, 0x42,
- 0x2F, 0x77, 0x51, 0x43, 0x4D, 0x41, 0x41, 0x77, 0x44, 0x67,
- 0x59, 0x44, 0x56, 0x52, 0x30, 0x50, 0x41, 0x51, 0x48, 0x2F,
- 0x42, 0x41, 0x51, 0x44, 0x41, 0x67, 0x4F, 0x6F, 0x4D, 0x42,
- 0x4D, 0x47, 0x41, 0x31, 0x55, 0x64, 0x4A, 0x51, 0x51, 0x4D,
- 0x4D, 0x41, 0x6F, 0x47, 0x43, 0x43, 0x73, 0x47, 0x41, 0x51,
- 0x55, 0x46, 0x0A, 0x42, 0x77, 0x4D, 0x42, 0x4D, 0x42, 0x45,
- 0x47, 0x43, 0x57, 0x43, 0x47, 0x53, 0x41, 0x47, 0x47, 0x2B,
- 0x45, 0x49, 0x42, 0x41, 0x51, 0x51, 0x45, 0x41, 0x77, 0x49,
- 0x47, 0x51, 0x44, 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67,
- 0x52, 0x7A, 0x50, 0x56, 0x51, 0x47, 0x44, 0x64, 0x51, 0x4E,
- 0x49, 0x41, 0x44, 0x42, 0x46, 0x41, 0x69, 0x41, 0x62, 0x79,
- 0x70, 0x51, 0x6F, 0x66, 0x2F, 0x61, 0x79, 0x0A, 0x44, 0x54,
- 0x46, 0x44, 0x55, 0x4F, 0x48, 0x56, 0x4E, 0x42, 0x66, 0x64,
- 0x72, 0x7A, 0x72, 0x65, 0x67, 0x51, 0x5A, 0x6E, 0x6D, 0x72,
- 0x4D, 0x47, 0x49, 0x6E, 0x35, 0x6B, 0x37, 0x50, 0x30, 0x4F,
- 0x75, 0x51, 0x49, 0x68, 0x41, 0x4B, 0x46, 0x49, 0x71, 0x44,
- 0x4C, 0x52, 0x42, 0x51, 0x6C, 0x72, 0x48, 0x4F, 0x75, 0x4A,
- 0x45, 0x6D, 0x62, 0x59, 0x4F, 0x4B, 0x48, 0x45, 0x58, 0x49,
- 0x6B, 0x4A, 0x0A, 0x44, 0x2F, 0x33, 0x70, 0x77, 0x44, 0x73,
- 0x64, 0x2B, 0x38, 0x32, 0x31, 0x54, 0x44, 0x46, 0x6F, 0x0A,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x43,
- 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x43, 0x65, 0x72, 0x74,
- 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x44, 0x61, 0x74, 0x61, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x56, 0x65, 0x72,
- 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x33, 0x20, 0x28, 0x30,
- 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6C, 0x20, 0x4E,
- 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A, 0x20, 0x31, 0x20, 0x28,
- 0x30, 0x78, 0x31, 0x29, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75,
- 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69, 0x74,
- 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77, 0x69,
- 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x49, 0x73, 0x73, 0x75, 0x65,
- 0x72, 0x3A, 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C,
- 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74,
- 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42,
- 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20,
- 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F,
- 0x53, 0x4D, 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20,
- 0x52, 0x6F, 0x6F, 0x74, 0x2D, 0x53, 0x4D, 0x32, 0x2C, 0x20,
- 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E, 0x77,
- 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F, 0x6D,
- 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64, 0x64,
- 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E, 0x66,
- 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E,
- 0x63, 0x6F, 0x6D, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x56, 0x61, 0x6C, 0x69, 0x64, 0x69, 0x74, 0x79,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x4E, 0x6F, 0x74, 0x20, 0x42, 0x65, 0x66,
- 0x6F, 0x72, 0x65, 0x3A, 0x20, 0x46, 0x65, 0x62, 0x20, 0x31,
- 0x35, 0x20, 0x30, 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37,
- 0x20, 0x32, 0x30, 0x32, 0x33, 0x20, 0x47, 0x4D, 0x54, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x4E, 0x6F, 0x74, 0x20, 0x41, 0x66, 0x74, 0x65,
- 0x72, 0x20, 0x3A, 0x20, 0x4E, 0x6F, 0x76, 0x20, 0x31, 0x31,
- 0x20, 0x30, 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20,
- 0x32, 0x30, 0x32, 0x35, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x75, 0x62,
- 0x6A, 0x65, 0x63, 0x74, 0x3A, 0x20, 0x43, 0x20, 0x3D, 0x20,
- 0x55, 0x53, 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20, 0x4D,
- 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C, 0x20,
- 0x3D, 0x20, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x2C,
- 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53,
- 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x4F, 0x55,
- 0x20, 0x3D, 0x20, 0x43, 0x41, 0x2D, 0x73, 0x6D, 0x32, 0x2C,
- 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77, 0x2E,
- 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63, 0x6F,
- 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41, 0x64,
- 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69, 0x6E,
- 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C,
- 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44, 0x20,
- 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x75,
- 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x50, 0x75, 0x62, 0x6C,
- 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x6E, 0x66,
- 0x6F, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C, 0x69,
- 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x6C, 0x67, 0x6F,
- 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x73, 0x6D, 0x32,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62,
- 0x6C, 0x69, 0x63, 0x2D, 0x4B, 0x65, 0x79, 0x3A, 0x20, 0x28,
- 0x32, 0x35, 0x36, 0x20, 0x62, 0x69, 0x74, 0x29, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x75, 0x62, 0x3A, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x30, 0x34, 0x3A, 0x32, 0x31, 0x3A, 0x39, 0x32, 0x3A, 0x66,
- 0x37, 0x3A, 0x63, 0x62, 0x3A, 0x32, 0x34, 0x3A, 0x64, 0x66,
- 0x3A, 0x36, 0x34, 0x3A, 0x34, 0x64, 0x3A, 0x62, 0x61, 0x3A,
- 0x61, 0x62, 0x3A, 0x36, 0x36, 0x3A, 0x37, 0x62, 0x3A, 0x38,
- 0x33, 0x3A, 0x37, 0x35, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x61, 0x39, 0x3A, 0x32,
- 0x39, 0x3A, 0x65, 0x37, 0x3A, 0x66, 0x66, 0x3A, 0x36, 0x34,
- 0x3A, 0x36, 0x33, 0x3A, 0x62, 0x36, 0x3A, 0x64, 0x35, 0x3A,
- 0x34, 0x32, 0x3A, 0x38, 0x30, 0x3A, 0x32, 0x30, 0x3A, 0x62,
- 0x64, 0x3A, 0x65, 0x32, 0x3A, 0x65, 0x32, 0x3A, 0x30, 0x32,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x31, 0x32, 0x3A, 0x33, 0x62, 0x3A, 0x38, 0x65,
- 0x3A, 0x62, 0x34, 0x3A, 0x30, 0x30, 0x3A, 0x39, 0x35, 0x3A,
- 0x30, 0x39, 0x3A, 0x38, 0x30, 0x3A, 0x63, 0x62, 0x3A, 0x35,
- 0x36, 0x3A, 0x65, 0x64, 0x3A, 0x34, 0x62, 0x3A, 0x63, 0x61,
- 0x3A, 0x38, 0x64, 0x3A, 0x35, 0x37, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x65, 0x36,
- 0x3A, 0x61, 0x65, 0x3A, 0x30, 0x35, 0x3A, 0x64, 0x33, 0x3A,
- 0x37, 0x36, 0x3A, 0x32, 0x37, 0x3A, 0x36, 0x33, 0x3A, 0x37,
- 0x31, 0x3A, 0x33, 0x39, 0x3A, 0x38, 0x39, 0x3A, 0x62, 0x37,
- 0x3A, 0x36, 0x39, 0x3A, 0x65, 0x36, 0x3A, 0x34, 0x38, 0x3A,
- 0x38, 0x30, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x61, 0x65, 0x3A, 0x64, 0x31, 0x3A,
- 0x61, 0x39, 0x3A, 0x34, 0x38, 0x3A, 0x31, 0x32, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x41, 0x53, 0x4E, 0x31, 0x20,
- 0x4F, 0x49, 0x44, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35, 0x30,
- 0x39, 0x76, 0x33, 0x20, 0x65, 0x78, 0x74, 0x65, 0x6E, 0x73,
- 0x69, 0x6F, 0x6E, 0x73, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35,
- 0x30, 0x39, 0x76, 0x33, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65,
- 0x63, 0x74, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64, 0x65,
- 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34, 0x37, 0x3A, 0x30,
- 0x41, 0x3A, 0x34, 0x38, 0x3A, 0x37, 0x45, 0x3A, 0x42, 0x42,
- 0x3A, 0x30, 0x32, 0x3A, 0x41, 0x38, 0x3A, 0x35, 0x41, 0x3A,
- 0x32, 0x36, 0x3A, 0x35, 0x37, 0x3A, 0x32, 0x42, 0x3A, 0x31,
- 0x39, 0x3A, 0x41, 0x39, 0x3A, 0x37, 0x42, 0x3A, 0x36, 0x31,
- 0x3A, 0x38, 0x42, 0x3A, 0x37, 0x46, 0x3A, 0x35, 0x44, 0x3A,
- 0x39, 0x39, 0x3A, 0x36, 0x45, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35,
- 0x30, 0x39, 0x76, 0x33, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6F,
- 0x72, 0x69, 0x74, 0x79, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49,
- 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A,
- 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x33, 0x34,
- 0x3A, 0x31, 0x44, 0x3A, 0x37, 0x39, 0x3A, 0x34, 0x34, 0x3A,
- 0x31, 0x35, 0x3A, 0x37, 0x39, 0x3A, 0x41, 0x31, 0x3A, 0x42,
- 0x31, 0x3A, 0x36, 0x33, 0x3A, 0x39, 0x39, 0x3A, 0x45, 0x33,
- 0x3A, 0x45, 0x44, 0x3A, 0x36, 0x35, 0x3A, 0x37, 0x43, 0x3A,
- 0x36, 0x34, 0x3A, 0x38, 0x39, 0x3A, 0x38, 0x30, 0x3A, 0x46,
- 0x46, 0x3A, 0x42, 0x38, 0x3A, 0x45, 0x43, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x42, 0x61, 0x73,
- 0x69, 0x63, 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x74, 0x72, 0x61,
- 0x69, 0x6E, 0x74, 0x73, 0x3A, 0x20, 0x63, 0x72, 0x69, 0x74,
- 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x43, 0x41, 0x3A, 0x54, 0x52, 0x55, 0x45, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x4B, 0x65,
- 0x79, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x3A, 0x20, 0x63,
- 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x44, 0x69, 0x67, 0x69, 0x74, 0x61,
- 0x6C, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72,
- 0x65, 0x2C, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
- 0x63, 0x61, 0x74, 0x65, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x2C,
- 0x20, 0x43, 0x52, 0x4C, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74,
- 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67, 0x6F, 0x72, 0x69,
- 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x2D, 0x77,
- 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74, 0x75, 0x72,
- 0x65, 0x20, 0x56, 0x61, 0x6C, 0x75, 0x65, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x33, 0x30, 0x3A,
- 0x34, 0x35, 0x3A, 0x30, 0x32, 0x3A, 0x32, 0x30, 0x3A, 0x34,
- 0x37, 0x3A, 0x34, 0x65, 0x3A, 0x30, 0x30, 0x3A, 0x30, 0x33,
- 0x3A, 0x61, 0x62, 0x3A, 0x33, 0x34, 0x3A, 0x61, 0x31, 0x3A,
- 0x61, 0x66, 0x3A, 0x35, 0x39, 0x3A, 0x33, 0x39, 0x3A, 0x38,
- 0x66, 0x3A, 0x36, 0x30, 0x3A, 0x33, 0x36, 0x3A, 0x62, 0x66,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x38, 0x39, 0x3A, 0x38, 0x38, 0x3A, 0x34, 0x32, 0x3A, 0x34,
- 0x31, 0x3A, 0x32, 0x37, 0x3A, 0x63, 0x31, 0x3A, 0x64, 0x64,
- 0x3A, 0x35, 0x37, 0x3A, 0x63, 0x39, 0x3A, 0x37, 0x39, 0x3A,
- 0x63, 0x62, 0x3A, 0x31, 0x66, 0x3A, 0x35, 0x36, 0x3A, 0x35,
- 0x63, 0x3A, 0x31, 0x36, 0x3A, 0x62, 0x35, 0x3A, 0x32, 0x38,
- 0x3A, 0x62, 0x64, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x30, 0x32, 0x3A, 0x32, 0x31, 0x3A, 0x30,
- 0x30, 0x3A, 0x38, 0x62, 0x3A, 0x32, 0x65, 0x3A, 0x32, 0x35,
- 0x3A, 0x65, 0x62, 0x3A, 0x32, 0x31, 0x3A, 0x39, 0x62, 0x3A,
- 0x61, 0x39, 0x3A, 0x32, 0x62, 0x3A, 0x61, 0x36, 0x3A, 0x36,
- 0x61, 0x3A, 0x35, 0x62, 0x3A, 0x64, 0x62, 0x3A, 0x61, 0x37,
- 0x3A, 0x63, 0x37, 0x3A, 0x32, 0x62, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x31, 0x31, 0x3A, 0x64,
- 0x66, 0x3A, 0x37, 0x33, 0x3A, 0x31, 0x35, 0x3A, 0x61, 0x64,
- 0x3A, 0x65, 0x34, 0x3A, 0x63, 0x35, 0x3A, 0x63, 0x33, 0x3A,
- 0x63, 0x32, 0x3A, 0x66, 0x33, 0x3A, 0x62, 0x34, 0x3A, 0x62,
- 0x34, 0x3A, 0x36, 0x37, 0x3A, 0x61, 0x66, 0x3A, 0x64, 0x37,
- 0x3A, 0x35, 0x31, 0x3A, 0x31, 0x63, 0x0A, 0x2D, 0x2D, 0x2D,
- 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x20, 0x43, 0x45,
- 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49, 0x49, 0x43, 0x6C,
- 0x6A, 0x43, 0x43, 0x41, 0x6A, 0x79, 0x67, 0x41, 0x77, 0x49,
- 0x42, 0x41, 0x67, 0x49, 0x42, 0x41, 0x54, 0x41, 0x4B, 0x42,
- 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50, 0x56, 0x51, 0x47,
- 0x44, 0x64, 0x54, 0x43, 0x42, 0x6C, 0x54, 0x45, 0x4C, 0x4D,
- 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55, 0x45, 0x42, 0x68, 0x4D,
- 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x0A,
- 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67, 0x4D, 0x42, 0x30,
- 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68, 0x62, 0x6D, 0x45, 0x78,
- 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41,
- 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76, 0x65, 0x6D, 0x56, 0x74,
- 0x59, 0x57, 0x34, 0x78, 0x46, 0x44, 0x41, 0x53, 0x42, 0x67,
- 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D, 0x43, 0x33, 0x64, 0x76,
- 0x62, 0x47, 0x5A, 0x54, 0x0A, 0x55, 0x30, 0x78, 0x66, 0x55,
- 0x30, 0x30, 0x79, 0x4D, 0x52, 0x45, 0x77, 0x44, 0x77, 0x59,
- 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44, 0x41, 0x68, 0x53, 0x62,
- 0x32, 0x39, 0x30, 0x4C, 0x56, 0x4E, 0x4E, 0x4D, 0x6A, 0x45,
- 0x59, 0x4D, 0x42, 0x59, 0x47, 0x41, 0x31, 0x55, 0x45, 0x41,
- 0x77, 0x77, 0x50, 0x64, 0x33, 0x64, 0x33, 0x4C, 0x6E, 0x64,
- 0x76, 0x62, 0x47, 0x5A, 0x7A, 0x63, 0x32, 0x77, 0x75, 0x0A,
- 0x59, 0x32, 0x39, 0x74, 0x4D, 0x52, 0x38, 0x77, 0x48, 0x51,
- 0x59, 0x4A, 0x4B, 0x6F, 0x5A, 0x49, 0x68, 0x76, 0x63, 0x4E,
- 0x41, 0x51, 0x6B, 0x42, 0x46, 0x68, 0x42, 0x70, 0x62, 0x6D,
- 0x5A, 0x76, 0x51, 0x48, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x7A,
- 0x63, 0x32, 0x77, 0x75, 0x59, 0x32, 0x39, 0x74, 0x4D, 0x42,
- 0x34, 0x58, 0x44, 0x54, 0x49, 0x7A, 0x4D, 0x44, 0x49, 0x78,
- 0x4E, 0x54, 0x41, 0x32, 0x0A, 0x4D, 0x6A, 0x4D, 0x77, 0x4E,
- 0x31, 0x6F, 0x58, 0x44, 0x54, 0x49, 0x31, 0x4D, 0x54, 0x45,
- 0x78, 0x4D, 0x54, 0x41, 0x32, 0x4D, 0x6A, 0x4D, 0x77, 0x4E,
- 0x31, 0x6F, 0x77, 0x67, 0x61, 0x77, 0x78, 0x43, 0x7A, 0x41,
- 0x4A, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x59, 0x54, 0x41,
- 0x6C, 0x56, 0x54, 0x4D, 0x52, 0x41, 0x77, 0x44, 0x67, 0x59,
- 0x44, 0x56, 0x51, 0x51, 0x49, 0x44, 0x41, 0x64, 0x4E, 0x0A,
- 0x62, 0x32, 0x35, 0x30, 0x59, 0x57, 0x35, 0x68, 0x4D, 0x52,
- 0x41, 0x77, 0x44, 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x48,
- 0x44, 0x41, 0x64, 0x43, 0x62, 0x33, 0x70, 0x6C, 0x62, 0x57,
- 0x46, 0x75, 0x4D, 0x52, 0x51, 0x77, 0x45, 0x67, 0x59, 0x44,
- 0x56, 0x51, 0x51, 0x4B, 0x44, 0x41, 0x74, 0x33, 0x62, 0x32,
- 0x78, 0x6D, 0x55, 0x31, 0x4E, 0x4D, 0x58, 0x33, 0x4E, 0x74,
- 0x4D, 0x6A, 0x45, 0x50, 0x0A, 0x4D, 0x41, 0x30, 0x47, 0x41,
- 0x31, 0x55, 0x45, 0x43, 0x77, 0x77, 0x47, 0x51, 0x30, 0x45,
- 0x74, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52, 0x67, 0x77, 0x46,
- 0x67, 0x59, 0x44, 0x56, 0x51, 0x51, 0x44, 0x44, 0x41, 0x39,
- 0x33, 0x64, 0x33, 0x63, 0x75, 0x64, 0x32, 0x39, 0x73, 0x5A,
- 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32, 0x30,
- 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42, 0x67, 0x6B, 0x71, 0x0A,
- 0x68, 0x6B, 0x69, 0x47, 0x39, 0x77, 0x30, 0x42, 0x43, 0x51,
- 0x45, 0x57, 0x45, 0x47, 0x6C, 0x75, 0x5A, 0x6D, 0x39, 0x41,
- 0x64, 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x62, 0x43,
- 0x35, 0x6A, 0x62, 0x32, 0x30, 0x78, 0x46, 0x7A, 0x41, 0x56,
- 0x42, 0x67, 0x6F, 0x4A, 0x6B, 0x69, 0x61, 0x4A, 0x6B, 0x2F,
- 0x49, 0x73, 0x5A, 0x41, 0x45, 0x42, 0x44, 0x41, 0x64, 0x33,
- 0x62, 0x32, 0x78, 0x6D, 0x0A, 0x55, 0x31, 0x4E, 0x4D, 0x4D,
- 0x46, 0x6F, 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45,
- 0x63, 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43,
- 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49,
- 0x74, 0x41, 0x30, 0x49, 0x41, 0x42, 0x43, 0x47, 0x53, 0x39,
- 0x38, 0x73, 0x6B, 0x33, 0x32, 0x52, 0x4E, 0x75, 0x71, 0x74,
- 0x6D, 0x65, 0x34, 0x4E, 0x31, 0x71, 0x53, 0x6E, 0x6E, 0x0A,
- 0x2F, 0x32, 0x52, 0x6A, 0x74, 0x74, 0x56, 0x43, 0x67, 0x43,
- 0x43, 0x39, 0x34, 0x75, 0x49, 0x43, 0x45, 0x6A, 0x75, 0x4F,
- 0x74, 0x41, 0x43, 0x56, 0x43, 0x59, 0x44, 0x4C, 0x56, 0x75,
- 0x31, 0x4C, 0x79, 0x6F, 0x31, 0x58, 0x35, 0x71, 0x34, 0x46,
- 0x30, 0x33, 0x59, 0x6E, 0x59, 0x33, 0x45, 0x35, 0x69, 0x62,
- 0x64, 0x70, 0x35, 0x6B, 0x69, 0x41, 0x72, 0x74, 0x47, 0x70,
- 0x53, 0x42, 0x4B, 0x6A, 0x0A, 0x59, 0x7A, 0x42, 0x68, 0x4D,
- 0x42, 0x30, 0x47, 0x41, 0x31, 0x55, 0x64, 0x44, 0x67, 0x51,
- 0x57, 0x42, 0x42, 0x52, 0x48, 0x43, 0x6B, 0x68, 0x2B, 0x75,
- 0x77, 0x4B, 0x6F, 0x57, 0x69, 0x5A, 0x58, 0x4B, 0x78, 0x6D,
- 0x70, 0x65, 0x32, 0x47, 0x4C, 0x66, 0x31, 0x32, 0x5A, 0x62,
- 0x6A, 0x41, 0x66, 0x42, 0x67, 0x4E, 0x56, 0x48, 0x53, 0x4D,
- 0x45, 0x47, 0x44, 0x41, 0x57, 0x67, 0x42, 0x51, 0x30, 0x0A,
- 0x48, 0x58, 0x6C, 0x45, 0x46, 0x58, 0x6D, 0x68, 0x73, 0x57,
- 0x4F, 0x5A, 0x34, 0x2B, 0x31, 0x6C, 0x66, 0x47, 0x53, 0x4A,
- 0x67, 0x50, 0x2B, 0x34, 0x37, 0x44, 0x41, 0x50, 0x42, 0x67,
- 0x4E, 0x56, 0x48, 0x52, 0x4D, 0x42, 0x41, 0x66, 0x38, 0x45,
- 0x42, 0x54, 0x41, 0x44, 0x41, 0x51, 0x48, 0x2F, 0x4D, 0x41,
- 0x34, 0x47, 0x41, 0x31, 0x55, 0x64, 0x44, 0x77, 0x45, 0x42,
- 0x2F, 0x77, 0x51, 0x45, 0x0A, 0x41, 0x77, 0x49, 0x42, 0x68,
- 0x6A, 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A,
- 0x50, 0x56, 0x51, 0x47, 0x44, 0x64, 0x51, 0x4E, 0x49, 0x41,
- 0x44, 0x42, 0x46, 0x41, 0x69, 0x42, 0x48, 0x54, 0x67, 0x41,
- 0x44, 0x71, 0x7A, 0x53, 0x68, 0x72, 0x31, 0x6B, 0x35, 0x6A,
- 0x32, 0x41, 0x32, 0x76, 0x34, 0x6D, 0x49, 0x51, 0x6B, 0x45,
- 0x6E, 0x77, 0x64, 0x31, 0x58, 0x79, 0x58, 0x6E, 0x4C, 0x0A,
- 0x48, 0x31, 0x5A, 0x63, 0x46, 0x72, 0x55, 0x6F, 0x76, 0x51,
- 0x49, 0x68, 0x41, 0x49, 0x73, 0x75, 0x4A, 0x65, 0x73, 0x68,
- 0x6D, 0x36, 0x6B, 0x72, 0x70, 0x6D, 0x70, 0x62, 0x32, 0x36,
- 0x66, 0x48, 0x4B, 0x78, 0x48, 0x66, 0x63, 0x78, 0x57, 0x74,
- 0x35, 0x4D, 0x58, 0x44, 0x77, 0x76, 0x4F, 0x30, 0x74, 0x47,
- 0x65, 0x76, 0x31, 0x31, 0x45, 0x63, 0x0A, 0x2D, 0x2D, 0x2D,
- 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x43, 0x45, 0x52, 0x54,
- 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x2D, 0x2D, 0x2D,
- 0x2D, 0x2D, 0x0A
-};
-#define sizeof_server_sm2 (sizeof(server_sm2))
-
-/* ./certs/sm2/server-sm2-cert.pem */
-static const unsigned char server_sm2_cert[] =
-{
- 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
- 0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
- 0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
- 0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
- 0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
- 0x20, 0x31, 0x20, 0x28, 0x30, 0x78, 0x31, 0x29, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D,
- 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x49,
- 0x73, 0x73, 0x75, 0x65, 0x72, 0x3A, 0x20, 0x43, 0x20, 0x3D,
- 0x20, 0x55, 0x53, 0x2C, 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20,
- 0x4D, 0x6F, 0x6E, 0x74, 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C,
- 0x20, 0x3D, 0x20, 0x42, 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E,
- 0x2C, 0x20, 0x4F, 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66,
- 0x53, 0x53, 0x4C, 0x5F, 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x4F,
- 0x55, 0x20, 0x3D, 0x20, 0x43, 0x41, 0x2D, 0x73, 0x6D, 0x32,
- 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77,
- 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41,
- 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69,
- 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x56,
- 0x61, 0x6C, 0x69, 0x64, 0x69, 0x74, 0x79, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x4E, 0x6F, 0x74, 0x20, 0x42, 0x65, 0x66, 0x6F, 0x72, 0x65,
- 0x3A, 0x20, 0x46, 0x65, 0x62, 0x20, 0x31, 0x35, 0x20, 0x30,
- 0x36, 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30,
- 0x32, 0x33, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E,
- 0x6F, 0x74, 0x20, 0x41, 0x66, 0x74, 0x65, 0x72, 0x20, 0x3A,
- 0x20, 0x4E, 0x6F, 0x76, 0x20, 0x31, 0x31, 0x20, 0x30, 0x36,
- 0x3A, 0x32, 0x33, 0x3A, 0x30, 0x37, 0x20, 0x32, 0x30, 0x32,
- 0x35, 0x20, 0x47, 0x4D, 0x54, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x53, 0x75, 0x62, 0x6A, 0x65, 0x63,
- 0x74, 0x3A, 0x20, 0x43, 0x20, 0x3D, 0x20, 0x55, 0x53, 0x2C,
- 0x20, 0x53, 0x54, 0x20, 0x3D, 0x20, 0x4D, 0x6F, 0x6E, 0x74,
- 0x61, 0x6E, 0x61, 0x2C, 0x20, 0x4C, 0x20, 0x3D, 0x20, 0x42,
- 0x6F, 0x7A, 0x65, 0x6D, 0x61, 0x6E, 0x2C, 0x20, 0x4F, 0x20,
- 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x5F,
- 0x73, 0x6D, 0x32, 0x2C, 0x20, 0x4F, 0x55, 0x20, 0x3D, 0x20,
- 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2D, 0x73, 0x6D, 0x32,
- 0x2C, 0x20, 0x43, 0x4E, 0x20, 0x3D, 0x20, 0x77, 0x77, 0x77,
- 0x2E, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73, 0x6C, 0x2E, 0x63,
- 0x6F, 0x6D, 0x2C, 0x20, 0x65, 0x6D, 0x61, 0x69, 0x6C, 0x41,
- 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x20, 0x3D, 0x20, 0x69,
- 0x6E, 0x66, 0x6F, 0x40, 0x77, 0x6F, 0x6C, 0x66, 0x73, 0x73,
- 0x6C, 0x2E, 0x63, 0x6F, 0x6D, 0x2C, 0x20, 0x55, 0x49, 0x44,
- 0x20, 0x3D, 0x20, 0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53,
- 0x75, 0x62, 0x6A, 0x65, 0x63, 0x74, 0x20, 0x50, 0x75, 0x62,
- 0x6C, 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x6E,
- 0x66, 0x6F, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75, 0x62, 0x6C,
- 0x69, 0x63, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x73, 0x6D,
- 0x32, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x50, 0x75,
- 0x62, 0x6C, 0x69, 0x63, 0x2D, 0x4B, 0x65, 0x79, 0x3A, 0x20,
- 0x28, 0x32, 0x35, 0x36, 0x20, 0x62, 0x69, 0x74, 0x29, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x75, 0x62, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x30, 0x34, 0x3A, 0x39, 0x34, 0x3A, 0x37, 0x30, 0x3A,
- 0x32, 0x62, 0x3A, 0x34, 0x36, 0x3A, 0x65, 0x34, 0x3A, 0x35,
- 0x65, 0x3A, 0x30, 0x66, 0x3A, 0x34, 0x31, 0x3A, 0x66, 0x62,
- 0x3A, 0x38, 0x66, 0x3A, 0x32, 0x64, 0x3A, 0x33, 0x34, 0x3A,
- 0x30, 0x61, 0x3A, 0x34, 0x31, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34, 0x30, 0x3A,
- 0x31, 0x39, 0x3A, 0x35, 0x65, 0x3A, 0x66, 0x62, 0x3A, 0x64,
- 0x34, 0x3A, 0x31, 0x64, 0x3A, 0x31, 0x31, 0x3A, 0x61, 0x63,
- 0x3A, 0x66, 0x61, 0x3A, 0x66, 0x35, 0x3A, 0x39, 0x33, 0x3A,
- 0x33, 0x37, 0x3A, 0x63, 0x36, 0x3A, 0x66, 0x61, 0x3A, 0x38,
- 0x37, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x30, 0x38, 0x3A, 0x66, 0x37, 0x3A, 0x31,
- 0x36, 0x3A, 0x31, 0x66, 0x3A, 0x32, 0x63, 0x3A, 0x63, 0x65,
- 0x3A, 0x33, 0x30, 0x3A, 0x34, 0x30, 0x3A, 0x39, 0x64, 0x3A,
- 0x34, 0x66, 0x3A, 0x61, 0x36, 0x3A, 0x32, 0x61, 0x3A, 0x30,
- 0x61, 0x3A, 0x61, 0x31, 0x3A, 0x64, 0x36, 0x3A, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x39,
- 0x35, 0x3A, 0x33, 0x33, 0x3A, 0x63, 0x33, 0x3A, 0x61, 0x36,
- 0x3A, 0x30, 0x33, 0x3A, 0x39, 0x38, 0x3A, 0x65, 0x36, 0x3A,
- 0x38, 0x64, 0x3A, 0x30, 0x35, 0x3A, 0x33, 0x34, 0x3A, 0x62,
- 0x30, 0x3A, 0x39, 0x37, 0x3A, 0x30, 0x63, 0x3A, 0x64, 0x65,
- 0x3A, 0x61, 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x37, 0x3A, 0x63, 0x66,
- 0x3A, 0x35, 0x33, 0x3A, 0x38, 0x66, 0x3A, 0x64, 0x31, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x41, 0x53, 0x4E, 0x31,
- 0x20, 0x4F, 0x49, 0x44, 0x3A, 0x20, 0x53, 0x4D, 0x32, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58, 0x35,
- 0x30, 0x39, 0x76, 0x33, 0x20, 0x65, 0x78, 0x74, 0x65, 0x6E,
- 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3A, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x53, 0x75, 0x62, 0x6A,
- 0x65, 0x63, 0x74, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x49, 0x64,
- 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x3A, 0x20,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x36, 0x37, 0x3A,
- 0x41, 0x45, 0x3A, 0x36, 0x30, 0x3A, 0x46, 0x46, 0x3A, 0x37,
- 0x45, 0x3A, 0x31, 0x42, 0x3A, 0x30, 0x46, 0x3A, 0x39, 0x35,
- 0x3A, 0x41, 0x45, 0x3A, 0x31, 0x46, 0x3A, 0x38, 0x32, 0x3A,
- 0x35, 0x39, 0x3A, 0x46, 0x32, 0x3A, 0x36, 0x43, 0x3A, 0x35,
- 0x36, 0x3A, 0x32, 0x44, 0x3A, 0x39, 0x33, 0x3A, 0x45, 0x46,
- 0x3A, 0x31, 0x37, 0x3A, 0x33, 0x32, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x41, 0x75, 0x74, 0x68,
- 0x6F, 0x72, 0x69, 0x74, 0x79, 0x20, 0x4B, 0x65, 0x79, 0x20,
- 0x49, 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
- 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x34,
- 0x37, 0x3A, 0x30, 0x41, 0x3A, 0x34, 0x38, 0x3A, 0x37, 0x45,
- 0x3A, 0x42, 0x42, 0x3A, 0x30, 0x32, 0x3A, 0x41, 0x38, 0x3A,
- 0x35, 0x41, 0x3A, 0x32, 0x36, 0x3A, 0x35, 0x37, 0x3A, 0x32,
- 0x42, 0x3A, 0x31, 0x39, 0x3A, 0x41, 0x39, 0x3A, 0x37, 0x42,
- 0x3A, 0x36, 0x31, 0x3A, 0x38, 0x42, 0x3A, 0x37, 0x46, 0x3A,
- 0x35, 0x44, 0x3A, 0x39, 0x39, 0x3A, 0x36, 0x45, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x42, 0x61,
- 0x73, 0x69, 0x63, 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x74, 0x72,
- 0x61, 0x69, 0x6E, 0x74, 0x73, 0x3A, 0x20, 0x63, 0x72, 0x69,
- 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x43, 0x41, 0x3A, 0x46, 0x41, 0x4C, 0x53, 0x45,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x58, 0x35, 0x30, 0x39, 0x76, 0x33, 0x20,
- 0x4B, 0x65, 0x79, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x3A,
- 0x20, 0x63, 0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6C, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x44, 0x69, 0x67, 0x69,
- 0x74, 0x61, 0x6C, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61, 0x74,
- 0x75, 0x72, 0x65, 0x2C, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x45,
- 0x6E, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x6D, 0x65, 0x6E,
- 0x74, 0x2C, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x41, 0x67, 0x72,
- 0x65, 0x65, 0x6D, 0x65, 0x6E, 0x74, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x58,
- 0x35, 0x30, 0x39, 0x76, 0x33, 0x20, 0x45, 0x78, 0x74, 0x65,
- 0x6E, 0x64, 0x65, 0x64, 0x20, 0x4B, 0x65, 0x79, 0x20, 0x55,
- 0x73, 0x61, 0x67, 0x65, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x54, 0x4C, 0x53, 0x20, 0x57, 0x65, 0x62,
- 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x41, 0x75,
- 0x74, 0x68, 0x65, 0x6E, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69,
- 0x6F, 0x6E, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x4E, 0x65, 0x74, 0x73, 0x63,
- 0x61, 0x70, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x20, 0x54,
- 0x79, 0x70, 0x65, 0x3A, 0x20, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x53, 0x53, 0x4C, 0x20, 0x53, 0x65, 0x72, 0x76,
- 0x65, 0x72, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67,
- 0x6E, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x41, 0x6C, 0x67,
- 0x6F, 0x72, 0x69, 0x74, 0x68, 0x6D, 0x3A, 0x20, 0x53, 0x4D,
- 0x32, 0x2D, 0x77, 0x69, 0x74, 0x68, 0x2D, 0x53, 0x4D, 0x33,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x53, 0x69, 0x67, 0x6E, 0x61,
- 0x74, 0x75, 0x72, 0x65, 0x20, 0x56, 0x61, 0x6C, 0x75, 0x65,
- 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x33, 0x30, 0x3A, 0x34, 0x35, 0x3A, 0x30, 0x32, 0x3A, 0x32,
- 0x30, 0x3A, 0x31, 0x62, 0x3A, 0x63, 0x61, 0x3A, 0x39, 0x34,
- 0x3A, 0x32, 0x38, 0x3A, 0x37, 0x66, 0x3A, 0x66, 0x36, 0x3A,
- 0x62, 0x32, 0x3A, 0x30, 0x64, 0x3A, 0x33, 0x31, 0x3A, 0x34,
- 0x33, 0x3A, 0x35, 0x30, 0x3A, 0x65, 0x31, 0x3A, 0x64, 0x35,
- 0x3A, 0x33, 0x34, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x31, 0x37, 0x3A, 0x64, 0x64, 0x3A, 0x61,
- 0x66, 0x3A, 0x33, 0x61, 0x3A, 0x64, 0x65, 0x3A, 0x38, 0x31,
- 0x3A, 0x30, 0x36, 0x3A, 0x36, 0x37, 0x3A, 0x39, 0x61, 0x3A,
- 0x62, 0x33, 0x3A, 0x30, 0x36, 0x3A, 0x32, 0x32, 0x3A, 0x37,
- 0x65, 0x3A, 0x36, 0x34, 0x3A, 0x65, 0x63, 0x3A, 0x66, 0x64,
- 0x3A, 0x30, 0x65, 0x3A, 0x62, 0x39, 0x3A, 0x0A, 0x20, 0x20,
- 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x30, 0x32, 0x3A, 0x32,
- 0x31, 0x3A, 0x30, 0x30, 0x3A, 0x61, 0x31, 0x3A, 0x34, 0x38,
- 0x3A, 0x61, 0x38, 0x3A, 0x33, 0x32, 0x3A, 0x64, 0x31, 0x3A,
- 0x30, 0x35, 0x3A, 0x30, 0x39, 0x3A, 0x36, 0x62, 0x3A, 0x31,
- 0x63, 0x3A, 0x65, 0x62, 0x3A, 0x38, 0x39, 0x3A, 0x31, 0x32,
- 0x3A, 0x36, 0x36, 0x3A, 0x64, 0x38, 0x3A, 0x33, 0x38, 0x3A,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x61,
- 0x31, 0x3A, 0x63, 0x34, 0x3A, 0x35, 0x63, 0x3A, 0x38, 0x39,
- 0x3A, 0x30, 0x39, 0x3A, 0x30, 0x66, 0x3A, 0x66, 0x64, 0x3A,
- 0x65, 0x39, 0x3A, 0x63, 0x30, 0x3A, 0x33, 0x62, 0x3A, 0x31,
- 0x64, 0x3A, 0x66, 0x62, 0x3A, 0x63, 0x64, 0x3A, 0x62, 0x35,
- 0x3A, 0x34, 0x63, 0x3A, 0x33, 0x31, 0x3A, 0x36, 0x38, 0x0A,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41,
- 0x54, 0x45, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x49, 0x43, 0x32, 0x44, 0x43, 0x43, 0x41, 0x6E, 0x36, 0x67,
- 0x41, 0x77, 0x49, 0x42, 0x41, 0x67, 0x49, 0x42, 0x41, 0x54,
- 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x44, 0x64, 0x54, 0x43, 0x42, 0x72, 0x44,
- 0x45, 0x4C, 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55, 0x45,
- 0x42, 0x68, 0x4D, 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45, 0x44,
- 0x41, 0x4F, 0x0A, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67,
- 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68, 0x62,
- 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76, 0x65,
- 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34, 0x78, 0x46, 0x44, 0x41,
- 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D, 0x43,
- 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x0A, 0x55, 0x30,
- 0x78, 0x66, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x51, 0x38, 0x77,
- 0x44, 0x51, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44, 0x41,
- 0x5A, 0x44, 0x51, 0x53, 0x31, 0x7A, 0x62, 0x54, 0x49, 0x78,
- 0x47, 0x44, 0x41, 0x57, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41,
- 0x4D, 0x4D, 0x44, 0x33, 0x64, 0x33, 0x64, 0x79, 0x35, 0x33,
- 0x62, 0x32, 0x78, 0x6D, 0x63, 0x33, 0x4E, 0x73, 0x4C, 0x6D,
- 0x4E, 0x76, 0x0A, 0x62, 0x54, 0x45, 0x66, 0x4D, 0x42, 0x30,
- 0x47, 0x43, 0x53, 0x71, 0x47, 0x53, 0x49, 0x62, 0x33, 0x44,
- 0x51, 0x45, 0x4A, 0x41, 0x52, 0x59, 0x51, 0x61, 0x57, 0x35,
- 0x6D, 0x62, 0x30, 0x42, 0x33, 0x62, 0x32, 0x78, 0x6D, 0x63,
- 0x33, 0x4E, 0x73, 0x4C, 0x6D, 0x4E, 0x76, 0x62, 0x54, 0x45,
- 0x58, 0x4D, 0x42, 0x55, 0x47, 0x43, 0x67, 0x6D, 0x53, 0x4A,
- 0x6F, 0x6D, 0x54, 0x38, 0x69, 0x78, 0x6B, 0x0A, 0x41, 0x51,
- 0x45, 0x4D, 0x42, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54,
- 0x55, 0x30, 0x77, 0x77, 0x48, 0x68, 0x63, 0x4E, 0x4D, 0x6A,
- 0x4D, 0x77, 0x4D, 0x6A, 0x45, 0x31, 0x4D, 0x44, 0x59, 0x79,
- 0x4D, 0x7A, 0x41, 0x33, 0x57, 0x68, 0x63, 0x4E, 0x4D, 0x6A,
- 0x55, 0x78, 0x4D, 0x54, 0x45, 0x78, 0x4D, 0x44, 0x59, 0x79,
- 0x4D, 0x7A, 0x41, 0x33, 0x57, 0x6A, 0x43, 0x42, 0x73, 0x44,
- 0x45, 0x4C, 0x0A, 0x4D, 0x41, 0x6B, 0x47, 0x41, 0x31, 0x55,
- 0x45, 0x42, 0x68, 0x4D, 0x43, 0x56, 0x56, 0x4D, 0x78, 0x45,
- 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x67,
- 0x4D, 0x42, 0x30, 0x31, 0x76, 0x62, 0x6E, 0x52, 0x68, 0x62,
- 0x6D, 0x45, 0x78, 0x45, 0x44, 0x41, 0x4F, 0x42, 0x67, 0x4E,
- 0x56, 0x42, 0x41, 0x63, 0x4D, 0x42, 0x30, 0x4A, 0x76, 0x65,
- 0x6D, 0x56, 0x74, 0x59, 0x57, 0x34, 0x78, 0x0A, 0x46, 0x44,
- 0x41, 0x53, 0x42, 0x67, 0x4E, 0x56, 0x42, 0x41, 0x6F, 0x4D,
- 0x43, 0x33, 0x64, 0x76, 0x62, 0x47, 0x5A, 0x54, 0x55, 0x30,
- 0x78, 0x66, 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52, 0x4D, 0x77,
- 0x45, 0x51, 0x59, 0x44, 0x56, 0x51, 0x51, 0x4C, 0x44, 0x41,
- 0x70, 0x54, 0x5A, 0x58, 0x4A, 0x32, 0x5A, 0x58, 0x49, 0x74,
- 0x63, 0x32, 0x30, 0x79, 0x4D, 0x52, 0x67, 0x77, 0x46, 0x67,
- 0x59, 0x44, 0x0A, 0x56, 0x51, 0x51, 0x44, 0x44, 0x41, 0x39,
- 0x33, 0x64, 0x33, 0x63, 0x75, 0x64, 0x32, 0x39, 0x73, 0x5A,
- 0x6E, 0x4E, 0x7A, 0x62, 0x43, 0x35, 0x6A, 0x62, 0x32, 0x30,
- 0x78, 0x48, 0x7A, 0x41, 0x64, 0x42, 0x67, 0x6B, 0x71, 0x68,
- 0x6B, 0x69, 0x47, 0x39, 0x77, 0x30, 0x42, 0x43, 0x51, 0x45,
- 0x57, 0x45, 0x47, 0x6C, 0x75, 0x5A, 0x6D, 0x39, 0x41, 0x64,
- 0x32, 0x39, 0x73, 0x5A, 0x6E, 0x4E, 0x7A, 0x0A, 0x62, 0x43,
- 0x35, 0x6A, 0x62, 0x32, 0x30, 0x78, 0x46, 0x7A, 0x41, 0x56,
- 0x42, 0x67, 0x6F, 0x4A, 0x6B, 0x69, 0x61, 0x4A, 0x6B, 0x2F,
- 0x49, 0x73, 0x5A, 0x41, 0x45, 0x42, 0x44, 0x41, 0x64, 0x33,
- 0x62, 0x32, 0x78, 0x6D, 0x55, 0x31, 0x4E, 0x4D, 0x4D, 0x46,
- 0x6F, 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63,
- 0x7A, 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43,
- 0x71, 0x42, 0x0A, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49,
- 0x74, 0x41, 0x30, 0x49, 0x41, 0x42, 0x4A, 0x52, 0x77, 0x4B,
- 0x30, 0x62, 0x6B, 0x58, 0x67, 0x39, 0x42, 0x2B, 0x34, 0x38,
- 0x74, 0x4E, 0x41, 0x70, 0x42, 0x51, 0x42, 0x6C, 0x65, 0x2B,
- 0x39, 0x51, 0x64, 0x45, 0x61, 0x7A, 0x36, 0x39, 0x5A, 0x4D,
- 0x33, 0x78, 0x76, 0x71, 0x48, 0x43, 0x50, 0x63, 0x57, 0x48,
- 0x79, 0x7A, 0x4F, 0x4D, 0x45, 0x43, 0x64, 0x0A, 0x54, 0x36,
- 0x59, 0x71, 0x43, 0x71, 0x48, 0x57, 0x6C, 0x54, 0x50, 0x44,
- 0x70, 0x67, 0x4F, 0x59, 0x35, 0x6F, 0x30, 0x46, 0x4E, 0x4C,
- 0x43, 0x58, 0x44, 0x4E, 0x36, 0x6B, 0x78, 0x38, 0x39, 0x54,
- 0x6A, 0x39, 0x47, 0x6A, 0x67, 0x59, 0x6B, 0x77, 0x67, 0x59,
- 0x59, 0x77, 0x48, 0x51, 0x59, 0x44, 0x56, 0x52, 0x30, 0x4F,
- 0x42, 0x42, 0x59, 0x45, 0x46, 0x47, 0x65, 0x75, 0x59, 0x50,
- 0x39, 0x2B, 0x0A, 0x47, 0x77, 0x2B, 0x56, 0x72, 0x68, 0x2B,
- 0x43, 0x57, 0x66, 0x4A, 0x73, 0x56, 0x69, 0x32, 0x54, 0x37,
- 0x78, 0x63, 0x79, 0x4D, 0x42, 0x38, 0x47, 0x41, 0x31, 0x55,
- 0x64, 0x49, 0x77, 0x51, 0x59, 0x4D, 0x42, 0x61, 0x41, 0x46,
- 0x45, 0x63, 0x4B, 0x53, 0x48, 0x36, 0x37, 0x41, 0x71, 0x68,
- 0x61, 0x4A, 0x6C, 0x63, 0x72, 0x47, 0x61, 0x6C, 0x37, 0x59,
- 0x59, 0x74, 0x2F, 0x58, 0x5A, 0x6C, 0x75, 0x0A, 0x4D, 0x41,
- 0x77, 0x47, 0x41, 0x31, 0x55, 0x64, 0x45, 0x77, 0x45, 0x42,
- 0x2F, 0x77, 0x51, 0x43, 0x4D, 0x41, 0x41, 0x77, 0x44, 0x67,
- 0x59, 0x44, 0x56, 0x52, 0x30, 0x50, 0x41, 0x51, 0x48, 0x2F,
- 0x42, 0x41, 0x51, 0x44, 0x41, 0x67, 0x4F, 0x6F, 0x4D, 0x42,
- 0x4D, 0x47, 0x41, 0x31, 0x55, 0x64, 0x4A, 0x51, 0x51, 0x4D,
- 0x4D, 0x41, 0x6F, 0x47, 0x43, 0x43, 0x73, 0x47, 0x41, 0x51,
- 0x55, 0x46, 0x0A, 0x42, 0x77, 0x4D, 0x42, 0x4D, 0x42, 0x45,
- 0x47, 0x43, 0x57, 0x43, 0x47, 0x53, 0x41, 0x47, 0x47, 0x2B,
- 0x45, 0x49, 0x42, 0x41, 0x51, 0x51, 0x45, 0x41, 0x77, 0x49,
- 0x47, 0x51, 0x44, 0x41, 0x4B, 0x42, 0x67, 0x67, 0x71, 0x67,
- 0x52, 0x7A, 0x50, 0x56, 0x51, 0x47, 0x44, 0x64, 0x51, 0x4E,
- 0x49, 0x41, 0x44, 0x42, 0x46, 0x41, 0x69, 0x41, 0x62, 0x79,
- 0x70, 0x51, 0x6F, 0x66, 0x2F, 0x61, 0x79, 0x0A, 0x44, 0x54,
- 0x46, 0x44, 0x55, 0x4F, 0x48, 0x56, 0x4E, 0x42, 0x66, 0x64,
- 0x72, 0x7A, 0x72, 0x65, 0x67, 0x51, 0x5A, 0x6E, 0x6D, 0x72,
- 0x4D, 0x47, 0x49, 0x6E, 0x35, 0x6B, 0x37, 0x50, 0x30, 0x4F,
- 0x75, 0x51, 0x49, 0x68, 0x41, 0x4B, 0x46, 0x49, 0x71, 0x44,
- 0x4C, 0x52, 0x42, 0x51, 0x6C, 0x72, 0x48, 0x4F, 0x75, 0x4A,
- 0x45, 0x6D, 0x62, 0x59, 0x4F, 0x4B, 0x48, 0x45, 0x58, 0x49,
- 0x6B, 0x4A, 0x0A, 0x44, 0x2F, 0x33, 0x70, 0x77, 0x44, 0x73,
- 0x64, 0x2B, 0x38, 0x32, 0x31, 0x54, 0x44, 0x46, 0x6F, 0x0A,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x43,
- 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_server_sm2_cert (sizeof(server_sm2_cert))
-
-/* ./certs/sm2/server-sm2-key.pem */
-static const unsigned char server_sm2_key[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B, 0x45,
- 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x46, 0x6F,
- 0x77, 0x46, 0x41, 0x59, 0x49, 0x4B, 0x6F, 0x45, 0x63, 0x7A,
- 0x31, 0x55, 0x42, 0x67, 0x69, 0x30, 0x47, 0x43, 0x43, 0x71,
- 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59, 0x49, 0x74, 0x41,
- 0x30, 0x49, 0x41, 0x42, 0x4A, 0x52, 0x77, 0x4B, 0x30, 0x62,
- 0x6B, 0x58, 0x67, 0x39, 0x42, 0x2B, 0x34, 0x38, 0x74, 0x4E,
- 0x41, 0x70, 0x42, 0x51, 0x42, 0x6C, 0x65, 0x2B, 0x39, 0x51,
- 0x64, 0x0A, 0x45, 0x61, 0x7A, 0x36, 0x39, 0x5A, 0x4D, 0x33,
- 0x78, 0x76, 0x71, 0x48, 0x43, 0x50, 0x63, 0x57, 0x48, 0x79,
- 0x7A, 0x4F, 0x4D, 0x45, 0x43, 0x64, 0x54, 0x36, 0x59, 0x71,
- 0x43, 0x71, 0x48, 0x57, 0x6C, 0x54, 0x50, 0x44, 0x70, 0x67,
- 0x4F, 0x59, 0x35, 0x6F, 0x30, 0x46, 0x4E, 0x4C, 0x43, 0x58,
- 0x44, 0x4E, 0x36, 0x6B, 0x78, 0x38, 0x39, 0x54, 0x6A, 0x39,
- 0x45, 0x3D, 0x0A, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E,
- 0x44, 0x20, 0x50, 0x55, 0x42, 0x4C, 0x49, 0x43, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_server_sm2_key (sizeof(server_sm2_key))
-
-/* ./certs/sm2/server-sm2-priv.pem */
-static const unsigned char server_sm2_priv[] =
-{
- 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x42, 0x45, 0x47, 0x49, 0x4E,
- 0x20, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B,
- 0x45, 0x59, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x0A, 0x4D, 0x49,
- 0x47, 0x49, 0x41, 0x67, 0x45, 0x41, 0x4D, 0x42, 0x51, 0x47,
- 0x43, 0x43, 0x71, 0x42, 0x48, 0x4D, 0x39, 0x56, 0x41, 0x59,
- 0x49, 0x74, 0x42, 0x67, 0x67, 0x71, 0x67, 0x52, 0x7A, 0x50,
- 0x56, 0x51, 0x47, 0x43, 0x4C, 0x51, 0x52, 0x74, 0x4D, 0x47,
- 0x73, 0x43, 0x41, 0x51, 0x45, 0x45, 0x49, 0x4E, 0x63, 0x7A,
- 0x77, 0x61, 0x46, 0x78, 0x6D, 0x4E, 0x70, 0x44, 0x67, 0x51,
- 0x31, 0x77, 0x0A, 0x51, 0x6F, 0x68, 0x6A, 0x30, 0x45, 0x78,
- 0x2B, 0x44, 0x34, 0x71, 0x62, 0x4C, 0x64, 0x6F, 0x56, 0x71,
- 0x67, 0x35, 0x61, 0x2B, 0x75, 0x31, 0x33, 0x4F, 0x6B, 0x4F,
- 0x6F, 0x6F, 0x55, 0x51, 0x44, 0x51, 0x67, 0x41, 0x45, 0x6C,
- 0x48, 0x41, 0x72, 0x52, 0x75, 0x52, 0x65, 0x44, 0x30, 0x48,
- 0x37, 0x6A, 0x79, 0x30, 0x30, 0x43, 0x6B, 0x46, 0x41, 0x47,
- 0x56, 0x37, 0x37, 0x31, 0x42, 0x30, 0x52, 0x0A, 0x72, 0x50,
- 0x72, 0x31, 0x6B, 0x7A, 0x66, 0x47, 0x2B, 0x6F, 0x63, 0x49,
- 0x39, 0x78, 0x59, 0x66, 0x4C, 0x4D, 0x34, 0x77, 0x51, 0x4A,
- 0x31, 0x50, 0x70, 0x69, 0x6F, 0x4B, 0x6F, 0x64, 0x61, 0x56,
- 0x4D, 0x38, 0x4F, 0x6D, 0x41, 0x35, 0x6A, 0x6D, 0x6A, 0x51,
- 0x55, 0x30, 0x73, 0x4A, 0x63, 0x4D, 0x33, 0x71, 0x54, 0x48,
- 0x7A, 0x31, 0x4F, 0x50, 0x30, 0x51, 0x3D, 0x3D, 0x0A, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x45, 0x4E, 0x44, 0x20, 0x50, 0x52,
- 0x49, 0x56, 0x41, 0x54, 0x45, 0x20, 0x4B, 0x45, 0x59, 0x2D,
- 0x2D, 0x2D, 0x2D, 0x2D, 0x0A
-};
-#define sizeof_server_sm2_priv (sizeof(server_sm2_priv))
-
-#endif /* WOLFSSL_NO_PEM */
-
-#endif /* WOLFSSL_SM2 || WOLFSSL_SM3 || WOLFSSL_SM4 */
-#endif /* WOLFSSL_CERTS_TEST_SM_H */
diff --git a/include/bitcoin/ssl/wolfssl/crl.h b/include/bitcoin/ssl/wolfssl/crl.h
deleted file mode 100644
index 059edeef8..000000000
--- a/include/bitcoin/ssl/wolfssl/crl.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/* crl.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-#ifndef WOLFSSL_CRL_H
-#define WOLFSSL_CRL_H
-
-
-#ifdef HAVE_CRL
-
-#include
-#include
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_LOCAL int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm);
-WOLFSSL_LOCAL void FreeCRL(WOLFSSL_CRL* crl, int dynamic);
-
-WOLFSSL_LOCAL int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type,
- int monitor);
-WOLFSSL_LOCAL int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz,
- int type, int verify);
-WOLFSSL_LOCAL int CheckCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert);
-WOLFSSL_LOCAL int CheckCertCRL_ex(WOLFSSL_CRL* crl, byte* issuerHash,
- byte* serial, int serialSz, byte* serialHash, const byte* extCrlInfo,
- int extCrlInfoSz, void* issuerName);
-#ifdef HAVE_CRL_UPDATE_CB
-WOLFSSL_LOCAL int GetCRLInfo(WOLFSSL_CRL* crl, CrlInfo* info, const byte* buff,
- long sz, int type);
-#endif
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_CRL */
-#endif /* WOLFSSL_CRL_H */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/asn1t.h b/include/bitcoin/ssl/wolfssl/openssl/asn1t.h
deleted file mode 100644
index 47aba84b1..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/asn1t.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/* asn1t.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* asn1t.h for openssl */
-
-#ifndef WOLFSSL_ASN1T_H_
-#define WOLFSSL_ASN1T_H_
-
-#include
-#include
-
-#endif /* WOLFSSL_ASN1T_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/camellia.h b/include/bitcoin/ssl/wolfssl/openssl/camellia.h
deleted file mode 100644
index b3d7c8397..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/camellia.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* camellia.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef WOLFSSL_CAMELLIA_H_
-#define WOLFSSL_CAMELLIA_H_
-
-#include
-
-#endif /* WOLFSSL_CAMELLIA_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/cms.h b/include/bitcoin/ssl/wolfssl/openssl/cms.h
deleted file mode 100644
index 88c4f826d..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/cms.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* cms.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef WOLFSSL_CMS_H_
-#define WOLFSSL_CMS_H_
-
-
-#endif /* WOLFSSL_CMS_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/ocsp.h b/include/bitcoin/ssl/wolfssl/openssl/ocsp.h
deleted file mode 100644
index 588bbd588..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/ocsp.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/* ocsp.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* ocsp.h for libcurl */
-
-#ifndef WOLFSSL_OCSP_H_
-#define WOLFSSL_OCSP_H_
-
-#ifdef HAVE_OCSP
-#include
-
-#ifndef OPENSSL_COEXIST
-
-#if defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) || defined(WOLFSSL_NGINX) ||\
- defined(WOLFSSL_HAPROXY) || defined(HAVE_LIGHTY)
-typedef OcspRequest OCSP_REQUEST;
-typedef OcspResponse OCSP_RESPONSE;
-typedef WOLFSSL_OCSP_BASICRESP OCSP_BASICRESP;
-typedef WOLFSSL_OCSP_SINGLERESP OCSP_SINGLERESP;
-typedef WOLFSSL_OCSP_CERTID OCSP_CERTID;
-typedef WOLFSSL_OCSP_ONEREQ OCSP_ONEREQ;
-typedef WOLFSSL_OCSP_REQ_CTX OCSP_REQ_CTX;
-#endif
-
-#define OCSP_REVOKED_STATUS_NOSTATUS (-1)
-
-
-#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0
-#define OCSP_RESPONSE_STATUS_TRYLATER 3
-
-#define V_OCSP_CERTSTATUS_GOOD 0
-#define V_OCSP_CERTSTATUS_REVOKED 1
-#define V_OCSP_CERTSTATUS_UNKNOWN 2
-
-#define OCSP_resp_find_status wolfSSL_OCSP_resp_find_status
-#define OCSP_cert_status_str wolfSSL_OCSP_cert_status_str
-#define OCSP_check_validity wolfSSL_OCSP_check_validity
-
-#define OCSP_CERTID_free wolfSSL_OCSP_CERTID_free
-#define OCSP_cert_to_id wolfSSL_OCSP_cert_to_id
-
-#define OCSP_BASICRESP_free wolfSSL_OCSP_BASICRESP_free
-#define OCSP_basic_verify wolfSSL_OCSP_basic_verify
-
-#define OCSP_RESPONSE_free wolfSSL_OCSP_RESPONSE_free
-#define d2i_OCSP_RESPONSE_bio wolfSSL_d2i_OCSP_RESPONSE_bio
-#define d2i_OCSP_RESPONSE wolfSSL_d2i_OCSP_RESPONSE
-#define i2d_OCSP_RESPONSE wolfSSL_i2d_OCSP_RESPONSE
-#define OCSP_response_status wolfSSL_OCSP_response_status
-#define OCSP_response_status_str wolfSSL_OCSP_response_status_str
-#define OCSP_response_get1_basic wolfSSL_OCSP_response_get1_basic
-#define OCSP_response_create wolfSSL_OCSP_response_create
-
-#define OCSP_REQUEST_new wolfSSL_OCSP_REQUEST_new
-#define OCSP_REQUEST_free wolfSSL_OCSP_REQUEST_free
-#define i2d_OCSP_REQUEST wolfSSL_i2d_OCSP_REQUEST
-#define OCSP_request_add0_id wolfSSL_OCSP_request_add0_id
-#define OCSP_request_add1_nonce wolfSSL_OCSP_request_add1_nonce
-#define OCSP_check_nonce wolfSSL_OCSP_check_nonce
-#define OCSP_id_get0_info wolfSSL_OCSP_id_get0_info
-#define OCSP_crl_reason_str wolfSSL_OCSP_crl_reason_str
-#define OCSP_REQUEST_add_ext wolfSSL_OCSP_REQUEST_add_ext
-
-#define OCSP_CERTID_dup wolfSSL_OCSP_CERTID_dup
-
-#define i2d_OCSP_REQUEST_bio wolfSSL_i2d_OCSP_REQUEST_bio
-
-#define i2d_OCSP_CERTID wolfSSL_i2d_OCSP_CERTID
-#define d2i_OCSP_CERTID wolfSSL_d2i_OCSP_CERTID
-#define OCSP_SINGLERESP_get0_id wolfSSL_OCSP_SINGLERESP_get0_id
-#define OCSP_id_cmp wolfSSL_OCSP_id_cmp
-#define OCSP_single_get0_status wolfSSL_OCSP_single_get0_status
-#define OCSP_resp_count wolfSSL_OCSP_resp_count
-#define OCSP_resp_get0 wolfSSL_OCSP_resp_get0
-
-#define OCSP_REQ_CTX_new wolfSSL_OCSP_REQ_CTX_new
-#define OCSP_REQ_CTX_free wolfSSL_OCSP_REQ_CTX_free
-#define OCSP_sendreq_new wolfSSL_OCSP_sendreq_new
-#define OCSP_REQ_CTX_set1_req wolfSSL_OCSP_REQ_CTX_set1_req
-#define OCSP_REQ_CTX_add1_header wolfSSL_OCSP_REQ_CTX_add1_header
-#define OCSP_REQ_CTX_http wolfSSL_OCSP_REQ_CTX_http
-#define OCSP_REQ_CTX_nbio wolfSSL_OCSP_REQ_CTX_nbio
-#define OCSP_sendreq_nbio wolfSSL_OCSP_sendreq_nbio
-
-#endif /* !OPENSSL_COEXIST */
-
-#endif /* HAVE_OCSP */
-
-#endif /* WOLFSSL_OCSP_H_ */
-
diff --git a/include/bitcoin/ssl/wolfssl/openssl/opensslconf.h b/include/bitcoin/ssl/wolfssl/openssl/opensslconf.h
deleted file mode 100644
index ac6b55bc7..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/opensslconf.h
+++ /dev/null
@@ -1,8 +0,0 @@
-/* opensslconf.h for openSSL */
-
-
-#ifndef OPENSSL_THREADS
- #define OPENSSL_THREADS
-#endif
-
-
diff --git a/include/bitcoin/ssl/wolfssl/openssl/ossl_typ.h b/include/bitcoin/ssl/wolfssl/openssl/ossl_typ.h
deleted file mode 100644
index 743779f7b..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/ossl_typ.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* ossl_typ.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/openssl/ossl_typ.h
-*/
-
-
-#ifndef WOLFSSL_OSSL_TYP_H_
-#define WOLFSSL_OSSL_TYP_H_
-
-#include
-
-#endif /* !WOLFSSL_OSSL_TYP_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/safestack.h b/include/bitcoin/ssl/wolfssl/openssl/safestack.h
deleted file mode 100644
index 7126af05f..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/safestack.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/* safestack.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* stack.h for openSSL */
-
-#ifndef WOLFSSL_SAFESTACK_H_
-#define WOLFSSL_SAFESTACK_H_
-
-#include
-#include
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
diff --git a/include/bitcoin/ssl/wolfssl/openssl/srp.h b/include/bitcoin/ssl/wolfssl/openssl/srp.h
deleted file mode 100644
index bd4e15414..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/srp.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* srp.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef WOLFSSL_SRP_H_
-#define WOLFSSL_SRP_H_
-
-#include
-
-#ifndef OPENSSL_COEXIST
-
-#define SRP_MINIMAL_N SRP_MODULUS_MIN_BITS
-
-#endif /* !OPENSSL_COEXIST */
-
-#endif /* WOLFSSL_SRP_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/openssl/txt_db.h b/include/bitcoin/ssl/wolfssl/openssl/txt_db.h
deleted file mode 100644
index 8ad0b1831..000000000
--- a/include/bitcoin/ssl/wolfssl/openssl/txt_db.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* txt_db.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef WOLFSSL_TXT_DB_H_
-#define WOLFSSL_TXT_DB_H_
-
-#include
-
-#define WOLFSSL_TXT_DB_MAX_FIELDS 10
-
-struct WOLFSSL_TXT_DB {
- int num_fields;
- WOLF_STACK_OF(WOLFSSL_STRING) *data;
- long error;
- long arg1;
- long arg2;
- wolf_sk_hash_cb hash_fn[WOLFSSL_TXT_DB_MAX_FIELDS];
-};
-
-typedef struct WOLFSSL_TXT_DB WOLFSSL_TXT_DB;
-typedef int (*wolf_lh_compare_cb)(const void* a,
- const void* b);
-
-WOLFSSL_API WOLFSSL_TXT_DB *wolfSSL_TXT_DB_read(WOLFSSL_BIO *in, int num);
-WOLFSSL_API long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db);
-WOLFSSL_API int wolfSSL_TXT_DB_insert(WOLFSSL_TXT_DB *db, WOLFSSL_STRING *row);
-WOLFSSL_API void wolfSSL_TXT_DB_free(WOLFSSL_TXT_DB *db);
-WOLFSSL_API int wolfSSL_TXT_DB_create_index(WOLFSSL_TXT_DB *db, int field,
- void* qual, wolf_sk_hash_cb hash, wolf_lh_compare_cb cmp);
-WOLFSSL_API WOLFSSL_STRING *wolfSSL_TXT_DB_get_by_index(WOLFSSL_TXT_DB *db,
- int idx, WOLFSSL_STRING *value);
-
-#define TXT_DB WOLFSSL_TXT_DB
-
-#define TXT_DB_read wolfSSL_TXT_DB_read
-#define TXT_DB_write wolfSSL_TXT_DB_write
-#define TXT_DB_insert wolfSSL_TXT_DB_insert
-#define TXT_DB_free wolfSSL_TXT_DB_free
-#define TXT_DB_create_index wolfSSL_TXT_DB_create_index
-#define TXT_DB_get_by_index wolfSSL_TXT_DB_get_by_index
-
-#endif /* WOLFSSL_TXT_DB_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/quic.h b/include/bitcoin/ssl/wolfssl/quic.h
deleted file mode 100644
index 263c5c1ba..000000000
--- a/include/bitcoin/ssl/wolfssl/quic.h
+++ /dev/null
@@ -1,310 +0,0 @@
-/* quic.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-/* wolfSSL QUIC API */
-
-#ifndef WOLFSSL_QUIC_H
-#define WOLFSSL_QUIC_H
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#ifdef WOLFSSL_QUIC
-
-#ifndef NO_STDINT_H
- #include
-#endif
-
-/* QUIC operates on three encryption levels which determine
- * which keys/algos are used for de-/encryption. These are
- * kept separately for incoming and outgoing data and.
- * Due to the nature of UDP, more than one might be in use
- * at the same time due to resends or out-of-order arrivals.
- */
-typedef enum wolfssl_encryption_level_t {
- wolfssl_encryption_initial = 0,
- wolfssl_encryption_early_data,
- wolfssl_encryption_handshake,
- wolfssl_encryption_application
-} WOLFSSL_ENCRYPTION_LEVEL;
-
-
-/* All QUIC related callbacks to the application.
- */
-typedef struct wolfssl_quic_method_t WOLFSSL_QUIC_METHOD;
-
-struct wolfssl_quic_method_t {
- /**
- * Provide secrets to the QUIC stack when they become available in the SSL
- * instance during handshake processing. read/write secrets have the same
- * length. A call may only provide one, passing NULL as the other.
- */
- int (*set_encryption_secrets)(WOLFSSL* ssl, WOLFSSL_ENCRYPTION_LEVEL level,
- const uint8_t* read_secret,
- const uint8_t* write_secret,
- size_t secret_len);
- /**
- * Provide handshake packets to the QUIC stack to send to the peer. The
- * QUIC stack will wrap these and take care of re-transmissions.
- */
- int (*add_handshake_data)(WOLFSSL* ssl, WOLFSSL_ENCRYPTION_LEVEL level,
- const uint8_t* data, size_t len);
- /**
- * Flush any buffered packets during handshake.
- */
- int (*flush_flight)(WOLFSSL* ssl);
- /**
- * Send a TLS alert that happened during handshake. In QUIC, such alerts
- * lead to connection shutdown.
- */
- int (*send_alert)(WOLFSSL* ssl, WOLFSSL_ENCRYPTION_LEVEL level,
- uint8_t alert);
-};
-
-
-/**
- * Mark the given SSL context for QUIC protocol handling. Meaning all
- * SSL instances derived from it will inherit this. Provides all callbacks
- * to the QUIC application the SSL stack needs.
- */
-WOLFSSL_API
-int wolfSSL_CTX_set_quic_method(WOLFSSL_CTX* ctx,
- const WOLFSSL_QUIC_METHOD* quic_method);
-/**
- * Mark exactly this SSL instance for QUIC protocol handling.
- * Provides all callbacks to the QUIC application the SSL stack needs.
- */
-WOLFSSL_API
-int wolfSSL_set_quic_method(WOLFSSL* ssl,
- const WOLFSSL_QUIC_METHOD* quic_method);
-
-/**
- * Check if QUIC handling has been installed on the given SSL instance.
- */
-WOLFSSL_API int wolfSSL_is_quic(WOLFSSL* ssl);
-
-/**
- * Return the current encryption level of the SSL instance for READs.
- */
-WOLFSSL_API
-WOLFSSL_ENCRYPTION_LEVEL wolfSSL_quic_read_level(const WOLFSSL* ssl);
-
-/**
- * Return the current encryption level of the SSL instance for WRITEs.
- */
-WOLFSSL_API
-WOLFSSL_ENCRYPTION_LEVEL wolfSSL_quic_write_level(const WOLFSSL* ssl);
-
-
-/**
- * Configure the QUIC transport version to use. On `use_legacy` != 0,
- * selects TLSX_KEY_QUIC_TP_PARAMS_DRAFT, otherwise TLSX_KEY_QUIC_TP_PARAMS.
- * This method is part of the BoringSSL API and replicated here for app
- * portability (as in quictls/openssl).
- */
-WOLFSSL_API
-void wolfSSL_set_quic_use_legacy_codepoint(WOLFSSL* ssl, int use_legacy);
-
-/**
- * Set the TLS extension for the transport parameter version to announce
- * to the peer. Known values are TLSX_KEY_QUIC_TP_PARAMS (V1) and
- * TLSX_KEY_QUIC_TP_PARAMS_DRAFT.
- * Setting it to 0 will announce both V1 and draft versions to a server.
- * Servers will, on 0, select the latest version seen from the client.
- * Default is 0.
- */
-WOLFSSL_API
-void wolfSSL_set_quic_transport_version(WOLFSSL* ssl, int version);
-
-/**
- * Get the configured transport version.
- */
-WOLFSSL_API int wolfSSL_get_quic_transport_version(const WOLFSSL* ssl);
-
-/**
- * Set the raw QUIC transport parameter that will be sent in the TLS extension
- * to the peer, using the configured transport version(s).
- */
-WOLFSSL_API int wolfSSL_set_quic_transport_params(WOLFSSL* ssl,
- const uint8_t* params,
- size_t params_len);
-/**
- * Get the raw QUIC transport parameter as retrieved via TLS Extension
- * from the peer. If the peer announced several versions,
- * return the latest one.
- * If the extension has not arrived yet, initializes out parameter to
- * NULL, resp. 0.
- */
-WOLFSSL_API
-void wolfSSL_get_peer_quic_transport_params(const WOLFSSL* ssl,
- const uint8_t* *out_params,
- size_t* out_params_len);
-
-/**
- * Get the QUIC version negotiated with the peer during the handshake.
- */
-WOLFSSL_API int wolfSSL_get_peer_quic_transport_version(const WOLFSSL* ssl);
-
-#ifdef WOLFSSL_EARLY_DATA
-WOLFSSL_API void wolfSSL_set_quic_early_data_enabled(WOLFSSL* ssl, int enabled);
-#endif
-
-/**
- * Advisory amount of the maximum data a QUIC protocol handler should have
- * in flight. This varies during handshake processing, for example certificate
- * exchange will increase the limit.
- */
-WOLFSSL_API
-size_t wolfSSL_quic_max_handshake_flight_len(const WOLFSSL* ssl,
- WOLFSSL_ENCRYPTION_LEVEL level);
-
-
-/**
- * The QUIC protocol handler provides peer TLS records to the SSL instance
- * during handshake to progress it. The SSL instance will use the registered
- * callbacks to send packets to the peer.
- * Encryption level is provided to indicate how to decrypt the data. Data may
- * be added for levels not yet reached by the SSL instance. However, data
- * may only be added in ever increasing levels and levels may only increase
- * at TLS record boundaries. Any violation will make this function fail.
- */
-WOLFSSL_API
-int wolfSSL_provide_quic_data(WOLFSSL* ssl, WOLFSSL_ENCRYPTION_LEVEL level,
- const uint8_t* data, size_t len);
-
-WOLFSSL_API
-int wolfSSL_quic_do_handshake(WOLFSSL* ssl);
-
-/**
- * Process any CRYPTO data added post-handshake.
- */
-WOLFSSL_API int wolfSSL_process_quic_post_handshake(WOLFSSL* ssl);
-
-/**
- * Process any pending input and flush all output. Can be invoked
- * during and/or after handshake processing.
- */
-WOLFSSL_API int wolfSSL_quic_read_write(WOLFSSL* ssl);
-
-/**
- * Get the AEAD cipher that is currently selected in the SSL instance.
- * Will return NULL if none has been selected so far. This is used by the
- * QUIC stack to encrypt/decrypt packets after the handshake.
- */
-WOLFSSL_API const WOLFSSL_EVP_CIPHER* wolfSSL_quic_get_aead(WOLFSSL* ssl);
-
-/**
- * Use to classify the AEAD cipher for key reuse limits.
- */
-WOLFSSL_API int wolfSSL_quic_aead_is_gcm(const WOLFSSL_EVP_CIPHER* aead_cipher);
-WOLFSSL_API int wolfSSL_quic_aead_is_ccm(const WOLFSSL_EVP_CIPHER* aead_cipher);
-WOLFSSL_API
-int wolfSSL_quic_aead_is_chacha20(const WOLFSSL_EVP_CIPHER* aead_cipher);
-
-/**
- * Get the 'tag' length used by the AEAD cipher. Encryption buffer lengths
- * are plaintext length plus this tag length.
- */
-WOLFSSL_API
-size_t wolfSSL_quic_get_aead_tag_len(const WOLFSSL_EVP_CIPHER* aead_cipher);
-
-/**
- * The message digest currently selected in the SSL instance.
- */
-WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_quic_get_md(WOLFSSL* ssl);
-
-/**
- * The QUIC header protection cipher matching the AEAD cipher currently
- * selected in the SSL instance.
- */
-WOLFSSL_API const WOLFSSL_EVP_CIPHER* wolfSSL_quic_get_hp(WOLFSSL* ssl);
-
-/**
- * Create and initialize a cipher context for use in en- or decryption.
- */
-WOLFSSL_API WOLFSSL_EVP_CIPHER_CTX*
-wolfSSL_quic_crypt_new(const WOLFSSL_EVP_CIPHER* cipher,
- const uint8_t* key, const uint8_t* iv, int encrypt);
-
-/**
- * Use a previously created cipher context to encrypt the given plain text.
- */
-WOLFSSL_API
-int wolfSSL_quic_aead_encrypt(uint8_t* dest, WOLFSSL_EVP_CIPHER_CTX* aead_ctx,
- const uint8_t* plain, size_t plainlen,
- const uint8_t* iv, const uint8_t* aad,
- size_t aadlen);
-/**
- * Use a previously created cipher context to decrypt the given encoded text.
- */
-WOLFSSL_API
-int wolfSSL_quic_aead_decrypt(uint8_t* dest, WOLFSSL_EVP_CIPHER_CTX* ctx,
- const uint8_t* enc, size_t enclen,
- const uint8_t* iv, const uint8_t* aad,
- size_t aadlen);
-
-/**
- * Extract a pseudo-random key, using the given message digest, a secret
- * and a salt. The key size is the size of the digest.
- */
-WOLFSSL_API
-int wolfSSL_quic_hkdf_extract(uint8_t* dest, const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* salt, size_t saltlen);
-/**
- * Expand a pseudo-random key (secret) into a new key, using the mesasge
- * digest and the info bytes.
- */
-WOLFSSL_API
-int wolfSSL_quic_hkdf_expand(uint8_t* dest, size_t destlen,
- const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* info, size_t infolen);
-
-/**
- * Extract and extpand secret, salt and info into a new key.
- */
-WOLFSSL_API
-int wolfSSL_quic_hkdf(uint8_t* dest, size_t destlen,
- const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* salt, size_t saltlen,
- const uint8_t* info, size_t infolen);
-
-/* most common QUIC packet size as of 2022 was 1,200 bytes
- * largest packet size listed in the RFC is 1,392 bytes
- * this gives plenty of breathing room for capacity of records but keeps sizes
- * read from the wire sane */
-#ifndef WOLFSSL_QUIC_MAX_RECORD_CAPACITY
- /* 1024*1024 -- 1 MB */
- #define WOLFSSL_QUIC_MAX_RECORD_CAPACITY (1048576)
-#endif
-
-#endif /* WOLFSSL_QUIC */
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_QUIC_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-impl.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-impl.h
deleted file mode 100644
index debfc3fdc..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-impl.h
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- BLAKE2 reference source code package - reference C implementations
-
- Written in 2012 by Samuel Neves
-
- To the extent possible under law, the author(s) have dedicated all copyright
- and related and neighboring rights to this software to the public domain
- worldwide. This software is distributed without any warranty.
-
- You should have received a copy of the CC0 Public Domain Dedication along with
- this software. If not, see .
-*/
-/* blake2-impl.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-#ifndef WOLFCRYPT_BLAKE2_IMPL_H
-#define WOLFCRYPT_BLAKE2_IMPL_H
-
-#include
-
-static WC_INLINE word32 load32( const void *src )
-{
-#if defined(LITTLE_ENDIAN_ORDER)
- return *( word32 * )( src );
-#else
- const byte *p = ( byte * )src;
- word32 w = *p++;
- w |= ( word32 )( *p++ ) << 8;
- w |= ( word32 )( *p++ ) << 16;
- w |= ( word32 )( *p++ ) << 24;
- return w;
-#endif
-}
-
-static WC_INLINE word64 load64( const void *src )
-{
-#if defined(LITTLE_ENDIAN_ORDER)
- return *( word64 * )( src );
-#else
- const byte *p = ( byte * )src;
- word64 w = *p++;
- w |= ( word64 )( *p++ ) << 8;
- w |= ( word64 )( *p++ ) << 16;
- w |= ( word64 )( *p++ ) << 24;
- w |= ( word64 )( *p++ ) << 32;
- w |= ( word64 )( *p++ ) << 40;
- w |= ( word64 )( *p++ ) << 48;
- w |= ( word64 )( *p++ ) << 56;
- return w;
-#endif
-}
-
-static WC_INLINE void store32( void *dst, word32 w )
-{
-#if defined(LITTLE_ENDIAN_ORDER)
- *( word32 * )( dst ) = w;
-#else
- byte *p = ( byte * )dst;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w;
-#endif
-}
-
-static WC_INLINE void store64( void *dst, word64 w )
-{
-#if defined(LITTLE_ENDIAN_ORDER) && !defined(WOLFSSL_GENERAL_ALIGNMENT)
- *( word64 * )( dst ) = w;
-#else
- byte *p = ( byte * )dst;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w;
-#endif
-}
-
-static WC_INLINE word64 load48( const void *src )
-{
- const byte *p = ( const byte * )src;
- word64 w = *p++;
- w |= ( word64 )( *p++ ) << 8;
- w |= ( word64 )( *p++ ) << 16;
- w |= ( word64 )( *p++ ) << 24;
- w |= ( word64 )( *p++ ) << 32;
- w |= ( word64 )( *p++ ) << 40;
- return w;
-}
-
-static WC_INLINE void store48( void *dst, word64 w )
-{
- byte *p = ( byte * )dst;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w; w >>= 8;
- *p++ = ( byte )w;
-}
-
-static WC_INLINE word32 rotl32( const word32 w, const unsigned c )
-{
- return ( w << c ) | ( w >> ( 32 - c ) );
-}
-
-static WC_INLINE word64 rotl64( const word64 w, const unsigned c )
-{
- return ( w << c ) | ( w >> ( 64 - c ) );
-}
-
-static WC_INLINE word32 rotr32( const word32 w, const unsigned c )
-{
- return ( w >> c ) | ( w << ( 32 - c ) );
-}
-
-static WC_INLINE word64 rotr64( const word64 w, const unsigned c )
-{
- return ( w >> c ) | ( w << ( 64 - c ) );
-}
-
-/* prevents compiler optimizing out memset() */
-static WC_INLINE void secure_zero_memory( void *v, word64 n )
-{
- volatile byte *p = ( volatile byte * )v;
-
- while( n-- ) *p++ = 0;
-}
-
-#endif /* WOLFCRYPT_BLAKE2_IMPL_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-int.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-int.h
deleted file mode 100644
index 1dcb1fd79..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/blake2-int.h
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- BLAKE2 reference source code package - reference C implementations
-
- Written in 2012 by Samuel Neves
-
- To the extent possible under law, the author(s) have dedicated all copyright
- and related and neighboring rights to this software to the public domain
- worldwide. This software is distributed without any warranty.
-
- You should have received a copy of the CC0 Public Domain Dedication along with
- this software. If not, see .
-*/
-/* blake2-int.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-
-#ifndef WOLFCRYPT_BLAKE2_INT_H
-#define WOLFCRYPT_BLAKE2_INT_H
-
-#include
-
-#if defined(__cplusplus)
- extern "C" {
-#endif
-
- enum blake2s_constant
- {
- BLAKE2S_BLOCKBYTES = 64,
- BLAKE2S_OUTBYTES = 32,
- BLAKE2S_KEYBYTES = 32,
- BLAKE2S_SALTBYTES = 8,
- BLAKE2S_PERSONALBYTES = 8
- };
-
- enum blake2b_constant
- {
- BLAKE2B_BLOCKBYTES = 128,
- BLAKE2B_OUTBYTES = 64,
- BLAKE2B_KEYBYTES = 64,
- BLAKE2B_SALTBYTES = 16,
- BLAKE2B_PERSONALBYTES = 16
- };
-
-#pragma pack(push, 1)
- typedef struct __blake2s_param
- {
- byte digest_length; /* 1 */
- byte key_length; /* 2 */
- byte fanout; /* 3 */
- byte depth; /* 4 */
- word32 leaf_length; /* 8 */
- byte node_offset[6];/* 14 */
- byte node_depth; /* 15 */
- byte inner_length; /* 16 */
- /* byte reserved[0]; */
- byte salt[BLAKE2S_SALTBYTES]; /* 24 */
- byte personal[BLAKE2S_PERSONALBYTES]; /* 32 */
- } blake2s_param;
-
- typedef struct __blake2s_state
- {
- word32 h[8];
- word32 t[2];
- word32 f[2];
- byte buf[2 * BLAKE2S_BLOCKBYTES];
- word32 buflen;
- byte last_node;
- } blake2s_state ;
-
- typedef struct __blake2b_param
- {
- byte digest_length; /* 1 */
- byte key_length; /* 2 */
- byte fanout; /* 3 */
- byte depth; /* 4 */
- word32 leaf_length; /* 8 */
- word64 node_offset; /* 16 */
- byte node_depth; /* 17 */
- byte inner_length; /* 18 */
- byte reserved[14]; /* 32 */
- byte salt[BLAKE2B_SALTBYTES]; /* 48 */
- byte personal[BLAKE2B_PERSONALBYTES]; /* 64 */
- } blake2b_param;
-
- typedef struct __blake2b_state
- {
- word64 h[8];
- word64 t[2];
- word64 f[2];
- byte buf[2 * BLAKE2B_BLOCKBYTES];
- word64 buflen;
- byte last_node;
- } blake2b_state;
-
- typedef struct __blake2sp_state
- {
- blake2s_state S[8][1];
- blake2s_state R[1];
- byte buf[8 * BLAKE2S_BLOCKBYTES];
- word32 buflen;
- } blake2sp_state;
-
- typedef struct __blake2bp_state
- {
- blake2b_state S[4][1];
- blake2b_state R[1];
- byte buf[4 * BLAKE2B_BLOCKBYTES];
- word64 buflen;
- } blake2bp_state;
-#pragma pack(pop)
-
- /* Streaming API */
- int blake2s_init( blake2s_state *S, byte outlen );
- int blake2s_init_key( blake2s_state *S, byte outlen, const void *key, byte keylen );
- int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
- int blake2s_update( blake2s_state *S, const byte *in, word32 inlen );
- int blake2s_final( blake2s_state *S, byte *out, byte outlen );
-
- int blake2b_init( blake2b_state *S, byte outlen );
- int blake2b_init_key( blake2b_state *S, byte outlen, const void *key, byte keylen );
- int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
- int blake2b_update( blake2b_state *S, const byte *in, word64 inlen );
- int blake2b_final( blake2b_state *S, byte *out, byte outlen );
-
- int blake2sp_init( blake2sp_state *S, byte outlen );
- int blake2sp_init_key( blake2sp_state *S, byte outlen, const void *key, byte keylen );
- int blake2sp_update( blake2sp_state *S, const byte *in, word32 inlen );
- int blake2sp_final( blake2sp_state *S, byte *out, byte outlen );
-
- int blake2bp_init( blake2bp_state *S, byte outlen );
- int blake2bp_init_key( blake2bp_state *S, byte outlen, const void *key, byte keylen );
- int blake2bp_update( blake2bp_state *S, const byte *in, word64 inlen );
- int blake2bp_final( blake2bp_state *S, byte *out, byte outlen );
-
- /* Simple API */
- int blake2s( byte *out, const void *in, const void *key, byte outlen, word32 inlen, byte keylen );
- int blake2b( byte *out, const void *in, const void *key, byte outlen, word64 inlen, byte keylen );
-
- int blake2sp( byte *out, const void *in, const void *key, byte outlen, word32 inlen, byte keylen );
- int blake2bp( byte *out, const void *in, const void *key, byte outlen, word64 inlen, byte keylen );
-
- static WC_INLINE int blake2( byte *out, const void *in, const void *key, byte outlen, word64 inlen, byte keylen )
- {
- return blake2b( out, in, key, outlen, inlen, keylen );
- }
-
-
-
-#if defined(__cplusplus)
- }
-#endif
-
-#endif /* WOLFCRYPT_BLAKE2_INT_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/compress.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/compress.h
deleted file mode 100644
index 4f401a616..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/compress.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* compress.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/compress.h
-*/
-
-
-#ifndef WOLF_CRYPT_COMPRESS_H
-#define WOLF_CRYPT_COMPRESS_H
-
-#include
-
-#ifdef HAVE_LIBZ
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-
-#define COMPRESS_FIXED 1
-
-#define LIBZ_WINBITS_GZIP 16
-
-
-WOLFSSL_API int wc_Compress(byte*, word32, const byte*, word32, word32);
-WOLFSSL_API int wc_Compress_ex(byte* out, word32 outSz, const byte* in,
- word32 inSz, word32 flags, word32 windowBits);
-WOLFSSL_API int wc_DeCompress(byte*, word32, const byte*, word32);
-WOLFSSL_API int wc_DeCompress_ex(byte* out, word32 outSz, const byte* in,
- word32 inSz, int windowBits);
-WOLFSSL_API int wc_DeCompressDynamic(byte** out, int max, int memoryType,
- const byte* in, word32 inSz, int windowBits, void* heap);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-
-#endif /* HAVE_LIBZ */
-#endif /* WOLF_CRYPT_COMPRESS_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/dilithium.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/dilithium.h
deleted file mode 100644
index abded5ce2..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/dilithium.h
+++ /dev/null
@@ -1,1051 +0,0 @@
-/* dilithium.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/dilithium.h
-*/
-
-/* Interfaces for Dilithium NIST Level 1 (Dilithium512) and Dilithium NIST Level 5
- * (Dilithium1024). */
-
-#ifndef WOLF_CRYPT_DILITHIUM_H
-#define WOLF_CRYPT_DILITHIUM_H
-
-#include
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#if defined(HAVE_DILITHIUM)
-
-#ifdef HAVE_LIBOQS
-#include
-#include
-#endif
-
-#if defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) && \
- defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
- !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
- !defined(WOLFSSL_DILITHIUM_VERIFY_ONLY)
- #define WOLFSSL_DILITHIUM_VERIFY_ONLY
-#endif
-#ifdef WOLFSSL_DILITHIUM_VERIFY_ONLY
- #ifndef WOLFSSL_DILITHIUM_NO_MAKE_KEY
- #define WOLFSSL_DILITHIUM_NO_MAKE_KEY
- #endif
- #ifndef WOLFSSL_DILITHIUM_NO_SIGN
- #define WOLFSSL_DILITHIUM_NO_SIGN
- #endif
-#endif
-
-#if !defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) || \
- !defined(WOLFSSL_DILITHIUM_NO_VERIFY)
- #define WOLFSSL_DILITHIUM_PUBLIC_KEY
-#endif
-#if !defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) || \
- !defined(WOLFSSL_DILITHIUM_NO_SIGN)
- #define WOLFSSL_DILITHIUM_PRIVATE_KEY
-#endif
-
-#if defined(WOLFSSL_DILITHIUM_PUBLIC_KEY) && \
- defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) && \
- !defined(WOLFSSL_DILITHIUM_NO_CHECK_KEY) && \
- !defined(WOLFSSL_DILITHIUM_CHECK_KEY)
- #define WOLFSSL_DILITHIUM_CHECK_KEY
-#endif
-
-#ifdef WOLFSSL_WC_DILITHIUM
- #include
-#ifndef WOLFSSL_DILITHIUM_VERIFY_ONLY
- #include
-#endif
-#endif
-
-#if defined(WC_DILITHIUM_CACHE_PRIV_VECTORS) && \
- !defined(WC_DILITHIUM_CACHE_MATRIX_A)
- #define WC_DILITHIUM_CACHE_MATRIX_A
-#endif
-#if defined(WC_DILITHIUM_CACHE_PUB_VECTORS) && \
- !defined(WC_DILITHIUM_CACHE_MATRIX_A)
- #define WC_DILITHIUM_CACHE_MATRIX_A
-#endif
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* Macros Definitions */
-
-#ifdef WOLFSSL_WC_DILITHIUM
-
-#ifndef WOLFSSL_DILITHIUM_ALIGNMENT
- #if defined(__arch64__)
- #define WOLFSSL_DILITHIUM_ALIGNMENT 8
- #elif defined(__arm__)
- #define WOLFSSL_DILITHIUM_ALIGNMENT 4
- #elif !defined(WOLFSSL_AESNI) && defined(WOLFSSL_GENERAL_ALIGNMENT)
- #define WOLFSSL_DILITHIUM_ALIGNMENT WOLFSSL_GENERAL_ALIGNMENT
- #else
- #define WOLFSSL_DILITHIUM_ALIGNMENT 8
- #endif
-#endif /* WOLFSSL_DILITHIUM_ALIGNMENT */
-
-#define DILITHIUM_LEVEL2_KEY_SIZE 2560
-#define DILITHIUM_LEVEL2_SIG_SIZE 2420
-#define DILITHIUM_LEVEL2_PUB_KEY_SIZE 1312
-#define DILITHIUM_LEVEL2_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL2_PUB_KEY_SIZE + DILITHIUM_LEVEL2_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 1334
-#define DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 2588
-#define DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 3904
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 5344
-
-#define DILITHIUM_LEVEL3_KEY_SIZE 4032
-#define DILITHIUM_LEVEL3_SIG_SIZE 3309
-#define DILITHIUM_LEVEL3_PUB_KEY_SIZE 1952
-#define DILITHIUM_LEVEL3_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL3_PUB_KEY_SIZE + DILITHIUM_LEVEL3_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 1974
-#define DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 4060
-#define DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 6016
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 8204
-
-#define DILITHIUM_LEVEL5_KEY_SIZE 4896
-#define DILITHIUM_LEVEL5_SIG_SIZE 4627
-#define DILITHIUM_LEVEL5_PUB_KEY_SIZE 2592
-#define DILITHIUM_LEVEL5_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL5_PUB_KEY_SIZE + DILITHIUM_LEVEL5_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 2614
-#define DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 4924
-#define DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 7520
-/* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and
- * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 10267
-
-#define ML_DSA_LEVEL2_KEY_SIZE 2560
-#define ML_DSA_LEVEL2_SIG_SIZE 2420
-#define ML_DSA_LEVEL2_PUB_KEY_SIZE 1312
-#define ML_DSA_LEVEL2_PRV_KEY_SIZE \
- (ML_DSA_LEVEL2_PUB_KEY_SIZE + ML_DSA_LEVEL2_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL2_PUB_KEY_DER_SIZE DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL2_PRV_KEY_DER_SIZE DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL2_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define ML_DSA_LEVEL2_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE
-
-#define ML_DSA_LEVEL3_KEY_SIZE 4032
-#define ML_DSA_LEVEL3_SIG_SIZE 3309
-#define ML_DSA_LEVEL3_PUB_KEY_SIZE 1952
-#define ML_DSA_LEVEL3_PRV_KEY_SIZE \
- (ML_DSA_LEVEL3_PUB_KEY_SIZE + ML_DSA_LEVEL3_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL3_PUB_KEY_DER_SIZE DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL3_PRV_KEY_DER_SIZE DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL3_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define ML_DSA_LEVEL3_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE
-
-#define ML_DSA_LEVEL5_KEY_SIZE 4896
-#define ML_DSA_LEVEL5_SIG_SIZE 4627
-#define ML_DSA_LEVEL5_PUB_KEY_SIZE 2592
-#define ML_DSA_LEVEL5_PRV_KEY_SIZE \
- (ML_DSA_LEVEL5_PUB_KEY_SIZE + ML_DSA_LEVEL5_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL5_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL5_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL5_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and
- * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */
-#define ML_DSA_LEVEL5_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE
-
-
-
-/* Modulus. */
-#define DILITHIUM_Q 0x7fe001
-/* Number of bits in modulus. */
-#define DILITHIUM_Q_BITS 23
-/* Number of elements in polynomial. */
-#define DILITHIUM_N 256
-#define MLDSA_N 256
-
-/* Number of dropped bits. */
-#define DILITHIUM_D 13
-/* Maximum value of dropped bits. */
-#define DILITHIUM_D_MAX (1 << DILITHIUM_D)
-/* Half maximum value. */
-#define DILITHIUM_D_MAX_HALF (1 << (DILITHIUM_D - 1))
-/* Number of undropped bits. */
-#define DILITHIUM_U (DILITHIUM_Q_BITS - DILITHIUM_D)
-
-/* Bits in coefficient range of y, GAMMA1, of 2^17 is 17. */
-#define DILITHIUM_GAMMA1_BITS_17 17
-/* Coefficient range of y, GAMMA1, of 2^17. */
-#define DILITHIUM_GAMMA1_17 (1 << 17)
-/* # encoding bits of y is GAMMA1 + 1. */
-#define DILITHIUM_GAMMA1_17_ENC_BITS 18
-/* Coefficient range of y, GAMMA1, of 2^17. */
-/* Bits in coefficient range of y, GAMMA1, of 2^19 is 19. */
-#define DILITHIUM_GAMMA1_BITS_19 19
-/* Coefficient range of y, GAMMA1, of 2^19. */
-#define DILITHIUM_GAMMA1_19 (1 << 19)
-/* # encoding bits of y is GAMMA1 + 1. */
-#define DILITHIUM_GAMMA1_19_ENC_BITS 20
-
-/* Low-order rounding range, GAMMA2, is Q divided by 88. */
-#define DILITHIUM_Q_LOW_88 ((DILITHIUM_Q - 1) / 88)
-/* Absolute low-order rounding range, GAMMA2, is Q divided by 88. */
-#define DILITHIUM_Q_LOW_88_2 (((DILITHIUM_Q - 1) / 88) * 2)
-/* # encoding bits of w1 when range is 88. */
-#define DILITHIUM_Q_HI_88_ENC_BITS 6
-/* Low-order rounding range, GAMMA2, is Q divided by 32. */
-#define DILITHIUM_Q_LOW_32 ((DILITHIUM_Q - 1) / 32)
-/* Absolute low-order rounding range, GAMMA2, is Q divided by 32. */
-#define DILITHIUM_Q_LOW_32_2 (((DILITHIUM_Q - 1) / 32) * 2)
-/* # encoding bits of w1 when range is 32. */
-#define DILITHIUM_Q_HI_32_ENC_BITS 4
-
-/* Private key range, eta, of 2. */
-#define DILITHIUM_ETA_2 2
-/* Bits needed to encode values in range -2..2 as a positive number. */
-#define DILITHIUM_ETA_2_BITS 3
-/* Extract count of valid values. */
-#define DILITHIUM_ETA_2_MOD 15
-/* Private key range, eta, of 4. */
-#define DILITHIUM_ETA_4 4
-/* Bits needed to encode values in range -4..4 as a positive number. */
-#define DILITHIUM_ETA_4_BITS 4
-/* Extract count of valid values. */
-#define DILITHIUM_ETA_4_MOD 9
-
-/* Number of bytes in a polynomial in memory. */
-#define DILITHIUM_POLY_SIZE (DILITHIUM_N * sizeof(sword32))
-
-#ifndef WOLFSSL_NO_ML_DSA_44
-
-/* Fist dimension of A, k, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_K 4
-/* Second dimension of A, l, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_L 4
-/* Private key range, ETA, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_ETA DILITHIUM_ETA_2
-/* Number of bits in private key for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_ETA_BITS DILITHIUM_ETA_2_BITS
-/* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_LAMBDA 128
-/* # +/-1's in polynomial c, TAU, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_TAU 39
-/* BETA = TAU * ETA for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_BETA \
- (PARAMS_ML_DSA_44_TAU * PARAMS_ML_DSA_44_ETA)
-/* Max # 1's in the hint h, OMEGA, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_OMEGA 80
-/* Bits in coefficient range of y, GAMMA1, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_17
-/* Ccoefficient range of y, GAMMA1, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_GAMMA1 (1 << PARAMS_ML_DSA_44_GAMMA1_BITS)
-/* Low-order rounding range, GAMMA2, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_GAMMA2 DILITHIUM_Q_LOW_88
-/* Bits in high-order rounding range, GAMMA2, for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_GAMMA2_HI_BITS 6
-/* Encoding size of w1 in bytes for ML-DSA-44.
- * K * N / 8 * 6 - 6 bits as max value is 43 in high bits. */
-#define PARAMS_ML_DSA_44_W1_ENC_SZ \
- (PARAMS_ML_DSA_44_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_44_GAMMA2_HI_BITS)
-/* Size of memory used for matrix a in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_A_SIZE \
- (PARAMS_ML_DSA_44_K * PARAMS_ML_DSA_44_L * DILITHIUM_POLY_SIZE)
-/* Size of memory used for vector s1 in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_S1_SIZE \
- (PARAMS_ML_DSA_44_L * DILITHIUM_POLY_SIZE)
-/* Encoding size of s1 in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_S1_ENC_SIZE \
- (PARAMS_ML_DSA_44_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_44_ETA_BITS / 8)
-/* Size of memory used for vector s2 in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_S2_SIZE \
- (PARAMS_ML_DSA_44_K * DILITHIUM_POLY_SIZE)
-/* Encoding size of s2 in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_S2_ENC_SIZE \
- (PARAMS_ML_DSA_44_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_44_ETA_BITS / 8)
-/* Encoding size of z in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_Z_ENC_SIZE \
- (PARAMS_ML_DSA_44_S1_SIZE / sizeof(sword32) / 8 * \
- (PARAMS_ML_DSA_44_GAMMA1_BITS + 1))
-/* Encoding size of public key in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_PK_SIZE \
- (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_44_K * DILITHIUM_N * DILITHIUM_U / 8)
-/* Encoding size of signature in bytes for ML-DSA-44. */
-#define PARAMS_ML_DSA_44_SIG_SIZE \
- ((PARAMS_ML_DSA_44_LAMBDA / 4) + \
- PARAMS_ML_DSA_44_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_44_GAMMA1_BITS + 1) + \
- PARAMS_ML_DSA_44_OMEGA + PARAMS_ML_DSA_44_K)
-
-#endif /* WOLFSSL_NO_ML_DSA_44 */
-
-#ifndef WOLFSSL_NO_ML_DSA_65
-
-/* Fist dimension of A, k, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_K 6
-/* Second dimension of A, l, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_L 5
-/* Private key range, ETA, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_ETA DILITHIUM_ETA_4
-/* Number of bits in private key for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_ETA_BITS DILITHIUM_ETA_4_BITS
-/* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_LAMBDA 192
-/* # +/-1's in polynomial c, TAU, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_TAU 49
-/* BETA = TAU * ETA for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_BETA \
- (PARAMS_ML_DSA_65_TAU * PARAMS_ML_DSA_65_ETA)
-/* Max # 1's in the hint h, OMEGA, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_OMEGA 55
-/* Bits in coefficient range of y, GAMMA1, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19
-/* Ccoefficient range of y, GAMMA1, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_GAMMA1 (1 << PARAMS_ML_DSA_65_GAMMA1_BITS)
-/* Low-order rounding range, GAMMA2, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_GAMMA2 DILITHIUM_Q_LOW_32
-/* Bits in high-order rounding range, GAMMA2, for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_GAMMA2_HI_BITS 4
-/* Encoding size of w1 in bytes for ML-DSA-65.
- * K * N / 8 * 4 - 4 bits as max value is 15 in high bits. */
-#define PARAMS_ML_DSA_65_W1_ENC_SZ \
- (PARAMS_ML_DSA_65_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_65_GAMMA2_HI_BITS)
-/* Size of memory used for matrix a in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_A_SIZE \
- (PARAMS_ML_DSA_65_K * PARAMS_ML_DSA_65_L * DILITHIUM_POLY_SIZE)
-/* Size of memory used for vector s1 in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_S1_SIZE \
- (PARAMS_ML_DSA_65_L * DILITHIUM_POLY_SIZE)
-/* Encoding size of s1 in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_S1_ENC_SIZE \
- (PARAMS_ML_DSA_65_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_65_ETA_BITS / 8)
-/* Size of memory used for vector s2 in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_S2_SIZE \
- (PARAMS_ML_DSA_65_K * DILITHIUM_POLY_SIZE)
-/* Encoding size of s2 in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_S2_ENC_SIZE \
- (PARAMS_ML_DSA_65_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_65_ETA_BITS / 8)
-/* Encoding size of z in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_Z_ENC_SIZE \
- (PARAMS_ML_DSA_65_S1_SIZE / sizeof(sword32) / 8 * \
- (PARAMS_ML_DSA_65_GAMMA1_BITS + 1))
-/* Encoding size of public key in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_PK_SIZE \
- (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_65_K * DILITHIUM_N * DILITHIUM_U / 8)
-/* Encoding size of signature in bytes for ML-DSA-65. */
-#define PARAMS_ML_DSA_65_SIG_SIZE \
- ((PARAMS_ML_DSA_65_LAMBDA / 4) + \
- PARAMS_ML_DSA_65_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_65_GAMMA1_BITS + 1) + \
- PARAMS_ML_DSA_65_OMEGA + PARAMS_ML_DSA_65_K)
-
-#endif /* WOLFSSL_NO_ML_DSA_65 */
-
-#ifndef WOLFSSL_NO_ML_DSA_87
-
-/* Fist dimension of A, k, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_K 8
-/* Second dimension of A, l, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_L 7
-/* Private key range, ETA, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_ETA DILITHIUM_ETA_2
-/* Number of bits in private key for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_ETA_BITS DILITHIUM_ETA_2_BITS
-/* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_LAMBDA 256
-/* # +/-1's in polynomial c, TAU, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_TAU 60
-/* BETA = TAU * ETA for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_BETA \
- (PARAMS_ML_DSA_87_TAU * PARAMS_ML_DSA_87_ETA)
-/* Max # 1's in the hint h, OMEGA, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_OMEGA 75
-/* Bits in coefficient range of y, GAMMA1, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19
-/* Ccoefficient range of y, GAMMA1, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_GAMMA1 (1 << PARAMS_ML_DSA_87_GAMMA1_BITS)
-/* Low-order rounding range, GAMMA2, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_GAMMA2 DILITHIUM_Q_LOW_32
-/* Bits in high-order rounding range, GAMMA2, for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_GAMMA2_HI_BITS 4
-/* Encoding size of w1 in bytes for ML-DSA-87.
- * K * N / 8 * 4 - 4 bits as max value is 15 in high bits. */
-#define PARAMS_ML_DSA_87_W1_ENC_SZ \
- (PARAMS_ML_DSA_87_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_87_GAMMA2_HI_BITS)
-/* Size of memory used for matrix A in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_A_SIZE \
- (PARAMS_ML_DSA_87_K * PARAMS_ML_DSA_87_L * DILITHIUM_POLY_SIZE)
-#define PARAMS_ML_DSA_87_S_SIZE 4
-/* Size of memory used for vector s1 in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_S1_SIZE \
- (PARAMS_ML_DSA_87_L * DILITHIUM_POLY_SIZE)
-/* Encoding size of s1 in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_S1_ENC_SIZE \
- (PARAMS_ML_DSA_87_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_87_ETA_BITS / 8)
-/* Size of memory used for vector s2 in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_S2_SIZE \
- (PARAMS_ML_DSA_87_K * DILITHIUM_POLY_SIZE)
-/* Encoding size of s2 in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_S2_ENC_SIZE \
- (PARAMS_ML_DSA_87_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_87_ETA_BITS / 8)
-/* Encoding size of z in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_Z_ENC_SIZE \
- (PARAMS_ML_DSA_87_S1_SIZE / sizeof(sword32) / 8 * \
- (PARAMS_ML_DSA_87_GAMMA1_BITS + 1))
-/* Encoding size of public key in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_PK_SIZE \
- (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_87_K * DILITHIUM_N * DILITHIUM_U / 8)
-/* Encoding size of signature in bytes for ML-DSA-87. */
-#define PARAMS_ML_DSA_87_SIG_SIZE \
- ((PARAMS_ML_DSA_87_LAMBDA / 4) + \
- PARAMS_ML_DSA_87_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_87_GAMMA1_BITS + 1) + \
- PARAMS_ML_DSA_87_OMEGA + PARAMS_ML_DSA_87_K)
-
-#endif /* WOLFSSL_NO_ML_DSA_87 */
-
-
-#ifndef WOLFSSL_NO_ML_DSA_87
-
-#define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_87_W1_ENC_SZ
-/* Maximum collision strength of c-tilde in bytes. */
-#define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_87_LAMBDA
-
-/* Maximum count of elements of a vector with dimension K. */
-#define DILITHIUM_MAX_K_VECTOR_COUNT \
- (PARAMS_ML_DSA_87_K * DILITHIUM_N)
-/* Maximum count of elements of a vector with dimension L. */
-#define DILITHIUM_MAX_L_VECTOR_COUNT \
- (PARAMS_ML_DSA_87_L * DILITHIUM_N)
-/* Maximum count of elements of a matrix with dimension KxL. */
-#define DILITHIUM_MAX_MATRIX_COUNT \
- (PARAMS_ML_DSA_87_K * PARAMS_ML_DSA_87_L * DILITHIUM_N)
-
-#elif !defined(WOLFSSL_NO_ML_DSA_65)
-
-/* Maximum w1 encoding size in bytes. */
-#define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_65_W1_ENC_SZ
-/* Maximum collision strength of c-tilde in bytes. */
-#define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_65_LAMBDA
-
-/* Maximum count of elements of a vector with dimension K. */
-#define DILITHIUM_MAX_K_VECTOR_COUNT \
- (PARAMS_ML_DSA_65_K * DILITHIUM_N)
-/* Maximum count of elements of a vector with dimension L. */
-#define DILITHIUM_MAX_L_VECTOR_COUNT \
- (PARAMS_ML_DSA_65_L * DILITHIUM_N)
-/* Maximum count of elements of a matrix with dimension KxL. */
-#define DILITHIUM_MAX_MATRIX_COUNT \
- (PARAMS_ML_DSA_65_K * PARAMS_ML_DSA_65_L * DILITHIUM_N)
-
-#else
-
-/* Maximum w1 encoding size in bytes. */
-#define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_44_W1_ENC_SZ
-/* Maximum collision strength of c-tilde in bytes. */
-#define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_44_LAMBDA
-
-/* Maximum count of elements of a vector with dimension K. */
-#define DILITHIUM_MAX_K_VECTOR_COUNT \
- (PARAMS_ML_DSA_44_K * DILITHIUM_N)
-/* Maximum count of elements of a vector with dimension L. */
-#define DILITHIUM_MAX_L_VECTOR_COUNT \
- (PARAMS_ML_DSA_44_L * DILITHIUM_N)
-/* Maximum count of elements of a matrix with dimension KxL. */
-#define DILITHIUM_MAX_MATRIX_COUNT \
- (PARAMS_ML_DSA_44_K * PARAMS_ML_DSA_44_L * DILITHIUM_N)
-
-#endif
-
-/* Length of K in bytes. */
-#define DILITHIUM_K_SZ 32
-/* Length of TR in bytes. */
-#define DILITHIUM_TR_SZ 64
-/* Length of public key seed in bytes when expanding a. */
-#define DILITHIUM_PUB_SEED_SZ 32
-/* Length of private key seed in bytes when generating a key. */
-#define DILITHIUM_PRIV_SEED_SZ 64
-
-/* Length of seed when creating vector c. */
-#define DILITHIUM_SEED_SZ 32
-/* Length of seeds created when making a key. */
-#define DILITHIUM_SEEDS_SZ 128
-
-/* Length of MU in bytes. */
-#define DILITHIUM_MU_SZ 64
-/* Length of random in bytes when generating a signature. */
-#define DILITHIUM_RND_SZ 32
-/* Length of private random in bytes when generating a signature. */
-#define DILITHIUM_PRIV_RAND_SEED_SZ 64
-
-/* 5 blocks, each block 21 * 8 bytes = 840 bytes.
- * Minimum required is 256 * 3 = 768. */
-#define DILITHIUM_GEN_A_NBLOCKS 5
-/* Number of bytes to generate with Shake128 when generating A. */
-#define DILITHIUM_GEN_A_BYTES \
- (DILITHIUM_GEN_A_NBLOCKS * WC_SHA3_128_COUNT * 8)
-/* Number of bytes to a block of SHAKE-128 when generating A. */
-#define DILITHIUM_GEN_A_BLOCK_BYTES (WC_SHA3_128_COUNT * 8)
-
-/* Number of bytes to a block of SHAKE-256 when generating c. */
-#define DILITHIUM_GEN_C_BLOCK_BYTES (WC_SHA3_256_COUNT * 8)
-
-
-#ifndef WOLFSSL_DILITHIUM_SMALL
-#if defined(LITTLE_ENDIAN_ORDER) && (WOLFSSL_DILITHIUM_ALIGNMENT == 0)
- /* A block SHAKE-128 output plus one for reading 4 bytes at a time. */
- #define DILITHIUM_REJ_NTT_POLY_H_SIZE (DILITHIUM_GEN_A_BYTES + 1)
-#else
- /* A block SHAKE-128 output. */
- #define DILITHIUM_REJ_NTT_POLY_H_SIZE DILITHIUM_GEN_A_BYTES
-#endif /* LITTLE_ENDIAN_ORDER && WOLFSSL_DILITHIUM_ALIGNMENT == 0 */
-#else
-#if defined(LITTLE_ENDIAN_ORDER) && (WOLFSSL_DILITHIUM_ALIGNMENT == 0)
- /* A block SHAKE-128 output plus one for reading 4 bytes at a time. */
- #define DILITHIUM_REJ_NTT_POLY_H_SIZE (DILITHIUM_GEN_A_BLOCK_BYTES + 1)
-#else
- /* A block SHAKE-128 output. */
- #define DILITHIUM_REJ_NTT_POLY_H_SIZE DILITHIUM_GEN_A_BLOCK_BYTES
-#endif /* LITTLE_ENDIAN_ORDER && WOLFSSL_DILITHIUM_ALIGNMENT == 0 */
-#endif
-
-#elif defined(HAVE_LIBOQS)
-
-#define DILITHIUM_LEVEL2_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_secret_key
-#define DILITHIUM_LEVEL2_SIG_SIZE OQS_SIG_ml_dsa_44_ipd_length_signature
-#define DILITHIUM_LEVEL2_PUB_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_public_key
-#define DILITHIUM_LEVEL2_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL2_PUB_KEY_SIZE+DILITHIUM_LEVEL2_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 1334
-#define DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 2588
-#define DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 3904
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 5344
-
-#define DILITHIUM_LEVEL3_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_secret_key
-#define DILITHIUM_LEVEL3_SIG_SIZE OQS_SIG_ml_dsa_65_ipd_length_signature
-#define DILITHIUM_LEVEL3_PUB_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_public_key
-#define DILITHIUM_LEVEL3_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL3_PUB_KEY_SIZE+DILITHIUM_LEVEL3_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 1974
-#define DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 4060
-#define DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 6016
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 8204
-
-#define DILITHIUM_LEVEL5_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_secret_key
-#define DILITHIUM_LEVEL5_SIG_SIZE OQS_SIG_ml_dsa_87_ipd_length_signature
-#define DILITHIUM_LEVEL5_PUB_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_public_key
-#define DILITHIUM_LEVEL5_PRV_KEY_SIZE \
- (DILITHIUM_LEVEL5_PUB_KEY_SIZE+DILITHIUM_LEVEL5_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 2614
-#define DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 4924
-#define DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 7520
-/* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and
- * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */
-#define DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 10267
-
-#define ML_DSA_LEVEL2_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_secret_key
-#define ML_DSA_LEVEL2_SIG_SIZE OQS_SIG_ml_dsa_44_ipd_length_signature
-#define ML_DSA_LEVEL2_PUB_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_public_key
-#define ML_DSA_LEVEL2_PRV_KEY_SIZE \
- (ML_DSA_LEVEL2_PUB_KEY_SIZE+ML_DSA_LEVEL2_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL2_PUB_KEY_DER_SIZE DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL2_PRV_KEY_DER_SIZE DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL2_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define ML_DSA_LEVEL2_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE
-
-#define ML_DSA_LEVEL3_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_secret_key
-#define ML_DSA_LEVEL3_SIG_SIZE OQS_SIG_ml_dsa_65_ipd_length_signature
-#define ML_DSA_LEVEL3_PUB_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_public_key
-#define ML_DSA_LEVEL3_PRV_KEY_SIZE \
- (ML_DSA_LEVEL3_PUB_KEY_SIZE+ML_DSA_LEVEL3_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL3_PUB_KEY_DER_SIZE DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL3_PRV_KEY_DER_SIZE DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL3_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN PRIVATE KEY-----" and
- * the footer "-----END PRIVATE KEY-----" */
-#define ML_DSA_LEVEL3_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE
-
-#define ML_DSA_LEVEL5_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_secret_key
-#define ML_DSA_LEVEL5_SIG_SIZE OQS_SIG_ml_dsa_87_ipd_length_signature
-#define ML_DSA_LEVEL5_PUB_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_public_key
-#define ML_DSA_LEVEL5_PRV_KEY_SIZE \
- (ML_DSA_LEVEL5_PUB_KEY_SIZE+ML_DSA_LEVEL5_KEY_SIZE)
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define ML_DSA_LEVEL5_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE
-#define ML_DSA_LEVEL5_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE
-#define ML_DSA_LEVEL5_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and
- * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */
-#define ML_DSA_LEVEL5_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE
-
-#endif
-
-#define DILITHIUM_MAX_KEY_SIZE DILITHIUM_LEVEL5_KEY_SIZE
-#define DILITHIUM_MAX_SIG_SIZE DILITHIUM_LEVEL5_SIG_SIZE
-#define DILITHIUM_MAX_PUB_KEY_SIZE DILITHIUM_LEVEL5_PUB_KEY_SIZE
-#define DILITHIUM_MAX_PRV_KEY_SIZE DILITHIUM_LEVEL5_PRV_KEY_SIZE
-/* Buffer sizes large enough to store exported DER encoded keys */
-#define DILITHIUM_MAX_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE
-#define DILITHIUM_MAX_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE
-#define DILITHIUM_MAX_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE
-/* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and
- * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */
-#define DILITHIUM_MAX_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE
-
-
-#ifdef WOLF_PRIVATE_KEY_ID
-#define DILITHIUM_MAX_ID_LEN 32
-#define DILITHIUM_MAX_LABEL_LEN 32
-#endif
-
-/* Structs */
-
-#ifdef WOLFSSL_WC_DILITHIUM
-typedef struct wc_dilithium_params {
- byte level;
- byte k;
- byte l;
- byte eta;
- byte eta_bits;
- byte tau;
- byte beta;
- byte omega;
- word16 lambda;
- byte gamma1_bits;
- sword32 gamma2;
- word32 w1EncSz;
- word16 aSz;
- word16 s1Sz;
- word16 s1EncSz;
- word16 s2Sz;
- word16 s2EncSz;
- word16 zEncSz;
- word16 pkSz;
- word16 sigSz;
-} wc_dilithium_params;
-#endif
-
-struct dilithium_key {
- byte pubKeySet;
- byte prvKeySet;
- byte level; /* 2,3 or 5 */
-
- void* heap; /* heap hint */
-
-#ifdef WOLF_CRYPTO_CB
- void* devCtx;
- int devId;
-#endif
-#ifdef WOLF_PRIVATE_KEY_ID
- byte id[DILITHIUM_MAX_ID_LEN];
- int idLen;
- char label[DILITHIUM_MAX_LABEL_LEN];
- int labelLen;
-#endif
-
-#ifndef WOLFSSL_DILITHIUM_ASSIGN_KEY
-#ifdef USE_INTEL_SPEEDUP
- byte p[DILITHIUM_MAX_PUB_KEY_SIZE+8];
- byte k[DILITHIUM_MAX_KEY_SIZE+8];
-#else
- byte p[DILITHIUM_MAX_PUB_KEY_SIZE];
- byte k[DILITHIUM_MAX_KEY_SIZE];
-#endif
-#else
- const byte* p;
- const byte* k;
-#endif
-
-#ifdef WOLFSSL_WC_DILITHIUM
- const wc_dilithium_params* params;
- wc_Shake shake;
-#ifndef WC_DILITHIUM_FIXED_ARRAY
-#ifdef WC_DILITHIUM_CACHE_MATRIX_A
- sword32* a;
- byte aSet;
-#endif
-#ifdef WC_DILITHIUM_CACHE_PRIV_VECTORS
- sword32* s1;
- sword32* s2;
- sword32* t0;
- byte privVecsSet;
-#endif
-#ifdef WC_DILITHIUM_CACHE_PUB_VECTORS
- sword32* t1;
- byte pubVecSet;
-#endif
-#else
-#ifdef WC_DILITHIUM_CACHE_MATRIX_A
- sword32 a[DILITHIUM_MAX_MATRIX_COUNT];
- byte aSet;
-#endif
-#ifdef WC_DILITHIUM_CACHE_PRIV_VECTORS
- sword32 s1[DILITHIUM_MAX_L_VECTOR_COUNT];
- sword32 s2[DILITHIUM_MAX_K_VECTOR_COUNT];
- sword32 t0[DILITHIUM_MAX_K_VECTOR_COUNT];
- byte privVecsSet;
-#endif
-#ifdef WC_DILITHIUM_CACHE_PUB_VECTORS
- sword32 t1[DILITHIUM_MAX_K_VECTOR_COUNT];
- byte pubVecSet;
-#endif
-#endif
-#if defined(WOLFSSL_DILITHIUM_VERIFY_NO_MALLOC) && \
- defined(WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM)
- sword32 z[DILITHIUM_MAX_L_VECTOR_COUNT];
- sword32 c[DILITHIUM_N];
- sword32 w[DILITHIUM_N];
- sword32 t1[DILITHIUM_N];
- byte w1e[DILITHIUM_MAX_W1_ENC_SZ];
-#ifdef WOLFSSL_DILITHIUM_SMALL_MEM_POLY64
- sword64 t64[DILITHIUM_N];
-#endif
- byte h[DILITHIUM_REJ_NTT_POLY_H_SIZE];
- byte block[DILITHIUM_GEN_C_BLOCK_BYTES];
-#endif /* WOLFSSL_DILITHIUM_VERIFY_NO_MALLOC &&
- * WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM */
-#endif /* WOLFSSL_WC_DILITHIUM */
-};
-
-#ifndef WC_DILITHIUMKEY_TYPE_DEFINED
- typedef struct dilithium_key dilithium_key;
- #define WC_DILITHIUMKEY_TYPE_DEFINED
-#endif
-
-/* Functions */
-
-#ifndef WOLFSSL_DILITHIUM_VERIFY_ONLY
-WOLFSSL_API
-int wc_dilithium_make_key(dilithium_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_dilithium_make_key_from_seed(dilithium_key* key, const byte* seed);
-
-WOLFSSL_API
-int wc_dilithium_sign_msg(const byte* msg, word32 msgLen, byte* sig,
- word32* sigLen, dilithium_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_dilithium_sign_ctx_msg(const byte* ctx, byte ctxLen, const byte* msg,
- word32 msgLen, byte* sig, word32* sigLen, dilithium_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_dilithium_sign_ctx_hash(const byte* ctx, byte ctxLen, int hashAlg,
- const byte* hash, word32 hashLen, byte* sig, word32* sigLen,
- dilithium_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_dilithium_sign_msg_with_seed(const byte* msg, word32 msgLen, byte* sig,
- word32 *sigLen, dilithium_key* key, const byte* seed);
-WOLFSSL_API
-int wc_dilithium_sign_ctx_msg_with_seed(const byte* ctx, byte ctxLen,
- const byte* msg, word32 msgLen, byte* sig, word32 *sigLen,
- dilithium_key* key, const byte* seed);
-WOLFSSL_API
-int wc_dilithium_sign_ctx_hash_with_seed(const byte* ctx, byte ctxLen,
- int hashAlg, const byte* hash, word32 hashLen, byte* sig, word32 *sigLen,
- dilithium_key* key, const byte* seed);
-#endif
-WOLFSSL_API
-int wc_dilithium_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
- word32 msgLen, int* res, dilithium_key* key);
-WOLFSSL_API
-int wc_dilithium_verify_ctx_msg(const byte* sig, word32 sigLen, const byte* ctx,
- word32 ctxLen, const byte* msg, word32 msgLen, int* res,
- dilithium_key* key);
-WOLFSSL_API
-int wc_dilithium_verify_ctx_hash(const byte* sig, word32 sigLen,
- const byte* ctx, word32 ctxLen, int hashAlg, const byte* hash,
- word32 hashLen, int* res, dilithium_key* key);
-
-WOLFSSL_API
-dilithium_key* wc_dilithium_new(void* heap, int devId);
-WOLFSSL_API
-int wc_dilithium_delete(dilithium_key* key, dilithium_key** key_p);
-
-WOLFSSL_API
-int wc_dilithium_init(dilithium_key* key);
-
-WOLFSSL_API
-int wc_dilithium_init_ex(dilithium_key* key, void* heap, int devId);
-
-#ifdef WOLF_PRIVATE_KEY_ID
-WOLFSSL_API
-int wc_dilithium_init_id(dilithium_key* key, const unsigned char* id, int len,
- void* heap, int devId);
-WOLFSSL_API
-int wc_dilithium_init_label(dilithium_key* key, const char* label, void* heap,
- int devId);
-#endif
-
-WOLFSSL_API
-int wc_dilithium_set_level(dilithium_key* key, byte level);
-WOLFSSL_API
-int wc_dilithium_get_level(dilithium_key* key, byte* level);
-WOLFSSL_API
-void wc_dilithium_free(dilithium_key* key);
-
-#ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY
-WOLFSSL_API
-int wc_dilithium_size(dilithium_key* key);
-#endif
-#if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) && \
- defined(WOLFSSL_DILITHIUM_PUBLIC_KEY)
-WOLFSSL_API
-int wc_dilithium_priv_size(dilithium_key* key);
-#endif
-#ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY
-WOLFSSL_API
-int wc_dilithium_pub_size(dilithium_key* key);
-#endif
-#if !defined(WOLFSSL_DILITHIUM_NO_SIGN) || !defined(WOLFSSL_DILITHIUM_NO_VERIFY)
-WOLFSSL_API
-int wc_dilithium_sig_size(dilithium_key* key);
-#endif
-
-#ifdef WOLFSSL_DILITHIUM_CHECK_KEY
-WOLFSSL_API
-int wc_dilithium_check_key(dilithium_key* key);
-#endif
-
-#ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY
-WOLFSSL_API
-int wc_dilithium_import_public(const byte* in, word32 inLen,
- dilithium_key* key);
-#endif
-#ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY
-WOLFSSL_API
-int wc_dilithium_import_private(const byte* priv, word32 privSz,
- dilithium_key* key);
-#define wc_dilithium_import_private_only wc_dilithium_import_private
-WOLFSSL_API
-int wc_dilithium_import_key(const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz, dilithium_key* key);
-#endif
-
-#ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY
-WOLFSSL_API
-int wc_dilithium_export_public(dilithium_key* key, byte* out, word32* outLen);
-#endif
-#ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY
-WOLFSSL_API
-int wc_dilithium_export_private(dilithium_key* key, byte* out, word32* outLen);
-#define wc_dilithium_export_private_only wc_dilithium_export_private
-#endif
-#ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY
-WOLFSSL_API
-int wc_dilithium_export_key(dilithium_key* key, byte* priv, word32 *privSz,
- byte* pub, word32 *pubSz);
-#endif
-
-#ifndef WOLFSSL_DILITHIUM_NO_ASN1
-WOLFSSL_LOCAL int dilithium_get_oid_sum(dilithium_key* key, int* keyFormat);
-#endif /* WOLFSSL_DILITHIUM_NO_ASN1 */
-
-#ifndef WOLFSSL_DILITHIUM_NO_ASN1
-#if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY)
-WOLFSSL_API int wc_Dilithium_PrivateKeyDecode(const byte* input,
- word32* inOutIdx, dilithium_key* key, word32 inSz);
-#endif
-#endif /* WOLFSSL_DILITHIUM_NO_ASN1 */
-#ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY
-WOLFSSL_API int wc_Dilithium_PublicKeyDecode(const byte* input,
- word32* inOutIdx, dilithium_key* key, word32 inSz);
-#endif
-
-#ifndef WOLFSSL_DILITHIUM_NO_ASN1
-#ifdef WC_ENABLE_ASYM_KEY_EXPORT
-WOLFSSL_API int wc_Dilithium_PublicKeyToDer(dilithium_key* key, byte* output,
- word32 inLen, int withAlg);
-#endif
-#if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY)
-WOLFSSL_API int wc_Dilithium_KeyToDer(dilithium_key* key, byte* output,
- word32 inLen);
-#endif
-#ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY
-WOLFSSL_API int wc_Dilithium_PrivateKeyToDer(dilithium_key* key, byte* output,
- word32 inLen);
-#endif
-#endif /* WOLFSSL_DILITHIUM_NO_ASN1 */
-
-#ifdef USE_INTEL_SPEEDUP
-WOLFSSL_LOCAL void wc_mldsa_poly_red_avx2(sword32* a);
-
-WOLFSSL_LOCAL void wc_mldsa_ntt_avx2(sword32* r);
-WOLFSSL_LOCAL void wc_mldsa_ntt_full_avx2(sword32* r);
-WOLFSSL_LOCAL void wc_mldsa_invntt_avx2(sword32* r);
-WOLFSSL_LOCAL void wc_mldsa_invntt_full_avx2(sword32* r);
-
-WOLFSSL_LOCAL void wc_mldsa_mul_avx2(sword32* r, const sword32* a,
- const sword32* b);
-WOLFSSL_LOCAL void wc_mldsa_mul_vec_4_avx2(sword32* r, const sword32* a,
- const sword32* b);
-WOLFSSL_LOCAL void wc_mldsa_mul_vec_5_avx2(sword32* r, const sword32* a,
- const sword32* b);
-WOLFSSL_LOCAL void wc_mldsa_mul_vec_7_avx2(sword32* r, const sword32* a,
- const sword32* b);
-WOLFSSL_LOCAL void wc_mldsa_matrix_mul_4x4_avx2(sword32* r, const sword32* m,
- const sword32* v);
-WOLFSSL_LOCAL void wc_mldsa_matrix_mul_6x5_avx2(sword32* r, const sword32* m,
- const sword32* v);
-WOLFSSL_LOCAL void wc_mldsa_matrix_mul_8x7_avx2(sword32* r, const sword32* m,
- const sword32* v);
-
-WOLFSSL_LOCAL void wc_mldsa_redistribute_21_rand_avx2(word64* s, byte* r0,
- byte* r1, byte* r2, byte* r3);
-WOLFSSL_LOCAL int wc_mldsa_rej_uniform_n_avx2(sword32* a, word32 len,
- const byte* r, word32 rLen);
-WOLFSSL_LOCAL int wc_mldsa_rej_uniform_avx2(sword32* a, word32 len,
- const byte* r, word32 rLen);
-
-WOLFSSL_LOCAL void wc_mldsa_redistribute_17_rand_avx2(word64* s, byte* r0,
- byte* r1, byte* r2, byte* r3);
-WOLFSSL_LOCAL void wc_mldsa_extract_coeffs_eta2_avx2(const byte* z,
- unsigned int zLen, sword32* s, unsigned int* cnt);
-WOLFSSL_LOCAL void wc_mldsa_extract_coeffs_eta4_avx2(const byte* z,
- unsigned int zLen, sword32* s, unsigned int* cnt);
-
-WOLFSSL_LOCAL void wc_mldsa_vec_encode_eta_2_avx2(const sword32* s, byte d,
- byte* p);
-WOLFSSL_LOCAL void wc_mldsa_vec_encode_eta_4_avx2(const sword32* t, byte* p);
-WOLFSSL_LOCAL void wc_mldsa_decode_eta_2_avx2(const byte* p, sword32* s);
-WOLFSSL_LOCAL void wc_mldsa_decode_eta_4_avx2(const byte* p, sword32* s);
-
-WOLFSSL_LOCAL void wc_mldsa_encode_w1_88_avx2(const sword32* w1, byte* w1e);
-WOLFSSL_LOCAL void wc_mldsa_encode_w1_32_avx2(const sword32* w1, byte* w1e);
-
-WOLFSSL_LOCAL void wc_mldsa_vec_encode_t0_t1_avx2(const sword32* t, byte d,
- byte* t0, byte* t1);
-WOLFSSL_LOCAL void wc_mldsa_decode_t0_avx2(const byte* t0, sword32* t);
-WOLFSSL_LOCAL void wc_mldsa_decode_t1_avx2(const byte* t1, sword32* t);
-
-WOLFSSL_LOCAL void wc_mldsa_decode_gamma1_17_avx2(const byte* s, sword32* z);
-WOLFSSL_LOCAL void wc_mldsa_decode_gamma1_19_avx2(const byte* s, sword32* z);
-WOLFSSL_LOCAL void wc_mldsa_encode_gamma1_17_avx2(const sword32* z, byte* s);
-WOLFSSL_LOCAL void wc_mldsa_encode_gamma1_19_avx2(const sword32* z, byte* s);
-
-WOLFSSL_LOCAL void wc_mldsa_decompose_q88_avx2(const sword32* r, sword32* r0,
- sword32* r1);
-WOLFSSL_LOCAL void wc_mldsa_decompose_q32_avx2(const sword32* r, byte k,
- sword32* r0, sword32* r1);
-
-WOLFSSL_LOCAL void wc_mldsa_use_hint_88_avx2(sword32* w1, const byte* h);
-WOLFSSL_LOCAL void wc_mldsa_use_hint_32_avx2(sword32* w1, byte k,
- const byte* h);
-
-WOLFSSL_LOCAL int wc_mldsa_vec_check_low_avx2(const sword32* a, byte l,
- sword32 hi);
-
-WOLFSSL_LOCAL void wc_mldsa_poly_add_avx2(sword32* r, const sword32* a);
-WOLFSSL_LOCAL void wc_mldsa_poly_sub_avx2(sword32* r, const sword32* a);
-WOLFSSL_LOCAL void wc_mldsa_poly_make_pos_avx2(sword32* a);
-#endif
-
-
-#define WC_ML_DSA_DRAFT 10
-
-#define WC_ML_DSA_44 2
-#define WC_ML_DSA_65 3
-#define WC_ML_DSA_87 5
-#define WC_ML_DSA_44_DRAFT (2 + WC_ML_DSA_DRAFT)
-#define WC_ML_DSA_65_DRAFT (3 + WC_ML_DSA_DRAFT)
-#define WC_ML_DSA_87_DRAFT (5 + WC_ML_DSA_DRAFT)
-
-#define DILITHIUM_ML_DSA_44_KEY_SIZE 2560
-#define DILITHIUM_ML_DSA_44_SIG_SIZE 2420
-#define DILITHIUM_ML_DSA_44_PUB_KEY_SIZE 1312
-#define DILITHIUM_ML_DSA_44_PRV_KEY_SIZE \
- (DILITHIUM_ML_DSA_44_PUB_KEY_SIZE + DILITHIUM_ML_DSA_44_KEY_SIZE)
-
-#define DILITHIUM_ML_DSA_65_KEY_SIZE 4032
-#define DILITHIUM_ML_DSA_65_SIG_SIZE 3309
-#define DILITHIUM_ML_DSA_65_PUB_KEY_SIZE 1952
-#define DILITHIUM_ML_DSA_65_PRV_KEY_SIZE \
- (DILITHIUM_ML_DSA_65_PUB_KEY_SIZE + DILITHIUM_ML_DSA_65_KEY_SIZE)
-
-#define DILITHIUM_ML_DSA_87_KEY_SIZE 4896
-#define DILITHIUM_ML_DSA_87_SIG_SIZE 4627
-#define DILITHIUM_ML_DSA_87_PUB_KEY_SIZE 2592
-#define DILITHIUM_ML_DSA_87_PRV_KEY_SIZE \
- (DILITHIUM_ML_DSA_87_PUB_KEY_SIZE + DILITHIUM_ML_DSA_87_KEY_SIZE)
-
-
-#define MlDsaKey dilithium_key
-
-
-#define wc_MlDsaKey_Init(key, heap, devId) \
- wc_dilithium_init_ex(key, heap, devId)
-#define wc_MlDsaKey_SetParams(key, id) \
- wc_dilithium_set_level(key, id)
-#define wc_MlDsaKey_GetParams(key, id) \
- wc_dilithium_get_level(key, id)
-#define wc_MlDsaKey_MakeKey(key, rng) \
- wc_dilithium_make_key(key, rng)
-#define wc_MlDsaKey_ExportPrivRaw(key, out, outLen) \
- wc_dilithium_export_private_only(key, out, outLen)
-#define wc_MlDsaKey_ImportPrivRaw(key, in, inLen) \
- wc_dilithium_import_private_only(in, inLen, key)
-#define wc_MlDsaKey_Sign(key, sig, sigSz, msg, msgSz, rng) \
- wc_dilithium_sign_msg(msg, msgSz, sig, sigSz, key, rng)
-#define wc_MlDsaKey_Free(key) \
- wc_dilithium_free(key)
-#define wc_MlDsaKey_ExportPubRaw(key, out, outLen) \
- wc_dilithium_export_public(key, out, outLen)
-#define wc_MlDsaKey_ImportPubRaw(key, in, inLen) \
- wc_dilithium_import_public(in, inLen, key)
-#define wc_MlDsaKey_Verify(key, sig, sigSz, msg, msgSz, res) \
- wc_dilithium_verify_msg(sig, sigSz, msg, msgSz, res, key)
-
-#define wc_MlDsaKey_PublicKeyToDer(key, output, len, withAlg) \
- wc_Dilithium_PublicKeyToDer(key, output, len, withAlg)
-
-#define wc_MlDsaKey_PrivateKeyToDer(key, output, len) \
- wc_Dilithium_PrivateKeyToDer(key, output, len)
-
-
-WOLFSSL_API int wc_MlDsaKey_GetPrivLen(MlDsaKey* key, int* len);
-WOLFSSL_API int wc_MlDsaKey_GetPubLen(MlDsaKey* key, int* len);
-WOLFSSL_API int wc_MlDsaKey_GetSigLen(MlDsaKey* key, int* len);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_DILITHIUM */
-#endif /* WOLF_CRYPT_DILITHIUM_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/eccsi.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/eccsi.h
deleted file mode 100644
index 1e5a77c9f..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/eccsi.h
+++ /dev/null
@@ -1,176 +0,0 @@
-/* eccsi.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/eccsi.h
-*/
-
-
-#ifndef WOLF_CRYPT_ECCSI_H
-#define WOLF_CRYPT_ECCSI_H
-
-#include
-
-#ifdef WOLFCRYPT_HAVE_ECCSI
-
-#include
-#include
-#include
-#include
-
-#define WOLFCRYPT_ECCSI_KMS
-#define WOLFCRYPT_ECCSI_CLIENT
-
-#define MAX_ECCSI_BYTES (256 / 8)
-
-/* Maximum number of loops of attempting to generate key pairs and signatures.
- */
-#ifndef ECCSI_MAX_GEN_COUNT
- #define ECCSI_MAX_GEN_COUNT 10
-#endif
-
-typedef struct EccsiKeyParams {
- /** Order (q) of elliptic curve as an MP integer. */
- mp_int order;
-#ifdef WOLFCRYPT_ECCSI_CLIENT
- /** A parameter of elliptic curve as an MP integer. */
- mp_int a;
- /** P parameter of elliptic curve as an MP integer. */
- mp_int b;
- /** Prime of elliptic curve as an MP integer. */
- mp_int prime;
-#endif
- /** Base point for elliptic curve operations as an ECC point. */
- ecc_point* base;
-
- /** Bit indicates order (q) is set as an MP integer in ECCSI key. */
- WC_BITFIELD haveOrder:1;
- /** Bit indicates A is set as an MP integer in ECCSI key. */
- WC_BITFIELD haveA:1;
- /** Bit indicates B is set as an MP integer in ECCSI key. */
- WC_BITFIELD haveB:1;
- /** Bit indicates prime is set as an MP integer in ECCSI key. */
- WC_BITFIELD havePrime:1;
- /** Bit indicates base point is set as an MP integer in ECCSI key. */
- WC_BITFIELD haveBase:1;
-} EccsiKeyParams;
-
-/**
- * ECCSI key.
- */
-typedef struct EccsiKey {
- /** ECC key to perform elliptic curve operations with. */
- ecc_key ecc;
- /** ECC key to perform public key elliptic curve operations with. */
- ecc_key pubkey;
- /** ECC parameter in forms that can be used in computation. */
- EccsiKeyParams params;
-#ifdef WOLFCRYPT_ECCSI_CLIENT
- /** Temporary MP integer used during operations.. */
- mp_int tmp;
- /** Secret Signing Key */
- mp_int ssk;
- /** Public Validation Token (PVT) */
- ecc_point* pvt;
-#endif
- /** Generic hash algorithm object. */
- wc_HashAlg hash;
- /** Temporary buffer for use in operations. */
- byte data[(MAX_ECCSI_BYTES * 2) + 1];
-#ifdef WOLFCRYPT_ECCSI_CLIENT
- /** Hash of identity - used in signing/verification. */
- byte idHash[WC_MAX_DIGEST_SIZE];
- /** Size of hash of identity in bytes. */
- byte idHashSz;
-#endif
- /** Heap hint for dynamic memory allocation. */
- void* heap;
- /** Bit indicates KPAK (public key) is in montgomery form. */
- WC_BITFIELD kpakMont:1;
-} EccsiKey;
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_API int wc_InitEccsiKey(EccsiKey* key, void* heap, int devId);
-WOLFSSL_API int wc_InitEccsiKey_ex(EccsiKey* key, int keySz, int curveId,
- void* heap, int devId);
-WOLFSSL_API void wc_FreeEccsiKey(EccsiKey* key);
-
-WOLFSSL_API int wc_MakeEccsiKey(EccsiKey* key, WC_RNG* rng);
-
-WOLFSSL_API int wc_MakeEccsiPair(EccsiKey* key, WC_RNG* rng,
- enum wc_HashType hashType, const byte* id, word32 idSz, mp_int* ssk,
- ecc_point* pvt);
-WOLFSSL_API int wc_ValidateEccsiPair(EccsiKey* key, enum wc_HashType hashType,
- const byte* id, word32 idSz, const mp_int* ssk, ecc_point* pvt,
- int* valid);
-WOLFSSL_API int wc_ValidateEccsiPvt(EccsiKey* key, const ecc_point* pvt,
- int* valid);
-WOLFSSL_API int wc_EncodeEccsiPair(const EccsiKey* key, mp_int* ssk,
- ecc_point* pvt, byte* data, word32* sz);
-WOLFSSL_API int wc_EncodeEccsiSsk(const EccsiKey* key, mp_int* ssk, byte* data,
- word32* sz);
-WOLFSSL_API int wc_EncodeEccsiPvt(const EccsiKey* key, ecc_point* pvt,
- byte* data, word32* sz, int raw);
-WOLFSSL_API int wc_DecodeEccsiPair(const EccsiKey* key, const byte* data,
- word32 sz, mp_int* ssk, ecc_point* pvt);
-WOLFSSL_API int wc_DecodeEccsiSsk(const EccsiKey* key, const byte* data,
- word32 sz, mp_int* ssk);
-WOLFSSL_API int wc_DecodeEccsiPvt(const EccsiKey* key, const byte* data,
- word32 sz, ecc_point* pvt);
-WOLFSSL_API int wc_DecodeEccsiPvtFromSig(const EccsiKey* key, const byte* sig,
- word32 sz, ecc_point* pvt);
-
-WOLFSSL_API int wc_ExportEccsiKey(EccsiKey* key, byte* data, word32* sz);
-WOLFSSL_API int wc_ImportEccsiKey(EccsiKey* key, const byte* data, word32 sz);
-
-WOLFSSL_API int wc_ExportEccsiPrivateKey(EccsiKey* key, byte* data, word32* sz);
-WOLFSSL_API int wc_ImportEccsiPrivateKey(EccsiKey* key, const byte* data,
- word32 sz);
-
-WOLFSSL_API int wc_ExportEccsiPublicKey(EccsiKey* key, byte* data, word32* sz,
- int raw);
-WOLFSSL_API int wc_ImportEccsiPublicKey(EccsiKey* key, const byte* data,
- word32 sz, int trusted);
-
-WOLFSSL_API int wc_HashEccsiId(EccsiKey* key, enum wc_HashType hashType,
- const byte* id, word32 idSz, ecc_point* pvt, byte* hash, byte* hashSz);
-WOLFSSL_API int wc_SetEccsiHash(EccsiKey* key, const byte* hash, byte hashSz);
-WOLFSSL_API int wc_SetEccsiPair(EccsiKey* key, const mp_int* ssk,
- const ecc_point* pvt);
-
-WOLFSSL_API int wc_SignEccsiHash(EccsiKey* key, WC_RNG* rng,
- enum wc_HashType hashType, const byte* msg, word32 msgSz, byte* sig,
- word32* sigSz);
-WOLFSSL_API int wc_VerifyEccsiHash(EccsiKey* key, enum wc_HashType hashType,
- const byte* msg, word32 msgSz, const byte* sig, word32 sigSz,
- int* verified);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFCRYPT_HAVE_ECCSI */
-
-#endif /* WOLF_CRYPT_ECCSI_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_lms.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_lms.h
deleted file mode 100644
index 18e1221ba..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_lms.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* ext_lms.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef EXT_LMS_H
-#define EXT_LMS_H
-
-#if defined(WOLFSSL_HAVE_LMS) && defined(HAVE_LIBLMS)
-
-#include
-
-/* hash-sigs LMS HSS includes */
-#include
-
-#if defined(WOLFSSL_WC_LMS)
-#error "This code is incompatible with wolfCrypt's implementation of LMS."
-#endif
-
-/*
- * The hash-sigs LMS lib supports from MIN_HSS_LEVELS to MAX_HSS_LEVELS
- * number of levels of Merkle trees. It allows for the tree height and
- * winternitz parameter to be unique per level.
- */
-
-/* hss structs */
-typedef struct hss_working_key hss_working_key;
-typedef struct hss_extra_info hss_extra_info;
-
-struct LmsKey {
- unsigned levels; /* Number of tree levels. */
- param_set_t lm_type[MAX_HSS_LEVELS]; /* Height param per level. */
- param_set_t lm_ots_type[MAX_HSS_LEVELS]; /* Winternitz param per level. */
- unsigned char pub[HSS_MAX_PUBLIC_KEY_LEN];
-#ifndef WOLFSSL_LMS_VERIFY_ONLY
- hss_working_key * working_key;
- wc_lms_write_private_key_cb write_private_key; /* Callback to write/update key. */
- wc_lms_read_private_key_cb read_private_key; /* Callback to read key. */
- void * context; /* Context arg passed to callbacks. */
- hss_extra_info info;
-#endif /* ifndef WOLFSSL_LMS_VERIFY_ONLY */
- enum wc_LmsState state;
-};
-
-#endif /* WOLFSSL_HAVE_LMS */
-#endif /* EXT_LMS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_mlkem.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_mlkem.h
deleted file mode 100644
index bd6cd5cc0..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_mlkem.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/* ext_mlkem.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef EXT_KYBER_H
-#define EXT_KYBER_H
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#ifdef WOLFSSL_HAVE_MLKEM
-#include
-
-#if !defined(HAVE_LIBOQS)
-#error "This code requires liboqs"
-#endif
-
-#if defined(WOLFSSL_WC_MLKEM)
-#error "This code is incompatible with wolfCrypt's implementation of Kyber."
-#endif
-
-#if defined (HAVE_LIBOQS)
- #include
-
- #ifndef WOLFSSL_NO_ML_KEM
- #define EXT_KYBER_MAX_PRIV_SZ OQS_KEM_ml_kem_1024_length_secret_key
- #define EXT_KYBER_MAX_PUB_SZ OQS_KEM_ml_kem_1024_length_public_key
- #elif defined(WOLFSSL_MLKEM_KYBER)
- #define EXT_KYBER_MAX_PRIV_SZ OQS_KEM_kyber_1024_length_secret_key
- #define EXT_KYBER_MAX_PUB_SZ OQS_KEM_kyber_1024_length_public_key
- #endif
-#endif
-
-struct KyberKey {
- /* Type of key: KYBER_LEVEL1
- * KYBER_LEVEL3
- * KYBER_LEVEL5
- *
- * Note we don't save the variant (SHAKE vs AES) as that is decided at
- * configuration time. */
- int type;
-
-#ifdef WOLF_CRYPTO_CB
- void* devCtx;
- int devId;
-#endif
-
- byte priv[EXT_KYBER_MAX_PRIV_SZ];
- byte pub[EXT_KYBER_MAX_PUB_SZ];
-};
-
-#if defined (HAVE_LIBOQS)
-WOLFSSL_LOCAL int ext_mlkem_enabled(int id);
-#endif
-#endif /* WOLFSSL_HAVE_MLKEM */
-#endif /* EXT_KYBER_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_xmss.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_xmss.h
deleted file mode 100644
index 788437c83..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/ext_xmss.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/* ext_xmss.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef EXT_XMSS_H
-#define EXT_XMSS_H
-
-#if defined(WOLFSSL_HAVE_XMSS) && defined(HAVE_LIBXMSS)
-
-#include
-
-#include
-#include
-
-#if defined(WOLFSSL_WC_XMSS)
- #error "This code is incompatible with wolfCrypt's implementation of XMSS."
-#endif
-
-struct XmssKey {
- unsigned char pk[XMSS_SHA256_PUBLEN];
- word32 oid;
- int is_xmssmt;
- xmss_params params;
-#ifndef WOLFSSL_XMSS_VERIFY_ONLY
- /* The secret key length is a function of xmss_params. */
- unsigned char * sk;
- word32 sk_len;
- wc_xmss_write_private_key_cb write_private_key; /* Callback to write/update key. */
- wc_xmss_read_private_key_cb read_private_key; /* Callback to read key. */
- void * context; /* Context arg passed to callbacks. */
-#endif /* ifndef WOLFSSL_XMSS_VERIFY_ONLY */
- enum wc_XmssState state;
-};
-
-#endif /* WOLFSSL_HAVE_XMSS */
-#endif /* EXT_XMSS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/falcon.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/falcon.h
deleted file mode 100644
index 904a68c23..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/falcon.h
+++ /dev/null
@@ -1,180 +0,0 @@
-/* falcon.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/falcon.h
-*/
-
-/* Interfaces for Falcon NIST Level 1 (Falcon512) and Falcon NIST Level 5
- * (Falcon1024). */
-
-#ifndef WOLF_CRYPT_FALCON_H
-#define WOLF_CRYPT_FALCON_H
-
-#include
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#if defined(HAVE_PQC) && defined(HAVE_FALCON)
-
-#ifdef HAVE_LIBOQS
-#include
-#include
-#endif
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* Macros Definitions */
-
-#ifdef HAVE_LIBOQS
-#define FALCON_LEVEL1_KEY_SIZE OQS_SIG_falcon_512_length_secret_key
-#define FALCON_LEVEL1_SIG_SIZE OQS_SIG_falcon_512_length_signature
-#define FALCON_LEVEL1_PUB_KEY_SIZE OQS_SIG_falcon_512_length_public_key
-#define FALCON_LEVEL1_PRV_KEY_SIZE (FALCON_LEVEL1_PUB_KEY_SIZE+FALCON_LEVEL1_KEY_SIZE)
-
-#define FALCON_LEVEL5_KEY_SIZE OQS_SIG_falcon_1024_length_secret_key
-#define FALCON_LEVEL5_SIG_SIZE OQS_SIG_falcon_1024_length_signature
-#define FALCON_LEVEL5_PUB_KEY_SIZE OQS_SIG_falcon_1024_length_public_key
-#define FALCON_LEVEL5_PRV_KEY_SIZE (FALCON_LEVEL5_PUB_KEY_SIZE+FALCON_LEVEL5_KEY_SIZE)
-#endif
-
-#define FALCON_MAX_KEY_SIZE FALCON_LEVEL5_KEY_SIZE
-#define FALCON_MAX_SIG_SIZE FALCON_LEVEL5_SIG_SIZE
-#define FALCON_MAX_PUB_KEY_SIZE FALCON_LEVEL5_PUB_KEY_SIZE
-#define FALCON_MAX_PRV_KEY_SIZE FALCON_LEVEL5_PRV_KEY_SIZE
-
-#ifdef WOLF_PRIVATE_KEY_ID
-#define FALCON_MAX_ID_LEN 32
-#define FALCON_MAX_LABEL_LEN 32
-#endif
-
-
-/* Structs */
-
-struct falcon_key {
- bool pubKeySet;
- bool prvKeySet;
- byte level;
-
-#ifdef WOLF_CRYPTO_CB
- void* devCtx;
- int devId;
-#endif
-#ifdef WOLF_PRIVATE_KEY_ID
- byte id[FALCON_MAX_ID_LEN];
- int idLen;
- char label[FALCON_MAX_LABEL_LEN];
- int labelLen;
-#endif
-
- byte p[FALCON_MAX_PUB_KEY_SIZE];
- byte k[FALCON_MAX_PRV_KEY_SIZE];
-};
-
-#ifndef WC_FALCONKEY_TYPE_DEFINED
- typedef struct falcon_key falcon_key;
- #define WC_FALCONKEY_TYPE_DEFINED
-#endif
-
-/* Functions */
-
-WOLFSSL_API
-int wc_falcon_sign_msg(const byte* in, word32 inLen, byte* out, word32 *outLen,
- falcon_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_falcon_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
- word32 msgLen, int* res, falcon_key* key);
-
-WOLFSSL_API
-int wc_falcon_init(falcon_key* key);
-
-WOLFSSL_API
-int wc_falcon_init_ex(falcon_key* key, void* heap, int devId);
-
-#ifdef WOLF_PRIVATE_KEY_ID
-WOLFSSL_API
-int wc_falcon_init_id(falcon_key* key, const unsigned char* id, int len,
- void* heap, int devId);
-WOLFSSL_API
-int wc_falcon_init_label(falcon_key* key, const char* label, void* heap,
- int devId);
-#endif
-
-WOLFSSL_API
-int wc_falcon_set_level(falcon_key* key, byte level);
-WOLFSSL_API
-int wc_falcon_get_level(falcon_key* key, byte* level);
-WOLFSSL_API
-void wc_falcon_free(falcon_key* key);
-
-WOLFSSL_API
-int wc_falcon_import_public(const byte* in, word32 inLen, falcon_key* key);
-WOLFSSL_API
-int wc_falcon_import_private_only(const byte* priv, word32 privSz,
- falcon_key* key);
-WOLFSSL_API
-int wc_falcon_import_private_key(const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz,
- falcon_key* key);
-
-WOLFSSL_API
-int wc_falcon_export_public(falcon_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_falcon_export_private_only(falcon_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_falcon_export_private(falcon_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_falcon_export_key(falcon_key* key, byte* priv, word32 *privSz,
- byte* pub, word32 *pubSz);
-
-WOLFSSL_API
-int wc_falcon_check_key(falcon_key* key);
-
-WOLFSSL_API
-int wc_falcon_size(falcon_key* key);
-WOLFSSL_API
-int wc_falcon_priv_size(falcon_key* key);
-WOLFSSL_API
-int wc_falcon_pub_size(falcon_key* key);
-WOLFSSL_API
-int wc_falcon_sig_size(falcon_key* key);
-
-WOLFSSL_API int wc_Falcon_PrivateKeyDecode(const byte* input, word32* inOutIdx,
- falcon_key* key, word32 inSz);
-WOLFSSL_API int wc_Falcon_PublicKeyDecode(const byte* input, word32* inOutIdx,
- falcon_key* key, word32 inSz);
-WOLFSSL_API int wc_Falcon_KeyToDer(falcon_key* key, byte* output,
- word32 inLen);
-WOLFSSL_API int wc_Falcon_PrivateKeyToDer(falcon_key* key, byte* output,
- word32 inLen);
-WOLFSSL_API int wc_Falcon_PublicKeyToDer(falcon_key* key, byte* output,
- word32 inLen, int withAlg);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_PQC && HAVE_FALCON */
-#endif /* WOLF_CRYPT_FALCON_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/fe_448.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/fe_448.h
deleted file mode 100644
index 46a971750..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/fe_448.h
+++ /dev/null
@@ -1,122 +0,0 @@
-/* fe448_448.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-#ifndef WOLF_CRYPT_FE_448_H
-#define WOLF_CRYPT_FE_448_H
-
-#include
-
-#if defined(HAVE_CURVE448) || defined(HAVE_ED448)
-
-#include
-
-#if defined(HAVE___UINT128_T) && !defined(NO_CURVED448_128BIT) && \
- !defined(NO_INT128)
- #define CURVED448_128BIT
-#endif
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* default to be faster but take more memory */
-#if !defined(CURVE448_SMALL) && !defined(ED448_SMALL)
-
-#if defined(CURVED448_128BIT)
- typedef sword64 fe448;
- #ifndef WOLFSSL_UINT128_T_DEFINED
- #ifdef __SIZEOF_INT128__
- typedef __uint128_t uint128_t;
- typedef __int128_t int128_t;
- typedef __uint128_t word128;
- typedef __int128_t sword128;
- #else
- typedef unsigned long uint128_t __attribute__ ((mode(TI)));
- typedef long int128_t __attribute__ ((mode(TI)));
- typedef uint128_t word128;
- typedef int128_t sword128;
- #endif
- #define WOLFSSL_UINT128_T_DEFINED
- #endif
-#else
- typedef sword32 fe448;
-#endif
-
-WOLFSSL_LOCAL void fe448_init(void);
-WOLFSSL_LOCAL int curve448(byte* r, const byte* n, const byte* a);
-
-#if !defined(CURVED448_128BIT)
-WOLFSSL_LOCAL void fe448_reduce(fe448*);
-#else
-#define fe448_reduce(a) WC_DO_NOTHING
-#endif
-WOLFSSL_LOCAL void fe448_neg(fe448* r, const fe448* a);
-WOLFSSL_LOCAL void fe448_add(fe448* r, const fe448* a, const fe448* b);
-WOLFSSL_LOCAL void fe448_sub(fe448* r, const fe448* a, const fe448* b);
-WOLFSSL_LOCAL void fe448_mul(fe448* r, const fe448* a, const fe448* b);
-WOLFSSL_LOCAL void fe448_sqr(fe448* r, const fe448* a);
-WOLFSSL_LOCAL void fe448_mul39081(fe448* r, const fe448* a);
-WOLFSSL_LOCAL void fe448_invert(fe448* r, const fe448* a);
-
-WOLFSSL_LOCAL void fe448_0(fe448* a);
-WOLFSSL_LOCAL void fe448_1(fe448* a);
-WOLFSSL_LOCAL void fe448_copy(fe448* d, const fe448* a);
-WOLFSSL_LOCAL int fe448_isnonzero(const fe448* a);
-WOLFSSL_LOCAL int fe448_isnegative(const fe448* a);
-
-WOLFSSL_LOCAL void fe448_from_bytes(fe448* r, const unsigned char* b);
-WOLFSSL_LOCAL void fe448_to_bytes(unsigned char* b, const fe448* a);
-
-WOLFSSL_LOCAL void fe448_cmov(fe448* a, const fe448* b, int c);
-WOLFSSL_LOCAL void fe448_pow_2_446_222_1(fe448* r, const fe448* a);
-
-#else
-
-WOLFSSL_LOCAL void fe448_init(void);
-WOLFSSL_LOCAL int curve448(byte* r, const byte* n, const byte* a);
-
-#define fe448_reduce(a) WC_DO_NOTHING
-
-WOLFSSL_LOCAL void fe448_neg(word8* r, const word8* a);
-WOLFSSL_LOCAL void fe448_add(word8* r, const word8* a, const word8* b);
-WOLFSSL_LOCAL void fe448_sub(word8* r, const word8* a, const word8* b);
-WOLFSSL_LOCAL void fe448_mul(word8* r, const word8* a, const word8* b);
-WOLFSSL_LOCAL void fe448_sqr(word8* r, const word8* a);
-WOLFSSL_LOCAL void fe448_mul39081(word8* r, const word8* a);
-WOLFSSL_LOCAL void fe448_invert(word8* r, const word8* a);
-
-WOLFSSL_LOCAL void fe448_norm(byte *a);
-WOLFSSL_LOCAL void fe448_copy(word8* d, const word8* a);
-WOLFSSL_LOCAL int fe448_isnonzero(const word8* a);
-
-WOLFSSL_LOCAL void fe448_cmov(word8* a, const word8* b, int c);
-WOLFSSL_LOCAL void fe448_pow_2_446_222_1(word8* r, const word8* a);
-
-#endif /* !CURVE448_SMALL || !ED448_SMALL */
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_CURVE448 || HAVE_ED448 */
-
-#endif /* WOLF_CRYPT_FE_448_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_448.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_448.h
deleted file mode 100644
index df9a45040..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_448.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/* ge_448.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-#ifndef WOLF_CRYPT_GE_448_H
-#define WOLF_CRYPT_GE_448_H
-
-#include
-
-#ifdef HAVE_ED448
-
-#include
-
-/*
-ge448 means group element.
-
-Here the group is the set of pairs (x,y) of field elements (see fe.h)
-satisfying -x^2 + y^2 = 1 + d x^2y^2
-where d = -39081.
-
-Representations:
- ge448_p2 (projective) : (X:Y:Z) satisfying x=X/Z, y=Y/Z
- ge448_precomp (affine): (x,y)
-*/
-
-#ifdef ED448_SMALL
- typedef byte ge448;
- #define GE448_WORDS 56
-#elif defined(CURVED448_128BIT)
- typedef sword64 ge448;
- #define GE448_WORDS 8
-#else
- typedef sword32 ge448;
- #define GE448_WORDS 16
-#endif
-
-typedef struct {
- ge448 X[GE448_WORDS];
- ge448 Y[GE448_WORDS];
- ge448 Z[GE448_WORDS];
-} ge448_p2;
-
-
-WOLFSSL_LOCAL int ge448_compress_key(byte* out, const byte* xIn, const byte* yIn);
-WOLFSSL_LOCAL int ge448_from_bytes_negate_vartime(ge448_p2 *r, const byte *b);
-
-WOLFSSL_LOCAL int ge448_double_scalarmult_vartime(ge448_p2 *r, const byte *a,
- const ge448_p2 *A, const byte *b);
-WOLFSSL_LOCAL int ge448_scalarmult_base(ge448_p2* h, const byte* a);
-/* Only performs a weak reduce. */
-WOLFSSL_LOCAL void sc448_reduce(byte* b);
-WOLFSSL_LOCAL void sc448_muladd(byte* r, const byte* a, const byte* b, const byte* d);
-WOLFSSL_LOCAL void ge448_to_bytes(byte *s, const ge448_p2 *h);
-
-
-#ifndef ED448_SMALL
-typedef struct {
- ge448 x[GE448_WORDS];
- ge448 y[GE448_WORDS];
-} ge448_precomp;
-
-#endif /* !ED448_SMALL */
-
-#endif /* HAVE_ED448 */
-
-#endif /* WOLF_CRYPT_GE_448_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_operations.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_operations.h
deleted file mode 100644
index a9cc47584..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/ge_operations.h
+++ /dev/null
@@ -1,134 +0,0 @@
-/* ge_operations.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
- /* Based On Daniel J Bernstein's ed25519 Public Domain ref10 work. */
-
-#ifndef WOLF_CRYPT_GE_OPERATIONS_H
-#define WOLF_CRYPT_GE_OPERATIONS_H
-
-#include
-
-#ifdef HAVE_ED25519
-
-#include
-
-/*
-ge means group element.
-
-Here the group is the set of pairs (x,y) of field elements (see fe.h)
-satisfying -x^2 + y^2 = 1 + d x^2y^2
-where d = -121665/121666.
-
-Representations:
- ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z
- ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
- ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T
- ge_precomp (Duif): (y+x,y-x,2dxy)
-*/
-
-#ifdef ED25519_SMALL
- ALIGN16 typedef byte ge[F25519_SIZE];
-#elif defined(CURVED25519_ASM_64BIT)
- ALIGN16 typedef sword64 ge[4];
-#elif defined(CURVED25519_ASM_32BIT)
- ALIGN16 typedef sword32 ge[8];
-#elif defined(CURVED25519_128BIT)
- ALIGN16 typedef sword64 ge[5];
-#else
- ALIGN16 typedef sword32 ge[10];
-#endif
-
-typedef struct {
- ge X;
- ge Y;
- ge Z;
-} ge_p2;
-
-typedef struct {
- ge X;
- ge Y;
- ge Z;
- ge T;
-} ge_p3;
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_LOCAL int ge_compress_key(byte* out, const byte* xIn, const byte* yIn,
- word32 keySz);
-WOLFSSL_LOCAL int ge_frombytes_negate_vartime(ge_p3 *h,const unsigned char *s);
-
-WOLFSSL_LOCAL int ge_double_scalarmult_vartime(ge_p2 *r, const unsigned char *a,
- const ge_p3 *A, const unsigned char *b);
-WOLFSSL_LOCAL void ge_scalarmult_base(ge_p3 *h,const unsigned char *a);
-WOLFSSL_LOCAL void sc_reduce(byte* s);
-WOLFSSL_LOCAL void sc_muladd(byte* s, const byte* a, const byte* b,
- const byte* c);
-WOLFSSL_LOCAL void ge_tobytes(unsigned char *s,const ge_p2 *h);
-#ifndef GE_P3_TOBYTES_IMPL
-#define ge_p3_tobytes(s, h) ge_tobytes((s), (const ge_p2 *)(h))
-#else
-WOLFSSL_LOCAL void ge_p3_tobytes(unsigned char *s,const ge_p3 *h);
-#endif
-
-
-#ifndef ED25519_SMALL
-typedef struct {
- ge X;
- ge Y;
- ge Z;
- ge T;
-} ge_p1p1;
-
-typedef struct {
- ge yplusx;
- ge yminusx;
- ge xy2d;
-} ge_precomp;
-
-typedef struct {
- ge YplusX;
- ge YminusX;
- ge Z;
- ge T2d;
-} ge_cached;
-
-#ifdef CURVED25519_ASM
-WOLFSSL_LOCAL void ge_p1p1_to_p2(ge_p2 *r, const ge_p1p1 *p);
-WOLFSSL_LOCAL void ge_p1p1_to_p3(ge_p3 *r, const ge_p1p1 *p);
-WOLFSSL_LOCAL void ge_p2_dbl(ge_p1p1 *r, const ge_p2 *p);
-#define ge_p3_dbl(r, p) ge_p2_dbl((ge_p1p1 *)(r), (ge_p2 *)(p))
-WOLFSSL_LOCAL void ge_madd(ge_p1p1 *r, const ge_p3 *p, const ge_precomp *q);
-WOLFSSL_LOCAL void ge_msub(ge_p1p1 *r, const ge_p3 *p, const ge_precomp *q);
-WOLFSSL_LOCAL void ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q);
-WOLFSSL_LOCAL void ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q);
-#endif
-#endif /* !ED25519_SMALL */
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_ED25519 */
-
-#endif /* WOLF_CRYPT_GE_OPERATIONS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/integer.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/integer.h
deleted file mode 100644
index 1b63c25eb..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/integer.h
+++ /dev/null
@@ -1,449 +0,0 @@
-/* integer.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-/*
- * Based on public domain LibTomMath 0.38 by Tom St Denis, tomstdenis@iahu.ca,
- * http://math.libtomcrypt.com
- */
-
-
-#ifndef WOLF_CRYPT_INTEGER_H
-#define WOLF_CRYPT_INTEGER_H
-
-/* may optionally use SP math all or fast math instead. The heap math requires
- * realloc and is not timing resistant. The SP math all is recommended for new
- * designs.
- */
-
-#ifndef USE_INTEGER_HEAP_MATH
-
- /* Some platforms (like FIPS) may only include integer.h for math. */
- /* Handle variations of fast math, integer and sp math */
- #include
-
-#else
-
-#include
-#include
-#include
-
-#if !defined(CHAR_BIT) && !defined(NO_LIMITS_H)
- #include
-#endif
-
-#include
-
-
-#ifdef __cplusplus
-extern "C" {
-
-/* C++ compilers don't like assigning void * to mp_digit * */
-#define OPT_CAST(x) (x *)
-
-#elif defined(_SH3)
-
-/* SuperH SH3 compiler doesn't like assigning voi* to mp_digit* */
-#define OPT_CAST(x) (x *)
-
-#else
-
-/* C on the other hand doesn't care */
-#define OPT_CAST(x) /* null expansion */
-
-#endif /* __cplusplus */
-
-
-/* detect 64-bit mode if possible */
-#if (defined(__x86_64__) || defined(__aarch64__)) && !(defined (_MSC_VER) && defined(__clang__))
- #if !(defined(MP_64BIT) && defined(MP_16BIT) && defined(MP_8BIT))
- #define MP_64BIT
- #endif
-#endif
-/* if intel compiler doesn't provide 128 bit type don't turn on 64bit */
-#if defined(MP_64BIT) && defined(__INTEL_COMPILER) && !defined(HAVE___UINT128_T)
- #undef MP_64BIT
-#endif
-
-
-/* allow user to define on mp_digit, mp_word, DIGIT_BIT types */
-#ifndef WOLFSSL_BIGINT_TYPES
-
-/* some default configurations.
- *
- * A "mp_digit" must be able to hold DIGIT_BIT + 1 bits
- * A "mp_word" must be able to hold 2*DIGIT_BIT + 1 bits
- *
- * At the very least a mp_digit must be able to hold 7 bits
- * [any size beyond that is ok provided it doesn't overflow the data type]
- */
-#ifdef MP_8BIT
- /* 8-bit */
- typedef unsigned char mp_digit;
- typedef unsigned short mp_word;
- /* don't define DIGIT_BIT, so its calculated below */
-#elif defined(MP_16BIT)
- /* 16-bit */
- typedef unsigned int mp_digit;
- typedef unsigned long mp_word;
- /* don't define DIGIT_BIT, so its calculated below */
-#elif defined(NO_64BIT)
- /* 32-bit forced to 16-bit */
- typedef unsigned short mp_digit;
- typedef unsigned int mp_word;
- #define DIGIT_BIT 12
-#elif defined(MP_64BIT)
- /* 64-bit */
- /* for GCC only on supported platforms */
- typedef unsigned long long mp_digit; /* 64 bit type, 128 uses mode(TI) */
- typedef unsigned long mp_word __attribute__ ((mode(TI)));
- #define DIGIT_BIT 60
-#else
- /* 32-bit default case */
-
- #if defined(_MSC_VER) || defined(__BORLANDC__)
- typedef unsigned __int64 ulong64;
- #else
- typedef unsigned long long ulong64;
- #endif
-
- typedef unsigned int mp_digit; /* long could be 64 now, changed TAO */
- typedef ulong64 mp_word;
-
- #ifdef MP_31BIT
- /* this is an extension that uses 31-bit digits */
- #define DIGIT_BIT 31
- #else
- /* default case is 28-bit digits, defines MP_28BIT as a handy test macro */
- #define DIGIT_BIT 28
- #define MP_28BIT
- #endif
-#endif
-
-#endif /* WOLFSSL_BIGINT_TYPES */
-
-/* otherwise the bits per digit is calculated automatically from the size of
- a mp_digit */
-#ifndef DIGIT_BIT
- #define DIGIT_BIT ((int)((CHAR_BIT * sizeof(mp_digit) - 1)))
- /* bits per digit */
-#endif
-
-#define MP_DIGIT_BIT DIGIT_BIT
-#define MP_MASK ((((mp_digit)1)<<((mp_digit)DIGIT_BIT))-((mp_digit)1))
-#define MP_DIGIT_MAX MP_MASK
-
-/* equalities */
-#define MP_LT (-1) /* less than */
-#define MP_EQ 0 /* equal to */
-#define MP_GT 1 /* greater than */
-
-#define MP_ZPOS 0 /* positive integer */
-#define MP_NEG 1 /* negative */
-
-#define MP_OKAY 0 /* ok result */
-#define MP_RANGE MP_NOT_INF
-
-#define MP_YES 1 /* yes response */
-#define MP_NO 0 /* no response */
-
-/* Primality generation flags */
-#define LTM_PRIME_BBS 0x0001 /* BBS style prime */
-#define LTM_PRIME_SAFE 0x0002 /* Safe prime (p-1)/2 == prime */
-#define LTM_PRIME_2MSB_ON 0x0008 /* force 2nd MSB to 1 */
-
-typedef int mp_err;
-
-/* define this to use lower memory usage routines (exptmods mostly) */
-#define MP_LOW_MEM
-
-/* default precision */
-#ifndef MP_PREC
- #ifndef MP_LOW_MEM
- #define MP_PREC 32 /* default digits of precision */
- #else
- #define MP_PREC 1 /* default digits of precision */
- #endif
-#endif
-
-/* size of comba arrays, should be at least 2 * 2**(BITS_PER_WORD -
- BITS_PER_DIGIT*2) */
-#define MP_WARRAY ((mp_word)1 << (sizeof(mp_word) * CHAR_BIT - 2 * DIGIT_BIT + 1))
-
-/* No point in dynamically allocating mp_int when it is very small.
- * The dp field will grow and shrink dynamically.
- */
-/* Declare a statically allocated mp_int. */
-#define DECL_MP_INT_SIZE(name, bits) \
- mp_int name[1]
-/* Declare statically allocated mp_int. */
-#define DECL_MP_INT_SIZE_DYN(name, bits, max) \
- mp_int name[1]
-/* Zero out mp_int of minimal size. */
-#define NEW_MP_INT_SIZE(name, bits, heap, type) \
- XMEMSET(name, 0, sizeof(mp_int))
-/* Dispose of static mp_int. */
-#define FREE_MP_INT_SIZE(name, heap, type) \
- do { \
- if ((name) != NULL) { \
- mp_free(name); \
- } \
- } while (0)
-/* Initialize an mp_int. */
-#define INIT_MP_INT_SIZE(name, bits) \
- mp_init(name)
-/* Type to cast to when using size marcos. */
-#define MP_INT_SIZE mp_int
-
-#ifdef HAVE_WOLF_BIGINT
- /* raw big integer */
- typedef struct WC_BIGINT {
- byte* buf;
- word32 len;
- void* heap;
- } WC_BIGINT;
- #define WOLF_BIGINT_DEFINED
-#endif
-
-#define wc_mp_size_t int
-#define wc_mp_sign_t int
-
-/* the mp_int structure */
-typedef struct mp_int {
- int used, alloc, sign;
- mp_digit *dp;
-
-#ifdef HAVE_WOLF_BIGINT
- struct WC_BIGINT raw; /* unsigned binary (big endian) */
-#endif
-} mp_int;
-
-/* wolf big int and common functions */
-#include
-
-
-/* callback for mp_prime_random, should fill dst with random bytes and return
- how many read [up to len] */
-typedef int ltm_prime_callback(unsigned char *dst, int len, void *dat);
-
-
-#define USED(m) ((m)->used)
-#define DIGIT(m,k) ((m)->dp[(k)])
-#define SIGN(m) ((m)->sign)
-
-
-/* ---> Basic Manipulations <--- */
-#define mp_iszero(a) (((a)->used == 0) ? MP_YES : MP_NO)
-#define mp_isone(a) \
- (((((a)->used == 1)) && ((a)->dp[0] == 1u) && ((a)->sign == MP_ZPOS)) \
- ? MP_YES : MP_NO)
-#define mp_iseven(a) \
- (((a)->used > 0 && (((a)->dp[0] & 1u) == 0u)) ? MP_YES : MP_NO)
-#define mp_isodd(a) \
- (((a)->used > 0 && (((a)->dp[0] & 1u) == 1u)) ? MP_YES : MP_NO)
-#define mp_isneg(a) (((a)->sign != MP_ZPOS) ? MP_YES : MP_NO)
-#define mp_setneg(a) ((a)->sign = MP_NEG)
-#define mp_isword(a, w) \
- ((((a)->used == 1) && ((a)->dp[0] == (w))) || (((w) == 0) && ((a)->used == 0)) \
- ? MP_YES : MP_NO)
-/* Number of bits used based on used field only. */
-#define mp_bitsused(a) ((a)->used * DIGIT_BIT)
-
-/* number of primes */
-#ifdef MP_8BIT
- #define PRIME_SIZE 31
-#else
- #define PRIME_SIZE 256
-#endif
-
-#ifndef MAX_INVMOD_SZ
- #if defined(WOLFSSL_MYSQL_COMPATIBLE)
- #define MAX_INVMOD_SZ 8192
- #else
- #define MAX_INVMOD_SZ 4096
- #endif
-#endif
-
-#define mp_prime_random(a, t, size, bbs, cb, dat) \
- mp_prime_random_ex(a, t, ((size) * 8) + 1, ((bbs)==1)?LTM_PRIME_BBS:0, cb, dat)
-
-#define mp_read_mag(mp, str, len) mp_read_unsigned_bin((mp), (str), (len))
-#define mp_mag_size(mp) mp_unsigned_bin_size(mp)
-#define mp_tomag(mp, str) mp_to_unsigned_bin((mp), (str))
-
-#define MP_RADIX_BIN 2
-#define MP_RADIX_OCT 8
-#define MP_RADIX_DEC 10
-#define MP_RADIX_HEX 16
-#define MP_RADIX_MAX 64
-
-#define mp_tobinary(M, S) mp_toradix((M), (S), MP_RADIX_BIN)
-#define mp_tooctal(M, S) mp_toradix((M), (S), MP_RADIX_OCT)
-#define mp_todecimal(M, S) mp_toradix((M), (S), MP_RADIX_DEC)
-#define mp_tohex(M, S) mp_toradix((M), (S), MP_RADIX_HEX)
-
-#define s_mp_mul(a, b, c) s_mp_mul_digs(a, b, c, (a)->used + (b)->used + 1)
-
-#if defined(HAVE_ECC) || defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) || \
- defined(WOLFSSL_DEBUG_MATH) || defined(DEBUG_WOLFSSL)
-extern const char *mp_s_rmap;
-#endif
-
-/* functions needed by Rsa */
-MP_API int mp_init (mp_int * a);
-MP_API void mp_clear (mp_int * a);
-MP_API void mp_free (mp_int * a);
-MP_API void mp_forcezero(mp_int * a);
-MP_API int mp_unsigned_bin_size(const mp_int * a);
-MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
-MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b);
-MP_API int mp_to_unsigned_bin(const mp_int * a, unsigned char *b);
-#define mp_to_unsigned_bin_len_ct mp_to_unsigned_bin_len
-MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c);
-MP_API int mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y);
-MP_API int mp_exptmod_ex (mp_int * G, mp_int * X, int digits, mp_int * P,
- mp_int * Y);
-/* end functions needed by Rsa */
-
-/* functions added to support above needed, removed TOOM and KARATSUBA */
-MP_API int mp_count_bits (const mp_int * a);
-MP_API int mp_leading_bit (mp_int * a);
-MP_API int mp_init_copy (mp_int * a, const mp_int * b);
-MP_API int mp_copy (const mp_int * a, mp_int * b);
-MP_API int mp_grow (mp_int * a, int size);
-MP_API int mp_div_2d (mp_int * a, int b, mp_int * c, mp_int * d);
-MP_API void mp_zero (mp_int * a);
-MP_API void mp_clamp (mp_int * a);
-MP_API int mp_exch (mp_int * a, mp_int * b);
-MP_API int mp_cond_swap_ct_ex (mp_int * a, mp_int * b, int c, int m,
- mp_int * t);
-MP_API int mp_cond_swap_ct (mp_int * a, mp_int * b, int c, int m);
-MP_API void mp_rshd (mp_int * a, int b);
-MP_API void mp_rshb (mp_int * a, int b);
-MP_API int mp_mod_2d (mp_int * a, int b, mp_int * c);
-MP_API int mp_mul_2d (mp_int * a, int b, mp_int * c);
-MP_API int mp_lshd (mp_int * a, int b);
-MP_API int mp_abs (mp_int * a, mp_int * b);
-MP_API int mp_invmod (mp_int * a, mp_int * b, mp_int * c);
-int fast_mp_invmod (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_invmod_slow (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_cmp_mag (mp_int * a, mp_int * b);
-MP_API int mp_cmp (mp_int * a, mp_int * b);
-#define mp_cmp_ct(a, b, n) mp_cmp(a, b)
-MP_API int mp_cmp_d(mp_int * a, mp_digit b);
-MP_API int mp_set (mp_int * a, mp_digit b);
-MP_API int mp_is_bit_set (mp_int * a, mp_digit b);
-MP_API int mp_mod (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_div(mp_int * a, mp_int * b, mp_int * c, mp_int * d);
-MP_API int mp_div_2(mp_int * a, mp_int * b);
-MP_API int mp_div_2_mod_ct (mp_int* a, mp_int* b, mp_int* c);
-MP_API int mp_add (mp_int * a, mp_int * b, mp_int * c);
-int s_mp_add (mp_int * a, mp_int * b, mp_int * c);
-int s_mp_sub (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_sub (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_reduce_is_2k_l(mp_int *a);
-MP_API int mp_reduce_is_2k(mp_int *a);
-MP_API int mp_dr_is_modulus(mp_int *a);
-MP_API int mp_exptmod_fast (mp_int * G, mp_int * X, mp_int * P, mp_int * Y,
- int redmode);
-MP_API int mp_exptmod_base_2 (mp_int * X, mp_int * P, mp_int * Y);
-#define mp_exptmod_nct(G,X,P,Y) mp_exptmod_fast(G,X,P,Y,0)
-MP_API int mp_montgomery_setup (mp_int * n, mp_digit * rho);
-int fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho);
-MP_API int mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho);
-#define mp_montgomery_reduce_ex(x, n, rho, ct) mp_montgomery_reduce (x, n, rho)
-#define mp_montgomery_reduce_ct(x, n, rho) mp_montgomery_reduce (x, n, rho)
-MP_API void mp_dr_setup(mp_int *a, mp_digit *d);
-MP_API int mp_dr_reduce (mp_int * x, mp_int * n, mp_digit k);
-MP_API int mp_reduce_2k(mp_int *a, mp_int *n, mp_digit d);
-int fast_s_mp_mul_high_digs (mp_int * a, mp_int * b, mp_int * c, int digs);
-int s_mp_mul_high_digs (mp_int * a, mp_int * b, mp_int * c, int digs);
-MP_API int mp_reduce_2k_setup_l(mp_int *a, mp_int *d);
-MP_API int mp_reduce_2k_l(mp_int *a, mp_int *n, mp_int *d);
-MP_API int mp_reduce (mp_int * x, mp_int * m, mp_int * mu);
-MP_API int mp_reduce_setup (mp_int * a, mp_int * b);
-int s_mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y, int redmode);
-MP_API int mp_montgomery_calc_normalization (mp_int * a, mp_int * b);
-int s_mp_mul_digs (mp_int * a, mp_int * b, mp_int * c, int digs);
-int s_mp_sqr (mp_int * a, mp_int * b);
-int fast_s_mp_mul_digs (mp_int * a, mp_int * b, mp_int * c, int digs);
-int fast_s_mp_sqr (mp_int * a, mp_int * b);
-MP_API int mp_init_size (mp_int * a, int size);
-MP_API int mp_div_3 (mp_int * a, mp_int *c, mp_digit * d);
-MP_API int mp_mul_2(mp_int * a, mp_int * b);
-MP_API int mp_mul (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_sqr (mp_int * a, mp_int * b);
-MP_API int mp_mulmod (mp_int * a, mp_int * b, mp_int * c, mp_int * d);
-MP_API int mp_submod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_addmod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_submod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_addmod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_mul_d (mp_int * a, mp_digit b, mp_int * c);
-MP_API int mp_2expt (mp_int * a, int b);
-MP_API int mp_set_bit (mp_int * a, int b);
-MP_API int mp_reduce_2k_setup(mp_int *a, mp_digit *d);
-MP_API int mp_add_d (mp_int* a, mp_digit b, mp_int* c);
-MP_API int mp_set_int (mp_int * a, unsigned long b);
-MP_API int mp_sub_d (mp_int * a, mp_digit b, mp_int * c);
-/* end support added functions */
-
-/* added */
-MP_API int mp_init_multi(mp_int* a, mp_int* b, mp_int* c, mp_int* d, mp_int* e,
- mp_int* f);
-MP_API int mp_toradix (mp_int *a, char *str, int radix);
-MP_API int mp_radix_size (mp_int * a, int radix, int *size);
-
-#ifdef WOLFSSL_DEBUG_MATH
- MP_API void mp_dump(const char* desc, mp_int* a, byte verbose);
-#else
- #define mp_dump(desc, a, verbose) WC_DO_NOTHING
-#endif
-
-#if defined(HAVE_ECC) || defined(WOLFSSL_KEY_GEN) || !defined(NO_RSA) || \
- !defined(NO_DSA) || !defined(NO_DH)
- MP_API int mp_sqrmod(mp_int* a, mp_int* b, mp_int* c);
-#endif
-#if !defined(NO_DSA) || defined(HAVE_ECC) || defined(OPENSSL_EXTRA)
- MP_API int mp_read_radix(mp_int* a, const char* str, int radix);
-#endif
-
-#if defined(WOLFSSL_KEY_GEN) || !defined(NO_RSA) || !defined(NO_DSA) || !defined(NO_DH)
- MP_API int mp_prime_is_prime (mp_int * a, int t, int *result);
- MP_API int mp_prime_is_prime_ex (mp_int * a, int t, int *result, WC_RNG* rng);
-#endif /* WOLFSSL_KEY_GEN NO_RSA NO_DSA NO_DH */
-#ifdef WOLFSSL_KEY_GEN
- MP_API int mp_gcd (mp_int * a, mp_int * b, mp_int * c);
- MP_API int mp_lcm (mp_int * a, mp_int * b, mp_int * c);
- MP_API int mp_rand_prime(mp_int* a, int len, WC_RNG* rng, void* heap);
-#endif
-
-MP_API int mp_cnt_lsb(mp_int *a);
-MP_API int mp_mod_d(mp_int* a, mp_digit b, mp_digit* c);
-
-
-#ifdef __cplusplus
- }
-#endif
-
-
-#endif /* USE_INTEGER_HEAP_MATH */
-
-#endif /* WOLF_CRYPT_INTEGER_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/libwolfssl_sources_asm.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/libwolfssl_sources_asm.h
deleted file mode 100644
index 5ecd092b1..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/libwolfssl_sources_asm.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* libwolfssl_sources_asm.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* In wolfSSL library sources, #include this file before any other #includes, to
- * assure BUILDING_WOLFSSL is defined.
- *
- * This file also includes the common headers needed by all sources.
- */
-
-#ifndef LIBWOLFSSL_SOURCES_ASM_H
-#define LIBWOLFSSL_SOURCES_ASM_H
-
-#if defined(TEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE) && \
- defined(WOLF_CRYPT_SETTINGS_H) && \
- !defined(LIBWOLFSSL_SOURCES_H)
- #error settings.h included before libwolfssl_sources_asm.h.
-#endif
-
-#ifndef BUILDING_WOLFSSL
- #define BUILDING_WOLFSSL
-#endif
-
-#if defined(HAVE_CONFIG_H) && !defined(WC_CONFIG_H_INCLUDED)
- #include
- #define WC_CONFIG_H_INCLUDED
-#endif
-
-#include
-
-#endif /* LIBWOLFSSL_SOURCES_ASM_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/lms.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/lms.h
deleted file mode 100644
index c9324cc69..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/lms.h
+++ /dev/null
@@ -1,202 +0,0 @@
-/* lms.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/lms.h
- */
-
-#ifndef WOLF_CRYPT_LMS_H
-#define WOLF_CRYPT_LMS_H
-
-#include
-#include
-
-#ifdef WOLFSSL_HAVE_LMS
-
-/* Length of the Key ID. */
-#define WC_LMS_I_LEN 16
-
-typedef struct LmsKey LmsKey;
-
-/* Private key write and read callbacks. */
-typedef int (*wc_lms_write_private_key_cb)(const byte * priv, word32 privSz, void *context);
-typedef int (*wc_lms_read_private_key_cb)(byte * priv, word32 privSz, void *context);
-
-/* Return codes returned by private key callbacks. */
-enum wc_LmsRc {
- WC_LMS_RC_NONE,
- WC_LMS_RC_BAD_ARG, /* Bad arg in read or write callback. */
- WC_LMS_RC_WRITE_FAIL, /* Write or update private key failed. */
- WC_LMS_RC_READ_FAIL, /* Read private key failed. */
- WC_LMS_RC_SAVED_TO_NV_MEMORY, /* Wrote private key to nonvolatile storage. */
- WC_LMS_RC_READ_TO_MEMORY /* Read private key from storage. */
-};
-
-/* LMS/HSS signatures are defined by 3 parameters:
- * levels: number of levels of Merkle trees.
- * height: height of an individual Merkle tree.
- * winternitz: number of bits from hash used in a Winternitz chain.
- *
- * The acceptable parameter values are those in RFC8554:
- * levels = {1..8}
- * height = {5, 10, 15, 20, 25}
- * winternitz = {1, 2, 4, 8}
- *
- * The number of available signatures is:
- * N = 2 ** (levels * height)
- *
- * Signature sizes are determined by levels and winternitz
- * parameters primarily, and height to a lesser extent:
- * - Larger levels values increase signature size significantly.
- * - Larger height values increase signature size moderately.
- * - Larger winternitz values will reduce the signature size, at
- * the expense of longer key generation and sign/verify times.
- *
- * Key generation time is strongly determined by the height of
- * the first level tree. A 3 level, 5 height tree is much faster
- * than 1 level, 15 height at initial key gen, even if the number
- * of available signatures is the same.
- * */
-
-/* Predefined LMS/HSS parameter sets for convenience.
- *
- * Not predefining many sets with Winternitz=1, because the signatures
- * will be large. */
-enum wc_LmsParm {
-#ifndef WOLFSSL_NO_LMS_SHA256_256
- WC_LMS_PARM_NONE = 0,
- WC_LMS_PARM_L1_H5_W1 = 1,
- WC_LMS_PARM_L1_H5_W2 = 2,
- WC_LMS_PARM_L1_H5_W4 = 3,
- WC_LMS_PARM_L1_H5_W8 = 4,
- WC_LMS_PARM_L1_H10_W2 = 5,
- WC_LMS_PARM_L1_H10_W4 = 6,
- WC_LMS_PARM_L1_H10_W8 = 7,
- WC_LMS_PARM_L1_H15_W2 = 8,
- WC_LMS_PARM_L1_H15_W4 = 9,
- WC_LMS_PARM_L1_H15_W8 = 10,
- WC_LMS_PARM_L1_H20_W2 = 11,
- WC_LMS_PARM_L1_H20_W4 = 12,
- WC_LMS_PARM_L1_H20_W8 = 13,
- WC_LMS_PARM_L2_H5_W2 = 14,
- WC_LMS_PARM_L2_H5_W4 = 15,
- WC_LMS_PARM_L2_H5_W8 = 16,
- WC_LMS_PARM_L2_H10_W2 = 17,
- WC_LMS_PARM_L2_H10_W4 = 18,
- WC_LMS_PARM_L2_H10_W8 = 19,
- WC_LMS_PARM_L2_H15_W2 = 20,
- WC_LMS_PARM_L2_H15_W4 = 21,
- WC_LMS_PARM_L2_H15_W8 = 22,
- WC_LMS_PARM_L2_H20_W2 = 23,
- WC_LMS_PARM_L2_H20_W4 = 24,
- WC_LMS_PARM_L2_H20_W8 = 25,
- WC_LMS_PARM_L3_H5_W2 = 26,
- WC_LMS_PARM_L3_H5_W4 = 27,
- WC_LMS_PARM_L3_H5_W8 = 28,
- WC_LMS_PARM_L3_H10_W4 = 29,
- WC_LMS_PARM_L3_H10_W8 = 30,
- WC_LMS_PARM_L4_H5_W2 = 31,
- WC_LMS_PARM_L4_H5_W4 = 32,
- WC_LMS_PARM_L4_H5_W8 = 33,
- WC_LMS_PARM_L4_H10_W4 = 34,
- WC_LMS_PARM_L4_H10_W8 = 35,
-#endif
-
-#ifdef WOLFSSL_LMS_SHA256_192
- WC_LMS_PARM_SHA256_192_L1_H5_W1 = 36,
- WC_LMS_PARM_SHA256_192_L1_H5_W2 = 37,
- WC_LMS_PARM_SHA256_192_L1_H5_W4 = 38,
- WC_LMS_PARM_SHA256_192_L1_H5_W8 = 39,
- WC_LMS_PARM_SHA256_192_L1_H10_W2 = 40,
- WC_LMS_PARM_SHA256_192_L1_H10_W4 = 41,
- WC_LMS_PARM_SHA256_192_L1_H10_W8 = 42,
- WC_LMS_PARM_SHA256_192_L1_H15_W2 = 43,
- WC_LMS_PARM_SHA256_192_L1_H15_W4 = 44,
- WC_LMS_PARM_SHA256_192_L1_H20_W2 = 53,
- WC_LMS_PARM_SHA256_192_L1_H20_W4 = 54,
- WC_LMS_PARM_SHA256_192_L1_H20_W8 = 55,
- WC_LMS_PARM_SHA256_192_L2_H10_W2 = 45,
- WC_LMS_PARM_SHA256_192_L2_H10_W4 = 46,
- WC_LMS_PARM_SHA256_192_L2_H10_W8 = 47,
- WC_LMS_PARM_SHA256_192_L3_H5_W2 = 48,
- WC_LMS_PARM_SHA256_192_L3_H5_W4 = 49,
- WC_LMS_PARM_SHA256_192_L3_H5_W8 = 50,
- WC_LMS_PARM_SHA256_192_L3_H10_W4 = 51,
- WC_LMS_PARM_SHA256_192_L4_H5_W8 = 52,
-#endif
-};
-
-/* enum wc_LmsState is to help track the state of an LMS/HSS Key. */
-enum wc_LmsState {
- WC_LMS_STATE_FREED, /* Key has been freed from memory. */
- WC_LMS_STATE_INITED, /* Key has been inited, ready to set params.*/
- WC_LMS_STATE_PARMSET, /* Params are set, ready to MakeKey or Reload. */
- WC_LMS_STATE_OK, /* Able to sign signatures and verify. */
- WC_LMS_STATE_VERIFYONLY, /* A public only LmsKey. */
- WC_LMS_STATE_BAD, /* Can't guarantee key's state. */
- WC_LMS_STATE_NOSIGS /* Signatures exhausted. */
-};
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-WOLFSSL_API int wc_LmsKey_Init(LmsKey * key, void * heap, int devId);
-WOLFSSL_API int wc_LmsKey_SetLmsParm(LmsKey * key, enum wc_LmsParm lmsParm);
-WOLFSSL_API int wc_LmsKey_SetParameters(LmsKey * key, int levels,
- int height, int winternitz);
-WOLFSSL_API int wc_LmsKey_GetParameters(const LmsKey * key, int * levels,
- int * height, int * winternitz);
-#ifndef WOLFSSL_LMS_VERIFY_ONLY
-WOLFSSL_API int wc_LmsKey_SetWriteCb(LmsKey * key,
- wc_lms_write_private_key_cb write_cb);
-WOLFSSL_API int wc_LmsKey_SetReadCb(LmsKey * key,
- wc_lms_read_private_key_cb read_cb);
-WOLFSSL_API int wc_LmsKey_SetContext(LmsKey * key, void * context);
-WOLFSSL_API int wc_LmsKey_MakeKey(LmsKey * key, WC_RNG * rng);
-WOLFSSL_API int wc_LmsKey_Reload(LmsKey * key);
-WOLFSSL_API int wc_LmsKey_GetPrivLen(const LmsKey * key, word32 * len);
-WOLFSSL_API int wc_LmsKey_Sign(LmsKey * key, byte * sig, word32 * sigSz,
- const byte * msg, int msgSz);
-WOLFSSL_API int wc_LmsKey_SigsLeft(LmsKey * key);
-#endif /* ifndef WOLFSSL_LMS_VERIFY_ONLY */
-WOLFSSL_API void wc_LmsKey_Free(LmsKey * key);
-WOLFSSL_API int wc_LmsKey_GetSigLen(const LmsKey * key, word32 * len);
-WOLFSSL_API int wc_LmsKey_GetPubLen(const LmsKey * key, word32 * len);
-WOLFSSL_API int wc_LmsKey_ExportPub(LmsKey * keyDst, const LmsKey * keySrc);
-WOLFSSL_API int wc_LmsKey_ExportPubRaw(const LmsKey * key, byte * out,
- word32 * outLen);
-WOLFSSL_API int wc_LmsKey_ImportPubRaw(LmsKey * key, const byte * in,
- word32 inLen);
-WOLFSSL_API int wc_LmsKey_Verify(LmsKey * key, const byte * sig, word32 sigSz,
- const byte * msg, int msgSz);
-WOLFSSL_API const char * wc_LmsKey_ParmToStr(enum wc_LmsParm lmsParm);
-WOLFSSL_API const char * wc_LmsKey_RcToStr(enum wc_LmsRc lmsRc);
-
-WOLFSSL_API int wc_LmsKey_GetKid(LmsKey * key, const byte ** kid,
- word32* kidSz);
-WOLFSSL_API const byte * wc_LmsKey_GetKidFromPrivRaw(const byte * priv,
- word32 privSz);
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_LMS */
-#endif /* WOLF_CRYPT_LMS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/mlkem.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/mlkem.h
deleted file mode 100644
index 074cd8cd3..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/mlkem.h
+++ /dev/null
@@ -1,377 +0,0 @@
-/* mlkem.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/mlkem.h
- */
-
-#ifndef WOLF_CRYPT_MLKEM_H
-#define WOLF_CRYPT_MLKEM_H
-
-#include
-#include
-
-#ifdef WOLFSSL_HAVE_MLKEM
-
-/* Number of co-efficients in polynomial. */
-#define MLKEM_N 256
-
-/* Define algorithm type when not excluded. */
-#ifndef WOLFSSL_NO_ML_KEM
- #if !defined(WOLFSSL_NO_ML_KEM_512)
- #define WOLFSSL_WC_ML_KEM_512
- #endif
- #if !defined(WOLFSSL_NO_ML_KEM_768)
- #define WOLFSSL_WC_ML_KEM_768
- #endif
- #if !defined(WOLFSSL_NO_ML_KEM_1024)
- #define WOLFSSL_WC_ML_KEM_1024
- #endif
-
- #if !defined(WOLFSSL_WC_ML_KEM_512) && !defined(WOLFSSL_WC_ML_KEM_768) && \
- !defined(WOLFSSL_WC_ML_KEM_1024)
- #error "No ML-KEM key size chosen."
- #endif
-#endif
-
-#ifdef WOLFSSL_MLKEM_KYBER
- #ifndef WOLFSSL_NO_KYBER512
- #define WOLFSSL_KYBER512
- #define WOLFSSL_WC_ML_KEM_512
- #endif
- #ifndef WOLFSSL_NO_KYBER768
- #define WOLFSSL_KYBER768
- #define WOLFSSL_WC_ML_KEM_768
- #endif
- #ifndef WOLFSSL_NO_KYBER1024
- #define WOLFSSL_KYBER1024
- #define WOLFSSL_WC_ML_KEM_1024
- #endif
-
- #if !defined(WOLFSSL_KYBER512) && !defined(WOLFSSL_KYBER768) && \
- !defined(WOLFSSL_KYBER1024)
- #error "No Kyber key size chosen."
- #endif
-#endif
-
-/* Size of a polynomial vector based on dimensions. */
-#define MLKEM_POLY_VEC_SZ(k) ((k) * WC_ML_KEM_POLY_SIZE)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define MLKEM_POLY_COMPRESSED_SZ(b) ((b) * (MLKEM_N / 8))
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define MLKEM_POLY_VEC_COMPRESSED_SZ(k, b) ((k) * ((b) * (MLKEM_N / 8)))
-
-#ifdef WOLFSSL_WC_ML_KEM_512
-#define WC_ML_KEM_512_K 2
-/* Size of a polynomial vector. */
-#define WC_ML_KEM_512_POLY_VEC_SZ MLKEM_POLY_VEC_SZ(WC_ML_KEM_512_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define WC_ML_KEM_512_POLY_COMPRESSED_SZ MLKEM_POLY_COMPRESSED_SZ(4)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define WC_ML_KEM_512_POLY_VEC_COMPRESSED_SZ \
- MLKEM_POLY_VEC_COMPRESSED_SZ(WC_ML_KEM_512_K, 10)
-
-/* Public key size. */
-#define WC_ML_KEM_512_PUBLIC_KEY_SIZE \
- (WC_ML_KEM_512_POLY_VEC_SZ + WC_ML_KEM_SYM_SZ)
-/* Private key size. */
-#define WC_ML_KEM_512_PRIVATE_KEY_SIZE \
- (WC_ML_KEM_512_POLY_VEC_SZ + WC_ML_KEM_512_PUBLIC_KEY_SIZE + \
- 2 * WC_ML_KEM_SYM_SZ)
-/* Cipher text size. */
-#define WC_ML_KEM_512_CIPHER_TEXT_SIZE \
- (WC_ML_KEM_512_POLY_VEC_COMPRESSED_SZ + WC_ML_KEM_512_POLY_COMPRESSED_SZ)
-#endif
-
-#ifdef WOLFSSL_WC_ML_KEM_768
-#define WC_ML_KEM_768_K 3
-
-/* Size of a polynomial vector. */
-#define WC_ML_KEM_768_POLY_VEC_SZ MLKEM_POLY_VEC_SZ(WC_ML_KEM_768_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define WC_ML_KEM_768_POLY_COMPRESSED_SZ MLKEM_POLY_COMPRESSED_SZ(4)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define WC_ML_KEM_768_POLY_VEC_COMPRESSED_SZ \
- MLKEM_POLY_VEC_COMPRESSED_SZ(WC_ML_KEM_768_K, 10)
-
-/* Public key size. */
-#define WC_ML_KEM_768_PUBLIC_KEY_SIZE \
- (WC_ML_KEM_768_POLY_VEC_SZ + WC_ML_KEM_SYM_SZ)
-/* Private key size. */
-#define WC_ML_KEM_768_PRIVATE_KEY_SIZE \
- (WC_ML_KEM_768_POLY_VEC_SZ + WC_ML_KEM_768_PUBLIC_KEY_SIZE + \
- 2 * WC_ML_KEM_SYM_SZ)
-/* Cipher text size. */
-#define WC_ML_KEM_768_CIPHER_TEXT_SIZE \
- (WC_ML_KEM_768_POLY_VEC_COMPRESSED_SZ + WC_ML_KEM_768_POLY_COMPRESSED_SZ)
-#endif
-
-#ifdef WOLFSSL_WC_ML_KEM_1024
-#define WC_ML_KEM_1024_K 4
-
-/* Size of a polynomial vector. */
-#define WC_ML_KEM_1024_POLY_VEC_SZ MLKEM_POLY_VEC_SZ(WC_ML_KEM_1024_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define WC_ML_KEM_1024_POLY_COMPRESSED_SZ MLKEM_POLY_COMPRESSED_SZ(5)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define WC_ML_KEM_1024_POLY_VEC_COMPRESSED_SZ \
- MLKEM_POLY_VEC_COMPRESSED_SZ(WC_ML_KEM_1024_K, 11)
-
-/* Public key size. */
-#define WC_ML_KEM_1024_PUBLIC_KEY_SIZE \
- (WC_ML_KEM_1024_POLY_VEC_SZ + WC_ML_KEM_SYM_SZ)
-/* Private key size. */
-#define WC_ML_KEM_1024_PRIVATE_KEY_SIZE \
- (WC_ML_KEM_1024_POLY_VEC_SZ + WC_ML_KEM_1024_PUBLIC_KEY_SIZE + \
- 2 * WC_ML_KEM_SYM_SZ)
-/* Cipher text size. */
-#define WC_ML_KEM_1024_CIPHER_TEXT_SIZE \
- (WC_ML_KEM_1024_POLY_VEC_COMPRESSED_SZ + WC_ML_KEM_1024_POLY_COMPRESSED_SZ)
-#endif
-
-#ifndef WC_ML_KEM_MAX_K
-#ifdef WOLFSSL_WC_ML_KEM_1024
-#define WC_ML_KEM_MAX_K WC_ML_KEM_1024_K
-#define WC_ML_KEM_MAX_PRIVATE_KEY_SIZE WC_ML_KEM_1024_PRIVATE_KEY_SIZE
-#define WC_ML_KEM_MAX_PUBLIC_KEY_SIZE WC_ML_KEM_1024_PUBLIC_KEY_SIZE
-#define WC_ML_KEM_MAX_CIPHER_TEXT_SIZE WC_ML_KEM_1024_CIPHER_TEXT_SIZE
-#elif defined(WOLFSSL_WC_ML_KEM_768)
-#define WC_ML_KEM_MAX_K WC_ML_KEM_768_K
-#define WC_ML_KEM_MAX_PRIVATE_KEY_SIZE WC_ML_KEM_768_PRIVATE_KEY_SIZE
-#define WC_ML_KEM_MAX_PUBLIC_KEY_SIZE WC_ML_KEM_768_PUBLIC_KEY_SIZE
-#define WC_ML_KEM_MAX_CIPHER_TEXT_SIZE WC_ML_KEM_768_CIPHER_TEXT_SIZE
-#elif defined(WOLFSSL_WC_ML_KEM_512)
-#define WC_ML_KEM_MAX_K WC_ML_KEM_512_K
-#define WC_ML_KEM_MAX_PRIVATE_KEY_SIZE WC_ML_KEM_512_PRIVATE_KEY_SIZE
-#define WC_ML_KEM_MAX_PUBLIC_KEY_SIZE WC_ML_KEM_512_PUBLIC_KEY_SIZE
-#define WC_ML_KEM_MAX_CIPHER_TEXT_SIZE WC_ML_KEM_512_CIPHER_TEXT_SIZE
-#endif
-#endif /* WC_ML_KEM_MAX_K */
-
-#define KYBER_N MLKEM_N
-
-/* Size of a polynomial vector based on dimensions. */
-#define KYBER_POLY_VEC_SZ(k) ((k) * KYBER_POLY_SIZE)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define KYBER_POLY_COMPRESSED_SZ(b) ((b) * (KYBER_N / 8))
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define KYBER_POLY_VEC_COMPRESSED_SZ(k, b) ((k) * ((b) * (KYBER_N / 8)))
-
-
-/* Kyber-512 parameters */
-/* Number of polynomials in a vector and vectors in a matrix. */
-#define KYBER512_K 2
-
-/* Size of a polynomial vector. */
-#define KYBER512_POLY_VEC_SZ KYBER_POLY_VEC_SZ(KYBER512_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define KYBER512_POLY_COMPRESSED_SZ KYBER_POLY_COMPRESSED_SZ(4)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define KYBER512_POLY_VEC_COMPRESSED_SZ \
- KYBER_POLY_VEC_COMPRESSED_SZ(KYBER512_K, 10)
-
-/* Public key size. */
-#define KYBER512_PUBLIC_KEY_SIZE \
- (KYBER512_POLY_VEC_SZ + KYBER_SYM_SZ)
-/* Private key size. */
-#define KYBER512_PRIVATE_KEY_SIZE \
- (KYBER512_POLY_VEC_SZ + KYBER512_PUBLIC_KEY_SIZE + 2 * KYBER_SYM_SZ)
-/* Cipher text size. */
-#define KYBER512_CIPHER_TEXT_SIZE \
- (KYBER512_POLY_VEC_COMPRESSED_SZ + KYBER512_POLY_COMPRESSED_SZ)
-
-/* Kyber-768 parameters */
-/* Number of polynomials in a vector and vectors in a matrix. */
-#define KYBER768_K 3
-
-/* Size of a polynomial vector. */
-#define KYBER768_POLY_VEC_SZ KYBER_POLY_VEC_SZ(KYBER768_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define KYBER768_POLY_COMPRESSED_SZ KYBER_POLY_COMPRESSED_SZ(4)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define KYBER768_POLY_VEC_COMPRESSED_SZ \
- KYBER_POLY_VEC_COMPRESSED_SZ(KYBER768_K, 10)
-
-/* Public key size. */
-#define KYBER768_PUBLIC_KEY_SIZE \
- (KYBER768_POLY_VEC_SZ + KYBER_SYM_SZ)
-/* Private key size. */
-#define KYBER768_PRIVATE_KEY_SIZE \
- (KYBER768_POLY_VEC_SZ + KYBER768_PUBLIC_KEY_SIZE + 2 * KYBER_SYM_SZ)
-/* Cipher text size. */
-#define KYBER768_CIPHER_TEXT_SIZE \
- (KYBER768_POLY_VEC_COMPRESSED_SZ + KYBER768_POLY_COMPRESSED_SZ)
-
-/* Kyber-1024 parameters */
-/* Number of polynomials in a vector and vectors in a matrix. */
-#define KYBER1024_K 4
-
-/* Size of a polynomial vector. */
-#define KYBER1024_POLY_VEC_SZ KYBER_POLY_VEC_SZ(KYBER1024_K)
-/* Size of a compressed polynomial based on bits per coefficient. */
-#define KYBER1024_POLY_COMPRESSED_SZ KYBER_POLY_COMPRESSED_SZ(5)
-/* Size of a compressed vector polynomial based on dimensions and bits per
- * coefficient. */
-#define KYBER1024_POLY_VEC_COMPRESSED_SZ \
- KYBER_POLY_VEC_COMPRESSED_SZ(KYBER1024_K, 11)
-
-/* Public key size. */
-#define KYBER1024_PUBLIC_KEY_SIZE \
- (KYBER1024_POLY_VEC_SZ + KYBER_SYM_SZ)
-/* Private key size. */
-#define KYBER1024_PRIVATE_KEY_SIZE \
- (KYBER1024_POLY_VEC_SZ + KYBER1024_PUBLIC_KEY_SIZE + 2 * KYBER_SYM_SZ)
-/* Cipher text size. */
-#define KYBER1024_CIPHER_TEXT_SIZE \
- (KYBER1024_POLY_VEC_COMPRESSED_SZ + KYBER1024_POLY_COMPRESSED_SZ)
-
-
-/* Maximum dimensions and sizes of supported key types. */
-#ifdef WOLFSSL_KYBER1024
-#define KYBER_MAX_K KYBER1024_K
-#define KYBER_MAX_PRIVATE_KEY_SIZE KYBER1024_PRIVATE_KEY_SIZE
-#define KYBER_MAX_PUBLIC_KEY_SIZE KYBER1024_PUBLIC_KEY_SIZE
-#define KYBER_MAX_CIPHER_TEXT_SIZE KYBER1024_CIPHER_TEXT_SIZE
-#elif defined(WOLFSSL_KYBER768)
-#define KYBER_MAX_K KYBER768_K
-#define KYBER_MAX_PRIVATE_KEY_SIZE KYBER768_PRIVATE_KEY_SIZE
-#define KYBER_MAX_PUBLIC_KEY_SIZE KYBER768_PUBLIC_KEY_SIZE
-#define KYBER_MAX_CIPHER_TEXT_SIZE KYBER768_CIPHER_TEXT_SIZE
-#elif defined(WOLFSSL_KYBER512)
-#define KYBER_MAX_K KYBER512_K
-#define KYBER_MAX_PRIVATE_KEY_SIZE KYBER512_PRIVATE_KEY_SIZE
-#define KYBER_MAX_PUBLIC_KEY_SIZE KYBER512_PUBLIC_KEY_SIZE
-#define KYBER_MAX_CIPHER_TEXT_SIZE KYBER512_CIPHER_TEXT_SIZE
-#endif
-
-#define KYBER_SYM_SZ WC_ML_KEM_SYM_SZ
-#define KYBER_SS_SZ WC_ML_KEM_SS_SZ
-#define KYBER_MAKEKEY_RAND_SZ WC_ML_KEM_MAKEKEY_RAND_SZ
-#define KYBER_ENC_RAND_SZ WC_ML_KEM_ENC_RAND_SZ
-#define KYBER_POLY_SIZE WC_ML_KEM_POLY_SIZE
-
-
-enum {
- /* Types of Kyber keys. */
- WC_ML_KEM_512 = 0,
- WC_ML_KEM_768 = 1,
- WC_ML_KEM_1024 = 2,
-
- MLKEM_KYBER = 0x10,
- KYBER512 = 0 | MLKEM_KYBER,
- KYBER768 = 1 | MLKEM_KYBER,
- KYBER1024 = 2 | MLKEM_KYBER,
-
- KYBER_LEVEL1 = KYBER512,
- KYBER_LEVEL3 = KYBER768,
- KYBER_LEVEL5 = KYBER1024,
-
- /* Symmetric data size. */
- WC_ML_KEM_SYM_SZ = 32,
- /* Shared secret size. */
- WC_ML_KEM_SS_SZ = 32,
- /* Size of random required for making a key. */
- WC_ML_KEM_MAKEKEY_RAND_SZ = 2 * WC_ML_KEM_SYM_SZ,
- /* Size of random required for encapsulation. */
- WC_ML_KEM_ENC_RAND_SZ = WC_ML_KEM_SYM_SZ,
-
- /* Encoded polynomial size. */
- WC_ML_KEM_POLY_SIZE = 384,
-};
-
-
-/* Different structures for different implementations. */
-typedef struct MlKemKey MlKemKey;
-
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_API MlKemKey* wc_MlKemKey_New(int type, void* heap, int devId);
-WOLFSSL_API int wc_MlKemKey_Delete(MlKemKey* key, MlKemKey** key_p);
-
-WOLFSSL_API int wc_MlKemKey_Init(MlKemKey* key, int type, void* heap,
- int devId);
-WOLFSSL_API int wc_MlKemKey_Free(MlKemKey* key);
-
-WOLFSSL_API int wc_MlKemKey_MakeKey(MlKemKey* key, WC_RNG* rng);
-WOLFSSL_API int wc_MlKemKey_MakeKeyWithRandom(MlKemKey* key,
- const unsigned char* rand, int len);
-
-WOLFSSL_API int wc_MlKemKey_CipherTextSize(MlKemKey* key, word32* len);
-WOLFSSL_API int wc_MlKemKey_SharedSecretSize(MlKemKey* key, word32* len);
-
-WOLFSSL_API int wc_MlKemKey_Encapsulate(MlKemKey* key, unsigned char* ct,
- unsigned char* ss, WC_RNG* rng);
-WOLFSSL_API int wc_MlKemKey_EncapsulateWithRandom(MlKemKey* key,
- unsigned char* ct, unsigned char* ss, const unsigned char* rand, int len);
-WOLFSSL_API int wc_MlKemKey_Decapsulate(MlKemKey* key, unsigned char* ss,
- const unsigned char* ct, word32 len);
-
-WOLFSSL_API int wc_MlKemKey_DecodePrivateKey(MlKemKey* key,
- const unsigned char* in, word32 len);
-WOLFSSL_API int wc_MlKemKey_DecodePublicKey(MlKemKey* key,
- const unsigned char* in, word32 len);
-
-WOLFSSL_API int wc_MlKemKey_PrivateKeySize(MlKemKey* key, word32* len);
-WOLFSSL_API int wc_MlKemKey_PublicKeySize(MlKemKey* key, word32* len);
-WOLFSSL_API int wc_MlKemKey_EncodePrivateKey(MlKemKey* key, unsigned char* out,
- word32 len);
-WOLFSSL_API int wc_MlKemKey_EncodePublicKey(MlKemKey* key, unsigned char* out,
- word32 len);
-
-
-#define KyberKey MlKemKey
-
-#define wc_KyberKey_Init(type, key, heap, devId) \
- wc_MlKemKey_Init(key, type, heap, devId)
-#define wc_KyberKey_Free wc_MlKemKey_Free
-#define wc_KyberKey_MakeKey wc_MlKemKey_MakeKey
-#define wc_KyberKey_MakeKeyWithRandom wc_MlKemKey_MakeKeyWithRandom
-#define wc_KyberKey_CipherTextSize wc_MlKemKey_CipherTextSize
-#define wc_KyberKey_SharedSecretSize wc_MlKemKey_SharedSecretSize
-#define wc_KyberKey_Encapsulate wc_MlKemKey_Encapsulate
-#define wc_KyberKey_EncapsulateWithRandom wc_MlKemKey_EncapsulateWithRandom
-#define wc_KyberKey_Decapsulate wc_MlKemKey_Decapsulate
-#define wc_KyberKey_DecodePrivateKey wc_MlKemKey_DecodePrivateKey
-#define wc_KyberKey_DecodePublicKey wc_MlKemKey_DecodePublicKey
-#define wc_KyberKey_PrivateKeySize wc_MlKemKey_PrivateKeySize
-#define wc_KyberKey_PublicKeySize wc_MlKemKey_PublicKeySize
-#define wc_KyberKey_EncodePrivateKey wc_MlKemKey_EncodePrivateKey
-#define wc_KyberKey_EncodePublicKey wc_MlKemKey_EncodePublicKey
-
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_MLKEM */
-
-#endif /* WOLF_CRYPT_MLKEM_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_class.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_class.h
deleted file mode 100644
index c540aaacf..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_class.h
+++ /dev/null
@@ -1,1021 +0,0 @@
-/* mpi_class.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-#if !(defined(LTM1) && defined(LTM2) && defined(LTM3))
-#if defined(LTM2)
-#define LTM3
-#endif
-#if defined(LTM1)
-#define LTM2
-#endif
-#define LTM1
-
-#if defined(LTM_ALL)
-#define BN_ERROR_C
-#define BN_FAST_MP_INVMOD_C
-#define BN_FAST_MP_MONTGOMERY_REDUCE_C
-#define BN_FAST_S_MP_MUL_DIGS_C
-#define BN_FAST_S_MP_MUL_HIGH_DIGS_C
-#define BN_FAST_S_MP_SQR_C
-#define BN_MP_2EXPT_C
-#define BN_MP_ABS_C
-#define BN_MP_ADD_C
-#define BN_MP_ADD_D_C
-#define BN_MP_ADDMOD_C
-#define BN_MP_AND_C
-#define BN_MP_CLAMP_C
-#define BN_MP_CLEAR_C
-#define BN_MP_CLEAR_MULTI_C
-#define BN_MP_CMP_C
-#define BN_MP_CMP_D_C
-#define BN_MP_CMP_MAG_C
-#define BN_MP_CNT_LSB_C
-#define BN_MP_COPY_C
-#define BN_MP_COUNT_BITS_C
-#define BN_MP_DIV_C
-#define BN_MP_DIV_2_C
-#define BN_MP_DIV_2D_C
-#define BN_MP_DIV_3_C
-#define BN_MP_DIV_D_C
-#define BN_MP_DR_IS_MODULUS_C
-#define BN_MP_DR_REDUCE_C
-#define BN_MP_DR_SETUP_C
-#define BN_MP_EXCH_C
-#define BN_MP_EXPT_D_C
-#define BN_MP_EXPTMOD_BASE_2
-#define BN_MP_EXPTMOD_C
-#define BN_MP_EXPTMOD_FAST_C
-#define BN_MP_EXTEUCLID_C
-#define BN_MP_FREAD_C
-#define BN_MP_FWRITE_C
-#define BN_MP_GCD_C
-#define BN_MP_GET_INT_C
-#define BN_MP_GROW_C
-#define BN_MP_INIT_C
-#define BN_MP_INIT_COPY_C
-#define BN_MP_INIT_MULTI_C
-#define BN_MP_INIT_SET_C
-#define BN_MP_INIT_SET_INT_C
-#define BN_MP_INIT_SIZE_C
-#define BN_MP_INVMOD_C
-#define BN_MP_INVMOD_SLOW_C
-#define BN_MP_IS_SQUARE_C
-#define BN_MP_JACOBI_C
-#define BN_MP_KARATSUBA_MUL_C
-#define BN_MP_KARATSUBA_SQR_C
-#define BN_MP_LCM_C
-#define BN_MP_LSHD_C
-#define BN_MP_MOD_C
-#define BN_MP_MOD_2D_C
-#define BN_MP_MOD_D_C
-#define BN_MP_MONTGOMERY_CALC_NORMALIZATION_C
-#define BN_MP_MONTGOMERY_REDUCE_C
-#define BN_MP_MONTGOMERY_SETUP_C
-#define BN_MP_MUL_C
-#define BN_MP_MUL_2_C
-#define BN_MP_MUL_2D_C
-#define BN_MP_MUL_D_C
-#define BN_MP_MULMOD_C
-#define BN_MP_N_ROOT_C
-#define BN_MP_NEG_C
-#define BN_MP_OR_C
-#define BN_MP_PRIME_FERMAT_C
-#define BN_MP_PRIME_IS_DIVISIBLE_C
-#define BN_MP_PRIME_IS_PRIME_C
-#define BN_MP_PRIME_MILLER_RABIN_C
-#define BN_MP_PRIME_NEXT_PRIME_C
-#define BN_MP_PRIME_RABIN_MILLER_TRIALS_C
-#define BN_MP_PRIME_RANDOM_EX_C
-#define BN_MP_RADIX_SIZE_C
-#define BN_MP_RADIX_SMAP_C
-#define BN_MP_RAND_C
-#define BN_MP_READ_RADIX_C
-#define BN_MP_READ_SIGNED_BIN_C
-#define BN_MP_READ_UNSIGNED_BIN_C
-#define BN_MP_REDUCE_C
-#define BN_MP_REDUCE_2K_C
-#define BN_MP_REDUCE_2K_L_C
-#define BN_MP_REDUCE_2K_SETUP_C
-#define BN_MP_REDUCE_2K_SETUP_L_C
-#define BN_MP_REDUCE_IS_2K_C
-#define BN_MP_REDUCE_IS_2K_L_C
-#define BN_MP_REDUCE_SETUP_C
-#define BN_MP_RSHD_C
-#define BN_MP_SET_C
-#define BN_MP_SET_INT_C
-#define BN_MP_SHRINK_C
-#define BN_MP_SIGNED_BIN_SIZE_C
-#define BN_MP_SQR_C
-#define BN_MP_SQRMOD_C
-#define BN_MP_SQRT_C
-#define BN_MP_SUB_C
-#define BN_MP_SUB_D_C
-#define BN_MP_SUBMOD_C
-#define BN_MP_TO_SIGNED_BIN_C
-#define BN_MP_TO_SIGNED_BIN_N_C
-#define BN_MP_TO_UNSIGNED_BIN_C
-#define BN_MP_TO_UNSIGNED_BIN_N_C
-#define BN_MP_TOOM_MUL_C
-#define BN_MP_TOOM_SQR_C
-#define BN_MP_TORADIX_C
-#define BN_MP_TORADIX_N_C
-#define BN_MP_UNSIGNED_BIN_SIZE_C
-#define BN_MP_XOR_C
-#define BN_MP_ZERO_C
-#define BN_PRIME_TAB_C
-#define BN_REVERSE_C
-#define BN_S_MP_ADD_C
-#define BN_S_MP_EXPTMOD_C
-#define BN_S_MP_MUL_DIGS_C
-#define BN_S_MP_MUL_HIGH_DIGS_C
-#define BN_S_MP_SQR_C
-#define BN_S_MP_SUB_C
-#define BNCORE_C
-#endif
-
-#if defined(BN_ERROR_C)
- #define BN_MP_ERROR_TO_STRING_C
-#endif
-
-#if defined(BN_FAST_MP_INVMOD_C)
- #define BN_MP_ISEVEN_C
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_COPY_C
- #define BN_MP_MOD_C
- #define BN_MP_SET_C
- #define BN_MP_DIV_2_C
- #define BN_MP_ISODD_C
- #define BN_MP_SUB_C
- #define BN_MP_CMP_C
- #define BN_MP_ISZERO_C
- #define BN_MP_CMP_D_C
- #define BN_MP_ADD_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_FAST_MP_MONTGOMERY_REDUCE_C)
- #define BN_MP_GROW_C
- #define BN_MP_RSHD_C
- #define BN_MP_CLAMP_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_FAST_S_MP_MUL_DIGS_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_FAST_S_MP_MUL_HIGH_DIGS_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_FAST_S_MP_SQR_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_2EXPT_C)
- #define BN_MP_ZERO_C
- #define BN_MP_GROW_C
-#endif
-
-#if defined(BN_MP_ABS_C)
- #define BN_MP_COPY_C
-#endif
-
-#if defined(BN_MP_ADD_C)
- #define BN_S_MP_ADD_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_ADD_D_C)
- #define BN_MP_GROW_C
- #define BN_MP_SUB_D_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_ADDMOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_ADD_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MOD_C
-#endif
-
-#if defined(BN_MP_AND_C)
- #define BN_MP_INIT_COPY_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_CLAMP_C)
-#endif
-
-#if defined(BN_MP_CLEAR_C)
-#endif
-
-#if defined(BN_MP_CLEAR_MULTI_C)
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_CMP_C)
- #define BN_MP_CMP_MAG_C
-#endif
-
-#if defined(BN_MP_CMP_D_C)
-#endif
-
-#if defined(BN_MP_CMP_MAG_C)
-#endif
-
-#if defined(BN_MP_CNT_LSB_C)
- #define BN_MP_ISZERO_C
-#endif
-
-#if defined(BN_MP_COPY_C)
- #define BN_MP_GROW_C
-#endif
-
-#if defined(BN_MP_COUNT_BITS_C)
-#endif
-
-#if defined(BN_MP_DIV_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_COPY_C
- #define BN_MP_ZERO_C
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_SET_C
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_ABS_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_CMP_C
- #define BN_MP_SUB_C
- #define BN_MP_ADD_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_MULTI_C
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_INIT_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_LSHD_C
- #define BN_MP_RSHD_C
- #define BN_MP_MUL_D_C
- #define BN_MP_CLAMP_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_DIV_2_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_DIV_2D_C)
- #define BN_MP_COPY_C
- #define BN_MP_ZERO_C
- #define BN_MP_INIT_C
- #define BN_MP_MOD_2D_C
- #define BN_MP_CLEAR_C
- #define BN_MP_RSHD_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
-#endif
-
-#if defined(BN_MP_DIV_3_C)
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_DIV_D_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_COPY_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_DIV_3_C
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_DR_IS_MODULUS_C)
-#endif
-
-#if defined(BN_MP_DR_REDUCE_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_DR_SETUP_C)
-#endif
-
-#if defined(BN_MP_EXCH_C)
-#endif
-
-#if defined(BN_MP_EXPT_D_C)
- #define BN_MP_INIT_COPY_C
- #define BN_MP_SET_C
- #define BN_MP_SQR_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MUL_C
-#endif
-
-#if defined(BN_MP_EXPTMOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_INVMOD_C
- #define BN_MP_CLEAR_C
- #define BN_MP_ABS_C
- #define BN_MP_CLEAR_MULTI_C
- #define BN_MP_REDUCE_IS_2K_L_C
- #define BN_S_MP_EXPTMOD_C
- #define BN_MP_DR_IS_MODULUS_C
- #define BN_MP_REDUCE_IS_2K_C
- #define BN_MP_ISODD_C
- #define BN_MP_EXPTMOD_FAST_C
- #define BN_MP_EXPTMOD_BASE_2
-#endif
-
-#if defined(BN_MP_EXPTMOD_FAST_C)
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_INIT_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MONTGOMERY_SETUP_C
- #define BN_FAST_MP_MONTGOMERY_REDUCE_C
- #define BN_MP_MONTGOMERY_REDUCE_C
- #define BN_MP_DR_SETUP_C
- #define BN_MP_DR_REDUCE_C
- #define BN_MP_REDUCE_2K_SETUP_C
- #define BN_MP_REDUCE_2K_C
- #define BN_MP_MONTGOMERY_CALC_NORMALIZATION_C
- #define BN_MP_MULMOD_C
- #define BN_MP_SET_C
- #define BN_MP_MOD_C
- #define BN_MP_COPY_C
- #define BN_MP_SQR_C
- #define BN_MP_MUL_C
- #define BN_MP_EXCH_C
-#endif
-
-#if defined(BN_MP_EXTEUCLID_C)
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_SET_C
- #define BN_MP_COPY_C
- #define BN_MP_ISZERO_C
- #define BN_MP_DIV_C
- #define BN_MP_MUL_C
- #define BN_MP_SUB_C
- #define BN_MP_NEG_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_MP_FREAD_C)
- #define BN_MP_ZERO_C
- #define BN_MP_S_RMAP_C
- #define BN_MP_MUL_D_C
- #define BN_MP_ADD_D_C
- #define BN_MP_CMP_D_C
-#endif
-
-#if defined(BN_MP_FWRITE_C)
- #define BN_MP_RADIX_SIZE_C
- #define BN_MP_TORADIX_C
-#endif
-
-#if defined(BN_MP_GCD_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_ABS_C
- #define BN_MP_ZERO_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_CNT_LSB_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_EXCH_C
- #define BN_S_MP_SUB_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_GET_INT_C)
-#endif
-
-#if defined(BN_MP_GROW_C)
-#endif
-
-#if defined(BN_MP_INIT_C)
-#endif
-
-#if defined(BN_MP_INIT_COPY_C)
- #define BN_MP_COPY_C
-#endif
-
-#if defined(BN_MP_INIT_MULTI_C)
- #define BN_MP_ERR_C
- #define BN_MP_INIT_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_INIT_SET_C)
- #define BN_MP_INIT_C
- #define BN_MP_SET_C
-#endif
-
-#if defined(BN_MP_INIT_SET_INT_C)
- #define BN_MP_INIT_C
- #define BN_MP_SET_INT_C
-#endif
-
-#if defined(BN_MP_INIT_SIZE_C)
- #define BN_MP_INIT_C
-#endif
-
-#if defined(BN_MP_INVMOD_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_ISODD_C
- #define BN_FAST_MP_INVMOD_C
- #define BN_MP_INVMOD_SLOW_C
-#endif
-
-#if defined(BN_MP_INVMOD_SLOW_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_MOD_C
- #define BN_MP_COPY_C
- #define BN_MP_ISEVEN_C
- #define BN_MP_SET_C
- #define BN_MP_DIV_2_C
- #define BN_MP_ISODD_C
- #define BN_MP_ADD_C
- #define BN_MP_SUB_C
- #define BN_MP_CMP_C
- #define BN_MP_CMP_D_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_MP_IS_SQUARE_C)
- #define BN_MP_MOD_D_C
- #define BN_MP_INIT_SET_INT_C
- #define BN_MP_MOD_C
- #define BN_MP_GET_INT_C
- #define BN_MP_SQRT_C
- #define BN_MP_SQR_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_JACOBI_C)
- #define BN_MP_CMP_D_C
- #define BN_MP_ISZERO_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_CNT_LSB_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_MOD_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_KARATSUBA_MUL_C)
- #define BN_MP_MUL_C
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_SUB_C
- #define BN_MP_ADD_C
- #define BN_MP_LSHD_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_KARATSUBA_SQR_C)
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_SQR_C
- #define BN_MP_SUB_C
- #define BN_S_MP_ADD_C
- #define BN_MP_LSHD_C
- #define BN_MP_ADD_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_LCM_C)
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_GCD_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_DIV_C
- #define BN_MP_MUL_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_MP_LSHD_C)
- #define BN_MP_GROW_C
- #define BN_MP_RSHD_C
-#endif
-
-#if defined(BN_MP_MOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_DIV_C
- #define BN_MP_CLEAR_C
- #define BN_MP_ADD_C
- #define BN_MP_EXCH_C
-#endif
-
-#if defined(BN_MP_MOD_2D_C)
- #define BN_MP_ZERO_C
- #define BN_MP_COPY_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_MOD_D_C)
- #define BN_MP_DIV_D_C
-#endif
-
-#if defined(BN_MP_MONTGOMERY_CALC_NORMALIZATION_C)
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_2EXPT_C
- #define BN_MP_SET_C
- #define BN_MP_MUL_2_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_MONTGOMERY_REDUCE_C)
- #define BN_FAST_MP_MONTGOMERY_REDUCE_C
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
- #define BN_MP_RSHD_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_MONTGOMERY_SETUP_C)
-#endif
-
-#if defined(BN_MP_MUL_C)
- #define BN_MP_TOOM_MUL_C
- #define BN_MP_KARATSUBA_MUL_C
- #define BN_FAST_S_MP_MUL_DIGS_C
- #define BN_S_MP_MUL_C
- #define BN_S_MP_MUL_DIGS_C
-#endif
-
-#if defined(BN_MP_MUL_2_C)
- #define BN_MP_GROW_C
-#endif
-
-#if defined(BN_MP_MUL_2D_C)
- #define BN_MP_COPY_C
- #define BN_MP_GROW_C
- #define BN_MP_LSHD_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_MUL_D_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_MULMOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_MUL_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MOD_C
-#endif
-
-#if defined(BN_MP_N_ROOT_C)
- #define BN_MP_INIT_C
- #define BN_MP_SET_C
- #define BN_MP_COPY_C
- #define BN_MP_EXPT_D_C
- #define BN_MP_MUL_C
- #define BN_MP_SUB_C
- #define BN_MP_MUL_D_C
- #define BN_MP_DIV_C
- #define BN_MP_CMP_C
- #define BN_MP_SUB_D_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_NEG_C)
- #define BN_MP_COPY_C
- #define BN_MP_ISZERO_C
-#endif
-
-#if defined(BN_MP_OR_C)
- #define BN_MP_INIT_COPY_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_PRIME_FERMAT_C)
- #define BN_MP_CMP_D_C
- #define BN_MP_INIT_C
- #define BN_MP_EXPTMOD_C
- #define BN_MP_CMP_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_PRIME_IS_DIVISIBLE_C)
- #define BN_MP_MOD_D_C
-#endif
-
-#if defined(BN_MP_PRIME_IS_PRIME_C)
- #define BN_MP_CMP_D_C
- #define BN_MP_PRIME_IS_DIVISIBLE_C
- #define BN_MP_INIT_C
- #define BN_MP_SET_C
- #define BN_MP_PRIME_MILLER_RABIN_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_PRIME_MILLER_RABIN_C)
- #define BN_MP_CMP_D_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_SUB_D_C
- #define BN_MP_CNT_LSB_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_EXPTMOD_C
- #define BN_MP_CMP_C
- #define BN_MP_SQRMOD_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_PRIME_NEXT_PRIME_C)
- #define BN_MP_CMP_D_C
- #define BN_MP_SET_C
- #define BN_MP_SUB_D_C
- #define BN_MP_ISEVEN_C
- #define BN_MP_MOD_D_C
- #define BN_MP_INIT_C
- #define BN_MP_ADD_D_C
- #define BN_MP_PRIME_MILLER_RABIN_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_PRIME_RABIN_MILLER_TRIALS_C)
-#endif
-
-#if defined(BN_MP_PRIME_RANDOM_EX_C)
- #define BN_MP_READ_UNSIGNED_BIN_C
- #define BN_MP_PRIME_IS_PRIME_C
- #define BN_MP_SUB_D_C
- #define BN_MP_DIV_2_C
- #define BN_MP_MUL_2_C
- #define BN_MP_ADD_D_C
-#endif
-
-#if defined(BN_MP_RADIX_SIZE_C)
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_ISZERO_C
- #define BN_MP_DIV_D_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_RADIX_SMAP_C)
- #define BN_MP_S_RMAP_C
-#endif
-
-#if defined(BN_MP_RAND_C)
- #define BN_MP_ZERO_C
- #define BN_MP_ADD_D_C
- #define BN_MP_LSHD_C
-#endif
-
-#if defined(BN_MP_READ_RADIX_C)
- #define BN_MP_ZERO_C
- #define BN_MP_S_RMAP_C
- #define BN_MP_RADIX_SMAP_C
- #define BN_MP_MUL_D_C
- #define BN_MP_ADD_D_C
- #define BN_MP_ISZERO_C
-#endif
-
-#if defined(BN_MP_READ_SIGNED_BIN_C)
- #define BN_MP_READ_UNSIGNED_BIN_C
-#endif
-
-#if defined(BN_MP_READ_UNSIGNED_BIN_C)
- #define BN_MP_GROW_C
- #define BN_MP_ZERO_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_REDUCE_C)
- #define BN_MP_REDUCE_SETUP_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_RSHD_C
- #define BN_MP_MUL_C
- #define BN_S_MP_MUL_HIGH_DIGS_C
- #define BN_FAST_S_MP_MUL_HIGH_DIGS_C
- #define BN_MP_MOD_2D_C
- #define BN_S_MP_MUL_DIGS_C
- #define BN_MP_SUB_C
- #define BN_MP_CMP_D_C
- #define BN_MP_SET_C
- #define BN_MP_LSHD_C
- #define BN_MP_ADD_C
- #define BN_MP_CMP_C
- #define BN_S_MP_SUB_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_REDUCE_2K_C)
- #define BN_MP_INIT_C
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_MUL_D_C
- #define BN_S_MP_ADD_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_REDUCE_2K_L_C)
- #define BN_MP_INIT_C
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_MUL_C
- #define BN_S_MP_ADD_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_REDUCE_2K_SETUP_C)
- #define BN_MP_INIT_C
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_2EXPT_C
- #define BN_MP_CLEAR_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_REDUCE_2K_SETUP_L_C)
- #define BN_MP_INIT_C
- #define BN_MP_2EXPT_C
- #define BN_MP_COUNT_BITS_C
- #define BN_S_MP_SUB_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_REDUCE_IS_2K_C)
- #define BN_MP_REDUCE_2K_C
- #define BN_MP_COUNT_BITS_C
-#endif
-
-#if defined(BN_MP_REDUCE_IS_2K_L_C)
-#endif
-
-#if defined(BN_MP_REDUCE_SETUP_C)
- #define BN_MP_2EXPT_C
- #define BN_MP_DIV_C
-#endif
-
-#if defined(BN_MP_RSHD_C)
- #define BN_MP_ZERO_C
-#endif
-
-#if defined(BN_MP_SET_C)
- #define BN_MP_ZERO_C
-#endif
-
-#if defined(BN_MP_SET_INT_C)
- #define BN_MP_ZERO_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_SHRINK_C)
-#endif
-
-#if defined(BN_MP_SIGNED_BIN_SIZE_C)
- #define BN_MP_UNSIGNED_BIN_SIZE_C
-#endif
-
-#if defined(BN_MP_SQR_C)
- #define BN_MP_TOOM_SQR_C
- #define BN_MP_KARATSUBA_SQR_C
- #define BN_FAST_S_MP_SQR_C
- #define BN_S_MP_SQR_C
-#endif
-
-#if defined(BN_MP_SQRMOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_SQR_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MOD_C
-#endif
-
-#if defined(BN_MP_SQRT_C)
- #define BN_MP_N_ROOT_C
- #define BN_MP_ISZERO_C
- #define BN_MP_ZERO_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_RSHD_C
- #define BN_MP_DIV_C
- #define BN_MP_ADD_C
- #define BN_MP_DIV_2_C
- #define BN_MP_CMP_MAG_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_SUB_C)
- #define BN_S_MP_ADD_C
- #define BN_MP_CMP_MAG_C
- #define BN_S_MP_SUB_C
-#endif
-
-#if defined(BN_MP_SUB_D_C)
- #define BN_MP_GROW_C
- #define BN_MP_ADD_D_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_MP_SUBMOD_C)
- #define BN_MP_INIT_C
- #define BN_MP_SUB_C
- #define BN_MP_CLEAR_C
- #define BN_MP_MOD_C
-#endif
-
-#if defined(BN_MP_TO_SIGNED_BIN_C)
- #define BN_MP_TO_UNSIGNED_BIN_C
-#endif
-
-#if defined(BN_MP_TO_SIGNED_BIN_N_C)
- #define BN_MP_SIGNED_BIN_SIZE_C
- #define BN_MP_TO_SIGNED_BIN_C
-#endif
-
-#if defined(BN_MP_TO_UNSIGNED_BIN_C)
- #define BN_MP_INIT_COPY_C
- #define BN_MP_ISZERO_C
- #define BN_MP_DIV_2D_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_TO_UNSIGNED_BIN_N_C)
- #define BN_MP_UNSIGNED_BIN_SIZE_C
- #define BN_MP_TO_UNSIGNED_BIN_C
-#endif
-
-#if defined(BN_MP_TOOM_MUL_C)
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_MOD_2D_C
- #define BN_MP_COPY_C
- #define BN_MP_RSHD_C
- #define BN_MP_MUL_C
- #define BN_MP_MUL_2_C
- #define BN_MP_ADD_C
- #define BN_MP_SUB_C
- #define BN_MP_DIV_2_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_MUL_D_C
- #define BN_MP_DIV_3_C
- #define BN_MP_LSHD_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_MP_TOOM_SQR_C)
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_MOD_2D_C
- #define BN_MP_COPY_C
- #define BN_MP_RSHD_C
- #define BN_MP_SQR_C
- #define BN_MP_MUL_2_C
- #define BN_MP_ADD_C
- #define BN_MP_SUB_C
- #define BN_MP_DIV_2_C
- #define BN_MP_MUL_2D_C
- #define BN_MP_MUL_D_C
- #define BN_MP_DIV_3_C
- #define BN_MP_LSHD_C
- #define BN_MP_CLEAR_MULTI_C
-#endif
-
-#if defined(BN_MP_TORADIX_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_DIV_D_C
- #define BN_MP_CLEAR_C
- #define BN_MP_S_RMAP_C
-#endif
-
-#if defined(BN_MP_TORADIX_N_C)
- #define BN_MP_ISZERO_C
- #define BN_MP_INIT_COPY_C
- #define BN_MP_DIV_D_C
- #define BN_MP_CLEAR_C
- #define BN_MP_S_RMAP_C
-#endif
-
-#if defined(BN_MP_UNSIGNED_BIN_SIZE_C)
- #define BN_MP_COUNT_BITS_C
-#endif
-
-#if defined(BN_MP_XOR_C)
- #define BN_MP_INIT_COPY_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_MP_ZERO_C)
-#endif
-
-#if defined(BN_PRIME_TAB_C)
-#endif
-
-#if defined(BN_REVERSE_C)
-#endif
-
-#if defined(BN_S_MP_ADD_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BN_S_MP_EXPTMOD_C)
- #define BN_MP_COUNT_BITS_C
- #define BN_MP_INIT_C
- #define BN_MP_CLEAR_C
- #define BN_MP_REDUCE_SETUP_C
- #define BN_MP_REDUCE_C
- #define BN_MP_REDUCE_2K_SETUP_L_C
- #define BN_MP_REDUCE_2K_L_C
- #define BN_MP_MOD_C
- #define BN_MP_COPY_C
- #define BN_MP_SQR_C
- #define BN_MP_MUL_C
- #define BN_MP_SET_C
- #define BN_MP_EXCH_C
-#endif
-
-#if defined(BN_S_MP_MUL_DIGS_C)
- #define BN_FAST_S_MP_MUL_DIGS_C
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_S_MP_MUL_HIGH_DIGS_C)
- #define BN_FAST_S_MP_MUL_HIGH_DIGS_C
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_S_MP_SQR_C)
- #define BN_MP_INIT_SIZE_C
- #define BN_MP_CLAMP_C
- #define BN_MP_EXCH_C
- #define BN_MP_CLEAR_C
-#endif
-
-#if defined(BN_S_MP_SUB_C)
- #define BN_MP_GROW_C
- #define BN_MP_CLAMP_C
-#endif
-
-#if defined(BNCORE_C)
-#endif
-
-#ifdef LTM3
-#define LTM_LAST
-#endif
-#include "mpi_superclass.h"
-#include "mpi_class.h"
-#else
-#define LTM_LAST
-#endif
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_superclass.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_superclass.h
deleted file mode 100644
index a9f2f9a73..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/mpi_superclass.h
+++ /dev/null
@@ -1,96 +0,0 @@
-/* mpi_superclass.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-/* super class file for PK algos */
-
-/* default ... include all MPI */
-#define LTM_ALL
-
-/* RSA only (does not support DH/DSA/ECC) */
-/* #define SC_RSA_1 */
-
-/* For reference.... On an Athlon64 optimizing for speed...
-
- LTM's mpi.o with all functions [striped] is 142KiB in size.
-
-*/
-
-/* Works for RSA only, mpi.o is 68KiB */
-#ifdef SC_RSA_1
- #define BN_MP_SHRINK_C
- #define BN_MP_LCM_C
- #define BN_MP_PRIME_RANDOM_EX_C
- #define BN_MP_INVMOD_C
- #define BN_MP_GCD_C
- #define BN_MP_MOD_C
- #define BN_MP_MULMOD_C
- #define BN_MP_ADDMOD_C
- #define BN_MP_EXPTMOD_C
- #define BN_MP_SET_INT_C
- #define BN_MP_INIT_MULTI_C
- #define BN_MP_CLEAR_MULTI_C
- #define BN_MP_UNSIGNED_BIN_SIZE_C
- #define BN_MP_TO_UNSIGNED_BIN_C
- #define BN_MP_MOD_D_C
- #define BN_MP_PRIME_RABIN_MILLER_TRIALS_C
- #define BN_REVERSE_C
- #define BN_PRIME_TAB_C
-
- /* other modifiers */
- #define BN_MP_DIV_SMALL /* Slower division, not critical */
-
- /* here we are on the last pass so we turn things off. The functions classes are still there
- * but we remove them specifically from the build. This also invokes tweaks in functions
- * like removing support for even moduli, etc...
- */
-#ifdef LTM_LAST
- #undef BN_MP_TOOM_MUL_C
- #undef BN_MP_TOOM_SQR_C
- #undef BN_MP_KARATSUBA_MUL_C
- #undef BN_MP_KARATSUBA_SQR_C
- #undef BN_MP_REDUCE_C
- #undef BN_MP_REDUCE_SETUP_C
- #undef BN_MP_DR_IS_MODULUS_C
- #undef BN_MP_DR_SETUP_C
- #undef BN_MP_DR_REDUCE_C
- #undef BN_MP_REDUCE_IS_2K_C
- #undef BN_MP_REDUCE_2K_SETUP_C
- #undef BN_MP_REDUCE_2K_C
- #undef BN_S_MP_EXPTMOD_C
- #undef BN_MP_DIV_3_C
- #undef BN_S_MP_MUL_HIGH_DIGS_C
- #undef BN_FAST_S_MP_MUL_HIGH_DIGS_C
- #undef BN_FAST_MP_INVMOD_C
-
- /* To safely undefine these you have to make sure your RSA key won't exceed the Comba threshold
- * which is roughly 255 digits [7140 bits for 32-bit machines, 15300 bits for 64-bit machines]
- * which means roughly speaking you can handle up to 2536-bit RSA keys with these defined without
- * trouble.
- */
- #undef BN_S_MP_MUL_DIGS_C
- #undef BN_S_MP_SQR_C
- #undef BN_MP_MONTGOMERY_REDUCE_C
-#endif
-
-#endif
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs11.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs11.h
deleted file mode 100644
index 2413e724e..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/pkcs11.h
+++ /dev/null
@@ -1,585 +0,0 @@
-/* pkcs11.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef _PKCS11_H_
-#define _PKCS11_H_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#ifndef NULL_PTR
-#define NULL_PTR 0
-#endif
-#define CK_TRUE 1
-#define CK_FALSE 0
-
-
-#define CK_INVALID_HANDLE 0UL
-
-#define CKN_SURRENDER 0UL
-
-#define CKF_TOKEN_PRESENT 0x00000001UL
-#define CKF_REMOVABLE_DEVICE 0x00000002UL
-#define CKF_HW_SLOT 0x00000004UL
-
-#define CKF_HW 0x00000001UL
-#define CKF_ENCRYPT 0x00000100UL
-#define CKF_DECRYPT 0x00000200UL
-#define CKF_DIGEST 0x00000400UL
-#define CKF_SIGN 0x00000800UL
-#define CKF_SIGN_RECOVER 0x00001000UL
-#define CKF_VERIFY 0x00002000UL
-#define CKF_VERIFY_RECOVER 0x00004000UL
-#define CKF_GENERATE 0x00008000UL
-#define CKF_GENERATE_KEY_PAIR 0x00010000UL
-#define CKF_WRAP 0x00020000UL
-#define CKF_UNWRAP 0x00040000UL
-#define CKF_DERIVE 0x00080000UL
-#define CKF_EC_F_P 0x00100000UL
-#define CKF_EC_F_2M 0x00200000UL
-#define CKF_EC_ECPARAMETERS 0x00400000UL
-#define CKF_EC_NAMEDCURVE 0x00800000UL
-#define CKF_EC_UNCOMPRESS 0x01000000UL
-#define CKF_EC_COMPRESS 0x02000000UL
-
-#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001UL
-#define CKF_OS_LOCKING_OK 0x00000002UL
-
-#define CKU_SO 0UL
-#define CKU_USER 1UL
-#define CKU_CONTEXT_SPECIFIC 2UL
-
-#define CKF_RW_SESSION 0x00000002UL
-#define CKF_SERIAL_SESSION 0x00000004UL
-
-#define CKO_CERTIFICATE 0x00000001UL
-#define CKO_PUBLIC_KEY 0x00000002UL
-#define CKO_PRIVATE_KEY 0x00000003UL
-#define CKO_SECRET_KEY 0x00000004UL
-
-
-#define CKK_RSA 0x00000000UL
-#define CKK_DH 0x00000002UL
-#define CKK_EC 0x00000003UL
-#define CKK_GENERIC_SECRET 0x00000010UL
-#define CKK_AES 0x0000001FUL
-#define CKK_MD5_HMAC 0x00000027UL
-#define CKK_SHA_1_HMAC 0x00000028UL
-#define CKK_SHA256_HMAC 0x0000002bUL
-#define CKK_SHA384_HMAC 0x0000002cUL
-#define CKK_SHA512_HMAC 0x0000002dUL
-#define CKK_SHA224_HMAC 0x0000002eUL
-
-#define CKA_CLASS 0x00000000UL
-#define CKA_TOKEN 0x00000001UL
-#define CKA_PRIVATE 0x00000002UL
-#define CKA_LABEL 0x00000003UL
-#define CKA_VALUE 0x00000011UL
-#define CKA_OBJECT_ID 0x00000012UL
-#define CKA_OWNER 0x00000084UL
-#define CKA_TRUSTED 0x00000086UL
-#define CKA_KEY_TYPE 0x00000100UL
-#define CKA_ID 0x00000102UL
-#define CKA_SENSITIVE 0x00000103UL
-#define CKA_ENCRYPT 0x00000104UL
-#define CKA_DECRYPT 0x00000105UL
-#define CKA_WRAP 0x00000106UL
-#define CKA_UNWRAP 0x00000107UL
-#define CKA_SIGN 0x00000108UL
-#define CKA_SIGN_RECOVER 0x00000109UL
-#define CKA_VERIFY 0x0000010AUL
-#define CKA_VERIFY_RECOVER 0x0000010BUL
-#define CKA_DERIVE 0x0000010CUL
-#define CKA_MODULUS 0x00000120UL
-#define CKA_MODULUS_BITS 0x00000121UL
-#define CKA_PUBLIC_EXPONENT 0x00000122UL
-#define CKA_PRIVATE_EXPONENT 0x00000123UL
-#define CKA_PRIME_1 0x00000124UL
-#define CKA_PRIME_2 0x00000125UL
-#define CKA_EXPONENT_1 0x00000126UL
-#define CKA_EXPONENT_2 0x00000127UL
-#define CKA_COEFFICIENT 0x00000128UL
-#define CKA_PUBLIC_KEY_INFO 0x00000129UL
-#define CKA_PRIME 0x00000130UL
-#define CKA_BASE 0x00000132UL
-#define CKA_PRIME_BITS 0x00000133UL
-#define CKA_VALUE_BITS 0x00000160UL
-#define CKA_VALUE_LEN 0x00000161UL
-#define CKA_EXTRACTABLE 0x00000162UL
-#define CKA_LOCAL 0x00000163UL
-#define CKA_NEVER_EXTRACTABLE 0x00000164UL
-#define CKA_ALWAYS_SENSITIVE 0x00000165UL
-#define CKA_KEY_GEN_MECHANISM 0x00000166UL
-#define CKA_MODIFIABLE 0x00000170UL
-#define CKA_COPYABLE 0x00000171UL
-#define CKA_DESTROYABLE 0x00000172UL
-#define CKA_EC_PARAMS 0x00000180UL
-#define CKA_EC_POINT 0x00000181UL
-#define CKA_ALWAYS_AUTHENTICATE 0x00000202UL
-#define CKA_HW_FEATURE_TYPE 0x00000300UL
-#define CKA_RESET_ON_INIT 0x00000301UL
-#define CKA_HAS_RESET 0x00000302UL
-
-#define CKM_RSA_PKCS_KEY_PAIR_GEN 0x00000000UL
-#define CKM_RSA_PKCS 0x00000001UL
-#define CKM_RSA_X_509 0x00000003UL
-#define CKM_RSA_PKCS_OAEP 0x00000009UL
-#define CKM_RSA_PKCS_PSS 0x0000000DUL
-#define CKM_DH_PKCS_KEY_PAIR_GEN 0x00000020UL
-#define CKM_DH_PKCS_DERIVE 0x00000021UL
-#define CKM_MD5_HMAC 0x00000211UL
-#define CKM_SHA_1 0x00000220UL
-#define CKM_SHA_1_HMAC 0x00000221UL
-#define CKM_SHA256 0x00000250UL
-#define CKM_SHA256_HMAC 0x00000251UL
-#define CKM_SHA224 0x00000255UL
-#define CKM_SHA224_HMAC 0x00000256UL
-#define CKM_SHA384 0x00000260UL
-#define CKM_SHA384_HMAC 0x00000261UL
-#define CKM_SHA512 0x00000270UL
-#define CKM_SHA512_HMAC 0x00000271UL
-#define CKM_GENERIC_SECRET_KEY_GEN 0x00000350UL
-#define CKM_EC_KEY_PAIR_GEN 0x00001040UL
-#define CKM_ECDSA 0x00001041UL
-#define CKM_ECDH1_DERIVE 0x00001050UL
-#define CKM_ECDH1_COFACTOR_DERIVE 0x00001051UL
-#define CKM_AES_KEY_GEN 0x00001080UL
-#define CKM_AES_CBC 0x00001082UL
-#define CKM_AES_CTR 0x00001086UL
-#define CKM_AES_GCM 0x00001087UL
-
-/* full data RSA PK callbacks */
-#define CKM_SHA1_RSA_PKCS_PSS 0x0000000EUL
-#define CKM_SHA256_RSA_PKCS_PSS 0x00000043UL
-#define CKM_SHA384_RSA_PKCS_PSS 0x00000044UL
-#define CKM_SHA512_RSA_PKCS_PSS 0x00000045UL
-#define CKM_SHA224_RSA_PKCS_PSS 0x00000047UL
-
-#define CKG_MGF1_SHA1 0x00000001UL
-#define CKG_MGF1_SHA224 0x00000005UL
-#define CKG_MGF1_SHA256 0x00000002UL
-#define CKG_MGF1_SHA384 0x00000003UL
-#define CKG_MGF1_SHA512 0x00000004UL
-
-
-#define CKR_OK 0x00000000UL
-#define CKR_MECHANISM_INVALID 0x00000070UL
-#define CKR_SIGNATURE_INVALID 0x000000C0UL
-
-#define CKD_NULL 0x00000001UL
-#define CKZ_DATA_SPECIFIED 0x00000001UL
-
-typedef unsigned char CK_BYTE;
-typedef CK_BYTE CK_CHAR;
-typedef CK_BYTE CK_UTF8CHAR;
-typedef CK_BYTE CK_BBOOL;
-typedef unsigned long int CK_ULONG;
-typedef long int CK_LONG;
-typedef CK_ULONG CK_FLAGS;
-typedef CK_BYTE* CK_BYTE_PTR;
-typedef CK_CHAR* CK_CHAR_PTR;
-typedef CK_UTF8CHAR* CK_UTF8CHAR_PTR;
-typedef CK_ULONG* CK_ULONG_PTR;
-typedef void* CK_VOID_PTR;
-typedef CK_VOID_PTR* CK_VOID_PTR_PTR;
-
-
-typedef CK_ULONG CK_RV;
-
-
-typedef struct CK_VERSION {
- CK_BYTE major;
- CK_BYTE minor;
-} CK_VERSION;
-typedef CK_VERSION* CK_VERSION_PTR;
-
-
-/* Info Types */
-typedef struct CK_INFO {
- CK_VERSION cryptokiVersion;
- CK_UTF8CHAR manufacturerID[32];
- CK_FLAGS flags;
- CK_UTF8CHAR libraryDescription[32];
- CK_VERSION libraryVersion;
-} CK_INFO;
-typedef CK_INFO* CK_INFO_PTR;
-
-
-/* Slot Types */
-typedef CK_ULONG CK_SLOT_ID;
-typedef CK_SLOT_ID* CK_SLOT_ID_PTR;
-
-typedef struct CK_SLOT_INFO {
- CK_UTF8CHAR slotDescription[64];
- CK_UTF8CHAR manufacturerID[32];
- CK_FLAGS flags;
-
- CK_VERSION hardwareVersion;
- CK_VERSION firmwareVersion;
-} CK_SLOT_INFO;
-typedef CK_SLOT_INFO* CK_SLOT_INFO_PTR;
-
-
-/* Token Types */
-typedef struct CK_TOKEN_INFO {
- CK_UTF8CHAR label[32];
- CK_UTF8CHAR manufacturerID[32];
- CK_UTF8CHAR model[16];
- CK_CHAR serialNumber[16];
- CK_FLAGS flags;
- CK_ULONG ulMaxSessionCount;
- CK_ULONG ulSessionCount;
- CK_ULONG ulMaxRwSessionCount;
- CK_ULONG ulRwSessionCount;
- CK_ULONG ulMaxPinLen;
- CK_ULONG ulMinPinLen;
- CK_ULONG ulTotalPublicMemory;
- CK_ULONG ulFreePublicMemory;
- CK_ULONG ulTotalPrivateMemory;
- CK_ULONG ulFreePrivateMemory;
- CK_VERSION hardwareVersion;
- CK_VERSION firmwareVersion;
- CK_CHAR utcTime[16];
-} CK_TOKEN_INFO;
-typedef CK_TOKEN_INFO* CK_TOKEN_INFO_PTR;
-
-
-/* Session Types */
-typedef CK_ULONG CK_SESSION_HANDLE;
-typedef CK_SESSION_HANDLE* CK_SESSION_HANDLE_PTR;
-
-typedef CK_ULONG CK_USER_TYPE;
-
-typedef CK_ULONG CK_STATE;
-
-typedef struct CK_SESSION_INFO {
- CK_SLOT_ID slotID;
- CK_STATE state;
- CK_FLAGS flags;
- CK_ULONG ulDeviceError;
-} CK_SESSION_INFO;
-typedef CK_SESSION_INFO* CK_SESSION_INFO_PTR;
-
-
-/* Object Types */
-typedef CK_ULONG CK_OBJECT_HANDLE;
-typedef CK_OBJECT_HANDLE* CK_OBJECT_HANDLE_PTR;
-
-typedef CK_ULONG CK_OBJECT_CLASS;
-typedef CK_OBJECT_CLASS* CK_OBJECT_CLASS_PTR;
-
-typedef CK_ULONG CK_KEY_TYPE;
-
-typedef CK_ULONG CK_ATTRIBUTE_TYPE;
-
-typedef struct CK_ATTRIBUTE {
- CK_ATTRIBUTE_TYPE type;
- CK_VOID_PTR pValue;
- CK_ULONG ulValueLen;
-} CK_ATTRIBUTE;
-typedef CK_ATTRIBUTE* CK_ATTRIBUTE_PTR;
-
-
-/* Mechanism Types */
-typedef CK_ULONG CK_MECHANISM_TYPE;
-typedef CK_MECHANISM_TYPE* CK_MECHANISM_TYPE_PTR;
-
-typedef struct CK_MECHANISM {
- CK_MECHANISM_TYPE mechanism;
- CK_VOID_PTR pParameter;
- CK_ULONG ulParameterLen;
-} CK_MECHANISM;
-typedef CK_MECHANISM* CK_MECHANISM_PTR;
-
-typedef struct CK_MECHANISM_INFO {
- CK_ULONG ulMinKeySize;
- CK_ULONG ulMaxKeySize;
- CK_FLAGS flags;
-} CK_MECHANISM_INFO;
-typedef CK_MECHANISM_INFO * CK_MECHANISM_INFO_PTR;
-
-
-typedef CK_ULONG CK_NOTIFICATION;
-
-typedef CK_RV (*CK_NOTIFY)(CK_SESSION_HANDLE hSession, CK_NOTIFICATION event,
- CK_VOID_PTR pApplication);
-
-
-/* Threading types. */
-typedef CK_RV (*CK_CREATEMUTEX)(CK_VOID_PTR_PTR ppMutex);
-typedef CK_RV (*CK_DESTROYMUTEX)(CK_VOID_PTR pMutex);
-typedef CK_RV (*CK_LOCKMUTEX)(CK_VOID_PTR pMutex);
-typedef CK_RV (*CK_UNLOCKMUTEX)(CK_VOID_PTR pMutex);
-
-typedef struct CK_C_INITIALIZE_ARGS {
- CK_CREATEMUTEX CreateMutex;
- CK_DESTROYMUTEX DestroyMutex;
- CK_LOCKMUTEX LockMutex;
- CK_UNLOCKMUTEX UnlockMutex;
- CK_FLAGS flags;
- CK_VOID_PTR pReserved;
-} CK_C_INITIALIZE_ARGS;
-typedef CK_C_INITIALIZE_ARGS* CK_C_INITIALIZE_ARGS_PTR;
-
-
-/* Cryptographic algorithm types. */
-typedef CK_ULONG CK_EC_KDF_TYPE;
-
-typedef struct CK_ECDH1_DERIVE_PARAMS {
- CK_EC_KDF_TYPE kdf;
- CK_ULONG ulSharedDataLen;
- CK_BYTE_PTR pSharedData;
- CK_ULONG ulPublicDataLen;
- CK_BYTE_PTR pPublicData;
-} CK_ECDH1_DERIVE_PARAMS;
-typedef CK_ECDH1_DERIVE_PARAMS* CK_ECDH1_DERIVE_PARAMS_PTR;
-
-
-typedef struct CK_GCM_PARAMS {
- CK_BYTE_PTR pIv;
- CK_ULONG ulIvLen;
- CK_ULONG ulIvBits;
- CK_BYTE_PTR pAAD;
- CK_ULONG ulAADLen;
- CK_ULONG ulTagBits;
-} CK_GCM_PARAMS;
-typedef CK_GCM_PARAMS* CK_GCM_PARAMS_PTR;
-
-typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
-
-typedef struct CK_RSA_PKCS_PSS_PARAMS {
- CK_MECHANISM_TYPE hashAlg;
- CK_RSA_PKCS_MGF_TYPE mgf;
- CK_ULONG sLen;
-} CK_RSA_PKCS_PSS_PARAMS;
-typedef CK_RSA_PKCS_PSS_PARAMS *CK_RSA_PKCS_PSS_PARAMS_PTR;
-
-typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
-
-typedef struct CK_RSA_PKCS_OAEP_PARAMS {
- CK_MECHANISM_TYPE hashAlg;
- CK_RSA_PKCS_MGF_TYPE mgf;
- CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
- CK_VOID_PTR pSourceData;
- CK_ULONG ulSourceDataLen;
-} CK_RSA_PKCS_OAEP_PARAMS;
-typedef CK_RSA_PKCS_OAEP_PARAMS *CK_RSA_PKCS_OAEP_PARAMS_PTR;
-
-/* Function list types. */
-typedef struct CK_FUNCTION_LIST CK_FUNCTION_LIST;
-typedef CK_FUNCTION_LIST* CK_FUNCTION_LIST_PTR;
-typedef CK_FUNCTION_LIST_PTR* CK_FUNCTION_LIST_PTR_PTR;
-
-typedef CK_RV (*CK_C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR ppFunctionList);
-
-#ifdef HAVE_PKCS11_STATIC
-CK_RV C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList);
-#endif
-
-struct CK_FUNCTION_LIST {
- CK_VERSION version;
-
- CK_RV (*C_Initialize)(CK_VOID_PTR pInitArgs);
- CK_RV (*C_Finalize)(CK_VOID_PTR pReserved);
- CK_RV (*C_GetInfo)(CK_INFO_PTR pInfo);
- CK_RV (*C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR ppFunctionList);
- CK_RV (*C_GetSlotList)(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
- CK_ULONG_PTR pulCount);
- CK_RV (*C_GetSlotInfo)(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo);
- CK_RV (*C_GetTokenInfo)(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo);
- CK_RV (*C_GetMechanismList)(CK_SLOT_ID slotID,
- CK_MECHANISM_TYPE_PTR pMechanismList,
- CK_ULONG_PTR pulCount);
- CK_RV (*C_GetMechanismInfo)(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
- CK_MECHANISM_INFO_PTR pInfo);
- CK_RV (*C_InitToken)(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin,
- CK_ULONG ulPinLen, CK_UTF8CHAR_PTR pLabel);
- CK_RV (*C_InitPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin,
- CK_ULONG ulPinLen);
- CK_RV (*C_SetPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,
- CK_ULONG ulOldLen, CK_UTF8CHAR_PTR pNewPin,
- CK_ULONG ulNewLen);
- CK_RV (*C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags,
- CK_VOID_PTR pApplication, CK_NOTIFY Notify,
- CK_SESSION_HANDLE_PTR phSession);
- CK_RV (*C_CloseSession)(CK_SESSION_HANDLE hSession);
- CK_RV (*C_CloseAllSessions)(CK_SLOT_ID slotID);
- CK_RV (*C_GetSessionInfo)(CK_SESSION_HANDLE hSession,
- CK_SESSION_INFO_PTR pInfo);
- CK_RV (*C_GetOperationState)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pOperationState,
- CK_ULONG_PTR pulOperationStateLen);
- CK_RV (*C_SetOperationState)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pOperationState,
- CK_ULONG ulOperationStateLen,
- CK_OBJECT_HANDLE hEncryptionKey,
- CK_OBJECT_HANDLE hAuthenticationKey);
- CK_RV (*C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
- CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen);
- CK_RV (*C_Logout)(CK_SESSION_HANDLE hSession);
- CK_RV (*C_CreateObject)(CK_SESSION_HANDLE hSession,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
- CK_OBJECT_HANDLE_PTR phObject);
- CK_RV (*C_CopyObject)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
- CK_OBJECT_HANDLE_PTR phNewObject);
- CK_RV (*C_DestroyObject)(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject);
- CK_RV (*C_GetObjectSize)(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pulSize);
- CK_RV (*C_GetAttributeValue)(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
- CK_RV (*C_SetAttributeValue)(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
- CK_RV (*C_FindObjectsInit)(CK_SESSION_HANDLE hSession,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
- CK_RV (*C_FindObjects)(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE_PTR phObject,
- CK_ULONG ulMaxObjectCount,
- CK_ULONG_PTR pulObjectCount);
- CK_RV (*C_FindObjectsFinal)(CK_SESSION_HANDLE hSession);
- CK_RV (*C_EncryptInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey);
- CK_RV (*C_Encrypt)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
- CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData,
- CK_ULONG_PTR pulEncryptedDataLen);
- CK_RV (*C_EncryptUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
- CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
- CK_ULONG_PTR pulEncryptedPartLen);
- CK_RV (*C_EncryptFinal)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pLastEncryptedPart,
- CK_ULONG_PTR pulLastEncryptedPartLen);
- CK_RV (*C_DecryptInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey);
- CK_RV (*C_Decrypt)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
- CK_ULONG ulEncryptedDataLen, CK_BYTE_PTR pData,
- CK_ULONG_PTR pulDataLen);
- CK_RV (*C_DecryptUpdate)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pEncryptedPart,
- CK_ULONG ulEncryptedPartLen, CK_BYTE_PTR pPart,
- CK_ULONG_PTR pulPartLen);
- CK_RV (*C_DecryptFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pLastPart,
- CK_ULONG_PTR pulLastPartLen);
- CK_RV (*C_DigestInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism);
- CK_RV (*C_Digest)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
- CK_ULONG ulDataLen, CK_BYTE_PTR pDigest,
- CK_ULONG_PTR pulDigestLen);
- CK_RV (*C_DigestUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
- CK_ULONG ulPartLen);
- CK_RV (*C_DigestKey)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey);
- CK_RV (*C_DigestFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest,
- CK_ULONG_PTR pulDigestLen);
- CK_RV (*C_SignInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hKey);
- CK_RV (*C_Sign)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
- CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
- CK_ULONG_PTR pulSignatureLen);
- CK_RV (*C_SignUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
- CK_ULONG ulPartLen);
- CK_RV (*C_SignFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
- CK_ULONG_PTR pulSignatureLen);
- CK_RV (*C_SignRecoverInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hKey);
- CK_RV (*C_SignRecover)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
- CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
- CK_ULONG_PTR pulSignatureLen);
- CK_RV (*C_VerifyInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey);
- CK_RV (*C_Verify)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
- CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
- CK_ULONG ulSignatureLen);
- CK_RV (*C_VerifyUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
- CK_ULONG ulPartLen);
- CK_RV (*C_VerifyFinal)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen);
- CK_RV (*C_VerifyRecoverInit)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hKey);
- CK_RV (*C_VerifyRecover)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen,
- CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen);
- CK_RV (*C_DigestEncryptUpdate)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pPart, CK_ULONG ulPartLen,
- CK_BYTE_PTR pEncryptedPart,
- CK_ULONG_PTR pulEncryptedPartLen);
- CK_RV (*C_DecryptDigestUpdate)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pEncryptedPart,
- CK_ULONG ulEncryptedPartLen,
- CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen);
- CK_RV (*C_SignEncryptUpdate)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pPart, CK_ULONG ulPartLen,
- CK_BYTE_PTR pEncryptedPart,
- CK_ULONG_PTR pulEncryptedPartLen);
- CK_RV (*C_DecryptVerifyUpdate)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR pEncryptedPart,
- CK_ULONG ulEncryptedPartLen,
- CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen);
- CK_RV (*C_GenerateKey)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
- CK_OBJECT_HANDLE_PTR phKey);
- CK_RV (*C_GenerateKeyPair)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_ATTRIBUTE_PTR pPublicKeyTemplate,
- CK_ULONG ulPublicKeyAttributeCount,
- CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
- CK_ULONG ulPrivateKeyAttributeCount,
- CK_OBJECT_HANDLE_PTR phPublicKey,
- CK_OBJECT_HANDLE_PTR phPrivateKey);
- CK_RV (*C_WrapKey)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey,
- CK_BYTE_PTR pWrappedKey,
- CK_ULONG_PTR pulWrappedKeyLen);
- CK_RV (*C_UnwrapKey)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hUnwrappingKey,
- CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen,
- CK_ATTRIBUTE_PTR pTemplate,
- CK_ULONG ulAttributeCount,
- CK_OBJECT_HANDLE_PTR phKey);
- CK_RV (*C_DeriveKey)(CK_SESSION_HANDLE hSession,
- CK_MECHANISM_PTR pMechanism,
- CK_OBJECT_HANDLE hBaseKey,
- CK_ATTRIBUTE_PTR pTemplate,
- CK_ULONG ulAttributeCount,
- CK_OBJECT_HANDLE_PTR phKey);
- CK_RV (*C_SeedRandom)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed,
- CK_ULONG ulSeedLen);
- CK_RV (*C_GenerateRandom)(CK_SESSION_HANDLE hSession,
- CK_BYTE_PTR RandomData, CK_ULONG ulRandomLen);
- CK_RV (*C_GetFunctionStatus)(CK_SESSION_HANDLE hSession);
- CK_RV (*C_CancelFunction)(CK_SESSION_HANDLE hSession);
- CK_RV (*C_WaitForSlotEvent)(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot,
- CK_VOID_PTR pRserved);
-
-};
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* _PKCS11_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/sakke.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/sakke.h
deleted file mode 100644
index 37db5a15f..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/sakke.h
+++ /dev/null
@@ -1,228 +0,0 @@
-/* sakke.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/sakke.h
-*/
-
-
-#ifndef WOLF_CRYPT_SAKKE_H
-#define WOLF_CRYPT_SAKKE_H
-
-#include
-
-#ifdef WOLFCRYPT_HAVE_SAKKE
-
-#include
-#include
-#include
-#include
-
-#define WOLFCRYPT_SAKKE_KMS
-#define WOLFCRYPT_SAKKE_CLIENT
-
-#define SAKKE_ID_MAX_SIZE 128
-
-/* Maximum number of loops of attempting to generate a key. */
-#ifndef SAKKE_MAX_GEN_COUNT
- #define SAKKE_MAX_GEN_COUNT 10
-#endif
-
-
-/** MP integer in projective form. */
-typedef ecc_point mp_proj;
-
-/** SAKKE ECC parameters in usable format. */
-typedef struct SakkeKeyParams {
- /** Prime as an MP integer. */
- mp_int prime;
- /** Q (order) as an MP integer. */
- mp_int q;
- /** G (pairing base) as an MP integer. */
- mp_int g;
- /** Temporary MP integer used during operations. */
- mp_int a;
- /** Base point for elliptic curve operations as an ECC point. */
- ecc_point* base;
-
- /** Bit indicate prime is set as an MP integer in SAKKE key. */
- WC_BITFIELD havePrime:1;
- /** Bit indicates q (order) is set as an MP integer in SAKKE key. */
- WC_BITFIELD haveQ:1;
- /** Bit indicates g (pairing base) is set as an MP integer in SAKKE key. */
- WC_BITFIELD haveG:1;
- /** Bit indicates a is set as an MP integer in SAKKE key. */
- WC_BITFIELD haveA:1;
- /** Bit indicates base point is set as an ECC point in SAKKE key. */
- WC_BITFIELD haveBase:1;
-} SakkeKeyParams;
-
-/** Temporary values to use in SAKKE calculations. */
-typedef struct SakkeKeyTmp {
- /** Temporary MP integer used during operations. */
- mp_int m1;
- /** Temporary MP integer used during operations. */
- mp_int m2;
-
-#ifdef WOLFCRYPT_SAKKE_CLIENT
- /** Temporary elliptic curve point for use in operations. */
- ecc_point* p1;
- /** Temporary elliptic curve point for use in operations. */
- ecc_point* p2;
- /** Temporary MP projective integer for use in operations. */
- mp_proj* p3;
-#endif
-} SakkeKeyTmp;
-
-#ifdef WOLFCRYPT_SAKKE_CLIENT
-/** SAKKE data for the intermediate point I. */
-typedef struct SakkeKeyPointI {
- /** Temporary elliptic curve point for use in operations. */
- ecc_point* i;
- /** Table associated with point I. */
- byte* table;
- /** Length of table */
- word32 tableLen;
- /** Identity associated with point I. */
- byte id[SAKKE_ID_MAX_SIZE];
- /** Size of identity associated with point I. */
- word16 idSz;
-} SakkeKeyPointI;
-
-/** SAKKE data for the Receiver Secret Key (RSK). */
-typedef struct SakkeKeyRsk {
- /** RSK (Receiver Secret Key). */
- ecc_point* rsk;
- /** Table associated with point I. */
- byte* table;
- /** Length of table */
- word32 tableLen;
- /** Indicates whether an RSK value has been set. */
- WC_BITFIELD set:1;
-} SakkeKeyRsk;
-#endif
-
-/**
- * SAKKE key.
- */
-typedef struct SakkeKey {
- /** ECC key to perform elliptic curve operations with. */
- ecc_key ecc;
-
- /** ECC parameter in forms that can be used in computation. */
- SakkeKeyParams params;
- /** Temporaries used during calculations. */
- SakkeKeyTmp tmp;
-
-#ifdef WOLFCRYPT_SAKKE_CLIENT
- /** Data relating to the RSK (Receiver Secret Key). */
- SakkeKeyRsk rsk;
- /** Identity to perform operations with. */
- byte id[SAKKE_ID_MAX_SIZE];
- /** Size of identity in bytes. */
- word16 idSz;
-
- /** Data relating to the intermediate point I. */
- SakkeKeyPointI i;
-
- /** Generic hash algorithm object. */
- wc_HashAlg hash;
- /** Temporary buffer for use in operations. */
- byte data[(MAX_ECC_BYTES * 2) + 1];
-#endif
-
- /** Heap hint for dynamic memory allocation. */
- void* heap;
-
- /** Bit indicates Z, public key, is in montgomery form. */
- WC_BITFIELD zMont:1;
- /** Bit indicate MP integers have been initialized. */
- WC_BITFIELD mpInit:1;
-} SakkeKey;
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_API int wc_InitSakkeKey(SakkeKey* key, void* heap, int devId);
-WOLFSSL_API int wc_InitSakkeKey_ex(SakkeKey* key, int keySize, int curveId,
- void* heap, int devId);
-WOLFSSL_API void wc_FreeSakkeKey(SakkeKey* key);
-
-WOLFSSL_API int wc_MakeSakkeKey(SakkeKey* key, WC_RNG* rng);
-WOLFSSL_API int wc_MakeSakkePublicKey(SakkeKey* key, ecc_point* pub);
-
-WOLFSSL_API int wc_MakeSakkeRsk(SakkeKey* key, const byte* id, word16 idSz,
- ecc_point* rsk);
-WOLFSSL_API int wc_ValidateSakkeRsk(SakkeKey* key, const byte* id, word16 idSz,
- ecc_point* rsk, int* valid);
-
-WOLFSSL_API int wc_ExportSakkeKey(SakkeKey* key, byte* data, word32* sz);
-WOLFSSL_API int wc_ImportSakkeKey(SakkeKey* key, const byte* data, word32 sz);
-WOLFSSL_API int wc_ExportSakkePrivateKey(SakkeKey* key, byte* data, word32* sz);
-WOLFSSL_API int wc_ImportSakkePrivateKey(SakkeKey* key, const byte* data,
- word32 sz);
-WOLFSSL_API int wc_ExportSakkePublicKey(SakkeKey* key, byte* data,
- word32* sz, int raw);
-WOLFSSL_API int wc_ImportSakkePublicKey(SakkeKey* key, const byte* data,
- word32 sz, int trusted);
-
-WOLFSSL_API int wc_EncodeSakkeRsk(const SakkeKey* key, ecc_point* rsk,
- byte* out, word32* sz, int raw);
-WOLFSSL_API int wc_DecodeSakkeRsk(const SakkeKey* key, const byte* data,
- word32 sz, ecc_point* rsk);
-WOLFSSL_API int wc_ImportSakkeRsk(SakkeKey* key, const byte* data, word32 sz);
-
-WOLFSSL_API int wc_GetSakkeAuthSize(SakkeKey* key, word16* authSz);
-
-WOLFSSL_API int wc_SetSakkeIdentity(SakkeKey* key, const byte* id, word16 idSz);
-WOLFSSL_API int wc_MakeSakkePointI(SakkeKey* key, const byte* id, word16 idSz);
-WOLFSSL_API int wc_GetSakkePointI(SakkeKey* key, byte* data, word32* sz);
-WOLFSSL_API int wc_SetSakkePointI(SakkeKey* key, const byte* id, word16 idSz,
- const byte* data, word32 sz);
-WOLFSSL_API int wc_GenerateSakkePointITable(SakkeKey* key, byte* table,
- word32* len);
-WOLFSSL_API int wc_SetSakkePointITable(SakkeKey* key, byte* table, word32 len);
-WOLFSSL_API int wc_ClearSakkePointITable(SakkeKey* key);
-
-WOLFSSL_API int wc_MakeSakkeEncapsulatedSSV(SakkeKey* key,
- enum wc_HashType hashType, byte* ssv, word16 ssvSz, byte* auth,
- word16* authSz);
-
-WOLFSSL_API int wc_GenerateSakkeRskTable(const SakkeKey* key,
- const ecc_point* rsk, byte* table, word32* len);
-WOLFSSL_API int wc_SetSakkeRsk(SakkeKey* key, const ecc_point* rsk, byte* table,
- word32 len);
-
-WOLFSSL_API int wc_GenerateSakkeSSV(SakkeKey* key, WC_RNG* rng, byte* ssv,
- word16* ssvSz);
-WOLFSSL_API int wc_DeriveSakkeSSV(SakkeKey* key, enum wc_HashType hashType,
- byte* ssv, word16 ssvSz, const byte* auth,
- word16 authSz);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFCRYPT_HAVE_SAKKE */
-
-#endif /* WOLF_CRYPT_SAKKE_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/selftest.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/selftest.h
deleted file mode 100644
index 11758e325..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/selftest.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* selftest.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-#ifndef WOLFCRYPT_SELF_TEST_H
-#define WOLFCRYPT_SELF_TEST_H
-
-#include
-
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#ifdef HAVE_SELFTEST
- /* Get wolfCrypt CAVP version */
- WOLFSSL_API const char* wolfCrypt_GetVersion_CAVP_selftest(void);
-
- /* wolfCrypt self test, runs CAVP KATs */
- WOLFSSL_API int wolfCrypt_SelfTest(void);
-#endif
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFCRYPT_SELF_TEST_H */
-
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/sp.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/sp.h
deleted file mode 100644
index 666bbb9f1..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/sp.h
+++ /dev/null
@@ -1,447 +0,0 @@
-/* sp.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-#ifndef WOLF_CRYPT_SP_H
-#define WOLF_CRYPT_SP_H
-
-#include
-#include
-
-#if defined(WOLFSSL_HAVE_SP_RSA) || defined(WOLFSSL_HAVE_SP_DH) || \
- defined(WOLFSSL_HAVE_SP_ECC)
-#ifdef _WIN32_WCE
- typedef __int8 int8_t;
- typedef __int32 int32_t;
- typedef __int64 int64_t;
- typedef unsigned __int8 uint8_t;
- typedef unsigned __int32 uint32_t;
- typedef unsigned __int64 uint64_t;
-#elif !defined(NO_STDINT_H)
- #include
-#endif
-
-#include
-#include
-
-#if defined(HAVE_ECC) && defined(WOLFSSL_HAVE_SP_ECC)
- #include
-#else
- #undef WOLFSSL_HAVE_SP_ECC
-#endif
-
-#ifdef noinline
- #define SP_NOINLINE noinline
-#elif defined(_MSC_VER)
- #define SP_NOINLINE __declspec(noinline)
-#elif defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
- #define SP_NOINLINE _Pragma("inline = never")
-#elif defined(__GNUC__) || defined(__KEIL__) || defined(__DCC__)
- #define SP_NOINLINE __attribute__((noinline))
-#else
- #define SP_NOINLINE
-#endif
-
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#ifdef WOLFSSL_HAVE_SP_RSA
-
-/* non-const versions only needed for inlined ARM assembly */
-#if defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION == 2 \
- && ( defined(WOLFSSL_SP_ARM32_ASM) || defined(WOLFSSL_SP_ARM64_ASM) )
-
-WOLFSSL_LOCAL int sp_RsaPublic_2048(const byte* in, word32 inLen,
- mp_int* em, mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_2048(const byte* in, word32 inLen,
- mp_int* dm, mp_int* pm, mp_int* qm, mp_int* dpm, mp_int* dqm, mp_int* qim,
- mp_int* mm, byte* out, word32* outLen);
-
-WOLFSSL_LOCAL int sp_RsaPublic_3072(const byte* in, word32 inLen,
- mp_int* em, mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_3072(const byte* in, word32 inLen,
- mp_int* dm, mp_int* pm, mp_int* qm, mp_int* dpm, mp_int* dqm, mp_int* qim,
- mp_int* mm, byte* out, word32* outLen);
-
-WOLFSSL_LOCAL int sp_RsaPublic_4096(const byte* in, word32 inLen,
- mp_int* em, mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_4096(const byte* in, word32 inLen,
- mp_int* dm, mp_int* pm, mp_int* qm, mp_int* dpm, mp_int* dqm, mp_int* qim,
- mp_int* mm, byte* out, word32* outLen);
-
-#else
-
-WOLFSSL_LOCAL int sp_RsaPublic_2048(const byte* in, word32 inLen,
- const mp_int* em, const mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_2048(const byte* in, word32 inLen,
- const mp_int* dm, const mp_int* pm, const mp_int* qm, const mp_int* dpm,
- const mp_int* dqm, const mp_int* qim, const mp_int* mm, byte* out,
- word32* outLen);
-
-WOLFSSL_LOCAL int sp_RsaPublic_3072(const byte* in, word32 inLen,
- const mp_int* em, const mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_3072(const byte* in, word32 inLen,
- const mp_int* dm, const mp_int* pm, const mp_int* qm, const mp_int* dpm,
- const mp_int* dqm, const mp_int* qim, const mp_int* mm, byte* out,
- word32* outLen);
-
-WOLFSSL_LOCAL int sp_RsaPublic_4096(const byte* in, word32 inLen,
- const mp_int* em, const mp_int* mm, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_RsaPrivate_4096(const byte* in, word32 inLen,
- const mp_int* dm, const mp_int* pm, const mp_int* qm, const mp_int* dpm,
- const mp_int* dqm, const mp_int* qim, const mp_int* mm, byte* out,
- word32* outLen);
-
-#endif /* HAVE_FIPS_VERSION && HAVE_FIPS_VERSION == 2 && !WOLFSSL_SP_ARM[32|64]_ASM */
-
-#endif /* WOLFSSL_HAVE_SP_RSA */
-
-#if defined(WOLFSSL_HAVE_SP_DH) || defined(WOLFSSL_HAVE_SP_RSA)
-
-/* non-const versions only needed for inlined ARM assembly */
-#if defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION == 2 \
- && ( defined(WOLFSSL_SP_ARM32_ASM) || defined(WOLFSSL_SP_ARM64_ASM) )
-
-WOLFSSL_LOCAL int sp_ModExp_1024(mp_int* base, mp_int* exp, mp_int* mod,
- mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_1536(mp_int* base, mp_int* exp, mp_int* mod,
- mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_2048(mp_int* base, mp_int* exp, mp_int* mod,
- mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_3072(mp_int* base, mp_int* exp, mp_int* mod,
- mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_4096(mp_int* base, mp_int* exp, mp_int* mod,
- mp_int* res);
-
-#else
-
-WOLFSSL_LOCAL int sp_ModExp_1024(const mp_int* base, const mp_int* exp,
- const mp_int* mod, mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_1536(const mp_int* base, const mp_int* exp,
- const mp_int* mod, mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_2048(const mp_int* base, const mp_int* exp,
- const mp_int* mod, mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_3072(const mp_int* base, const mp_int* exp,
- const mp_int* mod, mp_int* res);
-WOLFSSL_LOCAL int sp_ModExp_4096(const mp_int* base, const mp_int* exp,
- const mp_int* mod, mp_int* res);
-
-#endif /* HAVE_FIPS_VERSION && HAVE_FIPS_VERSION == 2 && !WOLFSSL_SP_ARM[32|64]_ASM */
-
-#endif
-
-#ifdef WOLFSSL_HAVE_SP_DH
-
-/* non-const versions only needed for inlined ARM assembly */
-#if defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION == 2 \
- && ( defined(WOLFSSL_SP_ARM32_ASM) || defined(WOLFSSL_SP_ARM64_ASM) )
-
-WOLFSSL_LOCAL int sp_DhExp_2048(mp_int* base, const byte* exp, word32 expLen,
- mp_int* mod, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_DhExp_3072(mp_int* base, const byte* exp, word32 expLen,
- mp_int* mod, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_DhExp_4096(mp_int* base, const byte* exp, word32 expLen,
- mp_int* mod, byte* out, word32* outLen);
-
-#else
-
-WOLFSSL_LOCAL int sp_DhExp_2048(const mp_int* base, const byte* exp,
- word32 expLen, const mp_int* mod, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_DhExp_3072(const mp_int* base, const byte* exp,
- word32 expLen, const mp_int* mod, byte* out, word32* outLen);
-WOLFSSL_LOCAL int sp_DhExp_4096(const mp_int* base, const byte* exp,
- word32 expLen, const mp_int* mod, byte* out, word32* outLen);
-
-#endif /* HAVE_FIPS_VERSION && HAVE_FIPS_VERSION == 2 && !WOLFSSL_SP_ARM[32|64]_ASM */
-
-#endif /* WOLFSSL_HAVE_SP_DH */
-
-#ifdef WOLFSSL_HAVE_SP_ECC
-
-/* non-const versions only needed for inlined ARM assembly */
-#if defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION == 2 \
- && ( defined(WOLFSSL_SP_ARM32_ASM) || defined(WOLFSSL_SP_ARM64_ASM) )
-
-int sp_ecc_mulmod_256(mp_int* km, ecc_point* gm, ecc_point* rm, int map,
- void* heap);
-int sp_ecc_mulmod_base_256(mp_int* km, ecc_point* rm, int map, void* heap);
-
-int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap);
-int sp_ecc_secret_gen_256(mp_int* priv, ecc_point* pub, byte* out,
- word32* outlen, void* heap);
-int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng, mp_int* priv,
- mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-int sp_ecc_verify_256(const byte* hash, word32 hashLen, mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* r, mp_int* sm, int* res, void* heap);
-int sp_ecc_is_point_256(mp_int* pX, mp_int* pY);
-int sp_ecc_check_key_256(mp_int* pX, mp_int* pY, mp_int* privm, void* heap);
-int sp_ecc_proj_add_point_256(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* qX, mp_int* qY, mp_int* qZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-int sp_ecc_proj_dbl_point_256(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-int sp_ecc_map_256(mp_int* pX, mp_int* pY, mp_int* pZ);
-int sp_ecc_uncompress_256(mp_int* xm, int odd, mp_int* ym);
-
-
-int sp_ecc_mulmod_384(mp_int* km, ecc_point* gm, ecc_point* rm, int map,
- void* heap);
-int sp_ecc_mulmod_base_384(mp_int* km, ecc_point* rm, int map, void* heap);
-
-int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap);
-int sp_ecc_secret_gen_384(mp_int* priv, ecc_point* pub, byte* out,
- word32* outlen, void* heap);
-int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng, mp_int* priv,
- mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-int sp_ecc_verify_384(const byte* hash, word32 hashLen, mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* r, mp_int* sm, int* res, void* heap);
-int sp_ecc_is_point_384(mp_int* pX, mp_int* pY);
-int sp_ecc_check_key_384(mp_int* pX, mp_int* pY, mp_int* privm, void* heap);
-int sp_ecc_proj_add_point_384(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* qX, mp_int* qY, mp_int* qZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-int sp_ecc_proj_dbl_point_384(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-int sp_ecc_map_384(mp_int* pX, mp_int* pY, mp_int* pZ);
-int sp_ecc_uncompress_384(mp_int* xm, int odd, mp_int* ym);
-
-#else
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* rm,
- int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_add_256(const mp_int* km,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub,
- void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_256(const mp_int* priv,
- const ecc_point* pub, byte* out, word32* outlen, void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
- const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_256(const byte* hash, word32 hashLen,
- const mp_int* pX, const mp_int* pY, const mp_int* pZ, const mp_int* r,
- const mp_int* sm, int* res, void* heap);
-WOLFSSL_LOCAL int sp_ecc_is_point_256(const mp_int* pX, const mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY,
- const mp_int* privm, void* heap);
-WOLFSSL_LOCAL int sp_ecc_proj_add_point_256(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* qX, mp_int* qY, mp_int* qZ, mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_proj_dbl_point_256(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_map_256(mp_int* pX, mp_int* pY, mp_int* pZ);
-WOLFSSL_LOCAL int sp_ecc_uncompress_256(mp_int* xm, int odd, mp_int* ym);
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* rm,
- int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_add_384(const mp_int* km,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_384(const mp_int* priv,
- const ecc_point* pub, byte* out, word32* outlen, void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
- const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_384(const byte* hash, word32 hashLen,
- const mp_int* pX, const mp_int* pY, const mp_int* pZ, const mp_int* r,
- const mp_int* sm, int* res, void* heap);
-WOLFSSL_LOCAL int sp_ecc_is_point_384(const mp_int* pX, const mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY,
- const mp_int* privm, void* heap);
-WOLFSSL_LOCAL int sp_ecc_proj_add_point_384(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* qX, mp_int* qY, mp_int* qZ, mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_proj_dbl_point_384(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_map_384(mp_int* pX, mp_int* pY, mp_int* pZ);
-WOLFSSL_LOCAL int sp_ecc_uncompress_384(mp_int* xm, int odd, mp_int* ym);
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* rm,
- int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_add_521(const mp_int* km,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_521(const mp_int* priv,
- const ecc_point* pub, byte* out, word32* outlen, void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
- const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_521(const byte* hash, word32 hashLen,
- const mp_int* pX, const mp_int* pY, const mp_int* pZ, const mp_int* r,
- const mp_int* sm, int* res, void* heap);
-WOLFSSL_LOCAL int sp_ecc_is_point_521(const mp_int* pX, const mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY,
- const mp_int* privm, void* heap);
-WOLFSSL_LOCAL int sp_ecc_proj_add_point_521(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* qX, mp_int* qY, mp_int* qZ, mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_proj_dbl_point_521(mp_int* pX, mp_int* pY, mp_int* pZ,
- mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_map_521(mp_int* pX, mp_int* pY, mp_int* pZ);
-WOLFSSL_LOCAL int sp_ecc_uncompress_521(mp_int* xm, int odd, mp_int* ym);
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* rm,
- int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_add_1024(const mp_int* km,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_gen_table_1024(const ecc_point* gm, byte* table,
- word32* len, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_table_1024(const mp_int* km,
- const ecc_point* gm, byte* table, ecc_point* r, int map, void* heap);
-WOLFSSL_LOCAL int sp_ModExp_Fp_star_1024(const mp_int* base, mp_int* exp,
- mp_int* res);
-WOLFSSL_LOCAL int sp_Pairing_1024(const ecc_point* p, const ecc_point* q,
- mp_int* res);
-WOLFSSL_LOCAL int sp_Pairing_gen_precomp_1024(const ecc_point* p, byte* table,
- word32* len);
-WOLFSSL_LOCAL int sp_Pairing_precomp_1024(const ecc_point* p,
- const ecc_point* q, mp_int* res, const byte* table, word32 len);
-WOLFSSL_LOCAL int sp_ecc_is_point_1024(const mp_int* pX, const mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY,
- const mp_int* privm, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_sm2_256(const mp_int* km, const ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_add_sm2_256(const mp_int* km, const ecc_point* gm,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_sm2_256(const mp_int* km, ecc_point* rm,
- int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_add_sm2_256(const mp_int* km,
- const ecc_point* am, int inMont, ecc_point* rm, int map, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_sm2_256(WC_RNG* rng, mp_int* priv,
- ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_sm2_256(const mp_int* priv,
- const ecc_point* pub, byte* out, word32* outlen, void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_sm2_256(const byte* hash, word32 hashLen,
- WC_RNG* rng, const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km,
- void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_sm2_256(const byte* hash, word32 hashLen,
- const mp_int* pX, const mp_int* pY, const mp_int* pZ, const mp_int* r,
- const mp_int* sm, int* res, void* heap);
-WOLFSSL_LOCAL int sp_ecc_is_point_sm2_256(const mp_int* pX, const mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_sm2_256(const mp_int* pX, const mp_int* pY,
- const mp_int* privm, void* heap);
-WOLFSSL_LOCAL int sp_ecc_proj_add_point_sm2_256(mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* qX, mp_int* qY, mp_int* qZ, mp_int* rX, mp_int* rY,
- mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_proj_dbl_point_sm2_256(mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_map_sm2_256(mp_int* pX, mp_int* pY, mp_int* pZ);
-WOLFSSL_LOCAL int sp_ecc_uncompress_sm2_256(mp_int* xm, int odd, mp_int* ym);
-
-#endif /* HAVE_FIPS_VERSION && HAVE_FIPS_VERSION == 2 && !WOLFSSL_SP_ARM[32|64]_ASM */
-
-#ifdef WOLFSSL_SP_NONBLOCK
-WOLFSSL_LOCAL int sp_ecc_make_key_256_nb(sp_ecc_ctx_t* sp_ctx, WC_RNG* rng,
- mp_int* priv, ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_256_nb(sp_ecc_ctx_t* sp_ctx,
- const mp_int* priv, const ecc_point* pub, byte* out, word32* outLen,
- void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_256_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, WC_RNG* rng, mp_int* priv, mp_int* rm, mp_int* sm,
- mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_256_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, const mp_int* pX, const mp_int* pY, const mp_int* pZ,
- const mp_int* r, const mp_int* sm, int* res, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_384_nb(sp_ecc_ctx_t* sp_ctx, WC_RNG* rng,
- mp_int* priv, ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_384_nb(sp_ecc_ctx_t* sp_ctx,
- const mp_int* priv, const ecc_point* pub, byte* out, word32* outLen,
- void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_384_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, WC_RNG* rng, mp_int* priv, mp_int* rm, mp_int* sm,
- mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_384_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, const mp_int* pX, const mp_int* pY, const mp_int* pZ,
- const mp_int* r, const mp_int* sm, int* res, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_521_nb(sp_ecc_ctx_t* sp_ctx, WC_RNG* rng,
- mp_int* priv, ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_521_nb(sp_ecc_ctx_t* sp_ctx,
- const mp_int* priv, const ecc_point* pub, byte* out, word32* outLen,
- void* heap);
-WOLFSSL_LOCAL int sp_ecc_sign_521_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, WC_RNG* rng, mp_int* priv, mp_int* rm, mp_int* sm,
- mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_521_nb(sp_ecc_ctx_t* ctx, const byte* hash,
- word32 hashLen, const mp_int* pX, const mp_int* pY, const mp_int* pZ,
- const mp_int* r, const mp_int* sm, int* res, void* heap);
-#endif /* WOLFSSL_SP_NONBLOCK */
-
-#ifdef HAVE_ECC_SM2
-
-WOLFSSL_LOCAL int sp_ecc_mulmod_sm2_256(mp_int* km, ecc_point* gm,
- ecc_point* rm, int map, void* heap);
-WOLFSSL_LOCAL int sp_ecc_mulmod_base_sm2_256(mp_int* km, ecc_point* rm, int map,
- void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_make_key_sm2_256(WC_RNG* rng, mp_int* priv,
- ecc_point* pub, void* heap);
-WOLFSSL_LOCAL int sp_ecc_secret_gen_sm2_256(mp_int* priv, ecc_point* pub,
- byte* out, word32* outlen, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_sign_sm2_256(const byte* hash, word32 hashLen,
- WC_RNG* rng, mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap);
-WOLFSSL_LOCAL int sp_ecc_verify_sm2_256(const byte* hash, word32 hashLen,
- mp_int* pX, mp_int* pY, mp_int* pZ, mp_int* r, mp_int* sm, int* res,
- void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_is_point_sm2_256(mp_int* pX, mp_int* pY);
-WOLFSSL_LOCAL int sp_ecc_check_key_sm2_256(mp_int* pX, mp_int* pY,
- mp_int* privm, void* heap);
-
-WOLFSSL_LOCAL int sp_ecc_proj_add_point_sm2_256(mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* qX, mp_int* qY, mp_int* qZ, mp_int* rX, mp_int* rY,
- mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_proj_dbl_point_sm2_256(mp_int* pX, mp_int* pY,
- mp_int* pZ, mp_int* rX, mp_int* rY, mp_int* rZ);
-WOLFSSL_LOCAL int sp_ecc_map_sm2_256(mp_int* pX, mp_int* pY, mp_int* pZ);
-WOLFSSL_LOCAL int sp_ecc_uncompress_sm2_256(mp_int* xm, int odd, mp_int* ym);
-
-#endif
-
-
-#endif /* WOLFSSL_HAVE_SP_ECC */
-
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_SP_RSA || WOLFSSL_HAVE_SP_DH || WOLFSSL_HAVE_SP_ECC */
-
-#endif /* WOLF_CRYPT_SP_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/sphincs.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/sphincs.h
deleted file mode 100644
index 06928aa22..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/sphincs.h
+++ /dev/null
@@ -1,167 +0,0 @@
-/* sphincs.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/sphincs.h
-*/
-
-/* Interfaces for Sphincs:
- * - SPHINCS_FAST_LEVEL1 (AKA SPHINCS+-SHAKE-128f-simple)
- * - SPHINCS_FAST_LEVEL3 (AKA SPHINCS+-SHAKE-192f-simple)
- * - SPHINCS_FAST_LEVEL5 (AKA SPHINCS+-SHAKE-256f-simple)
- * - SPHINCS_SMALL_LEVEL1 (AKA SPHINCS+-SHAKE-128s-simple)
- * - SPHINCS_SMALL_LEVEL3 (AKA SPHINCS+-SHAKE-192s-simple)
- * - SPHINCS_SMALL_LEVEL5 (AKA SPHINCS+-SHAKE-256s-simple)
- */
-
-#ifndef WOLF_CRYPT_SPHINCS_H
-#define WOLF_CRYPT_SPHINCS_H
-
-#include
-
-#if defined(HAVE_PQC) && defined(HAVE_SPHINCS)
-
-#ifdef HAVE_LIBOQS
-#include
-#include
-#endif
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* Macros Definitions */
-
-#ifdef HAVE_LIBOQS
-
-#define SPHINCS_FAST_LEVEL1_SIG_SIZE OQS_SIG_sphincs_shake_128f_simple_length_signature
-#define SPHINCS_FAST_LEVEL3_SIG_SIZE OQS_SIG_sphincs_shake_192f_simple_length_signature
-#define SPHINCS_FAST_LEVEL5_SIG_SIZE OQS_SIG_sphincs_shake_256f_simple_length_signature
-#define SPHINCS_SMALL_LEVEL1_SIG_SIZE OQS_SIG_sphincs_shake_128s_simple_length_signature
-#define SPHINCS_SMALL_LEVEL3_SIG_SIZE OQS_SIG_sphincs_shake_192s_simple_length_signature
-#define SPHINCS_SMALL_LEVEL5_SIG_SIZE OQS_SIG_sphincs_shake_256s_simple_length_signature
-
-#define SPHINCS_LEVEL1_KEY_SIZE OQS_SIG_sphincs_shake_128f_simple_length_secret_key
-#define SPHINCS_LEVEL1_PUB_KEY_SIZE OQS_SIG_sphincs_shake_128f_simple_length_public_key
-#define SPHINCS_LEVEL1_PRV_KEY_SIZE (SPHINCS_LEVEL1_PUB_KEY_SIZE+SPHINCS_LEVEL1_KEY_SIZE)
-
-#define SPHINCS_LEVEL3_KEY_SIZE OQS_SIG_sphincs_shake_192f_simple_length_secret_key
-#define SPHINCS_LEVEL3_PUB_KEY_SIZE OQS_SIG_sphincs_shake_192f_simple_length_public_key
-#define SPHINCS_LEVEL3_PRV_KEY_SIZE (SPHINCS_LEVEL3_PUB_KEY_SIZE+SPHINCS_LEVEL3_KEY_SIZE)
-
-#define SPHINCS_LEVEL5_KEY_SIZE OQS_SIG_sphincs_shake_256f_simple_length_secret_key
-#define SPHINCS_LEVEL5_PUB_KEY_SIZE OQS_SIG_sphincs_shake_256f_simple_length_public_key
-#define SPHINCS_LEVEL5_PRV_KEY_SIZE (SPHINCS_LEVEL5_PUB_KEY_SIZE+SPHINCS_LEVEL5_KEY_SIZE)
-#endif
-
-#define SPHINCS_MAX_SIG_SIZE SPHINCS_FAST_LEVEL5_SIG_SIZE
-#define SPHINCS_MAX_KEY_SIZE SPHINCS_LEVEL5_PRV_KEY_SIZE
-#define SPHINCS_MAX_PUB_KEY_SIZE SPHINCS_LEVEL5_PUB_KEY_SIZE
-#define SPHINCS_MAX_PRV_KEY_SIZE SPHINCS_LEVEL5_PRV_KEY_SIZE
-
-#define FAST_VARIANT 1
-#define SMALL_VARIANT 2
-
-/* Structs */
-
-struct sphincs_key {
- bool pubKeySet;
- bool prvKeySet;
- byte level; /* 1,3 or 5 */
- byte optim; /* FAST_VARIANT or SMALL_VARIANT */
- byte p[SPHINCS_MAX_PUB_KEY_SIZE];
- byte k[SPHINCS_MAX_PRV_KEY_SIZE];
-};
-
-#ifndef WC_SPHINCSKEY_TYPE_DEFINED
- typedef struct sphincs_key sphincs_key;
- #define WC_SPHINCSKEY_TYPE_DEFINED
-#endif
-
-/* Functions */
-
-WOLFSSL_API
-int wc_sphincs_sign_msg(const byte* in, word32 inLen, byte* out, word32 *outLen,
- sphincs_key* key, WC_RNG* rng);
-WOLFSSL_API
-int wc_sphincs_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
- word32 msgLen, int* res, sphincs_key* key);
-
-WOLFSSL_API
-int wc_sphincs_init(sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_set_level_and_optim(sphincs_key* key, byte level, byte optim);
-WOLFSSL_API
-int wc_sphincs_get_level_and_optim(sphincs_key* key, byte* level, byte *optim);
-WOLFSSL_API
-void wc_sphincs_free(sphincs_key* key);
-
-WOLFSSL_API
-int wc_sphincs_import_public(const byte* in, word32 inLen, sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_import_private_only(const byte* priv, word32 privSz,
- sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_import_private_key(const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz,
- sphincs_key* key);
-
-WOLFSSL_API
-int wc_sphincs_export_public(sphincs_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_sphincs_export_private_only(sphincs_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_sphincs_export_private(sphincs_key* key, byte* out, word32* outLen);
-WOLFSSL_API
-int wc_sphincs_export_key(sphincs_key* key, byte* priv, word32 *privSz,
- byte* pub, word32 *pubSz);
-
-WOLFSSL_API
-int wc_sphincs_check_key(sphincs_key* key);
-
-WOLFSSL_API
-int wc_sphincs_size(sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_priv_size(sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_pub_size(sphincs_key* key);
-WOLFSSL_API
-int wc_sphincs_sig_size(sphincs_key* key);
-
-WOLFSSL_API int wc_Sphincs_PrivateKeyDecode(const byte* input,
- word32* inOutIdx,
- sphincs_key* key, word32 inSz);
-WOLFSSL_API int wc_Sphincs_PublicKeyDecode(const byte* input,
- word32* inOutIdx,
- sphincs_key* key, word32 inSz);
-WOLFSSL_API int wc_Sphincs_KeyToDer(sphincs_key* key, byte* output,
- word32 inLen);
-WOLFSSL_API int wc_Sphincs_PrivateKeyToDer(sphincs_key* key, byte* output,
- word32 inLen);
-WOLFSSL_API int wc_Sphincs_PublicKeyToDer(sphincs_key* key, byte* output,
- word32 inLen, int withAlg);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_PQC && HAVE_SPHINCS */
-#endif /* WOLF_CRYPT_SPHINCS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/tfm.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/tfm.h
deleted file mode 100644
index 48d85a78e..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/tfm.h
+++ /dev/null
@@ -1,941 +0,0 @@
-/* tfm.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-
-/*
- * Based on public domain TomsFastMath 0.10 by Tom St Denis, tomstdenis@iahu.ca,
- * http://math.libtomcrypt.com
- */
-
-
-/**
- * Edited by Moises Guimaraes (moises.guimaraes@phoebus.com.br)
- * to fit CyaSSL's needs.
- */
-
-/*!
- \file wolfssl/wolfcrypt/tfm.h
-*/
-
-#ifndef WOLF_CRYPT_TFM_H
-#define WOLF_CRYPT_TFM_H
-
-#include
-#include
-#ifndef CHAR_BIT
- #include
-#endif
-
-#include
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#ifdef WOLFSSL_NO_ASM
- #undef TFM_NO_ASM
- #define TFM_NO_ASM
-#endif
-
-#ifdef NO_64BIT
- #undef NO_TFM_64BIT
- #define NO_TFM_64BIT
-#endif
-
-#ifndef NO_TFM_64BIT
-/* autodetect x86-64 and make sure we are using 64-bit digits with x86-64 asm */
-#if defined(__x86_64__)
- #if defined(TFM_X86) || defined(TFM_SSE2) || defined(TFM_ARM)
- #error x86-64 detected, x86-32/SSE2/ARM optimizations are not valid!
- #endif
- #if !defined(TFM_X86_64) && !defined(TFM_NO_ASM)
- #define TFM_X86_64
- #endif
-#endif
-#if defined(__aarch64__) && defined(__APPLE__)
- #if !defined(TFM_AARCH_64) && !defined(TFM_NO_ASM)
- #define TFM_AARCH_64
- #endif
-#endif
-#if defined(TFM_X86_64) || defined(TFM_AARCH_64)
- #if !defined(FP_64BIT)
- #define FP_64BIT
- #endif
-#endif
-/* use 64-bit digit even if not using asm on x86_64 */
-#if defined(__x86_64__) && !defined(FP_64BIT)
- #define FP_64BIT
-#endif
-/* if intel compiler doesn't provide 128 bit type don't turn on 64bit */
-#if defined(FP_64BIT) && defined(__INTEL_COMPILER) && !defined(HAVE___UINT128_T)
- #undef FP_64BIT
- #undef TFM_X86_64
-#endif
-#endif /* NO_TFM_64BIT */
-
-/* try to detect x86-32 */
-#if defined(__i386__) && !defined(TFM_SSE2)
- #if defined(TFM_X86_64) || defined(TFM_ARM)
- #error x86-32 detected, x86-64/ARM optimizations are not valid!
- #endif
- #if !defined(TFM_X86) && !defined(TFM_NO_ASM)
- #define TFM_X86
- #endif
-#endif
-
-/* make sure we're 32-bit for x86-32/sse/arm/ppc32 */
-#if (defined(TFM_X86) || defined(TFM_SSE2) || defined(TFM_ARM) || defined(TFM_PPC32)) && defined(FP_64BIT)
- #warning x86-32, SSE2 and ARM, PPC32 optimizations require 32-bit digits (undefining)
- #undef FP_64BIT
-#endif
-
-/* multi asms? */
-#ifdef TFM_X86
- #define TFM_ASM
-#endif
-#ifdef TFM_X86_64
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-#ifdef TFM_SSE2
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-#ifdef TFM_ARM
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-#ifdef TFM_PPC32
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-#ifdef TFM_PPC64
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-#ifdef TFM_AVR32
- #ifdef TFM_ASM
- #error TFM_ASM already defined!
- #endif
- #define TFM_ASM
-#endif
-
-/* we want no asm? */
-#ifdef TFM_NO_ASM
- #undef TFM_X86
- #undef TFM_X86_64
- #undef TFM_SSE2
- #undef TFM_ARM
- #undef TFM_PPC32
- #undef TFM_PPC64
- #undef TFM_AVR32
- #undef TFM_ASM
-#endif
-
-/* ECC helpers */
-#ifdef TFM_ECC192
- #ifdef FP_64BIT
- #define TFM_MUL3
- #define TFM_SQR3
- #else
- #define TFM_MUL6
- #define TFM_SQR6
- #endif
-#endif
-
-#ifdef TFM_ECC224
- #ifdef FP_64BIT
- #define TFM_MUL4
- #define TFM_SQR4
- #else
- #define TFM_MUL7
- #define TFM_SQR7
- #endif
-#endif
-
-#ifdef TFM_ECC256
- #ifdef FP_64BIT
- #define TFM_MUL4
- #define TFM_SQR4
- #else
- #define TFM_MUL8
- #define TFM_SQR8
- #endif
-#endif
-
-#ifdef TFM_ECC384
- #ifdef FP_64BIT
- #define TFM_MUL6
- #define TFM_SQR6
- #else
- #define TFM_MUL12
- #define TFM_SQR12
- #endif
-#endif
-
-#ifdef TFM_ECC521
- #ifdef FP_64BIT
- #define TFM_MUL9
- #define TFM_SQR9
- #else
- #define TFM_MUL17
- #define TFM_SQR17
- #endif
-#endif
-
-
-/* allow user to define on fp_digit, fp_word types */
-#ifndef WOLFSSL_BIGINT_TYPES
-
-/* some default configurations.
- */
-#if defined(WC_16BIT_CPU)
- typedef unsigned int fp_digit;
- #define SIZEOF_FP_DIGIT 2
- typedef unsigned long fp_word;
- typedef signed long fp_sword;
-#elif defined(FP_64BIT)
- /* for GCC only on supported platforms */
- typedef unsigned long long fp_digit; /* 64bit, 128 uses mode(TI) below */
- #define SIZEOF_FP_DIGIT 8
- typedef unsigned long fp_word __attribute__ ((mode(TI)));
- typedef signed long fp_sword __attribute__ ((mode(TI)));
-#else
-
- #ifndef NO_TFM_64BIT
- #if defined(_MSC_VER) || defined(__BORLANDC__)
- typedef unsigned __int64 ulong64;
- #if defined(INTIME_RTOS)
- #undef long64
- #endif
- typedef signed __int64 long64;
- #else
- typedef unsigned long long ulong64;
- typedef signed long long long64;
- #endif
- typedef unsigned int fp_digit;
- #define SIZEOF_FP_DIGIT 4
- typedef ulong64 fp_word;
- typedef long64 fp_sword;
- #define FP_32BIT
- #else
- /* some procs like coldfire prefer not to place multiply into 64bit type
- even though it exists */
- typedef unsigned short fp_digit;
- #define SIZEOF_FP_DIGIT 2
- typedef unsigned int fp_word;
- typedef signed int fp_sword;
- #endif
-#endif
-
-#endif /* WOLFSSL_BIGINT_TYPES */
-
-
-/* # of digits this is */
-#define DIGIT_BIT ((CHAR_BIT) * SIZEOF_FP_DIGIT)
-
-/* Max size of any number in bits. Basically the largest size you will be
- * multiplying should be half [or smaller] of FP_MAX_SIZE-four_digit
- *
- * It defaults to 4096-bits [allowing multiplications up to 2048x2048 bits ]
- */
-
-
-#ifndef FP_MAX_BITS
- #define FP_MAX_BITS 4096
-#endif
-#ifdef WOLFSSL_OPENSSH
- /* OpenSSH uses some BIG primes so we need to accommodate for that */
- #undef FP_MAX_BITS
- #define FP_MAX_BITS 16384
-#endif
-#define FP_MAX_SIZE (FP_MAX_BITS+(8*DIGIT_BIT))
-
-/* will this lib work? */
-#if CHAR_BIT == 0
- #error CHAR_BIT must be nonzero
-#endif
-#if (CHAR_BIT & 7)
- #error CHAR_BIT must be a multiple of eight.
-#endif
-#if FP_MAX_BITS % CHAR_BIT
- #error FP_MAX_BITS must be a multiple of CHAR_BIT
-#endif
-
-#define FP_MASK (fp_digit)(-1)
-#define FP_DIGIT_MAX FP_MASK
-#define FP_SIZE (FP_MAX_SIZE/DIGIT_BIT)
-#define MP_SIZE (FP_MAX_SIZE/DIGIT_BIT) /* for compatibility with SP_INT */
-
-
-#define FP_MAX_PRIME_SIZE (FP_MAX_BITS/(2*CHAR_BIT))
-/* In terms of FP_MAX_BITS, it is double the size possible for a number
- * to allow for multiplication, divide that 2 out. Also divide by CHAR_BIT
- * to convert from bits to bytes. (Note, FP_PRIME_SIZE is the number of
- * values in the canned prime number list.) */
-
-/* signs */
-#define FP_ZPOS 0
-#define FP_NEG 1
-
-/* return codes */
-#define FP_OKAY 0
-#define FP_VAL MP_VAL
-#define FP_MEM MP_MEM
-#define FP_NOT_INF MP_NOT_INF
-#define FP_WOULDBLOCK MP_WOULDBLOCK
-
-/* equalities */
-#define FP_LT (-1) /* less than */
-#define FP_EQ 0 /* equal to */
-#define FP_GT 1 /* greater than */
-
-/* replies */
-#define FP_YES 1 /* yes response */
-#define FP_NO 0 /* no response */
-
-
-#ifdef WOLFSSL_SMALL_STACK
-/*
- * Dynamic memory allocation of mp_int.
- */
-/* Declare a dynamically allocated mp_int. */
-#define DECL_MP_INT_SIZE(name, bits) \
- mp_int* name = NULL
-/* Declare a dynamically allocated mp_int. */
-#define DECL_MP_INT_SIZE_DYN(name, bits, max) \
- mp_int* name = NULL
-/* Allocate an mp_int of minimal size and zero out. */
-#define NEW_MP_INT_SIZE(name, bits, heap, type) \
-do { \
- name = (mp_int*)XMALLOC(sizeof(mp_int), heap, type); \
- if (name != NULL) { \
- XMEMSET(name, 0, sizeof(mp_int)); \
- } \
-} \
-while (0)
-/* Dispose of dynamically allocated mp_int. */
-#define FREE_MP_INT_SIZE(name, heap, type) \
- XFREE(name, heap, type)
-/* Must check for mp_int pointer for NULL. */
-#define MP_INT_SIZE_CHECK_NULL
-#else
-/*
- * Static allocation of mp_int.
- */
-/* Declare a statically allocated mp_int. */
-#define DECL_MP_INT_SIZE(name, bits) \
- mp_int name[1]
-/* Declare a statically allocated mp_int. */
-#define DECL_MP_INT_SIZE_DYN(name, bits, max) \
- mp_int name[1]
-/* Zero out mp_int of minimal size. */
-#define NEW_MP_INT_SIZE(name, bits, heap, type) \
- XMEMSET(name, 0, sizeof(mp_int))
-/* Dispose of static mp_int. */
-#define FREE_MP_INT_SIZE(name, heap, type) WC_DO_NOTHING
-#endif
-
-/* Initialize an mp_int. */
-#define INIT_MP_INT_SIZE(name, bits) \
- mp_init(name)
-/* Type to cast to when using size macros. */
-#define MP_INT_SIZE mp_int
-
-
-#ifdef HAVE_WOLF_BIGINT
- /* raw big integer */
- typedef struct WC_BIGINT {
- byte* buf;
- word32 len;
- void* heap;
- } WC_BIGINT;
- #define WOLF_BIGINT_DEFINED
-#endif
-
-#define wc_mp_size_t int
-#define wc_mp_sign_t int
-
-/* a FP type */
-typedef struct fp_int {
- int used;
- int sign;
-#if defined(ALT_ECC_SIZE) || defined(HAVE_WOLF_BIGINT)
- int size;
-#endif
- fp_digit dp[FP_SIZE];
-
-#ifdef HAVE_WOLF_BIGINT
- struct WC_BIGINT raw; /* unsigned binary (big endian) */
-#endif
-} fp_int;
-
-/* Types */
-typedef fp_digit mp_digit;
-typedef fp_word mp_word;
-typedef fp_int mp_int;
-
-
-/* wolf big int and common functions */
-#include
-
-
-/* externally define this symbol to ignore the default settings, useful for changing the build from the make process */
-#ifndef TFM_ALREADY_SET
-
-/* do we want the large set of small multiplications ?
- Enable these if you are going to be doing a lot of small (<= 16 digit) multiplications say in ECC
- Or if you're on a 64-bit machine doing RSA as a 1024-bit integer == 16 digits ;-)
- */
-/* need to refactor the function */
-/*#define TFM_SMALL_SET */
-
-/* do we want huge code
- Enable these if you are doing 20, 24, 28, 32, 48, 64 digit multiplications (useful for RSA)
- Less important on 64-bit machines as 32 digits == 2048 bits
- */
-#if 0
-#define TFM_MUL3
-#define TFM_MUL4
-#define TFM_MUL6
-#define TFM_MUL7
-#define TFM_MUL8
-#define TFM_MUL9
-#define TFM_MUL12
-#define TFM_MUL17
-#endif
-#ifdef TFM_HUGE_SET
-#define TFM_MUL20
-#define TFM_MUL24
-#define TFM_MUL28
-#define TFM_MUL32
-#if (FP_MAX_BITS >= 6144) && defined(FP_64BIT)
- #define TFM_MUL48
-#endif
-#if (FP_MAX_BITS >= 8192) && defined(FP_64BIT)
- #define TFM_MUL64
-#endif
-#endif
-
-#if 0
-#define TFM_SQR3
-#define TFM_SQR4
-#define TFM_SQR6
-#define TFM_SQR7
-#define TFM_SQR8
-#define TFM_SQR9
-#define TFM_SQR12
-#define TFM_SQR17
-#endif
-#ifdef TFM_HUGE_SET
-#define TFM_SQR20
-#define TFM_SQR24
-#define TFM_SQR28
-#define TFM_SQR32
-#define TFM_SQR48
-#define TFM_SQR64
-#endif
-
-/* Optional math checks (enable WOLFSSL_DEBUG_MATH to print info) */
-/* #define TFM_CHECK */
-
-/* Is the target a P4 Prescott
- */
-/* #define TFM_PRESCOTT */
-
-/* Do we want timing resistant fp_exptmod() ?
- * This makes it slower but also timing invariant with respect to the exponent
- */
-/* #define TFM_TIMING_RESISTANT */
-
-#endif /* TFM_ALREADY_SET */
-
-/* functions */
-
-/* returns a TFM ident string useful for debugging... */
-/*const char *fp_ident(void);*/
-
-/* initialize [or zero] an fp int */
-void fp_init(fp_int *a);
-MP_API void fp_zero(fp_int *a);
-MP_API void fp_clear(fp_int *a);
-/* uses ForceZero to clear sensitive memory */
-MP_API void fp_forcezero (fp_int * a);
-MP_API void fp_free(fp_int* a);
-
-/* zero/one/even/odd/neg/word ? */
-#define fp_iszero(a) (((a)->used == 0) ? FP_YES : FP_NO)
-#define fp_isone(a) \
- ((((a)->used == 1) && ((a)->dp[0] == 1) && ((a)->sign == FP_ZPOS)) \
- ? FP_YES : FP_NO)
-#define fp_iseven(a) \
- (((a)->used > 0 && (((a)->dp[0] & 1) == 0)) ? FP_YES : FP_NO)
-#define fp_isodd(a) \
- (((a)->used > 0 && (((a)->dp[0] & 1) == 1)) ? FP_YES : FP_NO)
-#define fp_isneg(a) (((a)->sign != FP_ZPOS) ? FP_YES : FP_NO)
-#define fp_setneg(a) ((a)->sign = FP_NEG)
-#define fp_isword(a, w) \
- (((((a)->used == 1) && ((a)->dp[0] == (w))) || \
- (((w) == 0) && ((a)->used == 0))) ? FP_YES : FP_NO)
-/* Number of bits used based on used field only. */
-#define fp_bitsused(a) ((a)->used * DIGIT_BIT)
-
-/* set to a small digit */
-void fp_set(fp_int *a, fp_digit b);
-int fp_set_int(fp_int *a, unsigned long b);
-
-/* check if a bit is set */
-int fp_is_bit_set(fp_int *a, fp_digit b);
-/* set the b bit to 1 */
-int fp_set_bit (fp_int * a, fp_digit b);
-
-/* copy from a to b */
-void fp_copy(const fp_int *a, fp_int *b);
-void fp_init_copy(fp_int *a, const fp_int *b);
-
-/* clamp digits */
-#define fp_clamp(a) { while ((a)->used && (a)->dp[(a)->used-1] == 0) --((a)->used); (a)->sign = (a)->used ? (a)->sign : FP_ZPOS; }
-#define mp_clamp(a) fp_clamp(a)
-#define mp_grow(a,s) MP_OKAY
-
-/* negate and absolute */
-#define fp_neg(a, b) { fp_copy(a, b); (b)->sign ^= 1; fp_clamp(b); }
-#define fp_abs(a, b) { fp_copy(a, b); (b)->sign = 0; }
-
-/* right shift x digits */
-void fp_rshd(fp_int *a, int x);
-
-/* right shift x bits */
-void fp_rshb(fp_int *c, int x);
-
-/* left shift x digits */
-int fp_lshd(fp_int *a, int x);
-
-/* signed comparison */
-int fp_cmp(fp_int *a, fp_int *b);
-
-/* unsigned comparison */
-int fp_cmp_mag(fp_int *a, fp_int *b);
-
-/* power of 2 operations */
-void fp_div_2d(fp_int *a, int b, fp_int *c, fp_int *d);
-void fp_mod_2d(fp_int *a, int b, fp_int *c);
-int fp_mul_2d(fp_int *a, int b, fp_int *c);
-void fp_2expt (fp_int *a, int b);
-int fp_mul_2(fp_int *a, fp_int *b);
-void fp_div_2(fp_int *a, fp_int *b);
-/* c = a / 2 (mod b) - constant time (a < b and positive) */
-int fp_div_2_mod_ct(fp_int *a, fp_int *b, fp_int *c);
-
-
-/* Counts the number of lsbs which are zero before the first zero bit */
-int fp_cnt_lsb(fp_int *a);
-
-/* c = a + b */
-int fp_add(fp_int *a, fp_int *b, fp_int *c);
-
-/* c = a - b */
-int fp_sub(fp_int *a, fp_int *b, fp_int *c);
-
-/* c = a * b */
-int fp_mul(fp_int *a, fp_int *b, fp_int *c);
-
-/* b = a*a */
-int fp_sqr(fp_int *a, fp_int *b);
-
-/* a/b => cb + d == a */
-int fp_div(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* c = a mod b, 0 <= c < b */
-int fp_mod(fp_int *a, fp_int *b, fp_int *c);
-
-/* compare against a single digit */
-int fp_cmp_d(fp_int *a, fp_digit b);
-
-/* c = a + b */
-int fp_add_d(fp_int *a, fp_digit b, fp_int *c);
-
-/* c = a - b */
-int fp_sub_d(fp_int *a, fp_digit b, fp_int *c);
-
-/* c = a * b */
-int fp_mul_d(fp_int *a, fp_digit b, fp_int *c);
-
-/* a/b => cb + d == a */
-/*int fp_div_d(fp_int *a, fp_digit b, fp_int *c, fp_digit *d);*/
-
-/* c = a mod b, 0 <= c < b */
-/*int fp_mod_d(fp_int *a, fp_digit b, fp_digit *c);*/
-
-/* ---> number theory <--- */
-/* d = a + b (mod c) */
-/*int fp_addmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);*/
-
-/* d = a - b (mod c) */
-/*int fp_submod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);*/
-
-/* d = a * b (mod c) */
-int fp_mulmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* d = a - b (mod c) */
-int fp_submod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* d = a + b (mod c) */
-int fp_addmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* d = a - b (mod c) - constant time (a < c and b < c) */
-int fp_submod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* d = a + b (mod c) - constant time (a < c and b < c) */
-int fp_addmod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
-
-/* c = a * a (mod b) */
-int fp_sqrmod(fp_int *a, fp_int *b, fp_int *c);
-
-/* c = 1/a (mod b) */
-int fp_invmod(fp_int *a, fp_int *b, fp_int *c);
-int fp_invmod_mont_ct(fp_int *a, fp_int *b, fp_int *c, fp_digit mp);
-
-/* c = (a, b) */
-/*int fp_gcd(fp_int *a, fp_int *b, fp_int *c);*/
-
-/* c = [a, b] */
-/*int fp_lcm(fp_int *a, fp_int *b, fp_int *c);*/
-
-/* setups the montgomery reduction */
-int fp_montgomery_setup(fp_int *a, fp_digit *rho);
-
-/* computes a = B**n mod b without division or multiplication useful for
- * normalizing numbers in a Montgomery system.
- */
-int fp_montgomery_calc_normalization(fp_int *a, fp_int *b);
-
-/* computes x/R == x (mod N) via Montgomery Reduction */
-int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp);
-int fp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp, int ct);
-
-/* d = a**b (mod c) */
-int fp_exptmod(fp_int *G, fp_int *X, fp_int *P, fp_int *Y);
-int fp_exptmod_ex(fp_int *G, fp_int *X, int minDigits, fp_int *P, fp_int *Y);
-int fp_exptmod_nct(fp_int *G, fp_int *X, fp_int *P, fp_int *Y);
-
-#ifdef WC_RSA_NONBLOCK
-
-enum tfmExptModNbState {
- TFM_EXPTMOD_NB_INIT = 0,
- TFM_EXPTMOD_NB_MONT,
- TFM_EXPTMOD_NB_MONT_RED,
- TFM_EXPTMOD_NB_MONT_MUL,
- TFM_EXPTMOD_NB_MONT_MOD,
- TFM_EXPTMOD_NB_MONT_MODCHK,
- TFM_EXPTMOD_NB_NEXT,
- TFM_EXPTMOD_NB_MUL,
- TFM_EXPTMOD_NB_MUL_RED,
- TFM_EXPTMOD_NB_SQR,
- TFM_EXPTMOD_NB_SQR_RED,
- TFM_EXPTMOD_NB_RED,
- TFM_EXPTMOD_NB_COUNT /* last item for total state count only */
-};
-
-typedef struct {
-#ifndef WC_NO_CACHE_RESISTANT
- fp_int R[3];
-#else
- fp_int R[2];
-#endif
- fp_digit buf;
- fp_digit mp;
- int bitcnt;
- int digidx;
- int y;
- int state; /* tfmExptModNbState */
-#ifdef WC_RSA_NONBLOCK_TIME
- word32 maxBlockInst; /* maximum instructions to block */
- word32 totalInst; /* tracks total instructions */
-#endif
-} exptModNb_t;
-
-#ifdef WC_RSA_NONBLOCK_TIME
-enum {
- TFM_EXPTMOD_NB_STOP = 0, /* stop and return FP_WOULDBLOCK */
- TFM_EXPTMOD_NB_CONTINUE = 1, /* keep blocking */
-};
-#endif
-
-/* non-blocking version of timing resistant fp_exptmod function */
-/* supports cache resistance */
-int fp_exptmod_nb(exptModNb_t* nb, fp_int* G, fp_int* X, fp_int* P, fp_int* Y);
-
-#endif /* WC_RSA_NONBLOCK */
-
-/* primality stuff */
-
-/* perform a Miller-Rabin test of a to the base b and store result in "result" */
-/*void fp_prime_miller_rabin (fp_int * a, fp_int * b, int *result);*/
-
-#define FP_PRIME_SIZE 256
-/* 256 trial divisions + 8 Miller-Rabins, returns FP_YES if probable prime */
-/*int fp_isprime(fp_int *a);*/
-/* extended version of fp_isprime, do 't' Miller-Rabins instead of only 8 */
-/*int fp_isprime_ex(fp_int *a, int t, int* result);*/
-
-/* Primality generation flags */
-/*#define TFM_PRIME_BBS 0x0001 */ /* BBS style prime */
-/*#define TFM_PRIME_SAFE 0x0002 */ /* Safe prime (p-1)/2 == prime */
-/*#define TFM_PRIME_2MSB_OFF 0x0004 */ /* force 2nd MSB to 0 */
-/*#define TFM_PRIME_2MSB_ON 0x0008 */ /* force 2nd MSB to 1 */
-
-/* callback for fp_prime_random, should fill dst with random bytes and return how many read [up to len] */
-/*typedef int tfm_prime_callback(unsigned char *dst, int len, void *dat);*/
-
-/*#define fp_prime_random(a, t, size, bbs, cb, dat) fp_prime_random_ex(a, t, ((size) * 8) + 1, (bbs==1)?TFM_PRIME_BBS:0, cb, dat)*/
-
-/*int fp_prime_random_ex(fp_int *a, int t, int size, int flags, tfm_prime_callback cb, void *dat);*/
-
-/* radix conversions */
-int fp_count_bits(const fp_int *a);
-int fp_leading_bit(fp_int *a);
-
-int fp_unsigned_bin_size(const fp_int *a);
-int fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c);
-int fp_to_unsigned_bin(const fp_int *a, unsigned char *b);
-int fp_to_unsigned_bin_len_ct(fp_int *a, unsigned char *out, int outSz);
-int fp_to_unsigned_bin_len(fp_int *a, unsigned char *b, int c);
-int fp_to_unsigned_bin_at_pos(int x, fp_int *t, unsigned char *b);
-
-/*int fp_read_radix(fp_int *a, char *str, int radix);*/
-/*int fp_toradix(fp_int *a, char *str, int radix);*/
-/*int fp_toradix_n(fp_int * a, char *str, int radix, int maxlen);*/
-
-
-/* VARIOUS LOW LEVEL STUFFS */
-int s_fp_add(fp_int *a, fp_int *b, fp_int *c);
-void s_fp_sub(fp_int *a, fp_int *b, fp_int *c);
-
-int fp_mul_comba(fp_int *a, fp_int *b, fp_int *c);
-
-int fp_mul_comba_small(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba3(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba4(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba6(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba7(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba8(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba9(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba12(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba17(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba20(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba24(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba28(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba32(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba48(fp_int *a, fp_int *b, fp_int *c);
-int fp_mul_comba64(fp_int *a, fp_int *b, fp_int *c);
-int fp_sqr_comba(fp_int *a, fp_int *b);
-int fp_sqr_comba_small(fp_int *a, fp_int *b);
-int fp_sqr_comba3(fp_int *a, fp_int *b);
-int fp_sqr_comba4(fp_int *a, fp_int *b);
-int fp_sqr_comba6(fp_int *a, fp_int *b);
-int fp_sqr_comba7(fp_int *a, fp_int *b);
-int fp_sqr_comba8(fp_int *a, fp_int *b);
-int fp_sqr_comba9(fp_int *a, fp_int *b);
-int fp_sqr_comba12(fp_int *a, fp_int *b);
-int fp_sqr_comba17(fp_int *a, fp_int *b);
-int fp_sqr_comba20(fp_int *a, fp_int *b);
-int fp_sqr_comba24(fp_int *a, fp_int *b);
-int fp_sqr_comba28(fp_int *a, fp_int *b);
-int fp_sqr_comba32(fp_int *a, fp_int *b);
-int fp_sqr_comba48(fp_int *a, fp_int *b);
-int fp_sqr_comba64(fp_int *a, fp_int *b);
-
-
-/**
- * Used by wolfSSL
- */
-
-/* Constants */
-#define MP_LT FP_LT /* less than */
-#define MP_EQ FP_EQ /* equal to */
-#define MP_GT FP_GT /* greater than */
-#define MP_RANGE MP_NOT_INF
-#define MP_OKAY FP_OKAY /* ok result */
-#define MP_NO FP_NO /* yes/no result */
-#define MP_YES FP_YES /* yes/no result */
-#define MP_ZPOS FP_ZPOS
-#define MP_NEG FP_NEG
-#define MP_MASK FP_MASK
-
-/* Prototypes */
-#define mp_zero(a) fp_zero(a)
-#define mp_isone(a) fp_isone(a)
-#define mp_iseven(a) fp_iseven(a)
-#define mp_isneg(a) fp_isneg(a)
-#define mp_setneg(a) fp_setneg(a)
-#define mp_isword(a, w) fp_isword(a, w)
-#define mp_bitsused(a) fp_bitsused(a)
-
-#define MP_RADIX_BIN 2
-#define MP_RADIX_OCT 8
-#define MP_RADIX_DEC 10
-#define MP_RADIX_HEX 16
-#define MP_RADIX_MAX 64
-
-#define mp_tobinary(M, S) mp_toradix((M), (S), MP_RADIX_BIN)
-#define mp_tooctal(M, S) mp_toradix((M), (S), MP_RADIX_OCT)
-#define mp_todecimal(M, S) mp_toradix((M), (S), MP_RADIX_DEC)
-#define mp_tohex(M, S) mp_toradix((M), (S), MP_RADIX_HEX)
-
-MP_API int mp_init (mp_int * a);
-MP_API int mp_init_copy(fp_int * a, const fp_int * b);
-MP_API void mp_clear (mp_int * a);
-MP_API void mp_free (mp_int * a);
-MP_API void mp_forcezero (mp_int * a);
-MP_API int mp_init_multi(mp_int* a, mp_int* b, mp_int* c, mp_int* d, mp_int* e,
- mp_int* f);
-
-MP_API int mp_add (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_sub (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_add_d (mp_int * a, mp_digit b, mp_int * c);
-
-MP_API int mp_mul (mp_int * a, mp_int * b, mp_int * c);
-MP_API int mp_mul_d (mp_int * a, mp_digit b, mp_int * c);
-MP_API int mp_mulmod (mp_int * a, mp_int * b, mp_int * c, mp_int * d);
-MP_API int mp_submod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_addmod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_submod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_addmod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
-MP_API int mp_mod(mp_int *a, mp_int *b, mp_int *c);
-MP_API int mp_invmod(mp_int *a, mp_int *b, mp_int *c);
-MP_API int mp_invmod_mont_ct(mp_int *a, mp_int *b, mp_int *c, fp_digit mp);
-MP_API int mp_exptmod (mp_int * g, mp_int * x, mp_int * p, mp_int * y);
-MP_API int mp_exptmod_ex (mp_int * g, mp_int * x, int minDigits, mp_int * p,
- mp_int * y);
-MP_API int mp_exptmod_nct (mp_int * g, mp_int * x, mp_int * p, mp_int * y);
-MP_API int mp_mul_2d(mp_int *a, int b, mp_int *c);
-MP_API int mp_2expt(mp_int* a, int b);
-
-MP_API int mp_div(mp_int * a, mp_int * b, mp_int * c, mp_int * d);
-
-MP_API int mp_cmp(mp_int *a, mp_int *b);
-#define mp_cmp_ct(a, b, n) mp_cmp(a, b)
-MP_API int mp_cmp_d(mp_int *a, mp_digit b);
-
-MP_API int mp_unsigned_bin_size(const mp_int * a);
-MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
-MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b);
-MP_API int mp_to_unsigned_bin(const mp_int * a, unsigned char *b);
-MP_API int mp_to_unsigned_bin_len_ct(mp_int * a, unsigned char *b, int c);
-MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c);
-
-MP_API int mp_sub_d(fp_int *a, fp_digit b, fp_int *c);
-MP_API int mp_copy(const fp_int* a, fp_int* b);
-MP_API int mp_isodd(const mp_int* a);
-MP_API int mp_iszero(const mp_int* a);
-MP_API int mp_count_bits(const mp_int *a);
-MP_API int mp_leading_bit(mp_int *a);
-MP_API int mp_set_int(mp_int *a, unsigned long b);
-MP_API int mp_is_bit_set (mp_int * a, mp_digit b);
-MP_API int mp_set_bit (mp_int * a, mp_digit b);
-MP_API void mp_rshb(mp_int *a, int x);
-MP_API void mp_rshd(mp_int *a, int x);
-MP_API int mp_toradix (mp_int *a, char *str, int radix);
-MP_API int mp_radix_size (mp_int * a, int radix, int *size);
-
-#ifdef WOLFSSL_DEBUG_MATH
- MP_API void mp_dump(const char* desc, mp_int* a, byte verbose);
-#else
- #define mp_dump(desc, a, verbose) WC_DO_NOTHING
-#endif
-
-#if defined(OPENSSL_EXTRA) || !defined(NO_DSA) || defined(HAVE_ECC)
- MP_API int mp_read_radix(mp_int* a, const char* str, int radix);
-#endif
-
-#define mp_montgomery_reduce_ct(a, m, mp) \
- mp_montgomery_reduce_ex(a, m, mp, 1)
-MP_API int mp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp);
-MP_API int mp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp, int ct);
-MP_API int mp_montgomery_setup(fp_int *a, fp_digit *rho);
-MP_API int mp_sqr(fp_int *a, fp_int *b);
-
-#ifdef HAVE_ECC
- MP_API int mp_div_2(fp_int * a, fp_int * b);
- MP_API int mp_div_2_mod_ct(mp_int *a, mp_int *b, mp_int *c);
-#endif
-
-#if defined(HAVE_ECC) || !defined(NO_RSA) || !defined(NO_DSA) || \
- defined(WOLFSSL_KEY_GEN)
- MP_API int mp_set(fp_int *a, fp_digit b);
-#endif
-
-#if defined(HAVE_ECC) || defined(WOLFSSL_KEY_GEN) || !defined(NO_RSA) || \
- !defined(NO_DSA) || !defined(NO_DH)
- MP_API int mp_sqrmod(mp_int* a, mp_int* b, mp_int* c);
- MP_API int mp_montgomery_calc_normalization(mp_int *a, mp_int *b);
-#endif
-
-#if !defined(NO_DH) || !defined(NO_DSA) || !defined(NO_RSA) || defined(WOLFSSL_KEY_GEN)
-MP_API int mp_prime_is_prime(mp_int* a, int t, int* result);
-MP_API int mp_prime_is_prime_ex(mp_int* a, int t, int* result, WC_RNG* rng);
-#endif /* !NO_DH || !NO_DSA || !NO_RSA || WOLFSSL_KEY_GEN */
-#ifdef WOLFSSL_KEY_GEN
-MP_API int mp_gcd(fp_int *a, fp_int *b, fp_int *c);
-MP_API int mp_lcm(fp_int *a, fp_int *b, fp_int *c);
-MP_API int mp_rand_prime(mp_int* a, int len, WC_RNG* rng, void* heap);
-MP_API int mp_exch(mp_int *a, mp_int *b);
-#endif /* WOLFSSL_KEY_GEN */
-MP_API int mp_cond_swap_ct_ex(mp_int* a, mp_int* b, int c, int m, mp_int* t);
-MP_API int mp_cond_swap_ct(mp_int* a, mp_int* b, int c, int m);
-
-MP_API int mp_cnt_lsb(fp_int *a);
-MP_API int mp_div_2d(fp_int *a, int b, fp_int *c, fp_int *d);
-MP_API int mp_mod_2d(fp_int *a, int b, fp_int *c);
-MP_API int mp_mod_d(fp_int* a, fp_digit b, fp_digit* c);
-MP_API int mp_lshd (mp_int * a, int b);
-MP_API int mp_abs(mp_int* a, mp_int* b);
-
-WOLFSSL_API word32 CheckRunTimeFastMath(void);
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
-void mp_memzero_add(const char* name, mp_int* a);
-void mp_memzero_check(mp_int* a);
-#endif
-
-/* If user uses RSA, DH, DSA, or ECC math lib directly then fast math FP_SIZE
- must match, return 1 if a match otherwise 0 */
-#define CheckFastMathSettings() (FP_SIZE == CheckRunTimeFastMath())
-
-
-#ifdef __cplusplus
- }
-#endif
-
-#endif /* WOLF_CRYPT_TFM_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/user_settings.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/user_settings.h
index 5fb4c1ba2..1019a94f3 100644
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/user_settings.h
+++ b/include/bitcoin/ssl/wolfssl/wolfcrypt/user_settings.h
@@ -102,6 +102,7 @@
/* Remove unused or undesired components. */
#define WOLFSSL_NO_CLIENT_AUTH
#define NO_SESSION_CACHE
+#define NO_PWDBASED
#define NO_OLD_TLS
#define NO_OCSP
#define NO_DES3
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_lms.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_lms.h
deleted file mode 100644
index 5c3e4a2be..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_lms.h
+++ /dev/null
@@ -1,506 +0,0 @@
-/* wc_lms.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* Implementation based on:
- * RFC 8554: Leighton-Micali Hash-Based Signatures
- * https://datatracker.ietf.org/doc/html/rfc8554
- * Implementation by Sean Parkinson.
- */
-
-/* Possible LMS options:
- *
- * WOLFSSL_LMS_LARGE_CACHES Default: OFF
- * Authentication path caches are large and signing faster.
- * WOLFSSL_LMS_ROOT_LEVELS Default: 5 (Large: 7)
- * Number of levels of interior nodes from the to to cached.
- * Valid value are: 1..height of subtree.
- * The bigger the number, the larger the LmsKey but faster signing.
- * Only applies when !WOLFSSL_WC_LMS_SMALL.
- * WOLFSSL_LMS_CACHE_BITS Default: 5 (Large: 7)
- * 2 to the power of the value is the number of leaf nodes to cache.
- * Maximum valid value is height of subtree.
- * Valid value are: 0..height of subtree.
- * The bigger the number, the larger the LmsKey but faster signing.
- * Only applies when !WOLFSSL_WC_LMS_SMALL.
- *
- * Memory/Level | R/C | Approx. Time (% of 5/5)
- * (Bytes) | | H=10 | H=15 | H=20
- * -------------+--------------+--------+--------
- * 2016 | 5/5 | 100.0% | 100.0% | 100.0%
- * 3040 | 5/6 | 75.5% | 89.2% |
- * 4064 | 6/6 | 75.3% | 78.8% |
- * 4576 | 4/7 | 72.4% | 87.6% |
- * 6112 | 6/7 | 72.1% | 67.5% |
- * 8160 | 7/7 | 72.2% | 56.8% |
- * 8416 | 3/8 | 66.4% | 84.9% |
- * 12256 | 7/8 | 66.5% | 45.9% |
- * 16352 | 8/8 | 66.0% | 35.0% |
- * 16416 | 1/9 | 54.1% | 79.5% |
- * R = Root levels
- * C = Cache bits
- * To mimic the dynamic memory usage of XMSS, use 3/3.
- *
- * WOLFSSL_LMS_NO_SIGN SMOOTHING Default: OFF
- * Disable precalculation of next subtree.
- * Use less dynamic memory.
- * At certain indexes, signing will take a long time compared to the mean.
- * When OFF, the private key holds a second copy of caches.
- *
- * WOLFSSL_LMS_NO_SIG_CACHE Default: OFF
- * Signature cache is disabled.
- * This will use less dynamic memory and make signing slower when multiple
- * levels.
- *
- * Sig cache holds the C and y hashes for a tree that is not the lowest.
- * Sig cache size = (levels - 1) * (1 + p) * 32 bytes
- * p is the number of y terms based on Winternitz width.
- *
- * w | p | l | Bytes
- * ---+----+---+------
- * 4 | 67 | 2 | 2176
- * 4 | 67 | 3 | 4353
- * 4 | 67 | 4 | 6528
- * 8 | 34 | 2 | 1120
- * 8 | 34 | 3 | 2240
- * 8 | 34 | 4 | 3360
- * w = Winternitz width
- * l = #levels
- */
-
-#ifndef WC_LMS_H
-#define WC_LMS_H
-
-#include
-
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS)
-
-#include
-#include
-
-#ifdef WOLFSSL_LMS_MAX_LEVELS
- /* Maximum number of levels of trees supported by implementation. */
- #define LMS_MAX_LEVELS WOLFSSL_LMS_MAX_LEVELS
-#else
- /* Maximum number of levels of trees supported by implementation. */
- #define LMS_MAX_LEVELS 4
-#endif
-#if (LMS_MAX_LEVELS < 1) || (LMS_MAX_LEVELS > 4)
- #error "LMS parameters only support heights 1-4."
-#endif
-
-/* Smoothing is only used when there are 2 or more levels. */
-#if LMS_MAX_LEVELS == 1 && !defined(WOLFSSL_LMS_NO_SIGN_SMOOTHING)
- #define WOLFSSL_LMS_NO_SIGN_SMOOTHING
-#endif
-
-#ifdef WOLFSSL_LMS_MAX_HEIGHT
- /* Maximum height of a tree supported by implementation. */
- #define LMS_MAX_HEIGHT WOLFSSL_LMS_MAX_HEIGHT
-#else
- /* Maximum height of a tree supported by implementation. */
- #define LMS_MAX_HEIGHT 20
-#endif
-#if (LMS_MAX_HEIGHT < 5) || (LMS_MAX_HEIGHT > 20)
- #error "LMS parameters only support heights 5-20."
-#endif
-
-/* Length of I in bytes. */
-#define LMS_I_LEN 16
-/* Length of L in bytes. */
-#define LMS_L_LEN 4
-/* Length of Q for a level. */
-#define LMS_Q_LEN 4
-/* Length of P in bytes. */
-#define LMS_P_LEN 2
-/* Length of W in bytes. */
-#define LMS_W_LEN 1
-
-/* Length of numeric types when encoding. */
-#define LMS_TYPE_LEN 4
-
-/* Size of digest output when truncatint SHA-256 to 192 bits. */
-#define WC_SHA256_192_DIGEST_SIZE 24
-
-/* Maximum size of a node hash. */
-#define LMS_MAX_NODE_LEN WC_SHA256_DIGEST_SIZE
-/* Maximum size of SEED (produced by hash). */
-#define LMS_SEED_LEN WC_SHA256_DIGEST_SIZE
-/* Maximum number of P, number of n-byte string elements in LM-OTS signature.
- * Value of P when N=32 and W=1.
- */
-#define LMS_MAX_P 265
-
-
-#ifndef WOLFSSL_LMS_ROOT_LEVELS
- #ifdef WOLFSSL_LMS_LARGE_CACHES
- /* Number of root levels of interior nodes to store. */
- #define LMS_ROOT_LEVELS 7
- #else
- /* Number of root levels of interior nodes to store. */
- #define LMS_ROOT_LEVELS 5
- #endif
-#else
- #define LMS_ROOT_LEVELS WOLFSSL_LMS_ROOT_LEVELS
-#endif
-#if LMS_ROOT_LEVELS <= 0
- #error "LMS_ROOT_LEVELS must be greater than 0."
-#endif
-/* Count of root nodes to store per level. */
-#define LMS_ROOT_COUNT ((1 << (LMS_ROOT_LEVELS)) - 1)
-
-#ifndef WOLFSSL_LMS_CACHE_BITS
- #ifdef WOLFSSL_LMS_LARGE_CACHES
- /* 2 to the power of the value is the number of leaf nodes to cache. */
- #define LMS_CACHE_BITS 7
- #else
- /* 2 to the power of the value is the number of leaf nodes to cache. */
- #define LMS_CACHE_BITS 5
- #endif
-#else
- #define LMS_CACHE_BITS WOLFSSL_LMS_CACHE_BITS
-#endif
-#if LMS_CACHE_BITS < 0
- #error "LMS_CACHE_BITS must be greater than or equal to 0."
-#endif
-/* Number of leaf nodes to cache. */
-#define LMS_LEAF_CACHE (1 << LMS_CACHE_BITS)
-
-/* Maximum number of levels of trees described in private key. */
-#define HSS_MAX_LEVELS 8
-/* Length of full Q in bytes. Q from all levels combined. */
-#define HSS_Q_LEN 8
-
-/* Compressed parameter set length in bytes. */
-#define HSS_COMPRESS_PARAM_SET_LEN 1
-/* Total compressed parameter set length for private key in bytes. */
-#define HSS_PRIV_KEY_PARAM_SET_LEN \
- (HSS_COMPRESS_PARAM_SET_LEN * HSS_MAX_LEVELS)
-
-/* Private key length for one level. */
-#define LMS_PRIV_LEN(hLen) \
- (LMS_Q_LEN + (hLen) + LMS_I_LEN)
-/* Public key length in signature. */
-#define LMS_PUBKEY_LEN(hLen) \
- (LMS_TYPE_LEN + LMS_TYPE_LEN + LMS_I_LEN + (hLen))
-
-/* LMS signature data length. */
-#define LMS_SIG_LEN(h, p, hLen) \
- (LMS_Q_LEN + LMS_TYPE_LEN + (hLen) + (p) * (hLen) + LMS_TYPE_LEN + \
- (h) * (hLen))
-
-/* Length of public key. */
-#define HSS_PUBLIC_KEY_LEN(hLen) (LMS_L_LEN + LMS_PUBKEY_LEN(hLen))
-/* Length of private key. */
-#define HSS_PRIVATE_KEY_LEN(hLen) \
- (HSS_Q_LEN + HSS_PRIV_KEY_PARAM_SET_LEN + (hLen) + LMS_I_LEN)
-/* Maximum public key length - length is constant for all parameters. */
-#define HSS_MAX_PRIVATE_KEY_LEN HSS_PRIVATE_KEY_LEN(LMS_MAX_NODE_LEN)
-/* Maximum private key length - length is constant for all parameters. */
-#define HSS_MAX_PUBLIC_KEY_LEN HSS_PUBLIC_KEY_LEN(LMS_MAX_NODE_LEN)
-/* Maximum signature length. */
-#define HSS_MAX_SIG_LEN \
- (LMS_TYPE_LEN + \
- LMS_MAX_LEVELS * (LMS_Q_LEN + LMS_TYPE_LEN + LMS_TYPE_LEN + \
- LMS_MAX_NODE_LEN * (1 + LMS_MAX_P + LMS_MAX_HEIGHT)) + \
- (LMS_MAX_LEVELS - 1) * LMS_PUBKEY_LEN(LMS_MAX_NODE_LEN))
-
-/* Maximum buffer length required for use when hashing. */
-#define LMS_MAX_BUFFER_LEN \
- (LMS_I_LEN + LMS_Q_LEN + LMS_P_LEN + LMS_W_LEN + 2 * LMS_MAX_NODE_LEN)
-
-
-/* Private key data length.
- *
- * HSSPrivKey.priv
- */
-#define LMS_PRIV_KEY_LEN(l, hLen) \
- ((l) * LMS_PRIV_LEN(hLen))
-
-/* Stack of nodes. */
-#define LMS_STACK_CACHE_LEN(h, hLen) \
- (((h) + 1) * (hLen))
-
-/* Root cache length. */
-#define LMS_ROOT_CACHE_LEN(rl, hLen) \
- (((1 << (rl)) - 1) * (hLen))
-
-/* Leaf cache length. */
-#define LMS_LEAF_CACHE_LEN(cb, hLen) \
- ((1 << (cb)) * (hLen))
-
-/* Length of LMS private key state.
- *
- * LmsPrivState
- * auth_path +
- * root +
- * stack.stack + stack.offset +
- * cache.leaf + cache.index + cache.offset
- */
-#define LMS_PRIV_STATE_LEN(h, rl, cb, hLen) \
- (((h) * (hLen)) + \
- LMS_STACK_CACHE_LEN(h, hLen) + 4 + \
- LMS_ROOT_CACHE_LEN(rl, hLen) + \
- LMS_LEAF_CACHE_LEN(cb, hLen) + 4 + 4)
-
-#ifndef WOLFSSL_WC_LMS_SMALL
- /* Private key data state for all levels. */
- #define LMS_PRIV_STATE_ALL_LEN(l, h, rl, cb, hLen) \
- ((l) * LMS_PRIV_STATE_LEN(h, rl, cb, hLen))
-#else
- /* Private key data state for all levels. */
- #define LMS_PRIV_STATE_ALL_LEN(l, h, rl, cb, hLen) 0
-#endif
-
-#ifndef WOLFSSL_LMS_NO_SIGN_SMOOTHING
- /* Extra private key data for smoothing. */
- #define LMS_PRIV_SMOOTH_LEN(l, h, rl, cb, hLen) \
- (LMS_PRIV_KEY_LEN(l, hLen) + \
- ((l) - 1) * LMS_PRIV_STATE_LEN(h, rl, cb, hLen))
-#else
- /* Extra private key data for smoothing. */
- #define LMS_PRIV_SMOOTH_LEN(l, h, rl, cb, hLen) 0
-#endif
-
-#ifndef WOLFSSL_LMS_NO_SIG_CACHE
- #define LMS_PRIV_Y_TREE_LEN(p, hLen) \
- ((hLen) + (p) * (hLen))
- /* Length of the y data cached in private key data. */
- #define LMS_PRIV_Y_LEN(l, p, hLen) \
- (((l) - 1) * ((hLen) + (p) * (hLen)))
-#else
- /* Length of the y data cached in private key data. */
- #define LMS_PRIV_Y_LEN(l, p, hLen) 0
-#endif
-
-#ifndef WOLFSSL_WC_LMS_SMALL
-/* Length of private key data. */
-#define LMS_PRIV_DATA_LEN(l, h, p, rl, cb, hLen) \
- (LMS_PRIV_KEY_LEN(l, hLen) + \
- LMS_PRIV_STATE_ALL_LEN(l, h, rl, cb, hLen) + \
- LMS_PRIV_SMOOTH_LEN(l, h, rl, cb, hLen) + \
- LMS_PRIV_Y_LEN(l, p, hLen))
-#else
-#define LMS_PRIV_DATA_LEN(l, h, p, rl, cb, hLen) \
- LMS_PRIV_KEY_LEN(l, hLen)
-#endif
-
-/* Indicates using SHA-256 for hashing. */
-#define LMS_SHA256 0x0000
-/* Indicates using SHA-256/192 for hashing. */
-#define LMS_SHA256_192 0x1000
-/* Mask to get hashing algorithm from type. */
-#define LMS_HASH_MASK 0xf000
-/* Mask to get height or Winternitz width from type. */
-#define LMS_H_W_MASK 0x0fff
-
-/* LMS Parameters. */
-/* SHA-256 hash, 32-bytes of hash used, tree height of 5. */
-#define LMS_SHA256_M32_H5 0x05
-/* SHA-256 hash, 32-bytes of hash used, tree height of 10. */
-#define LMS_SHA256_M32_H10 0x06
-/* SHA-256 hash, 32-bytes of hash used, tree height of 15. */
-#define LMS_SHA256_M32_H15 0x07
-/* SHA-256 hash, 32-bytes of hash used, tree height of 20. */
-#define LMS_SHA256_M32_H20 0x08
-/* SHA-256 hash, 32-bytes of hash used, tree height of 25. */
-#define LMS_SHA256_M32_H25 0x09
-
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 1 bit. */
-#define LMOTS_SHA256_N32_W1 0x01
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 2 bits. */
-#define LMOTS_SHA256_N32_W2 0x02
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 4 bits. */
-#define LMOTS_SHA256_N32_W4 0x03
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 8 bits. */
-#define LMOTS_SHA256_N32_W8 0x04
-
-/* SHA-256 hash, 32-bytes of hash used, tree height of 5. */
-#define LMS_SHA256_M24_H5 (0x0a | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, tree height of 10. */
-#define LMS_SHA256_M24_H10 (0x0b | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, tree height of 15. */
-#define LMS_SHA256_M24_H15 (0x0c | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, tree height of 20. */
-#define LMS_SHA256_M24_H20 (0x0d | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, tree height of 25. */
-#define LMS_SHA256_M24_H25 (0x0e | LMS_SHA256_192)
-
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 1 bit. */
-#define LMOTS_SHA256_N24_W1 (0x05 | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 2 bits. */
-#define LMOTS_SHA256_N24_W2 (0x06 | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 4 bits. */
-#define LMOTS_SHA256_N24_W4 (0x07 | LMS_SHA256_192)
-/* SHA-256 hash, 32-bytes of hash used, Winternitz width of 8 bits. */
-#define LMOTS_SHA256_N24_W8 (0x08 | LMS_SHA256_192)
-
-typedef struct LmsParams {
- /* Number of tree levels. */
- word8 levels;
- /* Height of each tree. */
- word8 height;
- /* Width or Winternitz coefficient. */
- word8 width;
- /* Number of left-shift bits used in checksum calculation. */
- word8 ls;
- /* Number of n-byte string elements in LM-OTS signature. */
- word16 p;
- /* LMS type. */
- word16 lmsType;
- /* LMOTS type. */
- word16 lmOtsType;
- /* Length of LM-OTS signature. */
- word16 sig_len;
- /* Length of seed. */
- word16 hash_len;
-#ifndef WOLFSSL_WC_LMS_SMALL
- /* Number of root levels of interior nodes to store. */
- word8 rootLevels;
- /* 2 to the power of the value is the number of leaf nodes to cache. */
- word8 cacheBits;
-#endif
-} LmsParams;
-
-/* Mapping of id and string to parameters. */
-typedef struct wc_LmsParamsMap {
- /* Identifier of parameters. */
- enum wc_LmsParm id;
- /* String representation of identifier of parameters. */
-#ifdef WOLFSSL_NAMES_STATIC
- const char str[32]; /* large enough for largest string in wc_lms_map[] */
-#else
- const char* str;
-#endif
- /* LMS parameter set. */
- LmsParams params;
-} wc_LmsParamsMap;
-
-typedef struct LmsState {
- /* Buffer to hold data to hash. */
- ALIGN16 byte buffer[LMS_MAX_BUFFER_LEN];
-#ifdef WOLFSSL_SMALL_STACK
- /* Buffer to hold expanded Q coefficients. */
- ALIGN16 byte a[LMS_MAX_P];
-#endif
- /* LMS parameters. */
- const LmsParams* params;
- /* Hash algorithm. */
- wc_Sha256 hash;
- /* Hash algorithm for calculating K. */
- wc_Sha256 hash_k;
-} LmsState;
-
-#ifndef WOLFSSL_WC_LMS_SMALL
-/* Stack of interior node hashes. */
-typedef struct LmsStack {
- /* Stack nodes. */
- byte* stack;
- /* Top of stack offset. */
- word32 offset;
-} LmsStack;
-
-/* Cache of leaf hashes. */
-typedef struct HssLeafCache {
- /* Cache of leaf nodes. Circular queue. */
- byte* cache;
- /* Start index of cached leaf nodes. */
- word32 idx;
- /* Index into cache of first leaf node. */
- word32 offset;
-} HssLeafCache;
-
-typedef struct LmsPrivState {
- /* Authentication path for current index. */
- byte* auth_path;
- /* Stack nodes. */
- LmsStack stack;
- /* Root nodes. */
- byte* root;
- /* Cache of leaf nodes. */
- HssLeafCache leaf;
-} LmsPrivState;
-#endif /* WOLFSSL_WC_LMS_SMALL */
-
-typedef struct HssPrivKey {
- /* Private key. */
- byte* priv;
-#ifndef WOLFSSL_WC_LMS_SMALL
- /* Per level state of the private key. */
- LmsPrivState state[LMS_MAX_LEVELS];
-#ifndef WOLFSSL_LMS_NO_SIGN_SMOOTHING
- /* Next private key. */
- byte* next_priv;
- /* Next private state. */
- LmsPrivState next_state[LMS_MAX_LEVELS - 1];
-#endif
-#ifndef WOLFSSL_LMS_NO_SIG_CACHE
- /* Per level state of the private key. */
- byte* y;
-#endif
- /* Indicates the key has all levels initialized. */
- word8 inited:1;
-#endif
-} HssPrivKey;
-
-struct LmsKey {
- /* Public key. */
- ALIGN16 byte pub[HSS_PUBLIC_KEY_LEN(LMS_MAX_NODE_LEN)];
-#ifndef WOLFSSL_LMS_VERIFY_ONLY
- /* Encoded private key. */
- ALIGN16 byte priv_raw[HSS_MAX_PRIVATE_KEY_LEN];
-
- /* Packed private key data. */
- byte* priv_data;
- /* HSS Private key. */
- HssPrivKey priv;
-
- /* Callback to write/update key. */
- wc_lms_write_private_key_cb write_private_key;
- /* Callback to read key. */
- wc_lms_read_private_key_cb read_private_key;
- /* Context arg passed to callbacks. */
- void* context;
- /* Dynamic memory hint. */
- void* heap;
-#endif /* !WOLFSSL_LMS_VERIFY_ONLY */
- /* Parameters of key. */
- const LmsParams* params;
- /* Current state of key. */
- enum wc_LmsState state;
-#ifdef WOLF_CRYPTO_CB
- /* Device Identifier. */
- int devId;
-#endif
-};
-
-int wc_hss_make_key(LmsState* state, WC_RNG* rng, byte* priv_raw,
- HssPrivKey* priv_key, byte* priv_data, byte* pub);
-int wc_hss_reload_key(LmsState* state, const byte* priv_raw,
- HssPrivKey* priv_key, byte* priv_data, byte* pub_root);
-int wc_hss_sign(LmsState* state, byte* priv_raw, HssPrivKey* priv_key,
- byte* priv_data, const byte* msg, word32 msgSz, byte* sig);
-int wc_hss_sigsleft(const LmsParams* params, const byte* priv_raw);
-int wc_hss_verify(LmsState* state, const byte* pub, const byte* msg,
- word32 msgSz, const byte* sig);
-
-#endif /* WOLFSSL_HAVE_LMS && WOLFSSL_WC_LMS */
-
-#endif /* WC_LMS_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_mlkem.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_mlkem.h
deleted file mode 100644
index 91e015f36..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_mlkem.h
+++ /dev/null
@@ -1,370 +0,0 @@
-/* wc_mlkem.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/wc_mlkem.h
-*/
-
-
-#ifndef WOLF_CRYPT_WC_MLKEM_H
-#define WOLF_CRYPT_WC_MLKEM_H
-
-#include
-#include
-#include
-#include
-
-#ifdef WOLFSSL_HAVE_MLKEM
-
-#ifdef WOLFSSL_KYBER_NO_MAKE_KEY
- #define WOLFSSL_MLKEM_NO_MAKE_KEY
-#endif
-#ifdef WOLFSSL_KYBER_NO_ENCAPSULATE
- #define WOLFSSL_MLKEM_NO_ENCAPSULATE
-#endif
-#ifdef WOLFSSL_KYBER_NO_DECAPSULATE
- #define WOLFSSL_MLKEM_NO_DECAPSULATE
-#endif
-
-#ifdef noinline
- #define MLKEM_NOINLINE noinline
-#elif defined(_MSC_VER)
- #define MLKEM_NOINLINE __declspec(noinline)
-#elif defined(__GNUC__)
- #define MLKEM_NOINLINE __attribute__((noinline))
-#else
- #define MLKEM_NOINLINE
-#endif
-
-enum {
- /* Flags of Kyber keys. */
- MLKEM_FLAG_PRIV_SET = 0x0001,
- MLKEM_FLAG_PUB_SET = 0x0002,
- MLKEM_FLAG_BOTH_SET = 0x0003,
- MLKEM_FLAG_H_SET = 0x0004,
- MLKEM_FLAG_A_SET = 0x0008,
-
- /* 2 bits of random used to create noise value. */
- MLKEM_CBD_ETA2 = 2,
- /* 3 bits of random used to create noise value. */
- MLKEM_CBD_ETA3 = 3,
-
- /* Number of bits to compress to. */
- MLKEM_COMP_4BITS = 4,
- MLKEM_COMP_5BITS = 5,
- MLKEM_COMP_10BITS = 10,
- MLKEM_COMP_11BITS = 11,
-};
-
-
-/* SHAKE128 rate. */
-#define XOF_BLOCK_SIZE 168
-
-/* Modulus of co-efficients of polynomial. */
-#define MLKEM_Q 3329
-
-
-/* Kyber-512 parameters */
-#ifdef WOLFSSL_WC_ML_KEM_512
-/* Number of bits of random to create noise from. */
-#define WC_ML_KEM_512_ETA1 MLKEM_CBD_ETA3
-#endif /* WOLFSSL_WC_ML_KEM_512 */
-
-/* Kyber-768 parameters */
-#ifdef WOLFSSL_WC_ML_KEM_768
-/* Number of bits of random to create noise from. */
-#define WC_ML_KEM_768_ETA1 MLKEM_CBD_ETA2
-#endif /* WOLFSSL_WC_ML_KEM_768 */
-
-/* Kyber-1024 parameters */
-#ifdef WOLFSSL_WC_ML_KEM_1024
-/* Number of bits of random to create noise from. */
-#define WC_ML_KEM_1024_ETA1 MLKEM_CBD_ETA2
-#endif /* WOLFSSL_KYBER1024 */
-
-
-
-/* The data type of the hash function. */
-#define MLKEM_HASH_T wc_Sha3
-
-/* The data type of the pseudo-random function. */
-#define MLKEM_PRF_T wc_Shake
-
-/* ML-KEM key. */
-struct MlKemKey {
- /* Type of key: WC_ML_KEM_512, WC_ML_KEM_768, WC_ML_KEM_1024 */
- int type;
- /* Dynamic memory allocation hint. */
- void* heap;
-#if defined(WOLF_CRYPTO_CB)
- /* Device Id. */
- int devId;
-#endif
- /* Flags indicating what is stored in the key. */
- int flags;
-
- /* A pseudo-random function object. */
- MLKEM_HASH_T hash;
- /* A pseudo-random function object. */
- MLKEM_PRF_T prf;
-
- /* Private key as a vector. */
- sword16 priv[WC_ML_KEM_MAX_K * MLKEM_N];
- /* Public key as a vector. */
- sword16 pub[WC_ML_KEM_MAX_K * MLKEM_N];
- /* Public seed. */
- byte pubSeed[WC_ML_KEM_SYM_SZ];
- /* Public hash - hash of encoded public key. */
- byte h[WC_ML_KEM_SYM_SZ];
- /* Randomizer for decapsulation. */
- byte z[WC_ML_KEM_SYM_SZ];
-#ifdef WOLFSSL_MLKEM_CACHE_A
- /* A matrix from key generation. */
- sword16 a[WC_ML_KEM_MAX_K * WC_ML_KEM_MAX_K * MLKEM_N];
-#endif
-};
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_LOCAL
-void mlkem_init(void);
-
-#ifndef WOLFSSL_MLKEM_MAKEKEY_SMALL_MEM
-WOLFSSL_LOCAL
-void mlkem_keygen(sword16* priv, sword16* pub, sword16* e, const sword16* a,
- int kp);
-#else
-WOLFSSL_LOCAL
-int mlkem_keygen_seeds(sword16* priv, sword16* pub, MLKEM_PRF_T* prf,
- sword16* e, int kp, byte* seed, byte* noiseSeed);
-#endif
-#ifndef WOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM
-WOLFSSL_LOCAL
-void mlkem_encapsulate(const sword16* pub, sword16* bp, sword16* v,
- const sword16* at, sword16* sp, const sword16* ep, const sword16* epp,
- const sword16* m, int kp);
-#else
-WOLFSSL_LOCAL
-int mlkem_encapsulate_seeds(const sword16* pub, MLKEM_PRF_T* prf, sword16* bp,
- sword16* tp, sword16* sp, int kp, const byte* msg, byte* seed,
- byte* coins);
-#endif
-WOLFSSL_LOCAL
-void mlkem_decapsulate(const sword16* priv, sword16* mp, sword16* bp,
- const sword16* v, int kp);
-
-WOLFSSL_LOCAL
-int mlkem_gen_matrix(MLKEM_PRF_T* prf, sword16* a, int kp, byte* seed,
- int transposed);
-WOLFSSL_LOCAL
-int mlkem_get_noise(MLKEM_PRF_T* prf, int kp, sword16* vec1, sword16* vec2,
- sword16* poly, byte* seed);
-
-#if defined(USE_INTEL_SPEEDUP) || \
- (defined(WOLFSSL_ARMASM) && defined(__aarch64__))
-WOLFSSL_LOCAL
-int mlkem_kdf(byte* seed, int seedLen, byte* out, int outLen);
-#endif
-WOLFSSL_LOCAL
-void mlkem_hash_init(MLKEM_HASH_T* hash);
-WOLFSSL_LOCAL
-int mlkem_hash_new(MLKEM_HASH_T* hash, void* heap, int devId);
-WOLFSSL_LOCAL
-void mlkem_hash_free(MLKEM_HASH_T* hash);
-WOLFSSL_LOCAL
-int mlkem_hash256(wc_Sha3* hash, const byte* data, word32 dataLen, byte* out);
-WOLFSSL_LOCAL
-int mlkem_hash512(wc_Sha3* hash, const byte* data1, word32 data1Len,
- const byte* data2, word32 data2Len, byte* out);
-
-WOLFSSL_LOCAL
-int mlkem_derive_secret(MLKEM_PRF_T* prf, const byte* z, const byte* ct,
- word32 ctSz, byte* ss);
-
-WOLFSSL_LOCAL
-void mlkem_prf_init(MLKEM_PRF_T* prf);
-WOLFSSL_LOCAL
-int mlkem_prf_new(MLKEM_PRF_T* prf, void* heap, int devId);
-WOLFSSL_LOCAL
-void mlkem_prf_free(MLKEM_PRF_T* prf);
-
-WOLFSSL_LOCAL
-int mlkem_cmp(const byte* a, const byte* b, int sz);
-
-WOLFSSL_LOCAL
-void mlkem_vec_compress_10(byte* r, sword16* v, unsigned int kp);
-WOLFSSL_LOCAL
-void mlkem_vec_compress_11(byte* r, sword16* v);
-WOLFSSL_LOCAL
-void mlkem_vec_decompress_10(sword16* v, const unsigned char* b,
- unsigned int kp);
-WOLFSSL_LOCAL
-void mlkem_vec_decompress_11(sword16* v, const unsigned char* b);
-
-WOLFSSL_LOCAL
-void mlkem_compress_4(byte* b, sword16* p);
-WOLFSSL_LOCAL
-void mlkem_compress_5(byte* b, sword16* p);
-WOLFSSL_LOCAL
-void mlkem_decompress_4(sword16* p, const unsigned char* b);
-WOLFSSL_LOCAL
-void mlkem_decompress_5(sword16* p, const unsigned char* b);
-
-WOLFSSL_LOCAL
-void mlkem_from_msg(sword16* p, const byte* msg);
-WOLFSSL_LOCAL
-void mlkem_to_msg(byte* msg, sword16* p);
-WOLFSSL_LOCAL
-void mlkem_from_bytes(sword16* p, const byte* b, int k);
-WOLFSSL_LOCAL
-void mlkem_to_bytes(byte* b, sword16* p, int k);
-
-#ifdef USE_INTEL_SPEEDUP
-WOLFSSL_LOCAL
-void mlkem_keygen_avx2(sword16* priv, sword16* pub, sword16* e,
- const sword16* a, int kp);
-WOLFSSL_LOCAL
-void mlkem_encapsulate_avx2(const sword16* pub, sword16* bp, sword16* v,
- const sword16* at, sword16* sp, const sword16* ep, const sword16* epp,
- const sword16* m, int kp);
-WOLFSSL_LOCAL
-void mlkem_decapsulate_avx2(const sword16* priv, sword16* mp, sword16* bp,
- const sword16* v, int kp);
-
-WOLFSSL_LOCAL
-unsigned int mlkem_rej_uniform_n_avx2(sword16* p, unsigned int len,
- const byte* r, unsigned int rLen);
-WOLFSSL_LOCAL
-unsigned int mlkem_rej_uniform_avx2(sword16* p, unsigned int len, const byte* r,
- unsigned int rLen);
-WOLFSSL_LOCAL
-void mlkem_redistribute_21_rand_avx2(const word64* s, byte* r0, byte* r1,
- byte* r2, byte* r3);
-void mlkem_redistribute_17_rand_avx2(const word64* s, byte* r0, byte* r1,
- byte* r2, byte* r3);
-void mlkem_redistribute_16_rand_avx2(const word64* s, byte* r0, byte* r1,
- byte* r2, byte* r3);
-void mlkem_redistribute_8_rand_avx2(const word64* s, byte* r0, byte* r1,
- byte* r2, byte* r3);
-
-WOLFSSL_LOCAL
-void mlkem_cbd_eta2_avx2(sword16* p, const byte* r);
-WOLFSSL_LOCAL
-void mlkem_cbd_eta3_avx2(sword16* p, const byte* r);
-
-WOLFSSL_LOCAL
-void mlkem_from_msg_avx2(sword16* p, const byte* msg);
-WOLFSSL_LOCAL
-void mlkem_to_msg_avx2(byte* msg, sword16* p);
-
-WOLFSSL_LOCAL
-void mlkem_from_bytes_avx2(sword16* p, const byte* b);
-WOLFSSL_LOCAL
-void mlkem_to_bytes_avx2(byte* b, sword16* p);
-
-WOLFSSL_LOCAL
-void mlkem_compress_10_avx2(byte* r, const sword16* p, int n);
-WOLFSSL_LOCAL
-void mlkem_decompress_10_avx2(sword16* p, const byte* r, int n);
-WOLFSSL_LOCAL
-void mlkem_compress_11_avx2(byte* r, const sword16* p, int n);
-WOLFSSL_LOCAL
-void mlkem_decompress_11_avx2(sword16* p, const byte* r, int n);
-
-WOLFSSL_LOCAL
-void mlkem_compress_4_avx2(byte* r, const sword16* p);
-WOLFSSL_LOCAL
-void mlkem_decompress_4_avx2(sword16* p, const byte* r);
-WOLFSSL_LOCAL
-void mlkem_compress_5_avx2(byte* r, const sword16* p);
-WOLFSSL_LOCAL
-void mlkem_decompress_5_avx2(sword16* p, const byte* r);
-
-
-WOLFSSL_LOCAL
-int mlkem_cmp_avx2(const byte* a, const byte* b, int sz);
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-WOLFSSL_LOCAL void mlkem_ntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_invntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_ntt_sqrdmlsh(sword16* r);
-WOLFSSL_LOCAL void mlkem_invntt_sqrdmlsh(sword16* r);
-WOLFSSL_LOCAL void mlkem_basemul_mont(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_basemul_mont_add(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_add_reduce(sword16* r, const sword16* a);
-WOLFSSL_LOCAL void mlkem_add3_reduce(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_rsub_reduce(sword16* r, const sword16* a);
-WOLFSSL_LOCAL void mlkem_to_mont(sword16* p);
-WOLFSSL_LOCAL void mlkem_to_mont_sqrdmlsh(sword16* p);
-WOLFSSL_LOCAL void mlkem_sha3_blocksx3_neon(word64* state);
-WOLFSSL_LOCAL void mlkem_shake128_blocksx3_seed_neon(word64* state, byte* seed);
-WOLFSSL_LOCAL void mlkem_shake256_blocksx3_seed_neon(word64* state, byte* seed);
-WOLFSSL_LOCAL unsigned int mlkem_rej_uniform_neon(sword16* p, unsigned int len,
- const byte* r, unsigned int rLen);
-WOLFSSL_LOCAL int mlkem_cmp_neon(const byte* a, const byte* b, int sz);
-WOLFSSL_LOCAL void mlkem_csubq_neon(sword16* p);
-WOLFSSL_LOCAL void mlkem_from_msg_neon(sword16* p, const byte* msg);
-WOLFSSL_LOCAL void mlkem_to_msg_neon(byte* msg, sword16* p);
-#elif defined(WOLFSSL_ARMASM_THUMB2) && defined(WOLFSSL_ARMASM)
-#define mlkem_ntt mlkem_thumb2_ntt
-#define mlkem_invntt mlkem_thumb2_invntt
-#define mlkem_basemul_mont mlkem_thumb2_basemul_mont
-#define mlkem_basemul_mont_add mlkem_thumb2_basemul_mont_add
-#define mlkem_rej_uniform_c mlkem_thumb2_rej_uniform
-
-WOLFSSL_LOCAL void mlkem_thumb2_ntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_thumb2_invntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_thumb2_basemul_mont(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_thumb2_basemul_mont_add(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_thumb2_csubq(sword16* p);
-WOLFSSL_LOCAL unsigned int mlkem_thumb2_rej_uniform(sword16* p,
- unsigned int len, const byte* r, unsigned int rLen);
-#elif defined(WOLFSSL_ARMASM)
-#define mlkem_ntt mlkem_arm32_ntt
-#define mlkem_invntt mlkem_arm32_invntt
-#define mlkem_basemul_mont mlkem_arm32_basemul_mont
-#define mlkem_basemul_mont_add mlkem_arm32_basemul_mont_add
-#define mlkem_rej_uniform_c mlkem_arm32_rej_uniform
-
-WOLFSSL_LOCAL void mlkem_arm32_ntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_arm32_invntt(sword16* r);
-WOLFSSL_LOCAL void mlkem_arm32_basemul_mont(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_arm32_basemul_mont_add(sword16* r, const sword16* a,
- const sword16* b);
-WOLFSSL_LOCAL void mlkem_arm32_csubq(sword16* p);
-WOLFSSL_LOCAL unsigned int mlkem_arm32_rej_uniform(sword16* p, unsigned int len,
- const byte* r, unsigned int rLen);
-#endif
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_MLKEM */
-
-#endif /* WOLF_CRYPT_WC_MLKEM_H */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_pkcs11.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_pkcs11.h
deleted file mode 100644
index 803a1a6c0..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_pkcs11.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/* wc_pkcs11.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef _WOLFPKCS11_H_
-#define _WOLFPKCS11_H_
-
-#include
-
-#ifdef HAVE_PKCS11
-
-#ifndef WOLF_CRYPTO_CB
- #error PKCS11 support requires ./configure --enable-cryptocb or WOLF_CRYPTO_CB to be defined
-#endif
-
-#include
-#include
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-
-typedef struct Pkcs11Dev {
-#ifndef HAVE_PKCS11_STATIC
- void* dlHandle; /* Handle to library */
-#endif
- CK_FUNCTION_LIST* func; /* Array of functions */
- void* heap;
-} Pkcs11Dev;
-
-typedef struct Pkcs11Token {
- CK_FUNCTION_LIST* func; /* Table of PKCS#11 function from lib */
- CK_SLOT_ID slotId; /* Id of slot to use */
- CK_SESSION_HANDLE handle; /* Handle to active session */
- CK_UTF8CHAR_PTR userPin; /* User's PIN to login with */
- CK_ULONG userPinSz; /* Size of user's PIN in bytes */
- byte userPinLogin:1; /* Login with User's PIN */
-} Pkcs11Token;
-
-typedef struct Pkcs11Session {
- CK_FUNCTION_LIST* func; /* Table of PKCS#11 function from lib */
- CK_SLOT_ID slotId; /* Id of slot to use */
- CK_SESSION_HANDLE handle; /* Handle to active session */
-} Pkcs11Session;
-
-/* Types of keys that can be stored. */
-enum Pkcs11KeyType {
- PKCS11_KEY_TYPE_AES_GCM,
- PKCS11_KEY_TYPE_AES_CBC,
- PKCS11_KEY_TYPE_HMAC,
- PKCS11_KEY_TYPE_RSA,
- PKCS11_KEY_TYPE_EC,
-};
-
-WOLFSSL_API int wc_Pkcs11_Initialize(Pkcs11Dev* dev, const char* library,
- void* heap);
-WOLFSSL_API int wc_Pkcs11_Initialize_ex(Pkcs11Dev* dev, const char* library,
- void* heap, CK_RV* rvp);
-WOLFSSL_API void wc_Pkcs11_Finalize(Pkcs11Dev* dev);
-
-WOLFSSL_API int wc_Pkcs11Token_Init(Pkcs11Token* token, Pkcs11Dev* dev,
- int slotId, const char* tokenName, const unsigned char *userPin,
- int userPinSz);
-WOLFSSL_API int wc_Pkcs11Token_Init_NoLogin(Pkcs11Token* token, Pkcs11Dev* dev,
- int slotId, const char* tokenName);
-WOLFSSL_API int wc_Pkcs11Token_InitName(Pkcs11Token* token, Pkcs11Dev* dev,
- const char* tokenName, int tokenSz,
- const unsigned char* userPin, int userPinSz);
-WOLFSSL_API int wc_Pkcs11Token_InitName_NoLogin(Pkcs11Token* token,
- Pkcs11Dev* dev, const char* tokenName, int tokenSz);
-
-WOLFSSL_API void wc_Pkcs11Token_Final(Pkcs11Token* token);
-WOLFSSL_API int wc_Pkcs11Token_Open(Pkcs11Token* token, int readWrite);
-WOLFSSL_API void wc_Pkcs11Token_Close(Pkcs11Token* token);
-
-WOLFSSL_API int wc_Pkcs11StoreKey(Pkcs11Token* token, int type, int clear,
- void* key);
-
-WOLFSSL_API int wc_Pkcs11_CryptoDevCb(int devId, wc_CryptoInfo* info,
- void* ctx);
-
-WOLFSSL_LOCAL int wc_hash2sz(int);
-WOLFSSL_LOCAL CK_MECHANISM_TYPE wc_hash2ckm(int);
-WOLFSSL_LOCAL CK_MECHANISM_TYPE wc_mgf2ckm(int);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* HAVE_PKCS11 */
-
-#endif /* _WOLFPKCS11_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_xmss.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_xmss.h
deleted file mode 100644
index 68cedaff3..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/wc_xmss.h
+++ /dev/null
@@ -1,285 +0,0 @@
-/* wc_xmss.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* Based on:
- * o RFC 8391 - XMSS: eXtended Merkle Signature Scheme
- * o [HDSS] "Hash-based Digital Signature Schemes", Buchmann, Dahmen and Szydlo
- * from "Post Quantum Cryptography", Springer 2009.
- */
-
-#ifndef WC_XMSS_H
-#define WC_XMSS_H
-
-#ifdef WOLFSSL_HAVE_XMSS
-#include
-#include
-#include
-#include
-
-#if !defined(WOLFSSL_WC_XMSS)
- #error "This code is incompatible with external implementation of XMSS."
-#endif
-
-#if (defined(WC_XMSS_SHA512) || defined(WC_XMSS_SHAKE256)) && \
- (WOLFSSL_WC_XMSS_MAX_HASH_SIZE >= 512)
- #define WC_XMSS_MAX_N 64
- #define WC_XMSS_MAX_PADDING_LEN 64
-#else
- #define WC_XMSS_MAX_N 32
- #define WC_XMSS_MAX_PADDING_LEN 32
-#endif
-#define WC_XMSS_MAX_MSG_PRE_LEN \
- (WC_XMSS_MAX_PADDING_LEN + 3 * WC_XMSS_MAX_N)
-#define WC_XMSS_MAX_TREE_HEIGHT 20
-#define WC_XMSS_MAX_CSUM_BYTES 4
-#define WC_XMSS_MAX_WOTS_LEN (8 * WC_XMSS_MAX_N / 4 + 3)
-#define WC_XMSS_MAX_WOTS_SIG_LEN (WC_XMSS_MAX_WOTS_LEN * WC_XMSS_MAX_N)
-#define WC_XMSS_MAX_STACK_LEN \
- ((WC_XMSS_MAX_TREE_HEIGHT + 1) * WC_XMSS_MAX_N)
-#define WC_XMSS_MAX_D 12
-#define WC_XMSS_MAX_BDS_STATES (2 * WC_XMSS_MAX_D - 1)
-#define WC_XMSS_MAX_TREE_HASH \
- ((2 * WC_XMSS_MAX_D - 1) * WC_XMSS_MAX_TREE_HEIGHT)
-#define WC_XMSS_MAX_BDS_K 0
-
-#define WC_XMSS_ADDR_LEN 32
-
-#define WC_XMSS_HASH_PRF_MAX_DATA_LEN \
- (WC_XMSS_MAX_PADDING_LEN + 2 * WC_XMSS_MAX_N + WC_XMSS_ADDR_LEN)
-#define WC_XMSS_HASH_MAX_DATA_LEN \
- (WC_XMSS_MAX_PADDING_LEN + 3 * WC_XMSS_MAX_N)
-
-
-#define WC_XMSS_SHA256_N 32
-#define WC_XMSS_SHA256_PADDING_LEN 32
-#define WC_XMSS_SHA256_WOTS_LEN 67
-
-#define XMSS_OID_LEN 4
-
-#define XMSS_MAX_HASH_LEN WC_SHA256_DIGEST_SIZE
-
-#define XMSS_RETAIN_LEN(k, n) ((!!(k)) * ((1 << (k)) - (k) - 1) * (n))
-
-/* XMMS Algorithm OIDs
- * Note: values are used in mathematical calculations in OID to parames. */
-#define WC_XMSS_OID_SHA2_10_256 0x01
-#define WC_XMSS_OID_SHA2_16_256 0x02
-#define WC_XMSS_OID_SHA2_20_256 0x03
-#define WC_XMSS_OID_SHA2_10_512 0x04
-#define WC_XMSS_OID_SHA2_16_512 0x05
-#define WC_XMSS_OID_SHA2_20_512 0x06
-#define WC_XMSS_OID_SHAKE_10_256 0x07
-#define WC_XMSS_OID_SHAKE_16_256 0x08
-#define WC_XMSS_OID_SHAKE_20_256 0x09
-#define WC_XMSS_OID_SHAKE_10_512 0x0a
-#define WC_XMSS_OID_SHAKE_16_512 0x0b
-#define WC_XMSS_OID_SHAKE_20_512 0x0c
-#define WC_XMSS_OID_SHA2_10_192 0x0d
-#define WC_XMSS_OID_SHA2_16_192 0x0e
-#define WC_XMSS_OID_SHA2_20_192 0x0f
-#define WC_XMSS_OID_SHAKE256_10_256 0x10
-#define WC_XMSS_OID_SHAKE256_16_256 0x11
-#define WC_XMSS_OID_SHAKE256_20_256 0x12
-#define WC_XMSS_OID_SHAKE256_10_192 0x13
-#define WC_XMSS_OID_SHAKE256_16_192 0x14
-#define WC_XMSS_OID_SHAKE256_20_192 0x15
-#define WC_XMSS_OID_FIRST WC_XMSS_OID_SHA2_10_256
-#define WC_XMSS_OID_LAST WC_XMSS_OID_SHAKE256_20_192
-
-/* XMMS^MT Algorithm OIDs
- * Note: values are used in mathematical calculations in OID to parames. */
-#define WC_XMSSMT_OID_SHA2_20_2_256 0x01
-#define WC_XMSSMT_OID_SHA2_20_4_256 0x02
-#define WC_XMSSMT_OID_SHA2_40_2_256 0x03
-#define WC_XMSSMT_OID_SHA2_40_4_256 0x04
-#define WC_XMSSMT_OID_SHA2_40_8_256 0x05
-#define WC_XMSSMT_OID_SHA2_60_3_256 0x06
-#define WC_XMSSMT_OID_SHA2_60_6_256 0x07
-#define WC_XMSSMT_OID_SHA2_60_12_256 0x08
-#define WC_XMSSMT_OID_SHA2_20_2_512 0x09
-#define WC_XMSSMT_OID_SHA2_20_4_512 0x0a
-#define WC_XMSSMT_OID_SHA2_40_2_512 0x0b
-#define WC_XMSSMT_OID_SHA2_40_4_512 0x0c
-#define WC_XMSSMT_OID_SHA2_40_8_512 0x0d
-#define WC_XMSSMT_OID_SHA2_60_3_512 0x0e
-#define WC_XMSSMT_OID_SHA2_60_6_512 0x0f
-#define WC_XMSSMT_OID_SHA2_60_12_512 0x10
-#define WC_XMSSMT_OID_SHAKE_20_2_256 0x11
-#define WC_XMSSMT_OID_SHAKE_20_4_256 0x12
-#define WC_XMSSMT_OID_SHAKE_40_2_256 0x13
-#define WC_XMSSMT_OID_SHAKE_40_4_256 0x14
-#define WC_XMSSMT_OID_SHAKE_40_8_256 0x15
-#define WC_XMSSMT_OID_SHAKE_60_3_256 0x16
-#define WC_XMSSMT_OID_SHAKE_60_6_256 0x17
-#define WC_XMSSMT_OID_SHAKE_60_12_256 0x18
-#define WC_XMSSMT_OID_SHAKE_20_2_512 0x19
-#define WC_XMSSMT_OID_SHAKE_20_4_512 0x1a
-#define WC_XMSSMT_OID_SHAKE_40_2_512 0x1b
-#define WC_XMSSMT_OID_SHAKE_40_4_512 0x1c
-#define WC_XMSSMT_OID_SHAKE_40_8_512 0x1d
-#define WC_XMSSMT_OID_SHAKE_60_3_512 0x1e
-#define WC_XMSSMT_OID_SHAKE_60_6_512 0x1f
-#define WC_XMSSMT_OID_SHAKE_60_12_512 0x20
-#define WC_XMSSMT_OID_SHA2_20_2_192 0x21
-#define WC_XMSSMT_OID_SHA2_20_4_192 0x22
-#define WC_XMSSMT_OID_SHA2_40_2_192 0x23
-#define WC_XMSSMT_OID_SHA2_40_4_192 0x24
-#define WC_XMSSMT_OID_SHA2_40_8_192 0x25
-#define WC_XMSSMT_OID_SHA2_60_3_192 0x26
-#define WC_XMSSMT_OID_SHA2_60_6_192 0x27
-#define WC_XMSSMT_OID_SHA2_60_12_192 0x28
-#define WC_XMSSMT_OID_SHAKE256_20_2_256 0x29
-#define WC_XMSSMT_OID_SHAKE256_20_4_256 0x2a
-#define WC_XMSSMT_OID_SHAKE256_40_2_256 0x2b
-#define WC_XMSSMT_OID_SHAKE256_40_4_256 0x2c
-#define WC_XMSSMT_OID_SHAKE256_40_8_256 0x2d
-#define WC_XMSSMT_OID_SHAKE256_60_3_256 0x2e
-#define WC_XMSSMT_OID_SHAKE256_60_6_256 0x2f
-#define WC_XMSSMT_OID_SHAKE256_60_12_256 0x30
-#define WC_XMSSMT_OID_SHAKE256_20_2_192 0x31
-#define WC_XMSSMT_OID_SHAKE256_20_4_192 0x32
-#define WC_XMSSMT_OID_SHAKE256_40_2_192 0x33
-#define WC_XMSSMT_OID_SHAKE256_40_4_192 0x34
-#define WC_XMSSMT_OID_SHAKE256_40_8_192 0x35
-#define WC_XMSSMT_OID_SHAKE256_60_3_192 0x36
-#define WC_XMSSMT_OID_SHAKE256_60_6_192 0x37
-#define WC_XMSSMT_OID_SHAKE256_60_12_192 0x38
-#define WC_XMSSMT_OID_FIRST WC_XMSSMT_OID_SHA2_20_2_256
-#define WC_XMSSMT_OID_LAST WC_XMSSMT_OID_SHAKE256_60_12_192
-
-
-/* Type for hash address. */
-typedef word32 HashAddress[8];
-
-/* XMSS/XMSS^MT fixed parameters. */
-typedef struct XmssParams {
- /* Hash algorithm to use. */
- word8 hash;
- /* Size of hash output. */
- word8 n;
- /* Number of bytes of padding before rest of hash data. */
- word8 pad_len;
- /* Number of values to chain = 2 * n + 3. */
- word8 wots_len;
- /* Number of bytes in each WOTS+ signature. */
- word16 wots_sig_len;
- /* Full height of tree. */
- word8 h;
- /* Height of tree each subtree. */
- word8 sub_h;
- /* Number of subtrees = h / sub_h. */
- word8 d;
- /* Number of bytes to encode index into in private/secret key. */
- word8 idx_len;
- /* Number of bytes in a signature. */
- word32 sig_len;
- /* Number of bytes in a secret/private key. */
- word32 sk_len;
- /* Number of bytes in a public key. */
- word8 pk_len;
- /* BDS parameter for fast C implementation. */
- word8 bds_k;
-} XmssParams;
-
-struct XmssKey {
- /* Public key. */
- unsigned char pk[2 * WC_XMSS_MAX_N];
- /* OID that identifies parameters. */
- word32 oid;
- /* Indicates whether the parameters are for XMSS^MT. */
- int is_xmssmt;
- /* XMSS/XMSS^MT parameters. */
- const XmssParams* params;
-#ifndef WOLFSSL_XMSS_VERIFY_ONLY
- /* Secret/private key. */
- unsigned char* sk;
- /* Length of secret key. */
- word32 sk_len;
- /* Callback to write/update key. */
- wc_xmss_write_private_key_cb write_private_key;
- /* Callback to read key. */
- wc_xmss_read_private_key_cb read_private_key;
- /* Context arg passed to callbacks. */
- void* context;
-#endif /* ifndef WOLFSSL_XMSS_VERIFY_ONLY */
- /* State of key. */
- enum wc_XmssState state;
-};
-
-typedef struct XmssState {
- const XmssParams* params;
-
- /* Digest is assumed to be at the end. */
- union {
- #ifdef WC_XMSS_SHA256
- wc_Sha256 sha256;
- #endif
- #ifdef WC_XMSS_SHA512
- wc_Sha512 sha512;
- #endif
- #if defined(WC_XMSS_SHAKE128) || defined(WC_XMSS_SHAKE256)
- wc_Shake shake;
- #endif
- } digest;
-#if !defined(WOLFSSL_WC_XMSS_SMALL) && defined(WC_XMSS_SHA256) && \
- !defined(WC_XMSS_FULL_HASH)
- ALIGN16 word32 dgst_state[WC_SHA256_DIGEST_SIZE / sizeof(word32)];
-#endif
- ALIGN16 byte prf_buf[WC_XMSS_HASH_PRF_MAX_DATA_LEN];
- ALIGN16 byte buf[WC_XMSS_HASH_MAX_DATA_LEN];
- ALIGN16 byte pk[WC_XMSS_MAX_WOTS_SIG_LEN];
-#ifndef WOLFSSL_XMSS_VERIFY_ONLY
- ALIGN16 byte stack[WC_XMSS_MAX_STACK_LEN];
-#else
- ALIGN16 byte stack[WC_XMSS_ADDR_LEN];
-#endif
- byte encMsg[WC_XMSS_MAX_WOTS_LEN];
- HashAddress addr;
-
- int ret;
-} XmssState;
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_LOCAL int wc_xmssmt_keygen(XmssState *state, const unsigned char* seed,
- unsigned char *sk, unsigned char *pk);
-WOLFSSL_LOCAL int wc_xmss_keygen(XmssState *state, const unsigned char* seed,
- unsigned char *sk, unsigned char *pk);
-
-WOLFSSL_LOCAL int wc_xmssmt_sign(XmssState *state, const unsigned char *m,
- word32 mlen, unsigned char *sk, unsigned char *sm);
-WOLFSSL_LOCAL int wc_xmss_sign(XmssState *state, const unsigned char *m,
- word32 mlen, unsigned char *sk, unsigned char *sm);
-
-WOLFSSL_LOCAL int wc_xmss_sigsleft(const XmssParams* params, unsigned char* sk);
-
-WOLFSSL_LOCAL int wc_xmssmt_verify(XmssState *state, const unsigned char *m,
- word32 mlen, const unsigned char *sm, const unsigned char *pk);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_XMSS */
-#endif /* WC_XMSS_H */
-
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/wolfevent.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/wolfevent.h
deleted file mode 100644
index 04dbceb4e..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/wolfevent.h
+++ /dev/null
@@ -1,120 +0,0 @@
-/* wolfevent.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#ifndef _WOLF_EVENT_H_
-#define _WOLF_EVENT_H_
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#ifndef SINGLE_THREADED
- #include
-#endif
-
-typedef struct WOLF_EVENT WOLF_EVENT;
-typedef unsigned short WOLF_EVENT_FLAG;
-
-typedef enum WOLF_EVENT_TYPE {
- WOLF_EVENT_TYPE_NONE,
-#ifdef WOLFSSL_ASYNC_CRYPT
- WOLF_EVENT_TYPE_ASYNC_WOLFSSL, /* context is WOLFSSL* */
- WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT, /* context is WC_ASYNC_DEV */
- WOLF_EVENT_TYPE_ASYNC_FIRST = WOLF_EVENT_TYPE_ASYNC_WOLFSSL,
- WOLF_EVENT_TYPE_ASYNC_LAST = WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT,
-#endif /* WOLFSSL_ASYNC_CRYPT */
-} WOLF_EVENT_TYPE;
-
-typedef enum WOLF_EVENT_STATE {
- WOLF_EVENT_STATE_READY,
- WOLF_EVENT_STATE_PENDING,
- WOLF_EVENT_STATE_DONE,
-} WOLF_EVENT_STATE;
-
-struct WOLF_EVENT {
- /* double linked list */
- WOLF_EVENT* next;
- WOLF_EVENT* prev;
-
- void* context;
- union {
- void* ptr;
-#ifdef WOLFSSL_ASYNC_CRYPT
- struct WC_ASYNC_DEV* async;
-#endif
- } dev;
-#ifdef HAVE_CAVIUM
- word64 reqId;
- #ifdef WOLFSSL_NITROX_DEBUG
- word32 pendCount;
- #endif
-#endif
-#ifndef WC_NO_ASYNC_THREADING
- pthread_t threadId;
-#endif
- int ret; /* Async return code */
- unsigned int flags;
- WOLF_EVENT_TYPE type;
- WOLF_EVENT_STATE state;
-};
-
-enum WOLF_POLL_FLAGS {
- WOLF_POLL_FLAG_CHECK_HW = 0x01,
-};
-
-typedef struct {
- WOLF_EVENT* head; /* head of queue */
- WOLF_EVENT* tail; /* tail of queue */
-#ifndef SINGLE_THREADED
- wolfSSL_Mutex lock; /* queue lock */
-#endif
- int count;
-} WOLF_EVENT_QUEUE;
-
-
-#ifdef HAVE_WOLF_EVENT
-
-/* Event */
-WOLFSSL_API int wolfEvent_Init(WOLF_EVENT* event, WOLF_EVENT_TYPE type, void* context);
-WOLFSSL_API int wolfEvent_Poll(WOLF_EVENT* event, WOLF_EVENT_FLAG flags);
-
-/* Event Queue */
-WOLFSSL_API int wolfEventQueue_Init(WOLF_EVENT_QUEUE* queue);
-WOLFSSL_API int wolfEventQueue_Push(WOLF_EVENT_QUEUE* queue, WOLF_EVENT* event);
-WOLFSSL_API int wolfEventQueue_Pop(WOLF_EVENT_QUEUE* queue, WOLF_EVENT** event);
-WOLFSSL_API int wolfEventQueue_Poll(WOLF_EVENT_QUEUE* queue, void* context_filter,
- WOLF_EVENT** events, int maxEvents, WOLF_EVENT_FLAG flags, int* eventCount);
-WOLFSSL_API int wolfEventQueue_Count(WOLF_EVENT_QUEUE* queue);
-WOLFSSL_API void wolfEventQueue_Free(WOLF_EVENT_QUEUE* queue);
-
-/* the queue mutex must be locked prior to calling these */
-WOLFSSL_API int wolfEventQueue_Add(WOLF_EVENT_QUEUE* queue, WOLF_EVENT* event);
-WOLFSSL_API int wolfEventQueue_Remove(WOLF_EVENT_QUEUE* queue, WOLF_EVENT* event);
-
-
-#endif /* HAVE_WOLF_EVENT */
-
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* _WOLF_EVENT_H_ */
diff --git a/include/bitcoin/ssl/wolfssl/wolfcrypt/xmss.h b/include/bitcoin/ssl/wolfssl/wolfcrypt/xmss.h
deleted file mode 100644
index 2f7d7a819..000000000
--- a/include/bitcoin/ssl/wolfssl/wolfcrypt/xmss.h
+++ /dev/null
@@ -1,203 +0,0 @@
-/* xmss.h
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/xmss.h
- */
-
-#ifndef WOLF_CRYPT_XMSS_H
-#define WOLF_CRYPT_XMSS_H
-
-#include
-#include
-
-#ifdef WOLFSSL_HAVE_XMSS
-
-/* Note on XMSS/XMSS^MT pub/priv key sizes:
- * - The XMSS/XMSS^MT pub key has a defined format and size.
- * - The XMSS/XMSS^MT private key is implementation and parameter
- * specific. It does not have a standardized format or size.
- *
- * The XMSS/XMSS^MT public and secret key format and length is:
- * PK = OID || root || SEED;
- * PK_len = 4 + 2 * n
- *
- * SK = OID || (implementation defined)
- * SK_len = 4 + (implementation defined)
- *
- * where n is the number of bytes in the hash function, which is 32
- * in this SHA256 implementation.
- *
- * However the private key is implementation specific. For example,
- * in xmss-reference the private key size varies from 137 bytes to
- * 1377 bytes between slow and fast implementations with param name
- * "XMSSMT-SHA2_20/2_256".
- *
- * References:
- * - RFC 8391
- * - Table 2 of Kampanakis, Fluhrer, IACR, 2017.
- * */
-
-#define XMSS_SHA256_PUBLEN (68)
-
-/* Supported XMSS/XMSS^MT parameter set names:
- * We are supporting all SHA256 parameter sets with n=32 and
- * Winternitz=16, from RFC 8391 and NIST SP 800-208.
- *
- * ----------------------------------------------------------
- * | Name OID n w len h d |
- * XMSS: | "XMSS-SHA2_10_256" 0x00000001 32 16 67 10 1 |
- * | "XMSS-SHA2_16_256" 0x00000002 32 16 67 16 1 |
- * | "XMSS-SHA2_20_256" 0x00000003 32 16 67 20 1 |
- * | |
- * XMSSMT: | "XMSSMT-SHA2_20/2_256" 0x00000001 32 16 67 20 2 |
- * | "XMSSMT-SHA2_20/4_256" 0x00000002 32 16 67 20 4 |
- * | "XMSSMT-SHA2_40/2_256" 0x00000003 32 16 67 40 2 |
- * | "XMSSMT-SHA2_40/4_256" 0x00000004 32 16 67 40 4 |
- * | "XMSSMT-SHA2_40/8_256" 0x00000005 32 16 67 40 8 |
- * | "XMSSMT-SHA2_60/3_256" 0x00000006 32 16 67 60 3 |
- * | "XMSSMT-SHA2_60/6_256" 0x00000007 32 16 67 60 6 |
- * | "XMSSMT-SHA2_60/12_256" 0x00000008 32 16 67 60 12 |
- * ----------------------------------------------------------
- *
- * Note that some XMSS and XMSSMT names do have overlapping OIDs.
- *
- * References:
- * 1. NIST SP 800-208
- * 2. RFC 8391
- * */
-
-#define XMSS_NAME_LEN (16) /* strlen("XMSS-SHA2_10_256") */
-#define XMSSMT_NAME_MIN_LEN (20) /* strlen("XMSSMT-SHA2_20/2_256") */
-#define XMSSMT_NAME_MAX_LEN (21) /* strlen("XMSSMT-SHA2_60/12_256") */
-
-#if defined(HAVE_FIPS) || defined(HAVE_LIBXMSS)
- #undef WOLFSSL_WC_XMSS_NO_SHA512
- #define WOLFSSL_WC_XMSS_NO_SHA512
- #undef WOLFSSL_WC_XMSS_NO_SHAKE128
- #define WOLFSSL_WC_XMSS_NO_SHAKE128
- #undef WOLFSSL_WC_XMSS_MAX_HASH_SIZE
- #ifdef HAVE_LIBXMSS
- #define WOLFSSL_WC_XMSS_MIN_HASH_SIZE 256
- #else
- #define WOLFSSL_WC_XMSS_MIN_HASH_SIZE 192
- #endif
- #define WOLFSSL_WC_XMSS_MAX_HASH_SIZE 256
-#endif
-
-#if !defined(NO_SHA256) && !defined(WOLFSSL_WC_XMSS_NO_SHA256)
- #define WC_XMSS_SHA256
-#endif
-#if defined(WOLFSSL_SHA512) && !defined(WOLFSSL_WC_XMSS_NO_SHA512)
- #define WC_XMSS_SHA512
-#endif
-#if defined(WOLFSSL_SHAKE128) && !defined(WOLFSSL_WC_XMSS_NO_SHAKE128)
- #define WC_XMSS_SHAKE128
-#endif
-#if defined(WOLFSSL_SHAKE256) && !defined(WOLFSSL_WC_XMSS_NO_SHAKE256)
- #define WC_XMSS_SHAKE256
-#endif
-
-#ifndef WOLFSSL_WC_XMSS_MIN_HASH_SIZE
- #define WOLFSSL_WC_XMSS_MIN_HASH_SIZE 192
-#endif
-#ifndef WOLFSSL_WC_XMSS_MAX_HASH_SIZE
- #define WOLFSSL_WC_XMSS_MAX_HASH_SIZE 512
-#endif
-#if WOLFSSL_WC_XMSS_MIN_HASH_SIZE > WOLFSSL_WC_XMSS_MAX_HASH_SIZE
- #error "XMSS minimum hash size is greater than maximum hash size"
-#endif
-
-#ifndef WOLFSSL_XMSS_MIN_HEIGHT
- #define WOLFSSL_XMSS_MIN_HEIGHT 10
-#endif
-#ifndef WOLFSSL_XMSS_MAX_HEIGHT
- #define WOLFSSL_XMSS_MAX_HEIGHT 60
-#endif
-#if WOLFSSL_XMSS_MIN_HEIGHT > WOLFSSL_XMSS_MAX_HEIGHT
- #error "XMSS minimum height is greater than maximum height"
-#endif
-
-typedef struct XmssKey XmssKey;
-
-/* Return codes returned by private key callbacks. */
-enum wc_XmssRc {
- WC_XMSS_RC_NONE,
- WC_XMSS_RC_BAD_ARG, /* Bad arg in read or write callback. */
- WC_XMSS_RC_WRITE_FAIL, /* Write or update private key failed. */
- WC_XMSS_RC_READ_FAIL, /* Read private key failed. */
- WC_XMSS_RC_SAVED_TO_NV_MEMORY, /* Wrote private key to nonvolatile storage. */
- WC_XMSS_RC_READ_TO_MEMORY /* Read private key from storage. */
-};
-
-/* enum wc_XmssState is to help track the state of an XMSS Key. */
-enum wc_XmssState {
- WC_XMSS_STATE_FREED, /* Key has been freed from memory. */
- WC_XMSS_STATE_INITED, /* Key has been inited, ready to set params.*/
- WC_XMSS_STATE_PARMSET, /* Params are set, ready to MakeKey or Reload. */
- WC_XMSS_STATE_OK, /* Able to sign signatures and verify. */
- WC_XMSS_STATE_VERIFYONLY, /* A public only XmssKey. */
- WC_XMSS_STATE_BAD, /* Can't guarantee key's state. */
- WC_XMSS_STATE_NOSIGS /* Signatures exhausted. */
-};
-
-/* Private key write and read callbacks. */
-typedef enum wc_XmssRc (*wc_xmss_write_private_key_cb)(const byte* priv, word32 privSz,
- void* context);
-typedef enum wc_XmssRc (*wc_xmss_read_private_key_cb)(byte* priv, word32 privSz,
- void* context);
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-WOLFSSL_API int wc_XmssKey_Init(XmssKey* key, void* heap, int devId);
-WOLFSSL_API int wc_XmssKey_SetParamStr(XmssKey* key, const char* str);
-#ifndef WOLFSSL_XMSS_VERIFY_ONLY
-WOLFSSL_API int wc_XmssKey_SetWriteCb(XmssKey* key,
- wc_xmss_write_private_key_cb write_cb);
-WOLFSSL_API int wc_XmssKey_SetReadCb(XmssKey* key,
- wc_xmss_read_private_key_cb read_cb);
-WOLFSSL_API int wc_XmssKey_SetContext(XmssKey* key, void* context);
-WOLFSSL_API int wc_XmssKey_MakeKey(XmssKey* key, WC_RNG* rng);
-WOLFSSL_API int wc_XmssKey_Reload(XmssKey* key);
-WOLFSSL_API int wc_XmssKey_GetPrivLen(const XmssKey* key, word32* len);
-WOLFSSL_API int wc_XmssKey_Sign(XmssKey* key, byte* sig, word32* sigSz,
- const byte* msg, int msgSz);
-WOLFSSL_API int wc_XmssKey_SigsLeft(XmssKey* key);
-#endif /* ifndef WOLFSSL_XMSS_VERIFY_ONLY */
-WOLFSSL_API void wc_XmssKey_Free(XmssKey* key);
-WOLFSSL_API int wc_XmssKey_GetSigLen(const XmssKey* key, word32* len);
-WOLFSSL_API int wc_XmssKey_GetPubLen(const XmssKey* key, word32* len);
-WOLFSSL_API int wc_XmssKey_ExportPub(XmssKey* keyDst, const XmssKey* keySrc);
-WOLFSSL_API int wc_XmssKey_ExportPubRaw(const XmssKey* key, byte* out,
- word32* outLen);
-WOLFSSL_API int wc_XmssKey_ImportPubRaw(XmssKey* key, const byte* in,
- word32 inLen);
-WOLFSSL_API int wc_XmssKey_Verify(XmssKey* key, const byte* sig, word32 sigSz,
- const byte* msg, int msgSz);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLFSSL_HAVE_XMSS */
-#endif /* WOLF_CRYPT_XMSS_H */
diff --git a/src/ssl/wolfssl/crl.c b/src/ssl/wolfssl/crl.c
deleted file mode 100644
index 9056bd1c6..000000000
--- a/src/ssl/wolfssl/crl.c
+++ /dev/null
@@ -1,1906 +0,0 @@
-/* crl.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-/*
-CRL Options:
- * CRL_STATIC_REVOKED_LIST: default: off
- * Enables fixed static list of RevokedCerts to allow
- * for a binary search.
- * CRL_MAX_REVOKED_CERTS: default: 4
- * Specifies the number of buffers to hold RevokedCerts.
- * The default value is set to 4.
- * CRL_REPORT_LOAD_ERRORS: default: off
- * Return any errors encountered during loading CRL
- * from a directory.
-*/
-
-#ifndef WOLFCRYPT_ONLY
-#ifdef HAVE_CRL
-
-#include
-#include
-#include
-
-#ifndef NO_STRING_H
- #include
-#endif
-
-#ifdef HAVE_CRL_MONITOR
- #if defined(__MACH__) || defined(__FreeBSD__) || defined(__linux__) || \
- defined(_MSC_VER)
- static int StopMonitor(wolfSSL_CRL_mfd_t mfd);
- #else
- #error "CRL monitor only currently supported on linux or mach or windows"
- #endif
-#endif /* HAVE_CRL_MONITOR */
-
-
-/* Initialize CRL members */
-int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm)
-{
- WOLFSSL_ENTER("InitCRL");
- if(cm != NULL)
- crl->heap = cm->heap;
- else
- crl->heap = NULL;
- crl->cm = cm;
- crl->crlList = NULL;
- crl->currentEntry = NULL;
-#ifdef HAVE_CRL_MONITOR
- crl->monitors[0].path = NULL;
- crl->monitors[1].path = NULL;
- crl->tid = INVALID_THREAD_VAL;
- crl->mfd = WOLFSSL_CRL_MFD_INIT_VAL;
- crl->setup = 0; /* thread setup done predicate */
- if (wolfSSL_CondInit(&crl->cond) != 0) {
- WOLFSSL_MSG("thread condition init failed");
- return BAD_COND_E;
- }
-#endif
-#ifdef HAVE_CRL_IO
- crl->crlIOCb = NULL;
-#endif
- if (wc_InitRwLock(&crl->crlLock) != 0) {
- WOLFSSL_MSG("Init Mutex failed");
- return BAD_MUTEX_E;
- }
-#ifdef OPENSSL_ALL
- {
- int ret;
- wolfSSL_RefInit(&crl->ref, &ret);
- (void)ret;
- }
-#endif
-
- return 0;
-}
-
-
-/* Initialize CRL Entry */
-static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
- int verified, void* heap)
-{
- WOLFSSL_ENTER("InitCRL_Entry");
-
- XMEMCPY(crle->issuerHash, dcrl->issuerHash, CRL_DIGEST_SIZE);
- /* XMEMCPY(crle->crlHash, dcrl->crlHash, CRL_DIGEST_SIZE);
- * copy the hash here if needed for optimized comparisons */
- XMEMCPY(crle->lastDate, dcrl->lastDate, MAX_DATE_SIZE);
- XMEMCPY(crle->nextDate, dcrl->nextDate, MAX_DATE_SIZE);
- crle->lastDateFormat = dcrl->lastDateFormat;
- crle->nextDateFormat = dcrl->nextDateFormat;
- crle->version = dcrl->version;
-
-#if defined(OPENSSL_EXTRA)
- crle->lastDateAsn1.length = MAX_DATE_SIZE;
- XMEMCPY (crle->lastDateAsn1.data, crle->lastDate,
- (size_t)crle->lastDateAsn1.length);
- crle->lastDateAsn1.type = crle->lastDateFormat;
- crle->nextDateAsn1.length = MAX_DATE_SIZE;
- XMEMCPY (crle->nextDateAsn1.data, crle->nextDate,
- (size_t)crle->nextDateAsn1.length);
- crle->nextDateAsn1.type = crle->nextDateFormat;
-
- crle->issuer = NULL;
- wolfSSL_d2i_X509_NAME(&crle->issuer, (unsigned char**)&dcrl->issuer,
- dcrl->issuerSz);
- if (crle->issuer == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
-#endif
-#ifdef CRL_STATIC_REVOKED_LIST
- /* ParseCRL_CertList() has already cached the Revoked certs into
- the crle->certs array */
-#else
- crle->certs = dcrl->certs; /* take ownership */
-#endif
- dcrl->certs = NULL;
- crle->totalCerts = dcrl->totalCerts;
- crle->crlNumberSet = dcrl->crlNumberSet;
- if (crle->crlNumberSet) {
- XMEMCPY(crle->crlNumber, dcrl->crlNumber, CRL_MAX_NUM_SZ);
- }
- crle->verified = verified;
- if (!verified) {
- crle->tbsSz = dcrl->sigIndex - dcrl->certBegin;
- crle->signatureSz = dcrl->sigLength;
- crle->signatureOID = dcrl->signatureOID;
- crle->toBeSigned = (byte*)XMALLOC(crle->tbsSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- if (crle->toBeSigned == NULL)
- return WOLFSSL_FATAL_ERROR;
- crle->signature = (byte*)XMALLOC(crle->signatureSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- if (crle->signature == NULL) {
- XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_CRL_ENTRY);
- crle->toBeSigned = NULL;
- return WOLFSSL_FATAL_ERROR;
- }
-
- #ifdef WC_RSA_PSS
- crle->sigParamsSz = dcrl->sigParamsLength;
- if (dcrl->sigParamsLength > 0) {
- crle->sigParams = (byte*)XMALLOC(crle->sigParamsSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- if (crle->sigParams== NULL) {
- XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_CRL_ENTRY);
- crle->toBeSigned = NULL;
- XFREE(crle->signature, heap, DYNAMIC_TYPE_CRL_ENTRY);
- crle->signature = NULL;
- return WOLFSSL_FATAL_ERROR;
- }
- XMEMCPY(crle->sigParams, buff + dcrl->sigParamsIndex,
- crle->sigParamsSz);
- }
- #endif
- XMEMCPY(crle->toBeSigned, buff + dcrl->certBegin, crle->tbsSz);
- XMEMCPY(crle->signature, dcrl->signature, crle->signatureSz);
- #ifndef NO_SKID
- crle->extAuthKeyIdSet = dcrl->extAuthKeyIdSet;
- if (crle->extAuthKeyIdSet)
- XMEMCPY(crle->extAuthKeyId, dcrl->extAuthKeyId, KEYID_SIZE);
- #endif
- }
- else {
- crle->toBeSigned = NULL;
- crle->signature = NULL;
- }
-
- (void)verified;
- (void)heap;
-
- return 0;
-}
-
-static CRL_Entry* CRL_Entry_new(void* heap)
-{
- CRL_Entry* crle = (CRL_Entry*)XMALLOC(sizeof(CRL_Entry), heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- if (crle != NULL) {
- XMEMSET(crle, 0, sizeof(CRL_Entry));
- if (wc_InitMutex(&crle->verifyMutex) != 0) {
- XFREE(crle, heap, DYNAMIC_TYPE_CRL_ENTRY);
- crle = NULL;
- }
- }
- (void)heap;
- return crle;
-}
-
-/* Free all CRL Entry resources */
-static void CRL_Entry_free(CRL_Entry* crle, void* heap)
-{
- WOLFSSL_ENTER("CRL_Entry_free");
- if (crle == NULL) {
- WOLFSSL_MSG("CRL Entry is null");
- return;
- }
-#ifdef CRL_STATIC_REVOKED_LIST
- XMEMSET(crle->certs, 0, CRL_MAX_REVOKED_CERTS*sizeof(RevokedCert));
-#else
- {
- RevokedCert* tmp;
- RevokedCert* next;
-
- for (tmp = crle->certs; tmp != NULL; tmp = next) {
- next = tmp->next;
- XFREE(tmp, heap, DYNAMIC_TYPE_REVOKED);
- }
-
- }
-#endif
- XFREE(crle->signature, heap, DYNAMIC_TYPE_CRL_ENTRY);
- XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_CRL_ENTRY);
-#ifdef WC_RSA_PSS
- XFREE(crle->sigParams, heap, DYNAMIC_TYPE_CRL_ENTRY);
-#endif
-#if defined(OPENSSL_EXTRA)
- if (crle->issuer != NULL) {
- FreeX509Name(crle->issuer);
- XFREE(crle->issuer, heap, DYNAMIC_TYPE_X509);
- }
-#endif
- wc_FreeMutex(&crle->verifyMutex);
- XFREE(crle, heap, DYNAMIC_TYPE_CRL_ENTRY);
- (void)heap;
-}
-
-
-/* Free all CRL resources */
-void FreeCRL(WOLFSSL_CRL* crl, int dynamic)
-{
- CRL_Entry* tmp;
-
- WOLFSSL_ENTER("FreeCRL");
-
- if (crl == NULL)
- return;
-
-#ifdef OPENSSL_ALL
- {
- int ret;
- int doFree = 0;
- wolfSSL_RefDec(&crl->ref, &doFree, &ret);
- if (ret != 0)
- WOLFSSL_MSG("Couldn't lock x509 mutex");
- if (!doFree)
- return;
- wolfSSL_RefFree(&crl->ref);
- }
-#endif
-
- tmp = crl->crlList;
-#ifdef HAVE_CRL_MONITOR
- if (crl->monitors[0].path)
- XFREE(crl->monitors[0].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
-
- if (crl->monitors[1].path)
- XFREE(crl->monitors[1].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
-#endif
-
- XFREE(crl->currentEntry, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
- crl->currentEntry = NULL;
- while(tmp) {
- CRL_Entry* next = tmp->next;
- CRL_Entry_free(tmp, crl->heap);
- tmp = next;
- }
-
-#ifdef HAVE_CRL_MONITOR
- if (crl->tid != INVALID_THREAD_VAL) {
- WOLFSSL_MSG("stopping monitor thread");
- if (StopMonitor(crl->mfd) == 0) {
- if (wolfSSL_JoinThread(crl->tid) != 0)
- WOLFSSL_MSG("stop monitor failed in wolfSSL_JoinThread");
- }
- else {
- WOLFSSL_MSG("stop monitor failed");
- }
- }
- if (wolfSSL_CondFree(&crl->cond) != 0)
- WOLFSSL_MSG("wolfSSL_CondFree failed in FreeCRL");
-#endif
- wc_FreeRwLock(&crl->crlLock);
- if (dynamic) /* free self */
- XFREE(crl, crl->heap, DYNAMIC_TYPE_CRL);
-}
-
-static int FindRevokedSerial(RevokedCert* rc, byte* serial, int serialSz,
- byte* serialHash, int totalCerts)
-{
- int ret = 0;
- byte hash[SIGNER_DIGEST_SIZE];
-#ifdef CRL_STATIC_REVOKED_LIST
- /* do binary search */
- int low, high, mid;
-
- low = 0;
- high = totalCerts - 1;
-
- while (low <= high) {
- mid = (low + high) / 2;
-
- if (XMEMCMP(rc[mid].serialNumber, serial, rc->serialSz) < 0) {
- low = mid + 1;
- }
- else if (XMEMCMP(rc[mid].serialNumber, serial, rc->serialSz) > 0) {
- high = mid - 1;
- }
- else {
- WOLFSSL_MSG("Cert revoked");
- ret = CRL_CERT_REVOKED;
- break;
- }
- }
-#else
- (void)totalCerts;
- /* search in the linked list*/
- while (rc) {
- if (serialHash == NULL) {
- if (rc->serialSz == serialSz &&
- XMEMCMP(rc->serialNumber, serial, (size_t)rc->serialSz) == 0) {
- WOLFSSL_MSG("Cert revoked");
- ret = CRL_CERT_REVOKED;
- break;
- }
- }
- else {
- ret = CalcHashId(rc->serialNumber, (word32)rc->serialSz, hash);
- if (ret != 0)
- break;
- if (XMEMCMP(hash, serialHash, SIGNER_DIGEST_SIZE) == 0) {
- WOLFSSL_MSG("Cert revoked");
- ret = CRL_CERT_REVOKED;
- break;
- }
- }
- rc = rc->next;
- }
-#endif
- return ret;
-}
-
-static int VerifyCRLE(const WOLFSSL_CRL* crl, CRL_Entry* crle)
-{
- Signer* ca = NULL;
- SignatureCtx sigCtx;
- int ret = 0;
-
-#ifndef NO_SKID
- if (crle->extAuthKeyIdSet)
- ca = GetCA(crl->cm, crle->extAuthKeyId);
- if (ca == NULL)
- ca = GetCAByName(crl->cm, crle->issuerHash);
-#else /* NO_SKID */
- ca = GetCA(crl->cm, crle->issuerHash);
-#endif /* NO_SKID */
- if (ca == NULL) {
- WOLFSSL_MSG("Did NOT find CRL issuer CA");
- return ASN_CRL_NO_SIGNER_E;
- }
-
- ret = VerifyCRL_Signature(&sigCtx, crle->toBeSigned, crle->tbsSz,
- crle->signature, crle->signatureSz, crle->signatureOID,
- #ifdef WC_RSA_PSS
- crle->sigParams, (int)crle->sigParamsSz,
- #else
- NULL, 0,
- #endif
- ca, crl->heap);
-
- if (ret == 0) {
- crle->verified = 1;
- }
- else {
- crle->verified = ret;
- }
-
- return ret;
-}
-
-static int CheckCertCRLList(WOLFSSL_CRL* crl, byte* issuerHash, byte* serial,
- int serialSz, byte* serialHash, int *pFoundEntry)
-{
- CRL_Entry* crle;
- int foundEntry = 0;
- int ret = 0;
-
- if (wc_LockRwLock_Rd(&crl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Rd failed");
- return BAD_MUTEX_E;
- }
-
- for (crle = crl->crlList; crle != NULL; crle = crle->next) {
- if (XMEMCMP(crle->issuerHash, issuerHash, CRL_DIGEST_SIZE) == 0) {
- int nextDateValid = 1;
-
- WOLFSSL_MSG("Found CRL Entry on list");
-
- if (crle->verified == 0) {
- if (wc_LockMutex(&crle->verifyMutex) != 0) {
- WOLFSSL_MSG("wc_LockMutex failed");
- break;
- }
-
- /* A different thread may have verified the entry while we were
- * waiting for the mutex. */
- if (crle->verified == 0)
- ret = VerifyCRLE(crl, crle);
-
- wc_UnLockMutex(&crle->verifyMutex);
-
- if (ret != 0)
- break;
- }
-
- if (crle->verified < 0) {
- WOLFSSL_MSG("Cannot use CRL as it didn't verify");
- ret = crle->verified;
- break;
- }
-
- WOLFSSL_MSG("Checking next date validity");
-
- #ifdef WOLFSSL_NO_CRL_NEXT_DATE
- if (crle->nextDateFormat != ASN_OTHER_TYPE)
- #endif
- {
- #if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
- if (!XVALIDATE_DATE(crle->nextDate,crle->nextDateFormat, ASN_AFTER)) {
- WOLFSSL_MSG("CRL next date is no longer valid");
- nextDateValid = 0;
- }
- #endif
- }
- if (nextDateValid) {
- foundEntry = 1;
- ret = FindRevokedSerial(crle->certs, serial, serialSz,
- serialHash, crle->totalCerts);
- if (ret != 0)
- break;
- }
- else if (foundEntry == 0) {
- ret = CRL_CERT_DATE_ERR;
- }
- }
- }
-
- wc_UnLockRwLock(&crl->crlLock);
-
- *pFoundEntry = foundEntry;
-
- return ret;
-}
-
-int CheckCertCRL_ex(WOLFSSL_CRL* crl, byte* issuerHash, byte* serial,
- int serialSz, byte* serialHash, const byte* extCrlInfo,
- int extCrlInfoSz, void* issuerName)
-{
- int foundEntry = 0;
- int ret = 0;
-
- WOLFSSL_ENTER("CheckCertCRL");
- (void)issuerName;
-
- if ((serial == NULL || serialSz == 0) && serialHash == NULL) {
- WOLFSSL_MSG("Either serial or hash has to be provided");
- return BUFFER_ERROR;
- }
-
-#ifdef WOLFSSL_CRL_ALLOW_MISSING_CDP
- /* Skip CRL verification in case no CDP in peer cert */
- if (!extCrlInfo) {
- return ret;
- }
-#endif
-
- ret = CheckCertCRLList(crl, issuerHash, serial, serialSz, serialHash,
- &foundEntry);
-
-#ifdef HAVE_CRL_IO
- if (foundEntry == 0) {
- /* perform embedded lookup */
- if (crl->crlIOCb) {
- int cbRet = crl->crlIOCb(crl, (const char*)extCrlInfo,
- extCrlInfoSz);
- if (cbRet == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ)) {
- ret = OCSP_WANT_READ;
- }
- else if (ret >= 0) {
- /* try again */
- ret = CheckCertCRLList(crl, issuerHash, serial, serialSz,
- serialHash, &foundEntry);
- }
- }
- }
-#endif
-
-#if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
- (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
- !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) && \
- !defined(NO_STDIO_FILESYSTEM)
- /* if not find entry in the CRL list, it looks at the folder that sets */
- /* by LOOKUP_ctrl because user would want to use hash_dir. */
- /* Loading .rN form CRL file if find at the folder, */
- /* and try again checking Cert in the CRL list. */
- /* When not set the folder or not use hash_dir, do nothing. */
- if ((foundEntry == 0) && (ret != WC_NO_ERR_TRACE(OCSP_WANT_READ))) {
- if (crl->cm != NULL && crl->cm->x509_store_p != NULL) {
- int loadRet = LoadCertByIssuer(crl->cm->x509_store_p,
- (WOLFSSL_X509_NAME*)issuerName, X509_LU_CRL);
- if (loadRet == WOLFSSL_SUCCESS) {
- /* try again */
- ret = CheckCertCRLList(crl, issuerHash, serial, serialSz,
- serialHash, &foundEntry);
- }
- }
- }
-#endif
- if (foundEntry == 0) {
- WOLFSSL_MSG("Couldn't find CRL for status check");
- if (ret != WC_NO_ERR_TRACE(CRL_CERT_DATE_ERR)) {
- ret = CRL_MISSING;
- }
-
- if (crl->cm != NULL && crl->cm->cbMissingCRL) {
- char url[256];
-
- WOLFSSL_MSG("Issuing missing CRL callback");
- url[0] = '\0';
- if (extCrlInfo) {
- if (extCrlInfoSz < (int)sizeof(url) -1 ) {
- XMEMCPY(url, extCrlInfo, (size_t)extCrlInfoSz);
- url[extCrlInfoSz] = '\0';
- }
- else {
- WOLFSSL_MSG("CRL url too long");
- }
- }
-
- crl->cm->cbMissingCRL(url);
- }
-
- if (crl->cm != NULL && crl->cm->crlCb &&
- crl->cm->crlCb(ret, crl, crl->cm, crl->cm->crlCbCtx)) {
- if (ret != 0)
- WOLFSSL_MSG("Overriding CRL error");
- ret = 0;
- }
- }
-
- return ret;
-}
-
-/* Is the cert ok with CRL, return 0 on success */
-int CheckCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert)
-{
-#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
- void* issuerName = cert->issuerName;
-#else
- void* issuerName = NULL;
-#endif
- return CheckCertCRL_ex(crl, cert->issuerHash, cert->serial, cert->serialSz,
- NULL, cert->extCrlInfo, cert->extCrlInfoSz, issuerName);
-}
-
-#ifdef HAVE_CRL_UPDATE_CB
-static void SetCrlInfo(CRL_Entry* entry, CrlInfo *info)
-{
- info->issuerHash = (byte *)entry->issuerHash;
- info->issuerHashLen = CRL_DIGEST_SIZE;
- info->lastDate = (byte *)entry->lastDate;
- info->lastDateMaxLen = MAX_DATE_SIZE;
- info->lastDateFormat = entry->lastDateFormat;
- info->nextDate = (byte *)entry->nextDate;
- info->nextDateMaxLen = MAX_DATE_SIZE;
- info->nextDateFormat = entry->nextDateFormat;
- info->crlNumberSet = entry->crlNumberSet;
- if (info->crlNumberSet)
- XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
-}
-
-static void SetCrlInfoFromDecoded(DecodedCRL* entry, CrlInfo *info)
-{
- info->issuerHash = (byte *)entry->issuerHash;
- info->issuerHashLen = SIGNER_DIGEST_SIZE;
- info->lastDate = (byte *)entry->lastDate;
- info->lastDateMaxLen = MAX_DATE_SIZE;
- info->lastDateFormat = entry->lastDateFormat;
- info->nextDate = (byte *)entry->nextDate;
- info->nextDateMaxLen = MAX_DATE_SIZE;
- info->nextDateFormat = entry->nextDateFormat;
- info->crlNumberSet = entry->crlNumberSet;
- if (info->crlNumberSet)
- XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
-}
-#endif
-
-/* Returns MP_GT if prev crlNumber is smaller
- * MP_EQ if equal
- * MP_LT if prev crlNumber is larger */
-static int CompareCRLnumber(CRL_Entry* prev, CRL_Entry* curr)
-{
- int ret = 0;
- DECL_MP_INT_SIZE_DYN(prev_num, CRL_MAX_NUM_SZ * CHAR_BIT,
- CRL_MAX_NUM_SZ * CHAR_BIT);
- DECL_MP_INT_SIZE_DYN(curr_num, CRL_MAX_NUM_SZ * CHAR_BIT,
- CRL_MAX_NUM_SZ * CHAR_BIT);
-
- NEW_MP_INT_SIZE(prev_num, CRL_MAX_NUM_SZ * CHAR_BIT, NULL,
- DYNAMIC_TYPE_TMP_BUFFER);
- NEW_MP_INT_SIZE(curr_num, CRL_MAX_NUM_SZ * CHAR_BIT, NULL,
- DYNAMIC_TYPE_TMP_BUFFER);
-#ifdef MP_INT_SIZE_CHECK_NULL
- if ((prev_num == NULL) || (curr_num == NULL)) {
- ret = MEMORY_E;
- }
-#endif
-
- if (ret == 0 && ((INIT_MP_INT_SIZE(prev_num, CRL_MAX_NUM_SZ * CHAR_BIT)
- != MP_OKAY) || (INIT_MP_INT_SIZE(curr_num,
- CRL_MAX_NUM_SZ * CHAR_BIT)) != MP_OKAY)) {
- ret = MP_INIT_E;
- }
-
- if (ret == 0 && (mp_read_radix(prev_num, (char*)prev->crlNumber,
- MP_RADIX_HEX) != MP_OKAY ||
- mp_read_radix(curr_num, (char*)curr->crlNumber,
- MP_RADIX_HEX) != MP_OKAY)) {
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0)
- ret = mp_cmp(prev_num, curr_num);
-
- FREE_MP_INT_SIZE(prev_num, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- FREE_MP_INT_SIZE(curr_num, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-/* Add Decoded CRL, 0 on success */
-static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
- int verified)
-{
- CRL_Entry* crle = NULL;
- CRL_Entry* curr = NULL;
- CRL_Entry* prev = NULL;
-#ifdef HAVE_CRL_UPDATE_CB
- CrlInfo old;
- CrlInfo cnew;
-#endif
- int ret = 0;
-
- WOLFSSL_ENTER("AddCRL");
-
- if (crl == NULL)
- return WOLFSSL_FATAL_ERROR;
-
- crle = crl->currentEntry;
-
- if (crle == NULL) {
- crle = CRL_Entry_new(crl->heap);
- if (crle == NULL) {
- WOLFSSL_MSG("alloc CRL Entry failed");
- return MEMORY_E;
- }
- }
-
- if (InitCRL_Entry(crle, dcrl, buff, verified, crl->heap) < 0) {
- WOLFSSL_MSG("Init CRL Entry failed");
- CRL_Entry_free(crle, crl->heap);
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (wc_LockRwLock_Wr(&crl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Wr failed");
- CRL_Entry_free(crle, crl->heap);
- return BAD_MUTEX_E;
- }
-
- for (curr = crl->crlList; curr != NULL; curr = curr->next) {
- if (XMEMCMP(curr->issuerHash, crle->issuerHash, CRL_DIGEST_SIZE) == 0) {
- ret = CompareCRLnumber(crle, curr);
- /* Error out if the CRL we're attempting to add isn't more
- * authoritative than the existing entry */
- if (ret == MP_LT || ret == MP_EQ) {
- WOLFSSL_MSG("Same or newer CRL entry already exists");
- CRL_Entry_free(crle, crl->heap);
- wc_UnLockRwLock(&crl->crlLock);
- return BAD_FUNC_ARG;
- }
- else if (ret < 0) {
- WOLFSSL_MSG("Error comparing CRL Numbers");
- return ret;
- }
-
- crle->next = curr->next;
- if (prev != NULL) {
- prev->next = crle;
- }
- else {
- crl->crlList = crle;
- }
-
-#ifdef HAVE_CRL_UPDATE_CB
- if (crl->cm && crl->cm->cbUpdateCRL != NULL) {
- SetCrlInfo(curr, &old);
- SetCrlInfo(crle, &cnew);
- crl->cm->cbUpdateCRL(&old, &cnew);
- }
-#endif
-
- break;
- }
- prev = curr;
- }
-
- if (curr != NULL) {
- CRL_Entry_free(curr, crl->heap);
- }
- else {
- crle->next = crl->crlList;
- crl->crlList = crle;
- }
- wc_UnLockRwLock(&crl->crlLock);
- /* Avoid heap-use-after-free after crl->crlList is released */
- crl->currentEntry = NULL;
-
- return 0;
-}
-
-
-/* Load CRL File of type, WOLFSSL_SUCCESS on ok */
-int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz, int type,
- int verify)
-{
- int ret = WOLFSSL_SUCCESS;
- const byte* myBuffer = buff; /* if DER ok, otherwise switch */
- DerBuffer* der = NULL;
- WC_DECLARE_VAR(dcrl, DecodedCRL, 1, 0);
-
- WOLFSSL_ENTER("BufferLoadCRL");
-
- if (crl == NULL || buff == NULL || sz == 0)
- return BAD_FUNC_ARG;
-
- if (type == WOLFSSL_FILETYPE_PEM) {
- #ifdef WOLFSSL_PEM_TO_DER
- ret = PemToDer(buff, sz, CRL_TYPE, &der, NULL, NULL, NULL);
- if (ret == 0) {
- myBuffer = der->buffer;
- sz = der->length;
- }
- else {
- WOLFSSL_MSG("Pem to Der failed");
- FreeDer(&der);
- return WOLFSSL_FATAL_ERROR;
- }
- #else
- ret = NOT_COMPILED_IN;
- #endif
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- dcrl = (DecodedCRL*)XMALLOC(sizeof(DecodedCRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (dcrl == NULL) {
- FreeDer(&der);
- return MEMORY_E;
- }
-#endif
-
- crl->currentEntry = CRL_Entry_new(crl->heap);
- if (crl->currentEntry == NULL) {
- WOLFSSL_MSG_CERT_LOG("alloc CRL Entry failed");
- WC_FREE_VAR_EX(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- FreeDer(&der);
- return MEMORY_E;
- }
-
- InitDecodedCRL(dcrl, crl->heap);
- ret = ParseCRL(crl->currentEntry->certs, dcrl, myBuffer, (word32)sz,
- verify, crl->cm);
-
- if (ret != 0 && !(ret == WC_NO_ERR_TRACE(ASN_CRL_NO_SIGNER_E)
- && verify == NO_VERIFY)) {
- WOLFSSL_MSG_CERT_LOG("ParseCRL error");
- WOLFSSL_MSG_CERT_EX("ParseCRL verify = %d, ret = %d", verify, ret);
- CRL_Entry_free(crl->currentEntry, crl->heap);
- crl->currentEntry = NULL;
- }
- else {
- ret = AddCRL(crl, dcrl, myBuffer,
- ret != WC_NO_ERR_TRACE(ASN_CRL_NO_SIGNER_E));
- if (ret != 0) {
- WOLFSSL_MSG_CERT_LOG("AddCRL error");
- crl->currentEntry = NULL;
- }
- }
-
- FreeDecodedCRL(dcrl);
-
- WC_FREE_VAR_EX(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- FreeDer(&der);
-
- return ret ? ret : WOLFSSL_SUCCESS; /* convert 0 to WOLFSSL_SUCCESS */
-}
-
-#ifdef HAVE_CRL_UPDATE_CB
-/* Fill out CRL info structure, WOLFSSL_SUCCESS on ok */
-int GetCRLInfo(WOLFSSL_CRL* crl, CrlInfo* info, const byte* buff,
- long sz, int type)
-{
- int ret = WOLFSSL_SUCCESS;
- const byte* myBuffer = buff; /* if DER ok, otherwise switch */
- DerBuffer* der = NULL;
- CRL_Entry* crle = NULL;
- WC_DECLARE_VAR(dcrl, DecodedCRL, 1, 0);
-
- WOLFSSL_ENTER("GetCRLInfo");
-
- if (crl == NULL || info == NULL || buff == NULL || sz == 0)
- return BAD_FUNC_ARG;
-
- if (type == WOLFSSL_FILETYPE_PEM) {
- #ifdef WOLFSSL_PEM_TO_DER
- ret = PemToDer(buff, sz, CRL_TYPE, &der, NULL, NULL, NULL);
- if (ret == 0) {
- myBuffer = der->buffer;
- sz = der->length;
- }
- else {
- WOLFSSL_MSG("Pem to Der failed");
- FreeDer(&der);
- return -1;
- }
- #else
- ret = NOT_COMPILED_IN;
- #endif
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- dcrl = (DecodedCRL*)XMALLOC(sizeof(DecodedCRL), NULL,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (dcrl == NULL) {
- FreeDer(&der);
- return MEMORY_E;
- }
-#endif
-
- crle = CRL_Entry_new(crl->heap);
- if (crle == NULL) {
- WOLFSSL_MSG("alloc CRL Entry failed");
- WC_FREE_VAR_EX(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- FreeDer(&der);
- return MEMORY_E;
- }
-
- InitDecodedCRL(dcrl, crl->heap);
- ret = ParseCRL(crle->certs, dcrl, myBuffer, (word32)sz,
- 0, crl->cm);
- if (ret != 0 && !(ret == WC_NO_ERR_TRACE(ASN_CRL_NO_SIGNER_E))) {
- WOLFSSL_MSG("ParseCRL error");
- CRL_Entry_free(crle, crl->heap);
- crle = NULL;
- }
- else {
- SetCrlInfoFromDecoded((DecodedCRL*)dcrl, info);
- }
-
- FreeDecodedCRL(dcrl);
-
- WC_FREE_VAR_EX(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- FreeDer(&der);
- CRL_Entry_free(crle, crl->heap);
-
- return ret ? ret : WOLFSSL_SUCCESS; /* convert 0 to WOLFSSL_SUCCESS */
-}
-#endif
-
-#if defined(OPENSSL_EXTRA) && defined(HAVE_CRL)
-/* helper function to create a new dynamic WOLFSSL_X509_CRL structure */
-static WOLFSSL_X509_CRL* wolfSSL_X509_crl_new(WOLFSSL_CERT_MANAGER* cm)
-{
- WOLFSSL_X509_CRL* ret;
- void* heap = NULL;
-
- if (cm != NULL) {
- heap = cm->heap;
- }
-
- ret = (WOLFSSL_X509_CRL*)XMALLOC(sizeof(WOLFSSL_X509_CRL), heap,
- DYNAMIC_TYPE_CRL);
- if (ret != NULL) {
- if (InitCRL(ret, cm) < 0) {
- WOLFSSL_MSG("Unable to initialize new CRL structure");
- XFREE(ret, heap, DYNAMIC_TYPE_CRL);
- ret = NULL;
- }
- }
- return ret;
-}
-
-#ifndef CRL_STATIC_REVOKED_LIST
-/* returns head of copied list that was alloc'd */
-static RevokedCert *DupRevokedCertList(RevokedCert* in, void* heap)
-{
- RevokedCert* head = NULL;
- RevokedCert* current = in;
- RevokedCert* prev = NULL;
- while (current) {
- RevokedCert* tmp = (RevokedCert*)XMALLOC(sizeof(RevokedCert), heap,
- DYNAMIC_TYPE_REVOKED);
- if (tmp != NULL) {
- XMEMCPY(tmp->serialNumber, current->serialNumber,
- EXTERNAL_SERIAL_SIZE);
- tmp->serialSz = current->serialSz;
- XMEMCPY(tmp->revDate, current->revDate,
- MAX_DATE_SIZE);
- tmp->revDateFormat = current->revDateFormat;
- tmp->next = NULL;
- if (prev != NULL)
- prev->next = tmp;
- if (head == NULL)
- head = tmp;
- prev = tmp;
- }
- else {
- WOLFSSL_MSG("Failed to allocate new RevokedCert structure");
- /* free up any existing list */
- while (head != NULL) {
- current = head;
- head = head->next;
- XFREE(current, heap, DYNAMIC_TYPE_REVOKED);
- }
- return NULL;
- }
- current = current->next;
- }
-
- (void)heap;
- return head;
-}
-
-#endif /* CRL_STATIC_REVOKED_LIST */
-/* returns a deep copy of ent on success and null on fail */
-static CRL_Entry* DupCRL_Entry(const CRL_Entry* ent, void* heap)
-{
- CRL_Entry *dupl;
- const size_t copyOffset = WC_OFFSETOF(CRL_Entry, verifyMutex) +
- sizeof(ent->verifyMutex);
-#ifdef CRL_STATIC_REVOKED_LIST
- if (ent->totalCerts > CRL_MAX_REVOKED_CERTS) {
- return NULL;
- }
-#endif
- dupl = CRL_Entry_new(heap);
- if (dupl == NULL) {
- WOLFSSL_MSG("alloc CRL Entry failed");
- return NULL;
- }
-
- XMEMCPY((byte*)dupl + copyOffset, (byte*)ent + copyOffset,
- sizeof(CRL_Entry) - copyOffset);
-
-#ifndef CRL_STATIC_REVOKED_LIST
- dupl->certs = DupRevokedCertList(ent->certs, heap);
- if (ent->certs != NULL && dupl->certs == NULL) {
- CRL_Entry_free(dupl, heap);
- return NULL;
- }
-#endif
-#ifdef OPENSSL_EXTRA
- dupl->issuer = wolfSSL_X509_NAME_dup(ent->issuer);
- if (ent->issuer != NULL && dupl->issuer == NULL) {
- CRL_Entry_free(dupl, heap);
- return NULL;
- }
-#endif
-
- if (!ent->verified) {
- dupl->toBeSigned = (byte*)XMALLOC(dupl->tbsSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- dupl->signature = (byte*)XMALLOC(dupl->signatureSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- #ifdef WC_RSA_PSS
- dupl->sigParams = (byte*)XMALLOC(dupl->sigParamsSz, heap,
- DYNAMIC_TYPE_CRL_ENTRY);
- #endif
- if (dupl->toBeSigned == NULL || dupl->signature == NULL
- #ifdef WC_RSA_PSS
- /* allow sigParamsSz is zero and XMALLOC(0) to return NULL */
- || (dupl->sigParams == NULL && dupl->sigParamsSz != 0)
- #endif
- ) {
- CRL_Entry_free(dupl, heap);
- return NULL;
- }
- XMEMCPY(dupl->toBeSigned, ent->toBeSigned, dupl->tbsSz);
- XMEMCPY(dupl->signature, ent->signature, dupl->signatureSz);
- #ifdef WC_RSA_PSS
- if (dupl->sigParamsSz > 0) {
- XMEMCPY(dupl->sigParams, ent->sigParams, dupl->sigParamsSz);
- }
- #endif
- }
- else {
- dupl->toBeSigned = NULL;
- dupl->tbsSz = 0;
- dupl->signature = NULL;
- dupl->signatureSz = 0;
-#ifdef WC_RSA_PSS
- dupl->sigParams = NULL;
- dupl->sigParamsSz = 0;
-#endif
-#if !defined(NO_SKID) && !defined(NO_ASN)
- dupl->extAuthKeyIdSet = 0;
-#endif
- }
-
- return dupl;
-}
-
-
-/* returns the head of a deep copy of the list on success and null on fail */
-static CRL_Entry* DupCRL_list(CRL_Entry* crl, void* heap)
-{
- CRL_Entry* current;
- CRL_Entry* head = NULL;
- CRL_Entry** prev = &head;
-
- for (current = crl; current != NULL; current = current->next) {
- CRL_Entry* tmp = DupCRL_Entry(current, heap);
- if (tmp != NULL) {
- *prev = tmp;
- prev = &tmp->next;
- }
- else {
- WOLFSSL_MSG("Failed to allocate new CRL_Entry structure");
- /* free up any existing list */
- while (head != NULL) {
- CRL_Entry* next = head->next;
- CRL_Entry_free(head, heap);
- head = next;
- }
- return NULL;
- }
- }
-
- return head;
-}
-
-
-/* Duplicates everything except the parent cm pointed to.
- * Expects that Init has already been done to 'dupl'
- * return 0 on success */
-static int DupX509_CRL(WOLFSSL_X509_CRL *dupl, const WOLFSSL_X509_CRL* crl)
-{
- if (dupl == NULL || crl == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef HAVE_CRL_MONITOR
- if (crl->monitors[0].path) {
- size_t pathSz = XSTRLEN(crl->monitors[0].path) + 1;
- dupl->monitors[0].path = (char*)XMALLOC(pathSz, dupl->heap,
- DYNAMIC_TYPE_CRL_MONITOR);
- if (dupl->monitors[0].path != NULL) {
- XSTRNCPY(dupl->monitors[0].path, crl->monitors[0].path, pathSz);
- }
- else {
- return MEMORY_E;
- }
- }
-
- if (crl->monitors[1].path) {
- size_t pathSz = XSTRLEN(crl->monitors[1].path) + 1;
- dupl->monitors[1].path = (char*)XMALLOC(pathSz, dupl->heap,
- DYNAMIC_TYPE_CRL_MONITOR);
- if (dupl->monitors[1].path != NULL) {
- XSTRNCPY(dupl->monitors[1].path, crl->monitors[1].path, pathSz);
- }
- else {
- if (dupl->monitors[0].path != NULL) {
- XFREE(dupl->monitors[0].path, dupl->heap,
- DYNAMIC_TYPE_CRL_MONITOR);
- dupl->monitors[0].path = NULL;
- }
- return MEMORY_E;
- }
- }
-#endif
-
- dupl->crlList = DupCRL_list(crl->crlList, dupl->heap);
- if (dupl->crlList == NULL)
- return MEMORY_E;
-#ifdef HAVE_CRL_IO
- dupl->crlIOCb = crl->crlIOCb;
-#endif
-
- return 0;
-}
-
-WOLFSSL_X509_CRL* wolfSSL_X509_CRL_dup(const WOLFSSL_X509_CRL* crl)
-{
- WOLFSSL_X509_CRL* ret;
-
- WOLFSSL_ENTER("wolfSSL_X509_CRL_dup");
-
- ret = wolfSSL_X509_crl_new(crl->cm);
- if (ret != NULL && DupX509_CRL(ret, crl) != 0) {
- FreeCRL(ret, 1);
- ret = NULL;
- }
- return ret;
-}
-
-/* returns WOLFSSL_SUCCESS on success. Does not take ownership of newcrl */
-int wolfSSL_X509_STORE_add_crl(WOLFSSL_X509_STORE *store, WOLFSSL_X509_CRL *newcrl)
-{
- WOLFSSL_X509_CRL *crl;
- int ret = 0;
-
- WOLFSSL_ENTER("wolfSSL_X509_STORE_add_crl");
- if (store == NULL || newcrl == NULL || store->cm == NULL)
- return BAD_FUNC_ARG;
-
- if (store->cm->crl == NULL) {
- crl = wolfSSL_X509_crl_new(store->cm);
- if (crl == NULL) {
- WOLFSSL_MSG("wolfSSL_X509_crl_new failed");
- return WOLFSSL_FAILURE;
- }
- if (wc_LockRwLock_Rd(&newcrl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Rd failed");
- return BAD_MUTEX_E;
- }
- ret = DupX509_CRL(crl, newcrl);
- wc_UnLockRwLock(&newcrl->crlLock);
- if (ret != 0) {
- FreeCRL(crl, 1);
- return WOLFSSL_FAILURE;
- }
- store->crl = store->cm->crl = crl;
- if (wolfSSL_CertManagerEnableCRL(store->cm, WOLFSSL_CRL_CHECKALL)
- != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("wolfSSL_CertManagerEnableCRL error");
- return WOLFSSL_FAILURE;
- }
- return WOLFSSL_SUCCESS;
- }
-
- /* find tail of current list and add new list */
- crl = store->cm->crl;
- if (newcrl->crlList != NULL) {
- CRL_Entry **tail;
- CRL_Entry *toAdd;
-
- if (wc_LockRwLock_Wr(&crl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Wr failed");
- return BAD_MUTEX_E;
- }
-
- if (crl != newcrl && wc_LockRwLock_Rd(&newcrl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Rd failed");
- wc_UnLockRwLock(&crl->crlLock);
- return BAD_MUTEX_E;
- }
- toAdd = DupCRL_list(newcrl->crlList, crl->heap);
- if (crl != newcrl)
- wc_UnLockRwLock(&newcrl->crlLock);
-
- tail = &crl->crlList;
- while (*tail != NULL)
- tail = &(*tail)->next;
- *tail = toAdd;
- wc_UnLockRwLock(&crl->crlLock);
- }
-
- if (wolfSSL_CertManagerEnableCRL(store->cm, WOLFSSL_CRL_CHECKALL)
- != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("wolfSSL_CertManagerEnableCRL error");
- return WOLFSSL_FAILURE;
- }
-
- WOLFSSL_LEAVE("wolfSSL_X509_STORE_add_crl", WOLFSSL_SUCCESS);
-
- return WOLFSSL_SUCCESS;
-}
-#endif
-
-#ifdef HAVE_CRL_MONITOR
-
-
-/* Signal Monitor thread is setup, save status to setup flag, 0 on success */
-static int SignalSetup(WOLFSSL_CRL* crl, int status)
-{
- int ret, condRet;
-
- ret = wolfSSL_CondStart(&crl->cond);
- if (ret != 0)
- return ret;
-
- crl->setup = status;
-
- condRet = wolfSSL_CondSignal(&crl->cond);
- ret = wolfSSL_CondEnd(&crl->cond);
- if (ret != 0)
- return ret;
-
- return condRet;
-}
-
-
-/* read in new CRL entries and save new list */
-static int SwapLists(WOLFSSL_CRL* crl)
-{
- int ret;
- CRL_Entry* newList;
- WC_DECLARE_VAR(tmp, WOLFSSL_CRL, 1, 0);
-
- WC_ALLOC_VAR_EX(tmp, WOLFSSL_CRL, 1, NULL, DYNAMIC_TYPE_TMP_BUFFER,
- return MEMORY_E);
-
- if (InitCRL(tmp, crl->cm) < 0) {
- WOLFSSL_MSG("Init tmp CRL failed");
- WC_FREE_VAR_EX(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (crl->monitors[0].path) {
- ret = LoadCRL(tmp, crl->monitors[0].path, WOLFSSL_FILETYPE_PEM, 0);
- if (ret != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("PEM LoadCRL on dir change failed");
- FreeCRL(tmp, 0);
- WC_FREE_VAR_EX(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- if (crl->monitors[1].path) {
- ret = LoadCRL(tmp, crl->monitors[1].path, WOLFSSL_FILETYPE_ASN1, 0);
- if (ret != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("DER LoadCRL on dir change failed");
- FreeCRL(tmp, 0);
- WC_FREE_VAR_EX(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- if (wc_LockRwLock_Wr(&crl->crlLock) != 0) {
- WOLFSSL_MSG("wc_LockRwLock_Wr failed");
- FreeCRL(tmp, 0);
- WC_FREE_VAR_EX(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FATAL_ERROR;
- }
-
- newList = tmp->crlList;
-
- /* swap lists */
- tmp->crlList = crl->crlList;
- crl->crlList = newList;
-
- wc_UnLockRwLock(&crl->crlLock);
-
- FreeCRL(tmp, 0);
-
- WC_FREE_VAR_EX(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return 0;
-}
-
-
-#if (defined(__MACH__) || defined(__FreeBSD__))
-
-#include
-#include
-#include
-#include
-#include
-
-#ifdef __MACH__
- #define XEVENT_MODE O_EVTONLY
-#elif defined(__FreeBSD__)
- #define XEVENT_MODE O_RDONLY
-#endif
-
-
-/* we need a unique kqueue user filter fd for crl in case user is doing custom
- * events too */
-#ifndef CRL_CUSTOM_FD
- #define CRL_CUSTOM_FD 123456
-#endif
-
-
-/* shutdown monitor thread, 0 on success */
-static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
-{
- struct kevent change;
-
- /* trigger custom shutdown */
-#if defined(NOTE_TRIGGER)
- EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
-#elif defined(EV_TRIGGER)
- EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, EV_TRIGGER, 0, 0, NULL);
-#endif
- if (kevent(mfd, &change, 1, NULL, 0, NULL) < 0) {
- WOLFSSL_MSG("kevent trigger customer event failed");
- return WOLFSSL_FATAL_ERROR;
- }
-
- return 0;
-}
-
-
-/* OS X monitoring */
-static THREAD_RETURN WOLFSSL_THREAD DoMonitor(void* arg)
-{
- int fPEM, fDER;
- struct kevent change;
-
- WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
-
- WOLFSSL_ENTER("DoMonitor");
-
- crl->mfd = kqueue();
- if (crl->mfd == -1) {
- WOLFSSL_MSG("kqueue failed");
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
-
- /* listen for custom shutdown event */
- EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, EV_ADD, 0, 0, NULL);
- if (kevent(crl->mfd, &change, 1, NULL, 0, NULL) < 0) {
- WOLFSSL_MSG("kevent monitor customer event failed");
- SignalSetup(crl, MONITOR_SETUP_E);
- (void)close(crl->mfd);
- return NULL;
- }
-
- fPEM = -1;
- fDER = -1;
-
- if (crl->monitors[0].path) {
- fPEM = open(crl->monitors[0].path, XEVENT_MODE);
- if (fPEM == -1) {
- WOLFSSL_MSG("PEM event dir open failed");
- SignalSetup(crl, MONITOR_SETUP_E);
- (void)close(crl->mfd);
- return NULL;
- }
- }
-
- if (crl->monitors[1].path) {
- fDER = open(crl->monitors[1].path, XEVENT_MODE);
- if (fDER == -1) {
- WOLFSSL_MSG("DER event dir open failed");
- if (fPEM != -1)
- (void)close(fPEM);
- (void)close(crl->mfd);
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
- }
-
- if (fPEM != -1)
- EV_SET(&change, fPEM, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
- NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
-
- if (fDER != -1)
- EV_SET(&change, fDER, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
- NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
-
- /* signal to calling thread we're setup */
- if (SignalSetup(crl, 1) != 0) {
- if (fPEM != -1)
- (void)close(fPEM);
- if (fDER != -1)
- (void)close(fDER);
- (void)close(crl->mfd);
- return NULL;
- }
-
- for (;;) {
- struct kevent event;
- int numEvents = kevent(crl->mfd, &change, 1, &event, 1, NULL);
-
- WOLFSSL_MSG("Got kevent");
-
- if (numEvents == -1) {
- WOLFSSL_MSG("kevent problem, continue");
- continue;
- }
-
- if (event.filter == EVFILT_USER) {
- WOLFSSL_MSG("Got user shutdown event, breaking out");
- break;
- }
-
- if (SwapLists(crl) < 0) {
- WOLFSSL_MSG("SwapLists problem, continue");
- }
- }
-
- if (fPEM != -1)
- (void)close(fPEM);
- if (fDER != -1)
- (void)close(fDER);
-
- (void)close(crl->mfd);
-
- return NULL;
-}
-
-
-#elif defined(__linux__)
-
-#include
-#include
-#include
-#include
-
-
-#ifndef max
- static WC_INLINE int max(int a, int b)
- {
- return a > b ? a : b;
- }
-#endif /* max */
-
-
-/* shutdown monitor thread, 0 on success */
-static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
-{
- word64 w64 = 1;
-
- /* write to our custom event */
- if (write(mfd, &w64, sizeof(w64)) < 0) {
- WOLFSSL_MSG("StopMonitor write failed");
- return WOLFSSL_FATAL_ERROR;
- }
-
- return 0;
-}
-
-
-/* linux monitoring */
-static THREAD_RETURN WOLFSSL_THREAD DoMonitor(void* arg)
-{
- int notifyFd;
- int wd = -1;
- WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
- WC_DECLARE_VAR(buff, char, 8192, 0);
-
- WOLFSSL_ENTER("DoMonitor");
-
- crl->mfd = eventfd(0, 0); /* our custom shutdown event */
- if (crl->mfd < 0) {
- WOLFSSL_MSG("eventfd failed");
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
-
- notifyFd = inotify_init();
- if (notifyFd < 0) {
- WOLFSSL_MSG("inotify failed");
- (void)close(crl->mfd);
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
-
- if (crl->monitors[0].path) {
- wd = inotify_add_watch(notifyFd, crl->monitors[0].path, IN_CLOSE_WRITE |
- IN_DELETE);
- if (wd < 0) {
- WOLFSSL_MSG("PEM notify add watch failed");
- (void)close(crl->mfd);
- (void)close(notifyFd);
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
- }
-
- if (crl->monitors[1].path) {
- wd = inotify_add_watch(notifyFd, crl->monitors[1].path, IN_CLOSE_WRITE |
- IN_DELETE);
- if (wd < 0) {
- WOLFSSL_MSG("DER notify add watch failed");
- (void)close(crl->mfd);
- (void)close(notifyFd);
- SignalSetup(crl, MONITOR_SETUP_E);
- return NULL;
- }
- }
-
-
- /* signal to calling thread we're setup */
- if (SignalSetup(crl, 1) != 0) {
- if (wd > 0) {
- if (inotify_rm_watch(notifyFd, wd) < 0)
- WOLFSSL_MSG("inotify_rm_watch #1 failed in DoMonitor");
- }
- (void)close(crl->mfd);
- (void)close(notifyFd);
- return NULL;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- buff = (char*)XMALLOC(8192, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (buff == NULL)
- return NULL;
-#endif
-
- for (;;) {
- fd_set readfds;
- int result;
- int length;
-
- FD_ZERO(&readfds);
- FD_SET(notifyFd, &readfds);
- FD_SET(crl->mfd, &readfds);
-
- result = select(max(notifyFd, crl->mfd) + 1, &readfds, NULL, NULL,NULL);
-
- WOLFSSL_MSG("Got notify event");
-
- if (result < 0) {
- WOLFSSL_MSG("select problem, continue");
- continue;
- }
-
- if (FD_ISSET(crl->mfd, &readfds)) {
- word64 r64;
- int rlen;
-
- WOLFSSL_MSG("got custom shutdown event, breaking out");
-
- /* read out the bytes written to the event to clean up */
- rlen = (int) read(crl->mfd, &r64, sizeof(r64));
- if (rlen < 0) {
- WOLFSSL_MSG("read custom event failure");
- }
-
- break;
- }
-
- length = (int) read(notifyFd, buff, 8192);
- if (length < 0) {
- WOLFSSL_MSG("notify read problem, continue");
- continue;
- }
-
- if (SwapLists(crl) < 0) {
- WOLFSSL_MSG("SwapLists problem, continue");
- }
- }
-
- WC_FREE_VAR_EX(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if (wd > 0) {
- if (inotify_rm_watch(notifyFd, wd) < 0)
- WOLFSSL_MSG("inotify_rm_watch #2 failed in DoMonitor");
- }
- (void)close(crl->mfd);
- (void)close(notifyFd);
-
- return NULL;
-}
-
-#elif defined(_MSC_VER)
-
-/* shutdown monitor thread, 0 on success */
-static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
-{
- if (SetEvent(mfd) == 0) {
- WOLFSSL_MSG("SetEvent custom event trigger failed");
- return WOLFSSL_FATAL_ERROR;
- }
- return 0;
-}
-
-#ifdef DEBUG_WOLFSSL
-#define SHOW_WINDOWS_ERROR() do { \
- LPVOID lpMsgBuf = NULL; \
- DWORD dw = GetLastError(); \
- FormatMessageA( \
- FORMAT_MESSAGE_ALLOCATE_BUFFER | \
- FORMAT_MESSAGE_FROM_SYSTEM | \
- FORMAT_MESSAGE_IGNORE_INSERTS, \
- NULL, \
- dw, \
- MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), \
- (LPSTR) &lpMsgBuf, \
- 0, NULL ); \
- WOLFSSL_MSG_EX("DoMonitor failed with error %d: %s\n", \
- dw, lpMsgBuf); \
- LocalFree(lpMsgBuf); \
-} while(0)
-#else
-#define SHOW_WINDOWS_ERROR() WC_DO_NOTHING
-#endif
-
-#define DM_ERROR() do { \
- SHOW_WINDOWS_ERROR(); \
- status = MONITOR_SETUP_E; \
- goto cleanup; \
-} while(0)
-
-/* windows monitoring
- * Tested initially by hand by running
- * .\server.exe -A certs/ca-cert.pem -i -x
- * and connecting to with
- * .\client.exe -C -c certs/server-cert.pem -k certs/server-key.pem
- * This connection succeeds by default. By deleting all files from certs/crl
- * except for crl.revoked we disallow the client to connect. Deleting files
- * is done while the server is running to show that the monitor reacts to
- * changes in the crl directory. */
-static THREAD_RETURN WOLFSSL_THREAD DoMonitor(void* arg)
-{
- WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
- int status = 0;
- HANDLE handles[WOLFSSL_CRL_MONITORS_LEN + 1];
- DWORD handlesLen = 0;
- int i;
-
- WOLFSSL_ENTER("DoMonitor");
-
- handles[0] = crl->mfd = CreateEventA(NULL, FALSE, FALSE, NULL);
- if (crl->mfd == NULL) {
- WOLFSSL_MSG("CreateEventA failed");
- DM_ERROR();
- }
- handlesLen++;
-
- for (i = 0; i < WOLFSSL_CRL_MONITORS_LEN; i++) {
- if (crl->monitors[i].path) {
- handles[handlesLen] = FindFirstChangeNotificationA(
- crl->monitors[i].path, TRUE,
- /* Watch for any changes that may affect what CRL's we load.
- * This may trigger on the same file multiple times but this
- * way we are certain that we have the most up to date and
- * accurate set of CRL's. We don't expect this to trigger
- * often enough for it to be a bottleneck. */
- FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_ATTRIBUTES |
- FILE_NOTIFY_CHANGE_SIZE | FILE_NOTIFY_CHANGE_LAST_WRITE |
- FILE_NOTIFY_CHANGE_SECURITY);
- if (handles[handlesLen] == INVALID_HANDLE_VALUE) {
- WOLFSSL_MSG("FindFirstChangeNotificationA failed");
- DM_ERROR();
- }
- handlesLen++;
- }
- }
-
- if (handlesLen == 1) {
- WOLFSSL_MSG("Nothing to watch. Only custom event handle set.");
- DM_ERROR();
- }
-
- if (SignalSetup(crl, 1) != 0) {
- WOLFSSL_MSG("Call to SignalSetup failed");
- DM_ERROR();
- }
-
- for (;;) {
- DWORD waitRet = WaitForMultipleObjects(handlesLen, handles, FALSE,
- INFINITE);
- WOLFSSL_MSG("Got notify event");
-
- if (waitRet >= WAIT_OBJECT_0 && waitRet < WAIT_OBJECT_0 + handlesLen) {
- if (waitRet == WAIT_OBJECT_0) {
- WOLFSSL_MSG("got custom shutdown event, breaking out");
- break;
- }
- else if (SwapLists(crl) < 0) {
- WOLFSSL_MSG("SwapLists problem, continue");
- }
- }
- else {
- WOLFSSL_MSG("Unexpected WaitForMultipleObjects return. Continue.");
- }
-
- for (i = 1; i < (int)handlesLen; i++) {
- if (FindNextChangeNotification(handles[i]) == 0) {
- WOLFSSL_MSG("FindNextChangeNotification failed");
- DM_ERROR();
- }
- }
- }
-
-cleanup:
- if (status != 0)
- SignalSetup(crl, status);
- for (i = 0; i < (int)handlesLen; i++) {
- BOOL closeRet;
- if (i == 0) /* First handle is our custom event */
- closeRet = CloseHandle(handles[i]);
- else
- closeRet = FindCloseChangeNotification(handles[i]);
- if (closeRet == 0) {
- WOLFSSL_MSG("Failed to close handle");
- }
- }
- crl->mfd = INVALID_HANDLE_VALUE;
- return 0;
-}
-
-#endif /* MACH or linux or windows */
-
-
-/* Start Monitoring the CRL path(s) in a thread */
-static int StartMonitorCRL(WOLFSSL_CRL* crl)
-{
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("StartMonitorCRL");
-
- if (crl == NULL)
- return BAD_FUNC_ARG;
-
- if (crl->tid != INVALID_THREAD_VAL) {
- WOLFSSL_MSG("Monitor thread already running");
- return ret; /* that's ok, someone already started */
- }
-
- if (wolfSSL_NewThread(&crl->tid, DoMonitor, crl) != 0) {
- WOLFSSL_MSG("Thread creation error");
- return THREAD_CREATE_E;
- }
-
- /* wait for setup to complete */
- if (wolfSSL_CondStart(&crl->cond) != 0) {
- WOLFSSL_MSG("wolfSSL_CondStart failed");
- return BAD_MUTEX_E;
- }
- while (crl->setup == 0) {
- int condRet;
- condRet = wolfSSL_CondWait(&crl->cond);
- if (condRet != 0) {
- ret = BAD_COND_E;
- break;
- }
- }
- if (ret >= 0 && crl->setup < 0)
- ret = crl->setup; /* store setup error */
-
- if (ret < 0) {
- WOLFSSL_MSG("DoMonitor setup failure");
- crl->tid = INVALID_THREAD_VAL; /* thread already done */
- }
- if (wolfSSL_CondEnd(&crl->cond) != 0) {
- WOLFSSL_MSG("wolfSSL_CondEnd failed");
- return BAD_MUTEX_E;
- }
-
- return ret;
-}
-
-#endif /* HAVE_CRL_MONITOR */
-
-#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
-
-/* Load CRL path files of type, WOLFSSL_SUCCESS on ok */
-int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
-{
- int ret = WOLFSSL_SUCCESS;
- char* name = NULL;
- WC_DECLARE_VAR(readCtx, ReadDirCtx, 1, 0);
-
- WOLFSSL_ENTER("LoadCRL");
- if (crl == NULL)
- return BAD_FUNC_ARG;
-
- WC_ALLOC_VAR_EX(readCtx, ReadDirCtx, 1, crl->heap,
- DYNAMIC_TYPE_TMP_BUFFER, return MEMORY_E);
-
- /* try to load each regular file in path */
- ret = wc_ReadDirFirst(readCtx, path, &name);
- while (ret == 0 && name) {
- int skip = 0;
- if (type == WOLFSSL_FILETYPE_PEM) {
- if (XSTRSTR(name, ".pem") == NULL) {
- WOLFSSL_MSG("not .pem file, skipping");
- skip = 1;
- }
- }
- else {
- if (XSTRSTR(name, ".der") == NULL &&
- XSTRSTR(name, ".crl") == NULL)
- {
- WOLFSSL_MSG("not .der or .crl file, skipping");
- skip = 1;
- }
- }
-
-#ifndef CRL_REPORT_LOAD_ERRORS
- if (!skip && ProcessFile(NULL, name, type, CRL_TYPE, NULL, 0, crl,
- VERIFY) != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("CRL file load failed, continuing");
- }
-#else
- if (!skip) {
- ret = ProcessFile(NULL, name, type, CRL_TYPE, NULL, 0, crl, VERIFY);
- if (ret != WOLFSSL_SUCCESS) {
- WOLFSSL_MSG("CRL file load failed");
- wc_ReadDirClose(readCtx);
- WC_FREE_VAR_EX(readCtx, crl->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return ret;
- }
- }
-#endif
-
- ret = wc_ReadDirNext(readCtx, path, &name);
- }
- wc_ReadDirClose(readCtx);
-
- /* load failures not reported, for backwards compat */
- ret = WOLFSSL_SUCCESS;
-
- WC_FREE_VAR_EX(readCtx, crl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-
- if (monitor & WOLFSSL_CRL_MONITOR) {
-#ifdef HAVE_CRL_MONITOR
- word32 pathLen;
- char* pathBuf;
-
- WOLFSSL_MSG("monitor path requested");
-
- pathLen = (word32)XSTRLEN(path);
- pathBuf = (char*)XMALLOC(pathLen+1, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
- if (pathBuf) {
- XMEMCPY(pathBuf, path, pathLen+1);
-
- if (type == WOLFSSL_FILETYPE_PEM) {
- /* free old path before setting a new one */
- if (crl->monitors[0].path) {
- XFREE(crl->monitors[0].path, crl->heap,
- DYNAMIC_TYPE_CRL_MONITOR);
- }
- crl->monitors[0].path = pathBuf;
- crl->monitors[0].type = WOLFSSL_FILETYPE_PEM;
- } else {
- /* free old path before setting a new one */
- if (crl->monitors[1].path) {
- XFREE(crl->monitors[1].path, crl->heap,
- DYNAMIC_TYPE_CRL_MONITOR);
- }
- crl->monitors[1].path = pathBuf;
- crl->monitors[1].type = WOLFSSL_FILETYPE_ASN1;
- }
-
- if (monitor & WOLFSSL_CRL_START_MON) {
- WOLFSSL_MSG("start monitoring requested");
-
- ret = StartMonitorCRL(crl);
- }
- }
- else {
- ret = MEMORY_E;
- }
-#else
- WOLFSSL_MSG("CRL monitoring requested but not compiled in");
- ret = NOT_COMPILED_IN;
-#endif
- }
-
- return ret;
-}
-
-#else
-int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
-{
- (void)crl;
- (void)path;
- (void)type;
- (void)monitor;
-
- /* stub for scenario where file system is not supported */
- return NOT_COMPILED_IN;
-}
-#endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
-
-#endif /* HAVE_CRL */
-#endif /* !WOLFCRYPT_ONLY */
diff --git a/src/ssl/wolfssl/dtls.c b/src/ssl/wolfssl/dtls.c
deleted file mode 100644
index dff1ffab3..000000000
--- a/src/ssl/wolfssl/dtls.c
+++ /dev/null
@@ -1,1491 +0,0 @@
-/* dtls.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-/*
- * WOLFSSL_DTLS_NO_HVR_ON_RESUME
- * WOLFSSL_DTLS13_NO_HRR_ON_RESUME
- * If defined, a DTLS server will not do a cookie exchange on successful
- * client resumption: the resumption will be faster (one RTT less) and
- * will consume less bandwidth (one ClientHello and one
- * HelloVerifyRequest/HelloRetryRequest less). On the other hand, if a valid
- * SessionID/ticket/psk is collected, forged clientHello messages will
- * consume resources on the server. For DTLS 1.3, using this option also
- * allows for the server to process Early Data/0-RTT Data. Without this, the
- * Early Data would be dropped since the server doesn't enter stateful
- * processing until receiving a verified ClientHello with the cookie.
- *
- * To allow DTLS 1.3 resumption without the cookie exchange:
- * - Compile wolfSSL with WOLFSSL_DTLS13_NO_HRR_ON_RESUME defined
- * - Call wolfSSL_dtls13_no_hrr_on_resume(ssl, 1) on the WOLFSSL object to
- * disable the cookie exchange on resumption
- * - Continue like with a normal connection
- * WOLFSSL_DTLS_CH_FRAG
- * Allow a server to process a fragmented second/verified (one containing a
- * valid cookie response) ClientHello message. The first/unverified (one
- * without a cookie extension) ClientHello MUST be unfragmented so that the
- * DTLS server can process it statelessly. This is only implemented for
- * DTLS 1.3. The user MUST call wolfSSL_dtls13_allow_ch_frag() on the server
- * to explicitly enable this during runtime.
- */
-
-#ifndef WOLFCRYPT_ONLY
-
-#include
-#include
-#include
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
-
-#ifdef WOLFSSL_DTLS
-
-void DtlsResetState(WOLFSSL* ssl)
-{
- /* Reset the state so that we can statelessly await the
- * ClientHello that contains the cookie. Don't gate on IsAtLeastTLSv1_3
- * to handle the edge case when the peer wants a lower version. */
-
- /* Reset DTLS window */
-#ifdef WOLFSSL_DTLS13
- w64Zero(&ssl->dtls13Epochs[0].nextSeqNumber);
- w64Zero(&ssl->dtls13Epochs[0].nextPeerSeqNumber);
- XMEMSET(ssl->dtls13Epochs[0].window, 0,
- sizeof(ssl->dtls13Epochs[0].window));
- Dtls13FreeFsmResources(ssl);
-#endif
- ssl->keys.dtls_expected_peer_handshake_number = 0;
- ssl->keys.dtls_handshake_number = 0;
- ssl->keys.dtls_sequence_number_hi = 0;
- ssl->keys.dtls_sequence_number_lo = 0;
-
- /* Reset states */
- ssl->options.serverState = NULL_STATE;
- ssl->options.clientState = NULL_STATE;
- ssl->options.connectState = CONNECT_BEGIN;
- ssl->options.acceptState = ACCEPT_BEGIN;
- ssl->options.handShakeState = NULL_STATE;
- ssl->options.seenUnifiedHdr = 0;
- ssl->msgsReceived.got_client_hello = 0;
- ssl->keys.dtls_handshake_number = 0;
- ssl->keys.dtls_expected_peer_handshake_number = 0;
- XMEMSET(ssl->keys.peerSeq, 0, sizeof(ssl->keys.peerSeq));
- ssl->options.tls = 0;
- ssl->options.tls1_1 = 0;
- ssl->options.tls1_3 = 0;
-#if defined(WOLFSSL_DTLS) && defined(WOLFSSL_DTLS_CID)
- ssl->buffers.dtlsCtx.processingPendingRecord = 0;
- /* Clear the pending peer in case user set */
- XFREE(ssl->buffers.dtlsCtx.pendingPeer.sa, ssl->heap,
- DYNAMIC_TYPE_SOCKADDR);
- ssl->buffers.dtlsCtx.pendingPeer.sa = NULL;
- ssl->buffers.dtlsCtx.pendingPeer.sz = 0;
- ssl->buffers.dtlsCtx.pendingPeer.bufSz = 0;
-#endif
-}
-
-int DtlsIgnoreError(int err)
-{
- /* Whitelist of errors not to ignore */
- switch (err) {
- case WC_NO_ERR_TRACE(MEMORY_E):
- case WC_NO_ERR_TRACE(MEMORY_ERROR):
- case WC_NO_ERR_TRACE(ASYNC_INIT_E):
- case WC_NO_ERR_TRACE(ASYNC_OP_E):
- case WC_NO_ERR_TRACE(SOCKET_ERROR_E):
- case WC_NO_ERR_TRACE(WANT_READ):
- case WC_NO_ERR_TRACE(WANT_WRITE):
- case WC_NO_ERR_TRACE(COOKIE_ERROR):
- return 0;
- default:
- return 1;
- }
-}
-
-void DtlsSetSeqNumForReply(WOLFSSL* ssl)
-{
- /* We cover both DTLS 1.2 and 1.3 cases because we may be negotiating
- * protocols. */
- /* We should continue with the same sequence number as the
- * Client Hello. */
- ssl->keys.dtls_sequence_number_hi = ssl->keys.curSeq_hi;
- ssl->keys.dtls_sequence_number_lo = ssl->keys.curSeq_lo;
-#ifdef WOLFSSL_DTLS13
- if (ssl->dtls13EncryptEpoch != NULL) {
- ssl->dtls13EncryptEpoch->nextSeqNumber =
- w64From32(ssl->keys.curSeq_hi, ssl->keys.curSeq_lo);
- }
-#endif
- /* We should continue with the same handshake number as the
- * Client Hello. */
- ssl->keys.dtls_handshake_number =
- ssl->keys.dtls_peer_handshake_number;
-}
-
-#if !defined(NO_WOLFSSL_SERVER)
-
-#if defined(NO_SHA) && defined(NO_SHA256)
-#error "DTLS needs either SHA or SHA-256"
-#endif /* NO_SHA && NO_SHA256 */
-
-#if !defined(NO_SHA) && defined(NO_SHA256)
-#define DTLS_COOKIE_TYPE WC_SHA
-#define DTLS_COOKIE_SZ WC_SHA_DIGEST_SIZE
-#endif /* !NO_SHA && NO_SHA256 */
-
-#ifndef NO_SHA256
-#define DTLS_COOKIE_TYPE WC_SHA256
-#define DTLS_COOKIE_SZ WC_SHA256_DIGEST_SIZE
-#endif /* !NO_SHA256 */
-
-#if defined(WOLFSSL_DTLS13) && (defined(HAVE_SESSION_TICKET) || \
- !defined(NO_PSK))
-typedef struct PskInfo {
- byte cipherSuite0;
- byte cipherSuite;
- byte isValid:1;
-} PskInfo;
-#endif
-
-typedef struct WolfSSL_ConstVector {
- word32 size;
- const byte* elements;
-} WolfSSL_ConstVector;
-
-typedef struct WolfSSL_CH {
- ProtocolVersion* pv;
- const byte* random;
- WolfSSL_ConstVector sessionId;
- WolfSSL_ConstVector cookie;
- WolfSSL_ConstVector cipherSuite;
- WolfSSL_ConstVector compression;
- WolfSSL_ConstVector extension;
- WolfSSL_ConstVector cookieExt;
- const byte* raw;
- word32 length;
- /* Store the DTLS 1.2 cookie since we can just compute it once in dtls.c */
- byte dtls12cookie[DTLS_COOKIE_SZ];
- byte dtls12cookieSet:1;
-} WolfSSL_CH;
-
-static word32 ReadVector8(const byte* input, WolfSSL_ConstVector* v)
-{
- v->size = *input;
- v->elements = input + OPAQUE8_LEN;
- return v->size + OPAQUE8_LEN;
-}
-
-static word32 ReadVector16(const byte* input, WolfSSL_ConstVector* v)
-{
- word16 size16;
- ato16(input, &size16);
- v->size = (word32)size16;
- v->elements = input + OPAQUE16_LEN;
- return v->size + OPAQUE16_LEN;
-}
-
-static int CreateDtls12Cookie(const WOLFSSL* ssl, const WolfSSL_CH* ch,
- byte* cookie)
-{
- int ret;
- Hmac cookieHmac;
-
- if (ssl->buffers.dtlsCookieSecret.buffer == NULL ||
- ssl->buffers.dtlsCookieSecret.length == 0) {
- WOLFSSL_MSG("Missing DTLS 1.2 cookie secret");
- return COOKIE_ERROR;
- }
-
- ret = wc_HmacInit(&cookieHmac, ssl->heap, ssl->devId);
- if (ret == 0) {
- ret = wc_HmacSetKey(&cookieHmac, DTLS_COOKIE_TYPE,
- ssl->buffers.dtlsCookieSecret.buffer,
- ssl->buffers.dtlsCookieSecret.length);
- if (ret == 0) {
- /* peerLock not necessary. Still in handshake phase. */
- ret = wc_HmacUpdate(&cookieHmac,
- (const byte*)ssl->buffers.dtlsCtx.peer.sa,
- ssl->buffers.dtlsCtx.peer.sz);
- }
- if (ret == 0)
- ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->pv, OPAQUE16_LEN);
- if (ret == 0)
- ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->random, RAN_LEN);
- if (ret == 0) {
- ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->sessionId.elements,
- ch->sessionId.size);
- }
- if (ret == 0) {
- ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->cipherSuite.elements,
- ch->cipherSuite.size);
- }
- if (ret == 0) {
- ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->compression.elements,
- ch->compression.size);
- }
- if (ret == 0)
- ret = wc_HmacFinal(&cookieHmac, cookie);
- wc_HmacFree(&cookieHmac);
- }
-
- return ret;
-}
-
-static int CheckDtlsCookie(const WOLFSSL* ssl, WolfSSL_CH* ch,
- byte isTls13, byte* cookieGood)
-{
- int ret = 0;
-
- (void)isTls13;
-
- *cookieGood = 0;
-#ifdef WOLFSSL_DTLS13
- if (isTls13) {
- word16 len;
- if (ch->cookieExt.size < OPAQUE16_LEN + 1)
- return BUFFER_E;
- ato16(ch->cookieExt.elements, &len);
- if (ch->cookieExt.size - OPAQUE16_LEN != len)
- return BUFFER_E;
- ret = TlsCheckCookie(ssl, ch->cookieExt.elements + OPAQUE16_LEN,
- (word16)(ch->cookieExt.size - OPAQUE16_LEN));
- if (ret < 0 && ret != WC_NO_ERR_TRACE(HRR_COOKIE_ERROR))
- return ret;
- *cookieGood = ret > 0;
- ret = 0;
- }
- else
-#endif
- {
- if (ch->cookie.size != DTLS_COOKIE_SZ)
- return 0;
- if (!ch->dtls12cookieSet) {
- ret = CreateDtls12Cookie(ssl, ch, ch->dtls12cookie);
- if (ret != 0)
- return ret;
- ch->dtls12cookieSet = 1;
- }
- *cookieGood = ConstantCompare(ch->cookie.elements, ch->dtls12cookie,
- DTLS_COOKIE_SZ) == 0;
- }
- return ret;
-}
-
-static int ParseClientHello(const byte* input, word32 helloSz, WolfSSL_CH* ch,
- byte isFirstCHFrag)
-{
- word32 idx = 0;
-
- (void)isFirstCHFrag;
-
- /* protocol version, random and session id length check */
- if (OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
- return BUFFER_ERROR;
-
- ch->raw = input;
- ch->pv = (ProtocolVersion*)(input + idx);
- idx += OPAQUE16_LEN;
- ch->random = (byte*)(input + idx);
- idx += RAN_LEN;
- idx += ReadVector8(input + idx, &ch->sessionId);
- if (idx > helloSz - OPAQUE8_LEN)
- return BUFFER_ERROR;
- idx += ReadVector8(input + idx, &ch->cookie);
- if (idx > helloSz - OPAQUE16_LEN)
- return BUFFER_ERROR;
- idx += ReadVector16(input + idx, &ch->cipherSuite);
- if (idx > helloSz - OPAQUE8_LEN)
- return BUFFER_ERROR;
- idx += ReadVector8(input + idx, &ch->compression);
- if (idx < helloSz - OPAQUE16_LEN) {
- /* Extensions are optional */
-#ifdef WOLFSSL_DTLS_CH_FRAG
- word32 extStart = idx + OPAQUE16_LEN;
-#endif
- idx += ReadVector16(input + idx, &ch->extension);
- if (idx > helloSz) {
-#ifdef WOLFSSL_DTLS_CH_FRAG
- idx = helloSz;
- /* Allow incomplete extensions if we are parsing a fragment */
- if (isFirstCHFrag && extStart < helloSz)
- ch->extension.size = helloSz - extStart;
- else
-#endif
- return BUFFER_ERROR;
- }
- }
- if (idx != helloSz)
- return BUFFER_ERROR;
- ch->length = idx;
- return 0;
-}
-
-#if (defined(WOLFSSL_DTLS_NO_HVR_ON_RESUME) && defined(HAVE_SESSION_TICKET)) \
- || defined(WOLFSSL_DTLS13)
-static int FindExtByType(WolfSSL_ConstVector* ret, word16 extType,
- WolfSSL_ConstVector exts, int* tlsxFound)
-{
- word32 len, idx = 0;
- word16 type;
- WolfSSL_ConstVector ext;
-
- XMEMSET(ret, 0, sizeof(*ret));
- len = exts.size;
- *tlsxFound = FALSE;
- /* type + len */
- while (len >= OPAQUE16_LEN + OPAQUE16_LEN) {
- ato16(exts.elements + idx, &type);
- idx += OPAQUE16_LEN;
- idx += ReadVector16(exts.elements + idx, &ext);
- if (idx > exts.size ||
- ext.elements + ext.size > exts.elements + exts.size)
- return BUFFER_ERROR;
- if (type == extType) {
- XMEMCPY(ret, &ext, sizeof(ext));
- *tlsxFound = TRUE;
- return 0;
- }
- len = exts.size - idx;
- }
- return 0;
-}
-#endif
-
-#if defined(WOLFSSL_DTLS_NO_HVR_ON_RESUME)
-#ifdef HAVE_SESSION_TICKET
-static int TlsTicketIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector exts,
- int* resume)
-{
- WolfSSL_ConstVector tlsxSessionTicket;
- byte tempTicket[SESSION_TICKET_LEN];
- InternalTicket* it = NULL;
- int ret = 0;
- int tlsxFound;
-
- *resume = FALSE;
-
- ret = FindExtByType(&tlsxSessionTicket, TLSX_SESSION_TICKET, exts,
- &tlsxFound);
- if (ret != 0)
- return ret;
- if (tlsxSessionTicket.size == 0)
- return 0;
- if (tlsxSessionTicket.size > SESSION_TICKET_LEN)
- return 0;
- XMEMCPY(tempTicket, tlsxSessionTicket.elements, tlsxSessionTicket.size);
- ret = DoDecryptTicket(ssl, tempTicket, (word32)tlsxSessionTicket.size, &it);
- if (ret == WOLFSSL_TICKET_RET_OK || ret == WOLFSSL_TICKET_RET_CREATE) {
- /* This logic is only for TLS <= 1.2 tickets. Don't accept TLS 1.3. */
- if (!IsAtLeastTLSv1_3(it->pv))
- *resume = TRUE;
- }
- if (it != NULL)
- ForceZero(it, sizeof(InternalTicket));
- return 0;
-}
-#endif /* HAVE_SESSION_TICKET */
-
-static int TlsSessionIdIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector sessionID,
- int* resume)
-{
- const WOLFSSL_SESSION* sess;
- word32 sessRow;
- int ret;
-#ifdef HAVE_EXT_CACHE
- int copy;
-#endif
- *resume = FALSE;
-
- if (ssl->options.sessionCacheOff)
- return 0;
- if (sessionID.size != ID_LEN)
- return 0;
-
-#ifdef HAVE_EXT_CACHE
- if (ssl->ctx->get_sess_cb != NULL) {
- WOLFSSL_SESSION* extSess =
- ssl->ctx->get_sess_cb((WOLFSSL*)ssl, sessionID.elements, ID_LEN,
- ©);
- if (extSess != NULL) {
-#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
- defined(HAVE_SESSION_TICKET))
- /* This logic is only for TLS <= 1.2 tickets. Don't accept
- * TLS 1.3. */
- if (!IsAtLeastTLSv1_3(extSess->version))
-#endif
- *resume = TRUE;
- if (!copy)
- wolfSSL_FreeSession(ssl->ctx, extSess);
- if (*resume)
- return 0;
- }
- }
- if (ssl->ctx->internalCacheLookupOff)
- return 0;
-#endif
-
-
- ret = TlsSessionCacheGetAndRdLock(sessionID.elements, &sess, &sessRow,
- ssl->options.side);
- if (ret == 0 && sess != NULL) {
-#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
- defined(HAVE_SESSION_TICKET))
- /* This logic is only for TLS <= 1.2 tickets. Don't accept
- * TLS 1.3. */
- if (!IsAtLeastTLSv1_3(sess->version))
-#endif
- *resume = TRUE;
- TlsSessionCacheUnlockRow(sessRow);
- }
-
- return 0;
-}
-
-static int TlsResumptionIsValid(const WOLFSSL* ssl, WolfSSL_CH* ch,
- int* resume)
-{
- int ret;
-
-#ifdef HAVE_SESSION_TICKET
- ret = TlsTicketIsValid(ssl, ch->extension, resume);
- if (ret != 0)
- return ret;
- if (*resume)
- return 0;
-#endif /* HAVE_SESSION_TICKET */
- ret = TlsSessionIdIsValid(ssl, ch->sessionId, resume);
- return ret;
-}
-#endif /* WOLFSSL_DTLS13 || WOLFSSL_DTLS_NO_HVR_ON_RESUME */
-
-#ifdef WOLFSSL_DTLS13
-static int TlsCheckSupportedVersion(const WOLFSSL* ssl,
- WolfSSL_CH* ch, byte *isTls13)
-{
- WolfSSL_ConstVector tlsxSupportedVersions;
- int ret;
- ProtocolVersion pv = ssl->version;
- int tlsxFound;
-
- ret = FindExtByType(&tlsxSupportedVersions, TLSX_SUPPORTED_VERSIONS,
- ch->extension, &tlsxFound);
- if (ret != 0)
- return ret;
- if (!tlsxFound || tlsxSupportedVersions.elements == NULL) {
- *isTls13 = 0;
- return 0;
- }
- ret = TLSX_SupportedVersions_Parse(ssl, tlsxSupportedVersions.elements,
- (word16)tlsxSupportedVersions.size, client_hello, &pv, NULL, NULL);
- if (ret != 0)
- return ret;
- if (IsAtLeastTLSv1_3(pv))
- *isTls13 = 1;
- else
- *isTls13 = 0;
-
- return 0;
-}
-#endif
-
-#if defined(WOLFSSL_DTLS13) && \
- (!defined(NO_PSK) || defined(HAVE_SESSION_TICKET))
-/* Very simplified version of CheckPreSharedKeys to find the current suite */
-static void FindPskSuiteFromExt(const WOLFSSL* ssl, TLSX* extensions,
- PskInfo* pskInfo, Suites* suites)
-{
- TLSX* pskExt = TLSX_Find(extensions, TLSX_PRE_SHARED_KEY);
- PreSharedKey* current;
- int i;
- int ret;
-
- if (pskExt == NULL)
- return;
-
- for (i = 0; i < suites->suiteSz; i += 2) {
- for (current = (PreSharedKey*)pskExt->data; current != NULL;
- current = current->next) {
-#ifdef HAVE_SESSION_TICKET
- {
- /* Decode the identity. */
- switch (current->decryptRet) {
- case PSK_DECRYPT_NONE:
- ret = DoClientTicket_ex(ssl, current, 0);
- break;
- case PSK_DECRYPT_OK:
- ret = WOLFSSL_TICKET_RET_OK;
- break;
- case PSK_DECRYPT_CREATE:
- ret = WOLFSSL_TICKET_RET_CREATE;
- break;
- case PSK_DECRYPT_FAIL:
- default:
- ret = WOLFSSL_TICKET_RET_REJECT;
- break;
- }
- if (ret == WOLFSSL_TICKET_RET_OK) {
- if (DoClientTicketCheck(ssl, current, ssl->timeout,
- suites->suites + i) != 0) {
- continue;
- }
-
- pskInfo->cipherSuite0 = current->it->suite[0];
- pskInfo->cipherSuite = current->it->suite[1];
- pskInfo->isValid = 1;
- goto cleanup;
- }
- }
-#endif
-#ifndef NO_PSK
- {
- int found = 0;
- byte psk_key[MAX_PSK_KEY_LEN];
- word32 psk_keySz;
- byte foundSuite[SUITE_LEN];
- ret = FindPskSuite(ssl, current, psk_key, &psk_keySz,
- suites->suites + i, &found, foundSuite);
- /* Clear the key just in case */
- ForceZero(psk_key, sizeof(psk_key));
- if (ret == 0 && found) {
- pskInfo->cipherSuite0 = foundSuite[0];
- pskInfo->cipherSuite = foundSuite[1];
- pskInfo->isValid = 1;
- goto cleanup;
- }
- }
-#endif
- }
- }
-
- /* Empty return necessary so we can have both the label and macro guard */
-cleanup:
-#ifdef HAVE_SESSION_TICKET
- CleanupClientTickets((PreSharedKey*)pskExt->data);
-#endif
- return;
-}
-#endif
-
-#ifdef WOLFSSL_DTLS13
-
-#ifndef WOLFSSL_SEND_HRR_COOKIE
-#error "WOLFSSL_SEND_HRR_COOKIE has to be defined to use DTLS 1.3 server"
-#endif
-
-#ifdef WOLFSSL_PSK_ONE_ID
-#error WOLFSSL_PSK_ONE_ID is not compatible with stateless DTLS 1.3 server. \
- wolfSSL needs to be able to make multiple calls for the same PSK.
-#endif
-
-static int SendStatelessReplyDtls13(const WOLFSSL* ssl, WolfSSL_CH* ch)
-{
- int ret = -1;
- TLSX* parsedExts = NULL;
- WolfSSL_ConstVector tlsx;
- int tlsxFound;
- Suites suites;
- byte haveSA = 0;
- byte haveKS = 0;
- byte haveSG = 0;
-#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
- byte usePSK = 0;
- byte doKE = 0;
-#endif
- CipherSuite cs;
- CipherSpecs specs;
- byte cookieHash[WC_MAX_DIGEST_SIZE];
- int cookieHashSz;
-#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
- PskInfo pskInfo;
- XMEMSET(&pskInfo, 0, sizeof(pskInfo));
-#endif
-
-#ifndef HAVE_SUPPORTED_CURVES
- (void)doKE;
-#endif /* !HAVE_SUPPORTED_CURVES */
-
- XMEMSET(&cs, 0, sizeof(cs));
-
- /* We need to echo the session ID sent by the client */
- if (ch->sessionId.size > ID_LEN) {
- /* Too large. We can't echo this. */
- ERROR_OUT(INVALID_PARAMETER, dtls13_cleanup);
- }
-
- /* Populate the suites struct to find a common ciphersuite */
- XMEMSET(&suites, 0, sizeof(suites));
- suites.suiteSz = (word16)ch->cipherSuite.size;
- if ((suites.suiteSz % 2) != 0)
- ERROR_OUT(INVALID_PARAMETER, dtls13_cleanup);
- if (suites.suiteSz > WOLFSSL_MAX_SUITE_SZ)
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- XMEMCPY(suites.suites, ch->cipherSuite.elements, suites.suiteSz);
-
- /* Populate extensions */
-
- /* Supported versions always need to be present. Has to appear after
- * key share as that is the order we reconstruct it in
- * RestartHandshakeHashWithCookie. */
- ret = TLSX_Push(&parsedExts,
- TLSX_SUPPORTED_VERSIONS, ssl, ssl->heap);
- if (ret != 0)
- goto dtls13_cleanup;
- /* Set that this is a response extension */
- parsedExts->resp = 1;
-
-#if defined(HAVE_SUPPORTED_CURVES)
- ret = TLSX_SupportedCurve_Copy(ssl->extensions, &parsedExts, ssl->heap);
- if (ret != 0)
- goto dtls13_cleanup;
-#endif
-
-#if !defined(NO_CERTS)
- /* Signature algs */
- ret = FindExtByType(&tlsx, TLSX_SIGNATURE_ALGORITHMS,
- ch->extension, &tlsxFound);
- if (ret != 0)
- goto dtls13_cleanup;
- if (tlsxFound) {
- WolfSSL_ConstVector sigAlgs;
- if (tlsx.size < OPAQUE16_LEN)
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- ReadVector16(tlsx.elements, &sigAlgs);
- if (sigAlgs.size != tlsx.size - OPAQUE16_LEN)
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- if ((sigAlgs.size % 2) != 0)
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- if (sigAlgs.size > WOLFSSL_MAX_SIGALGO)
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- suites.hashSigAlgoSz = (word16)sigAlgs.size;
- XMEMCPY(suites.hashSigAlgo, sigAlgs.elements, sigAlgs.size);
- haveSA = 1;
- }
-#endif /* !defined(NO_CERTS) */
-
-#ifdef HAVE_SUPPORTED_CURVES
- /* Supported groups */
- ret = FindExtByType(&tlsx, TLSX_SUPPORTED_GROUPS,
- ch->extension, &tlsxFound);
- if (ret != 0)
- goto dtls13_cleanup;
- if (tlsxFound) {
- ret = TLSX_SupportedCurve_Parse(ssl, tlsx.elements,
- (word16)tlsx.size, 1, &parsedExts);
- if (ret != 0)
- goto dtls13_cleanup;
- haveSG = 1;
- }
-
- /* Key share */
- ret = FindExtByType(&tlsx, TLSX_KEY_SHARE,
- ch->extension, &tlsxFound);
- if (ret != 0)
- goto dtls13_cleanup;
- if (tlsxFound) {
- ret = TLSX_KeyShare_Parse_ClientHello(ssl, tlsx.elements,
- (word16)tlsx.size, &parsedExts);
- if (ret != 0)
- goto dtls13_cleanup;
- haveKS = 1;
- }
-#endif /* HAVE_SUPPORTED_CURVES */
-
-#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
- /* Pre-shared key */
- ret = FindExtByType(&tlsx, TLSX_PRE_SHARED_KEY, ch->extension, &tlsxFound);
- if (ret != 0)
- goto dtls13_cleanup;
- if (tlsxFound) {
- /* Let's just assume that the binders are correct here. We will
- * actually verify this in the stateful part of the processing
- * and if they don't match we will error out there anyway. */
- byte modes;
-
- /* TLSX_PreSharedKey_Parse_ClientHello uses word16 length */
- if (tlsx.size > WOLFSSL_MAX_16BIT) {
- ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
- }
-
- /* Ask the user for the ciphersuite matching this identity */
- if (TLSX_PreSharedKey_Parse_ClientHello(&parsedExts,
- tlsx.elements, (word16)tlsx.size, ssl->heap) == 0) {
- /* suites only needs to be refined when searching for a PSK.
- * MatchSuite_ex handles refining internally. */
- refineSuites(WOLFSSL_SUITES(ssl), &suites, &suites,
- ssl->options.useClientOrder);
- FindPskSuiteFromExt(ssl, parsedExts, &pskInfo, &suites);
- }
- /* Revert to full handshake if PSK parsing failed */
-
- if (pskInfo.isValid) {
- ret = FindExtByType(&tlsx, TLSX_PSK_KEY_EXCHANGE_MODES,
- ch->extension, &tlsxFound);
- if (ret != 0)
- goto dtls13_cleanup;
- if (!tlsxFound)
- ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
- ret = TLSX_PskKeyModes_Parse_Modes(tlsx.elements, (word16)tlsx.size,
- client_hello, &modes);
- if (ret != 0)
- goto dtls13_cleanup;
- if ((modes & (1 << PSK_DHE_KE)) &&
- !ssl->options.noPskDheKe) {
- if (!haveKS)
- ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
- doKE = 1;
- }
- else if ((modes & (1 << PSK_KE)) == 0 ||
- ssl->options.onlyPskDheKe) {
- ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
- }
- usePSK = 1;
- }
- }
-#endif
-
-#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
- if (usePSK && pskInfo.isValid) {
- cs.cipherSuite0 = pskInfo.cipherSuite0;
- cs.cipherSuite = pskInfo.cipherSuite;
-
- /* https://datatracker.ietf.org/doc/html/rfc8446#section-9.2 */
- if (haveSG ^ haveKS) {
- WOLFSSL_MSG("Client needs to send both or none of KeyShare and "
- "SupportedGroups");
- ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
- }
-
-#ifdef HAVE_SUPPORTED_CURVES
- if (doKE) {
- byte searched = 0;
- ret = TLSX_KeyShare_Choose(ssl, parsedExts, cs.cipherSuite0,
- cs.cipherSuite, &cs.clientKSE, &searched);
- if (ret != 0)
- goto dtls13_cleanup;
- if (cs.clientKSE == NULL && searched)
- cs.doHelloRetry = 1;
- }
-#endif /* HAVE_SUPPORTED_CURVES */
- }
- else
-#endif /* defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) */
- {
- /* https://datatracker.ietf.org/doc/html/rfc8446#section-9.2 */
- if (!haveKS || !haveSA || !haveSG) {
- WOLFSSL_MSG("Client didn't send KeyShare or SigAlgs or "
- "SupportedGroups.");
- ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
- }
- /* TLSX_KeyShare_Choose is done deep inside MatchSuite_ex */
- ret = MatchSuite_ex(ssl, &suites, &cs, parsedExts);
- if (ret < 0) {
- WOLFSSL_MSG("Unsupported cipher suite, ClientHello DTLS 1.3");
- ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
- }
- }
-
-#ifdef WOLFSSL_DTLS13_NO_HRR_ON_RESUME
- if (ssl->options.dtls13NoHrrOnResume && usePSK && pskInfo.isValid &&
- !cs.doHelloRetry) {
- /* Skip HRR on resumption */
- ((WOLFSSL*)ssl)->options.dtlsStateful = 1;
- goto dtls13_cleanup;
- }
-#endif
-
-#ifdef HAVE_SUPPORTED_CURVES
- if (cs.doHelloRetry) {
- ret = TLSX_KeyShare_SetSupported(ssl, &parsedExts);
- if (ret != 0)
- goto dtls13_cleanup;
- }
- else {
- /* Need to remove the keyshare ext if we found a common group
- * and are not doing curve negotiation. */
- TLSX_Remove(&parsedExts, TLSX_KEY_SHARE, ssl->heap);
- }
-#endif /* HAVE_SUPPORTED_CURVES */
-
- /* This is required to correctly generate the hash */
- ret = GetCipherSpec(WOLFSSL_SERVER_END, cs.cipherSuite0,
- cs.cipherSuite, &specs, NULL);
- if (ret != 0)
- goto dtls13_cleanup;
-
- /* Calculate the cookie hash */
- ret = Dtls13HashClientHello(ssl, cookieHash, &cookieHashSz, ch->raw,
- ch->length, &specs);
- if (ret != 0)
- goto dtls13_cleanup;
-
- /* Push the cookie to extensions */
- ret = CreateCookieExt(ssl, cookieHash, (word16)cookieHashSz,
- &parsedExts, cs.cipherSuite0, cs.cipherSuite);
- if (ret != 0)
- goto dtls13_cleanup;
-
- {
- WOLFSSL* nonConstSSL = (WOLFSSL*)ssl;
- TLSX* sslExts = nonConstSSL->extensions;
-
- nonConstSSL->options.tls = 1;
- nonConstSSL->options.tls1_1 = 1;
- nonConstSSL->options.tls1_3 = 1;
-
- XMEMCPY(nonConstSSL->session->sessionID, ch->sessionId.elements,
- ch->sessionId.size);
- nonConstSSL->session->sessionIDSz = (byte)ch->sessionId.size;
- nonConstSSL->options.cipherSuite0 = cs.cipherSuite0;
- nonConstSSL->options.cipherSuite = cs.cipherSuite;
- nonConstSSL->extensions = parsedExts;
-
- ret = SendTls13ServerHello(nonConstSSL, hello_retry_request);
-
- /* Can be modified inside SendTls13ServerHello */
- parsedExts = nonConstSSL->extensions;
-
- nonConstSSL->session->sessionIDSz = 0;
- nonConstSSL->options.cipherSuite0 = 0;
- nonConstSSL->options.cipherSuite = 0;
- nonConstSSL->extensions = sslExts;
-
- nonConstSSL->options.tls = 0;
- nonConstSSL->options.tls1_1 = 0;
- nonConstSSL->options.tls1_3 = 0;
- }
-dtls13_cleanup:
- TLSX_FreeAll(parsedExts, ssl->heap);
- return ret;
-}
-#endif
-
-static int SendStatelessReply(const WOLFSSL* ssl, WolfSSL_CH* ch, byte isTls13)
-{
- int ret;
- (void)isTls13;
-#ifdef WOLFSSL_DTLS13
- if (isTls13) {
- ret = SendStatelessReplyDtls13(ssl, ch);
- }
- else
-#endif
- {
-#if !defined(WOLFSSL_NO_TLS12)
- if (!ch->dtls12cookieSet) {
- ret = CreateDtls12Cookie(ssl, ch, ch->dtls12cookie);
- if (ret != 0)
- return ret;
- ch->dtls12cookieSet = 1;
- }
- ret = SendHelloVerifyRequest((WOLFSSL*)ssl, ch->dtls12cookie,
- DTLS_COOKIE_SZ);
-#else
- WOLFSSL_MSG("DTLS1.2 disabled with WOLFSSL_NO_TLS12");
- WOLFSSL_ERROR_VERBOSE(NOT_COMPILED_IN);
- ret = NOT_COMPILED_IN;
-#endif
- }
- return ret;
-}
-
-static int ClientHelloSanityCheck(WolfSSL_CH* ch, byte isTls13)
-{
- /* Do basic checks on the basic fields */
-
- /* Check the protocol version */
- if (ch->pv->major != DTLS_MAJOR)
- return VERSION_ERROR;
- if (ch->pv->minor != DTLSv1_2_MINOR && ch->pv->minor != DTLS_MINOR)
- return VERSION_ERROR;
- if (isTls13) {
- if (ch->cookie.size != 0)
- return INVALID_PARAMETER;
- if (ch->compression.size != COMP_LEN)
- return INVALID_PARAMETER;
- if (ch->compression.elements[0] != NO_COMPRESSION)
- return INVALID_PARAMETER;
- }
-
- return 0;
-}
-
-int DoClientHelloStateless(WOLFSSL* ssl, const byte* input, word32 helloSz,
- byte isFirstCHFrag, byte* tls13)
-{
- int ret;
- WolfSSL_CH ch;
- byte isTls13 = 0;
-
- WOLFSSL_ENTER("DoClientHelloStateless");
- if (isFirstCHFrag) {
-#ifdef WOLFSSL_DTLS_CH_FRAG
- WOLFSSL_MSG("\tProcessing fragmented ClientHello");
-#else
- WOLFSSL_MSG("\tProcessing fragmented ClientHello but "
- "WOLFSSL_DTLS_CH_FRAG is not defined. This should not happen.");
- return BAD_STATE_E;
-#endif
- }
- if (tls13 != NULL)
- *tls13 = 0;
-
- XMEMSET(&ch, 0, sizeof(ch));
-
- ssl->options.dtlsStateful = 0;
- ret = ParseClientHello(input, helloSz, &ch, isFirstCHFrag);
- if (ret != 0)
- return ret;
-
-#ifdef WOLFSSL_DTLS13
- if (IsAtLeastTLSv1_3(ssl->version)) {
- ret = TlsCheckSupportedVersion(ssl, &ch, &isTls13);
- if (ret != 0)
- return ret;
- if (tls13 != NULL)
- *tls13 = isTls13;
- if (isTls13) {
- int tlsxFound;
- ret = FindExtByType(&ch.cookieExt, TLSX_COOKIE, ch.extension,
- &tlsxFound);
- if (ret != 0) {
- if (isFirstCHFrag) {
- WOLFSSL_MSG("\t\tCookie probably missing from first "
- "fragment. Dropping.");
- }
- return ret;
- }
- }
- }
-#endif
-
- ret = ClientHelloSanityCheck(&ch, isTls13);
- if (ret != 0)
- return ret;
-
-#ifdef WOLFSSL_DTLS_NO_HVR_ON_RESUME
- if (!isTls13 && !isFirstCHFrag) {
- int resume = FALSE;
- ret = TlsResumptionIsValid(ssl, &ch, &resume);
- if (ret != 0)
- return ret;
- if (resume) {
- ssl->options.dtlsStateful = 1;
- return 0;
- }
- }
-#endif
-
- if (ch.cookie.size == 0 && ch.cookieExt.size == 0) {
-#ifdef WOLFSSL_DTLS_CH_FRAG
- /* Don't send anything here when processing fragment */
- if (isFirstCHFrag)
- ret = COOKIE_ERROR;
- else
-#endif
- ret = SendStatelessReply(ssl, &ch, isTls13);
- }
- else {
- byte cookieGood;
- ret = CheckDtlsCookie(ssl, &ch, isTls13, &cookieGood);
- if (ret != 0)
- return ret;
- if (!cookieGood) {
-#ifdef WOLFSSL_DTLS13
- /* Invalid cookie for DTLS 1.3 results in an alert. Alert to be sent
- * in DoTls13ClientHello. */
- if (isTls13)
- ret = INVALID_PARAMETER;
- else
-#endif
-#ifdef WOLFSSL_DTLS_CH_FRAG
- /* Don't send anything here when processing fragment */
- if (isFirstCHFrag)
- ret = COOKIE_ERROR;
- else
-#endif
- ret = SendStatelessReply(ssl, &ch, isTls13);
- }
- else {
- ssl->options.dtlsStateful = 1;
- /* Update the window now that we enter the stateful parsing */
-#ifdef WOLFSSL_DTLS13
- if (isTls13) {
- /* Set record numbers before current record number as read */
- Dtls13Epoch* e;
- ret = Dtls13UpdateWindowRecordRecvd(ssl);
- e = Dtls13GetEpoch(ssl, ssl->keys.curEpoch64);
- if (e != NULL)
- XMEMSET(e->window, 0xFF, sizeof(e->window));
- }
- else
-#endif
- DtlsUpdateWindow(ssl);
- /* Set record numbers before current record number as read */
- XMEMSET(ssl->keys.peerSeq->window, 0xFF,
- sizeof(ssl->keys.peerSeq->window));
- }
- }
-
- return ret;
-}
-#endif /* !defined(NO_WOLFSSL_SERVER) */
-
-#if defined(WOLFSSL_DTLS_CID)
-
-static ConnectionID* DtlsCidNew(const byte* cid, byte size, void* heap)
-{
- ConnectionID* ret;
-
- ret = (ConnectionID*)XMALLOC(sizeof(ConnectionID) + size, heap,
- DYNAMIC_TYPE_TLSX);
- if (ret == NULL)
- return NULL;
-
- ret->length = size;
- XMEMCPY(ret->id, cid, size);
-
- return ret;
-}
-
-static WC_INLINE CIDInfo* DtlsCidGetInfo(WOLFSSL* ssl)
-{
- return ssl->dtlsCidInfo;
-}
-
-static int DtlsCidGetSize(WOLFSSL* ssl, unsigned int* size, int rx)
-{
- ConnectionID* id;
- CIDInfo* info;
-
- if (ssl == NULL || size == NULL)
- return BAD_FUNC_ARG;
-
- info = DtlsCidGetInfo(ssl);
- if (info == NULL)
- return WOLFSSL_FAILURE;
-
- id = rx ? info->rx : info->tx;
- if (id == NULL) {
- *size = 0;
- return WOLFSSL_SUCCESS;
- }
-
- *size = id->length;
- return WOLFSSL_SUCCESS;
-}
-
-static int DtlsCidGet(WOLFSSL* ssl, unsigned char* buf, int bufferSz, int rx)
-{
- ConnectionID* id;
- CIDInfo* info;
-
- if (ssl == NULL || buf == NULL)
- return BAD_FUNC_ARG;
-
- info = DtlsCidGetInfo(ssl);
- if (info == NULL)
- return WOLFSSL_FAILURE;
-
- id = rx ? info->rx : info->tx;
- if (id == NULL || id->length == 0)
- return WOLFSSL_SUCCESS;
-
- if (id->length > bufferSz)
- return LENGTH_ERROR;
-
- XMEMCPY(buf, id->id, id->length);
- return WOLFSSL_SUCCESS;
-}
-
-static int DtlsCidGet0(WOLFSSL* ssl, unsigned char** cid, int rx)
-{
- ConnectionID* id;
- CIDInfo* info;
-
- if (ssl == NULL || cid == NULL)
- return BAD_FUNC_ARG;
-
- info = DtlsCidGetInfo(ssl);
- if (info == NULL)
- return WOLFSSL_FAILURE;
-
- id = rx ? info->rx : info->tx;
- if (id == NULL || id->length == 0)
- return WOLFSSL_SUCCESS;
-
- *cid = id->id;
- return WOLFSSL_SUCCESS;
-}
-
-static CIDInfo* DtlsCidGetInfoFromExt(byte* ext)
-{
- WOLFSSL** sslPtr;
- WOLFSSL* ssl;
-
- if (ext == NULL)
- return NULL;
- sslPtr = (WOLFSSL**)ext;
- ssl = *sslPtr;
- if (ssl == NULL)
- return NULL;
- return ssl->dtlsCidInfo;
-}
-
-static void DtlsCidUnsetInfoFromExt(byte* ext)
-{
- WOLFSSL** sslPtr;
- WOLFSSL* ssl;
-
- if (ext == NULL)
- return;
- sslPtr = (WOLFSSL**)ext;
- ssl = *sslPtr;
- if (ssl == NULL)
- return;
- ssl->dtlsCidInfo = NULL;
-}
-
-void TLSX_ConnectionID_Free(byte* ext, void* heap)
-{
- CIDInfo* info;
- (void)heap;
-
- info = DtlsCidGetInfoFromExt(ext);
- if (info == NULL)
- return;
- XFREE(info->rx, heap, DYNAMIC_TYPE_TLSX);
- XFREE(info->tx, heap, DYNAMIC_TYPE_TLSX);
- XFREE(info, heap, DYNAMIC_TYPE_TLSX);
- DtlsCidUnsetInfoFromExt(ext);
- XFREE(ext, heap, DYNAMIC_TYPE_TLSX);
-}
-
-word16 TLSX_ConnectionID_Write(byte* ext, byte* output)
-{
- CIDInfo* info;
-
- info = DtlsCidGetInfoFromExt(ext);
- if (info == NULL)
- return 0;
-
- /* empty CID */
- if (info->rx == NULL) {
- *output = 0;
- return OPAQUE8_LEN;
- }
-
- *output = info->rx->length;
- XMEMCPY(output + OPAQUE8_LEN, info->rx->id, info->rx->length);
- return OPAQUE8_LEN + info->rx->length;
-}
-
-word16 TLSX_ConnectionID_GetSize(byte* ext)
-{
- CIDInfo* info = DtlsCidGetInfoFromExt(ext);
- if (info == NULL)
- return 0;
- return info->rx == NULL ? OPAQUE8_LEN : OPAQUE8_LEN + info->rx->length;
-}
-
-int TLSX_ConnectionID_Use(WOLFSSL* ssl)
-{
- CIDInfo* info;
- WOLFSSL** ext;
- int ret;
-
- ext = (WOLFSSL**)TLSX_Find(ssl->extensions, TLSX_CONNECTION_ID);
- if (ext != NULL)
- return 0;
-
- info = (CIDInfo*)XMALLOC(sizeof(CIDInfo), ssl->heap, DYNAMIC_TYPE_TLSX);
- if (info == NULL)
- return MEMORY_ERROR;
- ext = (WOLFSSL**)XMALLOC(sizeof(WOLFSSL*), ssl->heap, DYNAMIC_TYPE_TLSX);
- if (ext == NULL) {
- XFREE(info, ssl->heap, DYNAMIC_TYPE_TLSX);
- return MEMORY_ERROR;
- }
- XMEMSET(info, 0, sizeof(CIDInfo));
- /* CIDInfo needs to be accessed every time we send or receive a record. To
- * avoid the cost of the extension lookup save a pointer to the structure
- * inside the SSL object itself, and save a pointer to the SSL object in the
- * extension. The extension freeing routine uses the pointer to the SSL
- * object to find the structure and to set ssl->dtlsCidInfo pointer to NULL
- * after freeing the structure. */
- ssl->dtlsCidInfo = info;
- *ext = ssl;
- ret =
- TLSX_Push(&ssl->extensions, TLSX_CONNECTION_ID, (void*)ext, ssl->heap);
- if (ret != 0) {
- XFREE(info, ssl->heap, DYNAMIC_TYPE_TLSX);
- XFREE(ext, ssl->heap, DYNAMIC_TYPE_TLSX);
- ssl->dtlsCidInfo = NULL;
- return ret;
- }
-
- return 0;
-}
-
-int TLSX_ConnectionID_Parse(WOLFSSL* ssl, const byte* input, word16 length,
- byte isRequest)
-{
- CIDInfo* info;
- byte cidSz;
- TLSX* ext;
-
- ext = TLSX_Find(ssl->extensions, TLSX_CONNECTION_ID);
- if (ext == NULL) {
- /* CID not enabled */
- if (isRequest) {
- WOLFSSL_MSG("Received CID ext but it's not enabled, ignoring");
- return 0;
- }
- else {
- WOLFSSL_MSG("CID ext not requested by the Client, aborting");
- return UNSUPPORTED_EXTENSION;
- }
- }
-
- if (length < OPAQUE8_LEN)
- return BUFFER_ERROR;
-
- cidSz = *input;
- if (cidSz + OPAQUE8_LEN > length)
- return BUFFER_ERROR;
-
- info = DtlsCidGetInfo(ssl);
- if (info == NULL)
- return BAD_STATE_E;
-
- /* it may happen if we process two ClientHello because the server sent an
- * HRR/HVR request */
- if (info->tx != NULL || info->negotiated) {
- if (ssl->options.side != WOLFSSL_SERVER_END &&
- ssl->options.serverState != SERVER_HELLO_RETRY_REQUEST_COMPLETE &&
- !IsSCR(ssl))
- return BAD_STATE_E;
-
- /* Should not be null if negotiated */
- if (info->tx == NULL)
- return BAD_STATE_E;
-
- /* For now we don't support changing the CID on a rehandshake */
- if (cidSz != info->tx->length ||
- XMEMCMP(info->tx->id, input + OPAQUE8_LEN, cidSz) != 0)
- return DTLS_CID_ERROR;
- }
- else if (cidSz > 0) {
- ConnectionID* id = (ConnectionID*)XMALLOC(sizeof(*id) + cidSz,
- ssl->heap, DYNAMIC_TYPE_TLSX);
- if (id == NULL)
- return MEMORY_ERROR;
- XMEMCPY(id->id, input + OPAQUE8_LEN, cidSz);
- id->length = cidSz;
- info->tx = id;
- }
-
- info->negotiated = 1;
- if (isRequest)
- ext->resp = 1;
-
- return 0;
-}
-
-void DtlsCIDOnExtensionsParsed(WOLFSSL* ssl)
-{
- CIDInfo* info;
-
- info = DtlsCidGetInfo(ssl);
- if (info == NULL)
- return;
-
- if (!info->negotiated) {
- TLSX_Remove(&ssl->extensions, TLSX_CONNECTION_ID, ssl->heap);
- return;
- }
-}
-
-byte DtlsCIDCheck(WOLFSSL* ssl, const byte* input, word16 inputSize)
-{
- CIDInfo* info;
- info = DtlsCidGetInfo(ssl);
- if (info == NULL || info->rx == NULL || info->rx->length == 0)
- return 0;
- if (inputSize < info->rx->length)
- return 0;
- return XMEMCMP(input, info->rx->id, info->rx->length) == 0;
-}
-
-int wolfSSL_dtls_cid_use(WOLFSSL* ssl)
-{
- int ret;
-
- ssl->options.useDtlsCID = 1;
- ret = TLSX_ConnectionID_Use(ssl);
- if (ret != 0)
- return ret;
- return WOLFSSL_SUCCESS;
-}
-
-int wolfSSL_dtls_cid_is_enabled(WOLFSSL* ssl)
-{
- return DtlsCidGetInfo(ssl) != NULL;
-}
-
-int wolfSSL_dtls_cid_set(WOLFSSL* ssl, unsigned char* cid, unsigned int size)
-{
- ConnectionID* newCid;
- CIDInfo* cidInfo;
-
- if (!ssl->options.useDtlsCID)
- return WOLFSSL_FAILURE;
-
- cidInfo = DtlsCidGetInfo(ssl);
- if (cidInfo == NULL)
- return WOLFSSL_FAILURE;
-
- if (cidInfo->rx != NULL) {
- WOLFSSL_MSG("wolfSSL doesn't support changing the CID during a "
- "connection");
- return WOLFSSL_FAILURE;
- }
-
- /* empty CID */
- if (size == 0)
- return WOLFSSL_SUCCESS;
-
- if (size > DTLS_CID_MAX_SIZE)
- return LENGTH_ERROR;
-
- newCid = DtlsCidNew(cid, (byte)size, ssl->heap);
- if (newCid == NULL)
- return MEMORY_ERROR;
- cidInfo->rx = newCid;
- return WOLFSSL_SUCCESS;
-}
-
-int wolfSSL_dtls_cid_get_rx_size(WOLFSSL* ssl, unsigned int* size)
-{
- return DtlsCidGetSize(ssl, size, 1);
-}
-
-int wolfSSL_dtls_cid_get_rx(WOLFSSL* ssl, unsigned char* buf,
- unsigned int bufferSz)
-{
- return DtlsCidGet(ssl, buf, bufferSz, 1);
-}
-
-int wolfSSL_dtls_cid_get0_rx(WOLFSSL* ssl, unsigned char** cid)
-{
- return DtlsCidGet0(ssl, cid, 1);
-}
-
-int wolfSSL_dtls_cid_get_tx_size(WOLFSSL* ssl, unsigned int* size)
-{
- return DtlsCidGetSize(ssl, size, 0);
-}
-
-int wolfSSL_dtls_cid_get_tx(WOLFSSL* ssl, unsigned char* buf,
- unsigned int bufferSz)
-{
- return DtlsCidGet(ssl, buf, bufferSz, 0);
-}
-
-int wolfSSL_dtls_cid_get0_tx(WOLFSSL* ssl, unsigned char** cid)
-{
- return DtlsCidGet0(ssl, cid, 0);
-}
-
-int wolfSSL_dtls_cid_max_size(void)
-{
- return DTLS_CID_MAX_SIZE;
-}
-
-const unsigned char* wolfSSL_dtls_cid_parse(const unsigned char* msg,
- unsigned int msgSz, unsigned int cidSz)
-{
- /* we need at least the first byte to check version */
- if (msg == NULL || cidSz == 0 || msgSz < OPAQUE8_LEN + cidSz)
- return NULL;
- if (msg[0] == dtls12_cid) {
- /* DTLS 1.2 CID packet */
- if (msgSz < DTLS_RECORD_HEADER_SZ + cidSz)
- return NULL;
- /* content type(1) + version(2) + epoch(2) + sequence(6) */
- return msg + ENUM_LEN + VERSION_SZ + OPAQUE16_LEN + OPAQUE16_LEN +
- OPAQUE32_LEN;
- }
-#ifdef WOLFSSL_DTLS13
- else if (Dtls13UnifiedHeaderCIDPresent(msg[0])) {
- /* DTLS 1.3 CID packet */
- if (msgSz < OPAQUE8_LEN + cidSz)
- return NULL;
- return msg + OPAQUE8_LEN;
- }
-#endif
- return NULL;
-}
-#endif /* WOLFSSL_DTLS_CID */
-
-byte DtlsGetCidTxSize(WOLFSSL* ssl)
-{
-#ifdef WOLFSSL_DTLS_CID
- unsigned int cidSz;
- int ret;
- ret = wolfSSL_dtls_cid_get_tx_size(ssl, &cidSz);
- if (ret != WOLFSSL_SUCCESS)
- return 0;
- return (byte)cidSz;
-#else
- (void)ssl;
- return 0;
-#endif
-}
-
-byte DtlsGetCidRxSize(WOLFSSL* ssl)
-{
-#ifdef WOLFSSL_DTLS_CID
- unsigned int cidSz;
- int ret;
- ret = wolfSSL_dtls_cid_get_rx_size(ssl, &cidSz);
- if (ret != WOLFSSL_SUCCESS)
- return 0;
- return (byte)cidSz;
-#else
- (void)ssl;
- return 0;
-#endif
-}
-
-byte wolfSSL_is_stateful(WOLFSSL* ssl)
-{
- return (byte)(ssl != NULL ? ssl->options.dtlsStateful : 0);
-}
-
-#endif /* WOLFSSL_DTLS */
-
-#endif /* WOLFCRYPT_ONLY */
diff --git a/src/ssl/wolfssl/dtls13.c b/src/ssl/wolfssl/dtls13.c
deleted file mode 100644
index 9c729fa1e..000000000
--- a/src/ssl/wolfssl/dtls13.c
+++ /dev/null
@@ -1,3065 +0,0 @@
-/* dtls13.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef WOLFSSL_DTLS13
-
-#include
-#include
-#include
-#include
-#include
-
-#ifdef NO_INLINE
-#include
-#else
-#define WOLFSSL_MISC_INCLUDED
-#include
-#endif
-
-/**
- * enum rnDirection - distinguish between RecordNumber Enc/Dec
- * PROTECT: encrypt the Record Number
- * DEPROTECT: decrypt the Record Number
- */
-enum rnDirection {
- PROTECT = 0,
- DEPROTECT,
-};
-
-/**
- * struct Dtls13HandshakeHeader: represent DTLS Handshake header
- * @msg_type: type of message (client_hello,server_hello,etc)
- * @length: length of the message
- * @messageSeq: message sequence number (used for reordering and retransmission)
- * @fragmentOffset: this is the offset of the data in the complete message. For
- * an unfragmented message this is always zero
- * @fragmentLength: length of this fragment (if not fragmented @fragmentLength
- * is always equal to @length)
- */
-typedef struct Dtls13HandshakeHeader {
- byte msg_type;
- byte length[3];
- byte messageSeq[2];
- byte fragmentOffset[3];
- byte fragmentLength[3];
-} Dtls13HandshakeHeader;
-
-wc_static_assert(sizeof(Dtls13HandshakeHeader) == DTLS13_HANDSHAKE_HEADER_SZ);
-
-/**
- * struct Dtls13Recordplaintextheader: represent header of unprotected DTLSv1.3
- * record
- * @contentType: content type of the record (handshake, applicationData, etc)
- * @legacyversionrecord: legacy version field
- * @epoch: epoch number (lower 16 bits)
- * @sequenceNumber: sequence number (lower 16 bits)
- * @length: length of the record
- */
-typedef struct Dtls13RecordPlaintextHeader {
- byte contentType;
- ProtocolVersion legacyVersionRecord;
- byte epoch[2];
- byte sequenceNumber[6];
- byte length[2];
-} Dtls13RecordPlaintextHeader;
-
-/* size of the len field in the unified header */
-#define DTLS13_LEN_SIZE 2
-/* size of the flags in the unified header */
-#define DTLS13_HDR_FLAGS_SIZE 1
-/* size of the sequence number where SEQ_LEN_BIT is present */
-#define DTLS13_SEQ_16_LEN 2
-/* size of the sequence number where SEQ_LEN_BIT is not present */
-#define DTLS13_SEQ_8_LEN 1
-
-/* fixed bits mask to detect unified header */
-#define DTLS13_FIXED_BITS_MASK (0x111 << 5)
-/* fixed bits value to detect unified header */
-#define DTLS13_FIXED_BITS (0x1 << 5)
-/* ConnectionID present bit in the unified header flags */
-#define DTLS13_CID_BIT (0x1 << 4)
-/* Sequence number is 16 bits if this bit is into unified header flags */
-#define DTLS13_SEQ_LEN_BIT (0x1 << 3)
-/* Length field is present if this bit is into unified header flags */
-#define DTLS13_LEN_BIT (0x1 << 2)
-
-/* For now, the size of the outgoing DTLSv1.3 record header is fixed to 5 bytes
- (8 bit header flags + 16bit record number + 16 bit length). In the future, we
- can dynamically choose to remove the length from the header to save
- space. Also it will need to account for client connection ID when
- supported. */
-#define DTLS13_UNIFIED_HEADER_SIZE 5
-#define DTLS13_MIN_CIPHERTEXT 16
-#define DTLS13_MIN_RTX_INTERVAL 1
-
-#ifndef NO_WOLFSSL_CLIENT
-WOLFSSL_METHOD* wolfDTLSv1_3_client_method_ex(void* heap)
-{
- WOLFSSL_METHOD* method;
-
- WOLFSSL_ENTER("DTLSv1_3_client_method_ex");
- (void)heap;
-
- method = (WOLFSSL_METHOD*)XMALLOC(sizeof(WOLFSSL_METHOD), heap,
- DYNAMIC_TYPE_METHOD);
- if (method)
- InitSSL_Method(method, MakeDTLSv1_3());
-
- return method;
-}
-
-WOLFSSL_METHOD* wolfDTLSv1_3_client_method(void)
-{
- return wolfDTLSv1_3_client_method_ex(NULL);
-}
-#endif /* !NO_WOLFSSL_CLIENT */
-
-
-#ifndef NO_WOLFSSL_SERVER
-WOLFSSL_METHOD* wolfDTLSv1_3_server_method_ex(void* heap)
-{
- WOLFSSL_METHOD* method;
-
- WOLFSSL_ENTER("DTLSv1_3_server_method_ex");
- (void)heap;
-
- method = (WOLFSSL_METHOD*)XMALLOC(sizeof(WOLFSSL_METHOD), heap,
- DYNAMIC_TYPE_METHOD);
- if (method) {
- InitSSL_Method(method, MakeDTLSv1_3());
- method->side = WOLFSSL_SERVER_END;
- }
-
- return method;
-}
-
-WOLFSSL_METHOD* wolfDTLSv1_3_server_method(void)
-{
- return wolfDTLSv1_3_server_method_ex(NULL);
-}
-#endif /* !NO_WOLFSSL_SERVER */
-
-int Dtls13RlAddPlaintextHeader(WOLFSSL* ssl, byte* out,
- enum ContentType content_type, word16 length)
-{
- Dtls13RecordPlaintextHeader* hdr;
- word32 seq[2];
- int ret;
-
- hdr = (Dtls13RecordPlaintextHeader*)out;
- hdr->contentType = content_type;
- hdr->legacyVersionRecord.major = DTLS_MAJOR;
- hdr->legacyVersionRecord.minor = DTLSv1_2_MINOR;
-
- ret = Dtls13GetSeq(ssl, CUR_ORDER, seq, 1);
- if (ret != 0)
- return ret;
-
- /* seq[0] combines the epoch and 16 MSB of sequence number. We write on the
- epoch field and will overflow to the first two bytes of the sequence
- number */
- c16toa((word16)(seq[0] >> 16), hdr->epoch);
- c16toa((word16)seq[0], hdr->sequenceNumber);
- c32toa(seq[1], &hdr->sequenceNumber[2]);
-
- c16toa(length, hdr->length);
-
- return 0;
-}
-
-static int Dtls13HandshakeAddHeaderFrag(WOLFSSL* ssl, byte* output,
- enum HandShakeType msg_type, word32 frag_offset, word32 frag_length,
- word32 msg_length)
-{
- Dtls13HandshakeHeader* hdr;
-
- hdr = (Dtls13HandshakeHeader*)output;
-
- hdr->msg_type = msg_type;
- c32to24((word32)msg_length, hdr->length);
- c16toa(ssl->keys.dtls_handshake_number, hdr->messageSeq);
-
- c32to24(frag_offset, hdr->fragmentOffset);
- c32to24(frag_length, hdr->fragmentLength);
-
- return 0;
-}
-
-static byte Dtls13TypeIsEncrypted(enum HandShakeType hs_type)
-{
- byte ret = 0;
-
- switch (hs_type) {
- case hello_request:
- case hello_verify_request:
- case client_hello:
- case hello_retry_request:
- case server_hello:
- break;
- case encrypted_extensions:
- case session_ticket:
- case end_of_early_data:
- case certificate:
- case server_key_exchange:
- case certificate_request:
- case server_hello_done:
- case certificate_verify:
- case client_key_exchange:
- case finished:
- case certificate_status:
- case key_update:
- case change_cipher_hs:
- case message_hash:
- case no_shake:
- ret = 1;
- }
-
- return ret;
-}
-
-static int Dtls13GetRnMask(WOLFSSL* ssl, const byte* ciphertext, byte* mask,
- enum rnDirection dir)
-{
- RecordNumberCiphers* c;
-
- if (dir == PROTECT)
- c = &ssl->dtlsRecordNumberEncrypt;
- else
- c = &ssl->dtlsRecordNumberDecrypt;
-
-#if defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm ||
- ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm) {
-
- if (c->aes == NULL)
- return BAD_STATE_E;
-#if !defined(HAVE_SELFTEST) && \
- (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3)) \
- || defined(WOLFSSL_KERNEL_MODE))
- return wc_AesEncryptDirect(c->aes, mask, ciphertext);
-#else
- wc_AesEncryptDirect(c->aes, mask, ciphertext);
- return 0;
-#endif
- }
-#endif /* HAVE_AESGCM || HAVE_AESCCM */
-
-#ifdef HAVE_CHACHA
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_chacha) {
- word32 counter;
- int ret;
-
- if (c->chacha == NULL)
- return BAD_STATE_E;
-
- /* assuming CIPHER[0..3] should be interpreted as little endian 32-bits
- integer. The draft rfc isn't really clear on that. See sec 4.2.3 of
- the draft. See also Section 2.3 of the Chacha RFC. */
- ato32le(ciphertext, &counter);
-
- ret = wc_Chacha_SetIV(c->chacha, &ciphertext[4], counter);
- if (ret != 0)
- return ret;
-
- XMEMSET(mask, 0, DTLS13_RN_MASK_SIZE);
-
- return wc_Chacha_Process(c->chacha, mask, mask, DTLS13_RN_MASK_SIZE);
- }
-#endif /* HAVE_CHACHA */
-
- return NOT_COMPILED_IN;
-}
-
-static int Dtls13EncryptDecryptRecordNumber(WOLFSSL* ssl, byte* seq,
- int SeqLength, const byte* ciphertext, enum rnDirection dir)
-{
- byte mask[DTLS13_RN_MASK_SIZE];
- int ret;
-
-#ifdef HAVE_NULL_CIPHER
- /* Do not encrypt record numbers with null cipher. See RFC 9150 Sec 9 */
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_cipher_null)
- return 0;
-#endif /*HAVE_NULL_CIPHER */
-
- ret = Dtls13GetRnMask(ssl, ciphertext, mask, dir);
- if (ret != 0)
- return ret;
-
- xorbuf(seq, mask, SeqLength);
-
- return 0;
-}
-
-static byte Dtls13RtxMsgNeedsAck(WOLFSSL* ssl, enum HandShakeType hs)
-{
-
-#ifndef NO_WOLFSSL_SERVER
- /* we send an ACK when processing the finished message. In this case either
- we already sent an ACK for client's Certificate/CertificateVerify or they
- are in our list of seen records and will be included in the ACK
- message */
- if (ssl->options.side == WOLFSSL_SERVER_END && (hs == finished))
- return 1;
-#else
- (void)ssl;
-#endif /* NO_WOLFSSL_SERVER */
-
- if (hs == session_ticket || hs == key_update)
- return 1;
-
- return 0;
-}
-
-static void Dtls13MsgWasProcessed(WOLFSSL* ssl, enum HandShakeType hs)
-{
- if (ssl->options.dtlsStateful)
- ssl->keys.dtls_expected_peer_handshake_number++;
-
-#ifdef WOLFSSL_RW_THREADED
- if (wc_LockMutex(&ssl->dtls13Rtx.mutex) == 0)
-#endif
- {
- /* we need to send ACKs on the last message of a flight that needs
- * explicit acknowledgment */
- ssl->dtls13Rtx.sendAcks = Dtls13RtxMsgNeedsAck(ssl, hs);
- #ifdef WOLFSSL_RW_THREADED
- wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
- #endif
- }
-}
-
-int Dtls13ProcessBufferedMessages(WOLFSSL* ssl)
-{
- DtlsMsg* msg = ssl->dtls_rx_msg_list;
- word32 idx = 0;
- int ret = 0;
-
- WOLFSSL_ENTER("Dtls13ProcessBufferedMessages");
-
- while (msg != NULL) {
- int downgraded = 0;
- idx = 0;
-
- /* message not in order */
- if (ssl->keys.dtls_expected_peer_handshake_number != msg->seq)
- break;
-
- /* message not complete */
- if (!msg->ready)
- break;
-
-#ifndef WOLFSSL_DISABLE_EARLY_SANITY_CHECKS
- ret = MsgCheckEncryption(ssl, msg->type, msg->encrypted);
- if (ret != 0) {
- SendAlert(ssl, alert_fatal, unexpected_message);
- break;
- }
-#endif
-
- /* We may have DTLS <=1.2 msgs stored from before we knew which version
- * we were going to use. Interpret correctly. */
- if (IsAtLeastTLSv1_3(ssl->version)) {
- ret = DoTls13HandShakeMsgType(ssl, msg->fullMsg, &idx, msg->type,
- msg->sz, msg->sz);
- if (!IsAtLeastTLSv1_3(ssl->version))
- downgraded = 1;
- }
- else {
-#if !defined(WOLFSSL_NO_TLS12)
- ret = DoHandShakeMsgType(ssl, msg->fullMsg, &idx, msg->type,
- msg->sz, msg->sz);
-#else
- WOLFSSL_MSG("DTLS1.2 disabled with WOLFSSL_NO_TLS12");
- WOLFSSL_ERROR_VERBOSE(NOT_COMPILED_IN);
- ret = NOT_COMPILED_IN;
-#endif
- }
-
- /* processing certificate_request triggers a connect. The error came
- * from there, the message can be considered processed successfully.
- * WANT_WRITE means that we are done with processing the msg and we are
- * waiting to flush the output buffer. */
- if ((ret == 0 || ret == WC_NO_ERR_TRACE(WANT_WRITE)) ||
- (msg->type == certificate_request &&
- ssl->options.handShakeDone &&
- ret == WC_NO_ERR_TRACE(WC_PENDING_E))) {
- if (IsAtLeastTLSv1_3(ssl->version))
- Dtls13MsgWasProcessed(ssl, (enum HandShakeType)msg->type);
- else if (downgraded)
- /* DoHandShakeMsgType normally handles the hs number but if
- * DoTls13HandShakeMsgType processed 1.2 msgs then this wasn't
- * incremented. */
- ssl->keys.dtls_expected_peer_handshake_number++;
-
- ssl->dtls_rx_msg_list = msg->next;
- DtlsMsgDelete(msg, ssl->heap);
- msg = ssl->dtls_rx_msg_list;
- ssl->dtls_rx_msg_list_sz--;
- }
-
- if (ret != 0)
- break;
- }
-
- WOLFSSL_LEAVE("dtls13_process_buffered_messages()", ret);
-
- return ret;
-}
-
-static int Dtls13NextMessageComplete(WOLFSSL* ssl)
-{
- return ssl->dtls_rx_msg_list != NULL &&
- ssl->dtls_rx_msg_list->ready &&
- ssl->dtls_rx_msg_list->seq ==
- ssl->keys.dtls_expected_peer_handshake_number;
-}
-
-static WC_INLINE int FragIsInOutputBuffer(WOLFSSL* ssl, const byte* frag)
-{
- const byte* OutputBuffer = ssl->buffers.outputBuffer.buffer;
- word32 OutputBufferSize = ssl->buffers.outputBuffer.bufferSize;
-
- return frag >= OutputBuffer && frag < OutputBuffer + OutputBufferSize;
-}
-
-static int Dtls13SendFragFromBuffer(WOLFSSL* ssl, byte* output, word16 length)
-{
- byte* buf;
- int ret;
-
- if (FragIsInOutputBuffer(ssl, output))
- return BAD_FUNC_ARG;
-
- ret = CheckAvailableSize(ssl, length);
- if (ret != 0)
- return ret;
-
- buf = GetOutputBuffer(ssl);
-
- XMEMCPY(buf, output, length);
-
- ssl->buffers.outputBuffer.length += length;
-
- return SendBuffered(ssl);
-}
-
-static int Dtls13SendNow(WOLFSSL* ssl, enum HandShakeType handshakeType)
-{
- if (!ssl->options.groupMessages || ssl->dtls13SendingFragments)
- return 1;
-
- if (handshakeType == client_hello || handshakeType == hello_retry_request ||
- handshakeType == finished || handshakeType == session_ticket ||
- handshakeType == session_ticket || handshakeType == key_update ||
- (handshakeType == certificate_request &&
- ssl->options.handShakeState == HANDSHAKE_DONE))
- return 1;
-
- return 0;
-}
-
-/* Handshake header DTLS only fields are not included in the transcript hash.
- * body points to the body of the DTLSHandshake message. */
-int Dtls13HashClientHello(const WOLFSSL* ssl, byte* hash, int* hashSz,
- const byte* body, word32 length, CipherSpecs* specs)
-{
- /* msg_type(1) + length (3) */
- byte header[OPAQUE32_LEN];
- int ret;
- wc_HashAlg hashCtx;
- int type = wolfSSL_GetHmacType_ex(specs);
-
- if (type < 0)
- return type;
-
- header[0] = (byte)client_hello;
- c32to24(length, header + 1);
-
- ret = wc_HashInit_ex(&hashCtx, (enum wc_HashType)type, ssl->heap, ssl->devId);
- if (ret == 0) {
- ret = wc_HashUpdate(&hashCtx, (enum wc_HashType)type, header, OPAQUE32_LEN);
- if (ret == 0)
- ret = wc_HashUpdate(&hashCtx, (enum wc_HashType)type, body, length);
- if (ret == 0)
- ret = wc_HashFinal(&hashCtx, (enum wc_HashType)type, hash);
- if (ret == 0) {
- *hashSz = wc_HashGetDigestSize((enum wc_HashType)type);
- if (*hashSz < 0)
- ret = *hashSz;
- }
- wc_HashFree(&hashCtx, (enum wc_HashType)type);
- }
- return ret;
-}
-
-/* Handshake header DTLS only fields are not included in the transcript hash */
-int Dtls13HashHandshake(WOLFSSL* ssl, const byte* input, word16 length)
-{
- int ret;
-
- if (length < DTLS_HANDSHAKE_HEADER_SZ)
- return BAD_FUNC_ARG;
-
- /* msg_type(1) + length (3) */
- ret = HashRaw(ssl, input, OPAQUE32_LEN);
- if (ret != 0)
- return ret;
-
- input += OPAQUE32_LEN;
- length -= OPAQUE32_LEN;
-
- /* message_seq(2) + fragment_offset(3) + fragment_length(3) */
- input += OPAQUE64_LEN;
- length -= OPAQUE64_LEN;
-
- return HashRaw(ssl, input, length);
-}
-
-static int Dtls13SendFragment(WOLFSSL* ssl, byte* output, word16 output_size,
- word16 length, enum HandShakeType handshakeType, int hashOutput,
- int sendImmediately)
-{
- word16 recordHeaderLength;
- word16 recordLength;
- byte isProtected;
- int sendLength;
- byte* msg;
- int ret;
-
- if (output_size < length)
- return BUFFER_ERROR;
-
- isProtected = Dtls13TypeIsEncrypted(handshakeType);
- recordHeaderLength = Dtls13GetRlHeaderLength(ssl, isProtected);
-
- if (length <= recordHeaderLength)
- return BUFFER_ERROR;
-
- recordLength = length - recordHeaderLength;
-
- if (!isProtected) {
- ret = Dtls13RlAddPlaintextHeader(ssl, output, handshake, recordLength);
- if (ret != 0)
- return ret;
- }
- else {
- msg = output + recordHeaderLength;
-
- if (hashOutput) {
- ret = Dtls13HashHandshake(ssl, msg, recordLength);
- if (ret != 0)
- return ret;
- }
-
- sendLength = BuildTls13Message(ssl, output, output_size, msg,
- recordLength, handshake, 0, 0, 0);
- if (sendLength < 0)
- return sendLength;
-
- length = (word16)sendLength;
- }
-
- if (!FragIsInOutputBuffer(ssl, output))
- return Dtls13SendFragFromBuffer(ssl, output, length);
-
- ssl->buffers.outputBuffer.length += length;
-
- ret = 0;
- if (sendImmediately)
- ret = SendBuffered(ssl);
-
- return ret;
-}
-
-static void Dtls13FreeFragmentsBuffer(WOLFSSL* ssl)
-{
- XFREE(ssl->dtls13FragmentsBuffer.buffer, ssl->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- ssl->dtls13FragmentsBuffer.buffer = NULL;
- ssl->dtls13SendingFragments = 0;
- ssl->dtls13MessageLength = ssl->dtls13FragOffset = 0;
-}
-
-static WC_INLINE void Dtls13FreeRtxBufferRecord(WOLFSSL* ssl,
- Dtls13RtxRecord* r)
-{
- (void)ssl;
-
- XFREE(r->data, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- XFREE(r, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
-}
-
-static Dtls13RtxRecord* Dtls13RtxNewRecord(WOLFSSL* ssl, byte* data,
- word16 length, enum HandShakeType handshakeType, w64wrapper seq)
-{
- w64wrapper epochNumber;
- Dtls13RtxRecord* r;
-
- WOLFSSL_ENTER("Dtls13RtxNewRecord");
-
- if (ssl->dtls13EncryptEpoch == NULL)
- return NULL;
-
- epochNumber = ssl->dtls13EncryptEpoch->epochNumber;
-
- r = (Dtls13RtxRecord*)XMALLOC(sizeof(*r), ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- if (r == NULL)
- return NULL;
-
- r->data = (byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- if (r->data == NULL) {
- XFREE(r, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- return NULL;
- }
-
- XMEMCPY(r->data, data, length);
- r->epoch = epochNumber;
- r->length = length;
- r->next = NULL;
- r->handshakeType = handshakeType;
- r->seq[0] = seq;
- r->rnIdx = 1;
-
- return r;
-}
-
-static void Dtls13RtxAddRecord(Dtls13Rtx* fsm, Dtls13RtxRecord* r)
-{
- WOLFSSL_ENTER("Dtls13RtxAddRecord");
-
- *fsm->rtxRecordTailPtr = r;
- fsm->rtxRecordTailPtr = &r->next;
- r->next = NULL;
-}
-
-static void Dtls13RtxRecordUnlink(WOLFSSL* ssl, Dtls13RtxRecord** prevNext,
- Dtls13RtxRecord* r)
-{
- /* if r was at the tail of the list, update the tail pointer */
- if (r->next == NULL) {
- #ifdef WOLFSSL_RW_THREADED
- if (wc_LockMutex(&ssl->dtls13Rtx.mutex) == 0)
- #endif
- {
- ssl->dtls13Rtx.rtxRecordTailPtr = prevNext;
- #ifdef WOLFSSL_RW_THREADED
- wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
- #endif
- }
- }
-
- /* unlink */
- *prevNext = r->next;
-}
-
-void Dtls13RtxFlushBuffered(WOLFSSL* ssl, byte keepNewSessionTicket)
-{
- Dtls13RtxRecord *r, **prevNext;
-
- WOLFSSL_ENTER("Dtls13RtxFlushBuffered");
-
- prevNext = &ssl->dtls13Rtx.rtxRecords;
- r = ssl->dtls13Rtx.rtxRecords;
-
- /* we process the head at the end */
- while (r != NULL) {
-
- if (keepNewSessionTicket && r->handshakeType == session_ticket) {
- prevNext = &r->next;
- r = r->next;
- continue;
- }
-
- *prevNext = r->next;
- Dtls13FreeRtxBufferRecord(ssl, r);
- r = *prevNext;
- }
-
- ssl->dtls13Rtx.rtxRecordTailPtr = prevNext;
-}
-
-static Dtls13RecordNumber* Dtls13NewRecordNumber(w64wrapper epoch,
- w64wrapper seq, void* heap)
-{
- Dtls13RecordNumber* rn;
-
- (void)heap;
-
- rn = (Dtls13RecordNumber*)XMALLOC(sizeof(*rn), heap,
- DYNAMIC_TYPE_DTLS_MSG);
- if (rn == NULL)
- return NULL;
-
- rn->next = NULL;
- rn->epoch = epoch;
- rn->seq = seq;
-
- return rn;
-}
-
-int Dtls13RtxAddAck(WOLFSSL* ssl, w64wrapper epoch, w64wrapper seq)
-{
- Dtls13RecordNumber* rn;
-
- WOLFSSL_ENTER("Dtls13RtxAddAck");
-
-#ifdef WOLFSSL_RW_THREADED
- if (wc_LockMutex(&ssl->dtls13Rtx.mutex) == 0)
-#endif
- {
- /* Find location to insert new record */
- Dtls13RecordNumber** prevNext = &ssl->dtls13Rtx.seenRecords;
- Dtls13RecordNumber* cur = ssl->dtls13Rtx.seenRecords;
-
- for (; cur != NULL; prevNext = &cur->next, cur = cur->next) {
- if (w64Equal(cur->epoch, epoch) && w64Equal(cur->seq, seq)) {
- /* already in list. no duplicates. */
- return 0;
- }
- else if (w64LT(epoch, cur->epoch)
- || (w64Equal(epoch, cur->epoch)
- && w64LT(seq, cur->seq))) {
- break;
- }
- }
-
- rn = Dtls13NewRecordNumber(epoch, seq, ssl->heap);
- if (rn == NULL)
- return MEMORY_E;
-
- *prevNext = rn;
- rn->next = cur;
- #ifdef WOLFSSL_RW_THREADED
- wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
- #endif
- }
-
- return 0;
-}
-
-static void Dtls13RtxFlushAcks(WOLFSSL* ssl)
-{
- Dtls13RecordNumber *list, *rn;
-
- (void)ssl;
-
- WOLFSSL_ENTER("Dtls13RtxFlushAcks");
-
-#ifdef WOLFSSL_RW_THREADED
- if (wc_LockMutex(&ssl->dtls13Rtx.mutex) == 0)
-#endif
- {
- list = ssl->dtls13Rtx.seenRecords;
-
- while (list != NULL) {
- rn = list;
- list = rn->next;
- XFREE(rn, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- }
-
- ssl->dtls13Rtx.seenRecords = NULL;
- #ifdef WOLFSSL_RW_THREADED
- wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
- #endif
- }
-}
-
-static int Dtls13DetectDisruption(WOLFSSL* ssl, word32 fragOffset)
-{
- /* retransmission. The other peer may have lost our flight or our ACKs. We
- don't account this as a disruption */
- if (ssl->keys.dtls_peer_handshake_number <
- ssl->keys.dtls_expected_peer_handshake_number)
- return 0;
-
- /* out of order message */
- if (ssl->keys.dtls_peer_handshake_number >
- ssl->keys.dtls_expected_peer_handshake_number) {
- return 1;
- }
-
- /* first fragment of in-order message */
- if (fragOffset == 0)
- return 0;
-
- /* is not the next fragment in the message (the check is not 100% perfect,
- in the worst case, we don't detect the disruption and wait for the other
- peer retransmission) */
- if (ssl->dtls_rx_msg_list != NULL) {
- DtlsFragBucket* last = ssl->dtls_rx_msg_list->fragBucketList;
- while (last != NULL && last->m.m.next != NULL)
- last = last->m.m.next;
- /* Does this fragment start right after the last fragment we
- * have stored? */
- if (last != NULL && (last->m.m.offset + last->m.m.sz) != fragOffset)
- return 1;
- }
- else {
- /* ssl->dtls_rx_msg_list is NULL and fragOffset != 0 so this is not in
- * order */
- return 1;
- }
-
- return 0;
-}
-
-static void Dtls13RtxRemoveCurAck(WOLFSSL* ssl)
-{
- Dtls13RecordNumber *rn, **prevNext;
-
- prevNext = &ssl->dtls13Rtx.seenRecords;
- rn = ssl->dtls13Rtx.seenRecords;
-
- while (rn != NULL) {
- if (w64Equal(rn->epoch, ssl->keys.curEpoch64) &&
- w64Equal(rn->seq, ssl->keys.curSeq)) {
- *prevNext = rn->next;
- XFREE(rn, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- return;
- }
-
- prevNext = &rn->next;
- rn = rn->next;
- }
-}
-
-static void Dtls13MaybeSaveClientHello(WOLFSSL* ssl)
-{
- Dtls13RtxRecord *r, **prev_next;
-
- r = ssl->dtls13Rtx.rtxRecords;
- prev_next = &ssl->dtls13Rtx.rtxRecords;
-
- if (ssl->options.side == WOLFSSL_CLIENT_END &&
- ssl->options.connectState >= CLIENT_HELLO_SENT &&
- ssl->options.connectState <= HELLO_AGAIN_REPLY &&
- ssl->options.downgrade && ssl->options.minDowngrade >= DTLSv1_2_MINOR) {
- while (r != NULL) {
- if (r->handshakeType == client_hello) {
- Dtls13RtxRecordUnlink(ssl, prev_next, r);
- XFREE(ssl->dtls13ClientHello, ssl->heap, DYNAMIC_TYPE_DTLS_MSG);
- ssl->dtls13ClientHello = r->data;
- ssl->dtls13ClientHelloSz = r->length;
- r->data = NULL;
- Dtls13FreeRtxBufferRecord(ssl, r);
- return;
- }
- prev_next = &r->next;
- r = r->next;
- }
- }
-}
-
-static int Dtls13RtxMsgRecvd(WOLFSSL* ssl, enum HandShakeType hs,
- word32 fragOffset)
-{
- WOLFSSL_ENTER("Dtls13RtxMsgRecvd");
-
- if (!ssl->options.handShakeDone &&
- ssl->keys.dtls_peer_handshake_number >=
- ssl->keys.dtls_expected_peer_handshake_number) {
-
- if (hs == server_hello)
- Dtls13MaybeSaveClientHello(ssl);
-
- /* In the handshake, receiving part of the next flight, acknowledge the
- * sent flight. */
- /* On the server side, receiving the last client flight does not ACK any
- * sent new_session_ticket messages. */
- /* We don't want to clear the buffer until we have done version
- * negotiation in the SH or have received a unified header in the
- * DTLS record. */
- if (ssl->options.serverState >= SERVER_HELLO_COMPLETE ||
- ssl->options.seenUnifiedHdr)
- /* Use 1.2 API to clear 1.2 buffers too */
- DtlsMsgPoolReset(ssl);
- }
-
- if (ssl->keys.dtls_peer_handshake_number <
- ssl->keys.dtls_expected_peer_handshake_number) {
-
- /* retransmission detected. */
- ssl->dtls13Rtx.retransmit = 1;
-
- /* the other peer may have retransmitted because an ACK for a flight
- that needs explicit ACK was lost.*/
- if (ssl->dtls13Rtx.seenRecords != NULL)
- ssl->dtls13Rtx.sendAcks = 1;
- }
-
- if (ssl->keys.dtls_peer_handshake_number ==
- ssl->keys.dtls_expected_peer_handshake_number &&
- ssl->options.handShakeDone && hs == certificate_request) {
-
- /* the current record, containing a post-handshake certificate request,
- is implicitly acknowledged by the
- certificate/certificate_verify/finished flight we are about to
- send. Please note that if the certificate request came out-of-order
- and we didn't send an ACK (sendMoreAcks == 0 and the missing
- packet(s) arrive before that fast timeout expired), then we will send
- both the ACK and the flight. While unnecessary this it's harmless, it
- should be rare and simplifies the code. Otherwise, it would be
- necessary to track which record number contained a CertificateRequest
- with a particular context id */
- Dtls13RtxRemoveCurAck(ssl);
- }
-
- if (ssl->options.dtls13SendMoreAcks &&
- Dtls13DetectDisruption(ssl, fragOffset)) {
- WOLFSSL_MSG("Disruption detected");
- ssl->dtls13Rtx.sendAcks = 1;
- }
-
- return 0;
-}
-
-void Dtls13FreeFsmResources(WOLFSSL* ssl)
-{
- Dtls13RtxFlushAcks(ssl);
- /* Use 1.2 API to clear 1.2 buffers too */
- DtlsMsgPoolReset(ssl);
- Dtls13RtxFlushBuffered(ssl, 0);
-}
-
-static int Dtls13SendOneFragmentRtx(WOLFSSL* ssl,
- enum HandShakeType handshakeType, word16 outputSize, byte* message,
- word32 length, int hashOutput)
-{
- Dtls13RtxRecord* rtxRecord = NULL;
- word16 recordHeaderLength;
- byte isProtected;
- int ret;
-
- isProtected = Dtls13TypeIsEncrypted(handshakeType);
- recordHeaderLength = Dtls13GetRlHeaderLength(ssl, isProtected);
-
- if (handshakeType != hello_retry_request) {
- rtxRecord = Dtls13RtxNewRecord(ssl, message + recordHeaderLength,
- (word16)(length - recordHeaderLength), handshakeType,
- ssl->dtls13EncryptEpoch->nextSeqNumber);
- if (rtxRecord == NULL)
- return MEMORY_E;
- }
-
- ret = Dtls13SendFragment(ssl, message, outputSize, (word16)length,
- handshakeType, hashOutput, Dtls13SendNow(ssl, handshakeType));
-
- if (rtxRecord != NULL) {
- if (ret == 0 || ret == WC_NO_ERR_TRACE(WANT_WRITE))
- Dtls13RtxAddRecord(&ssl->dtls13Rtx, rtxRecord);
- else
- Dtls13FreeRtxBufferRecord(ssl, rtxRecord);
- }
-
- return ret;
-}
-
-static int Dtls13SendFragmentedInternal(WOLFSSL* ssl)
-{
- int fragLength, rlHeaderLength;
- int remainingSize, maxFragment;
- int recordLength;
- byte isEncrypted;
- byte* output;
- int ret;
-
- isEncrypted = Dtls13TypeIsEncrypted(
- (enum HandShakeType)ssl->dtls13FragHandshakeType);
- rlHeaderLength = Dtls13GetRlHeaderLength(ssl, isEncrypted);
- maxFragment = wolfSSL_GetMaxFragSize(ssl, MAX_RECORD_SIZE);
-
- remainingSize = ssl->dtls13MessageLength - ssl->dtls13FragOffset;
-
- while (remainingSize > 0) {
-
- fragLength = maxFragment - rlHeaderLength - DTLS_HANDSHAKE_HEADER_SZ;
-
- recordLength = maxFragment;
-
- if (fragLength > remainingSize) {
- fragLength = remainingSize;
- recordLength =
- fragLength + rlHeaderLength + DTLS_HANDSHAKE_HEADER_SZ;
- }
-
- ret = CheckAvailableSize(ssl, recordLength + MAX_MSG_EXTRA);
- if (ret != 0) {
- Dtls13FreeFragmentsBuffer(ssl);
- return ret;
- }
-
- output = GetOutputBuffer(ssl);
-
- ret = Dtls13HandshakeAddHeaderFrag(ssl, output + rlHeaderLength,
- (enum HandShakeType)ssl->dtls13FragHandshakeType,
- ssl->dtls13FragOffset, fragLength, ssl->dtls13MessageLength);
- if (ret != 0) {
- Dtls13FreeFragmentsBuffer(ssl);
- return ret;
- }
-
- XMEMCPY(output + rlHeaderLength + DTLS_HANDSHAKE_HEADER_SZ,
- ssl->dtls13FragmentsBuffer.buffer + ssl->dtls13FragOffset,
- fragLength);
-
- ret = Dtls13SendOneFragmentRtx(ssl,
- (enum HandShakeType)ssl->dtls13FragHandshakeType,
- (word16)recordLength + MAX_MSG_EXTRA, output, (word32)recordLength, 0);
- if (ret == WC_NO_ERR_TRACE(WANT_WRITE)) {
- ssl->dtls13FragOffset += fragLength;
- return ret;
- }
-
- if (ret != 0) {
- Dtls13FreeFragmentsBuffer(ssl);
- return ret;
- }
-
- ssl->dtls13FragOffset += fragLength;
- remainingSize -= fragLength;
- }
-
- /* we sent all fragments */
- Dtls13FreeFragmentsBuffer(ssl);
- return 0;
-}
-
-static int Dtls13SendFragmented(WOLFSSL* ssl, byte* message, word16 length,
- enum HandShakeType handshake_type, int hash_output)
-{
- int rlHeaderLength;
- byte isEncrypted;
- int messageSize;
- int ret;
-
- if (ssl->dtls13SendingFragments != 0) {
- WOLFSSL_MSG(
- "dtls13_send_fragmented() invoked while already sending fragments");
- return BAD_STATE_E;
- }
-
- isEncrypted = Dtls13TypeIsEncrypted(handshake_type);
- rlHeaderLength = Dtls13GetRlHeaderLength(ssl, isEncrypted);
-
- if (length < rlHeaderLength)
- return INCOMPLETE_DATA;
-
- /* DTLSv1.3 do not consider fragmentation for hash transcript. Build the
- hash now pretending fragmentation will not happen */
- if (hash_output) {
- ret = Dtls13HashHandshake(ssl, message + rlHeaderLength,
- length - (word16)rlHeaderLength);
- if (ret != 0)
- return ret;
- }
-
- messageSize = length - rlHeaderLength - DTLS_HANDSHAKE_HEADER_SZ;
-
- ssl->dtls13FragmentsBuffer.buffer =
- (byte*)XMALLOC(messageSize, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-
- if (ssl->dtls13FragmentsBuffer.buffer == NULL)
- return MEMORY_E;
-
- XMEMCPY(ssl->dtls13FragmentsBuffer.buffer,
- message + rlHeaderLength + DTLS_HANDSHAKE_HEADER_SZ, messageSize);
-
- ssl->dtls13MessageLength = messageSize;
- ssl->dtls13FragHandshakeType = handshake_type;
- ssl->dtls13SendingFragments = 1;
-
- return Dtls13SendFragmentedInternal(ssl);
-}
-
-static WC_INLINE word8 Dtls13GetEpochBits(w64wrapper epoch)
-{
- return w64GetLow32(epoch) & EE_MASK;
-}
-
-#ifdef WOLFSSL_DTLS_CID
-
-static int Dtls13AddCID(WOLFSSL* ssl, byte* flags, byte* out, word16* idx)
-{
- byte cidSz;
- int ret;
-
- if (!wolfSSL_dtls_cid_is_enabled(ssl))
- return 0;
-
- cidSz = DtlsGetCidTxSize(ssl);
-
- /* no cid */
- if (cidSz == 0)
- return 0;
- *flags |= DTLS13_CID_BIT;
- /* we know that we have at least cidSz of space */
- ret = wolfSSL_dtls_cid_get_tx(ssl, out + *idx, cidSz);
- if (ret != WOLFSSL_SUCCESS)
- return ret;
- *idx += cidSz;
- return 0;
-}
-
-static int Dtls13UnifiedHeaderParseCID(WOLFSSL* ssl, byte flags,
- const byte* input, word16 inputSize, word16* idx)
-{
- unsigned int _cidSz;
- int ret;
-
- if (flags & DTLS13_CID_BIT) {
- if (!wolfSSL_dtls_cid_is_enabled(ssl)) {
- WOLFSSL_MSG("CID while no negotiated CID, ignoring");
- return DTLS_CID_ERROR;
- }
-
- if (!DtlsCIDCheck(ssl, input + *idx, inputSize - *idx)) {
- WOLFSSL_MSG("Not matching or wrong CID, ignoring");
- return DTLS_CID_ERROR;
- }
-
- ret = wolfSSL_dtls_cid_get_rx_size(ssl, &_cidSz);
- if (ret != WOLFSSL_SUCCESS)
- return ret;
-
- *idx += (word16)_cidSz;
- return 0;
- }
-
- /* CID not present */
- if (wolfSSL_dtls_cid_is_enabled(ssl)) {
- ret = wolfSSL_dtls_cid_get_rx_size(ssl, &_cidSz);
- if (ret != WOLFSSL_SUCCESS)
- return ret;
-
- if (_cidSz != 0) {
- WOLFSSL_MSG("expecting CID, ignoring");
- return DTLS_CID_ERROR;
- }
- }
-
- return 0;
-}
-
-int Dtls13UnifiedHeaderCIDPresent(byte flags)
-{
- return Dtls13IsUnifiedHeader(flags) && (flags & DTLS13_CID_BIT);
-}
-
-#else
-#define Dtls13AddCID(a, b, c, d) 0
-#define Dtls13UnifiedHeaderParseCID(a, b, c, d, e) 0
-#endif /* WOLFSSL_DTLS_CID */
-
-/**
- * dtls13RlAddCiphertextHeader() - add record layer header in the buffer
- * @ssl: ssl object
- * @out: output buffer where to put the header
- * @length: length of the record
- */
-int Dtls13RlAddCiphertextHeader(WOLFSSL* ssl, byte* out, word16 length)
-{
- word16 seqNumber, idx;
- byte* flags;
- int ret;
-
- if (out == NULL)
- return BAD_FUNC_ARG;
-
- if (ssl->dtls13EncryptEpoch == NULL)
- return BAD_STATE_E;
-
- flags = out;
-
- /* header fixed bits */
- *flags = DTLS13_FIXED_BITS;
- /* epoch bits */
- *flags |= Dtls13GetEpochBits(ssl->dtls13EncryptEpoch->epochNumber);
-
- idx = DTLS13_HDR_FLAGS_SIZE;
- ret = Dtls13AddCID(ssl, flags, out, &idx);
- if (ret != 0)
- return ret;
-
- /* include 16-bit seq */
- *flags |= DTLS13_SEQ_LEN_BIT;
- /* include 16-bit length */
- *flags |= DTLS13_LEN_BIT;
-
- seqNumber = (word16)w64GetLow32(ssl->dtls13EncryptEpoch->nextSeqNumber);
- c16toa(seqNumber, out + idx);
- idx += OPAQUE16_LEN;
- c16toa(length, out + idx);
-
- return 0;
-}
-
-/**
- * Dtls13HandshakeAddHeader() - add handshake layer header
- * @ssl: ssl object
- * @output: output buffer
- * @msg_type: handshake type
- * @length: length of the message
- */
-int Dtls13HandshakeAddHeader(WOLFSSL* ssl, byte* output,
- enum HandShakeType msg_type, word32 length)
-{
- Dtls13HandshakeHeader* hdr;
-
- hdr = (Dtls13HandshakeHeader*)output;
-
- hdr->msg_type = msg_type;
- c32to24((word32)length, hdr->length);
- c16toa(ssl->keys.dtls_handshake_number, hdr->messageSeq);
-
- /* send unfragmented first */
- c32to24(0, hdr->fragmentOffset);
- c32to24((word32)length, hdr->fragmentLength);
-
- return 0;
-}
-
-int Dtls13MinimumRecordLength(WOLFSSL* ssl)
-{
- return Dtls13GetRlHeaderLength(ssl, 1) + DTLS13_MIN_CIPHERTEXT;
-}
-
-/**
- * Dtls13EncryptRecordNumber() - encrypt record number in the header
- * @ssl: ssl object
- * @hdr: header
- *
- * Further info rfc draft 43 sec 4.2.3
- */
-int Dtls13EncryptRecordNumber(WOLFSSL* ssl, byte* hdr, word16 recordLength)
-{
- int seqLength;
- int hdrLength;
- int cidSz;
-
- if (ssl == NULL || hdr == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef HAVE_NULL_CIPHER
- /* Do not encrypt record numbers with null cipher. See RFC 9150 Sec 9 */
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_cipher_null)
- return 0;
-#endif /*HAVE_NULL_CIPHER */
-
- /* we need at least a 16 bytes of ciphertext to encrypt record number see
- 4.2.3*/
- if (recordLength < Dtls13MinimumRecordLength(ssl))
- return BUFFER_ERROR;
-
- seqLength = (*hdr & DTLS13_LEN_BIT) ? DTLS13_SEQ_16_LEN : DTLS13_SEQ_8_LEN;
-
- cidSz = DtlsGetCidTxSize(ssl);
- /* header flags + seq number + CID size*/
- hdrLength = OPAQUE8_LEN + seqLength + cidSz;
-
- /* length present */
- if (*hdr & DTLS13_LEN_BIT)
- hdrLength += DTLS13_LEN_SIZE;
-
- return Dtls13EncryptDecryptRecordNumber(ssl,
- /* seq number offset */
- hdr + OPAQUE8_LEN + cidSz,
- /* seq size */
- seqLength,
- /* cipher text */
- hdr + hdrLength, PROTECT);
-}
-
-/**
- * Dtls13GetRlHeaderLength() - get record layer header length
- * @ssl: ssl object
- * @isEncrypted: whether the record will be protected or not
- *
- * returns the length of the record layer header in bytes.
- */
-word16 Dtls13GetRlHeaderLength(WOLFSSL* ssl, byte isEncrypted)
-{
- (void)ssl;
-
- if (!isEncrypted)
- return DTLS_RECORD_HEADER_SZ;
-
- return DTLS13_UNIFIED_HEADER_SIZE + DtlsGetCidTxSize(ssl);
-}
-
-/**
- * Dtls13GetHeadersLength() - return length of record + handshake header
- * @ssl: ssl object
- * @type: type of handshake in the message
- */
-word16 Dtls13GetHeadersLength(WOLFSSL* ssl, enum HandShakeType type)
-{
- byte isEncrypted;
-
- isEncrypted = Dtls13TypeIsEncrypted(type);
-
- return Dtls13GetRlHeaderLength(ssl, isEncrypted) + DTLS_HANDSHAKE_HEADER_SZ;
-}
-
-/**
- * Dtls13IsUnifiedHeader() - check if header is a DTLS unified header
- * @header_flags: first byte of the header
- *
- * Further info: dtls v1.3 draft43 section 4
- */
-int Dtls13IsUnifiedHeader(byte hdrFirstByte)
-{
- if (hdrFirstByte == alert || hdrFirstByte == handshake ||
- hdrFirstByte == ack)
- return 0;
-
- return ((hdrFirstByte & DTLS13_FIXED_BITS_MASK) == DTLS13_FIXED_BITS);
-}
-
-int Dtls13ReconstructSeqNumber(WOLFSSL* ssl, Dtls13UnifiedHdrInfo* hdrInfo,
- w64wrapper* out)
-{
- word16 expectedLowBits;
- word16 seqLowBits;
- w64wrapper temp;
- word32 out32;
- word32 shift;
- word16 mask;
- byte wrap = 0;
-
- if (hdrInfo->seqHiPresent) {
- seqLowBits = (hdrInfo->seqHi << 8) | hdrInfo->seqLo;
- mask = 0xffff;
- shift = (1 << 16);
- }
- else {
- seqLowBits = hdrInfo->seqLo;
- mask = 0xff;
- shift = (1 << 8);
- }
-
- /* *out = (nextPeerSeqNumber & ~mask) | seqLowbits */
- out32 = w64GetLow32(ssl->dtls13DecryptEpoch->nextPeerSeqNumber);
- expectedLowBits = out32 & mask;
- out32 = (out32 & ~mask) | seqLowBits;
- *out = ssl->dtls13DecryptEpoch->nextPeerSeqNumber;
- w64SetLow32(out, out32);
- if (seqLowBits >= expectedLowBits) {
- if ((word32)(seqLowBits - expectedLowBits) > shift / 2) {
- temp = w64Sub32(*out, shift, &wrap);
- if (!wrap)
- *out = temp;
- return 0;
- }
- }
- else {
- /* seqLowbits < expectedLowBits */
- if ((word32)(expectedLowBits - seqLowBits) > shift / 2) {
- temp = w64Add32(*out, shift, &wrap);
- if (!wrap)
- *out = temp;
- return 0;
- }
- }
-
- return 0;
-}
-
-int Dtls13ReconstructEpochNumber(WOLFSSL* ssl, byte epochBits,
- w64wrapper* epoch)
-{
- w64wrapper _epoch;
- Dtls13Epoch* e;
- byte found = 0;
- int i;
-
- if (Dtls13GetEpochBits(ssl->dtls13PeerEpoch) == epochBits) {
- *epoch = ssl->dtls13PeerEpoch;
- return 0;
- }
-
- w64Zero(&_epoch);
-
- for (i = 0; i < DTLS13_EPOCH_SIZE; ++i) {
- e = &ssl->dtls13Epochs[i];
-
- if (!e->isValid)
- continue;
-
- if (Dtls13GetEpochBits(e->epochNumber) != epochBits)
- continue;
-
- if (w64GT(e->epochNumber, _epoch)) {
- found = 1;
- _epoch = e->epochNumber;
- }
- }
-
- if (found) {
- *epoch = _epoch;
- return 0;
- }
-
- return SEQUENCE_ERROR;
-}
-
-int Dtls13GetUnifiedHeaderSize(WOLFSSL* ssl, const byte input, word16* size)
-{
- (void)ssl;
-
- if (size == NULL)
- return BAD_FUNC_ARG;
-
- /* flags (1) + CID + seq 8bit (1) */
- *size = OPAQUE8_LEN + DtlsGetCidRxSize(ssl) + OPAQUE8_LEN;
- if (input & DTLS13_SEQ_LEN_BIT)
- *size += OPAQUE8_LEN;
- if (input & DTLS13_LEN_BIT)
- *size += OPAQUE16_LEN;
-
- return 0;
-}
-
-/**
- * Dtls13ParseUnifiedRecordLayer() - parse DTLS unified header
- * @ssl: [in] ssl object
- * @input: [in] buffer where the header is
- * @inputSize: [in] size of the input buffer
- * @hdrInfo: [out] header info struct
- *
- * It parse the header and put the relevant information inside @hdrInfo. Further
- * info: draft43 section 4
- *
- * return 0 on success
- */
-int Dtls13ParseUnifiedRecordLayer(WOLFSSL* ssl, const byte* input,
- word16 inputSize, Dtls13UnifiedHdrInfo* hdrInfo)
-{
- byte seqLen, hasLength;
- byte* seqNum;
- byte flags;
- word16 idx;
- int ret;
-
- if (input == NULL || inputSize < DTLS13_HDR_FLAGS_SIZE)
- return BAD_FUNC_ARG;
-
- flags = *input;
- idx = DTLS13_HDR_FLAGS_SIZE;
- ret = Dtls13UnifiedHeaderParseCID(ssl, flags, input, inputSize, &idx);
- if (ret != 0)
- return ret;
-
- seqNum = (byte*)input + idx;
- seqLen = (flags & DTLS13_SEQ_LEN_BIT) != 0 ? DTLS13_SEQ_16_LEN
- : DTLS13_SEQ_8_LEN;
- hasLength = flags & DTLS13_LEN_BIT;
- hdrInfo->epochBits = flags & EE_MASK;
-
- idx += seqLen;
-
- if (inputSize < idx)
- return BUFFER_ERROR;
-
- if (hasLength) {
- if (inputSize < idx + DTLS13_LEN_SIZE)
- return BUFFER_ERROR;
-
- ato16(input + idx, &hdrInfo->recordLength);
- idx += DTLS13_LEN_SIZE;
- }
- else {
- /* length not present. The size of the record is the all the remaining
- data received with this datagram */
- hdrInfo->recordLength = inputSize - idx;
- }
-
- /* Do not encrypt record numbers with null cipher. See RFC 9150 Sec 9 */
- if (ssl->specs.bulk_cipher_algorithm != wolfssl_cipher_null)
- {
- /* minimum size for a dtls1.3 packet is 16 bytes (to have enough
- * ciphertext to create record number xor mask).
- * (draft 43 - Sec 4.2.3) */
- if (hdrInfo->recordLength < DTLS13_RN_MASK_SIZE)
- return LENGTH_ERROR;
- if (inputSize < idx + DTLS13_RN_MASK_SIZE)
- return BUFFER_ERROR;
-
- ret = Dtls13EncryptDecryptRecordNumber(ssl, seqNum, seqLen, input + idx,
- DEPROTECT);
- if (ret != 0)
- return ret;
- }
-
- if (seqLen == DTLS13_SEQ_16_LEN) {
- hdrInfo->seqHiPresent = 1;
- hdrInfo->seqHi = seqNum[0];
- hdrInfo->seqLo = seqNum[1];
- }
- else {
- hdrInfo->seqHiPresent = 0;
- hdrInfo->seqLo = seqNum[0];
- }
-
- return 0;
-}
-
-int Dtls13RecordRecvd(WOLFSSL* ssl)
-{
- int ret;
-
- if (ssl->curRL.type != handshake)
- return 0;
-
- if (!ssl->options.dtls13SendMoreAcks)
- ssl->dtls13FastTimeout = 1;
-
- ret = Dtls13RtxAddAck(ssl, ssl->keys.curEpoch64, ssl->keys.curSeq);
- if (ret != 0)
- WOLFSSL_MSG("can't save ack fragment");
-
- return ret;
-}
-
-static void Dtls13RtxMoveToEndOfList(WOLFSSL* ssl, Dtls13RtxRecord** prevNext,
- Dtls13RtxRecord* r)
-{
- /* already at the end */
- if (r->next == NULL)
- return;
-
- Dtls13RtxRecordUnlink(ssl, prevNext, r);
- /* add to the end */
- Dtls13RtxAddRecord(&ssl->dtls13Rtx, r);
-}
-
-static int Dtls13RtxSendBuffered(WOLFSSL* ssl)
-{
- word16 headerLength;
- Dtls13RtxRecord *r, **prevNext;
- w64wrapper seq;
- byte* output;
- int isLast;
- int sendSz;
-#ifndef NO_ASN_TIME
- word32 now;
-#endif
- int ret;
-
- WOLFSSL_ENTER("Dtls13RtxSendBuffered");
-
-#ifndef NO_ASN_TIME
- now = LowResTimer();
- if (now - ssl->dtls13Rtx.lastRtx < DTLS13_MIN_RTX_INTERVAL) {
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Avoid too fast retransmission");
-#endif /* WOLFSSL_DEBUG_TLS */
- return 0;
- }
-
- ssl->dtls13Rtx.lastRtx = now;
-#endif
-
- r = ssl->dtls13Rtx.rtxRecords;
- prevNext = &ssl->dtls13Rtx.rtxRecords;
- while (r != NULL) {
- isLast = r->next == NULL;
- WOLFSSL_MSG("Dtls13Rtx One Record");
-
- headerLength = Dtls13GetRlHeaderLength(ssl, !w64IsZero(r->epoch));
-
- sendSz = r->length + headerLength;
-
- if (!w64IsZero(r->epoch))
- sendSz += MAX_MSG_EXTRA;
-
- ret = CheckAvailableSize(ssl, sendSz);
- if (ret != 0)
- return ret;
-
- output = GetOutputBuffer(ssl);
-
- XMEMCPY(output + headerLength, r->data, r->length);
-
- if (!w64Equal(ssl->dtls13EncryptEpoch->epochNumber, r->epoch)) {
- ret = Dtls13SetEpochKeys(ssl, r->epoch, ENCRYPT_SIDE_ONLY);
- if (ret != 0)
- return ret;
- }
-
- seq = ssl->dtls13EncryptEpoch->nextSeqNumber;
-
- ret = Dtls13SendFragment(ssl, output, (word16)sendSz, r->length + headerLength,
- (enum HandShakeType)r->handshakeType, 0,
- isLast || !ssl->options.groupMessages);
- if (ret != 0 && ret != WC_NO_ERR_TRACE(WANT_WRITE))
- return ret;
-
- if (r->rnIdx >= DTLS13_RETRANS_RN_SIZE)
- r->rnIdx = 0;
-
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG_EX("tracking r hs: %d with seq: %ld", r->handshakeType,
- seq);
-#endif /* WOLFSSL_DEBUG_TLS */
-
- r->seq[r->rnIdx] = seq;
- r->rnIdx++;
-
- if (ret == WC_NO_ERR_TRACE(WANT_WRITE)) {
- /* this fragment will be sent eventually. Move it to the end of the
- list so next time we start with a new one. */
- Dtls13RtxMoveToEndOfList(ssl, prevNext, r);
- return ret;
- }
-
- prevNext = &r->next;
- r = r->next;
- }
-
- return 0;
-}
-
-static int Dtls13AcceptFragmented(WOLFSSL *ssl, enum HandShakeType type)
-{
- if (IsEncryptionOn(ssl, 0))
- return 1;
- if (ssl->options.side == WOLFSSL_CLIENT_END && type == server_hello)
- return 1;
-#ifdef WOLFSSL_DTLS_CH_FRAG
- if (ssl->options.side == WOLFSSL_SERVER_END && type == client_hello &&
- ssl->options.dtls13ChFrag && ssl->options.dtlsStateful)
- return 1;
-#endif
- return 0;
-}
-
-int Dtls13CheckEpoch(WOLFSSL* ssl, enum HandShakeType type)
-{
- w64wrapper plainEpoch = w64From32(0x0, 0x0);
- w64wrapper hsEpoch = w64From32(0x0, DTLS13_EPOCH_HANDSHAKE);
- w64wrapper t0Epoch = w64From32(0x0, DTLS13_EPOCH_TRAFFIC0);
-
- if (IsAtLeastTLSv1_3(ssl->version)) {
- switch (type) {
- case client_hello:
- case server_hello:
- case hello_verify_request:
- case hello_retry_request:
- case hello_request:
- if (!w64Equal(ssl->keys.curEpoch64, plainEpoch)) {
- WOLFSSL_MSG("Msg should be epoch 0");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- break;
- case encrypted_extensions:
- case server_key_exchange:
- case server_hello_done:
- case client_key_exchange:
- if (!w64Equal(ssl->keys.curEpoch64, hsEpoch)) {
- if (ssl->options.side == WOLFSSL_CLIENT_END &&
- ssl->options.serverState < SERVER_HELLO_COMPLETE) {
- /* before processing SH we don't know which version
- * will be negotiated. */
- if (!w64Equal(ssl->keys.curEpoch64, plainEpoch)) {
- WOLFSSL_MSG("Msg should be epoch 2 or 0");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- else {
- WOLFSSL_MSG("Msg should be epoch 2");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- break;
- case certificate_request:
- case certificate:
- case certificate_verify:
- case finished:
- if (!ssl->options.handShakeDone) {
- if (!w64Equal(ssl->keys.curEpoch64, hsEpoch)) {
- if (ssl->options.side == WOLFSSL_CLIENT_END &&
- ssl->options.serverState < SERVER_HELLO_COMPLETE) {
- /* before processing SH we don't know which version
- * will be negotiated. */
- if (!w64Equal(ssl->keys.curEpoch64, plainEpoch)) {
- WOLFSSL_MSG("Msg should be epoch 2 or 0");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- else {
- WOLFSSL_MSG("Msg should be epoch 2");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- }
- else {
- /* Allow epoch 2 in case of rtx */
- if (!w64GTE(ssl->keys.curEpoch64, hsEpoch)) {
- WOLFSSL_MSG("Msg should be epoch 2+");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- break;
- case certificate_status:
- case change_cipher_hs:
- case key_update:
- case session_ticket:
- if (!w64GTE(ssl->keys.curEpoch64, t0Epoch)) {
- WOLFSSL_MSG("Msg should be epoch 3+");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- break;
- case end_of_early_data:
- case message_hash:
- case no_shake:
- default:
- WOLFSSL_MSG("Unknown message type");
- WOLFSSL_ERROR_VERBOSE(SANITY_MSG_E);
- return SANITY_MSG_E;
- }
- }
- return 0;
-}
-
-/**
- * Dtls13HandshakeRecv() - process an handshake message. Deal with
- fragmentation if needed
- * @ssl: [in] ssl object
- * @input: [in] input buffer
- * @size: [in] input buffer size
- * @type: [out] content type
- * @processedSize: [out] amount of byte processed
- *
- * returns 0 on success
- */
-static int _Dtls13HandshakeRecv(WOLFSSL* ssl, byte* input, word32 size,
- word32* processedSize)
-{
- word32 fragOff, fragLength;
- byte isComplete, isFirst;
- byte usingAsyncCrypto;
- word32 messageLength;
- byte handshakeType;
- word32 idx;
- int ret;
-
- idx = 0;
- ret = GetDtlsHandShakeHeader(ssl, input, &idx, &handshakeType,
- &messageLength, &fragOff, &fragLength, size);
- if (ret != 0)
- return PARSE_ERROR;
-
- /* Need idx + fragLength as we don't advance the inputBuffer idx value */
- ret = EarlySanityCheckMsgReceived(ssl, handshakeType, idx + fragLength);
- if (ret != 0) {
- WOLFSSL_ERROR(ret);
- return ret;
- }
-
- ret = Dtls13CheckEpoch(ssl, (enum HandShakeType)handshakeType);
- if (ret != 0) {
- WOLFSSL_ERROR(ret);
- return ret;
- }
-
- if (ssl->options.side == WOLFSSL_SERVER_END &&
- ssl->options.acceptState < TLS13_ACCEPT_FIRST_REPLY_DONE) {
- if (handshakeType != client_hello) {
- WOLFSSL_MSG("Ignoring other messages before we verify a ClientHello");
- *processedSize = size;
- return 0;
- }
- /* To be able to operate in stateless mode, we assume the ClientHello
- * is in order and we use its Handshake Message number and Sequence
- * Number for our Tx. */
- ssl->keys.dtls_expected_peer_handshake_number =
- ssl->keys.dtls_handshake_number =
- ssl->keys.dtls_peer_handshake_number;
- ssl->dtls13Epochs[0].nextSeqNumber = ssl->keys.curSeq;
- }
-
- if (idx + fragLength > size) {
- WOLFSSL_ERROR(INCOMPLETE_DATA);
- return INCOMPLETE_DATA;
- }
-
- if (fragOff + fragLength > messageLength)
- return BUFFER_ERROR;
-
- ret = Dtls13RtxMsgRecvd(ssl, (enum HandShakeType)handshakeType, fragOff);
- if (ret != 0)
- return ret;
-
- if (ssl->keys.dtls_peer_handshake_number <
- ssl->keys.dtls_expected_peer_handshake_number) {
-
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG(
- "DTLS1.3 retransmission detected - discard and schedule a rtx");
-#endif /* WOLFSSL_DEBUG_TLS */
-
- /* ignore the message */
- *processedSize = idx + fragLength + ssl->keys.padSz;
-
- return 0;
- }
-
- isFirst = fragOff == 0;
- isComplete = isFirst && fragLength == messageLength;
-
- if (!isComplete && !Dtls13AcceptFragmented(ssl, (enum HandShakeType)handshakeType)) {
-#ifdef WOLFSSL_DTLS_CH_FRAG
- byte tls13 = 0;
- /* check if the first CH fragment contains a valid cookie */
- if (ssl->options.dtls13ChFrag && !ssl->options.dtlsStateful &&
- isFirst && handshakeType == client_hello &&
- DoClientHelloStateless(ssl, input + idx, fragLength, 1, &tls13)
- == 0 && tls13) {
- /* We can save this message and continue as stateful. */
- if (ssl->chGoodCb != NULL) {
- int cbret = ssl->chGoodCb(ssl, ssl->chGoodCtx);
- if (cbret < 0) {
- ssl->error = cbret;
- WOLFSSL_MSG("ClientHello Good Cb don't continue error");
- return WOLFSSL_FATAL_ERROR;
- }
- }
- WOLFSSL_MSG("ClientHello fragment verified");
- }
- else
-#endif
- {
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("DTLS1.3 not accepting fragmented plaintext message");
-#endif /* WOLFSSL_DEBUG_TLS */
- /* ignore the message */
- *processedSize = idx + fragLength + ssl->keys.padSz;
- return 0;
- }
- }
-
- usingAsyncCrypto = ssl->devId != INVALID_DEVID;
-
- /* store the message if any of the following: (a) incomplete message, (b)
- * out of order message or (c) if using async crypto. In (c) the processing
- * of the message can return WC_PENDING_E, it's easier to handle this error
- * if the message is stored in the buffer.
- */
- if (!isComplete ||
- ssl->keys.dtls_peer_handshake_number >
- ssl->keys.dtls_expected_peer_handshake_number ||
- usingAsyncCrypto) {
- if (ssl->dtls_rx_msg_list_sz < DTLS_POOL_SZ) {
- DtlsMsgStore(ssl, (word16)w64GetLow32(ssl->keys.curEpoch64),
- ssl->keys.dtls_peer_handshake_number,
- input + DTLS_HANDSHAKE_HEADER_SZ, messageLength, handshakeType,
- fragOff, fragLength, ssl->heap);
- }
- else {
- /* DTLS_POOL_SZ outstanding messages is way more than enough for any
- * valid peer */
- return DTLS_TOO_MANY_FRAGMENTS_E;
- }
-
- *processedSize = idx + fragLength + ssl->keys.padSz;
- if (Dtls13NextMessageComplete(ssl))
- return Dtls13ProcessBufferedMessages(ssl);
-
- return 0;
- }
-
- ret = DoTls13HandShakeMsgType(ssl, input, &idx, handshakeType,
- messageLength, size);
- *processedSize = idx;
- if (ret != 0)
- return ret;
-
- Dtls13MsgWasProcessed(ssl, (enum HandShakeType)handshakeType);
-
- /* check if we have buffered some message */
- if (Dtls13NextMessageComplete(ssl))
- return Dtls13ProcessBufferedMessages(ssl);
-
- return 0;
-}
-
-int Dtls13HandshakeRecv(WOLFSSL* ssl, byte* input, word32* inOutIdx,
- word32 totalSz)
-{
- word32 maxSize, processedSize = 0;
- byte* message;
- int ret;
-
- message = input + *inOutIdx;
- maxSize = totalSz - *inOutIdx;
-
- ret = _Dtls13HandshakeRecv(ssl, message, maxSize, &processedSize);
-
- *inOutIdx += processedSize;
-
- return ret;
-}
-
-/**
- * Dtls13FragmentsContinue() - keep sending pending fragments
- * @ssl: ssl object
- */
-int Dtls13FragmentsContinue(WOLFSSL* ssl)
-{
- int ret;
-
- ret = Dtls13SendFragmentedInternal(ssl);
- if (ret == 0)
- ssl->keys.dtls_handshake_number++;
-
- return ret;
-}
-
-/**
- * Dtls13AddHeaders() - setup handshake header
- * @output: output buffer at the start of the record
- * @length: length of the full message, included headers
- * @hsType: handshake type
- * @ssl: ssl object
- *
- * This function add the handshake headers and leaves space for the record
- * layer. The real record layer will be added in dtls_send() for unprotected
- * messages and in BuildTls13message() for protected messages.
- *
- * returns 0 on success, -1 otherwise
- */
-int Dtls13AddHeaders(byte* output, word32 length, enum HandShakeType hsType,
- WOLFSSL* ssl)
-{
- word16 handshakeOffset;
- byte isEncrypted;
-
- isEncrypted = Dtls13TypeIsEncrypted(hsType);
- handshakeOffset = Dtls13GetRlHeaderLength(ssl, isEncrypted);
-
- /* The record header is placed by either Dtls13HandshakeSend() or
- BuildTls13Message() */
-
- return Dtls13HandshakeAddHeader(ssl, output + handshakeOffset, hsType,
- length);
-}
-
-/**
- * Dtls13HandshakeSend() - send an handshake message. Fragment if necessary.
- *
- * @ssl: ssl object
- * @message: message where the buffer is in. Handshake header already in place.
- * @output_size: size of the @message buffer
- * @length: length of the message including headers
- * @handshakeType: handshake type of the message
- * @hashOutput: if true add the message to the transcript hash
- *
- */
-int Dtls13HandshakeSend(WOLFSSL* ssl, byte* message, word16 outputSize,
- word16 length, enum HandShakeType handshakeType, int hashOutput)
-{
- int maxFrag;
- int maxLen;
- int ret;
-
- if (ssl->dtls13EncryptEpoch == NULL)
- return BAD_STATE_E;
-
- /* if we are here, the message is built */
- ssl->options.buildingMsg = 0;
-
- if (!ssl->options.handShakeDone) {
-
- /* during the handshake, if we are sending a new flight, we can flush
- our ACK list. When sending client
- [certificate/certificate_verify]/finished flight, we may flush an ACK
- for a newSessionticket message, sent by the server just after sending
- its finished message. This should not be a problem. That message
- arrived out-of-order (before the server finished) so likely an ACK
- was already sent. In the worst case we will ACK the server
- retranmission*/
- if (handshakeType == certificate || handshakeType == finished ||
- handshakeType == server_hello || handshakeType == client_hello)
- Dtls13RtxFlushAcks(ssl);
- }
-
- /* we want to send always with the highest epoch */
- if (!w64Equal(ssl->dtls13EncryptEpoch->epochNumber, ssl->dtls13Epoch)) {
- ret = Dtls13SetEpochKeys(ssl, ssl->dtls13Epoch, ENCRYPT_SIDE_ONLY);
- if (ret != 0)
- return ret;
- }
-
- maxFrag = wolfSSL_GetMaxFragSize(ssl, MAX_RECORD_SIZE);
- maxLen = length;
-
- if (handshakeType == key_update)
- ssl->dtls13WaitKeyUpdateAck = 1;
-
- if (maxLen < maxFrag) {
- ret = Dtls13SendOneFragmentRtx(ssl, handshakeType, outputSize, message,
- length, hashOutput);
- if (ret == 0 || ret == WC_NO_ERR_TRACE(WANT_WRITE))
- ssl->keys.dtls_handshake_number++;
- }
- else {
- ret = Dtls13SendFragmented(ssl, message, length, handshakeType,
- hashOutput);
- if (ret == 0)
- ssl->keys.dtls_handshake_number++;
- }
-
- return ret;
-}
-
-#define SN_LABEL_SZ 2
-static const byte snLabel[SN_LABEL_SZ + 1] = "sn";
-
-/**
- * Dtls13DeriveSnKeys() - derive the key used to encrypt the record number
- * @ssl: ssl object
- * @provision: which side (CLIENT or SERVER) to provision
- */
-int Dtls13DeriveSnKeys(WOLFSSL* ssl, int provision)
-{
- byte key_dig[MAX_PRF_DIG];
- int ret = 0;
-
- if (provision & PROVISION_CLIENT) {
- WOLFSSL_MSG("Derive SN Client key");
- ret = Tls13DeriveKey(ssl, key_dig, ssl->specs.key_size,
- ssl->clientSecret, snLabel, SN_LABEL_SZ, ssl->specs.mac_algorithm,
- 0, WOLFSSL_CLIENT_END);
- if (ret != 0)
- goto end;
-
- XMEMCPY(ssl->keys.client_sn_key, key_dig, ssl->specs.key_size);
- }
-
- if (provision & PROVISION_SERVER) {
- WOLFSSL_MSG("Derive SN Server key");
- ret = Tls13DeriveKey(ssl, key_dig, ssl->specs.key_size,
- ssl->serverSecret, snLabel, SN_LABEL_SZ, ssl->specs.mac_algorithm,
- 0, WOLFSSL_SERVER_END);
- if (ret != 0)
- goto end;
-
- XMEMCPY(ssl->keys.server_sn_key, key_dig, ssl->specs.key_size);
- }
-
-end:
- ForceZero(key_dig, MAX_PRF_DIG);
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(key_dig, sizeof(key_dig));
-#endif
- return ret;
-}
-
-static int Dtls13InitAesCipher(WOLFSSL* ssl, RecordNumberCiphers* cipher,
- const byte* key, word16 keySize)
-{
- int ret;
- if (cipher->aes == NULL) {
- cipher->aes =
- (Aes*)XMALLOC(sizeof(Aes), ssl->heap, DYNAMIC_TYPE_CIPHER);
- if (cipher->aes == NULL)
- return MEMORY_E;
- }
- else {
- wc_AesFree(cipher->aes);
- }
-
- XMEMSET(cipher->aes, 0, sizeof(*cipher->aes));
-
- ret = wc_AesInit(cipher->aes, ssl->heap, INVALID_DEVID);
- if (ret != 0)
- return ret;
-
- return wc_AesSetKey(cipher->aes, key, keySize, NULL, AES_ENCRYPTION);
-}
-
-#ifdef HAVE_CHACHA
-static int Dtls13InitChaChaCipher(RecordNumberCiphers* c, byte* key,
- word16 keySize, void* heap)
-{
- (void)heap;
-
- if (c->chacha == NULL) {
- c->chacha = (ChaCha*)XMALLOC(sizeof(ChaCha), heap, DYNAMIC_TYPE_CIPHER);
-
- if (c->chacha == NULL)
- return MEMORY_E;
- }
-
- return wc_Chacha_SetKey(c->chacha, key, keySize);
-}
-#endif /* HAVE_CHACHA */
-
-struct Dtls13Epoch* Dtls13GetEpoch(WOLFSSL* ssl, w64wrapper epochNumber)
-{
- Dtls13Epoch* e;
- int i;
-
- for (i = 0; i < DTLS13_EPOCH_SIZE; ++i) {
- e = &ssl->dtls13Epochs[i];
- if (w64Equal(e->epochNumber, epochNumber) && e->isValid)
- return e;
- }
-
- return NULL;
-}
-
-void Dtls13SetOlderEpochSide(WOLFSSL* ssl, w64wrapper epochNumber,
- int side)
-{
- Dtls13Epoch* e;
- int i;
-
- for (i = 0; i < DTLS13_EPOCH_SIZE; ++i) {
- e = &ssl->dtls13Epochs[i];
- if (e->isValid && w64LT(e->epochNumber, epochNumber)) {
- e->side = (byte)side;
- }
- }
-}
-
-static void Dtls13EpochCopyKeys(WOLFSSL* ssl, Dtls13Epoch* e, Keys* k, int side)
-{
- byte clientWrite, serverWrite;
- byte enc, dec;
-
- WOLFSSL_ENTER("Dtls13SetEpochKeys");
-
- clientWrite = serverWrite = 0;
- enc = dec = 0;
- switch (side) {
-
- case ENCRYPT_SIDE_ONLY:
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- clientWrite = 1;
- if (ssl->options.side == WOLFSSL_SERVER_END)
- serverWrite = 1;
- enc = 1;
- break;
-
- case DECRYPT_SIDE_ONLY:
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- serverWrite = 1;
- if (ssl->options.side == WOLFSSL_SERVER_END)
- clientWrite = 1;
- dec = 1;
- break;
-
- case ENCRYPT_AND_DECRYPT_SIDE:
- clientWrite = serverWrite = 1;
- enc = dec = 1;
- break;
- }
-
- if (clientWrite) {
- XMEMCPY(e->client_write_key, k->client_write_key,
- sizeof(e->client_write_key));
-
- XMEMCPY(e->client_write_IV, k->client_write_IV,
- sizeof(e->client_write_IV));
-
- XMEMCPY(e->client_sn_key, k->client_sn_key, sizeof(e->client_sn_key));
- }
-
- if (serverWrite) {
- XMEMCPY(e->server_write_key, k->server_write_key,
- sizeof(e->server_write_key));
- XMEMCPY(e->server_write_IV, k->server_write_IV,
- sizeof(e->server_write_IV));
- XMEMCPY(e->server_sn_key, k->server_sn_key, sizeof(e->server_sn_key));
- }
-
- if (enc)
- XMEMCPY(e->aead_enc_imp_IV, k->aead_enc_imp_IV,
- sizeof(e->aead_enc_imp_IV));
-
- if (dec)
- XMEMCPY(e->aead_dec_imp_IV, k->aead_dec_imp_IV,
- sizeof(e->aead_dec_imp_IV));
-}
-
-/* For storing the sequence number we use a word32[2] array here, instead of
- word64. This is to reuse existing code */
-int Dtls13GetSeq(WOLFSSL* ssl, int order, word32* seq, byte increment)
-{
- w64wrapper* nativeSeq;
-
- if (order == PEER_ORDER) {
- nativeSeq = &ssl->keys.curSeq;
- /* never increment seq number for current record. In DTLS seq number are
- explicit */
- increment = 0;
- }
- else if (order == CUR_ORDER) {
-
- if (ssl->dtls13EncryptEpoch == NULL) {
- return BAD_STATE_E;
- }
-
- nativeSeq = &ssl->dtls13EncryptEpoch->nextSeqNumber;
- }
- else {
- return BAD_FUNC_ARG;
- }
-
- seq[0] = w64GetHigh32(*nativeSeq);
- seq[1] = w64GetLow32(*nativeSeq);
-
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG_EX("Dtls13GetSeq(): using seq: %ld", *nativeSeq);
-#endif /* WOLFSSL_DEBUG_TLS */
-
- if (increment) {
- w64Increment(nativeSeq);
-
- /* seq number wrapped up */
- if (w64IsZero(*nativeSeq))
- return BAD_STATE_E;
- }
-
- return 0;
-}
-
-static Dtls13Epoch* Dtls13NewEpochSlot(WOLFSSL* ssl)
-{
- Dtls13Epoch *e, *oldest = NULL;
- w64wrapper oldestNumber;
- int i;
-
- /* FIXME: add max function */
- oldestNumber = w64From32((word32)-1, (word32)-1);
- oldest = NULL;
-
- for (i = 0; i < DTLS13_EPOCH_SIZE; ++i) {
- e = &ssl->dtls13Epochs[i];
- if (!e->isValid)
- return e;
-
- if (!w64Equal(e->epochNumber, ssl->dtls13Epoch) &&
- !w64Equal(e->epochNumber, ssl->dtls13PeerEpoch) &&
- w64LT(e->epochNumber, oldestNumber))
- oldest = e;
- }
-
- if (oldest == NULL)
- return NULL;
-
- e = oldest;
-
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG_EX("Delete epoch: %d", e->epochNumber);
-#endif /* WOLFSSL_DEBUG_TLS */
-
- XMEMSET(e, 0, sizeof(*e));
-
- return e;
-}
-
-int Dtls13NewEpoch(WOLFSSL* ssl, w64wrapper epochNumber, int side)
-{
- Dtls13Epoch* e;
-
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG_EX("New epoch: %d", w64GetLow32(epochNumber));
-#endif /* WOLFSSL_DEBUG_TLS */
-
- e = Dtls13GetEpoch(ssl, epochNumber);
- if (e == NULL) {
- e = Dtls13NewEpochSlot(ssl);
- if (e == NULL)
- return BAD_STATE_E;
- }
-
- Dtls13EpochCopyKeys(ssl, e, &ssl->keys, side);
-
- if (!e->isValid) {
- /* fresh epoch, initialize fields */
- e->epochNumber = epochNumber;
- e->isValid = 1;
- e->side = (byte)side;
- }
- else if (e->side != side) {
- /* epoch used for the other side already. update side */
- e->side = ENCRYPT_AND_DECRYPT_SIDE;
- }
-
- /* Once handshake is done. Mark epochs older than the last one as encrypt
- * only so that they can't be used for decryption. */
- if (ssl->options.handShakeDone && (e->side == ENCRYPT_AND_DECRYPT_SIDE ||
- e->side == DECRYPT_SIDE_ONLY)) {
- w64Decrement(&epochNumber);
- Dtls13SetOlderEpochSide(ssl, epochNumber, ENCRYPT_SIDE_ONLY);
- }
-
- return 0;
-}
-
-int Dtls13SetEpochKeys(WOLFSSL* ssl, w64wrapper epochNumber,
- enum encrypt_side side)
-{
- byte clientWrite, serverWrite;
- Dtls13Epoch* e;
- byte enc, dec;
-
- WOLFSSL_ENTER("Dtls13SetEpochKeys");
-
- clientWrite = serverWrite = 0;
- enc = dec = 0;
- switch (side) {
-
- case ENCRYPT_SIDE_ONLY:
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- clientWrite = 1;
- if (ssl->options.side == WOLFSSL_SERVER_END)
- serverWrite = 1;
- enc = 1;
- break;
-
- case DECRYPT_SIDE_ONLY:
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- serverWrite = 1;
- if (ssl->options.side == WOLFSSL_SERVER_END)
- clientWrite = 1;
- dec = 1;
- break;
-
- case ENCRYPT_AND_DECRYPT_SIDE:
- clientWrite = serverWrite = 1;
- enc = dec = 1;
- break;
- }
-
- e = Dtls13GetEpoch(ssl, epochNumber);
- /* we don't have the requested key */
- if (e == NULL)
- return BAD_STATE_E;
-
- if (e->side != ENCRYPT_AND_DECRYPT_SIDE && e->side != side)
- return BAD_STATE_E;
-
- if (enc)
- ssl->dtls13EncryptEpoch = e;
- if (dec)
- ssl->dtls13DecryptEpoch = e;
-
- /* epoch 0 has no key to copy */
- if (w64IsZero(epochNumber))
- return 0;
-
- if (clientWrite) {
- XMEMCPY(ssl->keys.client_write_key, e->client_write_key,
- sizeof(ssl->keys.client_write_key));
-
- XMEMCPY(ssl->keys.client_write_IV, e->client_write_IV,
- sizeof(ssl->keys.client_write_IV));
-
- XMEMCPY(ssl->keys.client_sn_key, e->client_sn_key,
- sizeof(ssl->keys.client_sn_key));
- }
-
- if (serverWrite) {
- XMEMCPY(ssl->keys.server_write_key, e->server_write_key,
- sizeof(ssl->keys.server_write_key));
-
- XMEMCPY(ssl->keys.server_write_IV, e->server_write_IV,
- sizeof(ssl->keys.server_write_IV));
-
- XMEMCPY(ssl->keys.server_sn_key, e->server_sn_key,
- sizeof(ssl->keys.server_sn_key));
- }
-
- if (enc)
- XMEMCPY(ssl->keys.aead_enc_imp_IV, e->aead_enc_imp_IV,
- sizeof(ssl->keys.aead_enc_imp_IV));
- if (dec)
- XMEMCPY(ssl->keys.aead_dec_imp_IV, e->aead_dec_imp_IV,
- sizeof(ssl->keys.aead_dec_imp_IV));
-
- return SetKeysSide(ssl, side);
-}
-
-int Dtls13SetRecordNumberKeys(WOLFSSL* ssl, enum encrypt_side side)
-{
- RecordNumberCiphers* enc = NULL;
- RecordNumberCiphers* dec = NULL;
- byte *encKey = NULL, *decKey = NULL;
- int ret;
-
- if (ssl == NULL) {
- return BAD_FUNC_ARG;
- }
-
- switch (side) {
- case ENCRYPT_SIDE_ONLY:
- enc = &ssl->dtlsRecordNumberEncrypt;
- break;
- case DECRYPT_SIDE_ONLY:
- dec = &ssl->dtlsRecordNumberDecrypt;
- break;
- case ENCRYPT_AND_DECRYPT_SIDE:
- enc = &ssl->dtlsRecordNumberEncrypt;
- dec = &ssl->dtlsRecordNumberDecrypt;
- break;
- }
-
- if (enc) {
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- encKey = ssl->keys.client_sn_key;
- else
- encKey = ssl->keys.server_sn_key;
- }
-
- if (dec) {
- if (ssl->options.side == WOLFSSL_CLIENT_END)
- decKey = ssl->keys.server_sn_key;
- else
- decKey = ssl->keys.client_sn_key;
- }
-
- /* DTLSv1.3 supports only AEAD algorithm. */
-#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm ||
- ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm) {
-
- if (enc) {
- ret = Dtls13InitAesCipher(ssl, enc, encKey, ssl->specs.key_size);
- if (ret != 0)
- return ret;
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Provisioning AES Record Number enc key:");
- WOLFSSL_BUFFER(encKey, ssl->specs.key_size);
-#endif /* WOLFSSL_DEBUG_TLS */
- }
-
- if (dec) {
- ret = Dtls13InitAesCipher(ssl, dec, decKey, ssl->specs.key_size);
- if (ret != 0)
- return ret;
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Provisioning AES Record Number dec key:");
- WOLFSSL_BUFFER(decKey, ssl->specs.key_size);
-#endif /* WOLFSSL_DEBUG_TLS */
- }
-
- return 0;
- }
-#endif /* BUILD_AESGCM || HAVE_AESCCM */
-
-#ifdef HAVE_CHACHA
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_chacha) {
- if (enc) {
- ret = Dtls13InitChaChaCipher(enc, encKey, ssl->specs.key_size,
- ssl->heap);
- if (ret != 0)
- return ret;
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Provisioning CHACHA Record Number enc key:");
- WOLFSSL_BUFFER(encKey, ssl->specs.key_size);
-#endif /* WOLFSSL_DEBUG_TLS */
- }
-
- if (dec) {
- ret = Dtls13InitChaChaCipher(dec, decKey, ssl->specs.key_size,
- ssl->heap);
- if (ret != 0)
- return ret;
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Provisioning CHACHA Record Number dec key:");
- WOLFSSL_BUFFER(decKey, ssl->specs.key_size);
-#endif /* WOLFSSL_DEBUG_TLS */
- }
-
- return 0;
- }
-#endif /* HAVE_CHACHA */
-
-#ifdef HAVE_NULL_CIPHER
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_cipher_null) {
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("Skipping Record Number key provisioning with null cipher");
-#endif /* WOLFSSL_DEBUG_TLS */
- return 0;
- }
-#endif /* HAVE_NULL_CIPHER */
-
- return NOT_COMPILED_IN;
-}
-
-/* 64 bits epoch + 64 bits sequence */
-#define DTLS13_RN_SIZE 16
-
-static int Dtls13GetAckListLength(Dtls13RecordNumber* list, word16* length)
-{
- int numberElements;
-
- numberElements = 0;
-
- /* TODO: check that we don't exceed the maximum length */
-
- while (list != NULL) {
- list = list->next;
- numberElements++;
- }
-
- *length = (word16)(DTLS13_RN_SIZE * numberElements);
- return 0;
-}
-
-int Dtls13WriteAckMessage(WOLFSSL* ssl,
- Dtls13RecordNumber* recordNumberList, word32* length)
-{
- word16 msgSz, headerLength;
- byte *output, *ackMessage;
- word32 sendSz;
- int ret;
-
- sendSz = 0;
-
- if (ssl->dtls13EncryptEpoch == NULL)
- return BAD_STATE_E;
-
- if (w64IsZero(ssl->dtls13EncryptEpoch->epochNumber)) {
- /* unprotected ACK */
- headerLength = DTLS_RECORD_HEADER_SZ;
- }
- else {
- headerLength = Dtls13GetRlHeaderLength(ssl, 1);
- sendSz += MAX_MSG_EXTRA;
- }
-
- ret = Dtls13GetAckListLength(recordNumberList, &msgSz);
- if (ret != 0)
- return ret;
-
- sendSz += headerLength;
-
- /* ACK list 2 bytes length field */
- sendSz += OPAQUE16_LEN;
-
- /* ACK list */
- sendSz += msgSz;
-
- ret = CheckAvailableSize(ssl, sendSz);
- if (ret != 0)
- return ret;
-
- output = GetOutputBuffer(ssl);
-
- ackMessage = output + headerLength;
-
- c16toa(msgSz, ackMessage);
- ackMessage += OPAQUE16_LEN;
-
- WOLFSSL_MSG("write ack records");
-
- while (recordNumberList != NULL) {
- WOLFSSL_MSG_EX("epoch %d seq %d", recordNumberList->epoch,
- recordNumberList->seq);
- c64toa(&recordNumberList->epoch, ackMessage);
- ackMessage += OPAQUE64_LEN;
- c64toa(&recordNumberList->seq, ackMessage);
- ackMessage += OPAQUE64_LEN;
- recordNumberList = recordNumberList->next;
- }
-
- *length = msgSz + OPAQUE16_LEN;
-
- return 0;
-}
-
-static int Dtls13RtxIsTrackedByRn(const Dtls13RtxRecord* r, w64wrapper epoch,
- w64wrapper seq)
-{
- int i;
- if (!w64Equal(r->epoch, epoch))
- return 0;
-
- for (i = 0; i < r->rnIdx; ++i) {
- if (w64Equal(r->seq[i], seq))
- return 1;
- }
-
- return 0;
-}
-
-static int Dtls13KeyUpdateAckReceived(WOLFSSL* ssl)
-{
- int ret;
-
- ret = DeriveTls13Keys(ssl, update_traffic_key, ENCRYPT_SIDE_ONLY, 1);
- if (ret != 0)
- return ret;
-
- w64Increment(&ssl->dtls13Epoch);
-
- /* Epoch wrapped up */
- if (w64IsZero(ssl->dtls13Epoch))
- return BAD_STATE_E;
-
- return Dtls13SetEpochKeys(ssl, ssl->dtls13Epoch, ENCRYPT_SIDE_ONLY);
-}
-
-#ifdef WOLFSSL_DEBUG_TLS
-static void Dtls13PrintRtxRecord(Dtls13RtxRecord* r)
-{
- int i;
-
- WOLFSSL_MSG_EX("r: hs: %d epoch: %ld", r->handshakeType, r->epoch);
- for (i = 0; i < r->rnIdx; i++)
- WOLFSSL_MSG_EX("seq: %ld", r->seq[i]);
-}
-#endif /* WOLFSSL_DEBUG_TLS */
-
-static void Dtls13RtxRemoveRecord(WOLFSSL* ssl, w64wrapper epoch,
- w64wrapper seq)
-{
- Dtls13RtxRecord *r, **prevNext;
-
- prevNext = &ssl->dtls13Rtx.rtxRecords;
- r = ssl->dtls13Rtx.rtxRecords;
-
- while (r != NULL) {
-#ifdef WOLFSSL_DEBUG_TLS
- Dtls13PrintRtxRecord(r);
-#endif /* WOLFSSL_DEBUG_TLS */
-
- if (Dtls13RtxIsTrackedByRn(r, epoch, seq)) {
-#ifdef WOLFSSL_DEBUG_TLS
- WOLFSSL_MSG("removing record");
-#endif /* WOLFSSL_DEBUG_TLS */
- Dtls13RtxRecordUnlink(ssl, prevNext, r);
- Dtls13FreeRtxBufferRecord(ssl, r);
- return;
- }
- prevNext = &r->next;
- r = r->next;
- }
-
- return;
-}
-
-int Dtls13DoScheduledWork(WOLFSSL* ssl)
-{
- int ret;
- int sendAcks;
-
- WOLFSSL_ENTER("Dtls13DoScheduledWork");
-
- ssl->dtls13SendingAckOrRtx = 1;
-
-#ifdef WOLFSSL_RW_THREADED
- ret = wc_LockMutex(&ssl->dtls13Rtx.mutex);
- if (ret < 0)
- return ret;
-#endif
- sendAcks = ssl->dtls13Rtx.sendAcks;
- if (sendAcks) {
- ssl->dtls13Rtx.sendAcks = 0;
- }
-#ifdef WOLFSSL_RW_THREADED
- ret = wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
-#endif
- if (sendAcks) {
- ret = SendDtls13Ack(ssl);
- if (ret != 0)
- return ret;
- }
-
- if (ssl->dtls13Rtx.retransmit) {
- ssl->dtls13Rtx.retransmit = 0;
- ret = Dtls13RtxSendBuffered(ssl);
- if (ret != 0)
- return ret;
- }
-
- ssl->dtls13SendingAckOrRtx = 0;
-
- if (ssl->dtls13DoKeyUpdate) {
- ssl->dtls13DoKeyUpdate = 0;
- ret = Tls13UpdateKeys(ssl);
- if (ret != 0)
- return ret;
- }
-
- return 0;
-}
-
-/* Send ACKs when available after a timeout but only retransmit the last
- * flight after a long timeout */
-int Dtls13RtxTimeout(WOLFSSL* ssl)
-{
- int ret = 0;
-
- /* We don't want to send acks until we have done version
- * negotiation in the SH or have received a unified header in the
- * DTLS record. */
- if (ssl->dtls13Rtx.seenRecords != NULL &&
- (ssl->options.serverState >= SERVER_HELLO_COMPLETE ||
- ssl->options.seenUnifiedHdr)) {
- ssl->dtls13Rtx.sendAcks = 0;
- /* reset fast timeout as we are sending ACKs */
- ssl->dtls13FastTimeout = 0;
- ret = SendDtls13Ack(ssl);
- if (ret != 0)
- return ret;
- }
-
- /* we have two timeouts, a shorter (dtls13FastTimeout = 1) and a longer
- one. When the shorter expires we only send ACKs, as it normally means
- that some messages we are waiting for don't arrive yet. But we
- retransmit our buffered messages only if the longer timeout
- expires. fastTimeout is 1/4 of the longer timeout */
- if (ssl->dtls13FastTimeout) {
- ssl->dtls13FastTimeout = 0;
- return 0;
- }
-
- /* Increase timeout on long timeout */
- if (DtlsMsgPoolTimeout(ssl) != 0)
- return WOLFSSL_FATAL_ERROR;
-
- return Dtls13RtxSendBuffered(ssl);
-}
-
-static int Dtls13RtxHasKeyUpdateBuffered(WOLFSSL* ssl)
-{
- Dtls13RtxRecord* r = ssl->dtls13Rtx.rtxRecords;
-
- while (r != NULL) {
- if (r->handshakeType == key_update)
- return 1;
-
- r = r->next;
- }
-
- return 0;
-}
-
-int DoDtls13KeyUpdateAck(WOLFSSL* ssl)
-{
- int ret = 0;
-
- if (!Dtls13RtxHasKeyUpdateBuffered(ssl)) {
- /* we removed the KeyUpdate message because it was ACKed */
- ssl->dtls13WaitKeyUpdateAck = 0;
- ret = Dtls13KeyUpdateAckReceived(ssl);
- }
-
- return ret;
-}
-
-int DoDtls13Ack(WOLFSSL* ssl, const byte* input, word32 inputSize,
- word32* processedSize)
-{
- const byte* ackMessage;
- w64wrapper epoch, seq;
- word16 length;
-#ifndef WOLFSSL_RW_THREADED
- int ret;
-#endif
- int i;
-
- if (inputSize < OPAQUE16_LEN)
- return BUFFER_ERROR;
-
- ato16(input, &length);
-
- if (inputSize < (word32)(OPAQUE16_LEN + length))
- return BUFFER_ERROR;
-
- if (length % (DTLS13_RN_SIZE) != 0)
- return PARSE_ERROR;
-
- WOLFSSL_MSG("read ack records");
-
- ackMessage = input + OPAQUE16_LEN;
- for (i = 0; i < length; i += DTLS13_RN_SIZE) {
- ato64(ackMessage + i, &epoch);
- ato64(ackMessage + i + OPAQUE64_LEN, &seq);
- WOLFSSL_MSG_EX("epoch %d seq %d", epoch, seq);
- Dtls13RtxRemoveRecord(ssl, epoch, seq);
- }
-
- /* last client flight was completely acknowledged by the server. Handshake
- is complete. */
- if (ssl->options.side == WOLFSSL_CLIENT_END &&
- ssl->options.connectState == WAIT_FINISHED_ACK &&
- ssl->dtls13Rtx.rtxRecords == NULL) {
- ssl->options.serverState = SERVER_FINISHED_ACKED;
- }
-
-#ifndef WOLFSSL_RW_THREADED
- if (ssl->dtls13WaitKeyUpdateAck) {
- ret = DoDtls13KeyUpdateAck(ssl);
- if (ret != 0)
- return ret;
- }
-#endif
-
- *processedSize = length + OPAQUE16_LEN;
-
- /* After the handshake, not retransmitting here may incur in some extra time
- in case a post-handshake authentication message is lost, because the ACK
- mechanism does not shortcut the retransmission timer. If, on the other
- hand, we retransmit we may do extra retransmissions of unrelated messages
- in the queue. ex: we send KeyUpdate, CertificateRequest that are
- unrelated between each other, receiving the ACK for the KeyUpdate will
- trigger re-sending the CertificateRequest before the timeout.*/
- /* TODO: be more smart about when doing retransmission looking in the
- retransmission queue or based on the type of message removed from the
- seen record list */
- if (ssl->dtls13Rtx.rtxRecords != NULL)
- ssl->dtls13Rtx.retransmit = 1;
-
- return 0;
-}
-
-int SendDtls13Ack(WOLFSSL* ssl)
-{
- word32 outputSize;
- int headerSize;
- word32 length;
- byte* output;
- int ret;
-
- if (ssl->dtls13EncryptEpoch == NULL)
- return BAD_STATE_E;
-
- WOLFSSL_ENTER("SendDtls13Ack");
-
- ret = 0;
-
- /* The handshake is not complete and the client didn't setup the TRAFFIC0
- epoch yet */
- if (ssl->options.side == WOLFSSL_SERVER_END &&
- !ssl->options.handShakeDone &&
- w64GTE(ssl->dtls13Epoch, w64From32(0, DTLS13_EPOCH_TRAFFIC0))) {
- ret = Dtls13SetEpochKeys(ssl, w64From32(0, DTLS13_EPOCH_HANDSHAKE),
- ENCRYPT_SIDE_ONLY);
- }
- else if (!w64Equal(ssl->dtls13Epoch,
- ssl->dtls13EncryptEpoch->epochNumber)) {
- ret = Dtls13SetEpochKeys(ssl, ssl->dtls13Epoch, ENCRYPT_SIDE_ONLY);
- }
-
- if (ret != 0)
- return ret;
-
-#ifdef WOLFSSL_RW_THREADED
- ret = wc_LockMutex(&ssl->dtls13Rtx.mutex);
- if (ret < 0)
- return ret;
-#endif
- ret = Dtls13WriteAckMessage(ssl, ssl->dtls13Rtx.seenRecords, &length);
-#ifdef WOLFSSL_RW_THREADED
- wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
-#endif
- if (ret != 0)
- return ret;
-
- output = GetOutputBuffer(ssl);
-
- if (w64IsZero(ssl->dtls13EncryptEpoch->epochNumber)) {
- ret = Dtls13RlAddPlaintextHeader(ssl, output, ack, (word16)length);
- if (ret != 0)
- return ret;
-
- ssl->buffers.outputBuffer.length += length + DTLS_RECORD_HEADER_SZ;
- }
- else {
- outputSize = ssl->buffers.outputBuffer.bufferSize -
- ssl->buffers.outputBuffer.idx -
- ssl->buffers.outputBuffer.length;
-
- headerSize = Dtls13GetRlHeaderLength(ssl, 1);
-
- ret = BuildTls13Message(ssl, output, outputSize, output + headerSize,
- length, ack, 0, 0, 0);
- if (ret < 0)
- return ret;
-
- ssl->buffers.outputBuffer.length += ret;
- }
-
- Dtls13RtxFlushAcks(ssl);
-
- return SendBuffered(ssl);
-}
-
-static int Dtls13RtxRecordMatchesReqCtx(Dtls13RtxRecord* r, byte* ctx,
- byte ctxLen)
-{
- if (r->handshakeType != certificate_request)
- return 0;
- if (r->length <= ctxLen + 1)
- return 0;
- return XMEMCMP(ctx, r->data + 1, ctxLen) == 0;
-}
-
-int Dtls13RtxProcessingCertificate(WOLFSSL* ssl, byte* input, word32 inputSize)
-{
- Dtls13RtxRecord* rtxRecord = ssl->dtls13Rtx.rtxRecords;
- Dtls13RtxRecord** prevNext = &ssl->dtls13Rtx.rtxRecords;
- byte ctxLength;
-
- WOLFSSL_ENTER("Dtls13RtxProcessingCertificate");
-
- if (inputSize <= 1) {
- WOLFSSL_MSG("Malformed Certificate");
- return BAD_FUNC_ARG;
- }
-
- ctxLength = *input;
-
- if (inputSize < (word32)ctxLength + OPAQUE8_LEN) {
- WOLFSSL_MSG("Malformed Certificate");
- return BAD_FUNC_ARG;
- }
-
- while (rtxRecord != NULL) {
- if (Dtls13RtxRecordMatchesReqCtx(rtxRecord, input + 1, ctxLength)) {
- Dtls13RtxRecordUnlink(ssl, prevNext, rtxRecord);
- Dtls13FreeRtxBufferRecord(ssl, rtxRecord);
- return 0;
- }
- prevNext = &rtxRecord->next;
- rtxRecord = rtxRecord->next;
- }
-
- /* This isn't an error since we just can't find a Dtls13RtxRecord that
- * matches the Request Context. Request Context validity is checked
- * later. */
- WOLFSSL_MSG("Can't find any previous Certificate Request");
- return 0;
-}
-
-int wolfSSL_dtls13_has_pending_msg(WOLFSSL* ssl)
-{
- return ssl->dtls13Rtx.rtxRecords != NULL;
-}
-
-#ifndef WOLFSSL_TLS13_IGNORE_AEAD_LIMITS
-/* Limits specified by
- * https://www.rfc-editor.org/rfc/rfc9147.html#name-aead-limits
- * We specify the limit by which we need to do a key update as the halfway point
- * to the hard decryption fail limit. */
-int Dtls13CheckAEADFailLimit(WOLFSSL* ssl)
-{
- w64wrapper keyUpdateLimit;
- w64wrapper hardLimit;
- switch (ssl->specs.bulk_cipher_algorithm) {
-#if defined(BUILD_AESGCM) || (defined(HAVE_CHACHA) && defined(HAVE_POLY1305))
- case wolfssl_aes_gcm:
- case wolfssl_chacha:
- hardLimit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT;
- keyUpdateLimit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT;
- break;
-#endif
-#ifdef HAVE_AESCCM
- case wolfssl_aes_ccm:
- if (ssl->specs.aead_mac_size == AES_CCM_8_AUTH_SZ) {
- /* Limit is 2^7. The RFC recommends that
- * "TLS_AES_128_CCM_8_SHA256 is not suitable for general use".
- * We still should enforce the limit. */
- hardLimit = DTLS_AEAD_AES_CCM_8_FAIL_LIMIT;
- keyUpdateLimit = DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT;
- }
- else {
- /* Limit is 2^23.5.
- * Without the fraction is 11863283 (0x00B504F3)
- * Half of this value is 5931641 (0x005A8279) */
- hardLimit = DTLS_AEAD_AES_CCM_FAIL_LIMIT;
- keyUpdateLimit = DTLS_AEAD_AES_CCM_FAIL_KU_LIMIT;
- }
- break;
-#endif
- case wolfssl_cipher_null:
- /* No encryption being done. The MAC check must have failed. */
- return 0;
- default:
- WOLFSSL_MSG("Unrecognized ciphersuite for AEAD limit check");
- WOLFSSL_ERROR_VERBOSE(DECRYPT_ERROR);
- return DECRYPT_ERROR;
- }
- if (ssl->dtls13DecryptEpoch == NULL) {
- WOLFSSL_MSG("Dtls13CheckAEADFailLimit: ssl->dtls13DecryptEpoch should "
- "not be NULL");
- WOLFSSL_ERROR_VERBOSE(BAD_STATE_E);
- return BAD_STATE_E;
- }
- w64Increment(&ssl->dtls13DecryptEpoch->dropCount);
- if (w64GT(ssl->dtls13DecryptEpoch->dropCount, hardLimit)) {
- /* We have reached the hard limit for failed decryptions. */
- WOLFSSL_MSG("Connection exceeded hard AEAD limit");
- WOLFSSL_ERROR_VERBOSE(DECRYPT_ERROR);
- return DECRYPT_ERROR;
- }
- else if (w64GT(ssl->dtls13DecryptEpoch->dropCount, keyUpdateLimit)) {
- WOLFSSL_MSG("Connection exceeded key update limit. Issuing key update");
- /* If not waiting for a response then request a key update. */
- if (!ssl->keys.updateResponseReq) {
- ssl->dtls13DoKeyUpdate = 1;
- ssl->dtls13InvalidateBefore = ssl->dtls13PeerEpoch;
- w64Increment(&ssl->dtls13InvalidateBefore);
- }
- }
- return 0;
-}
-#endif
-
-#ifdef WOLFSSL_DTLS_CH_FRAG
-int wolfSSL_dtls13_allow_ch_frag(WOLFSSL *ssl, int enabled)
-{
- if (ssl->options.side == WOLFSSL_CLIENT_END) {
- return WOLFSSL_FAILURE;
- }
- ssl->options.dtls13ChFrag = !!enabled;
- return WOLFSSL_SUCCESS;
-}
-#endif
-
-#ifdef WOLFSSL_DTLS13_NO_HRR_ON_RESUME
-int wolfSSL_dtls13_no_hrr_on_resume(WOLFSSL *ssl, int enabled)
-{
- if (ssl->options.side == WOLFSSL_CLIENT_END) {
- return WOLFSSL_FAILURE;
- }
- ssl->options.dtls13NoHrrOnResume = !!enabled;
- return WOLFSSL_SUCCESS;
-}
-#endif
-
-#endif /* WOLFSSL_DTLS13 */
diff --git a/src/ssl/wolfssl/ocsp.c b/src/ssl/wolfssl/ocsp.c
deleted file mode 100644
index 2348af7df..000000000
--- a/src/ssl/wolfssl/ocsp.c
+++ /dev/null
@@ -1,2132 +0,0 @@
-/* ocsp.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
- /* Name change compatibility layer no longer needs to be included here */
-
-/*
- * WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK:
- * Disable looking for an authorized responder in the verification path of
- * the issuer. This will make the authorized responder only look at the
- * OCSP response signer and direct issuer.
- */
-
-#ifndef WOLFCRYPT_ONLY
-#ifdef HAVE_OCSP
-
-#include
-#include
-#include
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-/* Allocates and initializes a WOLFSSL_OCSP object. Returns pointer on success, NULL on failure. */
-WOLFSSL_OCSP* wc_NewOCSP(WOLFSSL_CERT_MANAGER* cm)
-{
- WOLFSSL_OCSP* ocsp = NULL;
- ocsp = (WOLFSSL_OCSP*)XMALLOC(sizeof(WOLFSSL_OCSP), cm ? cm->heap : NULL, DYNAMIC_TYPE_OCSP);
- if (ocsp == NULL)
- return NULL;
- if (InitOCSP(ocsp, cm) != 0) {
- XFREE(ocsp, cm ? cm->heap : NULL, DYNAMIC_TYPE_OCSP);
- return NULL;
- }
- return ocsp;
-}
-
-/* Frees a WOLFSSL_OCSP object allocated by wc_NewOCSP. */
-void wc_FreeOCSP(WOLFSSL_OCSP* ocsp)
-{
- if (ocsp) {
- FreeOCSP(ocsp, 1);
- }
-}
-
-int wc_CheckCertOcspResponse(WOLFSSL_OCSP *ocsp, DecodedCert *cert,
- byte *response, int responseSz, void* heap)
-{
- int ret = WC_NO_ERR_TRACE(ASN_OCSP_CONFIRM_E);
-
-#ifdef WOLFSSL_SMALL_STACK
- OcspRequest* ocspRequest;
-#else
- OcspRequest ocspRequest[1];
-#endif
-
-
-#ifdef WOLFSSL_SMALL_STACK
- ocspRequest = (OcspRequest*)XMALLOC(sizeof(OcspRequest), NULL,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (ocspRequest == NULL) {
- WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
- return MEMORY_E;
- }
-#endif
-
- if (InitOcspRequest(ocspRequest, cert, ocsp->cm->ocspSendNonce,
- ocsp->cm->heap) == 0) {
- ret = CheckOcspResponse(ocsp, response, responseSz, NULL, NULL, NULL,
- ocspRequest, heap);
- FreeOcspRequest(ocspRequest);
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- XFREE(ocspRequest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-
- WOLFSSL_LEAVE("CheckCertOCSP", ret);
- return ret;
-}
-
-int InitOCSP(WOLFSSL_OCSP* ocsp, WOLFSSL_CERT_MANAGER* cm)
-{
- WOLFSSL_ENTER("InitOCSP");
-
- ForceZero(ocsp, sizeof(WOLFSSL_OCSP));
-
- if (wc_InitMutex(&ocsp->ocspLock) != 0)
- return BAD_MUTEX_E;
-
- ocsp->cm = cm;
-
- return 0;
-}
-
-
-static int InitOcspEntry(OcspEntry* entry, OcspRequest* request)
-{
- WOLFSSL_ENTER("InitOcspEntry");
-
- ForceZero(entry, sizeof(OcspEntry));
-
- XMEMCPY(entry->issuerHash, request->issuerHash, OCSP_DIGEST_SIZE);
- XMEMCPY(entry->issuerKeyHash, request->issuerKeyHash, OCSP_DIGEST_SIZE);
-
- return 0;
-}
-
-
-static void FreeOcspEntry(OcspEntry* entry, void* heap)
-{
- CertStatus *status, *next;
-
- if (entry == NULL || !entry->ownStatus)
- return;
-
- WOLFSSL_ENTER("FreeOcspEntry");
-
- for (status = entry->status; status; status = next) {
- next = status->next;
-
- XFREE(status->rawOcspResponse, heap, DYNAMIC_TYPE_OCSP_STATUS);
-
-#ifdef OPENSSL_EXTRA
- if (status->serialInt) {
- if (status->serialInt->isDynamic) {
- XFREE(status->serialInt->data, NULL, DYNAMIC_TYPE_OPENSSL);
- }
- XFREE(status->serialInt, NULL, DYNAMIC_TYPE_OPENSSL);
- }
- status->serialInt = NULL;
-#endif
-
- XFREE(status, heap, DYNAMIC_TYPE_OCSP_STATUS);
- }
-
- (void)heap;
-}
-
-
-void FreeOCSP(WOLFSSL_OCSP* ocsp, int dynamic)
-{
- OcspEntry *entry, *next;
-
- WOLFSSL_ENTER("FreeOCSP");
-
- for (entry = ocsp->ocspList; entry; entry = next) {
- next = entry->next;
- FreeOcspEntry(entry, ocsp->cm->heap);
- XFREE(entry, ocsp->cm->heap, DYNAMIC_TYPE_OCSP_ENTRY);
- }
-
- wc_FreeMutex(&ocsp->ocspLock);
-
- if (dynamic)
- XFREE(ocsp, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
-
-}
-
-
-static int xstat2err(int st)
-{
- switch (st) {
- case CERT_GOOD:
- return 0;
- case CERT_REVOKED:
- return OCSP_CERT_REVOKED;
- default:
- return OCSP_CERT_UNKNOWN;
- }
-}
-
-int CheckCertOCSP_ex(WOLFSSL_OCSP* ocsp, DecodedCert* cert, WOLFSSL* ssl)
-{
- int ret = WC_NO_ERR_TRACE(OCSP_LOOKUP_FAIL);
-
- WC_DECLARE_VAR(ocspRequest, OcspRequest, 1, 0);
-
- WOLFSSL_ENTER("CheckCertOCSP");
-
-
-#ifdef WOLFSSL_SMALL_STACK
- ocspRequest = (OcspRequest*)XMALLOC(sizeof(OcspRequest), NULL,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (ocspRequest == NULL) {
- WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
- return MEMORY_E;
- }
-#endif
-
- if (InitOcspRequest(ocspRequest, cert, ocsp->cm->ocspSendNonce,
- ocsp->cm->heap) == 0) {
- ocspRequest->ssl = ssl;
- ret = CheckOcspRequest(ocsp, ocspRequest, NULL, NULL);
-
- FreeOcspRequest(ocspRequest);
- }
-
- WC_FREE_VAR_EX(ocspRequest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- WOLFSSL_LEAVE("CheckCertOCSP", ret);
- return ret;
-}
-int CheckCertOCSP(WOLFSSL_OCSP* ocsp, DecodedCert* cert)
-{
- return CheckCertOCSP_ex(ocsp, cert, NULL);
-}
-
-static int GetOcspEntry(WOLFSSL_OCSP* ocsp, OcspRequest* request,
- OcspEntry** entry)
-{
- WOLFSSL_ENTER("GetOcspEntry");
-
- *entry = NULL;
-
- if (wc_LockMutex(&ocsp->ocspLock) != 0) {
- WOLFSSL_LEAVE("CheckCertOCSP", BAD_MUTEX_E);
- return BAD_MUTEX_E;
- }
-
- for (*entry = ocsp->ocspList; *entry; *entry = (*entry)->next)
- if (XMEMCMP((*entry)->issuerHash, request->issuerHash,
- OCSP_DIGEST_SIZE) == 0
- && XMEMCMP((*entry)->issuerKeyHash, request->issuerKeyHash,
- OCSP_DIGEST_SIZE) == 0)
- break;
-
- if (*entry == NULL) {
- *entry = (OcspEntry*)XMALLOC(sizeof(OcspEntry),
- ocsp->cm->heap, DYNAMIC_TYPE_OCSP_ENTRY);
- if (*entry) {
- InitOcspEntry(*entry, request);
- (*entry)->next = ocsp->ocspList;
- ocsp->ocspList = *entry;
- }
- }
-
- wc_UnLockMutex(&ocsp->ocspLock);
-
- return *entry ? 0 : MEMORY_ERROR;
-}
-
-
-/* Mallocs responseBuffer->buffer and is up to caller to free on success
- *
- * Returns OCSP status
- */
-static int GetOcspStatus(WOLFSSL_OCSP* ocsp, OcspRequest* request,
- OcspEntry* entry, CertStatus** status, buffer* responseBuffer,
- void* heap)
-{
- int ret = WC_NO_ERR_TRACE(OCSP_INVALID_STATUS);
-
- WOLFSSL_ENTER("GetOcspStatus");
-
- (void)heap;
- *status = NULL;
-
- if (wc_LockMutex(&ocsp->ocspLock) != 0) {
- WOLFSSL_LEAVE("CheckCertOCSP", BAD_MUTEX_E);
- return BAD_MUTEX_E;
- }
-
- for (*status = entry->status; *status; *status = (*status)->next)
- if ((*status)->serialSz == request->serialSz
- && !XMEMCMP((*status)->serial, request->serial, (size_t)(*status)->serialSz))
- break;
-
- if (responseBuffer && *status && !(*status)->rawOcspResponse) {
- /* force fetching again */
- ret = OCSP_INVALID_STATUS;
- }
- else if (*status) {
-#ifndef NO_ASN_TIME
- if (XVALIDATE_DATE((*status)->thisDate,
- (*status)->thisDateFormat, ASN_BEFORE)
- && ((*status)->nextDate[0] != 0)
- && XVALIDATE_DATE((*status)->nextDate,
- (*status)->nextDateFormat, ASN_AFTER))
-#endif
- {
- ret = xstat2err((*status)->status);
-
- if (responseBuffer) {
- responseBuffer->buffer = (byte*)XMALLOC(
- (*status)->rawOcspResponseSz, heap,
- DYNAMIC_TYPE_TMP_BUFFER);
-
- if (responseBuffer->buffer) {
- responseBuffer->length = (*status)->rawOcspResponseSz;
- XMEMCPY(responseBuffer->buffer,
- (*status)->rawOcspResponse,
- (*status)->rawOcspResponseSz);
- }
- }
- }
- }
-
- wc_UnLockMutex(&ocsp->ocspLock);
-
- return ret;
-}
-
-/* Check that the response for validity. Store result in status.
- *
- * ocsp Context object for OCSP status.
- * response OCSP response message data.
- * responseSz Length of OCSP response message data.
- * responseBuffer Buffer object to return the response with.
- * status The certificate status object.
- * entry The OCSP entry for this certificate.
- * ocspRequest Request corresponding to response.
- * heap Heap hint used for responseBuffer
- * returns OCSP_LOOKUP_FAIL when the response is bad and 0 otherwise.
- */
-int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz,
- WOLFSSL_BUFFER_INFO *responseBuffer, CertStatus *status,
- OcspEntry *entry, OcspRequest *ocspRequest, void* heap)
-{
-#ifdef WOLFSSL_SMALL_STACK
- CertStatus* newStatus;
- OcspEntry* newSingle;
- OcspResponse* ocspResponse;
-#else
- CertStatus newStatus[1];
- OcspEntry newSingle[1];
- OcspResponse ocspResponse[1];
-#endif
- int ret;
- int validated = 0; /* ocsp validation flag */
-
- (void)heap;
-
-#ifdef WOLFSSL_SMALL_STACK
- newStatus = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
- DYNAMIC_TYPE_OCSP_STATUS);
- newSingle = (OcspEntry*)XMALLOC(sizeof(OcspEntry), NULL,
- DYNAMIC_TYPE_OCSP_ENTRY);
- ocspResponse = (OcspResponse*)XMALLOC(sizeof(OcspResponse), NULL,
- DYNAMIC_TYPE_OCSP_REQUEST);
-
- if (newStatus == NULL || newSingle == NULL || ocspResponse == NULL) {
- XFREE(newStatus, NULL, DYNAMIC_TYPE_OCSP_STATUS);
- XFREE(newSingle, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
- XFREE(ocspResponse, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
-
- WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
- return MEMORY_E;
- }
-#endif
- InitOcspResponse(ocspResponse, newSingle, newStatus, response,
- (word32)responseSz, ocsp->cm->heap);
-#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
- if (ocspRequest != NULL && ocspRequest->ssl != NULL &&
- TLSX_CSR2_IsMulti(((WOLFSSL*)ocspRequest->ssl)->extensions)) {
- ocspResponse->pendingCAs = TLSX_CSR2_GetPendingSigners(((WOLFSSL*)ocspRequest->ssl)->extensions);
- }
-#endif
- ret = OcspResponseDecode(ocspResponse, ocsp->cm, ocsp->cm->heap, 0, 0);
- if (ret != 0) {
- ocsp->error = ret;
- WOLFSSL_LEAVE("OcspResponseDecode failed", ocsp->error);
- goto end;
- }
-
- if (ocspResponse->responseStatus != OCSP_SUCCESSFUL) {
- WOLFSSL_MSG("OcspResponse status bad");
- goto end;
- }
- if (ocspRequest != NULL) {
- /* Has the chance to bubble up response changing ocspResponse->single to
- no longer be pointing at newSingle */
- ret = CompareOcspReqResp(ocspRequest, ocspResponse);
- if (ret != 0) {
- goto end;
- }
- }
-
- if (responseBuffer) {
- responseBuffer->buffer = (byte*)XMALLOC((size_t)responseSz, heap,
- DYNAMIC_TYPE_TMP_BUFFER);
-
- if (responseBuffer->buffer) {
- responseBuffer->length = (unsigned int)responseSz;
- XMEMCPY(responseBuffer->buffer, response, (size_t)responseSz);
- }
- }
-
- ret = xstat2err(ocspResponse->single->status->status);
- if (ret == 0) {
- validated = 1;
- }
-
- if (wc_LockMutex(&ocsp->ocspLock) != 0) {
- ret = BAD_MUTEX_E;
- goto end;
- }
-
- if (status != NULL) {
- XFREE(status->rawOcspResponse, ocsp->cm->heap, DYNAMIC_TYPE_OCSP_STATUS);
-
- /* Replace existing certificate entry with updated */
- ocspResponse->single->status->next = status->next;
- XMEMCPY(status, ocspResponse->single->status, sizeof(CertStatus));
- }
- else if (entry != NULL) {
- /* Save new certificate entry */
- status = (CertStatus*)XMALLOC(sizeof(CertStatus),
- ocsp->cm->heap, DYNAMIC_TYPE_OCSP_STATUS);
- if (status != NULL) {
- XMEMCPY(status, ocspResponse->single->status, sizeof(CertStatus));
- status->next = entry->status;
- entry->status = status;
- entry->ownStatus = 1;
- entry->totalStatus++;
- }
- }
-
- if (status && responseBuffer && responseBuffer->buffer) {
- status->rawOcspResponse = (byte*)XMALLOC(responseBuffer->length,
- ocsp->cm->heap,
- DYNAMIC_TYPE_OCSP_STATUS);
-
- if (status->rawOcspResponse) {
- status->rawOcspResponseSz = responseBuffer->length;
- XMEMCPY(status->rawOcspResponse, responseBuffer->buffer,
- responseBuffer->length);
- }
- }
-
- wc_UnLockMutex(&ocsp->ocspLock);
-
-end:
- if (ret == 0 && validated == 1) {
- WOLFSSL_MSG("New OcspResponse validated");
- }
- else if (ret == WC_NO_ERR_TRACE(OCSP_CERT_REVOKED)) {
- WOLFSSL_MSG("OCSP revoked");
- }
- else if (ret == WC_NO_ERR_TRACE(OCSP_CERT_UNKNOWN)) {
- WOLFSSL_MSG("OCSP unknown");
- }
- else {
- WOLFSSL_MSG("OCSP lookup failure");
- ret = OCSP_LOOKUP_FAIL;
- }
-
- FreeOcspResponse(ocspResponse);
- WC_FREE_VAR_EX(newStatus, NULL, DYNAMIC_TYPE_OCSP_STATUS);
- WC_FREE_VAR_EX(newSingle, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
- WC_FREE_VAR_EX(ocspResponse, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
- return ret;
-}
-
-/* 0 on success */
-/* allow user to override the maximum request size at build-time */
-#ifndef OCSP_MAX_REQUEST_SZ
-#define OCSP_MAX_REQUEST_SZ 2048
-#endif
-int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest,
- buffer* responseBuffer, void* heap)
-{
- OcspEntry* entry = NULL;
- CertStatus* status = NULL;
- byte* request = NULL;
- int requestSz = OCSP_MAX_REQUEST_SZ;
- int responseSz = 0;
- byte* response = NULL;
- const char* url = NULL;
- int urlSz = 0;
- int ret = -1;
- WOLFSSL* ssl;
- void* ioCtx;
-
- WOLFSSL_ENTER("CheckOcspRequest");
-
- if (ocsp == NULL || ocspRequest == NULL)
- return BAD_FUNC_ARG;
-
- if (responseBuffer) {
- responseBuffer->buffer = NULL;
- responseBuffer->length = 0;
- }
-
- ret = GetOcspEntry(ocsp, ocspRequest, &entry);
- if (ret != 0)
- return ret;
-
- ret = GetOcspStatus(ocsp, ocspRequest, entry, &status, responseBuffer,
- heap);
- if (ret != WC_NO_ERR_TRACE(OCSP_INVALID_STATUS))
- return ret;
-
- if (responseBuffer) {
- XFREE(responseBuffer->buffer, heap, DYNAMIC_TYPE_TMP_BUFFER);
- responseBuffer->buffer = NULL;
- }
-
- /* get SSL and IOCtx */
- ssl = (WOLFSSL*)ocspRequest->ssl;
- ioCtx = (ssl && ssl->ocspIOCtx != NULL) ?
- ssl->ocspIOCtx : ocsp->cm->ocspIOCtx;
-
- if (ocsp->cm->ocspUseOverrideURL) {
- url = ocsp->cm->ocspOverrideURL;
- if (url != NULL && url[0] != '\0')
- urlSz = (int)XSTRLEN(url);
- else
- return OCSP_NEED_URL;
- }
- else if (ocspRequest->urlSz != 0 && ocspRequest->url != NULL) {
- url = (const char *)ocspRequest->url;
- urlSz = ocspRequest->urlSz;
- }
- else {
- /* cert doesn't have extAuthInfo, assuming CERT_GOOD */
- WOLFSSL_MSG("Cert has no OCSP URL, assuming CERT_GOOD");
- return 0;
- }
-
- request = (byte*)XMALLOC((size_t)requestSz, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
- if (request == NULL) {
- WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
- return MEMORY_ERROR;
- }
-
- requestSz = EncodeOcspRequest(ocspRequest, request, (word32)requestSz);
- if (requestSz > 0 && ocsp->cm->ocspIOCb) {
- responseSz = ocsp->cm->ocspIOCb(ioCtx, url, urlSz,
- request, requestSz, &response);
- }
- if (responseSz == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ)) {
- ret = OCSP_WANT_READ;
- }
- else if (responseSz == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_TIMEOUT)){
- ret = HTTP_TIMEOUT;
- }
-
- XFREE(request, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
-
- if (responseSz >= 0 && response) {
- ret = CheckOcspResponse(ocsp, response, responseSz, responseBuffer, status,
- entry, ocspRequest, heap);
- }
-
- if (response != NULL && ocsp->cm->ocspRespFreeCb)
- ocsp->cm->ocspRespFreeCb(ioCtx, response);
-
- /* Keep responseBuffer in the case of getting to response check. Caller
- * should free responseBuffer after checking OCSP return value in "ret" */
- WOLFSSL_LEAVE("CheckOcspRequest", ret);
- return ret;
-}
-
-#ifndef WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK
-static int CheckOcspResponderChain(OcspEntry* single, DecodedCert *cert,
- void* vp, Signer* pendingCAs) {
- /* Attempt to build a chain up to cert's issuer */
- WOLFSSL_CERT_MANAGER* cm = (WOLFSSL_CERT_MANAGER*)vp;
- Signer* ca = NULL;
- Signer* prev = NULL;
- int passed = 0;
-
- /*
- * Relation between certs:
- * CA
- * / \
- * intermediate(s) cert in OCSP response
- * | with OCSP key usage ext
- * issuer of cert
- * in OCSP request
- */
-
- /* End loop if no more issuers found or if we have found a self
- * signed cert (ca == prev) */
- ca = GetCAByName(cm, single->issuerHash);
-#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
- if (ca == NULL && pendingCAs != NULL) {
- ca = findSignerByName(pendingCAs, single->issuerHash);
- }
-#else
- (void)pendingCAs;
-#endif
- for (; ca != NULL && ca != prev;
- prev = ca) {
- if (XMEMCMP(cert->issuerHash, ca->issuerNameHash,
- OCSP_DIGEST_SIZE) == 0) {
- WOLFSSL_MSG("\tOCSP Response signed by authorized "
- "responder delegated by issuer "
- "(found in chain)");
- passed = 1;
- break;
- }
- ca = GetCAByName(cm, ca->issuerNameHash);
-#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
- if (ca == NULL && pendingCAs != NULL) {
- ca = findSignerByName(pendingCAs, single->issuerHash);
- }
-#endif
- }
- return passed;
-}
-#endif
-
-/**
- * Enforce https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2
- * @param bs The basic response to verify
- * @param cert The decoded bs->cert
- * @return
- */
-int CheckOcspResponder(OcspResponse *bs, DecodedCert *cert, void* vp)
-{
- int ret = 0;
- OcspEntry* single;
-
- /* Both evaluate to enum values so can't use a pre-processor check */
- WOLFSSL_ASSERT_EQ(OCSP_DIGEST_SIZE, SIGNER_DIGEST_SIZE);
-
- (void)vp;
-
- WOLFSSL_ENTER("CheckOcspResponder");
-
- /* In the future if this API is used more then it could be beneficial to
- * implement calling InitDecodedCert and ParseCertRelative here
- * automatically when cert == NULL. */
- if (bs == NULL || cert == NULL)
- return BAD_FUNC_ARG;
-
- /* Traverse the list and check that the cert has the authority to provide
- * an OCSP response for each entry. */
- for (single = bs->single; single != NULL; single = single->next) {
- int passed = 0;
-
- if (XMEMCMP(cert->subjectHash, single->issuerHash, OCSP_DIGEST_SIZE)
- == 0) {
- WOLFSSL_MSG("\tOCSP Response signed by issuer");
- passed = 1;
- }
- else if ((cert->extExtKeyUsage & EXTKEYUSE_OCSP_SIGN) != 0) {
- if (XMEMCMP(cert->issuerHash, single->issuerHash,
- OCSP_DIGEST_SIZE) == 0) {
- WOLFSSL_MSG("\tOCSP Response signed by authorized responder "
- "delegated by issuer");
- passed = 1;
- }
-#ifndef WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK
- else if (vp != NULL) {
- passed = CheckOcspResponderChain(single, cert, vp, bs->pendingCAs);
- }
-#endif
- }
-
- if (!passed) {
- WOLFSSL_MSG("\tOCSP Responder not authorized");
- ret = BAD_OCSP_RESPONDER;
- break;
- }
- }
- return ret;
-}
-
-
-/* compatibility layer OCSP functions */
-#ifdef OPENSSL_EXTRA
-int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
- WOLFSSL_OCSP_CERTID* id, int* status, int* reason,
- WOLFSSL_ASN1_TIME** revtime, WOLFSSL_ASN1_TIME** thisupd,
- WOLFSSL_ASN1_TIME** nextupd)
-{
- WOLFSSL_OCSP_SINGLERESP* single;
-
- if (bs == NULL || id == NULL)
- return WOLFSSL_FAILURE;
-
- single = bs->single;
- while (single != NULL) {
- if ((XMEMCMP(single->status->serial, id->status->serial, (size_t)single->status->serialSz) == 0)
- && (XMEMCMP(single->issuerHash, id->issuerHash, OCSP_DIGEST_SIZE) == 0)
- && (XMEMCMP(single->issuerKeyHash, id->issuerKeyHash, OCSP_DIGEST_SIZE) == 0)) {
- break;
- }
- single = single->next;
- }
-
- if (single == NULL)
- return WOLFSSL_FAILURE;
-
- if (status != NULL)
- *status = single->status->status;
-#ifdef WOLFSSL_OCSP_PARSE_STATUS
- if (thisupd != NULL)
- *thisupd = &single->status->thisDateParsed;
- if (nextupd != NULL)
- *nextupd = &single->status->nextDateParsed;
-#else
- if (thisupd != NULL)
- *thisupd = NULL;
- if (nextupd != NULL)
- *nextupd = NULL;
-#endif
-
- /* TODO: Not needed for Nginx or httpd */
- if (reason != NULL)
- *reason = 0;
- if (revtime != NULL)
- *revtime = NULL;
-
- return WOLFSSL_SUCCESS;
-}
-
-const char *wolfSSL_OCSP_cert_status_str(long s)
-{
- switch (s) {
- case CERT_GOOD:
- return "good";
- case CERT_REVOKED:
- return "revoked";
- case CERT_UNKNOWN:
- return "unknown";
- default:
- return "(UNKNOWN)";
- }
-}
-
-int wolfSSL_OCSP_check_validity(WOLFSSL_ASN1_TIME* thisupd,
- WOLFSSL_ASN1_TIME* nextupd, long sec, long maxsec)
-{
- (void)thisupd;
- (void)nextupd;
- (void)sec;
- (void)maxsec;
- /* Dates validated in DecodeSingleResponse. */
- return WOLFSSL_SUCCESS;
-}
-
-void wolfSSL_OCSP_CERTID_free(WOLFSSL_OCSP_CERTID* certId)
-{
- FreeOcspEntry(certId, NULL);
- XFREE(certId, NULL, DYNAMIC_TYPE_OPENSSL);
-}
-
-WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
- const WOLFSSL_EVP_MD *dgst, const WOLFSSL_X509 *subject,
- const WOLFSSL_X509 *issuer)
-{
- WOLFSSL_OCSP_CERTID* certId = NULL;
- CertStatus* certStatus = NULL;
- WOLFSSL_CERT_MANAGER* cm = NULL;
- int ret = -1;
- DerBuffer* derCert = NULL;
- int dgstType;
- WC_DECLARE_VAR(cert, DecodedCert, 1, 0);
-
- if (dgst == NULL) {
- dgstType = WC_HASH_TYPE_SHA;
- }
- else if (wolfSSL_EVP_get_hashinfo(dgst, &dgstType, NULL) !=
- WOLFSSL_SUCCESS) {
- return NULL;
- }
-
- if (dgstType != OCSP_DIGEST)
- return NULL;
-
- cm = wolfSSL_CertManagerNew();
- if (cm == NULL
- || subject == NULL || subject->derCert == NULL
- || issuer == NULL || issuer->derCert == NULL)
- goto out;
-
- WC_ALLOC_VAR_EX(cert, DecodedCert, 1, cm->heap, DYNAMIC_TYPE_DCERT,
- goto out);
-
- ret = AllocDer(&derCert, issuer->derCert->length,
- issuer->derCert->type, NULL);
- if (ret == 0) {
- /* AddCA() frees the buffer. */
- XMEMCPY(derCert->buffer, issuer->derCert->buffer,
- issuer->derCert->length);
- ret = AddCA(cm, &derCert, WOLFSSL_USER_CA, 1);
- if (ret != WOLFSSL_SUCCESS) {
- goto out;
- }
- derCert = NULL;
- }
-
- ret = -1;
-
- certId = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID),
- cm->heap, DYNAMIC_TYPE_OPENSSL);
- if (certId == NULL)
- goto out;
-
- certStatus = (CertStatus*)XMALLOC(sizeof(CertStatus), cm->heap,
- DYNAMIC_TYPE_OPENSSL);
- if (certStatus == NULL)
- goto out;
-
- XMEMSET(certId, 0, sizeof(WOLFSSL_OCSP_CERTID));
- XMEMSET(certStatus, 0, sizeof(CertStatus));
-
- certId->status = certStatus;
- certId->ownStatus = 1;
-
- InitDecodedCert(cert, subject->derCert->buffer,
- subject->derCert->length, NULL);
- if (ParseCertRelative(cert, CERT_TYPE, VERIFY_OCSP, cm, NULL) != 0) {
- FreeDecodedCert(cert);
- goto out;
- }
- else {
- certId->hashAlgoOID = wc_HashGetOID(OCSP_DIGEST);
- XMEMCPY(certId->issuerHash, cert->issuerHash, OCSP_DIGEST_SIZE);
- XMEMCPY(certId->issuerKeyHash, cert->issuerKeyHash, OCSP_DIGEST_SIZE);
- XMEMCPY(certId->status->serial, cert->serial, (size_t)cert->serialSz);
- certId->status->serialSz = cert->serialSz;
- FreeDecodedCert(cert);
- }
-
- ret = 0;
-
-out:
-
- if (ret != 0) {
- if (derCert != NULL)
- FreeDer(&derCert);
- if (cm != NULL) {
- XFREE(certId, cm->heap, DYNAMIC_TYPE_OPENSSL);
- certId = NULL;
- XFREE(certStatus, cm->heap, DYNAMIC_TYPE_OPENSSL);
- }
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- if (cm != NULL)
- XFREE(cert, cm->heap, DYNAMIC_TYPE_DCERT);
-#endif
-
- if (cm != NULL)
- wolfSSL_CertManagerFree(cm);
-
- return certId;
-}
-
-void wolfSSL_OCSP_BASICRESP_free(WOLFSSL_OCSP_BASICRESP* basicResponse)
-{
- wolfSSL_OCSP_RESPONSE_free(basicResponse);
-}
-
-/* Calculate ancode CertID DER encoding following RFC 6960:
- CertID ::= SEQUENCE {
- hashAlgorithm AlgorithmIdentifier,
- issuerNameHash OCTET STRING,
- issuerKeyHash OCTET STRING,
- serialNumber CertificateSerialNumber }
-*/
-static int OcspEncodeCertID(WOLFSSL_OCSP_CERTID* id, byte* output,
- word32* totalSz, word32* intSize)
-{
- word32 idx = 0;
- int ret;
-
- if (id == NULL || totalSz == NULL || intSize == NULL ||
- (output != NULL && (*totalSz == 0 || *totalSz <= *intSize)))
- return BAD_FUNC_ARG;
-
- if (output != NULL) {
- ret = SetSequence(*intSize, output);
- if (ret < 0)
- return ret;
- idx += ret;
- }
-
- ret = SetAlgoID(id->hashAlgoOID, ((output != NULL) ? output + idx : output),
- oidHashType, 0);
- if (ret <= 0)
- return -1;
- idx += ret;
-
- /* issuerNameHash */
- ret = SetOctetString(OCSP_DIGEST_SIZE, ((output != NULL) ? output + idx : output));
- if (ret < 0)
- return ret;
- idx += ret;
- if (output != NULL)
- XMEMCPY(output + idx, id->issuerHash, OCSP_DIGEST_SIZE);
- idx += OCSP_DIGEST_SIZE;
-
- /* issuerKeyHash */
- ret = SetOctetString(OCSP_DIGEST_SIZE, ((output != NULL) ? output + idx : output));
- if (ret < 0)
- return ret;
- idx += ret;
- if (output != NULL)
- XMEMCPY(output + idx, id->issuerKeyHash, OCSP_DIGEST_SIZE);
- idx += OCSP_DIGEST_SIZE;
-
- /* serialNumber */
- ret = SetASNInt(id->status->serialSz, id->status->serial[0], ((output != NULL) ? output + idx : output));
- if (ret < 0)
- return ret;
- idx += ret;
- if (output != NULL)
- XMEMCPY(output + idx, id->status->serial, id->status->serialSz);
- idx += id->status->serialSz;
-
- if (output == NULL) {
- *intSize = idx;
- ret = SetSequence(idx, NULL);
- if (ret < 0)
- return ret;
- idx += ret;
- *totalSz = idx;
- }
- else if (idx != *totalSz) {
- return BUFFER_E;
- }
-
- return 0;
-}
-
-static int OcspRespIdMatches(OcspResponse* resp, const byte* NameHash,
- const byte* keyHash)
-{
- if (resp->responderIdType == OCSP_RESPONDER_ID_NAME) {
- return XMEMCMP(NameHash, resp->responderId.nameHash,
- SIGNER_DIGEST_SIZE) == 0;
- }
- else if (resp->responderIdType == OCSP_RESPONDER_ID_KEY) {
- return XMEMCMP(keyHash, resp->responderId.keyHash, KEYID_SIZE) == 0;
- }
-
- return 0;
-}
-
-static int OcspFindSigner(WOLFSSL_OCSP_BASICRESP *resp,
- WOLF_STACK_OF(WOLFSSL_X509) *certs, DecodedCert **signer, int *embedded,
- unsigned long flags)
-{
- WOLFSSL_X509 *signer_x509 = NULL;
- DecodedCert *certDecoded;
- int i;
-
- certDecoded = (DecodedCert *)XMALLOC(sizeof(*certDecoded), resp->heap,
- DYNAMIC_TYPE_DCERT);
- if (certDecoded == NULL)
- return MEMORY_E;
-
- for (i = 0; i < wolfSSL_sk_X509_num(certs); i++) {
- signer_x509 = wolfSSL_sk_X509_value(certs, i);
- if (signer_x509 == NULL)
- continue;
-
- InitDecodedCert(certDecoded, signer_x509->derCert->buffer,
- signer_x509->derCert->length, resp->heap);
- if (ParseCertRelative(certDecoded, CERT_TYPE, NO_VERIFY,
- NULL, NULL) == 0) {
- if (OcspRespIdMatches(resp, certDecoded->subjectHash,
- certDecoded->subjectKeyHash)) {
- *signer = certDecoded;
- *embedded = 0;
- return 0;
- }
- }
- FreeDecodedCert(certDecoded);
- }
-
- if (flags & WOLFSSL_OCSP_NOINTERN) {
- XFREE(certDecoded, resp->heap, DYNAMIC_TYPE_DCERT);
- return ASN_NO_SIGNER_E;
- }
-
- /* not found in certs, search the cert embedded in the response */
- InitDecodedCert(certDecoded, resp->cert, resp->certSz, resp->heap);
- if (ParseCertRelative(certDecoded, CERT_TYPE, NO_VERIFY, NULL, NULL) == 0) {
- if (OcspRespIdMatches(resp, certDecoded->subjectHash,
- certDecoded->subjectKeyHash)) {
- *signer = certDecoded;
- *embedded = 1;
- return 0;
- }
- }
- FreeDecodedCert(certDecoded);
-
- XFREE(certDecoded, resp->heap, DYNAMIC_TYPE_DCERT);
- return ASN_NO_SIGNER_E;
-}
-
-static int OcspVerifySigner(WOLFSSL_OCSP_BASICRESP *resp, DecodedCert *cert,
- WOLFSSL_X509_STORE *st, unsigned long flags)
-{
- WC_DECLARE_VAR(c, DecodedCert, 1, 0);
-
- int ret = -1;
- if (st == NULL)
- return ASN_OCSP_CONFIRM_E;
-
- WC_ALLOC_VAR_EX(c, DecodedCert, 1, NULL, DYNAMIC_TYPE_DCERT,
- return MEMORY_E);
-
- InitDecodedCert(c, cert->source, cert->maxIdx, NULL);
- if (ParseCertRelative(c, CERT_TYPE, VERIFY, st->cm, NULL) != 0) {
- ret = ASN_OCSP_CONFIRM_E;
- goto err;
- }
-#ifndef WOLFSSL_NO_OCSP_ISSUER_CHECK
- if ((flags & WOLFSSL_OCSP_NOCHECKS) == 0) {
- ret = CheckOcspResponder(resp, c, st->cm);
- }
- else {
- ret = 0;
- }
-#else
- (void)resp;
- (void)flags;
- ret = 0;
-#endif
-
-err:
- FreeDecodedCert(c);
- WC_FREE_VAR_EX(c, NULL, DYNAMIC_TYPE_DCERT);
- return ret;
-}
-/* Signature verified in DecodeBasicOcspResponse.
- * But no store available to verify certificate. */
-int wolfSSL_OCSP_basic_verify(WOLFSSL_OCSP_BASICRESP* bs,
- WOLF_STACK_OF(WOLFSSL_X509) * certs, WOLFSSL_X509_STORE* st,
- unsigned long flags)
-{
- int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
- int embedded;
- DecodedCert *cert = NULL;
-
- ret = OcspFindSigner(bs, certs, &cert, &embedded, flags);
- if (ret != 0) {
- WOLFSSL_MSG("OCSP no signer found");
- return WOLFSSL_FAILURE;
- }
-
- /* skip certificate verification if cert in certs and TRUST_OTHER is true */
- if (!embedded && (flags & WOLFSSL_OCSP_TRUSTOTHER) != 0)
- flags |= WOLFSSL_OCSP_NOVERIFY;
-
- /* verify response signature */
- ret = ConfirmSignature(
- &cert->sigCtx,
- bs->response, bs->responseSz,
- cert->publicKey, cert->pubKeySize, cert->keyOID,
- bs->sig, bs->sigSz, bs->sigOID, bs->sigParams, bs->sigParamsSz,
- NULL);
-
- if (ret != 0) {
- WOLFSSL_MSG("OCSP signature verification failed");
- ret = -1;
- goto err;
- }
-
- if ((flags & WOLFSSL_OCSP_NOVERIFY) == 0) {
- ret = OcspVerifySigner(bs, cert, st, flags);
- }
-
-err:
- FreeDecodedCert(cert);
- XFREE(cert, NULL, DYNAMIC_TYPE_DCERT);
- return ret == 0 ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
-}
-
-void wolfSSL_OCSP_RESPONSE_free(OcspResponse* response)
-{
- OcspEntry *s, *sNext;
- if (response == NULL)
- return;
-
-
- s = response->single;
- while (s != NULL) {
- sNext = s->next;
- FreeOcspEntry(s, NULL);
- XFREE(s, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
- s = sNext;
- }
-
- XFREE(response->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- XFREE(response, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
-}
-
-#ifndef NO_BIO
-OcspResponse* wolfSSL_d2i_OCSP_RESPONSE_bio(WOLFSSL_BIO* bio,
- OcspResponse** response)
-{
- byte* data;
- byte* p;
- int len;
- int dataAlloced = 0;
- OcspResponse* ret = NULL;
-
- if (bio == NULL)
- return NULL;
-
- if (bio->type == WOLFSSL_BIO_MEMORY) {
- len = wolfSSL_BIO_get_mem_data(bio, &data);
- if (len <= 0 || data == NULL) {
- return NULL;
- }
- }
-#ifndef NO_FILESYSTEM
- else if (bio->type == WOLFSSL_BIO_FILE) {
- long fcur;
- long flen;
-
- if (bio->ptr.fh == NULL)
- return NULL;
-
- fcur = XFTELL(bio->ptr.fh);
- if (fcur < 0)
- return NULL;
- if(XFSEEK(bio->ptr.fh, 0, SEEK_END) != 0)
- return NULL;
- flen = XFTELL(bio->ptr.fh);
- if (flen < 0)
- return NULL;
- if (XFSEEK(bio->ptr.fh, fcur, SEEK_SET) != 0)
- return NULL;
-
- /* check calculated length */
- fcur = flen - fcur;
- if (fcur > MAX_WOLFSSL_FILE_SIZE || fcur <= 0)
- return NULL;
-
- data = (byte*)XMALLOC((size_t)fcur, 0, DYNAMIC_TYPE_TMP_BUFFER);
- if (data == NULL)
- return NULL;
- dataAlloced = 1;
-
- len = wolfSSL_BIO_read(bio, (char *)data, (int)flen);
- }
-#endif
- else
- return NULL;
-
- if (len > 0) {
- p = data;
- ret = wolfSSL_d2i_OCSP_RESPONSE(response, (const unsigned char **)&p,
- len);
- }
-
- if (dataAlloced)
- XFREE(data, 0, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-#endif /* !NO_BIO */
-
-OcspResponse* wolfSSL_d2i_OCSP_RESPONSE(OcspResponse** response,
- const unsigned char** data, int len)
-{
- OcspResponse *resp = NULL;
- word32 idx = 0;
- int length = 0;
- int ret;
-
- if (data == NULL)
- return NULL;
-
- if (response != NULL)
- resp = *response;
- if (resp == NULL) {
- resp = (OcspResponse*)XMALLOC(sizeof(OcspResponse), NULL,
- DYNAMIC_TYPE_OCSP_REQUEST);
- if (resp == NULL)
- return NULL;
- XMEMSET(resp, 0, sizeof(OcspResponse));
- }
-
- resp->source = (byte*)XMALLOC((size_t)len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (resp->source == NULL) {
- XFREE(resp, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
- return NULL;
- }
- resp->single = (OcspEntry*)XMALLOC(sizeof(OcspEntry), NULL,
- DYNAMIC_TYPE_OCSP_ENTRY);
- if (resp->single == NULL) {
- XFREE(resp->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- XFREE(resp, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
- return NULL;
- }
- XMEMSET(resp->single, 0, sizeof(OcspEntry));
- resp->single->status = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
- DYNAMIC_TYPE_OCSP_STATUS);
- resp->single->ownStatus = 1;
- if (resp->single->status == NULL) {
- XFREE(resp->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- XFREE(resp->single, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
- XFREE(resp, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
- return NULL;
- }
- XMEMSET(resp->single->status, 0, sizeof(CertStatus));
-
- XMEMCPY(resp->source, *data, (size_t)len);
- resp->maxIdx = (word32)len;
-
- ret = OcspResponseDecode(resp, NULL, NULL, 1, 1);
- if (ret != 0 && ret != WC_NO_ERR_TRACE(ASN_OCSP_CONFIRM_E)) {
- /* for just converting from a DER to an internal structure the CA may
- * not yet be known to this function for signature verification */
- wolfSSL_OCSP_RESPONSE_free(resp);
- return NULL;
- }
-
- if (GetSequence(*data, &idx, &length, (word32)len) >= 0)
- (*data) += (unsigned char) ((int)idx + length);
-
- if (response != NULL && *response == NULL)
- *response = resp;
-
- return resp;
-}
-
-int wolfSSL_i2d_OCSP_RESPONSE(OcspResponse* response,
- unsigned char** data)
-{
- if (data == NULL)
- return (int)response->maxIdx;
-
- XMEMCPY(*data, response->source, response->maxIdx);
- return (int)response->maxIdx;
-}
-
-int wolfSSL_OCSP_response_status(OcspResponse *response)
-{
- return response->responseStatus;
-}
-
-const char *wolfSSL_OCSP_response_status_str(long s)
-{
- switch (s) {
- case OCSP_SUCCESSFUL:
- return "successful";
- case OCSP_MALFORMED_REQUEST:
- return "malformedrequest";
- case OCSP_INTERNAL_ERROR:
- return "internalerror";
- case OCSP_TRY_LATER:
- return "trylater";
- case OCSP_SIG_REQUIRED:
- return "sigrequired";
- case OCSP_UNAUTHORIZED:
- return "unauthorized";
- default:
- return "(UNKNOWN)";
- }
-}
-
-WOLFSSL_OCSP_BASICRESP* wolfSSL_OCSP_response_get1_basic(OcspResponse* response)
-{
- WOLFSSL_OCSP_BASICRESP* bs;
- const unsigned char *ptr = response->source;
-
- bs = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, response->maxIdx);
- return bs;
-}
-
-OcspRequest* wolfSSL_OCSP_REQUEST_new(void)
-{
- OcspRequest* request;
-
- request = (OcspRequest*)XMALLOC(sizeof(OcspRequest), NULL,
- DYNAMIC_TYPE_OPENSSL);
- if (request != NULL)
- XMEMSET(request, 0, sizeof(OcspRequest));
-
- return request;
-}
-
-void wolfSSL_OCSP_REQUEST_free(OcspRequest* request)
-{
- FreeOcspRequest(request);
- XFREE(request, NULL, DYNAMIC_TYPE_OPENSSL);
-}
-
-int wolfSSL_i2d_OCSP_REQUEST(OcspRequest* request, unsigned char** data)
-{
- int size;
-
- if (request == NULL)
- return BAD_FUNC_ARG;
-
- size = EncodeOcspRequest(request, NULL, 0);
- if (size <= 0 || data == NULL)
- return size;
-
- return EncodeOcspRequest(request, *data, (word32) size);
-}
-
-WOLFSSL_OCSP_ONEREQ* wolfSSL_OCSP_request_add0_id(OcspRequest *req,
- WOLFSSL_OCSP_CERTID *cid)
-{
- if (req == NULL || cid == NULL || cid->status == NULL)
- return NULL;
-
- if (req->cid != NULL)
- wolfSSL_OCSP_CERTID_free((WOLFSSL_OCSP_CERTID*)req->cid);
- /* Keep to free */
- req->cid = (void*)cid;
-
- XMEMCPY(req->issuerHash, cid->issuerHash, KEYID_SIZE);
- XMEMCPY(req->issuerKeyHash, cid->issuerKeyHash, KEYID_SIZE);
- if (cid->status->serialSz > req->serialSz) {
- XFREE(req->serial, req->heap, DYNAMIC_TYPE_OCSP);
- req->serial = (byte*)XMALLOC((size_t)cid->status->serialSz,
- req->heap, DYNAMIC_TYPE_OCSP_REQUEST);
- if (req->serial == NULL)
- return NULL;
- }
- XMEMCPY(req->serial, cid->status->serial, (size_t)cid->status->serialSz);
- req->serialSz = cid->status->serialSz;
-
- return req;
-}
-
-WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_CERTID_dup(WOLFSSL_OCSP_CERTID* id)
-{
- WOLFSSL_OCSP_CERTID* certId;
-
- if (id == NULL)
- return NULL;
-
- certId = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID),
- NULL, DYNAMIC_TYPE_OPENSSL);
- if (certId) {
- XMEMCPY(certId, id, sizeof(WOLFSSL_OCSP_CERTID));
- }
- return certId;
-}
-
-#ifndef NO_BIO
-int wolfSSL_i2d_OCSP_REQUEST_bio(WOLFSSL_BIO* out,
- WOLFSSL_OCSP_REQUEST *req)
-{
- int size = -1;
- unsigned char* data = NULL;
-
- WOLFSSL_ENTER("wolfSSL_i2d_OCSP_REQUEST_bio");
- if (out == NULL || req == NULL)
- return WOLFSSL_FAILURE;
-
- size = wolfSSL_i2d_OCSP_REQUEST(req, NULL);
- if (size > 0) {
- data = (unsigned char*) XMALLOC((size_t)size, out->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- }
-
- if (data != NULL) {
- size = wolfSSL_i2d_OCSP_REQUEST(req, &data);
- }
-
- if (size <= 0) {
- XFREE(data, out->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FAILURE;
- }
-
- if (wolfSSL_BIO_write(out, data, size) == (int)size) {
- XFREE(data, out->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_SUCCESS;
- }
-
- XFREE(data, out->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return WOLFSSL_FAILURE;
-}
-#endif /* !NO_BIO */
-
-int wolfSSL_i2d_OCSP_CERTID(WOLFSSL_OCSP_CERTID* id, unsigned char** data)
-{
- int allocated = 0;
- word32 derSz = 0;
- word32 intSz = 0;
- int ret;
- WOLFSSL_ENTER("wolfSSL_i2d_OCSP_CERTID");
-
- if (id == NULL)
- return -1;
-
- if (id->rawCertId != NULL) {
- derSz = id->rawCertIdSize;
- }
- else {
- ret = OcspEncodeCertID(id, NULL, &derSz, &intSz);
- if (ret != 0) {
- WOLFSSL_MSG("Failed to calculate CertID size");
- return -1;
- }
- }
-
- if (data == NULL) {
- return derSz;
- }
-
- if (*data == NULL) {
- /* Allocate buffer for DER encoding */
- *data = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_OPENSSL);
- if (*data == NULL) {
- WOLFSSL_MSG("Failed to allocate memory for CertID DER encoding");
- return -1;
- }
- allocated = 1;
- }
-
- if (id->rawCertId != NULL) {
- XMEMCPY(*data, id->rawCertId, id->rawCertIdSize);
- }
- else {
- ret = OcspEncodeCertID(id, *data, &derSz, &intSz);
- if (ret < 0) {
- WOLFSSL_MSG("Failed to encode CertID");
- if (allocated) {
- XFREE(*data, NULL, DYNAMIC_TYPE_OPENSSL);
- *data = NULL;
- }
- return -1;
- }
- }
-
- if (!allocated)
- *data += derSz;
-
- return derSz;
-}
-
-WOLFSSL_OCSP_CERTID* wolfSSL_d2i_OCSP_CERTID(WOLFSSL_OCSP_CERTID** cidOut,
- const unsigned char** derIn,
- int length)
-{
- WOLFSSL_OCSP_CERTID *cid = NULL;
- int isAllocated = 0;
- word32 idx = 0;
- int ret;
-
- if (derIn == NULL || *derIn == NULL || length <= 0)
- return NULL;
-
- if (cidOut != NULL && *cidOut != NULL) {
- cid = *cidOut;
- FreeOcspEntry(cid, NULL);
- }
- else {
- cid = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID), NULL,
- DYNAMIC_TYPE_OPENSSL);
- if (cid == NULL)
- return NULL;
- isAllocated = 1;
- }
-
- XMEMSET(cid, 0, sizeof(WOLFSSL_OCSP_CERTID));
- cid->status = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
- DYNAMIC_TYPE_OCSP_STATUS);
- if (cid->status == NULL) {
- XFREE(cid, NULL, DYNAMIC_TYPE_OPENSSL);
- return NULL;
- }
- XMEMSET(cid->status, 0, sizeof(CertStatus));
- cid->ownStatus = 1;
-
- ret = OcspDecodeCertID(*derIn, &idx, length, cid);
- if (ret != 0) {
- FreeOcspEntry(cid, NULL);
- if (isAllocated) {
- XFREE(cid, NULL, DYNAMIC_TYPE_OPENSSL);
- }
- return NULL;
- }
-
- *derIn += idx;
-
- if (isAllocated && cidOut != NULL)
- *cidOut = cid;
-
- return cid;
-}
-
-const WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_SINGLERESP_get0_id(
- const WOLFSSL_OCSP_SINGLERESP *single)
-{
- return single;
-}
-
-/**
- * Compare two WOLFSSL_OCSP_CERTID objects
- * @param a
- * @param b
- * @return 0 on success and when objects have the same id otherwise either
- * the id's don't match or an error occurred
- */
-int wolfSSL_OCSP_id_cmp(WOLFSSL_OCSP_CERTID *a, WOLFSSL_OCSP_CERTID *b)
-{
- int ret = 0;
- if (a == NULL || b == NULL)
- return WOLFSSL_FATAL_ERROR;
-
- ret = a->hashAlgoOID != b->hashAlgoOID;
- if (ret == 0)
- ret = XMEMCMP(a->issuerHash, b->issuerHash, OCSP_DIGEST_SIZE);
- if (ret == 0)
- ret = XMEMCMP(a->issuerKeyHash, b->issuerKeyHash, OCSP_DIGEST_SIZE);
- if (ret == 0) {
- if (a->status != NULL && b->status != NULL) {
- if (a->status->serialSz == b->status->serialSz)
- ret = XMEMCMP(a->status->serial, b->status->serial,
- (size_t)a->status->serialSz);
- else
- ret = -1;
- }
- else if (a->status != b->status) {
- /* If either is not null then return non-zero */
- ret = -1;
- }
- }
- return ret;
-}
-
-int wolfSSL_OCSP_single_get0_status(WOLFSSL_OCSP_SINGLERESP *single,
- int *reason,
- WOLFSSL_ASN1_TIME **revtime,
- WOLFSSL_ASN1_TIME **thisupd,
- WOLFSSL_ASN1_TIME **nextupd)
-{
- if (single == NULL)
- return WOLFSSL_FAILURE;
-
-#ifdef WOLFSSL_OCSP_PARSE_STATUS
- if (thisupd != NULL)
- *thisupd = &single->status->thisDateParsed;
- if (nextupd != NULL)
- *nextupd = &single->status->nextDateParsed;
-#else
- if (thisupd != NULL)
- *thisupd = NULL;
- if (nextupd != NULL)
- *nextupd = NULL;
-#endif
- if (reason != NULL)
- *reason = 0;
- if (revtime != NULL)
- *revtime = NULL;
-
- return single->status->status;
-}
-
-int wolfSSL_OCSP_resp_count(WOLFSSL_OCSP_BASICRESP *bs)
-{
- WOLFSSL_OCSP_SINGLERESP* single;
- int count = 0;
-
- if (bs == NULL)
- return WOLFSSL_FAILURE;
-
- single = bs->single;
- while(single != NULL)
- {
- ++count;
- single = single->next;
- }
-
- return count;
-}
-
-WOLFSSL_OCSP_SINGLERESP* wolfSSL_OCSP_resp_get0(WOLFSSL_OCSP_BASICRESP *bs, int idx)
-{
- WOLFSSL_OCSP_SINGLERESP* single;
- int currIdx = 0;
-
- if (bs == NULL)
- return NULL;
-
- single = bs->single;
- while(single != NULL && currIdx != idx)
- {
- single = single->next;
- ++currIdx;
- }
-
- return single;
-}
-
-#endif /* OPENSSL_EXTRA */
-
-#ifdef OPENSSL_ALL
-
-/*******************************************************************************
- * START OF WOLFSSL_OCSP_REQ_CTX API
- ******************************************************************************/
-
-enum ocspReqStates {
- ORS_INVALID = 0,
- ORS_HEADER_ADDED,
- ORS_REQ_DONE
-};
-
-enum ocspReqIOStates {
- ORIOS_INVALID = 0,
- ORIOS_WRITE,
- ORIOS_READ
-};
-
-WOLFSSL_OCSP_REQ_CTX* wolfSSL_OCSP_REQ_CTX_new(WOLFSSL_BIO *bio, int maxline)
-{
- WOLFSSL_OCSP_REQ_CTX* ret = NULL;
-
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_new");
-
- if (maxline <= 0)
- maxline = OCSP_MAX_REQUEST_SZ;
-
- ret = (WOLFSSL_OCSP_REQ_CTX*)XMALLOC(sizeof(*ret), NULL,
- DYNAMIC_TYPE_OPENSSL);
- if (ret != NULL) {
- XMEMSET(ret, 0, sizeof(*ret));
- ret->buf = (byte*)XMALLOC((word32)maxline, NULL, DYNAMIC_TYPE_OPENSSL);
- if (ret->buf == NULL)
- goto error;
- ret->reqResp = wolfSSL_BIO_new(wolfSSL_BIO_s_mem());
- ret->bufLen = maxline;
- ret->bio = bio;
- ret->ioState = ORIOS_WRITE;
- }
-
- return ret;
-error:
- wolfSSL_OCSP_REQ_CTX_free(ret);
- return NULL;
-}
-
-void wolfSSL_OCSP_REQ_CTX_free(WOLFSSL_OCSP_REQ_CTX *ctx)
-{
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_free");
- if (ctx != NULL) {
- if (ctx->buf != NULL)
- XFREE(ctx->buf, NULL, DYNAMIC_TYPE_OPENSSL);
- if (ctx->reqResp != NULL)
- wolfSSL_BIO_free(ctx->reqResp);
- XFREE(ctx, NULL, DYNAMIC_TYPE_OPENSSL);
- }
-}
-
-WOLFSSL_OCSP_REQ_CTX* wolfSSL_OCSP_sendreq_new(WOLFSSL_BIO *bio,
- const char *path, OcspRequest *req, int maxline)
-{
- WOLFSSL_OCSP_REQ_CTX* ret = NULL;
-
- WOLFSSL_ENTER("wolfSSL_OCSP_sendreq_new");
-
- ret = wolfSSL_OCSP_REQ_CTX_new(bio, maxline);
- if (ret == NULL)
- return NULL;
-
- if (wolfSSL_OCSP_REQ_CTX_http(ret, "POST", path) != WOLFSSL_SUCCESS)
- goto error;
-
- if (req != NULL &&
- wolfSSL_OCSP_REQ_CTX_set1_req(ret, req) != WOLFSSL_SUCCESS)
- goto error;
-
- return ret;
-error:
- wolfSSL_OCSP_REQ_CTX_free(ret);
- return NULL;
-}
-
-int wolfSSL_OCSP_REQ_CTX_add1_header(WOLFSSL_OCSP_REQ_CTX *ctx,
- const char *name, const char *value)
-{
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_add1_header");
-
- if (name == NULL) {
- WOLFSSL_MSG("Bad parameter");
- return WOLFSSL_FAILURE;
- }
- if (wolfSSL_BIO_puts(ctx->reqResp, name) <= 0) {
- WOLFSSL_MSG("wolfSSL_BIO_puts error");
- return WOLFSSL_FAILURE;
- }
- if (value != NULL) {
- if (wolfSSL_BIO_write(ctx->reqResp, ": ", 2) != 2) {
- WOLFSSL_MSG("wolfSSL_BIO_write error");
- return WOLFSSL_FAILURE;
- }
- if (wolfSSL_BIO_puts(ctx->reqResp, value) <= 0) {
- WOLFSSL_MSG("wolfSSL_BIO_puts error");
- return WOLFSSL_FAILURE;
- }
- }
- if (wolfSSL_BIO_write(ctx->reqResp, "\r\n", 2) != 2) {
- WOLFSSL_MSG("wolfSSL_BIO_write error");
- return WOLFSSL_FAILURE;
- }
-
- ctx->state = ORS_HEADER_ADDED;
-
- return WOLFSSL_SUCCESS;
-}
-
-int wolfSSL_OCSP_REQ_CTX_http(WOLFSSL_OCSP_REQ_CTX *ctx, const char *op,
- const char *path)
-{
- static const char http_hdr[] = "%s %s HTTP/1.0\r\n";
-
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_http");
-
- if (ctx == NULL || op == NULL) {
- WOLFSSL_MSG("Bad parameter");
- return WOLFSSL_FAILURE;
- }
-
- if (path == NULL)
- path = "/";
-
- if (wolfSSL_BIO_printf(ctx->reqResp, http_hdr, op, path) <= 0) {
- WOLFSSL_MSG("WOLFSSL_OCSP_REQ_CTX: wolfSSL_BIO_printf error");
- return WOLFSSL_FAILURE;
- }
-
- ctx->state = ORS_HEADER_ADDED;
-
- return WOLFSSL_SUCCESS;
-}
-
-int wolfSSL_OCSP_REQ_CTX_set1_req(WOLFSSL_OCSP_REQ_CTX *ctx, OcspRequest *req)
-{
- static const char req_hdr[] =
- "Content-Type: application/ocsp-request\r\n"
- "Content-Length: %d\r\n\r\n";
- /* Should be enough to hold Content-Length */
- char req_hdr_buf[sizeof(req_hdr) + 10];
- int req_hdr_buf_len;
- int req_len = wolfSSL_i2d_OCSP_REQUEST(req, NULL);
-
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_set1_req");
-
- if (ctx == NULL || req == NULL) {
- WOLFSSL_MSG("Bad parameters");
- return WOLFSSL_FAILURE;
- }
-
- if (req_len <= 0) {
- WOLFSSL_MSG("wolfSSL_OCSP_REQ_CTX_set1_req: request len error");
- return WOLFSSL_FAILURE;
- }
-
- req_hdr_buf_len =
- XSNPRINTF(req_hdr_buf, sizeof(req_hdr_buf), req_hdr, req_len);
- if (req_hdr_buf_len >= (int)sizeof(req_hdr_buf)) {
- WOLFSSL_MSG("wolfSSL_OCSP_REQ_CTX_set1_req: request too long");
- return WOLFSSL_FAILURE;
- }
-
- if (wolfSSL_BIO_write(ctx->reqResp, req_hdr_buf, req_hdr_buf_len) <= 0) {
- WOLFSSL_MSG("wolfSSL_OCSP_REQ_CTX_set1_req: wolfSSL_BIO_write error");
- return WOLFSSL_FAILURE;
- }
-
- if (wolfSSL_i2d_OCSP_REQUEST_bio(ctx->reqResp, req) <= 0) {
- WOLFSSL_MSG("wolfSSL_OCSP_REQ_CTX_set1_req: request i2d error");
- return WOLFSSL_FAILURE;
- }
-
- ctx->state = ORS_REQ_DONE;
-
- return WOLFSSL_SUCCESS;
-}
-
-static int OCSP_REQ_CTX_bio_cb(char *buf, int sz, void *ctx)
-{
- return BioReceiveInternal((WOLFSSL_BIO*)ctx, NULL, buf, sz);
-}
-
-int wolfSSL_OCSP_REQ_CTX_nbio(WOLFSSL_OCSP_REQ_CTX *ctx)
-{
- WOLFSSL_ENTER("wolfSSL_OCSP_REQ_CTX_nbio");
-
- if (ctx == NULL) {
- WOLFSSL_MSG("Bad parameters");
- return WOLFSSL_FAILURE;
- }
-
- switch ((enum ocspReqIOStates)ctx->ioState) {
- case ORIOS_WRITE:
- case ORIOS_READ:
- break;
- case ORIOS_INVALID:
- default:
- WOLFSSL_MSG("Invalid ctx->ioState state");
- return WOLFSSL_FAILURE;
- }
-
- if (ctx->ioState == ORIOS_WRITE) {
- switch ((enum ocspReqStates)ctx->state) {
- case ORS_HEADER_ADDED:
- /* Write final new line to complete http header */
- if (wolfSSL_BIO_write(ctx->reqResp, "\r\n", 2) != 2) {
- WOLFSSL_MSG("wolfSSL_BIO_write error");
- return WOLFSSL_FAILURE;
- }
- break;
- case ORS_REQ_DONE:
- break;
- case ORS_INVALID:
- default:
- WOLFSSL_MSG("Invalid WOLFSSL_OCSP_REQ_CTX state");
- return WOLFSSL_FAILURE;
- }
- }
-
- switch ((enum ocspReqIOStates)ctx->ioState) {
- case ORIOS_WRITE:
- {
- const unsigned char *req;
- int reqLen = wolfSSL_BIO_get_mem_data(ctx->reqResp, (void*)&req);
- if (reqLen <= 0) {
- WOLFSSL_MSG("wolfSSL_BIO_get_mem_data error");
- return WOLFSSL_FAILURE;
- }
- while (ctx->sent < reqLen) {
- int sent = wolfSSL_BIO_write(ctx->bio, req + ctx->sent,
- reqLen - ctx->sent);
- if (sent <= 0) {
- if (wolfSSL_BIO_should_retry(ctx->bio))
- return WOLFSSL_FATAL_ERROR;
- WOLFSSL_MSG("wolfSSL_BIO_write error");
- ctx->ioState = ORIOS_INVALID;
- return 0;
- }
- ctx->sent += sent;
- }
- ctx->sent = 0;
- ctx->ioState = ORIOS_READ;
- (void)wolfSSL_BIO_reset(ctx->reqResp);
- FALL_THROUGH;
- }
- case ORIOS_READ:
- {
- byte* resp = NULL;
- int respLen;
- int ret;
-
- if (ctx->buf == NULL) /* Should be allocated in new call */
- return WOLFSSL_FAILURE;
-
- ret = wolfIO_HttpProcessResponseOcspGenericIO(OCSP_REQ_CTX_bio_cb,
- ctx->bio, &resp, ctx->buf, ctx->bufLen, NULL);
- if (ret <= 0) {
- if (resp != NULL)
- XFREE(resp, NULL, DYNAMIC_TYPE_OCSP);
- if (ret == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ) ||
- ret == WC_NO_ERR_TRACE(OCSP_WANT_READ))
- {
- return WOLFSSL_FATAL_ERROR;
- }
- return WOLFSSL_FAILURE;
- }
- respLen = ret;
- ret = wolfSSL_BIO_write(ctx->reqResp, resp, respLen);
- XFREE(resp, NULL, DYNAMIC_TYPE_OCSP);
- if (ret != respLen) {
- WOLFSSL_MSG("wolfSSL_BIO_write error");
- return WOLFSSL_FAILURE;
- }
- break;
- }
- case ORIOS_INVALID:
- default:
- WOLFSSL_MSG("Invalid ctx->ioState state");
- return WOLFSSL_FAILURE;
- }
-
- return WOLFSSL_SUCCESS;
-}
-
-int wolfSSL_OCSP_sendreq_nbio(OcspResponse **presp, WOLFSSL_OCSP_REQ_CTX *ctx)
-{
- int ret;
- int len;
- const unsigned char *resp = NULL;
-
- WOLFSSL_ENTER("wolfSSL_OCSP_sendreq_nbio");
-
- if (presp == NULL)
- return WOLFSSL_FAILURE;
-
- ret = wolfSSL_OCSP_REQ_CTX_nbio(ctx);
- if (ret != WOLFSSL_SUCCESS)
- return ret;
-
- len = wolfSSL_BIO_get_mem_data(ctx->reqResp, (void*)&resp);
- if (len <= 0)
- return WOLFSSL_FAILURE;
- return wolfSSL_d2i_OCSP_RESPONSE(presp, &resp, len) != NULL
- ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
-}
-
-/*******************************************************************************
- * END OF WOLFSSL_OCSP_REQ_CTX API
- ******************************************************************************/
-
-#ifndef NO_WOLFSSL_STUB
-int wolfSSL_OCSP_REQUEST_add_ext(OcspRequest* req, WOLFSSL_X509_EXTENSION* ext,
- int idx)
-{
- WOLFSSL_STUB("wolfSSL_OCSP_REQUEST_add_ext");
- (void)req;
- (void)ext;
- (void)idx;
- return WOLFSSL_FATAL_ERROR;
-}
-#endif
-
-#ifndef NO_WOLFSSL_STUB
-OcspResponse* wolfSSL_OCSP_response_create(int status,
- WOLFSSL_OCSP_BASICRESP* bs)
-{
- WOLFSSL_STUB("wolfSSL_OCSP_response_create");
- (void)status;
- (void)bs;
- return NULL;
-}
-#endif
-
-#ifndef NO_WOLFSSL_STUB
-const char* wolfSSL_OCSP_crl_reason_str(long s)
-{
- WOLFSSL_STUB("wolfSSL_OCSP_crl_reason_str");
- (void)s;
- return NULL;
-}
-#endif
-
-/* Returns elements of an OCSP_CERTID struct. Currently only supports
- * returning the serial number, and returns an error if user requests
- * any of name, pmd, and/or keyHash.
- * Return 1 on success, 0 on failure */
-int wolfSSL_OCSP_id_get0_info(WOLFSSL_ASN1_STRING **name,
- WOLFSSL_ASN1_OBJECT **pmd, WOLFSSL_ASN1_STRING **keyHash,
- WOLFSSL_ASN1_INTEGER **serial, WOLFSSL_OCSP_CERTID *cid)
-{
- WOLFSSL_ENTER("wolfSSL_OCSP_id_get0_info");
-
- if (cid == NULL)
- return 0;
-
- /* build up ASN1_INTEGER for serial */
- if (serial != NULL) {
- int i = 0;
- WOLFSSL_ASN1_INTEGER* ser;
-
- ser = wolfSSL_ASN1_INTEGER_new();
- if (ser == NULL)
- return 0;
-
- if (cid->status->serialSz > (WOLFSSL_ASN1_INTEGER_MAX - 2)) {
- /* allocate data buffer, +2 for type and length */
- ser->data = (unsigned char*)XMALLOC((size_t)cid->status->serialSz + 2, NULL,
- DYNAMIC_TYPE_OPENSSL);
- if (ser->data == NULL) {
- wolfSSL_ASN1_INTEGER_free(ser);
- return 0;
- }
- ser->dataMax = (unsigned int)cid->status->serialSz + 2;
- ser->isDynamic = 1;
- } else {
- /* Use array instead of dynamic memory */
- ser->data = ser->intData;
- ser->dataMax = WOLFSSL_ASN1_INTEGER_MAX;
- }
-
- #if defined(WOLFSSL_QT) || defined(WOLFSSL_HAPROXY)
- /* Serial number starts at 0 index of ser->data */
- XMEMCPY(&ser->data[i], cid->status->serial,
- (size_t)cid->status->serialSz);
- ser->length = cid->status->serialSz;
- #else
- ser->data[i++] = ASN_INTEGER;
- i += SetLength(cid->status->serialSz, ser->data + i);
- XMEMCPY(&ser->data[i], cid->status->serial,
- (size_t)cid->status->serialSz);
- ser->length = i + cid->status->serialSz;
- #endif
-
- cid->status->serialInt = ser;
- *serial = ser;
- }
-
- /* Not needed for Apache, return error if user is requesting */
- if (name != NULL || pmd != NULL || keyHash != NULL) {
- if (name != NULL)
- *name = NULL;
-
- if (pmd != NULL)
- *pmd = NULL;
-
- if (keyHash != NULL)
- *keyHash = NULL;
- return 0;
- }
-
- return 1;
-}
-
-int wolfSSL_OCSP_request_add1_nonce(OcspRequest* req, unsigned char* val,
- int sz)
-{
- WC_RNG rng;
-
- WOLFSSL_ENTER("wolfSSL_OCSP_request_add1_nonce");
-
- if (req == NULL || sz > MAX_OCSP_NONCE_SZ) {
- WOLFSSL_MSG("Bad parameter");
- return WOLFSSL_FAILURE;
- }
-
- if (sz <= 0)
- sz = MAX_OCSP_NONCE_SZ;
-
- if (val != NULL) {
- XMEMCPY(req->nonce, val, (size_t)sz);
- }
- else {
- if (
-#ifndef HAVE_FIPS
- wc_InitRng_ex(&rng, req->heap, INVALID_DEVID)
-#else
- wc_InitRng(&rng)
-#endif
- != 0) {
- WOLFSSL_MSG("RNG init failed");
- return WOLFSSL_FAILURE;
- }
- if (wc_RNG_GenerateBlock(&rng, req->nonce, (word32)sz) != 0) {
- WOLFSSL_MSG("wc_RNG_GenerateBlock failed");
- wc_FreeRng(&rng);
- return WOLFSSL_FAILURE;
- }
- wc_FreeRng(&rng);
- }
- req->nonceSz = sz;
-
- return WOLFSSL_SUCCESS;
-}
-
-/* Returns result of OCSP nonce comparison. Return values:
- * 1 - nonces are both present and equal
- * 2 - both nonces are absent
- * 3 - nonce only present in response
- * -1 - nonce only present in request
- * 0 - both nonces present and equal
- */
-int wolfSSL_OCSP_check_nonce(OcspRequest* req, WOLFSSL_OCSP_BASICRESP* bs)
-{
- byte* reqNonce = NULL;
- byte* rspNonce = NULL;
- int reqNonceSz = 0;
- int rspNonceSz = 0;
-
- WOLFSSL_ENTER("wolfSSL_OCSP_check_nonce");
-
- if (req != NULL) {
- reqNonce = req->nonce;
- reqNonceSz = req->nonceSz;
- }
-
- if (bs != NULL) {
- rspNonce = bs->nonce;
- rspNonceSz = bs->nonceSz;
- }
-
- /* nonce absent in both req and rsp */
- if (reqNonce == NULL && rspNonce == NULL)
- return 2;
-
- /* nonce present in rsp only */
- if (reqNonce == NULL && rspNonce != NULL)
- return 3;
-
- /* nonce present in req only */
- if (reqNonce != NULL && rspNonce == NULL)
- return WOLFSSL_FATAL_ERROR;
-
- /* nonces are present and equal, return 1. Extra NULL check for fixing
- scan-build warning. */
- if (reqNonceSz == rspNonceSz && reqNonce && rspNonce) {
- if (XMEMCMP(reqNonce, rspNonce, (size_t)reqNonceSz) == 0)
- return 1;
- }
-
- /* nonces are present but not equal */
- return 0;
-}
-
-#endif /* OPENSSL_ALL */
-
-#else /* HAVE_OCSP */
-
-
-#ifdef _MSC_VER
- /* 4206 warning for blank file */
- #pragma warning(disable: 4206)
-#endif
-
-
-#endif /* HAVE_OCSP */
-#endif /* WOLFCRYPT_ONLY */
diff --git a/src/ssl/wolfssl/quic.c b/src/ssl/wolfssl/quic.c
deleted file mode 100644
index 21f64903b..000000000
--- a/src/ssl/wolfssl/quic.c
+++ /dev/null
@@ -1,1387 +0,0 @@
-/* quic.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
- /* Name change compatibility layer no longer needs to be included here */
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#ifndef WOLFCRYPT_ONLY
-#ifdef WOLFSSL_QUIC
-
-#include
-#include
-#include
-
-#include
-#include
-#include
-#include
-
-
-static int qr_length(const uint8_t *data, size_t len)
-{
- word32 rlen;
- if (len < 4) {
- return 0;
- }
- c24to32(&data[1], &rlen);
- return (int)rlen + 4;
-}
-
-static void quic_record_free(WOLFSSL *ssl, QuicRecord *r)
-{
- (void)ssl;
- if (r->data) {
- ForceZero(r->data, r->capacity);
- XFREE(r->data, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
- }
- XFREE(r, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-}
-
-
-static QuicRecord *quic_record_make(WOLFSSL *ssl,
- WOLFSSL_ENCRYPTION_LEVEL level,
- const uint8_t *data, size_t len)
-{
- QuicRecord *qr;
-
- qr = (QuicRecord*)XMALLOC(sizeof(*qr), ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
- if (qr) {
- memset(qr, 0, sizeof(*qr));
- qr->level = level;
- if (level == wolfssl_encryption_early_data) {
- qr->capacity = qr->len = (word32)len;
- }
- else {
- qr->capacity = qr->len = (word32) qr_length(data, len);
- if (qr->capacity > WOLFSSL_QUIC_MAX_RECORD_CAPACITY) {
- WOLFSSL_MSG("QUIC length read larger than expected");
- quic_record_free(ssl, qr);
- return NULL;
- }
- }
- if (qr->capacity == 0) {
- qr->capacity = 2*1024;
- }
- qr->data = (uint8_t*)XMALLOC(qr->capacity, ssl->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (!qr->data) {
- quic_record_free(ssl, qr);
- return NULL;
- }
- }
- return qr;
-}
-
-static int quic_record_complete(QuicRecord *r)
-{
- return r->len && r->end >= r->len;
-}
-
-static int quic_record_done(QuicRecord *r)
-{
- return r->len && r->end >= r->len && r->start >= r->end;
-}
-
-static int quic_record_append(WOLFSSL *ssl, QuicRecord *qr, const uint8_t *data,
- size_t len, size_t *pconsumed)
-{
- size_t missing, consumed = 0;
- int ret = WOLFSSL_SUCCESS;
-
- (void)ssl;
- if (!qr->len && len) {
- missing = 4 - qr->end;
- if (len < missing) {
- XMEMCPY(qr->data + qr->end, data, len);
- qr->end += (word32)len;
- consumed = len;
- goto cleanup; /* len consumed, but qr->len still unknown */
- }
- XMEMCPY(qr->data + qr->end, data, missing);
- qr->end += (word32)missing;
- len -= missing;
- data += missing;
- consumed = missing;
-
- qr->len = (word32)qr_length(qr->data, qr->end);
-
- /* sanity check on length read from wire before use */
- if (qr->len > WOLFSSL_QUIC_MAX_RECORD_CAPACITY) {
- WOLFSSL_MSG("Length read for quic is larger than expected");
- ret = BUFFER_E;
- goto cleanup;
- }
-
- if (qr->len > qr->capacity) {
- uint8_t *ndata = (uint8_t*)XREALLOC(qr->data, qr->len, ssl->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (!ndata) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
- qr->data = ndata;
- qr->capacity = qr->len;
- }
- }
-
- if (!quic_record_complete(qr) && len != 0) {
- missing = qr->len - qr->end;
- if (len > missing) {
- len = missing;
- }
- XMEMCPY(qr->data + qr->end, data, len);
- qr->end += (word32)len;
- consumed += len;
- }
-
-cleanup:
- *pconsumed = (ret == WOLFSSL_SUCCESS) ? consumed : 0;
- return ret;
-}
-
-
-static word32 add_rec_header(byte* output, word32 length, byte type)
-{
- RecordLayerHeader* rl;
-
- /* record layer header */
- rl = (RecordLayerHeader*)output;
- if (rl == NULL) {
- return 0;
- }
- rl->type = type;
- rl->pvMajor = SSLv3_MAJOR;
- rl->pvMinor = TLSv1_2_MINOR;
- c16toa((word16)length, rl->length);
- return RECORD_HEADER_SZ;
-}
-
-static sword32 quic_record_transfer(QuicRecord* qr, byte* buf, word32 sz)
-{
- word32 len = qr->end - qr->start;
- word32 offset = 0;
- word32 rlen;
-
- if (len <= 0) {
- return 0;
- }
-
- /* We check if the buf is at least RECORD_HEADER_SZ */
- if (sz < RECORD_HEADER_SZ) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (qr->rec_hdr_remain == 0) {
- /* start a new TLS record */
- rlen = (qr->len <= (word32)MAX_RECORD_SIZE) ?
- qr->len : (word32)MAX_RECORD_SIZE;
- offset += add_rec_header(buf, rlen,
- (qr->level == wolfssl_encryption_early_data) ?
- application_data : handshake);
- qr->rec_hdr_remain = rlen;
- sz -= offset;
- }
- if (len > qr->rec_hdr_remain) {
- len = qr->rec_hdr_remain;
- }
- if (len > sz) {
- len = sz;
- }
- if (len > 0) {
- XMEMCPY(buf + offset, qr->data + qr->start, len);
- qr->start += len;
- qr->rec_hdr_remain -= len;
- }
- return (sword32)(len + offset);
-}
-
-
-const QuicTransportParam* QuicTransportParam_new(const uint8_t* data,
- size_t len, void* heap)
-{
- QuicTransportParam* tp;
-
- if (len > 65353) return NULL;
- tp = (QuicTransportParam*)XMALLOC(sizeof(*tp), heap, DYNAMIC_TYPE_TLSX);
- if (!tp) return NULL;
- tp->data = (uint8_t*)XMALLOC(len, heap, DYNAMIC_TYPE_TLSX);
- if (!tp->data) {
- XFREE(tp, heap, DYNAMIC_TYPE_TLSX);
- return NULL;
- }
- XMEMCPY((uint8_t*)tp->data, data, len);
- tp->len = (word16)len;
- return tp;
-}
-
-const QuicTransportParam* QuicTransportParam_dup(const QuicTransportParam* tp,
- void* heap)
-{
- QuicTransportParam* tp2;
- tp2 = (QuicTransportParam*)XMALLOC(sizeof(*tp2), heap, DYNAMIC_TYPE_TLSX);
- if (!tp2) return NULL;
- tp2->data = (uint8_t*)XMALLOC(tp->len, heap, DYNAMIC_TYPE_TLSX);
- if (!tp2->data) {
- XFREE(tp2, heap, DYNAMIC_TYPE_TLSX);
- return NULL;
- }
- XMEMCPY((uint8_t*)tp2->data, tp->data, tp->len);
- tp2->len = tp->len;
- return tp2;
-}
-
-void QuicTransportParam_free(const QuicTransportParam* tp, void* heap)
-{
- (void)heap;
- if (tp) {
- if (tp->data) XFREE((uint8_t*)tp->data, heap, DYNAMIC_TYPE_TLSX);
- XFREE((void*)tp, heap, DYNAMIC_TYPE_TLSX);
- }
-}
-
-
-void wolfSSL_quic_clear(WOLFSSL* ssl)
-{
- QuicEncData* qd;
-
- /* keep
- * - ssl->quic.transport_local
- * - ssl->quic.method
- * - ssl->quic.transport_version
- * reset/free everything else
- */
- if (ssl->quic.transport_peer) {
- QTP_FREE(ssl->quic.transport_peer, ssl->heap);
- ssl->quic.transport_peer = NULL;
- }
- if (ssl->quic.transport_peer_draft) {
- QTP_FREE(ssl->quic.transport_peer_draft, ssl->heap);
- ssl->quic.transport_peer_draft = NULL;
- }
- ssl->quic.enc_level_write = wolfssl_encryption_initial;
- ssl->quic.enc_level_latest_recvd = wolfssl_encryption_initial;
-
- while ((qd = ssl->quic.input_head)) {
- ssl->quic.input_head = qd->next;
- quic_record_free(ssl, qd);
- }
- ssl->quic.input_tail = NULL;
- ssl->quic.output_rec_remain = 0;
-
- if (ssl->quic.scratch) {
- quic_record_free(ssl, ssl->quic.scratch);
- ssl->quic.scratch = NULL;
- }
-}
-
-
-void wolfSSL_quic_free(WOLFSSL* ssl)
-{
- wolfSSL_quic_clear(ssl);
- if (ssl->quic.transport_local) {
- QTP_FREE(ssl->quic.transport_local, ssl->heap);
- ssl->quic.transport_local = NULL;
- }
-
- ssl->quic.method = NULL;
-}
-
-
-static int ctx_check_quic_compat(const WOLFSSL_CTX* ctx)
-{
- WOLFSSL_ENTER("ctx_check_quic_compat");
- if (ctx->method->version.major != SSLv3_MAJOR
- || ctx->method->version.minor != TLSv1_3_MINOR
- || (ctx->method->downgrade && ctx->minDowngrade < TLSv1_3_MINOR)) {
- WOLFSSL_MSG_EX("ctx not quic compatible: vmajor=%d, vminor=%d, downgrade=%d",
- ctx->method->version.major,
- ctx->method->version.minor,
- ctx->method->downgrade
- );
- return WOLFSSL_FAILURE;
- }
- return WOLFSSL_SUCCESS;
-}
-
-static int check_method_sanity(const WOLFSSL_QUIC_METHOD* m)
-{
- WOLFSSL_ENTER("check_method_sanity");
- if (m && m->set_encryption_secrets
- && m->add_handshake_data
- && m->flush_flight
- && m->send_alert) {
- return WOLFSSL_SUCCESS;
- }
- return WOLFSSL_FAILURE;
-}
-
-int wolfSSL_CTX_set_quic_method(WOLFSSL_CTX* ctx,
- const WOLFSSL_QUIC_METHOD* quic_method)
-{
- WOLFSSL_ENTER("wolfSSL_CTX_set_quic_method");
- if (ctx_check_quic_compat(ctx) != WOLFSSL_SUCCESS
- || check_method_sanity(quic_method) != WOLFSSL_SUCCESS) {
- return WOLFSSL_FAILURE;
- }
- ctx->quic.method = quic_method;
- return WOLFSSL_SUCCESS;
-}
-
-
-int wolfSSL_set_quic_method(WOLFSSL* ssl,
- const WOLFSSL_QUIC_METHOD* quic_method)
-{
- WOLFSSL_ENTER("wolfSSL_set_quic_method");
- if (ctx_check_quic_compat(ssl->ctx) != WOLFSSL_SUCCESS
- || check_method_sanity(quic_method) != WOLFSSL_SUCCESS) {
- return WOLFSSL_FAILURE;
- }
- ssl->quic.method = quic_method;
- return WOLFSSL_SUCCESS;
-}
-
-
-int wolfSSL_is_quic(WOLFSSL* ssl)
-{
- return WOLFSSL_IS_QUIC(ssl);
-}
-
-
-WOLFSSL_ENCRYPTION_LEVEL wolfSSL_quic_read_level(const WOLFSSL* ssl)
-{
- return ssl->quic.enc_level_read;
-}
-
-
-WOLFSSL_ENCRYPTION_LEVEL wolfSSL_quic_write_level(const WOLFSSL* ssl)
-{
- return ssl->quic.enc_level_write;
-}
-
-
-int wolfSSL_set_quic_transport_params(WOLFSSL* ssl,
- const uint8_t* params,
- size_t params_len)
-{
- const QuicTransportParam* tp;
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_set_quic_transport_params");
-
- if (!params || params_len == 0) {
- tp = NULL;
- }
- else {
- tp = QuicTransportParam_new(params, params_len, ssl->heap);
- if (!tp) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
- }
- if (ssl->quic.transport_local)
- QTP_FREE(ssl->quic.transport_local, ssl->heap);
- ssl->quic.transport_local = tp;
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_set_quic_transport_params", ret);
- return ret;
-}
-
-
-void wolfSSL_get_peer_quic_transport_params(const WOLFSSL* ssl,
- const uint8_t** out_params,
- size_t* out_params_len)
-{
- const QuicTransportParam* tp = ssl->quic.transport_peer ?
- ssl->quic.transport_peer : ssl->quic.transport_peer_draft;
-
- *out_params = tp ? tp->data : NULL;
- *out_params_len = tp ? tp->len : 0;
-}
-
-
-int wolfSSL_get_peer_quic_transport_version(const WOLFSSL* ssl)
-{
- return ssl->quic.transport_peer ?
- TLSX_KEY_QUIC_TP_PARAMS : (ssl->quic.transport_peer_draft ?
- TLSX_KEY_QUIC_TP_PARAMS : -1);
-}
-
-
-void wolfSSL_set_quic_use_legacy_codepoint(WOLFSSL* ssl, int use_legacy)
-{
- ssl->quic.transport_version = use_legacy ? TLSX_KEY_QUIC_TP_PARAMS_DRAFT
- : TLSX_KEY_QUIC_TP_PARAMS;
-}
-
-void wolfSSL_set_quic_transport_version(WOLFSSL* ssl, int version)
-{
- if (version == TLSX_KEY_QUIC_TP_PARAMS
- || version == TLSX_KEY_QUIC_TP_PARAMS_DRAFT
- || !version) {
- ssl->quic.transport_version = version;
- }
- else {
- WOLFSSL_MSG("wolfSSL_set_quic_transport_version: invalid version");
- }
-}
-
-
-int wolfSSL_get_quic_transport_version(const WOLFSSL* ssl)
-{
- return ssl->quic.transport_version;
-}
-
-
-int wolfSSL_quic_add_transport_extensions(WOLFSSL* ssl, int msg_type)
-{
- /* RFC 9001, ch. 8.2: "The quic_transport_parameters extension is carried
- * in the ClientHello and the EncryptedExtensions messages during the
- * handshake. Endpoints MUST send the quic_transport_parameters extension;"
- * Which means, at least one. There can be more to signal compatibility to
- * older/newer versions.
- */
- int ret = 0, is_resp = (msg_type == encrypted_extensions);
-
- if (ssl->quic.transport_local == NULL) {
- return QUIC_TP_MISSING_E;
- }
-
- if (is_resp) {
- /* server response: time to decide which version to use */
- if (ssl->quic.transport_peer && ssl->quic.transport_peer_draft) {
- if (ssl->quic.transport_version == TLSX_KEY_QUIC_TP_PARAMS_DRAFT) {
- ret = TLSX_QuicTP_Use(ssl,
- TLSX_KEY_QUIC_TP_PARAMS_DRAFT, is_resp);
- QTP_FREE(ssl->quic.transport_peer, ssl->heap);
- ssl->quic.transport_peer = NULL;
- }
- else {
- ret = TLSX_QuicTP_Use(ssl, TLSX_KEY_QUIC_TP_PARAMS, is_resp);
- QTP_FREE(ssl->quic.transport_peer_draft,
- ssl->heap);
- ssl->quic.transport_peer_draft = NULL;
- }
- }
- else {
- if (ssl->quic.transport_version == TLSX_KEY_QUIC_TP_PARAMS_DRAFT
- && ssl->quic.transport_peer_draft) {
- ret = TLSX_QuicTP_Use(ssl, TLSX_KEY_QUIC_TP_PARAMS_DRAFT,
- is_resp);
- }
- else if (ssl->quic.transport_peer) {
- ret = TLSX_QuicTP_Use(ssl, TLSX_KEY_QUIC_TP_PARAMS, is_resp);
- }
- else {
- /* no match, send none, will let the client fail */
- }
- }
- }
- else {
- /* client hello */
- if (ssl->quic.transport_version == 0) {
- /* not being set to a particular id, we send both draft+v1 */
- ret = TLSX_QuicTP_Use(ssl, TLSX_KEY_QUIC_TP_PARAMS, is_resp)
- || TLSX_QuicTP_Use(ssl, TLSX_KEY_QUIC_TP_PARAMS_DRAFT, is_resp);
- }
- else {
- /* otherwise, send the version configured */
- ret = TLSX_QuicTP_Use(ssl, (TLSX_Type)ssl->quic.transport_version,
- is_resp);
- }
- }
- return ret;
-}
-
-
-#define QUIC_HS_FLIGHT_LIMIT_DEFAULT (16* 1024)
-
-size_t wolfSSL_quic_max_handshake_flight_len(const WOLFSSL* ssl,
- WOLFSSL_ENCRYPTION_LEVEL level)
-{
- switch (level) {
- case wolfssl_encryption_initial:
- case wolfssl_encryption_application:
- return QUIC_HS_FLIGHT_LIMIT_DEFAULT;
- case wolfssl_encryption_early_data:
- return 0; /* QUIC does not send at this level */
- case wolfssl_encryption_handshake:
- /* during handshake itself, certificates may be exchanged which
- * exceed our default limit, advise a higher limit one.
- */
- if (ssl->options.side == WOLFSSL_SERVER_END) {
- if (ssl->options.verifyPeer
- && MAX_CERTIFICATE_SZ > QUIC_HS_FLIGHT_LIMIT_DEFAULT)
- return MAX_CERTIFICATE_SZ;
- }
- else {
- /* clients may receive the server cert chain
- */
- if (2*MAX_CERTIFICATE_SZ > QUIC_HS_FLIGHT_LIMIT_DEFAULT)
- return 2*MAX_CERTIFICATE_SZ;
- }
- return QUIC_HS_FLIGHT_LIMIT_DEFAULT;
- }
- return 0;
-}
-
-
-#ifdef WOLFSSL_EARLY_DATA
-void wolfSSL_set_quic_early_data_enabled(WOLFSSL* ssl, int enabled)
-{
- /* This only has effect on server and when the handshake has
- * not started yet.
- * This function is part of the quictls/openssl API and does
- * not return any error, sadly. So we just ignore any
- * unsuccessful use. But we can produce some warnings.
- */
- if (!WOLFSSL_IS_QUIC(ssl)) {
- WOLFSSL_MSG("wolfSSL_set_quic_early_data_enabled: not a QUIC SSL");
- }
- else if (ssl->options.handShakeState != NULL_STATE) {
- WOLFSSL_MSG("wolfSSL_set_quic_early_data_enabled: handshake started");
- }
- else {
- wolfSSL_set_max_early_data(ssl, enabled ? UINT32_MAX : 0);
- }
-}
-#endif /* WOLFSSL_EARLY_DATA */
-
-int wolfSSL_quic_do_handshake(WOLFSSL* ssl)
-{
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_quic_do_handshake");
-
- if (!wolfSSL_is_quic(ssl)) {
- WOLFSSL_MSG("WOLFSSL_QUIC_DO_HANDSHAKE not a QUIC SSL");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- while (ssl->options.handShakeState != HANDSHAKE_DONE) {
- /* Peculiar: do_handshake() is successful, but the state
- * indicates that we are not DONE. This seems to happen
- * when resuming sessions and an EARLY_DATA indicator
- * is presented by the client.
- * Theory: wolfSSL expects the APP to read the early data
- * and silently continues the handshake when the EndOfEarlyData
- * and the client Finished arrives.
- * This confuses the QUIC state handling.
- */
-#ifdef WOLFSSL_EARLY_DATA
- if (ssl->options.maxEarlyDataSz) {
- byte tmpbuffer[256];
- int len;
-
- if (ssl->options.side == WOLFSSL_CLIENT_END) {
- if (ssl->options.resuming) {
- ret = wolfSSL_write_early_data(ssl, tmpbuffer, 0, &len);
- }
- }
- else {
- ret = wolfSSL_read_early_data(ssl, tmpbuffer,
- sizeof(tmpbuffer), &len);
- }
- if (ret < 0) {
- goto cleanup;
- }
- }
-#endif /* WOLFSSL_EARLY_DATA */
-
- ret = wolfSSL_SSL_do_handshake_internal(ssl);
- if (ret <= 0)
- goto cleanup;
- }
-
-cleanup:
- if (ret <= 0
- && ssl->options.handShakeState == HANDSHAKE_DONE
- && (ssl->error == WC_NO_ERR_TRACE(ZERO_RETURN) ||
- ssl->error == WC_NO_ERR_TRACE(WANT_READ)))
- {
- ret = WOLFSSL_SUCCESS;
- }
- if (ret == WOLFSSL_SUCCESS) {
- ssl->error = WOLFSSL_ERROR_NONE;
- }
- WOLFSSL_LEAVE("wolfSSL_quic_do_handshake", ret);
- return ret;
-}
-
-int wolfSSL_quic_read_write(WOLFSSL* ssl)
-{
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_quic_read_write");
-
- if (!wolfSSL_is_quic(ssl)) {
- WOLFSSL_MSG("WOLFSSL_QUIC_READ_WRITE not a QUIC SSL");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (ssl->options.handShakeState != HANDSHAKE_DONE) {
- ret = wolfSSL_quic_do_handshake(ssl);
- if (ret != WOLFSSL_SUCCESS)
- goto cleanup;
- }
-
- ret = wolfSSL_process_quic_post_handshake(ssl);
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_quic_read_write", ret);
- return ret;
-}
-
-int wolfSSL_process_quic_post_handshake(WOLFSSL* ssl)
-{
- int ret = WOLFSSL_SUCCESS, nret;
-
- WOLFSSL_ENTER("wolfSSL_process_quic_post_handshake");
-
- if (!wolfSSL_is_quic(ssl)) {
- WOLFSSL_MSG("WOLFSSL_QUIC_POST_HS not a QUIC SSL");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (ssl->options.handShakeState != HANDSHAKE_DONE) {
- WOLFSSL_MSG("WOLFSSL_QUIC_POST_HS handshake is not done yet");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- while (ssl->quic.input_head != NULL
- || ssl->buffers.inputBuffer.length > 0) {
- if ((nret = ProcessReply(ssl)) < 0) {
- ret = nret;
- break;
- }
- }
- while (ssl->buffers.outputBuffer.length > 0) {
- SendBuffered(ssl);
- }
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_process_quic_post_handshake", ret);
- return ret;
-}
-
-
-int wolfSSL_provide_quic_data(WOLFSSL* ssl, WOLFSSL_ENCRYPTION_LEVEL level,
- const uint8_t* data, size_t len)
-{
- int ret = WOLFSSL_SUCCESS;
- size_t l;
-
- WOLFSSL_ENTER("wolfSSL_provide_quic_data");
- if (!wolfSSL_is_quic(ssl)) {
- WOLFSSL_MSG("WOLFSSL_QUIC_PROVIDE_DATA not a QUIC SSL");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (level < wolfSSL_quic_read_level(ssl)
- || (ssl->quic.input_tail && level < ssl->quic.input_tail->level)
- || level < ssl->quic.enc_level_latest_recvd) {
- WOLFSSL_MSG("WOLFSSL_QUIC_PROVIDE_DATA wrong encryption level");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- while (len > 0) {
- if (ssl->quic.scratch) {
- if (ssl->quic.scratch->level != level) {
- WOLFSSL_MSG("WOLFSSL_QUIC_PROVIDE_DATA wrong encryption level");
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- ret = quic_record_append(ssl, ssl->quic.scratch, data, len, &l);
- if (ret != WOLFSSL_SUCCESS) {
- goto cleanup;
- }
- data += l;
- len -= l;
- if (quic_record_complete(ssl->quic.scratch)) {
- if (ssl->quic.input_tail) {
- ssl->quic.input_tail->next = ssl->quic.scratch;
- ssl->quic.input_tail = ssl->quic.scratch;
- }
- else {
- ssl->quic.input_head = ssl->quic.input_tail =
- ssl->quic.scratch;
- }
- ssl->quic.scratch = NULL;
- }
- }
- else {
- /* start of next record with all bytes for the header */
- ssl->quic.scratch = quic_record_make(ssl, level, data, len);
- if (!ssl->quic.scratch) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
- }
- }
-
- ssl->quic.enc_level_latest_recvd = level;
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_provide_quic_data", ret);
- return ret;
-}
-
-
-/* Called internally when SSL wants a certain amount of input. */
-int wolfSSL_quic_receive(WOLFSSL* ssl, byte* buf, word32 sz)
-{
- sword32 n = 0;
- int transferred = 0;
-
- WOLFSSL_ENTER("wolfSSL_quic_receive");
- while (sz > 0) {
- n = 0;
- if (ssl->quic.input_head) {
- n = quic_record_transfer(ssl->quic.input_head, buf, sz);
-
- /* record too small to be fit into a RecordLayerHeader struct. */
- if (n == -1) {
- return WOLFSSL_FATAL_ERROR;
- }
- if (quic_record_done(ssl->quic.input_head)) {
- QuicRecord* qr = ssl->quic.input_head;
- ssl->quic.input_head = qr->next;
- if (!qr->next) {
- ssl->quic.input_tail = NULL;
- }
- quic_record_free(ssl, qr);
- }
- }
-
- if (n == 0) {
- if (transferred > 0) {
- goto cleanup;
- }
- ssl->error = transferred = WANT_READ;
- goto cleanup;
- }
- sz -= (word32)n;
- buf += n;
- transferred += (int)n;
- }
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_quic_receive", transferred);
- return transferred;
-}
-
-/**
- * We need to forward the HANDSHAKE messages to the QUIC protocol stack
- * via ssl->quic.method->add_handshake_data().
- * The messages in the output buffer are unencrypted TLS records. We need
- * to forward the content of those records.
- */
-static int wolfSSL_quic_send_internal(WOLFSSL* ssl)
-{
- int ret = 0, aret;
- size_t len;
- RecordLayerHeader* rl;
- word16 rlen;
- word32 idx, length;
- byte* output;
-
- WOLFSSL_ENTER("wolfSSL_quic_send");
-
- idx = ssl->buffers.outputBuffer.idx;
- length = ssl->buffers.outputBuffer.length;
- output = ssl->buffers.outputBuffer.buffer + idx;
- while (length > 0) {
- if (ssl->quic.output_rec_remain > 0) {
- len = ssl->quic.output_rec_remain;
- if (len > length) {
- len = length;
- }
-
- aret = ssl->quic.method->add_handshake_data(ssl,
- ssl->quic.output_rec_level, (const uint8_t*)output, len);
- if (aret != 1) {
- /* The application has an error. General disaster. */
- WOLFSSL_MSG("WOLFSSL_QUIC_SEND application failed");
- ret = FWRITE_ERROR;
- goto cleanup;
- }
- output += len;
- length -= (word32)len;
- ssl->quic.output_rec_remain -= (word32)len;
- }
- else {
- /* at start of a TLS Record */
- rl = (RecordLayerHeader*)output;
- ato16(rl->length, &rlen);
- output += RECORD_HEADER_SZ;
- length -= RECORD_HEADER_SZ;
- ssl->quic.output_rec_remain = rlen;
- ssl->quic.output_rec_level = ssl->quic.enc_level_write;
- if (rl->type == application_data) {
- if (ssl->options.handShakeState != HANDSHAKE_DONE) {
- ssl->quic.output_rec_level = wolfssl_encryption_early_data;
- }
- else {
- WOLFSSL_MSG("WOLFSSL_QUIC_SEND app data after handshake");
- ret = FWRITE_ERROR;
- goto cleanup;
- }
- }
- }
- }
-
- ssl->buffers.outputBuffer.idx = 0;
- ssl->buffers.outputBuffer.length = 0;
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_quic_send", ret);
- return ret;
-}
-
-int wolfSSL_quic_send(WOLFSSL* ssl)
-{
- return wolfSSL_quic_send_internal(ssl);
-}
-
-int wolfSSL_quic_forward_secrets(WOLFSSL* ssl, int ktype, int side)
-{
- const uint8_t* rx_secret = NULL, *tx_secret = NULL;
- WOLFSSL_ENCRYPTION_LEVEL level;
- int ret = 0;
-
- WOLFSSL_ENTER("wolfSSL_quic_forward_secrets");
- switch (ktype) {
- case early_data_key:
- level = wolfssl_encryption_early_data;
- break;
- case handshake_key:
- level = wolfssl_encryption_handshake;
- break;
- case traffic_key:
- FALL_THROUGH;
- case update_traffic_key:
- level = wolfssl_encryption_application;
- break;
- case no_key:
- FALL_THROUGH;
- default:
- /* ignore */
- goto cleanup;
- }
-
- if (side == ENCRYPT_AND_DECRYPT_SIDE || side == ENCRYPT_SIDE_ONLY) {
- tx_secret = (ssl->options.side == WOLFSSL_CLIENT_END) ?
- ssl->clientSecret : ssl->serverSecret;
- }
- if (side == ENCRYPT_AND_DECRYPT_SIDE || side == DECRYPT_SIDE_ONLY) {
- rx_secret = (ssl->options.side == WOLFSSL_CLIENT_END) ?
- ssl->serverSecret : ssl->clientSecret;
- }
-
- if (!tx_secret && !rx_secret) {
- WOLFSSL_MSG("WOLFSSL_QUIC_FORWARD_SECRETS neither "
- "enc- nor decrypt specified");
- goto cleanup;
- }
-
- if(!ssl->quic.method->set_encryption_secrets(
- ssl, level, rx_secret, tx_secret, ssl->specs.hash_size)) {
- WOLFSSL_MSG("WOLFSSL_QUIC_FORWARD_SECRETS failed");
- ret = WOLFSSL_FATAL_ERROR;
- goto cleanup;
- }
-
- /* Having installed the secrets, any future read/write will happen
- * at the level. Except early data, which is detected on the record
- * type and the handshake state. */
- if (ktype == early_data_key) {
- goto cleanup;
- }
-
- if (tx_secret && ssl->quic.enc_level_write != level) {
- ssl->quic.enc_level_write_next = level;
- }
- if (rx_secret && ssl->quic.enc_level_read != level) {
- ssl->quic.enc_level_read_next = level;
- }
-
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_quic_forward_secrets", ret);
- return ret;
-}
-
-int wolfSSL_quic_keys_active(WOLFSSL* ssl, enum encrypt_side side)
-{
- int ret = 0;
-
- WOLFSSL_ENTER("wolfSSL_quic_keys_active");
- /* Keys derived from recent secrets have been activated */
- if (side == ENCRYPT_AND_DECRYPT_SIDE || side == ENCRYPT_SIDE_ONLY) {
- /* If there is data in the output buffers, it was supposed to be
- * encrypted at the previous level. We need to remember that when
- * forwarding this data to the QUIC protocol application. */
- if (ssl->buffers.outputBuffer.length > 0) {
- ret = wolfSSL_quic_send_internal(ssl);
- if (ret)
- goto cleanup;
- }
- ssl->quic.enc_level_write = ssl->quic.enc_level_write_next;
- }
- if (side == ENCRYPT_AND_DECRYPT_SIDE || side == DECRYPT_SIDE_ONLY) {
- ssl->quic.enc_level_read = ssl->quic.enc_level_read_next;
- }
-cleanup:
- WOLFSSL_LEAVE("wolfSSL_quic_keys_active", ret);
- return ret;
-}
-
-const WOLFSSL_EVP_CIPHER* wolfSSL_quic_get_aead(WOLFSSL* ssl)
-{
- WOLFSSL_CIPHER* cipher = NULL;
- const WOLFSSL_EVP_CIPHER* evp_cipher = NULL;
-
- if (ssl == NULL) {
- return NULL;
- }
-
- cipher = wolfSSL_get_current_cipher(ssl);
-
- if (cipher == NULL) {
- return NULL;
- }
-
- switch (cipher->cipherSuite) {
-#if !defined(NO_AES) && defined(HAVE_AESGCM)
- #ifdef WOLFSSL_AES_128
- case TLS_AES_128_GCM_SHA256:
- evp_cipher = wolfSSL_EVP_aes_128_gcm();
- break;
- #endif
- #ifdef WOLFSSL_AES_256
- case TLS_AES_256_GCM_SHA384:
- evp_cipher = wolfSSL_EVP_aes_256_gcm();
- break;
- #endif
-#endif
-#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
- case TLS_CHACHA20_POLY1305_SHA256:
- evp_cipher = wolfSSL_EVP_chacha20_poly1305();
- break;
-#endif
-#if !defined(NO_AES) && defined(HAVE_AESCCM) && defined(WOLFSSL_AES_128)
- case TLS_AES_128_CCM_SHA256:
- evp_cipher = wolfSSL_EVP_aes_128_ccm();
- break;
- case TLS_AES_128_CCM_8_SHA256:
- WOLFSSL_MSG("wolfSSL_quic_get_aead: no CCM-8 support in EVP layer");
- evp_cipher = NULL;
- break;
-#endif
-
- default:
- evp_cipher = NULL;
- break;
- }
-
- if (!evp_cipher) {
- /* should not happen, as SSL* should not have negotiated it? */
- WOLFSSL_MSG("wolfSSL_quic_get_aead: current cipher not supported");
- return NULL;
- }
- return evp_cipher;
-}
-
-/* currently only used if HAVE_CHACHA && HAVE_POLY1305. */
-WC_MAYBE_UNUSED static int evp_cipher_eq(const WOLFSSL_EVP_CIPHER* c1,
- const WOLFSSL_EVP_CIPHER* c2)
-{
- /* We could check on nid equality, but we seem to have singulars */
- return c1 == c2;
-}
-
-const WOLFSSL_EVP_CIPHER* wolfSSL_quic_get_hp(WOLFSSL* ssl)
-{
- WOLFSSL_CIPHER* cipher = NULL;
- const WOLFSSL_EVP_CIPHER* evp_cipher = NULL;
-
- if (ssl == NULL) {
- return NULL;
- }
-
- cipher = wolfSSL_get_current_cipher(ssl);
-
- if (cipher == NULL) {
- return NULL;
- }
-
- switch (cipher->cipherSuite) {
-#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(WOLFSSL_AES_COUNTER)
- /* This has to be CTR even though the spec says that ECB is used for
- * mask generation. ngtcp2_crypto_hp_mask uses a hack where they pass
- * in the "ECB" input as the IV for the CTR cipher and then the input
- * is just a cleared buffer. They do this so that the EVP
- * init-update-final cycle can be used without the padding that is added
- * for EVP_aes_(128|256)_ecb. */
-#if defined(WOLFSSL_AES_128)
- case TLS_AES_128_GCM_SHA256:
- evp_cipher = wolfSSL_EVP_aes_128_ctr();
- break;
-#endif
-#if defined(WOLFSSL_AES_256)
- case TLS_AES_256_GCM_SHA384:
- evp_cipher = wolfSSL_EVP_aes_256_ctr();
- break;
-#endif
-#endif
-#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
- case TLS_CHACHA20_POLY1305_SHA256:
- evp_cipher = wolfSSL_EVP_chacha20();
- break;
-#endif
-#if !defined(NO_AES) && defined(HAVE_AESCCM) && defined(WOLFSSL_AES_128) && \
- defined(WOLFSSL_AES_COUNTER)
- /* This has to be CTR. See comment above. */
- case TLS_AES_128_CCM_SHA256:
- evp_cipher = wolfSSL_EVP_aes_128_ctr();
- break;
- case TLS_AES_128_CCM_8_SHA256:
- WOLFSSL_MSG("wolfSSL_quic_get_hp: no CCM-8 support in EVP layer");
- evp_cipher = NULL;
- break;
-#endif
- default:
- evp_cipher = NULL;
- break;
- }
-
- if (!evp_cipher) {
- /* should not happen, as SSL* should not have negotiated it? */
- WOLFSSL_MSG("wolfSSL_quic_get_hp: current cipher not supported");
- return NULL;
- }
- return evp_cipher;
-}
-
-size_t wolfSSL_quic_get_aead_tag_len(const WOLFSSL_EVP_CIPHER* aead_cipher)
-{
- size_t ret;
-#ifdef WOLFSSL_SMALL_STACK
- WOLFSSL_EVP_CIPHER_CTX *ctx = wolfSSL_EVP_CIPHER_CTX_new();
- if (ctx == NULL)
- return 0;
-#else
- WOLFSSL_EVP_CIPHER_CTX ctx[1];
-#endif
-
- XMEMSET(ctx, 0, sizeof(*ctx));
- if (wolfSSL_EVP_CipherInit(ctx, aead_cipher, NULL, NULL, 0)
- == WOLFSSL_SUCCESS) {
- ret = (size_t)ctx->authTagSz;
- } else {
- ret = 0;
- }
-
- (void)wolfSSL_EVP_CIPHER_CTX_cleanup(ctx);
- WC_FREE_VAR_EX(ctx, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-int wolfSSL_quic_aead_is_gcm(const WOLFSSL_EVP_CIPHER* aead_cipher)
-{
- return WOLFSSL_EVP_CIPHER_mode(aead_cipher) == WOLFSSL_EVP_CIPH_GCM_MODE;
-}
-
-int wolfSSL_quic_aead_is_ccm(const WOLFSSL_EVP_CIPHER* aead_cipher)
-{
- return WOLFSSL_EVP_CIPHER_mode(aead_cipher) == WOLFSSL_EVP_CIPH_CCM_MODE;
-}
-
-int wolfSSL_quic_aead_is_chacha20(const WOLFSSL_EVP_CIPHER* aead_cipher)
-{
-#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
- return evp_cipher_eq(aead_cipher, wolfSSL_EVP_chacha20_poly1305());
-#else
- (void)aead_cipher;
- return 0;
-#endif
-}
-
-const WOLFSSL_EVP_MD* wolfSSL_quic_get_md(WOLFSSL* ssl)
-{
- /* a copy from the handshake md setup */
- switch(ssl->specs.mac_algorithm) {
- case no_mac:
- #ifndef NO_MD5
- case md5_mac:
- return wolfSSL_EVP_md5();
- #endif
- #ifndef NO_SHA
- case sha_mac:
- return wolfSSL_EVP_sha1();
- #endif
- #ifdef WOLFSSL_SHA224
- case sha224_mac:
- return wolfSSL_EVP_sha224();
- #endif
- case sha256_mac:
- return wolfSSL_EVP_sha256();
- #ifdef WOLFSSL_SHA384
- case sha384_mac:
- return wolfSSL_EVP_sha384();
- #endif
- #ifdef WOLFSSL_SHA512
- case sha512_mac:
- return wolfSSL_EVP_sha512();
- #endif
- case rmd_mac:
- case blake2b_mac:
- WOLFSSL_MSG("no suitable EVP_MD");
- return NULL;
- default:
- WOLFSSL_MSG("Unknown mac algorithm");
- return NULL;
- }
-}
-
-#ifdef OPENSSL_EXTRA
-
-int wolfSSL_quic_hkdf_extract(uint8_t* dest, const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* salt, size_t saltlen)
-{
- WOLFSSL_EVP_PKEY_CTX* pctx = NULL;
- size_t destlen = (size_t)wolfSSL_EVP_MD_size(md);
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_quic_hkdf_extract");
-
- pctx = wolfSSL_EVP_PKEY_CTX_new_id(WC_NID_hkdf, NULL);
- if (pctx == NULL) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (wolfSSL_EVP_PKEY_derive_init(pctx) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_hkdf_mode(
- pctx, WOLFSSL_EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set_hkdf_md(pctx, md) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_salt(
- pctx, (byte*)salt, (int)saltlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_key(
- pctx, (byte*)secret, (int)secretlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_derive(pctx, dest, &destlen) != WOLFSSL_SUCCESS) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
-cleanup:
- if (pctx)
- wolfSSL_EVP_PKEY_CTX_free(pctx);
- WOLFSSL_LEAVE("wolfSSL_quic_hkdf_extract", ret);
- return ret;
-}
-
-
-int wolfSSL_quic_hkdf_expand(uint8_t* dest, size_t destlen,
- const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* info, size_t infolen)
-{
- WOLFSSL_EVP_PKEY_CTX* pctx = NULL;
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_quic_hkdf_expand");
-
- pctx = wolfSSL_EVP_PKEY_CTX_new_id(WC_NID_hkdf, NULL);
- if (pctx == NULL) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (wolfSSL_EVP_PKEY_derive_init(pctx) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_hkdf_mode(
- pctx, WOLFSSL_EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set_hkdf_md(pctx, md) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_salt(
- pctx, (byte*)"", 0) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_key(
- pctx, (byte*)secret, (int)secretlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_add1_hkdf_info(
- pctx, (byte*)info, (int)infolen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_derive(pctx, dest, &destlen) != WOLFSSL_SUCCESS) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
-cleanup:
- if (pctx)
- wolfSSL_EVP_PKEY_CTX_free(pctx);
- WOLFSSL_LEAVE("wolfSSL_quic_hkdf_expand", ret);
- return ret;
-}
-
-
-int wolfSSL_quic_hkdf(uint8_t* dest, size_t destlen,
- const WOLFSSL_EVP_MD* md,
- const uint8_t* secret, size_t secretlen,
- const uint8_t* salt, size_t saltlen,
- const uint8_t* info, size_t infolen)
-{
- WOLFSSL_EVP_PKEY_CTX* pctx = NULL;
- int ret = WOLFSSL_SUCCESS;
-
- WOLFSSL_ENTER("wolfSSL_quic_hkdf");
-
- pctx = wolfSSL_EVP_PKEY_CTX_new_id(WC_NID_hkdf, NULL);
- if (pctx == NULL) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
- if (wolfSSL_EVP_PKEY_derive_init(pctx) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_hkdf_mode(
- pctx, WOLFSSL_EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set_hkdf_md(pctx, md) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_salt(
- pctx, (byte*)salt, (int)saltlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_set1_hkdf_key(
- pctx, (byte*)secret, (int)secretlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_CTX_add1_hkdf_info(
- pctx, (byte*)info, (int)infolen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_PKEY_derive(pctx, dest, &destlen) != WOLFSSL_SUCCESS) {
- ret = WOLFSSL_FAILURE;
- goto cleanup;
- }
-
-cleanup:
- if (pctx)
- wolfSSL_EVP_PKEY_CTX_free(pctx);
- WOLFSSL_LEAVE("wolfSSL_quic_hkdf", ret);
- return ret;
-}
-
-#endif /* OPENSSL_EXTRA */
-
-
-WOLFSSL_EVP_CIPHER_CTX* wolfSSL_quic_crypt_new(const WOLFSSL_EVP_CIPHER* cipher,
- const uint8_t* key,
- const uint8_t* iv,
- int encrypt)
-{
- WOLFSSL_EVP_CIPHER_CTX* ctx;
-
- ctx = wolfSSL_EVP_CIPHER_CTX_new();
- if (ctx == NULL) {
- return NULL;
- }
-
- if (wolfSSL_EVP_CipherInit(ctx, cipher, key, iv, encrypt)
- != WOLFSSL_SUCCESS) {
- wolfSSL_EVP_CIPHER_CTX_free(ctx);
- return NULL;
- }
-
- return ctx;
-}
-
-
-int wolfSSL_quic_aead_encrypt(uint8_t* dest, WOLFSSL_EVP_CIPHER_CTX* ctx,
- const uint8_t* plain, size_t plainlen,
- const uint8_t* iv, const uint8_t* aad,
- size_t aadlen)
-{
- int len;
-
- /* A case can be made if this really should be a function in wolfSSL, since
- * the same should be doable from the API by a QUIC protocol stack.
- * What speaks for this:
- * - it gives us a decent testing point
- * - API users do not have to re-invent (it fits into ngtcp2 use).
- * picotls offers a similar abstraction level for AEAD.
- * TODO: there is some fiddling in OpenSSL+quic in regard to CCM ciphers
- * which we need to check.
- */
- if (wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 1) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherUpdate(
- ctx, NULL, &len, aad, (int)aadlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherUpdate(
- ctx, dest, &len, plain, (int)plainlen) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherFinal(ctx, dest + len, &len) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CIPHER_CTX_ctrl(
- ctx, WOLFSSL_EVP_CTRL_AEAD_GET_TAG, ctx->authTagSz, dest + plainlen)
- != WOLFSSL_SUCCESS) {
- return WOLFSSL_FAILURE;
- }
-
- return WOLFSSL_SUCCESS;
-}
-
-
-int wolfSSL_quic_aead_decrypt(uint8_t* dest, WOLFSSL_EVP_CIPHER_CTX* ctx,
- const uint8_t* enc, size_t enclen,
- const uint8_t* iv, const uint8_t* aad,
- size_t aadlen)
-{
- int len;
- const uint8_t* tag;
-
- /* See rationale for wolfSSL_quic_aead_encrypt() on why this is here */
- if (enclen > INT_MAX || ctx->authTagSz > (int)enclen) {
- return WOLFSSL_FAILURE;
- }
-
- enclen -= (size_t)ctx->authTagSz;
- tag = enc + enclen;
-
- if (wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 0) != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CIPHER_CTX_ctrl(
- ctx, WOLFSSL_EVP_CTRL_AEAD_SET_TAG, ctx->authTagSz, (uint8_t*)tag)
- != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherUpdate(ctx, NULL, &len, aad, (int)aadlen)
- != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherUpdate(ctx, dest, &len, enc, (int)enclen)
- != WOLFSSL_SUCCESS
- || wolfSSL_EVP_CipherFinal(ctx, dest, &len) != WOLFSSL_SUCCESS) {
- return WOLFSSL_FAILURE;
- }
-
- return WOLFSSL_SUCCESS;
-}
-
-
-#endif /* WOLFSSL_QUIC */
-#endif /* WOLFCRYPT_ONLY */
-
diff --git a/src/ssl/wolfssl/sniffer.c b/src/ssl/wolfssl/sniffer.c
deleted file mode 100644
index 6854d5800..000000000
--- a/src/ssl/wolfssl/sniffer.c
+++ /dev/null
@@ -1,7750 +0,0 @@
-/* sniffer.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- #include
-#endif
-
-/* Build Options:
- * WOLFSSL_SNIFFER_NO_RECOVERY: Do not track missed data count.
- * SNIFFER_SINGLE_SESSION_CACHE: Do not cache more than one session.
- */
-
-
-/* xctime */
-#ifndef XCTIME
- #define XCTIME ctime
-#endif
-
-/* only in this file, to avoid confusing future ports leave
- * these defines here. Do not move to wc_port.h */
-#ifdef USER_CUSTOM_SNIFFX
- /* To be implemented in user_settings.h */
-#elif defined(FUSION_RTOS)
- #include
- #define XINET_NTOA FNS_INET_NTOA
- #define XINET_ATON FNS_INET_ATON
- #define XINET_PTON(a,b,c,d) FNS_INET_PTON((a),(b),(c),(d),NULL)
- #define XINET_NTOP(a,b,c,d) FNS_INET_NTOP((a),(b),(c),(d),NULL)
- #define XINET_ADDR FNS_INET_ADDR
- #define XHTONS FNS_HTONS
- #define XNTOHS FNS_NTOHS
- #define XHTONL FNS_HTONL
- #define XNTOHL FNS_NTOHL
- #define XINADDR_NONE FNS_INADDR_NONE
-#else
- /* default */
- #define XINET_NTOA inet_ntoa
- #define XINET_ATON inet_aton
- #define XINET_PTON(a,b,c) inet_pton((a),(b),(c))
- #define XINET_NTOP inet_ntop
- #define XINET_ADDR inet_addr
- #define XHTONS htons
- #define XNTOHS ntohs
- #define XHTONL htonl
- #define XNTOHL ntohl
- #define XINADDR_NONE INADDR_NONE
-#endif
-
-#if !defined(WOLFCRYPT_ONLY) && !defined(NO_FILESYSTEM)
-#ifdef WOLFSSL_SNIFFER
-
-#include
-
-#ifdef FUSION_RTOS
- #include
- #ifdef TCP_PROTOCOL
- #undef TCP_PROTOCOL
- #endif
-#else
- #ifndef _WIN32
- #include
- #else
- #include
- #endif
-#endif
-
-#ifdef _WIN32
- #define SNPRINTF _snprintf
-#else
- #define SNPRINTF snprintf
-#endif
-
-#include
-#include
-#include
-#include
-
-#ifndef NO_RSA
- #include
-#endif
-#ifndef NO_DH
- #include
-#endif
-#if defined(HAVE_ECC) || defined(HAVE_CURVE25519)
- #include
-#endif
-#ifdef HAVE_CURVE25519
- #include
-#endif
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#ifdef WOLF_CRYPTO_CB
- #include
- #ifdef HAVE_INTEL_QA_SYNC
- #include
- #endif
- #ifdef HAVE_CAVIUM_OCTEON_SYNC
- #include
- #endif
-#endif
-
-#define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
-
-#ifndef WOLFSSL_SNIFFER_TIMEOUT
- #define WOLFSSL_SNIFFER_TIMEOUT 900
- /* Cache unclosed Sessions for 15 minutes since last used */
-#endif
-
-/* Misc constants */
-enum {
- MAX_SERVER_ADDRESS = 128, /* maximum server address length */
- MAX_SERVER_NAME = 128, /* maximum server name length */
- MAX_ERROR_LEN = 80, /* maximum error length */
- ETHER_IF_ADDR_LEN = 6, /* ethernet interface address length */
- LOCAL_IF_ADDR_LEN = 4, /* localhost interface address length, !windows */
- TCP_PROTO = 6, /* TCP_PROTOCOL */
- IP_HDR_SZ = 20, /* IPv4 header length, min */
- IP6_HDR_SZ = 40, /* IPv6 header length, min */
- TCP_HDR_SZ = 20, /* TCP header length, min */
- IPV4 = 4, /* IP version 4 */
- IPV6 = 6, /* IP version 6 */
- TCP_PROTOCOL = 6, /* TCP Protocol id */
- NO_NEXT_HEADER = 59, /* IPv6 no headers follow */
- TRACE_MSG_SZ = 80, /* Trace Message buffer size */
- HASH_SIZE = 499, /* Session Hash Table Rows */
- PSEUDO_HDR_SZ = 12, /* TCP Pseudo Header size in bytes */
- STREAM_INFO_SZ = 44, /* SnifferStreamInfo size in bytes */
- FATAL_ERROR_STATE = 1, /* SnifferSession fatal error state */
- TICKET_HINT_LEN = 4, /* Session Ticket Hint length */
- TICKET_HINT_AGE_LEN= 4, /* Session Ticket Age add length */
- EXT_TYPE_SZ = 2, /* Extension type length */
- MAX_INPUT_SZ = MAX_RECORD_SIZE + COMP_EXTRA + MAX_MSG_EXTRA +
- MTU_EXTRA, /* Max input sz of reassembly */
-
- /* TLS Extensions */
- EXT_SERVER_NAME = 0x0000, /* a.k.a. SNI */
- EXT_MAX_FRAGMENT_LENGTH = 0x0001,
- EXT_TRUSTED_CA_KEYS = 0x0003,
- EXT_TRUNCATED_HMAC = 0x0004,
- EXT_STATUS_REQUEST = 0x0005, /* a.k.a. OCSP stapling */
- EXT_SUPPORTED_GROUPS = 0x000a, /* a.k.a. Supported Curves */
- EXT_EC_POINT_FORMATS = 0x000b,
- EXT_SIGNATURE_ALGORITHMS = 0x000d,
- EXT_APPLICATION_LAYER_PROTOCOL = 0x0010, /* a.k.a. ALPN */
- EXT_STATUS_REQUEST_V2 = 0x0011, /* a.k.a. OCSP stapling v2 */
- EXT_ENCRYPT_THEN_MAC = 0x0016, /* RFC 7366 */
- EXT_MASTER_SECRET = 0x0017, /* Extended Master Secret Extension ID */
- EXT_TICKET_ID = 0x0023, /* Session Ticket Extension ID */
- EXT_PRE_SHARED_KEY = 0x0029,
- EXT_EARLY_DATA = 0x002a,
- EXT_SUPPORTED_VERSIONS = 0x002b,
- EXT_COOKIE = 0x002c,
- EXT_PSK_KEY_EXCHANGE_MODES = 0x002d,
- EXT_POST_HANDSHAKE_AUTH = 0x0031,
- EXT_SIGNATURE_ALGORITHMS_CERT = 0x0032,
- EXT_KEY_SHARE = 0x0033,
- EXT_RENEGOTIATION_INFO = 0xff01
-};
-
-
-#ifdef _WIN32
-
-static HMODULE dllModule; /* for error string resources */
-
-BOOL APIENTRY DllMain( HMODULE hModule,
- DWORD ul_reason_for_call,
- LPVOID lpReserved
- )
-{
- static int didInit = 0;
-
- switch (ul_reason_for_call)
- {
- case DLL_PROCESS_ATTACH:
- if (didInit == 0) {
- dllModule = hModule;
- ssl_InitSniffer();
- didInit = 1;
- }
- break;
- case DLL_THREAD_ATTACH:
- break;
- case DLL_THREAD_DETACH:
- break;
- case DLL_PROCESS_DETACH:
- if (didInit) {
- ssl_FreeSniffer();
- didInit = 0;
- }
- break;
- }
- return TRUE;
-}
-
-#endif /* _WIN32 */
-
-
-static WC_THREADSHARED int TraceOn = 0; /* Trace is off by default */
-static WC_THREADSHARED XFILE TraceFile = 0;
-
-
-/* windows uses .rc table for this */
-#ifndef _WIN32
-
-static const char* const msgTable[] =
-{
- /* 1 */
- "Out of Memory",
- "New SSL Sniffer Server Registered",
- "Checking IP Header",
- "SSL Sniffer Server Not Registered",
- "Checking TCP Header",
-
- /* 6 */
- "SSL Sniffer Server Port Not Registered",
- "RSA Private Decrypt Error",
- "RSA Private Decode Error",
- "Set Cipher Spec Error",
- "Server Hello Input Malformed",
-
- /* 11 */
- "Couldn't Resume Session Error",
- "Server Did Resumption",
- "Client Hello Input Malformed",
- "Client Trying to Resume",
- "Handshake Input Malformed",
-
- /* 16 */
- "Got Hello Verify msg",
- "Got Server Hello msg",
- "Got Cert Request msg",
- "Got Server Key Exchange msg",
- "Got Cert msg",
-
- /* 21 */
- "Got Server Hello Done msg",
- "Got Finished msg",
- "Got Client Hello msg",
- "Got Client Key Exchange msg",
- "Got Cert Verify msg",
-
- /* 26 */
- "Got Unknown Handshake msg",
- "New SSL Sniffer Session created",
- "Couldn't create new SSL",
- "Got a Packet to decode",
- "No data present",
-
- /* 31 */
- "Session Not Found",
- "Got an Old Client Hello msg",
- "Old Client Hello Input Malformed",
- "Old Client Hello OK",
- "Bad Old Client Hello",
-
- /* 36 */
- "Bad Record Header",
- "Record Header Input Malformed",
- "Got a HandShake msg",
- "Bad HandShake msg",
- "Got a Change Cipher Spec msg",
-
- /* 41 */
- "Got Application Data msg",
- "Bad Application Data",
- "Got an Alert msg",
- "Another msg to Process",
- "Removing Session From Table",
-
- /* 46 */
- "Bad Key File",
- "Wrong IP Version",
- "Wrong Protocol type",
- "Packet Short for header processing",
- "Got Unknown Record Type",
-
- /* 51 */
- "Can't Open Trace File",
- "Session in Fatal Error State",
- "Partial SSL record received",
- "Buffer Error, malformed input",
- "Added to Partial Input",
-
- /* 56 */
- "Received a Duplicate Packet",
- "Received an Out of Order Packet",
- "Received an Overlap Duplicate Packet",
- "Received an Overlap Reassembly Begin Duplicate Packet",
- "Received an Overlap Reassembly End Duplicate Packet",
-
- /* 61 */
- "Missed the Client Hello Entirely",
- "Got Hello Request msg",
- "Got Session Ticket msg",
- "Bad Input",
- "Bad Decrypt Type",
-
- /* 66 */
- "Bad Finished Message Processing",
- "Bad Compression Type",
- "Bad DeriveKeys Error",
- "Saw ACK for Missing Packet Error",
- "Bad Decrypt Operation",
-
- /* 71 */
- "Decrypt Keys Not Set Up",
- "Late Key Load Error",
- "Got Certificate Status msg",
- "RSA Key Missing Error",
- "Secure Renegotiation Not Supported",
-
- /* 76 */
- "Get Session Stats Failure",
- "Reassembly Buffer Size Exceeded",
- "Dropping Lost Fragment",
- "Dropping Partial Record",
- "Clear ACK Fault",
-
- /* 81 */
- "Bad Decrypt Size",
- "Extended Master Secret Hash Error",
- "Handshake Message Split Across TLS Records",
- "ECC Private Decode Error",
- "ECC Public Decode Error",
-
- /* 86 */
- "Watch callback not set",
- "Watch hash failed",
- "Watch callback failed",
- "Bad Certificate Message",
- "Store data callback not set",
-
- /* 91 */
- "No data destination Error",
- "Store data callback failed",
- "Loading chain input",
- "Got encrypted extension",
- "Got Hello Retry Request",
-
- /* 96 */
- "Setting up keys",
- "Unsupported TLS Version",
- "Server Client Key Mismatch",
-
- /* 99 */
- "Invalid or missing keylog file",
-};
-
-
-/* *nix version uses table above */
-static void GetError(int idx, char* str)
-{
- if (str == NULL ||
- idx <= 0 || idx > (int)(sizeof(msgTable)/sizeof(const char* const)))
- return;
- XSTRNCPY(str, msgTable[idx - 1], MAX_ERROR_LEN-1);
- str[MAX_ERROR_LEN-1] = '\0';
-}
-
-
-#else /* _WIN32 */
-
-
-/* Windows version uses .rc table */
-static void GetError(int idx, char* buffer)
-{
- if (buffer == NULL)
- return;
- if (!LoadStringA(dllModule, idx, buffer, MAX_ERROR_LEN))
- buffer[0] = 0;
-}
-
-
-#endif /* _WIN32 */
-
-
-/* Packet Buffer for reassembly list and ready list */
-typedef struct PacketBuffer {
- word32 begin; /* relative sequence begin */
- word32 end; /* relative sequence end */
- byte* data; /* actual data */
- struct PacketBuffer* next; /* next on reassembly list or ready list */
-} PacketBuffer;
-
-
-#ifdef HAVE_SNI
-
-/* NamedKey maps a SNI name to a specific private key */
-typedef struct NamedKey {
- char name[MAX_SERVER_NAME]; /* server DNS name */
- word32 nameSz; /* size of server DNS name */
- byte* key; /* DER private key */
- word32 keySz; /* size of DER private key */
- int isEphemeralKey;
- struct NamedKey* next; /* for list */
-} NamedKey;
-
-#endif
-
-/* Sniffer Server holds info for each server/port monitored */
-typedef struct SnifferServer {
- WOLFSSL_CTX* ctx; /* SSL context */
- char address[MAX_SERVER_ADDRESS]; /* passed in server address */
- IpAddrInfo server; /* network order address */
- int port; /* server port */
-#ifdef HAVE_SNI
- NamedKey* namedKeys; /* mapping of names and keys */
- wolfSSL_Mutex namedKeysMutex; /* mutex for namedKey list */
-#endif
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- byte useKeyLogFile; /* True if session secrets are coming from a
- keylog file */
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
-
- struct SnifferServer* next; /* for list */
-} SnifferServer;
-
-/* Session Flags */
-typedef struct Flags {
- byte side; /* which end is current packet headed */
- byte serverCipherOn; /* indicates whether cipher is active */
- byte clientCipherOn; /* indicates whether cipher is active */
- byte resuming; /* did this session come from resumption */
- byte clientHello; /* processed client hello yet, for SSLv2 */
- byte finCount; /* get both FINs before removing */
- byte fatalError; /* fatal error state */
- byte cliAckFault; /* client acked unseen data from server */
- byte srvAckFault; /* server acked unseen data from client */
- byte cliSkipPartial; /* client skips partial data to catch up */
- byte srvSkipPartial; /* server skips partial data to catch up */
-#ifdef HAVE_EXTENDED_MASTER
- byte expectEms; /* expect extended master secret */
-#endif
- byte gotFinished; /* processed finished */
- byte secRenegEn; /* secure renegotiation enabled */
-#ifdef WOLFSSL_ASYNC_CRYPT
- byte wasPolled;
-#endif
-#ifdef SNIFFER_SINGLE_SESSION_CACHE
- byte cached; /* have we cached this session yet */
-#endif
-} Flags;
-
-
-/* Out of Order FIN capture */
-typedef struct FinCapture {
- word32 cliFinSeq; /* client relative sequence FIN 0 is no */
- word32 srvFinSeq; /* server relative sequence FIN, 0 is no */
- byte cliCounted; /* did we count yet, detects duplicates */
- byte srvCounted; /* did we count yet, detects duplicates */
-} FinCapture;
-
-
-typedef struct HsHashes {
-#ifndef NO_OLD_TLS
-#ifndef NO_SHA
- wc_Sha hashSha;
-#endif
-#ifndef NO_MD5
- wc_Md5 hashMd5;
-#endif
-#endif /* !NO_OLD_TLS */
-#ifndef NO_SHA256
- wc_Sha256 hashSha256;
-#endif
-#ifdef WOLFSSL_SHA384
- wc_Sha384 hashSha384;
-#endif
-} HsHashes;
-
-typedef struct KeyShareInfo {
- word16 named_group;
- int key_len;
- const byte* key;
-
- /* additional info */
- int dh_key_bits;
- int curve_id;
-} KeyShareInfo;
-
-/* Sniffer Session holds info for each client/server SSL/TLS session */
-typedef struct SnifferSession {
- SnifferServer* context; /* server context */
- WOLFSSL* sslServer; /* SSL server side decode */
- WOLFSSL* sslClient; /* SSL client side decode */
- IpAddrInfo server; /* server address in network byte order */
- IpAddrInfo client; /* client address in network byte order */
- word16 srvPort; /* server port */
- word16 cliPort; /* client port */
- word32 cliSeqStart; /* client start sequence */
- word32 srvSeqStart; /* server start sequence */
- word32 cliSeqLast; /* client last sequence */
- word32 srvSeqLast; /* server last sequence */
- word32 cliExpected; /* client expected sequence (relative) */
- word32 srvExpected; /* server expected sequence (relative) */
- FinCapture finCapture; /* retain out of order FIN s */
- Flags flags; /* session flags */
- time_t lastUsed; /* last used ticks */
- word32 keySz; /* size of the private key */
- PacketBuffer* cliReassemblyList; /* client out of order packets */
- PacketBuffer* srvReassemblyList; /* server out of order packets */
- word32 cliReassemblyMemory; /* client packet memory used */
- word32 srvReassemblyMemory; /* server packet memory used */
- struct SnifferSession* next; /* for hash table list */
- byte* ticketID; /* mac ID of session ticket */
-#ifdef HAVE_MAX_FRAGMENT
- byte* tlsFragBuf;
- word32 tlsFragOffset;
- word32 tlsFragSize;
-#endif
-#ifdef HAVE_SNI
- const char* sni; /* server name indication */
-#endif
-#ifdef HAVE_EXTENDED_MASTER
- HsHashes* hash;
-#endif
-#ifdef WOLFSSL_TLS13
- byte* cliKeyShare;
- word32 cliKeyShareSz;
- KeyShareInfo srvKs;
- KeyShareInfo cliKs;
-#endif
-#ifdef WOLFSSL_ASYNC_CRYPT
- void* userCtx;
- word32 pendSeq; /* when WC_PENDING_E is returned capture sequence */
-#endif
- int error; /* store the last set error number */
- byte verboseErr; /* Last set error is helpful and should
- * not be overwritten by FATAL_ERROR_STATE */
-} SnifferSession;
-
-
-/* Sniffer Server List and mutex */
-static THREAD_LS_T SnifferServer* ServerList = NULL;
-#ifndef HAVE_C___ATOMIC
-static WC_THREADSHARED wolfSSL_Mutex ServerListMutex WOLFSSL_MUTEX_INITIALIZER_CLAUSE(ServerListMutex);
-#endif
-
-/* Session Hash Table, mutex, and count */
-static THREAD_LS_T SnifferSession* SessionTable[HASH_SIZE];
-#ifndef HAVE_C___ATOMIC
-static WC_THREADSHARED wolfSSL_Mutex SessionMutex WOLFSSL_MUTEX_INITIALIZER_CLAUSE(SessionMutex);
-#endif
-static THREAD_LS_T int SessionCount = 0;
-
-static WC_THREADSHARED int RecoveryEnabled = 0; /* global switch */
-static WC_THREADSHARED int MaxRecoveryMemory = -1;
- /* per session max recovery memory */
-#ifndef WOLFSSL_SNIFFER_NO_RECOVERY
-/* Recovery of missed data switches and stats */
-static WC_THREADSHARED wolfSSL_Mutex RecoveryMutex WOLFSSL_MUTEX_INITIALIZER_CLAUSE(RecoveryMutex); /* for stats */
-/* # of sessions with missed data */
-static WC_THREADSHARED word32 MissedDataSessions = 0;
-#endif
-
-/* Connection Info Callback */
-static WC_THREADSHARED SSLConnCb ConnectionCb;
-static WC_THREADSHARED void* ConnectionCbCtx = NULL;
-
-#ifdef WOLFSSL_SNIFFER_STATS
-/* Sessions Statistics */
-static WC_THREADSHARED SSLStats SnifferStats;
-static WC_THREADSHARED wolfSSL_Mutex StatsMutex WOLFSSL_MUTEX_INITIALIZER_CLAUSE(StatsMutex);
-#endif
-
-#ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
-static WC_THREADSHARED SSLKeyCb KeyCb;
-static WC_THREADSHARED void* KeyCbCtx = NULL;
-#endif
-
-#ifdef WOLFSSL_SNIFFER_WATCH
-/* Watch Key Callback */
-static WC_THREADSHARED SSLWatchCb WatchCb;
-static WC_THREADSHARED void* WatchCbCtx = NULL;
-#endif
-
-#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
-/* Store Data Callback */
-static WC_THREADSHARED SSLStoreDataCb StoreDataCb;
-#endif
-
-
-#ifndef WOLFSSL_SNIFFER_NO_RECOVERY
-static void UpdateMissedDataSessions(void)
-{
- wc_LockMutex(&RecoveryMutex);
- MissedDataSessions += 1;
- wc_UnLockMutex(&RecoveryMutex);
-}
-#endif
-
-#ifdef WOLFSSL_SNIFFER_STATS
- #ifdef HAVE_C___ATOMIC
- #define LOCK_STAT() WC_DO_NOTHING
- #define UNLOCK_STAT() WC_DO_NOTHING
- #define NOLOCK_ADD_TO_STAT(x,y) ({ TraceStat(#x, y); \
- __atomic_fetch_add(&x, y, __ATOMIC_RELAXED); })
- #else
- #define LOCK_STAT() wc_LockMutex(&StatsMutex)
- #define UNLOCK_STAT() wc_UnLockMutex(&StatsMutex)
- #define NOLOCK_ADD_TO_STAT(x,y) ({ TraceStat(#x, y); x += y; })
- #endif
- #define NOLOCK_INC_STAT(x) NOLOCK_ADD_TO_STAT(x,1)
- #define ADD_TO_STAT(x,y) do { LOCK_STAT(); \
- NOLOCK_ADD_TO_STAT(x,y); UNLOCK_STAT(); } while (0)
- #define INC_STAT(x) do { LOCK_STAT(); \
- NOLOCK_INC_STAT(x); UNLOCK_STAT(); } while (0)
-#endif /* WOLFSSL_SNIFFER_STATS */
-
-#ifdef HAVE_C___ATOMIC
- #define LOCK_SESSION() WC_DO_NOTHING
- #define UNLOCK_SESSION() WC_DO_NOTHING
- #define LOCK_SERVER_LIST() WC_DO_NOTHING
- #define UNLOCK_SERVER_LIST() WC_DO_NOTHING
-#else
- #define LOCK_SESSION() wc_LockMutex(&SessionMutex)
- #define UNLOCK_SESSION() wc_UnLockMutex(&SessionMutex)
- #define LOCK_SERVER_LIST() wc_LockMutex(&ServerListMutex)
- #define UNLOCK_SERVER_LIST() wc_UnLockMutex(&ServerListMutex)
-#endif
-
-
-#if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- static WC_THREADSHARED int CryptoDeviceId = INVALID_DEVID;
-#endif
-
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
-static int addSecretNode(unsigned char* clientRandom,
- int type,
- unsigned char* masterSecret,
- char* error);
-static void hexToBin(const char* hex, unsigned char* bin, int binLength);
-static int parseKeyLogFile(const char* fileName, char* error);
-static unsigned char* findSecret(unsigned char* clientRandom, int type);
-static void freeSecretList(void);
-static int snifferSecretCb(unsigned char* client_random,
- int type,
- unsigned char* output_secret);
-static void setSnifferSecretCb(SnifferSession* session);
-static int addKeyLogSnifferServerHelper(const char* address,
- int port,
- char* error);
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
-
-
-/* Initialize overall Sniffer */
-void ssl_InitSniffer_ex(int devId)
-{
- wolfSSL_Init();
-#ifndef WOLFSSL_MUTEX_INITIALIZER
-#ifndef HAVE_C___ATOMIC
- wc_InitMutex(&ServerListMutex);
- wc_InitMutex(&SessionMutex);
-#endif
-#ifndef WOLFSSL_SNIFFER_NO_RECOVERY
- wc_InitMutex(&RecoveryMutex);
-#endif
-#ifdef WOLFSSL_SNIFFER_STATS
- XMEMSET(&SnifferStats, 0, sizeof(SSLStats));
- wc_InitMutex(&StatsMutex);
-#endif
-#endif /* !WOLFSSL_MUTEX_INITIALIZER */
-
-#ifdef WOLFSSL_SNIFFER_STATS
- XMEMSET(&SnifferStats, 0, sizeof(SSLStats));
-#endif
-#if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- CryptoDeviceId = devId;
-#endif
- (void)devId;
-}
-
-static int GetDevId(void)
-{
- int devId = INVALID_DEVID;
-
-#ifdef WOLF_CRYPTO_CB
- #ifdef HAVE_INTEL_QA_SYNC
- devId = wc_CryptoCb_InitIntelQa();
- if (devId == INVALID_DEVID) {
- fprintf(stderr, "Couldn't init the Intel QA\n");
- }
- #endif
- #ifdef HAVE_CAVIUM_OCTEON_SYNC
- devId = wc_CryptoCb_InitOcteon();
- if (devId == INVALID_DEVID) {
- fprintf(stderr, "Couldn't init the Octeon\n");
- }
- #endif
-#endif
-
- return devId;
-}
-
-void ssl_InitSniffer(void)
-{
- int devId = GetDevId();
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (wolfAsync_DevOpen(&devId) < 0) {
- fprintf(stderr, "Async device open failed\nRunning without async\n");
- devId = INVALID_DEVID;
- }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
- (void)devId;
-
- ssl_InitSniffer_ex(devId);
-}
-
-void ssl_InitSniffer_ex2(int threadNum)
-{
- int devId = GetDevId();
-
-#ifdef WOLFSSL_ASYNC_CRYPT
-#ifndef WC_NO_ASYNC_THREADING
- if (wolfAsync_DevOpenThread(&devId, &threadNum) < 0)
-#else
- if (wolfAsync_DevOpen(&devId) < 0)
-#endif
- {
- fprintf(stderr, "Async device open failed\nRunning without async\n");
- devId = INVALID_DEVID;
- }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
- (void)devId;
- (void)threadNum;
-
- ssl_InitSniffer_ex(devId);
-}
-
-#ifdef HAVE_SNI
-
-/* Free Named Key and the zero out the private key it holds */
-static void FreeNamedKey(NamedKey* in)
-{
- if (in) {
- if (in->key) {
- ForceZero(in->key, in->keySz);
- XFREE(in->key, NULL, DYNAMIC_TYPE_X509);
- }
- XFREE(in, NULL, DYNAMIC_TYPE_SNIFFER_NAMED_KEY);
- }
-}
-
-
-static void FreeNamedKeyList(NamedKey* in)
-{
- NamedKey* next;
-
- while (in) {
- next = in->next;
- FreeNamedKey(in);
- in = next;
- }
-}
-
-#endif
-
-
-/* Free Sniffer Server's resources/self */
-static void FreeSnifferServer(SnifferServer* srv)
-{
- if (srv) {
-#ifdef HAVE_SNI
- wc_LockMutex(&srv->namedKeysMutex);
- FreeNamedKeyList(srv->namedKeys);
- wc_UnLockMutex(&srv->namedKeysMutex);
- wc_FreeMutex(&srv->namedKeysMutex);
-#endif
- wolfSSL_CTX_free(srv->ctx);
- }
- XFREE(srv, NULL, DYNAMIC_TYPE_SNIFFER_SERVER);
-}
-
-
-/* free PacketBuffer's resources/self */
-static void FreePacketBuffer(PacketBuffer* del)
-{
- if (del) {
- XFREE(del->data, NULL, DYNAMIC_TYPE_SNIFFER_PB_BUFFER);
- XFREE(del, NULL, DYNAMIC_TYPE_SNIFFER_PB);
- }
-}
-
-
-/* remove PacketBuffer List */
-static void FreePacketList(PacketBuffer* in)
-{
- if (in) {
- PacketBuffer* del;
- PacketBuffer* packet = in;
-
- while (packet) {
- del = packet;
- packet = packet->next;
- FreePacketBuffer(del);
- }
- }
-}
-
-
-/* Free Sniffer Session's resources/self */
-static void FreeSnifferSession(SnifferSession* session)
-{
- if (session) {
- wolfSSL_free(session->sslClient);
- wolfSSL_free(session->sslServer);
-
- FreePacketList(session->cliReassemblyList);
- FreePacketList(session->srvReassemblyList);
-
- XFREE(session->ticketID, NULL, DYNAMIC_TYPE_SNIFFER_TICKET_ID);
-#ifdef HAVE_EXTENDED_MASTER
- XFREE(session->hash, NULL, DYNAMIC_TYPE_HASHES);
-#endif
-#ifdef WOLFSSL_TLS13
- XFREE(session->cliKeyShare, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-#ifdef HAVE_MAX_FRAGMENT
- XFREE(session->tlsFragBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- session->tlsFragBuf = NULL;
-#endif
- }
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
-}
-
-
-/* Free overall Sniffer */
-void ssl_FreeSniffer(void)
-{
- SnifferServer* srv;
- SnifferServer* removeServer;
- SnifferSession* session;
- SnifferSession* removeSession;
- int i;
-
- LOCK_SERVER_LIST();
- LOCK_SESSION();
-
- /* Free sessions (wolfSSL objects) first */
- for (i = 0; i < HASH_SIZE; i++) {
- session = SessionTable[i];
- while (session) {
- removeSession = session;
- session = session->next;
- FreeSnifferSession(removeSession);
- }
- }
- XMEMSET(SessionTable, 0, sizeof(SessionTable));
- SessionCount = 0;
-
- /* Then server (wolfSSL_CTX) */
- srv = ServerList;
- while (srv) {
- removeServer = srv;
- srv = srv->next;
- FreeSnifferServer(removeServer);
- }
- ServerList = NULL;
-
-
-
- UNLOCK_SESSION();
- UNLOCK_SERVER_LIST();
-
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- freeSecretList();
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
-
-
-#ifndef WOLFSSL_MUTEX_INITIALIZER
-#ifndef WOLFSSL_SNIFFER_NO_RECOVERY
- wc_FreeMutex(&RecoveryMutex);
-#endif
-#ifndef HAVE_C___ATOMIC
- wc_FreeMutex(&SessionMutex);
- wc_FreeMutex(&ServerListMutex);
-#endif
-#endif /* !WOLFSSL_MUTEX_INITIALIZER */
-
-#ifdef WOLF_CRYPTO_CB
- #ifdef HAVE_INTEL_QA_SYNC
- wc_CryptoCb_CleanupIntelQa(&CryptoDeviceId);
- #endif
- #ifdef HAVE_CAVIUM_OCTEON_SYNC
- wc_CryptoCb_CleanupOcteon(&CryptoDeviceId);
- #endif
-#endif
-#ifdef WOLFSSL_ASYNC_CRYPT
- wolfAsync_DevClose(&CryptoDeviceId);
-#endif
-
- if (TraceFile) {
- TraceOn = 0;
- XFCLOSE(TraceFile);
- TraceFile = NULL;
- }
-
- wolfSSL_Cleanup();
-}
-
-
-#ifdef HAVE_EXTENDED_MASTER
-
-static int HashInit(HsHashes* hash)
-{
- int ret = 0;
-
- XMEMSET(hash, 0, sizeof(HsHashes));
-
-#ifndef NO_OLD_TLS
-#ifndef NO_SHA
- if (ret == 0)
- ret = wc_InitSha(&hash->hashSha);
-#endif
-#ifndef NO_MD5
- if (ret == 0)
- ret = wc_InitMd5(&hash->hashMd5);
-#endif
-#endif /* !NO_OLD_TLS */
-#ifndef NO_SHA256
- if (ret == 0)
- ret = wc_InitSha256(&hash->hashSha256);
-#endif
-#ifdef WOLFSSL_SHA384
- if (ret == 0)
- ret = wc_InitSha384(&hash->hashSha384);
-#endif
-
- return ret;
-}
-
-static int HashUpdate(HsHashes* hash, const byte* input, int sz)
-{
- int ret = 0;
-
- input -= HANDSHAKE_HEADER_SZ;
- sz += HANDSHAKE_HEADER_SZ;
-
-#ifndef NO_OLD_TLS
-#ifndef NO_SHA
- if (ret == 0)
- ret = wc_ShaUpdate(&hash->hashSha, input, sz);
-#endif
-#ifndef NO_MD5
- if (ret == 0)
- ret = wc_Md5Update(&hash->hashMd5, input, sz);
-#endif
-#endif /* !NO_OLD_TLS */
-#ifndef NO_SHA256
- if (ret == 0)
- ret = wc_Sha256Update(&hash->hashSha256, input, sz);
-#endif
-#ifdef WOLFSSL_SHA384
- if (ret == 0)
- ret = wc_Sha384Update(&hash->hashSha384, input, sz);
-#endif
-
- return ret;
-}
-
-static int HashCopy(HS_Hashes* d, HsHashes* s)
-{
-#ifndef NO_OLD_TLS
-#ifndef NO_SHA
- XMEMCPY(&d->hashSha, &s->hashSha, sizeof(wc_Sha));
-#endif
-#ifndef NO_MD5
- XMEMCPY(&d->hashMd5, &s->hashMd5, sizeof(wc_Md5));
-#endif
-#endif /* !NO_OLD_TLS */
-#ifndef NO_SHA256
- XMEMCPY(&d->hashSha256, &s->hashSha256, sizeof(wc_Sha256));
-#endif
-#ifdef WOLFSSL_SHA384
- XMEMCPY(&d->hashSha384, &s->hashSha384, sizeof(wc_Sha384));
-#endif
-
- return 0;
-}
-
-#endif
-
-
-/* Initialize a SnifferServer */
-static void InitSnifferServer(SnifferServer* sniffer)
-{
- XMEMSET(sniffer, 0, sizeof(SnifferServer));
-}
-
-
-/* Initialize session flags */
-static void InitFlags(Flags* flags)
-{
- XMEMSET(flags, 0, sizeof(Flags));
-}
-
-
-/* Initialize FIN Capture */
-static void InitFinCapture(FinCapture* cap)
-{
- XMEMSET(cap, 0, sizeof(FinCapture));
-}
-
-
-/* Initialize a Sniffer Session */
-static void InitSession(SnifferSession* session)
-{
- XMEMSET(session, 0, sizeof(SnifferSession));
- InitFlags(&session->flags);
- InitFinCapture(&session->finCapture);
-}
-
-
-/* IP Info from IP Header */
-typedef struct IpInfo {
- int length; /* length of this header */
- int total; /* total length of fragment */
- IpAddrInfo src; /* network order source address */
- IpAddrInfo dst; /* network order destination address */
-} IpInfo;
-
-
-/* TCP Info from TCP Header */
-typedef struct TcpInfo {
- int srcPort; /* source port */
- int dstPort; /* destination port */
- int length; /* length of this header */
- word32 sequence; /* sequence number */
- word32 ackNumber; /* ack number */
- byte fin; /* FIN set */
- byte rst; /* RST set */
- byte syn; /* SYN set */
- byte ack; /* ACK set */
-} TcpInfo;
-
-
-/* Tcp Pseudo Header for Checksum calculation */
-typedef struct TcpPseudoHdr {
- word32 src; /* source address */
- word32 dst; /* destination address */
- byte rsv; /* reserved, always 0 */
- byte protocol; /* IP protocol */
- word16 length; /* tcp header length + data length (doesn't include */
- /* pseudo header length) network order */
-} TcpPseudoHdr;
-
-
-#ifdef WOLFSSL_ENCRYPTED_KEYS
-/* Password Setting Callback */
-static int SetPassword(char* passwd, int sz, int rw, void* userdata)
-{
- (void)rw;
- XSTRNCPY(passwd, (const char*)userdata, sz);
- return (int)XSTRLEN((const char*)userdata);
-}
-#endif
-
-/* Ethernet Header */
-typedef struct EthernetHdr {
- byte dst[ETHER_IF_ADDR_LEN]; /* destination host address */
- byte src[ETHER_IF_ADDR_LEN]; /* source host address */
- word16 type; /* IP, ARP, etc */
-} EthernetHdr;
-
-
-/* IPv4 Header */
-typedef struct IpHdr {
- byte ver_hl; /* version/header length */
- byte tos; /* type of service */
- word16 length; /* total length */
- word16 id; /* identification */
- word16 offset; /* fragment offset field */
- byte ttl; /* time to live */
- byte protocol; /* protocol */
- word16 sum; /* checksum */
- word32 src; /* source address */
- word32 dst; /* destination address */
-} IpHdr;
-
-
-/* IPv6 Header */
-typedef struct Ip6Hdr {
- byte ver_hl; /* version/traffic class high */
- byte tc_fl; /* traffic class low/flow label high */
- word16 fl; /* flow label low */
- word16 length; /* payload length */
- byte next_header; /* next header (6 for TCP, any other skip) */
- byte hl; /* hop limit */
- byte src[16]; /* source address */
- byte dst[16]; /* destination address */
-} Ip6Hdr;
-
-
-/* IPv6 extension header */
-typedef struct Ip6ExtHdr {
- byte next_header; /* next header (6 for TCP, any other skip) */
- byte length; /* length in 8-octet units - 1 */
- byte reserved[6];
-} Ip6ExtHdr;
-
-
-#define IP_HL(ip) ( (((ip)->ver_hl) & 0x0f) * 4)
-#define IP_V(ip) ( ((ip)->ver_hl) >> 4)
-
-/* TCP Header */
-typedef struct TcpHdr {
- word16 srcPort; /* source port */
- word16 dstPort; /* destination port */
- word32 sequence; /* sequence number */
- word32 ack; /* acknowledgment number */
- byte offset; /* data offset, reserved */
- byte flags; /* option flags */
- word16 window; /* window */
- word16 sum; /* checksum */
- word16 urgent; /* urgent pointer */
-} TcpHdr;
-
-#define TCP_LEN(tcp) ( (((tcp)->offset & 0xf0) >> 4) * 4)
-#define TCP_FIN 0x01
-#define TCP_SYN 0x02
-#define TCP_RST 0x04
-#define TCP_ACK 0x10
-
-
-
-
-
-/* Use platform specific GetError to write to trace file if tracing */
-static void TraceError(int idx, char* error)
-{
- if (TraceOn) {
- char myBuffer[MAX_ERROR_LEN];
- if (error == NULL) {
- error = myBuffer;
- GetError(idx, myBuffer);
- }
- XFPRINTF(TraceFile, "\t%s\n", error);
-#ifdef DEBUG_SNIFFER
- XFPRINTF(stderr, "\t%s\n", error);
-#endif
- }
-}
-
-static void Trace(int idx)
-{
- TraceError(idx, NULL);
-}
-
-
-/* Show TimeStamp for beginning of packet Trace */
-static void TraceHeader(void)
-{
- if (TraceOn) {
- time_t ticks = wc_Time(NULL);
- XFPRINTF(TraceFile, "\n%s", XCTIME(&ticks));
- }
-}
-
-
-/* Show Set Server info for Trace */
-static void TraceSetServer(const char* srv, int port, const char* keyFile)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tTrying to install a new Sniffer Server with\n");
- if (keyFile != NULL) {
- XFPRINTF(TraceFile, "\tserver: %s, port: %d, keyFile: %s\n",
- srv, port, keyFile);
- }
- else {
- XFPRINTF(TraceFile, "\tserver: %s, port: %d\n",
- srv, port);
- }
- }
-}
-
-
-#ifdef HAVE_SNI
-
-/* Show Set Named Server info for Trace */
-static void TraceSetNamedServer(const char* name,
- const char* srv, int port, const char* keyFile)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tTrying to install a new Sniffer Server with\n");
- XFPRINTF(TraceFile, "\tname: %s, server: %s, port: %d, keyFile: %s\n",
- name ? name : "",
- srv ? srv : "",
- port,
- keyFile ? keyFile : "");
- }
-}
-
-#endif
-
-
-/* Trace got packet number */
-static void TracePacket(void)
-{
- if (TraceOn) {
- static word32 packetNumber = 0;
- XFPRINTF(TraceFile, "\tGot a Packet to decode, packet %u\n",
- ++packetNumber);
- }
-}
-
-
-/* Convert network byte order address into human readable */
-static const char* IpToS(int version, void* src, char* dst)
-{
- return XINET_NTOP(version, src, dst, TRACE_MSG_SZ);
-}
-
-
-/* Show destination and source address from Ip Hdr for packet Trace */
-static void TraceIP(IpHdr* iphdr)
-{
- if (TraceOn) {
- char src[TRACE_MSG_SZ];
- char dst[TRACE_MSG_SZ];
- XFPRINTF(TraceFile, "\tdst:%s src:%s\n",
- IpToS(AF_INET, &iphdr->dst, dst),
- IpToS(AF_INET, &iphdr->src, src));
- }
-}
-
-
-/* Show destination and source address from Ip6Hdr for packet Trace */
-static void TraceIP6(Ip6Hdr* iphdr)
-{
- if (TraceOn) {
- char src[TRACE_MSG_SZ];
- char dst[TRACE_MSG_SZ];
- XFPRINTF(TraceFile, "\tdst: %s src: %s\n",
- IpToS(AF_INET6, iphdr->dst, dst),
- IpToS(AF_INET6, iphdr->src, src));
- }
-}
-
-
-/* Show destination and source port from Tcp Hdr for packet Trace */
-static void TraceTcp(TcpHdr* tcphdr)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tdstPort:%u srcPort:%u\n", XNTOHS(tcphdr->dstPort),
- XNTOHS(tcphdr->srcPort));
- }
-}
-
-
-/* Show sequence and payload length for Trace */
-static void TraceSequence(word32 seq, int len)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tSequence:%u, payload length:%d\n", seq, len);
- }
-}
-
-
-/* Show sequence and payload length for Trace */
-static void TraceAck(word32 acknowledgement, word32 expected)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tAck:%u Expected:%u\n", acknowledgement,
- expected);
- }
-}
-
-
-/* Show relative expected and relative received sequences */
-static void TraceRelativeSequence(word32 expected, word32 got)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tExpected sequence:%u, received sequence:%u\n",
- expected, got);
- }
-}
-
-
-/* Show server sequence startup from SYN */
-static void TraceServerSyn(word32 seq)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tServer SYN, Sequence Start:%u\n", seq);
- }
-}
-
-
-/* Show client sequence startup from SYN */
-static void TraceClientSyn(word32 seq)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tClient SYN, Sequence Start:%u\n", seq);
- }
-}
-
-
-/* Show client FIN capture */
-static void TraceClientFin(word32 finSeq, word32 relSeq)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tClient FIN capture:%u, current SEQ:%u\n",
- finSeq, relSeq);
- }
-}
-
-
-/* Show server FIN capture */
-static void TraceServerFin(word32 finSeq, word32 relSeq)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tServer FIN capture:%u, current SEQ:%u\n",
- finSeq, relSeq);
- }
-}
-
-
-/* Show number of SSL data bytes decoded, could be 0 (ok) */
-static void TraceGotData(int bytes)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\t%d bytes of SSL App data processed\n", bytes);
- }
-}
-
-
-/* Show bytes added to old SSL App data */
-static void TraceAddedData(int newBytes, int existingBytes)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile,
- "\t%d bytes added to %d existing bytes in User Buffer\n",
- newBytes, existingBytes);
- }
-}
-
-
-/* Show Stale Session */
-static void TraceStaleSession(void)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tFound a stale session\n");
- }
-}
-
-
-/* Show Finding Stale Sessions */
-static void TraceFindingStale(void)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tTrying to find Stale Sessions\n");
- }
-}
-
-
-/* Show Removed Session */
-static void TraceRemovedSession(void)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tRemoved it\n");
- }
-}
-
-
-/* Show SSLInfo if provided and is valid. */
-static void TraceSessionInfo(SSLInfo* sslInfo)
-{
- if (TraceOn) {
- if (sslInfo != NULL && sslInfo->isValid) {
- XFPRINTF(TraceFile,
- "\tver:(%u %u) suiteId:(%02x %02x) suiteName:(%s) "
- #ifdef HAVE_SNI
- "sni:(%s) "
- #endif
- "keySize:(%u)\n",
- sslInfo->protocolVersionMajor,
- sslInfo->protocolVersionMinor,
- sslInfo->serverCipherSuite0,
- sslInfo->serverCipherSuite,
- sslInfo->serverCipherSuiteName,
- #ifdef HAVE_SNI
- sslInfo->serverNameIndication,
- #endif
- sslInfo->keySize);
- }
- }
-}
-
-
-#ifdef WOLFSSL_SNIFFER_STATS
-
-/* Show value added to a named statistic. */
-static void TraceStat(const char* name, int add)
-{
- if (TraceOn) {
- XFPRINTF(TraceFile, "\tAdding %d to %s\n", add, name);
- }
-}
-
-#endif
-
-
-/* Set user error string */
-static void SetError(int idx, char* error, SnifferSession* session, int fatal)
-{
- GetError(idx, error);
- TraceError(idx, error);
- if (session)
- session->error = idx;
- if (session && fatal == FATAL_ERROR_STATE)
- session->flags.fatalError = 1;
-}
-
-
-/* Compare IpAddrInfo structs */
-static WC_INLINE int MatchAddr(IpAddrInfo l, IpAddrInfo r)
-{
- if (l.version == r.version) {
- if (l.version == IPV4)
- return (l.ip4 == r.ip4);
- else if (l.version == IPV6)
- return (0 == XMEMCMP(l.ip6, r.ip6, sizeof(l.ip6)));
- }
- return 0;
-}
-
-
-#ifndef WOLFSSL_SNIFFER_WATCH
-
-/* See if this IPV4 network order address has been registered */
-/* return 1 is true, 0 is false */
-static int IsServerRegistered(word32 addr)
-{
- int ret = 0; /* false */
- SnifferServer* sniffer;
-
- LOCK_SERVER_LIST();
-
- sniffer = ServerList;
- while (sniffer) {
- if (sniffer->server.ip4 == addr) {
- ret = 1;
- break;
- }
- sniffer = sniffer->next;
- }
-
- UNLOCK_SERVER_LIST();
-
- return ret;
-}
-
-
-/* See if this port has been registered to watch */
-/* See if this IPV4 network order address has been registered */
-/* return 1 is true, 0 is false */
-static int IsServerRegistered6(byte* addr)
-{
- int ret = 0; /* false */
- SnifferServer* sniffer;
-
- LOCK_SERVER_LIST();
-
- sniffer = ServerList;
- while (sniffer) {
- if (sniffer->server.version == IPV6 &&
- 0 == XMEMCMP(sniffer->server.ip6, addr, sizeof(sniffer->server.ip6))) {
- ret = 1;
- break;
- }
- sniffer = sniffer->next;
- }
-
- UNLOCK_SERVER_LIST();
-
- return ret;
-}
-
-
-/* See if this port has been registered to watch */
-/* return 1 is true, 0 is false */
-static int IsPortRegistered(word32 port)
-{
- int ret = 0; /* false */
- SnifferServer* sniffer;
-
- LOCK_SERVER_LIST();
-
- sniffer = ServerList;
- while (sniffer) {
- if (sniffer->port == (int)port) {
- ret = 1;
- break;
- }
- sniffer = sniffer->next;
- }
-
- UNLOCK_SERVER_LIST();
-
- return ret;
-}
-
-#endif
-
-
-/* Get SnifferServer from IP and Port */
-static SnifferServer* GetSnifferServer(IpInfo* ipInfo, TcpInfo* tcpInfo)
-{
- SnifferServer* sniffer;
-
- LOCK_SERVER_LIST();
-
- sniffer = ServerList;
-
-#ifndef WOLFSSL_SNIFFER_WATCH
- while (sniffer) {
- if (sniffer->port == tcpInfo->srcPort &&
- MatchAddr(sniffer->server, ipInfo->src))
- break;
- if (sniffer->port == tcpInfo->dstPort &&
- MatchAddr(sniffer->server, ipInfo->dst))
- break;
-
- if (sniffer->next)
- sniffer = sniffer->next;
- else
- break;
- }
-#else
- (void)ipInfo;
- (void)tcpInfo;
-#endif
-
- UNLOCK_SERVER_LIST();
-
- return sniffer;
-}
-
-
-/* Hash the Session Info, return hash row */
-static word32 SessionHash(IpInfo* ipInfo, TcpInfo* tcpInfo)
-{
- word32 hash = 1;
-
- if (ipInfo->src.version == IPV4) {
- hash *= ipInfo->src.ip4 * ipInfo->dst.ip4;
- }
- else if (ipInfo->src.version == IPV6) {
- word32* x;
- word32 y;
- x = (word32*)ipInfo->src.ip6;
- y = x[0] ^ x[1] ^ x[2] ^ x[3];
- hash *= y;
- x = (word32*)ipInfo->dst.ip6;
- y = x[0] ^ x[1] ^ x[2] ^ x[3];
- hash *= y;
- }
- hash *= tcpInfo->srcPort * tcpInfo->dstPort;
-
- return hash % HASH_SIZE;
-}
-
-
-/* Get Existing SnifferSession from IP and Port */
-static SnifferSession* GetSnifferSession(IpInfo* ipInfo, TcpInfo* tcpInfo)
-{
- SnifferSession* session;
- time_t currTime = wc_Time(NULL);
- word32 row = SessionHash(ipInfo, tcpInfo);
-
- LOCK_SESSION();
- session = SessionTable[row];
- while (session) {
- if (MatchAddr(session->server, ipInfo->src) &&
- MatchAddr(session->client, ipInfo->dst) &&
- session->srvPort == tcpInfo->srcPort &&
- session->cliPort == tcpInfo->dstPort)
- break;
-
- if (MatchAddr(session->client, ipInfo->src) &&
- MatchAddr(session->server, ipInfo->dst) &&
- session->cliPort == tcpInfo->srcPort &&
- session->srvPort == tcpInfo->dstPort)
- break;
-
- session = session->next;
- }
-
- if (session)
- session->lastUsed= currTime; /* keep session alive, remove stale will */
- /* leave alone */
- UNLOCK_SESSION();
-
- /* determine side */
- if (session) {
- if (MatchAddr(ipInfo->dst, session->server) &&
- tcpInfo->dstPort == session->srvPort) {
-
- session->flags.side = WOLFSSL_SERVER_END;
- }
- else {
- session->flags.side = WOLFSSL_CLIENT_END;
- }
- }
-
- return session;
-}
-
-
-#if defined(HAVE_SNI) || defined(WOLFSSL_SNIFFER_WATCH)
-
-static int LoadKeyFile(byte** keyBuf, word32* keyBufSz,
- const char* keyFile, int keySz, int typeKey,
- const char* password)
-{
- byte* loadBuf;
- long fileSz = 0;
- XFILE file;
- int ret = -1;
-
- if (keyBuf == NULL || keyBufSz == NULL || keyFile == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (keySz == 0) {
- /* load from file */
- file = XFOPEN(keyFile, "rb");
- if (file == XBADFILE) return WOLFSSL_FATAL_ERROR;
- if(XFSEEK(file, 0, XSEEK_END) != 0) {
- XFCLOSE(file);
- return WOLFSSL_FATAL_ERROR;
- }
- fileSz = XFTELL(file);
- if (fileSz > MAX_WOLFSSL_FILE_SIZE || fileSz < 0) {
- XFCLOSE(file);
- return WOLFSSL_FATAL_ERROR;
- }
- if(XFSEEK(file, 0, XSEEK_SET) != 0) {
- XFCLOSE(file);
- return WOLFSSL_FATAL_ERROR;
- }
-
- loadBuf = (byte*)XMALLOC(fileSz, NULL, DYNAMIC_TYPE_FILE);
- if (loadBuf == NULL) {
- XFCLOSE(file);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ret = (int)XFREAD(loadBuf, 1, fileSz, file);
- XFCLOSE(file);
-
- if (ret != fileSz) {
- XFREE(loadBuf, NULL, DYNAMIC_TYPE_FILE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- else {
- /* use buffer directly */
- loadBuf = (byte*)XMALLOC(keySz, NULL, DYNAMIC_TYPE_FILE);
- if (loadBuf == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
- fileSz = keySz;
- XMEMCPY(loadBuf, keyFile, fileSz);
- }
-
- if (typeKey == WOLFSSL_FILETYPE_PEM) {
- byte* saveBuf = (byte*)XMALLOC(fileSz, NULL, DYNAMIC_TYPE_X509);
- int saveBufSz = 0;
-
- ret = -1;
- if (saveBuf != NULL) {
- saveBufSz = wc_KeyPemToDer(loadBuf, (int)fileSz,
- saveBuf, (int)fileSz, password);
- if (saveBufSz < 0) {
- saveBufSz = 0;
- XFREE(saveBuf, NULL, DYNAMIC_TYPE_X509);
- saveBuf = NULL;
- }
- else
- ret = 0;
- }
-
- ForceZero(loadBuf, (word32)fileSz);
- XFREE(loadBuf, NULL, DYNAMIC_TYPE_FILE);
-
- if (saveBuf) {
- *keyBuf = saveBuf;
- *keyBufSz = (word32)saveBufSz;
- }
- }
- else {
- *keyBuf = loadBuf;
- *keyBufSz = (word32)fileSz;
- }
-
- if (ret < 0) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- return ret;
-}
-
-#endif
-
-
-#ifdef WOLFSSL_SNIFFER_WATCH
-
-static int CreateWatchSnifferServer(char* error)
-{
- SnifferServer* sniffer;
-
- sniffer = (SnifferServer*)XMALLOC(sizeof(SnifferServer), NULL,
- DYNAMIC_TYPE_SNIFFER_SERVER);
- if (sniffer == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- InitSnifferServer(sniffer);
- sniffer->ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
- if (!sniffer->ctx) {
- SetError(MEMORY_STR, error, NULL, 0);
- FreeSnifferServer(sniffer);
- return WOLFSSL_FATAL_ERROR;
- }
-#if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- if (CryptoDeviceId != INVALID_DEVID)
- wolfSSL_CTX_SetDevId(sniffer->ctx, CryptoDeviceId);
-#endif
-
- /* add to server list */
- LOCK_SERVER_LIST();
- sniffer->next = ServerList;
- ServerList = sniffer;
- UNLOCK_SERVER_LIST();
-
- return 0;
-}
-
-#endif
-
-
-/* Caller locks ServerListMutex */
-static int SetNamedPrivateKey(const char* name, const char* address, int port,
- const char* keyFile, int keySz, int typeKey, const char* password,
- char* error, int isEphemeralKey)
-{
- SnifferServer* sniffer;
- int ret;
- int type = (typeKey == FILETYPE_PEM) ? WOLFSSL_FILETYPE_PEM :
- WOLFSSL_FILETYPE_ASN1;
- int isNew = 0;
- IpAddrInfo serverIp;
-
-#ifdef HAVE_SNI
- NamedKey* namedKey = NULL;
-#endif
-
- (void)name;
-#ifdef HAVE_SNI
- if (name != NULL) {
- namedKey = (NamedKey*)XMALLOC(sizeof(NamedKey),
- NULL, DYNAMIC_TYPE_SNIFFER_NAMED_KEY);
- if (namedKey == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- XMEMSET(namedKey, 0, sizeof(NamedKey));
-
- namedKey->nameSz = (word32)XSTRLEN(name);
- if (namedKey->nameSz > sizeof(namedKey->name)-1)
- namedKey->nameSz = sizeof(namedKey->name)-1;
- XSTRNCPY(namedKey->name, name, namedKey->nameSz);
- namedKey->name[MAX_SERVER_NAME-1] = '\0';
- namedKey->isEphemeralKey = isEphemeralKey;
- ret = LoadKeyFile(&namedKey->key, &namedKey->keySz,
- keyFile, keySz, type, password);
- if (ret < 0) {
- SetError(KEY_FILE_STR, error, NULL, 0);
- FreeNamedKey(namedKey);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-#endif
-
- serverIp.version = IPV4;
- serverIp.ip4 = XINET_ADDR(address);
- if (serverIp.ip4 == XINADDR_NONE) {
- #ifdef FUSION_RTOS
- if (XINET_PTON(AF_INET6, address, serverIp.ip6,
- sizeof(serverIp.ip4)) == 1)
- #else
- if (XINET_PTON(AF_INET6, address, serverIp.ip6) == 1)
- #endif
- {
- serverIp.version = IPV6;
- }
- }
-
- sniffer = ServerList;
- while (sniffer != NULL &&
- (!MatchAddr(sniffer->server, serverIp) || sniffer->port != port)) {
- sniffer = sniffer->next;
- }
-
- if (sniffer == NULL) {
- isNew = 1;
- sniffer = (SnifferServer*)XMALLOC(sizeof(SnifferServer),
- NULL, DYNAMIC_TYPE_SNIFFER_SERVER);
- if (sniffer == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
-#ifdef HAVE_SNI
- FreeNamedKey(namedKey);
-#endif
- return WOLFSSL_FATAL_ERROR;
- }
- InitSnifferServer(sniffer);
-
- XSTRNCPY(sniffer->address, address, MAX_SERVER_ADDRESS-1);
- sniffer->address[MAX_SERVER_ADDRESS-1] = '\0';
- sniffer->server = serverIp;
- sniffer->port = port;
-
- sniffer->ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
- if (!sniffer->ctx) {
- SetError(MEMORY_STR, error, NULL, 0);
-#ifdef HAVE_SNI
- FreeNamedKey(namedKey);
-#endif
- FreeSnifferServer(sniffer);
- return WOLFSSL_FATAL_ERROR;
- }
- #if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- if (CryptoDeviceId != INVALID_DEVID)
- wolfSSL_CTX_SetDevId(sniffer->ctx, CryptoDeviceId);
- #endif
- }
-
- if (name == NULL) {
- if (password) {
- #ifdef WOLFSSL_ENCRYPTED_KEYS
- wolfSSL_CTX_set_default_passwd_cb(sniffer->ctx, SetPassword);
- wolfSSL_CTX_set_default_passwd_cb_userdata(
- sniffer->ctx, (void*)password);
- #endif
- }
-
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- if (isEphemeralKey) {
- /* auto detect key type with WC_PK_TYPE_NONE */
- /* keySz == 0 mean load file */
- ret = wolfSSL_CTX_set_ephemeral_key(sniffer->ctx, WC_PK_TYPE_NONE,
- keyFile, keySz, type);
- if (ret == 0)
- ret = WOLFSSL_SUCCESS;
- }
- else
- #endif
- {
- if (keySz == 0) {
- ret = wolfSSL_CTX_use_PrivateKey_file(sniffer->ctx, keyFile, type);
- }
- else {
- ret = wolfSSL_CTX_use_PrivateKey_buffer(sniffer->ctx,
- (const byte*)keyFile, keySz, type);
- }
- }
- if (ret != WOLFSSL_SUCCESS) {
- SetError(KEY_FILE_STR, error, NULL, 0);
- if (isNew)
- FreeSnifferServer(sniffer);
- return WOLFSSL_FATAL_ERROR;
- }
- #ifdef WOLF_CRYPTO_CB
- wolfSSL_CTX_SetDevId(sniffer->ctx, CryptoDeviceId);
- #endif
- }
-#ifdef HAVE_SNI
- else {
- wc_LockMutex(&sniffer->namedKeysMutex);
- namedKey->next = sniffer->namedKeys;
- sniffer->namedKeys = namedKey;
- wc_UnLockMutex(&sniffer->namedKeysMutex);
- }
-#endif
-
- if (isNew) {
- sniffer->next = ServerList;
- ServerList = sniffer;
- }
-
-#ifndef WOLFSSL_STATIC_EPHEMERAL
- (void)isEphemeralKey;
-#endif
-
- return 0;
-}
-
-
-#ifdef HAVE_SNI
-/* Sets the private key for a specific name, server and port */
-/* returns 0 on success, -1 on error */
-int ssl_SetNamedPrivateKey(const char* name,
- const char* address, int port,
- const char* keyFile, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetNamedServer(name, address, port, keyFile);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(name, address, port, keyFile, 0,
- typeKey, password, error, 0);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-
-int ssl_SetNamedPrivateKeyBuffer(const char* name,
- const char* address, int port,
- const char* keyBuf, int keySz, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetNamedServer(name, address, port, NULL);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(name, address, port, keyBuf, keySz,
- typeKey, password, error, 0);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-#endif /* HAVE_SNI */
-
-/* Sets the private key for a specific server and port */
-/* returns 0 on success, -1 on error */
-int ssl_SetPrivateKey(const char* address, int port,
- const char* keyFile, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetServer(address, port, keyFile);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(NULL, address, port, keyFile, 0,
- typeKey, password, error, 0);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-
-int ssl_SetPrivateKeyBuffer(const char* address, int port,
- const char* keyBuf, int keySz, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetServer(address, port, "from buffer");
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(NULL, address, port, keyBuf, keySz,
- typeKey, password, error, 0);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-
-#ifdef WOLFSSL_STATIC_EPHEMERAL
-#ifdef HAVE_SNI
-/* Sets the ephemeral key for a specific name, server and port */
-/* returns 0 on success, -1 on error */
-int ssl_SetNamedEphemeralKey(const char* name,
- const char* address, int port,
- const char* keyFile, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetNamedServer(name, address, port, keyFile);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(name, address, port, keyFile, 0,
- typeKey, password, error, 1);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-
-int ssl_SetNamedEphemeralKeyBuffer(const char* name,
- const char* address, int port,
- const char* keyBuf, int keySz, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetNamedServer(name, address, port, NULL);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(name, address, port, keyBuf, keySz,
- typeKey, password, error, 1);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-#endif /* HAVE_SNI */
-
-/* Sets the ephemeral key for a specific server and port */
-/* returns 0 on success, -1 on error */
-int ssl_SetEphemeralKey(const char* address, int port,
- const char* keyFile, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetServer(address, port, keyFile);
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(NULL, address, port, keyFile, 0,
- typeKey, password, error, 1);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-
-int ssl_SetEphemeralKeyBuffer(const char* address, int port,
- const char* keyBuf, int keySz, int typeKey,
- const char* password, char* error)
-{
- int ret;
-
- TraceHeader();
- TraceSetServer(address, port, "from buffer");
-
- LOCK_SERVER_LIST();
- ret = SetNamedPrivateKey(NULL, address, port, keyBuf, keySz,
- typeKey, password, error, 1);
- UNLOCK_SERVER_LIST();
-
- if (ret == 0)
- Trace(NEW_SERVER_STR);
-
- return ret;
-}
-#endif /* WOLFSSL_STATIC_EPHEMERAL */
-
-/* Check IP Header for IPV6, TCP, and a registered server address */
-/* returns 0 on success, -1 on error */
-static int CheckIp6Hdr(Ip6Hdr* iphdr, IpInfo* info, int length, char* error)
-{
- int version = IP_V(iphdr);
- int exthdrsz = IP6_HDR_SZ;
-
- TraceIP6(iphdr);
- Trace(IP_CHECK_STR);
-
- if (version != IPV6) {
- SetError(BAD_IPVER_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* Here, we need to move onto next header if not TCP. */
- if (iphdr->next_header != TCP_PROTOCOL) {
- Ip6ExtHdr* exthdr = (Ip6ExtHdr*)((byte*)iphdr + IP6_HDR_SZ);
- do {
- int hdrsz = (exthdr->length + 1) * 8;
- if (hdrsz > length - exthdrsz) {
- SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- exthdrsz += hdrsz;
- exthdr = (Ip6ExtHdr*)((byte*)exthdr + hdrsz);
- }
- while (exthdr->next_header != TCP_PROTOCOL &&
- exthdr->next_header != NO_NEXT_HEADER);
- }
-
-#ifndef WOLFSSL_SNIFFER_WATCH
- if (!IsServerRegistered6(iphdr->src) && !IsServerRegistered6(iphdr->dst)) {
- SetError(SERVER_NOT_REG_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-#endif
-
- info->length = exthdrsz;
- info->total = XNTOHS(iphdr->length) + info->length;
- /* IPv6 doesn't include its own header size in the length like v4. */
- info->src.version = IPV6;
- XMEMCPY(info->src.ip6, iphdr->src, sizeof(info->src.ip6));
- info->dst.version = IPV6;
- XMEMCPY(info->dst.ip6, iphdr->dst, sizeof(info->dst.ip6));
-
- return 0;
-}
-
-
-/* Check IP Header for IPV4, TCP, and a registered server address */
-/* If header IPv6, pass to CheckIp6Hdr(). */
-/* returns 0 on success, -1 on error */
-static int CheckIpHdr(IpHdr* iphdr, IpInfo* info, int length, char* error,
- int trace)
-{
- int version = IP_V(iphdr);
-
- if (version == IPV6)
- return CheckIp6Hdr((Ip6Hdr*)iphdr, info, length, error);
-
- if (trace) {
- TraceIP(iphdr);
- Trace(IP_CHECK_STR);
- }
-
- if (version != IPV4) {
- SetError(BAD_IPVER_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (iphdr->protocol != TCP_PROTOCOL) {
- SetError(BAD_PROTO_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- info->length = IP_HL(iphdr);
- info->total = XNTOHS(iphdr->length);
- info->src.version = IPV4;
- info->src.ip4 = iphdr->src;
- info->dst.version = IPV4;
- info->dst.ip4 = iphdr->dst;
-
- if (info->total == 0)
- info->total = length; /* reassembled may be off */
-
- return 0;
-}
-
-
-/* Check TCP Header for a registered port */
-/* returns 0 on success, -1 on error */
-static int CheckTcpHdr(TcpHdr* tcphdr, TcpInfo* info, char* error, int trace)
-{
- if (trace) {
- TraceTcp(tcphdr);
- Trace(TCP_CHECK_STR);
- }
-
- info->srcPort = XNTOHS(tcphdr->srcPort);
- info->dstPort = XNTOHS(tcphdr->dstPort);
- info->length = TCP_LEN(tcphdr);
- info->sequence = XNTOHL(tcphdr->sequence);
- info->fin = tcphdr->flags & TCP_FIN;
- info->rst = tcphdr->flags & TCP_RST;
- info->syn = tcphdr->flags & TCP_SYN;
- info->ack = tcphdr->flags & TCP_ACK;
- if (info->ack)
- info->ackNumber = XNTOHL(tcphdr->ack);
-
- (void)error;
-
- return 0;
-}
-
-
-/* Decode Record Layer Header */
-static int GetRecordHeader(const byte* input, RecordLayerHeader* rh, int* size)
-{
- XMEMCPY(rh, input, RECORD_HEADER_SZ);
- *size = (rh->length[0] << 8) | rh->length[1];
-
- /* make sure length is valid */
- if (*size > (MAX_RECORD_SIZE + COMP_EXTRA + MAX_MSG_EXTRA))
- return LENGTH_ERROR;
- /* make sure the record type is valid */
- if (rh->type < change_cipher_spec ||
- #ifdef WOLFSSL_DTLS13
- rh->type > ack
- #else
- rh->type > dtls12_cid
- #endif
- ) {
- return UNKNOWN_RECORD_TYPE;
- }
- /* make sure version is valid */
- if (rh->pvMajor > SSLv3_MAJOR || rh->pvMinor > TLSv1_3_MINOR) {
- return VERSION_ERROR;
- }
-
- return 0;
-}
-
-
-/* Copies the session's information to the provided sslInfo. Skip copy if
- * SSLInfo is not provided. */
-static void CopySessionInfo(SnifferSession* session, SSLInfo* sslInfo)
-{
- if (NULL != sslInfo) {
- XMEMSET(sslInfo, 0, sizeof(SSLInfo));
-
- /* Pass back Session Info after we have processed the Server Hello. */
- if (0 != session->sslServer->options.cipherSuite) {
- const char* pCipher;
-
- sslInfo->isValid = 1;
- sslInfo->protocolVersionMajor = session->sslServer->version.major;
- sslInfo->protocolVersionMinor = session->sslServer->version.minor;
- sslInfo->serverCipherSuite0 =
- session->sslServer->options.cipherSuite0;
- sslInfo->serverCipherSuite =
- session->sslServer->options.cipherSuite;
-
- pCipher = wolfSSL_get_cipher(session->sslServer);
- if (NULL != pCipher) {
- XSTRNCPY((char*)sslInfo->serverCipherSuiteName, pCipher,
- sizeof(sslInfo->serverCipherSuiteName) - 1);
- sslInfo->serverCipherSuiteName
- [sizeof(sslInfo->serverCipherSuiteName) - 1] = '\0';
- }
- sslInfo->keySize = session->keySz;
- #ifdef HAVE_SNI
- if (NULL != session->sni) {
- XSTRNCPY((char*)sslInfo->serverNameIndication,
- session->sni, sizeof(sslInfo->serverNameIndication) - 1);
- sslInfo->serverNameIndication
- [sizeof(sslInfo->serverNameIndication) - 1] = '\0';
- }
- #endif
- TraceSessionInfo(sslInfo);
- }
- }
-}
-
-
-/* Call the session connection start callback. */
-static void CallConnectionCb(SnifferSession* session)
-{
- if (ConnectionCb != NULL) {
- SSLInfo info;
- CopySessionInfo(session, &info);
- ConnectionCb((const void*)session, &info, ConnectionCbCtx);
- }
-}
-
-#ifdef SHOW_SECRETS
-static void PrintSecret(const char* desc, const byte* buf, int sz)
-{
- int i;
- printf("%s: ", desc);
- for (i = 0; i < sz; i++) {
- printf("%02x", buf[i]);
- }
- printf("\n");
-}
-
-static void ShowTlsSecrets(SnifferSession* session)
-{
- PrintSecret("server master secret", session->sslServer->arrays->masterSecret, SECRET_LEN);
- PrintSecret("client master secret", session->sslClient->arrays->masterSecret, SECRET_LEN);
- printf("server suite = %d\n", session->sslServer->options.cipherSuite);
- printf("client suite = %d\n", session->sslClient->options.cipherSuite);
-}
-#endif /* SHOW_SECRETS */
-
-typedef struct {
- int type;
- union {
- #ifndef NO_RSA
- RsaKey rsa;
- #endif
- #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
- struct {
- word32 pLen; /* modulus length */
- word32 privKeySz;
- byte privKey[WC_DH_PRIV_MAX_SZ]; /* max for TLS */
- DhKey key;
- } dh;
- #endif
- #ifdef HAVE_ECC
- ecc_key ecc;
- #endif
- #ifdef HAVE_CURVE25519
- curve25519_key x25519;
- #endif
- #ifdef HAVE_CURVE448
- curve448_key x448;
- #endif
- } priv;
-
-#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
- union {
- /* RSA is for static RSA only */
- /* DH does not use public DhKey for Agree */
- #ifdef HAVE_ECC
- ecc_key ecc;
- #endif
- #ifdef HAVE_CURVE25519
- curve25519_key x25519;
- #endif
- #ifdef HAVE_CURVE448
- curve448_key x448;
- #endif
- } pub;
-#endif
- byte initPriv:1;
- byte initPub:1;
-} SnifferKey;
-
-typedef struct SetupKeysArgs {
-#ifdef WOLFSSL_ASYNC_CRYPT
- SnifferKey* key;
-#else
- SnifferKey key[1];
-#endif
- DerBuffer* keyBuf;
- int length;
- byte keyBufFree:1;
- byte keyLocked:1;
-} SetupKeysArgs;
-
-static void FreeSetupKeysArgs(WOLFSSL* ssl, void* pArgs)
-{
- SetupKeysArgs* args = (SetupKeysArgs*)pArgs;
-
- if (args == NULL) {
- return;
- }
- (void)ssl;
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (args->key != NULL)
-#endif
- {
- #ifndef NO_RSA
- if (args->key->type == WC_PK_TYPE_RSA) {
- if (args->key->initPriv) {
- wc_FreeRsaKey(&args->key->priv.rsa);
- }
- }
- #endif
- #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
- if (args->key->type == WC_PK_TYPE_DH) {
- if (args->key->initPriv) {
- wc_FreeDhKey(&args->key->priv.dh.key);
- }
- }
- #endif
- #ifdef HAVE_ECC
- if (args->key->type == WC_PK_TYPE_ECDH) {
- if (args->key->initPriv) {
- wc_ecc_free(&args->key->priv.ecc);
- }
- if (args->key->initPub) {
- wc_ecc_free(&args->key->pub.ecc);
- }
- }
- #endif
- #ifdef HAVE_CURVE25519
- if (args->key->type == WC_PK_TYPE_CURVE25519) {
- if (args->key->initPriv) {
- wc_curve25519_free(&args->key->priv.x25519);
- }
- if (args->key->initPub) {
- wc_curve25519_free(&args->key->pub.x25519);
- }
- }
- #endif
- #ifdef HAVE_CURVE448
- if (args->key->type == WC_PK_TYPE_CURVE448) {
- if (args->key->initPriv) {
- wc_curve448_free(&args->key->priv.x448);
- }
- if (args->key->initPub) {
- wc_curve448_free(&args->key->pub.x448);
- }
- }
- #endif
- args->key->type = WC_PK_TYPE_NONE;
- args->key->initPriv = 0; args->key->initPub = 0;
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- XFREE(args->key, NULL, DYNAMIC_TYPE_SNIFFER_KEY);
- args->key = NULL;
-#else
- XMEMSET(args->key, 0, sizeof(args->key));
-#endif
- }
-
- if (args->keyBuf != NULL && args->keyBufFree) {
- FreeDer(&args->keyBuf);
- args->keyBufFree = 0;
- }
-}
-
-/* Process Keys */
-static int SetupKeys(const byte* input, int* sslBytes, SnifferSession* session,
- char* error, KeyShareInfo* ksInfo)
-{
- word32 idx;
- int ret;
- int devId = INVALID_DEVID;
- WOLFSSL_CTX* ctx = session->context->ctx;
- WOLFSSL* ssl = session->sslServer;
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- SetupKeysArgs* args = NULL;
- WOLFSSL_ASSERT_SIZEOF_GE(ssl->async->args, *args);
-#else
- SetupKeysArgs args[1];
-#endif
-
- Trace(SNIFFER_KEY_SETUP_STR);
-
- if (session->sslServer->arrays == NULL ||
- session->sslClient->arrays == NULL) {
- /* Secret's have already been established and released.
- * This can happen with secure renegotiation. */
- return 0;
- }
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (ssl->async == NULL) {
- ssl->async = (struct WOLFSSL_ASYNC*)
- XMALLOC(sizeof(struct WOLFSSL_ASYNC), ssl->heap,
- DYNAMIC_TYPE_ASYNC);
- if (ssl->async == NULL)
- ERROR_OUT(MEMORY_E, exit_sk);
- }
- args = (SetupKeysArgs*)ssl->async->args;
-
- ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
- if (ret != WC_NO_ERR_TRACE(WC_NO_PENDING_E)) {
- /* Check for error */
- if (ret < 0)
- goto exit_sk;
- }
- else
-#endif
- {
- /* Reset state */
- ret = 0;
- ssl->options.asyncState = TLS_ASYNC_BEGIN;
- XMEMSET(args, 0, sizeof(SetupKeysArgs));
- #ifdef WOLFSSL_ASYNC_CRYPT
- ssl->async->freeArgs = FreeSetupKeysArgs;
- #endif
- #ifdef WOLFSSL_ASYNC_CRYPT
- args->key = (SnifferKey*)XMALLOC(sizeof(SnifferKey), NULL,
- DYNAMIC_TYPE_SNIFFER_KEY);
- #endif
- }
-
-#if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- devId = CryptoDeviceId;
-#endif
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (args->key == NULL) {
- ERROR_OUT(MEMORY_E, exit_sk);
- }
-#endif
-
- #if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- if (session->context->useKeyLogFile) {
- ret = 0;
- XMEMSET(args, 0, sizeof(SetupKeysArgs));
-
- /* We want to skip all the key setup and go right to master secret generation, which is
- * where we inject the master secret obtained from the keylog file */
- ssl->options.asyncState = TLS_ASYNC_FINALIZE;
- }
- #endif
-
- switch (ssl->options.asyncState) {
- case TLS_ASYNC_BEGIN:
- {
- #if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
- int useCurveId = 0;
- if (ksInfo && ksInfo->curve_id != 0) {
- useCurveId = ksInfo->curve_id;
- }
- #endif
-
- #if defined(WOLFSSL_STATIC_EPHEMERAL) && !defined(SINGLE_THREADED)
- if (ctx->staticKELockInit &&
- wc_LockMutex(&ctx->staticKELock) == 0) {
- args->keyLocked = 1;
- }
- #endif
-
- #ifndef NO_RSA
- /* Static RSA */
- if (ksInfo == NULL && ssl->buffers.key) {
- ret = wc_InitRsaKey_ex(&args->key->priv.rsa, NULL, devId);
- if (ret == 0) {
- args->key->type = WC_PK_TYPE_RSA;
- args->key->initPriv = 1;
- args->keyBuf = ssl->buffers.key;
- #ifdef WOLFSSL_ASYNC_CRYPT
- ret = wolfSSL_AsyncInit(ssl, &args->key->priv.rsa.asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- #endif
- }
- if (ret == 0) {
- idx = 0;
- ret = wc_RsaPrivateKeyDecode(args->keyBuf->buffer, &idx,
- &args->key->priv.rsa, args->keyBuf->length);
- if (ret != 0) {
- #ifndef HAVE_ECC
- SetError(RSA_DECODE_STR, error, session,
- FATAL_ERROR_STATE);
- break;
- #else
- /* If we can do ECC, this isn't fatal. Not loading a key
- * later will be fatal, though. */
- SetError(RSA_DECODE_STR, error, session, 0);
- args->keyBuf = NULL;
- #endif
- }
- }
-
- if (ret == 0) {
- args->length = wc_RsaEncryptSize(&args->key->priv.rsa);
- if (IsTLS(session->sslServer)) {
- input += 2; /* tls pre length */
- }
-
- if (args->length > *sslBytes) {
- SetError(PARTIAL_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
- }
-
- #ifdef WC_RSA_BLINDING
- if (ret == 0) {
- ret = wc_RsaSetRNG(&args->key->priv.rsa,
- session->sslServer->rng);
- if (ret != 0) {
- SetError(RSA_DECRYPT_STR, error, session,
- FATAL_ERROR_STATE);
- }
- }
- #endif
-
- if (ret == 0) {
- session->keySz = args->length * WOLFSSL_BIT_SIZE;
- /* length is the key size in bytes */
- session->sslServer->arrays->preMasterSz = SECRET_LEN;
- }
- }
- #endif /* !NO_RSA */
-
- #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
- /* Static DH Key */
- if (ksInfo && ksInfo->dh_key_bits != 0 && args->keyBuf == NULL) {
- #ifdef HAVE_PUBLIC_FFDHE
- const DhParams* params;
- #endif
-
- /* try and load static ephemeral */
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- args->keyBuf = ssl->staticKE.dhKey;
- if (args->keyBuf == NULL)
- args->keyBuf = ctx->staticKE.dhKey;
- #endif
-
- ret = 0;
- #ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
- if (KeyCb != NULL) {
- if (args->keyBuf == NULL) {
- ret = AllocDer(&args->keyBuf, FILE_BUFFER_SIZE,
- PRIVATEKEY_TYPE, NULL);
- if (ret == 0)
- args->keyBufFree = 1;
- }
- ret = KeyCb(session, ksInfo->named_group,
- session->srvKs.key, session->srvKs.key_len,
- session->cliKs.key, session->cliKs.key_len,
- args->keyBuf, KeyCbCtx, error);
- if (ret != 0) {
- SetError(-1, error, session, FATAL_ERROR_STATE);
- }
- }
- #endif
- if (ret == 0 && args->keyBuf == NULL) {
- ret = BUFFER_E;
- }
-
- #ifdef HAVE_PUBLIC_FFDHE
- if (ret == 0) {
- /* get DH params */
- switch (ksInfo->named_group) {
- #ifdef HAVE_FFDHE_2048
- case WOLFSSL_FFDHE_2048:
- params = wc_Dh_ffdhe2048_Get();
- args->key->priv.dh.privKeySz = 29;
- break;
- #endif
- #ifdef HAVE_FFDHE_3072
- case WOLFSSL_FFDHE_3072:
- params = wc_Dh_ffdhe3072_Get();
- args->key->priv.dh.privKeySz = 34;
- break;
- #endif
- #ifdef HAVE_FFDHE_4096
- case WOLFSSL_FFDHE_4096:
- params = wc_Dh_ffdhe4096_Get();
- args->key->priv.dh.privKeySz = 39;
- break;
- #endif
- #ifdef HAVE_FFDHE_6144
- case WOLFSSL_FFDHE_6144:
- params = wc_Dh_ffdhe6144_Get();
- args->key->priv.dh.privKeySz = 46;
- break;
- #endif
- #ifdef HAVE_FFDHE_8192
- case WOLFSSL_FFDHE_8192:
- params = wc_Dh_ffdhe8192_Get();
- args->key->priv.dh.privKeySz = 52;
- break;
- #endif
- default:
- ret = BAD_FUNC_ARG;
- }
- }
- #endif
-
- if (ret == 0) {
- ret = wc_InitDhKey_ex(&args->key->priv.dh.key, NULL, devId);
- if (ret == 0) {
- args->key->type = WC_PK_TYPE_DH;
- args->key->initPriv = 1;
- #ifdef WOLFSSL_ASYNC_CRYPT
- ret = wolfSSL_AsyncInit(ssl,
- &args->key->priv.dh.key.asyncDev, WC_ASYNC_FLAG_NONE);
- #endif
- }
- }
- if (ret == 0) {
- #ifdef HAVE_PUBLIC_FFDHE
- ret = wc_DhSetKey(&args->key->priv.dh.key,
- (byte*)params->p, params->p_len,
- (byte*)params->g, params->g_len);
- args->key->priv.dh.pLen = params->p_len;
- #else
- ret = wc_DhSetNamedKey(&args->key->priv.dh.key,
- ksInfo->named_group);
- if (ret == 0) {
- args->key->priv.dh.privKeySz =
- wc_DhGetNamedKeyMinSize(ksInfo->named_group);
- ret = wc_DhGetNamedKeyParamSize(ksInfo->named_group,
- &args->key->priv.dh.pLen, NULL, NULL);
- }
- #endif
- }
- if (ret == 0) {
- idx = 0;
- ret = wc_DhKeyDecode(args->keyBuf->buffer, &idx,
- &args->key->priv.dh.key, args->keyBuf->length);
- }
- if (ret == 0) {
- ret = wc_DhExportKeyPair(&args->key->priv.dh.key,
- args->key->priv.dh.privKey, &args->key->priv.dh.privKeySz,
- NULL, NULL);
- }
- }
- #endif /* !NO_DH && WOLFSSL_DH_EXTRA */
-
- #ifdef HAVE_ECC
- /* Static ECC Key */
- if (useCurveId >= 0 && args->keyBuf == NULL
- #ifdef HAVE_CURVE25519
- && useCurveId != ECC_X25519
- #endif
- #ifdef HAVE_CURVE448
- && useCurveId != ECC_X448
- #endif
- ) {
- /* try and load static ephemeral */
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- args->keyBuf = ssl->staticKE.ecKey;
- if (args->keyBuf == NULL)
- args->keyBuf = ctx->staticKE.ecKey;
- #endif
-
- /* try static ECC */
- if (args->keyBuf == NULL) {
- args->keyBuf = session->sslServer->buffers.key;
- }
-
- ret = 0;
- #ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
- if (KeyCb != NULL && ksInfo) {
- if (args->keyBuf == NULL) {
- ret = AllocDer(&args->keyBuf, FILE_BUFFER_SIZE,
- PRIVATEKEY_TYPE, NULL);
- if (ret == 0)
- args->keyBufFree = 1;
- }
- ret = KeyCb(session, ksInfo->named_group,
- session->srvKs.key, session->srvKs.key_len,
- session->cliKs.key, session->cliKs.key_len,
- args->keyBuf, KeyCbCtx, error);
- if (ret != 0) {
- SetError(-1, error, session, FATAL_ERROR_STATE);
- }
- }
- #endif
-
- if (ret == 0 && args->keyBuf == NULL) {
- ret = BUFFER_E;
- }
- if (ret == 0) {
- ret = wc_ecc_init_ex(&args->key->priv.ecc, NULL, devId);
- if (ret == 0) {
- args->key->type = WC_PK_TYPE_ECDH;
- args->key->initPriv = 1;
- #ifdef WOLFSSL_ASYNC_CRYPT
- ret = wolfSSL_AsyncInit(ssl, &args->key->priv.ecc.asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- #endif
- }
- }
- #if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
- (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
- !defined(HAVE_SELFTEST)
- if (ret == 0) {
- ret = wc_ecc_set_rng(&args->key->priv.ecc,
- session->sslServer->rng);
- }
- #endif
- if (ret == 0) {
- idx = 0;
- ret = wc_EccPrivateKeyDecode(args->keyBuf->buffer, &idx,
- &args->key->priv.ecc, args->keyBuf->length);
- if (ret != 0) {
- SetError(ECC_DECODE_STR, error, session, FATAL_ERROR_STATE);
- }
- }
-
- if (ret == 0) {
- args->length = wc_ecc_size(&args->key->priv.ecc) * 2 + 1;
- /* The length should be 2 times the key size (x and y), plus 1
- * for the type byte. */
- if (!IsAtLeastTLSv1_3(session->sslServer->version)) {
- input += 1; /* Don't include the TLS length for the key. */
- }
-
- if (args->length > *sslBytes) {
- SetError(PARTIAL_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
-
- /* if curve not provided in key share data, then use private
- * key curve */
- if (useCurveId == 0 && args->key->priv.ecc.dp) {
- /* this is for the static ECC case */
- useCurveId = args->key->priv.ecc.dp->id;
- }
- }
- if (ret == 0) {
- ret = wc_ecc_init(&args->key->pub.ecc);
- if (ret == 0)
- args->key->initPub = 1;
- }
- if (ret == 0) {
- ret = wc_ecc_import_x963_ex(input, args->length,
- &args->key->pub.ecc, useCurveId);
- if (ret != 0) {
- SetError(ECC_PUB_DECODE_STR, error, session,
- FATAL_ERROR_STATE);
- }
- }
- if (ret == 0) {
- session->keySz = ((args->length - 1) / 2) * WOLFSSL_BIT_SIZE;
- /* Length is in bytes. Subtract 1 for the ECC key type. Divide
- * by two as the key is in (x,y) coordinates, where x and y are
- * the same size, the key size. Convert from bytes to bits. */
- session->sslServer->arrays->preMasterSz = ENCRYPT_LEN;
- }
- }
- #endif /* HAVE_ECC */
-
- #ifdef HAVE_CURVE25519
- /* Static Curve25519 Key */
- if (useCurveId == ECC_X25519) {
- /* try and load static ephemeral */
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- args->keyBuf = ssl->staticKE.x25519Key;
- if (args->keyBuf == NULL)
- args->keyBuf = ctx->staticKE.x25519Key;
- #endif
-
- ret = 0;
- #ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
- if (KeyCb != NULL && ksInfo) {
- if (args->keyBuf == NULL) {
- ret = AllocDer(&args->keyBuf, FILE_BUFFER_SIZE,
- PRIVATEKEY_TYPE, NULL);
- if (ret == 0)
- args->keyBufFree = 1;
- }
- ret = KeyCb(session, ksInfo->named_group,
- session->srvKs.key, session->srvKs.key_len,
- session->cliKs.key, session->cliKs.key_len,
- args->keyBuf, KeyCbCtx, error);
- if (ret != 0) {
- SetError(-1, error, session, FATAL_ERROR_STATE);
- break;
- }
- }
- #endif
-
- if (ret == 0 && args->keyBuf == NULL) {
- ret = BUFFER_E;
- }
- if (ret == 0) {
- ret = wc_curve25519_init_ex(&args->key->priv.x25519, NULL,
- devId);
- if (ret == 0) {
- args->key->type = WC_PK_TYPE_CURVE25519;
- args->key->initPriv = 1;
- #ifdef WOLFSSL_ASYNC_CRYPT
- ret = wolfSSL_AsyncInit(ssl,
- &args->key->priv.x25519.asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- #endif
- }
- }
- if (ret == 0) {
- idx = 0;
- ret = wc_Curve25519PrivateKeyDecode(args->keyBuf->buffer, &idx,
- &args->key->priv.x25519, args->keyBuf->length);
- if (ret != 0) {
- SetError(ECC_DECODE_STR, error, session, FATAL_ERROR_STATE);
- }
- }
-
- if (ret == 0) {
- args->length = CURVE25519_KEYSIZE;
- if (args->length > *sslBytes) {
- SetError(PARTIAL_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
- }
- if (ret == 0) {
- ret = wc_curve25519_init(&args->key->pub.x25519);
- if (ret == 0)
- args->key->initPub = 1;
- }
- if (ret == 0) {
- ret = wc_curve25519_import_public_ex(input, args->length,
- &args->key->pub.x25519, EC25519_LITTLE_ENDIAN);
- if (ret != 0) {
- SetError(ECC_PUB_DECODE_STR, error, session,
- FATAL_ERROR_STATE);
- }
- }
-
- if (ret == 0) {
- /* For Curve25519 length is always 32 */
- session->keySz = CURVE25519_KEYSIZE;
- session->sslServer->arrays->preMasterSz = ENCRYPT_LEN;
- }
- }
- #endif /* HAVE_CURVE25519 */
-
- #ifdef HAVE_CURVE448
- /* Static Curve448 Key */
- if (useCurveId == ECC_X448) {
- /* try and load static ephemeral */
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- args->keyBuf = ssl->staticKE.x448Key;
- if (args->keyBuf == NULL)
- args->keyBuf = ctx->staticKE.x448Key;
- #endif
-
- ret = 0;
- #ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
- if (KeyCb != NULL && ksInfo) {
- if (args->keyBuf == NULL) {
- ret = AllocDer(&args->keyBuf, FILE_BUFFER_SIZE,
- PRIVATEKEY_TYPE, NULL);
- if (ret == 0)
- args->keyBufFree = 1;
- }
- ret = KeyCb(session, ksInfo->named_group,
- session->srvKs.key, session->srvKs.key_len,
- session->cliKs.key, session->cliKs.key_len,
- args->keyBuf, KeyCbCtx, error);
- if (ret != 0) {
- SetError(-1, error, session, FATAL_ERROR_STATE);
- break;
- }
- }
- #endif
-
- if (ret == 0 && args->keyBuf == NULL) {
- ret = BUFFER_E;
- }
- if (ret == 0) {
- ret = wc_curve448_init(&args->key->priv.x448);
- if (ret == 0) {
- args->key->type = WC_PK_TYPE_CURVE448;
- args->key->initPriv = 1;
- #ifdef WOLFSSL_ASYNC_CRYPT
- ret = wolfSSL_AsyncInit(ssl, &args->key->priv.x448.asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- #endif
- }
- }
- if (ret == 0) {
- idx = 0;
- ret = wc_Curve448PrivateKeyDecode(args->keyBuf->buffer, &idx,
- &args->key->priv.x448, args->keyBuf->length);
- if (ret != 0) {
- SetError(ECC_DECODE_STR, error, session, FATAL_ERROR_STATE);
- }
- }
-
- if (ret == 0) {
- args->length = CURVE448_KEY_SIZE;
- if (args->length > *sslBytes) {
- SetError(PARTIAL_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
- }
- if (ret == 0) {
- ret = wc_curve448_init(&args->key->pub.x448);
- if (ret == 0)
- args->key->initPub = 1;
- }
- if (ret == 0) {
- ret = wc_curve448_import_public_ex(input, args->length,
- &args->key->pub.x448, EC448_LITTLE_ENDIAN);
- if (ret != 0) {
- SetError(ECC_PUB_DECODE_STR, error, session,
- FATAL_ERROR_STATE);
- }
- }
-
- if (ret == 0) {
- session->keySz = CURVE448_KEY_SIZE;
- session->sslServer->arrays->preMasterSz = ENCRYPT_LEN;
- }
- }
- #endif /* HAVE_CURVE448 */
-
- #if defined(WOLFSSL_STATIC_EPHEMERAL) && !defined(SINGLE_THREADED)
- if (args->keyLocked) {
- wc_UnLockMutex(&ctx->staticKELock);
- }
- #endif
-
- /* make sure a key type was found */
- if (args->key->type == WC_PK_TYPE_NONE) {
- ret = NOT_COMPILED_IN;
- }
-
- /* check for errors before moving to next state */
- if (ret < 0) {
- break;
- }
-
- /* Advance state and proceed */
- ssl->options.asyncState = TLS_ASYNC_DO;
- } /* case TLS_ASYNC_BEGIN */
- FALL_THROUGH;
-
- case TLS_ASYNC_DO:
- {
- #ifdef WOLFSSL_ASYNC_CRYPT
- WC_ASYNC_DEV* asyncDev = NULL;
- #endif
- #ifndef NO_RSA
- if (args->key->type == WC_PK_TYPE_RSA) {
- ret = wc_RsaPrivateDecrypt(input, args->length,
- session->sslServer->arrays->preMasterSecret,
- session->sslServer->arrays->preMasterSz,
- &args->key->priv.rsa);
- #ifdef WOLFSSL_ASYNC_CRYPT
- asyncDev = &args->key->priv.rsa.asyncDev;
- #endif
- }
- #endif /* !NO_RSA */
- #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
- if (args->key->type == WC_PK_TYPE_DH) {
- /* Derive secret from private key and peer's public key */
- ret = wc_DhAgree(&args->key->priv.dh.key,
- session->sslServer->arrays->preMasterSecret,
- &session->sslServer->arrays->preMasterSz,
- args->key->priv.dh.privKey, args->key->priv.dh.privKeySz,
- input, *sslBytes);
- #ifdef WOLFSSL_ASYNC_CRYPT
- asyncDev = &args->key->priv.dh.key.asyncDev;
- #endif
- }
- #endif /* !NO_DH && WOLFSSL_DH_EXTRA */
- #ifdef HAVE_ECC
- if (args->key->type == WC_PK_TYPE_ECDH) {
- ret = wc_ecc_shared_secret(&args->key->priv.ecc,
- &args->key->pub.ecc,
- session->sslServer->arrays->preMasterSecret,
- &session->sslServer->arrays->preMasterSz);
- #ifdef WOLFSSL_ASYNC_CRYPT
- asyncDev = &args->key->priv.ecc.asyncDev;
- #endif
- }
- #endif /* HAVE_ECC */
- #ifdef HAVE_CURVE25519
- if (args->key->type == WC_PK_TYPE_CURVE25519) {
- ret = wc_curve25519_shared_secret_ex(&args->key->priv.x25519,
- &args->key->pub.x25519,
- session->sslServer->arrays->preMasterSecret,
- &session->sslServer->arrays->preMasterSz,
- EC25519_LITTLE_ENDIAN);
- #ifdef WOLFSSL_ASYNC_CRYPT
- asyncDev = &args->key->priv.x25519.asyncDev;
- #endif
- }
- #endif /* HAVE_CURVE25519 */
- #ifdef HAVE_CURVE448
- if (args->key->type == WC_PK_TYPE_CURVE448) {
- ret = wc_curve448_shared_secret_ex(&args->key->priv.x448,
- &args->key->pub.x448,
- session->sslServer->arrays->preMasterSecret,
- &session->sslServer->arrays->preMasterSz, EC448_LITTLE_ENDIAN);
- #ifdef WOLFSSL_ASYNC_CRYPT
- asyncDev = &args->key->priv.x448.asyncDev;
- #endif
- }
- #endif /* HAVE_CURVE448 */
-
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- /* Handle async pending response */
- ret = wolfSSL_AsyncPush(ssl, asyncDev);
- break;
- }
- #endif /* WOLFSSL_ASYNC_CRYPT */
-
- /* check for errors before moving to next state */
- if (ret < 0) {
- break;
- }
-
- /* Advance state and proceed */
- ssl->options.asyncState = TLS_ASYNC_VERIFY;
- } /* case TLS_ASYNC_DO */
- FALL_THROUGH;
-
- case TLS_ASYNC_VERIFY:
- {
- #ifndef NO_RSA
- if (args->key->type == WC_PK_TYPE_RSA) {
- if (ret != SECRET_LEN) {
- SetError(RSA_DECRYPT_STR, error, session, FATAL_ERROR_STATE);
- ret = RSA_BUFFER_E;
- }
- }
- #endif /* !NO_RSA */
- #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
- if (args->key->type == WC_PK_TYPE_DH) {
- /* left-padded with zeros up to the size of the prime */
- if (args->key->priv.dh.pLen >
- session->sslServer->arrays->preMasterSz) {
- word32 diff = args->key->priv.dh.pLen -
- session->sslServer->arrays->preMasterSz;
- XMEMMOVE(session->sslServer->arrays->preMasterSecret + diff,
- session->sslServer->arrays->preMasterSecret,
- session->sslServer->arrays->preMasterSz);
- XMEMSET(session->sslServer->arrays->preMasterSecret, 0, diff);
- session->sslServer->arrays->preMasterSz=args->key->priv.dh.pLen;
- }
- }
- #endif /* !NO_DH && WOLFSSL_DH_EXTRA */
-
- /* check for errors before moving to next state */
- if (ret < 0) {
- break;
- }
-
- /* Advance state and proceed */
- ssl->options.asyncState = TLS_ASYNC_FINALIZE;
- } /* case TLS_ASYNC_VERIFY */
- FALL_THROUGH;
-
- case TLS_ASYNC_FINALIZE:
- {
- #if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- if (!session->context->useKeyLogFile)
- #endif /* !WOLFSSL_SNIFFER_KEYLOGFILE */
- {
- /* store for client side as well */
- XMEMCPY(session->sslClient->arrays->preMasterSecret,
- session->sslServer->arrays->preMasterSecret,
- session->sslServer->arrays->preMasterSz);
- session->sslClient->arrays->preMasterSz =
- session->sslServer->arrays->preMasterSz;
- }
-
- #ifdef SHOW_SECRETS
- PrintSecret("pre master secret",
- session->sslServer->arrays->preMasterSecret,
- session->sslServer->arrays->preMasterSz);
- #endif
-
- if (SetCipherSpecs(session->sslServer) != 0) {
- SetError(BAD_CIPHER_SPEC_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- ret = WOLFSSL_FATAL_ERROR; break;
- }
-
- if (SetCipherSpecs(session->sslClient) != 0) {
- SetError(BAD_CIPHER_SPEC_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- ret = WOLFSSL_FATAL_ERROR; break;
- }
-
- #ifdef WOLFSSL_TLS13
- /* TLS v1.3 derive handshake key */
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- ret = DeriveEarlySecret(session->sslServer);
- ret += DeriveEarlySecret(session->sslClient);
- ret += DeriveHandshakeSecret(session->sslServer);
- ret += DeriveHandshakeSecret(session->sslClient);
- ret += DeriveTls13Keys(session->sslServer, handshake_key,
- ENCRYPT_AND_DECRYPT_SIDE, 1);
- ret += DeriveTls13Keys(session->sslClient, handshake_key,
- ENCRYPT_AND_DECRYPT_SIDE, 1);
- #ifdef WOLFSSL_EARLY_DATA
- ret += SetKeysSide(session->sslServer, DECRYPT_SIDE_ONLY);
- ret += SetKeysSide(session->sslClient, DECRYPT_SIDE_ONLY);
- #else
- ret += SetKeysSide(session->sslServer, ENCRYPT_AND_DECRYPT_SIDE);
- ret += SetKeysSide(session->sslClient, ENCRYPT_AND_DECRYPT_SIDE);
- #endif
- }
- else
- #endif /* WOLFSSL_TLS13 */
- {
- ret = MakeMasterSecret(session->sslServer);
- ret += MakeMasterSecret(session->sslClient);
- ret += SetKeysSide(session->sslServer, ENCRYPT_AND_DECRYPT_SIDE);
- ret += SetKeysSide(session->sslClient, ENCRYPT_AND_DECRYPT_SIDE);
- }
- if (ret != 0) {
- SetError(BAD_DERIVE_STR, error, session, FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR; break;
- }
-
- #ifdef SHOW_SECRETS
- #ifdef WOLFSSL_TLS13
- if (!IsAtLeastTLSv1_3(session->sslServer->version))
- #endif
- {
- ShowTlsSecrets(session);
- }
- #endif
-
- CallConnectionCb(session);
-
- break;
- } /* case TLS_ASYNC_FINALIZE */
-
- default:
- ret = INPUT_CASE_ERROR;
- } /* switch(ssl->options.asyncState) */
-
-#ifdef WOLFSSL_ASYNC_CRYPT
-exit_sk:
-
- /* Handle async pending response */
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- return ret;
- }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
-#ifdef WOLFSSL_SNIFFER_STATS
- if (ret < 0)
- INC_STAT(SnifferStats.sslKeyFails);
-#endif
-
- /* Final cleanup */
-#ifdef WOLFSSL_ASYNC_CRYPT
- FreeAsyncCtx(ssl, 1);
-#else
- FreeSetupKeysArgs(ssl, args);
-#endif
-#ifndef WOLFSSL_STATIC_EPHEMERAL
- (void)ctx;
-#endif
-
- return ret;
-}
-
-/* Process Client Key Exchange */
-static int ProcessClientKeyExchange(const byte* input, int* sslBytes,
- SnifferSession* session, char* error)
-{
- int ret;
-
-#ifndef WOLFSSL_STATIC_EPHEMERAL
- if (session->sslServer->buffers.key == NULL ||
- session->sslServer->buffers.key->buffer == NULL ||
- session->sslServer->buffers.key->length == 0) {
-
- SetError(RSA_KEY_MISSING_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-#endif
-
- ret = SetupKeys(input, sslBytes, session, error, NULL);
-
- return ret;
-}
-
-#ifdef WOLFSSL_TLS13
-static int ProcessKeyShare(KeyShareInfo* info, const byte* input, int len,
- word16 filter_group)
-{
- int idx = 0;
- while (idx < len) {
- /* clear info (reset dh_key_bits and curve_id) */
- XMEMSET(info, 0, sizeof(KeyShareInfo));
-
- /* Named group and public key */
- if (idx + OPAQUE16_LEN > len) {
- return WOLFSSL_FATAL_ERROR;
- }
- info->named_group = (word16)((input[idx] << 8) | input[idx+1]);
- idx += OPAQUE16_LEN;
- info->key_len = 0;
- info->key = NULL;
- /* If key was provided... (a hello_retry_request will not send a key) */
- if (idx + 2 <= len) {
- info->key_len = (word16)((input[idx] << 8) | input[idx+1]);
- idx += OPAQUE16_LEN;
- if (info->key_len == 0 || info->key_len > len - idx) {
- return WOLFSSL_FATAL_ERROR;
- }
- info->key = &input[idx];
- idx += info->key_len;
- }
-
- switch (info->named_group) {
- #ifndef NO_DH
- #ifdef HAVE_FFDHE_2048
- case WOLFSSL_FFDHE_2048:
- info->dh_key_bits = 2048;
- break;
- #endif
- #ifdef HAVE_FFDHE_3072
- case WOLFSSL_FFDHE_3072:
- info->dh_key_bits = 3072;
- break;
- #endif
- #ifdef HAVE_FFDHE_4096
- case WOLFSSL_FFDHE_4096:
- info->dh_key_bits = 4096;
- break;
- #endif
- #ifdef HAVE_FFDHE_6144
- case WOLFSSL_FFDHE_6144:
- info->dh_key_bits = 6144;
- break;
- #endif
- #ifdef HAVE_FFDHE_8192
- case WOLFSSL_FFDHE_8192:
- info->dh_key_bits = 8192;
- break;
- #endif
- #endif /* !NO_DH */
- #ifdef HAVE_ECC
- #if !defined(NO_ECC256) || defined(HAVE_ALL_CURVES)
- #ifndef NO_ECC_SECP
- case WOLFSSL_ECC_SECP256R1:
- info->curve_id = ECC_SECP256R1;
- break;
- #endif /* !NO_ECC_SECP */
- #ifdef WOLFSSL_SM2
- case WOLFSSL_ECC_SM2P256V1:
- info->curve_id = ECC_SM2P256V1;
- break;
- #endif /* WOLFSSL_SM2 */
- #endif
- #if defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)
- #ifndef NO_ECC_SECP
- case WOLFSSL_ECC_SECP384R1:
- info->curve_id = ECC_SECP384R1;
- break;
- #endif /* !NO_ECC_SECP */
- #endif
- #if defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)
- #ifndef NO_ECC_SECP
- case WOLFSSL_ECC_SECP521R1:
- info->curve_id = ECC_SECP521R1;
- break;
- #endif /* !NO_ECC_SECP */
- #endif
- #endif /* HAVE_ECC */
- #ifdef HAVE_CURVE25519
- case WOLFSSL_ECC_X25519:
- info->curve_id = ECC_X25519;
- break;
- #endif
- #ifdef HAVE_CURVE448
- case WOLFSSL_ECC_X448:
- info->curve_id = ECC_X448;
- break;
- #endif
- default:
- /* do not throw error here, keep iterating the client key share */
- break;
- }
-
- if (filter_group == 0 || filter_group == info->named_group) {
- return 0;
- }
- }
- return NO_PEER_KEY; /* unsupported key type */
-}
-
-static int ProcessServerKeyShare(SnifferSession* session, const byte* input, int len,
- char* error)
-{
- int ret;
-
- if (session->cliKeyShare == NULL || session->cliKeyShareSz == 0) {
- /* session->cliKeyShareSz could not be provided yet if the client_hello
- did not send a key share to force a hello_retry_request */
- return 0;
- }
-
- /* Get server_hello key share (and key) */
- ret = ProcessKeyShare(&session->srvKs, input, len, 0);
- if (ret == 0 && session->srvKs.key_len > 0) {
- /* Get client_hello key share */
- ret = ProcessKeyShare(&session->cliKs, session->cliKeyShare,
- session->cliKeyShareSz, session->srvKs.named_group);
- }
- if (ret != 0) {
- SetError(SERVER_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- return ret;
-}
-#endif /* WOLFSSL_TLS13 */
-
-/* Process Session Ticket */
-static int ProcessSessionTicket(const byte* input, int* sslBytes,
- SnifferSession* session, char* error)
-{
- word16 len;
-
-#ifdef WOLFSSL_TLS13
- WOLFSSL* ssl;
-
- if (session->flags.side == WOLFSSL_SERVER_END)
- ssl = session->sslServer;
- else
- ssl = session->sslClient;
-#endif
-
- /* make sure can read through hint len */
- if (TICKET_HINT_LEN > *sslBytes) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- input += TICKET_HINT_LEN; /* skip over hint len */
- *sslBytes -= TICKET_HINT_LEN;
-
-#ifdef WOLFSSL_TLS13
- /* TLS v1.3 has hint age and nonce */
- if (IsAtLeastTLSv1_3(ssl->version)) {
- /* make sure can read through hint age and nonce len */
- if (TICKET_HINT_AGE_LEN + 1 > *sslBytes) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- input += TICKET_HINT_AGE_LEN; /* skip over hint age */
- *sslBytes -= TICKET_HINT_AGE_LEN;
-
- /* ticket nonce */
- len = input[0];
- if (len > MAX_TICKET_NONCE_STATIC_SZ) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- input += OPAQUE8_LEN;
- *sslBytes -= OPAQUE8_LEN;
- #ifdef HAVE_SESSION_TICKET
- /* store nonce in server for DeriveResumptionPSK */
- session->sslServer->session->ticketNonce.len = len;
- if (len > 0)
- XMEMCPY(session->sslServer->session->ticketNonce.data, input, len);
- #endif
- input += len;
- *sslBytes -= len;
- }
-#endif
-
- /* make sure can read through len */
- if (OPAQUE16_LEN > *sslBytes) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- len = (word16)((input[0] << 8) | input[1]);
- input += OPAQUE16_LEN;
- *sslBytes -= OPAQUE16_LEN;
-
- /* make sure can read through ticket */
- if (len > *sslBytes) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
-#ifdef WOLFSSL_TLS13
- /* TLS v1.3 has hint age and nonce */
- if (IsAtLeastTLSv1_3(ssl->version)) {
- /* Note: Must use server session for sessions */
- #ifdef HAVE_SESSION_TICKET
- WOLFSSL_SESSION* sess;
- if (SetTicket(session->sslServer, input, len) != 0) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* set haveSessionId to use the wolfSession cache */
- session->sslServer->options.haveSessionId = 1;
-
- #ifdef SNIFFER_SINGLE_SESSION_CACHE
- /* Use the wolf Session cache to retain resumption secret */
- if (session->flags.cached == 0) {
- #endif /* SNIFFER_SINGLE_SESSION_CACHE */
- sess = wolfSSL_GetSession(session->sslServer, NULL, 0);
- if (sess == NULL) {
- SetupSession(session->sslServer);
- AddSession(session->sslServer); /* don't re add */
- #ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslResumptionInserts);
- #endif
- }
- #ifdef SNIFFER_SINGLE_SESSION_CACHE
- session->flags.cached = 1;
- }
- #endif /* SNIFFER_SINGLE_SESSION_CACHE */
- #endif /* HAVE_SESSION_TICKET */
- }
- else
-#endif /* WOLFSSL_TLS13 */
- {
- /* capture last part of sessionID as macID (32 bytes) */
- if (len < ID_LEN) {
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- /* store session with macID as sessionID */
- session->sslServer->options.haveSessionId = 1;
- if (session->sslServer->arrays) {
- XMEMCPY(session->sslServer->arrays->sessionID,
- input + len - ID_LEN, ID_LEN);
- session->sslServer->arrays->sessionIDSz = ID_LEN;
- }
- }
-
- return 0;
-}
-
-static int DoResume(SnifferSession* session, char* error)
-{
- int ret = 0;
- WOLFSSL_SESSION* resume;
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- resume = wolfSSL_GetSession(session->sslServer,
- session->sslServer->session->masterSecret, 0);
- if (resume == NULL) {
- /* TLS v1.3 with hello_retry uses session_id even for new session,
- so ignore error here */
- return 0;
- }
- }
- else
-#endif
- {
- #ifdef HAVE_SESSION_TICKET
- /* make sure "useTicket" is not set, otherwise the session will not be
- * properly retrieved */
- session->sslServer->options.useTicket = 0;
- #endif
- resume = wolfSSL_GetSession(session->sslServer,
- session->sslServer->arrays->masterSecret, 0);
- if (resume == NULL) {
- #ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslResumeMisses);
- #endif
- SetError(BAD_SESSION_RESUME_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- /* make sure client has master secret too */
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- XMEMCPY(session->sslClient->session->masterSecret,
- session->sslServer->session->masterSecret, SECRET_LEN);
- }
- else
-#endif
- {
- XMEMCPY(session->sslClient->arrays->masterSecret,
- session->sslServer->arrays->masterSecret, SECRET_LEN);
- }
- session->flags.resuming = 1;
-
- Trace(SERVER_DID_RESUMPTION_STR);
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslResumedConns);
-#endif
- if (SetCipherSpecs(session->sslServer) != 0) {
- SetError(BAD_CIPHER_SPEC_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (SetCipherSpecs(session->sslClient) != 0) {
- SetError(BAD_CIPHER_SPEC_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- return WOLFSSL_FATAL_ERROR;
- }
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- #ifdef HAVE_SESSION_TICKET
- /* Resumption PSK is resumption master secret. */
- session->sslServer->arrays->psk_keySz = session->sslServer->specs.hash_size;
- session->sslClient->arrays->psk_keySz = session->sslClient->specs.hash_size;
- ret = DeriveResumptionPSK(session->sslServer,
- session->sslServer->session->ticketNonce.data,
- session->sslServer->session->ticketNonce.len,
- session->sslServer->arrays->psk_key);
- /* Copy resumption PSK to client */
- XMEMCPY(session->sslClient->arrays->psk_key,
- session->sslServer->arrays->psk_key,
- session->sslServer->arrays->psk_keySz);
- #endif
- /* handshake key setup below and traffic keys done in SetupKeys */
- }
- else
-#endif
- {
- if (IsTLS(session->sslServer)) {
- ret = DeriveTlsKeys(session->sslServer);
- ret += DeriveTlsKeys(session->sslClient);
- }
- else {
-#ifndef NO_OLD_TLS
- ret = DeriveKeys(session->sslServer);
- ret += DeriveKeys(session->sslClient);
-#endif
- }
- ret += SetKeysSide(session->sslServer, ENCRYPT_AND_DECRYPT_SIDE);
- ret += SetKeysSide(session->sslClient, ENCRYPT_AND_DECRYPT_SIDE);
- }
-
- if (ret != 0) {
- SetError(BAD_DERIVE_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- return ret;
-}
-
-/* Process Server Hello */
-static int ProcessServerHello(int msgSz, const byte* input, int* sslBytes,
- SnifferSession* session, char* error)
-{
- int ret = 0;
- ProtocolVersion pv;
- byte b, b0;
- int toRead = VERSION_SZ + RAN_LEN + ENUM_LEN;
- int doResume = 0;
- const byte* inputHello = input;
- int initialBytes = *sslBytes;
-
- (void)msgSz;
-
- /* make sure we didn't miss ClientHello */
- if (session->flags.clientHello == 0 || session->sslClient->arrays == NULL) {
- SetError(MISSED_CLIENT_HELLO_STR, error, session, 0);
- return 0; /* do not throw error, just ignore packet */
- }
-
- /* make sure can read through session len */
- if (toRead > *sslBytes) {
- SetError(SERVER_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- XMEMCPY(&pv, input, VERSION_SZ);
- input += VERSION_SZ;
- *sslBytes -= VERSION_SZ;
-
- session->sslServer->version = pv;
- session->sslClient->version = pv;
- if (pv.minor >= TLSv1_MINOR) {
- session->sslServer->options.tls = 1;
- session->sslClient->options.tls = 1;
- }
-
- XMEMCPY(session->sslServer->arrays->serverRandom, input, RAN_LEN);
- XMEMCPY(session->sslClient->arrays->serverRandom, input, RAN_LEN);
- input += RAN_LEN;
- *sslBytes -= RAN_LEN;
-
- b = *input++;
- *sslBytes -= 1;
-
- /* make sure can read through compression */
- if ( (b + SUITE_LEN + ENUM_LEN) > *sslBytes) {
- SetError(SERVER_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- if (b) {
- #ifdef WOLFSSL_TLS13
- XMEMCPY(session->sslServer->session->sessionID, input, ID_LEN);
- session->sslServer->session->sessionIDSz = ID_LEN;
- #endif
- XMEMCPY(session->sslServer->arrays->sessionID, input, ID_LEN);
- session->sslServer->arrays->sessionIDSz = ID_LEN;
- session->sslServer->options.haveSessionId = 1;
- }
- input += b;
- *sslBytes -= b;
-
- /* cipher suite */
- b0 = *input++; /* first byte, ECC or not */
- session->sslServer->options.cipherSuite0 = b0;
- session->sslClient->options.cipherSuite0 = b0;
- b = *input++;
- session->sslServer->options.cipherSuite = b;
- session->sslClient->options.cipherSuite = b;
- *sslBytes -= SUITE_LEN;
-
-#ifdef WOLFSSL_SNIFFER_STATS
- {
- const CipherSuiteInfo* suites = GetCipherNames();
- int suitesSz = GetCipherNamesSize();
- int match = 0;
-
- while (suitesSz) {
- if (b0 == suites->cipherSuite0 && b == suites->cipherSuite) {
- match = 1;
- break;
- }
- suites++;
- suitesSz--;
- }
- if (!match)
- INC_STAT(SnifferStats.sslCiphersUnsupported);
- }
-#endif /* WOLFSSL_SNIFFER_STATS */
-
- /* compression */
- b = *input++;
- *sslBytes -= ENUM_LEN;
-
- if (b) {
- SetError(BAD_COMPRESSION_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* extensions */
- if ((initialBytes - *sslBytes) < msgSz) {
- word16 len;
-
- /* skip extensions until extended master secret */
- /* make sure can read len */
- if (SUITE_LEN > *sslBytes) {
- SetError(SERVER_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- len = (word16)((input[0] << 8) | input[1]);
- input += SUITE_LEN;
- *sslBytes -= SUITE_LEN;
- /* make sure can read through all extensions */
- if (len > *sslBytes) {
- SetError(SERVER_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- while (len >= EXT_TYPE_SZ + LENGTH_SZ) {
- word16 extType;
- word16 extLen;
-
- extType = (word16)((input[0] << 8) | input[1]);
- input += EXT_TYPE_SZ;
- *sslBytes -= EXT_TYPE_SZ;
-
- extLen = (word16)((input[0] << 8) | input[1]);
- input += LENGTH_SZ;
- *sslBytes -= LENGTH_SZ;
-
- /* make sure can read through individual extension */
- if (extLen > *sslBytes) {
- SetError(SERVER_HELLO_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- #ifdef DEBUG_SNIFFER
- printf("\tserver_hello ext: 0x%02x (len %d)\n", extType, extLen);
- #endif
-
- switch (extType) {
- #ifdef WOLFSSL_TLS13
- case EXT_KEY_SHARE:
- ret = ProcessServerKeyShare(session, input, extLen, error);
- if (ret != 0) {
- SetError(SERVER_HELLO_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- break;
- #endif
- #ifdef HAVE_SESSION_TICKET
- case EXT_PRE_SHARED_KEY:
- /* indicates we want to use resumption */
- session->sslServer->options.resuming = 1;
- session->sslClient->options.resuming = 1;
- #ifdef WOLFSSL_TLS13
- /* default nonce to len = 1, data = 0 */
- session->sslServer->session->ticketNonce.len = 1;
- session->sslServer->session->ticketNonce.data[0] = 0;
- session->sslClient->session->ticketNonce.len = 1;
- session->sslClient->session->ticketNonce.data[0] = 0;
- #endif
- break;
- #endif
- #ifdef HAVE_MAX_FRAGMENT
- case EXT_MAX_FRAGMENT_LENGTH:
- {
- word16 max_fragment = MAX_RECORD_SIZE;
- switch (input[0]) {
- case WOLFSSL_MFL_2_8 : max_fragment = 256; break;
- case WOLFSSL_MFL_2_9 : max_fragment = 512; break;
- case WOLFSSL_MFL_2_10: max_fragment = 1024; break;
- case WOLFSSL_MFL_2_11: max_fragment = 2048; break;
- case WOLFSSL_MFL_2_12: max_fragment = 4096; break;
- case WOLFSSL_MFL_2_13: max_fragment = 8192; break;
- default: break;
- }
- session->sslServer->max_fragment = max_fragment;
- session->sslClient->max_fragment = max_fragment;
- break;
- }
- #endif
- case EXT_SUPPORTED_VERSIONS:
- session->sslServer->version.major = input[0];
- session->sslServer->version.minor = input[1];
- session->sslClient->version.major = input[0];
- session->sslClient->version.minor = input[1];
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- /* The server side handshake encryption is on for future packets */
- session->flags.serverCipherOn = 1;
- }
- break;
- case EXT_MASTER_SECRET:
- #ifdef HAVE_EXTENDED_MASTER
- session->flags.expectEms = 1;
- #endif
- break;
- case EXT_RENEGOTIATION_INFO:
- session->flags.secRenegEn = 1;
- break;
- } /* switch (extType) */
-
- input += extLen;
- *sslBytes -= extLen;
- len -= extLen + EXT_TYPE_SZ + LENGTH_SZ;
- }
- }
-
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
-#ifndef WOLFSSL_TLS13
- SetError(UNSUPPORTED_TLS_VER_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- return WOLFSSL_FATAL_ERROR;
-#endif
- }
- else {
-#ifdef WOLFSSL_NO_TLS12
- SetError(UNSUPPORTED_TLS_VER_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- return WOLFSSL_FATAL_ERROR;
-#endif
- }
-
-#ifdef HAVE_EXTENDED_MASTER
- if (!session->flags.expectEms) {
- XFREE(session->hash, NULL, DYNAMIC_TYPE_HASHES);
- session->hash = NULL;
- }
-#endif
-
- if (session->sslServer->options.haveSessionId) {
- if (session->sslServer->arrays->sessionIDSz == ID_LEN &&
- session->sslClient->arrays->sessionIDSz == ID_LEN &&
- XMEMCMP(session->sslServer->arrays->sessionID,
- session->sslClient->arrays->sessionID, ID_LEN) == 0) {
- doResume = 1;
- }
- }
- else if (session->sslClient->options.haveSessionId == 0 &&
- session->sslServer->options.haveSessionId == 0 &&
- session->ticketID) {
- doResume = 1;
- }
-
- if (session->ticketID && doResume) {
- /* use ticketID to retrieve from session, prefer over sessionID */
- XMEMCPY(session->sslServer->arrays->sessionID,session->ticketID,ID_LEN);
- session->sslServer->arrays->sessionIDSz = ID_LEN;
- session->sslServer->options.haveSessionId = 1; /* may not have
- actual sessionID */
- }
-
-#ifdef WOLFSSL_TLS13
- /* Is TLS v1.3 hello_retry_request? */
- if (IsAtLeastTLSv1_3(session->sslServer->version) && session->srvKs.key_len == 0) {
- Trace(GOT_HELLO_RETRY_REQ_STR);
-
- /* do not compute keys yet */
- session->flags.serverCipherOn = 0;
-
- /* make sure the mac and digest size are set */
- SetCipherSpecs(session->sslServer);
- SetCipherSpecs(session->sslClient);
-
- /* reset hashes */
- RestartHandshakeHash(session->sslServer);
- RestartHandshakeHash(session->sslClient);
-
- doResume = 0;
- }
-#endif
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (session->sslServer->error != WC_NO_ERR_TRACE(WC_PENDING_E) &&
- session->pendSeq == 0)
-#endif
- {
- /* hash server_hello */
- HashRaw(session->sslServer, inputHello - HANDSHAKE_HEADER_SZ,
- initialBytes + HANDSHAKE_HEADER_SZ);
- HashRaw(session->sslClient, inputHello - HANDSHAKE_HEADER_SZ,
- initialBytes + HANDSHAKE_HEADER_SZ);
- }
-
- if (doResume) {
- ret = DoResume(session, error);
- if (ret != 0) {
- return ret;
- }
- }
- else {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslStandardConns);
-#endif
- }
-
-#ifdef SHOW_SECRETS
- printf("cipher suite = 0x%02x\n", session->sslServer->options.cipherSuite);
- PrintSecret("server random", session->sslServer->arrays->serverRandom, RAN_LEN);
-#endif
-
-#ifdef WOLFSSL_TLS13
- /* Setup handshake keys */
- if (IsAtLeastTLSv1_3(session->sslServer->version) && session->srvKs.key_len > 0) {
- ret = SetupKeys(session->cliKs.key, &session->cliKs.key_len,
- session, error, &session->cliKs);
- if (ret != 0) {
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- return ret;
- }
- #endif
- SetError(KEY_MISMATCH_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- return ret;
- }
-
- if (session->flags.side == WOLFSSL_SERVER_END)
- session->flags.serverCipherOn = 1;
- else
- session->flags.clientCipherOn = 1;
- }
-#endif
-
- return 0;
-}
-
-#ifdef HAVE_SNI
-/* Function return value must be 0 for success */
-static int LoadNamedKey(SnifferSession* session, const byte* name, word16 nameSz)
-{
- int ret = 0;
- WOLFSSL* ssl = session->sslServer;
- NamedKey* namedKey;
-
- wc_LockMutex(&session->context->namedKeysMutex);
- namedKey = session->context->namedKeys;
- while (namedKey != NULL) {
- if (nameSz == namedKey->nameSz &&
- XSTRNCMP((char*)name, namedKey->name, nameSz) == 0) {
- #ifdef WOLFSSL_STATIC_EPHEMERAL
- if (namedKey->isEphemeralKey) {
- /* auto detect key type with WC_PK_TYPE_NONE */
- ret = wolfSSL_set_ephemeral_key(ssl,
- WC_PK_TYPE_NONE, (const char*)namedKey->key,
- namedKey->keySz, WOLFSSL_FILETYPE_ASN1);
- }
- else
- #endif
- {
- ret = wolfSSL_use_PrivateKey_buffer(ssl,
- namedKey->key, namedKey->keySz,
- WOLFSSL_FILETYPE_ASN1);
- /* translate return code */
- ret = (ret == WOLFSSL_SUCCESS) ? 0 : -1;
- }
- if (ret == 0) {
- session->sni = namedKey->name;
- }
- break;
- }
- namedKey = namedKey->next;
- }
- wc_UnLockMutex(&session->context->namedKeysMutex);
- return ret;
-}
-#endif
-
-/* Process normal Client Hello */
-static int ProcessClientHello(const byte* input, int* sslBytes,
- SnifferSession* session, char* error)
-{
- int ret = 0;
- byte bLen;
- word16 len;
- int toRead = VERSION_SZ + RAN_LEN + ENUM_LEN;
- const byte* inputHello = input;
- int inputHelloSz = *sslBytes;
- WOLFSSL* ssl = session->sslServer;
- int didHash = 0;
-
- session->flags.clientHello = 1; /* don't process again */
-
- /* make sure can read up to session len */
- if (toRead > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* skip, get negotiated one from server hello */
- input += VERSION_SZ;
- *sslBytes -= VERSION_SZ;
-
- /* for secure renegotiation server arrays can be NULL */
- if (session->sslServer->arrays)
- XMEMCPY(session->sslServer->arrays->clientRandom, input, RAN_LEN);
- if (session->sslClient->arrays)
- XMEMCPY(session->sslClient->arrays->clientRandom, input, RAN_LEN);
-
- input += RAN_LEN;
- *sslBytes -= RAN_LEN;
-
- /* store session in case trying to resume */
- bLen = *input++;
- *sslBytes -= ENUM_LEN;
- if (bLen) {
- if (ID_LEN > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- Trace(CLIENT_RESUME_TRY_STR);
-#ifdef WOLFSSL_TLS13
- XMEMCPY(session->sslClient->session->sessionID, input, ID_LEN);
- session->sslClient->session->sessionIDSz = ID_LEN;
-#endif
- if (session->sslClient->arrays) {
- XMEMCPY(session->sslClient->arrays->sessionID, input, ID_LEN);
- session->sslClient->arrays->sessionIDSz = ID_LEN;
- }
- session->sslClient->options.haveSessionId = 1;
- }
-
-#ifdef SHOW_SECRETS
- if (ssl->arrays)
- PrintSecret("client random", ssl->arrays->clientRandom, RAN_LEN);
-#endif
-
- input += bLen;
- *sslBytes -= bLen;
-
- /* skip cipher suites */
- /* make sure can read len */
- if (SUITE_LEN > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- len = (word16)((input[0] << 8) | input[1]);
- input += SUITE_LEN;
- *sslBytes -= SUITE_LEN;
- /* make sure can read suites + comp len */
- if (len + ENUM_LEN > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- input += len;
- *sslBytes -= len;
-
- /* skip compression */
- bLen = *input++;
- *sslBytes -= ENUM_LEN;
- /* make sure can read len */
- if (bLen > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- input += bLen;
- *sslBytes -= bLen;
-
- if (*sslBytes == 0) {
- /* no extensions */
- return 0;
- }
-
- /* skip extensions until session ticket */
- /* make sure can read len */
- if (SUITE_LEN > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- len = (word16)((input[0] << 8) | input[1]);
- input += SUITE_LEN;
- *sslBytes -= SUITE_LEN;
- /* make sure can read through all extensions */
- if (len > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- while (len >= EXT_TYPE_SZ + LENGTH_SZ) {
- word16 extType;
- word16 extLen;
-
- extType = (word16)((input[0] << 8) | input[1]);
- input += EXT_TYPE_SZ;
- *sslBytes -= EXT_TYPE_SZ;
-
- extLen = (word16)((input[0] << 8) | input[1]);
- input += LENGTH_SZ;
- *sslBytes -= LENGTH_SZ;
-
- /* make sure can read through individual extension */
- if (extLen > *sslBytes) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- #ifdef DEBUG_SNIFFER
- printf("\tclient_hello ext: 0x%02x (len %d)\n", extType, extLen);
- #endif
-
- switch (extType) {
- #ifdef HAVE_SNI
- case EXT_SERVER_NAME:
- {
- word16 listLen = 0, offset = 0;
-
- ato16(input + offset, &listLen);
- offset += OPAQUE16_LEN;
-
- if (extLen < offset + listLen)
- return BUFFER_ERROR;
-
- while (listLen > ENUM_LEN + OPAQUE16_LEN) {
- byte sniType = input[offset++];
- word16 sniLen;
-
- ato16(input + offset, &sniLen);
- offset += OPAQUE16_LEN;
-
- if (extLen < offset + sniLen)
- return BUFFER_ERROR;
-
- if (sniType == WOLFSSL_SNI_HOST_NAME) {
- ret = LoadNamedKey(session, input + offset, sniLen);
- if (ret < 0) {
- /* don't treat this as fatal error */
- SetError(CLIENT_HELLO_LATE_KEY_STR, error, session, 0);
- break;
- }
- }
- offset += sniLen;
- listLen -= min(ENUM_LEN + OPAQUE16_LEN + sniLen, listLen);
- }
- break;
- }
- #endif
- #ifdef WOLFSSL_TLS13
- case EXT_KEY_SHARE:
- {
- word16 ksLen = (word16)((input[0] << 8) | input[1]);
- if (ksLen + OPAQUE16_LEN > extLen) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- /* cache key share data till server_hello */
- session->cliKeyShareSz = ksLen;
- if (ksLen > 0) {
- session->cliKeyShare = (byte*)XMALLOC(ksLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (session->cliKeyShare == NULL) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- break;
- }
- XMEMCPY(session->cliKeyShare, &input[2], ksLen);
- }
- break;
- }
- #ifdef HAVE_SESSION_TICKET
- case EXT_PRE_SHARED_KEY:
- {
- word16 idsLen, idLen, bindersLen, idx = 0;
- word32 ticketAge;
- const byte *identity, *binders;
-
- idsLen = (word16)((input[idx] << 8) | input[idx+1]);
- if (idsLen + OPAQUE16_LEN + idx > extLen) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- idx += OPAQUE16_LEN;
-
- /* PSK identity */
- idLen = (word16)((input[idx] << 8) | input[idx+1]);
- if (idLen + OPAQUE16_LEN + idx > extLen) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- idx += OPAQUE16_LEN;
- identity = &input[idx];
- idx += idLen;
-
- /* Obfuscated Ticket Age 32-bits */
- ticketAge = (word32)((input[idx] << 24) | (input[idx+1] << 16) |
- (input[idx+2] << 8) | input[idx+3]);
- (void)ticketAge; /* not used */
- idx += OPAQUE32_LEN;
-
- /* binders - all binders */
- bindersLen = (word16)((input[idx] << 8) | input[idx+1]);
- if (bindersLen + OPAQUE16_LEN + idx > extLen) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- idx += OPAQUE16_LEN;
- binders = &input[idx];
- bindersLen += OPAQUE16_LEN; /* includes 2 bytes for total len */
- (void)binders; /* not used */
-
- /* Hash data up to binders for deriving binders in PSK extension. */
- HashRaw(session->sslServer, inputHello - HANDSHAKE_HEADER_SZ,
- inputHelloSz - bindersLen + HANDSHAKE_HEADER_SZ);
- HashRaw(session->sslClient, inputHello - HANDSHAKE_HEADER_SZ,
- inputHelloSz - bindersLen + HANDSHAKE_HEADER_SZ);
-
- /* call to decrypt session ticket */
- if (DoClientTicket(ssl, identity, idLen) != WOLFSSL_TICKET_RET_OK) {
- /* we aren't decrypting the resumption, since we know the master secret */
- /* ignore errors */
- }
- ssl->options.resuming = 1;
-
- /* Hash the rest of the ClientHello. */
- HashRaw(session->sslServer, inputHello + inputHelloSz - bindersLen, bindersLen);
- HashRaw(session->sslClient, inputHello + inputHelloSz - bindersLen, bindersLen);
- didHash = 1;
- break;
- }
- #endif /* HAVE_SESSION_TICKET */
- #endif /* WOLFSSL_TLS13 */
- case EXT_SUPPORTED_VERSIONS:
- break;
- case EXT_TICKET_ID:
- /* make sure can read through ticket if there is a non blank one */
- if (extLen && extLen < ID_LEN) {
- SetError(CLIENT_HELLO_INPUT_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- if (extLen) {
- if (session->ticketID == NULL) {
- session->ticketID = (byte*)XMALLOC(ID_LEN,
- NULL, DYNAMIC_TYPE_SNIFFER_TICKET_ID);
- if (session->ticketID == 0) {
- SetError(MEMORY_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- #ifdef HAVE_SESSION_TICKET
- /* do not set "ssl->options.useTicket", since the sniffer uses
- * the cache differently for retaining the master secret only */
- #endif
- XMEMCPY(session->ticketID, input + extLen - ID_LEN, ID_LEN);
- }
- break;
- }
-
- input += extLen;
- *sslBytes -= extLen;
- len -= extLen + EXT_TYPE_SZ + LENGTH_SZ;
- }
-
- if (!didHash) {
- HashRaw(session->sslServer, inputHello - HANDSHAKE_HEADER_SZ,
- inputHelloSz + HANDSHAKE_HEADER_SZ);
- HashRaw(session->sslClient, inputHello - HANDSHAKE_HEADER_SZ,
- inputHelloSz + HANDSHAKE_HEADER_SZ);
- }
-
- (void)ssl;
-
- return ret;
-}
-
-
-#ifdef WOLFSSL_SNIFFER_WATCH
-
-static int KeyWatchCall(SnifferSession* session, const byte* data, int dataSz,
- char* error)
-{
- int ret;
- wc_Sha256 sha;
- byte digest[WC_SHA256_DIGEST_SIZE];
-
- if (WatchCb == NULL) {
- SetError(WATCH_CB_MISSING_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ret = wc_InitSha256(&sha);
- if (ret == 0)
- ret = wc_Sha256Update(&sha, data, dataSz);
- if (ret == 0)
- ret = wc_Sha256Final(&sha, digest);
- if (ret != 0) {
- SetError(WATCH_HASH_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ret = WatchCb((void*)session, digest, sizeof(digest),
- data, dataSz, WatchCbCtx, error);
- if (ret != 0) {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslKeysUnmatched);
-#endif
- SetError(WATCH_FAIL_STR, error, session, FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
- else {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslKeyMatches);
-#endif
- }
- return ret;
-}
-
-/* Process Certificate */
-static int ProcessCertificate(const byte* input, int* sslBytes,
- SnifferSession* session, char* error)
-{
- word32 certChainSz;
- word32 certSz;
-
- /* If the receiver is the server, this is the client certificate message,
- * and it should be ignored at this point. */
- if (session->flags.side == WOLFSSL_SERVER_END)
- return 0;
-
- if (*sslBytes < CERT_HEADER_SZ) {
- SetError(BAD_CERT_MSG_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(session->sslServer->version)) {
- /* skip 1 byte (Request context len) */
- input += OPAQUE8_LEN;
- *sslBytes -= OPAQUE8_LEN;
- }
-#endif
-
- ato24(input, &certChainSz);
- *sslBytes -= CERT_HEADER_SZ;
- input += CERT_HEADER_SZ;
-
- if (*sslBytes < (int)certChainSz) {
- SetError(BAD_CERT_MSG_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ato24(input, &certSz);
- input += OPAQUE24_LEN;
- if (*sslBytes < (int)certSz) {
- SetError(BAD_CERT_MSG_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- *sslBytes -= certChainSz;
-
- return KeyWatchCall(session, input, certSz, error);
-}
-
-#endif /* WOLFSSL_SNIFFER_WATCH */
-
-
-/* Process Finished */
-static int ProcessFinished(const byte* input, int size, int* sslBytes,
- SnifferSession* session, char* error)
-{
- WOLFSSL* ssl;
- word32 inOutIdx = 0;
- int ret;
-
- if (session->flags.side == WOLFSSL_SERVER_END)
- ssl = session->sslServer;
- else
- ssl = session->sslClient;
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(ssl->version)) {
- ret = DoTls13Finished(ssl, input, &inOutIdx, (word32)size,
- (word32)*sslBytes, SNIFF);
-
- ssl->options.handShakeState = HANDSHAKE_DONE;
- ssl->options.handShakeDone = 1;
- }
- else
-#endif
- {
- ret = DoFinished(ssl, input, &inOutIdx, (word32)size,
- (word32)*sslBytes, SNIFF);
- }
- *sslBytes -= (int)inOutIdx;
-
- if (ret < 0) {
- SetError(BAD_FINISHED_MSG, error, session, FATAL_ERROR_STATE);
- return ret;
- }
-
- if (ret == 0
- #ifdef SNIFFER_SINGLE_SESSION_CACHE
- && session->flags.cached == 0
- #endif
- ) {
- if (session->sslServer->options.haveSessionId) {
- #ifndef NO_SESSION_CACHE
- WOLFSSL_SESSION* sess = wolfSSL_GetSession(session->sslServer, NULL, 0);
- if (sess == NULL) {
- SetupSession(session->sslServer);
- AddSession(session->sslServer); /* don't re add */
- #ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslResumptionInserts);
- #endif
- }
- #ifdef SNIFFER_SINGLE_SESSION_CACHE
- session->flags.cached = 1;
- #endif
- #endif
- }
- }
-
-#ifdef WOLFSSL_TLS13
- /* Derive TLS v1.3 traffic keys */
- if (IsAtLeastTLSv1_3(ssl->version)) {
- if (!session->flags.gotFinished) {
- /* When either side gets "finished" derive master secret and keys */
- ret = DeriveMasterSecret(session->sslServer);
- ret += DeriveMasterSecret(session->sslClient);
- #ifdef WOLFSSL_EARLY_DATA
- ret += DeriveTls13Keys(session->sslServer, traffic_key, ENCRYPT_AND_DECRYPT_SIDE, ssl->earlyData == no_early_data);
- ret += DeriveTls13Keys(session->sslClient, traffic_key, ENCRYPT_AND_DECRYPT_SIDE, ssl->earlyData == no_early_data);
- #else
- ret += DeriveTls13Keys(session->sslServer, traffic_key, ENCRYPT_AND_DECRYPT_SIDE, 1);
- ret += DeriveTls13Keys(session->sslClient, traffic_key, ENCRYPT_AND_DECRYPT_SIDE, 1);
- #endif
-
- if (ret != 0) {
- SetError(BAD_FINISHED_MSG, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- session->flags.gotFinished = 1;
- #ifdef SHOW_SECRETS
- ShowTlsSecrets(session);
- #endif
- }
-
- if (session->flags.side == WOLFSSL_SERVER_END) {
- /* finished from client to server */
- ret = SetKeysSide(session->sslServer, DECRYPT_SIDE_ONLY);
- ret += SetKeysSide(session->sslClient, ENCRYPT_SIDE_ONLY);
-
- #ifdef HAVE_SESSION_TICKET
- /* derive resumption secret for next session - on finished (from client) */
- ret += DeriveResumptionSecret(session->sslClient,
- session->sslClient->session->masterSecret);
-
- /* copy resumption secret to server */
- XMEMCPY(session->sslServer->session->masterSecret,
- session->sslClient->session->masterSecret, SECRET_LEN);
- #ifdef SHOW_SECRETS
- PrintSecret("resumption secret",
- session->sslClient->session->masterSecret, SECRET_LEN);
- #endif
- #endif
- }
- else {
- /* finished from server to client */
- ret = SetKeysSide(session->sslServer, ENCRYPT_SIDE_ONLY);
- ret += SetKeysSide(session->sslClient, DECRYPT_SIDE_ONLY);
- }
-
- if (ret != 0) {
- SetError(BAD_FINISHED_MSG, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-#endif
-
- /* Do not free handshake resources yet if secure renegotiation */
- if (session->flags.secRenegEn == 0) {
- /* If receiving a finished message from one side, free the resources
- * from the other side's tracker. */
- if (session->flags.side == WOLFSSL_SERVER_END)
- FreeHandshakeResources(session->sslClient);
- else
- FreeHandshakeResources(session->sslServer);
- }
-
- return ret;
-}
-
-
-/* Process HandShake input */
-static int DoHandShake(const byte* input, int* sslBytes,
- SnifferSession* session, char* error, word16 rhSize)
-{
- byte type;
- int size;
- int ret = 0;
- WOLFSSL* ssl;
- int startBytes;
-
- (void)rhSize;
-
-#ifdef HAVE_MAX_FRAGMENT
- if (session->tlsFragBuf) {
- XMEMCPY(session->tlsFragBuf + session->tlsFragOffset, input, rhSize);
- session->tlsFragOffset += rhSize;
- *sslBytes -= rhSize;
-
- if (session->tlsFragOffset < session->tlsFragSize) {
- return 0;
- }
-
- /* reassembled complete fragment */
- input = session->tlsFragBuf;
- *sslBytes = session->tlsFragSize;
- rhSize = session->tlsFragSize;
- }
-#endif
-
- if (*sslBytes < HANDSHAKE_HEADER_SZ) {
- SetError(HANDSHAKE_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- type = input[0];
- size = (input[1] << 16) | (input[2] << 8) | input[3];
-
- input += HANDSHAKE_HEADER_SZ;
- *sslBytes -= HANDSHAKE_HEADER_SZ;
- startBytes = *sslBytes;
-
- if (*sslBytes < size) {
- Trace(SPLIT_HANDSHAKE_MSG_STR);
- *sslBytes = 0;
- return ret;
- }
-
- if (session->flags.side == WOLFSSL_SERVER_END)
- ssl = session->sslServer;
- else
- ssl = session->sslClient;
-
-#ifdef HAVE_MAX_FRAGMENT
- if (rhSize < size) {
- /* partial fragment, let's reassemble */
- if (session->tlsFragBuf == NULL) {
- session->tlsFragOffset = 0;
- session->tlsFragSize = size + HANDSHAKE_HEADER_SZ;
- session->tlsFragBuf = (byte*)XMALLOC(session->tlsFragSize, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (session->tlsFragBuf == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- return 0;
- }
-
- /* include the handshake header */
- input -= HANDSHAKE_HEADER_SZ;
- *sslBytes += HANDSHAKE_HEADER_SZ;
- }
-
- XMEMCPY(session->tlsFragBuf + session->tlsFragOffset, input, rhSize);
- session->tlsFragOffset += rhSize;
- *sslBytes -= rhSize;
- return 0;
- }
-#endif
-
-#ifdef WOLFSSL_TLS13
- if (type != client_hello && type != server_hello
- #ifdef WOLFSSL_ASYNC_CRYPT
- && session->sslServer->error != WC_NO_ERR_TRACE(WC_PENDING_E)
- && session->pendSeq == 0
- #endif
- ) {
- /* For resumption the hash is before / after client_hello PSK binder */
- /* hash the packet including header */
- /* TLS v1.3 requires the hash for the handshake and transfer key derivation */
- /* we hash even for non TLS v1.3, since we don't know if its actually
- TLS v1.3 till later at EXT_SUPPORTED_VERSIONS in server_hello */
- /* hello retry request restarts hash prior to server_hello hash calc */
- HashRaw(session->sslServer, input - HANDSHAKE_HEADER_SZ, size + HANDSHAKE_HEADER_SZ);
- HashRaw(session->sslClient, input - HANDSHAKE_HEADER_SZ, size + HANDSHAKE_HEADER_SZ);
- }
-#endif
-#ifdef HAVE_EXTENDED_MASTER
- if (session->hash) {
- if (HashUpdate(session->hash, input, size) != 0) {
- SetError(EXTENDED_MASTER_HASH_STR, error,
- session, FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- goto exit;
- }
- }
-#endif
-
- switch (type) {
- case hello_verify_request:
- Trace(GOT_HELLO_VERIFY_STR);
- break;
- case hello_request:
- Trace(GOT_HELLO_REQUEST_STR);
- break;
- case session_ticket:
- Trace(GOT_SESSION_TICKET_STR);
- ret = ProcessSessionTicket(input, sslBytes, session, error);
- break;
- case server_hello:
- Trace(GOT_SERVER_HELLO_STR);
- ret = ProcessServerHello(size, input, sslBytes, session, error);
- break;
- case certificate_request:
- Trace(GOT_CERT_REQ_STR);
- break;
- case server_key_exchange:
- Trace(GOT_SERVER_KEY_EX_STR);
-
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- if (!session->context->useKeyLogFile)
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
- {
- /* can't know temp key passively */
- SetError(BAD_CIPHER_SPEC_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- ret = WOLFSSL_FATAL_ERROR;
-
-#if defined(WOLFSSL_SNIFFER_STATS)
- INC_STAT(SnifferStats.sslEphemeralMisses);
-#endif /* WOLFSSL_SNIFFER_STATS */
- }
- break;
- case encrypted_extensions:
- Trace(GOT_ENC_EXT_STR);
- ssl->msgsReceived.got_encrypted_extensions = 1;
- break;
- case certificate:
- Trace(GOT_CERT_STR);
- if (session->flags.side == WOLFSSL_SERVER_END) {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslClientAuthConns);
-#endif
- }
-#ifdef WOLFSSL_SNIFFER_WATCH
- ret = ProcessCertificate(input, sslBytes, session, error);
-#endif
- break;
- case server_hello_done:
- Trace(GOT_SERVER_HELLO_DONE_STR);
- break;
- case finished:
- Trace(GOT_FINISHED_STR);
- ret = ProcessFinished(input, size, sslBytes, session, error);
- break;
- case client_hello:
- Trace(GOT_CLIENT_HELLO_STR);
- ret = ProcessClientHello(input, sslBytes, session, error);
- break;
- case client_key_exchange:
- Trace(GOT_CLIENT_KEY_EX_STR);
-#ifdef HAVE_EXTENDED_MASTER
- if (session->flags.expectEms) {
- /* on async reentry the session->hash is already copied
- * and free'd */
- if (session->hash != NULL) {
- if (HashCopy(session->sslServer->hsHashes,
- session->hash) == 0 &&
- HashCopy(session->sslClient->hsHashes,
- session->hash) == 0) {
-
- session->sslServer->options.haveEMS = 1;
- session->sslClient->options.haveEMS = 1;
- }
- else {
- SetError(EXTENDED_MASTER_HASH_STR, error,
- session, FATAL_ERROR_STATE);
- ret = WOLFSSL_FATAL_ERROR;
- }
- XMEMSET(session->hash, 0, sizeof(HsHashes));
- XFREE(session->hash, NULL, DYNAMIC_TYPE_HASHES);
- session->hash = NULL;
- }
- }
- else {
- session->sslServer->options.haveEMS = 0;
- session->sslClient->options.haveEMS = 0;
- }
-#endif
- if (ret == 0) {
- ret = ProcessClientKeyExchange(input, sslBytes, session, error);
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E))
- return ret;
- #endif
- if (ret != 0) {
- SetError(KEY_MISMATCH_STR, error, session, FATAL_ERROR_STATE);
- session->verboseErr = 1;
- }
- }
- break;
- case certificate_verify:
- Trace(GOT_CERT_VER_STR);
- break;
- case certificate_status:
- Trace(GOT_CERT_STATUS_STR);
- break;
- default:
- SetError(GOT_UNKNOWN_HANDSHAKE_STR, error, session, 0);
- ret = WOLFSSL_FATAL_ERROR;
- break;
- }
-
-#ifdef HAVE_EXTENDED_MASTER
-exit:
-#endif
-#ifdef HAVE_MAX_FRAGMENT
- XFREE(session->tlsFragBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- session->tlsFragBuf = NULL;
-#endif
-
- *sslBytes = startBytes - size; /* actual bytes of full process */
-
- return ret;
-}
-
-/* For ciphers that use AEAD use the encrypt routine to
- * bypass the auth tag checking */
-static int DecryptDo(WOLFSSL* ssl, byte* plain, const byte* input,
- word16 sz)
-{
- int ret = 0;
-
- (void)plain;
- (void)input;
- (void)sz;
-
- switch (ssl->specs.bulk_cipher_algorithm)
- {
- #ifndef NO_RC4
- case wolfssl_rc4:
- wc_Arc4Process(ssl->decrypt.arc4, plain, input, sz);
- break;
- #endif
-
- #ifndef NO_DES3
- case wolfssl_triple_des:
- #ifdef WOLFSSL_ASYNC_CRYPT
- /* initialize event */
- ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.des3->asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- if (ret != 0)
- break;
- #endif
-
- ret = wc_Des3_CbcDecrypt(ssl->decrypt.des3, plain, input, sz);
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.des3->asyncDev);
- }
- #endif
- break;
- #endif
-
- #if !defined(NO_AES) && defined(HAVE_AES_CBC)
- case wolfssl_aes:
- #ifdef WOLFSSL_ASYNC_CRYPT
- /* initialize event */
- ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.aes->asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- if (ret != 0)
- break;
- #endif
- ret = wc_AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.aes->asyncDev);
- }
- #endif
- break;
- #endif
-
- #if defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
- case wolfssl_aes_gcm:
- case wolfssl_aes_ccm: /* GCM AEAD macros use same size as CCM */
- {
- /* For ciphers that use AEAD use the encrypt routine to
- * bypass the auth tag checking */
- wc_AesAuthEncryptFunc aes_auth_fn;
-
- #ifdef WOLFSSL_ASYNC_CRYPT
- /* initialize event */
- ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.aes->asyncDev,
- WC_ASYNC_FLAG_CALL_AGAIN);
- if (ret != 0)
- break;
- #endif
-
- #if defined(HAVE_AESGCM) && defined(HAVE_AESCCM)
- aes_auth_fn = (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm)
- ? wc_AesGcmEncrypt : wc_AesCcmEncrypt;
- #elif defined(HAVE_AESGCM)
- aes_auth_fn = wc_AesGcmEncrypt;
- #else
- aes_auth_fn = wc_AesCcmEncrypt;
- #endif
-
- XMEMSET(ssl->decrypt.additional, 0, AEAD_AUTH_DATA_SZ);
-
- XMEMCPY(ssl->decrypt.nonce, ssl->keys.aead_dec_imp_IV, AESGCM_IMP_IV_SZ);
- XMEMCPY(ssl->decrypt.nonce + AESGCM_IMP_IV_SZ, input, AESGCM_EXP_IV_SZ);
-
- if ((ret = aes_auth_fn(ssl->decrypt.aes,
- plain,
- input + AESGCM_EXP_IV_SZ,
- sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
- ssl->decrypt.nonce, AESGCM_NONCE_SZ,
- ssl->decrypt.additional, AEAD_AUTH_DATA_SZ,
- NULL, 0)) < 0) {
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.aes->asyncDev);
- }
- #endif
- }
- }
- break;
- #endif /* HAVE_AESGCM || HAVE_AESCCM */
-
- #ifdef HAVE_ARIA
- case wolfssl_aria_gcm:
- ret = wc_AriaDecrypt(ssl->decrypt.aria,
- plain,
- (byte *)input + AESGCM_EXP_IV_SZ,
- sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
- ssl->decrypt.nonce, AESGCM_NONCE_SZ,
- ssl->decrypt.additional, ssl->specs.aead_mac_size,
- NULL, 0);
- break;
- #endif
-
- #ifdef HAVE_CAMELLIA
- case wolfssl_camellia:
- ret = wc_CamelliaCbcDecrypt(ssl->decrypt.cam, plain, input, sz);
- break;
- #endif
-
- #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && \
- !defined(NO_CHAPOL_AEAD)
- case wolfssl_chacha:
- ret = ChachaAEADDecrypt(ssl, plain, input, sz);
- break;
- #endif
-
- #ifdef HAVE_NULL_CIPHER
- case wolfssl_cipher_null:
- if (input != plain) {
- XMEMMOVE(plain, input, sz);
- }
- break;
- #endif
-
- default:
- WOLFSSL_MSG("wolfSSL Decrypt programming error");
- ret = DECRYPT_ERROR;
- }
-
- return ret;
-}
-
-static int DecryptTls(WOLFSSL* ssl, byte* plain, const byte* input,
- word16 sz)
-{
- int ret = 0;
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (ssl->decrypt.state != CIPHER_STATE_BEGIN) {
- ret = wolfSSL_AsyncPop(ssl, &ssl->decrypt.state);
- if (ret != WC_NO_ERR_TRACE(WC_NO_PENDING_E)) {
- /* check for still pending */
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E))
- return ret;
-
- ssl->error = 0; /* clear async */
-
- /* let failures through so CIPHER_STATE_END logic is run */
- }
- }
- else
-#endif
- {
- /* Reset state */
- ret = 0;
- ssl->decrypt.state = CIPHER_STATE_BEGIN;
- }
-
- switch (ssl->decrypt.state) {
- case CIPHER_STATE_BEGIN:
- {
- if (ssl->decrypt.setup == 0) {
- WOLFSSL_MSG("Decrypt ciphers not setup");
- return DECRYPT_ERROR;
- }
-
- #if defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
- /* make sure AES GCM/CCM memory is allocated */
- /* free for these happens in FreeCiphers */
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
- ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) {
- /* make sure auth iv and auth are allocated */
- if (ssl->decrypt.additional == NULL)
- ssl->decrypt.additional = (byte*)XMALLOC(AEAD_AUTH_DATA_SZ,
- ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
- if (ssl->decrypt.nonce == NULL)
- ssl->decrypt.nonce = (byte*)XMALLOC(AESGCM_NONCE_SZ,
- ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
- if (ssl->decrypt.additional == NULL ||
- ssl->decrypt.nonce == NULL) {
- return MEMORY_E;
- }
- }
- #endif /* HAVE_AESGCM || HAVE_AESCCM */
-
- /* Advance state and proceed */
- ssl->decrypt.state = CIPHER_STATE_DO;
- }
- FALL_THROUGH;
- case CIPHER_STATE_DO:
- {
- ret = DecryptDo(ssl, plain, input, sz);
-
- /* Advance state */
- ssl->decrypt.state = CIPHER_STATE_END;
-
- #ifdef WOLFSSL_ASYNC_CRYPT
- /* If pending, return now */
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- return ret;
- }
- #endif
- }
- FALL_THROUGH;
- case CIPHER_STATE_END:
- {
- #if defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
- /* make sure AES GCM/CCM nonce is cleared */
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
- ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) {
- if (ssl->decrypt.nonce)
- ForceZero(ssl->decrypt.nonce, AESGCM_NONCE_SZ);
-
- if (ret < 0)
- ret = VERIFY_MAC_ERROR;
- }
- #endif /* HAVE_AESGCM || HAVE_AESCCM */
- break;
- }
-
- default:
- break;
- }
-
- /* Reset state */
- ssl->decrypt.state = CIPHER_STATE_BEGIN;
-
- return ret;
-}
-
-
-/* Decrypt input message into output, adjust output steam if needed */
-static const byte* DecryptMessage(WOLFSSL* ssl, const byte* input, word32 sz,
- byte* output, int* error, int* advance, RecordLayerHeader* rh)
-{
- int ivExtra = 0;
- int ret;
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(ssl->version)) {
- ret = DecryptTls13(ssl, output, input, sz, (byte*)rh, RECORD_HEADER_SZ);
- }
- else
-#endif
- {
- XMEMCPY(&ssl->curRL, rh, RECORD_HEADER_SZ);
- ret = DecryptTls(ssl, output, input, sz);
- }
-#ifdef WOLFSSL_ASYNC_CRYPT
- /* for async the symmetric operations are blocking */
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- do {
- ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
- } while (ret == 0);
- if (ret >= 0) {
- /* remove from event queue list */
- ret = wolfSSL_AsyncPop(ssl, NULL);
- }
- }
-#endif
- if (ret != 0) {
- *error = ret;
- return NULL;
- }
-
- ssl->curSize = sz;
- ssl->keys.encryptSz = sz;
- if (ssl->options.tls1_1 && ssl->specs.cipher_type == block) {
- output += ssl->specs.block_size; /* go past TLSv1.1 IV */
- ivExtra = ssl->specs.block_size;
- *advance = ssl->specs.block_size;
- }
-
- if (ssl->specs.cipher_type == aead) {
- *advance = ssl->specs.aead_mac_size;
- ssl->keys.padSz = ssl->specs.aead_mac_size;
- }
- else
- ssl->keys.padSz = ssl->specs.hash_size;
-
- if (ssl->specs.cipher_type == block) {
- /* last pad bytes indicates length */
- word32 pad = 0;
- if ((int)sz > ivExtra) {
- /* get value of last pad byte */
- pad = *(output + sz - ivExtra - 1) + 1;
- }
- ssl->keys.padSz += pad;
- }
-
-#ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(ssl->version)) {
- word16 i = (word16)(sz - ssl->keys.padSz);
- /* Remove padding from end of plain text. */
- for (--i; i > 0; i--) {
- if (output[i] != 0)
- break;
- }
- /* Get the real content type from the end of the data. */
- rh->type = output[i];
- ssl->keys.padSz = sz - i;
- }
-#endif
- (void)rh;
-
- return output;
-}
-
-
-/* remove session from table, use rowHint if no info (means we have a lock) */
-static void RemoveSession(SnifferSession* session, IpInfo* ipInfo,
- TcpInfo* tcpInfo, word32 rowHint)
-{
- SnifferSession* previous = 0;
- SnifferSession* current;
- word32 row = rowHint;
-#ifndef HAVE_C___ATOMIC
- int haveLock = 0;
-#endif
- Trace(REMOVE_SESSION_STR);
-
- if (ipInfo && tcpInfo)
- row = SessionHash(ipInfo, tcpInfo);
-#ifndef HAVE_C___ATOMIC
- else
- haveLock = 1;
-#endif
-
- if (row >= HASH_SIZE)
- return;
-
-#ifndef HAVE_C___ATOMIC
- if (!haveLock) {
- LOCK_SESSION();
- }
-#endif
-
- current = SessionTable[row];
-
- while (current) {
- if (current == session) {
- if (previous)
- previous->next = current->next;
- else
- SessionTable[row] = current->next;
- FreeSnifferSession(session);
- TraceRemovedSession();
- break;
- }
- previous = current;
- current = current->next;
- }
-
-#ifndef HAVE_C___ATOMIC
- if (!haveLock) {
- UNLOCK_SESSION();
- }
-#endif
-}
-
-
-/* Remove stale sessions from the Session Table, have a lock */
-static void RemoveStaleSessions(void)
-{
- word32 i;
- SnifferSession* session;
-
- for (i = 0; i < HASH_SIZE; i++) {
- session = SessionTable[i];
- while (session) {
- SnifferSession* next = session->next;
- if (wc_Time(NULL) >= session->lastUsed + WOLFSSL_SNIFFER_TIMEOUT) {
- TraceStaleSession();
- RemoveSession(session, NULL, NULL, i);
- }
- session = next;
- }
- }
-}
-
-void ssl_RemoveStaleSessions(void)
-{
- LOCK_SESSION();
- RemoveStaleSessions();
- UNLOCK_SESSION();
-}
-
-/* Create a new Sniffer Session */
-static SnifferSession* CreateSession(IpInfo* ipInfo, TcpInfo* tcpInfo,
- char* error)
-{
- SnifferSession* session = 0;
- int row;
-
- Trace(NEW_SESSION_STR);
- /* create a new one */
- session = (SnifferSession*)XMALLOC(sizeof(SnifferSession),
- NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- if (session == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- return NULL;
- }
- InitSession(session);
-#ifdef HAVE_EXTENDED_MASTER
- {
- HsHashes* newHash = (HsHashes*)XMALLOC(sizeof(HsHashes),
- NULL, DYNAMIC_TYPE_HASHES);
- if (newHash == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- return NULL;
- }
- if (HashInit(newHash) != 0) {
- SetError(EXTENDED_MASTER_HASH_STR, error, NULL, 0);
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- return NULL;
- }
- session->hash = newHash;
- }
-#endif
- session->server = ipInfo->dst;
- session->client = ipInfo->src;
- session->srvPort = (word16)tcpInfo->dstPort;
- session->cliPort = (word16)tcpInfo->srcPort;
- session->cliSeqStart = tcpInfo->sequence;
- session->cliExpected = 1; /* relative */
- session->lastUsed= wc_Time(NULL);
- session->keySz = 0;
- session->error = 0;
- session->verboseErr = 0;
-#ifdef HAVE_SNI
- session->sni = NULL;
-#endif
-
- session->context = GetSnifferServer(ipInfo, tcpInfo);
- if (session->context == NULL) {
- SetError(SERVER_NOT_REG_STR, error, NULL, 0);
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- return NULL;
- }
-
- session->sslServer = wolfSSL_new(session->context->ctx);
- if (session->sslServer == NULL) {
- SetError(BAD_NEW_SSL_STR, error, session, FATAL_ERROR_STATE);
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- return NULL;
- }
- session->sslClient = wolfSSL_new(session->context->ctx);
- if (session->sslClient == NULL) {
- wolfSSL_free(session->sslServer);
- session->sslServer = 0;
-
- SetError(BAD_NEW_SSL_STR, error, session, FATAL_ERROR_STATE);
- XFREE(session, NULL, DYNAMIC_TYPE_SNIFFER_SESSION);
- return NULL;
- }
- /* put server back into server mode */
- session->sslServer->options.side = WOLFSSL_SERVER_END;
-
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
- if (session->context->useKeyLogFile) {
- setSnifferSecretCb(session);
- }
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
-
-
- row = SessionHash(ipInfo, tcpInfo);
-
- /* add it to the session table */
- LOCK_SESSION();
-
- session->next = SessionTable[row];
- SessionTable[row] = session;
-
- SessionCount++;
-
- if ( (SessionCount % HASH_SIZE) == 0) {
- TraceFindingStale();
- RemoveStaleSessions();
- }
-
- UNLOCK_SESSION();
-
- /* CreateSession is called in response to a SYN packet, we know this
- * is headed to the server. Also we know the server is one we care
- * about as we've passed the GetSnifferServer() successfully. */
- session->flags.side = WOLFSSL_SERVER_END;
-
- return session;
-}
-
-
-#ifdef OLD_HELLO_ALLOWED
-
-/* Process Old Client Hello Input */
-static int DoOldHello(SnifferSession* session, const byte* sslFrame,
- int* rhSize, int* sslBytes, char* error)
-{
- const byte* input = sslFrame;
- byte b0, b1;
- word32 idx = 0;
- int ret;
-
- Trace(GOT_OLD_CLIENT_HELLO_STR);
- session->flags.clientHello = 1; /* don't process again */
- b0 = *input++;
- b1 = *input++;
- *sslBytes -= 2;
- *rhSize = ((b0 & 0x7f) << 8) | b1;
-
- if (*rhSize > *sslBytes) {
- SetError(OLD_CLIENT_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ret = ProcessOldClientHello(session->sslServer, input, &idx, *sslBytes,
- (word16)*rhSize);
- if (ret < 0 && ret != WC_NO_ERR_TRACE(MATCH_SUITE_ERROR)) {
- SetError(BAD_OLD_CLIENT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- Trace(OLD_CLIENT_OK_STR);
- XMEMCPY(session->sslClient->arrays->clientRandom,
- session->sslServer->arrays->clientRandom, RAN_LEN);
-
- *sslBytes -= *rhSize;
- return 0;
-}
-
-#endif /* OLD_HELLO_ALLOWED */
-
-
-#if 0
-/* Calculate the TCP checksum, see RFC 1071 */
-/* return 0 for success, -1 on error */
-/* can be called from decode() with
- TcpChecksum(&ipInfo, &tcpInfo, sslBytes, packet + ipInfo.length);
- could also add a 64bit version if type available and using this
-*/
-static int TcpChecksum(IpInfo* ipInfo, TcpInfo* tcpInfo, int dataLen,
- const byte* packet)
-{
- TcpPseudoHdr pseudo;
- int count = PSEUDO_HDR_SZ;
- const word16* data = (word16*)&pseudo;
- word32 sum = 0;
- word16 checksum;
-
- pseudo.src = ipInfo->src.ip4;
- pseudo.dst = ipInfo->dst.ip4;
- pseudo.rsv = 0;
- pseudo.protocol = TCP_PROTO;
- pseudo.length = htons(tcpInfo->length + dataLen);
-
- /* pseudo header sum */
- while (count >= 2) {
- sum += *data++;
- count -= 2;
- }
-
- count = tcpInfo->length + dataLen;
- data = (word16*)packet;
-
- /* main sum */
- while (count > 1) {
- sum += *data++;
- count -=2;
- }
-
- /* get left-over, if any */
- packet = (byte*)data;
- if (count > 0) {
- sum += *packet;
- }
-
- /* fold 32bit sum into 16 bits */
- while (sum >> 16)
- sum = (sum & 0xffff) + (sum >> 16);
-
- checksum = (word16)~sum;
- /* checksum should now equal 0, since included already calcd checksum */
- /* field, but tcp checksum offloading could negate calculation */
- if (checksum == 0)
- return 0;
- return WOLFSSL_FATAL_ERROR;
-}
-#endif
-
-
-/* Check IP and TCP headers, set payload */
-/* returns 0 on success, -1 on error */
-static int CheckHeaders(IpInfo* ipInfo, TcpInfo* tcpInfo, const byte* packet,
- int length, const byte** sslFrame, int* sslBytes, char* error,
- int checkReg, int trace)
-{
- IpHdr* iphdr = (IpHdr*)packet;
- TcpHdr* tcphdr;
- int version;
-
- if (trace) {
- TraceHeader();
- TracePacket();
- }
-
- /* ip header */
- if (length < IP_HDR_SZ) {
- SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- version = IP_V(iphdr);
- if (version != IPV6 && version != IPV4) {
- /* Is this VLAN IEEE 802.1Q Frame? TPID = 0x8100 */
- if (packet[2] == 0x81 && packet[3] == 0x00) {
- /* trim VLAN header and try again */
- packet += 8;
- length -= 8;
- }
- }
-
- if (CheckIpHdr(iphdr, ipInfo, length, error, trace) != 0)
- return WOLFSSL_FATAL_ERROR;
-
-#ifndef WOLFSSL_SNIFFER_WATCH
- if (checkReg &&
- !IsServerRegistered(iphdr->src) && !IsServerRegistered(iphdr->dst)) {
- SetError(SERVER_NOT_REG_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-#endif
-
- /* tcp header */
- if (length < (ipInfo->length + TCP_HDR_SZ)) {
- SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- tcphdr = (TcpHdr*)(packet + ipInfo->length);
- if (CheckTcpHdr(tcphdr, tcpInfo, error, trace) != 0)
- return WOLFSSL_FATAL_ERROR;
-
-#ifndef WOLFSSL_SNIFFER_WATCH
- if (checkReg &&
- !IsPortRegistered(tcpInfo->srcPort) &&
- !IsPortRegistered(tcpInfo->dstPort)) {
- SetError(SERVER_PORT_NOT_REG_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-#endif
-
- /* setup */
- *sslFrame = packet + ipInfo->length + tcpInfo->length;
- if (*sslFrame > packet + length) {
- SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* We only care about the data in the TCP/IP record. There may be extra
- * data after the IP record for the FCS for Ethernet. */
- *sslBytes = (int)(packet + ipInfo->total - *sslFrame);
-
- (void)checkReg;
-
- return 0;
-}
-
-
-/* Create or Find existing session */
-/* returns 0 on success (continue), -1 on error, 1 on success (end) */
-static int CheckSession(IpInfo* ipInfo, TcpInfo* tcpInfo, int sslBytes,
- SnifferSession** session, char* error)
-{
- /* create a new SnifferSession on client SYN */
- if (tcpInfo->syn && !tcpInfo->ack) {
- #ifdef WOLFSSL_ASYNC_CRYPT
- /* if session already exists and is pending do not create another */
- *session = GetSnifferSession(ipInfo, tcpInfo);
- if (*session != NULL) {
- if ((*session)->pendSeq != 0) {
- return WC_PENDING_E;
- }
- }
- #endif
-
- TraceClientSyn(tcpInfo->sequence);
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslEncryptedConns);
-#endif
- *session = CreateSession(ipInfo, tcpInfo, error);
- if (*session == NULL) {
- *session = GetSnifferSession(ipInfo, tcpInfo);
- /* already had existing, so OK */
- if (*session)
- return 1;
-
- SetError(MEMORY_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- return 1;
- }
- /* get existing sniffer session */
- else {
- *session = GetSnifferSession(ipInfo, tcpInfo);
- if (*session == NULL) {
- /* don't worry about extraneous RST or duplicate FINs */
- if (tcpInfo->fin || tcpInfo->rst)
- return 1;
- /* don't worry about duplicate ACKs either */
- if (sslBytes == 0 && tcpInfo->ack)
- return 1;
-
-#ifdef WOLFSSL_SNIFFER_STATS
- LOCK_STAT();
- NOLOCK_INC_STAT(SnifferStats.sslDecryptedPackets);
- NOLOCK_ADD_TO_STAT(SnifferStats.sslDecryptedBytes, sslBytes);
- UNLOCK_STAT();
-#endif
-
- SetError(BAD_SESSION_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- return 0;
-}
-
-
-/* Create a Packet Buffer from *begin - end, adjust new *begin and bytesLeft */
-static PacketBuffer* CreateBuffer(word32* begin, word32 end, const byte* data,
- int* bytesLeft)
-{
- PacketBuffer* pb;
- int added = (int)(end - *begin + 1);
-
- if (added <= 0) {
- return NULL;
- }
-
- pb = (PacketBuffer*)XMALLOC(sizeof(PacketBuffer),
- NULL, DYNAMIC_TYPE_SNIFFER_PB);
- if (pb == NULL) return NULL;
-
- pb->next = 0;
- pb->begin = *begin;
- pb->end = end;
- pb->data = (byte*)XMALLOC(added, NULL, DYNAMIC_TYPE_SNIFFER_PB_BUFFER);
-
- if (pb->data == NULL) {
- XFREE(pb, NULL, DYNAMIC_TYPE_SNIFFER_PB);
- return NULL;
- }
- XMEMCPY(pb->data, data, added);
-
- *bytesLeft -= added;
- *begin = pb->end + 1;
-
- return pb;
-}
-
-/* Add sslFrame to Reassembly List */
-/* returns 1 (end) on success, -1, on error */
-static int AddToReassembly(byte from, word32 seq, const byte* sslFrame,
- int sslBytes, SnifferSession* session, char* error)
-{
- PacketBuffer* add;
- PacketBuffer** front = (from == WOLFSSL_SERVER_END) ?
- &session->cliReassemblyList: &session->srvReassemblyList;
- PacketBuffer* curr = *front;
- PacketBuffer* prev = curr;
-
- word32* reassemblyMemory = (from == WOLFSSL_SERVER_END) ?
- &session->cliReassemblyMemory : &session->srvReassemblyMemory;
- word32 startSeq = seq;
- int added;
- int bytesLeft = sslBytes; /* could be overlapping fragment */
-
- /* if list is empty add full frame to front */
- if (!curr) {
- if (MaxRecoveryMemory != -1 &&
- (int)(*reassemblyMemory + sslBytes) > MaxRecoveryMemory) {
- SetError(REASSEMBLY_MAX_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- add = CreateBuffer(&seq, seq + sslBytes - 1, sslFrame, &bytesLeft);
- if (add == NULL) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- *front = add;
- *reassemblyMemory += sslBytes;
- return 1;
- }
-
- /* add to front if before current front, up to next->begin */
- if (seq < curr->begin) {
- word32 end = seq + sslBytes - 1;
-
- if (end >= curr->begin)
- end = curr->begin - 1;
-
- if (MaxRecoveryMemory -1 &&
- (int)(*reassemblyMemory + sslBytes) > MaxRecoveryMemory) {
- SetError(REASSEMBLY_MAX_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- add = CreateBuffer(&seq, end, sslFrame, &bytesLeft);
- if (add == NULL) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- add->next = curr;
- *front = add;
- *reassemblyMemory += sslBytes;
- }
-
- /* while we have bytes left, try to find a gap to fill */
- while (bytesLeft > 0) {
- /* get previous packet in list */
- while (curr && (seq >= curr->begin)) {
- prev = curr;
- curr = curr->next;
- }
-
- /* don't add duplicate data */
- if (prev->end >= seq) {
- if ( (seq + bytesLeft - 1) <= prev->end)
- return 1;
- seq = prev->end + 1;
- bytesLeft = startSeq + sslBytes - seq;
- }
-
- if (!curr)
- /* we're at the end */
- added = bytesLeft;
- else
- /* we're in between two frames */
- added = min(bytesLeft, (int)(curr->begin - seq));
-
- /* data already there */
- if (added <= 0)
- continue;
-
- if (MaxRecoveryMemory != -1 &&
- (int)(*reassemblyMemory + added) > MaxRecoveryMemory) {
- SetError(REASSEMBLY_MAX_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- add = CreateBuffer(&seq, seq + added - 1, &sslFrame[seq - startSeq],
- &bytesLeft);
- if (add == NULL) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- add->next = prev->next;
- prev->next = add;
- *reassemblyMemory += added;
- }
- return 1;
-}
-
-/* Add out of order FIN capture */
-/* returns 1 for success (end) */
-static int AddFinCapture(SnifferSession* session, word32 sequence)
-{
- if (session->flags.side == WOLFSSL_SERVER_END) {
- if (session->finCapture.cliCounted == 0)
- session->finCapture.cliFinSeq = sequence;
- }
- else {
- if (session->finCapture.srvCounted == 0)
- session->finCapture.srvFinSeq = sequence;
- }
- return 1;
-}
-
-/* Adjust incoming sequence based on side */
-/* returns 0 on success (continue), -1 on error, 1 on success (end) */
-static int AdjustSequence(TcpInfo* tcpInfo, SnifferSession* session,
- int* sslBytes, const byte** sslFrame, char* error)
-{
- int ret = 0;
- word32 seqStart = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->cliSeqStart : session->srvSeqStart;
- word32* seqLast = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliSeqLast : &session->srvSeqLast;
- word32 real = tcpInfo->sequence - seqStart;
- word32* expected = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliExpected : &session->srvExpected;
- PacketBuffer* reassemblyList = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->cliReassemblyList : session->srvReassemblyList;
- byte skipPartial = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->flags.srvSkipPartial :
- session->flags.cliSkipPartial;
-
- /* handle rollover of sequence */
- if (tcpInfo->sequence < seqStart)
- real = 0xffffffffU - seqStart + tcpInfo->sequence + 1;
-
- TraceRelativeSequence(*expected, real);
-
- if (real < *expected) {
- int overlap = *expected - real;
-
- if (real + *sslBytes > *expected) {
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (session->sslServer->error != WC_NO_ERR_TRACE(WC_PENDING_E) &&
- session->pendSeq != tcpInfo->sequence)
- #endif
- {
- Trace(OVERLAP_DUPLICATE_STR);
- }
-
- /* The following conditional block is duplicated below. It is the
- * same action but for a different setup case. If changing this
- * block be sure to also update the block below. */
- if (reassemblyList) {
- word32 newEnd;
-
- /* adjust to expected, remove duplicate */
- *sslFrame += overlap;
- *sslBytes = (*sslBytes > overlap) ? *sslBytes - overlap : 0;
-
- newEnd = *expected + *sslBytes;
- if (newEnd > reassemblyList->begin) {
- int covered_data_len;
-
- Trace(OVERLAP_REASSEMBLY_BEGIN_STR);
-
- /* remove bytes already on reassembly list */
- covered_data_len = newEnd - reassemblyList->begin;
- *sslFrame += covered_data_len;
- *sslBytes = (*sslBytes > covered_data_len) ?
- *sslBytes - covered_data_len : 0;
- }
- if ((*sslBytes > 0) && (newEnd > reassemblyList->end)) {
- Trace(OVERLAP_REASSEMBLY_END_STR);
-
- /* may be past reassembly list end (could have more on list)
- so try to add what's past the front->end */
- AddToReassembly(session->flags.side, reassemblyList->end + 1,
- *sslFrame + (reassemblyList->end - *expected + 1),
- newEnd - reassemblyList->end, session, error);
- }
- }
- else if (*sslBytes > 0) {
- if (real + *sslBytes - 1 > *seqLast) {
- /* fix segment overlap */
- #ifdef DEBUG_SNIFFER
- WOLFSSL* ssl = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->sslServer : session->sslClient;
- printf("\tSegment %d overlap (%d -> %d)\n",
- *sslBytes,
- ssl->buffers.inputBuffer.length - overlap,
- ssl->buffers.inputBuffer.length + *sslBytes - overlap - 1);
- #endif
- *sslBytes -= overlap;
- *sslFrame += overlap;
- }
-
- /* DUP overlap, allow */
- skipPartial = 0; /* do not reset sslBytes */
- }
- ret = 0;
- }
- else {
- /* This can happen with unseen acks, out of order packets, or
- * possible spurious retransmission. */
- if (*sslBytes > 0) {
- /* If packet has data attempt to process packet, if hasn't
- * already been received */
- if (
- #ifdef WOLFSSL_ASYNC_CRYPT
- session->sslServer->error != WC_NO_ERR_TRACE(WC_PENDING_E) &&
- session->pendSeq != tcpInfo->sequence &&
- #endif
- real + *sslBytes -1 <= *seqLast) {
- Trace(DUPLICATE_STR);
- ret = 1;
- }
- else {
- /* DUP: allow */
- skipPartial = 0; /* do not reset sslBytes */
- ret = 0;
- }
- }
- else {
- /* DUP empty, ignore */
- ret = 1;
- }
- }
- }
- else if (real > *expected) {
- Trace(OUT_OF_ORDER_STR);
- if (*sslBytes > 0) {
- int addResult = AddToReassembly(session->flags.side, real,
- *sslFrame, *sslBytes, session, error);
- ret = (skipPartial) ? 0 : addResult;
- }
- else if (tcpInfo->fin) {
- ret = AddFinCapture(session, real);
- }
- }
- else if (*sslBytes > 0) {
- if (skipPartial) {
- AddToReassembly(session->flags.side, real,
- *sslFrame, *sslBytes, session, error);
- ret = 0;
- }
- /* The following conditional block is duplicated above. It is the
- * same action but for a different setup case. If changing this
- * block be sure to also update the block above. */
- else if (reassemblyList) {
- word32 newEnd = *expected + *sslBytes;
-
- if (newEnd > reassemblyList->begin) {
- int covered_data_len;
-
- Trace(OVERLAP_REASSEMBLY_BEGIN_STR);
-
- /* remove bytes already on reassembly list */
- covered_data_len = newEnd - reassemblyList->begin;
- *sslFrame += covered_data_len;
- *sslBytes = (*sslBytes > covered_data_len) ?
- *sslBytes - covered_data_len : 0;
- }
- if ((*sslBytes > 0) && (newEnd > reassemblyList->end)) {
- Trace(OVERLAP_REASSEMBLY_END_STR);
-
- /* may be past reassembly list end (could have more on list)
- so try to add what's past the front->end */
- AddToReassembly(session->flags.side, reassemblyList->end + 1,
- *sslFrame + (reassemblyList->end - *expected + 1),
- newEnd - reassemblyList->end, session, error);
- }
- }
- }
- else {
- /* no data present */
- }
-
- if (ret == 0) {
- /* got expected sequence */
- *expected += *sslBytes;
- if (tcpInfo->fin)
- *expected += 1;
- }
- if (*sslBytes > 0) {
- *seqLast = real + *sslBytes - 1;
- }
- if (*sslBytes > 0 && skipPartial) {
- *sslBytes = 0;
- }
-
- return ret;
-}
-
-
-static int FindNextRecordInAssembly(SnifferSession* session,
- const byte** sslFrame, int* sslBytes,
- const byte** end, char* error)
-{
- PacketBuffer** front = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliReassemblyList :
- &session->srvReassemblyList;
- PacketBuffer* curr = *front;
- PacketBuffer* prev = NULL;
- byte* skipPartial = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->flags.srvSkipPartial :
- &session->flags.cliSkipPartial;
- int* reassemblyMemory = (session->flags.side == WOLFSSL_SERVER_END) ?
- (int*)&session->cliReassemblyMemory :
- (int*)&session->srvReassemblyMemory;
- WOLFSSL* ssl = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->sslServer :
- session->sslClient;
- ProtocolVersion pv = ssl->version;
- word32* expected = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliExpected :
- &session->srvExpected;
-
- while (curr != NULL) {
- *expected = curr->end + 1;
-
- if (curr->data[0] == application_data &&
- curr->data[1] == pv.major &&
- curr->data[2] == pv.minor) {
-
- if (ssl->buffers.inputBuffer.length > 0)
- Trace(DROPPING_PARTIAL_RECORD);
-
- *sslBytes = (int)(curr->end - curr->begin + 1);
- if ( *sslBytes > (int)ssl->buffers.inputBuffer.bufferSize) {
- if (GrowInputBuffer(ssl, *sslBytes, 0) < 0) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- XMEMCPY(ssl->buffers.inputBuffer.buffer, curr->data, *sslBytes);
-
- *front = curr->next;
- *reassemblyMemory -= *sslBytes;
- FreePacketBuffer(curr);
-
- ssl->buffers.inputBuffer.length = *sslBytes;
- *sslFrame = ssl->buffers.inputBuffer.buffer;
- *end = *sslFrame + *sslBytes;
- *skipPartial = 0;
-
- return 0;
- }
- else if (ssl->specs.cipher_type == block) {
- int ivPos = (int)(curr->end - curr->begin -
- ssl->specs.block_size + 1);
- if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes) {
-#ifndef NO_AES
- if (ivPos >= 0)
- wc_AesSetIV(ssl->decrypt.aes, curr->data + ivPos);
-#endif
- }
- else if (ssl->specs.bulk_cipher_algorithm == wolfssl_triple_des) {
-#ifndef NO_DES3
- if (ivPos >= 0)
- wc_Des3_SetIV(ssl->decrypt.des3, curr->data + ivPos);
-#endif
- }
- }
-
- Trace(DROPPING_LOST_FRAG_STR);
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslDecodeFails);
-#endif
- prev = curr;
- curr = curr->next;
- *reassemblyMemory -= (int)(prev->end - prev->begin + 1);
- FreePacketBuffer(prev);
- }
-
- *front = curr;
-
- return 0;
-}
-
-
-static int FixSequence(TcpInfo* tcpInfo, SnifferSession* session)
-{
- word32* expected = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->srvExpected : &session->cliExpected;
- word32 seqStart = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->srvSeqStart : session->cliSeqStart;
- PacketBuffer* list = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->srvReassemblyList :
- session->cliReassemblyList;
- byte* skipPartial = (session->flags.side != WOLFSSL_SERVER_END) ?
- &session->flags.srvSkipPartial :
- &session->flags.cliSkipPartial;
-
- *skipPartial = 1;
-
- if (list != NULL)
- *expected = list->begin;
- else
- *expected = tcpInfo->ackNumber - seqStart;
-
- return 1;
-}
-
-
-/* Check latest ack number for missing packets
- return 0 ok, <0 on error */
-static int CheckAck(TcpInfo* tcpInfo, SnifferSession* session)
-{
- if (tcpInfo->ack) {
- word32 seqStart = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->srvSeqStart :session->cliSeqStart;
- word32 real = tcpInfo->ackNumber - seqStart;
- word32 expected = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->srvExpected : session->cliExpected;
-
- /* handle rollover of sequence */
- if (tcpInfo->ackNumber < seqStart)
- real = 0xffffffffU - seqStart + tcpInfo->ackNumber + 1;
-
- TraceAck(real, expected);
-
- if (real > expected)
- return WOLFSSL_FATAL_ERROR; /* we missed a packet, ACKing data we never saw */
- }
- return 0;
-}
-
-
-/* Check TCP Sequence status */
-/* returns 0 on success (continue), -1 on error, 1 on success (end) */
-static int CheckSequence(IpInfo* ipInfo, TcpInfo* tcpInfo,
- SnifferSession* session, int* sslBytes,
- const byte** sslFrame, char* error)
-{
- int actualLen;
- byte* ackFault = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->flags.cliAckFault :
- &session->flags.srvAckFault;
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- if (session->sslServer->error == 0 && session->pendSeq != 0 &&
- session->pendSeq == tcpInfo->sequence) {
- return 0; /* ready to process, but skip sequence checking below (already done) */
- }
- /* check if this session is pending */
- else if (session->pendSeq != 0 && session->pendSeq != tcpInfo->sequence) {
- return WC_PENDING_E;
- }
-#endif
-
- /* init SEQ from server to client - if not ack fault */
- if (tcpInfo->syn && tcpInfo->ack && !*ackFault) {
- session->srvSeqStart = tcpInfo->sequence;
- session->srvExpected = 1;
- TraceServerSyn(tcpInfo->sequence);
- return 1;
- }
-
- /* adjust potential ethernet trailer */
- actualLen = ipInfo->total - ipInfo->length - tcpInfo->length;
- if (*sslBytes > actualLen) {
- *sslBytes = actualLen;
- }
-
- TraceSequence(tcpInfo->sequence, *sslBytes);
- if (CheckAck(tcpInfo, session) < 0) {
- if (!RecoveryEnabled) {
- #ifndef WOLFSSL_SNIFFER_NO_RECOVERY
- UpdateMissedDataSessions();
- #endif
- SetError(ACK_MISSED_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- else {
- SetError(ACK_MISSED_STR, error, session, 0);
- if (*ackFault == 0) {
- *ackFault = 1;
- #ifndef WOLFSSL_SNIFFER_NO_RECOVERY
- UpdateMissedDataSessions();
- #endif
- }
- return FixSequence(tcpInfo, session);
- }
- }
-
- if (*ackFault) {
- Trace(CLEAR_ACK_FAULT);
- *ackFault = 0;
- }
-
- return AdjustSequence(tcpInfo, session, sslBytes, sslFrame, error);
-}
-
-
-/* Check Status before record processing */
-/* returns 0 on success (continue), -1 on error, 1 on success (end) */
-static int CheckPreRecord(IpInfo* ipInfo, TcpInfo* tcpInfo,
- const byte** sslFrame, SnifferSession** pSession,
- int* sslBytes, const byte** end, char* error)
-{
- word32 length;
- SnifferSession* session = *pSession;
- WOLFSSL* ssl = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->sslServer : session->sslClient;
- byte skipPartial = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->flags.srvSkipPartial :
- session->flags.cliSkipPartial;
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- /* if this is a pending async packet do not "grow" on partial (we already did) */
- if (session->pendSeq == tcpInfo->sequence) {
- if (session->sslServer->error == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- return 0; /* don't check pre-record again */
- }
- /* if record check already done then restore, otherwise process normal */
- if (ssl->buffers.inputBuffer.length > 0) {
- *sslBytes = ssl->buffers.inputBuffer.length;
- *sslFrame = ssl->buffers.inputBuffer.buffer;
- *end = *sslFrame + *sslBytes;
- return 0;
- }
- }
-#endif
-
- /* remove SnifferSession on 2nd FIN or RST */
- if (tcpInfo->fin || tcpInfo->rst) {
- /* flag FIN and RST */
- if (tcpInfo->fin)
- session->flags.finCount += 1;
- else if (tcpInfo->rst)
- session->flags.finCount += 2;
-
- if (session->flags.finCount >= 2) {
- RemoveSession(session, ipInfo, tcpInfo, 0);
- *pSession = NULL;
- return 1;
- }
- }
-
- if (session->flags.fatalError == FATAL_ERROR_STATE) {
- SetError(FATAL_ERROR_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (skipPartial) {
- if (FindNextRecordInAssembly(session,
- sslFrame, sslBytes, end, error) < 0) {
- return WOLFSSL_FATAL_ERROR;
- }
- }
-
- if (*sslBytes <= 0) {
- Trace(NO_DATA_STR);
- return 1;
- }
-
- /* if current partial data, add to end of partial */
- /* if skipping, the data is already at the end of partial */
- length = ssl->buffers.inputBuffer.length;
- if ( !skipPartial && length ) {
- Trace(PARTIAL_ADD_STR);
-
- if ( (*sslBytes + length) > ssl->buffers.inputBuffer.bufferSize) {
- if (GrowInputBuffer(ssl, *sslBytes, length) < 0) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- XMEMCPY(&ssl->buffers.inputBuffer.buffer[length],
- *sslFrame, *sslBytes);
- *sslBytes += length;
- ssl->buffers.inputBuffer.length = *sslBytes;
- *sslFrame = ssl->buffers.inputBuffer.buffer;
- *end = *sslFrame + *sslBytes;
- }
-
- if (session->flags.clientHello == 0 && **sslFrame != handshake) {
- /* Sanity check the packet for an old style client hello. */
- int rhSize = (((*sslFrame)[0] & 0x7f) << 8) | ((*sslFrame)[1]);
-
- if ((rhSize <= (*sslBytes - 2)) &&
- (*sslFrame)[2] == OLD_HELLO_ID && (*sslFrame)[3] == SSLv3_MAJOR) {
-#ifdef OLD_HELLO_ALLOWED
- int ret = DoOldHello(session, *sslFrame, &rhSize, sslBytes, error);
- if (ret < 0)
- return WOLFSSL_FATAL_ERROR; /* error already set */
- if (*sslBytes <= 0)
- return 1;
-#endif
- }
- else {
-#ifdef STARTTLS_ALLOWED
- if (ssl->buffers.inputBuffer.dynamicFlag) {
- ssl->buffers.inputBuffer.length = 0;
- ShrinkInputBuffer(ssl, NO_FORCED_FREE);
- }
- return 1;
-#endif
- }
- }
-
- return 0;
-}
-
-
-/* See if input on the reassembly list is ready for consuming */
-/* returns 1 for TRUE, 0 for FALSE */
-static int HaveMoreInput(SnifferSession* session, const byte** sslFrame,
- int* sslBytes, const byte** end, char* error)
-{
- /* sequence and reassembly based on from, not to */
- int moreInput = 0;
- PacketBuffer** front = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliReassemblyList : &session->srvReassemblyList;
- word32* expected = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliExpected : &session->srvExpected;
- /* buffer is on receiving end */
- word32* length = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->sslServer->buffers.inputBuffer.length :
- &session->sslClient->buffers.inputBuffer.length;
- byte** myBuffer = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->sslServer->buffers.inputBuffer.buffer :
- &session->sslClient->buffers.inputBuffer.buffer;
- word32* bufferSize = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->sslServer->buffers.inputBuffer.bufferSize :
- &session->sslClient->buffers.inputBuffer.bufferSize;
- WOLFSSL* ssl = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->sslServer : session->sslClient;
- word32* reassemblyMemory = (session->flags.side == WOLFSSL_SERVER_END) ?
- &session->cliReassemblyMemory : &session->srvReassemblyMemory;
-
- while (*front && ((*front)->begin == *expected) ) {
- int room = (int)(*bufferSize - *length);
- int packetLen = (int)((*front)->end - (*front)->begin + 1);
-
- if (packetLen > room && *bufferSize < MAX_INPUT_SZ) {
- if (GrowInputBuffer(ssl, packetLen, *length) < 0) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return 0;
- }
- room = *bufferSize - *length; /* bufferSize is now bigger */
- }
-
- if (packetLen <= room) {
- PacketBuffer* del = *front;
- byte* buf = *myBuffer;
-
- XMEMCPY(&buf[*length], (*front)->data, packetLen);
- *length += packetLen;
- *expected += packetLen;
-
- /* remove used packet */
- *front = (*front)->next;
-
- *reassemblyMemory -= packetLen;
- FreePacketBuffer(del);
-
- moreInput = 1;
- }
- else
- break;
- }
- if (moreInput) {
- *sslFrame = *myBuffer;
- *sslBytes = *length;
- *end = *myBuffer + *length;
- }
- return moreInput;
-}
-
-
-
-/* Process Message(s) from sslFrame */
-/* return Number of bytes on success, 0 for no data yet, and -1 on error */
-static int ProcessMessage(const byte* sslFrame, SnifferSession* session,
- int sslBytes, byte** data, const byte* end,
- void* ctx, char* error)
-{
- const byte* sslBegin = sslFrame;
- const byte* recordEnd; /* end of record indicator */
- const byte* inRecordEnd; /* indicator from input stream not decrypt */
- RecordLayerHeader rh;
- int rhSize;
- int ret;
- int errCode = 0;
- int decoded = 0; /* bytes stored for user in data */
- int notEnough; /* notEnough bytes yet flag */
- int decrypted = 0; /* was current msg decrypted */
- WOLFSSL* ssl = (session->flags.side == WOLFSSL_SERVER_END) ?
- session->sslServer : session->sslClient;
-doMessage:
-
- notEnough = 0;
- rhSize = 0;
- if (sslBytes < 0) {
- SetError(PACKET_HDR_SHORT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- if (sslBytes >= RECORD_HEADER_SZ) {
- if (GetRecordHeader(sslFrame, &rh, &rhSize) != 0) {
- /* ignore packet if record header errors */
- SetError(BAD_RECORD_HDR_STR, error, session, 0);
- return 0;
- }
- }
- else {
- notEnough = 1;
- }
-
- if (notEnough || rhSize > (sslBytes - RECORD_HEADER_SZ)) {
- /* don't have enough input yet to process full SSL record */
- Trace(PARTIAL_INPUT_STR);
-
- /* store partial if not there already or we advanced */
- if (ssl->buffers.inputBuffer.length == 0 || sslBegin != sslFrame) {
- if (sslBytes > (int)ssl->buffers.inputBuffer.bufferSize) {
- if (GrowInputBuffer(ssl, sslBytes, 0) < 0) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- XMEMMOVE(ssl->buffers.inputBuffer.buffer, sslFrame, sslBytes);
- ssl->buffers.inputBuffer.length = sslBytes;
- }
- if (HaveMoreInput(session, &sslFrame, &sslBytes, &end, error))
- goto doMessage;
- return decoded;
- }
- sslFrame += RECORD_HEADER_SZ;
- sslBytes -= RECORD_HEADER_SZ;
- recordEnd = sslFrame + rhSize; /* may have more than one record */
- inRecordEnd = recordEnd;
-
- /* Make sure cipher is on for client, if we get an application data packet
- * and handshake is done for server. This workaround is required if client
- * handshake packets were missed, retransmitted or sent out of order. */
- if ((enum ContentType)rh.type == application_data &&
- ssl->options.handShakeDone && session->flags.serverCipherOn) {
- session->flags.clientCipherOn = 1;
- session->sslClient->options.handShakeState = HANDSHAKE_DONE;
- session->sslClient->options.handShakeDone = 1;
- }
-
- /* decrypt if needed */
- if ((session->flags.side == WOLFSSL_SERVER_END &&
- session->flags.serverCipherOn)
- || (session->flags.side == WOLFSSL_CLIENT_END &&
- session->flags.clientCipherOn)) {
- int ivAdvance = 0; /* TLSv1.1 advance amount */
-
- /* change_cipher_spec is not encrypted */
- if (rh.type == change_cipher_spec) {
- goto doPart;
- }
- if (ssl->decrypt.setup != 1) {
- SetError(DECRYPT_KEYS_NOT_SETUP, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- if (CheckAvailableSize(ssl, rhSize) < 0) {
- SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- sslFrame = DecryptMessage(ssl, sslFrame, rhSize,
- ssl->buffers.outputBuffer.buffer, &errCode,
- &ivAdvance, &rh);
- recordEnd = sslFrame - ivAdvance + rhSize; /* sslFrame moved so
- should recordEnd */
- decrypted = 1;
-
-#ifdef WOLFSSL_SNIFFER_STATS
- if (errCode != 0) {
- INC_STAT(SnifferStats.sslKeyFails);
- }
- else {
- LOCK_STAT();
- NOLOCK_INC_STAT(SnifferStats.sslDecryptedPackets);
- NOLOCK_ADD_TO_STAT(SnifferStats.sslDecryptedBytes, sslBytes);
- UNLOCK_STAT();
- }
-#endif
- if (errCode != 0) {
- if ((enum ContentType)rh.type == application_data) {
- SetError(BAD_DECRYPT, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- /* do not end session for failures on handshake packets */
- return 0;
- }
- }
-
-doPart:
-
- switch ((enum ContentType)rh.type) {
- case handshake:
- {
- int startIdx = sslBytes;
- int used;
-
- Trace(GOT_HANDSHAKE_STR);
- ret = DoHandShake(sslFrame, &sslBytes, session, error, rhSize);
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E))
- return ret;
- #endif
- if (ret != 0 || sslBytes > startIdx) {
- if (session->flags.fatalError == 0)
- SetError(BAD_HANDSHAKE_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* DoHandShake now fully decrements sslBytes to remaining */
- used = startIdx - sslBytes;
- sslFrame += used;
- if (decrypted)
- sslFrame += ssl->keys.padSz;
- }
- break;
- case change_cipher_spec:
- if (session->flags.side == WOLFSSL_SERVER_END) {
- #ifdef WOLFSSL_TLS13
- if (IsAtLeastTLSv1_3(session->sslServer->version) && session->srvKs.key_len == 0) {
- session->flags.serverCipherOn = 0;
- }
- else
- #endif
- {
- session->flags.serverCipherOn = 1;
- }
- }
- else
- session->flags.clientCipherOn = 1;
- Trace(GOT_CHANGE_CIPHER_STR);
- ssl->options.handShakeState = HANDSHAKE_DONE;
- ssl->options.handShakeDone = 1;
-
- sslFrame += 1;
- sslBytes -= 1;
-
- break;
- case application_data:
- Trace(GOT_APP_DATA_STR);
- {
- word32 inOutIdx = 0;
- int ivExtra = 0;
-
- ret = DoApplicationData(ssl, (byte*)sslFrame, &inOutIdx, SNIFF);
- if (ret == 0) {
- ret = ssl->buffers.clearOutputBuffer.length;
- #ifndef WOLFSSL_AEAD_ONLY
- if (ssl->specs.cipher_type == block) {
- if (ssl->options.tls1_1)
- ivExtra = ssl->specs.block_size;
- }
- else
- #endif
- if (ssl->specs.cipher_type == aead) {
- if (!ssl->options.tls1_3 &&
- ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
- ivExtra = AESGCM_EXP_IV_SZ;
- }
-
- ret -= ivExtra;
-
- #if defined(HAVE_ENCRYPT_THEN_MAC) && \
- !defined(WOLFSSL_AEAD_ONLY)
- if (ssl->options.startedETMRead)
- ret -= MacSize(ssl);
- #endif
- TraceGotData(ret);
- if (ret > 0) { /* may be blank message */
- if (data != NULL) {
- byte* tmpData; /* don't leak on realloc free */
- /* add an extra byte at end of allocation in case
- * user wants to null terminate plaintext */
- tmpData = (byte*)XREALLOC(*data, decoded + ret + 1,
- NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (tmpData == NULL) {
- ForceZero(*data, decoded);
- XFREE(*data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- *data = NULL;
- SetError(MEMORY_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
- *data = tmpData;
- XMEMCPY(*data + decoded,
- ssl->buffers.clearOutputBuffer.buffer, ret);
- }
- else {
-#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
- if (StoreDataCb) {
- const byte* buf;
- word32 offset = 0;
- word32 bufSz;
- int stored;
-
- buf = ssl->buffers.clearOutputBuffer.buffer;
- bufSz = ssl->buffers.clearOutputBuffer.length;
- do {
- stored = StoreDataCb(buf, bufSz, offset,
- ctx);
- if (stored <= 0) {
- return WOLFSSL_FATAL_ERROR;
- }
- offset += stored;
- } while (offset < bufSz);
- }
- else {
- SetError(STORE_DATA_CB_MISSING_STR, error,
- session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-#else
- (void)ctx;
- SetError(NO_DATA_DEST_STR, error, session,
- FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
-#endif
- }
- TraceAddedData(ret, decoded);
- decoded += ret;
- ssl->buffers.clearOutputBuffer.length = 0;
- }
- else if (ret < 0){
- #ifdef DEBUG_SNIFFER
- printf("Invalid data offset calculation! "
- "ret %d, inOutIdx %d, ivExtra %d\n",
- ret, inOutIdx, ivExtra);
- #endif
- /* set error, but do not treat fatal */
- SetError(BAD_APP_DATA_STR, error, session, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- else {
- /* set error, but do not treat fatal */
- SetError(BAD_APP_DATA_STR, error, session, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- if (ssl->buffers.outputBuffer.dynamicFlag)
- ShrinkOutputBuffer(ssl);
-
- sslFrame += inOutIdx;
- sslBytes -= inOutIdx;
- }
- break;
- case alert:
- Trace(GOT_ALERT_STR);
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslAlerts);
-#endif
- sslFrame += rhSize;
- sslBytes -= rhSize;
- break;
-#ifdef WOLFSSL_DTLS13
- case ack:
- /* TODO */
-#endif /* WOLFSSL_DTLS13 */
- case dtls12_cid:
- case no_type:
- default:
- SetError(GOT_UNKNOWN_RECORD_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* do we have another msg in record (if app data did we decode bytes?) */
- if (sslFrame < recordEnd && ((enum ContentType)rh.type != application_data ||
- ((enum ContentType)rh.type == application_data && decoded))) {
- Trace(ANOTHER_MSG_STR);
- goto doPart;
- }
-
- /* back to input stream instead of potential decrypt buffer */
- recordEnd = inRecordEnd;
-
- /* do we have more records ? */
- if (recordEnd < end) {
- Trace(ANOTHER_MSG_STR);
- sslFrame = recordEnd;
- sslBytes = (int)(end - recordEnd);
- goto doMessage;
- }
-
- /* clear used input */
- ssl->buffers.inputBuffer.length = 0;
-
- /* could have more input ready now */
- if (HaveMoreInput(session, &sslFrame, &sslBytes, &end, error))
- goto doMessage;
-
- if (ssl->buffers.inputBuffer.dynamicFlag)
- ShrinkInputBuffer(ssl, NO_FORCED_FREE);
-
- return decoded;
-}
-
-
-/* See if we need to process any pending FIN captures */
-/* Return 0=normal, else = session removed */
-static int CheckFinCapture(IpInfo* ipInfo, TcpInfo* tcpInfo,
- SnifferSession* session)
-{
- int ret = 0;
- if (session->finCapture.cliFinSeq && session->finCapture.cliFinSeq <=
- session->cliExpected) {
- if (session->finCapture.cliCounted == 0) {
- session->flags.finCount += 1;
- session->finCapture.cliCounted = 1;
- TraceClientFin(session->finCapture.cliFinSeq, session->cliExpected);
- }
- }
-
- if (session->finCapture.srvFinSeq && session->finCapture.srvFinSeq <=
- session->srvExpected) {
- if (session->finCapture.srvCounted == 0) {
- session->flags.finCount += 1;
- session->finCapture.srvCounted = 1;
- TraceServerFin(session->finCapture.srvFinSeq, session->srvExpected);
- }
- }
-
- if (session->flags.finCount >= 2) {
- RemoveSession(session, ipInfo, tcpInfo, 0);
- ret = 1;
- }
- return ret;
-}
-
-
-/* If session is in fatal error state free resources now
- return true if removed, 0 otherwise */
-static int RemoveFatalSession(IpInfo* ipInfo, TcpInfo* tcpInfo,
- SnifferSession* session, char* error)
-{
- if (session && session->flags.fatalError == FATAL_ERROR_STATE) {
- if (!session->verboseErr) {
- SetError(FATAL_ERROR_STR, error, NULL, 0);
- }
- RemoveSession(session, ipInfo, tcpInfo, 0);
- return 1;
- }
- return 0;
-}
-
-int ssl_DecodePacket_GetStream(SnifferStreamInfo* info, const byte* packet,
- int length, char* error )
-{
- TcpInfo tcpInfo;
- IpInfo ipInfo;
- const byte* sslFrame = NULL;
- int sslBytes = 0;
-
- XMEMSET(&tcpInfo, 0, sizeof(tcpInfo));
- XMEMSET(&ipInfo, 0, sizeof(ipInfo));
-
- if (CheckHeaders(&ipInfo, &tcpInfo, packet, length, &sslFrame, &sslBytes,
- error, 0, 0) != 0) {
- return WOLFSSL_SNIFFER_ERROR;
- }
-
- info->src = ipInfo.src;
- info->dst = ipInfo.dst;
- info->srcPort = tcpInfo.srcPort;
- info->dstPort = tcpInfo.dstPort;
-
- return 0;
-}
-
-/* Passes in an IP/TCP packet for decoding (ethernet/localhost frame) removed */
-/* returns Number of bytes on success, 0 for no data yet, and
- * WOLFSSL_SNIFFER_ERROR on error and WOLFSSL_SNIFFER_FATAL_ERROR on fatal state
- * error
- */
-static int ssl_DecodePacketInternal(const byte* packet, int length, int isChain,
- byte** data, SSLInfo* sslInfo,
- void* ctx, char* error, int asyncOkay)
-{
- TcpInfo tcpInfo;
- IpInfo ipInfo;
- byte* tmpPacket = NULL; /* Assemble the chain */
- const byte* sslFrame;
- const byte* end;
- int sslBytes; /* ssl bytes unconsumed */
- int ret;
- SnifferSession* session = NULL;
-
- if (isChain) {
-#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
- struct iovec* chain;
- word32 i;
-
- word32 chainSz = (word32)length;
-
- chain = (struct iovec*)packet;
- length = 0;
- for (i = 0; i < chainSz; i++) length += chain[i].iov_len;
-
- tmpPacket = (byte*)XMALLOC(length, NULL, DYNAMIC_TYPE_SNIFFER_CHAIN_BUFFER);
- if (tmpPacket == NULL) return MEMORY_E;
-
- length = 0;
- for (i = 0; i < chainSz; i++) {
- XMEMCPY(tmpPacket+length,chain[i].iov_base,chain[i].iov_len);
- length += chain[i].iov_len;
- }
- packet = (const byte*)tmpPacket;
-#else
- SetError(BAD_INPUT_STR, error, session, FATAL_ERROR_STATE);
- return WOLFSSL_SNIFFER_ERROR;
-#endif
- }
-
- if (CheckHeaders(&ipInfo, &tcpInfo, packet, length, &sslFrame, &sslBytes,
- error, 1, 1) != 0) {
- ret = WOLFSSL_SNIFFER_ERROR;
- goto exit_decode;
- }
-
- end = sslFrame + sslBytes;
-
- ret = CheckSession(&ipInfo, &tcpInfo, sslBytes, &session, error);
- if (RemoveFatalSession(&ipInfo, &tcpInfo, session, error)) {
- ret = WOLFSSL_SNIFFER_FATAL_ERROR;
- goto exit_decode;
- }
-#ifdef WOLFSSL_ASYNC_CRYPT
- else if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- ret = WC_PENDING_E;
- goto exit_decode;
- }
-#endif
- else if (ret == -1) {
- ret = WOLFSSL_SNIFFER_ERROR;
- goto exit_decode;
- }
- else if (ret == 1) {
-#ifdef WOLFSSL_SNIFFER_STATS
- if (sslBytes > 0) {
- LOCK_STAT();
- NOLOCK_INC_STAT(SnifferStats.sslEncryptedPackets);
- NOLOCK_ADD_TO_STAT(SnifferStats.sslEncryptedBytes, sslBytes);
- UNLOCK_STAT();
- }
- else {
- INC_STAT(SnifferStats.sslDecryptedPackets);
- }
-#endif
- ret = 0;
- goto exit_decode; /* done for now */
- }
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- session->userCtx = ctx;
-#endif
-
- ret = CheckSequence(&ipInfo, &tcpInfo, session, &sslBytes, &sslFrame,error);
- if (RemoveFatalSession(&ipInfo, &tcpInfo, session, error)) {
- ret = WOLFSSL_SNIFFER_FATAL_ERROR;
- goto exit_decode;
- }
- else if (ret == -1) {
- ret = WOLFSSL_SNIFFER_ERROR;
- goto exit_decode;
- }
- else if (ret == 1) {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslDecryptedPackets);
-#endif
- ret = 0;
- goto exit_decode; /* done for now */
- }
- else if (ret != 0) {
- goto exit_decode; /* return specific error case */
- }
-
- ret = CheckPreRecord(&ipInfo, &tcpInfo, &sslFrame, &session, &sslBytes,
- &end, error);
- if (RemoveFatalSession(&ipInfo, &tcpInfo, session, error)) {
- ret = WOLFSSL_SNIFFER_FATAL_ERROR;
- goto exit_decode;
- }
- else if (ret == -1) {
- ret = WOLFSSL_SNIFFER_ERROR;
- goto exit_decode;
- }
- else if (ret == 1) {
-#ifdef WOLFSSL_SNIFFER_STATS
- INC_STAT(SnifferStats.sslDecryptedPackets);
-#endif
- ret = 0;
- goto exit_decode; /* done for now */
- }
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- /* make sure this server was polled */
- if (asyncOkay &&
- session->sslServer->error == WC_NO_ERR_TRACE(WC_PENDING_E) &&
- !session->flags.wasPolled) {
- ret = WC_PENDING_E;
- goto exit_decode;
- }
-#endif
-
-#ifdef WOLFSSL_SNIFFER_STATS
- #ifdef WOLFSSL_ASYNC_CRYPT
- if (session->sslServer->error != WC_NO_ERR_TRACE(WC_PENDING_E))
- #endif
- {
- if (sslBytes > 0) {
- LOCK_STAT();
- NOLOCK_INC_STAT(SnifferStats.sslEncryptedPackets);
- NOLOCK_ADD_TO_STAT(SnifferStats.sslEncryptedBytes, sslBytes);
- UNLOCK_STAT();
- }
- else {
- INC_STAT(SnifferStats.sslDecryptedPackets);
- }
- }
-#endif
-
-#ifdef WOLFSSL_ASYNC_CRYPT
- do {
-#endif
- ret = ProcessMessage(sslFrame, session, sslBytes, data, end, ctx, error);
- session->sslServer->error = ret;
-#ifdef WOLFSSL_ASYNC_CRYPT
- /* capture the seq pending for this session */
- if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
- session->flags.wasPolled = 0;
- session->pendSeq = tcpInfo.sequence;
- if (!asyncOkay || CryptoDeviceId == INVALID_DEVID) {
- /* If devId has not been set then we need to block here by
- * polling and looping */
- wolfSSL_AsyncPoll(session->sslServer, WOLF_POLL_FLAG_CHECK_HW);
- }
- else {
- goto exit_decode; /* return to caller */
- }
- }
- else {
- session->pendSeq = 0;
- }
- } while (ret == WC_NO_ERR_TRACE(WC_PENDING_E));
-#else
- (void)asyncOkay;
-#endif
-
- if (RemoveFatalSession(&ipInfo, &tcpInfo, session, error)) {
- ret = WOLFSSL_SNIFFER_FATAL_ERROR;
- goto exit_decode;
- }
- if (CheckFinCapture(&ipInfo, &tcpInfo, session) == 0) {
- CopySessionInfo(session, sslInfo);
- }
-
-exit_decode:
- if (isChain) {
- XFREE(tmpPacket, NULL, DYNAMIC_TYPE_SNIFFER_CHAIN_BUFFER);
- }
- return ret;
-}
-
-
-/* Passes in an IP/TCP packet for decoding (ethernet/localhost frame) removed */
-/* returns Number of bytes on success, 0 for no data yet, WOLFSSL_SNIFFER_ERROR.
- * on error and WOLFSSL_SNIFFER_FATAL_ERROR on fatal state error */
-/* Also returns Session Info if available */
-int ssl_DecodePacketWithSessionInfo(const unsigned char* packet, int length,
- unsigned char** data, SSLInfo* sslInfo, char* error)
-{
- return ssl_DecodePacketInternal(packet, length, 0, data, sslInfo,
- NULL, error, 0);
-}
-
-
-/* Passes in an IP/TCP packet for decoding (ethernet/localhost frame) removed */
-/* returns Number of bytes on success, 0 for no data yet, WOLFSSL_SNIFFER_ERROR.
- * on error and WOLFSSL_SNIFFER_FATAL_ERROR on fatal state error */
-int ssl_DecodePacket(const byte* packet, int length, byte** data, char* error)
-{
- return ssl_DecodePacketInternal(packet, length, 0, data, NULL, NULL,
- error, 0);
-}
-
-
-#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
-
-/* returns Number of bytes on success, 0 for no data yet, WOLFSSL_SNIFFER_ERROR.
- * on error and WOLFSSL_SNIFFER_FATAL_ERROR on fatal state error */
-int ssl_DecodePacketWithSessionInfoStoreData(const unsigned char* packet,
- int length, void* ctx, SSLInfo* sslInfo, char* error)
-{
- return ssl_DecodePacketInternal(packet, length, 0, NULL, sslInfo,
- ctx, error, 0);
-}
-
-#endif
-
-
-#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
-
-/* returns Number of bytes on success, 0 for no data yet, WOLFSSL_SNIFFER_ERROR.
- * on error and WOLFSSL_SNIFFER_FATAL_ERROR on fatal state error */
-int ssl_DecodePacketWithChain(void* vChain, word32 chainSz, byte** data,
- char* error)
-{
- return ssl_DecodePacketInternal((const byte*)vChain, chainSz, 1, data,
- NULL, NULL, error, 0);
-}
-
-#endif
-
-
-#if defined(WOLFSSL_SNIFFER_CHAIN_INPUT) && \
- defined(WOLFSSL_SNIFFER_STORE_DATA_CB)
-
-/*
- * returns WOLFSSL_SNIFFER_ERROR on error and WOLFSSL_SNIFFER_FATAL_ERROR on
- * fatal state error
- */
-int ssl_DecodePacketWithChainSessionInfoStoreData(void* vChain, word32 chainSz,
- void* ctx, SSLInfo* sslInfo, char* error)
-{
- return ssl_DecodePacketInternal(vChain, chainSz, 1, NULL, sslInfo,
- ctx, error, 0);
-}
-
-#endif
-
-
-/* Deallocator for the decoded data buffer. */
-/* returns 0 on success, -1 on error */
-int ssl_FreeDecodeBuffer(byte** data, char* error)
-{
- return ssl_FreeZeroDecodeBuffer(data, 0, error);
-}
-
-
-/* Deallocator for the decoded data buffer, zeros out buffer. */
-/* returns 0 on success, -1 on error */
-int ssl_FreeZeroDecodeBuffer(byte** data, int sz, char* error)
-{
- (void)error;
-
- if (sz < 0) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- if (data != NULL) {
- ForceZero(*data, (word32)sz);
- XFREE(*data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- *data = NULL;
- }
-
- return 0;
-}
-
-
-/* Enables (if traceFile)/ Disables debug tracing */
-/* returns 0 on success, -1 on error */
-int ssl_Trace(const char* traceFile, char* error)
-{
- if (traceFile) {
- /* Don't try to reopen the file */
- if (TraceFile == NULL) {
- if (XSTRCMP(traceFile, "-") == 0) {
- TraceFile = stdout;
- } else {
- TraceFile = XFOPEN(traceFile, "a");
- if (!TraceFile) {
- SetError(BAD_TRACE_FILE_STR, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
- }
- TraceOn = 1;
- }
- }
- else
- TraceOn = 0;
-
- return 0;
-}
-
-
-/* Enables/Disables Recovery of missed data if later packets allow
- * maxMemory is number of bytes to use for reassembly buffering per session,
- * -1 means unlimited
- * returns 0 on success, -1 on error */
-int ssl_EnableRecovery(int onOff, int maxMemory, char* error)
-{
- (void)error;
-
- RecoveryEnabled = onOff;
- if (onOff)
- MaxRecoveryMemory = maxMemory;
-
- return 0;
-}
-
-
-
-#if defined(WOLFSSL_SESSION_STATS) && !defined(NO_SESSION_CACHE)
-
-int ssl_GetSessionStats(unsigned int* active, unsigned int* total,
- unsigned int* peak, unsigned int* maxSessions,
- unsigned int* missedData, unsigned int* reassemblyMem,
- char* error)
-{
- int ret;
-
- if (missedData) {
- #ifndef WOLFSSL_SNIFFER_NO_RECOVERY
- wc_LockMutex(&RecoveryMutex);
- *missedData = MissedDataSessions;
- wc_UnLockMutex(&RecoveryMutex);
- #endif
- }
-
- if (reassemblyMem) {
- SnifferSession* session;
- int i;
-
- *reassemblyMem = 0;
- LOCK_SESSION();
-
- for (i = 0; i < HASH_SIZE; i++) {
- session = SessionTable[i];
- while (session) {
- *reassemblyMem += session->cliReassemblyMemory;
- *reassemblyMem += session->srvReassemblyMemory;
- session = session->next;
- }
- }
- UNLOCK_SESSION();
- }
-
- ret = wolfSSL_get_session_stats(active, total, peak, maxSessions);
-
- if (ret == WOLFSSL_SUCCESS)
- return 0;
- else {
- SetError(BAD_SESSION_STATS, error, NULL, 0);
- return WOLFSSL_FATAL_ERROR;
- }
-}
-
-#endif
-
-
-
-int ssl_SetConnectionCb(SSLConnCb cb)
-{
- ConnectionCb = cb;
- return 0;
-}
-
-
-
-int ssl_SetConnectionCtx(void* ctx)
-{
- ConnectionCbCtx = ctx;
- return 0;
-}
-
-
-#ifdef WOLFSSL_SNIFFER_STATS
-
-/* Resets the statistics tracking global structure.
- * returns 0 on success, -1 on error */
-int ssl_ResetStatistics(void)
-{
- wc_LockMutex(&StatsMutex);
- XMEMSET(&SnifferStats, 0, sizeof(SSLStats));
- wc_UnLockMutex(&StatsMutex);
- return 0;
-}
-
-
-/* Copies the SSL statistics into the provided stats record.
- * returns 0 on success, -1 on error */
-int ssl_ReadStatistics(SSLStats* stats)
-{
- if (stats == NULL)
- return WOLFSSL_FATAL_ERROR;
-
- LOCK_STAT();
- XMEMCPY(stats, &SnifferStats, sizeof(SSLStats));
- UNLOCK_STAT();
- return 0;
-}
-
-/* Copies the SSL statistics into the provided stats record then
- * resets the statistics tracking global structure.
- * returns 0 on success, -1 on error */
-int ssl_ReadResetStatistics(SSLStats* stats)
-{
- if (stats == NULL)
- return WOLFSSL_FATAL_ERROR;
-
- LOCK_STAT();
- XMEMCPY(stats, &SnifferStats, sizeof(SSLStats));
- XMEMSET(&SnifferStats, 0, sizeof(SSLStats));
- UNLOCK_STAT();
- return 0;
-}
-
-#endif /* WOLFSSL_SNIFFER_STATS */
-
-
-#ifdef WOLFSSL_SNIFFER_WATCH
-
-int ssl_SetWatchKeyCallback_ex(SSLWatchCb cb, int devId, char* error)
-{
-#ifdef WOLF_CRYPTO_CB
- if (CryptoDeviceId == INVALID_DEVID)
- CryptoDeviceId = devId;
-#else
- (void)devId;
-#endif
- WatchCb = cb;
- return CreateWatchSnifferServer(error);
-}
-
-int ssl_SetWatchKeyCallback(SSLWatchCb cb, char* error)
-{
- WatchCb = cb;
- return CreateWatchSnifferServer(error);
-}
-
-int ssl_SetWatchKeyCtx(void* ctx, char* error)
-{
- (void)error;
- WatchCbCtx = ctx;
- return 0;
-}
-
-int ssl_SetWatchKey_buffer(void* vSniffer, const byte* key, word32 keySz,
- int keyType, char* error)
-{
- SnifferSession* sniffer;
- int ret;
-
- if (vSniffer == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
- if (key == NULL || keySz == 0) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- sniffer = (SnifferSession*)vSniffer;
- /* Remap the keyType from what the user can use to
- * what wolfSSL_use_PrivateKey_buffer expects. */
- keyType = (keyType == FILETYPE_PEM) ? WOLFSSL_FILETYPE_PEM :
- WOLFSSL_FILETYPE_ASN1;
-
-#ifdef WOLFSSL_STATIC_EPHEMERAL
- /* try setting static ephemeral first */
- /* auto detect key type with WC_PK_TYPE_NONE */
- ret = wolfSSL_set_ephemeral_key(sniffer->sslServer,
- WC_PK_TYPE_NONE, (const char*)key, keySz,
- WOLFSSL_FILETYPE_ASN1);
- if (ret != 0) {
- #ifdef DEBUG_SNIFFER
- /* print warnings */
- fprintf(stderr, "key watch set ephemeral failed %d\n", ret);
- #endif
- }
-#endif
-
- /* always try and load private key */
- ret = wolfSSL_use_PrivateKey_buffer(sniffer->sslServer,
- key, keySz, keyType);
-
- if (ret != WOLFSSL_SUCCESS) {
- SetError(KEY_FILE_STR, error, sniffer, FATAL_ERROR_STATE);
- return WOLFSSL_FATAL_ERROR;
- }
-
- return 0;
-}
-
-int ssl_SetWatchKey_file(void* vSniffer, const char* keyFile, int keyType,
- const char* password, char* error)
-{
- byte* keyBuf = NULL;
- word32 keyBufSz = 0;
- int ret;
-
- if (vSniffer == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
- if (keyFile == NULL) {
- return WOLFSSL_FATAL_ERROR;
- }
-
- /* Remap the keyType from what the user can use to
- * what LoadKeyFile expects. */
- keyType = (keyType == FILETYPE_PEM) ? WOLFSSL_FILETYPE_PEM :
- WOLFSSL_FILETYPE_ASN1;
-
- ret = LoadKeyFile(&keyBuf, &keyBufSz, keyFile, 0, keyType, password);
- if (ret < 0) {
- SetError(KEY_FILE_STR, error, NULL, 0);
- XFREE(keyBuf, NULL, DYNAMIC_TYPE_X509);
- return WOLFSSL_FATAL_ERROR;
- }
-
- ret = ssl_SetWatchKey_buffer(vSniffer, keyBuf, keyBufSz, FILETYPE_DER,
- error);
- XFREE(keyBuf, NULL, DYNAMIC_TYPE_X509);
-
- return ret;
-}
-
-#endif /* WOLFSSL_SNIFFER_WATCH */
-
-
-#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
-
-int ssl_SetStoreDataCallback(SSLStoreDataCb cb)
-{
- StoreDataCb = cb;
- return 0;
-}
-
-#endif /* WOLFSSL_SNIFFER_STORE_DATA_CB */
-
-#ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
-int ssl_SetKeyCallback(SSLKeyCb cb, void* cbCtx)
-{
- KeyCb = cb;
- KeyCbCtx = cbCtx;
- return 0;
-}
-#endif
-
-#ifdef WOLFSSL_ASYNC_CRYPT
-
-int ssl_DecodePacketAsync(void* packet, unsigned int packetSz,
- int isChain, unsigned char** data, char* error, SSLInfo* sslInfo,
- void* userCtx)
-{
- return ssl_DecodePacketInternal(packet, packetSz, isChain, data, sslInfo,
- userCtx, error, 1);
-}
-
-static SnifferSession* FindSession(WOLFSSL* ssl)
-{
- int i;
- SnifferSession* session;
- for (i = 0; i < HASH_SIZE; i++) {
- session = SessionTable[i];
- while (session) {
- if (session->sslServer == ssl) {
- return session;
- }
- session = session->next;
- }
- }
- return NULL;
-}
-
-int ssl_PollSniffer(WOLF_EVENT** events, int maxEvents, WOLF_EVENT_FLAG flags,
- int* pEventCount)
-{
- int ret = 0;
- int eventCount = 0;
- int i;
- SnifferServer* srv;
-
- LOCK_SERVER_LIST();
-
- /* Iterate the open sniffer sessions calling wolfSSL_CTX_AsyncPoll */
- srv = ServerList;
- while (srv) {
- int nMax = maxEvents - eventCount, nReady = 0;
- if (nMax <= 0) {
- break; /* out of room in events list */
- }
- ret = wolfSSL_CTX_AsyncPoll(srv->ctx, events + nReady, nMax, flags,
- &nReady);
- if (ret == 0) {
- eventCount += nReady;
- }
- else {
- #ifdef DEBUG_SNIFFER
- fprintf(stderr, "Sniffer Server %p: Poll error: %d\n", srv, ret);
- #endif
- break;
- }
- srv = srv->next;
- }
-
- UNLOCK_SERVER_LIST();
-
-
- /* iterate list and mark polled */
- LOCK_SESSION();
- for (i=0; icontext;
- SnifferSession* session = FindSession(ssl);
- if (session) {
- session->flags.wasPolled = 1;
- session->sslServer->error = events[i]->ret;
- }
- }
- UNLOCK_SESSION();
-
- *pEventCount = eventCount;
-
- return ret;
-}
-#endif
-
-
-#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
-
-/* Maximum length of the NSS Keylog prefix string */
-#define MAX_PREFIX_LENGTH (31)
-/* Maximum length (in bytes) required to store the binary representation of
- * the "client random" value parsed from keylog file */
-#define CLIENT_RANDOM_LENGTH (32)
-/* Maximum length (in bytes) required to store the binary representation of the
- * "secret" value parsed from keylog file */
-#define SECRET_LENGTH (48)
-
-typedef struct SecretNode {
- unsigned char clientRandom[CLIENT_RANDOM_LENGTH];
- unsigned char secrets[SNIFFER_SECRET_NUM_SECRET_TYPES][SECRET_LENGTH];
- struct SecretNode* next;
-} SecretNode;
-
-
-/* Default to the same size hash table as the session table,
- * but allow user to override */
-#ifndef WOLFSSL_SNIFFER_KEYLOGFILE_HASH_TABLE_SIZE
-#define WOLFSSL_SNIFFER_KEYLOGFILE_HASH_TABLE_SIZE HASH_SIZE
-#endif
-
-static THREAD_LS_T
-SecretNode*
-secretHashTable[WOLFSSL_SNIFFER_KEYLOGFILE_HASH_TABLE_SIZE] = {NULL};
-#ifndef HAVE_C___ATOMIC
-static WC_THREADSHARED wolfSSL_Mutex secretListMutex WOLFSSL_MUTEX_INITIALIZER_CLAUSE(secretListMutex);
-#endif
-
-static unsigned int secretHashFunction(unsigned char* clientRandom);
-
-#ifdef HAVE_C___ATOMIC
- #define LOCK_SECRET_LIST() WC_DO_NOTHING
- #define UNLOCK_SECRET_LIST() WC_DO_NOTHING
-#else
- #define LOCK_SECRET_LIST() wc_LockMutex(&secretListMutex)
- #define UNLOCK_SECRET_LIST() wc_UnLockMutex(&secretListMutex)
-#endif
-
-
-/*
- * Basic polynomial hash function that maps a 32-byte client random value to an
- * array index
- */
-static unsigned int secretHashFunction(unsigned char* clientRandom)
-{
- int i = 0;
- unsigned int hash = 0;
- const int CLIENT_RANDOM_NUM_BITS = CLIENT_RANDOM_LENGTH * 8;
-
- for (i = 0; i < CLIENT_RANDOM_LENGTH; i++) {
- hash = (hash * CLIENT_RANDOM_NUM_BITS + clientRandom[i])
- % WOLFSSL_SNIFFER_KEYLOGFILE_HASH_TABLE_SIZE;
- }
-
- return hash;
-}
-
-
-/*
- * Adds a new secret to the secret table, creating a new node based on the
- * client random if necessary. If the client random is already present in the
- * list, the requested secret will be updated.
- */
-static int addSecretNode(unsigned char* clientRandom,
- int type,
- unsigned char* secret,
- char* error)
-{
- int idx = 0;
- int ret = 0;
- SecretNode* node = NULL;
-
- if (type >= SNIFFER_SECRET_NUM_SECRET_TYPES) {
- return WOLFSSL_SNIFFER_ERROR;
- }
-
- LOCK_SECRET_LIST();
-
- idx = secretHashFunction(clientRandom);
- node = secretHashTable[idx];
-
- while(node) {
- /* Node already exists, so just add the requested secret */
- if (XMEMCMP(node->clientRandom, clientRandom, CLIENT_RANDOM_LENGTH)
- == 0)
- {
- XMEMCPY(node->secrets[type], secret, SECRET_LENGTH);
- ret = 0;
- goto unlockReturn;
- }
- node = node ->next;
- }
-
- node = (SecretNode*)XMALLOC(sizeof(SecretNode),
- NULL,
- DYNAMIC_TYPE_SNIFFER_KEYLOG_NODE);
- if (node == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- ret = WOLFSSL_SNIFFER_ERROR;
- goto unlockReturn;
- }
-
- XMEMCPY(node->clientRandom, clientRandom, CLIENT_RANDOM_LENGTH);
- XMEMCPY(node->secrets[type], secret, SECRET_LENGTH);
- node->next = secretHashTable[idx];
- secretHashTable[idx] = node;
-
-unlockReturn:
-
- UNLOCK_SECRET_LIST();
-
- return ret;
-}
-
-
-/*
- * Looks up a master secret for a given client random from the keylog file
- */
-static unsigned char* findSecret(unsigned char* clientRandom, int type)
-{
- unsigned char* secret = NULL;
- SecretNode* node = NULL;
- unsigned int idx = 0;
-
- LOCK_SECRET_LIST();
-
- idx = secretHashFunction(clientRandom);
- node = secretHashTable[idx];
-
- while (node != NULL) {
- if (XMEMCMP(node->clientRandom,
- clientRandom, CLIENT_RANDOM_LENGTH) == 0) {
- secret = node->secrets[type];
- break;
- }
- node = node->next;
- }
-
- UNLOCK_SECRET_LIST();
-
- return secret;
-}
-
-
-static void hexToBin(const char* hex, unsigned char* bin, int binLength)
-{
- int i = 0;
- for (i = 0; i < binLength; i++) {
- sscanf(hex + 2*i, "%02hhx", &bin[i]);
- }
-}
-
-/*
- * Helper function to parse secrets from the keylog file into the secret table
- */
-static int parseKeyLogFile(const char* fileName, char* error)
-{
- unsigned char clientRandom[CLIENT_RANDOM_LENGTH];
- unsigned char secret[SECRET_LENGTH];
- FILE* file = NULL;
- int ret = 0;
- int type = 0;
- /* +1 for null terminator */
- char prefix[MAX_PREFIX_LENGTH + 1] = {0};
- /* 2 chars for Hexadecimal representation, plus null terminator */
- char clientRandomHex[2 * CLIENT_RANDOM_LENGTH + 1] = {0};
- char secretHex[2 * SECRET_LENGTH + 1] = {0};
-
-
- file = fopen(fileName, "r");
- if (file == NULL) {
- fprintf(stderr, "Could not open keylog file: %s\n", fileName);
- SetError(KEYLOG_FILE_INVALID, error, NULL, 0);
- return WOLFSSL_SNIFFER_ERROR;
- }
-
- /* Format specifiers for each column should be:
- * MAX_PREFIX_LENGTH, 2*CLIENT_RANDOM_LENGTH, and 2*SECRET_LENGTH */
- while (fscanf(file, "%31s %64s %96s", prefix, clientRandomHex, secretHex)
- == 3) {
-
- if (XSTRCMP(prefix, "CLIENT_RANDOM") == 0) {
- type = SNIFFER_SECRET_TLS12_MASTER_SECRET;
- }
-#if defined(WOLFSSL_TLS13)
- else if (XSTRCMP(prefix, "CLIENT_EARLY_TRAFFIC_SECRET") == 0) {
- type = SNIFFER_SECRET_CLIENT_EARLY_TRAFFIC_SECRET;
- }
- else if (XSTRCMP(prefix, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0) {
- type = SNIFFER_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET;
- }
- else if (XSTRCMP(prefix, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0) {
- type = SNIFFER_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET;
- }
- else if (XSTRCMP(prefix, "CLIENT_TRAFFIC_SECRET_0") == 0) {
- type = SNIFFER_SECRET_CLIENT_TRAFFIC_SECRET;
- }
- else if (XSTRCMP(prefix, "SERVER_TRAFFIC_SECRET_0") == 0) {
- type = SNIFFER_SECRET_SERVER_TRAFFIC_SECRET;
- }
-#endif /* WOLFSSL_TLS13 */
- else {
- fprintf(stderr, "unrecognized prefix: %s\n", prefix);
- continue;
- }
-
- hexToBin(clientRandomHex, clientRandom, CLIENT_RANDOM_LENGTH);
- hexToBin(secretHex, secret, SECRET_LENGTH);
- ret = addSecretNode(clientRandom, type, secret, error);
-
- if (ret != 0) {
- fclose(file);
- return ret;
- }
- }
- fclose(file);
-
- return 0;
-}
-
-
-static void freeSecretList(void)
-{
- int i = 0;
-
- LOCK_SECRET_LIST();
-
- for (i=0; inext;
- XFREE(current, NULL, DYNAMIC_TYPE_SNIFFER_KEYLOG_NODE);
- current = next;
- }
- }
-
- UNLOCK_SECRET_LIST();
-}
-
-
-/*
- * Looks up secret based on client random and copies it to output_secret
- */
-static int snifferSecretCb(unsigned char* client_random,
- int type,
- unsigned char* output_secret)
-{
- unsigned char* secret = NULL;
-
- if (client_random == NULL || output_secret == NULL) {
- return WOLFSSL_SNIFFER_FATAL_ERROR;
- }
-
- if (type >= SNIFFER_SECRET_NUM_SECRET_TYPES) {
- return WOLFSSL_SNIFFER_FATAL_ERROR;
- }
-
- /* get secret from secret table based on client random */
- secret = findSecret(client_random, type);
- if (secret != NULL) {
- XMEMCPY(output_secret, secret, SECRET_LENGTH);
- return 0;
- }
-
- /* didn't find the secret */
- return WOLFSSL_SNIFFER_ERROR;
-}
-
-
-static void setSnifferSecretCb(SnifferSession* session)
-{
- session->context->useKeyLogFile = 1;
- session->sslServer->snifferSecretCb = snifferSecretCb;
- session->sslClient->snifferSecretCb = snifferSecretCb;
-}
-
-
-/*
- * Helper function that creates a sniffer server object that can decrypt using
- * a keylog file, and adds it to the server list
- *
- * NOTE: the caller is responsible for locking and unlocking the server list
- */
-static int addKeyLogSnifferServerHelper(const char* address,
- int port,
- char* error)
-{
- IpAddrInfo serverIp = {0};
- SnifferServer *sniffer = NULL;
-
- TraceHeader();
- TraceSetServer(address, port, NULL);
-
- serverIp.version = IPV4;
- serverIp.ip4 = XINET_ADDR(address);
- if (serverIp.ip4 == XINADDR_NONE) {
- #ifdef FUSION_RTOS
- if (XINET_PTON(AF_INET6, address, serverIp.ip6,
- sizeof(serverIp.ip4)) == 1)
- #else
- if (XINET_PTON(AF_INET6, address, serverIp.ip6) == 1)
- #endif
- {
- serverIp.version = IPV6;
- }
- }
-
- sniffer = ServerList;
- while (sniffer != NULL &&
- (!MatchAddr(sniffer->server, serverIp) || sniffer->port != port)) {
- sniffer = sniffer->next;
- }
-
- if (sniffer == NULL) {
- sniffer = (SnifferServer*)XMALLOC(sizeof(SnifferServer),
- NULL, DYNAMIC_TYPE_SNIFFER_SERVER);
- if (sniffer == NULL) {
- SetError(MEMORY_STR, error, NULL, 0);
- return WOLFSSL_SNIFFER_ERROR;
- }
- InitSnifferServer(sniffer);
-
- XSTRNCPY(sniffer->address, address, MAX_SERVER_ADDRESS-1);
- sniffer->address[MAX_SERVER_ADDRESS-1] = '\0';
- sniffer->server = serverIp;
- sniffer->port = port;
-
- sniffer->ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
- if (!sniffer->ctx) {
- SetError(MEMORY_STR, error, NULL, 0);
- FreeSnifferServer(sniffer);
- return WOLFSSL_SNIFFER_ERROR;
- }
- #if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_ASYNC_CRYPT)
- if (CryptoDeviceId != INVALID_DEVID)
- wolfSSL_CTX_SetDevId(sniffer->ctx, CryptoDeviceId);
- #endif
-
- sniffer->next = ServerList;
- ServerList = sniffer;
- }
- else {
- printf("SESSION ALREADY EXISTS\n");
- }
-
- /* Tag the new or existing server as requiring keylog support to
- * decrypt, otherwise it won't be usable */
- sniffer->useKeyLogFile = 1;
-
- return 0;
-}
-
-/*
- * Creates a sniffer server that is able to decrypt using secrets from a
- * keylog file, and adds it to the server list
- *
- * If a server at the address and port already exists, it will be marked
- * for keylog file decryption
- */
-int ssl_CreateKeyLogSnifferServer(const char* address, int port, char* error)
-{
- int ret = 0;
-
- if (address == NULL) {
- SetError(KEYLOG_FILE_INVALID, error, NULL, 0);
- return WOLFSSL_SNIFFER_ERROR;
- }
-
- LOCK_SERVER_LIST();
-
- ret = addKeyLogSnifferServerHelper(address, port, error);
-
- UNLOCK_SERVER_LIST();
-
- return ret;
-}
-
-
-/*
- * Loads secrets to decrypt TLS traffic from a keylog file. Only sniffer
- * servers registered with ssl_createKeyLogSnifferServer() will be able to
- * decrypt using these secrets
- */
-int ssl_LoadSecretsFromKeyLogFile(const char* keylogfile, char* error)
-{
- if (keylogfile == NULL) {
- SetError(KEYLOG_FILE_INVALID, error, NULL, 0);
- return WOLFSSL_SNIFFER_ERROR;
- }
-
- return parseKeyLogFile(keylogfile, error);
-}
-
-#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
-
-
-/*
- * Removes a session from the SessionTable based on client/server IP & ports
- * Returns 0 if a session was found and freed, -1 otherwise
- */
-int ssl_RemoveSession(const char* clientIp, int clientPort,
- const char* serverIp, int serverPort,
- char* error)
-{
- IpAddrInfo clientAddr;
- IpAddrInfo serverAddr;
- IpInfo ipInfo;
- TcpInfo tcpInfo;
- SnifferSession* session;
- int ret = -1; /* Default to not found */
- word32 row;
-
- if (clientIp == NULL || serverIp == NULL) {
- SetError(BAD_IPVER_STR, error, NULL, 0);
- return ret;
- }
-
- /* Set up client IP address */
- clientAddr.version = IPV4;
- clientAddr.ip4 = XINET_ADDR(clientIp);
- if (clientAddr.ip4 == XINADDR_NONE) {
- #ifdef FUSION_RTOS
- if (XINET_PTON(AF_INET6, clientIp, clientAddr.ip6,
- sizeof(clientAddr.ip4)) == 1)
- #else
- if (XINET_PTON(AF_INET6, clientIp, clientAddr.ip6) == 1)
- #endif
- {
- clientAddr.version = IPV6;
- }
- else {
- SetError(BAD_IPVER_STR, error, NULL, 0);
- return ret;
- }
- }
-
- /* Set up server IP address */
- serverAddr.version = IPV4;
- serverAddr.ip4 = XINET_ADDR(serverIp);
- if (serverAddr.ip4 == XINADDR_NONE) {
- #ifdef FUSION_RTOS
- if (XINET_PTON(AF_INET6, serverIp, serverAddr.ip6,
- sizeof(serverAddr.ip4)) == 1)
- #else
- if (XINET_PTON(AF_INET6, serverIp, serverAddr.ip6) == 1)
- #endif
- {
- serverAddr.version = IPV6;
- }
- else {
- SetError(BAD_IPVER_STR, error, NULL, 0);
- return ret;
- }
- }
-
- XMEMSET(&ipInfo, 0, sizeof(ipInfo));
- XMEMSET(&tcpInfo, 0, sizeof(tcpInfo));
-
- /* Set up client->server direction */
- ipInfo.src = clientAddr;
- ipInfo.dst = serverAddr;
- tcpInfo.srcPort = clientPort;
- tcpInfo.dstPort = serverPort;
-
- /* Calculate the hash row for this session */
- row = SessionHash(&ipInfo, &tcpInfo);
-
- LOCK_SESSION();
-
- /* Search only the specific row in the session table */
- session = SessionTable[row];
-
- while (session) {
- SnifferSession* next = session->next;
-
- /* Check if this session matches the specified client/server IP/port */
- if (MatchAddr(session->client, clientAddr) &&
- MatchAddr(session->server, serverAddr) &&
- session->cliPort == clientPort &&
- session->srvPort == serverPort) {
-
- /* Use RemoveSession to remove and free the session */
- RemoveSession(session, NULL, NULL, row);
- ret = 0; /* Session found and freed */
- break;
- }
-
- session = next;
- }
-
- UNLOCK_SESSION();
-
- return ret;
-}
-
-
-#undef ERROR_OUT
-
-#endif /* WOLFSSL_SNIFFER */
-#endif /* !WOLFCRYPT_ONLY && !NO_FILESYSTEM */
diff --git a/src/ssl/wolfssl/wolfcrypt/aes.c b/src/ssl/wolfssl/wolfcrypt/aes.c
deleted file mode 100644
index 4c43d4ebd..000000000
--- a/src/ssl/wolfssl/wolfcrypt/aes.c
+++ /dev/null
@@ -1,16449 +0,0 @@
-/* aes.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*
-
-DESCRIPTION
-This library provides the interfaces to the Advanced Encryption Standard (AES)
-for encrypting and decrypting data. AES is the standard known for a symmetric
-block cipher mechanism that uses n-bit binary string parameter key with 128-bits,
-192-bits, and 256-bits of key sizes.
-
-*/
-
-#include
-
-#if !defined(NO_AES)
-
-/* Tip: Locate the software cipher modes by searching for "Software AES" */
-
-#if FIPS_VERSION3_GE(2,0,0)
- /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
- #define FIPS_NO_WRAPPERS
-
- #ifdef USE_WINDOWS_API
- #pragma code_seg(".fipsA$b")
- #pragma const_seg(".fipsB$b")
- #endif
-#endif
-
-#include
-
-#ifdef WOLFSSL_AESNI
-#include
-#include
-#include
-#endif /* WOLFSSL_AESNI */
-
-#include
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#ifdef WOLFSSL_SECO_CAAM
-#include
-#endif
-
-#ifdef WOLFSSL_IMXRT_DCP
- #include
-#endif
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- #include
-#endif
-
-#if defined(WOLFSSL_AES_SIV)
- #include
-#endif /* WOLFSSL_AES_SIV */
-
-#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- #include
-#endif
-
-#if defined(WOLFSSL_MAX3266X) || defined(WOLFSSL_MAX3266X_OLD)
- #include
-#ifdef MAX3266X_CB
- /* Revert back to SW so HW CB works */
- /* HW only works for AES: ECB, CBC, and partial via ECB for other modes */
- #include
- /* Turn off MAX3266X_AES in the context of this file when using CB */
- #undef MAX3266X_AES
-#endif
-#endif
-
-#if defined(WOLFSSL_TI_CRYPT)
- #include
-#else
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#if !defined(WOLFSSL_RISCV_ASM)
-
-#ifdef WOLFSSL_IMX6_CAAM_BLOB
- /* case of possibly not using hardware acceleration for AES but using key
- blobs */
- #include
-#endif
-
-#ifdef DEBUG_AESNI
- #include
-#endif
-
-#ifdef _MSC_VER
- /* 4127 warning constant while(1) */
- #pragma warning(disable: 4127)
-#endif
-
-#if (!defined(WOLFSSL_ARMASM) && FIPS_VERSION3_GE(6,0,0)) || \
- FIPS_VERSION3_GE(7,0,0)
- const unsigned int wolfCrypt_FIPS_aes_ro_sanity[2] =
- { 0x1a2b3c4d, 0x00000002 };
- int wolfCrypt_FIPS_AES_sanity(void)
- {
- return 0;
- }
-#endif
-
-/* Define AES implementation includes and functions */
-#if defined(STM32_CRYPTO)
- /* STM32F2/F4/F7/L4/L5/H7/WB55 hardware AES support for ECB, CBC, CTR and GCM modes */
-
-#if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
-
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- int ret = 0;
- #ifdef WOLFSSL_STM32_CUBEMX
- CRYP_HandleTypeDef hcryp;
- #else
- CRYP_InitTypeDef cryptInit;
- CRYP_KeyInitTypeDef keyInit;
- #endif
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- #ifdef WOLFSSL_STM32U5_DHUK
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- /* Handle making use of wrapped key */
- if (aes->devId == WOLFSSL_STM32U5_DHUK_WRAPPED_DEVID) {
- CRYP_ConfigTypeDef Config = {0};
-
- ret = wc_Stm32_Aes_UnWrap(aes, &hcryp, (const byte*)aes->key,
- aes->keylen, aes->dhukIV, aes->dhukIVLen);
- if (ret != HAL_OK) {
- WOLFSSL_MSG("Error with DHUK key unwrap");
- ret = BAD_FUNC_ARG;
- }
- /* reconfigure for using unwrapped key now */
- HAL_CRYP_GetConfig(&hcryp, &Config);
- Config.KeyMode = CRYP_KEYMODE_NORMAL;
- Config.KeySelect = CRYP_KEYSEL_NORMAL;
- Config.Algorithm = CRYP_AES_ECB;
- Config.DataType = CRYP_DATATYPE_8B;
- Config.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
- HAL_CRYP_SetConfig(&hcryp, &Config);
- }
- else {
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 1);
- if (ret == 0) {
- hcryp.Init.Algorithm = CRYP_AES_ECB;
- ret = HAL_CRYP_Init(&hcryp);
- if (ret != HAL_OK) {
- ret = BAD_FUNC_ARG;
- }
- }
- }
-
- if (ret == HAL_OK) {
- ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,
- (uint32_t*)outBlock, STM32_HAL_TIMEOUT);
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
- }
- HAL_CRYP_DeInit(&hcryp);
- #elif defined(WOLFSSL_STM32_CUBEMX)
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- #if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_ECB;
- #elif defined(STM32_CRYPTO_AES_ONLY)
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_ECB;
- hcryp.Init.KeyWriteFlag = CRYP_KEY_WRITE_ENABLE;
- #endif
- if (HAL_CRYP_Init(&hcryp) != HAL_OK) {
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- #if defined(STM32_HAL_V2)
- ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,
- (uint32_t*)outBlock, STM32_HAL_TIMEOUT);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,
- outBlock, STM32_HAL_TIMEOUT);
- #else
- ret = HAL_CRYP_AESECB_Encrypt(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,
- outBlock, STM32_HAL_TIMEOUT);
- #endif
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
- HAL_CRYP_DeInit(&hcryp);
- }
-
- #else /* Standard Peripheral Library */
- ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* setup key */
- CRYP_KeyInit(&keyInit);
-
- /* set direction and mode */
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&inBlock[0]);
- CRYP_DataIn(*(uint32_t*)&inBlock[4]);
- CRYP_DataIn(*(uint32_t*)&inBlock[8]);
- CRYP_DataIn(*(uint32_t*)&inBlock[12]);
-
- /* wait until the complete message has been processed */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&outBlock[0] = CRYP_DataOut();
- *(uint32_t*)&outBlock[4] = CRYP_DataOut();
- *(uint32_t*)&outBlock[8] = CRYP_DataOut();
- *(uint32_t*)&outBlock[12] = CRYP_DataOut();
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- #endif /* WOLFSSL_STM32_CUBEMX */
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
-#endif /* WOLFSSL_AES_DIRECT || HAVE_AESGCM || HAVE_AESCCM */
-
-#ifdef HAVE_AES_DECRYPT
- #if defined(WOLFSSL_AES_DIRECT)
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- int ret = 0;
- #ifdef WOLFSSL_STM32_CUBEMX
- CRYP_HandleTypeDef hcryp;
- #else
- CRYP_InitTypeDef cryptInit;
- CRYP_KeyInitTypeDef keyInit;
- #endif
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- #ifdef WOLFSSL_STM32U5_DHUK
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- /* Handle making use of wrapped key */
- if (aes->devId == WOLFSSL_STM32U5_DHUK_WRAPPED_DEVID) {
- CRYP_ConfigTypeDef Config;
-
- XMEMSET(&Config, 0, sizeof(Config));
- ret = wc_Stm32_Aes_UnWrap(aes, &hcryp, (const byte*)aes->key,
- aes->keylen, aes->dhukIV, aes->dhukIVLen);
- if (ret != HAL_OK) {
- WOLFSSL_MSG("Error with DHUK unwrap");
- ret = BAD_FUNC_ARG;
- }
- /* reconfigure for using unwrapped key now */
- HAL_CRYP_GetConfig(&hcryp, &Config);
- Config.KeyMode = CRYP_KEYMODE_NORMAL;
- Config.KeySelect = CRYP_KEYSEL_NORMAL;
- Config.Algorithm = CRYP_AES_ECB;
- Config.DataType = CRYP_DATATYPE_8B;
- Config.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
- HAL_CRYP_SetConfig(&hcryp, &Config);
- }
- else {
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 1);
- if (ret == 0) {
- hcryp.Init.Algorithm = CRYP_AES_ECB;
- ret = HAL_CRYP_Init(&hcryp);
- if (ret != HAL_OK) {
- ret = BAD_FUNC_ARG;
- }
- }
- }
-
- if (ret == HAL_OK) {
- ret = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,
- (uint32_t*)outBlock, STM32_HAL_TIMEOUT);
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
- }
- HAL_CRYP_DeInit(&hcryp);
- #elif defined(WOLFSSL_STM32_CUBEMX)
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- #if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_ECB;
- #elif defined(STM32_CRYPTO_AES_ONLY)
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_KEYDERIVATION_DECRYPT;
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_ECB;
- hcryp.Init.KeyWriteFlag = CRYP_KEY_WRITE_ENABLE;
- #endif
- HAL_CRYP_Init(&hcryp);
-
- #if defined(STM32_HAL_V2)
- ret = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,
- (uint32_t*)outBlock, STM32_HAL_TIMEOUT);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,
- outBlock, STM32_HAL_TIMEOUT);
- #else
- ret = HAL_CRYP_AESECB_Decrypt(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,
- outBlock, STM32_HAL_TIMEOUT);
- #endif
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
- HAL_CRYP_DeInit(&hcryp);
-
- #else /* Standard Peripheral Library */
- ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set direction and key */
- CRYP_KeyInit(&keyInit);
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- /* wait until decrypt key has been initialized */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- /* set direction and mode */
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&inBlock[0]);
- CRYP_DataIn(*(uint32_t*)&inBlock[4]);
- CRYP_DataIn(*(uint32_t*)&inBlock[8]);
- CRYP_DataIn(*(uint32_t*)&inBlock[12]);
-
- /* wait until the complete message has been processed */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&outBlock[0] = CRYP_DataOut();
- *(uint32_t*)&outBlock[4] = CRYP_DataOut();
- *(uint32_t*)&outBlock[8] = CRYP_DataOut();
- *(uint32_t*)&outBlock[12] = CRYP_DataOut();
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- #endif /* WOLFSSL_STM32_CUBEMX */
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #endif /* WOLFSSL_AES_DIRECT */
-#endif /* HAVE_AES_DECRYPT */
-
-#elif defined(HAVE_COLDFIRE_SEC)
- /* Freescale Coldfire SEC support for CBC mode.
- * NOTE: no support for AES-CTR/GCM/CCM/Direct */
- #include "sec.h"
- #include "mcf5475_sec.h"
- #include "mcf5475_siu.h"
-#elif defined(FREESCALE_LTC)
- #include "fsl_ltc.h"
- #if defined(FREESCALE_LTC_AES_GCM)
- #undef NEED_AES_TABLES
- #undef GCM_TABLE
- #endif
-
- /* if LTC doesn't have GCM, use software with LTC AES ECB mode */
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- word32 keySize = 0;
- byte* key = (byte*)aes->key;
- int ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0)
- return ret;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- if (wolfSSL_CryptHwMutexLock() == 0) {
- LTC_AES_EncryptEcb(LTC_BASE, inBlock, outBlock, WC_AES_BLOCK_SIZE,
- key, keySize);
- wolfSSL_CryptHwMutexUnLock();
- }
- return 0;
- }
- #ifdef HAVE_AES_DECRYPT
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- word32 keySize = 0;
- byte* key = (byte*)aes->key;
- int ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0)
- return ret;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- if (wolfSSL_CryptHwMutexLock() == 0) {
- LTC_AES_DecryptEcb(LTC_BASE, inBlock, outBlock, WC_AES_BLOCK_SIZE,
- key, keySize, kLTC_EncryptKey);
- wolfSSL_CryptHwMutexUnLock();
- }
- return 0;
- }
- #endif
-
-#elif defined(FREESCALE_MMCAU)
- /* Freescale mmCAU hardware AES support for Direct, CBC, CCM, GCM modes
- * through the CAU/mmCAU library. Documentation located in
- * ColdFire/ColdFire+ CAU and Kinetis mmCAU Software Library User
- * Guide (See note in README). */
- #ifdef FREESCALE_MMCAU_CLASSIC
- /* MMCAU 1.4 library used with non-KSDK / classic MQX builds */
- #include "cau_api.h"
- #else
- #include "fsl_mmcau.h"
- #endif
-
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- if (wolfSSL_CryptHwMutexLock() == 0) {
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)outBlock % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_aes_encrypt alignment");
- return BAD_ALIGN_E;
- }
- cau_aes_encrypt(inBlock, (byte*)aes->key, aes->rounds, outBlock);
- #else
- MMCAU_AES_EncryptEcb(inBlock, (byte*)aes->key, aes->rounds,
- outBlock);
- #endif
- wolfSSL_CryptHwMutexUnLock();
- }
- return 0;
- }
- #ifdef HAVE_AES_DECRYPT
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- if (wolfSSL_CryptHwMutexLock() == 0) {
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)outBlock % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_aes_decrypt alignment");
- return BAD_ALIGN_E;
- }
- cau_aes_decrypt(inBlock, (byte*)aes->key, aes->rounds, outBlock);
- #else
- MMCAU_AES_DecryptEcb(inBlock, (byte*)aes->key, aes->rounds,
- outBlock);
- #endif
- wolfSSL_CryptHwMutexUnLock();
- }
- return 0;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(WOLFSSL_PIC32MZ_CRYPT)
-
- #include
-
- #if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT)
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- /* Thread mutex protection handled in Pic32Crypto */
- return wc_Pic32AesCrypt(aes->key, aes->keylen, NULL, 0,
- outBlock, inBlock, WC_AES_BLOCK_SIZE,
- PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB);
- }
- #endif
-
- #if defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT)
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- /* Thread mutex protection handled in Pic32Crypto */
- return wc_Pic32AesCrypt(aes->key, aes->keylen, NULL, 0,
- outBlock, inBlock, WC_AES_BLOCK_SIZE,
- PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB);
- }
- #endif
-
-#elif defined(WOLFSSL_NRF51_AES)
- /* Use built-in AES hardware - AES 128 ECB Encrypt Only */
- #include "wolfssl/wolfcrypt/port/nrf51.h"
-
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- int ret;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret == 0) {
- ret = nrf51_aes_encrypt(inBlock, (byte*)aes->key, aes->rounds,
- outBlock);
- wolfSSL_CryptHwMutexUnLock();
- }
- return ret;
- }
-
- #ifdef HAVE_AES_DECRYPT
- #error nRF51 AES Hardware does not support decrypt
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(WOLFSSL_ESP32_CRYPT) && \
- !defined(NO_WOLFSSL_ESP32_CRYPT_AES)
- #include
- #include
- #define TAG "aes"
-
- /* We'll use SW for fallback:
- * unsupported key lengths. (e.g. ESP32-S3)
- * chipsets not implemented.
- * hardware busy. */
- #define NEED_AES_TABLES
- #define NEED_AES_HW_FALLBACK
- #define NEED_SOFTWARE_AES_SETKEY
- #undef WOLFSSL_AES_DIRECT
- #define WOLFSSL_AES_DIRECT
-
- /* Encrypt: If we choose to never have a fallback to SW: */
- #if !defined(NEED_AES_HW_FALLBACK) && \
- (defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT))
- /* calling this one when NO_AES_192 is defined */
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- int ret;
-
- #ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- #endif
-
- /* Thread mutex protection handled in esp_aes_hw_InUse */
- #ifdef NEED_AES_HW_FALLBACK
- if (wc_esp32AesSupportedKeyLen(aes)) {
- ret = wc_esp32AesEncrypt(aes, inBlock, outBlock);
- }
- #else
- ret = wc_esp32AesEncrypt(aes, inBlock, outBlock);
- #endif
- return ret;
- }
- #endif
-
- /* Decrypt: If we choose to never have a fallback to SW: */
- #if !defined(NEED_AES_HW_FALLBACK) && \
- (defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT))
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
- int ret = 0;
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
- /* Thread mutex protection handled in esp_aes_hw_InUse */
- #ifdef NEED_AES_HW_FALLBACK
- if (wc_esp32AesSupportedKeyLen(aes)) {
- ret = wc_esp32AesDecrypt(aes, inBlock, outBlock);
- }
- else {
- ret = wc_AesDecrypt_SW(aes, inBlock, outBlock);
- }
- #else
- /* if we don't need fallback, always use HW */
- ret = wc_esp32AesDecrypt(aes, inBlock, outBlock);
- #endif
- return ret;
- }
- #endif
-
-#elif defined(WOLFSSL_AESNI)
-
- #define NEED_AES_TABLES
-
- /* Each platform needs to query info type 1 from cpuid to see if aesni is
- * supported. Also, let's setup a macro for proper linkage w/o ABI conflicts
- */
-
- #ifndef AESNI_ALIGN
- #define AESNI_ALIGN 16
- #endif
-
- /* note that all write access to these static variables must be idempotent,
- * as arranged by Check_CPU_support_AES(), else they will be susceptible to
- * data races.
- */
- static int checkedAESNI = 0;
- static int haveAESNI = 0;
- static cpuid_flags_t intel_flags = WC_CPUID_INITIALIZER;
-
- static WARN_UNUSED_RESULT int Check_CPU_support_AES(void)
- {
- cpuid_get_flags_ex(&intel_flags);
-
- return IS_INTEL_AESNI(intel_flags) != 0;
- }
-
-
- /* tell C compiler these are asm functions in case any mix up of ABI underscore
- prefix between clang/gcc/llvm etc */
- #ifdef HAVE_AES_CBC
- void AES_CBC_encrypt_AESNI(const unsigned char* in, unsigned char* out,
- unsigned char* ivec, unsigned long length,
- const unsigned char* KS, int nr)
- XASM_LINK("AES_CBC_encrypt_AESNI");
-
- #ifdef HAVE_AES_DECRYPT
- #if defined(WOLFSSL_AESNI_BY4) || defined(WOLFSSL_X86_BUILD)
- void AES_CBC_decrypt_AESNI_by4(const unsigned char* in, unsigned char* out,
- unsigned char* ivec, unsigned long length,
- const unsigned char* KS, int nr)
- XASM_LINK("AES_CBC_decrypt_AESNI_by4");
- #elif defined(WOLFSSL_AESNI_BY6)
- void AES_CBC_decrypt_AESNI_by6(const unsigned char* in, unsigned char* out,
- unsigned char* ivec, unsigned long length,
- const unsigned char* KS, int nr)
- XASM_LINK("AES_CBC_decrypt_AESNI_by6");
- #else /* WOLFSSL_AESNI_BYx */
- void AES_CBC_decrypt_AESNI_by8(const unsigned char* in, unsigned char* out,
- unsigned char* ivec, unsigned long length,
- const unsigned char* KS, int nr)
- XASM_LINK("AES_CBC_decrypt_AESNI_by8");
- #endif /* WOLFSSL_AESNI_BYx */
- #endif /* HAVE_AES_DECRYPT */
- #endif /* HAVE_AES_CBC */
-
- void AES_ECB_encrypt_AESNI(const unsigned char* in, unsigned char* out,
- unsigned long length, const unsigned char* KS, int nr)
- XASM_LINK("AES_ECB_encrypt_AESNI");
-
- #ifdef HAVE_AES_DECRYPT
- void AES_ECB_decrypt_AESNI(const unsigned char* in, unsigned char* out,
- unsigned long length, const unsigned char* KS, int nr)
- XASM_LINK("AES_ECB_decrypt_AESNI");
- #endif
-
- void AES_128_Key_Expansion_AESNI(const unsigned char* userkey,
- unsigned char* key_schedule)
- XASM_LINK("AES_128_Key_Expansion_AESNI");
-
- void AES_192_Key_Expansion_AESNI(const unsigned char* userkey,
- unsigned char* key_schedule)
- XASM_LINK("AES_192_Key_Expansion_AESNI");
-
- void AES_256_Key_Expansion_AESNI(const unsigned char* userkey,
- unsigned char* key_schedule)
- XASM_LINK("AES_256_Key_Expansion_AESNI");
-
-
- static WARN_UNUSED_RESULT int AES_set_encrypt_key_AESNI(
- const unsigned char *userKey, const int bits, Aes* aes)
- {
- int ret;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (!userKey || !aes)
- return BAD_FUNC_ARG;
-
- switch (bits) {
- case 128:
- AES_128_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 10;
- return 0;
- case 192:
- AES_192_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 12;
- return 0;
- case 256:
- AES_256_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 14;
- return 0;
- default:
- ret = BAD_FUNC_ARG;
- }
-
- return ret;
- }
-
- #ifdef HAVE_AES_DECRYPT
- static WARN_UNUSED_RESULT int AES_set_decrypt_key_AESNI(
- const unsigned char* userKey, const int bits, Aes* aes)
- {
- word32 nr;
- WC_DECLARE_VAR(temp_key, Aes, 1, 0);
- __m128i *Key_Schedule;
- __m128i *Temp_Key_Schedule;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (!userKey || !aes)
- return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_SMALL_STACK
- if ((temp_key = (Aes *)XMALLOC(sizeof *aes, aes->heap,
- DYNAMIC_TYPE_AES)) == NULL)
- return MEMORY_E;
-#endif
-
- if (AES_set_encrypt_key_AESNI(userKey,bits,temp_key)
- == WC_NO_ERR_TRACE(BAD_FUNC_ARG)) {
- WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES);
- return BAD_FUNC_ARG;
- }
-
- Key_Schedule = (__m128i*)aes->key;
- Temp_Key_Schedule = (__m128i*)temp_key->key;
-
- nr = temp_key->rounds;
- aes->rounds = nr;
-
- Key_Schedule[nr] = Temp_Key_Schedule[0];
- Key_Schedule[nr-1] = _mm_aesimc_si128(Temp_Key_Schedule[1]);
- Key_Schedule[nr-2] = _mm_aesimc_si128(Temp_Key_Schedule[2]);
- Key_Schedule[nr-3] = _mm_aesimc_si128(Temp_Key_Schedule[3]);
- Key_Schedule[nr-4] = _mm_aesimc_si128(Temp_Key_Schedule[4]);
- Key_Schedule[nr-5] = _mm_aesimc_si128(Temp_Key_Schedule[5]);
- Key_Schedule[nr-6] = _mm_aesimc_si128(Temp_Key_Schedule[6]);
- Key_Schedule[nr-7] = _mm_aesimc_si128(Temp_Key_Schedule[7]);
- Key_Schedule[nr-8] = _mm_aesimc_si128(Temp_Key_Schedule[8]);
- Key_Schedule[nr-9] = _mm_aesimc_si128(Temp_Key_Schedule[9]);
-
- if (nr>10) {
- Key_Schedule[nr-10] = _mm_aesimc_si128(Temp_Key_Schedule[10]);
- Key_Schedule[nr-11] = _mm_aesimc_si128(Temp_Key_Schedule[11]);
- }
-
- if (nr>12) {
- Key_Schedule[nr-12] = _mm_aesimc_si128(Temp_Key_Schedule[12]);
- Key_Schedule[nr-13] = _mm_aesimc_si128(Temp_Key_Schedule[13]);
- }
-
- Key_Schedule[0] = Temp_Key_Schedule[nr];
-
- WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES);
-
- return 0;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-
- #define NEED_AES_TABLES
-
- static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;
-
- static void Check_CPU_support_HwCrypto(Aes* aes)
- {
- cpuid_get_flags_ex(&cpuid_flags);
- aes->use_aes_hw_crypto = IS_AARCH64_AES(cpuid_flags);
- #ifdef HAVE_AESGCM
- aes->use_pmull_hw_crypto = IS_AARCH64_PMULL(cpuid_flags);
- aes->use_sha3_hw_crypto = IS_AARCH64_SHA3(cpuid_flags);
- #endif
- }
-
-#elif !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-
-#if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESCCM)
-static WARN_UNUSED_RESULT int wc_AesEncrypt(Aes* aes, const byte* inBlock,
- byte* outBlock)
-{
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_encrypt_AARCH32(inBlock, outBlock, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_encrypt(inBlock, outBlock, WC_AES_BLOCK_SIZE, (byte*)aes->key,
- (int)aes->rounds);
-#endif
- return 0;
-}
-#endif
-
-#ifdef HAVE_AES_DECRYPT
-#ifdef WOLFSSL_AES_DIRECT
-static WARN_UNUSED_RESULT int wc_AesDecrypt(Aes* aes, const byte* inBlock,
- byte* outBlock)
-{
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_decrypt_AARCH32(inBlock, outBlock, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_decrypt(inBlock, outBlock, WC_AES_BLOCK_SIZE, (byte*)aes->key,
- (int)aes->rounds);
-#endif
- return 0;
-}
-#endif
-#endif
-
-#elif (defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) \
- && !defined(WOLFSSL_QNX_CAAM)) || \
- ((defined(WOLFSSL_AFALG) || defined(WOLFSSL_DEVCRYPTO_AES)) && \
- defined(HAVE_AESCCM))
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret =
- wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- return wc_AesEncryptDirect(aes, outBlock, inBlock);
- }
-
-#elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
-#elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypto/devcrypto_aes.c */
-
-#elif defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
- #include "hal_data.h"
-
- #ifndef WOLFSSL_SCE_AES256_HANDLE
- #define WOLFSSL_SCE_AES256_HANDLE g_sce_aes_256
- #endif
-
- #ifndef WOLFSSL_SCE_AES192_HANDLE
- #define WOLFSSL_SCE_AES192_HANDLE g_sce_aes_192
- #endif
-
- #ifndef WOLFSSL_SCE_AES128_HANDLE
- #define WOLFSSL_SCE_AES128_HANDLE g_sce_aes_128
- #endif
-
- static WARN_UNUSED_RESULT int AES_ECB_encrypt(
- Aes* aes, const byte* inBlock, byte* outBlock, int sz)
- {
- word32 ret;
-
- if (WOLFSSL_SCE_GSCE_HANDLE.p_cfg->endian_flag ==
- CRYPTO_WORD_ENDIAN_BIG) {
- ByteReverseWords((word32*)inBlock, (word32*)inBlock, sz);
- }
-
- switch (aes->keylen) {
- #ifdef WOLFSSL_AES_128
- case AES_128_KEY_SIZE:
- ret = WOLFSSL_SCE_AES128_HANDLE.p_api->encrypt(
- WOLFSSL_SCE_AES128_HANDLE.p_ctrl, aes->key,
- NULL, (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- #ifdef WOLFSSL_AES_192
- case AES_192_KEY_SIZE:
- ret = WOLFSSL_SCE_AES192_HANDLE.p_api->encrypt(
- WOLFSSL_SCE_AES192_HANDLE.p_ctrl, aes->key,
- NULL, (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- #ifdef WOLFSSL_AES_256
- case AES_256_KEY_SIZE:
- ret = WOLFSSL_SCE_AES256_HANDLE.p_api->encrypt(
- WOLFSSL_SCE_AES256_HANDLE.p_ctrl, aes->key,
- NULL, (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- default:
- WOLFSSL_MSG("Unknown key size");
- return BAD_FUNC_ARG;
- }
-
- if (ret != SSP_SUCCESS) {
- /* revert input */
- ByteReverseWords((word32*)inBlock, (word32*)inBlock, sz);
- return WC_HW_E;
- }
-
- if (WOLFSSL_SCE_GSCE_HANDLE.p_cfg->endian_flag ==
- CRYPTO_WORD_ENDIAN_BIG) {
- ByteReverseWords((word32*)outBlock, (word32*)outBlock, sz);
- if (inBlock != outBlock) {
- /* revert input */
- ByteReverseWords((word32*)inBlock, (word32*)inBlock, sz);
- }
- }
- return 0;
- }
-
- #if defined(HAVE_AES_DECRYPT)
- static WARN_UNUSED_RESULT int AES_ECB_decrypt(
- Aes* aes, const byte* inBlock, byte* outBlock, int sz)
- {
- word32 ret;
-
- if (WOLFSSL_SCE_GSCE_HANDLE.p_cfg->endian_flag ==
- CRYPTO_WORD_ENDIAN_BIG) {
- ByteReverseWords((word32*)inBlock, (word32*)inBlock, sz);
- }
-
- switch (aes->keylen) {
- #ifdef WOLFSSL_AES_128
- case AES_128_KEY_SIZE:
- ret = WOLFSSL_SCE_AES128_HANDLE.p_api->decrypt(
- WOLFSSL_SCE_AES128_HANDLE.p_ctrl, aes->key, aes->reg,
- (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- #ifdef WOLFSSL_AES_192
- case AES_192_KEY_SIZE:
- ret = WOLFSSL_SCE_AES192_HANDLE.p_api->decrypt(
- WOLFSSL_SCE_AES192_HANDLE.p_ctrl, aes->key, aes->reg,
- (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- #ifdef WOLFSSL_AES_256
- case AES_256_KEY_SIZE:
- ret = WOLFSSL_SCE_AES256_HANDLE.p_api->decrypt(
- WOLFSSL_SCE_AES256_HANDLE.p_ctrl, aes->key, aes->reg,
- (sz / sizeof(word32)), (word32*)inBlock,
- (word32*)outBlock);
- break;
- #endif
- default:
- WOLFSSL_MSG("Unknown key size");
- return BAD_FUNC_ARG;
- }
- if (ret != SSP_SUCCESS) {
- return WC_HW_E;
- }
-
- if (WOLFSSL_SCE_GSCE_HANDLE.p_cfg->endian_flag ==
- CRYPTO_WORD_ENDIAN_BIG) {
- ByteReverseWords((word32*)outBlock, (word32*)outBlock, sz);
- if (inBlock != outBlock) {
- /* revert input */
- ByteReverseWords((word32*)inBlock, (word32*)inBlock, sz);
- }
- }
-
- return 0;
- }
- #endif /* HAVE_AES_DECRYPT */
-
- #if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT)
- static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- return AES_ECB_encrypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE);
- }
- #endif
-
- #if defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT)
- static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
- {
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
- return AES_ECB_decrypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE);
- }
- #endif
-
-#elif defined(WOLFSSL_KCAPI_AES)
- /* Only CBC and GCM are in wolfcrypt/src/port/kcapi/kcapi_aes.c */
- #if defined(WOLFSSL_AES_COUNTER) || defined(HAVE_AESCCM) || \
- defined(WOLFSSL_CMAC) || defined(WOLFSSL_AES_OFB) || \
- defined(WOLFSSL_AES_CFB) || defined(HAVE_AES_ECB) || \
- defined(WOLFSSL_AES_DIRECT) || defined(WOLFSSL_AES_XTS) || \
- (defined(HAVE_AES_CBC) && defined(WOLFSSL_NO_KCAPI_AES_CBC))
-
- #define NEED_AES_TABLES
- #endif
-#elif defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
-/* implemented in wolfcrypt/src/port/psa/psa_aes.c */
-
-#elif defined(WOLFSSL_RISCV_ASM)
-/* implemented in wolfcrypt/src/port/risc-v/riscv-64-aes.c */
-
-#elif defined(WOLFSSL_SILABS_SE_ACCEL)
-/* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
-
-#else
-
- /* using wolfCrypt software implementation */
- #define NEED_AES_TABLES
-#endif
-
-
-
-#if defined(WC_AES_BITSLICED) && !defined(HAVE_AES_ECB)
- #error "When WC_AES_BITSLICED is defined, HAVE_AES_ECB is needed."
-#endif
-
-#ifdef NEED_AES_TABLES
-
-#ifndef WC_AES_BITSLICED
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
-#if !defined(WOLFSSL_ESP32_CRYPT) || \
- (defined(NO_ESP32_CRYPT) || defined(NO_WOLFSSL_ESP32_CRYPT_AES) || \
- defined(NEED_AES_HW_FALLBACK))
-static const FLASH_QUALIFIER word32 rcon[] = {
- 0x01000000, 0x02000000, 0x04000000, 0x08000000,
- 0x10000000, 0x20000000, 0x40000000, 0x80000000,
- 0x1B000000, 0x36000000,
- /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
-};
-#endif /* ESP32 */
-#endif /* __aarch64__ || !WOLFSSL_ARMASM */
-
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) || defined(WOLFSSL_AES_DIRECT) || \
- defined(HAVE_AESCCM)
-#ifndef WOLFSSL_AES_SMALL_TABLES
-static const FLASH_QUALIFIER word32 Te[4][256] = {
-{
- 0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
- 0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
- 0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
- 0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
- 0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
- 0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
- 0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
- 0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
- 0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
- 0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
- 0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
- 0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
- 0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
- 0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
- 0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
- 0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
- 0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
- 0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
- 0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
- 0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
- 0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
- 0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
- 0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
- 0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
- 0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
- 0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
- 0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
- 0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
- 0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
- 0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
- 0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
- 0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
- 0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
- 0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
- 0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
- 0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
- 0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
- 0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
- 0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
- 0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
- 0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
- 0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
- 0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
- 0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
- 0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
- 0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
- 0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
- 0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
- 0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
- 0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
- 0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
- 0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
- 0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
- 0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
- 0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
- 0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
- 0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
- 0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
- 0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
- 0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
- 0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
- 0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
- 0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
- 0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
-},
-{
- 0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
- 0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
- 0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
- 0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
- 0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
- 0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
- 0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
- 0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
- 0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
- 0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
- 0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
- 0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
- 0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
- 0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
- 0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
- 0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
- 0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
- 0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
- 0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
- 0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
- 0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
- 0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
- 0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
- 0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
- 0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
- 0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
- 0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
- 0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
- 0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
- 0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
- 0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
- 0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
- 0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
- 0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
- 0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
- 0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
- 0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
- 0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
- 0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
- 0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
- 0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
- 0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
- 0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
- 0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
- 0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
- 0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
- 0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
- 0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
- 0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
- 0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
- 0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
- 0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
- 0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
- 0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
- 0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
- 0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
- 0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
- 0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
- 0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
- 0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
- 0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
- 0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
- 0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
- 0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
-},
-{
- 0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
- 0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
- 0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
- 0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
- 0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
- 0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
- 0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
- 0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
- 0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
- 0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
- 0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
- 0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
- 0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
- 0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
- 0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
- 0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
- 0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
- 0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
- 0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
- 0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
- 0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
- 0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
- 0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
- 0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
- 0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
- 0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
- 0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
- 0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
- 0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
- 0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
- 0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
- 0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
- 0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
- 0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
- 0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
- 0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
- 0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
- 0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
- 0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
- 0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
- 0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
- 0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
- 0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
- 0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
- 0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
- 0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
- 0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
- 0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
- 0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
- 0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
- 0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
- 0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
- 0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
- 0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
- 0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
- 0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
- 0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
- 0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
- 0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
- 0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
- 0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
- 0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
- 0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
- 0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
-},
-{
- 0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
- 0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
- 0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
- 0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
- 0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
- 0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
- 0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
- 0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
- 0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
- 0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
- 0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
- 0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
- 0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
- 0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
- 0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
- 0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
- 0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
- 0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
- 0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
- 0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
- 0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
- 0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
- 0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
- 0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
- 0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
- 0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
- 0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
- 0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
- 0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
- 0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
- 0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
- 0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
- 0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
- 0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
- 0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
- 0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
- 0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
- 0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
- 0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
- 0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
- 0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
- 0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
- 0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
- 0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
- 0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
- 0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
- 0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
- 0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
- 0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
- 0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
- 0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
- 0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
- 0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
- 0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
- 0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
- 0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
- 0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
- 0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
- 0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
- 0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
- 0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
- 0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
- 0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
- 0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
-}
-};
-
-#ifdef HAVE_AES_DECRYPT
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
-static const FLASH_QUALIFIER word32 Td[4][256] = {
-{
- 0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
- 0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
- 0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
- 0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
- 0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
- 0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
- 0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
- 0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
- 0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
- 0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
- 0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
- 0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
- 0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
- 0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
- 0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
- 0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
- 0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
- 0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
- 0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
- 0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
- 0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
- 0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
- 0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
- 0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
- 0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
- 0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
- 0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
- 0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
- 0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
- 0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
- 0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
- 0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
- 0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
- 0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
- 0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
- 0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
- 0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
- 0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
- 0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
- 0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
- 0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
- 0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
- 0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
- 0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
- 0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
- 0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
- 0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
- 0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
- 0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
- 0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
- 0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
- 0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
- 0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
- 0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
- 0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
- 0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
- 0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
- 0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
- 0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
- 0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
- 0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
- 0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
- 0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
- 0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
-},
-{
- 0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
- 0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
- 0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
- 0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
- 0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
- 0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
- 0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
- 0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
- 0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
- 0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
- 0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
- 0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
- 0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
- 0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
- 0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
- 0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
- 0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
- 0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
- 0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
- 0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
- 0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
- 0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
- 0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
- 0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
- 0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
- 0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
- 0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
- 0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
- 0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
- 0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
- 0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
- 0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
- 0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
- 0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
- 0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
- 0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
- 0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
- 0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
- 0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
- 0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
- 0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
- 0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
- 0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
- 0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
- 0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
- 0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
- 0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
- 0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
- 0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
- 0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
- 0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
- 0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
- 0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
- 0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
- 0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
- 0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
- 0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
- 0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
- 0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
- 0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
- 0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
- 0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
- 0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
- 0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
-},
-{
- 0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
- 0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
- 0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
- 0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
- 0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
- 0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
- 0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
- 0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
- 0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
- 0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
- 0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
- 0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
- 0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
- 0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
- 0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
- 0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
- 0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
- 0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
- 0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
- 0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
-
- 0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
- 0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
- 0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
- 0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
- 0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
- 0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
- 0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
- 0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
- 0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
- 0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
- 0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
- 0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
- 0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
- 0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
- 0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
- 0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
- 0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
- 0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
- 0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
- 0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
- 0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
- 0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
- 0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
- 0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
- 0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
- 0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
- 0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
- 0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
- 0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
- 0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
- 0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
- 0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
- 0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
- 0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
- 0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
- 0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
- 0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
- 0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
- 0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
- 0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
- 0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
- 0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
- 0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
- 0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
-},
-{
- 0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
- 0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
- 0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
- 0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
- 0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
- 0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
- 0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
- 0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
- 0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
- 0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
- 0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
- 0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
- 0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
- 0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
- 0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
- 0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
- 0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
- 0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
- 0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
- 0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
- 0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
- 0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
- 0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
- 0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
- 0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
- 0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
- 0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
- 0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
- 0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
- 0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
- 0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
- 0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
- 0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
- 0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
- 0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
- 0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
- 0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
- 0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
- 0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
- 0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
- 0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
- 0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
- 0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
- 0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
- 0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
- 0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
- 0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
- 0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
- 0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
- 0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
- 0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
- 0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
- 0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
- 0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
- 0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
- 0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
- 0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
- 0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
- 0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
- 0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
- 0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
- 0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
- 0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
- 0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
-}
-};
-#endif /* __aarch64__ || !WOLFSSL_ARMASM */
-#endif /* HAVE_AES_DECRYPT */
-#endif /* WOLFSSL_AES_SMALL_TABLES */
-
-#ifdef HAVE_AES_DECRYPT
-#if (defined(HAVE_AES_CBC) && !defined(WOLFSSL_DEVCRYPTO_CBC)) || \
- defined(HAVE_AES_ECB) || defined(WOLFSSL_AES_DIRECT)
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
-static const FLASH_QUALIFIER byte Td4[256] =
-{
- 0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
- 0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
- 0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
- 0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
- 0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
- 0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
- 0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
- 0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
- 0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
- 0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
- 0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
- 0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
- 0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
- 0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
- 0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
- 0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
- 0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
- 0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
- 0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
- 0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
- 0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
- 0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
- 0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
- 0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
- 0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
- 0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
- 0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
- 0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
- 0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
- 0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
- 0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
- 0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
-};
-#endif
-#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
-#endif /* HAVE_AES_DECRYPT */
-
-#define GETBYTE(x, y) (word32)((byte)((x) >> (8 * (y))))
-
-#ifdef WOLFSSL_AES_SMALL_TABLES
-static const byte Tsbox[256] = {
- 0x63U, 0x7cU, 0x77U, 0x7bU, 0xf2U, 0x6bU, 0x6fU, 0xc5U,
- 0x30U, 0x01U, 0x67U, 0x2bU, 0xfeU, 0xd7U, 0xabU, 0x76U,
- 0xcaU, 0x82U, 0xc9U, 0x7dU, 0xfaU, 0x59U, 0x47U, 0xf0U,
- 0xadU, 0xd4U, 0xa2U, 0xafU, 0x9cU, 0xa4U, 0x72U, 0xc0U,
- 0xb7U, 0xfdU, 0x93U, 0x26U, 0x36U, 0x3fU, 0xf7U, 0xccU,
- 0x34U, 0xa5U, 0xe5U, 0xf1U, 0x71U, 0xd8U, 0x31U, 0x15U,
- 0x04U, 0xc7U, 0x23U, 0xc3U, 0x18U, 0x96U, 0x05U, 0x9aU,
- 0x07U, 0x12U, 0x80U, 0xe2U, 0xebU, 0x27U, 0xb2U, 0x75U,
- 0x09U, 0x83U, 0x2cU, 0x1aU, 0x1bU, 0x6eU, 0x5aU, 0xa0U,
- 0x52U, 0x3bU, 0xd6U, 0xb3U, 0x29U, 0xe3U, 0x2fU, 0x84U,
- 0x53U, 0xd1U, 0x00U, 0xedU, 0x20U, 0xfcU, 0xb1U, 0x5bU,
- 0x6aU, 0xcbU, 0xbeU, 0x39U, 0x4aU, 0x4cU, 0x58U, 0xcfU,
- 0xd0U, 0xefU, 0xaaU, 0xfbU, 0x43U, 0x4dU, 0x33U, 0x85U,
- 0x45U, 0xf9U, 0x02U, 0x7fU, 0x50U, 0x3cU, 0x9fU, 0xa8U,
- 0x51U, 0xa3U, 0x40U, 0x8fU, 0x92U, 0x9dU, 0x38U, 0xf5U,
- 0xbcU, 0xb6U, 0xdaU, 0x21U, 0x10U, 0xffU, 0xf3U, 0xd2U,
- 0xcdU, 0x0cU, 0x13U, 0xecU, 0x5fU, 0x97U, 0x44U, 0x17U,
- 0xc4U, 0xa7U, 0x7eU, 0x3dU, 0x64U, 0x5dU, 0x19U, 0x73U,
- 0x60U, 0x81U, 0x4fU, 0xdcU, 0x22U, 0x2aU, 0x90U, 0x88U,
- 0x46U, 0xeeU, 0xb8U, 0x14U, 0xdeU, 0x5eU, 0x0bU, 0xdbU,
- 0xe0U, 0x32U, 0x3aU, 0x0aU, 0x49U, 0x06U, 0x24U, 0x5cU,
- 0xc2U, 0xd3U, 0xacU, 0x62U, 0x91U, 0x95U, 0xe4U, 0x79U,
- 0xe7U, 0xc8U, 0x37U, 0x6dU, 0x8dU, 0xd5U, 0x4eU, 0xa9U,
- 0x6cU, 0x56U, 0xf4U, 0xeaU, 0x65U, 0x7aU, 0xaeU, 0x08U,
- 0xbaU, 0x78U, 0x25U, 0x2eU, 0x1cU, 0xa6U, 0xb4U, 0xc6U,
- 0xe8U, 0xddU, 0x74U, 0x1fU, 0x4bU, 0xbdU, 0x8bU, 0x8aU,
- 0x70U, 0x3eU, 0xb5U, 0x66U, 0x48U, 0x03U, 0xf6U, 0x0eU,
- 0x61U, 0x35U, 0x57U, 0xb9U, 0x86U, 0xc1U, 0x1dU, 0x9eU,
- 0xe1U, 0xf8U, 0x98U, 0x11U, 0x69U, 0xd9U, 0x8eU, 0x94U,
- 0x9bU, 0x1eU, 0x87U, 0xe9U, 0xceU, 0x55U, 0x28U, 0xdfU,
- 0x8cU, 0xa1U, 0x89U, 0x0dU, 0xbfU, 0xe6U, 0x42U, 0x68U,
- 0x41U, 0x99U, 0x2dU, 0x0fU, 0xb0U, 0x54U, 0xbbU, 0x16U
-};
-
-#define AES_XTIME(x) ((byte)((byte)((x) << 1) ^ ((0 - ((x) >> 7)) & 0x1b)))
-
-static WARN_UNUSED_RESULT word32 col_mul(
- word32 t, int i2, int i3, int ia, int ib)
-{
- byte t3 = GETBYTE(t, i3);
- byte tm = AES_XTIME(GETBYTE(t, i2) ^ t3);
-
- return GETBYTE(t, ia) ^ GETBYTE(t, ib) ^ t3 ^ tm;
-}
-
-#if defined(HAVE_AES_CBC) || defined(HAVE_AES_ECB) || \
- defined(WOLFSSL_AES_DIRECT)
-static WARN_UNUSED_RESULT word32 inv_col_mul(
- word32 t, int i9, int ib, int id, int ie)
-{
- byte t9 = GETBYTE(t, i9);
- byte tb = GETBYTE(t, ib);
- byte td = GETBYTE(t, id);
- byte te = GETBYTE(t, ie);
- byte t0 = t9 ^ tb ^ td;
- return t0 ^ AES_XTIME(AES_XTIME(AES_XTIME(t0 ^ te) ^ td ^ te) ^ tb ^ te);
-}
-#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
-#endif /* WOLFSSL_AES_SMALL_TABLES */
-#endif
-#endif
-
-#if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT) || \
- defined(HAVE_AESCCM) || defined(HAVE_AESGCM)
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) || defined(WOLFSSL_AES_DIRECT) || \
- defined(HAVE_AESCCM)
-
-
-#ifndef WC_AES_BITSLICED
-
-#ifndef WC_CACHE_LINE_SZ
- #if defined(__x86_64__) || defined(_M_X64) || \
- (defined(__ILP32__) && (__ILP32__ >= 1))
- #define WC_CACHE_LINE_SZ 64
- #else
- /* default cache line size */
- #define WC_CACHE_LINE_SZ 32
- #endif
-#endif
-
-#ifndef WC_NO_CACHE_RESISTANT
-
-#if defined(__riscv) && !defined(WOLFSSL_AES_TOUCH_LINES)
- #define WOLFSSL_AES_TOUCH_LINES
-#endif
-
-#ifndef WOLFSSL_AES_SMALL_TABLES
-/* load 4 Te Tables into cache by cache line stride */
-static WARN_UNUSED_RESULT WC_INLINE word32 PreFetchTe(void)
-{
-#ifndef WOLFSSL_AES_TOUCH_LINES
- word32 x = 0;
- int i,j;
-
- for (i = 0; i < 4; i++) {
- /* 256 elements, each one is 4 bytes */
- for (j = 0; j < 256; j += WC_CACHE_LINE_SZ/4) {
- x &= Te[i][j];
- }
- }
- return x;
-#else
- return 0;
-#endif
-}
-#else
-/* load sbox into cache by cache line stride */
-static WARN_UNUSED_RESULT WC_INLINE word32 PreFetchSBox(void)
-{
-#ifndef WOLFSSL_AES_TOUCH_LINES
- word32 x = 0;
- int i;
-
- for (i = 0; i < 256; i += WC_CACHE_LINE_SZ/4) {
- x &= Tsbox[i];
- }
- return x;
-#else
- return 0;
-#endif
-}
-#endif
-#endif
-
-#ifdef WOLFSSL_AES_TOUCH_LINES
-#if WC_CACHE_LINE_SZ == 128
- #define WC_CACHE_LINE_BITS 5
- #define WC_CACHE_LINE_MASK_HI 0xe0
- #define WC_CACHE_LINE_MASK_LO 0x1f
- #define WC_CACHE_LINE_ADD 0x20
-#elif WC_CACHE_LINE_SZ == 64
- #define WC_CACHE_LINE_BITS 4
- #define WC_CACHE_LINE_MASK_HI 0xf0
- #define WC_CACHE_LINE_MASK_LO 0x0f
- #define WC_CACHE_LINE_ADD 0x10
-#elif WC_CACHE_LINE_SZ == 32
- #define WC_CACHE_LINE_BITS 3
- #define WC_CACHE_LINE_MASK_HI 0xf8
- #define WC_CACHE_LINE_MASK_LO 0x07
- #define WC_CACHE_LINE_ADD 0x08
-#elif WC_CACHE_LINE_SZ == 16
- #define WC_CACHE_LINE_BITS 2
- #define WC_CACHE_LINE_MASK_HI 0xfc
- #define WC_CACHE_LINE_MASK_LO 0x03
- #define WC_CACHE_LINE_ADD 0x04
-#else
- #error Cache line size not supported
-#endif
-
-#ifndef WOLFSSL_AES_SMALL_TABLES
-static word32 GetTable(const word32* t, byte o)
-{
-#if WC_CACHE_LINE_SZ == 64
- word32 e;
- byte hi = o & 0xf0;
- byte lo = o & 0x0f;
-
- e = t[lo + 0x00] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x10] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x20] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x30] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x40] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x50] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x60] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x70] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x80] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x90] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xa0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xb0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xc0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xd0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xe0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xf0] & ((word32)0 - (((word32)hi - 0x01) >> 31));
-
- return e;
-#else
- word32 e = 0;
- int i;
- byte hi = o & WC_CACHE_LINE_MASK_HI;
- byte lo = o & WC_CACHE_LINE_MASK_LO;
-
- for (i = 0; i < 256; i += (1 << WC_CACHE_LINE_BITS)) {
- e |= t[lo + i] & ((word32)0 - (((word32)hi - 0x01) >> 31));
- hi -= WC_CACHE_LINE_ADD;
- }
-
- return e;
-#endif
-}
-#endif
-
-#ifdef WOLFSSL_AES_SMALL_TABLES
-static byte GetTable8(const byte* t, byte o)
-{
-#if WC_CACHE_LINE_SZ == 64
- byte e;
- byte hi = o & 0xf0;
- byte lo = o & 0x0f;
-
- e = t[lo + 0x00] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x10] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x20] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x30] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x40] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x50] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x60] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x70] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x80] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0x90] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xa0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xb0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xc0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xd0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xe0] & ((word32)0 - (((word32)hi - 0x01) >> 31)); hi -= 0x10;
- e |= t[lo + 0xf0] & ((word32)0 - (((word32)hi - 0x01) >> 31));
-
- return e;
-#else
- byte e = 0;
- int i;
- byte hi = o & WC_CACHE_LINE_MASK_HI;
- byte lo = o & WC_CACHE_LINE_MASK_LO;
-
- for (i = 0; i < 256; i += (1 << WC_CACHE_LINE_BITS)) {
- e |= t[lo + i] & ((word32)0 - (((word32)hi - 0x01) >> 31));
- hi -= WC_CACHE_LINE_ADD;
- }
-
- return e;
-#endif
-}
-#endif
-
-#ifndef WOLFSSL_AES_SMALL_TABLES
-static void GetTable_Multi(const word32* t, word32* t0, byte o0,
- word32* t1, byte o1, word32* t2, byte o2, word32* t3, byte o3)
-{
- word32 e0 = 0;
- word32 e1 = 0;
- word32 e2 = 0;
- word32 e3 = 0;
- byte hi0 = o0 & WC_CACHE_LINE_MASK_HI;
- byte lo0 = o0 & WC_CACHE_LINE_MASK_LO;
- byte hi1 = o1 & WC_CACHE_LINE_MASK_HI;
- byte lo1 = o1 & WC_CACHE_LINE_MASK_LO;
- byte hi2 = o2 & WC_CACHE_LINE_MASK_HI;
- byte lo2 = o2 & WC_CACHE_LINE_MASK_LO;
- byte hi3 = o3 & WC_CACHE_LINE_MASK_HI;
- byte lo3 = o3 & WC_CACHE_LINE_MASK_LO;
- int i;
-
- for (i = 0; i < 256; i += (1 << WC_CACHE_LINE_BITS)) {
- e0 |= t[lo0 + i] & ((word32)0 - (((word32)hi0 - 0x01) >> 31));
- hi0 -= WC_CACHE_LINE_ADD;
- e1 |= t[lo1 + i] & ((word32)0 - (((word32)hi1 - 0x01) >> 31));
- hi1 -= WC_CACHE_LINE_ADD;
- e2 |= t[lo2 + i] & ((word32)0 - (((word32)hi2 - 0x01) >> 31));
- hi2 -= WC_CACHE_LINE_ADD;
- e3 |= t[lo3 + i] & ((word32)0 - (((word32)hi3 - 0x01) >> 31));
- hi3 -= WC_CACHE_LINE_ADD;
- }
- *t0 = e0;
- *t1 = e1;
- *t2 = e2;
- *t3 = e3;
-}
-static void XorTable_Multi(const word32* t, word32* t0, byte o0,
- word32* t1, byte o1, word32* t2, byte o2, word32* t3, byte o3)
-{
- word32 e0 = 0;
- word32 e1 = 0;
- word32 e2 = 0;
- word32 e3 = 0;
- byte hi0 = o0 & 0xf0;
- byte lo0 = o0 & 0x0f;
- byte hi1 = o1 & 0xf0;
- byte lo1 = o1 & 0x0f;
- byte hi2 = o2 & 0xf0;
- byte lo2 = o2 & 0x0f;
- byte hi3 = o3 & 0xf0;
- byte lo3 = o3 & 0x0f;
- int i;
-
- for (i = 0; i < 256; i += (1 << WC_CACHE_LINE_BITS)) {
- e0 |= t[lo0 + i] & ((word32)0 - (((word32)hi0 - 0x01) >> 31));
- hi0 -= WC_CACHE_LINE_ADD;
- e1 |= t[lo1 + i] & ((word32)0 - (((word32)hi1 - 0x01) >> 31));
- hi1 -= WC_CACHE_LINE_ADD;
- e2 |= t[lo2 + i] & ((word32)0 - (((word32)hi2 - 0x01) >> 31));
- hi2 -= WC_CACHE_LINE_ADD;
- e3 |= t[lo3 + i] & ((word32)0 - (((word32)hi3 - 0x01) >> 31));
- hi3 -= WC_CACHE_LINE_ADD;
- }
- *t0 ^= e0;
- *t1 ^= e1;
- *t2 ^= e2;
- *t3 ^= e3;
-}
-static word32 GetTable8_4(const byte* t, byte o0, byte o1, byte o2, byte o3)
-{
- word32 e = 0;
- int i;
- byte hi0 = o0 & WC_CACHE_LINE_MASK_HI;
- byte lo0 = o0 & WC_CACHE_LINE_MASK_LO;
- byte hi1 = o1 & WC_CACHE_LINE_MASK_HI;
- byte lo1 = o1 & WC_CACHE_LINE_MASK_LO;
- byte hi2 = o2 & WC_CACHE_LINE_MASK_HI;
- byte lo2 = o2 & WC_CACHE_LINE_MASK_LO;
- byte hi3 = o3 & WC_CACHE_LINE_MASK_HI;
- byte lo3 = o3 & WC_CACHE_LINE_MASK_LO;
-
- for (i = 0; i < 256; i += (1 << WC_CACHE_LINE_BITS)) {
- e |= (word32)(t[lo0 + i] & ((word32)0 - (((word32)hi0 - 0x01) >> 31)))
- << 24;
- hi0 -= WC_CACHE_LINE_ADD;
- e |= (word32)(t[lo1 + i] & ((word32)0 - (((word32)hi1 - 0x01) >> 31)))
- << 16;
- hi1 -= WC_CACHE_LINE_ADD;
- e |= (word32)(t[lo2 + i] & ((word32)0 - (((word32)hi2 - 0x01) >> 31)))
- << 8;
- hi2 -= WC_CACHE_LINE_ADD;
- e |= (word32)(t[lo3 + i] & ((word32)0 - (((word32)hi3 - 0x01) >> 31)))
- << 0;
- hi3 -= WC_CACHE_LINE_ADD;
- }
-
- return e;
-}
-#endif
-#else
-
-#define GetTable(t, o) t[o]
-#define GetTable8(t, o) t[o]
-#define GetTable_Multi(t, t0, o0, t1, o1, t2, o2, t3, o3) \
- *(t0) = (t)[o0]; *(t1) = (t)[o1]; *(t2) = (t)[o2]; *(t3) = (t)[o3]
-#define XorTable_Multi(t, t0, o0, t1, o1, t2, o2, t3, o3) \
- *(t0) ^= (t)[o0]; *(t1) ^= (t)[o1]; *(t2) ^= (t)[o2]; *(t3) ^= (t)[o3]
-#define GetTable8_4(t, o0, o1, o2, o3) \
- (((word32)(t)[o0] << 24) | ((word32)(t)[o1] << 16) | \
- ((word32)(t)[o2] << 8) | ((word32)(t)[o3] << 0))
-#endif
-
-#ifndef HAVE_CUDA
-/* Encrypt a block using AES.
- *
- * @param [in] aes AES object.
- * @param [in] inBlock Block to encrypt.
- * @param [out] outBlock Encrypted block.
- * @param [in] r Rounds divided by 2.
- */
-static void AesEncrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r)
-{
- word32 s0 = 0, s1 = 0, s2 = 0, s3 = 0;
- word32 t0 = 0, t1 = 0, t2 = 0, t3 = 0;
- const word32* rk;
-
-#ifdef WC_C_DYNAMIC_FALLBACK
- rk = aes->key_C_fallback;
-#else
- rk = aes->key;
-#endif
-
- /*
- * map byte array block to cipher state
- * and add initial round key:
- */
- XMEMCPY(&s0, inBlock, sizeof(s0));
- XMEMCPY(&s1, inBlock + sizeof(s0), sizeof(s1));
- XMEMCPY(&s2, inBlock + 2 * sizeof(s0), sizeof(s2));
- XMEMCPY(&s3, inBlock + 3 * sizeof(s0), sizeof(s3));
-
-#ifdef LITTLE_ENDIAN_ORDER
- s0 = ByteReverseWord32(s0);
- s1 = ByteReverseWord32(s1);
- s2 = ByteReverseWord32(s2);
- s3 = ByteReverseWord32(s3);
-#endif
-
- /* AddRoundKey */
- s0 ^= rk[0];
- s1 ^= rk[1];
- s2 ^= rk[2];
- s3 ^= rk[3];
-
-#ifndef WOLFSSL_AES_SMALL_TABLES
-#ifndef WC_NO_CACHE_RESISTANT
- s0 |= PreFetchTe();
-#endif
-
-#ifndef WOLFSSL_AES_TOUCH_LINES
-#define ENC_ROUND_T_S(o) \
- t0 = GetTable(Te[0], GETBYTE(s0, 3)) ^ GetTable(Te[1], GETBYTE(s1, 2)) ^ \
- GetTable(Te[2], GETBYTE(s2, 1)) ^ GetTable(Te[3], GETBYTE(s3, 0)) ^ \
- rk[(o)+4]; \
- t1 = GetTable(Te[0], GETBYTE(s1, 3)) ^ GetTable(Te[1], GETBYTE(s2, 2)) ^ \
- GetTable(Te[2], GETBYTE(s3, 1)) ^ GetTable(Te[3], GETBYTE(s0, 0)) ^ \
- rk[(o)+5]; \
- t2 = GetTable(Te[0], GETBYTE(s2, 3)) ^ GetTable(Te[1], GETBYTE(s3, 2)) ^ \
- GetTable(Te[2], GETBYTE(s0, 1)) ^ GetTable(Te[3], GETBYTE(s1, 0)) ^ \
- rk[(o)+6]; \
- t3 = GetTable(Te[0], GETBYTE(s3, 3)) ^ GetTable(Te[1], GETBYTE(s0, 2)) ^ \
- GetTable(Te[2], GETBYTE(s1, 1)) ^ GetTable(Te[3], GETBYTE(s2, 0)) ^ \
- rk[(o)+7]
-#define ENC_ROUND_S_T(o) \
- s0 = GetTable(Te[0], GETBYTE(t0, 3)) ^ GetTable(Te[1], GETBYTE(t1, 2)) ^ \
- GetTable(Te[2], GETBYTE(t2, 1)) ^ GetTable(Te[3], GETBYTE(t3, 0)) ^ \
- rk[(o)+0]; \
- s1 = GetTable(Te[0], GETBYTE(t1, 3)) ^ GetTable(Te[1], GETBYTE(t2, 2)) ^ \
- GetTable(Te[2], GETBYTE(t3, 1)) ^ GetTable(Te[3], GETBYTE(t0, 0)) ^ \
- rk[(o)+1]; \
- s2 = GetTable(Te[0], GETBYTE(t2, 3)) ^ GetTable(Te[1], GETBYTE(t3, 2)) ^ \
- GetTable(Te[2], GETBYTE(t0, 1)) ^ GetTable(Te[3], GETBYTE(t1, 0)) ^ \
- rk[(o)+2]; \
- s3 = GetTable(Te[0], GETBYTE(t3, 3)) ^ GetTable(Te[1], GETBYTE(t0, 2)) ^ \
- GetTable(Te[2], GETBYTE(t1, 1)) ^ GetTable(Te[3], GETBYTE(t2, 0)) ^ \
- rk[(o)+3]
-#else
-#define ENC_ROUND_T_S(o) \
- GetTable_Multi(Te[0], &t0, GETBYTE(s0, 3), &t1, GETBYTE(s1, 3), \
- &t2, GETBYTE(s2, 3), &t3, GETBYTE(s3, 3)); \
- XorTable_Multi(Te[1], &t0, GETBYTE(s1, 2), &t1, GETBYTE(s2, 2), \
- &t2, GETBYTE(s3, 2), &t3, GETBYTE(s0, 2)); \
- XorTable_Multi(Te[2], &t0, GETBYTE(s2, 1), &t1, GETBYTE(s3, 1), \
- &t2, GETBYTE(s0, 1), &t3, GETBYTE(s1, 1)); \
- XorTable_Multi(Te[3], &t0, GETBYTE(s3, 0), &t1, GETBYTE(s0, 0), \
- &t2, GETBYTE(s1, 0), &t3, GETBYTE(s2, 0)); \
- t0 ^= rk[(o)+4]; t1 ^= rk[(o)+5]; t2 ^= rk[(o)+6]; t3 ^= rk[(o)+7];
-
-#define ENC_ROUND_S_T(o) \
- GetTable_Multi(Te[0], &s0, GETBYTE(t0, 3), &s1, GETBYTE(t1, 3), \
- &s2, GETBYTE(t2, 3), &s3, GETBYTE(t3, 3)); \
- XorTable_Multi(Te[1], &s0, GETBYTE(t1, 2), &s1, GETBYTE(t2, 2), \
- &s2, GETBYTE(t3, 2), &s3, GETBYTE(t0, 2)); \
- XorTable_Multi(Te[2], &s0, GETBYTE(t2, 1), &s1, GETBYTE(t3, 1), \
- &s2, GETBYTE(t0, 1), &s3, GETBYTE(t1, 1)); \
- XorTable_Multi(Te[3], &s0, GETBYTE(t3, 0), &s1, GETBYTE(t0, 0), \
- &s2, GETBYTE(t1, 0), &s3, GETBYTE(t2, 0)); \
- s0 ^= rk[(o)+0]; s1 ^= rk[(o)+1]; s2 ^= rk[(o)+2]; s3 ^= rk[(o)+3];
-#endif
-
-#ifndef WOLFSSL_AES_NO_UNROLL
-/* Unroll the loop. */
- ENC_ROUND_T_S( 0);
- ENC_ROUND_S_T( 8); ENC_ROUND_T_S( 8);
- ENC_ROUND_S_T(16); ENC_ROUND_T_S(16);
- ENC_ROUND_S_T(24); ENC_ROUND_T_S(24);
- ENC_ROUND_S_T(32); ENC_ROUND_T_S(32);
- if (r > 5) {
- ENC_ROUND_S_T(40); ENC_ROUND_T_S(40);
- if (r > 6) {
- ENC_ROUND_S_T(48); ENC_ROUND_T_S(48);
- }
- }
- rk += r * 8;
-#else
- /*
- * Nr - 1 full rounds:
- */
-
- for (;;) {
- ENC_ROUND_T_S(0);
-
- rk += 8;
- if (--r == 0) {
- break;
- }
-
- ENC_ROUND_S_T(0);
- }
-#endif
-
- /*
- * apply last round and
- * map cipher state to byte array block:
- */
-
-#ifndef WOLFSSL_AES_TOUCH_LINES
- s0 =
- (GetTable(Te[2], GETBYTE(t0, 3)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(t1, 2)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(t2, 1)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(t3, 0)) & 0x000000ff) ^
- rk[0];
- s1 =
- (GetTable(Te[2], GETBYTE(t1, 3)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(t2, 2)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(t3, 1)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(t0, 0)) & 0x000000ff) ^
- rk[1];
- s2 =
- (GetTable(Te[2], GETBYTE(t2, 3)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(t3, 2)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(t0, 1)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(t1, 0)) & 0x000000ff) ^
- rk[2];
- s3 =
- (GetTable(Te[2], GETBYTE(t3, 3)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(t0, 2)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(t1, 1)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(t2, 0)) & 0x000000ff) ^
- rk[3];
-#else
-{
- word32 u0;
- word32 u1;
- word32 u2;
- word32 u3;
-
- s0 = rk[0]; s1 = rk[1]; s2 = rk[2]; s3 = rk[3];
- GetTable_Multi(Te[2], &u0, GETBYTE(t0, 3), &u1, GETBYTE(t1, 3),
- &u2, GETBYTE(t2, 3), &u3, GETBYTE(t3, 3));
- s0 ^= u0 & 0xff000000; s1 ^= u1 & 0xff000000;
- s2 ^= u2 & 0xff000000; s3 ^= u3 & 0xff000000;
- GetTable_Multi(Te[3], &u0, GETBYTE(t1, 2), &u1, GETBYTE(t2, 2),
- &u2, GETBYTE(t3, 2), &u3, GETBYTE(t0, 2));
- s0 ^= u0 & 0x00ff0000; s1 ^= u1 & 0x00ff0000;
- s2 ^= u2 & 0x00ff0000; s3 ^= u3 & 0x00ff0000;
- GetTable_Multi(Te[0], &u0, GETBYTE(t2, 1), &u1, GETBYTE(t3, 1),
- &u2, GETBYTE(t0, 1), &u3, GETBYTE(t1, 1));
- s0 ^= u0 & 0x0000ff00; s1 ^= u1 & 0x0000ff00;
- s2 ^= u2 & 0x0000ff00; s3 ^= u3 & 0x0000ff00;
- GetTable_Multi(Te[1], &u0, GETBYTE(t3, 0), &u1, GETBYTE(t0, 0),
- &u2, GETBYTE(t1, 0), &u3, GETBYTE(t2, 0));
- s0 ^= u0 & 0x000000ff; s1 ^= u1 & 0x000000ff;
- s2 ^= u2 & 0x000000ff; s3 ^= u3 & 0x000000ff;
-}
-#endif
-#else
-#ifndef WC_NO_CACHE_RESISTANT
- s0 |= PreFetchSBox();
-#endif
-
- r *= 2;
- /* Two rounds at a time */
- for (rk += 4; r > 1; r--, rk += 4) {
- t0 =
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 0)));
- t1 =
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 0)));
- t2 =
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 0)));
- t3 =
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 0)));
-
- s0 =
- (col_mul(t0, 3, 2, 0, 1) << 24) ^
- (col_mul(t0, 2, 1, 0, 3) << 16) ^
- (col_mul(t0, 1, 0, 2, 3) << 8) ^
- (col_mul(t0, 0, 3, 2, 1) ) ^
- rk[0];
- s1 =
- (col_mul(t1, 3, 2, 0, 1) << 24) ^
- (col_mul(t1, 2, 1, 0, 3) << 16) ^
- (col_mul(t1, 1, 0, 2, 3) << 8) ^
- (col_mul(t1, 0, 3, 2, 1) ) ^
- rk[1];
- s2 =
- (col_mul(t2, 3, 2, 0, 1) << 24) ^
- (col_mul(t2, 2, 1, 0, 3) << 16) ^
- (col_mul(t2, 1, 0, 2, 3) << 8) ^
- (col_mul(t2, 0, 3, 2, 1) ) ^
- rk[2];
- s3 =
- (col_mul(t3, 3, 2, 0, 1) << 24) ^
- (col_mul(t3, 2, 1, 0, 3) << 16) ^
- (col_mul(t3, 1, 0, 2, 3) << 8) ^
- (col_mul(t3, 0, 3, 2, 1) ) ^
- rk[3];
- }
-
- t0 =
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 0)));
- t1 =
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 0)));
- t2 =
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 0)));
- t3 =
- ((word32)GetTable8(Tsbox, GETBYTE(s3, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s0, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s1, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(s2, 0)));
- s0 = t0 ^ rk[0];
- s1 = t1 ^ rk[1];
- s2 = t2 ^ rk[2];
- s3 = t3 ^ rk[3];
-#endif
-
- /* write out */
-#ifdef LITTLE_ENDIAN_ORDER
- s0 = ByteReverseWord32(s0);
- s1 = ByteReverseWord32(s1);
- s2 = ByteReverseWord32(s2);
- s3 = ByteReverseWord32(s3);
-#endif
-
- XMEMCPY(outBlock, &s0, sizeof(s0));
- XMEMCPY(outBlock + sizeof(s0), &s1, sizeof(s1));
- XMEMCPY(outBlock + 2 * sizeof(s0), &s2, sizeof(s2));
- XMEMCPY(outBlock + 3 * sizeof(s0), &s3, sizeof(s3));
-}
-
-#if defined(HAVE_AES_ECB) && !(defined(WOLFSSL_IMX6_CAAM) && \
- !defined(NO_IMX6_CAAM_AES) && !defined(WOLFSSL_QNX_CAAM)) && \
- !defined(MAX3266X_AES)
-#if !defined(WOLFSSL_ARMASM) || defined(__aarch64__)
-/* Encrypt a number of blocks using AES.
- *
- * @param [in] aes AES object.
- * @param [in] in Block to encrypt.
- * @param [out] out Encrypted block.
- * @param [in] sz Number of blocks to encrypt.
- */
-static void AesEncryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz)
-{
- word32 i;
-
- for (i = 0; i < sz; i += WC_AES_BLOCK_SIZE) {
- AesEncrypt_C(aes, in, out, aes->rounds >> 1);
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-}
-#endif
-#endif
-#else
-extern void AesEncrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r);
-extern void AesEncryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz);
-#endif /* HAVE_CUDA */
-
-#else
-
-/* Bit-sliced implementation based on work by "circuit minimization team" (CMT):
- * http://cs-www.cs.yale.edu/homes/peralta/CircuitStuff/CMT.html
- */
-/* http://cs-www.cs.yale.edu/homes/peralta/CircuitStuff/SLP_AES_113.txt */
-static void bs_sub_bytes(bs_word u[8])
-{
- bs_word y1, y2, y3, y4, y5, y6, y7, y8, y9;
- bs_word y10, y11, y12, y13, y14, y15, y16, y17, y18, y19;
- bs_word y20, y21;
- bs_word t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
- bs_word t10, t11, t12, t13, t14, t15, t16, t17, t18, t19;
- bs_word t20, t21, t22, t23, t24, t25, t26, t27, t28, t29;
- bs_word t30, t31, t32, t33, t34, t35, t36, t37, t38, t39;
- bs_word t40, t41, t42, t43, t44, t45;
- bs_word z0, z1, z2, z3, z4, z5, z6, z7, z8, z9;
- bs_word z10, z11, z12, z13, z14, z15, z16, z17;
- bs_word tc1, tc2, tc3, tc4, tc5, tc6, tc7, tc8, tc9;
- bs_word tc10, tc11, tc12, tc13, tc14, tc16, tc17, tc18;
- bs_word tc20, tc21, tc26;
- bs_word U0, U1, U2, U3, U4, U5, U6, U7;
- bs_word S0, S1, S2, S3, S4, S5, S6, S7;
-
- U0 = u[7];
- U1 = u[6];
- U2 = u[5];
- U3 = u[4];
- U4 = u[3];
- U5 = u[2];
- U6 = u[1];
- U7 = u[0];
-
- y14 = U3 ^ U5;
- y13 = U0 ^ U6;
- y9 = U0 ^ U3;
- y8 = U0 ^ U5;
- t0 = U1 ^ U2;
- y1 = t0 ^ U7;
- y4 = y1 ^ U3;
- y12 = y13 ^ y14;
- y2 = y1 ^ U0;
- y5 = y1 ^ U6;
- y3 = y5 ^ y8;
- t1 = U4 ^ y12;
- y15 = t1 ^ U5;
- y20 = t1 ^ U1;
- y6 = y15 ^ U7;
- y10 = y15 ^ t0;
- y11 = y20 ^ y9;
- y7 = U7 ^ y11;
- y17 = y10 ^ y11;
- y19 = y10 ^ y8;
- y16 = t0 ^ y11;
- y21 = y13 ^ y16;
- y18 = U0 ^ y16;
- t2 = y12 & y15;
- t3 = y3 & y6;
- t4 = t3 ^ t2;
- t5 = y4 & U7;
- t6 = t5 ^ t2;
- t7 = y13 & y16;
- t8 = y5 & y1;
- t9 = t8 ^ t7;
- t10 = y2 & y7;
- t11 = t10 ^ t7;
- t12 = y9 & y11;
- t13 = y14 & y17;
- t14 = t13 ^ t12;
- t15 = y8 & y10;
- t16 = t15 ^ t12;
- t17 = t4 ^ y20;
- t18 = t6 ^ t16;
- t19 = t9 ^ t14;
- t20 = t11 ^ t16;
- t21 = t17 ^ t14;
- t22 = t18 ^ y19;
- t23 = t19 ^ y21;
- t24 = t20 ^ y18;
- t25 = t21 ^ t22;
- t26 = t21 & t23;
- t27 = t24 ^ t26;
- t28 = t25 & t27;
- t29 = t28 ^ t22;
- t30 = t23 ^ t24;
- t31 = t22 ^ t26;
- t32 = t31 & t30;
- t33 = t32 ^ t24;
- t34 = t23 ^ t33;
- t35 = t27 ^ t33;
- t36 = t24 & t35;
- t37 = t36 ^ t34;
- t38 = t27 ^ t36;
- t39 = t29 & t38;
- t40 = t25 ^ t39;
- t41 = t40 ^ t37;
- t42 = t29 ^ t33;
- t43 = t29 ^ t40;
- t44 = t33 ^ t37;
- t45 = t42 ^ t41;
- z0 = t44 & y15;
- z1 = t37 & y6;
- z2 = t33 & U7;
- z3 = t43 & y16;
- z4 = t40 & y1;
- z5 = t29 & y7;
- z6 = t42 & y11;
- z7 = t45 & y17;
- z8 = t41 & y10;
- z9 = t44 & y12;
- z10 = t37 & y3;
- z11 = t33 & y4;
- z12 = t43 & y13;
- z13 = t40 & y5;
- z14 = t29 & y2;
- z15 = t42 & y9;
- z16 = t45 & y14;
- z17 = t41 & y8;
- tc1 = z15 ^ z16;
- tc2 = z10 ^ tc1;
- tc3 = z9 ^ tc2;
- tc4 = z0 ^ z2;
- tc5 = z1 ^ z0;
- tc6 = z3 ^ z4;
- tc7 = z12 ^ tc4;
- tc8 = z7 ^ tc6;
- tc9 = z8 ^ tc7;
- tc10 = tc8 ^ tc9;
- tc11 = tc6 ^ tc5;
- tc12 = z3 ^ z5;
- tc13 = z13 ^ tc1;
- tc14 = tc4 ^ tc12;
- S3 = tc3 ^ tc11;
- tc16 = z6 ^ tc8;
- tc17 = z14 ^ tc10;
- tc18 = tc13 ^ tc14;
- S7 = ~(z12 ^ tc18);
- tc20 = z15 ^ tc16;
- tc21 = tc2 ^ z11;
- S0 = tc3 ^ tc16;
- S6 = ~(tc10 ^ tc18);
- S4 = tc14 ^ S3;
- S1 = ~(S3 ^ tc16);
- tc26 = tc17 ^ tc20;
- S2 = ~(tc26 ^ z17);
- S5 = tc21 ^ tc17;
-
- u[0] = S7;
- u[1] = S6;
- u[2] = S5;
- u[3] = S4;
- u[4] = S3;
- u[5] = S2;
- u[6] = S1;
- u[7] = S0;
-}
-
-#define BS_MASK_BIT_SET(w, j, bmask) \
- (((bs_word)0 - (((w) >> (j)) & (bs_word)1)) & (bmask))
-
-#define BS_TRANS_8(t, o, w, bmask, s) \
- t[o + s + 0] |= BS_MASK_BIT_SET(w, s + 0, bmask); \
- t[o + s + 1] |= BS_MASK_BIT_SET(w, s + 1, bmask); \
- t[o + s + 2] |= BS_MASK_BIT_SET(w, s + 2, bmask); \
- t[o + s + 3] |= BS_MASK_BIT_SET(w, s + 3, bmask); \
- t[o + s + 4] |= BS_MASK_BIT_SET(w, s + 4, bmask); \
- t[o + s + 5] |= BS_MASK_BIT_SET(w, s + 5, bmask); \
- t[o + s + 6] |= BS_MASK_BIT_SET(w, s + 6, bmask); \
- t[o + s + 7] |= BS_MASK_BIT_SET(w, s + 7, bmask)
-
-static void bs_transpose(bs_word* t, bs_word* blocks)
-{
- bs_word bmask = 1;
- int i;
-
- XMEMSET(t, 0, sizeof(bs_word) * AES_BLOCK_BITS);
-
- for (i = 0; i < BS_WORD_SIZE; i++) {
- int j;
- int o = 0;
- for (j = 0; j < BS_BLOCK_WORDS; j++) {
- #ifdef LITTLE_ENDIAN_ORDER
- bs_word w = blocks[i * BS_BLOCK_WORDS + j];
- #else
- bs_word w = bs_bswap(blocks[i * BS_BLOCK_WORDS + j]);
- #endif
- #ifdef WOLFSSL_AES_NO_UNROLL
- int k;
- for (k = 0; k < BS_WORD_SIZE; k++) {
- t[o + k] |= BS_MASK_BIT_SET(w, k, bmask);
- }
- #else
- BS_TRANS_8(t, o, w, bmask, 0);
- #if BS_WORD_SIZE >= 16
- BS_TRANS_8(t, o, w, bmask, 8);
- #endif
- #if BS_WORD_SIZE >= 32
- BS_TRANS_8(t, o, w, bmask, 16);
- BS_TRANS_8(t, o, w, bmask, 24);
- #endif
- #if BS_WORD_SIZE >= 64
- BS_TRANS_8(t, o, w, bmask, 32);
- BS_TRANS_8(t, o, w, bmask, 40);
- BS_TRANS_8(t, o, w, bmask, 48);
- BS_TRANS_8(t, o, w, bmask, 56);
- #endif
- #endif
- o += BS_WORD_SIZE;
- }
- bmask <<= 1;
- }
-}
-
-#define BS_INV_TRANS_8(t, o, w, bmask, s) \
- t[o + (s + 0) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 0, bmask); \
- t[o + (s + 1) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 1, bmask); \
- t[o + (s + 2) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 2, bmask); \
- t[o + (s + 3) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 3, bmask); \
- t[o + (s + 4) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 4, bmask); \
- t[o + (s + 5) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 5, bmask); \
- t[o + (s + 6) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 6, bmask); \
- t[o + (s + 7) * BS_BLOCK_WORDS] |= BS_MASK_BIT_SET(w, s + 7, bmask)
-
-static void bs_inv_transpose(bs_word* t, bs_word* blocks)
-{
- int o;
-
- XMEMSET(t, 0, sizeof(bs_word) * AES_BLOCK_BITS);
-
- for (o = 0; o < BS_BLOCK_WORDS; o++) {
- int i;
- for (i = 0; i < BS_WORD_SIZE; i++) {
- #ifdef LITTLE_ENDIAN_ORDER
- bs_word bmask = (bs_word)1 << i;
- #else
- bs_word bmask = bs_bswap((bs_word)1 << i);
- #endif
- bs_word w = blocks[(o << BS_WORD_SHIFT) + i];
- #ifdef WOLFSSL_AES_NO_UNROLL
- int j;
- for (j = 0; j < BS_WORD_SIZE; j++) {
- t[j * BS_BLOCK_WORDS + o] |= BS_MASK_BIT_SET(w, j, bmask);
- }
- #else
- BS_INV_TRANS_8(t, o, w, bmask, 0);
- #if BS_WORD_SIZE >= 16
- BS_INV_TRANS_8(t, o, w, bmask, 8);
- #endif
- #if BS_WORD_SIZE >= 32
- BS_INV_TRANS_8(t, o, w, bmask, 16);
- BS_INV_TRANS_8(t, o, w, bmask, 24);
- #endif
- #if BS_WORD_SIZE >= 64
- BS_INV_TRANS_8(t, o, w, bmask, 32);
- BS_INV_TRANS_8(t, o, w, bmask, 40);
- BS_INV_TRANS_8(t, o, w, bmask, 48);
- BS_INV_TRANS_8(t, o, w, bmask, 56);
- #endif
- #endif
- }
- }
-}
-
-#define BS_ROW_OFF_0 0
-#define BS_ROW_OFF_1 32
-#define BS_ROW_OFF_2 64
-#define BS_ROW_OFF_3 96
-
-#define BS_ROW_ADD (AES_BLOCK_BITS / 16 + AES_BLOCK_BITS / 4)
-#define BS_IDX_MASK 0x7f
-
-#define BS_ASSIGN_8(d, od, s, os) \
- d[(od) + 0] = s[(os) + 0]; \
- d[(od) + 1] = s[(os) + 1]; \
- d[(od) + 2] = s[(os) + 2]; \
- d[(od) + 3] = s[(os) + 3]; \
- d[(od) + 4] = s[(os) + 4]; \
- d[(od) + 5] = s[(os) + 5]; \
- d[(od) + 6] = s[(os) + 6]; \
- d[(od) + 7] = s[(os) + 7]
-
-static void bs_shift_rows(bs_word* t, bs_word* b)
-{
- int i;
-
- for (i = 0; i < 128; i += 32) {
- BS_ASSIGN_8(t, i + 0, b, ( 0 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 8, b, ( 40 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 16, b, ( 80 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 24, b, (120 + i) & BS_IDX_MASK);
- }
-}
-
-#define BS_SHIFT_OFF_0 0
-#define BS_SHIFT_OFF_1 8
-#define BS_SHIFT_OFF_2 16
-#define BS_SHIFT_OFF_3 24
-
-/* Shift rows and mix columns.
- * See: See https://eprint.iacr.org/2009/129.pdf - Appendix A
- */
-
-#define BS_SHIFT_MIX_8(t, o, br0, br1, br2, br3, of) \
- of = br0[7] ^ br1[7]; \
- t[o+0] = br1[0] ^ br2[0] ^ br3[0] ^ of; \
- t[o+1] = br0[0] ^ br1[0] ^ br1[1] ^ br2[1] ^ br3[1] ^ of; \
- t[o+2] = br0[1] ^ br1[1] ^ br1[2] ^ br2[2] ^ br3[2]; \
- t[o+3] = br0[2] ^ br1[2] ^ br1[3] ^ br2[3] ^ br3[3] ^ of; \
- t[o+4] = br0[3] ^ br1[3] ^ br1[4] ^ br2[4] ^ br3[4] ^ of; \
- t[o+5] = br0[4] ^ br1[4] ^ br1[5] ^ br2[5] ^ br3[5]; \
- t[o+6] = br0[5] ^ br1[5] ^ br1[6] ^ br2[6] ^ br3[6]; \
- t[o+7] = br0[6] ^ br1[6] ^ br1[7] ^ br2[7] ^ br3[7]
-
-static void bs_shift_mix(bs_word* t, bs_word* b)
-{
- int i;
- word8 or0 = BS_ROW_OFF_0 + BS_SHIFT_OFF_0;
- word8 or1 = BS_ROW_OFF_1 + BS_SHIFT_OFF_1;
- word8 or2 = BS_ROW_OFF_2 + BS_SHIFT_OFF_2;
- word8 or3 = BS_ROW_OFF_3 + BS_SHIFT_OFF_3;
-
- for (i = 0; i < AES_BLOCK_BITS; i += AES_BLOCK_BITS / 4) {
- bs_word* br0 = b + or0;
- bs_word* br1 = b + or1;
- bs_word* br2 = b + or2;
- bs_word* br3 = b + or3;
- bs_word of;
-
- BS_SHIFT_MIX_8(t, i + 0, br0, br1, br2, br3, of);
- BS_SHIFT_MIX_8(t, i + 8, br1, br2, br3, br0, of);
- BS_SHIFT_MIX_8(t, i + 16, br2, br3, br0, br1, of);
- BS_SHIFT_MIX_8(t, i + 24, br3, br0, br1, br2, of);
-
- or0 = (or0 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or1 = (or1 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or2 = (or2 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or3 = (or3 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- }
-}
-
-static void bs_add_round_key(bs_word* out, bs_word* b, bs_word* rk)
-{
- xorbufout((byte*)out, (byte*)b, (byte*)rk, BS_BLOCK_SIZE);
-}
-
-static void bs_sub_bytes_blocks(bs_word* b)
-{
- int i;
-
- for (i = 0; i < AES_BLOCK_BITS; i += 8) {
- bs_sub_bytes(b + i);
- }
-}
-
-static const FLASH_QUALIFIER byte bs_rcon[] = {
- 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36,
- /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
-};
-
-static void bs_ke_sub_bytes(unsigned char* out, unsigned char *in) {
- bs_word block[AES_BLOCK_BITS];
- bs_word trans[AES_BLOCK_BITS];
-
- XMEMSET(block, 0, sizeof(block));
- XMEMCPY(block, in, 4);
-
- bs_transpose(trans, block);
- bs_sub_bytes_blocks(trans);
- bs_inv_transpose(block, trans);
-
- XMEMCPY(out, block, 4);
-}
-
-static void bs_ke_transform(unsigned char* out, unsigned char *in, word8 i) {
- /* Rotate the input 8 bits to the left */
-#ifdef LITTLE_ENDIAN_ORDER
- *(word32*)out = rotrFixed(*(word32*)in, 8);
-#else
- *(word32*)out = rotlFixed(*(word32*)in, 8);
-#endif
- bs_ke_sub_bytes(out, out);
- /* On just the first byte, add 2^i to the byte */
- out[0] ^= bs_rcon[i];
-}
-
-static void bs_expand_key(unsigned char *in, word32 sz) {
- unsigned char t[4];
- word32 o;
- word8 i = 0;
-
- if (sz == 176) {
- /* Total of 11 rounds - AES-128. */
- for (o = 16; o < sz; o += 16) {
- bs_ke_transform(t, in + o - 4, i);
- i++;
- *(word32*)(in + o + 0) = *(word32*)(in + o - 16) ^
- *(word32*) t;
- *(word32*)(in + o + 4) = *(word32*)(in + o - 12) ^
- *(word32*)(in + o + 0);
- *(word32*)(in + o + 8) = *(word32*)(in + o - 8) ^
- *(word32*)(in + o + 4);
- *(word32*)(in + o + 12) = *(word32*)(in + o - 4) ^
- *(word32*)(in + o + 8);
- }
- }
- else if (sz == 208) {
- /* Total of 13 rounds - AES-192. */
- for (o = 24; o < sz; o += 24) {
- bs_ke_transform(t, in + o - 4, i);
- i++;
- *(word32*)(in + o + 0) = *(word32*)(in + o - 24) ^
- *(word32*) t;
- *(word32*)(in + o + 4) = *(word32*)(in + o - 20) ^
- *(word32*)(in + o + 0);
- *(word32*)(in + o + 8) = *(word32*)(in + o - 16) ^
- *(word32*)(in + o + 4);
- *(word32*)(in + o + 12) = *(word32*)(in + o - 12) ^
- *(word32*)(in + o + 8);
- *(word32*)(in + o + 16) = *(word32*)(in + o - 8) ^
- *(word32*)(in + o + 12);
- *(word32*)(in + o + 20) = *(word32*)(in + o - 4) ^
- *(word32*)(in + o + 16);
- }
- }
- else if (sz == 240) {
- /* Total of 15 rounds - AES-256. */
- for (o = 32; o < sz; o += 16) {
- if ((o & 0x1f) == 0) {
- bs_ke_transform(t, in + o - 4, i);
- i++;
- }
- else {
- bs_ke_sub_bytes(t, in + o - 4);
- }
- *(word32*)(in + o + 0) = *(word32*)(in + o - 32) ^
- *(word32*) t;
- *(word32*)(in + o + 4) = *(word32*)(in + o - 28) ^
- *(word32*)(in + o + 0);
- *(word32*)(in + o + 8) = *(word32*)(in + o - 24) ^
- *(word32*)(in + o + 4);
- *(word32*)(in + o + 12) = *(word32*)(in + o - 20) ^
- *(word32*)(in + o + 8);
- }
- }
-}
-
-static void bs_set_key(bs_word* rk, const byte* key, word32 keyLen,
- word32 rounds)
-{
- int i;
- byte bs_key[15 * WC_AES_BLOCK_SIZE];
- int ksSz = (rounds + 1) * WC_AES_BLOCK_SIZE;
- bs_word block[AES_BLOCK_BITS];
-
- /* Fist round. */
- XMEMCPY(bs_key, key, keyLen);
- bs_expand_key(bs_key, ksSz);
-
- for (i = 0; i < ksSz; i += WC_AES_BLOCK_SIZE) {
- int k;
-
- XMEMCPY(block, bs_key + i, WC_AES_BLOCK_SIZE);
- for (k = BS_BLOCK_WORDS; k < AES_BLOCK_BITS; k += BS_BLOCK_WORDS) {
- int l;
- for (l = 0; l < BS_BLOCK_WORDS; l++) {
- block[k + l] = block[l];
- }
- }
- bs_transpose(rk, block);
- rk += AES_BLOCK_BITS;
- }
-}
-
-static void bs_encrypt(bs_word* state, bs_word* rk, word32 r)
-{
- word32 i;
- bs_word trans[AES_BLOCK_BITS];
-
- bs_transpose(trans, state);
-
- bs_add_round_key(trans, trans, rk);
- for (i = 1; i < r; i++) {
- bs_sub_bytes_blocks(trans);
- bs_shift_mix(state, trans);
- rk += AES_BLOCK_BITS;
- bs_add_round_key(trans, state, rk);
- }
- bs_sub_bytes_blocks(trans);
- bs_shift_rows(state, trans);
- rk += AES_BLOCK_BITS;
- bs_add_round_key(trans, state, rk);
- bs_inv_transpose(state, trans);
-}
-
-#ifndef HAVE_CUDA
-/* Encrypt a block using AES.
- *
- * @param [in] aes AES object.
- * @param [in] inBlock Block to encrypt.
- * @param [out] outBlock Encrypted block.
- * @param [in] r Rounds divided by 2.
- */
-static void AesEncrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r)
-{
- bs_word state[AES_BLOCK_BITS];
-
- (void)r;
-
- XMEMCPY(state, inBlock, WC_AES_BLOCK_SIZE);
- XMEMSET(((byte*)state) + WC_AES_BLOCK_SIZE, 0, sizeof(state) - WC_AES_BLOCK_SIZE);
-
- bs_encrypt(state, aes->bs_key, aes->rounds);
-
- XMEMCPY(outBlock, state, WC_AES_BLOCK_SIZE);
-}
-
-#if defined(HAVE_AES_ECB) && !(defined(WOLFSSL_IMX6_CAAM) && \
- !defined(NO_IMX6_CAAM_AES) && !defined(WOLFSSL_QNX_CAAM))
-/* Encrypt a number of blocks using AES.
- *
- * @param [in] aes AES object.
- * @param [in] in Block to encrypt.
- * @param [out] out Encrypted block.
- * @param [in] sz Number of blocks to encrypt.
- */
-static void AesEncryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz)
-{
- bs_word state[AES_BLOCK_BITS];
-
- while (sz >= BS_BLOCK_SIZE) {
- XMEMCPY(state, in, BS_BLOCK_SIZE);
- bs_encrypt(state, aes->bs_key, aes->rounds);
- XMEMCPY(out, state, BS_BLOCK_SIZE);
- sz -= BS_BLOCK_SIZE;
- in += BS_BLOCK_SIZE;
- out += BS_BLOCK_SIZE;
- }
- if (sz > 0) {
- XMEMCPY(state, in, sz);
- XMEMSET(((byte*)state) + sz, 0, sizeof(state) - sz);
- bs_encrypt(state, aes->bs_key, aes->rounds);
- XMEMCPY(out, state, sz);
- }
-}
-#endif
-#else
-extern void AesEncrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r);
-extern void AesEncryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz);
-#endif /* HAVE_CUDA */
-
-#endif /* !WC_AES_BITSLICED */
-
-/* this section disabled with NO_AES_192 */
-/* calling this one when missing NO_AES_192 */
-static WARN_UNUSED_RESULT int wc_AesEncrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
-{
-#if defined(MAX3266X_AES)
- word32 keySize;
-#endif
-#if defined(MAX3266X_CB)
- int ret_cb;
-#endif
- word32 r;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- r = aes->rounds >> 1;
-
- if (r > 7 || r == 0) {
- WOLFSSL_ERROR_VERBOSE(KEYUSAGE_E);
- return KEYUSAGE_E;
- }
-
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- #ifdef DEBUG_AESNI
- printf("about to aes encrypt\n");
- printf("in = %p\n", inBlock);
- printf("out = %p\n", outBlock);
- printf("aes->key = %p\n", aes->key);
- printf("aes->rounds = %d\n", aes->rounds);
- printf("sz = %d\n", WC_AES_BLOCK_SIZE);
- #endif
-
- /* check alignment, decrypt doesn't need alignment */
- if ((wc_ptr_t)inBlock % AESNI_ALIGN) {
- #ifndef NO_WOLFSSL_ALLOC_ALIGN
- byte* tmp = (byte*)XMALLOC(WC_AES_BLOCK_SIZE + AESNI_ALIGN, aes->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- byte* tmp_align;
- if (tmp == NULL)
- return MEMORY_E;
-
- tmp_align = tmp + (AESNI_ALIGN - ((wc_ptr_t)tmp % AESNI_ALIGN));
-
- XMEMCPY(tmp_align, inBlock, WC_AES_BLOCK_SIZE);
- AES_ECB_encrypt_AESNI(tmp_align, tmp_align, WC_AES_BLOCK_SIZE,
- (byte*)aes->key, (int)aes->rounds);
- XMEMCPY(outBlock, tmp_align, WC_AES_BLOCK_SIZE);
- XFREE(tmp, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return 0;
- #else
- WOLFSSL_MSG("AES-ECB encrypt with bad alignment");
- WOLFSSL_ERROR_VERBOSE(BAD_ALIGN_E);
- return BAD_ALIGN_E;
- #endif
- }
-
- AES_ECB_encrypt_AESNI(inBlock, outBlock, WC_AES_BLOCK_SIZE, (byte*)aes->key,
- (int)aes->rounds);
-
- return 0;
- }
- else {
- #ifdef DEBUG_AESNI
- printf("Skipping AES-NI\n");
- #endif
- }
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_encrypt_AARCH64(inBlock, outBlock, (byte*)aes->key,
- (int)aes->rounds);
- return 0;
- }
-#elif !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_encrypt_AARCH32(inBlock, outBlock, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_encrypt(inBlock, outBlock, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds);
-#endif
- return 0;
-#endif /* WOLFSSL_AESNI */
-#if defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
- AES_ECB_encrypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE);
- return 0;
-#endif
-
-#if defined(WOLFSSL_IMXRT_DCP)
- if (aes->keylen == 16) {
- DCPAesEcbEncrypt(aes, outBlock, inBlock, WC_AES_BLOCK_SIZE);
- return 0;
- }
-#endif
-
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- if (aes->useSWCrypt == 0) {
- return se050_aes_crypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE,
- AES_ENCRYPTION, kAlgorithm_SSS_AES_ECB);
- }
-#endif
-
-#if defined(WOLFSSL_ESPIDF) && defined(NEED_AES_HW_FALLBACK)
- ESP_LOGV(TAG, "wc_AesEncrypt fallback check");
- if (wc_esp32AesSupportedKeyLen(aes)) {
- return wc_esp32AesEncrypt(aes, inBlock, outBlock);
- }
- else {
- /* For example, the ESP32-S3 does not support HW for len = 24,
- * so fall back to SW */
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesEncrypt HW Falling back, unsupported keylen = %d",
- aes->keylen);
- #endif
- }
-#endif
-
-#if defined(MAX3266X_AES)
- if (wc_AesGetKeySize(aes, &keySize) == 0) {
- return wc_MXC_TPU_AesEncrypt(inBlock, (byte*)aes->reg, (byte*)aes->key,
- MXC_TPU_MODE_ECB, WC_AES_BLOCK_SIZE,
- outBlock, (unsigned int)keySize);
- }
-#endif
-#if defined(MAX3266X_CB) && defined(HAVE_AES_ECB) /* Can do a basic ECB block */
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- ret_cb = wc_CryptoCb_AesEcbEncrypt(aes, outBlock, inBlock,
- WC_AES_BLOCK_SIZE);
- if (ret_cb != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret_cb;
- /* fall-through when unavailable */
- }
-#endif
-
- AesEncrypt_C(aes, inBlock, outBlock, r);
-
- return 0;
-} /* wc_AesEncrypt */
-#endif
-#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT || HAVE_AESGCM */
-
-#if defined(HAVE_AES_DECRYPT)
-#if ((defined(HAVE_AES_CBC) && !defined(WOLFSSL_DEVCRYPTO_CBC)) || \
- defined(HAVE_AES_ECB) || defined(WOLFSSL_AES_DIRECT)) && \
- (defined(__aarch64__) || !defined(WOLFSSL_ARMASM))
-
-#ifndef WC_AES_BITSLICED
-#ifndef WC_NO_CACHE_RESISTANT
-#ifndef WOLFSSL_AES_SMALL_TABLES
-/* load 4 Td Tables into cache by cache line stride */
-static WARN_UNUSED_RESULT WC_INLINE word32 PreFetchTd(void)
-{
- word32 x = 0;
- int i,j;
-
- for (i = 0; i < 4; i++) {
- /* 256 elements, each one is 4 bytes */
- for (j = 0; j < 256; j += WC_CACHE_LINE_SZ/4) {
- x &= Td[i][j];
- }
- }
- return x;
-}
-#endif /* !WOLFSSL_AES_SMALL_TABLES */
-
-/* load Td Table4 into cache by cache line stride */
-static WARN_UNUSED_RESULT WC_INLINE word32 PreFetchTd4(void)
-{
-#ifndef WOLFSSL_AES_TOUCH_LINES
- word32 x = 0;
- int i;
-
- for (i = 0; i < 256; i += WC_CACHE_LINE_SZ) {
- x &= (word32)Td4[i];
- }
- return x;
-#else
- return 0;
-#endif
-}
-#endif /* !WC_NO_CACHE_RESISTANT */
-
-/* Decrypt a block using AES.
- *
- * @param [in] aes AES object.
- * @param [in] inBlock Block to encrypt.
- * @param [out] outBlock Encrypted block.
- * @param [in] r Rounds divided by 2.
- */
-static void AesDecrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r)
-{
- word32 s0 = 0, s1 = 0, s2 = 0, s3 = 0;
- word32 t0 = 0, t1 = 0, t2 = 0, t3 = 0;
- const word32* rk;
-
-#ifdef WC_C_DYNAMIC_FALLBACK
- rk = aes->key_C_fallback;
-#else
- rk = aes->key;
-#endif
-
- /*
- * map byte array block to cipher state
- * and add initial round key:
- */
- XMEMCPY(&s0, inBlock, sizeof(s0));
- XMEMCPY(&s1, inBlock + sizeof(s0), sizeof(s1));
- XMEMCPY(&s2, inBlock + 2 * sizeof(s0), sizeof(s2));
- XMEMCPY(&s3, inBlock + 3 * sizeof(s0), sizeof(s3));
-
-#ifdef LITTLE_ENDIAN_ORDER
- s0 = ByteReverseWord32(s0);
- s1 = ByteReverseWord32(s1);
- s2 = ByteReverseWord32(s2);
- s3 = ByteReverseWord32(s3);
-#endif
-
- s0 ^= rk[0];
- s1 ^= rk[1];
- s2 ^= rk[2];
- s3 ^= rk[3];
-
-#ifndef WOLFSSL_AES_SMALL_TABLES
-#ifndef WC_NO_CACHE_RESISTANT
- s0 |= PreFetchTd();
-#endif
-
-#ifndef WOLFSSL_AES_TOUCH_LINES
-/* Unroll the loop. */
-#define DEC_ROUND_T_S(o) \
- t0 = GetTable(Td[0], GETBYTE(s0, 3)) ^ GetTable(Td[1], GETBYTE(s3, 2)) ^ \
- GetTable(Td[2], GETBYTE(s2, 1)) ^ GetTable(Td[3], GETBYTE(s1, 0)) ^ rk[(o)+4]; \
- t1 = GetTable(Td[0], GETBYTE(s1, 3)) ^ GetTable(Td[1], GETBYTE(s0, 2)) ^ \
- GetTable(Td[2], GETBYTE(s3, 1)) ^ GetTable(Td[3], GETBYTE(s2, 0)) ^ rk[(o)+5]; \
- t2 = GetTable(Td[0], GETBYTE(s2, 3)) ^ GetTable(Td[1], GETBYTE(s1, 2)) ^ \
- GetTable(Td[2], GETBYTE(s0, 1)) ^ GetTable(Td[3], GETBYTE(s3, 0)) ^ rk[(o)+6]; \
- t3 = GetTable(Td[0], GETBYTE(s3, 3)) ^ GetTable(Td[1], GETBYTE(s2, 2)) ^ \
- GetTable(Td[2], GETBYTE(s1, 1)) ^ GetTable(Td[3], GETBYTE(s0, 0)) ^ rk[(o)+7]
-#define DEC_ROUND_S_T(o) \
- s0 = GetTable(Td[0], GETBYTE(t0, 3)) ^ GetTable(Td[1], GETBYTE(t3, 2)) ^ \
- GetTable(Td[2], GETBYTE(t2, 1)) ^ GetTable(Td[3], GETBYTE(t1, 0)) ^ rk[(o)+0]; \
- s1 = GetTable(Td[0], GETBYTE(t1, 3)) ^ GetTable(Td[1], GETBYTE(t0, 2)) ^ \
- GetTable(Td[2], GETBYTE(t3, 1)) ^ GetTable(Td[3], GETBYTE(t2, 0)) ^ rk[(o)+1]; \
- s2 = GetTable(Td[0], GETBYTE(t2, 3)) ^ GetTable(Td[1], GETBYTE(t1, 2)) ^ \
- GetTable(Td[2], GETBYTE(t0, 1)) ^ GetTable(Td[3], GETBYTE(t3, 0)) ^ rk[(o)+2]; \
- s3 = GetTable(Td[0], GETBYTE(t3, 3)) ^ GetTable(Td[1], GETBYTE(t2, 2)) ^ \
- GetTable(Td[2], GETBYTE(t1, 1)) ^ GetTable(Td[3], GETBYTE(t0, 0)) ^ rk[(o)+3]
-#else
-#define DEC_ROUND_T_S(o) \
- GetTable_Multi(Td[0], &t0, GETBYTE(s0, 3), &t1, GETBYTE(s1, 3), \
- &t2, GETBYTE(s2, 3), &t3, GETBYTE(s3, 3)); \
- XorTable_Multi(Td[1], &t0, GETBYTE(s3, 2), &t1, GETBYTE(s0, 2), \
- &t2, GETBYTE(s1, 2), &t3, GETBYTE(s2, 2)); \
- XorTable_Multi(Td[2], &t0, GETBYTE(s2, 1), &t1, GETBYTE(s3, 1), \
- &t2, GETBYTE(s0, 1), &t3, GETBYTE(s1, 1)); \
- XorTable_Multi(Td[3], &t0, GETBYTE(s1, 0), &t1, GETBYTE(s2, 0), \
- &t2, GETBYTE(s3, 0), &t3, GETBYTE(s0, 0)); \
- t0 ^= rk[(o)+4]; t1 ^= rk[(o)+5]; t2 ^= rk[(o)+6]; t3 ^= rk[(o)+7];
-
-#define DEC_ROUND_S_T(o) \
- GetTable_Multi(Td[0], &s0, GETBYTE(t0, 3), &s1, GETBYTE(t1, 3), \
- &s2, GETBYTE(t2, 3), &s3, GETBYTE(t3, 3)); \
- XorTable_Multi(Td[1], &s0, GETBYTE(t3, 2), &s1, GETBYTE(t0, 2), \
- &s2, GETBYTE(t1, 2), &s3, GETBYTE(t2, 2)); \
- XorTable_Multi(Td[2], &s0, GETBYTE(t2, 1), &s1, GETBYTE(t3, 1), \
- &s2, GETBYTE(t0, 1), &s3, GETBYTE(t1, 1)); \
- XorTable_Multi(Td[3], &s0, GETBYTE(t1, 0), &s1, GETBYTE(t2, 0), \
- &s2, GETBYTE(t3, 0), &s3, GETBYTE(t0, 0)); \
- s0 ^= rk[(o)+0]; s1 ^= rk[(o)+1]; s2 ^= rk[(o)+2]; s3 ^= rk[(o)+3];
-#endif
-
-#ifndef WOLFSSL_AES_NO_UNROLL
- DEC_ROUND_T_S( 0);
- DEC_ROUND_S_T( 8); DEC_ROUND_T_S( 8);
- DEC_ROUND_S_T(16); DEC_ROUND_T_S(16);
- DEC_ROUND_S_T(24); DEC_ROUND_T_S(24);
- DEC_ROUND_S_T(32); DEC_ROUND_T_S(32);
- if (r > 5) {
- DEC_ROUND_S_T(40); DEC_ROUND_T_S(40);
- if (r > 6) {
- DEC_ROUND_S_T(48); DEC_ROUND_T_S(48);
- }
- }
- rk += r * 8;
-#else
-
- /*
- * Nr - 1 full rounds:
- */
-
- for (;;) {
- DEC_ROUND_T_S(0);
-
- rk += 8;
- if (--r == 0) {
- break;
- }
-
- DEC_ROUND_S_T(0);
- }
-#endif
- /*
- * apply last round and
- * map cipher state to byte array block:
- */
-
-#ifndef WC_NO_CACHE_RESISTANT
- t0 |= PreFetchTd4();
-#endif
-
- s0 = GetTable8_4(Td4, GETBYTE(t0, 3), GETBYTE(t3, 2),
- GETBYTE(t2, 1), GETBYTE(t1, 0)) ^ rk[0];
- s1 = GetTable8_4(Td4, GETBYTE(t1, 3), GETBYTE(t0, 2),
- GETBYTE(t3, 1), GETBYTE(t2, 0)) ^ rk[1];
- s2 = GetTable8_4(Td4, GETBYTE(t2, 3), GETBYTE(t1, 2),
- GETBYTE(t0, 1), GETBYTE(t3, 0)) ^ rk[2];
- s3 = GetTable8_4(Td4, GETBYTE(t3, 3), GETBYTE(t2, 2),
- GETBYTE(t1, 1), GETBYTE(t0, 0)) ^ rk[3];
-#else
-#ifndef WC_NO_CACHE_RESISTANT
- s0 |= PreFetchTd4();
-#endif
-
- r *= 2;
- for (rk += 4; r > 1; r--, rk += 4) {
- t0 =
- ((word32)GetTable8(Td4, GETBYTE(s0, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 0))) ^
- rk[0];
- t1 =
- ((word32)GetTable8(Td4, GETBYTE(s1, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 0))) ^
- rk[1];
- t2 =
- ((word32)GetTable8(Td4, GETBYTE(s2, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 0))) ^
- rk[2];
- t3 =
- ((word32)GetTable8(Td4, GETBYTE(s3, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 0))) ^
- rk[3];
-
- s0 =
- (inv_col_mul(t0, 0, 2, 1, 3) << 24) ^
- (inv_col_mul(t0, 3, 1, 0, 2) << 16) ^
- (inv_col_mul(t0, 2, 0, 3, 1) << 8) ^
- (inv_col_mul(t0, 1, 3, 2, 0) );
- s1 =
- (inv_col_mul(t1, 0, 2, 1, 3) << 24) ^
- (inv_col_mul(t1, 3, 1, 0, 2) << 16) ^
- (inv_col_mul(t1, 2, 0, 3, 1) << 8) ^
- (inv_col_mul(t1, 1, 3, 2, 0) );
- s2 =
- (inv_col_mul(t2, 0, 2, 1, 3) << 24) ^
- (inv_col_mul(t2, 3, 1, 0, 2) << 16) ^
- (inv_col_mul(t2, 2, 0, 3, 1) << 8) ^
- (inv_col_mul(t2, 1, 3, 2, 0) );
- s3 =
- (inv_col_mul(t3, 0, 2, 1, 3) << 24) ^
- (inv_col_mul(t3, 3, 1, 0, 2) << 16) ^
- (inv_col_mul(t3, 2, 0, 3, 1) << 8) ^
- (inv_col_mul(t3, 1, 3, 2, 0) );
- }
-
- t0 =
- ((word32)GetTable8(Td4, GETBYTE(s0, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 0)));
- t1 =
- ((word32)GetTable8(Td4, GETBYTE(s1, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 0)));
- t2 =
- ((word32)GetTable8(Td4, GETBYTE(s2, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s3, 0)));
- t3 =
- ((word32)GetTable8(Td4, GETBYTE(s3, 3)) << 24) ^
- ((word32)GetTable8(Td4, GETBYTE(s2, 2)) << 16) ^
- ((word32)GetTable8(Td4, GETBYTE(s1, 1)) << 8) ^
- ((word32)GetTable8(Td4, GETBYTE(s0, 0)));
- s0 = t0 ^ rk[0];
- s1 = t1 ^ rk[1];
- s2 = t2 ^ rk[2];
- s3 = t3 ^ rk[3];
-#endif
-
- /* write out */
-#ifdef LITTLE_ENDIAN_ORDER
- s0 = ByteReverseWord32(s0);
- s1 = ByteReverseWord32(s1);
- s2 = ByteReverseWord32(s2);
- s3 = ByteReverseWord32(s3);
-#endif
-
- XMEMCPY(outBlock, &s0, sizeof(s0));
- XMEMCPY(outBlock + sizeof(s0), &s1, sizeof(s1));
- XMEMCPY(outBlock + 2 * sizeof(s0), &s2, sizeof(s2));
- XMEMCPY(outBlock + 3 * sizeof(s0), &s3, sizeof(s3));
-
-}
-
-#if defined(HAVE_AES_ECB) && !(defined(WOLFSSL_IMX6_CAAM) && \
- !defined(NO_IMX6_CAAM_AES) && !defined(WOLFSSL_QNX_CAAM)) && \
- !defined(MAX3266X_AES)
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
-/* Decrypt a number of blocks using AES.
- *
- * @param [in] aes AES object.
- * @param [in] in Block to encrypt.
- * @param [out] out Encrypted block.
- * @param [in] sz Number of blocks to encrypt.
- */
-static void AesDecryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz)
-{
- word32 i;
-
- for (i = 0; i < sz; i += WC_AES_BLOCK_SIZE) {
- AesDecrypt_C(aes, in, out, aes->rounds >> 1);
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-}
-#endif
-#endif
-
-#else /* WC_AES_BITSLICED */
-
-/* http://cs-www.cs.yale.edu/homes/peralta/CircuitStuff/Sinv.txt */
-static void bs_inv_sub_bytes(bs_word u[8])
-{
- bs_word U0, U1, U2, U3, U4, U5, U6, U7;
- bs_word Y0, Y1, Y2, Y3, Y4, Y5, Y6, Y7;
- bs_word RTL0, RTL1, RTL2;
- bs_word sa0, sa1;
- bs_word sb0, sb1;
- bs_word ab0, ab1, ab2, ab3;
- bs_word ab20, ab21, ab22, ab23;
- bs_word al, ah, aa, bl, bh, bb;
- bs_word abcd1, abcd2, abcd3, abcd4, abcd5, abcd6;
- bs_word ph11, ph12, ph13, ph01, ph02, ph03;
- bs_word pl01, pl02, pl03, pl11, pl12, pl13;
- bs_word r1, r2, r3, r4, r5, r6, r7, r8, r9;
- bs_word rr1, rr2;
- bs_word r10, r11;
- bs_word cp1, cp2, cp3, cp4;
- bs_word vr1, vr2, vr3;
- bs_word pr1, pr2, pr3;
- bs_word wr1, wr2, wr3;
- bs_word qr1, qr2, qr3;
- bs_word tinv1, tinv2, tinv3, tinv4, tinv5, tinv6, tinv7, tinv8, tinv9;
- bs_word tinv10, tinv11, tinv12, tinv13;
- bs_word t01, t02;
- bs_word d0, d1, d2, d3;
- bs_word dl, dd, dh;
- bs_word sd0, sd1;
- bs_word p0, p1, p2, p3, p4, p6, p7;
- bs_word X11, X13, X14, X16, X18, X19;
- bs_word S0, S1, S2, S3, S4, S5, S6, S7;
-
- U0 = u[7];
- U1 = u[6];
- U2 = u[5];
- U3 = u[4];
- U4 = u[3];
- U5 = u[2];
- U6 = u[1];
- U7 = u[0];
-
- Y0 = U0 ^ U3;
- Y2 = ~(U1 ^ U3);
- Y4 = U0 ^ Y2;
- RTL0 = U6 ^ U7;
- Y1 = Y2 ^ RTL0;
- Y7 = ~(U2 ^ Y1);
- RTL1 = U3 ^ U4;
- Y6 = ~(U7 ^ RTL1);
- Y3 = Y1 ^ RTL1;
- RTL2 = ~(U0 ^ U2);
- Y5 = U5 ^ RTL2;
- sa1 = Y0 ^ Y2;
- sa0 = Y1 ^ Y3;
- sb1 = Y4 ^ Y6;
- sb0 = Y5 ^ Y7;
- ah = Y0 ^ Y1;
- al = Y2 ^ Y3;
- aa = sa0 ^ sa1;
- bh = Y4 ^ Y5;
- bl = Y6 ^ Y7;
- bb = sb0 ^ sb1;
- ab20 = sa0 ^ sb0;
- ab22 = al ^ bl;
- ab23 = Y3 ^ Y7;
- ab21 = sa1 ^ sb1;
- abcd1 = ah & bh;
- rr1 = Y0 & Y4;
- ph11 = ab20 ^ abcd1;
- t01 = Y1 & Y5;
- ph01 = t01 ^ abcd1;
- abcd2 = al & bl;
- r1 = Y2 & Y6;
- pl11 = ab22 ^ abcd2;
- r2 = Y3 & Y7;
- pl01 = r2 ^ abcd2;
- r3 = sa0 & sb0;
- vr1 = aa & bb;
- pr1 = vr1 ^ r3;
- wr1 = sa1 & sb1;
- qr1 = wr1 ^ r3;
- ab0 = ph11 ^ rr1;
- ab1 = ph01 ^ ab21;
- ab2 = pl11 ^ r1;
- ab3 = pl01 ^ qr1;
- cp1 = ab0 ^ pr1;
- cp2 = ab1 ^ qr1;
- cp3 = ab2 ^ pr1;
- cp4 = ab3 ^ ab23;
- tinv1 = cp3 ^ cp4;
- tinv2 = cp3 & cp1;
- tinv3 = cp2 ^ tinv2;
- tinv4 = cp1 ^ cp2;
- tinv5 = cp4 ^ tinv2;
- tinv6 = tinv5 & tinv4;
- tinv7 = tinv3 & tinv1;
- d2 = cp4 ^ tinv7;
- d0 = cp2 ^ tinv6;
- tinv8 = cp1 & cp4;
- tinv9 = tinv4 & tinv8;
- tinv10 = tinv4 ^ tinv2;
- d1 = tinv9 ^ tinv10;
- tinv11 = cp2 & cp3;
- tinv12 = tinv1 & tinv11;
- tinv13 = tinv1 ^ tinv2;
- d3 = tinv12 ^ tinv13;
- sd1 = d1 ^ d3;
- sd0 = d0 ^ d2;
- dl = d0 ^ d1;
- dh = d2 ^ d3;
- dd = sd0 ^ sd1;
- abcd3 = dh & bh;
- rr2 = d3 & Y4;
- t02 = d2 & Y5;
- abcd4 = dl & bl;
- r4 = d1 & Y6;
- r5 = d0 & Y7;
- r6 = sd0 & sb0;
- vr2 = dd & bb;
- wr2 = sd1 & sb1;
- abcd5 = dh & ah;
- r7 = d3 & Y0;
- r8 = d2 & Y1;
- abcd6 = dl & al;
- r9 = d1 & Y2;
- r10 = d0 & Y3;
- r11 = sd0 & sa0;
- vr3 = dd & aa;
- wr3 = sd1 & sa1;
- ph12 = rr2 ^ abcd3;
- ph02 = t02 ^ abcd3;
- pl12 = r4 ^ abcd4;
- pl02 = r5 ^ abcd4;
- pr2 = vr2 ^ r6;
- qr2 = wr2 ^ r6;
- p0 = ph12 ^ pr2;
- p1 = ph02 ^ qr2;
- p2 = pl12 ^ pr2;
- p3 = pl02 ^ qr2;
- ph13 = r7 ^ abcd5;
- ph03 = r8 ^ abcd5;
- pl13 = r9 ^ abcd6;
- pl03 = r10 ^ abcd6;
- pr3 = vr3 ^ r11;
- qr3 = wr3 ^ r11;
- p4 = ph13 ^ pr3;
- S7 = ph03 ^ qr3;
- p6 = pl13 ^ pr3;
- p7 = pl03 ^ qr3;
- S3 = p1 ^ p6;
- S6 = p2 ^ p6;
- S0 = p3 ^ p6;
- X11 = p0 ^ p2;
- S5 = S0 ^ X11;
- X13 = p4 ^ p7;
- X14 = X11 ^ X13;
- S1 = S3 ^ X14;
- X16 = p1 ^ S7;
- S2 = X14 ^ X16;
- X18 = p0 ^ p4;
- X19 = S5 ^ X16;
- S4 = X18 ^ X19;
-
- u[0] = S7;
- u[1] = S6;
- u[2] = S5;
- u[3] = S4;
- u[4] = S3;
- u[5] = S2;
- u[6] = S1;
- u[7] = S0;
-}
-
-static void bs_inv_shift_rows(bs_word* b)
-{
- bs_word t[AES_BLOCK_BITS];
- int i;
-
- for (i = 0; i < 128; i += 32) {
- BS_ASSIGN_8(t, i + 0, b, ( 0 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 8, b, (104 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 16, b, ( 80 + i) & BS_IDX_MASK);
- BS_ASSIGN_8(t, i + 24, b, ( 56 + i) & BS_IDX_MASK);
- }
-
- XMEMCPY(b, t, sizeof(t));
-}
-
-#define O0 0
-#define O1 8
-#define O2 16
-#define O3 24
-
-#define BS_INV_MIX_SHIFT_8(br, b, O0, O1, O2, O3, of0, of1, of2) \
- of0 = b[O0+7] ^ b[O0+6] ^ b[O0+5] ^ b[O1 + 7] ^ b[O1+5] ^ \
- b[O2+6] ^ b[O2+5] ^ b[O3+5]; \
- of1 = b[O0+7] ^ b[O0+6] ^ b[O1+6] ^ \
- b[O2+7] ^ b[O2+6] ^ b[O3+6]; \
- of2 = b[O0+7] ^ b[O1+7] ^ \
- b[O2+7] ^ b[O3+7]; \
- \
- br[0] = b[O1+0] ^ \
- b[O2+0] ^ b[O3+0] ^ of0; \
- br[1] = b[O0+0] ^ b[O1+0] ^ b[O1+1] ^ \
- b[O2+1] ^ b[O3+1] ^ of0 ^ of1; \
- br[2] = b[O0+1] ^ b[O0+0] ^ b[O1+1] ^ b[O1+2] ^ \
- b[O2+2] ^ b[O2+0] ^ b[O3+2] ^ of1 ^ of2; \
- br[3] = b[O0+2] ^ b[O0+1] ^ b[O0+0] ^ b[O1+0] ^ b[O1+2] ^ b[O1+3] ^ \
- b[O2+3] ^ b[O2+1] ^ b[O2+0] ^ b[O3+3] ^ b[O3+0] ^ of0 ^ of2; \
- br[4] = b[O0+3] ^ b[O0+2] ^ b[O0+1] ^ b[O1+1] ^ b[O1+3] ^ b[O1+4] ^ \
- b[O2+4] ^ b[O2+2] ^ b[O2+1] ^ b[O3+4] ^ b[O3+1] ^ of0 ^ of1; \
- br[5] = b[O0+4] ^ b[O0+3] ^ b[O0+2] ^ b[O1+2] ^ b[O1+4] ^ b[O1+5] ^ \
- b[O2+5] ^ b[O2+3] ^ b[O2+2] ^ b[O3+5] ^ b[O3+2] ^ of1 ^ of2; \
- br[6] = b[O0+5] ^ b[O0+4] ^ b[O0+3] ^ b[O1+3] ^ b[O1+5] ^ b[O1+6] ^ \
- b[O2+6] ^ b[O2+4] ^ b[O2+3] ^ b[O3+6] ^ b[O3+3] ^ of2; \
- br[7] = b[O0+6] ^ b[O0+5] ^ b[O0+4] ^ b[O1+4] ^ b[O1+6] ^ b[O1+7] ^ \
- b[O2+7] ^ b[O2+5] ^ b[O2+4] ^ b[O3+7] ^ b[O3+4]
-
-/* Inverse mix columns and shift rows. */
-static void bs_inv_mix_shift(bs_word* t, bs_word* b)
-{
- bs_word* bp = b;
- word8 or0 = BS_ROW_OFF_0 + BS_SHIFT_OFF_0;
- word8 or1 = BS_ROW_OFF_1 + BS_SHIFT_OFF_1;
- word8 or2 = BS_ROW_OFF_2 + BS_SHIFT_OFF_2;
- word8 or3 = BS_ROW_OFF_3 + BS_SHIFT_OFF_3;
- int i;
-
- for (i = 0; i < AES_BLOCK_BITS / 4; i += AES_BLOCK_BITS / 16) {
- bs_word* br;
- bs_word of0;
- bs_word of1;
- bs_word of2;
-
- br = t + or0;
- BS_INV_MIX_SHIFT_8(br, bp, O0, O1, O2, O3, of0, of1, of2);
- br = t + or1;
- BS_INV_MIX_SHIFT_8(br, bp, O1, O2, O3, O0, of0, of1, of2);
- br = t + or2;
- BS_INV_MIX_SHIFT_8(br, bp, O2, O3, O0, O1, of0, of1, of2);
- br = t + or3;
- BS_INV_MIX_SHIFT_8(br, bp, O3, O0, O1, O2, of0, of1, of2);
-
- or0 = (or0 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or1 = (or1 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or2 = (or2 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
- or3 = (or3 + AES_BLOCK_BITS / 4) & BS_IDX_MASK;
-
- bp += AES_BLOCK_BITS / 4;
- }
-}
-
-static void bs_inv_sub_bytes_blocks(bs_word* b)
-{
- int i;
-
- for (i = 0; i < AES_BLOCK_BITS; i += 8) {
- bs_inv_sub_bytes(b + i);
- }
-}
-
-static void bs_decrypt(bs_word* state, bs_word* rk, word32 r)
-{
- int i;
- bs_word trans[AES_BLOCK_BITS];
-
- bs_transpose(trans, state);
-
- rk += r * AES_BLOCK_BITS;
- bs_add_round_key(trans, trans, rk);
- bs_inv_shift_rows(trans);
- bs_inv_sub_bytes_blocks(trans);
- rk -= AES_BLOCK_BITS;
- bs_add_round_key(trans, trans, rk);
- for (i = (int)r - 2; i >= 0; i--) {
- bs_inv_mix_shift(state, trans);
- bs_inv_sub_bytes_blocks(state);
- rk -= AES_BLOCK_BITS;
- bs_add_round_key(trans, state, rk);
- }
-
- bs_inv_transpose(state, trans);
-}
-
-#ifdef WOLFSSL_AES_DIRECT
-/* Decrypt a block using AES.
- *
- * @param [in] aes AES object.
- * @param [in] inBlock Block to encrypt.
- * @param [out] outBlock Encrypted block.
- * @param [in] r Rounds divided by 2.
- */
-static void AesDecrypt_C(Aes* aes, const byte* inBlock, byte* outBlock,
- word32 r)
-{
- bs_word state[AES_BLOCK_BITS];
-
- (void)r;
-
- XMEMCPY(state, inBlock, WC_AES_BLOCK_SIZE);
- XMEMSET(((byte*)state) + WC_AES_BLOCK_SIZE, 0, sizeof(state) - WC_AES_BLOCK_SIZE);
-
- bs_decrypt(state, aes->bs_key, aes->rounds);
-
- XMEMCPY(outBlock, state, WC_AES_BLOCK_SIZE);
-}
-#endif
-
-#if defined(HAVE_AES_ECB) && !(defined(WOLFSSL_IMX6_CAAM) && \
- !defined(NO_IMX6_CAAM_AES) && !defined(WOLFSSL_QNX_CAAM))
-/* Decrypt a number of blocks using AES.
- *
- * @param [in] aes AES object.
- * @param [in] in Block to encrypt.
- * @param [out] out Encrypted block.
- * @param [in] sz Number of blocks to encrypt.
- */
-static void AesDecryptBlocks_C(Aes* aes, const byte* in, byte* out, word32 sz)
-{
- bs_word state[AES_BLOCK_BITS];
-
- while (sz >= BS_BLOCK_SIZE) {
- XMEMCPY(state, in, BS_BLOCK_SIZE);
- bs_decrypt(state, aes->bs_key, aes->rounds);
- XMEMCPY(out, state, BS_BLOCK_SIZE);
- sz -= BS_BLOCK_SIZE;
- in += BS_BLOCK_SIZE;
- out += BS_BLOCK_SIZE;
- }
- if (sz > 0) {
- XMEMCPY(state, in, sz);
- XMEMSET(((byte*)state) + sz, 0, sizeof(state) - sz);
- bs_decrypt(state, aes->bs_key, aes->rounds);
- XMEMCPY(out, state, sz);
- }
-}
-#endif
-
-#endif /* !WC_AES_BITSLICED */
-#endif
-
-#if (defined(HAVE_AES_CBC) && !defined(WOLFSSL_DEVCRYPTO_CBC)) || \
- defined(WOLFSSL_AES_DIRECT)
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
-#if !defined(WC_AES_BITSLICED) || defined(WOLFSSL_AES_DIRECT)
-/* Software AES - ECB Decrypt */
-static WARN_UNUSED_RESULT int wc_AesDecrypt(
- Aes* aes, const byte* inBlock, byte* outBlock)
-{
-#if defined(MAX3266X_AES)
- word32 keySize;
-#endif
-#if defined(MAX3266X_CB)
- int ret_cb;
-#endif
- word32 r;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- r = aes->rounds >> 1;
-
- if (r > 7 || r == 0) {
- WOLFSSL_ERROR_VERBOSE(KEYUSAGE_E);
- return KEYUSAGE_E;
- }
-
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- #ifdef DEBUG_AESNI
- printf("about to aes decrypt\n");
- printf("in = %p\n", inBlock);
- printf("out = %p\n", outBlock);
- printf("aes->key = %p\n", aes->key);
- printf("aes->rounds = %d\n", aes->rounds);
- printf("sz = %d\n", WC_AES_BLOCK_SIZE);
- #endif
-
- /* if input and output same will overwrite input iv */
- if ((const byte*)aes->tmp != inBlock)
- XMEMCPY(aes->tmp, inBlock, WC_AES_BLOCK_SIZE);
- AES_ECB_decrypt_AESNI(inBlock, outBlock, WC_AES_BLOCK_SIZE, (byte*)aes->key,
- (int)aes->rounds);
- return 0;
- }
- else {
- #ifdef DEBUG_AESNI
- printf("Skipping AES-NI\n");
- #endif
- }
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_decrypt_AARCH64(inBlock, outBlock, (byte*)aes->key,
- (int)aes->rounds);
- return 0;
- }
-#elif !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_decrypt_AARCH32(inBlock, outBlock, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_decrypt(inBlock, outBlock, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds);
-#endif
- return 0;
-#endif /* WOLFSSL_AESNI */
-#if defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
- return AES_ECB_decrypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE);
-#endif
-#if defined(WOLFSSL_IMXRT_DCP)
- if (aes->keylen == 16) {
- DCPAesEcbDecrypt(aes, outBlock, inBlock, WC_AES_BLOCK_SIZE);
- return 0;
- }
-#endif
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- if (aes->useSWCrypt == 0) {
- return se050_aes_crypt(aes, inBlock, outBlock, WC_AES_BLOCK_SIZE,
- AES_DECRYPTION, kAlgorithm_SSS_AES_ECB);
- }
-#endif
-#if defined(WOLFSSL_ESPIDF) && defined(NEED_AES_HW_FALLBACK)
- if (wc_esp32AesSupportedKeyLen(aes)) {
- return wc_esp32AesDecrypt(aes, inBlock, outBlock);
- }
- else {
- /* For example, the ESP32-S3 does not support HW for len = 24,
- * so fall back to SW */
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesDecrypt HW Falling back, "
- "unsupported keylen = %d", aes->keylen);
- #endif
- } /* else !wc_esp32AesSupportedKeyLen for ESP32 */
-#endif
-
-#if defined(MAX3266X_AES)
- if (wc_AesGetKeySize(aes, &keySize) == 0) {
- return wc_MXC_TPU_AesDecrypt(inBlock, (byte*)aes->reg, (byte*)aes->key,
- MXC_TPU_MODE_ECB, WC_AES_BLOCK_SIZE,
- outBlock, (unsigned int)keySize);
- }
-#endif
-
-#if defined(MAX3266X_CB) && defined(HAVE_AES_ECB) /* Can do a basic ECB block */
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- ret_cb = wc_CryptoCb_AesEcbDecrypt(aes, outBlock, inBlock,
- WC_AES_BLOCK_SIZE);
- if (ret_cb != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret_cb;
- /* fall-through when unavailable */
- }
-#endif
-
- AesDecrypt_C(aes, inBlock, outBlock, r);
-
- return 0;
-} /* wc_AesDecrypt[_SW]() */
-#endif /* !WC_AES_BITSLICED || WOLFSSL_AES_DIRECT */
-#endif
-#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
-#endif /* HAVE_AES_DECRYPT */
-
-#endif /* NEED_AES_TABLES */
-
-
-
-/* wc_AesSetKey */
-#if defined(STM32_CRYPTO)
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- word32 *rk;
-
- (void)dir;
-
- if (aes == NULL || (keylen != 16 &&
- #ifdef WOLFSSL_AES_192
- keylen != 24 &&
- #endif
- keylen != 32)) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- rk = aes->key;
- aes->keylen = keylen;
- aes->rounds = keylen/4 + 6;
- XMEMCPY(rk, userKey, keylen);
- #if !defined(WOLFSSL_STM32_CUBEMX) || defined(STM32_HAL_V2)
- ByteReverseWords(rk, rk, keylen);
- #endif
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
- return wc_AesSetIV(aes, iv);
- }
- #if defined(WOLFSSL_AES_DIRECT)
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKey(aes, userKey, keylen, iv, dir);
- }
- #endif
-
-#elif defined(HAVE_COLDFIRE_SEC)
- #if defined (HAVE_THREADX)
- #include "memory_pools.h"
- extern TX_BYTE_POOL mp_ncached; /* Non Cached memory pool */
- #endif
-
- #define AES_BUFFER_SIZE (WC_AES_BLOCK_SIZE * 64)
- static unsigned char *AESBuffIn = NULL;
- static unsigned char *AESBuffOut = NULL;
- static byte *secReg;
- static byte *secKey;
- static volatile SECdescriptorType *secDesc;
-
- static wolfSSL_Mutex Mutex_AesSEC;
-
- #define SEC_DESC_AES_CBC_ENCRYPT 0x60300010
- #define SEC_DESC_AES_CBC_DECRYPT 0x60200010
-
- extern volatile unsigned char __MBAR[];
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- if (AESBuffIn == NULL) {
- #if defined (HAVE_THREADX)
- int s1, s2, s3, s4, s5;
- s5 = tx_byte_allocate(&mp_ncached,(void *)&secDesc,
- sizeof(SECdescriptorType), TX_NO_WAIT);
- s1 = tx_byte_allocate(&mp_ncached, (void *)&AESBuffIn,
- AES_BUFFER_SIZE, TX_NO_WAIT);
- s2 = tx_byte_allocate(&mp_ncached, (void *)&AESBuffOut,
- AES_BUFFER_SIZE, TX_NO_WAIT);
- s3 = tx_byte_allocate(&mp_ncached, (void *)&secKey,
- WC_AES_BLOCK_SIZE*2, TX_NO_WAIT);
- s4 = tx_byte_allocate(&mp_ncached, (void *)&secReg,
- WC_AES_BLOCK_SIZE, TX_NO_WAIT);
-
- if (s1 || s2 || s3 || s4 || s5)
- return BAD_FUNC_ARG;
- #else
- #warning "Allocate non-Cache buffers"
- #endif
-
- wc_InitMutex(&Mutex_AesSEC);
- }
-
- if (!((keylen == 16) || (keylen == 24) || (keylen == 32)))
- return BAD_FUNC_ARG;
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- aes->keylen = keylen;
- aes->rounds = keylen/4 + 6;
- XMEMCPY(aes->key, userKey, keylen);
-
- if (iv)
- XMEMCPY(aes->reg, iv, WC_AES_BLOCK_SIZE);
-
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- return 0;
- }
-#elif defined(FREESCALE_LTC)
- int wc_AesSetKeyLocal(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir, int checkKeyLen)
- {
- if (aes == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- if (checkKeyLen) {
- if (!((keylen == 16) || (keylen == 24) || (keylen == 32)))
- return BAD_FUNC_ARG;
- }
- (void)dir;
-
- aes->rounds = keylen/4 + 6;
- XMEMCPY(aes->key, userKey, keylen);
-
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- return wc_AesSetIV(aes, iv);
- }
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir, 1);
- }
-
-
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKey(aes, userKey, keylen, iv, dir);
- }
-#elif defined(FREESCALE_MMCAU)
- int wc_AesSetKeyLocal(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir, int checkKeyLen)
- {
- int ret;
- byte* rk;
- byte* tmpKey = (byte*)userKey;
- int tmpKeyDynamic = 0;
- word32 alignOffset = 0;
-
- (void)dir;
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- if (checkKeyLen) {
- if (!((keylen == 16) || (keylen == 24) || (keylen == 32)))
- return BAD_FUNC_ARG;
- }
-
- rk = (byte*)aes->key;
- if (rk == NULL)
- return BAD_FUNC_ARG;
-
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- aes->rounds = keylen/4 + 6;
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)userKey % WOLFSSL_MMCAU_ALIGNMENT) {
- #ifndef NO_WOLFSSL_ALLOC_ALIGN
- byte* tmp = (byte*)XMALLOC(keylen + WOLFSSL_MMCAU_ALIGNMENT,
- aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- if (tmp == NULL) {
- return MEMORY_E;
- }
- alignOffset = WOLFSSL_MMCAU_ALIGNMENT -
- ((wc_ptr_t)tmp % WOLFSSL_MMCAU_ALIGNMENT);
- tmpKey = tmp + alignOffset;
- XMEMCPY(tmpKey, userKey, keylen);
- tmpKeyDynamic = 1;
- #else
- WOLFSSL_MSG("Bad cau_aes_set_key alignment");
- return BAD_ALIGN_E;
- #endif
- }
- #endif
-
- ret = wolfSSL_CryptHwMutexLock();
- if(ret == 0) {
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_aes_set_key(tmpKey, keylen*8, rk);
- #else
- MMCAU_AES_SetKey(tmpKey, keylen, rk);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- ret = wc_AesSetIV(aes, iv);
- }
-
- if (tmpKeyDynamic == 1) {
- XFREE(tmpKey - alignOffset, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- }
-
- return ret;
- }
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir, 1);
- }
-
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKey(aes, userKey, keylen, iv, dir);
- }
-
-#elif defined(WOLFSSL_NRF51_AES)
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- int ret;
-
- (void)dir;
- (void)iv;
-
- if (aes == NULL || keylen != 16)
- return BAD_FUNC_ARG;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- aes->keylen = keylen;
- aes->rounds = keylen/4 + 6;
- XMEMCPY(aes->key, userKey, keylen);
- ret = nrf51_aes_set_key(userKey);
-
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- return ret;
- }
-
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKey(aes, userKey, keylen, iv, dir);
- }
-#elif defined(WOLFSSL_ESP32_CRYPT) && !defined(NO_WOLFSSL_ESP32_CRYPT_AES)
- /* This is the only definition for HW only.
- * but needs to be renamed when fallback needed.
- * See call in wc_AesSetKey() */
- int wc_AesSetKey_for_ESP32(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- (void)dir;
- (void)iv;
- ESP_LOGV(TAG, "wc_AesSetKey_for_ESP32");
- if (aes == NULL || (keylen != 16 && keylen != 24 && keylen != 32)) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- #if !defined(WOLFSSL_AES_128)
- if (keylen == 16) {
- return BAD_FUNC_ARG;
- }
- #endif
-
- #if !defined(WOLFSSL_AES_192)
- if (keylen == 24) {
- return BAD_FUNC_ARG;
- }
- #endif
-
- #if !defined(WOLFSSL_AES_256)
- if (keylen == 32) {
- return BAD_FUNC_ARG;
- }
- #endif
-
- aes->keylen = keylen;
- aes->rounds = keylen/4 + 6;
-
- XMEMCPY(aes->key, userKey, keylen);
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
- return wc_AesSetIV(aes, iv);
- } /* wc_AesSetKey */
-
- /* end #elif ESP32 */
-#elif defined(WOLFSSL_CRYPTOCELL) && defined(WOLFSSL_CRYPTOCELL_AES)
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, const byte* iv,
- int dir)
- {
- SaSiError_t ret = SASI_OK;
- SaSiAesIv_t iv_aes;
-
- if (aes == NULL ||
- (keylen != AES_128_KEY_SIZE &&
- keylen != AES_192_KEY_SIZE &&
- keylen != AES_256_KEY_SIZE)) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret2 =
- wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret2 < 0)
- return ret2;
- }
-#endif
-
- #if defined(AES_MAX_KEY_SIZE)
- if (keylen > (AES_MAX_KEY_SIZE/8)) {
- return BAD_FUNC_ARG;
- }
- #endif
- if (dir != AES_ENCRYPTION &&
- dir != AES_DECRYPTION) {
- return BAD_FUNC_ARG;
- }
-
- if (dir == AES_ENCRYPTION) {
- aes->ctx.mode = SASI_AES_ENCRYPT;
- SaSi_AesInit(&aes->ctx.user_ctx,
- SASI_AES_ENCRYPT,
- SASI_AES_MODE_CBC,
- SASI_AES_PADDING_NONE);
- }
- else {
- aes->ctx.mode = SASI_AES_DECRYPT;
- SaSi_AesInit(&aes->ctx.user_ctx,
- SASI_AES_DECRYPT,
- SASI_AES_MODE_CBC,
- SASI_AES_PADDING_NONE);
- }
-
- aes->keylen = keylen;
- aes->rounds = keylen/4 + 6;
- XMEMCPY(aes->key, userKey, keylen);
-
- aes->ctx.key.pKey = (byte*)aes->key;
- aes->ctx.key.keySize= keylen;
-
- ret = SaSi_AesSetKey(&aes->ctx.user_ctx,
- SASI_AES_USER_KEY,
- &aes->ctx.key,
- sizeof(aes->ctx.key));
- if (ret != SASI_OK) {
- return BAD_FUNC_ARG;
- }
-
- ret = wc_AesSetIV(aes, iv);
-
- if (iv)
- XMEMCPY(iv_aes, iv, WC_AES_BLOCK_SIZE);
- else
- XMEMSET(iv_aes, 0, WC_AES_BLOCK_SIZE);
-
-
- ret = SaSi_AesSetIv(&aes->ctx.user_ctx, iv_aes);
- if (ret != SASI_OK) {
- return ret;
- }
- return ret;
- }
- #if defined(WOLFSSL_AES_DIRECT)
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- return wc_AesSetKey(aes, userKey, keylen, iv, dir);
- }
- #endif
-
-#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) \
- && !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
-
-#elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
-#elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypto/devcrypto_aes.c */
-
-#elif defined(WOLFSSL_SILABS_SE_ACCEL)
- /* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
-
-#elif defined(WOLFSSL_RENESAS_FSPSM_CRYPTONLY) && \
- !defined(NO_WOLFSSL_RENESAS_FSPSM_AES)
- /* implemented in wolfcrypt/src/port/renesas/renesas_fspsm_aes.c */
-
-#elif !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
- static int AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- aes->keylen = (int)keylen;
- aes->rounds = (keylen/4) + 6;
-
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_set_key_AARCH32(userKey, keylen, (byte*)aes->key, dir);
-#else
- AES_set_encrypt_key(userKey, keylen * 8, (byte*)aes->key);
-
- #ifdef HAVE_AES_DECRYPT
- if (dir == AES_DECRYPTION) {
- AES_invert_key((byte*)aes->key, aes->rounds);
- }
- #else
- (void)dir;
- #endif
-#endif
- return wc_AesSetIV(aes, iv);
- }
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- if ((aes == NULL) || (userKey == NULL)) {
- return BAD_FUNC_ARG;
- }
-
- switch (keylen) {
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 && \
- defined(WOLFSSL_AES_128)
- case 16:
- #endif
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192 && \
- defined(WOLFSSL_AES_192)
- case 24:
- #endif
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256 && \
- defined(WOLFSSL_AES_256)
- case 32:
- #endif
- break;
- default:
- return BAD_FUNC_ARG;
- }
-
- #ifdef WOLF_CRYPTO_CB
- if (aes->devId != INVALID_DEVID) {
- if (keylen > sizeof(aes->devKey)) {
- return BAD_FUNC_ARG;
- }
- XMEMCPY(aes->devKey, userKey, keylen);
- }
- #endif
-
- return AesSetKey(aes, userKey, keylen, iv, dir);
- }
-
- #if defined(WOLFSSL_AES_DIRECT) || defined(WOLFSSL_AES_COUNTER)
- /* AES-CTR and AES-DIRECT need to use this for key setup */
- /* This function allows key sizes that are not 128/192/256 bits */
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- if (aes == NULL) {
- return BAD_FUNC_ARG;
- }
- if (keylen > sizeof(aes->key)) {
- return BAD_FUNC_ARG;
- }
-
- return AesSetKey(aes, userKey, keylen, iv, dir);
- }
- #endif /* WOLFSSL_AES_DIRECT || WOLFSSL_AES_COUNTER */
-#else
- #define NEED_SOFTWARE_AES_SETKEY
-#endif
-
-/* Either we fell though with no HW support at all,
- * or perhaps there's HW support for *some* keylengths
- * and we need both HW and SW. */
-#ifdef NEED_SOFTWARE_AES_SETKEY
-
-#ifdef NEED_AES_TABLES
-
-#ifndef WC_AES_BITSLICED
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-/* Set the AES key and expand.
- *
- * @param [in] aes AES object.
- * @param [in] key Block to encrypt.
- * @param [in] keySz Number of bytes in key.
- * @param [in] dir Direction of crypt: AES_ENCRYPTION or AES_DECRYPTION.
- */
-static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
-{
-#ifdef WC_C_DYNAMIC_FALLBACK
- word32* rk = aes->key_C_fallback;
-#else
- word32* rk = aes->key;
-#endif
- word32 temp;
- unsigned int i = 0;
-
- XMEMCPY(rk, key, keySz);
-#if defined(LITTLE_ENDIAN_ORDER) && !defined(WOLFSSL_PIC32MZ_CRYPT) && \
- (!defined(WOLFSSL_ESP32_CRYPT) || defined(NO_WOLFSSL_ESP32_CRYPT_AES)) && \
- !defined(MAX3266X_AES)
- /* Always reverse words when using only SW */
- {
- ByteReverseWords(rk, rk, keySz);
- }
-#else
- /* Sometimes reverse words when using supported HW */
- #if defined(WOLFSSL_ESPIDF)
- /* Some platforms may need SW fallback (e.g. AES192) */
- #if defined(NEED_AES_HW_FALLBACK)
- {
- ESP_LOGV(TAG, "wc_AesEncrypt fallback check");
- if (wc_esp32AesSupportedKeyLen(aes)) {
- /* don't reverse for HW supported key lengths */
- }
- else {
- ByteReverseWords(rk, rk, keySz);
- }
- }
- #else
- /* If we don't need SW fallback, don't need to reverse words. */
- #endif /* NEED_AES_HW_FALLBACK */
- #endif /* WOLFSSL_ESPIDF */
-#endif /* LITTLE_ENDIAN_ORDER, etc */
-
- switch (keySz) {
-#if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 && \
- defined(WOLFSSL_AES_128)
- case 16:
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- temp = (word32)-1;
- wc_MemZero_Add("wc_AesSetKeyLocal temp", &temp, sizeof(temp));
- #endif
- while (1)
- {
- temp = rk[3];
- rk[4] = rk[0] ^
- #ifndef WOLFSSL_AES_SMALL_TABLES
- (GetTable(Te[2], GETBYTE(temp, 2)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(temp, 1)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(temp, 0)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(temp, 3)) & 0x000000ff) ^
- #else
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 2)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 1)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 0)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 3))) ^
- #endif
- rcon[i];
- rk[5] = rk[1] ^ rk[4];
- rk[6] = rk[2] ^ rk[5];
- rk[7] = rk[3] ^ rk[6];
- if (++i == 10)
- break;
- rk += 4;
- }
- break;
-#endif /* 128 */
-
-#if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192 && \
- defined(WOLFSSL_AES_192)
- case 24:
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- temp = (word32)-1;
- wc_MemZero_Add("wc_AesSetKeyLocal temp", &temp, sizeof(temp));
- #endif
- /* for (;;) here triggers a bug in VC60 SP4 w/ Pro Pack */
- while (1)
- {
- temp = rk[ 5];
- rk[ 6] = rk[ 0] ^
- #ifndef WOLFSSL_AES_SMALL_TABLES
- (GetTable(Te[2], GETBYTE(temp, 2)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(temp, 1)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(temp, 0)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(temp, 3)) & 0x000000ff) ^
- #else
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 2)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 1)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 0)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 3))) ^
- #endif
- rcon[i];
- rk[ 7] = rk[ 1] ^ rk[ 6];
- rk[ 8] = rk[ 2] ^ rk[ 7];
- rk[ 9] = rk[ 3] ^ rk[ 8];
- if (++i == 8)
- break;
- rk[10] = rk[ 4] ^ rk[ 9];
- rk[11] = rk[ 5] ^ rk[10];
- rk += 6;
- }
- break;
-#endif /* 192 */
-
-#if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256 && \
- defined(WOLFSSL_AES_256)
- case 32:
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- temp = (word32)-1;
- wc_MemZero_Add("wc_AesSetKeyLocal temp", &temp, sizeof(temp));
- #endif
- while (1)
- {
- temp = rk[ 7];
- rk[ 8] = rk[ 0] ^
- #ifndef WOLFSSL_AES_SMALL_TABLES
- (GetTable(Te[2], GETBYTE(temp, 2)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(temp, 1)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(temp, 0)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(temp, 3)) & 0x000000ff) ^
- #else
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 2)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 1)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 0)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 3))) ^
- #endif
- rcon[i];
- rk[ 9] = rk[ 1] ^ rk[ 8];
- rk[10] = rk[ 2] ^ rk[ 9];
- rk[11] = rk[ 3] ^ rk[10];
- if (++i == 7)
- break;
- temp = rk[11];
- rk[12] = rk[ 4] ^
- #ifndef WOLFSSL_AES_SMALL_TABLES
- (GetTable(Te[2], GETBYTE(temp, 3)) & 0xff000000) ^
- (GetTable(Te[3], GETBYTE(temp, 2)) & 0x00ff0000) ^
- (GetTable(Te[0], GETBYTE(temp, 1)) & 0x0000ff00) ^
- (GetTable(Te[1], GETBYTE(temp, 0)) & 0x000000ff);
- #else
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 3)) << 24) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 2)) << 16) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 1)) << 8) ^
- ((word32)GetTable8(Tsbox, GETBYTE(temp, 0)));
- #endif
- rk[13] = rk[ 5] ^ rk[12];
- rk[14] = rk[ 6] ^ rk[13];
- rk[15] = rk[ 7] ^ rk[14];
-
- rk += 8;
- }
- break;
-#endif /* 256 */
- } /* switch */
- ForceZero(&temp, sizeof(temp));
-
-#if defined(HAVE_AES_DECRYPT) && !defined(MAX3266X_AES)
- if (dir == AES_DECRYPTION) {
- unsigned int j;
-
-#ifdef WC_C_DYNAMIC_FALLBACK
- rk = aes->key_C_fallback;
-#else
- rk = aes->key;
-#endif
-
- /* invert the order of the round keys: */
- for (i = 0, j = 4* aes->rounds; i < j; i += 4, j -= 4) {
- temp = rk[i ]; rk[i ] = rk[j ]; rk[j ] = temp;
- temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
- temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
- temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
- }
- ForceZero(&temp, sizeof(temp));
- #if !defined(WOLFSSL_AES_SMALL_TABLES)
- /* apply the inverse MixColumn transform to all round keys but the
- first and the last: */
- for (i = 1; i < aes->rounds; i++) {
- rk += 4;
- rk[0] =
- GetTable(Td[0], GetTable(Te[1], GETBYTE(rk[0], 3)) & 0xff) ^
- GetTable(Td[1], GetTable(Te[1], GETBYTE(rk[0], 2)) & 0xff) ^
- GetTable(Td[2], GetTable(Te[1], GETBYTE(rk[0], 1)) & 0xff) ^
- GetTable(Td[3], GetTable(Te[1], GETBYTE(rk[0], 0)) & 0xff);
- rk[1] =
- GetTable(Td[0], GetTable(Te[1], GETBYTE(rk[1], 3)) & 0xff) ^
- GetTable(Td[1], GetTable(Te[1], GETBYTE(rk[1], 2)) & 0xff) ^
- GetTable(Td[2], GetTable(Te[1], GETBYTE(rk[1], 1)) & 0xff) ^
- GetTable(Td[3], GetTable(Te[1], GETBYTE(rk[1], 0)) & 0xff);
- rk[2] =
- GetTable(Td[0], GetTable(Te[1], GETBYTE(rk[2], 3)) & 0xff) ^
- GetTable(Td[1], GetTable(Te[1], GETBYTE(rk[2], 2)) & 0xff) ^
- GetTable(Td[2], GetTable(Te[1], GETBYTE(rk[2], 1)) & 0xff) ^
- GetTable(Td[3], GetTable(Te[1], GETBYTE(rk[2], 0)) & 0xff);
- rk[3] =
- GetTable(Td[0], GetTable(Te[1], GETBYTE(rk[3], 3)) & 0xff) ^
- GetTable(Td[1], GetTable(Te[1], GETBYTE(rk[3], 2)) & 0xff) ^
- GetTable(Td[2], GetTable(Te[1], GETBYTE(rk[3], 1)) & 0xff) ^
- GetTable(Td[3], GetTable(Te[1], GETBYTE(rk[3], 0)) & 0xff);
- }
- #endif
- }
-#else
- (void)dir;
-#endif /* HAVE_AES_DECRYPT */
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(&temp, sizeof(temp));
-#else
- (void)temp;
-#endif
-}
-#endif
-#else /* WC_AES_BITSLICED */
-/* Set the AES key and expand.
- *
- * @param [in] aes AES object.
- * @param [in] key Block to encrypt.
- * @param [in] keySz Number of bytes in key.
- * @param [in] dir Direction of crypt: AES_ENCRYPTION or AES_DECRYPTION.
- */
-static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
-{
- /* No need to invert when decrypting. */
- (void)dir;
-
- bs_set_key(aes->bs_key, key, keySz, aes->rounds);
-}
-#endif /* WC_AES_BITSLICED */
-
-#endif /* NEED_AES_TABLES */
-
-#ifndef WOLFSSL_RISCV_ASM
- /* Software AES - SetKey */
- static WARN_UNUSED_RESULT int wc_AesSetKeyLocal(
- Aes* aes, const byte* userKey, word32 keylen, const byte* iv, int dir,
- int checkKeyLen)
- {
- int ret;
- #ifdef WOLFSSL_IMX6_CAAM_BLOB
- byte local[32];
- word32 localSz = 32;
- #endif
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
-#endif
-
- switch (keylen) {
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 && \
- defined(WOLFSSL_AES_128)
- case 16:
- #endif
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192 && \
- defined(WOLFSSL_AES_192)
- case 24:
- #endif
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256 && \
- defined(WOLFSSL_AES_256)
- case 32:
- #endif
- break;
- default:
- return BAD_FUNC_ARG;
- }
-
- #ifdef WOLFSSL_MAXQ10XX_CRYPTO
- if (wc_MAXQ10XX_AesSetKey(aes, userKey, keylen) != 0) {
- return WC_HW_E;
- }
- #endif
-
- #ifdef WOLFSSL_IMX6_CAAM_BLOB
- if (keylen == (16 + WC_CAAM_BLOB_SZ) ||
- keylen == (24 + WC_CAAM_BLOB_SZ) ||
- keylen == (32 + WC_CAAM_BLOB_SZ)) {
- if (wc_caamOpenBlob((byte*)userKey, keylen, local, &localSz) != 0) {
- return BAD_FUNC_ARG;
- }
-
- /* set local values */
- userKey = local;
- keylen = localSz;
- }
- #endif
-
- #ifdef WOLFSSL_SECO_CAAM
- /* if set to use hardware than import the key */
- if (aes->devId == WOLFSSL_SECO_DEVID) {
- int keyGroup = 1; /* group one was chosen arbitrarily */
- unsigned int keyIdOut;
- byte importiv[GCM_NONCE_MID_SZ];
- int importivSz = GCM_NONCE_MID_SZ;
- int keyType = 0;
- WC_RNG rng;
-
- if (wc_InitRng(&rng) != 0) {
- WOLFSSL_MSG("RNG init for IV failed");
- return WC_HW_E;
- }
-
- if (wc_RNG_GenerateBlock(&rng, importiv, importivSz) != 0) {
- WOLFSSL_MSG("Generate IV failed");
- wc_FreeRng(&rng);
- return WC_HW_E;
- }
- wc_FreeRng(&rng);
-
- if (iv)
- XMEMCPY(aes->reg, iv, WC_AES_BLOCK_SIZE);
- else
- XMEMSET(aes->reg, 0, WC_AES_BLOCK_SIZE);
-
- switch (keylen) {
- case AES_128_KEY_SIZE: keyType = CAAM_KEYTYPE_AES128; break;
- case AES_192_KEY_SIZE: keyType = CAAM_KEYTYPE_AES192; break;
- case AES_256_KEY_SIZE: keyType = CAAM_KEYTYPE_AES256; break;
- }
-
- keyIdOut = wc_SECO_WrapKey(0, (byte*)userKey, keylen, importiv,
- importivSz, keyType, CAAM_KEY_TRANSIENT, keyGroup);
- if (keyIdOut == 0) {
- return WC_HW_E;
- }
- aes->blackKey = keyIdOut;
- return 0;
- }
- #endif
-
- #if defined(WOLF_CRYPTO_CB) || (defined(WOLFSSL_DEVCRYPTO) && \
- (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))) || \
- (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES))
- #ifdef WOLF_CRYPTO_CB
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- if (keylen > sizeof(aes->devKey)) {
- return BAD_FUNC_ARG;
- }
- XMEMCPY(aes->devKey, userKey, keylen);
- }
- #endif
-
- #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE < 256
- if (checkKeyLen) {
- /* Check key length only when AES_MAX_KEY_SIZE doesn't allow
- * all key sizes. Otherwise this condition is never true. */
- if (keylen > (AES_MAX_KEY_SIZE / 8)) {
- return BAD_FUNC_ARG;
- }
- }
- #else
- (void) checkKeyLen;
- #endif
-
- #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- aes->left = 0;
- #endif
-
- aes->keylen = (int)keylen;
- aes->rounds = (keylen/4) + 6;
- ret = wc_AesSetIV(aes, iv);
- if (ret != 0)
- return ret;
-
-#ifdef WC_C_DYNAMIC_FALLBACK
-#ifdef NEED_AES_TABLES
- AesSetKey_C(aes, userKey, keylen, dir);
-#endif /* NEED_AES_TABLES */
-#endif /* WC_C_DYNAMIC_FALLBACK */
-
- #ifdef WOLFSSL_AESNI
-
- /* The dynamics for determining whether AES-NI will be used are tricky.
- *
- * First, we check for CPU support and cache the result -- if AES-NI is
- * missing, we always shortcut to the AesSetKey_C() path.
- *
- * Second, if the CPU supports AES-NI, we confirm on a per-call basis
- * that it's safe to use in the caller context, using
- * SAVE_VECTOR_REGISTERS2(). This is an always-true no-op in user-space
- * builds, but has substantive logic behind it in kernel module builds.
- *
- * The outcome when SAVE_VECTOR_REGISTERS2() fails depends on
- * WC_C_DYNAMIC_FALLBACK -- if that's defined, we return immediately with
- * success but with AES-NI disabled (the earlier AesSetKey_C() allows
- * future encrypt/decrypt calls to succeed), otherwise we fail.
- *
- * Upon successful return, aes->use_aesni will have a zero value if
- * AES-NI is disabled, and a nonzero value if it's enabled.
- *
- * An additional, optional semantic is available via
- * WC_FLAG_DONT_USE_VECTOR_OPS, and is used in some kernel module builds
- * to let the caller inhibit AES-NI. When this macro is defined,
- * wc_AesInit() before wc_AesSetKey() is imperative, to avoid a read of
- * uninitialized data in aes->use_aesni. That's why support for
- * WC_FLAG_DONT_USE_VECTOR_OPS must remain optional -- wc_AesInit() was
- * only added in release 3.11.0, so legacy applications inevitably call
- * wc_AesSetKey() on uninitialized Aes contexts. This must continue to
- * function correctly with default build settings.
- */
-
- if (checkedAESNI == 0) {
- haveAESNI = Check_CPU_support_AES();
- checkedAESNI = 1;
- }
- if (haveAESNI
-#if defined(WC_FLAG_DONT_USE_VECTOR_OPS) && !defined(WC_C_DYNAMIC_FALLBACK)
- && (aes->use_aesni != WC_FLAG_DONT_USE_VECTOR_OPS)
-#endif
- )
- {
-#if defined(WC_FLAG_DONT_USE_VECTOR_OPS)
- if (aes->use_aesni == WC_FLAG_DONT_USE_VECTOR_OPS) {
- aes->use_aesni = 0;
- return 0;
- }
-#endif
- aes->use_aesni = 0;
- #ifdef WOLFSSL_KERNEL_MODE
- /* runtime alignment check */
- if ((wc_ptr_t)&aes->key & (wc_ptr_t)0xf) {
- ret = BAD_ALIGN_E;
- }
- else
- #endif /* WOLFSSL_KERNEL_MODE */
- {
- ret = SAVE_VECTOR_REGISTERS2();
- }
- if (ret == 0) {
- if (dir == AES_ENCRYPTION)
- ret = AES_set_encrypt_key_AESNI(userKey, (int)keylen * 8, aes);
-#ifdef HAVE_AES_DECRYPT
- else
- ret = AES_set_decrypt_key_AESNI(userKey, (int)keylen * 8, aes);
-#endif
-
- RESTORE_VECTOR_REGISTERS();
-
- if (ret == 0)
- aes->use_aesni = 1;
- else {
-#ifdef WC_C_DYNAMIC_FALLBACK
- ret = 0;
-#endif
- }
- return ret;
- } else {
-#ifdef WC_C_DYNAMIC_FALLBACK
- return 0;
-#else
- return ret;
-#endif
- }
- }
- else {
- aes->use_aesni = 0;
-#ifdef WC_C_DYNAMIC_FALLBACK
- /* If WC_C_DYNAMIC_FALLBACK, we already called AesSetKey_C()
- * above.
- */
- return 0;
-#endif
- }
- #endif /* WOLFSSL_AESNI */
-
- #if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- Check_CPU_support_HwCrypto(aes);
- if (aes->use_aes_hw_crypto) {
- AES_set_key_AARCH64(userKey, keylen, (byte*)aes->key, dir);
- return 0;
- }
- #endif
-
- #ifdef WOLFSSL_KCAPI_AES
- XMEMCPY(aes->devKey, userKey, keylen);
- if (aes->init != 0) {
- kcapi_cipher_destroy(aes->handle);
- aes->handle = NULL;
- aes->init = 0;
- }
- (void)dir;
- #endif
-
- if (keylen > sizeof(aes->key)) {
- return BAD_FUNC_ARG;
- }
-#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- return wc_psa_aes_set_key(aes, userKey, keylen, (uint8_t*)iv,
- ((psa_algorithm_t)0), dir);
-#endif
-
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- /* wolfSSL HostCrypto in SE05x SDK can request to use SW crypto
- * instead of SE05x crypto by setting useSWCrypt */
- if (aes->useSWCrypt == 0) {
- ret = se050_aes_set_key(aes, userKey, keylen, iv, dir);
- if (ret == 0) {
- ret = wc_AesSetIV(aes, iv);
- }
- return ret;
- }
-#endif
-
- XMEMCPY(aes->key, userKey, keylen);
-
-#ifndef WC_AES_BITSLICED
- #if defined(LITTLE_ENDIAN_ORDER) && !defined(WOLFSSL_PIC32MZ_CRYPT) && \
- (!defined(WOLFSSL_ESP32_CRYPT) || defined(NO_WOLFSSL_ESP32_CRYPT_AES)) \
- && !defined(MAX3266X_AES)
-
- /* software */
- ByteReverseWords(aes->key, aes->key, keylen);
-
- #elif defined(WOLFSSL_ESP32_CRYPT) && !defined(NO_WOLFSSL_ESP32_CRYPT_AES)
- if (wc_esp32AesSupportedKeyLen(aes)) {
- /* supported lengths don't get reversed */
- ESP_LOGV(TAG, "wc_AesSetKeyLocal (no ByteReverseWords)");
- }
- else {
- word32* rk = aes->key;
-
- /* For example, the ESP32-S3 does not support HW for len = 24,
- * so fall back to SW */
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesSetKeyLocal ByteReverseWords");
- #endif
- XMEMCPY(rk, userKey, keylen);
- /* When not ESP32 HW, we need to reverse endianness */
- ByteReverseWords(rk, rk, keylen);
- }
- #endif
-
- #ifdef WOLFSSL_IMXRT_DCP
- {
- /* Implemented in wolfcrypt/src/port/nxp/dcp_port.c */
- word32 temp = 0;
- if (keylen == 16)
- temp = DCPAesSetKey(aes, userKey, keylen, iv, dir);
- if (temp != 0)
- return WC_HW_E;
- }
- #endif
-#endif /* !WC_AES_BITSLICED */
-
-#ifdef NEED_AES_TABLES
- AesSetKey_C(aes, userKey, keylen, dir);
-#endif /* NEED_AES_TABLES */
-
-#if defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
- XMEMCPY((byte*)aes->key, userKey, keylen);
- if (WOLFSSL_SCE_GSCE_HANDLE.p_cfg->endian_flag == CRYPTO_WORD_ENDIAN_BIG) {
- ByteReverseWords(aes->key, aes->key, 32);
- }
-#endif
-
- #if defined(WOLFSSL_DEVCRYPTO) && \
- (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
- aes->ctx.cfd = -1;
- #endif
- #ifdef WOLFSSL_IMX6_CAAM_BLOB
- ForceZero(local, sizeof(local));
- #endif
- return ret;
- } /* wc_AesSetKeyLocal */
-
- int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- if (aes == NULL) {
- return BAD_FUNC_ARG;
- }
- if (keylen > sizeof(aes->key)) {
- return BAD_FUNC_ARG;
- }
-
- /* sometimes hardware may not support all keylengths (e.g. ESP32-S3) */
- #if defined(WOLFSSL_ESPIDF) && defined(NEED_AES_HW_FALLBACK)
- ESP_LOGV(TAG, "wc_AesSetKey fallback check %d", keylen);
- if (wc_esp32AesSupportedKeyLenValue(keylen)) {
- ESP_LOGV(TAG, "wc_AesSetKey calling wc_AesSetKey_for_ESP32");
- return wc_AesSetKey_for_ESP32(aes, userKey, keylen, iv, dir);
- }
- else {
- #if defined(WOLFSSL_HW_METRICS)
- /* It is interesting to know how many times we could not complete
- * AES in hardware due to unsupported lengths. */
- wc_esp32AesUnupportedLengthCountAdd();
- #endif
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesSetKey HW Fallback, unsupported keylen = %d",
- keylen);
- #endif
- }
- #endif /* WOLFSSL_ESPIDF && NEED_AES_HW_FALLBACK */
-
- return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir, 1);
-
- } /* wc_AesSetKey() */
-#endif
-
- #if defined(WOLFSSL_AES_DIRECT) || defined(WOLFSSL_AES_COUNTER)
- /* AES-CTR and AES-DIRECT need to use this for key setup */
- /* This function allows key sizes that are not 128/192/256 bits */
- int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
- const byte* iv, int dir)
- {
- if (aes == NULL) {
- return BAD_FUNC_ARG;
- }
- if (keylen > sizeof(aes->key)) {
- return BAD_FUNC_ARG;
- }
-
- return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir, 0);
- }
- #endif /* WOLFSSL_AES_DIRECT || WOLFSSL_AES_COUNTER */
-#endif /* wc_AesSetKey block */
-
-
-/* wc_AesSetIV is shared between software and hardware */
-int wc_AesSetIV(Aes* aes, const byte* iv)
-{
- if (aes == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- {
- int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);
- if (ret < 0)
- return ret;
- }
-#endif
-
- if (iv)
- XMEMCPY(aes->reg, iv, WC_AES_BLOCK_SIZE);
- else
- XMEMSET(aes->reg, 0, WC_AES_BLOCK_SIZE);
-
-#if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
- defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
- defined(WOLFSSL_AES_CTS)
- /* Clear any unused bytes from last cipher op. */
- aes->left = 0;
-#endif
-
- return 0;
-}
-
-#ifdef WOLFSSL_AESNI
-
-#ifdef WC_C_DYNAMIC_FALLBACK
-
-#define VECTOR_REGISTERS_PUSH { \
- int orig_use_aesni = aes->use_aesni; \
- if (aes->use_aesni && (SAVE_VECTOR_REGISTERS2() != 0)) { \
- aes->use_aesni = 0; \
- } \
- WC_DO_NOTHING
-
-#define VECTOR_REGISTERS_POP \
- if (aes->use_aesni) \
- RESTORE_VECTOR_REGISTERS(); \
- else \
- aes->use_aesni = orig_use_aesni; \
- } \
- WC_DO_NOTHING
-
-#elif defined(SAVE_VECTOR_REGISTERS2_DOES_NOTHING)
-
-#define VECTOR_REGISTERS_PUSH { \
- WC_DO_NOTHING
-
-#define VECTOR_REGISTERS_POP \
- } \
- WC_DO_NOTHING
-
-#else
-
-#define VECTOR_REGISTERS_PUSH { \
- if (aes->use_aesni && ((ret = SAVE_VECTOR_REGISTERS2()) != 0)) { \
- return ret; \
- } \
- WC_DO_NOTHING
-
-#define VECTOR_REGISTERS_POP \
- if (aes->use_aesni) { \
- RESTORE_VECTOR_REGISTERS(); \
- } \
- } \
- WC_DO_NOTHING
-
-#endif
-
-#else /* !WOLFSSL_AESNI */
-
-#define VECTOR_REGISTERS_PUSH { WC_DO_NOTHING
-#define VECTOR_REGISTERS_POP } WC_DO_NOTHING
-
-#endif /* !WOLFSSL_AESNI */
-
-
-/* AES-DIRECT */
-#if defined(WOLFSSL_AES_DIRECT)
- #if defined(HAVE_COLDFIRE_SEC)
- #error "Coldfire SEC doesn't yet support AES direct"
-
- #elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) && \
- !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
-
- #elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
- #elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
-
- #else
-
- /* Allow direct access to one block encrypt */
- int wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in)
- {
- int ret;
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
- VECTOR_REGISTERS_PUSH;
- ret = wc_AesEncrypt(aes, in, out);
- VECTOR_REGISTERS_POP;
- return ret;
- }
-
- /* vector reg save/restore is explicit in all below calls to
- * wc_Aes{En,De}cryptDirect(), so bypass the public version with a
- * macro.
- */
- #define wc_AesEncryptDirect(aes, out, in) wc_AesEncrypt(aes, in, out)
-
- #ifdef HAVE_AES_DECRYPT
- /* Allow direct access to one block decrypt */
- int wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in)
- {
- int ret;
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
- VECTOR_REGISTERS_PUSH;
- ret = wc_AesDecrypt(aes, in, out);
- VECTOR_REGISTERS_POP;
- return ret;
- }
-
- #define wc_AesDecryptDirect(aes, out, in) wc_AesDecrypt(aes, in, out)
-
- #endif /* HAVE_AES_DECRYPT */
- #endif /* AES direct block */
-#endif /* WOLFSSL_AES_DIRECT */
-
-
-/* AES-CBC */
-#ifdef HAVE_AES_CBC
-#if defined(STM32_CRYPTO)
-
-#ifdef WOLFSSL_STM32U5_DHUK
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret = 0;
- CRYP_HandleTypeDef hcryp;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- if (aes->devId == WOLFSSL_STM32U5_DHUK_WRAPPED_DEVID) {
- CRYP_ConfigTypeDef Config;
-
- XMEMSET(&Config, 0, sizeof(Config));
- ret = wc_Stm32_Aes_UnWrap(aes, &hcryp, (const byte*)aes->key, aes->keylen,
- (const byte*)aes->dhukIV, aes->dhukIVLen);
-
- /* reconfigure for using unwrapped key now */
- HAL_CRYP_GetConfig(&hcryp, &Config);
- Config.KeyMode = CRYP_KEYMODE_NORMAL;
- Config.KeySelect = CRYP_KEYSEL_NORMAL;
- Config.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- Config.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- HAL_CRYP_SetConfig(&hcryp, &Config);
- }
- else {
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 1);
- if (ret != 0) {
- wolfSSL_CryptHwMutexUnLock();
- return ret;
- }
- hcryp.Init.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- ret = HAL_CRYP_Init(&hcryp);
- }
-
- if (ret == HAL_OK) {
- ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in, blocks * WC_AES_BLOCK_SIZE,
- (uint32_t*)out, STM32_HAL_TIMEOUT);
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
-
- /* store iv for next call */
- XMEMCPY(aes->reg, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- }
-
- HAL_CRYP_DeInit(&hcryp);
-
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret = 0;
- CRYP_HandleTypeDef hcryp;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- if (aes->devId == WOLFSSL_STM32U5_DHUK_WRAPPED_DEVID) {
- CRYP_ConfigTypeDef Config;
-
- XMEMSET(&Config, 0, sizeof(Config));
- ret = wc_Stm32_Aes_UnWrap(aes, &hcryp, (const byte*)aes->key, aes->keylen,
- aes->dhukIV, aes->dhukIVLen);
-
- /* reconfigure for using unwrapped key now */
- HAL_CRYP_GetConfig(&hcryp, &Config);
- Config.KeyMode = CRYP_KEYMODE_NORMAL;
- Config.KeySelect = CRYP_KEYSEL_NORMAL;
- Config.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- Config.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- HAL_CRYP_SetConfig(&hcryp, &Config);
- }
- else {
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 1);
- if (ret != 0) {
- wolfSSL_CryptHwMutexUnLock();
- return ret;
- }
- hcryp.Init.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- ret = HAL_CRYP_Init(&hcryp);
- }
-
- if (ret == HAL_OK) {
- /* if input and output same will overwrite input iv */
- XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- ret = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in, blocks * WC_AES_BLOCK_SIZE,
- (uint32_t*)out, STM32_HAL_TIMEOUT);
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
-
- /* store iv for next call */
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
- }
-
- HAL_CRYP_DeInit(&hcryp);
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(WOLFSSL_STM32_CUBEMX)
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret = 0;
- CRYP_HandleTypeDef hcryp;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- #if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_CBC;
- hcryp.Init.KeyWriteFlag = CRYP_KEY_WRITE_ENABLE;
- #endif
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- ret = HAL_CRYP_Init(&hcryp);
-
- if (ret == HAL_OK) {
- #if defined(STM32_HAL_V2)
- ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in, blocks * WC_AES_BLOCK_SIZE,
- (uint32_t*)out, STM32_HAL_TIMEOUT);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)in, blocks * WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #else
- ret = HAL_CRYP_AESCBC_Encrypt(&hcryp, (uint8_t*)in,
- blocks * WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #endif
- }
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
-
- /* store iv for next call */
- XMEMCPY(aes->reg, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- HAL_CRYP_DeInit(&hcryp);
-
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret = 0;
- CRYP_HandleTypeDef hcryp;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- /* if input and output same will overwrite input iv */
- XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- #if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_CBC;
- ByteReverseWords(aes->reg, aes->reg, WC_AES_BLOCK_SIZE);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_KEYDERIVATION_DECRYPT;
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_CBC;
- hcryp.Init.KeyWriteFlag = CRYP_KEY_WRITE_ENABLE;
- #endif
-
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- ret = HAL_CRYP_Init(&hcryp);
-
- if (ret == HAL_OK) {
- #if defined(STM32_HAL_V2)
- ret = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in, blocks * WC_AES_BLOCK_SIZE,
- (uint32_t*)out, STM32_HAL_TIMEOUT);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)in, blocks * WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #else
- ret = HAL_CRYP_AESCBC_Decrypt(&hcryp, (uint8_t*)in,
- blocks * WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #endif
- }
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
-
- /* store iv for next call */
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
-
- HAL_CRYP_DeInit(&hcryp);
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#else /* Standard Peripheral Library */
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret;
- word32 *iv;
- CRYP_InitTypeDef cryptInit;
- CRYP_KeyInitTypeDef keyInit;
- CRYP_IVInitTypeDef ivInit;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set key */
- CRYP_KeyInit(&keyInit);
-
- /* set iv */
- iv = aes->reg;
- CRYP_IVStructInit(&ivInit);
- ByteReverseWords(iv, iv, WC_AES_BLOCK_SIZE);
- ivInit.CRYP_IV0Left = iv[0];
- ivInit.CRYP_IV0Right = iv[1];
- ivInit.CRYP_IV1Left = iv[2];
- ivInit.CRYP_IV1Right = iv[3];
- CRYP_IVInit(&ivInit);
-
- /* set direction and mode */
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- while (blocks--) {
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&in[0]);
- CRYP_DataIn(*(uint32_t*)&in[4]);
- CRYP_DataIn(*(uint32_t*)&in[8]);
- CRYP_DataIn(*(uint32_t*)&in[12]);
-
- /* wait until the complete message has been processed */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&out[0] = CRYP_DataOut();
- *(uint32_t*)&out[4] = CRYP_DataOut();
- *(uint32_t*)&out[8] = CRYP_DataOut();
- *(uint32_t*)&out[12] = CRYP_DataOut();
-
- /* store iv for next call */
- XMEMCPY(aes->reg, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- sz -= WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
-
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret;
- word32 *iv;
- CRYP_InitTypeDef cryptInit;
- CRYP_KeyInitTypeDef keyInit;
- CRYP_IVInitTypeDef ivInit;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- /* if input and output same will overwrite input iv */
- XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set direction and key */
- CRYP_KeyInit(&keyInit);
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- /* wait until key has been prepared */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- /* set direction and mode */
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
- CRYP_Init(&cryptInit);
-
- /* set iv */
- iv = aes->reg;
- CRYP_IVStructInit(&ivInit);
- ByteReverseWords(iv, iv, WC_AES_BLOCK_SIZE);
- ivInit.CRYP_IV0Left = iv[0];
- ivInit.CRYP_IV0Right = iv[1];
- ivInit.CRYP_IV1Left = iv[2];
- ivInit.CRYP_IV1Right = iv[3];
- CRYP_IVInit(&ivInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- while (blocks--) {
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&in[0]);
- CRYP_DataIn(*(uint32_t*)&in[4]);
- CRYP_DataIn(*(uint32_t*)&in[8]);
- CRYP_DataIn(*(uint32_t*)&in[12]);
-
- /* wait until the complete message has been processed */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&out[0] = CRYP_DataOut();
- *(uint32_t*)&out[4] = CRYP_DataOut();
- *(uint32_t*)&out[8] = CRYP_DataOut();
- *(uint32_t*)&out[12] = CRYP_DataOut();
-
- /* store iv for next call */
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
-
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- return ret;
- }
- #endif /* HAVE_AES_DECRYPT */
-#endif /* WOLFSSL_STM32_CUBEMX */
-
-#elif defined(HAVE_COLDFIRE_SEC)
- static WARN_UNUSED_RESULT int wc_AesCbcCrypt(
- Aes* aes, byte* po, const byte* pi, word32 sz, word32 descHeader)
- {
- #ifdef DEBUG_WOLFSSL
- int i; int stat1, stat2; int ret;
- #endif
-
- int size;
- volatile int v;
-
- if ((pi == NULL) || (po == NULL))
- return BAD_FUNC_ARG; /*wrong pointer*/
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
-
- wc_LockMutex(&Mutex_AesSEC);
-
- /* Set descriptor for SEC */
- secDesc->length1 = 0x0;
- secDesc->pointer1 = NULL;
-
- secDesc->length2 = WC_AES_BLOCK_SIZE;
- secDesc->pointer2 = (byte *)secReg; /* Initial Vector */
-
- switch(aes->rounds) {
- case 10: secDesc->length3 = 16; break;
- case 12: secDesc->length3 = 24; break;
- case 14: secDesc->length3 = 32; break;
- }
- XMEMCPY(secKey, aes->key, secDesc->length3);
-
- secDesc->pointer3 = (byte *)secKey;
- secDesc->pointer4 = AESBuffIn;
- secDesc->pointer5 = AESBuffOut;
- secDesc->length6 = 0x0;
- secDesc->pointer6 = NULL;
- secDesc->length7 = 0x0;
- secDesc->pointer7 = NULL;
- secDesc->nextDescriptorPtr = NULL;
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- size = AES_BUFFER_SIZE;
-#endif
- while (sz) {
- secDesc->header = descHeader;
- XMEMCPY(secReg, aes->reg, WC_AES_BLOCK_SIZE);
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- sz -= AES_BUFFER_SIZE;
-#else
- if (sz < AES_BUFFER_SIZE) {
- size = sz;
- sz = 0;
- } else {
- size = AES_BUFFER_SIZE;
- sz -= AES_BUFFER_SIZE;
- }
-#endif
-
- secDesc->length4 = size;
- secDesc->length5 = size;
-
- XMEMCPY(AESBuffIn, pi, size);
- if(descHeader == SEC_DESC_AES_CBC_DECRYPT) {
- XMEMCPY((void*)aes->tmp, (void*)&(pi[size-WC_AES_BLOCK_SIZE]),
- WC_AES_BLOCK_SIZE);
- }
-
- /* Point SEC to the location of the descriptor */
- MCF_SEC_FR0 = (uint32)secDesc;
- /* Initialize SEC and wait for encryption to complete */
- MCF_SEC_CCCR0 = 0x0000001a;
- /* poll SISR to determine when channel is complete */
- v=0;
-
- while ((secDesc->header>> 24) != 0xff) v++;
-
- #ifdef DEBUG_WOLFSSL
- ret = MCF_SEC_SISRH;
- stat1 = MCF_SEC_AESSR;
- stat2 = MCF_SEC_AESISR;
- if (ret & 0xe0000000) {
- db_printf("Aes_Cbc(i=%d):ISRH=%08x, AESSR=%08x, "
- "AESISR=%08x\n", i, ret, stat1, stat2);
- }
- #endif
-
- XMEMCPY(po, AESBuffOut, size);
-
- if (descHeader == SEC_DESC_AES_CBC_ENCRYPT) {
- XMEMCPY((void*)aes->reg, (void*)&(po[size-WC_AES_BLOCK_SIZE]),
- WC_AES_BLOCK_SIZE);
- } else {
- XMEMCPY((void*)aes->reg, (void*)aes->tmp, WC_AES_BLOCK_SIZE);
- }
-
- pi += size;
- po += size;
- }
-
- wc_UnLockMutex(&Mutex_AesSEC);
- return 0;
- }
-
- int wc_AesCbcEncrypt(Aes* aes, byte* po, const byte* pi, word32 sz)
- {
- return (wc_AesCbcCrypt(aes, po, pi, sz, SEC_DESC_AES_CBC_ENCRYPT));
- }
-
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* po, const byte* pi, word32 sz)
- {
- return (wc_AesCbcCrypt(aes, po, pi, sz, SEC_DESC_AES_CBC_DECRYPT));
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(FREESCALE_LTC)
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- word32 keySize;
- status_t status;
- byte *iv, *enc_key;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- iv = (byte*)aes->reg;
- enc_key = (byte*)aes->key;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
- status = LTC_AES_EncryptCbc(LTC_BASE, in, out, blocks * WC_AES_BLOCK_SIZE,
- iv, enc_key, keySize);
- wolfSSL_CryptHwMutexUnLock();
-
- /* store iv for next call */
- if (status == kStatus_Success) {
- XMEMCPY(iv, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- }
-
- return (status == kStatus_Success) ? 0 : -1;
- }
-
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- word32 keySize;
- status_t status;
- byte* iv, *dec_key;
- byte temp_block[WC_AES_BLOCK_SIZE];
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- iv = (byte*)aes->reg;
- dec_key = (byte*)aes->key;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- /* get IV for next call */
- XMEMCPY(temp_block, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
- status = LTC_AES_DecryptCbc(LTC_BASE, in, out, blocks * WC_AES_BLOCK_SIZE,
- iv, dec_key, keySize, kLTC_EncryptKey);
- wolfSSL_CryptHwMutexUnLock();
-
- /* store IV for next call */
- if (status == kStatus_Success) {
- XMEMCPY(iv, temp_block, WC_AES_BLOCK_SIZE);
- }
-
- return (status == kStatus_Success) ? 0 : -1;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(FREESCALE_MMCAU)
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- byte *iv;
- byte temp_block[WC_AES_BLOCK_SIZE];
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
- int ret;
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- iv = (byte*)aes->reg;
-
- while (blocks--) {
- XMEMCPY(temp_block, in + offset, WC_AES_BLOCK_SIZE);
-
- /* XOR block with IV for CBC */
- xorbuf(temp_block, iv, WC_AES_BLOCK_SIZE);
-
- ret = wc_AesEncrypt(aes, temp_block, out + offset);
- if (ret != 0)
- return ret;
-
- offset += WC_AES_BLOCK_SIZE;
-
- /* store IV for next block */
- XMEMCPY(iv, out + offset - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- }
-
- return 0;
- }
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret;
- int offset = 0;
- byte* iv;
- byte temp_block[WC_AES_BLOCK_SIZE];
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- return BAD_LENGTH_E;
- }
-#endif
- if (blocks == 0)
- return 0;
-
- iv = (byte*)aes->reg;
-
- while (blocks--) {
- XMEMCPY(temp_block, in + offset, WC_AES_BLOCK_SIZE);
-
- ret = wc_AesDecrypt(aes, in + offset, out + offset);
- if (ret != 0)
- return ret;
-
- /* XOR block with IV for CBC */
- xorbuf(out + offset, iv, WC_AES_BLOCK_SIZE);
-
- /* store IV for next block */
- XMEMCPY(iv, temp_block, WC_AES_BLOCK_SIZE);
-
- offset += WC_AES_BLOCK_SIZE;
- }
-
- return 0;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-#elif defined(MAX3266X_AES)
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- word32 keySize;
- int status;
- byte *iv;
-
- if ((in == NULL) || (out == NULL) || (aes == NULL)) {
- return BAD_FUNC_ARG;
- }
-
- /* Always enforce a length check */
- if (sz % WC_AES_BLOCK_SIZE) {
- #ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- return BAD_LENGTH_E;
- #else
- return BAD_FUNC_ARG;
- #endif
- }
- if (sz == 0) {
- return 0;
- }
-
- iv = (byte*)aes->reg;
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wc_MXC_TPU_AesEncrypt(in, iv, (byte*)aes->key,
- MXC_TPU_MODE_CBC, sz, out,
- (unsigned int)keySize);
- /* store iv for next call */
- if (status == 0) {
- XMEMCPY(iv, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- }
- return (status == 0) ? 0 : -1;
- }
-
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- word32 keySize;
- int status;
- byte *iv;
- byte temp_block[WC_AES_BLOCK_SIZE];
-
- if ((in == NULL) || (out == NULL) || (aes == NULL)) {
- return BAD_FUNC_ARG;
- }
-
- /* Always enforce a length check */
- if (sz % WC_AES_BLOCK_SIZE) {
- #ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- return BAD_LENGTH_E;
- #else
- return BAD_FUNC_ARG;
- #endif
- }
- if (sz == 0) {
- return 0;
- }
-
- iv = (byte*)aes->reg;
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- /* get IV for next call */
- XMEMCPY(temp_block, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- status = wc_MXC_TPU_AesDecrypt(in, iv, (byte*)aes->key,
- MXC_TPU_MODE_CBC, sz, out,
- keySize);
-
- /* store iv for next call */
- if (status == 0) {
- XMEMCPY(iv, temp_block, WC_AES_BLOCK_SIZE);
- }
- return (status == 0) ? 0 : -1;
- }
- #endif /* HAVE_AES_DECRYPT */
-
-
-
-#elif defined(WOLFSSL_PIC32MZ_CRYPT)
-
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret;
-
- if (sz == 0)
- return 0;
-
- /* hardware fails on input that is not a multiple of AES block size */
- if (sz % WC_AES_BLOCK_SIZE != 0) {
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- return BAD_LENGTH_E;
-#else
- return BAD_FUNC_ARG;
-#endif
- }
-
- ret = wc_Pic32AesCrypt(
- aes->key, aes->keylen, aes->reg, WC_AES_BLOCK_SIZE,
- out, in, sz, PIC32_ENCRYPTION,
- PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC);
-
- /* store iv for next call */
- if (ret == 0) {
- XMEMCPY(aes->reg, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- }
-
- return ret;
- }
- #ifdef HAVE_AES_DECRYPT
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret;
- byte scratch[WC_AES_BLOCK_SIZE];
-
- if (sz == 0)
- return 0;
-
- /* hardware fails on input that is not a multiple of AES block size */
- if (sz % WC_AES_BLOCK_SIZE != 0) {
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- return BAD_LENGTH_E;
-#else
- return BAD_FUNC_ARG;
-#endif
- }
- XMEMCPY(scratch, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- ret = wc_Pic32AesCrypt(
- aes->key, aes->keylen, aes->reg, WC_AES_BLOCK_SIZE,
- out, in, sz, PIC32_DECRYPTION,
- PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC);
-
- /* store iv for next call */
- if (ret == 0) {
- XMEMCPY((byte*)aes->reg, scratch, WC_AES_BLOCK_SIZE);
- }
-
- return ret;
- }
- #endif /* HAVE_AES_DECRYPT */
-#elif defined(WOLFSSL_ESP32_CRYPT) && \
- !defined(NO_WOLFSSL_ESP32_CRYPT_AES)
-
- /* We'll use SW for fall back:
- * unsupported key lengths
- * hardware busy */
- #define NEED_SW_AESCBC
- #define NEED_AESCBC_HW_FALLBACK
-
-#elif defined(WOLFSSL_CRYPTOCELL) && defined(WOLFSSL_CRYPTOCELL_AES)
- int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- return SaSi_AesBlock(&aes->ctx.user_ctx, (uint8_t*)in, sz, out);
- }
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- return SaSi_AesBlock(&aes->ctx.user_ctx, (uint8_t*)in, sz, out);
- }
-#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) && \
- !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
-
-#elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
-#elif defined(WOLFSSL_KCAPI_AES) && !defined(WOLFSSL_NO_KCAPI_AES_CBC)
- /* implemented in wolfcrypt/src/port/kcapi/kcapi_aes.c */
-
-#elif defined(WOLFSSL_DEVCRYPTO_CBC)
- /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
-
-#elif defined(WOLFSSL_SILABS_SE_ACCEL)
- /* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
-
-#elif defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- /* implemented in wolfcrypt/src/port/psa/psa_aes.c */
-
-#else
- /* Reminder: Some HW implementations may also define this as needed.
- * (e.g. for unsupported key length fallback) */
- #define NEED_SW_AESCBC
-#endif
-
-#ifdef NEED_SW_AESCBC
- /* Software AES - CBC Encrypt */
-
-int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
- word32 blocks;
- int ret;
-#endif
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if (sz == 0) {
- return 0;
- }
-
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
- blocks = sz / WC_AES_BLOCK_SIZE;
-#endif
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- if (sz % WC_AES_BLOCK_SIZE) {
- WOLFSSL_ERROR_VERBOSE(BAD_LENGTH_E);
- return BAD_LENGTH_E;
- }
-#endif
-
- #ifdef WOLFSSL_IMXRT_DCP
- /* Implemented in wolfcrypt/src/port/nxp/dcp_port.c */
- if (aes->keylen == 16)
- return DCPAesCbcEncrypt(aes, out, in, sz);
- #endif
-
- #ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret = wc_CryptoCb_AesCbcEncrypt(aes, out, in, sz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
- #endif
- #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- /* if async and byte count above threshold */
- if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
- sz >= WC_ASYNC_THRESH_AES_CBC) {
- #if defined(HAVE_CAVIUM)
- return NitroxAesCbcEncrypt(aes, out, in, sz);
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymAesCbcEncrypt(&aes->asyncDev, out, in, sz,
- (const byte*)aes->devKey, aes->keylen,
- (byte*)aes->reg, WC_AES_BLOCK_SIZE);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&aes->asyncDev, ASYNC_SW_AES_CBC_ENCRYPT)) {
- WC_ASYNC_SW* sw = &aes->asyncDev.sw;
- sw->aes.aes = aes;
- sw->aes.out = out;
- sw->aes.in = in;
- sw->aes.sz = sz;
- return WC_PENDING_E;
- }
- #endif
- }
- #endif /* WOLFSSL_ASYNC_CRYPT */
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_CBC_encrypt_AARCH32(in, out, sz, (byte*)aes->reg, (byte*)aes->key,
- (int)aes->rounds);
-#else
- AES_CBC_encrypt(in, out, sz, (const unsigned char*)aes->key,
- aes->rounds, (unsigned char*)aes->reg);
-#endif
- return 0;
-#else
- #if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- /* Implemented in wolfcrypt/src/port/nxp/se050_port.c */
- if (aes->useSWCrypt == 0) {
- return se050_aes_crypt(aes, in, out, sz, AES_ENCRYPTION,
- kAlgorithm_SSS_AES_CBC);
- }
- else
- #elif defined(WOLFSSL_ESPIDF) && defined(NEED_AESCBC_HW_FALLBACK)
- if (wc_esp32AesSupportedKeyLen(aes)) {
- ESP_LOGV(TAG, "wc_AesCbcEncrypt calling wc_esp32AesCbcEncrypt");
- return wc_esp32AesCbcEncrypt(aes, out, in, sz);
- }
- else {
- /* For example, the ESP32-S3 does not support HW for len = 24,
- * so fall back to SW */
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesCbcEncrypt HW Falling back, "
- "unsupported keylen = %d", aes->keylen);
- #endif
- }
- #elif defined(WOLFSSL_AESNI)
- VECTOR_REGISTERS_PUSH;
- if (aes->use_aesni) {
- #ifdef DEBUG_AESNI
- printf("about to aes cbc encrypt\n");
- printf("in = %p\n", in);
- printf("out = %p\n", out);
- printf("aes->key = %p\n", aes->key);
- printf("aes->reg = %p\n", aes->reg);
- printf("aes->rounds = %d\n", aes->rounds);
- printf("sz = %d\n", sz);
- #endif
-
- /* check alignment, decrypt doesn't need alignment */
- if ((wc_ptr_t)in % AESNI_ALIGN) {
- #ifndef NO_WOLFSSL_ALLOC_ALIGN
- byte* tmp = (byte*)XMALLOC(sz + WC_AES_BLOCK_SIZE + AESNI_ALIGN,
- aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- byte* tmp_align;
- if (tmp == NULL)
- ret = MEMORY_E;
- else {
- tmp_align = tmp + (AESNI_ALIGN - ((wc_ptr_t)tmp % AESNI_ALIGN));
- XMEMCPY(tmp_align, in, sz);
- AES_CBC_encrypt_AESNI(tmp_align, tmp_align, (byte*)aes->reg, sz,
- (byte*)aes->key, (int)aes->rounds);
- /* store iv for next call */
- XMEMCPY(aes->reg, tmp_align + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- XMEMCPY(out, tmp_align, sz);
- XFREE(tmp, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- ret = 0;
- }
- #else
- WOLFSSL_MSG("AES-CBC encrypt with bad alignment");
- WOLFSSL_ERROR_VERBOSE(BAD_ALIGN_E);
- ret = BAD_ALIGN_E;
- #endif
- } else {
- AES_CBC_encrypt_AESNI(in, out, (byte*)aes->reg, sz, (byte*)aes->key,
- (int)aes->rounds);
- /* store iv for next call */
- XMEMCPY(aes->reg, out + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- ret = 0;
- }
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_CBC_encrypt_AARCH64(in, out, sz, (byte*)aes->reg,
- (byte*)aes->key, (int)aes->rounds);
- ret = 0;
- }
- else
- #endif
- {
- ret = 0;
- while (blocks--) {
- xorbuf((byte*)aes->reg, in, WC_AES_BLOCK_SIZE);
- ret = wc_AesEncrypt(aes, (byte*)aes->reg, (byte*)aes->reg);
- if (ret != 0)
- break;
- XMEMCPY(out, aes->reg, WC_AES_BLOCK_SIZE);
-
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- }
- }
-
- #ifdef WOLFSSL_AESNI
- VECTOR_REGISTERS_POP;
- #endif
-
- return ret;
-#endif
- } /* wc_AesCbcEncrypt */
-
-#ifdef HAVE_AES_DECRYPT
- /* Software AES - CBC Decrypt */
- int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
- word32 blocks;
- int ret;
-#endif
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if (sz == 0) {
- return 0;
- }
-
- #if defined(WOLFSSL_ESPIDF) && defined(NEED_AESCBC_HW_FALLBACK)
- if (wc_esp32AesSupportedKeyLen(aes)) {
- ESP_LOGV(TAG, "wc_AesCbcDecrypt calling wc_esp32AesCbcDecrypt");
- return wc_esp32AesCbcDecrypt(aes, out, in, sz);
- }
- else {
- /* For example, the ESP32-S3 does not support HW for len = 24,
- * so fall back to SW */
- #ifdef DEBUG_WOLFSSL
- ESP_LOGW(TAG, "wc_AesCbcDecrypt HW Falling back, "
- "unsupported keylen = %d", aes->keylen);
- #endif
- }
- #endif
-
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
- blocks = sz / WC_AES_BLOCK_SIZE;
-#endif
- if (sz % WC_AES_BLOCK_SIZE) {
-#ifdef WOLFSSL_AES_CBC_LENGTH_CHECKS
- return BAD_LENGTH_E;
-#else
- return BAD_FUNC_ARG;
-#endif
- }
-
- #ifdef WOLFSSL_IMXRT_DCP
- /* Implemented in wolfcrypt/src/port/nxp/dcp_port.c */
- if (aes->keylen == 16)
- return DCPAesCbcDecrypt(aes, out, in, sz);
- #endif
-
- #ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret = wc_CryptoCb_AesCbcDecrypt(aes, out, in, sz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
- #endif
- #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- /* if async and byte count above threshold */
- if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
- sz >= WC_ASYNC_THRESH_AES_CBC) {
- #if defined(HAVE_CAVIUM)
- return NitroxAesCbcDecrypt(aes, out, in, sz);
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymAesCbcDecrypt(&aes->asyncDev, out, in, sz,
- (const byte*)aes->devKey, aes->keylen,
- (byte*)aes->reg, WC_AES_BLOCK_SIZE);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&aes->asyncDev, ASYNC_SW_AES_CBC_DECRYPT)) {
- WC_ASYNC_SW* sw = &aes->asyncDev.sw;
- sw->aes.aes = aes;
- sw->aes.out = out;
- sw->aes.in = in;
- sw->aes.sz = sz;
- return WC_PENDING_E;
- }
- #endif
- }
- #endif
-
- #if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- /* Implemented in wolfcrypt/src/port/nxp/se050_port.c */
- if (aes->useSWCrypt == 0) {
- return se050_aes_crypt(aes, in, out, sz, AES_DECRYPTION,
- kAlgorithm_SSS_AES_CBC);
- }
- #endif
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_CBC_decrypt_AARCH32(in, out, sz, (byte*)aes->reg, (byte*)aes->key,
- (int)aes->rounds);
-#else
- AES_CBC_decrypt(in, out, sz, (const unsigned char*)aes->key,
- aes->rounds, (unsigned char*)aes->reg);
-#endif
- return 0;
-#else
- VECTOR_REGISTERS_PUSH;
-
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- #ifdef DEBUG_AESNI
- printf("about to aes cbc decrypt\n");
- printf("in = %p\n", in);
- printf("out = %p\n", out);
- printf("aes->key = %p\n", aes->key);
- printf("aes->reg = %p\n", aes->reg);
- printf("aes->rounds = %d\n", aes->rounds);
- printf("sz = %d\n", sz);
- #endif
-
- /* if input and output same will overwrite input iv */
- XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- #if defined(WOLFSSL_AESNI_BY4) || defined(WOLFSSL_X86_BUILD)
- AES_CBC_decrypt_AESNI_by4(in, out, (byte*)aes->reg, sz, (byte*)aes->key,
- aes->rounds);
- #elif defined(WOLFSSL_AESNI_BY6)
- AES_CBC_decrypt_AESNI_by6(in, out, (byte*)aes->reg, sz, (byte*)aes->key,
- aes->rounds);
- #else /* WOLFSSL_AESNI_BYx */
- AES_CBC_decrypt_AESNI_by8(in, out, (byte*)aes->reg, sz, (byte*)aes->key,
- (int)aes->rounds);
- #endif /* WOLFSSL_AESNI_BYx */
- /* store iv for next call */
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
- ret = 0;
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_CBC_decrypt_AARCH64(in, out, sz, (byte*)aes->reg,
- (byte*)aes->key, (int)aes->rounds);
- ret = 0;
- }
- else
- #endif
- {
- ret = 0;
-#ifdef WC_AES_BITSLICED
- if (in != out) {
- unsigned char dec[WC_AES_BLOCK_SIZE * BS_WORD_SIZE];
-
- while (blocks > BS_WORD_SIZE) {
- AesDecryptBlocks_C(aes, in, dec, WC_AES_BLOCK_SIZE * BS_WORD_SIZE);
- xorbufout(out, dec, aes->reg, WC_AES_BLOCK_SIZE);
- xorbufout(out + WC_AES_BLOCK_SIZE, dec + WC_AES_BLOCK_SIZE, in,
- WC_AES_BLOCK_SIZE * (BS_WORD_SIZE - 1));
- XMEMCPY(aes->reg, in + (WC_AES_BLOCK_SIZE * (BS_WORD_SIZE - 1)),
- WC_AES_BLOCK_SIZE);
- in += WC_AES_BLOCK_SIZE * BS_WORD_SIZE;
- out += WC_AES_BLOCK_SIZE * BS_WORD_SIZE;
- blocks -= BS_WORD_SIZE;
- }
- if (blocks > 0) {
- AesDecryptBlocks_C(aes, in, dec, blocks * WC_AES_BLOCK_SIZE);
- xorbufout(out, dec, aes->reg, WC_AES_BLOCK_SIZE);
- xorbufout(out + WC_AES_BLOCK_SIZE, dec + WC_AES_BLOCK_SIZE, in,
- WC_AES_BLOCK_SIZE * (blocks - 1));
- XMEMCPY(aes->reg, in + (WC_AES_BLOCK_SIZE * (blocks - 1)),
- WC_AES_BLOCK_SIZE);
- blocks = 0;
- }
- }
- else {
- unsigned char dec[WC_AES_BLOCK_SIZE * BS_WORD_SIZE];
- int i;
-
- while (blocks > BS_WORD_SIZE) {
- AesDecryptBlocks_C(aes, in, dec, WC_AES_BLOCK_SIZE * BS_WORD_SIZE);
- XMEMCPY(aes->tmp, in + (BS_WORD_SIZE - 1) * WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- for (i = BS_WORD_SIZE-1; i >= 1; i--) {
- xorbufout(out + i * WC_AES_BLOCK_SIZE,
- dec + i * WC_AES_BLOCK_SIZE, in + (i - 1) * WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- }
- xorbufout(out, dec, aes->reg, WC_AES_BLOCK_SIZE);
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
-
- in += WC_AES_BLOCK_SIZE * BS_WORD_SIZE;
- out += WC_AES_BLOCK_SIZE * BS_WORD_SIZE;
- blocks -= BS_WORD_SIZE;
- }
- if (blocks > 0) {
- AesDecryptBlocks_C(aes, in, dec, blocks * WC_AES_BLOCK_SIZE);
- XMEMCPY(aes->tmp, in + (blocks - 1) * WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- for (i = blocks-1; i >= 1; i--) {
- xorbufout(out + i * WC_AES_BLOCK_SIZE,
- dec + i * WC_AES_BLOCK_SIZE, in + (i - 1) * WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- }
- xorbufout(out, dec, aes->reg, WC_AES_BLOCK_SIZE);
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
-
- blocks = 0;
- }
- }
-#else
- while (blocks--) {
- XMEMCPY(aes->tmp, in, WC_AES_BLOCK_SIZE);
- ret = wc_AesDecrypt(aes, in, out);
- if (ret != 0)
- return ret;
- xorbuf(out, (byte*)aes->reg, WC_AES_BLOCK_SIZE);
- /* store iv for next call */
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
-
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- }
-#endif
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-#endif
- }
-#endif /* HAVE_AES_DECRYPT */
-
-#endif /* AES-CBC block */
-#endif /* HAVE_AES_CBC */
-
-/* AES-CTR */
-#if defined(WOLFSSL_AES_COUNTER)
-
- #ifdef STM32_CRYPTO
- #define NEED_AES_CTR_SOFT
- #define XTRANSFORM_AESCTRBLOCK wc_AesCtrEncryptBlock
-
- int wc_AesCtrEncryptBlock(Aes* aes, byte* out, const byte* in)
- {
- int ret = 0;
- #ifdef WOLFSSL_STM32_CUBEMX
- CRYP_HandleTypeDef hcryp;
- #ifdef STM32_HAL_V2
- word32 iv[WC_AES_BLOCK_SIZE/sizeof(word32)];
- #endif
- #else
- word32 *iv;
- CRYP_InitTypeDef cryptInit;
- CRYP_KeyInitTypeDef keyInit;
- CRYP_IVInitTypeDef ivInit;
- #endif
-
- #ifdef WOLFSSL_STM32_CUBEMX
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0) {
- return ret;
- }
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- #if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_CTR;
- ByteReverseWords(iv, aes->reg, WC_AES_BLOCK_SIZE);
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)iv;
- #elif defined(STM32_CRYPTO_AES_ONLY)
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_CTR;
- hcryp.Init.KeyWriteFlag = CRYP_KEY_WRITE_ENABLE;
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- #else
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)aes->reg;
- #endif
- HAL_CRYP_Init(&hcryp);
-
- #if defined(STM32_HAL_V2)
- ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in, WC_AES_BLOCK_SIZE,
- (uint32_t*)out, STM32_HAL_TIMEOUT);
- #elif defined(STM32_CRYPTO_AES_ONLY)
- ret = HAL_CRYPEx_AES(&hcryp, (byte*)in, WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #else
- ret = HAL_CRYP_AESCTR_Encrypt(&hcryp, (byte*)in, WC_AES_BLOCK_SIZE,
- out, STM32_HAL_TIMEOUT);
- #endif
- if (ret != HAL_OK) {
- ret = WC_TIMEOUT_E;
- }
- HAL_CRYP_DeInit(&hcryp);
-
- #else /* Standard Peripheral Library */
- ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
- if (ret != 0) {
- return ret;
- }
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set key */
- CRYP_KeyInit(&keyInit);
-
- /* set iv */
- iv = aes->reg;
- CRYP_IVStructInit(&ivInit);
- ivInit.CRYP_IV0Left = ByteReverseWord32(iv[0]);
- ivInit.CRYP_IV0Right = ByteReverseWord32(iv[1]);
- ivInit.CRYP_IV1Left = ByteReverseWord32(iv[2]);
- ivInit.CRYP_IV1Right = ByteReverseWord32(iv[3]);
- CRYP_IVInit(&ivInit);
-
- /* set direction and mode */
- cryptInit.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt;
- cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CTR;
- CRYP_Init(&cryptInit);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&in[0]);
- CRYP_DataIn(*(uint32_t*)&in[4]);
- CRYP_DataIn(*(uint32_t*)&in[8]);
- CRYP_DataIn(*(uint32_t*)&in[12]);
-
- /* wait until the complete message has been processed */
- while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&out[0] = CRYP_DataOut();
- *(uint32_t*)&out[4] = CRYP_DataOut();
- *(uint32_t*)&out[8] = CRYP_DataOut();
- *(uint32_t*)&out[12] = CRYP_DataOut();
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- #endif /* WOLFSSL_STM32_CUBEMX */
-
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
- return ret;
- }
-
-
- #elif defined(WOLFSSL_PIC32MZ_CRYPT)
-
- #define NEED_AES_CTR_SOFT
- #define XTRANSFORM_AESCTRBLOCK wc_AesCtrEncryptBlock
-
- int wc_AesCtrEncryptBlock(Aes* aes, byte* out, const byte* in)
- {
- word32 tmpIv[WC_AES_BLOCK_SIZE / sizeof(word32)];
- XMEMCPY(tmpIv, aes->reg, WC_AES_BLOCK_SIZE);
- return wc_Pic32AesCrypt(
- aes->key, aes->keylen, tmpIv, WC_AES_BLOCK_SIZE,
- out, in, WC_AES_BLOCK_SIZE,
- PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCTR);
- }
-
- #elif defined(HAVE_COLDFIRE_SEC)
- #error "Coldfire SEC doesn't currently support AES-CTR mode"
-
- #elif defined(FREESCALE_LTC)
- int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- int ret = 0;
- word32 keySize;
- byte *iv, *enc_key;
- byte* tmp;
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- /* consume any unused bytes left in aes->tmp */
- tmp = (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left;
- while (aes->left && sz) {
- *(out++) = *(in++) ^ *(tmp++);
- aes->left--;
- sz--;
- }
-
- if (sz) {
- iv = (byte*)aes->reg;
- enc_key = (byte*)aes->key;
-
- ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0)
- return ret;
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0)
- return ret;
- LTC_AES_CryptCtr(LTC_BASE, in, out, sz,
- iv, enc_key, keySize, (byte*)aes->tmp,
- (uint32_t*)&aes->left);
- wolfSSL_CryptHwMutexUnLock();
- }
-
- return ret;
- }
-
- #elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) && \
- !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
-
- #elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
- #elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
-
- #elif defined(WOLFSSL_ESP32_CRYPT) && \
- !defined(NO_WOLFSSL_ESP32_CRYPT_AES)
- /* esp32 doesn't support CRT mode by hw. */
- /* use aes ecnryption plus sw implementation */
- #define NEED_AES_CTR_SOFT
-
- #elif defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- /* implemented in wolfcrypt/src/port/psa/psa_aes.c */
- #else
-
- /* Use software based AES counter */
- #define NEED_AES_CTR_SOFT
- #endif
-
- #ifdef NEED_AES_CTR_SOFT
- #if !(!defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO))
- /* Increment AES counter */
- static WC_INLINE void IncrementAesCounter(byte* inOutCtr)
- {
- /* in network byte order so start at end and work back */
- int i;
- for (i = WC_AES_BLOCK_SIZE - 1; i >= 0; i--) {
- if (++inOutCtr[i]) /* we're done unless we overflow */
- return;
- }
- }
- #endif
-
- /* Software AES - CTR Encrypt */
- int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
- {
- #if !(!defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO))
- byte scratch[WC_AES_BLOCK_SIZE];
- #endif
- #if defined(__aarch64__) || !defined(WOLFSSL_ARMASM)
- int ret = 0;
- #endif
- word32 processed;
-
- #if !(!defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO))
- XMEMSET(scratch, 0, sizeof(scratch));
- #endif
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- #ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret = wc_CryptoCb_AesCtrEncrypt(aes, out, in, sz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
- #endif
-
- /* consume any unused bytes left in aes->tmp */
- processed = min(aes->left, sz);
- xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left,
- processed);
- out += processed;
- in += processed;
- aes->left -= processed;
- sz -= processed;
-
- #if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
- #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_CTR_encrypt_AARCH32(in, out, sz, (byte*)aes->reg,
- (byte*)aes->key, (byte*)aes->tmp, &aes->left, aes->rounds);
- #else
- {
- word32 numBlocks;
- byte* tmp = (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left;
- /* consume any unused bytes left in aes->tmp */
- while ((aes->left != 0) && (sz != 0)) {
- *(out++) = *(in++) ^ *(tmp++);
- aes->left--;
- sz--;
- }
-
- /* do as many block size ops as possible */
- numBlocks = sz / WC_AES_BLOCK_SIZE;
- if (numBlocks > 0) {
- AES_CTR_encrypt(in, out, numBlocks * WC_AES_BLOCK_SIZE,
- (byte*)aes->key, aes->rounds, (byte*)aes->reg);
-
- sz -= numBlocks * WC_AES_BLOCK_SIZE;
- out += numBlocks * WC_AES_BLOCK_SIZE;
- in += numBlocks * WC_AES_BLOCK_SIZE;
- }
-
- /* handle non block size remaining */
- if (sz) {
- byte zeros[WC_AES_BLOCK_SIZE] = { 0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0 };
-
- AES_CTR_encrypt(zeros, (byte*)aes->tmp, WC_AES_BLOCK_SIZE,
- (byte*)aes->key, aes->rounds, (byte*)aes->reg);
-
- aes->left = WC_AES_BLOCK_SIZE;
- tmp = (byte*)aes->tmp;
-
- while (sz--) {
- *(out++) = *(in++) ^ *(tmp++);
- aes->left--;
- }
- }
- }
- #endif
- return 0;
- #else
- #if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_CTR_encrypt_AARCH64(in, out, sz, (byte*)aes->reg,
- (byte*)aes->key, (byte*)aes->tmp, &aes->left, aes->rounds);
- return 0;
- }
- #endif
-
- VECTOR_REGISTERS_PUSH;
-
- #if defined(HAVE_AES_ECB) && !defined(WOLFSSL_PIC32MZ_CRYPT) && \
- !defined(XTRANSFORM_AESCTRBLOCK)
- if (in != out && sz >= WC_AES_BLOCK_SIZE) {
- word32 blocks = sz / WC_AES_BLOCK_SIZE;
- byte* counter = (byte*)aes->reg;
- byte* c = out;
- while (blocks--) {
- XMEMCPY(c, counter, WC_AES_BLOCK_SIZE);
- c += WC_AES_BLOCK_SIZE;
- IncrementAesCounter(counter);
- }
-
- /* reset number of blocks and then do encryption */
- blocks = sz / WC_AES_BLOCK_SIZE;
- wc_AesEcbEncrypt(aes, out, out, WC_AES_BLOCK_SIZE * blocks);
- xorbuf(out, in, WC_AES_BLOCK_SIZE * blocks);
- in += WC_AES_BLOCK_SIZE * blocks;
- out += WC_AES_BLOCK_SIZE * blocks;
- sz -= blocks * WC_AES_BLOCK_SIZE;
- }
- else
- #endif
- {
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Add("wc_AesCtrEncrypt scratch", scratch,
- WC_AES_BLOCK_SIZE);
- #endif
- /* do as many block size ops as possible */
- while (sz >= WC_AES_BLOCK_SIZE) {
- #ifdef XTRANSFORM_AESCTRBLOCK
- XTRANSFORM_AESCTRBLOCK(aes, out, in);
- #else
- ret = wc_AesEncrypt(aes, (byte*)aes->reg, scratch);
- if (ret != 0)
- break;
- xorbuf(scratch, in, WC_AES_BLOCK_SIZE);
- XMEMCPY(out, scratch, WC_AES_BLOCK_SIZE);
- #endif
- IncrementAesCounter((byte*)aes->reg);
-
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- aes->left = 0;
- }
- ForceZero(scratch, WC_AES_BLOCK_SIZE);
- }
-
- /* handle non block size remaining and store unused byte count in left */
- if ((ret == 0) && sz) {
- ret = wc_AesEncrypt(aes, (byte*)aes->reg, (byte*)aes->tmp);
- if (ret == 0) {
- IncrementAesCounter((byte*)aes->reg);
- aes->left = WC_AES_BLOCK_SIZE - sz;
- xorbufout(out, in, aes->tmp, sz);
- }
- }
-
- if (ret < 0)
- ForceZero(scratch, WC_AES_BLOCK_SIZE);
-
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(scratch, WC_AES_BLOCK_SIZE);
- #endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
- #endif
- }
-
- int wc_AesCtrSetKey(Aes* aes, const byte* key, word32 len,
- const byte* iv, int dir)
- {
- if (aes == NULL) {
- return BAD_FUNC_ARG;
- }
- if (len > sizeof(aes->key)) {
- return BAD_FUNC_ARG;
- }
-
- return wc_AesSetKey(aes, key, len, iv, dir);
- }
-
- #endif /* NEED_AES_CTR_SOFT */
-
-#endif /* WOLFSSL_AES_COUNTER */
-#endif /* !WOLFSSL_RISCV_ASM */
-
-
-/*
- * The IV for AES GCM and CCM, stored in struct Aes's member reg, is comprised
- * of two parts in order:
- * 1. The fixed field which may be 0 or 4 bytes long. In TLS, this is set
- * to the implicit IV.
- * 2. The explicit IV is generated by wolfCrypt. It needs to be managed
- * by wolfCrypt to ensure the IV is unique for each call to encrypt.
- * The IV may be a 96-bit random value, or the 32-bit fixed value and a
- * 64-bit set of 0 or random data. The final 32-bits of reg is used as a
- * block counter during the encryption.
- */
-
-#if (defined(HAVE_AESGCM) && !defined(WC_NO_RNG)) || defined(HAVE_AESCCM)
-static WC_INLINE void IncCtr(byte* ctr, word32 ctrSz)
-{
- int i;
- for (i = (int)ctrSz - 1; i >= 0; i--) {
- if (++ctr[i])
- break;
- }
-}
-#endif /* HAVE_AESGCM || HAVE_AESCCM */
-
-
-#ifdef HAVE_AESGCM
-
-#ifdef WOLFSSL_AESGCM_STREAM
- /* Access initialization counter data. */
- #define AES_INITCTR(aes) ((aes)->streamData + 0 * WC_AES_BLOCK_SIZE)
- /* Access counter data. */
- #define AES_COUNTER(aes) ((aes)->streamData + 1 * WC_AES_BLOCK_SIZE)
- /* Access tag data. */
- #define AES_TAG(aes) ((aes)->streamData + 2 * WC_AES_BLOCK_SIZE)
- /* Access last GHASH block. */
- #define AES_LASTGBLOCK(aes) ((aes)->streamData + 3 * WC_AES_BLOCK_SIZE)
- /* Access last encrypted block. */
- #define AES_LASTBLOCK(aes) ((aes)->streamData + 4 * WC_AES_BLOCK_SIZE)
-
- #define GHASH_ONE_BLOCK GHASH_ONE_BLOCK_SW
-#endif
-
-#if defined(HAVE_COLDFIRE_SEC)
- #error "Coldfire SEC doesn't currently support AES-GCM mode"
-
-#endif
-
-#if defined(WOLFSSL_RISCV_ASM)
- /* implemented in wolfcrypt/src/port/risc-v/riscv-64-aes.c */
-
-#elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/afalg/afalg_aes.c */
-
-#elif defined(WOLFSSL_KCAPI_AES)
- /* implemented in wolfcrypt/src/port/kcapi/kcapi_aes.c */
-
-#elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
-
-#else /* software + AESNI implementation */
-
-#if !defined(FREESCALE_LTC_AES_GCM)
-static WC_INLINE void IncrementGcmCounter(byte* inOutCtr)
-{
- int i;
-
- /* in network byte order so start at end and work back */
- for (i = WC_AES_BLOCK_SIZE - 1; i >= WC_AES_BLOCK_SIZE - CTR_SZ; i--) {
- if (++inOutCtr[i]) /* we're done unless we overflow */
- return;
- }
-}
-#endif /* !FREESCALE_LTC_AES_GCM */
-
-#if !defined(WOLFSSL_ARMASM) || defined(__aarch64__) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-#if defined(GCM_SMALL) || defined(GCM_TABLE) || defined(GCM_TABLE_4BIT)
-
-static WC_INLINE void FlattenSzInBits(byte* buf, word32 sz)
-{
- /* Multiply the sz by 8 */
- word32 szHi = (sz >> (8*sizeof(sz) - 3));
- sz <<= 3;
-
- /* copy over the words of the sz into the destination buffer */
- buf[0] = (byte)(szHi >> 24);
- buf[1] = (byte)(szHi >> 16);
- buf[2] = (byte)(szHi >> 8);
- buf[3] = (byte)szHi;
- buf[4] = (byte)(sz >> 24);
- buf[5] = (byte)(sz >> 16);
- buf[6] = (byte)(sz >> 8);
- buf[7] = (byte)sz;
-}
-
-
-static WC_INLINE void RIGHTSHIFTX(byte* x)
-{
- int i;
- int carryIn = 0;
- volatile byte borrow = (byte)((0x00U - (x[15] & 0x01U)) & 0xE1U);
-
- for (i = 0; i < WC_AES_BLOCK_SIZE; i++) {
- int carryOut = (x[i] & 0x01) << 7;
- x[i] = (byte) ((x[i] >> 1) | carryIn);
- carryIn = carryOut;
- }
- x[0] ^= borrow;
-}
-
-#endif /* defined(GCM_SMALL) || defined(GCM_TABLE) || defined(GCM_TABLE_4BIT) */
-
-
-#ifdef GCM_TABLE
-
-void GenerateM0(Gcm* gcm)
-{
- int i, j;
- byte (*m)[WC_AES_BLOCK_SIZE] = gcm->M0;
-
- XMEMCPY(m[128], gcm->H, WC_AES_BLOCK_SIZE);
-
- for (i = 64; i > 0; i /= 2) {
- XMEMCPY(m[i], m[i*2], WC_AES_BLOCK_SIZE);
- RIGHTSHIFTX(m[i]);
- }
-
- for (i = 2; i < 256; i *= 2) {
- for (j = 1; j < i; j++) {
- XMEMCPY(m[i+j], m[i], WC_AES_BLOCK_SIZE);
- xorbuf(m[i+j], m[j], WC_AES_BLOCK_SIZE);
- }
- }
-
- XMEMSET(m[0], 0, WC_AES_BLOCK_SIZE);
-}
-
-#elif defined(GCM_TABLE_4BIT)
-
-#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_16BIT_CPU)
-static WC_INLINE void Shift4_M0(byte *r8, byte *z8)
-{
- int i;
- for (i = 15; i > 0; i--)
- r8[i] = (byte)(z8[i-1] << 4) | (byte)(z8[i] >> 4);
- r8[0] = (byte)(z8[0] >> 4);
-}
-#endif
-
-void GenerateM0(Gcm* gcm)
-{
-#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_16BIT_CPU)
- int i;
-#endif
- byte (*m)[WC_AES_BLOCK_SIZE] = gcm->M0;
-
- /* 0 times -> 0x0 */
- XMEMSET(m[0x0], 0, WC_AES_BLOCK_SIZE);
- /* 1 times -> 0x8 */
- XMEMCPY(m[0x8], gcm->H, WC_AES_BLOCK_SIZE);
- /* 2 times -> 0x4 */
- XMEMCPY(m[0x4], m[0x8], WC_AES_BLOCK_SIZE);
- RIGHTSHIFTX(m[0x4]);
- /* 4 times -> 0x2 */
- XMEMCPY(m[0x2], m[0x4], WC_AES_BLOCK_SIZE);
- RIGHTSHIFTX(m[0x2]);
- /* 8 times -> 0x1 */
- XMEMCPY(m[0x1], m[0x2], WC_AES_BLOCK_SIZE);
- RIGHTSHIFTX(m[0x1]);
-
- /* 0x3 */
- XMEMCPY(m[0x3], m[0x2], WC_AES_BLOCK_SIZE);
- xorbuf (m[0x3], m[0x1], WC_AES_BLOCK_SIZE);
-
- /* 0x5 -> 0x7 */
- XMEMCPY(m[0x5], m[0x4], WC_AES_BLOCK_SIZE);
- xorbuf (m[0x5], m[0x1], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0x6], m[0x4], WC_AES_BLOCK_SIZE);
- xorbuf (m[0x6], m[0x2], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0x7], m[0x4], WC_AES_BLOCK_SIZE);
- xorbuf (m[0x7], m[0x3], WC_AES_BLOCK_SIZE);
-
- /* 0x9 -> 0xf */
- XMEMCPY(m[0x9], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0x9], m[0x1], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xa], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xa], m[0x2], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xb], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xb], m[0x3], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xc], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xc], m[0x4], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xd], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xd], m[0x5], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xe], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xe], m[0x6], WC_AES_BLOCK_SIZE);
- XMEMCPY(m[0xf], m[0x8], WC_AES_BLOCK_SIZE);
- xorbuf (m[0xf], m[0x7], WC_AES_BLOCK_SIZE);
-
-#if defined(WOLFSSL_ARMASM) && !defined(__aarch64__) && \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- for (i = 0; i < 16; i++) {
- word32* m32 = (word32*)gcm->M0[i];
- m32[0] = ByteReverseWord32(m32[0]);
- m32[1] = ByteReverseWord32(m32[1]);
- m32[2] = ByteReverseWord32(m32[2]);
- m32[3] = ByteReverseWord32(m32[3]);
- }
-#endif
-
-#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_16BIT_CPU)
- for (i = 0; i < 16; i++) {
- Shift4_M0(m[16+i], m[i]);
- }
-#endif
-}
-
-#endif /* GCM_TABLE */
-#endif
-
-#if defined(WOLFSSL_AESNI) && defined(USE_INTEL_SPEEDUP)
- #define HAVE_INTEL_AVX1
- #define HAVE_INTEL_AVX2
-#endif
-
-#if defined(WOLFSSL_AESNI) && defined(GCM_TABLE_4BIT) && \
- defined(WC_C_DYNAMIC_FALLBACK)
-void GCM_generate_m0_aesni(const unsigned char *h, unsigned char *m)
- XASM_LINK("GCM_generate_m0_aesni");
-#ifdef HAVE_INTEL_AVX1
-void GCM_generate_m0_avx1(const unsigned char *h, unsigned char *m)
- XASM_LINK("GCM_generate_m0_avx1");
-#endif
-#ifdef HAVE_INTEL_AVX2
-void GCM_generate_m0_avx2(const unsigned char *h, unsigned char *m)
- XASM_LINK("GCM_generate_m0_avx2");
-#endif
-#endif /* WOLFSSL_AESNI && GCM_TABLE_4BIT && WC_C_DYNAMIC_FALLBACK */
-
-/* Software AES - GCM SetKey */
-int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
-{
- int ret;
- byte iv[WC_AES_BLOCK_SIZE];
-
- #ifdef WOLFSSL_IMX6_CAAM_BLOB
- byte local[32];
- word32 localSz = 32;
-
- if (len == (16 + WC_CAAM_BLOB_SZ) ||
- len == (24 + WC_CAAM_BLOB_SZ) ||
- len == (32 + WC_CAAM_BLOB_SZ)) {
- if (wc_caamOpenBlob((byte*)key, len, local, &localSz) != 0) {
- return BAD_FUNC_ARG;
- }
-
- /* set local values */
- key = local;
- len = localSz;
- }
- #endif
-
- if (!((len == 16) || (len == 24) || (len == 32)))
- return BAD_FUNC_ARG;
-
- if (aes == NULL || key == NULL) {
-#ifdef WOLFSSL_IMX6_CAAM_BLOB
- ForceZero(local, sizeof(local));
-#endif
- return BAD_FUNC_ARG;
- }
-#ifdef OPENSSL_EXTRA
- XMEMSET(aes->gcm.aadH, 0, sizeof(aes->gcm.aadH));
- aes->gcm.aadLen = 0;
-#endif
- XMEMSET(iv, 0, WC_AES_BLOCK_SIZE);
- ret = wc_AesSetKey(aes, key, len, iv, AES_ENCRYPTION);
-#ifdef WOLFSSL_AESGCM_STREAM
- aes->gcmKeySet = 1;
-#endif
- #if defined(WOLFSSL_SECO_CAAM)
- if (aes->devId == WOLFSSL_SECO_DEVID) {
- return ret;
- }
- #endif /* WOLFSSL_SECO_CAAM */
-
- #if defined(WOLFSSL_RENESAS_FSPSM_CRYPTONLY) && \
- !defined(NO_WOLFSSL_RENESAS_FSPSM_AES)
- return ret;
- #endif /* WOLFSSL_RENESAS_RSIP && WOLFSSL_RENESAS_FSPSM_CRYPTONLY*/
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
- if (ret == 0) {
- #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_GCM_set_key_AARCH32(iv, (byte*)aes->key, aes->gcm.H, aes->rounds);
- #else
- AES_ECB_encrypt(iv, aes->gcm.H, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds);
- #if defined(GCM_TABLE) || defined(GCM_TABLE_4BIT)
- GenerateM0(&aes->gcm);
- #endif /* GCM_TABLE */
- #endif
- }
-#else
-#if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (ret == 0 && aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- AES_GCM_set_key_AARCH64(iv, (byte*)aes->key, aes->gcm.H, aes->rounds);
- }
- else
-#endif
-#if !defined(FREESCALE_LTC_AES_GCM)
- if (ret == 0) {
- VECTOR_REGISTERS_PUSH;
- /* AES-NI code generates its own H value, but generate it here too, to
- * assure pure-C fallback is always usable.
- */
- ret = wc_AesEncrypt(aes, iv, aes->gcm.H);
- VECTOR_REGISTERS_POP;
- }
- if (ret == 0) {
-#if defined(GCM_TABLE) || defined(GCM_TABLE_4BIT)
-#if defined(WOLFSSL_AESNI) && defined(GCM_TABLE_4BIT)
- if (aes->use_aesni) {
- #if defined(WC_C_DYNAMIC_FALLBACK)
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- GCM_generate_m0_avx2(aes->gcm.H, (byte*)aes->gcm.M0);
- }
- else
- #endif
- #if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- GCM_generate_m0_avx1(aes->gcm.H, (byte*)aes->gcm.M0);
- }
- else
- #endif
- {
- GCM_generate_m0_aesni(aes->gcm.H, (byte*)aes->gcm.M0);
- }
- #endif
- }
- else
-#endif
- {
- GenerateM0(&aes->gcm);
- }
-#endif /* GCM_TABLE || GCM_TABLE_4BIT */
- }
-#endif /* FREESCALE_LTC_AES_GCM */
-#endif
-
-#if defined(WOLFSSL_XILINX_CRYPT) || defined(WOLFSSL_AFALG_XILINX_AES)
- wc_AesGcmSetKey_ex(aes, key, len, WOLFSSL_XILINX_AES_KEY_SRC);
-#endif
-
-#ifdef WOLF_CRYPTO_CB
- if (aes->devId != INVALID_DEVID) {
- XMEMCPY(aes->devKey, key, len);
- }
-#endif
-
-#ifdef WOLFSSL_IMX6_CAAM_BLOB
- ForceZero(local, sizeof(local));
-#endif
- return ret;
-}
-
-
-#ifdef WOLFSSL_AESNI
-
-void AES_GCM_encrypt_aesni(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- unsigned char *tag, word32 nbytes,
- word32 abytes, word32 ibytes,
- word32 tbytes, const unsigned char* key, int nr)
- XASM_LINK("AES_GCM_encrypt_aesni");
-#ifdef HAVE_INTEL_AVX1
-void AES_GCM_encrypt_avx1(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- unsigned char *tag, word32 nbytes,
- word32 abytes, word32 ibytes,
- word32 tbytes, const unsigned char* key,
- int nr)
- XASM_LINK("AES_GCM_encrypt_avx1");
-#ifdef HAVE_INTEL_AVX2
-void AES_GCM_encrypt_avx2(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- unsigned char *tag, word32 nbytes,
- word32 abytes, word32 ibytes,
- word32 tbytes, const unsigned char* key,
- int nr)
- XASM_LINK("AES_GCM_encrypt_avx2");
-#endif /* HAVE_INTEL_AVX2 */
-#endif /* HAVE_INTEL_AVX1 */
-
-#ifdef HAVE_AES_DECRYPT
-void AES_GCM_decrypt_aesni(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- const unsigned char *tag, word32 nbytes, word32 abytes,
- word32 ibytes, word32 tbytes, const unsigned char* key,
- int nr, int* res)
- XASM_LINK("AES_GCM_decrypt_aesni");
-#ifdef HAVE_INTEL_AVX1
-void AES_GCM_decrypt_avx1(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- const unsigned char *tag, word32 nbytes,
- word32 abytes, word32 ibytes, word32 tbytes,
- const unsigned char* key, int nr, int* res)
- XASM_LINK("AES_GCM_decrypt_avx1");
-#ifdef HAVE_INTEL_AVX2
-void AES_GCM_decrypt_avx2(const unsigned char *in, unsigned char *out,
- const unsigned char* addt, const unsigned char* ivec,
- const unsigned char *tag, word32 nbytes,
- word32 abytes, word32 ibytes, word32 tbytes,
- const unsigned char* key, int nr, int* res)
- XASM_LINK("AES_GCM_decrypt_avx2");
-#endif /* HAVE_INTEL_AVX2 */
-#endif /* HAVE_INTEL_AVX1 */
-#endif /* HAVE_AES_DECRYPT */
-
-#endif /* WOLFSSL_AESNI */
-
-#if !defined(WOLFSSL_ARMASM) || defined(__aarch64__) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-#if defined(GCM_SMALL)
-static void GMULT(byte* X, byte* Y)
-{
- byte Z[WC_AES_BLOCK_SIZE];
- byte V[WC_AES_BLOCK_SIZE];
- int i, j;
-
- XMEMSET(Z, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(V, X, WC_AES_BLOCK_SIZE);
- for (i = 0; i < WC_AES_BLOCK_SIZE; i++)
- {
- byte y = Y[i];
- for (j = 0; j < 8; j++)
- {
- if (y & 0x80) {
- xorbuf(Z, V, WC_AES_BLOCK_SIZE);
- }
-
- RIGHTSHIFTX(V);
- y = y << 1;
- }
- }
- XMEMCPY(X, Z, WC_AES_BLOCK_SIZE);
-}
-
-
-void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
- word32 cSz, byte* s, word32 sSz)
-{
- byte x[WC_AES_BLOCK_SIZE];
- byte scratch[WC_AES_BLOCK_SIZE];
- word32 blocks, partial;
- byte* h;
-
- if (gcm == NULL) {
- return;
- }
-
- h = gcm->H;
- XMEMSET(x, 0, WC_AES_BLOCK_SIZE);
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- while (blocks--) {
- xorbuf(x, a, WC_AES_BLOCK_SIZE);
- GMULT(x, h);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, a, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, h);
- }
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- while (blocks--) {
- xorbuf(x, c, WC_AES_BLOCK_SIZE);
- GMULT(x, h);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, c, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, h);
- }
- }
-
- /* Hash in the lengths of A and C in bits */
- FlattenSzInBits(&scratch[0], aSz);
- FlattenSzInBits(&scratch[8], cSz);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, h);
-
- /* Copy the result into s. */
- XMEMCPY(s, x, sSz);
-}
-
-#ifdef WOLFSSL_AESGCM_STREAM
-/* No extra initialization for small implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) WC_DO_NOTHING
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- xorbuf(AES_TAG(aes), block, WC_AES_BLOCK_SIZE); \
- GMULT(AES_TAG(aes), (aes)->gcm.H); \
- } \
- while (0)
-#endif /* WOLFSSL_AESGCM_STREAM */
-
-#ifdef WOLFSSL_ARMASM
-#define GCM_GMULT_LEN(gcm, x, a, len) \
- GCM_gmult_len(x, (const byte**)((gcm)->M0), a, len)
-#endif
-
-#elif defined(GCM_TABLE)
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-#define GCM_GMULT_LEN(gcm, x, a, len) \
- GCM_gmult_len(x, (const byte**)((gcm)->M0), a, len)
-#else
-ALIGN16 static const byte R[256][2] = {
- {0x00, 0x00}, {0x01, 0xc2}, {0x03, 0x84}, {0x02, 0x46},
- {0x07, 0x08}, {0x06, 0xca}, {0x04, 0x8c}, {0x05, 0x4e},
- {0x0e, 0x10}, {0x0f, 0xd2}, {0x0d, 0x94}, {0x0c, 0x56},
- {0x09, 0x18}, {0x08, 0xda}, {0x0a, 0x9c}, {0x0b, 0x5e},
- {0x1c, 0x20}, {0x1d, 0xe2}, {0x1f, 0xa4}, {0x1e, 0x66},
- {0x1b, 0x28}, {0x1a, 0xea}, {0x18, 0xac}, {0x19, 0x6e},
- {0x12, 0x30}, {0x13, 0xf2}, {0x11, 0xb4}, {0x10, 0x76},
- {0x15, 0x38}, {0x14, 0xfa}, {0x16, 0xbc}, {0x17, 0x7e},
- {0x38, 0x40}, {0x39, 0x82}, {0x3b, 0xc4}, {0x3a, 0x06},
- {0x3f, 0x48}, {0x3e, 0x8a}, {0x3c, 0xcc}, {0x3d, 0x0e},
- {0x36, 0x50}, {0x37, 0x92}, {0x35, 0xd4}, {0x34, 0x16},
- {0x31, 0x58}, {0x30, 0x9a}, {0x32, 0xdc}, {0x33, 0x1e},
- {0x24, 0x60}, {0x25, 0xa2}, {0x27, 0xe4}, {0x26, 0x26},
- {0x23, 0x68}, {0x22, 0xaa}, {0x20, 0xec}, {0x21, 0x2e},
- {0x2a, 0x70}, {0x2b, 0xb2}, {0x29, 0xf4}, {0x28, 0x36},
- {0x2d, 0x78}, {0x2c, 0xba}, {0x2e, 0xfc}, {0x2f, 0x3e},
- {0x70, 0x80}, {0x71, 0x42}, {0x73, 0x04}, {0x72, 0xc6},
- {0x77, 0x88}, {0x76, 0x4a}, {0x74, 0x0c}, {0x75, 0xce},
- {0x7e, 0x90}, {0x7f, 0x52}, {0x7d, 0x14}, {0x7c, 0xd6},
- {0x79, 0x98}, {0x78, 0x5a}, {0x7a, 0x1c}, {0x7b, 0xde},
- {0x6c, 0xa0}, {0x6d, 0x62}, {0x6f, 0x24}, {0x6e, 0xe6},
- {0x6b, 0xa8}, {0x6a, 0x6a}, {0x68, 0x2c}, {0x69, 0xee},
- {0x62, 0xb0}, {0x63, 0x72}, {0x61, 0x34}, {0x60, 0xf6},
- {0x65, 0xb8}, {0x64, 0x7a}, {0x66, 0x3c}, {0x67, 0xfe},
- {0x48, 0xc0}, {0x49, 0x02}, {0x4b, 0x44}, {0x4a, 0x86},
- {0x4f, 0xc8}, {0x4e, 0x0a}, {0x4c, 0x4c}, {0x4d, 0x8e},
- {0x46, 0xd0}, {0x47, 0x12}, {0x45, 0x54}, {0x44, 0x96},
- {0x41, 0xd8}, {0x40, 0x1a}, {0x42, 0x5c}, {0x43, 0x9e},
- {0x54, 0xe0}, {0x55, 0x22}, {0x57, 0x64}, {0x56, 0xa6},
- {0x53, 0xe8}, {0x52, 0x2a}, {0x50, 0x6c}, {0x51, 0xae},
- {0x5a, 0xf0}, {0x5b, 0x32}, {0x59, 0x74}, {0x58, 0xb6},
- {0x5d, 0xf8}, {0x5c, 0x3a}, {0x5e, 0x7c}, {0x5f, 0xbe},
- {0xe1, 0x00}, {0xe0, 0xc2}, {0xe2, 0x84}, {0xe3, 0x46},
- {0xe6, 0x08}, {0xe7, 0xca}, {0xe5, 0x8c}, {0xe4, 0x4e},
- {0xef, 0x10}, {0xee, 0xd2}, {0xec, 0x94}, {0xed, 0x56},
- {0xe8, 0x18}, {0xe9, 0xda}, {0xeb, 0x9c}, {0xea, 0x5e},
- {0xfd, 0x20}, {0xfc, 0xe2}, {0xfe, 0xa4}, {0xff, 0x66},
- {0xfa, 0x28}, {0xfb, 0xea}, {0xf9, 0xac}, {0xf8, 0x6e},
- {0xf3, 0x30}, {0xf2, 0xf2}, {0xf0, 0xb4}, {0xf1, 0x76},
- {0xf4, 0x38}, {0xf5, 0xfa}, {0xf7, 0xbc}, {0xf6, 0x7e},
- {0xd9, 0x40}, {0xd8, 0x82}, {0xda, 0xc4}, {0xdb, 0x06},
- {0xde, 0x48}, {0xdf, 0x8a}, {0xdd, 0xcc}, {0xdc, 0x0e},
- {0xd7, 0x50}, {0xd6, 0x92}, {0xd4, 0xd4}, {0xd5, 0x16},
- {0xd0, 0x58}, {0xd1, 0x9a}, {0xd3, 0xdc}, {0xd2, 0x1e},
- {0xc5, 0x60}, {0xc4, 0xa2}, {0xc6, 0xe4}, {0xc7, 0x26},
- {0xc2, 0x68}, {0xc3, 0xaa}, {0xc1, 0xec}, {0xc0, 0x2e},
- {0xcb, 0x70}, {0xca, 0xb2}, {0xc8, 0xf4}, {0xc9, 0x36},
- {0xcc, 0x78}, {0xcd, 0xba}, {0xcf, 0xfc}, {0xce, 0x3e},
- {0x91, 0x80}, {0x90, 0x42}, {0x92, 0x04}, {0x93, 0xc6},
- {0x96, 0x88}, {0x97, 0x4a}, {0x95, 0x0c}, {0x94, 0xce},
- {0x9f, 0x90}, {0x9e, 0x52}, {0x9c, 0x14}, {0x9d, 0xd6},
- {0x98, 0x98}, {0x99, 0x5a}, {0x9b, 0x1c}, {0x9a, 0xde},
- {0x8d, 0xa0}, {0x8c, 0x62}, {0x8e, 0x24}, {0x8f, 0xe6},
- {0x8a, 0xa8}, {0x8b, 0x6a}, {0x89, 0x2c}, {0x88, 0xee},
- {0x83, 0xb0}, {0x82, 0x72}, {0x80, 0x34}, {0x81, 0xf6},
- {0x84, 0xb8}, {0x85, 0x7a}, {0x87, 0x3c}, {0x86, 0xfe},
- {0xa9, 0xc0}, {0xa8, 0x02}, {0xaa, 0x44}, {0xab, 0x86},
- {0xae, 0xc8}, {0xaf, 0x0a}, {0xad, 0x4c}, {0xac, 0x8e},
- {0xa7, 0xd0}, {0xa6, 0x12}, {0xa4, 0x54}, {0xa5, 0x96},
- {0xa0, 0xd8}, {0xa1, 0x1a}, {0xa3, 0x5c}, {0xa2, 0x9e},
- {0xb5, 0xe0}, {0xb4, 0x22}, {0xb6, 0x64}, {0xb7, 0xa6},
- {0xb2, 0xe8}, {0xb3, 0x2a}, {0xb1, 0x6c}, {0xb0, 0xae},
- {0xbb, 0xf0}, {0xba, 0x32}, {0xb8, 0x74}, {0xb9, 0xb6},
- {0xbc, 0xf8}, {0xbd, 0x3a}, {0xbf, 0x7c}, {0xbe, 0xbe} };
-
-
-static void GMULT(byte *x, byte m[256][WC_AES_BLOCK_SIZE])
-{
-#if !defined(WORD64_AVAILABLE) || defined(BIG_ENDIAN_ORDER)
- int i, j;
- byte Z[WC_AES_BLOCK_SIZE];
- byte a;
-
- XMEMSET(Z, 0, sizeof(Z));
-
- for (i = 15; i > 0; i--) {
- xorbuf(Z, m[x[i]], WC_AES_BLOCK_SIZE);
- a = Z[15];
-
- for (j = 15; j > 0; j--) {
- Z[j] = Z[j-1];
- }
-
- Z[0] = R[a][0];
- Z[1] ^= R[a][1];
- }
- xorbuf(Z, m[x[0]], WC_AES_BLOCK_SIZE);
-
- XMEMCPY(x, Z, WC_AES_BLOCK_SIZE);
-#elif defined(WC_32BIT_CPU)
- byte Z[WC_AES_BLOCK_SIZE + WC_AES_BLOCK_SIZE];
- byte a;
- word32* pZ;
- word32* pm;
- word32* px = (word32*)(x);
- int i;
-
- pZ = (word32*)(Z + 15 + 1);
- pm = (word32*)(m[x[15]]);
- pZ[0] = pm[0];
- pZ[1] = pm[1];
- pZ[2] = pm[2];
- pZ[3] = pm[3];
- a = Z[16 + 15];
- Z[15] = R[a][0];
- Z[16] ^= R[a][1];
- for (i = 14; i > 0; i--) {
- pZ = (word32*)(Z + i + 1);
- pm = (word32*)(m[x[i]]);
- pZ[0] ^= pm[0];
- pZ[1] ^= pm[1];
- pZ[2] ^= pm[2];
- pZ[3] ^= pm[3];
- a = Z[16 + i];
- Z[i] = R[a][0];
- Z[i+1] ^= R[a][1];
- }
- pZ = (word32*)(Z + 1);
- pm = (word32*)(m[x[0]]);
- px[0] = pZ[0] ^ pm[0]; px[1] = pZ[1] ^ pm[1];
- px[2] = pZ[2] ^ pm[2]; px[3] = pZ[3] ^ pm[3];
-#else
- byte Z[WC_AES_BLOCK_SIZE + WC_AES_BLOCK_SIZE];
- byte a;
- word64* pZ;
- word64* pm;
- word64* px = (word64*)(x);
- int i;
-
- pZ = (word64*)(Z + 15 + 1);
- pm = (word64*)(m[x[15]]);
- pZ[0] = pm[0];
- pZ[1] = pm[1];
- a = Z[16 + 15];
- Z[15] = R[a][0];
- Z[16] ^= R[a][1];
- for (i = 14; i > 0; i--) {
- pZ = (word64*)(Z + i + 1);
- pm = (word64*)(m[x[i]]);
- pZ[0] ^= pm[0];
- pZ[1] ^= pm[1];
- a = Z[16 + i];
- Z[i] = R[a][0];
- Z[i+1] ^= R[a][1];
- }
- pZ = (word64*)(Z + 1);
- pm = (word64*)(m[x[0]]);
- px[0] = pZ[0] ^ pm[0]; px[1] = pZ[1] ^ pm[1];
-#endif
-}
-#endif
-
-void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
- word32 cSz, byte* s, word32 sSz)
-{
- byte x[WC_AES_BLOCK_SIZE];
- byte scratch[WC_AES_BLOCK_SIZE];
- word32 blocks, partial;
-
- if (gcm == NULL) {
- return;
- }
-
- XMEMSET(x, 0, WC_AES_BLOCK_SIZE);
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- #ifdef GCM_GMULT_LEN
- if (blocks > 0) {
- GCM_GMULT_LEN(gcm, x, a, blocks * WC_AES_BLOCK_SIZE);
- a += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, a, partial);
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- #else
- while (blocks--) {
- xorbuf(x, a, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, a, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- }
- #endif
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- #ifdef GCM_GMULT_LEN
- if (blocks > 0) {
- GCM_GMULT_LEN(gcm, x, c, blocks * WC_AES_BLOCK_SIZE);
- c += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, c, partial);
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- #else
- while (blocks--) {
- xorbuf(x, c, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, c, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- }
- #endif
- }
-
- /* Hash in the lengths of A and C in bits */
- FlattenSzInBits(&scratch[0], aSz);
- FlattenSzInBits(&scratch[8], cSz);
-#ifdef GCM_GMULT_LEN
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
-#else
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
-#endif
-
- /* Copy the result into s. */
- XMEMCPY(s, x, sSz);
-}
-
-#ifdef WOLFSSL_AESGCM_STREAM
-/* No extra initialization for table implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) WC_DO_NOTHING
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H using pre-computed table.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- xorbuf(AES_TAG(aes), block, WC_AES_BLOCK_SIZE); \
- GMULT(AES_TAG(aes), aes->gcm.M0); \
- } \
- while (0)
-#endif /* WOLFSSL_AESGCM_STREAM */
-/* end GCM_TABLE */
-#elif defined(GCM_TABLE_4BIT)
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-#define GCM_GMULT_LEN(gcm, x, a, len) \
- GCM_gmult_len(x, (const byte**)((gcm)->M0), a, len)
-#else
-/* remainder = x^7 + x^2 + x^1 + 1 => 0xe1
- * R shifts right a reverse bit pair of bytes such that:
- * R(b0, b1) => b1 = (b1 >> 1) | (b0 << 7); b0 >>= 1
- * 0 => 0, 0, 0, 0 => R(R(R(00,00) ^ 00,00) ^ 00,00) ^ 00,00 = 00,00
- * 8 => 0, 0, 0, 1 => R(R(R(00,00) ^ 00,00) ^ 00,00) ^ e1,00 = e1,00
- * 4 => 0, 0, 1, 0 => R(R(R(00,00) ^ 00,00) ^ e1,00) ^ 00,00 = 70,80
- * 2 => 0, 1, 0, 0 => R(R(R(00,00) ^ e1,00) ^ 00,00) ^ 00,00 = 38,40
- * 1 => 1, 0, 0, 0 => R(R(R(e1,00) ^ 00,00) ^ 00,00) ^ 00,00 = 1c,20
- * To calculate te rest, XOR result for each bit.
- * e.g. 6 = 4 ^ 2 => 48,c0
- *
- * Second half is same values rotated by 4-bits.
- */
-#if defined(BIG_ENDIAN_ORDER) || defined(WC_16BIT_CPU)
-static const byte R[16][2] = {
- {0x00, 0x00}, {0x1c, 0x20}, {0x38, 0x40}, {0x24, 0x60},
- {0x70, 0x80}, {0x6c, 0xa0}, {0x48, 0xc0}, {0x54, 0xe0},
- {0xe1, 0x00}, {0xfd, 0x20}, {0xd9, 0x40}, {0xc5, 0x60},
- {0x91, 0x80}, {0x8d, 0xa0}, {0xa9, 0xc0}, {0xb5, 0xe0},
-};
-#else
-static const word16 R[32] = {
- 0x0000, 0x201c, 0x4038, 0x6024,
- 0x8070, 0xa06c, 0xc048, 0xe054,
- 0x00e1, 0x20fd, 0x40d9, 0x60c5,
- 0x8091, 0xa08d, 0xc0a9, 0xe0b5,
-
- 0x0000, 0xc201, 0x8403, 0x4602,
- 0x0807, 0xca06, 0x8c04, 0x4e05,
- 0x100e, 0xd20f, 0x940d, 0x560c,
- 0x1809, 0xda08, 0x9c0a, 0x5e0b,
-};
-#endif
-
-/* Multiply in GF(2^128) defined by polynomial:
- * x^128 + x^7 + x^2 + x^1 + 1.
- *
- * H: hash key = encrypt(key, 0)
- * x = x * H in field
- *
- * x: cumulative result
- * m: 4-bit table
- * [0..15] * H
- */
-#if defined(BIG_ENDIAN_ORDER) || defined(WC_16BIT_CPU)
-static void GMULT(byte *x, byte m[16][WC_AES_BLOCK_SIZE])
-{
- int i, j, n;
- byte Z[WC_AES_BLOCK_SIZE];
- byte a;
-
- XMEMSET(Z, 0, sizeof(Z));
-
- for (i = 15; i >= 0; i--) {
- for (n = 0; n < 2; n++) {
- if (n == 0)
- xorbuf(Z, m[x[i] & 0xf], WC_AES_BLOCK_SIZE);
- else {
- xorbuf(Z, m[x[i] >> 4], WC_AES_BLOCK_SIZE);
- if (i == 0)
- break;
- }
- a = Z[15] & 0xf;
-
- for (j = 15; j > 0; j--)
- Z[j] = (Z[j-1] << 4) | (Z[j] >> 4);
- Z[0] >>= 4;
-
- Z[0] ^= R[a][0];
- Z[1] ^= R[a][1];
- }
- }
-
- XMEMCPY(x, Z, WC_AES_BLOCK_SIZE);
-}
-#elif defined(WC_32BIT_CPU)
-static WC_INLINE void GMULT(byte *x, byte m[32][WC_AES_BLOCK_SIZE])
-{
- int i;
- word32 z8[4] = {0, 0, 0, 0};
- byte a;
- word32* x8 = (word32*)x;
- word32* m8;
- byte xi;
- word32 n7, n6, n5, n4, n3, n2, n1, n0;
-
- for (i = 15; i > 0; i--) {
- xi = x[i];
-
- /* XOR in (msn * H) */
- m8 = (word32*)m[xi & 0xf];
- z8[0] ^= m8[0]; z8[1] ^= m8[1]; z8[2] ^= m8[2]; z8[3] ^= m8[3];
-
- /* Cache top byte for remainder calculations - lost in rotate. */
- a = (byte)(z8[3] >> 24);
-
- /* Rotate Z by 8-bits */
- z8[3] = (z8[2] >> 24) | (z8[3] << 8);
- z8[2] = (z8[1] >> 24) | (z8[2] << 8);
- z8[1] = (z8[0] >> 24) | (z8[1] << 8);
- z8[0] <<= 8;
-
- /* XOR in (msn * remainder) [pre-rotated by 4 bits] */
- z8[0] ^= (word32)R[16 + (a & 0xf)];
-
- xi >>= 4;
- /* XOR in next significant nibble (XORed with H) * remainder */
- m8 = (word32*)m[xi];
- a ^= (byte)(m8[3] >> 20);
- z8[0] ^= (word32)R[a >> 4];
-
- /* XOR in (next significant nibble * H) [pre-rotated by 4 bits] */
- m8 = (word32*)m[16 + xi];
- z8[0] ^= m8[0]; z8[1] ^= m8[1];
- z8[2] ^= m8[2]; z8[3] ^= m8[3];
- }
-
- xi = x[0];
-
- /* XOR in most significant nibble * H */
- m8 = (word32*)m[xi & 0xf];
- z8[0] ^= m8[0]; z8[1] ^= m8[1]; z8[2] ^= m8[2]; z8[3] ^= m8[3];
-
- /* Cache top byte for remainder calculations - lost in rotate. */
- a = (z8[3] >> 24) & 0xf;
-
- /* Rotate z by 4-bits */
- n7 = z8[3] & 0xf0f0f0f0ULL;
- n6 = z8[3] & 0x0f0f0f0fULL;
- n5 = z8[2] & 0xf0f0f0f0ULL;
- n4 = z8[2] & 0x0f0f0f0fULL;
- n3 = z8[1] & 0xf0f0f0f0ULL;
- n2 = z8[1] & 0x0f0f0f0fULL;
- n1 = z8[0] & 0xf0f0f0f0ULL;
- n0 = z8[0] & 0x0f0f0f0fULL;
- z8[3] = (n7 >> 4) | (n6 << 12) | (n4 >> 20);
- z8[2] = (n5 >> 4) | (n4 << 12) | (n2 >> 20);
- z8[1] = (n3 >> 4) | (n2 << 12) | (n0 >> 20);
- z8[0] = (n1 >> 4) | (n0 << 12);
-
- /* XOR in most significant nibble * remainder */
- z8[0] ^= (word32)R[a];
- /* XOR in next significant nibble * H */
- m8 = (word32*)m[xi >> 4];
- z8[0] ^= m8[0]; z8[1] ^= m8[1]; z8[2] ^= m8[2]; z8[3] ^= m8[3];
-
- /* Write back result. */
- x8[0] = z8[0]; x8[1] = z8[1]; x8[2] = z8[2]; x8[3] = z8[3];
-}
-#else
-static WC_INLINE void GMULT(byte *x, byte m[32][WC_AES_BLOCK_SIZE])
-{
- int i;
- word64 z8[2] = {0, 0};
- byte a;
- word64* x8 = (word64*)x;
- word64* m8;
- word64 n0, n1, n2, n3;
- byte xi;
-
- for (i = 15; i > 0; i--) {
- xi = x[i];
-
- /* XOR in (msn * H) */
- m8 = (word64*)m[xi & 0xf];
- z8[0] ^= m8[0];
- z8[1] ^= m8[1];
-
- /* Cache top byte for remainder calculations - lost in rotate. */
- a = (byte)(z8[1] >> 56);
-
- /* Rotate Z by 8-bits */
- z8[1] = (z8[0] >> 56) | (z8[1] << 8);
- z8[0] <<= 8;
-
- /* XOR in (next significant nibble * H) [pre-rotated by 4 bits] */
- m8 = (word64*)m[16 + (xi >> 4)];
- z8[0] ^= m8[0];
- z8[1] ^= m8[1];
-
- /* XOR in (msn * remainder) [pre-rotated by 4 bits] */
- z8[0] ^= (word64)R[16 + (a & 0xf)];
- /* XOR in next significant nibble (XORed with H) * remainder */
- m8 = (word64*)m[xi >> 4];
- a ^= (byte)(m8[1] >> 52);
- z8[0] ^= (word64)R[a >> 4];
- }
-
- xi = x[0];
-
- /* XOR in most significant nibble * H */
- m8 = (word64*)m[xi & 0xf];
- z8[0] ^= m8[0];
- z8[1] ^= m8[1];
-
- /* Cache top byte for remainder calculations - lost in rotate. */
- a = (z8[1] >> 56) & 0xf;
-
- /* Rotate z by 4-bits */
- n3 = z8[1] & W64LIT(0xf0f0f0f0f0f0f0f0);
- n2 = z8[1] & W64LIT(0x0f0f0f0f0f0f0f0f);
- n1 = z8[0] & W64LIT(0xf0f0f0f0f0f0f0f0);
- n0 = z8[0] & W64LIT(0x0f0f0f0f0f0f0f0f);
- z8[1] = (n3 >> 4) | (n2 << 12) | (n0 >> 52);
- z8[0] = (n1 >> 4) | (n0 << 12);
-
- /* XOR in next significant nibble * H */
- m8 = (word64*)m[xi >> 4];
- z8[0] ^= m8[0];
- z8[1] ^= m8[1];
- /* XOR in most significant nibble * remainder */
- z8[0] ^= (word64)R[a];
-
- /* Write back result. */
- x8[0] = z8[0];
- x8[1] = z8[1];
-}
-#endif
-#endif
-
-void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
- word32 cSz, byte* s, word32 sSz)
-{
- byte x[WC_AES_BLOCK_SIZE];
- byte scratch[WC_AES_BLOCK_SIZE];
- word32 blocks, partial;
-
- if (gcm == NULL) {
- return;
- }
-
- XMEMSET(x, 0, WC_AES_BLOCK_SIZE);
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- #ifdef GCM_GMULT_LEN
- if (blocks > 0) {
- GCM_GMULT_LEN(gcm, x, a, blocks * WC_AES_BLOCK_SIZE);
- a += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, a, partial);
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- #else
- while (blocks--) {
- xorbuf(x, a, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, a, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- }
- #endif
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- #ifdef GCM_GMULT_LEN
- if (blocks > 0) {
- GCM_GMULT_LEN(gcm, x, c, blocks * WC_AES_BLOCK_SIZE);
- c += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, c, partial);
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- #else
- while (blocks--) {
- xorbuf(x, c, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, c, partial);
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
- }
- #endif
- }
-
- /* Hash in the lengths of A and C in bits */
- FlattenSzInBits(&scratch[0], aSz);
- FlattenSzInBits(&scratch[8], cSz);
-#ifdef GCM_GMULT_LEN
- GCM_GMULT_LEN(gcm, x, scratch, WC_AES_BLOCK_SIZE);
-#else
- xorbuf(x, scratch, WC_AES_BLOCK_SIZE);
- GMULT(x, gcm->M0);
-#endif
-
- /* Copy the result into s. */
- XMEMCPY(s, x, sSz);
-}
-
-#ifdef WOLFSSL_AESGCM_STREAM
-/* No extra initialization for 4-bit table implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) WC_DO_NOTHING
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H using pre-computed table.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- xorbuf(AES_TAG(aes), block, WC_AES_BLOCK_SIZE); \
- GMULT(AES_TAG(aes), (aes)->gcm.M0); \
- } \
- while (0)
-#endif /* WOLFSSL_AESGCM_STREAM */
-#elif defined(WORD64_AVAILABLE) && !defined(GCM_WORD32)
-
-#if !defined(FREESCALE_LTC_AES_GCM)
-static void GMULT(word64* X, word64* Y)
-{
- word64 Z[2] = {0,0};
- word64 V[2];
- int i, j;
- word64 v1;
- V[0] = X[0]; V[1] = X[1];
-
- for (i = 0; i < 2; i++)
- {
- word64 y = Y[i];
- for (j = 0; j < 64; j++)
- {
-#ifndef AES_GCM_GMULT_NCT
- word64 mask = 0 - (y >> 63);
- Z[0] ^= V[0] & mask;
- Z[1] ^= V[1] & mask;
-#else
- if (y & 0x8000000000000000ULL) {
- Z[0] ^= V[0];
- Z[1] ^= V[1];
- }
-#endif
-
- v1 = (0 - (V[1] & 1)) & 0xE100000000000000ULL;
- V[1] >>= 1;
- V[1] |= V[0] << 63;
- V[0] >>= 1;
- V[0] ^= v1;
- y <<= 1;
- }
- }
- X[0] = Z[0];
- X[1] = Z[1];
-}
-
-
-void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
- word32 cSz, byte* s, word32 sSz)
-{
- word64 x[2] = {0,0};
- word32 blocks, partial;
- word64 bigH[2];
-
- if (gcm == NULL) {
- return;
- }
-
- XMEMCPY(bigH, gcm->H, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(bigH, bigH, WC_AES_BLOCK_SIZE);
- #endif
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- word64 bigA[2];
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- while (blocks--) {
- XMEMCPY(bigA, a, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(bigA, bigA, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigA[0];
- x[1] ^= bigA[1];
- GMULT(x, bigH);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(bigA, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(bigA, a, partial);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(bigA, bigA, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigA[0];
- x[1] ^= bigA[1];
- GMULT(x, bigH);
- }
-#ifdef OPENSSL_EXTRA
- /* store AAD partial tag for next call */
- gcm->aadH[0] = (word32)((x[0] & 0xFFFFFFFF00000000ULL) >> 32);
- gcm->aadH[1] = (word32)(x[0] & 0xFFFFFFFF);
- gcm->aadH[2] = (word32)((x[1] & 0xFFFFFFFF00000000ULL) >> 32);
- gcm->aadH[3] = (word32)(x[1] & 0xFFFFFFFF);
-#endif
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- word64 bigC[2];
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
-#ifdef OPENSSL_EXTRA
- /* Start from last AAD partial tag */
- if(gcm->aadLen) {
- x[0] = ((word64)gcm->aadH[0]) << 32 | gcm->aadH[1];
- x[1] = ((word64)gcm->aadH[2]) << 32 | gcm->aadH[3];
- }
-#endif
- while (blocks--) {
- XMEMCPY(bigC, c, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(bigC, bigC, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigC[0];
- x[1] ^= bigC[1];
- GMULT(x, bigH);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(bigC, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(bigC, c, partial);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(bigC, bigC, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigC[0];
- x[1] ^= bigC[1];
- GMULT(x, bigH);
- }
- }
-
- /* Hash in the lengths in bits of A and C */
- {
- word64 len[2];
- len[0] = aSz; len[1] = cSz;
-#ifdef OPENSSL_EXTRA
- if (gcm->aadLen)
- len[0] = (word64)gcm->aadLen;
-#endif
- /* Lengths are in bytes. Convert to bits. */
- len[0] *= 8;
- len[1] *= 8;
-
- x[0] ^= len[0];
- x[1] ^= len[1];
- GMULT(x, bigH);
- }
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords64(x, x, WC_AES_BLOCK_SIZE);
- #endif
- XMEMCPY(s, x, sSz);
-}
-#endif /* !FREESCALE_LTC_AES_GCM */
-
-#ifdef WOLFSSL_AESGCM_STREAM
-
-#ifdef LITTLE_ENDIAN_ORDER
-
-/* No extra initialization for small implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) \
- ByteReverseWords64((word64*)aes->gcm.H, (word64*)aes->gcm.H, WC_AES_BLOCK_SIZE)
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 block64[2]; \
- XMEMCPY(block64, block, WC_AES_BLOCK_SIZE); \
- ByteReverseWords64(block64, block64, WC_AES_BLOCK_SIZE); \
- x[0] ^= block64[0]; \
- x[1] ^= block64[1]; \
- GMULT(x, h); \
- } \
- while (0)
-
-#ifdef OPENSSL_EXTRA
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * Convert tag back to little-endian.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 len[2]; \
- len[0] = aes->aSz; len[1] = aes->cSz; \
- if (aes->gcm.aadLen) \
- len[0] = (word64)aes->gcm.aadLen; \
- /* Lengths are in bytes. Convert to bits. */ \
- len[0] *= 8; \
- len[1] *= 8; \
- \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- GMULT(x, h); \
- ByteReverseWords64(x, x, WC_AES_BLOCK_SIZE); \
- } \
- while (0)
-#else
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * Convert tag back to little-endian.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 len[2]; \
- len[0] = aes->aSz; len[1] = aes->cSz; \
- /* Lengths are in bytes. Convert to bits. */ \
- len[0] *= 8; \
- len[1] *= 8; \
- \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- GMULT(x, h); \
- ByteReverseWords64(x, x, WC_AES_BLOCK_SIZE); \
- } \
- while (0)
-#endif
-
-#else
-
-/* No extra initialization for small implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) WC_DO_NOTHING
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 block64[2]; \
- XMEMCPY(block64, block, WC_AES_BLOCK_SIZE); \
- x[0] ^= block64[0]; \
- x[1] ^= block64[1]; \
- GMULT(x, h); \
- } \
- while (0)
-
-#ifdef OPENSSL_EXTRA
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * Convert tag back to little-endian.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 len[2]; \
- len[0] = aes->aSz; len[1] = aes->cSz; \
- if (aes->gcm.aadLen) \
- len[0] = (word64)aes->gcm.aadLen; \
- /* Lengths are in bytes. Convert to bits. */ \
- len[0] *= 8; \
- len[1] *= 8; \
- \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- GMULT(x, h); \
- } \
- while (0)
-#else
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * Convert tag back to little-endian.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word64* x = (word64*)AES_TAG(aes); \
- word64* h = (word64*)aes->gcm.H; \
- word64 len[2]; \
- len[0] = aes->aSz; len[1] = aes->cSz; \
- /* Lengths are in bytes. Convert to bits. */ \
- len[0] *= 8; \
- len[1] *= 8; \
- \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- GMULT(x, h); \
- } \
- while (0)
-#endif
-
-#endif /* !LITTLE_ENDIAN_ORDER */
-
-#endif /* WOLFSSL_AESGCM_STREAM */
-/* end defined(WORD64_AVAILABLE) && !defined(GCM_WORD32) */
-#else /* GCM_WORD32 */
-
-static void GMULT(word32* X, word32* Y)
-{
- word32 Z[4] = {0,0,0,0};
- word32 V[4];
- int i, j;
-
- V[0] = X[0]; V[1] = X[1]; V[2] = X[2]; V[3] = X[3];
-
- for (i = 0; i < 4; i++)
- {
- word32 y = Y[i];
- for (j = 0; j < 32; j++)
- {
- if (y & 0x80000000) {
- Z[0] ^= V[0];
- Z[1] ^= V[1];
- Z[2] ^= V[2];
- Z[3] ^= V[3];
- }
-
- if (V[3] & 0x00000001) {
- V[3] >>= 1;
- V[3] |= ((V[2] & 0x00000001) ? 0x80000000 : 0);
- V[2] >>= 1;
- V[2] |= ((V[1] & 0x00000001) ? 0x80000000 : 0);
- V[1] >>= 1;
- V[1] |= ((V[0] & 0x00000001) ? 0x80000000 : 0);
- V[0] >>= 1;
- V[0] ^= 0xE1000000;
- } else {
- V[3] >>= 1;
- V[3] |= ((V[2] & 0x00000001) ? 0x80000000 : 0);
- V[2] >>= 1;
- V[2] |= ((V[1] & 0x00000001) ? 0x80000000 : 0);
- V[1] >>= 1;
- V[1] |= ((V[0] & 0x00000001) ? 0x80000000 : 0);
- V[0] >>= 1;
- }
- y <<= 1;
- }
- }
- X[0] = Z[0];
- X[1] = Z[1];
- X[2] = Z[2];
- X[3] = Z[3];
-}
-
-
-void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
- word32 cSz, byte* s, word32 sSz)
-{
- word32 x[4] = {0,0,0,0};
- word32 blocks, partial;
- word32 bigH[4];
-
- if (gcm == NULL) {
- return;
- }
-
- XMEMCPY(bigH, gcm->H, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(bigH, bigH, WC_AES_BLOCK_SIZE);
- #endif
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- word32 bigA[4];
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- while (blocks--) {
- XMEMCPY(bigA, a, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(bigA, bigA, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigA[0];
- x[1] ^= bigA[1];
- x[2] ^= bigA[2];
- x[3] ^= bigA[3];
- GMULT(x, bigH);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(bigA, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(bigA, a, partial);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(bigA, bigA, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigA[0];
- x[1] ^= bigA[1];
- x[2] ^= bigA[2];
- x[3] ^= bigA[3];
- GMULT(x, bigH);
- }
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- word32 bigC[4];
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- while (blocks--) {
- XMEMCPY(bigC, c, WC_AES_BLOCK_SIZE);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(bigC, bigC, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigC[0];
- x[1] ^= bigC[1];
- x[2] ^= bigC[2];
- x[3] ^= bigC[3];
- GMULT(x, bigH);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(bigC, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(bigC, c, partial);
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(bigC, bigC, WC_AES_BLOCK_SIZE);
- #endif
- x[0] ^= bigC[0];
- x[1] ^= bigC[1];
- x[2] ^= bigC[2];
- x[3] ^= bigC[3];
- GMULT(x, bigH);
- }
- }
-
- /* Hash in the lengths in bits of A and C */
- {
- word32 len[4];
-
- /* Lengths are in bytes. Convert to bits. */
- len[0] = (aSz >> (8*sizeof(aSz) - 3));
- len[1] = aSz << 3;
- len[2] = (cSz >> (8*sizeof(cSz) - 3));
- len[3] = cSz << 3;
-
- x[0] ^= len[0];
- x[1] ^= len[1];
- x[2] ^= len[2];
- x[3] ^= len[3];
- GMULT(x, bigH);
- }
- #ifdef LITTLE_ENDIAN_ORDER
- ByteReverseWords(x, x, WC_AES_BLOCK_SIZE);
- #endif
- XMEMCPY(s, x, sSz);
-}
-
-#ifdef WOLFSSL_AESGCM_STREAM
-#ifdef LITTLE_ENDIAN_ORDER
-/* Little-endian 32-bit word implementation requires byte reversal of H.
- *
- * H is all-zeros block encrypted with key.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) \
- ByteReverseWords((word32*)aes->gcm.H, (word32*)aes->gcm.H, WC_AES_BLOCK_SIZE)
-
-/* GHASH one block of data..
- *
- * XOR block, in big-endian form, into tag and GMULT with H.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- word32* x = (word32*)AES_TAG(aes); \
- word32* h = (word32*)aes->gcm.H; \
- word32 bigEnd[4]; \
- XMEMCPY(bigEnd, block, WC_AES_BLOCK_SIZE); \
- ByteReverseWords(bigEnd, bigEnd, WC_AES_BLOCK_SIZE); \
- x[0] ^= bigEnd[0]; \
- x[1] ^= bigEnd[1]; \
- x[2] ^= bigEnd[2]; \
- x[3] ^= bigEnd[3]; \
- GMULT(x, h); \
- } \
- while (0)
-
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * Convert tag back to little-endian.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word32 len[4]; \
- word32* x = (word32*)AES_TAG(aes); \
- word32* h = (word32*)aes->gcm.H; \
- len[0] = (aes->aSz >> (8*sizeof(aes->aSz) - 3)); \
- len[1] = aes->aSz << 3; \
- len[2] = (aes->cSz >> (8*sizeof(aes->cSz) - 3)); \
- len[3] = aes->cSz << 3; \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- x[2] ^= len[2]; \
- x[3] ^= len[3]; \
- GMULT(x, h); \
- ByteReverseWords(x, x, WC_AES_BLOCK_SIZE); \
- } \
- while (0)
-#else
-/* No extra initialization for 32-bit word implementation.
- *
- * @param [in] aes AES GCM object.
- */
-#define GHASH_INIT_EXTRA(aes) WC_DO_NOTHING
-
-/* GHASH one block of data..
- *
- * XOR block into tag and GMULT with H.
- *
- * @param [in, out] aes AES GCM object.
- * @param [in] block Block of AAD or cipher text.
- */
-#define GHASH_ONE_BLOCK_SW(aes, block) \
- do { \
- word32* x = (word32*)AES_TAG(aes); \
- word32* h = (word32*)aes->gcm.H; \
- word32 block32[4]; \
- XMEMCPY(block32, block, WC_AES_BLOCK_SIZE); \
- x[0] ^= block32[0]; \
- x[1] ^= block32[1]; \
- x[2] ^= block32[2]; \
- x[3] ^= block32[3]; \
- GMULT(x, h); \
- } \
- while (0)
-
-/* GHASH in AAD and cipher text lengths in bits.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- word32 len[4]; \
- word32* x = (word32*)AES_TAG(aes); \
- word32* h = (word32*)aes->gcm.H; \
- len[0] = (aes->aSz >> (8*sizeof(aes->aSz) - 3)); \
- len[1] = aes->aSz << 3; \
- len[2] = (aes->cSz >> (8*sizeof(aes->cSz) - 3)); \
- len[3] = aes->cSz << 3; \
- x[0] ^= len[0]; \
- x[1] ^= len[1]; \
- x[2] ^= len[2]; \
- x[3] ^= len[3]; \
- GMULT(x, h); \
- } \
- while (0)
-#endif /* LITTLE_ENDIAN_ORDER */
-#endif /* WOLFSSL_AESGCM_STREAM */
-#endif /* end GCM_WORD32 */
-#endif
-
-#if !defined(WOLFSSL_XILINX_CRYPT) && !defined(WOLFSSL_AFALG_XILINX_AES)
-#ifdef WOLFSSL_AESGCM_STREAM
-#ifndef GHASH_LEN_BLOCK
-/* Hash in the lengths of the AAD and cipher text in bits.
- *
- * Default implementation.
- *
- * @param [in, out] aes AES GCM object.
- */
-#define GHASH_LEN_BLOCK(aes) \
- do { \
- byte scratch[WC_AES_BLOCK_SIZE]; \
- FlattenSzInBits(&scratch[0], (aes)->aSz); \
- FlattenSzInBits(&scratch[8], (aes)->cSz); \
- GHASH_ONE_BLOCK(aes, scratch); \
- } \
- while (0)
-#endif
-
-/* Initialize a GHASH for streaming operations.
- *
- * @param [in, out] aes AES GCM object.
- */
-static void GHASH_INIT(Aes* aes) {
- /* Set tag to all zeros as initial value. */
- XMEMSET(AES_TAG(aes), 0, WC_AES_BLOCK_SIZE);
- /* Reset counts of AAD and cipher text. */
- aes->aOver = 0;
- aes->cOver = 0;
-#if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ; /* Don't do extra initialization. */
- }
- else
-#endif
- {
- /* Extra initialization based on implementation. */
- GHASH_INIT_EXTRA(aes);
- }
-}
-
-/* Update the GHASH with AAD and/or cipher text.
- *
- * @param [in,out] aes AES GCM object.
- * @param [in] a Additional authentication data buffer.
- * @param [in] aSz Size of data in AAD buffer.
- * @param [in] c Cipher text buffer.
- * @param [in] cSz Size of data in cipher text buffer.
- */
-static void GHASH_UPDATE(Aes* aes, const byte* a, word32 aSz, const byte* c,
- word32 cSz)
-{
- word32 blocks;
- word32 partial;
-
- /* Hash in A, the Additional Authentication Data */
- if (aSz != 0 && a != NULL) {
- /* Update count of AAD we have hashed. */
- aes->aSz += aSz;
- /* Check if we have unprocessed data. */
- if (aes->aOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->aOver);
- if (sz > aSz) {
- sz = (byte)aSz;
- }
- /* Copy extra into last GHASH block array and update count. */
- XMEMCPY(AES_LASTGBLOCK(aes) + aes->aOver, a, sz);
- aes->aOver = (byte)(aes->aOver + sz);
- if (aes->aOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- GHASH_ONE_BLOCK(aes, AES_LASTGBLOCK(aes));
- /* Reset count. */
- aes->aOver = 0;
- }
- /* Used up some data. */
- aSz -= sz;
- a += sz;
- }
-
- /* Calculate number of blocks of AAD and the leftover. */
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- /* GHASH full blocks now. */
- while (blocks--) {
- GHASH_ONE_BLOCK(aes, a);
- a += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Cache the partial block. */
- XMEMCPY(AES_LASTGBLOCK(aes), a, partial);
- aes->aOver = (byte)partial;
- }
- }
- if (aes->aOver > 0 && cSz > 0 && c != NULL) {
- /* No more AAD coming and we have a partial block. */
- /* Fill the rest of the block with zeros. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->aOver);
- XMEMSET(AES_LASTGBLOCK(aes) + aes->aOver, 0, sz);
- /* GHASH last AAD block. */
- GHASH_ONE_BLOCK(aes, AES_LASTGBLOCK(aes));
- /* Clear partial count for next time through. */
- aes->aOver = 0;
- }
-
- /* Hash in C, the Ciphertext */
- if (cSz != 0 && c != NULL) {
- /* Update count of cipher text we have hashed. */
- aes->cSz += cSz;
- if (aes->cOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->cOver);
- if (sz > cSz) {
- sz = (byte)cSz;
- }
- XMEMCPY(AES_LASTGBLOCK(aes) + aes->cOver, c, sz);
- /* Update count of unused encrypted counter. */
- aes->cOver = (byte)(aes->cOver + sz);
- if (aes->cOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- GHASH_ONE_BLOCK(aes, AES_LASTGBLOCK(aes));
- /* Reset count. */
- aes->cOver = 0;
- }
- /* Used up some data. */
- cSz -= sz;
- c += sz;
- }
-
- /* Calculate number of blocks of cipher text and the leftover. */
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- /* GHASH full blocks now. */
- while (blocks--) {
- GHASH_ONE_BLOCK(aes, c);
- c += WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Cache the partial block. */
- XMEMCPY(AES_LASTGBLOCK(aes), c, partial);
- aes->cOver = (byte)partial;
- }
- }
-}
-
-/* Finalize the GHASH calculation.
- *
- * Complete hashing cipher text and hash the AAD and cipher text lengths.
- *
- * @param [in, out] aes AES GCM object.
- * @param [out] s Authentication tag.
- * @param [in] sSz Size of authentication tag required.
- */
-static void GHASH_FINAL(Aes* aes, byte* s, word32 sSz)
-{
- /* AAD block incomplete when > 0 */
- byte over = aes->aOver;
-
- if (aes->cOver > 0) {
- /* Cipher text block incomplete. */
- over = aes->cOver;
- }
- if (over > 0) {
- /* Zeroize the unused part of the block. */
- XMEMSET(AES_LASTGBLOCK(aes) + over, 0,
- (size_t)WC_AES_BLOCK_SIZE - over);
- /* Hash the last block of cipher text. */
- GHASH_ONE_BLOCK(aes, AES_LASTGBLOCK(aes));
- }
- /* Hash in the lengths of AAD and cipher text in bits */
- GHASH_LEN_BLOCK(aes);
- /* Copy the result into s. */
- XMEMCPY(s, AES_TAG(aes), sSz);
- /* reset aes->gcm.H in case of reuse */
- GHASH_INIT_EXTRA(aes);
-}
-#endif /* WOLFSSL_AESGCM_STREAM */
-
-
-#ifdef FREESCALE_LTC_AES_GCM
-int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- status_t status;
- word32 keySize;
-
- /* argument checks */
- if (aes == NULL || authTagSz > WC_AES_BLOCK_SIZE || ivSz == 0) {
- return BAD_FUNC_ARG;
- }
-
- if (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) {
- WOLFSSL_MSG("GcmEncrypt authTagSz too small error");
- return BAD_FUNC_ARG;
- }
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status)
- return status;
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
-
- status = LTC_AES_EncryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
- authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
- wolfSSL_CryptHwMutexUnLock();
-
- return (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
-}
-
-#else
-
-#ifdef STM32_CRYPTO_AES_GCM
-
-/* this function supports inline encrypt */
-static WARN_UNUSED_RESULT int wc_AesGcmEncrypt_STM32(
- Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-#ifdef WOLFSSL_STM32_CUBEMX
- CRYP_HandleTypeDef hcryp;
-#else
- word32 keyCopy[AES_256_KEY_SIZE/sizeof(word32)];
-#endif
- word32 keySize;
-#ifdef WOLFSSL_STM32_CUBEMX
- int status = HAL_OK;
- word32 blocks = sz / WC_AES_BLOCK_SIZE;
- word32 partialBlock[WC_AES_BLOCK_SIZE/sizeof(word32)];
-#else
- int status = SUCCESS;
-#endif
- word32 partial = sz % WC_AES_BLOCK_SIZE;
- word32 tag[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 ctrInit[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 ctr[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 authhdr[WC_AES_BLOCK_SIZE/sizeof(word32)];
- byte* authInPadded = NULL;
- int authPadSz, wasAlloc = 0, useSwGhash = 0;
-
- ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0)
- return ret;
-
-#ifdef WOLFSSL_STM32_CUBEMX
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-#endif
-
- XMEMSET(ctr, 0, WC_AES_BLOCK_SIZE);
- if (ivSz == GCM_NONCE_MID_SZ) {
- byte* pCtr = (byte*)ctr;
- XMEMCPY(ctr, iv, ivSz);
- pCtr[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, (byte*)ctr, WC_AES_BLOCK_SIZE);
- }
- XMEMCPY(ctrInit, ctr, sizeof(ctr)); /* save off initial counter for GMAC */
-
- /* Authentication buffer */
-#if STM_CRYPT_HEADER_WIDTH == 1
- authPadSz = 0; /* CubeHAL supports byte mode */
-#else
- authPadSz = authInSz % STM_CRYPT_HEADER_WIDTH;
-#endif
-#ifdef WOLFSSL_STM32MP13
- /* STM32MP13 HAL at least v1.2 and lower has a bug with which it needs a
- * minimum of 16 bytes for the auth */
- if ((authInSz > 0) && (authInSz < 16)) {
- authPadSz = 16 - authInSz;
- }
-#endif
- if (authPadSz != 0) {
- if (authPadSz < authInSz + STM_CRYPT_HEADER_WIDTH) {
- authPadSz = authInSz + STM_CRYPT_HEADER_WIDTH - authPadSz;
- }
- if (authPadSz <= sizeof(authhdr)) {
- authInPadded = (byte*)authhdr;
- }
- else {
- authInPadded = (byte*)XMALLOC(authPadSz, aes->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (authInPadded == NULL) {
- wolfSSL_CryptHwMutexUnLock();
- return MEMORY_E;
- }
- wasAlloc = 1;
- }
- XMEMSET(authInPadded, 0, authPadSz);
- XMEMCPY(authInPadded, authIn, authInSz);
- } else {
- authPadSz = authInSz;
- authInPadded = (byte*)authIn;
- }
-
- /* for cases where hardware cannot be used for authTag calculate it */
- /* if IV is not 12 calculate GHASH using software */
- if (ivSz != GCM_NONCE_MID_SZ
- #if !defined(CRYP_HEADERWIDTHUNIT_BYTE)
- /* or hardware that does not support partial block */
- || sz == 0 || partial != 0
- #endif
- #if STM_CRYPT_HEADER_WIDTH == 4
- /* or authIn is not a multiple of 4 */
- || authPadSz != authInSz
- #endif
- ) {
- useSwGhash = 1;
- }
-
- /* Hardware requires counter + 1 */
- IncrementGcmCounter((byte*)ctr);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
-#ifdef WOLFSSL_STM32_CUBEMX
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)ctr;
- hcryp.Init.Header = (STM_CRYPT_TYPE*)authInPadded;
-
-#if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_GCM;
- hcryp.Init.HeaderSize = authPadSz / STM_CRYPT_HEADER_WIDTH;
- #ifdef CRYP_KEYIVCONFIG_ONCE
- /* allows repeated calls to HAL_CRYP_Encrypt */
- hcryp.Init.KeyIVConfigSkip = CRYP_KEYIVCONFIG_ONCE;
- #endif
- ByteReverseWords(ctr, ctr, WC_AES_BLOCK_SIZE);
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)ctr;
- HAL_CRYP_Init(&hcryp);
-
- #ifndef CRYP_KEYIVCONFIG_ONCE
- /* GCM payload phase - can handle partial blocks */
- status = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in,
- (blocks * WC_AES_BLOCK_SIZE) + partial, (uint32_t*)out, STM32_HAL_TIMEOUT);
- #else
- /* GCM payload phase - blocks */
- if (blocks) {
- status = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in,
- (blocks * WC_AES_BLOCK_SIZE), (uint32_t*)out, STM32_HAL_TIMEOUT);
- }
- /* GCM payload phase - partial remainder */
- if (status == HAL_OK && (partial != 0 || blocks == 0)) {
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)partialBlock, partial,
- (uint32_t*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- #endif
- if (status == HAL_OK && !useSwGhash) {
- /* Compute the authTag */
- status = HAL_CRYPEx_AESGCM_GenerateAuthTAG(&hcryp, (uint32_t*)tag,
- STM32_HAL_TIMEOUT);
- }
-#elif defined(STM32_CRYPTO_AES_ONLY)
- /* Set the CRYP parameters */
- hcryp.Init.HeaderSize = authPadSz;
- if (authPadSz == 0)
- hcryp.Init.Header = NULL; /* cannot pass pointer when authIn == 0 */
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_GCM_GMAC;
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
- hcryp.Init.GCMCMACPhase = CRYP_INIT_PHASE;
- HAL_CRYP_Init(&hcryp);
-
- /* GCM init phase */
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
- if (status == HAL_OK) {
- /* GCM header phase */
- hcryp.Init.GCMCMACPhase = CRYP_HEADER_PHASE;
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
- }
- if (status == HAL_OK) {
- /* GCM payload phase - blocks */
- hcryp.Init.GCMCMACPhase = CRYP_PAYLOAD_PHASE;
- if (blocks) {
- status = HAL_CRYPEx_AES_Auth(&hcryp, (byte*)in,
- (blocks * WC_AES_BLOCK_SIZE), out, STM32_HAL_TIMEOUT);
- }
- }
- if (status == HAL_OK && (partial != 0 || (sz > 0 && blocks == 0))) {
- /* GCM payload phase - partial remainder */
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYPEx_AES_Auth(&hcryp, (uint8_t*)partialBlock, partial,
- (uint8_t*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- if (status == HAL_OK && !useSwGhash) {
- /* GCM final phase */
- hcryp.Init.GCMCMACPhase = CRYP_FINAL_PHASE;
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, sz, (uint8_t*)tag, STM32_HAL_TIMEOUT);
- }
-#else
- hcryp.Init.HeaderSize = authPadSz;
- HAL_CRYP_Init(&hcryp);
- if (blocks) {
- /* GCM payload phase - blocks */
- status = HAL_CRYPEx_AESGCM_Encrypt(&hcryp, (byte*)in,
- (blocks * WC_AES_BLOCK_SIZE), out, STM32_HAL_TIMEOUT);
- }
- if (status == HAL_OK && (partial != 0 || blocks == 0)) {
- /* GCM payload phase - partial remainder */
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYPEx_AESGCM_Encrypt(&hcryp, (uint8_t*)partialBlock, partial,
- (uint8_t*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- if (status == HAL_OK && !useSwGhash) {
- /* Compute the authTag */
- status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, (uint8_t*)tag, STM32_HAL_TIMEOUT);
- }
-#endif
-
- if (status != HAL_OK)
- ret = AES_GCM_AUTH_E;
- HAL_CRYP_DeInit(&hcryp);
-
-#else /* Standard Peripheral Library */
- ByteReverseWords(keyCopy, (word32*)aes->key, keySize);
- status = CRYP_AES_GCM(MODE_ENCRYPT, (uint8_t*)ctr,
- (uint8_t*)keyCopy, keySize * 8,
- (uint8_t*)in, sz,
- (uint8_t*)authInPadded, authInSz,
- (uint8_t*)out, (uint8_t*)tag);
- if (status != SUCCESS)
- ret = AES_GCM_AUTH_E;
-#endif /* WOLFSSL_STM32_CUBEMX */
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- if (ret == 0) {
- /* return authTag */
- if (authTag) {
- if (useSwGhash) {
- GHASH(&aes->gcm, authIn, authInSz, out, sz, authTag, authTagSz);
- ret = wc_AesEncrypt(aes, (byte*)ctrInit, (byte*)tag);
- if (ret == 0) {
- xorbuf(authTag, tag, authTagSz);
- }
- }
- else {
- /* use hardware calculated tag */
- XMEMCPY(authTag, tag, authTagSz);
- }
- }
- }
-
- /* Free memory */
- if (wasAlloc) {
- XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- }
-
- return ret;
-}
-
-#endif /* STM32_CRYPTO_AES_GCM */
-
-#if !defined(WOLFSSL_ARMASM) || defined(__aarch64__)
-#ifdef WOLFSSL_AESNI
-/* For performance reasons, this code needs to be not inlined. */
-WARN_UNUSED_RESULT int AES_GCM_encrypt_C(
- Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz);
-#else
-static
-#endif
-WARN_UNUSED_RESULT int AES_GCM_encrypt_C(
- Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
- word32 blocks = sz / WC_AES_BLOCK_SIZE;
- word32 partial = sz % WC_AES_BLOCK_SIZE;
- const byte* p = in;
- byte* c = out;
- ALIGN16 byte counter[WC_AES_BLOCK_SIZE];
- ALIGN16 byte initialCounter[WC_AES_BLOCK_SIZE];
- ALIGN16 byte scratch[WC_AES_BLOCK_SIZE];
-
- if (ivSz == GCM_NONCE_MID_SZ) {
- /* Counter is IV with bottom 4 bytes set to: 0x00,0x00,0x00,0x01. */
- XMEMCPY(counter, iv, ivSz);
- XMEMSET(counter + GCM_NONCE_MID_SZ, 0,
- WC_AES_BLOCK_SIZE - GCM_NONCE_MID_SZ - 1);
- counter[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- /* Counter is GHASH of IV. */
-#ifdef OPENSSL_EXTRA
- word32 aadTemp = aes->gcm.aadLen;
- aes->gcm.aadLen = 0;
-#endif
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, counter, WC_AES_BLOCK_SIZE);
-#ifdef OPENSSL_EXTRA
- aes->gcm.aadLen = aadTemp;
-#endif
- }
- XMEMCPY(initialCounter, counter, WC_AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_PIC32MZ_CRYPT
- if (blocks) {
- /* use initial IV for HW, but don't use it below */
- XMEMCPY(aes->reg, counter, WC_AES_BLOCK_SIZE);
-
- ret = wc_Pic32AesCrypt(
- aes->key, aes->keylen, aes->reg, WC_AES_BLOCK_SIZE,
- out, in, (blocks * WC_AES_BLOCK_SIZE),
- PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
- if (ret != 0)
- return ret;
- }
- /* process remainder using partial handling */
-#endif
-
-#if defined(HAVE_AES_ECB) && !defined(WOLFSSL_PIC32MZ_CRYPT)
- /* some hardware acceleration can gain performance from doing AES encryption
- * of the whole buffer at once */
- if (c != p && blocks > 0) { /* can not handle inline encryption */
- while (blocks--) {
- IncrementGcmCounter(counter);
- XMEMCPY(c, counter, WC_AES_BLOCK_SIZE);
- c += WC_AES_BLOCK_SIZE;
- }
-
- /* reset number of blocks and then do encryption */
- blocks = sz / WC_AES_BLOCK_SIZE;
- wc_AesEcbEncrypt(aes, out, out, WC_AES_BLOCK_SIZE * blocks);
- xorbuf(out, p, WC_AES_BLOCK_SIZE * blocks);
- p += WC_AES_BLOCK_SIZE * blocks;
- }
- else
-#endif /* HAVE_AES_ECB && !WOLFSSL_PIC32MZ_CRYPT */
- {
- while (blocks--) {
- IncrementGcmCounter(counter);
- #if !defined(WOLFSSL_PIC32MZ_CRYPT)
- ret = wc_AesEncrypt(aes, counter, scratch);
- if (ret != 0)
- return ret;
- xorbufout(c, scratch, p, WC_AES_BLOCK_SIZE);
- #endif
- p += WC_AES_BLOCK_SIZE;
- c += WC_AES_BLOCK_SIZE;
- }
- }
-
- if (partial != 0) {
- IncrementGcmCounter(counter);
- ret = wc_AesEncrypt(aes, counter, scratch);
- if (ret != 0)
- return ret;
- xorbufout(c, scratch, p, partial);
- }
- if (authTag) {
- GHASH(&aes->gcm, authIn, authInSz, out, sz, authTag, authTagSz);
- ret = wc_AesEncrypt(aes, initialCounter, scratch);
- if (ret != 0)
- return ret;
- xorbuf(authTag, scratch, authTagSz);
-#ifdef OPENSSL_EXTRA
- if (!in && !sz)
- /* store AAD size for next call */
- aes->gcm.aadLen = authInSz;
-#endif
- }
-
- return ret;
-}
-#elif defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-static int AES_GCM_encrypt_AARCH32(Aes* aes, byte* out, const byte* in,
- word32 sz, const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- word32 blocks;
- word32 partial;
- byte counter[WC_AES_BLOCK_SIZE];
- byte initialCounter[WC_AES_BLOCK_SIZE];
- byte x[WC_AES_BLOCK_SIZE];
- byte scratch[WC_AES_BLOCK_SIZE];
-
- XMEMSET(initialCounter, 0, WC_AES_BLOCK_SIZE);
- if (ivSz == GCM_NONCE_MID_SZ) {
- XMEMCPY(initialCounter, iv, ivSz);
- initialCounter[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, initialCounter, WC_AES_BLOCK_SIZE);
- }
- XMEMCPY(counter, initialCounter, WC_AES_BLOCK_SIZE);
-
- /* Hash in the Additional Authentication Data */
- XMEMSET(x, 0, WC_AES_BLOCK_SIZE);
- if (authInSz != 0 && authIn != NULL) {
- blocks = authInSz / WC_AES_BLOCK_SIZE;
- partial = authInSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- GCM_GMULT_LEN(&aes->gcm, x, authIn, blocks * WC_AES_BLOCK_SIZE);
- authIn += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, authIn, partial);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- }
-
- /* do as many blocks as possible */
- blocks = sz / WC_AES_BLOCK_SIZE;
- partial = sz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- AES_GCM_encrypt(in, out, blocks * WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds, counter);
- GCM_GMULT_LEN(&aes->gcm, x, out, blocks * WC_AES_BLOCK_SIZE);
- in += blocks * WC_AES_BLOCK_SIZE;
- out += blocks * WC_AES_BLOCK_SIZE;
- }
- /* take care of partial block sizes leftover */
- if (partial != 0) {
- AES_GCM_encrypt(in, scratch, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds, counter);
- XMEMCPY(out, scratch, partial);
-
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, out, partial);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
-
- /* Hash in the lengths of A and C in bits */
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- FlattenSzInBits(&scratch[0], authInSz);
- FlattenSzInBits(&scratch[8], sz);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
- if (authTagSz > WC_AES_BLOCK_SIZE) {
- XMEMCPY(authTag, x, WC_AES_BLOCK_SIZE);
- }
- else {
- /* authTagSz can be smaller than WC_AES_BLOCK_SIZE */
- XMEMCPY(authTag, x, authTagSz);
- }
-
- /* Auth tag calculation. */
- AES_ECB_encrypt(initialCounter, scratch, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds);
- xorbuf(authTag, scratch, authTagSz);
-
- return 0;
-}
-#endif
-
-/* Software AES - GCM Encrypt */
-int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-
- /* argument checks */
- if (aes == NULL || authTagSz > WC_AES_BLOCK_SIZE || ivSz == 0 ||
- ((authTagSz > 0) && (authTag == NULL)) ||
- ((authInSz > 0) && (authIn == NULL)))
- {
- return BAD_FUNC_ARG;
- }
-
- if (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) {
- WOLFSSL_MSG("GcmEncrypt authTagSz too small error");
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret =
- wc_CryptoCb_AesGcmEncrypt(aes, out, in, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
-#endif
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- /* if async and byte count above threshold */
- /* only 12-byte IV is supported in HW */
- if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
- sz >= WC_ASYNC_THRESH_AES_GCM && ivSz == GCM_NONCE_MID_SZ) {
- #if defined(HAVE_CAVIUM)
- #ifdef HAVE_CAVIUM_V
- if (authInSz == 20) { /* Nitrox V GCM is only working with 20 byte AAD */
- return NitroxAesGcmEncrypt(aes, out, in, sz,
- (const byte*)aes->devKey, aes->keylen, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
- }
- #endif
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymAesGcmEncrypt(&aes->asyncDev, out, in, sz,
- (const byte*)aes->devKey, aes->keylen, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&aes->asyncDev, ASYNC_SW_AES_GCM_ENCRYPT)) {
- WC_ASYNC_SW* sw = &aes->asyncDev.sw;
- sw->aes.aes = aes;
- sw->aes.out = out;
- sw->aes.in = in;
- sw->aes.sz = sz;
- sw->aes.iv = iv;
- sw->aes.ivSz = ivSz;
- sw->aes.authTag = authTag;
- sw->aes.authTagSz = authTagSz;
- sw->aes.authIn = authIn;
- sw->aes.authInSz = authInSz;
- return WC_PENDING_E;
- }
- #endif
- }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
-#ifdef WOLFSSL_SILABS_SE_ACCEL
- return wc_AesGcmEncrypt_silabs(
- aes, out, in, sz,
- iv, ivSz,
- authTag, authTagSz,
- authIn, authInSz);
-#endif
-
-#ifdef STM32_CRYPTO_AES_GCM
- return wc_AesGcmEncrypt_STM32(
- aes, out, in, sz, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-#endif /* STM32_CRYPTO_AES_GCM */
-
- VECTOR_REGISTERS_PUSH;
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_GCM_encrypt_AARCH32(in, out, sz, iv, ivSz, authTag, authTagSz, authIn,
- authInSz, (byte*)aes->key, aes->gcm.H, (byte*)aes->tmp, (byte*)aes->reg,
- aes->rounds);
- ret = 0;
-#else
- ret = AES_GCM_encrypt_AARCH32(aes, out, in, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz);
-#endif
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
-#ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_encrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (const byte*)aes->key, (int)aes->rounds);
- ret = 0;
- }
- else
-#endif
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_encrypt_avx1(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (const byte*)aes->key, (int)aes->rounds);
- ret = 0;
- } else
-#endif
- {
- AES_GCM_encrypt_aesni(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (const byte*)aes->key, (int)aes->rounds);
- ret = 0;
- }
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_encrypt_AARCH64_EOR3(in, out, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz, (byte*)aes->key, aes->gcm.H,
- (byte*)aes->tmp, (byte*)aes->reg, aes->rounds);
- }
- else
- #endif
- {
- AES_GCM_encrypt_AARCH64(in, out, sz, iv, ivSz, authTag, authTagSz,
- authIn, authInSz, (byte*)aes->key, aes->gcm.H, (byte*)aes->tmp,
- (byte*)aes->reg, aes->rounds);
- }
- ret = 0;
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AES_GCM_encrypt_C(aes, out, in, sz, iv, ivSz, authTag, authTagSz,
- authIn, authInSz);
- }
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-#endif
-
-
-/* AES GCM Decrypt */
-#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT)
-#ifdef FREESCALE_LTC_AES_GCM
-int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
- word32 keySize;
- status_t status;
-
- /* argument checks */
- /* If the sz is non-zero, both in and out must be set. If sz is 0,
- * in and out are don't cares, as this is is the GMAC case. */
- if (aes == NULL || iv == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
- authTag == NULL || authTagSz > WC_AES_BLOCK_SIZE || authTagSz == 0 ||
- ivSz == 0 || ((authInSz > 0) && (authIn == NULL)))
- {
- return BAD_FUNC_ARG;
- }
-
- ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0) {
- return ret;
- }
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
-
- status = LTC_AES_DecryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
- authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
- wolfSSL_CryptHwMutexUnLock();
-
- return (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
-}
-
-#else
-
-#ifdef STM32_CRYPTO_AES_GCM
-/* this function supports inline decrypt */
-static WARN_UNUSED_RESULT int wc_AesGcmDecrypt_STM32(
- Aes* aes, byte* out,
- const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-#ifdef WOLFSSL_STM32_CUBEMX
- int status = HAL_OK;
- CRYP_HandleTypeDef hcryp;
- word32 blocks = sz / WC_AES_BLOCK_SIZE;
-#else
- int status = SUCCESS;
- word32 keyCopy[AES_256_KEY_SIZE/sizeof(word32)];
-#endif
- word32 keySize;
- word32 partial = sz % WC_AES_BLOCK_SIZE;
- word32 tag[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 tagExpected[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 partialBlock[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 ctr[WC_AES_BLOCK_SIZE/sizeof(word32)];
- word32 authhdr[WC_AES_BLOCK_SIZE/sizeof(word32)];
- byte* authInPadded = NULL;
- int authPadSz, wasAlloc = 0, tagComputed = 0;
-
- ret = wc_AesGetKeySize(aes, &keySize);
- if (ret != 0)
- return ret;
-
-#ifdef WOLFSSL_STM32_CUBEMX
- ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);
- if (ret != 0)
- return ret;
-#endif
-
- XMEMSET(ctr, 0, WC_AES_BLOCK_SIZE);
- if (ivSz == GCM_NONCE_MID_SZ) {
- byte* pCtr = (byte*)ctr;
- XMEMCPY(ctr, iv, ivSz);
- pCtr[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, (byte*)ctr, WC_AES_BLOCK_SIZE);
- }
-
- /* Make copy of expected authTag, which could get corrupted in some
- * Cube HAL versions without proper partial block support.
- * For TLS blocks the authTag is after the output buffer, so save it */
- XMEMCPY(tagExpected, authTag, authTagSz);
-
- /* Authentication buffer */
-#if STM_CRYPT_HEADER_WIDTH == 1
- authPadSz = 0; /* CubeHAL supports byte mode */
-#else
- authPadSz = authInSz % STM_CRYPT_HEADER_WIDTH;
-#endif
-#ifdef WOLFSSL_STM32MP13
- /* STM32MP13 HAL at least v1.2 and lower has a bug with which it needs a
- * minimum of 16 bytes for the auth */
- if ((authInSz > 0) && (authInSz < 16)) {
- authPadSz = 16 - authInSz;
- }
-#else
- if (authPadSz != 0) {
- authPadSz = authInSz + STM_CRYPT_HEADER_WIDTH - authPadSz;
- }
- else {
- authPadSz = authInSz;
- }
-#endif
-
- /* for cases where hardware cannot be used for authTag calculate it */
- /* if IV is not 12 calculate GHASH using software */
- if (ivSz != GCM_NONCE_MID_SZ
- #if !defined(CRYP_HEADERWIDTHUNIT_BYTE)
- /* or hardware that does not support partial block */
- || sz == 0 || partial != 0
- #endif
- #if STM_CRYPT_HEADER_WIDTH == 4
- /* or authIn is not a multiple of 4 */
- || authPadSz != authInSz
- #endif
- ) {
- GHASH(&aes->gcm, authIn, authInSz, in, sz, (byte*)tag, sizeof(tag));
- ret = wc_AesEncrypt(aes, (byte*)ctr, (byte*)partialBlock);
- if (ret != 0)
- return ret;
- xorbuf(tag, partialBlock, sizeof(tag));
- tagComputed = 1;
- }
-
- /* if using hardware for authentication tag make sure its aligned and zero padded */
- if (authPadSz != authInSz && !tagComputed) {
- if (authPadSz <= sizeof(authhdr)) {
- authInPadded = (byte*)authhdr;
- }
- else {
- authInPadded = (byte*)XMALLOC(authPadSz, aes->heap,
- DYNAMIC_TYPE_TMP_BUFFER);
- if (authInPadded == NULL) {
- wolfSSL_CryptHwMutexUnLock();
- return MEMORY_E;
- }
- wasAlloc = 1;
- }
- XMEMSET(authInPadded, 0, authPadSz);
- XMEMCPY(authInPadded, authIn, authInSz);
- } else {
- authInPadded = (byte*)authIn;
- }
-
- /* Hardware requires counter + 1 */
- IncrementGcmCounter((byte*)ctr);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
-#ifdef WOLFSSL_STM32_CUBEMX
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)ctr;
- hcryp.Init.Header = (STM_CRYPT_TYPE*)authInPadded;
-
-#if defined(STM32_HAL_V2)
- hcryp.Init.Algorithm = CRYP_AES_GCM;
- hcryp.Init.HeaderSize = authPadSz / STM_CRYPT_HEADER_WIDTH;
- #ifdef CRYP_KEYIVCONFIG_ONCE
- /* allows repeated calls to HAL_CRYP_Decrypt */
- hcryp.Init.KeyIVConfigSkip = CRYP_KEYIVCONFIG_ONCE;
- #endif
- ByteReverseWords(ctr, ctr, WC_AES_BLOCK_SIZE);
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)ctr;
- HAL_CRYP_Init(&hcryp);
-
- #ifndef CRYP_KEYIVCONFIG_ONCE
- /* GCM payload phase - can handle partial blocks */
- status = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in,
- (blocks * WC_AES_BLOCK_SIZE) + partial, (uint32_t*)out, STM32_HAL_TIMEOUT);
- #else
- /* GCM payload phase - blocks */
- if (blocks) {
- status = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in,
- (blocks * WC_AES_BLOCK_SIZE), (uint32_t*)out, STM32_HAL_TIMEOUT);
- }
- /* GCM payload phase - partial remainder */
- if (status == HAL_OK && (partial != 0 || blocks == 0)) {
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)partialBlock, partial,
- (uint32_t*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- #endif
- if (status == HAL_OK && !tagComputed) {
- /* Compute the authTag */
- status = HAL_CRYPEx_AESGCM_GenerateAuthTAG(&hcryp, (uint32_t*)tag,
- STM32_HAL_TIMEOUT);
- }
-#elif defined(STM32_CRYPTO_AES_ONLY)
- /* Set the CRYP parameters */
- hcryp.Init.HeaderSize = authPadSz;
- if (authPadSz == 0)
- hcryp.Init.Header = NULL; /* cannot pass pointer when authIn == 0 */
- hcryp.Init.ChainingMode = CRYP_CHAINMODE_AES_GCM_GMAC;
- hcryp.Init.OperatingMode = CRYP_ALGOMODE_DECRYPT;
- hcryp.Init.GCMCMACPhase = CRYP_INIT_PHASE;
- HAL_CRYP_Init(&hcryp);
-
- /* GCM init phase */
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
- if (status == HAL_OK) {
- /* GCM header phase */
- hcryp.Init.GCMCMACPhase = CRYP_HEADER_PHASE;
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
- }
- if (status == HAL_OK) {
- /* GCM payload phase - blocks */
- hcryp.Init.GCMCMACPhase = CRYP_PAYLOAD_PHASE;
- if (blocks) {
- status = HAL_CRYPEx_AES_Auth(&hcryp, (byte*)in,
- (blocks * WC_AES_BLOCK_SIZE), out, STM32_HAL_TIMEOUT);
- }
- }
- if (status == HAL_OK && (partial != 0 || (sz > 0 && blocks == 0))) {
- /* GCM payload phase - partial remainder */
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYPEx_AES_Auth(&hcryp, (byte*)partialBlock, partial,
- (byte*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- if (status == HAL_OK && tagComputed == 0) {
- /* GCM final phase */
- hcryp.Init.GCMCMACPhase = CRYP_FINAL_PHASE;
- status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, sz, (byte*)tag, STM32_HAL_TIMEOUT);
- }
-#else
- hcryp.Init.HeaderSize = authPadSz;
- HAL_CRYP_Init(&hcryp);
- if (blocks) {
- /* GCM payload phase - blocks */
- status = HAL_CRYPEx_AESGCM_Decrypt(&hcryp, (byte*)in,
- (blocks * WC_AES_BLOCK_SIZE), out, STM32_HAL_TIMEOUT);
- }
- if (status == HAL_OK && (partial != 0 || blocks == 0)) {
- /* GCM payload phase - partial remainder */
- XMEMSET(partialBlock, 0, sizeof(partialBlock));
- XMEMCPY(partialBlock, in + (blocks * WC_AES_BLOCK_SIZE), partial);
- status = HAL_CRYPEx_AESGCM_Decrypt(&hcryp, (byte*)partialBlock, partial,
- (byte*)partialBlock, STM32_HAL_TIMEOUT);
- XMEMCPY(out + (blocks * WC_AES_BLOCK_SIZE), partialBlock, partial);
- }
- if (status == HAL_OK && tagComputed == 0) {
- /* Compute the authTag */
- status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, (byte*)tag, STM32_HAL_TIMEOUT);
- }
-#endif
-
- if (status != HAL_OK)
- ret = AES_GCM_AUTH_E;
-
- HAL_CRYP_DeInit(&hcryp);
-
-#else /* Standard Peripheral Library */
- ByteReverseWords(keyCopy, (word32*)aes->key, aes->keylen);
-
- /* Input size and auth size need to be the actual sizes, even though
- * they are not block aligned, because this length (in bits) is used
- * in the final GHASH. */
- XMEMSET(partialBlock, 0, sizeof(partialBlock)); /* use this to get tag */
- status = CRYP_AES_GCM(MODE_DECRYPT, (uint8_t*)ctr,
- (uint8_t*)keyCopy, keySize * 8,
- (uint8_t*)in, sz,
- (uint8_t*)authInPadded, authInSz,
- (uint8_t*)out, (uint8_t*)partialBlock);
- if (status != SUCCESS)
- ret = AES_GCM_AUTH_E;
- if (tagComputed == 0)
- XMEMCPY(tag, partialBlock, authTagSz);
-#endif /* WOLFSSL_STM32_CUBEMX */
- wolfSSL_CryptHwMutexUnLock();
- wc_Stm32_Aes_Cleanup();
-
- /* Check authentication tag */
- if (ConstantCompare((const byte*)tagExpected, (byte*)tag, authTagSz) != 0) {
- ret = AES_GCM_AUTH_E;
- }
-
- /* Free memory */
- if (wasAlloc) {
- XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
- }
-
- return ret;
-}
-
-#endif /* STM32_CRYPTO_AES_GCM */
-
-#if !defined(WOLFSSL_ARMASM) || defined(__aarch64__)
-#ifdef WOLFSSL_AESNI
-/* For performance reasons, this code needs to be not inlined. */
-int WARN_UNUSED_RESULT AES_GCM_decrypt_C(
- Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz);
-#else
-static
-#endif
-int WARN_UNUSED_RESULT AES_GCM_decrypt_C(
- Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
- word32 blocks = sz / WC_AES_BLOCK_SIZE;
- word32 partial = sz % WC_AES_BLOCK_SIZE;
- const byte* c = in;
- byte* p = out;
- ALIGN16 byte counter[WC_AES_BLOCK_SIZE];
- ALIGN16 byte scratch[WC_AES_BLOCK_SIZE];
- ALIGN16 byte Tprime[WC_AES_BLOCK_SIZE];
- ALIGN16 byte EKY0[WC_AES_BLOCK_SIZE];
- volatile sword32 res;
-
- if (ivSz == GCM_NONCE_MID_SZ) {
- /* Counter is IV with bottom 4 bytes set to: 0x00,0x00,0x00,0x01. */
- XMEMCPY(counter, iv, ivSz);
- XMEMSET(counter + GCM_NONCE_MID_SZ, 0,
- WC_AES_BLOCK_SIZE - GCM_NONCE_MID_SZ - 1);
- counter[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- /* Counter is GHASH of IV. */
-#ifdef OPENSSL_EXTRA
- word32 aadTemp = aes->gcm.aadLen;
- aes->gcm.aadLen = 0;
-#endif
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, counter, WC_AES_BLOCK_SIZE);
-#ifdef OPENSSL_EXTRA
- aes->gcm.aadLen = aadTemp;
-#endif
- }
-
- /* Calc the authTag again using received auth data and the cipher text */
- GHASH(&aes->gcm, authIn, authInSz, in, sz, Tprime, sizeof(Tprime));
- ret = wc_AesEncrypt(aes, counter, EKY0);
- if (ret != 0)
- return ret;
- xorbuf(Tprime, EKY0, sizeof(Tprime));
-#ifdef WC_AES_GCM_DEC_AUTH_EARLY
- /* ConstantCompare returns the cumulative bitwise or of the bitwise xor of
- * the pairwise bytes in the strings.
- */
- res = ConstantCompare(authTag, Tprime, authTagSz);
- /* convert positive retval from ConstantCompare() to all-1s word, in
- * constant time.
- */
- res = 0 - (sword32)(((word32)(0 - res)) >> 31U);
- ret = res & AES_GCM_AUTH_E;
- if (ret != 0)
- return ret;
-#endif
-
-#ifdef OPENSSL_EXTRA
- if (!out) {
- /* authenticated, non-confidential data */
- /* store AAD size for next call */
- aes->gcm.aadLen = authInSz;
- }
-#endif
-
-#if defined(WOLFSSL_PIC32MZ_CRYPT)
- if (blocks) {
- /* use initial IV for HW, but don't use it below */
- XMEMCPY(aes->reg, counter, WC_AES_BLOCK_SIZE);
-
- ret = wc_Pic32AesCrypt(
- aes->key, aes->keylen, aes->reg, WC_AES_BLOCK_SIZE,
- out, in, (blocks * WC_AES_BLOCK_SIZE),
- PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
- if (ret != 0)
- return ret;
- }
- /* process remainder using partial handling */
-#endif
-
-#if defined(HAVE_AES_ECB) && !defined(WOLFSSL_PIC32MZ_CRYPT)
- /* some hardware acceleration can gain performance from doing AES encryption
- * of the whole buffer at once */
- if (c != p && blocks > 0) { /* can not handle inline decryption */
- while (blocks--) {
- IncrementGcmCounter(counter);
- XMEMCPY(p, counter, WC_AES_BLOCK_SIZE);
- p += WC_AES_BLOCK_SIZE;
- }
-
- /* reset number of blocks and then do encryption */
- blocks = sz / WC_AES_BLOCK_SIZE;
-
- wc_AesEcbEncrypt(aes, out, out, WC_AES_BLOCK_SIZE * blocks);
- xorbuf(out, c, WC_AES_BLOCK_SIZE * blocks);
- c += WC_AES_BLOCK_SIZE * blocks;
- }
- else
-#endif /* HAVE_AES_ECB && !PIC32MZ */
- {
- while (blocks--) {
- IncrementGcmCounter(counter);
- #if !defined(WOLFSSL_PIC32MZ_CRYPT)
- ret = wc_AesEncrypt(aes, counter, scratch);
- if (ret != 0)
- return ret;
- xorbufout(p, scratch, c, WC_AES_BLOCK_SIZE);
- #endif
- p += WC_AES_BLOCK_SIZE;
- c += WC_AES_BLOCK_SIZE;
- }
- }
-
- if (partial != 0) {
- IncrementGcmCounter(counter);
- ret = wc_AesEncrypt(aes, counter, scratch);
- if (ret != 0)
- return ret;
- xorbuf(scratch, c, partial);
- XMEMCPY(p, scratch, partial);
- }
-
-#ifndef WC_AES_GCM_DEC_AUTH_EARLY
- /* ConstantCompare returns the cumulative bitwise or of the bitwise xor of
- * the pairwise bytes in the strings.
- */
- res = ConstantCompare(authTag, Tprime, (int)authTagSz);
- /* convert positive retval from ConstantCompare() to all-1s word, in
- * constant time.
- */
- res = 0 - (sword32)(((word32)(0 - res)) >> 31U);
- /* now use res as a mask for constant time return of ret, unless tag
- * mismatch, whereupon AES_GCM_AUTH_E is returned.
- */
- ret = (ret & ~res) | (res & WC_NO_ERR_TRACE(AES_GCM_AUTH_E));
-#endif
- return ret;
-}
-#elif defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-static int AES_GCM_decrypt_AARCH32(Aes* aes, byte* out, const byte* in,
- word32 sz, const byte* iv, word32 ivSz, const byte* authTag,
- word32 authTagSz, const byte* authIn, word32 authInSz)
-{
- word32 blocks;
- word32 partial;
- byte counter[WC_AES_BLOCK_SIZE];
- byte initialCounter[WC_AES_BLOCK_SIZE];
- byte scratch[WC_AES_BLOCK_SIZE];
- byte x[WC_AES_BLOCK_SIZE];
-
- XMEMSET(initialCounter, 0, WC_AES_BLOCK_SIZE);
- if (ivSz == GCM_NONCE_MID_SZ) {
- XMEMCPY(initialCounter, iv, ivSz);
- initialCounter[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, initialCounter, WC_AES_BLOCK_SIZE);
- }
- XMEMCPY(counter, initialCounter, WC_AES_BLOCK_SIZE);
-
- XMEMSET(x, 0, WC_AES_BLOCK_SIZE);
- /* Hash in the Additional Authentication Data */
- if (authInSz != 0 && authIn != NULL) {
- blocks = authInSz / WC_AES_BLOCK_SIZE;
- partial = authInSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- GCM_GMULT_LEN(&aes->gcm, x, authIn, blocks * WC_AES_BLOCK_SIZE);
- authIn += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, authIn, partial);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
- }
- }
-
- blocks = sz / WC_AES_BLOCK_SIZE;
- partial = sz % WC_AES_BLOCK_SIZE;
- /* do as many blocks as possible */
- if (blocks > 0) {
- GCM_GMULT_LEN(&aes->gcm, x, in, blocks * WC_AES_BLOCK_SIZE);
-
- AES_GCM_encrypt(in, out, blocks * WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds, counter);
- in += blocks * WC_AES_BLOCK_SIZE;
- out += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- XMEMCPY(scratch, in, partial);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
-
- AES_GCM_encrypt(in, scratch, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds, counter);
- XMEMCPY(out, scratch, partial);
- }
-
- XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
- FlattenSzInBits(&scratch[0], authInSz);
- FlattenSzInBits(&scratch[8], sz);
- GCM_GMULT_LEN(&aes->gcm, x, scratch, WC_AES_BLOCK_SIZE);
- AES_ECB_encrypt(initialCounter, scratch, WC_AES_BLOCK_SIZE,
- (const unsigned char*)aes->key, aes->rounds);
- xorbuf(x, scratch, authTagSz);
- if (authTag != NULL) {
- if (ConstantCompare(authTag, x, authTagSz) != 0) {
- return AES_GCM_AUTH_E;
- }
- }
-
- return 0;
-}
-#endif
-
-/* Software AES - GCM Decrypt */
-int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* iv, word32 ivSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-#ifdef WOLFSSL_AESNI
- int res = WC_NO_ERR_TRACE(AES_GCM_AUTH_E);
-#endif
-
- /* argument checks */
- /* If the sz is non-zero, both in and out must be set. If sz is 0,
- * in and out are don't cares, as this is is the GMAC case. */
- if (aes == NULL || iv == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
- authTag == NULL || authTagSz > WC_AES_BLOCK_SIZE || authTagSz == 0 ||
- ivSz == 0) {
-
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret =
- wc_CryptoCb_AesGcmDecrypt(aes, out, in, sz, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
-#endif
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- /* if async and byte count above threshold */
- /* only 12-byte IV is supported in HW */
- if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
- sz >= WC_ASYNC_THRESH_AES_GCM && ivSz == GCM_NONCE_MID_SZ) {
- #if defined(HAVE_CAVIUM)
- #ifdef HAVE_CAVIUM_V
- if (authInSz == 20) { /* Nitrox V GCM is only working with 20 byte AAD */
- return NitroxAesGcmDecrypt(aes, out, in, sz,
- (const byte*)aes->devKey, aes->keylen, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
- }
- #endif
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymAesGcmDecrypt(&aes->asyncDev, out, in, sz,
- (const byte*)aes->devKey, aes->keylen, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&aes->asyncDev, ASYNC_SW_AES_GCM_DECRYPT)) {
- WC_ASYNC_SW* sw = &aes->asyncDev.sw;
- sw->aes.aes = aes;
- sw->aes.out = out;
- sw->aes.in = in;
- sw->aes.sz = sz;
- sw->aes.iv = iv;
- sw->aes.ivSz = ivSz;
- sw->aes.authTag = (byte*)authTag;
- sw->aes.authTagSz = authTagSz;
- sw->aes.authIn = authIn;
- sw->aes.authInSz = authInSz;
- return WC_PENDING_E;
- }
- #endif
- }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
-#ifdef WOLFSSL_SILABS_SE_ACCEL
- return wc_AesGcmDecrypt_silabs(
- aes, out, in, sz, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-
-#endif
-
-#ifdef STM32_CRYPTO_AES_GCM
- /* The STM standard peripheral library API's doesn't support partial blocks */
- return wc_AesGcmDecrypt_STM32(
- aes, out, in, sz, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-#endif /* STM32_CRYPTO_AES_GCM */
-
- VECTOR_REGISTERS_PUSH;
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- ret = AES_GCM_decrypt_AARCH32(in, out, sz, iv, ivSz, authTag, authTagSz,
- authIn, authInSz, (byte*)aes->key, aes->gcm.H, (byte*)aes->tmp,
- (byte*)aes->reg, aes->rounds);
-#else
- ret = AES_GCM_decrypt_AARCH32(aes, out, in, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz);
-#endif
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
-#ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_decrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (byte*)aes->key, (int)aes->rounds, &res);
- if (res == 0)
- ret = AES_GCM_AUTH_E;
- else
- ret = 0;
- }
- else
-#endif
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_decrypt_avx1(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (byte*)aes->key, (int)aes->rounds, &res);
- if (res == 0)
- ret = AES_GCM_AUTH_E;
- else
- ret = 0;
- }
- else
-#endif
- {
- AES_GCM_decrypt_aesni(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
- authTagSz, (byte*)aes->key, (int)aes->rounds, &res);
- if (res == 0)
- ret = AES_GCM_AUTH_E;
- else
- ret = 0;
- }
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- ret = AES_GCM_decrypt_AARCH64_EOR3(in, out, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz, (byte*)aes->key, aes->gcm.H,
- (byte*)aes->tmp, (byte*)aes->reg, aes->rounds);
- }
- else
- #endif
- {
- ret = AES_GCM_decrypt_AARCH64(in, out, sz, iv, ivSz, authTag,
- authTagSz, authIn, authInSz, (byte*)aes->key, aes->gcm.H,
- (byte*)aes->tmp, (byte*)aes->reg, aes->rounds);
- }
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AES_GCM_decrypt_C(aes, out, in, sz, iv, ivSz, authTag, authTagSz,
- authIn, authInSz);
- }
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-#endif
-#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
-
-#ifdef WOLFSSL_AESGCM_STREAM
-
-/* Initialize the AES GCM cipher with an IV. C implementation.
- *
- * @param [in, out] aes AES object.
- * @param [in] iv IV/nonce buffer.
- * @param [in] ivSz Length of IV/nonce data.
- */
-static WARN_UNUSED_RESULT int AesGcmInit_C(Aes* aes, const byte* iv, word32 ivSz)
-{
- ALIGN32 byte counter[WC_AES_BLOCK_SIZE];
- int ret;
-
- if (ivSz == GCM_NONCE_MID_SZ) {
- /* Counter is IV with bottom 4 bytes set to: 0x00,0x00,0x00,0x01. */
- XMEMCPY(counter, iv, ivSz);
- XMEMSET(counter + GCM_NONCE_MID_SZ, 0,
- WC_AES_BLOCK_SIZE - GCM_NONCE_MID_SZ - 1);
- counter[WC_AES_BLOCK_SIZE - 1] = 1;
- }
- else {
- /* Counter is GHASH of IV. */
- #ifdef OPENSSL_EXTRA
- word32 aadTemp = aes->gcm.aadLen;
- aes->gcm.aadLen = 0;
- #endif
- GHASH(&aes->gcm, NULL, 0, iv, ivSz, counter, WC_AES_BLOCK_SIZE);
- #ifdef OPENSSL_EXTRA
- aes->gcm.aadLen = aadTemp;
- #endif
- }
-
- /* Copy in the counter for use with cipher. */
- XMEMCPY(AES_COUNTER(aes), counter, WC_AES_BLOCK_SIZE);
- /* Encrypt initial counter into a buffer for GCM. */
- ret = wc_AesEncrypt(aes, counter, AES_INITCTR(aes));
- if (ret != 0)
- return ret;
- /* Reset state fields. */
- aes->over = 0;
- aes->aSz = 0;
- aes->cSz = 0;
- /* Initialization for GHASH. */
- GHASH_INIT(aes);
-
- return 0;
-}
-
-/* Update the AES GCM cipher with data. C implementation.
- *
- * Only enciphers data.
- *
- * @param [in, out] aes AES object.
- * @param [in] out Cipher text or plaintext buffer.
- * @param [in] in Plaintext or cipher text buffer.
- * @param [in] sz Length of data.
- */
-static WARN_UNUSED_RESULT int AesGcmCryptUpdate_C(
- Aes* aes, byte* out, const byte* in, word32 sz)
-{
- word32 blocks;
- word32 partial;
- int ret;
-
- /* Check if previous encrypted block was not used up. */
- if (aes->over > 0) {
- byte pSz = (byte)(WC_AES_BLOCK_SIZE - aes->over);
- if (pSz > sz) pSz = (byte)sz;
-
- /* Use some/all of last encrypted block. */
- xorbufout(out, AES_LASTBLOCK(aes) + aes->over, in, pSz);
- aes->over = (aes->over + pSz) & (WC_AES_BLOCK_SIZE - 1);
-
- /* Some data used. */
- sz -= pSz;
- in += pSz;
- out += pSz;
- }
-
- /* Calculate the number of blocks needing to be encrypted and any leftover.
- */
- blocks = sz / WC_AES_BLOCK_SIZE;
- partial = sz & (WC_AES_BLOCK_SIZE - 1);
-
-#if defined(HAVE_AES_ECB)
- /* Some hardware acceleration can gain performance from doing AES encryption
- * of the whole buffer at once.
- * Overwrites the cipher text before using plaintext - no inline encryption.
- */
- if ((out != in) && blocks > 0) {
- word32 b;
- /* Place incrementing counter blocks into cipher text. */
- for (b = 0; b < blocks; b++) {
- IncrementGcmCounter(AES_COUNTER(aes));
- XMEMCPY(out + b * WC_AES_BLOCK_SIZE, AES_COUNTER(aes), WC_AES_BLOCK_SIZE);
- }
-
- /* Encrypt counter blocks. */
- wc_AesEcbEncrypt(aes, out, out, WC_AES_BLOCK_SIZE * blocks);
- /* XOR in plaintext. */
- xorbuf(out, in, WC_AES_BLOCK_SIZE * blocks);
- /* Skip over processed data. */
- in += WC_AES_BLOCK_SIZE * blocks;
- out += WC_AES_BLOCK_SIZE * blocks;
- }
- else
-#endif /* HAVE_AES_ECB */
- {
- /* Encrypt block by block. */
- while (blocks--) {
- ALIGN32 byte scratch[WC_AES_BLOCK_SIZE];
- IncrementGcmCounter(AES_COUNTER(aes));
- /* Encrypt counter into a buffer. */
- ret = wc_AesEncrypt(aes, AES_COUNTER(aes), scratch);
- if (ret != 0)
- return ret;
- /* XOR plain text into encrypted counter into cipher text buffer. */
- xorbufout(out, scratch, in, WC_AES_BLOCK_SIZE);
- /* Data complete. */
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
- }
-
- if (partial != 0) {
- /* Generate an extra block and use up as much as needed. */
- IncrementGcmCounter(AES_COUNTER(aes));
- /* Encrypt counter into cache. */
- ret = wc_AesEncrypt(aes, AES_COUNTER(aes), AES_LASTBLOCK(aes));
- if (ret != 0)
- return ret;
- /* XOR plain text into encrypted counter into cipher text buffer. */
- xorbufout(out, AES_LASTBLOCK(aes), in, partial);
- /* Keep amount of encrypted block used. */
- aes->over = (byte)partial;
- }
-
- return 0;
-}
-
-/* Calculates authentication tag for AES GCM. C implementation.
- *
- * @param [in, out] aes AES object.
- * @param [out] authTag Buffer to store authentication tag in.
- * @param [in] authTagSz Length of tag to create.
- */
-static WARN_UNUSED_RESULT int AesGcmFinal_C(
- Aes* aes, byte* authTag, word32 authTagSz)
-{
- /* Calculate authentication tag. */
- GHASH_FINAL(aes, authTag, authTagSz);
- /* XOR in as much of encrypted counter as is required. */
- xorbuf(authTag, AES_INITCTR(aes), authTagSz);
-#ifdef OPENSSL_EXTRA
- /* store AAD size for next call */
- aes->gcm.aadLen = aes->aSz;
-#endif
- /* Zeroize last block to protect sensitive data. */
- ForceZero(AES_LASTBLOCK(aes), WC_AES_BLOCK_SIZE);
-
- return 0;
-}
-
-#ifdef WOLFSSL_AESNI
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* Assembly code implementations in: aes_gcm_asm.S */
-#ifdef HAVE_INTEL_AVX2
-extern void AES_GCM_init_avx2(const unsigned char* key, int nr,
- const unsigned char* ivec, unsigned int ibytes, unsigned char* h,
- unsigned char* counter, unsigned char* initCtr);
-extern void AES_GCM_aad_update_avx2(const unsigned char* addt,
- unsigned int abytes, unsigned char* tag, unsigned char* h);
-extern void AES_GCM_encrypt_block_avx2(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned char* counter);
-extern void AES_GCM_ghash_block_avx2(const unsigned char* data,
- unsigned char* tag, unsigned char* h);
-
-extern void AES_GCM_encrypt_update_avx2(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_encrypt_final_avx2(unsigned char* tag,
- unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr);
-#endif
-#ifdef HAVE_INTEL_AVX1
-extern void AES_GCM_init_avx1(const unsigned char* key, int nr,
- const unsigned char* ivec, unsigned int ibytes, unsigned char* h,
- unsigned char* counter, unsigned char* initCtr);
-extern void AES_GCM_aad_update_avx1(const unsigned char* addt,
- unsigned int abytes, unsigned char* tag, unsigned char* h);
-extern void AES_GCM_encrypt_block_avx1(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned char* counter);
-extern void AES_GCM_ghash_block_avx1(const unsigned char* data,
- unsigned char* tag, unsigned char* h);
-
-extern void AES_GCM_encrypt_update_avx1(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_encrypt_final_avx1(unsigned char* tag,
- unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr);
-#endif
-extern void AES_GCM_init_aesni(const unsigned char* key, int nr,
- const unsigned char* ivec, unsigned int ibytes, unsigned char* h,
- unsigned char* counter, unsigned char* initCtr);
-extern void AES_GCM_aad_update_aesni(const unsigned char* addt,
- unsigned int abytes, unsigned char* tag, unsigned char* h);
-extern void AES_GCM_encrypt_block_aesni(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned char* counter);
-extern void AES_GCM_ghash_block_aesni(const unsigned char* data,
- unsigned char* tag, unsigned char* h);
-
-extern void AES_GCM_encrypt_update_aesni(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_encrypt_final_aesni(unsigned char* tag,
- unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-/* Initialize the AES GCM cipher with an IV. AES-NI implementations.
- *
- * @param [in, out] aes AES object.
- * @param [in] iv IV/nonce buffer.
- * @param [in] ivSz Length of IV/nonce data.
- */
-static WARN_UNUSED_RESULT int AesGcmInit_aesni(
- Aes* aes, const byte* iv, word32 ivSz)
-{
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- /* Reset state fields. */
- aes->over = 0;
- aes->aSz = 0;
- aes->cSz = 0;
- /* Set tag to all zeros as initial value. */
- XMEMSET(AES_TAG(aes), 0, WC_AES_BLOCK_SIZE);
- /* Reset counts of AAD and cipher text. */
- aes->aOver = 0;
- aes->cOver = 0;
-
-#ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_init_avx2((byte*)aes->key, (int)aes->rounds, iv, ivSz,
- aes->gcm.H, AES_COUNTER(aes), AES_INITCTR(aes));
- }
- else
-#endif
-#ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_init_avx1((byte*)aes->key, (int)aes->rounds, iv, ivSz,
- aes->gcm.H, AES_COUNTER(aes), AES_INITCTR(aes));
- }
- else
-#endif
- {
- AES_GCM_init_aesni((byte*)aes->key, (int)aes->rounds, iv, ivSz,
- aes->gcm.H, AES_COUNTER(aes), AES_INITCTR(aes));
- }
-
- return 0;
-}
-
-/* Update the AES GCM for encryption with authentication data.
- *
- * Implementation uses AVX2, AVX1 or straight AES-NI optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- * @param [in] endA Whether no more authentication data is expected.
- */
-static WARN_UNUSED_RESULT int AesGcmAadUpdate_aesni(
- Aes* aes, const byte* a, word32 aSz, int endA)
-{
- word32 blocks;
- int partial;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (aSz != 0 && a != NULL) {
- /* Total count of AAD updated. */
- aes->aSz += aSz;
- /* Check if we have unprocessed data. */
- if (aes->aOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->aOver);
- if (sz > aSz) {
- sz = (byte)aSz;
- }
- /* Copy extra into last GHASH block array and update count. */
- XMEMCPY(AES_LASTGBLOCK(aes) + aes->aOver, a, sz);
- aes->aOver = (byte)(aes->aOver + sz);
- if (aes->aOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- /* Reset count. */
- aes->aOver = 0;
- }
- /* Used up some data. */
- aSz -= sz;
- a += sz;
- }
-
- /* Calculate number of blocks of AAD and the leftover. */
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* GHASH full blocks now. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_aad_update_avx2(a, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_aad_update_avx1(a, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_aad_update_aesni(a, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H);
- }
- /* Skip over to end of AAD blocks. */
- a += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Cache the partial block. */
- XMEMCPY(AES_LASTGBLOCK(aes), a, (size_t)partial);
- aes->aOver = (byte)partial;
- }
- }
- if (endA && (aes->aOver > 0)) {
- /* No more AAD coming and we have a partial block. */
- /* Fill the rest of the block with zeros. */
- XMEMSET(AES_LASTGBLOCK(aes) + aes->aOver, 0,
- (size_t)WC_AES_BLOCK_SIZE - aes->aOver);
- /* GHASH last AAD block. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- /* Clear partial count for next time through. */
- aes->aOver = 0;
- }
-
- return 0;
-}
-
-/* Update the AES GCM for encryption with data and/or authentication data.
- *
- * Implementation uses AVX2, AVX1 or straight AES-NI optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [out] c Buffer to hold cipher text.
- * @param [in] p Buffer holding plaintext.
- * @param [in] cSz Length of cipher text/plaintext in bytes.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- */
-static WARN_UNUSED_RESULT int AesGcmEncryptUpdate_aesni(
- Aes* aes, byte* c, const byte* p, word32 cSz, const byte* a, word32 aSz)
-{
- word32 blocks;
- int partial;
- int ret;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- /* Hash in A, the Authentication Data */
- ret = AesGcmAadUpdate_aesni(aes, a, aSz, (cSz > 0) && (c != NULL));
- if (ret != 0)
- return ret;
-
- /* Encrypt plaintext and Hash in C, the Cipher text */
- if (cSz != 0 && c != NULL) {
- /* Update count of cipher text we have hashed. */
- aes->cSz += cSz;
- if (aes->cOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->cOver);
- if (sz > cSz) {
- sz = (byte)cSz;
- }
- /* Encrypt some of the plaintext. */
- xorbuf(AES_LASTGBLOCK(aes) + aes->cOver, p, sz);
- XMEMCPY(c, AES_LASTGBLOCK(aes) + aes->cOver, sz);
- /* Update count of unused encrypted counter. */
- aes->cOver = (byte)(aes->cOver + sz);
- if (aes->cOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- /* Reset count. */
- aes->cOver = 0;
- }
- /* Used up some data. */
- cSz -= sz;
- p += sz;
- c += sz;
- }
-
- /* Calculate number of blocks of plaintext and the leftover. */
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* Encrypt and GHASH full blocks now. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_encrypt_update_avx2((byte*)aes->key, (int)aes->rounds,
- c, p, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_encrypt_update_avx1((byte*)aes->key, (int)aes->rounds,
- c, p, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_update_aesni((byte*)aes->key, (int)aes->rounds,
- c, p, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- /* Skip over to end of blocks. */
- p += blocks * WC_AES_BLOCK_SIZE;
- c += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Encrypt the counter - XOR in zeros as proxy for plaintext. */
- XMEMSET(AES_LASTGBLOCK(aes), 0, WC_AES_BLOCK_SIZE);
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_encrypt_block_avx2((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_encrypt_block_avx1((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_block_aesni((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- /* XOR the remaining plaintext to calculate cipher text.
- * Keep cipher text for GHASH of last partial block.
- */
- xorbuf(AES_LASTGBLOCK(aes), p, (word32)partial);
- XMEMCPY(c, AES_LASTGBLOCK(aes), (size_t)partial);
- /* Update count of the block used. */
- aes->cOver = (byte)partial;
- }
- }
- return 0;
-}
-
-/* Finalize the AES GCM for encryption and calculate the authentication tag.
- *
- * Calls AVX2, AVX1 or straight AES-NI optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] authTag Buffer to hold authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- */
-static WARN_UNUSED_RESULT int AesGcmEncryptFinal_aesni(
- Aes* aes, byte* authTag, word32 authTagSz)
-{
- /* AAD block incomplete when > 0 */
- byte over = aes->aOver;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (aes->cOver > 0) {
- /* Cipher text block incomplete. */
- over = aes->cOver;
- }
- if (over > 0) {
- /* Fill the rest of the block with zeros. */
- XMEMSET(AES_LASTGBLOCK(aes) + over, 0, (size_t)WC_AES_BLOCK_SIZE - over);
- /* GHASH last cipher block. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- }
- /* Calculate the authentication tag. */
-#ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_encrypt_final_avx2(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes));
- }
- else
-#endif
-#ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_encrypt_final_avx1(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes));
- }
- else
-#endif
- {
- AES_GCM_encrypt_final_aesni(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes));
- }
-
- return 0;
-}
-
-#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT)
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-/* Assembly code implementations in: aes_gcm_asm.S and aes_gcm_x86_asm.S */
-#ifdef HAVE_INTEL_AVX2
-extern void AES_GCM_decrypt_update_avx2(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_decrypt_final_avx2(unsigned char* tag,
- const unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr, int* res);
-#endif
-#ifdef HAVE_INTEL_AVX1
-extern void AES_GCM_decrypt_update_avx1(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_decrypt_final_avx1(unsigned char* tag,
- const unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr, int* res);
-#endif
-extern void AES_GCM_decrypt_update_aesni(const unsigned char* key, int nr,
- unsigned char* out, const unsigned char* in, unsigned int nbytes,
- unsigned char* tag, unsigned char* h, unsigned char* counter);
-extern void AES_GCM_decrypt_final_aesni(unsigned char* tag,
- const unsigned char* authTag, unsigned int tbytes, unsigned int nbytes,
- unsigned int abytes, unsigned char* h, unsigned char* initCtr, int* res);
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-/* Update the AES GCM for decryption with data and/or authentication data.
- *
- * @param [in, out] aes AES object.
- * @param [out] p Buffer to hold plaintext.
- * @param [in] c Buffer holding cipher text.
- * @param [in] cSz Length of cipher text/plaintext in bytes.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- */
-static WARN_UNUSED_RESULT int AesGcmDecryptUpdate_aesni(
- Aes* aes, byte* p, const byte* c, word32 cSz, const byte* a, word32 aSz)
-{
- word32 blocks;
- int partial;
- int ret;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- /* Hash in A, the Authentication Data */
- ret = AesGcmAadUpdate_aesni(aes, a, aSz, cSz > 0);
- if (ret != 0)
- return ret;
-
- /* Hash in C, the Cipher text, and decrypt. */
- if (cSz != 0 && p != NULL) {
- /* Update count of cipher text we have hashed. */
- aes->cSz += cSz;
- if (aes->cOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->cOver);
- if (sz > cSz) {
- sz = (byte)cSz;
- }
- /* Keep a copy of the cipher text for GHASH. */
- XMEMCPY(AES_LASTBLOCK(aes) + aes->cOver, c, sz);
- /* Decrypt some of the cipher text. */
- xorbuf(AES_LASTGBLOCK(aes) + aes->cOver, c, sz);
- XMEMCPY(p, AES_LASTGBLOCK(aes) + aes->cOver, sz);
- /* Update count of unused encrypted counter. */
- aes->cOver = (byte)(aes->cOver + sz);
- if (aes->cOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(AES_LASTBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(AES_LASTBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(AES_LASTBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- /* Reset count. */
- aes->cOver = 0;
- }
- /* Used up some data. */
- cSz -= sz;
- c += sz;
- p += sz;
- }
-
- /* Calculate number of blocks of plaintext and the leftover. */
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* Decrypt and GHASH full blocks now. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_decrypt_update_avx2((byte*)aes->key, (int)aes->rounds,
- p, c, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_decrypt_update_avx1((byte*)aes->key, (int)aes->rounds,
- p, c, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_decrypt_update_aesni((byte*)aes->key, (int)aes->rounds,
- p, c, blocks * WC_AES_BLOCK_SIZE, AES_TAG(aes), aes->gcm.H,
- AES_COUNTER(aes));
- }
- /* Skip over to end of blocks. */
- c += blocks * WC_AES_BLOCK_SIZE;
- p += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Encrypt the counter - XOR in zeros as proxy for cipher text. */
- XMEMSET(AES_LASTGBLOCK(aes), 0, WC_AES_BLOCK_SIZE);
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_encrypt_block_avx2((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_encrypt_block_avx1((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_block_aesni((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- /* Keep cipher text for GHASH of last partial block. */
- XMEMCPY(AES_LASTBLOCK(aes), c, (size_t)partial);
- /* XOR the remaining cipher text to calculate plaintext. */
- xorbuf(AES_LASTGBLOCK(aes), c, (word32)partial);
- XMEMCPY(p, AES_LASTGBLOCK(aes), (size_t)partial);
- /* Update count of the block used. */
- aes->cOver = (byte)partial;
- }
- }
-
- return 0;
-}
-
-/* Finalize the AES GCM for decryption and check the authentication tag.
- *
- * Calls AVX2, AVX1 or straight AES-NI optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] authTag Buffer holding authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- * @return AES_GCM_AUTH_E when authentication tag doesn't match calculated
- * value.
- */
-static WARN_UNUSED_RESULT int AesGcmDecryptFinal_aesni(
- Aes* aes, const byte* authTag, word32 authTagSz)
-{
- int ret = 0;
- int res;
- /* AAD block incomplete when > 0 */
- byte over = aes->aOver;
- byte *lastBlock = AES_LASTGBLOCK(aes);
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (aes->cOver > 0) {
- /* Cipher text block incomplete. */
- over = aes->cOver;
- lastBlock = AES_LASTBLOCK(aes);
- }
- if (over > 0) {
- /* Zeroize the unused part of the block. */
- XMEMSET(lastBlock + over, 0, (size_t)WC_AES_BLOCK_SIZE - over);
- /* Hash the last block of cipher text. */
- #ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_ghash_block_avx2(lastBlock, AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- #ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_ghash_block_avx1(lastBlock, AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_aesni(lastBlock, AES_TAG(aes), aes->gcm.H);
- }
- }
- /* Calculate and compare the authentication tag. */
-#ifdef HAVE_INTEL_AVX2
- if (IS_INTEL_AVX2(intel_flags)) {
- AES_GCM_decrypt_final_avx2(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes), &res);
- }
- else
-#endif
-#ifdef HAVE_INTEL_AVX1
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_GCM_decrypt_final_avx1(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes), &res);
- }
- else
-#endif
- {
- AES_GCM_decrypt_final_aesni(AES_TAG(aes), authTag, authTagSz, aes->cSz,
- aes->aSz, aes->gcm.H, AES_INITCTR(aes), &res);
- }
-
- /* Return error code when calculated doesn't match input. */
- if (res == 0) {
- ret = AES_GCM_AUTH_E;
- }
- return ret;
-}
-#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
-#endif /* WOLFSSL_AESNI */
-
-#if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-/* Initialize the AES GCM cipher with an IV. Aarch64 HW Crypto implementations.
- *
- * @param [in, out] aes AES object.
- * @param [in] iv IV/nonce buffer.
- * @param [in] ivSz Length of IV/nonce data.
- */
-static WARN_UNUSED_RESULT int AesGcmInit_AARCH64(Aes* aes, const byte* iv,
- word32 ivSz)
-{
- /* Reset state fields. */
- aes->over = 0;
- aes->aSz = 0;
- aes->cSz = 0;
- /* Set tag to all zeros as initial value. */
- XMEMSET(AES_TAG(aes), 0, WC_AES_BLOCK_SIZE);
- /* Reset counts of AAD and cipher text. */
- aes->aOver = 0;
- aes->cOver = 0;
-
-#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_init_AARCH64_EOR3((byte*)aes->key, (int)aes->rounds, iv, ivSz,
- aes->gcm.H, AES_COUNTER(aes), AES_INITCTR(aes));
- }
- else
-#endif
- {
- AES_GCM_init_AARCH64((byte*)aes->key, (int)aes->rounds, iv, ivSz,
- aes->gcm.H, AES_COUNTER(aes), AES_INITCTR(aes));
- }
-
- return 0;
-}
-
-/* Update the AES GCM for encryption with authentication data.
- *
- * Implementation uses AARCH64 optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- * @param [in] endA Whether no more authentication data is expected.
- */
-static WARN_UNUSED_RESULT int AesGcmAadUpdate_AARCH64(
- Aes* aes, const byte* a, word32 aSz, int endA)
-{
- word32 blocks;
- int partial;
-
- if (aSz != 0 && a != NULL) {
- /* Total count of AAD updated. */
- aes->aSz += aSz;
- /* Check if we have unprocessed data. */
- if (aes->aOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->aOver);
- if (sz > aSz) {
- sz = (byte)aSz;
- }
- /* Copy extra into last GHASH block array and update count. */
- XMEMCPY(AES_LASTGBLOCK(aes) + aes->aOver, a, sz);
- aes->aOver = (byte)(aes->aOver + sz);
- if (aes->aOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- /* Reset count. */
- aes->aOver = 0;
- }
- /* Used up some data. */
- aSz -= sz;
- a += sz;
- }
-
- /* Calculate number of blocks of AAD and the leftover. */
- blocks = aSz / WC_AES_BLOCK_SIZE;
- partial = aSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* GHASH full blocks now. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_aad_update_AARCH64_EOR3(a, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_aad_update_AARCH64(a, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H);
- }
- /* Skip over to end of AAD blocks. */
- a += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Cache the partial block. */
- XMEMCPY(AES_LASTGBLOCK(aes), a, (size_t)partial);
- aes->aOver = (byte)partial;
- }
- }
- if (endA && (aes->aOver > 0)) {
- /* No more AAD coming and we have a partial block. */
- /* Fill the rest of the block with zeros. */
- XMEMSET(AES_LASTGBLOCK(aes) + aes->aOver, 0,
- (size_t)WC_AES_BLOCK_SIZE - aes->aOver);
- /* GHASH last AAD block. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- /* Clear partial count for next time through. */
- aes->aOver = 0;
- }
-
- return 0;
-}
-
-/* Update the AES GCM for encryption with data and/or authentication data.
- *
- * Implementation uses AARCH64 optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [out] c Buffer to hold cipher text.
- * @param [in] p Buffer holding plaintext.
- * @param [in] cSz Length of cipher text/plaintext in bytes.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- */
-static WARN_UNUSED_RESULT int AesGcmEncryptUpdate_AARCH64(
- Aes* aes, byte* c, const byte* p, word32 cSz, const byte* a, word32 aSz)
-{
- word32 blocks;
- int partial;
- int ret;
-
- /* Hash in A, the Authentication Data */
- ret = AesGcmAadUpdate_AARCH64(aes, a, aSz, (cSz > 0) && (c != NULL));
- if (ret != 0)
- return ret;
-
- /* Encrypt plaintext and Hash in C, the Cipher text */
- if (cSz != 0 && c != NULL) {
- /* Update count of cipher text we have hashed. */
- aes->cSz += cSz;
- if (aes->cOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->cOver);
- if (sz > cSz) {
- sz = (byte)cSz;
- }
- /* Encrypt some of the plaintext. */
- xorbuf(AES_LASTGBLOCK(aes) + aes->cOver, p, sz);
- XMEMCPY(c, AES_LASTGBLOCK(aes) + aes->cOver, sz);
- /* Update count of unused encrypted counter. */
- aes->cOver = (byte)(aes->cOver + sz);
- if (aes->cOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(AES_LASTGBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- /* Reset count. */
- aes->cOver = 0;
- }
- /* Used up some data. */
- cSz -= sz;
- p += sz;
- c += sz;
- }
-
- /* Calculate number of blocks of plaintext and the leftover. */
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* Encrypt and GHASH full blocks now. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_encrypt_update_AARCH64_EOR3((byte*)aes->key,
- (int)aes->rounds, c, p, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H, AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_update_AARCH64((byte*)aes->key,
- (int)aes->rounds, c, p, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H, AES_COUNTER(aes));
- }
- /* Skip over to end of blocks. */
- p += blocks * WC_AES_BLOCK_SIZE;
- c += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Encrypt the counter - XOR in zeros as proxy for plaintext. */
- XMEMSET(AES_LASTGBLOCK(aes), 0, WC_AES_BLOCK_SIZE);
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_encrypt_block_AARCH64_EOR3((byte*)aes->key,
- (int)aes->rounds, AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes),
- AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_block_AARCH64((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- /* XOR the remaining plaintext to calculate cipher text.
- * Keep cipher text for GHASH of last partial block.
- */
- xorbuf(AES_LASTGBLOCK(aes), p, (word32)partial);
- XMEMCPY(c, AES_LASTGBLOCK(aes), (size_t)partial);
- /* Update count of the block used. */
- aes->cOver = (byte)partial;
- }
- }
- return 0;
-}
-
-/* Finalize the AES GCM for encryption and calculate the authentication tag.
- *
- * Calls ARCH64 optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] authTag Buffer to hold authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- */
-static WARN_UNUSED_RESULT int AesGcmEncryptFinal_AARCH64(Aes* aes,
- byte* authTag, word32 authTagSz)
-{
- /* AAD block incomplete when > 0 */
- byte over = aes->aOver;
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (aes->cOver > 0) {
- /* Cipher text block incomplete. */
- over = aes->cOver;
- }
- if (over > 0) {
- /* Fill the rest of the block with zeros. */
- XMEMSET(AES_LASTGBLOCK(aes) + over, 0,
- (size_t)WC_AES_BLOCK_SIZE - over);
- /* GHASH last cipher block. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(AES_LASTGBLOCK(aes), AES_TAG(aes),
- aes->gcm.H);
- }
- }
- /* Calculate the authentication tag. */
-#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_encrypt_final_AARCH64_EOR3(AES_TAG(aes), authTag, authTagSz,
- aes->cSz, aes->aSz, aes->gcm.H, AES_INITCTR(aes));
- }
- else
-#endif
- {
- AES_GCM_encrypt_final_AARCH64(AES_TAG(aes), authTag, authTagSz,
- aes->cSz, aes->aSz, aes->gcm.H, AES_INITCTR(aes));
- }
-
- return 0;
-}
-
-#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT)
-/* Update the AES GCM for decryption with data and/or authentication data.
- *
- * @param [in, out] aes AES object.
- * @param [out] p Buffer to hold plaintext.
- * @param [in] c Buffer holding cipher text.
- * @param [in] cSz Length of cipher text/plaintext in bytes.
- * @param [in] a Buffer holding authentication data.
- * @param [in] aSz Length of authentication data in bytes.
- */
-static WARN_UNUSED_RESULT int AesGcmDecryptUpdate_AARCH64(Aes* aes, byte* p,
- const byte* c, word32 cSz, const byte* a, word32 aSz)
-{
- word32 blocks;
- int partial;
- int ret;
-
- /* Hash in A, the Authentication Data */
- ret = AesGcmAadUpdate_AARCH64(aes, a, aSz, cSz > 0);
- if (ret != 0)
- return ret;
-
- /* Hash in C, the Cipher text, and decrypt. */
- if (cSz != 0 && p != NULL) {
- /* Update count of cipher text we have hashed. */
- aes->cSz += cSz;
- if (aes->cOver > 0) {
- /* Calculate amount we can use - fill up the block. */
- byte sz = (byte)(WC_AES_BLOCK_SIZE - aes->cOver);
- if (sz > cSz) {
- sz = (byte)cSz;
- }
- /* Keep a copy of the cipher text for GHASH. */
- XMEMCPY(AES_LASTBLOCK(aes) + aes->cOver, c, sz);
- /* Decrypt some of the cipher text. */
- xorbuf(AES_LASTGBLOCK(aes) + aes->cOver, c, sz);
- XMEMCPY(p, AES_LASTGBLOCK(aes) + aes->cOver, sz);
- /* Update count of unused encrypted counter. */
- aes->cOver = (byte)(aes->cOver + sz);
- if (aes->cOver == WC_AES_BLOCK_SIZE) {
- /* We have filled up the block and can process. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(AES_LASTBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(AES_LASTBLOCK(aes),
- AES_TAG(aes), aes->gcm.H);
- }
- /* Reset count. */
- aes->cOver = 0;
- }
- /* Used up some data. */
- cSz -= sz;
- c += sz;
- p += sz;
- }
-
- /* Calculate number of blocks of plaintext and the leftover. */
- blocks = cSz / WC_AES_BLOCK_SIZE;
- partial = cSz % WC_AES_BLOCK_SIZE;
- if (blocks > 0) {
- /* Decrypt and GHASH full blocks now. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_decrypt_update_AARCH64_EOR3((byte*)aes->key,
- (int)aes->rounds, p, c, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H, AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_decrypt_update_AARCH64((byte*)aes->key,
- (int)aes->rounds, p, c, blocks * WC_AES_BLOCK_SIZE,
- AES_TAG(aes), aes->gcm.H, AES_COUNTER(aes));
- }
- /* Skip over to end of blocks. */
- c += blocks * WC_AES_BLOCK_SIZE;
- p += blocks * WC_AES_BLOCK_SIZE;
- }
- if (partial != 0) {
- /* Encrypt the counter - XOR in zeros as proxy for cipher text. */
- XMEMSET(AES_LASTGBLOCK(aes), 0, WC_AES_BLOCK_SIZE);
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_encrypt_block_AARCH64_EOR3((byte*)aes->key,
- (int)aes->rounds, AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes),
- AES_COUNTER(aes));
- }
- else
- #endif
- {
- AES_GCM_encrypt_block_AARCH64((byte*)aes->key, (int)aes->rounds,
- AES_LASTGBLOCK(aes), AES_LASTGBLOCK(aes), AES_COUNTER(aes));
- }
- /* Keep cipher text for GHASH of last partial block. */
- XMEMCPY(AES_LASTBLOCK(aes), c, (size_t)partial);
- /* XOR the remaining cipher text to calculate plaintext. */
- xorbuf(AES_LASTGBLOCK(aes), c, (word32)partial);
- XMEMCPY(p, AES_LASTGBLOCK(aes), (size_t)partial);
- /* Update count of the block used. */
- aes->cOver = (byte)partial;
- }
- }
-
- return 0;
-}
-
-/* Finalize the AES GCM for decryption and check the authentication tag.
- *
- * Calls AVX2, AVX1 or straight AES-NI optimized assembly code.
- *
- * @param [in, out] aes AES object.
- * @param [in] authTag Buffer holding authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- * @return AES_GCM_AUTH_E when authentication tag doesn't match calculated
- * value.
- */
-static WARN_UNUSED_RESULT int AesGcmDecryptFinal_AARCH64(
- Aes* aes, const byte* authTag, word32 authTagSz)
-{
- int ret = 0;
- int res;
- /* AAD block incomplete when > 0 */
- byte over = aes->aOver;
- byte *lastBlock = AES_LASTGBLOCK(aes);
-
- ASSERT_SAVED_VECTOR_REGISTERS();
-
- if (aes->cOver > 0) {
- /* Cipher text block incomplete. */
- over = aes->cOver;
- lastBlock = AES_LASTBLOCK(aes);
- }
- if (over > 0) {
- /* Zeroize the unused part of the block. */
- XMEMSET(lastBlock + over, 0, (size_t)WC_AES_BLOCK_SIZE - over);
- /* Hash the last block of cipher text. */
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_ghash_block_AARCH64_EOR3(lastBlock, AES_TAG(aes),
- aes->gcm.H);
- }
- else
- #endif
- {
- AES_GCM_ghash_block_AARCH64(lastBlock, AES_TAG(aes), aes->gcm.H);
- }
- }
- /* Calculate and compare the authentication tag. */
-#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (aes->use_sha3_hw_crypto) {
- AES_GCM_decrypt_final_AARCH64_EOR3(AES_TAG(aes), authTag, authTagSz,
- aes->cSz, aes->aSz, aes->gcm.H, AES_INITCTR(aes), &res);
- }
- else
-#endif
- {
- AES_GCM_decrypt_final_AARCH64(AES_TAG(aes), authTag, authTagSz,
- aes->cSz, aes->aSz, aes->gcm.H, AES_INITCTR(aes), &res);
- }
-
- /* Return error code when calculated doesn't match input. */
- if (res == 0) {
- ret = AES_GCM_AUTH_E;
- }
- return ret;
-}
-#endif
-#endif
-
-/* Initialize an AES GCM cipher for encryption or decryption.
- *
- * Must call wc_AesInit() before calling this function.
- * Call wc_AesGcmSetIV() before calling this function to generate part of IV.
- * Call wc_AesGcmSetExtIV() before calling this function to cache IV.
- *
- * @param [in, out] aes AES object.
- * @param [in] key Buffer holding key.
- * @param [in] len Length of key in bytes.
- * @param [in] iv Buffer holding IV/nonce.
- * @param [in] ivSz Length of IV/nonce in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, or a length is non-zero but buffer
- * is NULL, or the IV is NULL and no previous IV has been set.
- * @return MEMORY_E when dynamic memory allocation fails. (WOLFSSL_SMALL_STACK)
- */
-int wc_AesGcmInit(Aes* aes, const byte* key, word32 len, const byte* iv,
- word32 ivSz)
-{
- int ret = 0;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || ((len > 0) && (key == NULL)) ||
- ((ivSz == 0) && (iv != NULL)) ||
- ((ivSz > 0) && (iv == NULL))) {
- ret = BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_AESNI)
- if ((ret == 0) && (aes->streamData == NULL)) {
- /* Allocate buffers for streaming. */
- aes->streamData_sz = 5 * WC_AES_BLOCK_SIZE;
- aes->streamData = (byte*)XMALLOC(aes->streamData_sz, aes->heap,
- DYNAMIC_TYPE_AES);
- if (aes->streamData == NULL) {
- ret = MEMORY_E;
- }
- }
-#endif
-
- /* Set the key if passed in. */
- if ((ret == 0) && (key != NULL)) {
- ret = wc_AesGcmSetKey(aes, key, len);
- }
-
- if (ret == 0) {
- /* Set the IV passed in if it is smaller than a block. */
- if ((iv != NULL) && (ivSz <= WC_AES_BLOCK_SIZE)) {
- XMEMMOVE((byte*)aes->reg, iv, ivSz);
- aes->nonceSz = ivSz;
- }
- /* No IV passed in, check for cached IV. */
- if ((iv == NULL) && (aes->nonceSz != 0)) {
- /* Use the cached copy. */
- iv = (byte*)aes->reg;
- ivSz = aes->nonceSz;
- }
-
- if (iv != NULL) {
- /* Initialize with the IV. */
-
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
- ret = AesGcmInit_aesni(aes, iv, ivSz);
- RESTORE_VECTOR_REGISTERS();
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ret = AesGcmInit_AARCH64(aes, iv, ivSz);
- }
- else
- #endif /* WOLFSSL_AESNI */
- {
- ret = AesGcmInit_C(aes, iv, ivSz);
- }
-
- if (ret == 0)
- aes->nonceSet = 1;
- }
- }
-
- return ret;
-}
-
-/* Initialize an AES GCM cipher for encryption.
- *
- * Must call wc_AesInit() before calling this function.
- *
- * @param [in, out] aes AES object.
- * @param [in] key Buffer holding key.
- * @param [in] len Length of key in bytes.
- * @param [in] iv Buffer holding IV/nonce.
- * @param [in] ivSz Length of IV/nonce in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, or a length is non-zero but buffer
- * is NULL, or the IV is NULL and no previous IV has been set.
- */
-int wc_AesGcmEncryptInit(Aes* aes, const byte* key, word32 len, const byte* iv,
- word32 ivSz)
-{
- return wc_AesGcmInit(aes, key, len, iv, ivSz);
-}
-
-/* Initialize an AES GCM cipher for encryption. Get IV.
- *
- * Must call wc_AesGcmSetIV() to generate part of IV before calling this
- * function.
- * Must call wc_AesInit() before calling this function.
- *
- * See wc_AesGcmEncrypt_ex() for non-streaming version of getting IV out.
- *
- * @param [in, out] aes AES object.
- * @param [in] key Buffer holding key.
- * @param [in] len Length of key in bytes.
- * @param [in] iv Buffer holding IV/nonce.
- * @param [in] ivSz Length of IV/nonce in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, key length is non-zero but key
- * is NULL, or the IV is NULL or ivOutSz is not the same as cached
- * nonce size.
- */
-int wc_AesGcmEncryptInit_ex(Aes* aes, const byte* key, word32 len, byte* ivOut,
- word32 ivOutSz)
-{
- int ret;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || (ivOut == NULL) || (ivOutSz != aes->nonceSz)) {
- ret = BAD_FUNC_ARG;
- }
- else {
- /* Copy out the IV including generated part for decryption. */
- XMEMCPY(ivOut, aes->reg, ivOutSz);
- /* Initialize AES GCM cipher with key and cached Iv. */
- ret = wc_AesGcmInit(aes, key, len, NULL, 0);
- }
-
- return ret;
-}
-
-/* Update the AES GCM for encryption with data and/or authentication data.
- *
- * All the AAD must be passed to update before the plaintext.
- * Last part of AAD can be passed with first part of plaintext.
- *
- * Must set key and IV before calling this function.
- * Must call wc_AesGcmInit() before calling this function.
- *
- * @param [in, out] aes AES object.
- * @param [out] out Buffer to hold cipher text.
- * @param [in] in Buffer holding plaintext.
- * @param [in] sz Length of plaintext in bytes.
- * @param [in] authIn Buffer holding authentication data.
- * @param [in] authInSz Length of authentication data in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, or a length is non-zero but buffer
- * is NULL.
- */
-int wc_AesGcmEncryptUpdate(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || ((authInSz > 0) && (authIn == NULL)) || ((sz > 0) &&
- ((out == NULL) || (in == NULL)))) {
- ret = BAD_FUNC_ARG;
- }
-
- /* Check key has been set. */
- if ((ret == 0) && (!aes->gcmKeySet)) {
- ret = MISSING_KEY;
- }
- /* Check IV has been set. */
- if ((ret == 0) && (!aes->nonceSet)) {
- ret = MISSING_IV;
- }
-
- if ((ret == 0) && aes->ctrSet && (aes->aSz == 0) && (aes->cSz == 0)) {
- aes->invokeCtr[0]++;
- if (aes->invokeCtr[0] == 0) {
- aes->invokeCtr[1]++;
- if (aes->invokeCtr[1] == 0)
- ret = AES_GCM_OVERFLOW_E;
- }
- }
-
- if (ret == 0) {
- /* Encrypt with AAD and/or plaintext. */
-
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
- ret = AesGcmEncryptUpdate_aesni(aes, out, in, sz, authIn, authInSz);
- RESTORE_VECTOR_REGISTERS();
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ret = AesGcmEncryptUpdate_AARCH64(aes, out, in, sz, authIn,
- authInSz);
- }
- else
- #endif
- {
- /* Encrypt the plaintext. */
- ret = AesGcmCryptUpdate_C(aes, out, in, sz);
- if (ret == 0) {
- /* Update the authentication tag with any authentication data and the
- * new cipher text. */
- GHASH_UPDATE(aes, authIn, authInSz, out, sz);
- }
- }
- }
-
- return ret;
-}
-
-/* Finalize the AES GCM for encryption and return the authentication tag.
- *
- * Must set key and IV before calling this function.
- * Must call wc_AesGcmInit() before calling this function.
- *
- * @param [in, out] aes AES object.
- * @param [out] authTag Buffer to hold authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- */
-int wc_AesGcmEncryptFinal(Aes* aes, byte* authTag, word32 authTagSz)
-{
- int ret = 0;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || (authTag == NULL) || (authTagSz > WC_AES_BLOCK_SIZE) ||
- (authTagSz == 0)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* Check key has been set. */
- if ((ret == 0) && (!aes->gcmKeySet)) {
- ret = MISSING_KEY;
- }
- /* Check IV has been set. */
- if ((ret == 0) && (!aes->nonceSet)) {
- ret = MISSING_IV;
- }
-
- if (ret == 0) {
- /* Calculate authentication tag. */
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
- ret = AesGcmEncryptFinal_aesni(aes, authTag, authTagSz);
- RESTORE_VECTOR_REGISTERS();
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ret = AesGcmEncryptFinal_AARCH64(aes, authTag, authTagSz);
- }
- else
- #endif
- {
- ret = AesGcmFinal_C(aes, authTag, authTagSz);
- }
- }
-
- if ((ret == 0) && aes->ctrSet) {
- IncCtr((byte*)aes->reg, aes->nonceSz);
- }
-
- return ret;
-}
-
-#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT)
-/* Initialize an AES GCM cipher for decryption.
- *
- * Must call wc_AesInit() before calling this function.
- *
- * Call wc_AesGcmSetExtIV() before calling this function to use FIPS external IV
- * instead.
- *
- * @param [in, out] aes AES object.
- * @param [in] key Buffer holding key.
- * @param [in] len Length of key in bytes.
- * @param [in] iv Buffer holding IV/nonce.
- * @param [in] ivSz Length of IV/nonce in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, or a length is non-zero but buffer
- * is NULL, or the IV is NULL and no previous IV has been set.
- */
-int wc_AesGcmDecryptInit(Aes* aes, const byte* key, word32 len, const byte* iv,
- word32 ivSz)
-{
- return wc_AesGcmInit(aes, key, len, iv, ivSz);
-}
-
-/* Update the AES GCM for decryption with data and/or authentication data.
- *
- * All the AAD must be passed to update before the cipher text.
- * Last part of AAD can be passed with first part of cipher text.
- *
- * Must set key and IV before calling this function.
- * Must call wc_AesGcmInit() before calling this function.
- *
- * @param [in, out] aes AES object.
- * @param [out] out Buffer to hold plaintext.
- * @param [in] in Buffer holding cipher text.
- * @param [in] sz Length of cipher text in bytes.
- * @param [in] authIn Buffer holding authentication data.
- * @param [in] authInSz Length of authentication data in bytes.
- * @return 0 on success.
- * @return BAD_FUNC_ARG when aes is NULL, or a length is non-zero but buffer
- * is NULL.
- */
-int wc_AesGcmDecryptUpdate(Aes* aes, byte* out, const byte* in, word32 sz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || ((authInSz > 0) && (authIn == NULL)) || ((sz > 0) &&
- ((out == NULL) || (in == NULL)))) {
- ret = BAD_FUNC_ARG;
- }
-
- /* Check key has been set. */
- if ((ret == 0) && (!aes->gcmKeySet)) {
- ret = MISSING_KEY;
- }
- /* Check IV has been set. */
- if ((ret == 0) && (!aes->nonceSet)) {
- ret = MISSING_IV;
- }
-
- if (ret == 0) {
- /* Decrypt with AAD and/or cipher text. */
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
- ret = AesGcmDecryptUpdate_aesni(aes, out, in, sz, authIn, authInSz);
- RESTORE_VECTOR_REGISTERS();
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ret = AesGcmDecryptUpdate_AARCH64(aes, out, in, sz, authIn,
- authInSz);
- }
- else
- #endif
- {
- /* Update the authentication tag with any authentication data and
- * cipher text. */
- GHASH_UPDATE(aes, authIn, authInSz, in, sz);
- /* Decrypt the cipher text. */
- ret = AesGcmCryptUpdate_C(aes, out, in, sz);
- }
- }
-
- return ret;
-}
-
-/* Finalize the AES GCM for decryption and check the authentication tag.
- *
- * Must set key and IV before calling this function.
- * Must call wc_AesGcmInit() before calling this function.
- *
- * @param [in, out] aes AES object.
- * @param [in] authTag Buffer holding authentication tag.
- * @param [in] authTagSz Length of authentication tag in bytes.
- * @return 0 on success.
- */
-int wc_AesGcmDecryptFinal(Aes* aes, const byte* authTag, word32 authTagSz)
-{
- int ret = 0;
-
- /* Check validity of parameters. */
- if ((aes == NULL) || (authTag == NULL) || (authTagSz > WC_AES_BLOCK_SIZE) ||
- (authTagSz == 0)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* Check key has been set. */
- if ((ret == 0) && (!aes->gcmKeySet)) {
- ret = MISSING_KEY;
- }
- /* Check IV has been set. */
- if ((ret == 0) && (!aes->nonceSet)) {
- ret = MISSING_IV;
- }
-
- if (ret == 0) {
- /* Calculate authentication tag and compare with one passed in.. */
- #ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
- ret = AesGcmDecryptFinal_aesni(aes, authTag, authTagSz);
- RESTORE_VECTOR_REGISTERS();
- }
- else
- #elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto) {
- ret = AesGcmDecryptFinal_AARCH64(aes, authTag, authTagSz);
- }
- else
- #endif
- {
- ALIGN32 byte calcTag[WC_AES_BLOCK_SIZE];
- /* Calculate authentication tag. */
- ret = AesGcmFinal_C(aes, calcTag, authTagSz);
- if (ret == 0) {
- /* Check calculated tag matches the one passed in. */
- if (ConstantCompare(authTag, calcTag, (int)authTagSz) != 0) {
- ret = AES_GCM_AUTH_E;
- }
- }
- }
- }
-
- return ret;
-}
-#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
-#endif /* WOLFSSL_AESGCM_STREAM */
-#endif /* WOLFSSL_XILINX_CRYPT */
-#endif /* end of block for AESGCM implementation selection */
-
-
-/* Common to all, abstract functions that build off of lower level AESGCM
- * functions */
-#ifndef WC_NO_RNG
-
-static WARN_UNUSED_RESULT WC_INLINE int CheckAesGcmIvSize(int ivSz) {
- return (ivSz == GCM_NONCE_MIN_SZ ||
- ivSz == GCM_NONCE_MID_SZ ||
- ivSz == GCM_NONCE_MAX_SZ);
-}
-
-
-int wc_AesGcmSetExtIV(Aes* aes, const byte* iv, word32 ivSz)
-{
- int ret = 0;
-
- if (aes == NULL || iv == NULL || !CheckAesGcmIvSize((int)ivSz)) {
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- XMEMCPY((byte*)aes->reg, iv, ivSz);
-
- /* If the IV is 96, allow for a 2^64 invocation counter.
- * For any other size for the nonce, limit the invocation
- * counter to 32-bits. (SP 800-38D 8.3) */
- aes->invokeCtr[0] = 0;
- aes->invokeCtr[1] = (ivSz == GCM_NONCE_MID_SZ) ? 0 : 0xFFFFFFFF;
- #ifdef WOLFSSL_AESGCM_STREAM
- aes->ctrSet = 1;
- #endif
- aes->nonceSz = ivSz;
- }
-
- return ret;
-}
-
-
-int wc_AesGcmSetIV(Aes* aes, word32 ivSz,
- const byte* ivFixed, word32 ivFixedSz,
- WC_RNG* rng)
-{
- int ret = 0;
-
- if (aes == NULL || rng == NULL || !CheckAesGcmIvSize((int)ivSz) ||
- (ivFixed == NULL && ivFixedSz != 0) ||
- (ivFixed != NULL && ivFixedSz != AES_IV_FIXED_SZ)) {
-
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- byte* iv = (byte*)aes->reg;
-
- if (ivFixedSz)
- XMEMCPY(iv, ivFixed, ivFixedSz);
-
- ret = wc_RNG_GenerateBlock(rng, iv + ivFixedSz, ivSz - ivFixedSz);
- }
-
- if (ret == 0) {
- /* If the IV is 96, allow for a 2^64 invocation counter.
- * For any other size for the nonce, limit the invocation
- * counter to 32-bits. (SP 800-38D 8.3) */
- aes->invokeCtr[0] = 0;
- aes->invokeCtr[1] = (ivSz == GCM_NONCE_MID_SZ) ? 0 : 0xFFFFFFFF;
- #ifdef WOLFSSL_AESGCM_STREAM
- aes->ctrSet = 1;
- #endif
- aes->nonceSz = ivSz;
- }
-
- return ret;
-}
-
-
-int wc_AesGcmEncrypt_ex(Aes* aes, byte* out, const byte* in, word32 sz,
- byte* ivOut, word32 ivOutSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
-
- if (aes == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
- ivOut == NULL || ivOutSz != aes->nonceSz ||
- (authIn == NULL && authInSz != 0)) {
-
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- aes->invokeCtr[0]++;
- if (aes->invokeCtr[0] == 0) {
- aes->invokeCtr[1]++;
- if (aes->invokeCtr[1] == 0)
- ret = AES_GCM_OVERFLOW_E;
- }
- }
-
- if (ret == 0) {
- XMEMCPY(ivOut, aes->reg, ivOutSz);
- ret = wc_AesGcmEncrypt(aes, out, in, sz,
- (byte*)aes->reg, ivOutSz,
- authTag, authTagSz,
- authIn, authInSz);
- if (ret == 0)
- IncCtr((byte*)aes->reg, ivOutSz);
- }
-
- return ret;
-}
-
-int wc_Gmac(const byte* key, word32 keySz, byte* iv, word32 ivSz,
- const byte* authIn, word32 authInSz,
- byte* authTag, word32 authTagSz, WC_RNG* rng)
-{
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- int ret;
-
- if (key == NULL || iv == NULL || (authIn == NULL && authInSz != 0) ||
- authTag == NULL || authTagSz == 0 || rng == NULL) {
-
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- aes = wc_AesNew(NULL, INVALID_DEVID, &ret);
-#else
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
-#endif
- if (ret != 0)
- return ret;
-
- ret = wc_AesGcmSetKey(aes, key, keySz);
- if (ret == 0)
- ret = wc_AesGcmSetIV(aes, ivSz, NULL, 0, rng);
- if (ret == 0)
- ret = wc_AesGcmEncrypt_ex(aes, NULL, NULL, 0, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-
-#ifdef WOLFSSL_SMALL_STACK
- wc_AesDelete(aes, NULL);
-#else
- wc_AesFree(aes);
-#endif
-
- return ret;
-}
-
-int wc_GmacVerify(const byte* key, word32 keySz,
- const byte* iv, word32 ivSz,
- const byte* authIn, word32 authInSz,
- const byte* authTag, word32 authTagSz)
-{
- int ret;
-#ifdef HAVE_AES_DECRYPT
- WC_DECLARE_VAR(aes, Aes, 1, 0);
-
- if (key == NULL || iv == NULL || (authIn == NULL && authInSz != 0) ||
- authTag == NULL || authTagSz == 0 || authTagSz > WC_AES_BLOCK_SIZE) {
-
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- aes = wc_AesNew(NULL, INVALID_DEVID, &ret);
-#else
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
-#endif
- if (ret == 0) {
- ret = wc_AesGcmSetKey(aes, key, keySz);
- if (ret == 0)
- ret = wc_AesGcmDecrypt(aes, NULL, NULL, 0, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-
- }
-#ifdef WOLFSSL_SMALL_STACK
- wc_AesDelete(aes, NULL);
-#else
- wc_AesFree(aes);
-#endif
-#else
- (void)key;
- (void)keySz;
- (void)iv;
- (void)ivSz;
- (void)authIn;
- (void)authInSz;
- (void)authTag;
- (void)authTagSz;
- ret = NOT_COMPILED_IN;
-#endif
- return ret;
-}
-
-#endif /* WC_NO_RNG */
-
-
-int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len)
-{
- if (gmac == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
- return wc_AesGcmSetKey(&gmac->aes, key, len);
-}
-
-
-int wc_GmacUpdate(Gmac* gmac, const byte* iv, word32 ivSz,
- const byte* authIn, word32 authInSz,
- byte* authTag, word32 authTagSz)
-{
- if (gmac == NULL) {
- return BAD_FUNC_ARG;
- }
-
- return wc_AesGcmEncrypt(&gmac->aes, NULL, NULL, 0, iv, ivSz,
- authTag, authTagSz, authIn, authInSz);
-}
-
-#endif /* HAVE_AESGCM */
-
-#ifdef HAVE_AESCCM
-
-int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz)
-{
- if (!((keySz == 16) || (keySz == 24) || (keySz == 32)))
- return BAD_FUNC_ARG;
-
- return wc_AesSetKey(aes, key, keySz, NULL, AES_ENCRYPTION);
-}
-
-
-/* Checks if the tag size is an accepted value based on RFC 3610 section 2
- * returns 0 if tag size is ok
- */
-int wc_AesCcmCheckTagSize(int sz)
-{
- /* values here are from RFC 3610 section 2 */
- if (sz != 4 && sz != 6 && sz != 8 && sz != 10 && sz != 12 && sz != 14
- && sz != 16) {
- WOLFSSL_MSG("Bad auth tag size AES-CCM");
- return BAD_FUNC_ARG;
- }
- return 0;
-}
-
-#if defined(WOLFSSL_RISCV_ASM)
- /* implementation located in wolfcrypt/src/port/risc-v/riscv-64-aes.c */
-
-#elif defined(HAVE_COLDFIRE_SEC)
- #error "Coldfire SEC doesn't currently support AES-CCM mode"
-
-#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) && \
- !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam_aes.c */
-
-#elif defined(WOLFSSL_SILABS_SE_ACCEL)
- /* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
-int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- return wc_AesCcmEncrypt_silabs(
- aes, out, in, inSz,
- nonce, nonceSz,
- authTag, authTagSz,
- authIn, authInSz);
-}
-
-#ifdef HAVE_AES_DECRYPT
-int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- return wc_AesCcmDecrypt_silabs(
- aes, out, in, inSz,
- nonce, nonceSz,
- authTag, authTagSz,
- authIn, authInSz);
-}
-#endif
-#elif defined(FREESCALE_LTC)
-
-/* return 0 on success */
-int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- byte *key;
- word32 keySize;
- status_t status;
-
- /* sanity check on arguments */
- /* note, LTC_AES_EncryptTagCcm() doesn't allow null src or dst
- * ptrs even if inSz is zero (ltc_aes_ccm_check_input_args()), so
- * don't allow it here either.
- */
- if (aes == NULL || out == NULL || in == NULL || nonce == NULL
- || authTag == NULL || nonceSz < 7 || nonceSz > 13) {
- return BAD_FUNC_ARG;
- }
-
- if (wc_AesCcmCheckTagSize(authTagSz) != 0) {
- return BAD_FUNC_ARG;
- }
-
- key = (byte*)aes->key;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
-
- status = LTC_AES_EncryptTagCcm(LTC_BASE, in, out, inSz,
- nonce, nonceSz, authIn, authInSz, key, keySize, authTag, authTagSz);
- wolfSSL_CryptHwMutexUnLock();
-
- return (kStatus_Success == status) ? 0 : BAD_FUNC_ARG;
-}
-
-#ifdef HAVE_AES_DECRYPT
-int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- byte *key;
- word32 keySize;
- status_t status;
-
- /* sanity check on arguments */
- if (aes == NULL || out == NULL || in == NULL || nonce == NULL
- || authTag == NULL || nonceSz < 7 || nonceSz > 13) {
- return BAD_FUNC_ARG;
- }
-
- key = (byte*)aes->key;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wolfSSL_CryptHwMutexLock();
- if (status != 0)
- return status;
- status = LTC_AES_DecryptTagCcm(LTC_BASE, in, out, inSz,
- nonce, nonceSz, authIn, authInSz, key, keySize, authTag, authTagSz);
- wolfSSL_CryptHwMutexUnLock();
-
- if (status != kStatus_Success) {
- XMEMSET(out, 0, inSz);
- return AES_CCM_AUTH_E;
- }
- return 0;
-}
-#endif /* HAVE_AES_DECRYPT */
-
-#else
-
-/* Software CCM */
-static WARN_UNUSED_RESULT int roll_x(
- Aes* aes, const byte* in, word32 inSz, byte* out)
-{
- int ret;
-
- /* process the bulk of the data */
- while (inSz >= WC_AES_BLOCK_SIZE) {
- xorbuf(out, in, WC_AES_BLOCK_SIZE);
- in += WC_AES_BLOCK_SIZE;
- inSz -= WC_AES_BLOCK_SIZE;
-
- ret = wc_AesEncrypt(aes, out, out);
- if (ret != 0)
- return ret;
- }
-
- /* process remainder of the data */
- if (inSz > 0) {
- xorbuf(out, in, inSz);
- ret = wc_AesEncrypt(aes, out, out);
- if (ret != 0)
- return ret;
- }
-
- return 0;
-}
-
-static WARN_UNUSED_RESULT int roll_auth(
- Aes* aes, const byte* in, word32 inSz, byte* out)
-{
- word32 authLenSz;
- word32 remainder;
- int ret;
-
- /* encode the length in */
- if (inSz <= 0xFEFF) {
- authLenSz = 2;
- out[0] ^= (byte)(inSz >> 8);
- out[1] ^= (byte)inSz;
- }
- else {
- authLenSz = 6;
- out[0] ^= 0xFF;
- out[1] ^= 0xFE;
- out[2] ^= (byte)(inSz >> 24);
- out[3] ^= (byte)(inSz >> 16);
- out[4] ^= (byte)(inSz >> 8);
- out[5] ^= (byte)inSz;
- }
- /* Note, the protocol handles auth data up to 2^64, but we are
- * using 32-bit sizes right now, so the bigger data isn't handled
- * else {}
- */
-
- /* start fill out the rest of the first block */
- remainder = WC_AES_BLOCK_SIZE - authLenSz;
- if (inSz >= remainder) {
- /* plenty of bulk data to fill the remainder of this block */
- xorbuf(out + authLenSz, in, remainder);
- inSz -= remainder;
- in += remainder;
- }
- else {
- /* not enough bulk data, copy what is available, and pad zero */
- xorbuf(out + authLenSz, in, inSz);
- inSz = 0;
- }
- ret = wc_AesEncrypt(aes, out, out);
-
- if ((ret == 0) && (inSz > 0)) {
- ret = roll_x(aes, in, inSz, out);
- }
-
- return ret;
-}
-
-
-static WC_INLINE void AesCcmCtrInc(byte* B, word32 lenSz)
-{
- word32 i;
-
- for (i = 0; i < lenSz; i++) {
- if (++B[WC_AES_BLOCK_SIZE - 1 - i] != 0) return;
- }
-}
-
-#ifdef WOLFSSL_AESNI
-static WC_INLINE void AesCcmCtrIncSet4(byte* B, word32 lenSz)
-{
- word32 i;
-
- /* B+1 = B */
- XMEMCPY(B + WC_AES_BLOCK_SIZE * 1, B, WC_AES_BLOCK_SIZE);
- /* B+2,B+3 = B,B+1 */
- XMEMCPY(B + WC_AES_BLOCK_SIZE * 2, B, WC_AES_BLOCK_SIZE * 2);
-
- for (i = 0; i < lenSz; i++) {
- if (++B[WC_AES_BLOCK_SIZE * 2 - 1 - i] != 0) break;
- }
- B[WC_AES_BLOCK_SIZE * 3 - 1] = (byte)(B[WC_AES_BLOCK_SIZE * 3 - 1] + 2U);
- if (B[WC_AES_BLOCK_SIZE * 3 - 1] < 2U) {
- for (i = 1; i < lenSz; i++) {
- if (++B[WC_AES_BLOCK_SIZE * 3 - 1 - i] != 0) break;
- }
- }
- B[WC_AES_BLOCK_SIZE * 4 - 1] = (byte)(B[WC_AES_BLOCK_SIZE * 4 - 1] + 3U);
- if (B[WC_AES_BLOCK_SIZE * 4 - 1] < 3U) {
- for (i = 1; i < lenSz; i++) {
- if (++B[WC_AES_BLOCK_SIZE * 4 - 1 - i] != 0) break;
- }
- }
-}
-
-static WC_INLINE void AesCcmCtrInc4(byte* B, word32 lenSz)
-{
- word32 i;
-
- B[WC_AES_BLOCK_SIZE - 1] = (byte)(B[WC_AES_BLOCK_SIZE - 1] + 4U);
- if (B[WC_AES_BLOCK_SIZE - 1] < 4U) {
- for (i = 1; i < lenSz; i++) {
- if (++B[WC_AES_BLOCK_SIZE - 1 - i] != 0) break;
- }
- }
-}
-#endif
-
-/* Software AES - CCM Encrypt */
-/* return 0 on success */
-int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
-#ifdef WOLFSSL_AESNI
- ALIGN128 byte A[WC_AES_BLOCK_SIZE * 4];
- ALIGN128 byte B[WC_AES_BLOCK_SIZE * 4];
-#else
- byte A[WC_AES_BLOCK_SIZE];
- byte B[WC_AES_BLOCK_SIZE];
-#endif
- byte lenSz;
- word32 i;
- byte mask = 0xFF;
- const word32 wordSz = (word32)sizeof(word32);
- int ret;
-
- /* sanity check on arguments */
- if (aes == NULL || (inSz != 0 && (in == NULL || out == NULL)) ||
- nonce == NULL || authTag == NULL || nonceSz < 7 || nonceSz > 13 ||
- authTagSz > WC_AES_BLOCK_SIZE)
- return BAD_FUNC_ARG;
-
- /* Sanity check on authIn to prevent segfault in xorbuf() where
- * variable 'in' is dereferenced as the mask 'm' in misc.c */
- if (authIn == NULL && authInSz > 0)
- return BAD_FUNC_ARG;
-
- /* sanity check on tag size */
- if (wc_AesCcmCheckTagSize((int)authTagSz) != 0) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret =
- wc_CryptoCb_AesCcmEncrypt(aes, out, in, inSz, nonce, nonceSz,
- authTag, authTagSz, authIn, authInSz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
-#endif
-
- XMEMSET(A, 0, sizeof(A));
- XMEMCPY(B+1, nonce, nonceSz);
- lenSz = (byte)(WC_AES_BLOCK_SIZE - 1U - nonceSz);
- B[0] = (byte)((authInSz > 0 ? 64 : 0)
- + (8 * (((byte)authTagSz - 2) / 2))
- + (lenSz - 1));
- for (i = 0; i < lenSz; i++) {
- if (mask && i >= wordSz)
- mask = 0x00;
- B[WC_AES_BLOCK_SIZE - 1 - i] = (byte)((inSz >> ((8 * i) & mask)) & mask);
- }
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(B));
-#endif
-
- VECTOR_REGISTERS_PUSH;
- ret = wc_AesEncrypt(aes, B, A);
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- if (ret == 0)
- wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(A));
-#endif
-
- if ((ret == 0) && (authInSz > 0))
- ret = roll_auth(aes, authIn, authInSz, A);
-
- if ((ret == 0) && (inSz > 0))
- ret = roll_x(aes, in, inSz, A);
-
- if (ret == 0) {
- XMEMCPY(authTag, A, authTagSz);
-
- B[0] = (byte)(lenSz - 1U);
- for (i = 0; i < lenSz; i++)
- B[WC_AES_BLOCK_SIZE - 1 - i] = 0;
- ret = wc_AesEncrypt(aes, B, A);
- }
-
- if (ret == 0) {
- xorbuf(authTag, A, authTagSz);
- B[15] = 1;
- }
-#ifdef WOLFSSL_AESNI
- if ((ret == 0) && aes->use_aesni) {
- while (inSz >= WC_AES_BLOCK_SIZE * 4) {
- AesCcmCtrIncSet4(B, lenSz);
-
- AES_ECB_encrypt_AESNI(B, A, WC_AES_BLOCK_SIZE * 4, (byte*)aes->key,
- (int)aes->rounds);
-
- xorbuf(A, in, WC_AES_BLOCK_SIZE * 4);
- XMEMCPY(out, A, WC_AES_BLOCK_SIZE * 4);
-
- inSz -= WC_AES_BLOCK_SIZE * 4;
- in += WC_AES_BLOCK_SIZE * 4;
- out += WC_AES_BLOCK_SIZE * 4;
-
- AesCcmCtrInc4(B, lenSz);
- }
- }
-#endif
- if (ret == 0) {
- while (inSz >= WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncrypt(aes, B, A);
- if (ret != 0)
- break;
- xorbuf(A, in, WC_AES_BLOCK_SIZE);
- XMEMCPY(out, A, WC_AES_BLOCK_SIZE);
-
- AesCcmCtrInc(B, lenSz);
- inSz -= WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
- }
- if ((ret == 0) && (inSz > 0)) {
- ret = wc_AesEncrypt(aes, B, A);
- }
- if ((ret == 0) && (inSz > 0)) {
- xorbuf(A, in, inSz);
- XMEMCPY(out, A, inSz);
- }
-
- ForceZero(A, sizeof(A));
- ForceZero(B, sizeof(B));
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(A, sizeof(A));
- wc_MemZero_Check(B, sizeof(B));
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-#ifdef HAVE_AES_DECRYPT
-/* Software AES - CCM Decrypt */
-int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- const byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
-#ifdef WOLFSSL_AESNI
- ALIGN128 byte B[WC_AES_BLOCK_SIZE * 4];
- ALIGN128 byte A[WC_AES_BLOCK_SIZE * 4];
-#else
- byte A[WC_AES_BLOCK_SIZE];
- byte B[WC_AES_BLOCK_SIZE];
-#endif
- byte* o;
- byte lenSz;
- word32 i, oSz;
- byte mask = 0xFF;
- const word32 wordSz = (word32)sizeof(word32);
- int ret = 0;
-
- /* sanity check on arguments */
- if (aes == NULL || (inSz != 0 && (in == NULL || out == NULL)) ||
- nonce == NULL || authTag == NULL || nonceSz < 7 || nonceSz > 13 ||
- authTagSz > WC_AES_BLOCK_SIZE)
- return BAD_FUNC_ARG;
-
- /* Sanity check on authIn to prevent segfault in xorbuf() where
- * variable 'in' is dereferenced as the mask 'm' in misc.c */
- if (authIn == NULL && authInSz > 0)
- return BAD_FUNC_ARG;
-
- /* sanity check on tag size */
- if (wc_AesCcmCheckTagSize((int)authTagSz) != 0) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- int crypto_cb_ret =
- wc_CryptoCb_AesCcmDecrypt(aes, out, in, inSz, nonce, nonceSz,
- authTag, authTagSz, authIn, authInSz);
- if (crypto_cb_ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return crypto_cb_ret;
- /* fall-through when unavailable */
- }
-#endif
-
- o = out;
- oSz = inSz;
- XMEMSET(A, 0, sizeof A);
- XMEMCPY(B+1, nonce, nonceSz);
- lenSz = (byte)(WC_AES_BLOCK_SIZE - 1U - nonceSz);
-
- B[0] = (byte)(lenSz - 1U);
- for (i = 0; i < lenSz; i++)
- B[WC_AES_BLOCK_SIZE - 1 - i] = 0;
- B[15] = 1;
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Add("wc_AesCcmEncrypt A", A, sizeof(A));
- wc_MemZero_Add("wc_AesCcmEncrypt B", B, sizeof(B));
-#endif
-
- VECTOR_REGISTERS_PUSH;
-
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- while (oSz >= WC_AES_BLOCK_SIZE * 4) {
- AesCcmCtrIncSet4(B, lenSz);
-
- AES_ECB_encrypt_AESNI(B, A, WC_AES_BLOCK_SIZE * 4, (byte*)aes->key,
- (int)aes->rounds);
-
- xorbuf(A, in, WC_AES_BLOCK_SIZE * 4);
- XMEMCPY(o, A, WC_AES_BLOCK_SIZE * 4);
-
- oSz -= WC_AES_BLOCK_SIZE * 4;
- in += WC_AES_BLOCK_SIZE * 4;
- o += WC_AES_BLOCK_SIZE * 4;
-
- AesCcmCtrInc4(B, lenSz);
- }
- }
-#endif
-
- while (oSz >= WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncrypt(aes, B, A);
- if (ret != 0)
- break;
- xorbuf(A, in, WC_AES_BLOCK_SIZE);
- XMEMCPY(o, A, WC_AES_BLOCK_SIZE);
- AesCcmCtrInc(B, lenSz);
- oSz -= WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- o += WC_AES_BLOCK_SIZE;
- }
-
- if ((ret == 0) && (inSz > 0))
- ret = wc_AesEncrypt(aes, B, A);
-
- if ((ret == 0) && (inSz > 0)) {
- xorbuf(A, in, oSz);
- XMEMCPY(o, A, oSz);
- for (i = 0; i < lenSz; i++)
- B[WC_AES_BLOCK_SIZE - 1 - i] = 0;
- ret = wc_AesEncrypt(aes, B, A);
- }
-
- if (ret == 0) {
- o = out;
- oSz = inSz;
-
- B[0] = (byte)((authInSz > 0 ? 64 : 0)
- + (8 * (((byte)authTagSz - 2) / 2))
- + (lenSz - 1));
- for (i = 0; i < lenSz; i++) {
- if (mask && i >= wordSz)
- mask = 0x00;
- B[WC_AES_BLOCK_SIZE - 1 - i] = (byte)((inSz >> ((8 * i) & mask)) & mask);
- }
-
- ret = wc_AesEncrypt(aes, B, A);
- }
-
- if (ret == 0) {
- if (authInSz > 0)
- ret = roll_auth(aes, authIn, authInSz, A);
- }
- if ((ret == 0) && (inSz > 0))
- ret = roll_x(aes, o, oSz, A);
-
- if (ret == 0) {
- B[0] = (byte)(lenSz - 1U);
- for (i = 0; i < lenSz; i++)
- B[WC_AES_BLOCK_SIZE - 1 - i] = 0;
- ret = wc_AesEncrypt(aes, B, B);
- }
-
- if (ret == 0)
- xorbuf(A, B, authTagSz);
-
- if (ret == 0) {
- if (ConstantCompare(A, authTag, (int)authTagSz) != 0) {
- /* If the authTag check fails, don't keep the decrypted data.
- * Unfortunately, you need the decrypted data to calculate the
- * check value. */
- #if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2) && \
- defined(ACVP_VECTOR_TESTING)
- WOLFSSL_MSG("Preserve output for vector responses");
- #else
- if (inSz > 0)
- XMEMSET(out, 0, inSz);
- #endif
- ret = AES_CCM_AUTH_E;
- }
- }
-
- ForceZero(A, sizeof(A));
- ForceZero(B, sizeof(B));
- o = NULL;
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(A, sizeof(A));
- wc_MemZero_Check(B, sizeof(B));
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-#endif /* HAVE_AES_DECRYPT */
-#endif /* software CCM */
-
-/* abstract functions that call lower level AESCCM functions */
-#ifndef WC_NO_RNG
-
-int wc_AesCcmSetNonce(Aes* aes, const byte* nonce, word32 nonceSz)
-{
- int ret = 0;
-
- if (aes == NULL || nonce == NULL ||
- nonceSz < CCM_NONCE_MIN_SZ || nonceSz > CCM_NONCE_MAX_SZ) {
-
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- XMEMCPY(aes->reg, nonce, nonceSz);
- aes->nonceSz = nonceSz;
-
- /* Invocation counter should be 2^61 */
- aes->invokeCtr[0] = 0;
- aes->invokeCtr[1] = 0xE0000000;
- }
-
- return ret;
-}
-
-
-int wc_AesCcmEncrypt_ex(Aes* aes, byte* out, const byte* in, word32 sz,
- byte* ivOut, word32 ivOutSz,
- byte* authTag, word32 authTagSz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
-
- if (aes == NULL || out == NULL ||
- (in == NULL && sz != 0) ||
- ivOut == NULL ||
- (authIn == NULL && authInSz != 0) ||
- (ivOutSz != aes->nonceSz)) {
-
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- aes->invokeCtr[0]++;
- if (aes->invokeCtr[0] == 0) {
- aes->invokeCtr[1]++;
- if (aes->invokeCtr[1] == 0)
- ret = AES_CCM_OVERFLOW_E;
- }
- }
-
- if (ret == 0) {
- ret = wc_AesCcmEncrypt(aes, out, in, sz,
- (byte*)aes->reg, aes->nonceSz,
- authTag, authTagSz,
- authIn, authInSz);
- if (ret == 0) {
- XMEMCPY(ivOut, aes->reg, aes->nonceSz);
- IncCtr((byte*)aes->reg, aes->nonceSz);
- }
- }
-
- return ret;
-}
-
-#endif /* WC_NO_RNG */
-
-#endif /* HAVE_AESCCM */
-
-#ifndef WC_NO_CONSTRUCTORS
-Aes* wc_AesNew(void* heap, int devId, int *result_code)
-{
- int ret;
- Aes* aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_AES);
- if (aes == NULL) {
- ret = MEMORY_E;
- }
- else {
- ret = wc_AesInit(aes, heap, devId);
- if (ret != 0) {
- XFREE(aes, heap, DYNAMIC_TYPE_AES);
- aes = NULL;
- }
- }
-
- if (result_code != NULL)
- *result_code = ret;
-
- return aes;
-}
-
-int wc_AesDelete(Aes *aes, Aes** aes_p)
-{
- if (aes == NULL)
- return BAD_FUNC_ARG;
- wc_AesFree(aes);
- XFREE(aes, aes->heap, DYNAMIC_TYPE_AES);
- if (aes_p != NULL)
- *aes_p = NULL;
- return 0;
-}
-#endif /* !WC_NO_CONSTRUCTORS */
-
-/* Initialize Aes */
-int wc_AesInit(Aes* aes, void* heap, int devId)
-{
- int ret = 0;
-
- if (aes == NULL)
- return BAD_FUNC_ARG;
-
- XMEMSET(aes, 0, sizeof(*aes));
-
- aes->heap = heap;
-
-#if defined(WOLF_CRYPTO_CB) || defined(WOLFSSL_STM32U5_DHUK)
- aes->devId = devId;
-#else
- (void)devId;
-#endif
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- ret = wolfAsync_DevCtxInit(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES,
- aes->heap, devId);
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
-#if defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES)
- aes->alFd = WC_SOCK_NOTSET;
- aes->rdFd = WC_SOCK_NOTSET;
-#endif
-#if defined(WOLFSSL_DEVCRYPTO) && \
- (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
- aes->ctx.cfd = -1;
-#endif
-#if defined(WOLFSSL_IMXRT_DCP)
- DCPAesInit(aes);
-#endif
-
-#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- ret = wc_psa_aes_init(aes);
-#endif
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- if (ret == 0)
- ret = wc_debug_CipherLifecycleInit(&aes->CipherLifecycleTag, aes->heap);
-#endif
-
- return ret;
-}
-
-#ifdef WOLF_PRIVATE_KEY_ID
-int wc_AesInit_Id(Aes* aes, unsigned char* id, int len, void* heap, int devId)
-{
- int ret = 0;
-
- if (aes == NULL)
- ret = BAD_FUNC_ARG;
- if (ret == 0 && (len < 0 || len > AES_MAX_ID_LEN))
- ret = BUFFER_E;
-
- if (ret == 0)
- ret = wc_AesInit(aes, heap, devId);
- if (ret == 0) {
- XMEMCPY(aes->id, id, (size_t)len);
- aes->idLen = len;
- aes->labelLen = 0;
- }
-
- return ret;
-}
-
-int wc_AesInit_Label(Aes* aes, const char* label, void* heap, int devId)
-{
- int ret = 0;
- size_t labelLen = 0;
-
- if (aes == NULL || label == NULL)
- ret = BAD_FUNC_ARG;
- if (ret == 0) {
- labelLen = XSTRLEN(label);
- if (labelLen == 0 || labelLen > AES_MAX_LABEL_LEN)
- ret = BUFFER_E;
- }
-
- if (ret == 0)
- ret = wc_AesInit(aes, heap, devId);
- if (ret == 0) {
- XMEMCPY(aes->label, label, labelLen);
- aes->labelLen = (int)labelLen;
- aes->idLen = 0;
- }
-
- return ret;
-}
-#endif
-
-/* Free Aes resources */
-void wc_AesFree(Aes* aes)
-{
- if (aes == NULL) {
- return;
- }
-
-#ifdef WC_DEBUG_CIPHER_LIFECYCLE
- (void)wc_debug_CipherLifecycleFree(&aes->CipherLifecycleTag, aes->heap, 1);
-#endif
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
- wolfAsync_DevCtxFree(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES);
-#endif /* WOLFSSL_ASYNC_CRYPT */
-#if defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES)
- if (aes->rdFd > 0) { /* negative is error case */
- close(aes->rdFd);
- aes->rdFd = WC_SOCK_NOTSET;
- }
- if (aes->alFd > 0) {
- close(aes->alFd);
- aes->alFd = WC_SOCK_NOTSET;
- }
-#endif /* WOLFSSL_AFALG */
-#ifdef WOLFSSL_KCAPI_AES
- ForceZero((byte*)aes->devKey, AES_MAX_KEY_SIZE/WOLFSSL_BIT_SIZE);
- if (aes->init == 1) {
- kcapi_cipher_destroy(aes->handle);
- }
- aes->init = 0;
- aes->handle = NULL;
-#endif
-#if defined(WOLFSSL_DEVCRYPTO) && \
- (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
- wc_DevCryptoFree(&aes->ctx);
-#endif
-#if defined(WOLF_CRYPTO_CB) || (defined(WOLFSSL_DEVCRYPTO) && \
- (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))) || \
- (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES))
- ForceZero((byte*)aes->devKey, AES_MAX_KEY_SIZE/WOLFSSL_BIT_SIZE);
-#endif
-#if defined(WOLFSSL_IMXRT_DCP)
- DCPAesFree(aes);
-#endif
-#if defined(WOLFSSL_AESGCM_STREAM) && defined(WOLFSSL_SMALL_STACK) && \
- !defined(WOLFSSL_AESNI)
- if (aes->streamData != NULL) {
- ForceZero(aes->streamData, aes->streamData_sz);
- XFREE(aes->streamData, aes->heap, DYNAMIC_TYPE_AES);
- aes->streamData = NULL;
- }
-#endif
-
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- if (aes->useSWCrypt == 0) {
- se050_aes_free(aes);
- }
-#endif
-
-#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- wc_psa_aes_free(aes);
-#endif
-
-#ifdef WOLFSSL_MAXQ10XX_CRYPTO
- wc_MAXQ10XX_AesFree(aes);
-#endif
-
-#if ((defined(WOLFSSL_RENESAS_FSPSM_TLS) || \
- defined(WOLFSSL_RENESAS_FSPSM_CRYPTONLY)) && \
- !defined(NO_WOLFSSL_RENESAS_FSPSM_AES))
- wc_fspsm_Aesfree(aes);
-#endif
-
- ForceZero(aes, sizeof(Aes));
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(aes, sizeof(Aes));
-#endif
-}
-
-int wc_AesGetKeySize(Aes* aes, word32* keySize)
-{
- int ret = 0;
-
- if (aes == NULL || keySize == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
- return wc_psa_aes_get_key_size(aes, keySize);
-#endif
-#if defined(WOLFSSL_CRYPTOCELL) && defined(WOLFSSL_CRYPTOCELL_AES)
- *keySize = aes->ctx.key.keySize;
- return ret;
-#endif
- switch (aes->rounds) {
-#ifdef WOLFSSL_AES_128
- case 10:
- *keySize = 16;
- break;
-#endif
-#ifdef WOLFSSL_AES_192
- case 12:
- *keySize = 24;
- break;
-#endif
-#ifdef WOLFSSL_AES_256
- case 14:
- *keySize = 32;
- break;
-#endif
- default:
- *keySize = 0;
- ret = BAD_FUNC_ARG;
- }
-
- return ret;
-}
-
-#endif /* !WOLFSSL_TI_CRYPT */
-
-/* the earlier do-nothing default definitions for VECTOR_REGISTERS_{PUSH,POP}
- * are missed when WOLFSSL_TI_CRYPT or WOLFSSL_ARMASM.
- */
-#ifndef VECTOR_REGISTERS_PUSH
- #define VECTOR_REGISTERS_PUSH { WC_DO_NOTHING
-#endif
-#ifndef VECTOR_REGISTERS_POP
- #define VECTOR_REGISTERS_POP } WC_DO_NOTHING
-#endif
-
-#ifdef HAVE_AES_ECB
-#if defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES) && \
- !defined(WOLFSSL_QNX_CAAM)
- /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
-
-#elif defined(WOLFSSL_AFALG)
- /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
-
-#elif defined(WOLFSSL_DEVCRYPTO_AES)
- /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
-
-#elif defined(WOLFSSL_RISCV_ASM)
- /* implemented in wolfcrypt/src/port/riscv/riscv-64-aes.c */
-
-#elif defined(WOLFSSL_SILABS_SE_ACCEL)
- /* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
-
-#elif defined(MAX3266X_AES)
-
-int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- int status;
- word32 keySize;
-
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wc_MXC_TPU_AesEncrypt(in, (byte*)aes->reg, (byte*)aes->key,
- MXC_TPU_MODE_ECB, sz, out, keySize);
-
- return status;
-}
-
-#ifdef HAVE_AES_DECRYPT
-int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- int status;
- word32 keySize;
-
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
-
- status = wc_AesGetKeySize(aes, &keySize);
- if (status != 0) {
- return status;
- }
-
- status = wc_MXC_TPU_AesDecrypt(in, (byte*)aes->reg, (byte*)aes->key,
- MXC_TPU_MODE_ECB, sz, out, keySize);
-
- return status;
-}
-#endif /* HAVE_AES_DECRYPT */
-
-#elif defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
-
-/* Software AES - ECB */
-int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
-
- return AES_ECB_encrypt(aes, in, out, sz);
-}
-
-
-int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
-
- return AES_ECB_decrypt(aes, in, out, sz);
-}
-
-#else
-
-/* Software AES - ECB */
-static WARN_UNUSED_RESULT int _AesEcbEncrypt(
- Aes* aes, byte* out, const byte* in, word32 sz)
-{
- int ret = 0;
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- ret = wc_CryptoCb_AesEcbEncrypt(aes, out, in, sz);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- ret = 0;
- /* fall-through when unavailable */
- }
-#endif
-#ifdef WOLFSSL_IMXRT_DCP
- if (aes->keylen == 16)
- return DCPAesEcbEncrypt(aes, out, in, sz);
-#endif
-
- VECTOR_REGISTERS_PUSH;
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_encrypt_blocks_AARCH32(in, out, sz, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_encrypt(in, out, sz, (const unsigned char*)aes->key, aes->rounds);
-#endif
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- AES_ECB_encrypt_AESNI(in, out, sz, (byte*)aes->key, (int)aes->rounds);
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_encrypt_blocks_AARCH64(in, out, sz, (byte*)aes->key,
- (int)aes->rounds);
- }
- else
-#endif
- {
-#if defined(NEED_AES_TABLES)
- AesEncryptBlocks_C(aes, in, out, sz);
-#else
- word32 i;
-
- for (i = 0; i < sz; i += WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncryptDirect(aes, out, in);
- if (ret != 0)
- break;
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-#endif
- }
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-#ifdef HAVE_AES_DECRYPT
-static WARN_UNUSED_RESULT int _AesEcbDecrypt(
- Aes* aes, byte* out, const byte* in, word32 sz)
-{
- int ret = 0;
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (aes->devId != INVALID_DEVID)
- #endif
- {
- ret = wc_CryptoCb_AesEcbDecrypt(aes, out, in, sz);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- ret = 0;
- /* fall-through when unavailable */
- }
-#endif
-#ifdef WOLFSSL_IMXRT_DCP
- if (aes->keylen == 16)
- return DCPAesEcbDecrypt(aes, out, in, sz);
-#endif
-
- VECTOR_REGISTERS_PUSH;
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
-#ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- AES_decrypt_blocks_AARCH32(in, out, sz, (byte*)aes->key, (int)aes->rounds);
-#else
- AES_ECB_decrypt(in, out, sz, (const unsigned char*)aes->key, aes->rounds);
-#endif
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- AES_ECB_decrypt_AESNI(in, out, sz, (byte*)aes->key, (int)aes->rounds);
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_decrypt_blocks_AARCH64(in, out, sz, (byte*)aes->key,
- (int)aes->rounds);
- }
- else
-#endif
- {
-#if defined(NEED_AES_TABLES)
- AesDecryptBlocks_C(aes, in, out, sz);
-#else
- word32 i;
-
- for (i = 0; i < sz; i += WC_AES_BLOCK_SIZE) {
- ret = wc_AesDecryptDirect(aes, out, in);
- if (ret != 0)
- break;
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- }
-#endif
- }
-#endif
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-#endif
-
-int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
- if ((sz % WC_AES_BLOCK_SIZE) != 0) {
- return BAD_LENGTH_E;
- }
-
- return _AesEcbEncrypt(aes, out, in, sz);
-}
-
-#ifdef HAVE_AES_DECRYPT
-int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- if ((in == NULL) || (out == NULL) || (aes == NULL))
- return BAD_FUNC_ARG;
- if ((sz % WC_AES_BLOCK_SIZE) != 0) {
- return BAD_LENGTH_E;
- }
-
- return _AesEcbDecrypt(aes, out, in, sz);
-}
-#endif /* HAVE_AES_DECRYPT */
-#endif
-#endif /* HAVE_AES_ECB */
-
-#if defined(WOLFSSL_AES_CFB)
-/* Feedback AES mode
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- * mode flag to specify AES mode
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - CFB Encrypt */
-static WARN_UNUSED_RESULT int AesCfbEncrypt_C(Aes* aes, byte* out,
- const byte* in, word32 sz)
-{
- int ret = 0;
- word32 processed;
-
- if ((aes == NULL) || (out == NULL) || (in == NULL)) {
- return BAD_FUNC_ARG;
- }
- if (sz == 0) {
- return 0;
- }
-
- if (aes->left > 0) {
- /* consume any unused bytes left in aes->tmp */
- processed = min(aes->left, sz);
- xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left,
- processed);
- XMEMCPY((byte*)aes->reg + WC_AES_BLOCK_SIZE - aes->left, out,
- processed);
- aes->left -= processed;
- out += processed;
- in += processed;
- sz -= processed;
- }
-
- VECTOR_REGISTERS_PUSH;
-
- while (sz >= WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->reg, (byte*)aes->reg);
- if (ret != 0) {
- break;
- }
- xorbuf((byte*)aes->reg, in, WC_AES_BLOCK_SIZE);
- XMEMCPY(out, aes->reg, WC_AES_BLOCK_SIZE);
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- }
-
- /* encrypt left over data */
- if ((ret == 0) && sz) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret == 0) {
- xorbufout(out, in, aes->tmp, sz);
- XMEMCPY(aes->reg, out, sz);
- aes->left = WC_AES_BLOCK_SIZE - sz;
- }
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-
-#if defined(HAVE_AES_DECRYPT)
-/* CFB 128
- *
- * aes structure holding key to use for decryption
- * out buffer to hold result of decryption (must be at least as large as input
- * buffer)
- * in buffer to decrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - CFB Decrypt */
-static WARN_UNUSED_RESULT int AesCfbDecrypt_C(Aes* aes, byte* out,
- const byte* in, word32 sz, byte mode)
-{
- int ret = 0;
- word32 processed;
-
- (void)mode;
-
- if ((aes == NULL) || (out == NULL) || (in == NULL)) {
- return BAD_FUNC_ARG;
- }
- if (sz == 0) {
- return 0;
- }
-
- if (aes->left > 0) {
- /* consume any unused bytes left in aes->tmp */
- processed = min(aes->left, sz);
- /* copy input over to aes->reg */
- XMEMCPY((byte*)aes->reg + WC_AES_BLOCK_SIZE - aes->left, in, processed);
- xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left,
- processed);
- aes->left -= processed;
- out += processed;
- in += processed;
- sz -= processed;
- }
-
- VECTOR_REGISTERS_PUSH;
-
- #if !defined(WOLFSSL_SMALL_STACK) && defined(HAVE_AES_ECB) && \
- !defined(WOLFSSL_PIC32MZ_CRYPT) && \
- (defined(USE_INTEL_SPEEDUP) || defined(WOLFSSL_ARMASM))
- {
- ALIGN16 byte tmp[4 * WC_AES_BLOCK_SIZE];
- while (sz >= 4 * WC_AES_BLOCK_SIZE) {
- XMEMCPY(tmp, aes->reg, WC_AES_BLOCK_SIZE);
- XMEMCPY(tmp + WC_AES_BLOCK_SIZE, in, 3 * WC_AES_BLOCK_SIZE);
- XMEMCPY(aes->reg, in + 3 * WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- ret = wc_AesEcbEncrypt(aes, tmp, tmp, 4 * WC_AES_BLOCK_SIZE);
- if (ret != 0) {
- break;
- }
- xorbufout(out, in, tmp, 4 * WC_AES_BLOCK_SIZE);
- out += 4 * WC_AES_BLOCK_SIZE;
- in += 4 * WC_AES_BLOCK_SIZE;
- sz -= 4 * WC_AES_BLOCK_SIZE;
- }
- }
- #endif
- while (sz >= WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret != 0) {
- break;
- }
- XMEMCPY((byte*)aes->reg, in, WC_AES_BLOCK_SIZE);
- xorbufout(out, in, (byte*)aes->tmp, WC_AES_BLOCK_SIZE);
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- }
-
- /* decrypt left over data */
- if ((ret == 0) && sz) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret == 0) {
- XMEMCPY(aes->reg, in, sz);
- xorbufout(out, in, aes->tmp, sz);
- aes->left = WC_AES_BLOCK_SIZE - sz;
- }
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-#endif /* HAVE_AES_DECRYPT */
-
-/* CFB 128
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - CFB Encrypt */
-int wc_AesCfbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return AesCfbEncrypt_C(aes, out, in, sz);
-}
-
-
-#ifdef HAVE_AES_DECRYPT
-/* CFB 128
- *
- * aes structure holding key to use for decryption
- * out buffer to hold result of decryption (must be at least as large as input
- * buffer)
- * in buffer to decrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - CFB Decrypt */
-int wc_AesCfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return AesCfbDecrypt_C(aes, out, in, sz, AES_CFB_MODE);
-}
-#endif /* HAVE_AES_DECRYPT */
-
-#ifndef WOLFSSL_NO_AES_CFB_1_8
-/* shift the whole WC_AES_BLOCK_SIZE array left by 8 or 1 bits */
-static void shiftLeftArray(byte* ary, byte shift)
-{
- int i;
-
- if (shift == WOLFSSL_BIT_SIZE) {
- /* shifting over by 8 bits */
- for (i = 0; i < WC_AES_BLOCK_SIZE - 1; i++) {
- ary[i] = ary[i+1];
- }
- ary[i] = 0;
- }
- else {
- /* shifting over by 7 or less bits */
- for (i = 0; i < WC_AES_BLOCK_SIZE - 1; i++) {
- byte carry = (byte)(ary[i+1] & (0XFF << (WOLFSSL_BIT_SIZE - shift)));
- carry = (byte)(carry >> (WOLFSSL_BIT_SIZE - shift));
- ary[i] = (byte)((ary[i] << shift) + carry);
- }
- ary[i] = (byte)(ary[i] << shift);
- }
-}
-
-
-/* returns 0 on success and negative values on failure */
-static WARN_UNUSED_RESULT int wc_AesFeedbackCFB8(
- Aes* aes, byte* out, const byte* in, word32 sz, byte dir)
-{
- byte *pt;
- int ret = 0;
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if (sz == 0) {
- return 0;
- }
-
- VECTOR_REGISTERS_PUSH;
-
- while (sz > 0) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret != 0)
- break;
- if (dir == AES_DECRYPTION) {
- pt = (byte*)aes->reg;
-
- /* LSB + CAT */
- shiftLeftArray(pt, WOLFSSL_BIT_SIZE);
- pt[WC_AES_BLOCK_SIZE - 1] = in[0];
- }
-
- /* MSB + XOR */
- #ifdef BIG_ENDIAN_ORDER
- ByteReverseWords(aes->tmp, aes->tmp, WC_AES_BLOCK_SIZE);
- #endif
- out[0] = (byte)(aes->tmp[0] ^ in[0]);
- if (dir == AES_ENCRYPTION) {
- pt = (byte*)aes->reg;
-
- /* LSB + CAT */
- shiftLeftArray(pt, WOLFSSL_BIT_SIZE);
- pt[WC_AES_BLOCK_SIZE - 1] = out[0];
- }
-
- out += 1;
- in += 1;
- sz -= 1;
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-
-/* returns 0 on success and negative values on failure */
-static WARN_UNUSED_RESULT int wc_AesFeedbackCFB1(
- Aes* aes, byte* out, const byte* in, word32 sz, byte dir)
-{
- byte tmp;
- byte cur = 0; /* hold current work in order to handle inline in=out */
- byte* pt;
- int bit = 7;
- int ret = 0;
-
- if (aes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if (sz == 0) {
- return 0;
- }
-
- VECTOR_REGISTERS_PUSH;
-
- while (sz > 0) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret != 0)
- break;
- if (dir == AES_DECRYPTION) {
- pt = (byte*)aes->reg;
-
- /* LSB + CAT */
- tmp = (byte)((0X01U << bit) & in[0]);
- tmp = (byte)(tmp >> bit);
- tmp &= 0x01;
- shiftLeftArray((byte*)aes->reg, 1);
- pt[WC_AES_BLOCK_SIZE - 1] |= tmp;
- }
-
- /* MSB + XOR */
- tmp = (byte)((0X01U << bit) & in[0]);
- pt = (byte*)aes->tmp;
- tmp = (byte)((pt[0] >> 7) ^ (tmp >> bit));
- tmp &= 0x01;
- cur = (byte)(cur | (tmp << bit));
-
-
- if (dir == AES_ENCRYPTION) {
- pt = (byte*)aes->reg;
-
- /* LSB + CAT */
- shiftLeftArray((byte*)aes->reg, 1);
- pt[WC_AES_BLOCK_SIZE - 1] |= tmp;
- }
-
- bit--;
- if (bit < 0) {
- out[0] = cur;
- out += 1;
- in += 1;
- sz -= 1;
- bit = 7U;
- cur = 0;
- }
- else {
- sz -= 1;
- }
- }
-
- if (ret == 0) {
- if (bit >= 0 && bit < 7) {
- out[0] = cur;
- }
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-
-/* CFB 1
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt (packed to left, i.e. 101 is 0x90)
- * sz size of input buffer in bits (0x1 would be size of 1 and 0xFF size of 8)
- *
- * returns 0 on success and negative values on failure
- */
-int wc_AesCfb1Encrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return wc_AesFeedbackCFB1(aes, out, in, sz, AES_ENCRYPTION);
-}
-
-
-/* CFB 8
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative values on failure
- */
-int wc_AesCfb8Encrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return wc_AesFeedbackCFB8(aes, out, in, sz, AES_ENCRYPTION);
-}
-#ifdef HAVE_AES_DECRYPT
-
-/* CFB 1
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer in bits (0x1 would be size of 1 and 0xFF size of 8)
- *
- * returns 0 on success and negative values on failure
- */
-int wc_AesCfb1Decrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return wc_AesFeedbackCFB1(aes, out, in, sz, AES_DECRYPTION);
-}
-
-
-/* CFB 8
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative values on failure
- */
-int wc_AesCfb8Decrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return wc_AesFeedbackCFB8(aes, out, in, sz, AES_DECRYPTION);
-}
-#endif /* HAVE_AES_DECRYPT */
-#endif /* !WOLFSSL_NO_AES_CFB_1_8 */
-#endif /* WOLFSSL_AES_CFB */
-
-#ifdef WOLFSSL_AES_OFB
-/* OFB AES mode
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - OFB Encrypt/Decrypt */
-static WARN_UNUSED_RESULT int AesOfbCrypt_C(Aes* aes, byte* out, const byte* in,
- word32 sz)
-{
- int ret = 0;
- word32 processed;
-
- if ((aes == NULL) || (out == NULL) || (in == NULL)) {
- return BAD_FUNC_ARG;
- }
- if (sz == 0) {
- return 0;
- }
-
- if (aes->left > 0) {
- /* consume any unused bytes left in aes->tmp */
- processed = min(aes->left, sz);
- xorbufout(out, in, (byte*)aes->tmp + WC_AES_BLOCK_SIZE - aes->left,
- processed);
- aes->left -= processed;
- out += processed;
- in += processed;
- sz -= processed;
- }
-
- VECTOR_REGISTERS_PUSH;
-
- while (sz >= WC_AES_BLOCK_SIZE) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->reg, (byte*)aes->reg);
- if (ret != 0) {
- break;
- }
- xorbufout(out, in, (byte*)aes->reg, WC_AES_BLOCK_SIZE);
- out += WC_AES_BLOCK_SIZE;
- in += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- }
-
- /* encrypt left over data */
- if ((ret == 0) && sz) {
- ret = wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
- if (ret == 0) {
- XMEMCPY(aes->reg, aes->tmp, WC_AES_BLOCK_SIZE);
- xorbufout(out, in, aes->tmp, sz);
- aes->left = WC_AES_BLOCK_SIZE - sz;
- }
- }
-
- VECTOR_REGISTERS_POP;
-
- return ret;
-}
-
-/* OFB
- *
- * aes structure holding key to use for encryption
- * out buffer to hold result of encryption (must be at least as large as input
- * buffer)
- * in buffer to encrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - OFB Encrypt */
-int wc_AesOfbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return AesOfbCrypt_C(aes, out, in, sz);
-}
-
-
-#ifdef HAVE_AES_DECRYPT
-/* OFB
- *
- * aes structure holding key to use for decryption
- * out buffer to hold result of decryption (must be at least as large as input
- * buffer)
- * in buffer to decrypt
- * sz size of input buffer
- *
- * returns 0 on success and negative error values on failure
- */
-/* Software AES - OFB Decrypt */
-int wc_AesOfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
- return AesOfbCrypt_C(aes, out, in, sz);
-}
-#endif /* HAVE_AES_DECRYPT */
-#endif /* WOLFSSL_AES_OFB */
-
-
-#ifdef HAVE_AES_KEYWRAP
-
-/* Initialize key wrap counter with value */
-static WC_INLINE void InitKeyWrapCounter(byte* inOutCtr, word32 value)
-{
- word32 i;
- word32 bytes;
-
- bytes = sizeof(word32);
- for (i = 0; i < sizeof(word32); i++) {
- inOutCtr[i+sizeof(word32)] = (byte)(value >> ((bytes - 1) * 8));
- bytes--;
- }
-}
-
-/* Increment key wrap counter */
-static WC_INLINE void IncrementKeyWrapCounter(byte* inOutCtr)
-{
- int i;
-
- /* in network byte order so start at end and work back */
- for (i = KEYWRAP_BLOCK_SIZE - 1; i >= 0; i--) {
- if (++inOutCtr[i]) /* we're done unless we overflow */
- return;
- }
-}
-
-/* Decrement key wrap counter */
-static WC_INLINE void DecrementKeyWrapCounter(byte* inOutCtr)
-{
- int i;
-
- for (i = KEYWRAP_BLOCK_SIZE - 1; i >= 0; i--) {
- if (--inOutCtr[i] != 0xFF) /* we're done unless we underflow */
- return;
- }
-}
-
-int wc_AesKeyWrap_ex(Aes *aes, const byte* in, word32 inSz, byte* out,
- word32 outSz, const byte* iv)
-{
- word32 i;
- byte* r;
- int j;
- int ret = 0;
-
- byte t[KEYWRAP_BLOCK_SIZE];
- byte tmp[WC_AES_BLOCK_SIZE];
-
- /* n must be at least 2 64-bit blocks, output size is (n + 1) 8 bytes (64-bit) */
- if (aes == NULL || in == NULL || inSz < 2*KEYWRAP_BLOCK_SIZE ||
- out == NULL || outSz < (inSz + KEYWRAP_BLOCK_SIZE))
- return BAD_FUNC_ARG;
-
- /* input must be multiple of 64-bits */
- if (inSz % KEYWRAP_BLOCK_SIZE != 0)
- return BAD_FUNC_ARG;
-
- r = out + 8;
- XMEMCPY(r, in, inSz);
- XMEMSET(t, 0, sizeof(t));
-
- /* user IV is optional */
- if (iv == NULL) {
- XMEMSET(tmp, 0xA6, KEYWRAP_BLOCK_SIZE);
- } else {
- XMEMCPY(tmp, iv, KEYWRAP_BLOCK_SIZE);
- }
-
- VECTOR_REGISTERS_PUSH;
-
- for (j = 0; j <= 5; j++) {
- for (i = 1; i <= inSz / KEYWRAP_BLOCK_SIZE; i++) {
- /* load R[i] */
- XMEMCPY(tmp + KEYWRAP_BLOCK_SIZE, r, KEYWRAP_BLOCK_SIZE);
-
- ret = wc_AesEncryptDirect(aes, tmp, tmp);
- if (ret != 0)
- break;
-
- /* calculate new A */
- IncrementKeyWrapCounter(t);
- xorbuf(tmp, t, KEYWRAP_BLOCK_SIZE);
-
- /* save R[i] */
- XMEMCPY(r, tmp + KEYWRAP_BLOCK_SIZE, KEYWRAP_BLOCK_SIZE);
- r += KEYWRAP_BLOCK_SIZE;
- }
- if (ret != 0)
- break;
- r = out + KEYWRAP_BLOCK_SIZE;
- }
-
- VECTOR_REGISTERS_POP;
-
- if (ret != 0)
- return ret;
-
- /* C[0] = A */
- XMEMCPY(out, tmp, KEYWRAP_BLOCK_SIZE);
-
- return (int)(inSz + KEYWRAP_BLOCK_SIZE);
-}
-
-/* perform AES key wrap (RFC3394), return out sz on success, negative on err */
-int wc_AesKeyWrap(const byte* key, word32 keySz, const byte* in, word32 inSz,
- byte* out, word32 outSz, const byte* iv)
-{
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- int ret;
-
- if (key == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_SMALL_STACK
- if ((aes = (Aes *)XMALLOC(sizeof *aes, NULL,
- DYNAMIC_TYPE_AES)) == NULL)
- return MEMORY_E;
-#endif
-
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
- if (ret != 0)
- goto out;
-
- ret = wc_AesSetKey(aes, key, keySz, NULL, AES_ENCRYPTION);
- if (ret != 0) {
- wc_AesFree(aes);
- goto out;
- }
-
- ret = wc_AesKeyWrap_ex(aes, in, inSz, out, outSz, iv);
-
- wc_AesFree(aes);
-
- out:
- WC_FREE_VAR_EX(aes, NULL, DYNAMIC_TYPE_AES);
-
- return ret;
-}
-
-int wc_AesKeyUnWrap_ex(Aes *aes, const byte* in, word32 inSz, byte* out,
- word32 outSz, const byte* iv)
-{
- byte* r;
- word32 i, n;
- int j;
- int ret = 0;
-
- byte t[KEYWRAP_BLOCK_SIZE];
- byte tmp[WC_AES_BLOCK_SIZE];
-
- const byte* expIv;
- const byte defaultIV[] = {
- 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6
- };
-
- if (aes == NULL || in == NULL || inSz < 3 * KEYWRAP_BLOCK_SIZE ||
- out == NULL || outSz < (inSz - KEYWRAP_BLOCK_SIZE))
- return BAD_FUNC_ARG;
-
- /* input must be multiple of 64-bits */
- if (inSz % KEYWRAP_BLOCK_SIZE != 0)
- return BAD_FUNC_ARG;
-
- /* user IV optional */
- if (iv != NULL)
- expIv = iv;
- else
- expIv = defaultIV;
-
- /* A = C[0], R[i] = C[i] */
- XMEMCPY(tmp, in, KEYWRAP_BLOCK_SIZE);
- XMEMCPY(out, in + KEYWRAP_BLOCK_SIZE, inSz - KEYWRAP_BLOCK_SIZE);
- XMEMSET(t, 0, sizeof(t));
-
- VECTOR_REGISTERS_PUSH;
-
- /* initialize counter to 6n */
- n = (inSz - 1) / KEYWRAP_BLOCK_SIZE;
- InitKeyWrapCounter(t, 6 * n);
-
- for (j = 5; j >= 0; j--) {
- for (i = n; i >= 1; i--) {
-
- /* calculate A */
- xorbuf(tmp, t, KEYWRAP_BLOCK_SIZE);
- DecrementKeyWrapCounter(t);
-
- /* load R[i], starting at end of R */
- r = out + ((i - 1) * KEYWRAP_BLOCK_SIZE);
- XMEMCPY(tmp + KEYWRAP_BLOCK_SIZE, r, KEYWRAP_BLOCK_SIZE);
- ret = wc_AesDecryptDirect(aes, tmp, tmp);
- if (ret != 0)
- break;
-
- /* save R[i] */
- XMEMCPY(r, tmp + KEYWRAP_BLOCK_SIZE, KEYWRAP_BLOCK_SIZE);
- }
- if (ret != 0)
- break;
- }
-
- VECTOR_REGISTERS_POP;
-
- if (ret != 0)
- return ret;
-
- /* verify IV */
- if (XMEMCMP(tmp, expIv, KEYWRAP_BLOCK_SIZE) != 0)
- return BAD_KEYWRAP_IV_E;
-
- return (int)(inSz - KEYWRAP_BLOCK_SIZE);
-}
-
-int wc_AesKeyUnWrap(const byte* key, word32 keySz, const byte* in, word32 inSz,
- byte* out, word32 outSz, const byte* iv)
-{
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- int ret;
-
- (void)iv;
-
- if (key == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_SMALL_STACK
- if ((aes = (Aes *)XMALLOC(sizeof *aes, NULL,
- DYNAMIC_TYPE_AES)) == NULL)
- return MEMORY_E;
-#endif
-
-
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
- if (ret != 0)
- goto out;
-
- ret = wc_AesSetKey(aes, key, keySz, NULL, AES_DECRYPTION);
- if (ret != 0) {
- wc_AesFree(aes);
- goto out;
- }
-
- ret = wc_AesKeyUnWrap_ex(aes, in, inSz, out, outSz, iv);
-
- wc_AesFree(aes);
-
- out:
- WC_FREE_VAR_EX(aes, NULL, DYNAMIC_TYPE_AES);
-
- return ret;
-}
-
-#endif /* HAVE_AES_KEYWRAP */
-
-#ifdef WOLFSSL_AES_XTS
-
-/* Galois Field to use */
-#define GF_XTS 0x87
-
-/* Set up keys for encryption and/or decryption.
- *
- * aes buffer holding aes subkeys
- * heap heap hint to use for memory. Can be NULL
- * devId id to use with async crypto. Can be 0
- *
- * return 0 on success
- */
-int wc_AesXtsInit(XtsAes* aes, void* heap, int devId)
-{
- int ret = 0;
-
- if (aes == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if ((ret = wc_AesInit(&aes->tweak, heap, devId)) != 0) {
- return ret;
- }
- if ((ret = wc_AesInit(&aes->aes, heap, devId)) != 0) {
- (void)wc_AesFree(&aes->tweak);
- return ret;
- }
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- if ((ret = wc_AesInit(&aes->aes_decrypt, heap, devId)) != 0) {
- (void)wc_AesFree(&aes->tweak);
- (void)wc_AesFree(&aes->aes);
- return ret;
- }
-#endif
-
- return 0;
-}
-
-/* Set up keys for encryption and/or decryption.
- *
- * aes buffer holding aes subkeys
- * key AES key for encrypt/decrypt and tweak process (concatenated)
- * len length of key buffer in bytes. Should be twice that of key size. i.e.
- * 32 for a 16 byte key.
- * dir direction: AES_ENCRYPTION, AES_DECRYPTION, or
- * AES_ENCRYPTION_AND_DECRYPTION
- *
- * return 0 on success
- */
-int wc_AesXtsSetKeyNoInit(XtsAes* aes, const byte* key, word32 len, int dir)
-{
- word32 keySz;
- int ret = 0;
-
- if (aes == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if ((dir != AES_ENCRYPTION) && (dir != AES_DECRYPTION)
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- && (dir != AES_ENCRYPTION_AND_DECRYPTION)
-#endif
- )
- {
- return BAD_FUNC_ARG;
- }
-
- if ((len != (AES_128_KEY_SIZE*2)) &&
-#ifndef HAVE_FIPS
- /* XTS-384 not allowed by FIPS and can not be treated like
- * RSA-4096 bit keys back in the day, can not vendor affirm
- * the use of 2 concatenated 192-bit keys (XTS-384) */
- (len != (AES_192_KEY_SIZE*2)) &&
-#endif
- (len != (AES_256_KEY_SIZE*2)))
- {
- WOLFSSL_MSG("Unsupported key size");
- return WC_KEY_SIZE_E;
- }
-
- keySz = len/2;
-
-#ifdef HAVE_FIPS
- if (XMEMCMP(key, key + keySz, keySz) == 0) {
- WOLFSSL_MSG("FIPS AES-XTS main and tweak keys must differ");
- return BAD_FUNC_ARG;
- }
-#endif
-
- if (dir == AES_ENCRYPTION
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- || dir == AES_ENCRYPTION_AND_DECRYPTION
-#endif
- )
- {
- ret = wc_AesSetKey(&aes->aes, key, keySz, NULL, AES_ENCRYPTION);
- }
-
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- if ((ret == 0) && ((dir == AES_DECRYPTION)
- || (dir == AES_ENCRYPTION_AND_DECRYPTION)))
- ret = wc_AesSetKey(&aes->aes_decrypt, key, keySz, NULL, AES_DECRYPTION);
-#else
- if (dir == AES_DECRYPTION)
- ret = wc_AesSetKey(&aes->aes, key, keySz, NULL, AES_DECRYPTION);
-#endif
-
- if (ret == 0)
- ret = wc_AesSetKey(&aes->tweak, key + keySz, keySz, NULL,
- AES_ENCRYPTION);
-
-#ifdef WOLFSSL_AESNI
- if (ret == 0) {
- /* With WC_C_DYNAMIC_FALLBACK, the main and tweak keys could have
- * conflicting _aesni status, but the AES-XTS asm implementations need
- * them to all be AESNI. If any aren't, disable AESNI on all.
- */
- #ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- if ((((dir == AES_ENCRYPTION) ||
- (dir == AES_ENCRYPTION_AND_DECRYPTION))
- && (aes->aes.use_aesni != aes->tweak.use_aesni))
- ||
- (((dir == AES_DECRYPTION) ||
- (dir == AES_ENCRYPTION_AND_DECRYPTION))
- && (aes->aes_decrypt.use_aesni != aes->tweak.use_aesni)))
- {
- #ifdef WC_C_DYNAMIC_FALLBACK
- aes->aes.use_aesni = 0;
- aes->aes_decrypt.use_aesni = 0;
- aes->tweak.use_aesni = 0;
- #else
- ret = SYSLIB_FAILED_E;
- #endif
- }
- #else /* !WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS */
- if (aes->aes.use_aesni != aes->tweak.use_aesni) {
- #ifdef WC_C_DYNAMIC_FALLBACK
- aes->aes.use_aesni = 0;
- aes->tweak.use_aesni = 0;
- #else
- ret = SYSLIB_FAILED_E;
- #endif
- }
- #endif /* !WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS */
- }
-#endif /* WOLFSSL_AESNI */
-
- return ret;
-}
-
-/* Combined call to wc_AesXtsInit() and wc_AesXtsSetKeyNoInit().
- *
- * Note: is up to user to call wc_AesXtsFree when done.
- *
- * return 0 on success
- */
-int wc_AesXtsSetKey(XtsAes* aes, const byte* key, word32 len, int dir,
- void* heap, int devId)
-{
- int ret = 0;
-
- if (aes == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- ret = wc_AesXtsInit(aes, heap, devId);
- if (ret != 0)
- return ret;
-
- ret = wc_AesXtsSetKeyNoInit(aes, key, len, dir);
-
- if (ret != 0)
- wc_AesXtsFree(aes);
-
- return ret;
-}
-
-
-/* This is used to free up resources used by Aes structs
- *
- * aes AES keys to free
- *
- * return 0 on success
- */
-int wc_AesXtsFree(XtsAes* aes)
-{
- if (aes != NULL) {
- wc_AesFree(&aes->aes);
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- wc_AesFree(&aes->aes_decrypt);
-#endif
- wc_AesFree(&aes->tweak);
- }
-
- return 0;
-}
-
-
-/* Same process as wc_AesXtsEncrypt but uses a word64 type as the tweak value
- * instead of a byte array. This just converts the word64 to a byte array and
- * calls wc_AesXtsEncrypt.
- *
- * aes AES keys to use for block encrypt/decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- * sector value to use for tweak
- *
- * returns 0 on success
- */
-int wc_AesXtsEncryptSector(XtsAes* aes, byte* out, const byte* in,
- word32 sz, word64 sector)
-{
- byte* pt;
- byte i[WC_AES_BLOCK_SIZE];
-
- XMEMSET(i, 0, WC_AES_BLOCK_SIZE);
-#ifdef BIG_ENDIAN_ORDER
- sector = ByteReverseWord64(sector);
-#endif
- pt = (byte*)§or;
- XMEMCPY(i, pt, sizeof(word64));
-
- return wc_AesXtsEncrypt(aes, out, in, sz, (const byte*)i, WC_AES_BLOCK_SIZE);
-}
-
-#ifdef HAVE_AES_DECRYPT
-/* Same process as wc_AesXtsDecrypt but uses a word64 type as the tweak value
- * instead of a byte array. This just converts the word64 to a byte array.
- *
- * aes AES keys to use for block encrypt/decrypt
- * out output buffer to hold plain text
- * in input cipher text buffer to encrypt
- * sz size of both out and in buffers
- * sector value to use for tweak
- *
- * returns 0 on success
- */
-int wc_AesXtsDecryptSector(XtsAes* aes, byte* out, const byte* in, word32 sz,
- word64 sector)
-{
- byte* pt;
- byte i[WC_AES_BLOCK_SIZE];
-
- XMEMSET(i, 0, WC_AES_BLOCK_SIZE);
-#ifdef BIG_ENDIAN_ORDER
- sector = ByteReverseWord64(sector);
-#endif
- pt = (byte*)§or;
- XMEMCPY(i, pt, sizeof(word64));
-
- return wc_AesXtsDecrypt(aes, out, in, sz, (const byte*)i, WC_AES_BLOCK_SIZE);
-}
-#endif
-
-#ifdef WOLFSSL_AESNI
-
-#if defined(USE_INTEL_SPEEDUP_FOR_AES) && !defined(USE_INTEL_SPEEDUP)
- #define USE_INTEL_SPEEDUP
-#endif
-
-#if defined(USE_INTEL_SPEEDUP)
- #define HAVE_INTEL_AVX1
- #define HAVE_INTEL_AVX2
-#endif /* USE_INTEL_SPEEDUP */
-
-void AES_XTS_encrypt_aesni(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* i, const unsigned char* key,
- const unsigned char* key2, int nr)
- XASM_LINK("AES_XTS_encrypt_aesni");
-#ifdef WOLFSSL_AESXTS_STREAM
-void AES_XTS_init_aesni(unsigned char* i, const unsigned char* tweak_key,
- int tweak_nr)
- XASM_LINK("AES_XTS_init_aesni");
-void AES_XTS_encrypt_update_aesni(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* key, unsigned char *i, int nr)
- XASM_LINK("AES_XTS_encrypt_update_aesni");
-#endif
-#ifdef HAVE_INTEL_AVX1
-void AES_XTS_encrypt_avx1(const unsigned char *in, unsigned char *out,
- word32 sz, const unsigned char* i,
- const unsigned char* key, const unsigned char* key2,
- int nr)
- XASM_LINK("AES_XTS_encrypt_avx1");
-#ifdef WOLFSSL_AESXTS_STREAM
-void AES_XTS_init_avx1(unsigned char* i, const unsigned char* tweak_key,
- int tweak_nr)
- XASM_LINK("AES_XTS_init_avx1");
-void AES_XTS_encrypt_update_avx1(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* key, unsigned char *i, int nr)
- XASM_LINK("AES_XTS_encrypt_update_avx1");
-#endif
-#endif /* HAVE_INTEL_AVX1 */
-
-#ifdef HAVE_AES_DECRYPT
-void AES_XTS_decrypt_aesni(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* i, const unsigned char* key,
- const unsigned char* key2, int nr)
- XASM_LINK("AES_XTS_decrypt_aesni");
-#ifdef WOLFSSL_AESXTS_STREAM
-void AES_XTS_decrypt_update_aesni(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* key, unsigned char *i, int nr)
- XASM_LINK("AES_XTS_decrypt_update_aesni");
-#endif
-#ifdef HAVE_INTEL_AVX1
-void AES_XTS_decrypt_avx1(const unsigned char *in, unsigned char *out,
- word32 sz, const unsigned char* i,
- const unsigned char* key, const unsigned char* key2,
- int nr)
- XASM_LINK("AES_XTS_decrypt_avx1");
-#ifdef WOLFSSL_AESXTS_STREAM
-void AES_XTS_decrypt_update_avx1(const unsigned char *in, unsigned char *out, word32 sz,
- const unsigned char* key, unsigned char *i, int nr)
- XASM_LINK("AES_XTS_decrypt_update_avx1");
-#endif
-#endif /* HAVE_INTEL_AVX1 */
-#endif /* HAVE_AES_DECRYPT */
-
-#endif /* WOLFSSL_AESNI */
-
-#ifdef HAVE_AES_ECB
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-/* helper function for encrypting / decrypting full buffer at once */
-static WARN_UNUSED_RESULT int _AesXtsHelper(
- Aes* aes, byte* out, const byte* in, word32 sz, int dir)
-{
- word32 outSz = sz;
- word32 totalSz = (sz / WC_AES_BLOCK_SIZE) * WC_AES_BLOCK_SIZE; /* total bytes */
- byte* pt = out;
-
- outSz -= WC_AES_BLOCK_SIZE;
-
- while (outSz > 0) {
- word32 j;
- byte carry = 0;
-
- /* multiply by shift left and propagate carry */
- for (j = 0; j < WC_AES_BLOCK_SIZE && outSz > 0; j++, outSz--) {
- byte tmpC;
-
- tmpC = (pt[j] >> 7) & 0x01;
- pt[j+WC_AES_BLOCK_SIZE] = (byte)((pt[j] << 1) + carry);
- carry = tmpC;
- }
- if (carry) {
- pt[WC_AES_BLOCK_SIZE] ^= GF_XTS;
- }
-
- pt += WC_AES_BLOCK_SIZE;
- }
-
- xorbuf(out, in, totalSz);
-#ifndef WOLFSSL_RISCV_ASM
- if (dir == AES_ENCRYPTION) {
- return _AesEcbEncrypt(aes, out, out, totalSz);
- }
- else {
- return _AesEcbDecrypt(aes, out, out, totalSz);
- }
-#else
- if (dir == AES_ENCRYPTION) {
- return wc_AesEcbEncrypt(aes, out, out, totalSz);
- }
- else {
- return wc_AesEcbDecrypt(aes, out, out, totalSz);
- }
-#endif
-}
-#endif
-#endif /* HAVE_AES_ECB */
-
-/* AES with XTS mode. (XTS) XEX encryption with Tweak and cipher text Stealing.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- * i value to use for tweak
- *
- * returns 0 on success
- */
-/* Software AES - XTS Encrypt */
-
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-static int AesXtsEncryptUpdate_sw(XtsAes* xaes, byte* out, const byte* in,
- word32 sz,
- byte *i);
-static int AesXtsEncrypt_sw(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- const byte* i)
-{
- int ret;
- byte tweak_block[WC_AES_BLOCK_SIZE];
-
- ret = wc_AesEncryptDirect(&xaes->tweak, tweak_block, i);
- if (ret != 0)
- return ret;
-
- return AesXtsEncryptUpdate_sw(xaes, out, in, sz, tweak_block);
-}
-
-#ifdef WOLFSSL_AESXTS_STREAM
-
-/* Block-streaming AES-XTS tweak setup.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * i readwrite value to use for tweak
- *
- * returns 0 on success
- */
-static int AesXtsInitTweak_sw(XtsAes* xaes, byte* i) {
- return wc_AesEncryptDirect(&xaes->tweak, i, i);
-}
-
-#endif /* WOLFSSL_AESXTS_STREAM */
-
-/* Block-streaming AES-XTS.
- *
- * Supply block-aligned input data with successive calls. Final call need not
- * be block aligned.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- *
- * returns 0 on success
- */
-/* Software AES - XTS Encrypt */
-static int AesXtsEncryptUpdate_sw(XtsAes* xaes, byte* out, const byte* in,
- word32 sz,
- byte *i)
-{
- int ret = 0;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
- Aes *aes = &xaes->aes;
-
-#ifdef HAVE_AES_ECB
- /* encrypt all of buffer at once when possible */
- if (in != out) { /* can not handle inline */
- XMEMCPY(out, i, WC_AES_BLOCK_SIZE);
- if ((ret = _AesXtsHelper(aes, out, in, sz, AES_ENCRYPTION)) != 0)
- return ret;
- }
-#endif
-
- while (blocks > 0) {
- word32 j;
- byte carry = 0;
-
-#ifdef HAVE_AES_ECB
- if (in == out)
-#endif
- { /* check for if inline */
- byte buf[WC_AES_BLOCK_SIZE];
-
- XMEMCPY(buf, in, WC_AES_BLOCK_SIZE);
- xorbuf(buf, i, WC_AES_BLOCK_SIZE);
- ret = wc_AesEncryptDirect(aes, out, buf);
- if (ret != 0)
- return ret;
- }
- xorbuf(out, i, WC_AES_BLOCK_SIZE);
-
- /* multiply by shift left and propagate carry */
- for (j = 0; j < WC_AES_BLOCK_SIZE; j++) {
- byte tmpC;
-
- tmpC = (i[j] >> 7) & 0x01;
- i[j] = (byte)((i[j] << 1) + carry);
- carry = tmpC;
- }
- if (carry) {
- i[0] ^= GF_XTS;
- }
-
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- blocks--;
- }
-
- /* stealing operation of XTS to handle left overs */
- if (sz > 0) {
- byte buf[WC_AES_BLOCK_SIZE];
-
- XMEMCPY(buf, out - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- if (sz >= WC_AES_BLOCK_SIZE) { /* extra sanity check before copy */
- return BUFFER_E;
- }
- if (in != out) {
- XMEMCPY(out, buf, sz);
- XMEMCPY(buf, in, sz);
- }
- else {
- byte buf2[WC_AES_BLOCK_SIZE];
-
- XMEMCPY(buf2, buf, sz);
- XMEMCPY(buf, in, sz);
- XMEMCPY(out, buf2, sz);
- }
-
- xorbuf(buf, i, WC_AES_BLOCK_SIZE);
- ret = wc_AesEncryptDirect(aes, out - WC_AES_BLOCK_SIZE, buf);
- if (ret == 0)
- xorbuf(out - WC_AES_BLOCK_SIZE, i, WC_AES_BLOCK_SIZE);
- }
-
- return ret;
-}
-#endif
-
-/* AES with XTS mode. (XTS) XEX encryption with Tweak and cipher text Stealing.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- * i value to use for tweak
- * iSz size of i buffer, should always be WC_AES_BLOCK_SIZE but having this input
- * adds a sanity check on how the user calls the function.
- *
- * returns 0 on success
- */
-int wc_AesXtsEncrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- const byte* i, word32 iSz)
-{
- int ret;
-
- Aes *aes;
-
- if (xaes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if FIPS_VERSION3_GE(6,0,0)
- /* SP800-38E - Restrict data unit to 2^20 blocks per key. A block is
- * WC_AES_BLOCK_SIZE or 16-bytes (128-bits). So each key may only be used to
- * protect up to 1,048,576 blocks of WC_AES_BLOCK_SIZE (16,777,216 bytes)
- */
- if (sz > FIPS_AES_XTS_MAX_BYTES_PER_TWEAK) {
- WOLFSSL_MSG("Request exceeds allowed bytes per SP800-38E");
- return BAD_FUNC_ARG;
- }
-#endif
-
- aes = &xaes->aes;
-
- if (aes->keylen == 0) {
- WOLFSSL_MSG("wc_AesXtsEncrypt called with unset encryption key.");
- return BAD_FUNC_ARG;
- }
-
- if (iSz < WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Plain text input too small for encryption");
- return BAD_FUNC_ARG;
- }
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- AES_XTS_encrypt_AARCH32(in, out, sz, i, (byte*)xaes->aes.key,
- (byte*)xaes->tweak.key, (byte*)xaes->aes.tmp, xaes->aes.rounds);
- ret = 0;
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_encrypt_avx1(in, out, sz, i,
- (const byte*)aes->key,
- (const byte*)xaes->tweak.key,
- (int)aes->rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_encrypt_aesni(in, out, sz, i,
- (const byte*)aes->key,
- (const byte*)xaes->tweak.key,
- (int)aes->rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_XTS_encrypt_AARCH64(in, out, sz, i, (byte*)xaes->aes.key,
- (byte*)xaes->tweak.key, (byte*)xaes->aes.tmp, xaes->aes.rounds);
- ret = 0;
- }
- else
-#endif
- {
- ret = AesXtsEncrypt_sw(xaes, out, in, sz, i);
- }
-#endif
-
- return ret;
-}
-
-#ifdef WOLFSSL_AESXTS_STREAM
-
-/* Block-streaming AES-XTS.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * i readwrite value to use for tweak
- * iSz size of i buffer, should always be WC_AES_BLOCK_SIZE but having this input
- * adds a sanity check on how the user calls the function.
- *
- * returns 0 on success
- */
-int wc_AesXtsEncryptInit(XtsAes* xaes, const byte* i, word32 iSz,
- struct XtsAesStreamData *stream)
-{
- int ret;
-
- Aes *aes;
-
- if ((xaes == NULL) || (i == NULL) || (stream == NULL)) {
- return BAD_FUNC_ARG;
- }
-
- if (iSz < WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- aes = &xaes->aes;
-
- if (aes->keylen == 0) {
- WOLFSSL_MSG("wc_AesXtsEncrypt called with unset encryption key.");
- return BAD_FUNC_ARG;
- }
-
- XMEMCPY(stream->tweak_block, i, WC_AES_BLOCK_SIZE);
- stream->bytes_crypted_with_this_tweak = 0;
-
- {
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_init_avx1(stream->tweak_block,
- (const byte*)xaes->tweak.key,
- (int)xaes->tweak.rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_init_aesni(stream->tweak_block,
- (const byte*)xaes->tweak.key,
- (int)xaes->tweak.rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AesXtsInitTweak_sw(xaes, stream->tweak_block);
- }
- }
-
- return ret;
-}
-
-/* Block-streaming AES-XTS
- *
- * Note that sz must be >= WC_AES_BLOCK_SIZE in each call, and must be a multiple
- * of WC_AES_BLOCK_SIZE in each call to wc_AesXtsEncryptUpdate().
- * wc_AesXtsEncryptFinal() can handle any length >= WC_AES_BLOCK_SIZE.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers -- must be >= WC_AES_BLOCK_SIZE.
- * i value to use for tweak
- * iSz size of i buffer, should always be WC_AES_BLOCK_SIZE but having this input
- * adds a sanity check on how the user calls the function.
- *
- * returns 0 on success
- */
-static int AesXtsEncryptUpdate(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- int ret;
-
-#ifdef WOLFSSL_AESNI
- Aes *aes;
-#endif
-
- if (xaes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_AESNI
- aes = &xaes->aes;
-#endif
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Plain text input too small for encryption");
- return BAD_FUNC_ARG;
- }
-
- if (stream->bytes_crypted_with_this_tweak & ((word32)WC_AES_BLOCK_SIZE - 1U))
- {
- WOLFSSL_MSG("Call to AesXtsEncryptUpdate after previous finalizing call");
- return BAD_FUNC_ARG;
- }
-
-#ifndef WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
- if (! WC_SAFE_SUM_WORD32(stream->bytes_crypted_with_this_tweak, sz,
- stream->bytes_crypted_with_this_tweak))
- {
- WOLFSSL_MSG("Overflow of stream->bytes_crypted_with_this_tweak "
- "in AesXtsEncryptUpdate().");
- }
-#endif
-#if FIPS_VERSION3_GE(6,0,0)
- /* SP800-38E - Restrict data unit to 2^20 blocks per key. A block is
- * WC_AES_BLOCK_SIZE or 16-bytes (128-bits). So each key may only be used to
- * protect up to 1,048,576 blocks of WC_AES_BLOCK_SIZE (16,777,216 bytes)
- */
- if (stream->bytes_crypted_with_this_tweak >
- FIPS_AES_XTS_MAX_BYTES_PER_TWEAK)
- {
- WOLFSSL_MSG("Request exceeds allowed bytes per SP800-38E");
- return BAD_FUNC_ARG;
- }
-#endif
- {
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_encrypt_update_avx1(in, out, sz,
- (const byte*)aes->key,
- stream->tweak_block,
- (int)aes->rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_encrypt_update_aesni(in, out, sz,
- (const byte*)aes->key,
- stream->tweak_block,
- (int)aes->rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AesXtsEncryptUpdate_sw(xaes, out, in, sz, stream->tweak_block);
- }
- }
-
- return ret;
-}
-
-int wc_AesXtsEncryptUpdate(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- if (stream == NULL)
- return BAD_FUNC_ARG;
- if (sz & ((word32)WC_AES_BLOCK_SIZE - 1U))
- return BAD_FUNC_ARG;
- return AesXtsEncryptUpdate(xaes, out, in, sz, stream);
-}
-
-int wc_AesXtsEncryptFinal(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- int ret;
- if (stream == NULL)
- return BAD_FUNC_ARG;
- if (sz > 0)
- ret = AesXtsEncryptUpdate(xaes, out, in, sz, stream);
- else
- ret = 0;
- /* force the count odd, to assure error on attempt to AesXtsEncryptUpdate()
- * after finalization.
- */
- stream->bytes_crypted_with_this_tweak |= 1U;
- ForceZero(stream->tweak_block, WC_AES_BLOCK_SIZE);
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(stream->tweak_block, WC_AES_BLOCK_SIZE);
-#endif
- return ret;
-}
-
-#endif /* WOLFSSL_AESXTS_STREAM */
-
-#ifdef HAVE_AES_DECRYPT
-
-/* Same process as encryption but use aes_decrypt key.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold plain text
- * in input cipher text buffer to decrypt
- * sz size of both out and in buffers
- * i value to use for tweak
- *
- * returns 0 on success
- */
-/* Software AES - XTS Decrypt */
-
-#if defined(__aarch64__) || !defined(WOLFSSL_ARMASM) || \
- defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
-static int AesXtsDecryptUpdate_sw(XtsAes* xaes, byte* out, const byte* in,
- word32 sz, byte *i);
-
-static int AesXtsDecrypt_sw(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- const byte* i)
-{
- int ret;
- byte tweak_block[WC_AES_BLOCK_SIZE];
-
- ret = wc_AesEncryptDirect(&xaes->tweak, tweak_block, i);
- if (ret != 0)
- return ret;
-
- return AesXtsDecryptUpdate_sw(xaes, out, in, sz, tweak_block);
-}
-
-/* Block-streaming AES-XTS.
- *
- * Same process as encryption but use decrypt key.
- *
- * Supply block-aligned input data with successive calls. Final call need not
- * be block aligned.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold plain text
- * in input cipher text buffer to decrypt
- * sz size of both out and in buffers
- * i value to use for tweak
- *
- * returns 0 on success
- */
-/* Software AES - XTS Decrypt */
-static int AesXtsDecryptUpdate_sw(XtsAes* xaes, byte* out, const byte* in,
- word32 sz, byte *i)
-{
- int ret = 0;
- word32 blocks = (sz / WC_AES_BLOCK_SIZE);
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- Aes *aes = &xaes->aes_decrypt;
-#else
- Aes *aes = &xaes->aes;
-#endif
- word32 j;
- byte carry = 0;
- byte stl = (sz % WC_AES_BLOCK_SIZE);
-
- /* if Stealing then break out of loop one block early to handle special
- * case */
- if (stl > 0) {
- blocks--;
- }
-
-#ifdef HAVE_AES_ECB
- /* decrypt all of buffer at once when possible */
- if (in != out) { /* can not handle inline */
- XMEMCPY(out, i, WC_AES_BLOCK_SIZE);
- if ((ret = _AesXtsHelper(aes, out, in, sz, AES_DECRYPTION)) != 0)
- return ret;
- }
-#endif
-
- while (blocks > 0) {
-#ifdef HAVE_AES_ECB
- if (in == out)
-#endif
- { /* check for if inline */
- byte buf[WC_AES_BLOCK_SIZE];
-
- XMEMCPY(buf, in, WC_AES_BLOCK_SIZE);
- xorbuf(buf, i, WC_AES_BLOCK_SIZE);
- ret = wc_AesDecryptDirect(aes, out, buf);
- if (ret != 0)
- return ret;
- }
- xorbuf(out, i, WC_AES_BLOCK_SIZE);
-
- /* multiply by shift left and propagate carry */
- for (j = 0; j < WC_AES_BLOCK_SIZE; j++) {
- byte tmpC;
-
- tmpC = (i[j] >> 7) & 0x01;
- i[j] = (byte)((i[j] << 1) + carry);
- carry = tmpC;
- }
- if (carry) {
- i[0] ^= GF_XTS;
- }
- carry = 0;
-
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
- blocks--;
- }
-
- /* stealing operation of XTS to handle left overs */
- if (sz >= WC_AES_BLOCK_SIZE) {
- byte buf[WC_AES_BLOCK_SIZE];
- byte tmp2[WC_AES_BLOCK_SIZE];
-
- /* multiply by shift left and propagate carry */
- for (j = 0; j < WC_AES_BLOCK_SIZE; j++) {
- byte tmpC;
-
- tmpC = (i[j] >> 7) & 0x01;
- tmp2[j] = (byte)((i[j] << 1) + carry);
- carry = tmpC;
- }
- if (carry) {
- tmp2[0] ^= GF_XTS;
- }
-
- XMEMCPY(buf, in, WC_AES_BLOCK_SIZE);
- xorbuf(buf, tmp2, WC_AES_BLOCK_SIZE);
- ret = wc_AesDecryptDirect(aes, out, buf);
- if (ret != 0)
- return ret;
- xorbuf(out, tmp2, WC_AES_BLOCK_SIZE);
-
- /* tmp2 holds partial | last */
- XMEMCPY(tmp2, out, WC_AES_BLOCK_SIZE);
- in += WC_AES_BLOCK_SIZE;
- out += WC_AES_BLOCK_SIZE;
- sz -= WC_AES_BLOCK_SIZE;
-
- /* Make buffer with end of cipher text | last */
- XMEMCPY(buf, tmp2, WC_AES_BLOCK_SIZE);
- if (sz >= WC_AES_BLOCK_SIZE) { /* extra sanity check before copy */
- return BUFFER_E;
- }
- XMEMCPY(buf, in, sz);
- XMEMCPY(out, tmp2, sz);
-
- xorbuf(buf, i, WC_AES_BLOCK_SIZE);
- ret = wc_AesDecryptDirect(aes, tmp2, buf);
- if (ret != 0)
- return ret;
- xorbuf(tmp2, i, WC_AES_BLOCK_SIZE);
- XMEMCPY(out - WC_AES_BLOCK_SIZE, tmp2, WC_AES_BLOCK_SIZE);
- }
-
- return ret;
-}
-#endif
-
-/* Same process as encryption but Aes key is AES_DECRYPTION type.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold plain text
- * in input cipher text buffer to decrypt
- * sz size of both out and in buffers
- * i value to use for tweak
- * iSz size of i buffer, should always be WC_AES_BLOCK_SIZE but having this input
- * adds a sanity check on how the user calls the function.
- *
- * returns 0 on success
- */
-int wc_AesXtsDecrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- const byte* i, word32 iSz)
-{
- int ret;
- Aes *aes;
-
- if (xaes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- aes = &xaes->aes_decrypt;
-#else
- aes = &xaes->aes;
-#endif
-
-/* FIPS TODO: SP800-38E - Restrict data unit to 2^20 blocks per key. A block is
- * WC_AES_BLOCK_SIZE or 16-bytes (128-bits). So each key may only be used to
- * protect up to 1,048,576 blocks of WC_AES_BLOCK_SIZE (16,777,216 bytes or
- * 134,217,728-bits) Add helpful printout and message along with BAD_FUNC_ARG
- * return whenever sz / WC_AES_BLOCK_SIZE > 1,048,576 or equal to that and sz is
- * not a sequence of complete blocks.
- */
-
- if (aes->keylen == 0) {
- WOLFSSL_MSG("wc_AesXtsDecrypt called with unset decryption key.");
- return BAD_FUNC_ARG;
- }
-
- if (iSz < WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Cipher text input too small for decryption");
- return BAD_FUNC_ARG;
- }
-
-#if !defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- AES_XTS_decrypt_AARCH32(in, out, sz, i, (byte*)xaes->aes.key,
- (byte*)xaes->tweak.key, (byte*)xaes->aes.tmp, xaes->aes.rounds);
- ret = 0;
-#else
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_decrypt_avx1(in, out, sz, i,
- (const byte*)aes->key,
- (const byte*)xaes->tweak.key,
- (int)aes->rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_decrypt_aesni(in, out, sz, i,
- (const byte*)aes->key,
- (const byte*)xaes->tweak.key,
- (int)aes->rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#elif defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \
- !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)
- if (aes->use_aes_hw_crypto) {
- AES_XTS_decrypt_AARCH64(in, out, sz, i, (byte*)xaes->aes.key,
- (byte*)xaes->tweak.key, (byte*)xaes->aes.tmp, xaes->aes.rounds);
- ret = 0;
- }
- else
-#endif
- {
- ret = AesXtsDecrypt_sw(xaes, out, in, sz, i);
- }
-#endif
-
- return ret;
-}
-
-#ifdef WOLFSSL_AESXTS_STREAM
-
-/* Same process as encryption but Aes key is AES_DECRYPTION type.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * i readwrite value to use for tweak
- * iSz size of i buffer, should always be WC_AES_BLOCK_SIZE but having this input
- * adds a sanity check on how the user calls the function.
- *
- * returns 0 on success
- */
-int wc_AesXtsDecryptInit(XtsAes* xaes, const byte* i, word32 iSz,
- struct XtsAesStreamData *stream)
-{
- int ret;
- Aes *aes;
-
- if (xaes == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- aes = &xaes->aes_decrypt;
-#else
- aes = &xaes->aes;
-#endif
-
- if (aes->keylen == 0) {
- WOLFSSL_MSG("wc_AesXtsDecrypt called with unset decryption key.");
- return BAD_FUNC_ARG;
- }
-
- if (iSz < WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- XMEMCPY(stream->tweak_block, i, WC_AES_BLOCK_SIZE);
- stream->bytes_crypted_with_this_tweak = 0;
-
- {
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_init_avx1(stream->tweak_block,
- (const byte*)xaes->tweak.key,
- (int)xaes->tweak.rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_init_aesni(stream->tweak_block,
- (const byte*)xaes->tweak.key,
- (int)xaes->tweak.rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AesXtsInitTweak_sw(xaes, stream->tweak_block);
- }
-
- }
-
- return ret;
-}
-
-/* Block-streaming AES-XTS
- *
- * Note that sz must be >= WC_AES_BLOCK_SIZE in each call, and must be a multiple
- * of WC_AES_BLOCK_SIZE in each call to wc_AesXtsDecryptUpdate().
- * wc_AesXtsDecryptFinal() can handle any length >= WC_AES_BLOCK_SIZE.
- *
- * xaes AES keys to use for block encrypt/decrypt
- * out output buffer to hold plain text
- * in input cipher text buffer to decrypt
- * sz size of both out and in buffers
- * i tweak buffer of size WC_AES_BLOCK_SIZE.
- *
- * returns 0 on success
- */
-static int AesXtsDecryptUpdate(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- int ret;
-#ifdef WOLFSSL_AESNI
- Aes *aes;
-#endif
-
- if (xaes == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_AESNI
-#ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS
- aes = &xaes->aes_decrypt;
-#else
- aes = &xaes->aes;
-#endif
-#endif
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Cipher text input too small for decryption");
- return BAD_FUNC_ARG;
- }
-
- if (stream->bytes_crypted_with_this_tweak &
- ((word32)WC_AES_BLOCK_SIZE - 1U))
- {
- WOLFSSL_MSG("AesXtsDecryptUpdate after previous finalizing call");
- return BAD_FUNC_ARG;
- }
-
-#ifndef WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
- if (! WC_SAFE_SUM_WORD32(stream->bytes_crypted_with_this_tweak, sz,
- stream->bytes_crypted_with_this_tweak))
- {
- WOLFSSL_MSG("Overflow of stream->bytes_crypted_with_this_tweak "
- "in AesXtsDecryptUpdate().");
- }
-#endif
-
- {
-#ifdef WOLFSSL_AESNI
- if (aes->use_aesni) {
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-#if defined(HAVE_INTEL_AVX1)
- if (IS_INTEL_AVX1(intel_flags)) {
- AES_XTS_decrypt_update_avx1(in, out, sz,
- (const byte*)aes->key,
- stream->tweak_block,
- (int)aes->rounds);
- ret = 0;
- }
- else
-#endif
- {
- AES_XTS_decrypt_update_aesni(in, out, sz,
- (const byte*)aes->key,
- stream->tweak_block,
- (int)aes->rounds);
- ret = 0;
- }
- RESTORE_VECTOR_REGISTERS();
- }
- else
-#endif /* WOLFSSL_AESNI */
- {
- ret = AesXtsDecryptUpdate_sw(xaes, out, in, sz,
- stream->tweak_block);
- }
- }
-
- return ret;
-}
-
-int wc_AesXtsDecryptUpdate(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- if (stream == NULL)
- return BAD_FUNC_ARG;
- if (sz & ((word32)WC_AES_BLOCK_SIZE - 1U))
- return BAD_FUNC_ARG;
- return AesXtsDecryptUpdate(xaes, out, in, sz, stream);
-}
-
-int wc_AesXtsDecryptFinal(XtsAes* xaes, byte* out, const byte* in, word32 sz,
- struct XtsAesStreamData *stream)
-{
- int ret;
- if (stream == NULL)
- return BAD_FUNC_ARG;
- if (sz > 0)
- ret = AesXtsDecryptUpdate(xaes, out, in, sz, stream);
- else
- ret = 0;
- ForceZero(stream->tweak_block, WC_AES_BLOCK_SIZE);
- /* force the count odd, to assure error on attempt to AesXtsEncryptUpdate()
- * after finalization.
- */
- stream->bytes_crypted_with_this_tweak |= 1U;
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(stream->tweak_block, WC_AES_BLOCK_SIZE);
-#endif
- return ret;
-}
-
-#endif /* WOLFSSL_AESXTS_STREAM */
-#endif /* HAVE_AES_DECRYPT */
-
-/* Same as wc_AesXtsEncryptSector but the sector gets incremented by one every
- * sectorSz bytes
- *
- * xaes AES keys to use for block encrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- * sector value to use for tweak
- * sectorSz size of the sector
- *
- * returns 0 on success
- */
-int wc_AesXtsEncryptConsecutiveSectors(XtsAes* aes, byte* out, const byte* in,
- word32 sz, word64 sector, word32 sectorSz)
-{
- int ret = 0;
- word32 iter = 0;
- word32 sectorCount;
- word32 remainder;
-
- if (aes == NULL || out == NULL || in == NULL || sectorSz == 0) {
- return BAD_FUNC_ARG;
- }
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Cipher text input too small for encryption");
- return BAD_FUNC_ARG;
- }
-
- sectorCount = sz / sectorSz;
- remainder = sz % sectorSz;
-
- while (sectorCount) {
- ret = wc_AesXtsEncryptSector(aes, out + (iter * sectorSz),
- in + (iter * sectorSz), sectorSz, sector);
- if (ret != 0)
- break;
-
- sectorCount--;
- iter++;
- sector++;
- }
-
- if (remainder && ret == 0)
- ret = wc_AesXtsEncryptSector(aes, out + (iter * sectorSz),
- in + (iter * sectorSz), remainder, sector);
-
- return ret;
-}
-
-#ifdef HAVE_AES_DECRYPT
-
-/* Same as wc_AesXtsEncryptConsecutiveSectors but Aes key is AES_DECRYPTION type
- *
- * xaes AES keys to use for block decrypt
- * out output buffer to hold cipher text
- * in input plain text buffer to encrypt
- * sz size of both out and in buffers
- * sector value to use for tweak
- * sectorSz size of the sector
- *
- * returns 0 on success
- */
-int wc_AesXtsDecryptConsecutiveSectors(XtsAes* aes, byte* out, const byte* in,
- word32 sz, word64 sector, word32 sectorSz)
-{
- int ret = 0;
- word32 iter = 0;
- word32 sectorCount;
- word32 remainder;
-
- if (aes == NULL || out == NULL || in == NULL || sectorSz == 0) {
- return BAD_FUNC_ARG;
- }
-
- if (sz < WC_AES_BLOCK_SIZE) {
- WOLFSSL_MSG("Cipher text input too small for decryption");
- return BAD_FUNC_ARG;
- }
-
- sectorCount = sz / sectorSz;
- remainder = sz % sectorSz;
-
- while (sectorCount) {
- ret = wc_AesXtsDecryptSector(aes, out + (iter * sectorSz),
- in + (iter * sectorSz), sectorSz, sector);
- if (ret != 0)
- break;
-
- sectorCount--;
- iter++;
- sector++;
- }
-
- if (remainder && ret == 0)
- ret = wc_AesXtsDecryptSector(aes, out + (iter * sectorSz),
- in + (iter * sectorSz), remainder, sector);
-
- return ret;
-}
-#endif /* HAVE_AES_DECRYPT */
-#endif /* WOLFSSL_AES_XTS */
-
-#ifdef WOLFSSL_AES_SIV
-
-/*
- * See RFC 5297 Section 2.4.
- */
-static WARN_UNUSED_RESULT int S2V(
- const byte* key, word32 keySz, const AesSivAssoc* assoc, word32 numAssoc,
- const byte* nonce, word32 nonceSz, const byte* data,
- word32 dataSz, byte* out)
-{
-#ifdef WOLFSSL_SMALL_STACK
- byte* tmp[3] = {NULL, NULL, NULL};
- int i;
- Cmac* cmac;
-#else
- byte tmp[3][WC_AES_BLOCK_SIZE];
- Cmac cmac[1];
-#endif
- word32 macSz = WC_AES_BLOCK_SIZE;
- int ret = 0;
- byte tmpi = 0;
- word32 ai;
- word32 zeroBytes;
-
-#ifdef WOLFSSL_SMALL_STACK
- for (i = 0; i < 3; ++i) {
- tmp[i] = (byte*)XMALLOC(WC_AES_BLOCK_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (tmp[i] == NULL) {
- ret = MEMORY_E;
- break;
- }
- }
- if (ret == 0)
-#endif
-
- if ((numAssoc > 126) || ((nonceSz > 0) && (numAssoc > 125))) {
- /* See RFC 5297 Section 7. */
- WOLFSSL_MSG("Maximum number of ADs (including the nonce) for AES SIV is"
- " 126.");
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- XMEMSET(tmp[1], 0, WC_AES_BLOCK_SIZE);
- XMEMSET(tmp[2], 0, WC_AES_BLOCK_SIZE);
-
- ret = wc_AesCmacGenerate(tmp[0], &macSz, tmp[1], WC_AES_BLOCK_SIZE,
- key, keySz);
- }
-
- if (ret == 0) {
- /* Loop over authenticated associated data AD1..ADn */
- for (ai = 0; ai < numAssoc; ++ai) {
- ShiftAndXorRb(tmp[1-tmpi], tmp[tmpi]);
- ret = wc_AesCmacGenerate(tmp[tmpi], &macSz, assoc[ai].assoc,
- assoc[ai].assocSz, key, keySz);
- if (ret != 0)
- break;
- xorbuf(tmp[1-tmpi], tmp[tmpi], WC_AES_BLOCK_SIZE);
- tmpi = (byte)(1 - tmpi);
- }
-
- /* Add nonce as final AD. See RFC 5297 Section 3. */
- if ((ret == 0) && (nonceSz > 0)) {
- ShiftAndXorRb(tmp[1-tmpi], tmp[tmpi]);
- ret = wc_AesCmacGenerate(tmp[tmpi], &macSz, nonce,
- nonceSz, key, keySz);
- if (ret == 0) {
- xorbuf(tmp[1-tmpi], tmp[tmpi], WC_AES_BLOCK_SIZE);
- }
- tmpi = (byte)(1U - tmpi);
- }
-
- /* For simplicity of the remaining code, make sure the "final" result
- is always in tmp[0]. */
- if (tmpi == 1) {
- XMEMCPY(tmp[0], tmp[1], WC_AES_BLOCK_SIZE);
- }
- }
-
- if (ret == 0) {
- if (dataSz >= WC_AES_BLOCK_SIZE) {
-
- WC_ALLOC_VAR_EX(cmac, Cmac, 1, NULL, DYNAMIC_TYPE_CMAC,
- ret=MEMORY_E);
- if (WC_VAR_OK(cmac))
- {
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- /* Aes part is checked by wc_AesFree. */
- wc_MemZero_Add("wc_AesCmacGenerate cmac",
- ((unsigned char *)cmac) + sizeof(Aes),
- sizeof(Cmac) - sizeof(Aes));
- #endif
- xorbuf(tmp[0], data + (dataSz - WC_AES_BLOCK_SIZE),
- WC_AES_BLOCK_SIZE);
- ret = wc_InitCmac(cmac, key, keySz, WC_CMAC_AES, NULL);
- if (ret == 0) {
- ret = wc_CmacUpdate(cmac, data, dataSz - WC_AES_BLOCK_SIZE);
- }
- if (ret == 0) {
- ret = wc_CmacUpdate(cmac, tmp[0], WC_AES_BLOCK_SIZE);
- }
- if (ret == 0) {
- ret = wc_CmacFinal(cmac, out, &macSz);
- }
- }
- #ifdef WOLFSSL_SMALL_STACK
- XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);
- #elif defined(WOLFSSL_CHECK_MEM_ZERO)
- wc_MemZero_Check(cmac, sizeof(Cmac));
- #endif
- }
- else {
- XMEMCPY(tmp[2], data, dataSz);
- tmp[2][dataSz] |= 0x80;
- zeroBytes = WC_AES_BLOCK_SIZE - (dataSz + 1);
- if (zeroBytes != 0) {
- XMEMSET(tmp[2] + dataSz + 1, 0, zeroBytes);
- }
- ShiftAndXorRb(tmp[1], tmp[0]);
- xorbuf(tmp[1], tmp[2], WC_AES_BLOCK_SIZE);
- ret = wc_AesCmacGenerate(out, &macSz, tmp[1], WC_AES_BLOCK_SIZE, key,
- keySz);
- }
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- for (i = 0; i < 3; ++i) {
- if (tmp[i] != NULL) {
- XFREE(tmp[i], NULL, DYNAMIC_TYPE_TMP_BUFFER);
- }
- }
-#endif
-
- return ret;
-}
-
-static WARN_UNUSED_RESULT int AesSivCipher(
- const byte* key, word32 keySz, const AesSivAssoc* assoc,
- word32 numAssoc, const byte* nonce, word32 nonceSz,
- const byte* data, word32 dataSz, byte* siv, byte* out,
- int enc)
-{
- int ret = 0;
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- byte sivTmp[WC_AES_BLOCK_SIZE];
-
- if (key == NULL || siv == NULL || out == NULL) {
- WOLFSSL_MSG("Bad parameter");
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0 && keySz != 32 && keySz != 48 && keySz != 64) {
- WOLFSSL_MSG("Bad key size. Must be 256, 384, or 512 bits.");
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- if (enc == 1) {
- ret = S2V(key, keySz / 2, assoc, numAssoc, nonce, nonceSz, data,
- dataSz, sivTmp);
- if (ret != 0) {
- WOLFSSL_MSG("S2V failed.");
- }
- else {
- XMEMCPY(siv, sivTmp, WC_AES_BLOCK_SIZE);
- }
- }
- else {
- XMEMCPY(sivTmp, siv, WC_AES_BLOCK_SIZE);
- }
- }
-
- if (ret == 0) {
-#ifdef WOLFSSL_SMALL_STACK
- aes = wc_AesNew(NULL, INVALID_DEVID, &ret);
-#else
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
-#endif
- if (ret != 0) {
- WOLFSSL_MSG("Failed to initialized AES object.");
- }
- }
-
- if (ret == 0 && dataSz > 0) {
- sivTmp[12] &= 0x7f;
- sivTmp[8] &= 0x7f;
- ret = wc_AesSetKey(aes, key + keySz / 2, keySz / 2, sivTmp,
- AES_ENCRYPTION);
- if (ret != 0) {
- WOLFSSL_MSG("Failed to set key for AES-CTR.");
- }
- else {
- ret = wc_AesCtrEncrypt(aes, out, data, dataSz);
- if (ret != 0) {
- WOLFSSL_MSG("AES-CTR encryption failed.");
- }
- }
- }
-
- if (ret == 0 && enc == 0) {
- ret = S2V(key, keySz / 2, assoc, numAssoc, nonce, nonceSz, out, dataSz,
- sivTmp);
- if (ret != 0) {
- WOLFSSL_MSG("S2V failed.");
- }
-
- if (XMEMCMP(siv, sivTmp, WC_AES_BLOCK_SIZE) != 0) {
- WOLFSSL_MSG("Computed SIV doesn't match received SIV.");
- ret = AES_SIV_AUTH_E;
- }
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- wc_AesDelete(aes, NULL);
-#else
- wc_AesFree(aes);
-#endif
-
- return ret;
-}
-
-/*
- * See RFC 5297 Section 2.6.
- */
-int wc_AesSivEncrypt(const byte* key, word32 keySz, const byte* assoc,
- word32 assocSz, const byte* nonce, word32 nonceSz,
- const byte* in, word32 inSz, byte* siv, byte* out)
-{
- AesSivAssoc ad;
- ad.assoc = assoc;
- ad.assocSz = assocSz;
- return AesSivCipher(key, keySz, &ad, 1U, nonce, nonceSz, in, inSz,
- siv, out, 1);
-}
-
-/*
- * See RFC 5297 Section 2.7.
- */
-int wc_AesSivDecrypt(const byte* key, word32 keySz, const byte* assoc,
- word32 assocSz, const byte* nonce, word32 nonceSz,
- const byte* in, word32 inSz, byte* siv, byte* out)
-{
- AesSivAssoc ad;
- ad.assoc = assoc;
- ad.assocSz = assocSz;
- return AesSivCipher(key, keySz, &ad, 1U, nonce, nonceSz, in, inSz,
- siv, out, 0);
-}
-
-/*
- * See RFC 5297 Section 2.6.
- */
-int wc_AesSivEncrypt_ex(const byte* key, word32 keySz, const AesSivAssoc* assoc,
- word32 numAssoc, const byte* nonce, word32 nonceSz,
- const byte* in, word32 inSz, byte* siv, byte* out)
-{
- return AesSivCipher(key, keySz, assoc, numAssoc, nonce, nonceSz, in, inSz,
- siv, out, 1);
-}
-
-/*
- * See RFC 5297 Section 2.7.
- */
-int wc_AesSivDecrypt_ex(const byte* key, word32 keySz, const AesSivAssoc* assoc,
- word32 numAssoc, const byte* nonce, word32 nonceSz,
- const byte* in, word32 inSz, byte* siv, byte* out)
-{
- return AesSivCipher(key, keySz, assoc, numAssoc, nonce, nonceSz, in, inSz,
- siv, out, 0);
-}
-
-#endif /* WOLFSSL_AES_SIV */
-
-#if defined(WOLFSSL_AES_EAX)
-
-/*
- * AES EAX one-shot API
- * Encrypts input data and computes an auth tag over the input
- * auth data and ciphertext
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxEncryptAuth(const byte* key, word32 keySz, byte* out,
- const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- /* output computed auth tag */
- byte* authTag, word32 authTagSz,
- /* input data to authenticate */
- const byte* authIn, word32 authInSz)
-{
-#if defined(WOLFSSL_SMALL_STACK)
- AesEax *eax;
-#else
- AesEax eax_mem;
- AesEax *eax = &eax_mem;
-#endif
- int ret;
- int eaxInited = 0;
-
- if (key == NULL || out == NULL || in == NULL || nonce == NULL
- || authTag == NULL || authIn == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SMALL_STACK)
- if ((eax = (AesEax *)XMALLOC(sizeof(AesEax),
- NULL,
- DYNAMIC_TYPE_AES_EAX)) == NULL) {
- return MEMORY_E;
- }
-#endif
-
- if ((ret = wc_AesEaxInit(eax,
- key, keySz,
- nonce, nonceSz,
- authIn, authInSz)) != 0) {
- goto cleanup;
- }
- eaxInited = 1;
-
- if ((ret = wc_AesEaxEncryptUpdate(eax, out, in, inSz, NULL, 0)) != 0) {
- goto cleanup;
- }
-
- if ((ret = wc_AesEaxEncryptFinal(eax, authTag, authTagSz)) != 0) {
- goto cleanup;
- }
-
-cleanup:
- if (eaxInited)
- wc_AesEaxFree(eax);
-#if defined(WOLFSSL_SMALL_STACK)
- XFREE(eax, NULL, DYNAMIC_TYPE_AES_EAX);
-#endif
- return ret;
-}
-
-
-/*
- * AES EAX one-shot API
- * Decrypts and authenticates data against a supplied auth tag
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxDecryptAuth(const byte* key, word32 keySz, byte* out,
- const byte* in, word32 inSz,
- const byte* nonce, word32 nonceSz,
- /* auth tag to verify against */
- const byte* authTag, word32 authTagSz,
- /* input data to authenticate */
- const byte* authIn, word32 authInSz)
-{
-#if defined(WOLFSSL_SMALL_STACK)
- AesEax *eax;
-#else
- AesEax eax_mem;
- AesEax *eax = &eax_mem;
-#endif
- int ret;
- int eaxInited = 0;
-
- if (key == NULL || out == NULL || in == NULL || nonce == NULL
- || authTag == NULL || authIn == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SMALL_STACK)
- if ((eax = (AesEax *)XMALLOC(sizeof(AesEax),
- NULL,
- DYNAMIC_TYPE_AES_EAX)) == NULL) {
- return MEMORY_E;
- }
-#endif
-
- if ((ret = wc_AesEaxInit(eax,
- key, keySz,
- nonce, nonceSz,
- authIn, authInSz)) != 0) {
-
- goto cleanup;
- }
- eaxInited = 1;
-
- if ((ret = wc_AesEaxDecryptUpdate(eax, out, in, inSz, NULL, 0)) != 0) {
- goto cleanup;
- }
-
- if ((ret = wc_AesEaxDecryptFinal(eax, authTag, authTagSz)) != 0) {
- goto cleanup;
- }
-
-cleanup:
- if (eaxInited)
- wc_AesEaxFree(eax);
-#if defined(WOLFSSL_SMALL_STACK)
- XFREE(eax, NULL, DYNAMIC_TYPE_AES_EAX);
-#endif
- return ret;
-}
-
-
-/*
- * AES EAX Incremental API:
- * Initializes an AES EAX encryption or decryption operation. This must be
- * called before any other EAX APIs are used on the AesEax struct
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxInit(AesEax* eax,
- const byte* key, word32 keySz,
- const byte* nonce, word32 nonceSz,
- const byte* authIn, word32 authInSz)
-{
- int ret = 0;
- word32 cmacSize;
- int aesInited = 0;
- int nonceCmacInited = 0;
- int aadCmacInited = 0;
-
- if (eax == NULL || key == NULL || nonce == NULL) {
- return BAD_FUNC_ARG;
- }
-
- XMEMSET(eax->prefixBuf, 0, sizeof(eax->prefixBuf));
-
- if ((ret = wc_AesInit(&eax->aes, NULL, INVALID_DEVID)) != 0) {
- goto out;
- }
- aesInited = 1;
-
- if ((ret = wc_AesSetKey(&eax->aes,
- key,
- keySz,
- NULL,
- AES_ENCRYPTION)) != 0) {
- goto out;
- }
-
- /*
- * OMAC the nonce to use as the IV for CTR encryption and auth tag chunk
- * N' = OMAC^0_K(N)
- */
- if ((ret = wc_InitCmac(&eax->nonceCmac,
- key,
- keySz,
- WC_CMAC_AES,
- NULL)) != 0) {
- return ret;
- }
- nonceCmacInited = 1;
-
- if ((ret = wc_CmacUpdate(&eax->nonceCmac,
- eax->prefixBuf,
- sizeof(eax->prefixBuf))) != 0) {
- goto out;
- }
-
- if ((ret = wc_CmacUpdate(&eax->nonceCmac, nonce, nonceSz)) != 0) {
- goto out;
- }
-
- cmacSize = WC_AES_BLOCK_SIZE;
- if ((ret = wc_CmacFinal(&eax->nonceCmac,
- eax->nonceCmacFinal,
- &cmacSize)) != 0) {
- goto out;
- }
-
- if ((ret = wc_AesSetIV(&eax->aes, eax->nonceCmacFinal)) != 0) {
- goto out;
- }
-
- /*
- * start the OMAC used to build the auth tag chunk for the AD .
- * This CMAC is continued in subsequent update calls when more auth data is
- * provided
- * H' = OMAC^1_K(H)
- */
- eax->prefixBuf[WC_AES_BLOCK_SIZE-1] = 1;
- if ((ret = wc_InitCmac(&eax->aadCmac,
- key,
- keySz,
- WC_CMAC_AES,
- NULL)) != 0) {
- goto out;
- }
- aadCmacInited = 1;
-
- if ((ret = wc_CmacUpdate(&eax->aadCmac,
- eax->prefixBuf,
- sizeof(eax->prefixBuf))) != 0) {
- goto out;
- }
-
- if (authIn != NULL) {
- if ((ret = wc_CmacUpdate(&eax->aadCmac, authIn, authInSz)) != 0) {
- goto out;
- }
- }
-
- /*
- * start the OMAC to create auth tag chunk for ciphertext. This MAC will be
- * updated in subsequent calls to encrypt/decrypt
- * C' = OMAC^2_K(C)
- */
- eax->prefixBuf[WC_AES_BLOCK_SIZE-1] = 2;
- if ((ret = wc_InitCmac(&eax->ciphertextCmac,
- key,
- keySz,
- WC_CMAC_AES,
- NULL)) != 0) {
- goto out;
- }
-
- if ((ret = wc_CmacUpdate(&eax->ciphertextCmac,
- eax->prefixBuf,
- sizeof(eax->prefixBuf))) != 0) {
- goto out;
- }
-
-out:
-
- if (ret != 0) {
- if (aesInited)
- wc_AesFree(&eax->aes);
- if (nonceCmacInited)
- wc_CmacFree(&eax->nonceCmac);
- if (aadCmacInited)
- wc_CmacFree(&eax->aadCmac);
- }
-
- return ret;
-}
-
-
-/*
- * AES EAX Incremental API:
- * Encrypts input plaintext using AES EAX mode, adding optional auth data to
- * the authentication stream
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxEncryptUpdate(AesEax* eax, byte* out,
- const byte* in, word32 inSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-
- if (eax == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- /*
- * Encrypt the plaintext using AES CTR
- * C = CTR(M)
- */
- if ((ret = wc_AesCtrEncrypt(&eax->aes, out, in, inSz)) != 0) {
- return ret;
- }
-
- /*
- * update OMAC with new ciphertext
- * C' = OMAC^2_K(C)
- */
- if ((ret = wc_CmacUpdate(&eax->ciphertextCmac, out, inSz)) != 0) {
- return ret;
- }
-
- /* If there exists new auth data, update the OMAC for that as well */
- if (authIn != NULL) {
- if ((ret = wc_CmacUpdate(&eax->aadCmac, authIn, authInSz)) != 0) {
- return ret;
- }
- }
-
- return 0;
-}
-
-
-/*
- * AES EAX Incremental API:
- * Decrypts input ciphertext using AES EAX mode, adding optional auth data to
- * the authentication stream
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxDecryptUpdate(AesEax* eax, byte* out,
- const byte* in, word32 inSz,
- const byte* authIn, word32 authInSz)
-{
- int ret;
-
- if (eax == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- /*
- * Decrypt the plaintext using AES CTR
- * C = CTR(M)
- */
- if ((ret = wc_AesCtrEncrypt(&eax->aes, out, in, inSz)) != 0) {
- return ret;
- }
-
- /*
- * update OMAC with new ciphertext
- * C' = OMAC^2_K(C)
- */
- if ((ret = wc_CmacUpdate(&eax->ciphertextCmac, in, inSz)) != 0) {
- return ret;
- }
-
- /* If there exists new auth data, update the OMAC for that as well */
- if (authIn != NULL) {
- if ((ret = wc_CmacUpdate(&eax->aadCmac, authIn, authInSz)) != 0) {
- return ret;
- }
- }
-
- return 0;
-}
-
-
-/*
- * AES EAX Incremental API:
- * Provides additional auth data information to the authentication
- * stream for an authenticated encryption or decryption operation
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxAuthDataUpdate(AesEax* eax, const byte* authIn, word32 authInSz)
-{
- return wc_CmacUpdate(&eax->aadCmac, authIn, authInSz);
-}
-
-
-/*
- * AES EAX Incremental API:
- * Finalizes the authenticated encryption operation, computing the auth tag
- * over previously supplied auth data and computed ciphertext
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxEncryptFinal(AesEax* eax, byte* authTag, word32 authTagSz)
-{
- word32 cmacSize;
- int ret;
- word32 i;
-
- if (eax == NULL || authTag == NULL || authTagSz > WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- /* Complete the OMAC for the ciphertext */
- cmacSize = WC_AES_BLOCK_SIZE;
- if ((ret = wc_CmacFinalNoFree(&eax->ciphertextCmac,
- eax->ciphertextCmacFinal,
- &cmacSize)) != 0) {
- return ret;
- }
-
- /* Complete the OMAC for auth data */
- cmacSize = WC_AES_BLOCK_SIZE;
- if ((ret = wc_CmacFinalNoFree(&eax->aadCmac,
- eax->aadCmacFinal,
- &cmacSize)) != 0) {
- return ret;
- }
-
- /*
- * Concatenate all three auth tag chunks into the final tag, truncating
- * at the specified tag length
- * T = Tag [first authTagSz bytes]
- */
- for (i = 0; i < authTagSz; i++) {
- authTag[i] = eax->nonceCmacFinal[i]
- ^ eax->aadCmacFinal[i]
- ^ eax->ciphertextCmacFinal[i];
- }
-
- return 0;
-}
-
-
-/*
- * AES EAX Incremental API:
- * Finalizes the authenticated decryption operation, computing the auth tag
- * for the previously supplied auth data and cipher text and validating it
- * against a provided auth tag
- *
- * Returns 0 on success
- * Return error code for failure
- */
-int wc_AesEaxDecryptFinal(AesEax* eax,
- const byte* authIn, word32 authInSz)
-{
- int ret;
- word32 i;
- word32 cmacSize;
-
-#if defined(WOLFSSL_SMALL_STACK)
- byte *authTag;
-#else
- byte authTag[WC_AES_BLOCK_SIZE];
-#endif
-
- if (eax == NULL || authIn == NULL || authInSz > WC_AES_BLOCK_SIZE) {
- return BAD_FUNC_ARG;
- }
-
- /* Complete the OMAC for the ciphertext */
- cmacSize = WC_AES_BLOCK_SIZE;
- if ((ret = wc_CmacFinalNoFree(&eax->ciphertextCmac,
- eax->ciphertextCmacFinal,
- &cmacSize)) != 0) {
- return ret;
- }
-
- /* Complete the OMAC for auth data */
- cmacSize = WC_AES_BLOCK_SIZE;
- if ((ret = wc_CmacFinalNoFree(&eax->aadCmac,
- eax->aadCmacFinal,
- &cmacSize)) != 0) {
- return ret;
- }
-
-#if defined(WOLFSSL_SMALL_STACK)
- authTag = (byte*)XMALLOC(WC_AES_BLOCK_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (authTag == NULL) {
- return MEMORY_E;
- }
-#endif
-
- /*
- * Concatenate all three auth tag chunks into the final tag, truncating
- * at the specified tag length
- * T = Tag [first authInSz bytes]
- */
- for (i = 0; i < authInSz; i++) {
- authTag[i] = eax->nonceCmacFinal[i]
- ^ eax->aadCmacFinal[i]
- ^ eax->ciphertextCmacFinal[i];
- }
-
- if (ConstantCompare((const byte*)authTag, authIn, (int)authInSz) != 0) {
- ret = AES_EAX_AUTH_E;
- }
- else {
- ret = 0;
- }
-
-#if defined(WOLFSSL_SMALL_STACK)
- XFREE(authTag, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-
- return ret;
-}
-
-/*
- * Frees the underlying CMAC and AES contexts. Must be called when done using
- * the AES EAX context structure.
- *
- * Returns 0 on success
- * Returns error code on failure
- */
-int wc_AesEaxFree(AesEax* eax)
-{
- if (eax == NULL) {
- return BAD_FUNC_ARG;
- }
-
- (void)wc_CmacFree(&eax->ciphertextCmac);
- (void)wc_CmacFree(&eax->aadCmac);
- wc_AesFree(&eax->aes);
-
- return 0;
-}
-
-#endif /* WOLFSSL_AES_EAX */
-
-#ifdef WOLFSSL_AES_CTS
-
-
-/* One-shot API */
-int wc_AesCtsEncrypt(const byte* key, word32 keySz, byte* out,
- const byte* in, word32 inSz,
- const byte* iv)
-{
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- int ret = 0;
- word32 outSz = inSz;
-
- if (key == NULL || out == NULL || in == NULL || iv == NULL)
- return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_SMALL_STACK
- aes = wc_AesNew(NULL, INVALID_DEVID, &ret);
-#else
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
-#endif
- if (ret == 0)
- ret = wc_AesSetKey(aes, key, keySz, iv, AES_ENCRYPTION);
- if (ret == 0)
- ret = wc_AesCtsEncryptUpdate(aes, out, &outSz, in, inSz);
- if (ret == 0) {
- out += outSz;
- outSz = inSz - outSz;
- ret = wc_AesCtsEncryptFinal(aes, out, &outSz);
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- wc_AesDelete(aes, NULL);
-#else
- wc_AesFree(aes);
-#endif
- return ret;
-}
-
-int wc_AesCtsDecrypt(const byte* key, word32 keySz, byte* out,
- const byte* in, word32 inSz,
- const byte* iv)
-{
- WC_DECLARE_VAR(aes, Aes, 1, 0);
- int ret = 0;
- word32 outSz = inSz;
-
- if (key == NULL || out == NULL || in == NULL || iv == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- aes = wc_AesNew(NULL, INVALID_DEVID, &ret);
-#else
- ret = wc_AesInit(aes, NULL, INVALID_DEVID);
-#endif
- if (ret == 0)
- ret = wc_AesSetKey(aes, key, keySz, iv, AES_DECRYPTION);
- if (ret == 0)
- ret = wc_AesCtsDecryptUpdate(aes, out, &outSz, in, inSz);
- if (ret == 0) {
- out += outSz;
- outSz = inSz - outSz;
- ret = wc_AesCtsDecryptFinal(aes, out, &outSz);
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- wc_AesDelete(aes, NULL);
-#else
- wc_AesFree(aes);
-#endif
- return ret;
-}
-
-static int AesCtsUpdate(Aes* aes, byte* out, word32* outSz,
- const byte* in, word32 inSz, int enc)
-{
- word32 blocks = 0;
- int ret = 0;
- word32 writtenSz = 0;
- word32 tmpOutSz;
-
- if (aes == NULL || out == NULL || in == NULL || outSz == NULL)
- return BAD_FUNC_ARG;
-
- /* Error out early for easy sanity check */
- if (*outSz < inSz)
- return BUFFER_E;
- tmpOutSz = *outSz;
-
- /* We need to store last two blocks of plaintext */
- if (aes->left > 0) {
- word32 copySz = min(inSz, (WC_AES_BLOCK_SIZE * 2) - aes->left);
- XMEMCPY(aes->ctsBlock + aes->left, in, copySz);
- aes->left += copySz;
- in += copySz;
- inSz -= copySz;
-
- if (aes->left == WC_AES_BLOCK_SIZE * 2) {
- if (inSz > WC_AES_BLOCK_SIZE) {
- if (tmpOutSz < WC_AES_BLOCK_SIZE * 2)
- return BUFFER_E;
- if (enc) {
- ret = wc_AesCbcEncrypt(aes, out, aes->ctsBlock,
- WC_AES_BLOCK_SIZE * 2);
- }
- else {
- ret = wc_AesCbcDecrypt(aes, out, aes->ctsBlock,
- WC_AES_BLOCK_SIZE * 2);
- }
- if (ret != 0)
- return ret;
- out += WC_AES_BLOCK_SIZE * 2;
- writtenSz += WC_AES_BLOCK_SIZE * 2;
- tmpOutSz -= WC_AES_BLOCK_SIZE * 2;
- aes->left = 0;
- }
- else if (inSz > 0) {
- if (tmpOutSz < WC_AES_BLOCK_SIZE)
- return BUFFER_E;
- if (enc) {
- ret = wc_AesCbcEncrypt(aes, out, aes->ctsBlock,
- WC_AES_BLOCK_SIZE);
- }
- else {
- ret = wc_AesCbcDecrypt(aes, out, aes->ctsBlock,
- WC_AES_BLOCK_SIZE);
- }
- if (ret != 0)
- return ret;
- out += WC_AES_BLOCK_SIZE;
- writtenSz += WC_AES_BLOCK_SIZE;
- tmpOutSz -= WC_AES_BLOCK_SIZE;
- /* Move the last block in ctsBlock to the beginning for
- * next operation */
- XMEMCPY(aes->ctsBlock, aes->ctsBlock + WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- XMEMCPY(aes->ctsBlock + WC_AES_BLOCK_SIZE, in, inSz);
- aes->left = WC_AES_BLOCK_SIZE + inSz;
- *outSz = writtenSz;
- return ret; /* Return the result of encryption */
- }
- else {
- /* Can't output data as we need > 1 block for Final call */
- *outSz = writtenSz;
- return 0;
- }
- }
- else {
- /* All input has been absorbed into aes->ctsBlock */
- *outSz = 0;
- return 0;
- }
- }
- if (inSz > WC_AES_BLOCK_SIZE) {
- /* We need to store the last two full or partial blocks */
- blocks = (inSz + (WC_AES_BLOCK_SIZE - 1)) / WC_AES_BLOCK_SIZE;
- blocks -= 2;
- }
- if (tmpOutSz < blocks * WC_AES_BLOCK_SIZE)
- return BUFFER_E;
- if (enc)
- ret = wc_AesCbcEncrypt(aes, out, in, blocks * WC_AES_BLOCK_SIZE);
- else
- ret = wc_AesCbcDecrypt(aes, out, in, blocks * WC_AES_BLOCK_SIZE);
- in += blocks * WC_AES_BLOCK_SIZE;
- inSz -= blocks * WC_AES_BLOCK_SIZE;
- XMEMCPY(aes->ctsBlock, in, inSz);
- aes->left = inSz;
- writtenSz += blocks * WC_AES_BLOCK_SIZE;
- *outSz = writtenSz;
- return ret;
-}
-
-/* Incremental API */
-int wc_AesCtsEncryptUpdate(Aes* aes, byte* out, word32* outSz,
- const byte* in, word32 inSz)
-{
- return AesCtsUpdate(aes, out, outSz, in, inSz, 1);
-}
-
-int wc_AesCtsEncryptFinal(Aes* aes, byte* out, word32* outSz)
-{
- int ret = 0;
-
- if (aes == NULL || out == NULL || outSz == NULL)
- return BAD_FUNC_ARG;
- if (*outSz < aes->left)
- return BUFFER_E;
-
- /* Input must be at least two complete or partial blocks */
- if (aes->left <= WC_AES_BLOCK_SIZE)
- return BAD_FUNC_ARG;
-
- /* Zero padding */
- XMEMSET(aes->ctsBlock + aes->left, 0, (WC_AES_BLOCK_SIZE * 2) - aes->left);
-
- ret = wc_AesCbcEncrypt(aes, aes->ctsBlock, aes->ctsBlock,
- WC_AES_BLOCK_SIZE * 2);
- if (ret != 0)
- return ret;
-
- XMEMCPY(out, aes->ctsBlock + WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
- XMEMCPY(out + WC_AES_BLOCK_SIZE, aes->ctsBlock,
- aes->left - WC_AES_BLOCK_SIZE);
- *outSz = aes->left;
- return ret;
-}
-
-int wc_AesCtsDecryptUpdate(Aes* aes, byte* out, word32* outSz,
- const byte* in, word32 inSz)
-{
- return AesCtsUpdate(aes, out, outSz, in, inSz, 0);
-}
-
-int wc_AesCtsDecryptFinal(Aes* aes, byte* out, word32* outSz)
-{
- int ret = 0;
- byte iv[WC_AES_BLOCK_SIZE];
- byte tmp[WC_AES_BLOCK_SIZE];
- word32 partialSz;
- word32 padSz;
-
- if (aes == NULL || out == NULL || outSz == NULL)
- return BAD_FUNC_ARG;
- if (*outSz < aes->left)
- return BUFFER_E;
-
- /* Input must be at least two complete or partial blocks */
- if (aes->left <= WC_AES_BLOCK_SIZE)
- return BAD_FUNC_ARG;
-
- partialSz = aes->left - WC_AES_BLOCK_SIZE;
- padSz = 2 * WC_AES_BLOCK_SIZE - aes->left;
- /* Zero pad */
- XMEMSET(aes->ctsBlock + aes->left, 0, padSz);
-
- /* Store IV */
- XMEMCPY(iv, aes->reg, WC_AES_BLOCK_SIZE);
- /* Load IV */
- XMEMCPY(aes->reg, aes->ctsBlock + WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-
- ret = wc_AesCbcDecrypt(aes, tmp, aes->ctsBlock, WC_AES_BLOCK_SIZE);
- if (ret != 0)
- return ret;
-
- /* Write out partial block */
- XMEMCPY(out + WC_AES_BLOCK_SIZE, tmp, partialSz);
- /* Retrieve the padding */
- XMEMCPY(aes->ctsBlock + aes->left, tmp + partialSz, padSz);
- /* Restore IV */
- XMEMCPY(aes->reg, iv, WC_AES_BLOCK_SIZE);
-
- ret = wc_AesCbcDecrypt(aes, out, aes->ctsBlock + WC_AES_BLOCK_SIZE,
- WC_AES_BLOCK_SIZE);
- if (ret != 0)
- return ret;
-
- *outSz = aes->left;
- return ret;
-}
-
-#endif /* WOLFSSL_AES_CTS */
-
-
-#endif /* !NO_AES */
diff --git a/src/ssl/wolfssl/wolfcrypt/arc4.c b/src/ssl/wolfssl/wolfcrypt/arc4.c
deleted file mode 100644
index da997f692..000000000
--- a/src/ssl/wolfssl/wolfcrypt/arc4.c
+++ /dev/null
@@ -1,143 +0,0 @@
-/* arc4.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifndef NO_RC4
-
-#include
-
-
-int wc_Arc4SetKey(Arc4* arc4, const byte* key, word32 length)
-{
- int ret = 0;
- word32 i;
- word32 keyIndex = 0, stateIndex = 0;
-
- if (arc4 == NULL || key == NULL || length == 0) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ARC4) && \
- defined(HAVE_CAVIUM) && !defined(HAVE_CAVIUM_V)
- if (arc4->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ARC4) {
- return NitroxArc4SetKey(arc4, key, length);
- }
-#endif
-
- arc4->x = 1;
- arc4->y = 0;
-
- for (i = 0; i < ARC4_STATE_SIZE; i++)
- arc4->state[i] = (byte)i;
-
- for (i = 0; i < ARC4_STATE_SIZE; i++) {
- word32 a = arc4->state[i];
- stateIndex += key[keyIndex] + a;
- stateIndex &= 0xFF;
- arc4->state[i] = arc4->state[stateIndex];
- arc4->state[stateIndex] = (byte)a;
-
- if (++keyIndex >= length)
- keyIndex = 0;
- }
-
- return ret;
-}
-
-
-static WC_INLINE byte MakeByte(word32* x, word32* y, byte* s)
-{
- word32 a = s[*x], b;
- *y = (*y+a) & 0xff;
-
- b = s[*y];
- s[*x] = (byte)b;
- s[*y] = (byte)a;
- *x = (*x+1) & 0xff;
-
- return s[(a+b) & 0xff];
-}
-
-
-int wc_Arc4Process(Arc4* arc4, byte* out, const byte* in, word32 length)
-{
- int ret = 0;
- word32 x;
- word32 y;
-
- if (arc4 == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ARC4) && \
- defined(HAVE_CAVIUM) && !defined(HAVE_CAVIUM_V)
- if (arc4->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ARC4) {
- return NitroxArc4Process(arc4, out, in, length);
- }
-#endif
-
- x = arc4->x;
- y = arc4->y;
-
- while(length--)
- *out++ = *in++ ^ MakeByte(&x, &y, arc4->state);
-
- arc4->x = (byte)x;
- arc4->y = (byte)y;
-
- return ret;
-}
-
-/* Initialize Arc4 for use with async device */
-int wc_Arc4Init(Arc4* arc4, void* heap, int devId)
-{
- int ret = 0;
-
- if (arc4 == NULL)
- return BAD_FUNC_ARG;
-
- arc4->heap = heap;
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ARC4)
- ret = wolfAsync_DevCtxInit(&arc4->asyncDev, WOLFSSL_ASYNC_MARKER_ARC4,
- arc4->heap, devId);
-#else
- (void)devId;
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
- return ret;
-}
-
-
-/* Free Arc4 from use with async device */
-void wc_Arc4Free(Arc4* arc4)
-{
- if (arc4 == NULL)
- return;
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ARC4)
- wolfAsync_DevCtxFree(&arc4->asyncDev, WOLFSSL_ASYNC_MARKER_ARC4);
-#endif /* WOLFSSL_ASYNC_CRYPT */
-}
-
-#endif /* NO_RC4 */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/ascon.c b/src/ssl/wolfssl/wolfcrypt/ascon.c
deleted file mode 100644
index 4ddbcfc9a..000000000
--- a/src/ssl/wolfssl/wolfcrypt/ascon.c
+++ /dev/null
@@ -1,521 +0,0 @@
-/* ascon.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef HAVE_ASCON
-
-#include
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-/*
- * Implementation of the ASCON AEAD and HASH algorithms. Based on the NIST
- * Initial Public Draft "NIST SP 800-232 ipd" and reference implementation found
- * at https://github.com/ascon/ascon-c.
- */
-
-/*
- * TODO
- * - Add support for big-endian systems
- * - Add support for 32-bit and smaller systems */
-
-#ifndef WORD64_AVAILABLE
- #error "Ascon implementation requires a 64-bit word"
-#endif
-
-/* Data block size in bytes */
-#define ASCON_HASH256_RATE 8
-#define ASCON_HASH256_ROUNDS 12
-#define ASCON_HASH256_IV 0x0000080100CC0002ULL
-
-#define ASCON_AEAD128_ROUNDS_PA 12
-#define ASCON_AEAD128_ROUNDS_PB 8
-#define ASCON_AEAD128_IV 0x00001000808C0001ULL
-#define ASCON_AEAD128_RATE 16
-
-#define MAX_ROUNDS 12
-
-#ifndef WOLFSSL_ASCON_UNROLL
-
-/* Table 5 */
-static const byte round_constants[MAX_ROUNDS] = {
- 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87, 0x78, 0x69, 0x5a, 0x4b
-};
-
-static byte start_index(byte rounds)
-{
- switch (rounds) {
- case 8:
- return 4;
- case 12:
- return 0;
- default:
- WOLFSSL_MSG("Something went wrong in wolfCrypt logic. Wrong ASCON "
- "rounds value.");
- return MAX_ROUNDS;
- }
-}
-
-static WC_INLINE void ascon_round(AsconState* a, byte round)
-{
- word64 tmp0, tmp1, tmp2, tmp3, tmp4;
- /* 3.2 Constant-Addition Layer */
- a->s64[2] ^= round_constants[round];
- /* 3.3 Substitution Layer */
- a->s64[0] ^= a->s64[4];
- a->s64[4] ^= a->s64[3];
- a->s64[2] ^= a->s64[1];
- tmp0 = a->s64[0] ^ (~a->s64[1] & a->s64[2]);
- tmp2 = a->s64[2] ^ (~a->s64[3] & a->s64[4]);
- tmp4 = a->s64[4] ^ (~a->s64[0] & a->s64[1]);
- tmp1 = a->s64[1] ^ (~a->s64[2] & a->s64[3]);
- tmp3 = a->s64[3] ^ (~a->s64[4] & a->s64[0]);
- tmp1 ^= tmp0;
- tmp3 ^= tmp2;
- tmp0 ^= tmp4;
- tmp2 = ~tmp2;
- /* 3.4 Linear Diffusion Layer */
- a->s64[4] = tmp4 ^ rotrFixed64(tmp4, 7) ^ rotrFixed64(tmp4, 41);
- a->s64[1] = tmp1 ^ rotrFixed64(tmp1, 61) ^ rotrFixed64(tmp1, 39);
- a->s64[3] = tmp3 ^ rotrFixed64(tmp3, 10) ^ rotrFixed64(tmp3, 17);
- a->s64[0] = tmp0 ^ rotrFixed64(tmp0, 19) ^ rotrFixed64(tmp0, 28);
- a->s64[2] = tmp2 ^ rotrFixed64(tmp2, 1) ^ rotrFixed64(tmp2, 6);
-}
-
-static void permutation(AsconState* a, byte rounds)
-{
- byte i = start_index(rounds);
- for (; i < MAX_ROUNDS; i++) {
- ascon_round(a, i);
- }
-}
-
-#else
-
-#define p(a, c) do { \
- word64 tmp0, tmp1, tmp2, tmp3, tmp4; \
- /* 3.2 Constant-Addition Layer */ \
- (a)->s64[2] ^= c; \
- /* 3.3 Substitution Layer */ \
- (a)->s64[0] ^= (a)->s64[4]; \
- (a)->s64[4] ^= (a)->s64[3]; \
- (a)->s64[2] ^= (a)->s64[1]; \
- tmp0 = (a)->s64[0] ^ (~(a)->s64[1] & (a)->s64[2]); \
- tmp2 = (a)->s64[2] ^ (~(a)->s64[3] & (a)->s64[4]); \
- tmp4 = (a)->s64[4] ^ (~(a)->s64[0] & (a)->s64[1]); \
- tmp1 = (a)->s64[1] ^ (~(a)->s64[2] & (a)->s64[3]); \
- tmp3 = (a)->s64[3] ^ (~(a)->s64[4] & (a)->s64[0]); \
- tmp1 ^= tmp0; \
- tmp3 ^= tmp2; \
- tmp0 ^= tmp4; \
- tmp2 = ~tmp2; \
- /* 3.4 Linear Diffusion Layer */ \
- (a)->s64[4] = tmp4 ^ rotrFixed64(tmp4, 7) ^ rotrFixed64(tmp4, 41); \
- (a)->s64[1] = tmp1 ^ rotrFixed64(tmp1, 61) ^ rotrFixed64(tmp1, 39); \
- (a)->s64[3] = tmp3 ^ rotrFixed64(tmp3, 10) ^ rotrFixed64(tmp3, 17); \
- (a)->s64[0] = tmp0 ^ rotrFixed64(tmp0, 19) ^ rotrFixed64(tmp0, 28); \
- (a)->s64[2] = tmp2 ^ rotrFixed64(tmp2, 1) ^ rotrFixed64(tmp2, 6); \
-} while (0)
-
-#define p8(a) \
- p(a, 0xb4); \
- p(a, 0xa5); \
- p(a, 0x96); \
- p(a, 0x87); \
- p(a, 0x78); \
- p(a, 0x69); \
- p(a, 0x5a); \
- p(a, 0x4b)
-
-#define p12(a) \
- p(a, 0xf0); \
- p(a, 0xe1); \
- p(a, 0xd2); \
- p(a, 0xc3); \
- p8(a)
-
-/* Needed layer to evaluate the macro values */
-#define _permutation(a, rounds) \
- p ## rounds(a)
-
-#define permutation(a, rounds) \
- _permutation(a, rounds)
-
-#endif
-
-/* AsconHash API */
-
-wc_AsconHash256* wc_AsconHash256_New(void)
-{
- wc_AsconHash256* ret = (wc_AsconHash256*)XMALLOC(sizeof(wc_AsconHash256),
- NULL, DYNAMIC_TYPE_ASCON);
- if (ret != NULL) {
- if (wc_AsconHash256_Init(ret) != 0) {
- wc_AsconHash256_Free(ret);
- ret = NULL;
- }
- }
- return ret;
-}
-
-void wc_AsconHash256_Free(wc_AsconHash256* a)
-{
- if (a != NULL) {
- wc_AsconHash256_Clear(a);
- XFREE(a, NULL, DYNAMIC_TYPE_ASCON);
- }
-}
-
-int wc_AsconHash256_Init(wc_AsconHash256* a)
-{
- if (a == NULL)
- return BAD_FUNC_ARG;
-
- XMEMSET(a, 0, sizeof(*a));
-
- a->state.s64[0] = ASCON_HASH256_IV;
- permutation(&a->state, ASCON_HASH256_ROUNDS);
-
- return 0;
-}
-
-void wc_AsconHash256_Clear(wc_AsconHash256* a)
-{
- if (a != NULL) {
- ForceZero(a, sizeof(*a));
- }
-}
-
-int wc_AsconHash256_Update(wc_AsconHash256* a, const byte* data, word32 dataSz)
-{
- if (a == NULL || (data == NULL && dataSz != 0))
- return BAD_FUNC_ARG;
-
- if (dataSz == 0)
- return 0;
-
- /* Process leftover block */
- if (a->lastBlkSz != 0) {
- word32 toProcess = min(ASCON_HASH256_RATE - a->lastBlkSz, dataSz);
- xorbuf(a->state.s8 + a->lastBlkSz, data, toProcess);
- data += toProcess;
- dataSz -= toProcess;
- a->lastBlkSz += toProcess;
-
- if (a->lastBlkSz < ASCON_HASH256_RATE)
- return 0;
-
- permutation(&a->state, ASCON_HASH256_ROUNDS);
- /* Reset the counter */
- a->lastBlkSz = 0;
- }
-
- while (dataSz >= ASCON_HASH256_RATE) {
- /* Read in input as little endian numbers */
- xorbuf(a->state.s64, data, ASCON_HASH256_RATE);
- permutation(&a->state, ASCON_HASH256_ROUNDS);
- data += ASCON_HASH256_RATE;
- dataSz -= ASCON_HASH256_RATE;
- }
-
- xorbuf(a->state.s64, data, dataSz);
- a->lastBlkSz = dataSz;
-
- return 0;
-}
-
-int wc_AsconHash256_Final(wc_AsconHash256* a, byte* hash)
-{
- byte i;
-
- if (a == NULL || hash == NULL)
- return BAD_FUNC_ARG;
-
- /* Process last block */
- a->state.s8[a->lastBlkSz] ^= 1;
-
- for (i = 0; i < ASCON_HASH256_SZ; i += ASCON_HASH256_RATE) {
- permutation(&a->state, ASCON_HASH256_ROUNDS);
- XMEMCPY(hash, a->state.s64, ASCON_HASH256_RATE);
- hash += ASCON_HASH256_RATE;
- }
-
- /* Clear state as soon as possible */
- wc_AsconHash256_Clear(a);
- return 0;
-}
-
-/* AsconAEAD API */
-
-wc_AsconAEAD128* wc_AsconAEAD128_New(void)
-{
- wc_AsconAEAD128 *ret = (wc_AsconAEAD128*) XMALLOC(sizeof(wc_AsconAEAD128),
- NULL, DYNAMIC_TYPE_ASCON);
- if (ret != NULL) {
- if (wc_AsconAEAD128_Init(ret) != 0) {
- wc_AsconAEAD128_Free(ret);
- ret = NULL;
- }
- }
- return ret;
-}
-
-void wc_AsconAEAD128_Free(wc_AsconAEAD128 *a)
-{
- if (a != NULL) {
- wc_AsconAEAD128_Clear(a);
- XFREE(a, NULL, DYNAMIC_TYPE_ASCON);
- }
-}
-
-int wc_AsconAEAD128_Init(wc_AsconAEAD128 *a)
-{
- if (a == NULL)
- return BAD_FUNC_ARG;
-
- XMEMSET(a, 0, sizeof(*a));
- a->state.s64[0] = ASCON_AEAD128_IV;
-
- return 0;
-}
-
-void wc_AsconAEAD128_Clear(wc_AsconAEAD128 *a)
-{
- if (a != NULL) {
- ForceZero(a, sizeof(*a));
- }
-}
-
-int wc_AsconAEAD128_SetKey(wc_AsconAEAD128* a, const byte* key)
-{
- if (a == NULL || key == NULL)
- return BAD_FUNC_ARG;
- if (a->keySet)
- return BAD_STATE_E;
-
- XMEMCPY(a->key, key, ASCON_AEAD128_KEY_SZ);
- a->state.s64[1] = a->key[0];
- a->state.s64[2] = a->key[1];
- a->keySet = 1;
-
- return 0;
-}
-
-int wc_AsconAEAD128_SetNonce(wc_AsconAEAD128* a, const byte* nonce)
-{
- if (a == NULL || nonce == NULL)
- return BAD_FUNC_ARG;
- if (a->nonceSet)
- return BAD_STATE_E;
-
- XMEMCPY(&a->state.s64[3], nonce, ASCON_AEAD128_NONCE_SZ);
- a->nonceSet = 1;
-
- return 0;
-}
-
-int wc_AsconAEAD128_SetAD(wc_AsconAEAD128* a, const byte* ad,
- word32 adSz)
-{
- if (a == NULL || (ad == NULL && adSz > 0))
- return BAD_FUNC_ARG;
- if (!a->keySet || !a->nonceSet) /* key and nonce must be set before */
- return BAD_STATE_E;
-
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PA);
- a->state.s64[3] ^= a->key[0];
- a->state.s64[4] ^= a->key[1];
-
- if (adSz > 0) {
- while (adSz >= ASCON_AEAD128_RATE) {
- xorbuf(a->state.s64, ad, ASCON_AEAD128_RATE);
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- ad += ASCON_AEAD128_RATE;
- adSz -= ASCON_AEAD128_RATE;
- }
- xorbuf(a->state.s64, ad, adSz);
- /* Pad the last block */
- a->state.s8[adSz] ^= 1;
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- }
- a->state.s64[4] ^= 1ULL << 63;
-
- a->adSet = 1;
- return 0;
-}
-
-int wc_AsconAEAD128_EncryptUpdate(wc_AsconAEAD128* a, byte* out,
- const byte* in, word32 inSz)
-{
- if (a == NULL || (in == NULL && inSz > 0))
- return BAD_FUNC_ARG;
- if (!a->keySet || !a->nonceSet || !a->adSet)
- return BAD_STATE_E;
-
- if (a->op == ASCON_AEAD128_NOTSET)
- a->op = ASCON_AEAD128_ENCRYPT;
- else if (a->op != ASCON_AEAD128_ENCRYPT)
- return BAD_STATE_E;
-
- /* Process leftover from last block */
- if (a->lastBlkSz != 0) {
- word32 toProcess = min(ASCON_AEAD128_RATE - a->lastBlkSz, inSz);
- xorbuf(&a->state.s8[a->lastBlkSz], in, toProcess);
- XMEMCPY(out, &a->state.s8[a->lastBlkSz], toProcess);
- a->lastBlkSz += toProcess;
- in += toProcess;
- out += toProcess;
- inSz -= toProcess;
-
- if (a->lastBlkSz < ASCON_AEAD128_RATE)
- return 0;
-
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- a->lastBlkSz = 0;
- }
-
- while (inSz >= ASCON_AEAD128_RATE) {
- xorbuf(a->state.s64, in, ASCON_AEAD128_RATE);
- XMEMCPY(out, a->state.s64, ASCON_AEAD128_RATE);
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- in += ASCON_AEAD128_RATE;
- out += ASCON_AEAD128_RATE;
- inSz -= ASCON_AEAD128_RATE;
- }
- /* Store leftover */
- xorbuf(a->state.s64, in, inSz);
- XMEMCPY(out, a->state.s64, inSz);
- a->lastBlkSz = inSz;
-
- return 0;
-}
-
-
-int wc_AsconAEAD128_EncryptFinal(wc_AsconAEAD128* a, byte* tag)
-{
- if (a == NULL || tag == NULL)
- return BAD_FUNC_ARG;
- if (!a->keySet || !a->nonceSet || !a->adSet)
- return BAD_STATE_E;
-
- if (a->op != ASCON_AEAD128_ENCRYPT)
- return BAD_STATE_E;
-
- /* Process leftover from last block */
- a->state.s8[a->lastBlkSz] ^= 1;
-
- a->state.s64[2] ^= a->key[0];
- a->state.s64[3] ^= a->key[1];
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PA);
- a->state.s64[3] ^= a->key[0];
- a->state.s64[4] ^= a->key[1];
-
- XMEMCPY(tag, &a->state.s64[3], ASCON_AEAD128_TAG_SZ);
-
- /* Clear state as soon as possible */
- wc_AsconAEAD128_Clear(a);
-
- return 0;
-
-}
-
-
-int wc_AsconAEAD128_DecryptUpdate(wc_AsconAEAD128* a, byte* out,
- const byte* in, word32 inSz)
-{
- if (a == NULL || (in == NULL && inSz > 0))
- return BAD_FUNC_ARG;
- if (!a->keySet || !a->nonceSet || !a->adSet)
- return BAD_STATE_E;
-
- if (a->op == ASCON_AEAD128_NOTSET)
- a->op = ASCON_AEAD128_DECRYPT;
- else if (a->op != ASCON_AEAD128_DECRYPT)
- return BAD_STATE_E;
-
- /* Process leftover block */
- if (a->lastBlkSz != 0) {
- word32 toProcess = min(ASCON_AEAD128_RATE - a->lastBlkSz, inSz);
- xorbufout(out, a->state.s8 + a->lastBlkSz, in, toProcess);
- XMEMCPY(a->state.s8 + a->lastBlkSz, in, toProcess);
- in += toProcess;
- out += toProcess;
- inSz -= toProcess;
- a->lastBlkSz += toProcess;
-
- if (a->lastBlkSz < ASCON_AEAD128_RATE)
- return 0;
-
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- a->lastBlkSz = 0;
- }
-
- while (inSz >= ASCON_AEAD128_RATE) {
- xorbufout(out, a->state.s64, in, ASCON_AEAD128_RATE);
- XMEMCPY(a->state.s64, in, ASCON_AEAD128_RATE);
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PB);
- in += ASCON_AEAD128_RATE;
- out += ASCON_AEAD128_RATE;
- inSz -= ASCON_AEAD128_RATE;
- }
- /* Store leftover */
- xorbufout(out, a->state.s64, in, inSz);
- XMEMCPY(a->state.s64, in, inSz);
- a->lastBlkSz = inSz;
-
- return 0;
-}
-
-int wc_AsconAEAD128_DecryptFinal(wc_AsconAEAD128* a, const byte* tag)
-{
- if (a == NULL || tag == NULL)
- return BAD_FUNC_ARG;
- if (!a->keySet || !a->nonceSet || !a->adSet)
- return BAD_STATE_E;
-
- if (a->op != ASCON_AEAD128_DECRYPT)
- return BAD_STATE_E;
-
- /* Pad last block */
- a->state.s8[a->lastBlkSz] ^= 1;
-
- a->state.s64[2] ^= a->key[0];
- a->state.s64[3] ^= a->key[1];
- permutation(&a->state, ASCON_AEAD128_ROUNDS_PA);
- a->state.s64[3] ^= a->key[0];
- a->state.s64[4] ^= a->key[1];
-
- if (ConstantCompare(tag, (const byte*)&a->state.s64[3],
- ASCON_AEAD128_TAG_SZ) != 0)
- return ASCON_AUTH_E;
-
- /* Clear state as soon as possible */
- wc_AsconAEAD128_Clear(a);
-
- return 0;
-}
-
-#endif /* HAVE_ASCON */
diff --git a/src/ssl/wolfssl/wolfcrypt/asm.c b/src/ssl/wolfssl/wolfcrypt/asm.c
deleted file mode 100644
index b061bb3ad..000000000
--- a/src/ssl/wolfssl/wolfcrypt/asm.c
+++ /dev/null
@@ -1,1832 +0,0 @@
-/* asm.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-/*
- * Based on public domain TomsFastMath 0.10 by Tom St Denis, tomstdenis@iahu.ca,
- * http://math.libtomcrypt.com
- */
-
-
-/******************************************************************/
-/* fp_montgomery_reduce.c asm or generic */
-
-
-/* Each platform needs to query info type 1 from cpuid to see if aesni is
- * supported. Also, let's setup a macro for proper linkage w/o ABI conflicts
- */
-
-#if defined(HAVE_INTEL_MULX)
-#ifndef _MSC_VER
- #define cpuid(reg, leaf, sub)\
- __asm__ __volatile__ ("cpuid":\
- "=a" (reg[0]), "=b" (reg[1]), "=c" (reg[2]), "=d" (reg[3]) :\
- "a" (leaf), "c"(sub));
-#else
- #include
- #define cpuid(a,b,c) __cpuidex((int*)a,b,c)
-#endif /* _MSC_VER */
-
-#define EAX 0
-#define EBX 1
-#define ECX 2
-#define EDX 3
-
-#define CPUID_AVX1 0x1
-#define CPUID_AVX2 0x2
-#define CPUID_RDRAND 0x4
-#define CPUID_RDSEED 0x8
-#define CPUID_BMI2 0x10 /* MULX, RORX */
-#define CPUID_ADX 0x20 /* ADCX, ADOX */
-
-#define IS_INTEL_AVX1 (cpuid_flags&CPUID_AVX1)
-#define IS_INTEL_AVX2 (cpuid_flags&CPUID_AVX2)
-#define IS_INTEL_BMI2 (cpuid_flags&CPUID_BMI2)
-#define IS_INTEL_ADX (cpuid_flags&CPUID_ADX)
-#define IS_INTEL_RDRAND (cpuid_flags&CPUID_RDRAND)
-#define IS_INTEL_RDSEED (cpuid_flags&CPUID_RDSEED)
-#define SET_FLAGS
-
-static word32 cpuid_check = 0 ;
-static word32 cpuid_flags = 0 ;
-
-static word32 cpuid_flag(word32 leaf, word32 sub, word32 num, word32 bit) {
- int got_intel_cpu = 0;
- int got_amd_cpu = 0;
- unsigned int reg[5];
-
- reg[4] = '\0' ;
- cpuid(reg, 0, 0);
-
- /* check for intel cpu */
- if( memcmp((char *)&(reg[EBX]), "Genu", 4) == 0 &&
- memcmp((char *)&(reg[EDX]), "ineI", 4) == 0 &&
- memcmp((char *)&(reg[ECX]), "ntel", 4) == 0) {
- got_intel_cpu = 1;
- }
-
- /* check for AMD cpu */
- if( memcmp((char *)&(reg[EBX]), "Auth", 4) == 0 &&
- memcmp((char *)&(reg[EDX]), "enti", 4) == 0 &&
- memcmp((char *)&(reg[ECX]), "cAMD", 4) == 0) {
- got_amd_cpu = 1;
- }
- if (got_intel_cpu || got_amd_cpu) {
- cpuid(reg, leaf, sub);
- return((reg[num]>>bit)&0x1) ;
- }
- return 0 ;
-}
-
-WC_INLINE static int set_cpuid_flags(void) {
- if(cpuid_check == 0) {
- if(cpuid_flag(7, 0, EBX, 8)){ cpuid_flags |= CPUID_BMI2 ; }
- if(cpuid_flag(7, 0, EBX,19)){ cpuid_flags |= CPUID_ADX ; }
- cpuid_check = 1 ;
- return 0 ;
- }
- return 1 ;
-}
-
-#define RETURN return
-#define IF_HAVE_INTEL_MULX(func, ret) \
- if(cpuid_check==0)set_cpuid_flags() ; \
- if(IS_INTEL_BMI2 && IS_INTEL_ADX){ func; ret ; }
-
-#else
- #define IF_HAVE_INTEL_MULX(func, ret) WC_DO_NOTHING
-#endif
-
-#if defined(TFM_X86) && !defined(TFM_SSE2)
-/* x86-32 code */
-
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#define INNERMUL \
-__asm__( \
- "movl %5,%%eax \n\t" \
- "mull %4 \n\t" \
- "addl %1,%%eax \n\t" \
- "adcl $0,%%edx \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl $0,%%edx \n\t" \
- "movl %%edx,%1 \n\t" \
-:"=g"(_c[LO]), "=r"(cy) \
-:"0"(_c[LO]), "1"(cy), "r"(mu), "r"(*tmpm++) \
-: "%eax", "%edx", "cc")
-
-#define PROPCARRY \
-__asm__( \
- "addl %1,%0 \n\t" \
- "setb %%al \n\t" \
- "movzbl %%al,%1 \n\t" \
-:"=g"(_c[LO]), "=r"(cy) \
-:"0"(_c[LO]), "1"(cy) \
-: "%eax", "cc")
-
-/******************************************************************/
-#elif defined(TFM_X86_64)
-/* x86-64 code */
-
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#define INNERMUL \
-__asm__( \
- "movq %5,%%rax \n\t" \
- "mulq %4 \n\t" \
- "addq %1,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rdx,%1 \n\t" \
-:"=g"(_c[LO]), "=r"(cy) \
-:"0"(_c[LO]), "1"(cy), "r"(mu), "r"(*tmpm++) \
-: "%rax", "%rdx", "cc")
-
-#if defined(HAVE_INTEL_MULX)
-#define MULX_INNERMUL8(x,y,z,cy) \
- __asm__ volatile ( \
- "movq %[yn], %%rdx\n\t" \
- "xorq %%rcx, %%rcx\n\t" \
- "movq 0(%[c]), %%r8\n\t" \
- "movq 8(%[c]), %%r9\n\t" \
- "movq 16(%[c]), %%r10\n\t" \
- "movq 24(%[c]), %%r11\n\t" \
- "movq 32(%[c]), %%r12\n\t" \
- "movq 40(%[c]), %%r13\n\t" \
- "movq 48(%[c]), %%r14\n\t" \
- "movq 56(%[c]), %%r15\n\t" \
- \
- "mulx 0(%[xp]), %%rax, %%rcx\n\t" \
- "adcxq %[cy], %%r8\n\t" \
- "adoxq %%rax, %%r8\n\t" \
- "mulx 8(%[xp]), %%rax, %[cy]\n\t" \
- "adcxq %%rcx, %%r9\n\t" \
- "adoxq %%rax, %%r9\n\t" \
- "mulx 16(%[xp]), %%rax, %%rcx\n\t" \
- "adcxq %[cy], %%r10\n\t" \
- "adoxq %%rax, %%r10\n\t" \
- "mulx 24(%[xp]), %%rax, %[cy]\n\t" \
- "adcxq %%rcx, %%r11\n\t" \
- "adoxq %%rax, %%r11\n\t" \
- "mulx 32(%[xp]), %%rax, %%rcx\n\t" \
- "adcxq %[cy], %%r12\n\t" \
- "adoxq %%rax, %%r12\n\t" \
- "mulx 40(%[xp]), %%rax, %[cy]\n\t" \
- "adcxq %%rcx, %%r13\n\t" \
- "adoxq %%rax, %%r13\n\t" \
- "mulx 48(%[xp]), %%rax, %%rcx\n\t" \
- "adcxq %[cy], %%r14\n\t" \
- "adoxq %%rax, %%r14\n\t" \
- "adcxq %%rcx, %%r15\n\t" \
- "mulx 56(%[xp]), %%rax, %[cy]\n\t" \
- "movq $0, %%rdx\n\t" \
- "adoxq %%rdx, %%rax\n\t" \
- "adcxq %%rdx, %[cy]\n\t" \
- "adoxq %%rdx, %[cy]\n\t" \
- "addq %%rax, %%r15\n\t" \
- "adcq $0, %[cy]\n\t" \
- \
- "movq %%r8, 0(%[c])\n\t" \
- "movq %%r9, 8(%[c])\n\t" \
- "movq %%r10, 16(%[c])\n\t" \
- "movq %%r11, 24(%[c])\n\t" \
- "movq %%r12, 32(%[c])\n\t" \
- "movq %%r13, 40(%[c])\n\t" \
- "movq %%r14, 48(%[c])\n\t" \
- "movq %%r15, 56(%[c])\n\t" \
- : [cy] "+r" (cy) \
- : [xp] "r" (x), [c] "r" (c_mulx), [yn] "rm" (y) \
- :"%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15", \
- "%rdx", "%rax", "%rcx" \
- )
-
-#define INNERMUL8_MULX \
-{\
- MULX_INNERMUL8(tmpm, mu, _c, cy);\
-}
-#endif
-
-#define INNERMUL8 \
- __asm__( \
- "movq 0(%5),%%rax \n\t" \
- "movq 0(%2),%%r10 \n\t" \
- "movq 0x8(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x8(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x10(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x10(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x8(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x18(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x18(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x10(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x20(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x20(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x18(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x28(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x28(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x20(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x30(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x30(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x28(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "movq 0x38(%5),%%r11 \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq 0x38(%2),%%r10 \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x30(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
- "movq %%r11,%%rax \n\t" \
- "mulq %4 \n\t" \
- "addq %%r10,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "addq %3,%%rax \n\t" \
- "adcq $0,%%rdx \n\t" \
- "movq %%rax,0x38(%0) \n\t" \
- "movq %%rdx,%1 \n\t" \
- \
-:"=r"(_c), "=r"(cy) \
-: "0"(_c), "1"(cy), "g"(mu), "r"(tmpm)\
-: "%rax", "%rdx", "%r10", "%r11", "cc")
-
-#define PROPCARRY \
-__asm__( \
- "addq %1,%0 \n\t" \
- "setb %%al \n\t" \
- "movzbq %%al,%1 \n\t" \
-:"=g"(_c[LO]), "=r"(cy) \
-:"0"(_c[LO]), "1"(cy) \
-: "%rax", "cc")
-
-/******************************************************************/
-#elif defined(TFM_SSE2)
-/* SSE2 code (assumes 32-bit fp_digits) */
-/* XMM register assignments:
- * xmm0 *tmpm++, then Mu * (*tmpm++)
- * xmm1 c[x], then Mu
- * xmm2 mp
- * xmm3 cy
- * xmm4 _c[LO]
- */
-
-#define MONT_START \
- __asm__("movd %0,%%mm2"::"g"(mp))
-
-#define MONT_FINI \
- __asm__("emms")
-
-#define LOOP_START \
-__asm__( \
-"movd %0,%%mm1 \n\t" \
-"pxor %%mm3,%%mm3 \n\t" \
-"pmuludq %%mm2,%%mm1 \n\t" \
-:: "g"(c[x]))
-
-/* pmuludq on mmx registers does a 32x32->64 multiply. */
-#define INNERMUL \
-__asm__( \
- "movd %1,%%mm4 \n\t" \
- "movd %2,%%mm0 \n\t" \
- "paddq %%mm4,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm0 \n\t" \
- "paddq %%mm0,%%mm3 \n\t" \
- "movd %%mm3,%0 \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-:"=g"(_c[LO]) : "0"(_c[LO]), "g"(*tmpm++) );
-
-#define INNERMUL8 \
-__asm__( \
- "movd 0(%1),%%mm4 \n\t" \
- "movd 0(%2),%%mm0 \n\t" \
- "paddq %%mm4,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm0 \n\t" \
- "movd 4(%2),%%mm5 \n\t" \
- "paddq %%mm0,%%mm3 \n\t" \
- "movd 4(%1),%%mm6 \n\t" \
- "movd %%mm3,0(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm6,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm5 \n\t" \
- "movd 8(%2),%%mm6 \n\t" \
- "paddq %%mm5,%%mm3 \n\t" \
- "movd 8(%1),%%mm7 \n\t" \
- "movd %%mm3,4(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm7,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm6 \n\t" \
- "movd 12(%2),%%mm7 \n\t" \
- "paddq %%mm6,%%mm3 \n\t" \
- "movd 12(%1),%%mm5 \n\t" \
- "movd %%mm3,8(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm5,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm7 \n\t" \
- "movd 16(%2),%%mm5 \n\t" \
- "paddq %%mm7,%%mm3 \n\t" \
- "movd 16(%1),%%mm6 \n\t" \
- "movd %%mm3,12(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm6,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm5 \n\t" \
- "movd 20(%2),%%mm6 \n\t" \
- "paddq %%mm5,%%mm3 \n\t" \
- "movd 20(%1),%%mm7 \n\t" \
- "movd %%mm3,16(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm7,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm6 \n\t" \
- "movd 24(%2),%%mm7 \n\t" \
- "paddq %%mm6,%%mm3 \n\t" \
- "movd 24(%1),%%mm5 \n\t" \
- "movd %%mm3,20(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm5,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm7 \n\t" \
- "movd 28(%2),%%mm5 \n\t" \
- "paddq %%mm7,%%mm3 \n\t" \
- "movd 28(%1),%%mm6 \n\t" \
- "movd %%mm3,24(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-\
- "paddq %%mm6,%%mm3 \n\t" \
- "pmuludq %%mm1,%%mm5 \n\t" \
- "paddq %%mm5,%%mm3 \n\t" \
- "movd %%mm3,28(%0) \n\t" \
- "psrlq $32, %%mm3 \n\t" \
-:"=r"(_c) : "0"(_c), "r"(tmpm) );
-
-/* TAO switched tmpm from "g" to "r" after gcc tried to index the indexed stack
- pointer */
-
-#define LOOP_END \
-__asm__( "movd %%mm3,%0 \n" :"=r"(cy))
-
-#define PROPCARRY \
-__asm__( \
- "addl %1,%0 \n\t" \
- "setb %%al \n\t" \
- "movzbl %%al,%1 \n\t" \
-:"=g"(_c[LO]), "=r"(cy) \
-:"0"(_c[LO]), "1"(cy) \
-: "%eax", "cc")
-
-/******************************************************************/
-#elif defined(TFM_ARM)
- /* ARMv4 code */
-
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-
-#ifdef __thumb__
-
-#define INNERMUL \
-__asm__( \
- " LDR r0,%1 \n\t" \
- " ADDS r0,r0,%0 \n\t" \
- " ITE CS \n\t" \
- " MOVCS %0,#1 \n\t" \
- " MOVCC %0,#0 \n\t" \
- " UMLAL r0,%0,%3,%4 \n\t" \
- " STR r0,%1 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"r"(mu),"r"(*tmpm++),"m"(_c[0]):"r0","cc");
-
-#define PROPCARRY \
-__asm__( \
- " LDR r0,%1 \n\t" \
- " ADDS r0,r0,%0 \n\t" \
- " STR r0,%1 \n\t" \
- " ITE CS \n\t" \
- " MOVCS %0,#1 \n\t" \
- " MOVCC %0,#0 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"m"(_c[0]):"r0","cc");
-
-
-/* TAO thumb mode uses ite (if then else) to detect carry directly
- * fixed unmatched constraint warning by changing 1 to m */
-
-#else /* __thumb__ */
-
-#define INNERMUL \
-__asm__( \
- " LDR r0,%1 \n\t" \
- " ADDS r0,r0,%0 \n\t" \
- " MOVCS %0,#1 \n\t" \
- " MOVCC %0,#0 \n\t" \
- " UMLAL r0,%0,%3,%4 \n\t" \
- " STR r0,%1 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"r"(mu),"r"(*tmpm++),"1"(_c[0]):"r0","cc");
-
-#define PROPCARRY \
-__asm__( \
- " LDR r0,%1 \n\t" \
- " ADDS r0,r0,%0 \n\t" \
- " STR r0,%1 \n\t" \
- " MOVCS %0,#1 \n\t" \
- " MOVCC %0,#0 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"1"(_c[0]):"r0","cc");
-
-#endif /* __thumb__ */
-
-#elif defined(TFM_PPC32)
-
-/* PPC32 */
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#ifdef __APPLE__
-
-#define INNERMUL \
-__asm__( \
- " mullw r16,%3,%4 \n\t" \
- " mulhwu r17,%3,%4 \n\t" \
- " addc r16,r16,%2 \n\t" \
- " addze r17,r17 \n\t" \
- " addc %1,r16,%5 \n\t" \
- " addze %0,r17 \n\t" \
-:"=r"(cy),"=r"(_c[0]):"0"(cy),"r"(mu),"r"(tmpm[0]),"1"(_c[0]):"r16", "r17", "cc"); ++tmpm;
-
-#define PROPCARRY \
-__asm__( \
- " addc %1,%3,%2 \n\t" \
- " xor %0,%2,%2 \n\t" \
- " addze %0,%2 \n\t" \
-:"=r"(cy),"=r"(_c[0]):"0"(cy),"1"(_c[0]):"cc");
-
-#else
-
-#define INNERMUL \
-__asm__( \
- " mullw 16,%3,%4 \n\t" \
- " mulhwu 17,%3,%4 \n\t" \
- " addc 16,16,%2 \n\t" \
- " addze 17,17 \n\t" \
- " addc %1,16,%5 \n\t" \
- " addze %0,17 \n\t" \
-:"=r"(cy),"=r"(_c[0]):"0"(cy),"r"(mu),"r"(tmpm[0]),"1"(_c[0]):"16", "17", "cc"); ++tmpm;
-
-#define PROPCARRY \
-__asm__( \
- " addc %1,%3,%2 \n\t" \
- " xor %0,%2,%2 \n\t" \
- " addze %0,%2 \n\t" \
-:"=r"(cy),"=r"(_c[0]):"0"(cy),"1"(_c[0]):"cc");
-
-#endif
-
-#elif defined(TFM_PPC64)
-
-/* PPC64 */
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#ifdef __APPLE__
-
-#define INNERMUL \
-__asm__( \
- " mulld r16,%3,%4 \n\t" \
- " mulhdu r17,%3,%4 \n\t" \
- " addc r16,16,%0 \n\t" \
- " addze r17,r17 \n\t" \
- " ldx r18,0,%1 \n\t" \
- " addc r16,r16,r18 \n\t" \
- " addze %0,r17 \n\t" \
- " sdx r16,0,%1 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"r"(mu),"r"(tmpm[0]),"1"(_c[0]):"r16", "r17", "r18","cc"); ++tmpm;
-
-#define PROPCARRY \
-__asm__( \
- " ldx r16,0,%1 \n\t" \
- " addc r16,r16,%0 \n\t" \
- " sdx r16,0,%1 \n\t" \
- " xor %0,%0,%0 \n\t" \
- " addze %0,%0 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"1"(_c[0]):"r16","cc");
-
-#else
-
-#define INNERMUL \
-__asm__( \
- " mulld 16,%3,%4 \n\t" \
- " mulhdu 17,%3,%4 \n\t" \
- " addc 16,16,%0 \n\t" \
- " addze 17,17 \n\t" \
- " ldx 18,0,%1 \n\t" \
- " addc 16,16,18 \n\t" \
- " addze %0,17 \n\t" \
- " sdx 16,0,%1 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"r"(mu),"r"(tmpm[0]),"1"(_c[0]):"16", "17", "18","cc"); ++tmpm;
-
-#define PROPCARRY \
-__asm__( \
- " ldx 16,0,%1 \n\t" \
- " addc 16,16,%0 \n\t" \
- " sdx 16,0,%1 \n\t" \
- " xor %0,%0,%0 \n\t" \
- " addze %0,%0 \n\t" \
-:"=r"(cy),"=m"(_c[0]):"0"(cy),"1"(_c[0]):"16","cc");
-
-#endif
-
-/******************************************************************/
-
-#elif defined(TFM_AVR32)
-
-/* AVR32 */
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#define INNERMUL \
-__asm__( \
- " ld.w r2,%1 \n\t" \
- " add r2,%0 \n\t" \
- " eor r3,r3 \n\t" \
- " acr r3 \n\t" \
- " macu.d r2,%3,%4 \n\t" \
- " st.w %1,r2 \n\t" \
- " mov %0,r3 \n\t" \
-:"=r"(cy),"=r"(_c):"0"(cy),"r"(mu),"r"(*tmpm++),"1"(_c):"r2","r3");
-
-#define PROPCARRY \
-__asm__( \
- " ld.w r2,%1 \n\t" \
- " add r2,%0 \n\t" \
- " st.w %1,r2 \n\t" \
- " eor %0,%0 \n\t" \
- " acr %0 \n\t" \
-:"=r"(cy),"=r"(&_c[0]):"0"(cy),"1"(&_c[0]):"r2","cc");
-
-/******************************************************************/
-#elif defined(TFM_MIPS)
-
-/* MIPS */
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#define INNERMUL \
-__asm__( \
- " multu %3,%4 \n\t" \
- " mflo $12 \n\t" \
- " mfhi $13 \n\t" \
- " addu $12,$12,%0 \n\t" \
- " sltu $10,$12,%0 \n\t" \
- " addu $13,$13,$10 \n\t" \
- " lw $10,%1 \n\t" \
- " addu $12,$12,$10 \n\t" \
- " sltu $10,$12,$10 \n\t" \
- " addu %0,$13,$10 \n\t" \
- " sw $12,%1 \n\t" \
-:"+r"(cy),"+m"(_c[0]):""(cy),"r"(mu),"r"(tmpm[0]),""(_c[0]):"$10","$12","$13"); ++tmpm;
-
-#define PROPCARRY \
-__asm__( \
- " lw $10,%1 \n\t" \
- " addu $10,$10,%0 \n\t" \
- " sw $10,%1 \n\t" \
- " sltu %0,$10,%0 \n\t" \
-:"+r"(cy),"+m"(_c[0]):""(cy),""(_c[0]):"$10");
-
-/******************************************************************/
-#else
-
-/* ISO C code */
-#define MONT_START
-#define MONT_FINI
-#define LOOP_END
-#define LOOP_START \
- mu = c[x] * mp
-
-#define INNERMUL \
- do { fp_word t; \
- t = ((fp_word)_c[0] + (fp_word)cy) + \
- (((fp_word)mu) * ((fp_word)*tmpm++)); \
- _c[0] = (fp_digit)t; \
- cy = (fp_digit)(t >> DIGIT_BIT); \
- } while (0)
-
-#define PROPCARRY \
- do { fp_digit t = _c[0] += cy; cy = (t < cy); } while (0)
-
-#endif
-/******************************************************************/
-
-
-#define LO 0
-/* end fp_montogomery_reduce.c asm */
-
-
-/* start fp_sqr_comba.c asm */
-#if defined(TFM_X86)
-
-/* x86-32 optimized */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-#define SQRADD(i, j) \
-__asm__( \
- "movl %3,%%eax \n\t" \
- "mull %%eax \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"+m"(c0), "+m"(c1), "+m"(c2) \
- : "m"(i) \
- :"%eax","%edx","cc");
-
-#define SQRADD2(i, j) \
-__asm__( \
- "movl %3,%%eax \n\t" \
- "mull %4 \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"+m"(c0), "+m"(c1), "+m"(c2) \
- : "m"(i), "m"(j) \
- :"%eax","%edx", "cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- "movl %3,%%eax \n\t" \
- "mull %4 \n\t" \
- "movl %%eax,%0 \n\t" \
- "movl %%edx,%1 \n\t" \
- "xorl %2,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2) \
- : "g"(i), "g"(j) \
- :"%eax","%edx","cc");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- "movl %6,%%eax \n\t" \
- "mull %7 \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2) \
- : "0"(sc0), "1"(sc1), "2"(sc2), "g"(i), "g"(j) \
- :"%eax","%edx","cc");
-
-#define SQRADDDB \
-__asm__( \
- "addl %6,%0 \n\t" \
- "adcl %7,%1 \n\t" \
- "adcl %8,%2 \n\t" \
- "addl %6,%0 \n\t" \
- "adcl %7,%1 \n\t" \
- "adcl %8,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2) \
- : "0"(c0), "1"(c1), "2"(c2), "r"(sc0), "r"(sc1), \
- "r"(sc2) \
- : "cc");
-
-#elif defined(TFM_X86_64)
-/* x86-64 optimized */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-#define SQRADD(i, j) \
-__asm__( \
- "movq %6,%%rax \n\t" \
- "mulq %%rax \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq %%rdx,%1 \n\t" \
- "adcq $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "x"(i) :"%rax","%rdx","cc");
-
-#define SQRADD2(i, j) \
-__asm__( \
- "movq %6,%%rax \n\t" \
- "mulq %7 \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq %%rdx,%1 \n\t" \
- "adcq $0,%2 \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq %%rdx,%1 \n\t" \
- "adcq $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "g"(i), "g"(j) :"%rax","%rdx","cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- "movq %3,%%rax \n\t" \
- "mulq %4 \n\t" \
- "movq %%rax,%0 \n\t" \
- "movq %%rdx,%1 \n\t" \
- "xorq %2,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2): "g"(i), "g"(j) :"%rax","%rdx","cc");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- "movq %6,%%rax \n\t" \
- "mulq %7 \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq %%rdx,%1 \n\t" \
- "adcq $0,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2): "0"(sc0), "1"(sc1), "2"(sc2), "g"(i), "g"(j) :"%rax","%rdx","cc");
-
-#define SQRADDDB \
-__asm__( \
- "addq %6,%0 \n\t" \
- "adcq %7,%1 \n\t" \
- "adcq %8,%2 \n\t" \
- "addq %6,%0 \n\t" \
- "adcq %7,%1 \n\t" \
- "adcq %8,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2) : "0"(c0), "1"(c1), "2"(c2), "r"(sc0), "r"(sc1), "r"(sc2) : "cc");
-
-#elif defined(TFM_SSE2)
-
-/* SSE2 Optimized */
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI \
- __asm__("emms");
-
-#define SQRADD(i, j) \
-__asm__( \
- "movd %6,%%mm0 \n\t" \
- "pmuludq %%mm0,%%mm0\n\t" \
- "movd %%mm0,%%eax \n\t" \
- "psrlq $32,%%mm0 \n\t" \
- "addl %%eax,%0 \n\t" \
- "movd %%mm0,%%eax \n\t" \
- "adcl %%eax,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i) :"%eax","cc");
-
-#define SQRADD2(i, j) \
-__asm__( \
- "movd %6,%%mm0 \n\t" \
- "movd %7,%%mm1 \n\t" \
- "pmuludq %%mm1,%%mm0\n\t" \
- "movd %%mm0,%%eax \n\t" \
- "psrlq $32,%%mm0 \n\t" \
- "movd %%mm0,%%edx \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j) :"%eax","%edx","cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- "movd %3,%%mm0 \n\t" \
- "movd %4,%%mm1 \n\t" \
- "pmuludq %%mm1,%%mm0\n\t" \
- "movd %%mm0,%0 \n\t" \
- "psrlq $32,%%mm0 \n\t" \
- "movd %%mm0,%1 \n\t" \
- "xorl %2,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2): "m"(i), "m"(j));
-
-/* TAO removed sc0,1,2 as input to remove warning so %6,%7 become %3,%4 */
-
-#define SQRADDAC(i, j) \
-__asm__( \
- "movd %6,%%mm0 \n\t" \
- "movd %7,%%mm1 \n\t" \
- "pmuludq %%mm1,%%mm0\n\t" \
- "movd %%mm0,%%eax \n\t" \
- "psrlq $32,%%mm0 \n\t" \
- "movd %%mm0,%%edx \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(sc0), "=r"(sc1), "=r"(sc2): "0"(sc0), "1"(sc1), "2"(sc2), "m"(i), "m"(j) :"%eax","%edx","cc");
-
-#define SQRADDDB \
-__asm__( \
- "addl %6,%0 \n\t" \
- "adcl %7,%1 \n\t" \
- "adcl %8,%2 \n\t" \
- "addl %6,%0 \n\t" \
- "adcl %7,%1 \n\t" \
- "adcl %8,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2) : "0"(c0), "1"(c1), "2"(c2), "r"(sc0), "r"(sc1), "r"(sc2) : "cc");
-
-#elif defined(TFM_ARM)
-
-/* ARM code */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
-__asm__( \
-" UMULL r0,r1,%6,%6 \n\t" \
-" ADDS %0,%0,r0 \n\t" \
-" ADCS %1,%1,r1 \n\t" \
-" ADC %2,%2,#0 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "0"(c0), "1"(c1), "2"(c2), "r"(i) : "r0", "r1", "cc");
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
-__asm__( \
-" UMULL r0,r1,%6,%7 \n\t" \
-" ADDS %0,%0,r0 \n\t" \
-" ADCS %1,%1,r1 \n\t" \
-" ADC %2,%2,#0 \n\t" \
-" ADDS %0,%0,r0 \n\t" \
-" ADCS %1,%1,r1 \n\t" \
-" ADC %2,%2,#0 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j) : "r0", "r1", "cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
-" UMULL %0,%1,%3,%4 \n\t" \
-" SUB %2,%2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2) : "r"(i), "r"(j) : "cc");
-
-/* TAO removed sc0,1,2 as input to remove warning so %6,%7 become %3,%4 */
-
-#define SQRADDAC(i, j) \
-__asm__( \
-" UMULL r0,r1,%6,%7 \n\t" \
-" ADDS %0,%0,r0 \n\t" \
-" ADCS %1,%1,r1 \n\t" \
-" ADC %2,%2,#0 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2) : "0"(sc0), "1"(sc1), "2"(sc2), "r"(i), "r"(j) : "r0", "r1", "cc");
-
-#define SQRADDDB \
-__asm__( \
-" ADDS %0,%0,%3 \n\t" \
-" ADCS %1,%1,%4 \n\t" \
-" ADC %2,%2,%5 \n\t" \
-" ADDS %0,%0,%3 \n\t" \
-" ADCS %1,%1,%4 \n\t" \
-" ADC %2,%2,%5 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "r"(sc0), "r"(sc1), "r"(sc2), "0"(c0), "1"(c1), "2"(c2) : "cc");
-
-#elif defined(TFM_PPC32)
-
-/* PPC32 */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
-__asm__( \
- " mullw 16,%6,%6 \n\t" \
- " addc %0,%0,16 \n\t" \
- " mulhwu 16,%6,%6 \n\t" \
- " adde %1,%1,16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i):"16","cc");
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
-__asm__( \
- " mullw 16,%6,%7 \n\t" \
- " mulhwu 17,%6,%7 \n\t" \
- " addc %0,%0,16 \n\t" \
- " adde %1,%1,17 \n\t" \
- " addze %2,%2 \n\t" \
- " addc %0,%0,16 \n\t" \
- " adde %1,%1,17 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"16", "17","cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- " mullw %0,%6,%7 \n\t" \
- " mulhwu %1,%6,%7 \n\t" \
- " xor %2,%2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i),"r"(j) : "cc");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- " mullw 16,%6,%7 \n\t" \
- " addc %0,%0,16 \n\t" \
- " mulhwu 16,%6,%7 \n\t" \
- " adde %1,%1,16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i), "r"(j):"16", "cc");
-
-#define SQRADDDB \
-__asm__( \
- " addc %0,%0,%3 \n\t" \
- " adde %1,%1,%4 \n\t" \
- " adde %2,%2,%5 \n\t" \
- " addc %0,%0,%3 \n\t" \
- " adde %1,%1,%4 \n\t" \
- " adde %2,%2,%5 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "r"(sc0), "r"(sc1), "r"(sc2), "0"(c0), "1"(c1), "2"(c2) : "cc");
-
-#elif defined(TFM_PPC64)
-/* PPC64 */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
-__asm__( \
- " mulld r16,%6,%6 \n\t" \
- " addc %0,%0,r16 \n\t" \
- " mulhdu r16,%6,%6 \n\t" \
- " adde %1,%1,r16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i):"r16","cc");
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
-__asm__( \
- " mulld r16,%6,%7 \n\t" \
- " mulhdu r17,%6,%7 \n\t" \
- " addc %0,%0,r16 \n\t" \
- " adde %1,%1,r17 \n\t" \
- " addze %2,%2 \n\t" \
- " addc %0,%0,r16 \n\t" \
- " adde %1,%1,r17 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"r16", "r17","cc");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- " mulld %0,%6,%7 \n\t" \
- " mulhdu %1,%6,%7 \n\t" \
- " xor %2,%2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i),"r"(j) : "cc");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- " mulld r16,%6,%7 \n\t" \
- " addc %0,%0,r16 \n\t" \
- " mulhdu r16,%6,%7 \n\t" \
- " adde %1,%1,r16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i), "r"(j):"r16", "cc");
-
-#define SQRADDDB \
-__asm__( \
- " addc %0,%0,%3 \n\t" \
- " adde %1,%1,%4 \n\t" \
- " adde %2,%2,%5 \n\t" \
- " addc %0,%0,%3 \n\t" \
- " adde %1,%1,%4 \n\t" \
- " adde %2,%2,%5 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "r"(sc0), "r"(sc1), "r"(sc2), "0"(c0), "1"(c1), "2"(c2) : "cc");
-
-
-#elif defined(TFM_AVR32)
-
-/* AVR32 */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
-__asm__( \
- " mulu.d r2,%6,%6 \n\t" \
- " add %0,%0,r2 \n\t" \
- " adc %1,%1,r3 \n\t" \
- " acr %2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i):"r2","r3");
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
-__asm__( \
- " mulu.d r2,%6,%7 \n\t" \
- " add %0,%0,r2 \n\t" \
- " adc %1,%1,r3 \n\t" \
- " acr %2, \n\t" \
- " add %0,%0,r2 \n\t" \
- " adc %1,%1,r3 \n\t" \
- " acr %2, \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"r2", "r3");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- " mulu.d r2,%6,%7 \n\t" \
- " mov %0,r2 \n\t" \
- " mov %1,r3 \n\t" \
- " eor %2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i),"r"(j) : "r2", "r3");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- " mulu.d r2,%6,%7 \n\t" \
- " add %0,%0,r2 \n\t" \
- " adc %1,%1,r3 \n\t" \
- " acr %2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i), "r"(j):"r2", "r3");
-
-#define SQRADDDB \
-__asm__( \
- " add %0,%0,%3 \n\t" \
- " adc %1,%1,%4 \n\t" \
- " adc %2,%2,%5 \n\t" \
- " add %0,%0,%3 \n\t" \
- " adc %1,%1,%4 \n\t" \
- " adc %2,%2,%5 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "r"(sc0), "r"(sc1), "r"(sc2), "0"(c0), "1"(c1), "2"(c2) : "cc");
-
-#elif defined(TFM_MIPS)
-
-/* MIPS */
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
-__asm__( \
- " multu %6,%6 \n\t" \
- " mflo $12 \n\t" \
- " mfhi $13 \n\t" \
- " addu %0,%0,$12 \n\t" \
- " sltu $12,%0,$12 \n\t" \
- " addu %1,%1,$13 \n\t" \
- " sltu $13,%1,$13 \n\t" \
- " addu %1,%1,$12 \n\t" \
- " sltu $12,%1,$12 \n\t" \
- " addu %2,%2,$13 \n\t" \
- " addu %2,%2,$12 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i):"$12","$13");
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
-__asm__( \
- " multu %6,%7 \n\t" \
- " mflo $12 \n\t" \
- " mfhi $13 \n\t" \
- \
- " addu %0,%0,$12 \n\t" \
- " sltu $14,%0,$12 \n\t" \
- " addu %1,%1,$13 \n\t" \
- " sltu $15,%1,$13 \n\t" \
- " addu %1,%1,$14 \n\t" \
- " sltu $14,%1,$14 \n\t" \
- " addu %2,%2,$15 \n\t" \
- " addu %2,%2,$14 \n\t" \
- \
- " addu %0,%0,$12 \n\t" \
- " sltu $14,%0,$12 \n\t" \
- " addu %1,%1,$13 \n\t" \
- " sltu $15,%1,$13 \n\t" \
- " addu %1,%1,$14 \n\t" \
- " sltu $14,%1,$14 \n\t" \
- " addu %2,%2,$15 \n\t" \
- " addu %2,%2,$14 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"$12", "$13", "$14", "$15");
-
-#define SQRADDSC(i, j) \
-__asm__( \
- " multu %6,%7 \n\t" \
- " mflo %0 \n\t" \
- " mfhi %1 \n\t" \
- " xor %2,%2,%2 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i),"r"(j) : "cc");
-
-#define SQRADDAC(i, j) \
-__asm__( \
- " multu %6,%7 \n\t" \
- " mflo $12 \n\t" \
- " mfhi $13 \n\t" \
- " addu %0,%0,$12 \n\t" \
- " sltu $12,%0,$12 \n\t" \
- " addu %1,%1,$13 \n\t" \
- " sltu $13,%1,$13 \n\t" \
- " addu %1,%1,$12 \n\t" \
- " sltu $12,%1,$12 \n\t" \
- " addu %2,%2,$13 \n\t" \
- " addu %2,%2,$12 \n\t" \
-:"=r"(sc0), "=r"(sc1), "=r"(sc2):"0"(sc0), "1"(sc1), "2"(sc2), "r"(i), "r"(j):"$12", "$13", "$14");
-
-#define SQRADDDB \
-__asm__( \
- " addu %0,%0,%3 \n\t" \
- " sltu $10,%0,%3 \n\t" \
- " addu %1,%1,$10 \n\t" \
- " sltu $10,%1,$10 \n\t" \
- " addu %1,%1,%4 \n\t" \
- " sltu $11,%1,%4 \n\t" \
- " addu %2,%2,$10 \n\t" \
- " addu %2,%2,$11 \n\t" \
- " addu %2,%2,%5 \n\t" \
- \
- " addu %0,%0,%3 \n\t" \
- " sltu $10,%0,%3 \n\t" \
- " addu %1,%1,$10 \n\t" \
- " sltu $10,%1,$10 \n\t" \
- " addu %1,%1,%4 \n\t" \
- " sltu $11,%1,%4 \n\t" \
- " addu %2,%2,$10 \n\t" \
- " addu %2,%2,$11 \n\t" \
- " addu %2,%2,%5 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "r"(sc0), "r"(sc1), "r"(sc2), "0"(c0), "1"(c1), "2"(c2) : "$10", "$11");
-
-#else
-
-#define TFM_ISO
-
-/* ISO C portable code */
-
-#define COMBA_START
-
-#define CLEAR_CARRY \
- c0 = c1 = c2 = 0;
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define CARRY_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_FINI
-
-/* multiplies point i and j, updates carry "c1" and digit c2 */
-#define SQRADD(i, j) \
- do { fp_word t; \
- t = c0 + ((fp_word)i) * ((fp_word)j); c0 = (fp_digit)t; \
- t = c1 + (t >> DIGIT_BIT); c1 = (fp_digit)t; \
- c2 +=(fp_digit) (t >> DIGIT_BIT); \
- } while (0);
-
-
-/* for squaring some of the terms are doubled... */
-#define SQRADD2(i, j) \
- do { fp_word t; \
- t = ((fp_word)i) * ((fp_word)j); \
- tt = (fp_word)c0 + t; c0 = (fp_digit)tt; \
- tt = (fp_word)c1 + (tt >> DIGIT_BIT); c1 = (fp_digit)tt; \
- c2 +=(fp_digit)(tt >> DIGIT_BIT); \
- tt = (fp_word)c0 + t; c0 = (fp_digit)tt; \
- tt = (fp_word)c1 + (tt >> DIGIT_BIT); c1 = (fp_digit)tt; \
- c2 +=(fp_digit)(tt >> DIGIT_BIT); \
- } while (0);
-
-#define SQRADDSC(i, j) \
- do { fp_word t; \
- t = ((fp_word)i) * ((fp_word)j); \
- sc0 = (fp_digit)t; sc1 = (t >> DIGIT_BIT); sc2 = 0; \
- } while (0);
-
-#define SQRADDAC(i, j) \
- do { fp_word t; \
- t = sc0 + ((fp_word)i) * ((fp_word)j); sc0 = (fp_digit)t; \
- t = sc1 + (t >> DIGIT_BIT); sc1 = (fp_digit)t; \
- sc2 += (fp_digit)(t >> DIGIT_BIT); \
- } while (0);
-
-#define SQRADDDB \
- do { fp_word t; \
- t = ((fp_word)sc0) + ((fp_word)sc0) + c0; c0 = (fp_digit)t; \
- t = ((fp_word)sc1) + ((fp_word)sc1) + c1 + (t >> DIGIT_BIT); \
- c1 = (fp_digit)t; \
- c2 = c2 + (fp_digit)(((fp_word)sc2) + ((fp_word)sc2) + (t >> DIGIT_BIT)); \
- } while (0);
-
-#endif
-
-#ifdef TFM_SMALL_SET
- #include "fp_sqr_comba_small_set.i"
-#endif
-
-#if defined(TFM_SQR3) && FP_SIZE >= 6
- #include "fp_sqr_comba_3.i"
-#endif
-#if defined(TFM_SQR4) && FP_SIZE >= 8
- #include "fp_sqr_comba_4.i"
-#endif
-#if defined(TFM_SQR6) && FP_SIZE >= 12
- #include "fp_sqr_comba_6.i"
-#endif
-#if defined(TFM_SQR7) && FP_SIZE >= 14
- #include "fp_sqr_comba_7.i"
-#endif
-#if defined(TFM_SQR8) && FP_SIZE >= 16
- #include "fp_sqr_comba_8.i"
-#endif
-#if defined(TFM_SQR9) && FP_SIZE >= 18
- #include "fp_sqr_comba_9.i"
-#endif
-#if defined(TFM_SQR12) && FP_SIZE >= 24
- #include "fp_sqr_comba_12.i"
-#endif
-#if defined(TFM_SQR17) && FP_SIZE >= 34
- #include "fp_sqr_comba_17.i"
-#endif
-#if defined(TFM_SQR20) && FP_SIZE >= 40
- #include "fp_sqr_comba_20.i"
-#endif
-#if defined(TFM_SQR24) && FP_SIZE >= 48
- #include "fp_sqr_comba_24.i"
-#endif
-#if defined(TFM_SQR28) && FP_SIZE >= 56
- #include "fp_sqr_comba_28.i"
-#endif
-#if defined(TFM_SQR32) && FP_SIZE >= 64
- #include "fp_sqr_comba_32.i"
-#endif
-#if defined(TFM_SQR48) && FP_SIZE >= 96
- #include "fp_sqr_comba_48.i"
-#endif
-#if defined(TFM_SQR64) && FP_SIZE >= 128
- #include "fp_sqr_comba_64.i"
-#endif
-/* end fp_sqr_comba.c asm */
-
-/* start fp_mul_comba.c asm */
-/* these are the combas. Worship them. */
-#if defined(TFM_X86)
-/* Generic x86 optimized code */
-
-/* anything you need at the start */
-#define COMBA_START
-
-/* clear the chaining variables */
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-/* forward the carry to the next digit */
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-/* store the first sum */
-#define COMBA_STORE(x) \
- x = c0;
-
-/* store the second sum [carry] */
-#define COMBA_STORE2(x) \
- x = c1;
-
-/* anything you need at the end */
-#define COMBA_FINI
-
-/* this should multiply i and j */
-#define MULADD(i, j) \
-__asm__( \
- "movl %6,%%eax \n\t" \
- "mull %7 \n\t" \
- "addl %%eax,%0 \n\t" \
- "adcl %%edx,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j) :"%eax","%edx","cc");
-
-#elif defined(TFM_X86_64)
-/* x86-64 optimized */
-
-/* anything you need at the start */
-#define COMBA_START
-
-/* clear the chaining variables */
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-/* forward the carry to the next digit */
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-/* store the first sum */
-#define COMBA_STORE(x) \
- x = c0;
-
-/* store the second sum [carry] */
-#define COMBA_STORE2(x) \
- x = c1;
-
-/* anything you need at the end */
-#define COMBA_FINI
-
-/* this should multiply i and j */
-#define MULADD(i, j) \
-__asm__ ( \
- "movq %6,%%rax \n\t" \
- "mulq %7 \n\t" \
- "addq %%rax,%0 \n\t" \
- "adcq %%rdx,%1 \n\t" \
- "adcq $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "g"(i), "g"(j) :"%rax","%rdx","cc");
-
-
-#if defined(HAVE_INTEL_MULX)
-#define MULADD_BODY(a,b,carry,c) \
- __asm__ volatile( \
- "movq %[a0],%%rdx\n\t" \
- "xorq %%rcx, %%rcx\n\t" \
- "movq 0(%[cp]),%%r8\n\t" \
- "movq 8(%[cp]),%%r9\n\t" \
- "movq 16(%[cp]),%%r10\n\t" \
- "movq 24(%[cp]),%%r11\n\t" \
- \
- "mulx (%[bp]),%%rax, %%rbx\n\t" \
- "adcxq %[ca], %%r8\n\t" \
- "adoxq %%rax, %%r8\n\t" \
- "mulx 8(%[bp]),%%rax, %%rcx\n\t" \
- "adcxq %%rbx, %%r9\n\t" \
- "adoxq %%rax, %%r9\n\t" \
- "mulx 16(%[bp]),%%rax, %%rbx\n\t" \
- "adcxq %%rcx, %%r10\n\t" \
- "adoxq %%rax, %%r10\n\t" \
- "mulx 24(%[bp]),%%rax, %%rcx\n\t" \
- "adcxq %%rbx, %%r11\n\t" \
- "mov $0, %[ca]\n\t" \
- "adoxq %%rax, %%r11\n\t" \
- "adcxq %%rcx, %[ca]\n\t" \
- "mov $0, %%rdx\n\t" \
- "adoxq %%rdx, %[ca]\n\t" \
- \
- "movq %%r8, 0(%[cp])\n\t" \
- "movq %%r9, 8(%[cp])\n\t" \
- "movq %%r10, 16(%[cp])\n\t" \
- "movq %%r11, 24(%[cp])\n\t" \
- : [ca] "+r" (carry) \
- : [a0] "r" (a->dp[ix]), [bp] "r" (&(b->dp[iy])), \
- [cp] "r" (&(c->dp[iz])) \
- : "%r8", "%r9", "%r10", "%r11", \
- "%rdx", "%rax", "%rcx", "%rbx" \
- )
-
-#define TFM_INTEL_MUL_COMBA(a, b, ca, c) \
- for (iz=0; izdp[iz] = 0; \
- for (ix=0; ixused; ix++) { \
- ca = 0; \
- for (iy=0; iyused; iy+=4) { \
- iz = ix + iy; \
- MULADD_BODY(a, b, ca, c); \
- } \
- c->dp[ix + iy] = ca; \
- }
-#endif
-
-#elif defined(TFM_SSE2)
-/* use SSE2 optimizations */
-
-/* anything you need at the start */
-#define COMBA_START
-
-/* clear the chaining variables */
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-/* forward the carry to the next digit */
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-/* store the first sum */
-#define COMBA_STORE(x) \
- x = c0;
-
-/* store the second sum [carry] */
-#define COMBA_STORE2(x) \
- x = c1;
-
-/* anything you need at the end */
-#define COMBA_FINI \
- __asm__("emms");
-
-/* this should multiply i and j */
-#define MULADD(i, j) \
-__asm__( \
- "movd %6,%%mm0 \n\t" \
- "movd %7,%%mm1 \n\t" \
- "pmuludq %%mm1,%%mm0\n\t" \
- "movd %%mm0,%%eax \n\t" \
- "psrlq $32,%%mm0 \n\t" \
- "addl %%eax,%0 \n\t" \
- "movd %%mm0,%%eax \n\t" \
- "adcl %%eax,%1 \n\t" \
- "adcl $0,%2 \n\t" \
- :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j) :"%eax","cc");
-
-#elif defined(TFM_ARM)
-/* ARM code */
-
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-#define MULADD(i, j) \
-__asm__( \
-" UMULL r0,r1,%6,%7 \n\t" \
-" ADDS %0,%0,r0 \n\t" \
-" ADCS %1,%1,r1 \n\t" \
-" ADC %2,%2,#0 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2) : "0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j) : "r0", "r1", "cc");
-
-#elif defined(TFM_PPC32)
-/* For 32-bit PPC */
-
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-/* untested: will mulhwu change the flags? Docs say no */
-#define MULADD(i, j) \
-__asm__( \
- " mullw 16,%6,%7 \n\t" \
- " addc %0,%0,16 \n\t" \
- " mulhwu 16,%6,%7 \n\t" \
- " adde %1,%1,16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"16");
-
-#elif defined(TFM_PPC64)
-/* For 64-bit PPC */
-
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-/* untested: will mulhdu change the flags? Docs say no */
-#define MULADD(i, j) \
-____asm__( \
- " mulld r16,%6,%7 \n\t" \
- " addc %0,%0,16 \n\t" \
- " mulhdu r16,%6,%7 \n\t" \
- " adde %1,%1,16 \n\t" \
- " addze %2,%2 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"r16");
-
-#elif defined(TFM_AVR32)
-
-/* ISO C code */
-
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-#define MULADD(i, j) \
-____asm__( \
- " mulu.d r2,%6,%7 \n\t"\
- " add %0,r2 \n\t"\
- " adc %1,%1,r3 \n\t"\
- " acr %2 \n\t"\
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"r2","r3");
-
-#elif defined(TFM_MIPS)
-
-/* MIPS */
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-#define MULADD(i, j) \
-__asm__( \
- " multu %6,%7 \n\t" \
- " mflo $12 \n\t" \
- " mfhi $13 \n\t" \
- " addu %0,%0,$12 \n\t" \
- " sltu $12,%0,$12 \n\t" \
- " addu %1,%1,$13 \n\t" \
- " sltu $13,%1,$13 \n\t" \
- " addu %1,%1,$12 \n\t" \
- " sltu $12,%1,$12 \n\t" \
- " addu %2,%2,$13 \n\t" \
- " addu %2,%2,$12 \n\t" \
-:"=r"(c0), "=r"(c1), "=r"(c2):"0"(c0), "1"(c1), "2"(c2), "r"(i), "r"(j):"$12","$13");
-
-#else
-/* ISO C code */
-
-#define COMBA_START
-
-#define COMBA_CLEAR \
- c0 = c1 = c2 = 0;
-
-#define COMBA_FORWARD \
- do { c0 = c1; c1 = c2; c2 = 0; } while (0);
-
-#define COMBA_STORE(x) \
- x = c0;
-
-#define COMBA_STORE2(x) \
- x = c1;
-
-#define COMBA_FINI
-
-#define MULADD(i, j) \
- do { fp_word t; \
- t = (fp_word)c0 + ((fp_word)i) * ((fp_word)j); \
- c0 = (fp_digit)t; \
- t = (fp_word)c1 + (t >> DIGIT_BIT); \
- c1 = (fp_digit)t; \
- c2 += (fp_digit)(t >> DIGIT_BIT); \
- } while (0);
-
-#endif
-
-
-#ifdef TFM_SMALL_SET
- #include "fp_mul_comba_small_set.i"
-#endif
-
-#if defined(TFM_MUL3) && FP_SIZE >= 6
- #include "fp_mul_comba_3.i"
-#endif
-#if defined(TFM_MUL4) && FP_SIZE >= 8
- #include "fp_mul_comba_4.i"
-#endif
-#if defined(TFM_MUL6) && FP_SIZE >= 12
- #include "fp_mul_comba_6.i"
-#endif
-#if defined(TFM_MUL7) && FP_SIZE >= 14
- #include "fp_mul_comba_7.i"
-#endif
-#if defined(TFM_MUL8) && FP_SIZE >= 16
- #include "fp_mul_comba_8.i"
-#endif
-#if defined(TFM_MUL9) && FP_SIZE >= 18
- #include "fp_mul_comba_9.i"
-#endif
-#if defined(TFM_MUL12) && FP_SIZE >= 24
- #include "fp_mul_comba_12.i"
-#endif
-#if defined(TFM_MUL17) && FP_SIZE >= 34
- #include "fp_mul_comba_17.i"
-#endif
-#if defined(TFM_MUL20) && FP_SIZE >= 40
- #include "fp_mul_comba_20.i"
-#endif
-#if defined(TFM_MUL24) && FP_SIZE >= 48
- #include "fp_mul_comba_24.i"
-#endif
-#if defined(TFM_MUL28) && FP_SIZE >= 56
- #include "fp_mul_comba_28.i"
-#endif
-#if defined(TFM_MUL32) && FP_SIZE >= 64
- #include "fp_mul_comba_32.i"
-#endif
-#if defined(TFM_MUL48) && FP_SIZE >= 96
- #include "fp_mul_comba_48.i"
-#endif
-#if defined(TFM_MUL64) && FP_SIZE >= 128
- #include "fp_mul_comba_64.i"
-#endif
-
-/* end fp_mul_comba.c asm */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/blake2b.c b/src/ssl/wolfssl/wolfcrypt/blake2b.c
deleted file mode 100644
index 1f473cdd1..000000000
--- a/src/ssl/wolfssl/wolfcrypt/blake2b.c
+++ /dev/null
@@ -1,517 +0,0 @@
-/*
- BLAKE2 reference source code package - reference C implementations
-
- Written in 2012 by Samuel Neves
-
- To the extent possible under law, the author(s) have dedicated all copyright
- and related and neighboring rights to this software to the public domain
- worldwide. This software is distributed without any warranty.
-
- You should have received a copy of the CC0 Public Domain Dedication along with
- this software. If not, see .
-*/
-/* blake2b.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef HAVE_BLAKE2
-
-#include
-#include
-
-static const word64 blake2b_IV[8] =
-{
- W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
- W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
- W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
- W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
-};
-
-static const byte blake2b_sigma[12][16] =
-{
- { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
- { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
- { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
- { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
- { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
- { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
- { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
- { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
- { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
- { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
- { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
- { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
-};
-
-
-static WC_INLINE int blake2b_set_lastnode( blake2b_state *S )
-{
- S->f[1] = ~W64LIT(0);
- return 0;
-}
-
-/* Some helper functions, not necessarily useful */
-static WC_INLINE int blake2b_set_lastblock( blake2b_state *S )
-{
- if( S->last_node ) blake2b_set_lastnode( S );
-
- S->f[0] = ~W64LIT(0);
- return 0;
-}
-
-static WC_INLINE int blake2b_increment_counter( blake2b_state *S, const word64
- inc )
-{
- S->t[0] += inc;
- S->t[1] += ( S->t[0] < inc );
- return 0;
-}
-
-static WC_INLINE int blake2b_init0( blake2b_state *S )
-{
- int i;
- XMEMSET( S, 0, sizeof( blake2b_state ) );
-
- for( i = 0; i < 8; ++i ) S->h[i] = blake2b_IV[i];
-
- return 0;
-}
-
-/* init xors IV with input parameter block */
-int blake2b_init_param( blake2b_state *S, const blake2b_param *P )
-{
- word32 i;
- byte *p ;
- blake2b_init0( S );
- p = ( byte * )( P );
-
- /* IV XOR ParamBlock */
- for( i = 0; i < 8; ++i )
- S->h[i] ^= load64( p + sizeof( S->h[i] ) * i );
-
- return 0;
-}
-
-
-int blake2b_init( blake2b_state *S, const byte outlen )
-{
-#ifdef WOLFSSL_BLAKE2B_INIT_EACH_FIELD
- blake2b_param P[1];
-#else
- volatile blake2b_param P[1];
-#endif
-
- if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_BLAKE2B_INIT_EACH_FIELD
- P->digest_length = outlen;
- P->key_length = 0;
- P->fanout = 1;
- P->depth = 1;
- store32( &P->leaf_length, 0 );
- store64( &P->node_offset, 0 );
- P->node_depth = 0;
- P->inner_length = 0;
- XMEMSET( P->reserved, 0, sizeof( P->reserved ) );
- XMEMSET( P->salt, 0, sizeof( P->salt ) );
- XMEMSET( P->personal, 0, sizeof( P->personal ) );
-#else
- XMEMSET( (blake2b_param *)P, 0, sizeof( *P ) );
- P->digest_length = outlen;
- P->fanout = 1;
- P->depth = 1;
-#endif
- return blake2b_init_param( S, (blake2b_param *)P );
-}
-
-
-int blake2b_init_key( blake2b_state *S, const byte outlen, const void *key,
- const byte keylen )
-{
- int ret = 0;
-#ifdef WOLFSSL_BLAKE2B_INIT_EACH_FIELD
- blake2b_param P[1];
-#else
- volatile blake2b_param P[1];
-#endif
-
- if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return BAD_FUNC_ARG;
-
- if ( !key || !keylen || keylen > BLAKE2B_KEYBYTES ) return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_BLAKE2B_INIT_EACH_FIELD
- P->digest_length = outlen;
- P->key_length = keylen;
- P->fanout = 1;
- P->depth = 1;
- store32( &P->leaf_length, 0 );
- store64( &P->node_offset, 0 );
- P->node_depth = 0;
- P->inner_length = 0;
- XMEMSET( P->reserved, 0, sizeof( P->reserved ) );
- XMEMSET( P->salt, 0, sizeof( P->salt ) );
- XMEMSET( P->personal, 0, sizeof( P->personal ) );
-#else
- XMEMSET( (blake2b_param *)P, 0, sizeof( *P ) );
- P->digest_length = outlen;
- P->key_length = keylen;
- P->fanout = 1;
- P->depth = 1;
-#endif
-
- ret = blake2b_init_param( S, (blake2b_param *)P );
- if ( ret < 0 ) return ret;
-
- {
-#ifdef WOLFSSL_SMALL_STACK
- byte* block;
-
- block = (byte*)XMALLOC(BLAKE2B_BLOCKBYTES, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( block == NULL ) return MEMORY_E;
-#else
- byte block[BLAKE2B_BLOCKBYTES];
-#endif
-
- XMEMSET( block, 0, BLAKE2B_BLOCKBYTES );
- XMEMCPY( block, key, keylen );
- ret = blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
- secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from */
- /* memory */
-
- WC_FREE_VAR_EX(block, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- }
- return ret;
-}
-
-static WC_INLINE int blake2b_compress(
- blake2b_state *S,
- const byte block[BLAKE2B_BLOCKBYTES],
- word64* m,
- word64* v)
-{
- word64 i;
-
- for( i = 0; i < 16; ++i )
- m[i] = load64( block + i * sizeof( m[i] ) );
-
- for( i = 0; i < 8; ++i )
- v[i] = S->h[i];
-
- v[ 8] = blake2b_IV[0];
- v[ 9] = blake2b_IV[1];
- v[10] = blake2b_IV[2];
- v[11] = blake2b_IV[3];
- v[12] = S->t[0] ^ blake2b_IV[4];
- v[13] = S->t[1] ^ blake2b_IV[5];
- v[14] = S->f[0] ^ blake2b_IV[6];
- v[15] = S->f[1] ^ blake2b_IV[7];
-#define G(r,i,a,b,c,d) \
- do { \
- (a) = (a) + (b) + m[blake2b_sigma[r][2*(i)+0]]; \
- (d) = rotr64((d) ^ (a), 32); \
- (c) = (c) + (d); \
- (b) = rotr64((b) ^ (c), 24); \
- (a) = (a) + (b) + m[blake2b_sigma[r][2*(i)+1]]; \
- (d) = rotr64((d) ^ (a), 16); \
- (c) = (c) + (d); \
- (b) = rotr64((b) ^ (c), 63); \
- } while(0)
-#define ROUND(r) \
- do { \
- G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
- G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
- G(r,2,v[ 2],v[ 6],v[10],v[14]); \
- G(r,3,v[ 3],v[ 7],v[11],v[15]); \
- G(r,4,v[ 0],v[ 5],v[10],v[15]); \
- G(r,5,v[ 1],v[ 6],v[11],v[12]); \
- G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
- G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
- } while(0)
- ROUND( 0 );
- ROUND( 1 );
- ROUND( 2 );
- ROUND( 3 );
- ROUND( 4 );
- ROUND( 5 );
- ROUND( 6 );
- ROUND( 7 );
- ROUND( 8 );
- ROUND( 9 );
- ROUND( 10 );
- ROUND( 11 );
-
- for( i = 0; i < 8; ++i )
- S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
-
-#undef G
-#undef ROUND
-
- return 0;
-}
-
-/* inlen now in bytes */
-int blake2b_update( blake2b_state *S, const byte *in, word64 inlen )
-{
- int ret = 0;
-#ifdef WOLFSSL_SMALL_STACK
- word64* m;
- word64* v;
-
- m = (word64*)XMALLOC(sizeof(word64) * 32, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( m == NULL ) return MEMORY_E;
-
- v = &m[16];
-#else
- word64 m[16];
- word64 v[16];
-#endif
-
- while( inlen > 0 )
- {
- word64 left = S->buflen;
- word64 fill = 2 * BLAKE2B_BLOCKBYTES - left;
-
- if( inlen > fill )
- {
- XMEMCPY( S->buf + left, in, (wolfssl_word)fill ); /* Fill buffer */
- S->buflen += fill;
- blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
-
- {
- ret = blake2b_compress( S, S->buf, m, v );
- if (ret < 0) break;
- }
-
- XMEMCPY( S->buf, S->buf + BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );
- /* Shift buffer left */
- S->buflen -= BLAKE2B_BLOCKBYTES;
- in += fill;
- inlen -= fill;
- }
- else /* inlen <= fill */
- {
- XMEMCPY( S->buf + left, in, (wolfssl_word)inlen );
- S->buflen += inlen; /* Be lazy, do not compress */
- inlen = 0;
- }
- }
-
- WC_FREE_VAR_EX(m, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-/* Is this correct? */
-int blake2b_final( blake2b_state *S, byte *out, byte outlen )
-{
- int ret = 0;
- byte buffer[BLAKE2B_OUTBYTES];
- word64 i;
-#ifdef WOLFSSL_SMALL_STACK
- word64* m;
- word64* v;
-
- m = (word64*)XMALLOC(sizeof(word64) * 32, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( m == NULL ) return MEMORY_E;
-
- v = &m[16];
-#else
- word64 m[16];
- word64 v[16];
-#endif
-
- if( S->buflen > BLAKE2B_BLOCKBYTES )
- {
- blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
-
- {
- ret = blake2b_compress( S, S->buf, m, v );
- if (ret < 0) goto out;
- }
-
- S->buflen -= BLAKE2B_BLOCKBYTES;
- if ( S->buflen > BLAKE2B_BLOCKBYTES )
- return BAD_LENGTH_E;
- XMEMMOVE( S->buf, S->buf + BLAKE2B_BLOCKBYTES, (wolfssl_word)S->buflen );
- }
-
- blake2b_increment_counter( S, S->buflen );
- blake2b_set_lastblock( S );
- XMEMSET( S->buf + S->buflen, 0, (wolfssl_word)(2 * BLAKE2B_BLOCKBYTES - S->buflen) );
- /* Padding */
- {
- ret = blake2b_compress( S, S->buf, m, v );
- if (ret < 0) goto out;
- }
-
- for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
- store64( buffer + sizeof( S->h[i] ) * i, S->h[i] );
-
- XMEMCPY( out, buffer, outlen );
-
- out:
-
- WC_FREE_VAR_EX(m, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-/* inlen, at least, should be word64. Others can be size_t. */
-int blake2b( byte *out, const void *in, const void *key, const byte outlen,
- const word64 inlen, byte keylen )
-{
- blake2b_state S[1];
-
- /* Verify parameters */
- if ( NULL == in ) return BAD_FUNC_ARG;
-
- if ( NULL == out ) return BAD_FUNC_ARG;
-
- if( NULL == key ) keylen = 0;
-
- if( keylen > 0 )
- {
- int ret = blake2b_init_key( S, outlen, key, keylen );
- if (ret < 0) return ret;
- }
- else
- {
- int ret = blake2b_init( S, outlen );
- if (ret < 0) return ret;
- }
-
- {
- int ret = blake2b_update( S, ( byte * )in, inlen );
- if (ret < 0) return ret;
- }
-
- return blake2b_final( S, out, outlen );
-}
-
-#if defined(BLAKE2B_SELFTEST)
-#include
-#include "blake2-kat.h"
-int main( int argc, char **argv )
-{
- byte key[BLAKE2B_KEYBYTES];
- byte buf[KAT_LENGTH];
-
- for( word32 i = 0; i < BLAKE2B_KEYBYTES; ++i )
- key[i] = ( byte )i;
-
- for( word32 i = 0; i < KAT_LENGTH; ++i )
- buf[i] = ( byte )i;
-
- for( word32 i = 0; i < KAT_LENGTH; ++i )
- {
- byte hash[BLAKE2B_OUTBYTES];
- if ( blake2b( hash, buf, key, BLAKE2B_OUTBYTES, i, BLAKE2B_KEYBYTES ) < 0 )
- {
- puts( "error" );
- return -1;
- }
-
- if( 0 != XMEMCMP( hash, blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )
- {
- puts( "error" );
- return -1;
- }
- }
-
- puts( "ok" );
- return 0;
-}
-#endif
-
-
-/* wolfCrypt API */
-
-/* Init Blake2b digest, track size in case final doesn't want to "remember" */
-int wc_InitBlake2b(Blake2b* b2b, word32 digestSz)
-{
- if (b2b == NULL){
- return BAD_FUNC_ARG;
- }
- b2b->digestSz = digestSz;
-
- return blake2b_init(b2b->S, (byte)digestSz);
-}
-
-/* Init Blake2b digest with key, track size in case final doesn't want to "remember" */
-int wc_InitBlake2b_WithKey(Blake2b* b2b, word32 digestSz, const byte *key, word32 keylen)
-{
- if (b2b == NULL){
- return BAD_FUNC_ARG;
- }
- b2b->digestSz = digestSz;
-
- if (keylen >= 256)
- return BAD_FUNC_ARG;
-
- if (key)
- return blake2b_init_key(b2b->S, (byte)digestSz, key, (byte)keylen);
- else
- return blake2b_init(b2b->S, (byte)digestSz);
-}
-
-/* Blake2b Update */
-int wc_Blake2bUpdate(Blake2b* b2b, const byte* data, word32 sz)
-{
- if (b2b == NULL){
- return BAD_FUNC_ARG;
- }
- if (data == NULL && sz != 0){
- return BAD_FUNC_ARG;
- }
- if (sz == 0){
- return 0;
- }
-
- return blake2b_update(b2b->S, data, sz);
-}
-
-
-/* Blake2b Final, if pass in zero size we use init digestSz */
-int wc_Blake2bFinal(Blake2b* b2b, byte* final, word32 requestSz)
-{
- word32 sz;
-
- if (b2b == NULL){
- return BAD_FUNC_ARG;
- }
- if (final == NULL){
- return BAD_FUNC_ARG;
- }
-
- sz = requestSz ? requestSz : b2b->digestSz;
-
- return blake2b_final(b2b->S, final, (byte)sz);
-}
-
-
-/* end CTaoCrypt API */
-
-#endif /* HAVE_BLAKE2 */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/blake2s.c b/src/ssl/wolfssl/wolfcrypt/blake2s.c
deleted file mode 100644
index cf5c9f2ff..000000000
--- a/src/ssl/wolfssl/wolfcrypt/blake2s.c
+++ /dev/null
@@ -1,511 +0,0 @@
-/*
- BLAKE2 reference source code package - reference C implementations
-
- Written in 2012 by Samuel Neves
-
- To the extent possible under law, the author(s) have dedicated all copyright
- and related and neighboring rights to this software to the public domain
- worldwide. This software is distributed without any warranty.
-
- You should have received a copy of the CC0 Public Domain Dedication along with
- this software. If not, see .
-*/
-/* blake2s.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef HAVE_BLAKE2S
-
-#include
-#include
-
-static const word32 blake2s_IV[8] =
-{
- 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
- 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
-};
-
-static const byte blake2s_sigma[10][16] =
-{
- { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
- { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
- { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
- { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
- { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
- { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
- { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
- { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
- { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
- { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 }
-};
-
-
-static WC_INLINE int blake2s_set_lastnode( blake2s_state *S )
-{
- S->f[1] = ~0U;
- return 0;
-}
-
-/* Some helper functions, not necessarily useful */
-static WC_INLINE int blake2s_set_lastblock( blake2s_state *S )
-{
- if( S->last_node ) blake2s_set_lastnode( S );
-
- S->f[0] = ~0U;
- return 0;
-}
-
-static WC_INLINE int blake2s_increment_counter( blake2s_state *S, const word32
- inc )
-{
- S->t[0] += inc;
- S->t[1] += ( S->t[0] < inc );
- return 0;
-}
-
-static WC_INLINE int blake2s_init0( blake2s_state *S )
-{
- int i;
- XMEMSET( S, 0, sizeof( blake2s_state ) );
-
- for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
-
- return 0;
-}
-
-/* init xors IV with input parameter block */
-int blake2s_init_param( blake2s_state *S, const blake2s_param *P )
-{
- word32 i;
- byte *p ;
- blake2s_init0( S );
- p = ( byte * )( P );
-
- /* IV XOR ParamBlock */
- for( i = 0; i < 8; ++i )
- S->h[i] ^= load32( p + sizeof( S->h[i] ) * i );
-
- return 0;
-}
-
-
-
-int blake2s_init( blake2s_state *S, const byte outlen )
-{
-#ifdef WOLFSSL_BLAKE2S_INIT_EACH_FIELD
- blake2s_param P[1];
-#else
- volatile blake2s_param P[1];
-#endif
-
- if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_BLAKE2S_INIT_EACH_FIELD
- P->digest_length = outlen;
- P->key_length = 0;
- P->fanout = 1;
- P->depth = 1;
- store32( &P->leaf_length, 0 );
- store32( &P->node_offset, 0 );
- P->node_depth = 0;
- P->inner_length = 0;
- XMEMSET( P->salt, 0, sizeof( P->salt ) );
- XMEMSET( P->personal, 0, sizeof( P->personal ) );
-#else
- XMEMSET( (blake2s_param *)P, 0, sizeof( *P ) );
- P->digest_length = outlen;
- P->fanout = 1;
- P->depth = 1;
-#endif
- return blake2s_init_param( S, (blake2s_param *)P );
-}
-
-
-int blake2s_init_key( blake2s_state *S, const byte outlen, const void *key,
- const byte keylen )
-{
- int ret = 0;
-#ifdef WOLFSSL_BLAKE2S_INIT_EACH_FIELD
- blake2s_param P[1];
-#else
- volatile blake2s_param P[1];
-#endif
-
- if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return BAD_FUNC_ARG;
-
- if ( !key || !keylen || keylen > BLAKE2S_KEYBYTES ) return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_BLAKE2S_INIT_EACH_FIELD
- P->digest_length = outlen;
- P->key_length = keylen;
- P->fanout = 1;
- P->depth = 1;
- store32( &P->leaf_length, 0 );
- store64( &P->node_offset, 0 );
- P->node_depth = 0;
- P->inner_length = 0;
- XMEMSET( P->salt, 0, sizeof( P->salt ) );
- XMEMSET( P->personal, 0, sizeof( P->personal ) );
-#else
- XMEMSET( (blake2s_param *)P, 0, sizeof( *P ) );
- P->digest_length = outlen;
- P->key_length = keylen;
- P->fanout = 1;
- P->depth = 1;
-#endif
-
- ret = blake2s_init_param( S, (blake2s_param *)P );
- if (ret < 0)
- return ret;
-
- {
-#ifdef WOLFSSL_SMALL_STACK
- byte* block;
-
- block = (byte*)XMALLOC(BLAKE2S_BLOCKBYTES, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( block == NULL ) return MEMORY_E;
-#else
- byte block[BLAKE2S_BLOCKBYTES];
-#endif
-
- XMEMSET( block, 0, BLAKE2S_BLOCKBYTES );
- XMEMCPY( block, key, keylen );
- ret = blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
- secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from */
- /* memory */
-
- WC_FREE_VAR_EX(block, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- }
- return ret;
-}
-
-static WC_INLINE int blake2s_compress(
- blake2s_state *S,
- const byte block[BLAKE2S_BLOCKBYTES],
- word32* m,
- word32* v)
-{
- word32 i;
-
- for( i = 0; i < 16; ++i )
- m[i] = load32( block + i * sizeof( m[i] ) );
-
- for( i = 0; i < 8; ++i )
- v[i] = S->h[i];
-
- v[ 8] = blake2s_IV[0];
- v[ 9] = blake2s_IV[1];
- v[10] = blake2s_IV[2];
- v[11] = blake2s_IV[3];
- v[12] = S->t[0] ^ blake2s_IV[4];
- v[13] = S->t[1] ^ blake2s_IV[5];
- v[14] = S->f[0] ^ blake2s_IV[6];
- v[15] = S->f[1] ^ blake2s_IV[7];
-#define G(r,i,a,b,c,d) \
- do { \
- (a) = (a) + (b) + m[blake2s_sigma[r][2*(i)+0]]; \
- (d) = rotr32((d) ^ (a), 16); \
- (c) = (c) + (d); \
- (b) = rotr32((b) ^ (c), 12); \
- (a) = (a) + (b) + m[blake2s_sigma[r][2*(i)+1]]; \
- (d) = rotr32((d) ^ (a), 8); \
- (c) = (c) + (d); \
- (b) = rotr32((b) ^ (c), 7); \
- } while(0)
-#define ROUND(r) \
- do { \
- G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
- G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
- G(r,2,v[ 2],v[ 6],v[10],v[14]); \
- G(r,3,v[ 3],v[ 7],v[11],v[15]); \
- G(r,4,v[ 0],v[ 5],v[10],v[15]); \
- G(r,5,v[ 1],v[ 6],v[11],v[12]); \
- G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
- G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
- } while(0)
- ROUND( 0 );
- ROUND( 1 );
- ROUND( 2 );
- ROUND( 3 );
- ROUND( 4 );
- ROUND( 5 );
- ROUND( 6 );
- ROUND( 7 );
- ROUND( 8 );
- ROUND( 9 );
-
- for( i = 0; i < 8; ++i )
- S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
-
-#undef G
-#undef ROUND
-
- return 0;
-}
-
-/* inlen now in bytes */
-int blake2s_update( blake2s_state *S, const byte *in, word32 inlen )
-{
- int ret = 0;
-#ifdef WOLFSSL_SMALL_STACK
- word32* m;
- word32* v;
-
- m = (word32*)XMALLOC(sizeof(word32) * 32, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( m == NULL ) return MEMORY_E;
-
- v = &m[16];
-#else
- word32 m[16];
- word32 v[16];
-#endif
-
- while( inlen > 0 )
- {
- word32 left = S->buflen;
- word32 fill = 2 * BLAKE2S_BLOCKBYTES - left;
-
- if( inlen > fill )
- {
- XMEMCPY( S->buf + left, in, (wolfssl_word)fill ); /* Fill buffer */
- S->buflen += fill;
- blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
-
- {
- ret= blake2s_compress( S, S->buf, m, v );
- if (ret < 0) break;
- }
-
- XMEMCPY( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );
- /* Shift buffer left */
- S->buflen -= BLAKE2S_BLOCKBYTES;
- in += fill;
- inlen -= fill;
- }
- else /* inlen <= fill */
- {
- XMEMCPY( S->buf + left, in, (wolfssl_word)inlen );
- S->buflen += inlen; /* Be lazy, do not compress */
- inlen = 0;
- }
- }
-
- WC_FREE_VAR_EX(m, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-/* Is this correct? */
-int blake2s_final( blake2s_state *S, byte *out, byte outlen )
-{
- int ret = 0;
- word32 i;
- byte buffer[BLAKE2S_BLOCKBYTES];
-#ifdef WOLFSSL_SMALL_STACK
- word32* m;
- word32* v;
-
- m = (word32*)XMALLOC(sizeof(word32) * 32, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if ( m == NULL ) return MEMORY_E;
-
- v = &m[16];
-#else
- word32 m[16];
- word32 v[16];
-#endif
-
- if( S->buflen > BLAKE2S_BLOCKBYTES )
- {
- blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
-
- {
- ret = blake2s_compress( S, S->buf, m, v );
- if (ret < 0) goto out;
- }
-
- S->buflen -= BLAKE2S_BLOCKBYTES;
- XMEMCPY( S->buf, S->buf + BLAKE2S_BLOCKBYTES, (wolfssl_word)S->buflen );
- }
-
- blake2s_increment_counter( S, S->buflen );
- blake2s_set_lastblock( S );
- XMEMSET( S->buf + S->buflen, 0, (wolfssl_word)(2 * BLAKE2S_BLOCKBYTES - S->buflen) );
- /* Padding */
- {
- ret = blake2s_compress( S, S->buf, m, v );
- if (ret < 0) goto out;
- }
-
- for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
- store64( buffer + sizeof( S->h[i] ) * i, S->h[i] );
-
- XMEMCPY( out, buffer, outlen );
-
- out:
-
- WC_FREE_VAR_EX(m, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return ret;
-}
-
-/* inlen, at least, should be word32. Others can be size_t. */
-int blake2s( byte *out, const void *in, const void *key, const byte outlen,
- const word32 inlen, byte keylen )
-{
- blake2s_state S[1];
-
- /* Verify parameters */
- if ( NULL == in ) return BAD_FUNC_ARG;
-
- if ( NULL == out ) return BAD_FUNC_ARG;
-
- if( NULL == key ) keylen = 0;
-
- if( keylen > 0 )
- {
- int ret = blake2s_init_key( S, outlen, key, keylen );
- if (ret < 0) return ret;
- }
- else
- {
- int ret = blake2s_init( S, outlen );
- if (ret < 0) return ret;
- }
-
- {
- int ret = blake2s_update( S, ( byte * )in, inlen );
- if (ret < 0) return ret;
- }
-
- return blake2s_final( S, out, outlen );
-}
-
-#if defined(BLAKE2S_SELFTEST)
-#include
-#include "blake2-kat.h"
-int main( int argc, char **argv )
-{
- byte key[BLAKE2S_KEYBYTES];
- byte buf[KAT_LENGTH];
-
- for( word32 i = 0; i < BLAKE2S_KEYBYTES; ++i )
- key[i] = ( byte )i;
-
- for( word32 i = 0; i < KAT_LENGTH; ++i )
- buf[i] = ( byte )i;
-
- for( word32 i = 0; i < KAT_LENGTH; ++i )
- {
- byte hash[BLAKE2S_OUTBYTES];
- if ( blake2s( hash, buf, key, BLAKE2S_OUTBYTES, i, BLAKE2S_KEYBYTES ) < 0 )
- {
- puts( "error" );
- return -1;
- }
-
- if( 0 != XMEMCMP( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
- {
- puts( "error" );
- return -1;
- }
- }
-
- puts( "ok" );
- return 0;
-}
-#endif
-
-
-/* wolfCrypt API */
-
-/* Init Blake2s digest, track size in case final doesn't want to "remember" */
-int wc_InitBlake2s(Blake2s* b2s, word32 digestSz)
-{
- if (b2s == NULL){
- return BAD_FUNC_ARG;
- }
- b2s->digestSz = digestSz;
-
- return blake2s_init(b2s->S, (byte)digestSz);
-}
-
-
-/* Init Blake2s digest with key, track size in case final doesn't want to "remember" */
-int wc_InitBlake2s_WithKey(Blake2s* b2s, word32 digestSz, const byte *key, word32 keylen)
-{
- if (b2s == NULL){
- return BAD_FUNC_ARG;
- }
- b2s->digestSz = digestSz;
-
- if (keylen >= 256)
- return BAD_FUNC_ARG;
-
- if (key)
- return blake2s_init_key(b2s->S, (byte)digestSz, key, (byte)keylen);
- else
- return blake2s_init(b2s->S, (byte)digestSz);
-}
-
-
-/* Blake2s Update */
-int wc_Blake2sUpdate(Blake2s* b2s, const byte* data, word32 sz)
-{
- if (b2s == NULL){
- return BAD_FUNC_ARG;
- }
- if (data == NULL && sz != 0){
- return BAD_FUNC_ARG;
- }
- if (sz == 0){
- return 0;
- }
-
- return blake2s_update(b2s->S, data, sz);
-}
-
-
-/* Blake2s Final, if pass in zero size we use init digestSz */
-int wc_Blake2sFinal(Blake2s* b2s, byte* final, word32 requestSz)
-{
- word32 sz;
-
- if (b2s == NULL){
- return BAD_FUNC_ARG;
- }
- if (final == NULL){
- return BAD_FUNC_ARG;
- }
-
- sz = requestSz ? requestSz : b2s->digestSz;
-
- return blake2s_final(b2s->S, final, (byte)sz);
-}
-
-
-/* end CTaoCrypt API */
-
-#endif /* HAVE_BLAKE2S */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/camellia.c b/src/ssl/wolfssl/wolfcrypt/camellia.c
deleted file mode 100644
index 607b30183..000000000
--- a/src/ssl/wolfssl/wolfcrypt/camellia.c
+++ /dev/null
@@ -1,1633 +0,0 @@
-/* camellia.c ver 1.2.0
- *
- * Copyright (c) 2006,2007
- * NTT (Nippon Telegraph and Telephone Corporation) . All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer as
- * the first lines of this file unmodified.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY NTT ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL NTT BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* camellia.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-
-/*
- * Algorithm Specification
- * http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
- */
-
-#include
-
-#ifdef HAVE_CAMELLIA
-
-#include
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-/* u32 must be 32bit word */
-typedef unsigned int u32;
-typedef unsigned char u8;
-
-/* key constants */
-
-#define CAMELLIA_SIGMA1L ((u32)0xA09E667FL)
-#define CAMELLIA_SIGMA1R ((u32)0x3BCC908BL)
-#define CAMELLIA_SIGMA2L ((u32)0xB67AE858L)
-#define CAMELLIA_SIGMA2R ((u32)0x4CAA73B2L)
-#define CAMELLIA_SIGMA3L ((u32)0xC6EF372FL)
-#define CAMELLIA_SIGMA3R ((u32)0xE94F82BEL)
-#define CAMELLIA_SIGMA4L ((u32)0x54FF53A5L)
-#define CAMELLIA_SIGMA4R ((u32)0xF1D36F1CL)
-#define CAMELLIA_SIGMA5L ((u32)0x10E527FAL)
-#define CAMELLIA_SIGMA5R ((u32)0xDE682D1DL)
-#define CAMELLIA_SIGMA6L ((u32)0xB05688C2L)
-#define CAMELLIA_SIGMA6R ((u32)0xB3E6C1FDL)
-
-/*
- * macros
- */
-
-
-#if defined(_MSC_VER)
-
-# define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
-# define GETU32(p) SWAP(*((u32 *)(p)))
-# define PUTU32(ct, st) {*((u32 *)(ct)) = SWAP((st));}
-
-#else /* not MS-VC */
-
-# define GETU32(pt) \
- (((u32)(pt)[0] << 24) \
- ^ ((u32)(pt)[1] << 16) \
- ^ ((u32)(pt)[2] << 8) \
- ^ ((u32)(pt)[3]))
-
-# define PUTU32(ct, st) { \
- (ct)[0] = (u8)((st) >> 24); \
- (ct)[1] = (u8)((st) >> 16); \
- (ct)[2] = (u8)((st) >> 8); \
- (ct)[3] = (u8)(st); }
-
-#endif
-
-#define CamelliaSubkeyL(INDEX) (subkey[(INDEX)*2])
-#define CamelliaSubkeyR(INDEX) (subkey[(INDEX)*2 + 1])
-
-/* rotation right shift 1byte */
-#define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
-/* rotation left shift 1bit */
-#define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
-/* rotation left shift 1byte */
-#define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
-
-#define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits) \
- do { \
- (w0) = (ll); \
- (ll) = ((ll) << (bits)) + ((lr) >> (32 - (bits))); \
- (lr) = ((lr) << (bits)) + ((rl) >> (32 - (bits))); \
- (rl) = ((rl) << (bits)) + ((rr) >> (32 - (bits))); \
- (rr) = ((rr) << (bits)) + ((w0) >> (32 - (bits))); \
- } while(0)
-
-#define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits) \
- do { \
- (w0) = (ll); \
- (w1) = (lr); \
- (ll) = ((lr) << ((bits) - 32)) + ((rl) >> (64 - (bits))); \
- (lr) = ((rl) << ((bits) - 32)) + ((rr) >> (64 - (bits))); \
- (rl) = ((rr) << ((bits) - 32)) + ((w0) >> (64 - (bits))); \
- (rr) = ((w0) << ((bits) - 32)) + ((w1) >> (64 - (bits))); \
- } while(0)
-
-#define CAMELLIA_SP1110(INDEX) (camellia_sp1110[(INDEX)])
-#define CAMELLIA_SP0222(INDEX) (camellia_sp0222[(INDEX)])
-#define CAMELLIA_SP3033(INDEX) (camellia_sp3033[(INDEX)])
-#define CAMELLIA_SP4404(INDEX) (camellia_sp4404[(INDEX)])
-
-#define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) \
- do { \
- (il) = (xl) ^ (kl); \
- (ir) = (xr) ^ (kr); \
- (t0) = (il) >> 16; \
- (t1) = (ir) >> 16; \
- (yl) = CAMELLIA_SP1110((ir) & 0xff) \
- ^ CAMELLIA_SP0222(((t1) >> 8) & 0xff) \
- ^ CAMELLIA_SP3033((t1) & 0xff) \
- ^ CAMELLIA_SP4404(((ir) >> 8) & 0xff); \
- (yr) = CAMELLIA_SP1110(((t0) >> 8) & 0xff) \
- ^ CAMELLIA_SP0222((t0) & 0xff) \
- ^ CAMELLIA_SP3033(((il) >> 8) & 0xff) \
- ^ CAMELLIA_SP4404((il) & 0xff); \
- (yl) ^= (yr); \
- (yr) = CAMELLIA_RR8(yr); \
- (yr) ^= (yl); \
- } while(0)
-
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
- do { \
- (t0) = (kll); \
- (t0) &= (ll); \
- (lr) ^= CAMELLIA_RL1(t0); \
- (t1) = (klr); \
- (t1) |= (lr); \
- (ll) ^= (t1); \
- \
- (t2) = (krr); \
- (t2) |= (rr); \
- (rl) ^= (t2); \
- (t3) = (krl); \
- (t3) &= (rl); \
- (rr) ^= CAMELLIA_RL1(t3); \
- } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) \
- do { \
- (ir) = CAMELLIA_SP1110((xr) & 0xff) \
- ^ CAMELLIA_SP0222(((xr) >> 24) & 0xff) \
- ^ CAMELLIA_SP3033(((xr) >> 16) & 0xff) \
- ^ CAMELLIA_SP4404(((xr) >> 8) & 0xff); \
- (il) = CAMELLIA_SP1110(((xl) >> 24) & 0xff) \
- ^ CAMELLIA_SP0222(((xl) >> 16) & 0xff) \
- ^ CAMELLIA_SP3033(((xl) >> 8) & 0xff) \
- ^ CAMELLIA_SP4404((xl) & 0xff); \
- (il) ^= (kl); \
- (ir) ^= (kr); \
- (ir) ^= (il); \
- (il) = CAMELLIA_RR8(il); \
- (il) ^= (ir); \
- (yl) ^= (ir); \
- (yr) ^= (il); \
- } while(0)
-
-
-static const u32 camellia_sp1110[256] = {
- 0x70707000,0x82828200,0x2c2c2c00,0xececec00,
- 0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,
- 0xe4e4e400,0x85858500,0x57575700,0x35353500,
- 0xeaeaea00,0x0c0c0c00,0xaeaeae00,0x41414100,
- 0x23232300,0xefefef00,0x6b6b6b00,0x93939300,
- 0x45454500,0x19191900,0xa5a5a500,0x21212100,
- 0xededed00,0x0e0e0e00,0x4f4f4f00,0x4e4e4e00,
- 0x1d1d1d00,0x65656500,0x92929200,0xbdbdbd00,
- 0x86868600,0xb8b8b800,0xafafaf00,0x8f8f8f00,
- 0x7c7c7c00,0xebebeb00,0x1f1f1f00,0xcecece00,
- 0x3e3e3e00,0x30303000,0xdcdcdc00,0x5f5f5f00,
- 0x5e5e5e00,0xc5c5c500,0x0b0b0b00,0x1a1a1a00,
- 0xa6a6a600,0xe1e1e100,0x39393900,0xcacaca00,
- 0xd5d5d500,0x47474700,0x5d5d5d00,0x3d3d3d00,
- 0xd9d9d900,0x01010100,0x5a5a5a00,0xd6d6d600,
- 0x51515100,0x56565600,0x6c6c6c00,0x4d4d4d00,
- 0x8b8b8b00,0x0d0d0d00,0x9a9a9a00,0x66666600,
- 0xfbfbfb00,0xcccccc00,0xb0b0b000,0x2d2d2d00,
- 0x74747400,0x12121200,0x2b2b2b00,0x20202000,
- 0xf0f0f000,0xb1b1b100,0x84848400,0x99999900,
- 0xdfdfdf00,0x4c4c4c00,0xcbcbcb00,0xc2c2c200,
- 0x34343400,0x7e7e7e00,0x76767600,0x05050500,
- 0x6d6d6d00,0xb7b7b700,0xa9a9a900,0x31313100,
- 0xd1d1d100,0x17171700,0x04040400,0xd7d7d700,
- 0x14141400,0x58585800,0x3a3a3a00,0x61616100,
- 0xdedede00,0x1b1b1b00,0x11111100,0x1c1c1c00,
- 0x32323200,0x0f0f0f00,0x9c9c9c00,0x16161600,
- 0x53535300,0x18181800,0xf2f2f200,0x22222200,
- 0xfefefe00,0x44444400,0xcfcfcf00,0xb2b2b200,
- 0xc3c3c300,0xb5b5b500,0x7a7a7a00,0x91919100,
- 0x24242400,0x08080800,0xe8e8e800,0xa8a8a800,
- 0x60606000,0xfcfcfc00,0x69696900,0x50505000,
- 0xaaaaaa00,0xd0d0d000,0xa0a0a000,0x7d7d7d00,
- 0xa1a1a100,0x89898900,0x62626200,0x97979700,
- 0x54545400,0x5b5b5b00,0x1e1e1e00,0x95959500,
- 0xe0e0e000,0xffffff00,0x64646400,0xd2d2d200,
- 0x10101000,0xc4c4c400,0x00000000,0x48484800,
- 0xa3a3a300,0xf7f7f700,0x75757500,0xdbdbdb00,
- 0x8a8a8a00,0x03030300,0xe6e6e600,0xdadada00,
- 0x09090900,0x3f3f3f00,0xdddddd00,0x94949400,
- 0x87878700,0x5c5c5c00,0x83838300,0x02020200,
- 0xcdcdcd00,0x4a4a4a00,0x90909000,0x33333300,
- 0x73737300,0x67676700,0xf6f6f600,0xf3f3f300,
- 0x9d9d9d00,0x7f7f7f00,0xbfbfbf00,0xe2e2e200,
- 0x52525200,0x9b9b9b00,0xd8d8d800,0x26262600,
- 0xc8c8c800,0x37373700,0xc6c6c600,0x3b3b3b00,
- 0x81818100,0x96969600,0x6f6f6f00,0x4b4b4b00,
- 0x13131300,0xbebebe00,0x63636300,0x2e2e2e00,
- 0xe9e9e900,0x79797900,0xa7a7a700,0x8c8c8c00,
- 0x9f9f9f00,0x6e6e6e00,0xbcbcbc00,0x8e8e8e00,
- 0x29292900,0xf5f5f500,0xf9f9f900,0xb6b6b600,
- 0x2f2f2f00,0xfdfdfd00,0xb4b4b400,0x59595900,
- 0x78787800,0x98989800,0x06060600,0x6a6a6a00,
- 0xe7e7e700,0x46464600,0x71717100,0xbababa00,
- 0xd4d4d400,0x25252500,0xababab00,0x42424200,
- 0x88888800,0xa2a2a200,0x8d8d8d00,0xfafafa00,
- 0x72727200,0x07070700,0xb9b9b900,0x55555500,
- 0xf8f8f800,0xeeeeee00,0xacacac00,0x0a0a0a00,
- 0x36363600,0x49494900,0x2a2a2a00,0x68686800,
- 0x3c3c3c00,0x38383800,0xf1f1f100,0xa4a4a400,
- 0x40404000,0x28282800,0xd3d3d300,0x7b7b7b00,
- 0xbbbbbb00,0xc9c9c900,0x43434300,0xc1c1c100,
- 0x15151500,0xe3e3e300,0xadadad00,0xf4f4f400,
- 0x77777700,0xc7c7c700,0x80808000,0x9e9e9e00,
-};
-
-static const u32 camellia_sp0222[256] = {
- 0x00e0e0e0,0x00050505,0x00585858,0x00d9d9d9,
- 0x00676767,0x004e4e4e,0x00818181,0x00cbcbcb,
- 0x00c9c9c9,0x000b0b0b,0x00aeaeae,0x006a6a6a,
- 0x00d5d5d5,0x00181818,0x005d5d5d,0x00828282,
- 0x00464646,0x00dfdfdf,0x00d6d6d6,0x00272727,
- 0x008a8a8a,0x00323232,0x004b4b4b,0x00424242,
- 0x00dbdbdb,0x001c1c1c,0x009e9e9e,0x009c9c9c,
- 0x003a3a3a,0x00cacaca,0x00252525,0x007b7b7b,
- 0x000d0d0d,0x00717171,0x005f5f5f,0x001f1f1f,
- 0x00f8f8f8,0x00d7d7d7,0x003e3e3e,0x009d9d9d,
- 0x007c7c7c,0x00606060,0x00b9b9b9,0x00bebebe,
- 0x00bcbcbc,0x008b8b8b,0x00161616,0x00343434,
- 0x004d4d4d,0x00c3c3c3,0x00727272,0x00959595,
- 0x00ababab,0x008e8e8e,0x00bababa,0x007a7a7a,
- 0x00b3b3b3,0x00020202,0x00b4b4b4,0x00adadad,
- 0x00a2a2a2,0x00acacac,0x00d8d8d8,0x009a9a9a,
- 0x00171717,0x001a1a1a,0x00353535,0x00cccccc,
- 0x00f7f7f7,0x00999999,0x00616161,0x005a5a5a,
- 0x00e8e8e8,0x00242424,0x00565656,0x00404040,
- 0x00e1e1e1,0x00636363,0x00090909,0x00333333,
- 0x00bfbfbf,0x00989898,0x00979797,0x00858585,
- 0x00686868,0x00fcfcfc,0x00ececec,0x000a0a0a,
- 0x00dadada,0x006f6f6f,0x00535353,0x00626262,
- 0x00a3a3a3,0x002e2e2e,0x00080808,0x00afafaf,
- 0x00282828,0x00b0b0b0,0x00747474,0x00c2c2c2,
- 0x00bdbdbd,0x00363636,0x00222222,0x00383838,
- 0x00646464,0x001e1e1e,0x00393939,0x002c2c2c,
- 0x00a6a6a6,0x00303030,0x00e5e5e5,0x00444444,
- 0x00fdfdfd,0x00888888,0x009f9f9f,0x00656565,
- 0x00878787,0x006b6b6b,0x00f4f4f4,0x00232323,
- 0x00484848,0x00101010,0x00d1d1d1,0x00515151,
- 0x00c0c0c0,0x00f9f9f9,0x00d2d2d2,0x00a0a0a0,
- 0x00555555,0x00a1a1a1,0x00414141,0x00fafafa,
- 0x00434343,0x00131313,0x00c4c4c4,0x002f2f2f,
- 0x00a8a8a8,0x00b6b6b6,0x003c3c3c,0x002b2b2b,
- 0x00c1c1c1,0x00ffffff,0x00c8c8c8,0x00a5a5a5,
- 0x00202020,0x00898989,0x00000000,0x00909090,
- 0x00474747,0x00efefef,0x00eaeaea,0x00b7b7b7,
- 0x00151515,0x00060606,0x00cdcdcd,0x00b5b5b5,
- 0x00121212,0x007e7e7e,0x00bbbbbb,0x00292929,
- 0x000f0f0f,0x00b8b8b8,0x00070707,0x00040404,
- 0x009b9b9b,0x00949494,0x00212121,0x00666666,
- 0x00e6e6e6,0x00cecece,0x00ededed,0x00e7e7e7,
- 0x003b3b3b,0x00fefefe,0x007f7f7f,0x00c5c5c5,
- 0x00a4a4a4,0x00373737,0x00b1b1b1,0x004c4c4c,
- 0x00919191,0x006e6e6e,0x008d8d8d,0x00767676,
- 0x00030303,0x002d2d2d,0x00dedede,0x00969696,
- 0x00262626,0x007d7d7d,0x00c6c6c6,0x005c5c5c,
- 0x00d3d3d3,0x00f2f2f2,0x004f4f4f,0x00191919,
- 0x003f3f3f,0x00dcdcdc,0x00797979,0x001d1d1d,
- 0x00525252,0x00ebebeb,0x00f3f3f3,0x006d6d6d,
- 0x005e5e5e,0x00fbfbfb,0x00696969,0x00b2b2b2,
- 0x00f0f0f0,0x00313131,0x000c0c0c,0x00d4d4d4,
- 0x00cfcfcf,0x008c8c8c,0x00e2e2e2,0x00757575,
- 0x00a9a9a9,0x004a4a4a,0x00575757,0x00848484,
- 0x00111111,0x00454545,0x001b1b1b,0x00f5f5f5,
- 0x00e4e4e4,0x000e0e0e,0x00737373,0x00aaaaaa,
- 0x00f1f1f1,0x00dddddd,0x00595959,0x00141414,
- 0x006c6c6c,0x00929292,0x00545454,0x00d0d0d0,
- 0x00787878,0x00707070,0x00e3e3e3,0x00494949,
- 0x00808080,0x00505050,0x00a7a7a7,0x00f6f6f6,
- 0x00777777,0x00939393,0x00868686,0x00838383,
- 0x002a2a2a,0x00c7c7c7,0x005b5b5b,0x00e9e9e9,
- 0x00eeeeee,0x008f8f8f,0x00010101,0x003d3d3d,
-};
-
-static const u32 camellia_sp3033[256] = {
- 0x38003838,0x41004141,0x16001616,0x76007676,
- 0xd900d9d9,0x93009393,0x60006060,0xf200f2f2,
- 0x72007272,0xc200c2c2,0xab00abab,0x9a009a9a,
- 0x75007575,0x06000606,0x57005757,0xa000a0a0,
- 0x91009191,0xf700f7f7,0xb500b5b5,0xc900c9c9,
- 0xa200a2a2,0x8c008c8c,0xd200d2d2,0x90009090,
- 0xf600f6f6,0x07000707,0xa700a7a7,0x27002727,
- 0x8e008e8e,0xb200b2b2,0x49004949,0xde00dede,
- 0x43004343,0x5c005c5c,0xd700d7d7,0xc700c7c7,
- 0x3e003e3e,0xf500f5f5,0x8f008f8f,0x67006767,
- 0x1f001f1f,0x18001818,0x6e006e6e,0xaf00afaf,
- 0x2f002f2f,0xe200e2e2,0x85008585,0x0d000d0d,
- 0x53005353,0xf000f0f0,0x9c009c9c,0x65006565,
- 0xea00eaea,0xa300a3a3,0xae00aeae,0x9e009e9e,
- 0xec00ecec,0x80008080,0x2d002d2d,0x6b006b6b,
- 0xa800a8a8,0x2b002b2b,0x36003636,0xa600a6a6,
- 0xc500c5c5,0x86008686,0x4d004d4d,0x33003333,
- 0xfd00fdfd,0x66006666,0x58005858,0x96009696,
- 0x3a003a3a,0x09000909,0x95009595,0x10001010,
- 0x78007878,0xd800d8d8,0x42004242,0xcc00cccc,
- 0xef00efef,0x26002626,0xe500e5e5,0x61006161,
- 0x1a001a1a,0x3f003f3f,0x3b003b3b,0x82008282,
- 0xb600b6b6,0xdb00dbdb,0xd400d4d4,0x98009898,
- 0xe800e8e8,0x8b008b8b,0x02000202,0xeb00ebeb,
- 0x0a000a0a,0x2c002c2c,0x1d001d1d,0xb000b0b0,
- 0x6f006f6f,0x8d008d8d,0x88008888,0x0e000e0e,
- 0x19001919,0x87008787,0x4e004e4e,0x0b000b0b,
- 0xa900a9a9,0x0c000c0c,0x79007979,0x11001111,
- 0x7f007f7f,0x22002222,0xe700e7e7,0x59005959,
- 0xe100e1e1,0xda00dada,0x3d003d3d,0xc800c8c8,
- 0x12001212,0x04000404,0x74007474,0x54005454,
- 0x30003030,0x7e007e7e,0xb400b4b4,0x28002828,
- 0x55005555,0x68006868,0x50005050,0xbe00bebe,
- 0xd000d0d0,0xc400c4c4,0x31003131,0xcb00cbcb,
- 0x2a002a2a,0xad00adad,0x0f000f0f,0xca00caca,
- 0x70007070,0xff00ffff,0x32003232,0x69006969,
- 0x08000808,0x62006262,0x00000000,0x24002424,
- 0xd100d1d1,0xfb00fbfb,0xba00baba,0xed00eded,
- 0x45004545,0x81008181,0x73007373,0x6d006d6d,
- 0x84008484,0x9f009f9f,0xee00eeee,0x4a004a4a,
- 0xc300c3c3,0x2e002e2e,0xc100c1c1,0x01000101,
- 0xe600e6e6,0x25002525,0x48004848,0x99009999,
- 0xb900b9b9,0xb300b3b3,0x7b007b7b,0xf900f9f9,
- 0xce00cece,0xbf00bfbf,0xdf00dfdf,0x71007171,
- 0x29002929,0xcd00cdcd,0x6c006c6c,0x13001313,
- 0x64006464,0x9b009b9b,0x63006363,0x9d009d9d,
- 0xc000c0c0,0x4b004b4b,0xb700b7b7,0xa500a5a5,
- 0x89008989,0x5f005f5f,0xb100b1b1,0x17001717,
- 0xf400f4f4,0xbc00bcbc,0xd300d3d3,0x46004646,
- 0xcf00cfcf,0x37003737,0x5e005e5e,0x47004747,
- 0x94009494,0xfa00fafa,0xfc00fcfc,0x5b005b5b,
- 0x97009797,0xfe00fefe,0x5a005a5a,0xac00acac,
- 0x3c003c3c,0x4c004c4c,0x03000303,0x35003535,
- 0xf300f3f3,0x23002323,0xb800b8b8,0x5d005d5d,
- 0x6a006a6a,0x92009292,0xd500d5d5,0x21002121,
- 0x44004444,0x51005151,0xc600c6c6,0x7d007d7d,
- 0x39003939,0x83008383,0xdc00dcdc,0xaa00aaaa,
- 0x7c007c7c,0x77007777,0x56005656,0x05000505,
- 0x1b001b1b,0xa400a4a4,0x15001515,0x34003434,
- 0x1e001e1e,0x1c001c1c,0xf800f8f8,0x52005252,
- 0x20002020,0x14001414,0xe900e9e9,0xbd00bdbd,
- 0xdd00dddd,0xe400e4e4,0xa100a1a1,0xe000e0e0,
- 0x8a008a8a,0xf100f1f1,0xd600d6d6,0x7a007a7a,
- 0xbb00bbbb,0xe300e3e3,0x40004040,0x4f004f4f,
-};
-
-static const u32 camellia_sp4404[256] = {
- 0x70700070,0x2c2c002c,0xb3b300b3,0xc0c000c0,
- 0xe4e400e4,0x57570057,0xeaea00ea,0xaeae00ae,
- 0x23230023,0x6b6b006b,0x45450045,0xa5a500a5,
- 0xeded00ed,0x4f4f004f,0x1d1d001d,0x92920092,
- 0x86860086,0xafaf00af,0x7c7c007c,0x1f1f001f,
- 0x3e3e003e,0xdcdc00dc,0x5e5e005e,0x0b0b000b,
- 0xa6a600a6,0x39390039,0xd5d500d5,0x5d5d005d,
- 0xd9d900d9,0x5a5a005a,0x51510051,0x6c6c006c,
- 0x8b8b008b,0x9a9a009a,0xfbfb00fb,0xb0b000b0,
- 0x74740074,0x2b2b002b,0xf0f000f0,0x84840084,
- 0xdfdf00df,0xcbcb00cb,0x34340034,0x76760076,
- 0x6d6d006d,0xa9a900a9,0xd1d100d1,0x04040004,
- 0x14140014,0x3a3a003a,0xdede00de,0x11110011,
- 0x32320032,0x9c9c009c,0x53530053,0xf2f200f2,
- 0xfefe00fe,0xcfcf00cf,0xc3c300c3,0x7a7a007a,
- 0x24240024,0xe8e800e8,0x60600060,0x69690069,
- 0xaaaa00aa,0xa0a000a0,0xa1a100a1,0x62620062,
- 0x54540054,0x1e1e001e,0xe0e000e0,0x64640064,
- 0x10100010,0x00000000,0xa3a300a3,0x75750075,
- 0x8a8a008a,0xe6e600e6,0x09090009,0xdddd00dd,
- 0x87870087,0x83830083,0xcdcd00cd,0x90900090,
- 0x73730073,0xf6f600f6,0x9d9d009d,0xbfbf00bf,
- 0x52520052,0xd8d800d8,0xc8c800c8,0xc6c600c6,
- 0x81810081,0x6f6f006f,0x13130013,0x63630063,
- 0xe9e900e9,0xa7a700a7,0x9f9f009f,0xbcbc00bc,
- 0x29290029,0xf9f900f9,0x2f2f002f,0xb4b400b4,
- 0x78780078,0x06060006,0xe7e700e7,0x71710071,
- 0xd4d400d4,0xabab00ab,0x88880088,0x8d8d008d,
- 0x72720072,0xb9b900b9,0xf8f800f8,0xacac00ac,
- 0x36360036,0x2a2a002a,0x3c3c003c,0xf1f100f1,
- 0x40400040,0xd3d300d3,0xbbbb00bb,0x43430043,
- 0x15150015,0xadad00ad,0x77770077,0x80800080,
- 0x82820082,0xecec00ec,0x27270027,0xe5e500e5,
- 0x85850085,0x35350035,0x0c0c000c,0x41410041,
- 0xefef00ef,0x93930093,0x19190019,0x21210021,
- 0x0e0e000e,0x4e4e004e,0x65650065,0xbdbd00bd,
- 0xb8b800b8,0x8f8f008f,0xebeb00eb,0xcece00ce,
- 0x30300030,0x5f5f005f,0xc5c500c5,0x1a1a001a,
- 0xe1e100e1,0xcaca00ca,0x47470047,0x3d3d003d,
- 0x01010001,0xd6d600d6,0x56560056,0x4d4d004d,
- 0x0d0d000d,0x66660066,0xcccc00cc,0x2d2d002d,
- 0x12120012,0x20200020,0xb1b100b1,0x99990099,
- 0x4c4c004c,0xc2c200c2,0x7e7e007e,0x05050005,
- 0xb7b700b7,0x31310031,0x17170017,0xd7d700d7,
- 0x58580058,0x61610061,0x1b1b001b,0x1c1c001c,
- 0x0f0f000f,0x16160016,0x18180018,0x22220022,
- 0x44440044,0xb2b200b2,0xb5b500b5,0x91910091,
- 0x08080008,0xa8a800a8,0xfcfc00fc,0x50500050,
- 0xd0d000d0,0x7d7d007d,0x89890089,0x97970097,
- 0x5b5b005b,0x95950095,0xffff00ff,0xd2d200d2,
- 0xc4c400c4,0x48480048,0xf7f700f7,0xdbdb00db,
- 0x03030003,0xdada00da,0x3f3f003f,0x94940094,
- 0x5c5c005c,0x02020002,0x4a4a004a,0x33330033,
- 0x67670067,0xf3f300f3,0x7f7f007f,0xe2e200e2,
- 0x9b9b009b,0x26260026,0x37370037,0x3b3b003b,
- 0x96960096,0x4b4b004b,0xbebe00be,0x2e2e002e,
- 0x79790079,0x8c8c008c,0x6e6e006e,0x8e8e008e,
- 0xf5f500f5,0xb6b600b6,0xfdfd00fd,0x59590059,
- 0x98980098,0x6a6a006a,0x46460046,0xbaba00ba,
- 0x25250025,0x42420042,0xa2a200a2,0xfafa00fa,
- 0x07070007,0x55550055,0xeeee00ee,0x0a0a000a,
- 0x49490049,0x68680068,0x38380038,0xa4a400a4,
- 0x28280028,0x7b7b007b,0xc9c900c9,0xc1c100c1,
- 0xe3e300e3,0xf4f400f4,0xc7c700c7,0x9e9e009e,
-};
-
-
-/**
- * Stuff related to the Camellia key schedule
- */
-#define subl(x) subL[(x)]
-#define subr(x) subR[(x)]
-
-static int camellia_setup128(const unsigned char *key, u32 *subkey)
-{
- u32 kll, klr, krl, krr;
- u32 il, ir, t0, t1, w0, w1;
- u32 kw4l, kw4r, dw, tl, tr;
-
-#ifdef WOLFSSL_SMALL_STACK
- u32* subL;
- u32* subR;
-
- subL = (u32*) XMALLOC(sizeof(u32) * 26, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (subL == NULL)
- return MEMORY_E;
-
- subR = (u32*) XMALLOC(sizeof(u32) * 26, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (subR == NULL) {
- XFREE(subL, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return MEMORY_E;
- }
-#else
- u32 subL[26];
- u32 subR[26];
-#endif
-
- /**
- * k == kll || klr || krl || krr (|| is concatenation)
- */
- kll = GETU32(key );
- klr = GETU32(key + 4);
- krl = GETU32(key + 8);
- krr = GETU32(key + 12);
- /**
- * generate KL dependent subkeys
- */
- subl(0) = kll; subr(0) = klr;
- subl(1) = krl; subr(1) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(4) = kll; subr(4) = klr;
- subl(5) = krl; subr(5) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
- subl(10) = kll; subr(10) = klr;
- subl(11) = krl; subr(11) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(13) = krl; subr(13) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
- subl(16) = kll; subr(16) = klr;
- subl(17) = krl; subr(17) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
- subl(18) = kll; subr(18) = klr;
- subl(19) = krl; subr(19) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
- subl(22) = kll; subr(22) = klr;
- subl(23) = krl; subr(23) = krr;
-
- /* generate KA */
- kll = subl(0); klr = subr(0);
- krl = subl(1); krr = subr(1);
- CAMELLIA_F(kll, klr,
- CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
- w0, w1, il, ir, t0, t1);
- krl ^= w0; krr ^= w1;
- CAMELLIA_F(krl, krr,
- CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
- kll, klr, il, ir, t0, t1);
- CAMELLIA_F(kll, klr,
- CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
- krl, krr, il, ir, t0, t1);
- krl ^= w0; krr ^= w1;
- CAMELLIA_F(krl, krr,
- CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
- w0, w1, il, ir, t0, t1);
- kll ^= w0; klr ^= w1;
-
- /* generate KA dependent subkeys */
- subl(2) = kll; subr(2) = klr;
- subl(3) = krl; subr(3) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(6) = kll; subr(6) = klr;
- subl(7) = krl; subr(7) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(8) = kll; subr(8) = klr;
- subl(9) = krl; subr(9) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(12) = kll; subr(12) = klr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(14) = kll; subr(14) = klr;
- subl(15) = krl; subr(15) = krr;
- CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
- subl(20) = kll; subr(20) = klr;
- subl(21) = krl; subr(21) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
- subl(24) = kll; subr(24) = klr;
- subl(25) = krl; subr(25) = krr;
-
-
- /* absorb kw2 to other subkeys */
- subl(3) ^= subl(1); subr(3) ^= subr(1);
- subl(5) ^= subl(1); subr(5) ^= subr(1);
- subl(7) ^= subl(1); subr(7) ^= subr(1);
- subl(1) ^= subr(1) & ~subr(9);
- dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
- subl(11) ^= subl(1); subr(11) ^= subr(1);
- subl(13) ^= subl(1); subr(13) ^= subr(1);
- subl(15) ^= subl(1); subr(15) ^= subr(1);
- subl(1) ^= subr(1) & ~subr(17);
- dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
- subl(19) ^= subl(1); subr(19) ^= subr(1);
- subl(21) ^= subl(1); subr(21) ^= subr(1);
- subl(23) ^= subl(1); subr(23) ^= subr(1);
- subl(24) ^= subl(1); subr(24) ^= subr(1);
-
- /* absorb kw4 to other subkeys */
- kw4l = subl(25); kw4r = subr(25);
- subl(22) ^= kw4l; subr(22) ^= kw4r;
- subl(20) ^= kw4l; subr(20) ^= kw4r;
- subl(18) ^= kw4l; subr(18) ^= kw4r;
- kw4l ^= kw4r & ~subr(16);
- dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
- subl(14) ^= kw4l; subr(14) ^= kw4r;
- subl(12) ^= kw4l; subr(12) ^= kw4r;
- subl(10) ^= kw4l; subr(10) ^= kw4r;
- kw4l ^= kw4r & ~subr(8);
- dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
- subl(6) ^= kw4l; subr(6) ^= kw4r;
- subl(4) ^= kw4l; subr(4) ^= kw4r;
- subl(2) ^= kw4l; subr(2) ^= kw4r;
- subl(0) ^= kw4l; subr(0) ^= kw4r;
-
- /* key XOR is end of F-function */
- CamelliaSubkeyL(0) = subl(0) ^ subl(2);
- CamelliaSubkeyR(0) = subr(0) ^ subr(2);
- CamelliaSubkeyL(2) = subl(3);
- CamelliaSubkeyR(2) = subr(3);
- CamelliaSubkeyL(3) = subl(2) ^ subl(4);
- CamelliaSubkeyR(3) = subr(2) ^ subr(4);
- CamelliaSubkeyL(4) = subl(3) ^ subl(5);
- CamelliaSubkeyR(4) = subr(3) ^ subr(5);
- CamelliaSubkeyL(5) = subl(4) ^ subl(6);
- CamelliaSubkeyR(5) = subr(4) ^ subr(6);
- CamelliaSubkeyL(6) = subl(5) ^ subl(7);
- CamelliaSubkeyR(6) = subr(5) ^ subr(7);
- tl = subl(10) ^ (subr(10) & ~subr(8));
- dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(7) = subl(6) ^ tl;
- CamelliaSubkeyR(7) = subr(6) ^ tr;
- CamelliaSubkeyL(8) = subl(8);
- CamelliaSubkeyR(8) = subr(8);
- CamelliaSubkeyL(9) = subl(9);
- CamelliaSubkeyR(9) = subr(9);
- tl = subl(7) ^ (subr(7) & ~subr(9));
- dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(10) = tl ^ subl(11);
- CamelliaSubkeyR(10) = tr ^ subr(11);
- CamelliaSubkeyL(11) = subl(10) ^ subl(12);
- CamelliaSubkeyR(11) = subr(10) ^ subr(12);
- CamelliaSubkeyL(12) = subl(11) ^ subl(13);
- CamelliaSubkeyR(12) = subr(11) ^ subr(13);
- CamelliaSubkeyL(13) = subl(12) ^ subl(14);
- CamelliaSubkeyR(13) = subr(12) ^ subr(14);
- CamelliaSubkeyL(14) = subl(13) ^ subl(15);
- CamelliaSubkeyR(14) = subr(13) ^ subr(15);
- tl = subl(18) ^ (subr(18) & ~subr(16));
- dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(15) = subl(14) ^ tl;
- CamelliaSubkeyR(15) = subr(14) ^ tr;
- CamelliaSubkeyL(16) = subl(16);
- CamelliaSubkeyR(16) = subr(16);
- CamelliaSubkeyL(17) = subl(17);
- CamelliaSubkeyR(17) = subr(17);
- tl = subl(15) ^ (subr(15) & ~subr(17));
- dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(18) = tl ^ subl(19);
- CamelliaSubkeyR(18) = tr ^ subr(19);
- CamelliaSubkeyL(19) = subl(18) ^ subl(20);
- CamelliaSubkeyR(19) = subr(18) ^ subr(20);
- CamelliaSubkeyL(20) = subl(19) ^ subl(21);
- CamelliaSubkeyR(20) = subr(19) ^ subr(21);
- CamelliaSubkeyL(21) = subl(20) ^ subl(22);
- CamelliaSubkeyR(21) = subr(20) ^ subr(22);
- CamelliaSubkeyL(22) = subl(21) ^ subl(23);
- CamelliaSubkeyR(22) = subr(21) ^ subr(23);
- CamelliaSubkeyL(23) = subl(22);
- CamelliaSubkeyR(23) = subr(22);
- CamelliaSubkeyL(24) = subl(24) ^ subl(23);
- CamelliaSubkeyR(24) = subr(24) ^ subr(23);
-
- /* apply the inverse of the last half of P-function */
- dw = CamelliaSubkeyL(2) ^ CamelliaSubkeyR(2), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(2) = CamelliaSubkeyL(2) ^ dw, CamelliaSubkeyL(2) = dw;
- dw = CamelliaSubkeyL(3) ^ CamelliaSubkeyR(3), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(3) = CamelliaSubkeyL(3) ^ dw, CamelliaSubkeyL(3) = dw;
- dw = CamelliaSubkeyL(4) ^ CamelliaSubkeyR(4), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(4) = CamelliaSubkeyL(4) ^ dw, CamelliaSubkeyL(4) = dw;
- dw = CamelliaSubkeyL(5) ^ CamelliaSubkeyR(5), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(5) = CamelliaSubkeyL(5) ^ dw, CamelliaSubkeyL(5) = dw;
- dw = CamelliaSubkeyL(6) ^ CamelliaSubkeyR(6), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(6) = CamelliaSubkeyL(6) ^ dw, CamelliaSubkeyL(6) = dw;
- dw = CamelliaSubkeyL(7) ^ CamelliaSubkeyR(7), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(7) = CamelliaSubkeyL(7) ^ dw, CamelliaSubkeyL(7) = dw;
- dw = CamelliaSubkeyL(10) ^ CamelliaSubkeyR(10), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(10) = CamelliaSubkeyL(10) ^ dw, CamelliaSubkeyL(10) = dw;
- dw = CamelliaSubkeyL(11) ^ CamelliaSubkeyR(11), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(11) = CamelliaSubkeyL(11) ^ dw, CamelliaSubkeyL(11) = dw;
- dw = CamelliaSubkeyL(12) ^ CamelliaSubkeyR(12), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(12) = CamelliaSubkeyL(12) ^ dw, CamelliaSubkeyL(12) = dw;
- dw = CamelliaSubkeyL(13) ^ CamelliaSubkeyR(13), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(13) = CamelliaSubkeyL(13) ^ dw, CamelliaSubkeyL(13) = dw;
- dw = CamelliaSubkeyL(14) ^ CamelliaSubkeyR(14), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(14) = CamelliaSubkeyL(14) ^ dw, CamelliaSubkeyL(14) = dw;
- dw = CamelliaSubkeyL(15) ^ CamelliaSubkeyR(15), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(15) = CamelliaSubkeyL(15) ^ dw, CamelliaSubkeyL(15) = dw;
- dw = CamelliaSubkeyL(18) ^ CamelliaSubkeyR(18), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(18) = CamelliaSubkeyL(18) ^ dw, CamelliaSubkeyL(18) = dw;
- dw = CamelliaSubkeyL(19) ^ CamelliaSubkeyR(19), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(19) = CamelliaSubkeyL(19) ^ dw, CamelliaSubkeyL(19) = dw;
- dw = CamelliaSubkeyL(20) ^ CamelliaSubkeyR(20), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(20) = CamelliaSubkeyL(20) ^ dw, CamelliaSubkeyL(20) = dw;
- dw = CamelliaSubkeyL(21) ^ CamelliaSubkeyR(21), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(21) = CamelliaSubkeyL(21) ^ dw, CamelliaSubkeyL(21) = dw;
- dw = CamelliaSubkeyL(22) ^ CamelliaSubkeyR(22), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(22) = CamelliaSubkeyL(22) ^ dw, CamelliaSubkeyL(22) = dw;
- dw = CamelliaSubkeyL(23) ^ CamelliaSubkeyR(23), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(23) = CamelliaSubkeyL(23) ^ dw, CamelliaSubkeyL(23) = dw;
-
- WC_FREE_VAR_EX(subL, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- WC_FREE_VAR_EX(subR, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return 0;
-}
-
-static int camellia_setup256(const unsigned char *key, u32 *subkey)
-{
- u32 kll,klr,krl,krr; /* left half of key */
- u32 krll,krlr,krrl,krrr; /* right half of key */
- u32 il, ir, t0, t1, w0, w1; /* temporary variables */
- u32 kw4l, kw4r, dw, tl, tr;
-
-#ifdef WOLFSSL_SMALL_STACK
- u32* subL;
- u32* subR;
-
- subL = (u32*) XMALLOC(sizeof(u32) * 34, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (subL == NULL)
- return MEMORY_E;
-
- subR = (u32*) XMALLOC(sizeof(u32) * 34, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- if (subR == NULL) {
- XFREE(subL, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- return MEMORY_E;
- }
-#else
- u32 subL[34];
- u32 subR[34];
-#endif
-
- /**
- * key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
- * (|| is concatenation)
- */
-
- kll = GETU32(key );
- klr = GETU32(key + 4);
- krl = GETU32(key + 8);
- krr = GETU32(key + 12);
- krll = GETU32(key + 16);
- krlr = GETU32(key + 20);
- krrl = GETU32(key + 24);
- krrr = GETU32(key + 28);
-
- /* generate KL dependent subkeys */
- subl(0) = kll; subr(0) = klr;
- subl(1) = krl; subr(1) = krr;
- CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
- subl(12) = kll; subr(12) = klr;
- subl(13) = krl; subr(13) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(16) = kll; subr(16) = klr;
- subl(17) = krl; subr(17) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
- subl(22) = kll; subr(22) = klr;
- subl(23) = krl; subr(23) = krr;
- CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
- subl(30) = kll; subr(30) = klr;
- subl(31) = krl; subr(31) = krr;
-
- /* generate KR dependent subkeys */
- CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
- subl(4) = krll; subr(4) = krlr;
- subl(5) = krrl; subr(5) = krrr;
- CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
- subl(8) = krll; subr(8) = krlr;
- subl(9) = krrl; subr(9) = krrr;
- CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
- subl(18) = krll; subr(18) = krlr;
- subl(19) = krrl; subr(19) = krrr;
- CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
- subl(26) = krll; subr(26) = krlr;
- subl(27) = krrl; subr(27) = krrr;
- CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
-
- /* generate KA */
- kll = subl(0) ^ krll; klr = subr(0) ^ krlr;
- krl = subl(1) ^ krrl; krr = subr(1) ^ krrr;
- CAMELLIA_F(kll, klr,
- CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
- w0, w1, il, ir, t0, t1);
- krl ^= w0; krr ^= w1;
- CAMELLIA_F(krl, krr,
- CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
- kll, klr, il, ir, t0, t1);
- kll ^= krll; klr ^= krlr;
- CAMELLIA_F(kll, klr,
- CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
- krl, krr, il, ir, t0, t1);
- krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
- CAMELLIA_F(krl, krr,
- CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
- w0, w1, il, ir, t0, t1);
- kll ^= w0; klr ^= w1;
-
- /* generate KB */
- krll ^= kll; krlr ^= klr;
- krrl ^= krl; krrr ^= krr;
- CAMELLIA_F(krll, krlr,
- CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
- w0, w1, il, ir, t0, t1);
- krrl ^= w0; krrr ^= w1;
- CAMELLIA_F(krrl, krrr,
- CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
- w0, w1, il, ir, t0, t1);
- krll ^= w0; krlr ^= w1;
-
- /* generate KA dependent subkeys */
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
- subl(6) = kll; subr(6) = klr;
- subl(7) = krl; subr(7) = krr;
- CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
- subl(14) = kll; subr(14) = klr;
- subl(15) = krl; subr(15) = krr;
- subl(24) = klr; subr(24) = krl;
- subl(25) = krr; subr(25) = kll;
- CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
- subl(28) = kll; subr(28) = klr;
- subl(29) = krl; subr(29) = krr;
-
- /* generate KB dependent subkeys */
- subl(2) = krll; subr(2) = krlr;
- subl(3) = krrl; subr(3) = krrr;
- CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
- subl(10) = krll; subr(10) = krlr;
- subl(11) = krrl; subr(11) = krrr;
- CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
- subl(20) = krll; subr(20) = krlr;
- subl(21) = krrl; subr(21) = krrr;
- CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
- subl(32) = krll; subr(32) = krlr;
- subl(33) = krrl; subr(33) = krrr;
-
- /* absorb kw2 to other subkeys */
- subl(3) ^= subl(1); subr(3) ^= subr(1);
- subl(5) ^= subl(1); subr(5) ^= subr(1);
- subl(7) ^= subl(1); subr(7) ^= subr(1);
- subl(1) ^= subr(1) & ~subr(9);
- dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
- subl(11) ^= subl(1); subr(11) ^= subr(1);
- subl(13) ^= subl(1); subr(13) ^= subr(1);
- subl(15) ^= subl(1); subr(15) ^= subr(1);
- subl(1) ^= subr(1) & ~subr(17);
- dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
- subl(19) ^= subl(1); subr(19) ^= subr(1);
- subl(21) ^= subl(1); subr(21) ^= subr(1);
- subl(23) ^= subl(1); subr(23) ^= subr(1);
- subl(1) ^= subr(1) & ~subr(25);
- dw = subl(1) & subl(25), subr(1) ^= CAMELLIA_RL1(dw);
- subl(27) ^= subl(1); subr(27) ^= subr(1);
- subl(29) ^= subl(1); subr(29) ^= subr(1);
- subl(31) ^= subl(1); subr(31) ^= subr(1);
- subl(32) ^= subl(1); subr(32) ^= subr(1);
-
- /* absorb kw4 to other subkeys */
- kw4l = subl(33); kw4r = subr(33);
- subl(30) ^= kw4l; subr(30) ^= kw4r;
- subl(28) ^= kw4l; subr(28) ^= kw4r;
- subl(26) ^= kw4l; subr(26) ^= kw4r;
- kw4l ^= kw4r & ~subr(24);
- dw = kw4l & subl(24), kw4r ^= CAMELLIA_RL1(dw);
- subl(22) ^= kw4l; subr(22) ^= kw4r;
- subl(20) ^= kw4l; subr(20) ^= kw4r;
- subl(18) ^= kw4l; subr(18) ^= kw4r;
- kw4l ^= kw4r & ~subr(16);
- dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
- subl(14) ^= kw4l; subr(14) ^= kw4r;
- subl(12) ^= kw4l; subr(12) ^= kw4r;
- subl(10) ^= kw4l; subr(10) ^= kw4r;
- kw4l ^= kw4r & ~subr(8);
- dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
- subl(6) ^= kw4l; subr(6) ^= kw4r;
- subl(4) ^= kw4l; subr(4) ^= kw4r;
- subl(2) ^= kw4l; subr(2) ^= kw4r;
- subl(0) ^= kw4l; subr(0) ^= kw4r;
-
- /* key XOR is end of F-function */
- CamelliaSubkeyL(0) = subl(0) ^ subl(2);
- CamelliaSubkeyR(0) = subr(0) ^ subr(2);
- CamelliaSubkeyL(2) = subl(3);
- CamelliaSubkeyR(2) = subr(3);
- CamelliaSubkeyL(3) = subl(2) ^ subl(4);
- CamelliaSubkeyR(3) = subr(2) ^ subr(4);
- CamelliaSubkeyL(4) = subl(3) ^ subl(5);
- CamelliaSubkeyR(4) = subr(3) ^ subr(5);
- CamelliaSubkeyL(5) = subl(4) ^ subl(6);
- CamelliaSubkeyR(5) = subr(4) ^ subr(6);
- CamelliaSubkeyL(6) = subl(5) ^ subl(7);
- CamelliaSubkeyR(6) = subr(5) ^ subr(7);
- tl = subl(10) ^ (subr(10) & ~subr(8));
- dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(7) = subl(6) ^ tl;
- CamelliaSubkeyR(7) = subr(6) ^ tr;
- CamelliaSubkeyL(8) = subl(8);
- CamelliaSubkeyR(8) = subr(8);
- CamelliaSubkeyL(9) = subl(9);
- CamelliaSubkeyR(9) = subr(9);
- tl = subl(7) ^ (subr(7) & ~subr(9));
- dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(10) = tl ^ subl(11);
- CamelliaSubkeyR(10) = tr ^ subr(11);
- CamelliaSubkeyL(11) = subl(10) ^ subl(12);
- CamelliaSubkeyR(11) = subr(10) ^ subr(12);
- CamelliaSubkeyL(12) = subl(11) ^ subl(13);
- CamelliaSubkeyR(12) = subr(11) ^ subr(13);
- CamelliaSubkeyL(13) = subl(12) ^ subl(14);
- CamelliaSubkeyR(13) = subr(12) ^ subr(14);
- CamelliaSubkeyL(14) = subl(13) ^ subl(15);
- CamelliaSubkeyR(14) = subr(13) ^ subr(15);
- tl = subl(18) ^ (subr(18) & ~subr(16));
- dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(15) = subl(14) ^ tl;
- CamelliaSubkeyR(15) = subr(14) ^ tr;
- CamelliaSubkeyL(16) = subl(16);
- CamelliaSubkeyR(16) = subr(16);
- CamelliaSubkeyL(17) = subl(17);
- CamelliaSubkeyR(17) = subr(17);
- tl = subl(15) ^ (subr(15) & ~subr(17));
- dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(18) = tl ^ subl(19);
- CamelliaSubkeyR(18) = tr ^ subr(19);
- CamelliaSubkeyL(19) = subl(18) ^ subl(20);
- CamelliaSubkeyR(19) = subr(18) ^ subr(20);
- CamelliaSubkeyL(20) = subl(19) ^ subl(21);
- CamelliaSubkeyR(20) = subr(19) ^ subr(21);
- CamelliaSubkeyL(21) = subl(20) ^ subl(22);
- CamelliaSubkeyR(21) = subr(20) ^ subr(22);
- CamelliaSubkeyL(22) = subl(21) ^ subl(23);
- CamelliaSubkeyR(22) = subr(21) ^ subr(23);
- tl = subl(26) ^ (subr(26) & ~subr(24));
- dw = tl & subl(24), tr = subr(26) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(23) = subl(22) ^ tl;
- CamelliaSubkeyR(23) = subr(22) ^ tr;
- CamelliaSubkeyL(24) = subl(24);
- CamelliaSubkeyR(24) = subr(24);
- CamelliaSubkeyL(25) = subl(25);
- CamelliaSubkeyR(25) = subr(25);
- tl = subl(23) ^ (subr(23) & ~subr(25));
- dw = tl & subl(25), tr = subr(23) ^ CAMELLIA_RL1(dw);
- CamelliaSubkeyL(26) = tl ^ subl(27);
- CamelliaSubkeyR(26) = tr ^ subr(27);
- CamelliaSubkeyL(27) = subl(26) ^ subl(28);
- CamelliaSubkeyR(27) = subr(26) ^ subr(28);
- CamelliaSubkeyL(28) = subl(27) ^ subl(29);
- CamelliaSubkeyR(28) = subr(27) ^ subr(29);
- CamelliaSubkeyL(29) = subl(28) ^ subl(30);
- CamelliaSubkeyR(29) = subr(28) ^ subr(30);
- CamelliaSubkeyL(30) = subl(29) ^ subl(31);
- CamelliaSubkeyR(30) = subr(29) ^ subr(31);
- CamelliaSubkeyL(31) = subl(30);
- CamelliaSubkeyR(31) = subr(30);
- CamelliaSubkeyL(32) = subl(32) ^ subl(31);
- CamelliaSubkeyR(32) = subr(32) ^ subr(31);
-
- /* apply the inverse of the last half of P-function */
- dw = CamelliaSubkeyL(2) ^ CamelliaSubkeyR(2), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(2) = CamelliaSubkeyL(2) ^ dw, CamelliaSubkeyL(2) = dw;
- dw = CamelliaSubkeyL(3) ^ CamelliaSubkeyR(3), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(3) = CamelliaSubkeyL(3) ^ dw, CamelliaSubkeyL(3) = dw;
- dw = CamelliaSubkeyL(4) ^ CamelliaSubkeyR(4), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(4) = CamelliaSubkeyL(4) ^ dw, CamelliaSubkeyL(4) = dw;
- dw = CamelliaSubkeyL(5) ^ CamelliaSubkeyR(5), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(5) = CamelliaSubkeyL(5) ^ dw, CamelliaSubkeyL(5) = dw;
- dw = CamelliaSubkeyL(6) ^ CamelliaSubkeyR(6), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(6) = CamelliaSubkeyL(6) ^ dw, CamelliaSubkeyL(6) = dw;
- dw = CamelliaSubkeyL(7) ^ CamelliaSubkeyR(7), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(7) = CamelliaSubkeyL(7) ^ dw, CamelliaSubkeyL(7) = dw;
- dw = CamelliaSubkeyL(10) ^ CamelliaSubkeyR(10), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(10) = CamelliaSubkeyL(10) ^ dw, CamelliaSubkeyL(10) = dw;
- dw = CamelliaSubkeyL(11) ^ CamelliaSubkeyR(11), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(11) = CamelliaSubkeyL(11) ^ dw, CamelliaSubkeyL(11) = dw;
- dw = CamelliaSubkeyL(12) ^ CamelliaSubkeyR(12), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(12) = CamelliaSubkeyL(12) ^ dw, CamelliaSubkeyL(12) = dw;
- dw = CamelliaSubkeyL(13) ^ CamelliaSubkeyR(13), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(13) = CamelliaSubkeyL(13) ^ dw, CamelliaSubkeyL(13) = dw;
- dw = CamelliaSubkeyL(14) ^ CamelliaSubkeyR(14), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(14) = CamelliaSubkeyL(14) ^ dw, CamelliaSubkeyL(14) = dw;
- dw = CamelliaSubkeyL(15) ^ CamelliaSubkeyR(15), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(15) = CamelliaSubkeyL(15) ^ dw, CamelliaSubkeyL(15) = dw;
- dw = CamelliaSubkeyL(18) ^ CamelliaSubkeyR(18), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(18) = CamelliaSubkeyL(18) ^ dw, CamelliaSubkeyL(18) = dw;
- dw = CamelliaSubkeyL(19) ^ CamelliaSubkeyR(19), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(19) = CamelliaSubkeyL(19) ^ dw, CamelliaSubkeyL(19) = dw;
- dw = CamelliaSubkeyL(20) ^ CamelliaSubkeyR(20), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(20) = CamelliaSubkeyL(20) ^ dw, CamelliaSubkeyL(20) = dw;
- dw = CamelliaSubkeyL(21) ^ CamelliaSubkeyR(21), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(21) = CamelliaSubkeyL(21) ^ dw, CamelliaSubkeyL(21) = dw;
- dw = CamelliaSubkeyL(22) ^ CamelliaSubkeyR(22), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(22) = CamelliaSubkeyL(22) ^ dw, CamelliaSubkeyL(22) = dw;
- dw = CamelliaSubkeyL(23) ^ CamelliaSubkeyR(23), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(23) = CamelliaSubkeyL(23) ^ dw, CamelliaSubkeyL(23) = dw;
- dw = CamelliaSubkeyL(26) ^ CamelliaSubkeyR(26), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(26) = CamelliaSubkeyL(26) ^ dw, CamelliaSubkeyL(26) = dw;
- dw = CamelliaSubkeyL(27) ^ CamelliaSubkeyR(27), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(27) = CamelliaSubkeyL(27) ^ dw, CamelliaSubkeyL(27) = dw;
- dw = CamelliaSubkeyL(28) ^ CamelliaSubkeyR(28), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(28) = CamelliaSubkeyL(28) ^ dw, CamelliaSubkeyL(28) = dw;
- dw = CamelliaSubkeyL(29) ^ CamelliaSubkeyR(29), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(29) = CamelliaSubkeyL(29) ^ dw, CamelliaSubkeyL(29) = dw;
- dw = CamelliaSubkeyL(30) ^ CamelliaSubkeyR(30), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(30) = CamelliaSubkeyL(30) ^ dw, CamelliaSubkeyL(30) = dw;
- dw = CamelliaSubkeyL(31) ^ CamelliaSubkeyR(31), dw = CAMELLIA_RL8(dw);
- CamelliaSubkeyR(31) = CamelliaSubkeyL(31) ^ dw,CamelliaSubkeyL(31) = dw;
-
- WC_FREE_VAR_EX(subL, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- WC_FREE_VAR_EX(subR, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- return 0;
-}
-
-static int camellia_setup192(const unsigned char *key, u32 *subkey)
-{
- unsigned char kk[32];
- u32 krll = 0, krlr = 0, krrl = 0, krrr = 0;
-
- XMEMCPY(kk, key, 24);
- XMEMCPY((unsigned char *)&krll, key+16,4);
- XMEMCPY((unsigned char *)&krlr, key+20,4);
- krrl = ~krll;
- krrr = ~krlr;
- XMEMCPY(kk+24, (unsigned char *)&krrl, 4);
- XMEMCPY(kk+28, (unsigned char *)&krrr, 4);
-
- return camellia_setup256(kk, subkey);
-}
-
-
-/**
- * Stuff related to camellia encryption/decryption
- *
- * "io" must be 4byte aligned and big-endian data.
- */
-static void camellia_encrypt128(const u32 *subkey, u32 *io)
-{
- u32 il, ir, t0, t1;
-
- /* pre whitening but absorb kw2*/
- io[0] ^= CamelliaSubkeyL(0);
- io[1] ^= CamelliaSubkeyR(0);
- /* main iteration */
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(2),CamelliaSubkeyR(2),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(3),CamelliaSubkeyR(3),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(4),CamelliaSubkeyR(4),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(5),CamelliaSubkeyR(5),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(6),CamelliaSubkeyR(6),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(7),CamelliaSubkeyR(7),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(8),CamelliaSubkeyR(8),
- CamelliaSubkeyL(9),CamelliaSubkeyR(9),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(10),CamelliaSubkeyR(10),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(11),CamelliaSubkeyR(11),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(12),CamelliaSubkeyR(12),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(13),CamelliaSubkeyR(13),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(14),CamelliaSubkeyR(14),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(15),CamelliaSubkeyR(15),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(16),CamelliaSubkeyR(16),
- CamelliaSubkeyL(17),CamelliaSubkeyR(17),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(18),CamelliaSubkeyR(18),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(19),CamelliaSubkeyR(19),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(20),CamelliaSubkeyR(20),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(21),CamelliaSubkeyR(21),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(22),CamelliaSubkeyR(22),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(23),CamelliaSubkeyR(23),
- io[0],io[1],il,ir,t0,t1);
-
- /* post whitening but kw4 */
- io[2] ^= CamelliaSubkeyL(24);
- io[3] ^= CamelliaSubkeyR(24);
-
- t0 = io[0];
- t1 = io[1];
- io[0] = io[2];
- io[1] = io[3];
- io[2] = t0;
- io[3] = t1;
-
- return;
-}
-
-static void camellia_decrypt128(const u32 *subkey, u32 *io)
-{
- u32 il,ir,t0,t1; /* temporary variables */
-
- /* pre whitening but absorb kw2*/
- io[0] ^= CamelliaSubkeyL(24);
- io[1] ^= CamelliaSubkeyR(24);
-
- /* main iteration */
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(23),CamelliaSubkeyR(23),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(22),CamelliaSubkeyR(22),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(21),CamelliaSubkeyR(21),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(20),CamelliaSubkeyR(20),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(19),CamelliaSubkeyR(19),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(18),CamelliaSubkeyR(18),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(17),CamelliaSubkeyR(17),
- CamelliaSubkeyL(16),CamelliaSubkeyR(16),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(15),CamelliaSubkeyR(15),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(14),CamelliaSubkeyR(14),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(13),CamelliaSubkeyR(13),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(12),CamelliaSubkeyR(12),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(11),CamelliaSubkeyR(11),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(10),CamelliaSubkeyR(10),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(9),CamelliaSubkeyR(9),
- CamelliaSubkeyL(8),CamelliaSubkeyR(8),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(7),CamelliaSubkeyR(7),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(6),CamelliaSubkeyR(6),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(5),CamelliaSubkeyR(5),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(4),CamelliaSubkeyR(4),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(3),CamelliaSubkeyR(3),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(2),CamelliaSubkeyR(2),
- io[0],io[1],il,ir,t0,t1);
-
- /* post whitening but kw4 */
- io[2] ^= CamelliaSubkeyL(0);
- io[3] ^= CamelliaSubkeyR(0);
-
- t0 = io[0];
- t1 = io[1];
- io[0] = io[2];
- io[1] = io[3];
- io[2] = t0;
- io[3] = t1;
-
- return;
-}
-
-/**
- * stuff for 192 and 256bit encryption/decryption
- */
-static void camellia_encrypt256(const u32 *subkey, u32 *io)
-{
- u32 il,ir,t0,t1; /* temporary variables */
-
- /* pre whitening but absorb kw2*/
- io[0] ^= CamelliaSubkeyL(0);
- io[1] ^= CamelliaSubkeyR(0);
-
- /* main iteration */
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(2),CamelliaSubkeyR(2),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(3),CamelliaSubkeyR(3),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(4),CamelliaSubkeyR(4),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(5),CamelliaSubkeyR(5),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(6),CamelliaSubkeyR(6),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(7),CamelliaSubkeyR(7),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(8),CamelliaSubkeyR(8),
- CamelliaSubkeyL(9),CamelliaSubkeyR(9),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(10),CamelliaSubkeyR(10),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(11),CamelliaSubkeyR(11),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(12),CamelliaSubkeyR(12),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(13),CamelliaSubkeyR(13),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(14),CamelliaSubkeyR(14),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(15),CamelliaSubkeyR(15),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(16),CamelliaSubkeyR(16),
- CamelliaSubkeyL(17),CamelliaSubkeyR(17),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(18),CamelliaSubkeyR(18),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(19),CamelliaSubkeyR(19),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(20),CamelliaSubkeyR(20),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(21),CamelliaSubkeyR(21),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(22),CamelliaSubkeyR(22),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(23),CamelliaSubkeyR(23),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(24),CamelliaSubkeyR(24),
- CamelliaSubkeyL(25),CamelliaSubkeyR(25),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(26),CamelliaSubkeyR(26),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(27),CamelliaSubkeyR(27),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(28),CamelliaSubkeyR(28),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(29),CamelliaSubkeyR(29),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(30),CamelliaSubkeyR(30),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(31),CamelliaSubkeyR(31),
- io[0],io[1],il,ir,t0,t1);
-
- /* post whitening but kw4 */
- io[2] ^= CamelliaSubkeyL(32);
- io[3] ^= CamelliaSubkeyR(32);
-
- t0 = io[0];
- t1 = io[1];
- io[0] = io[2];
- io[1] = io[3];
- io[2] = t0;
- io[3] = t1;
-
- return;
-}
-
-static void camellia_decrypt256(const u32 *subkey, u32 *io)
-{
- u32 il,ir,t0,t1; /* temporary variables */
-
- /* pre whitening but absorb kw2*/
- io[0] ^= CamelliaSubkeyL(32);
- io[1] ^= CamelliaSubkeyR(32);
-
- /* main iteration */
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(31),CamelliaSubkeyR(31),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(30),CamelliaSubkeyR(30),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(29),CamelliaSubkeyR(29),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(28),CamelliaSubkeyR(28),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(27),CamelliaSubkeyR(27),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(26),CamelliaSubkeyR(26),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(25),CamelliaSubkeyR(25),
- CamelliaSubkeyL(24),CamelliaSubkeyR(24),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(23),CamelliaSubkeyR(23),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(22),CamelliaSubkeyR(22),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(21),CamelliaSubkeyR(21),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(20),CamelliaSubkeyR(20),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(19),CamelliaSubkeyR(19),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(18),CamelliaSubkeyR(18),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(17),CamelliaSubkeyR(17),
- CamelliaSubkeyL(16),CamelliaSubkeyR(16),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(15),CamelliaSubkeyR(15),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(14),CamelliaSubkeyR(14),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(13),CamelliaSubkeyR(13),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(12),CamelliaSubkeyR(12),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(11),CamelliaSubkeyR(11),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(10),CamelliaSubkeyR(10),
- io[0],io[1],il,ir,t0,t1);
-
- CAMELLIA_FLS(io[0],io[1],io[2],io[3],
- CamelliaSubkeyL(9),CamelliaSubkeyR(9),
- CamelliaSubkeyL(8),CamelliaSubkeyR(8),
- t0,t1,il,ir);
-
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(7),CamelliaSubkeyR(7),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(6),CamelliaSubkeyR(6),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(5),CamelliaSubkeyR(5),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(4),CamelliaSubkeyR(4),
- io[0],io[1],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[0],io[1],
- CamelliaSubkeyL(3),CamelliaSubkeyR(3),
- io[2],io[3],il,ir,t0,t1);
- CAMELLIA_ROUNDSM(io[2],io[3],
- CamelliaSubkeyL(2),CamelliaSubkeyR(2),
- io[0],io[1],il,ir,t0,t1);
-
- /* post whitening but kw4 */
- io[2] ^= CamelliaSubkeyL(0);
- io[3] ^= CamelliaSubkeyR(0);
-
- t0 = io[0];
- t1 = io[1];
- io[0] = io[2];
- io[1] = io[3];
- io[2] = t0;
- io[3] = t1;
-
- return;
-}
-
-/***
- *
- * API for compatibility
- */
-
-static void Camellia_EncryptBlock(const word32 keyBitLength,
- const unsigned char *plaintext,
- const WC_CAMELLIA_KEY_TABLE_TYPE keyTable,
- unsigned char *ciphertext)
-{
- u32 tmp[4];
-
- tmp[0] = GETU32(plaintext);
- tmp[1] = GETU32(plaintext + 4);
- tmp[2] = GETU32(plaintext + 8);
- tmp[3] = GETU32(plaintext + 12);
-
- switch (keyBitLength) {
- case 128:
- camellia_encrypt128(keyTable, tmp);
- break;
- case 192:
- /* fall through */
- case 256:
- camellia_encrypt256(keyTable, tmp);
- break;
- default:
- break;
- }
-
- PUTU32(ciphertext, tmp[0]);
- PUTU32(ciphertext + 4, tmp[1]);
- PUTU32(ciphertext + 8, tmp[2]);
- PUTU32(ciphertext + 12, tmp[3]);
-}
-
-static void Camellia_DecryptBlock(const word32 keyBitLength,
- const unsigned char *ciphertext,
- const WC_CAMELLIA_KEY_TABLE_TYPE keyTable,
- unsigned char *plaintext)
-{
- u32 tmp[4];
-
- tmp[0] = GETU32(ciphertext);
- tmp[1] = GETU32(ciphertext + 4);
- tmp[2] = GETU32(ciphertext + 8);
- tmp[3] = GETU32(ciphertext + 12);
-
- switch (keyBitLength) {
- case 128:
- camellia_decrypt128(keyTable, tmp);
- break;
- case 192:
- /* fall through */
- case 256:
- camellia_decrypt256(keyTable, tmp);
- break;
- default:
- break;
- }
- PUTU32(plaintext, tmp[0]);
- PUTU32(plaintext + 4, tmp[1]);
- PUTU32(plaintext + 8, tmp[2]);
- PUTU32(plaintext + 12, tmp[3]);
-}
-
-
-
-/* wolfCrypt wrappers to the Camellia code */
-
-int wc_CamelliaSetKey(wc_Camellia* cam, const byte* key, word32 len, const byte* iv)
-{
- int ret = 0;
-
- if (cam == NULL) return BAD_FUNC_ARG;
-
- XMEMSET(cam->key, 0, WC_CAMELLIA_TABLE_BYTE_LEN);
-
- switch (len) {
- case 16:
- ret = camellia_setup128(key, cam->key);
- break;
- case 24:
- ret = camellia_setup192(key, cam->key);
- break;
- case 32:
- ret = camellia_setup256(key, cam->key);
- break;
- default:
- ret = BAD_FUNC_ARG;
- }
-
- if (ret != 0)
- return ret;
-
- cam->keySz = len * 8;
-
- return wc_CamelliaSetIV(cam, iv);
-}
-
-
-int wc_CamelliaSetIV(wc_Camellia* cam, const byte* iv)
-{
- if (cam == NULL)
- return BAD_FUNC_ARG;
-
- if (iv)
- XMEMCPY(cam->reg, iv, WC_CAMELLIA_BLOCK_SIZE);
- else
- XMEMSET(cam->reg, 0, WC_CAMELLIA_BLOCK_SIZE);
-
- return 0;
-}
-
-
-int wc_CamelliaEncryptDirect(wc_Camellia* cam, byte* out, const byte* in)
-{
- if (cam == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
- Camellia_EncryptBlock(cam->keySz, in, cam->key, out);
-
- return 0;
-}
-
-
-int wc_CamelliaDecryptDirect(wc_Camellia* cam, byte* out, const byte* in)
-{
- if (cam == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
- Camellia_DecryptBlock(cam->keySz, in, cam->key, out);
-
- return 0;
-}
-
-
-int wc_CamelliaCbcEncrypt(wc_Camellia* cam, byte* out, const byte* in, word32 sz)
-{
- word32 blocks;
- if (cam == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
- blocks = sz / WC_CAMELLIA_BLOCK_SIZE;
-
- while (blocks--) {
- xorbuf((byte*)cam->reg, in, WC_CAMELLIA_BLOCK_SIZE);
- Camellia_EncryptBlock(cam->keySz, (byte*)cam->reg,
- cam->key, (byte*)cam->reg);
- XMEMCPY(out, cam->reg, WC_CAMELLIA_BLOCK_SIZE);
-
- out += WC_CAMELLIA_BLOCK_SIZE;
- in += WC_CAMELLIA_BLOCK_SIZE;
- }
-
- return 0;
-}
-
-
-int wc_CamelliaCbcDecrypt(wc_Camellia* cam, byte* out, const byte* in, word32 sz)
-{
- word32 blocks;
- if (cam == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
- blocks = sz / WC_CAMELLIA_BLOCK_SIZE;
-
- while (blocks--) {
- XMEMCPY(cam->tmp, in, WC_CAMELLIA_BLOCK_SIZE);
- Camellia_DecryptBlock(cam->keySz, (byte*)cam->tmp, cam->key, out);
- xorbuf(out, (byte*)cam->reg, WC_CAMELLIA_BLOCK_SIZE);
- XMEMCPY(cam->reg, cam->tmp, WC_CAMELLIA_BLOCK_SIZE);
-
- out += WC_CAMELLIA_BLOCK_SIZE;
- in += WC_CAMELLIA_BLOCK_SIZE;
- }
-
- return 0;
-}
-
-
-#endif /* HAVE_CAMELLIA */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/cmac.c b/src/ssl/wolfssl/wolfcrypt/cmac.c
deleted file mode 100644
index 0d46054e2..000000000
--- a/src/ssl/wolfssl/wolfcrypt/cmac.c
+++ /dev/null
@@ -1,536 +0,0 @@
-/* cmac.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef WOLFSSL_QNX_CAAM
-#include
-#endif
-#if defined(WOLFSSL_HASH_KEEP)
-#include
-#endif
-
-#if defined(WOLFSSL_CMAC)
-
-#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
- /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
- #define FIPS_NO_WRAPPERS
-
- #ifdef USE_WINDOWS_API
- #pragma code_seg(".fipsA$c")
- #pragma const_seg(".fipsB$c")
- #endif
-#endif
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#include
-#include
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#if FIPS_VERSION3_GE(6,0,0)
- const unsigned int wolfCrypt_FIPS_cmac_ro_sanity[2] =
- { 0x1a2b3c4d, 0x00000003 };
- int wolfCrypt_FIPS_CMAC_sanity(void)
- {
- return 0;
- }
-#endif
-
-#ifdef WOLFSSL_HASH_KEEP
-/* Some hardware have issues with update, this function stores the data to be
- * hashed into an array. Once ready, the Final operation is called on all of the
- * data to be hashed at once.
- * returns 0 on success
- */
-int wc_CMAC_Grow(Cmac* cmac, const byte* in, int inSz)
-{
- return _wc_Hash_Grow(&cmac->msg, &cmac->used, &cmac->len, in, inSz, NULL);
-}
-#endif /* WOLFSSL_HASH_KEEP */
-
-#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
-/* Used by AES-SIV. See aes.c. */
-void ShiftAndXorRb(byte* out, byte* in)
-{
- int i, j, xorRb;
- int mask = 0, last = 0;
- byte Rb = 0x87;
-
- xorRb = (in[0] & 0x80) != 0;
-
- for (i = 1, j = WC_AES_BLOCK_SIZE - 1; i <= WC_AES_BLOCK_SIZE; i++, j--) {
- last = (in[j] & 0x80) ? 1 : 0;
- out[j] = (byte)((in[j] << 1) | mask);
- mask = last;
- if (xorRb) {
- out[j] ^= Rb;
- Rb = 0;
- }
- }
-}
-#endif /* !NO_AES && WOLFSSL_AES_DIRECT */
-
-/* returns 0 on success */
-int wc_InitCmac_ex(Cmac* cmac, const byte* key, word32 keySz,
- int type, void* unused, void* heap, int devId)
-{
- int ret = 0;
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- byte useSW = 0;
-#endif
-
- (void)unused;
- (void)heap;
-
- if (cmac == NULL || type != WC_CMAC_AES) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- /* save if we should use SW crypt, restore after memset */
- useSW = cmac->useSWCrypt;
-#endif
- XMEMSET(cmac, 0, sizeof(Cmac));
-
-#ifdef WOLF_CRYPTO_CB
- /* Set devId regardless of value (invalid or not) */
- cmac->devId = devId;
- #ifndef WOLF_CRYPTO_CB_FIND
- if (devId != INVALID_DEVID)
- #endif
- {
- cmac->devCtx = NULL;
-
- ret = wc_CryptoCb_Cmac(cmac, key, keySz, NULL, 0, NULL, NULL,
- type, unused);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- /* fall-through when unavailable */
- }
-#else
- (void)devId;
-#endif
-
- if (key == NULL || keySz == 0) {
- return BAD_FUNC_ARG;
- }
-
- switch (type) {
-#if !defined (NO_AES) && defined(WOLFSSL_AES_DIRECT)
- case WC_CMAC_AES:
- cmac->type = WC_CMAC_AES;
- ret = wc_AesInit(&cmac->aes, heap, devId);
-
- #if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)
- cmac->useSWCrypt = useSW;
- if (cmac->useSWCrypt == 1) {
- cmac->aes.useSWCrypt = 1;
- }
- #endif
-
- if (ret == 0) {
- ret = wc_AesSetKey(&cmac->aes, key, keySz, NULL, AES_ENCRYPTION);
- }
-
- if (ret == 0) {
- byte l[WC_AES_BLOCK_SIZE];
-
- XMEMSET(l, 0, WC_AES_BLOCK_SIZE);
- ret = wc_AesEncryptDirect(&cmac->aes, l, l);
- if (ret == 0) {
- ShiftAndXorRb(cmac->k1, l);
- ShiftAndXorRb(cmac->k2, cmac->k1);
- ForceZero(l, WC_AES_BLOCK_SIZE);
- }
- }
- break;
-#endif /* !NO_AES && WOLFSSL_AES_DIRECT */
- default:
- return BAD_FUNC_ARG;
- }
-
- return ret;
-}
-
-
-int wc_InitCmac(Cmac* cmac, const byte* key, word32 keySz,
- int type, void* unused)
-{
-#ifdef WOLFSSL_QNX_CAAM
- int devId = WOLFSSL_CAAM_DEVID;
-#else
- int devId = INVALID_DEVID;
-#endif
- return wc_InitCmac_ex(cmac, key, keySz, type, unused, NULL, devId);
-}
-
-
-
-int wc_CmacUpdate(Cmac* cmac, const byte* in, word32 inSz)
-{
- int ret = 0;
-
- if ((cmac == NULL) || (in == NULL && inSz != 0)) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (cmac->devId != INVALID_DEVID)
- #endif
- {
- ret = wc_CryptoCb_Cmac(cmac, NULL, 0, in, inSz,
- NULL, NULL, (int)cmac->type, NULL);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- /* fall-through when unavailable */
- }
-#endif
-
- /* Clear CRYPTOCB_UNAVAILABLE return code */
- ret = 0;
-
- switch (cmac->type) {
-#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
- case WC_CMAC_AES:
- {
- while ((ret == 0) && (inSz != 0)) {
- word32 add = min(inSz, WC_AES_BLOCK_SIZE - cmac->bufferSz);
- XMEMCPY(&cmac->buffer[cmac->bufferSz], in, add);
-
- cmac->bufferSz += add;
- in += add;
- inSz -= add;
-
- if (cmac->bufferSz == WC_AES_BLOCK_SIZE && inSz != 0) {
- if (cmac->totalSz != 0) {
- xorbuf(cmac->buffer, cmac->digest, WC_AES_BLOCK_SIZE);
- }
- ret = wc_AesEncryptDirect(&cmac->aes, cmac->digest,
- cmac->buffer);
- if (ret == 0) {
- cmac->totalSz += WC_AES_BLOCK_SIZE;
- cmac->bufferSz = 0;
- }
- }
- }
- }; break;
-#endif /* !NO_AES && WOLFSSL_AES_DIRECT */
- default:
- ret = BAD_FUNC_ARG;
- }
- return ret;
-}
-
-int wc_CmacFree(Cmac* cmac)
-{
- if (cmac == NULL)
- return BAD_FUNC_ARG;
-#if defined(WOLFSSL_HASH_KEEP)
- /* TODO: msg is leaked if wc_CmacFinal() is not called
- * e.g. when multiple calls to wc_CmacUpdate() and one fails but
- * wc_CmacFinal() not called. */
- XFREE(cmac->msg, cmac->heap, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
- switch (cmac->type) {
-#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
- case WC_CMAC_AES:
- wc_AesFree(&cmac->aes);
- break;
-#endif /* !NO_AES && WOLFSSL_AES_DIRECT */
- default:
- /* Nothing to do */
- (void)cmac;
- }
- ForceZero(cmac, sizeof(Cmac));
- return 0;
-}
-
-int wc_CmacFinalNoFree(Cmac* cmac, byte* out, word32* outSz)
-{
- int ret = 0;
-
- if (cmac == NULL || out == NULL || outSz == NULL) {
- return BAD_FUNC_ARG;
- }
- if (*outSz < WC_CMAC_TAG_MIN_SZ || *outSz > WC_CMAC_TAG_MAX_SZ) {
- return BUFFER_E;
- }
-
-#ifdef WOLF_CRYPTO_CB
- #ifndef WOLF_CRYPTO_CB_FIND
- if (cmac->devId != INVALID_DEVID)
- #endif
- {
- ret = wc_CryptoCb_Cmac(cmac, NULL, 0, NULL, 0, out, outSz,
- (int)cmac->type, NULL);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
-
- /* Clear CRYPTOCB_UNAVAILABLE return code */
- ret = 0;
-
- /* fall-through when unavailable */
- }
-#endif
- if (ret == 0) {
- switch (cmac->type) {
- #if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
- case WC_CMAC_AES:
- {
- const byte* subKey;
- word32 remainder;
-
- if (cmac->bufferSz == WC_AES_BLOCK_SIZE) {
- subKey = cmac->k1;
- }
- else {
- /* ensure we will have a valid remainder value */
- if (cmac->bufferSz > WC_AES_BLOCK_SIZE) {
- ret = BAD_STATE_E;
- break;
- }
- remainder = WC_AES_BLOCK_SIZE - cmac->bufferSz;
-
- if (remainder == 0) {
- remainder = WC_AES_BLOCK_SIZE;
- }
- if (remainder > 1) {
- XMEMSET(cmac->buffer + WC_AES_BLOCK_SIZE - remainder, 0,
- remainder);
- }
-
- cmac->buffer[WC_AES_BLOCK_SIZE - remainder] = 0x80;
- subKey = cmac->k2;
- }
- xorbuf(cmac->buffer, cmac->digest, WC_AES_BLOCK_SIZE);
- xorbuf(cmac->buffer, subKey, WC_AES_BLOCK_SIZE);
- ret = wc_AesEncryptDirect(&cmac->aes, cmac->digest, cmac->buffer);
- if (ret == 0) {
- XMEMCPY(out, cmac->digest, *outSz);
- }
- }; break;
- #endif /* !NO_AES && WOLFSSL_AES_DIRECT */
- default:
- ret = BAD_FUNC_ARG;
- }
- }
- return ret;
-}
-
-int wc_CmacFinal(Cmac* cmac, byte* out, word32* outSz)
-{
- int ret = 0;
-
- if (cmac == NULL)
- return BAD_FUNC_ARG;
- ret = wc_CmacFinalNoFree(cmac, out, outSz);
- (void)wc_CmacFree(cmac);
- return ret;
-}
-
-#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
-int wc_AesCmacGenerate_ex(Cmac* cmac,
- byte* out, word32* outSz,
- const byte* in, word32 inSz,
- const byte* key, word32 keySz,
- void* heap, int devId)
-{
- int ret = 0;
-
- if (cmac == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLF_CRYPTO_CB
- /* Set devId regardless of value (invalid or not) */
- cmac->devId = devId;
- #ifndef WOLF_CRYPTO_CB_FIND
- if (devId != INVALID_DEVID)
- #endif
- {
- ret = wc_CryptoCb_Cmac(cmac, key, keySz, in, inSz, out, outSz,
- WC_CMAC_AES, NULL);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
-
- /* Clear CRYPTOCB_UNAVAILABLE return code */
- ret = 0;
-
- /* fall-through when unavailable */
- }
-#endif
-
- if ( ((out == NULL) && (outSz != NULL) && (*outSz > 0))
- || (in == NULL && inSz > 0)
- || (key == NULL && keySz > 0)) {
- return BAD_FUNC_ARG;
- }
-
- /* Init step is optional */
- if (key != NULL) {
- ret = wc_InitCmac_ex(cmac, key, keySz, WC_CMAC_AES, NULL, heap, devId);
- }
- if (ret == 0) {
- ret = wc_CmacUpdate(cmac, in, inSz);
- /* Ensure we are freed and zeroed if not calling wc_CmacFinal */
- if (ret != 0) {
- (void)wc_CmacFree(cmac);
- }
- }
- if (ret == 0) {
- ret = wc_CmacFinal(cmac, out, outSz);
- }
-
- return ret;
-}
-
-
-int wc_AesCmacGenerate(byte* out, word32* outSz,
- const byte* in, word32 inSz,
- const byte* key, word32 keySz)
-{
- int ret = 0;
- WC_DECLARE_VAR(cmac, Cmac, 1, 0);
-
- if (out == NULL || (in == NULL && inSz > 0) || key == NULL || keySz == 0) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- if ((cmac = (Cmac *)XMALLOC(sizeof *cmac, NULL,
- DYNAMIC_TYPE_CMAC)) == NULL) {
- return MEMORY_E;
- }
-#endif
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- XMEMSET(((unsigned char *)cmac) + sizeof(Aes), 0xff,
- sizeof(Cmac) - sizeof(Aes));
- /* Aes part is checked by wc_AesFree. */
- wc_MemZero_Add("wc_AesCmacGenerate_ex cmac",
- ((unsigned char *)cmac) + sizeof(Aes), sizeof(Cmac) - sizeof(Aes));
-#endif
-
- ret = wc_AesCmacGenerate_ex(cmac,
- out, outSz,
- in, inSz,
- key, keySz,
- NULL,
- INVALID_DEVID);
-
-
-#ifdef WOLFSSL_SMALL_STACK
- XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- wc_MemZero_Check(cmac, sizeof(Cmac));
-#endif
-
- return ret;
-}
-
-
-int wc_AesCmacVerify_ex(Cmac* cmac,
- const byte* check, word32 checkSz,
- const byte* in, word32 inSz,
- const byte* key, word32 keySz,
- void* heap, int devId)
-{
- int ret = 0;
- byte a[WC_AES_BLOCK_SIZE];
- word32 aSz = sizeof(a);
- int compareRet;
-
- if (cmac == NULL || check == NULL || checkSz == 0 ||
- (in == NULL && inSz != 0)) {
- return BAD_FUNC_ARG;
- }
-
- XMEMSET(a, 0, aSz);
- ret = wc_AesCmacGenerate_ex(cmac,
- a, &aSz,
- in, inSz,
- key, keySz,
- heap,
- devId);
- if (ret == 0) {
- compareRet = ConstantCompare(check, a, (int)min(checkSz, aSz));
- ret = compareRet ? 1 : 0;
- }
-
- return ret;
-}
-
-
-int wc_AesCmacVerify(const byte* check, word32 checkSz,
- const byte* in, word32 inSz,
- const byte* key, word32 keySz)
-{
- int ret = 0;
- WC_DECLARE_VAR(cmac, Cmac, 1, 0);
-
- if (check == NULL || checkSz == 0 || (in == NULL && inSz > 0) ||
- key == NULL || keySz == 0) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_SMALL_STACK
- if ((cmac = (Cmac *)XMALLOC(sizeof *cmac, NULL,
- DYNAMIC_TYPE_CMAC)) == NULL) {
- return MEMORY_E;
- }
-#endif
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- XMEMSET(((unsigned char *)cmac) + sizeof(Aes), 0xff,
- sizeof(Cmac) - sizeof(Aes));
- /* Aes part is checked by wc_AesFree. */
- wc_MemZero_Add("wc_AesCmacGenerate_ex cmac",
- ((unsigned char *)cmac) + sizeof(Aes), sizeof(Cmac) - sizeof(Aes));
-#endif
-
- ret = wc_AesCmacVerify_ex(cmac,
- check, checkSz,
- in, inSz,
- key, keySz,
- NULL,
- INVALID_DEVID);
-
-#ifdef WOLFSSL_SMALL_STACK
- XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- wc_MemZero_Check(cmac, sizeof(Cmac));
-#endif
-
- return ret;
-}
-#endif /* !NO_AES && WOLFSSL_AES_DIRECT */
-
-#endif /* WOLFSSL_CMAC */
diff --git a/src/ssl/wolfssl/wolfcrypt/compress.c b/src/ssl/wolfssl/wolfcrypt/compress.c
deleted file mode 100644
index f2e8b3e6d..000000000
--- a/src/ssl/wolfssl/wolfcrypt/compress.c
+++ /dev/null
@@ -1,312 +0,0 @@
-/* compress.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifdef HAVE_LIBZ
-
-
-#include
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#include
-
-
-/* alloc user allocs to work with zlib */
-static void* myAlloc(void* opaque, unsigned int item, unsigned int size)
-{
- (void)opaque;
- return (void *)XMALLOC(item * size, opaque, DYNAMIC_TYPE_LIBZ);
-}
-
-
-static void myFree(void* opaque, void* memory)
-{
- (void)opaque;
- XFREE(memory, opaque, DYNAMIC_TYPE_LIBZ);
-}
-
-
-#ifdef HAVE_MCAPI
- #define DEFLATE_DEFAULT_WINDOWBITS 11
- #define DEFLATE_DEFAULT_MEMLEVEL 1
-#else
- #define DEFLATE_DEFAULT_WINDOWBITS 15
- #define DEFLATE_DEFAULT_MEMLEVEL 8
-#endif
-
-
-/*
- * out - pointer to destination buffer
- * outSz - size of destination buffer
- * in - pointer to source buffer to compress
- * inSz - size of source to compress
- * flags - flags to control how compress operates
- *
- * return:
- * negative - error code
- * positive - bytes stored in out buffer
- *
- * Note, the output buffer still needs to be larger than the input buffer.
- * The right chunk of data won't compress at all, and the lookup table will
- * add to the size of the output. The libz code says the compressed
- * buffer should be srcSz + 0.1% + 12.
- */
-int wc_Compress_ex(byte* out, word32 outSz, const byte* in, word32 inSz,
- word32 flags, word32 windowBits)
-{
- z_stream stream;
- int result = 0;
-
- stream.next_in = (Bytef*)in;
- stream.avail_in = (uInt)inSz;
-#ifdef MAXSEG_64K
- /* Check for source > 64K on 16-bit machine: */
- if ((uLong)stream.avail_in != inSz) return COMPRESS_INIT_E;
-#endif
- stream.next_out = out;
- stream.avail_out = (uInt)outSz;
- if ((uLong)stream.avail_out != outSz) return COMPRESS_INIT_E;
-
- stream.zalloc = (alloc_func)myAlloc;
- stream.zfree = (free_func)myFree;
- stream.opaque = (voidpf)0;
-
- if (deflateInit2(&stream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
- DEFLATE_DEFAULT_WINDOWBITS | windowBits,
- DEFLATE_DEFAULT_MEMLEVEL,
- flags ? Z_FIXED : Z_DEFAULT_STRATEGY) != Z_OK)
- return COMPRESS_INIT_E;
-
- if (deflate(&stream, Z_FINISH) != Z_STREAM_END) {
- deflateEnd(&stream);
- return COMPRESS_E;
- }
-
- result = (int)stream.total_out;
-
- if (deflateEnd(&stream) != Z_OK)
- result = COMPRESS_E;
-
- return result;
-}
-
-int wc_Compress(byte* out, word32 outSz, const byte* in, word32 inSz, word32 flags)
-{
- return wc_Compress_ex(out, outSz, in, inSz, flags, 0);
-}
-
-
-/* windowBits:
-* deflateInit() and inflateInit(), as well as deflateInit2() and inflateInit2()
- with windowBits in 0..15 all process zlib-wrapped deflate data.
- (See RFC 1950 and RFC 1951.)
-* deflateInit2() and inflateInit2() with negative windowBits in -1..-15 process
- raw deflate data with no header or trailer.
-* deflateInit2() and inflateInit2() with windowBits in 16..31, i.e. 16
- added to 0..15, process gzip-wrapped deflate data (RFC 1952).
-* inflateInit2() with windowBits in 32..47 (32 added to 0..15) will
- automatically detect either a gzip or zlib header (but not raw deflate
- data), and decompress accordingly.
-*/
-int wc_DeCompress_ex(byte* out, word32 outSz, const byte* in, word32 inSz,
- int windowBits)
-/*
- * out - pointer to destination buffer
- * outSz - size of destination buffer
- * in - pointer to source buffer to compress
- * inSz - size of source to compress
- * windowBits - flags to control how decompress operates
- *
- * return:
- * negative - error code
- * positive - bytes stored in out buffer
- */
-{
- z_stream stream;
- int result = 0;
-
- stream.next_in = (Bytef*)in;
- stream.avail_in = (uInt)inSz;
- /* Check for source > 64K on 16-bit machine: */
- if ((uLong)stream.avail_in != inSz) return DECOMPRESS_INIT_E;
-
- stream.next_out = out;
- stream.avail_out = (uInt)outSz;
- if ((uLong)stream.avail_out != outSz) return DECOMPRESS_INIT_E;
-
- stream.zalloc = (alloc_func)myAlloc;
- stream.zfree = (free_func)myFree;
- stream.opaque = (voidpf)0;
-
- if (inflateInit2(&stream, DEFLATE_DEFAULT_WINDOWBITS | windowBits) != Z_OK)
- return DECOMPRESS_INIT_E;
-
- result = inflate(&stream, Z_FINISH);
- if (result != Z_STREAM_END) {
- inflateEnd(&stream);
- return DECOMPRESS_E;
- }
-
- result = (int)stream.total_out;
-
- if (inflateEnd(&stream) != Z_OK)
- result = DECOMPRESS_E;
-
- return result;
-}
-
-
-int wc_DeCompress(byte* out, word32 outSz, const byte* in, word32 inSz)
-{
- return wc_DeCompress_ex(out, outSz, in, inSz, 0);
-}
-
-
-/* Decompress the input buffer and create output buffer. Free'ing 'out' buffer
- * is the callers responsibility on successful return.
- *
- * out gets set to the output buffer created, *out gets overwritten
- * maxSz is the max decompression multiplier, i.e if 2 then max out size created
- * would be 2*inSz, if set to -1 then there is no limit on out buffer size
- * memoryType the memory hint to use for 'out' i.e. DYNAMIC_TYPE_TMP_BUFFER
- * in compressed input buffer
- * inSz size of 'in' buffer
- * windowBits decompression behavior flag (can be 0)
- * heap hint to use when mallocing 'out' buffer
- *
- * return the decompressed size, creates and grows out buffer as needed
- */
-int wc_DeCompressDynamic(byte** out, int maxSz, int memoryType,
- const byte* in, word32 inSz, int windowBits, void* heap)
-{
- z_stream stream;
- int result = 0;
- int i;
- word32 tmpSz = 0;
- byte* tmp;
-
- (void)memoryType;
- (void)heap;
-
- if (out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
- i = (maxSz == 1)? 1 : 2; /* start with output buffer twice the size of input
- * unless max was set to 1 */
-
- stream.next_in = (Bytef*)in;
- stream.avail_in = (uInt)inSz;
- /* Check for source > 64K on 16-bit machine: */
- if ((uLong)stream.avail_in != inSz) return DECOMPRESS_INIT_E;
-
- tmpSz = inSz * i;
- tmp = (byte*)XMALLOC(tmpSz, heap, memoryType);
- if (tmp == NULL)
- return MEMORY_E;
-
- stream.next_out = tmp;
- stream.avail_out = (uInt)tmpSz;
- if ((uLong)stream.avail_out != tmpSz) return DECOMPRESS_INIT_E;
-
- stream.zalloc = (alloc_func)myAlloc;
- stream.zfree = (free_func)myFree;
- stream.opaque = (voidpf)0;
-
- if (inflateInit2(&stream, DEFLATE_DEFAULT_WINDOWBITS | windowBits) != Z_OK) {
- XFREE(tmp, heap, memoryType);
- return DECOMPRESS_INIT_E;
- }
-
- /*
- Wanted to use inflateGetHeader here for uncompressed size but
- structure gz_headerp does not contain the ISIZE from RFC1952
-
- gz_headerp header;
- inflateGetHeader(&stream, &header);
- */
-
- /* loop through doing the decompression block by block to get full size */
- do {
- result = inflate(&stream, Z_BLOCK);
- if (result == Z_STREAM_END) {
- /* hit end of decompression */
- break;
- }
-
- /* good chance output buffer ran out of space with Z_BUF_ERROR
- try increasing output buffer size */
- if (result == Z_BUF_ERROR) {
- word32 newSz;
- byte* newTmp;
-
- if (maxSz > 0 && i >= maxSz) {
- WOLFSSL_MSG("Hit max decompress size!");
- break;
- }
- i++;
-
- newSz = tmpSz + inSz;
- newTmp = (byte*)XMALLOC(newSz, heap, memoryType);
- if (newTmp == NULL) {
- WOLFSSL_MSG("Memory error with increasing buffer size");
- break;
- }
- XMEMCPY(newTmp, tmp, tmpSz);
- XFREE(tmp, heap, memoryType);
- tmp = newTmp;
- stream.next_out = tmp + stream.total_out;
- stream.avail_out = stream.avail_out + (uInt)inSz;
- tmpSz = newSz;
- result = inflate(&stream, Z_BLOCK);
- }
- } while (result == Z_OK);
-
- if (result == Z_STREAM_END) {
- result = (int)stream.total_out;
- *out = (byte*)XMALLOC(result, heap, memoryType);
- if (*out != NULL) {
- XMEMCPY(*out, tmp, result);
- }
- else {
- result = MEMORY_E;
- }
- }
- else {
- result = DECOMPRESS_E;
- }
-
- if (inflateEnd(&stream) != Z_OK)
- result = DECOMPRESS_E;
-
- XFREE(tmp, heap, memoryType);
- tmp = NULL;
-
- return result;
-}
-
-#endif /* HAVE_LIBZ */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/cpuid.c b/src/ssl/wolfssl/wolfcrypt/cpuid.c
deleted file mode 100644
index 5c3e333ff..000000000
--- a/src/ssl/wolfssl/wolfcrypt/cpuid.c
+++ /dev/null
@@ -1,411 +0,0 @@
-/* cpuid.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#include
-
-#if defined(HAVE_CPUID) || defined(HAVE_CPUID_INTEL) || \
- defined(HAVE_CPUID_AARCH64)
- static cpuid_flags_atomic_t cpuid_flags = WC_CPUID_ATOMIC_INITIALIZER;
-#endif
-
-#if defined(HAVE_CPUID_INTEL) && defined(WOLFSSL_SGX)
- /* @TODO calling cpuid from a trusted enclave needs additional hardening.
- * For initial benchmarking, the cpu support is getting hard set.
- * Another thing of note is cpuid calls cause a SIGILL signal, see
- * github issue #5 on intel/intel-sgx-ssl */
-
- /* For tying in an actual external call to cpuid this header and function
- * call would be used :
- * #include
- * #define cpuid(reg, leaf, sub) sgx_cpuidex((reg),(leaf),(sub))
- */
- void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
-
- new_cpuid_flags |= CPUID_AVX1;
- new_cpuid_flags |= CPUID_AVX2;
- new_cpuid_flags |= CPUID_BMI2;
- new_cpuid_flags |= CPUID_RDSEED;
- new_cpuid_flags |= CPUID_AESNI;
- new_cpuid_flags |= CPUID_ADX;
- new_cpuid_flags |= CPUID_MOVBE;
- new_cpuid_flags |= CPUID_BMI1;
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-
-#elif defined(HAVE_CPUID_INTEL)
- /* Each platform needs to query info type 1 from cpuid to see if aesni is
- * supported. Also, let's setup a macro for proper linkage w/o ABI conflicts
- */
-
- #ifndef _MSC_VER
- #define cpuid(reg, leaf, sub)\
- __asm__ __volatile__ ("cpuid":\
- "=a" ((reg)[0]), "=b" ((reg)[1]), "=c" ((reg)[2]), "=d" ((reg)[3]) :\
- "a" (leaf), "c"(sub));
- #else
- #include
-
- #define cpuid(a,b,c) __cpuidex((int*)a,b,c)
- #endif /* _MSC_VER */
-
- #define EAX 0
- #define EBX 1
- #define ECX 2
- #define EDX 3
-
- static cpuid_flags_t cpuid_flag(word32 leaf, word32 sub, word32 num, word32 bit)
- {
- int got_intel_cpu = 0;
- int got_amd_cpu = 0;
- unsigned int reg[5];
-
- XMEMSET(reg, '\0', sizeof(reg));
- cpuid(reg, 0, 0);
-
- /* check for Intel cpu */
- if (XMEMCMP((char *)&(reg[EBX]), "Genu", 4) == 0 &&
- XMEMCMP((char *)&(reg[EDX]), "ineI", 4) == 0 &&
- XMEMCMP((char *)&(reg[ECX]), "ntel", 4) == 0) {
- got_intel_cpu = 1;
- }
-
- /* check for AMD cpu */
- if (XMEMCMP((char *)&(reg[EBX]), "Auth", 4) == 0 &&
- XMEMCMP((char *)&(reg[EDX]), "enti", 4) == 0 &&
- XMEMCMP((char *)&(reg[ECX]), "cAMD", 4) == 0) {
- got_amd_cpu = 1;
- }
-
- if (got_intel_cpu || got_amd_cpu) {
- cpuid(reg, leaf, sub);
- return ((reg[num] >> bit) & 0x1);
- }
- return 0;
- }
-
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- if (cpuid_flag(1, 0, ECX, 28)) { new_cpuid_flags |= CPUID_AVX1 ; }
- if (cpuid_flag(7, 0, EBX, 5)) { new_cpuid_flags |= CPUID_AVX2 ; }
- if (cpuid_flag(7, 0, EBX, 8)) { new_cpuid_flags |= CPUID_BMI2 ; }
- if (cpuid_flag(1, 0, ECX, 30)) { new_cpuid_flags |= CPUID_RDRAND; }
- if (cpuid_flag(7, 0, EBX, 18)) { new_cpuid_flags |= CPUID_RDSEED; }
- if (cpuid_flag(1, 0, ECX, 25)) { new_cpuid_flags |= CPUID_AESNI ; }
- if (cpuid_flag(7, 0, EBX, 19)) { new_cpuid_flags |= CPUID_ADX ; }
- if (cpuid_flag(1, 0, ECX, 22)) { new_cpuid_flags |= CPUID_MOVBE ; }
- if (cpuid_flag(7, 0, EBX, 3)) { new_cpuid_flags |= CPUID_BMI1 ; }
- if (cpuid_flag(7, 0, EBX, 29)) { new_cpuid_flags |= CPUID_SHA ; }
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#elif defined(HAVE_CPUID_AARCH64)
-
-#define CPUID_AARCH64_FEAT_AES ((word64)1 << 4)
-#define CPUID_AARCH64_FEAT_AES_PMULL ((word64)1 << 5)
-#define CPUID_AARCH64_FEAT_SHA256 ((word64)1 << 12)
-#define CPUID_AARCH64_FEAT_SHA256_512 ((word64)1 << 13)
-#define CPUID_AARCH64_FEAT_RDM ((word64)1 << 28)
-#define CPUID_AARCH64_FEAT_SHA3 ((word64)1 << 32)
-#define CPUID_AARCH64_FEAT_SM3 ((word64)1 << 36)
-#define CPUID_AARCH64_FEAT_SM4 ((word64)1 << 40)
-
-#ifdef WOLFSSL_AARCH64_PRIVILEGE_MODE
- /* https://developer.arm.com/documentation/ddi0601/2024-09/AArch64-Registers
- * /ID-AA64ISAR0-EL1--AArch64-Instruction-Set-Attribute-Register-0 */
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- word64 features;
-
- __asm__ __volatile (
- "mrs %[feat], ID_AA64ISAR0_EL1\n"
- : [feat] "=r" (features)
- :
- :
- );
-
- if (features & CPUID_AARCH64_FEAT_AES)
- new_cpuid_flags |= CPUID_AES;
- if (features & CPUID_AARCH64_FEAT_AES_PMULL) {
- new_cpuid_flags |= CPUID_AES;
- new_cpuid_flags |= CPUID_PMULL;
- }
- if (features & CPUID_AARCH64_FEAT_SHA256)
- new_cpuid_flags |= CPUID_SHA256;
- if (features & CPUID_AARCH64_FEAT_SHA256_512)
- new_cpuid_flags |= CPUID_SHA256 | CPUID_SHA512;
- if (features & CPUID_AARCH64_FEAT_RDM)
- new_cpuid_flags |= CPUID_RDM;
- if (features & CPUID_AARCH64_FEAT_SHA3)
- new_cpuid_flags |= CPUID_SHA3;
- if (features & CPUID_AARCH64_FEAT_SM3)
- new_cpuid_flags |= CPUID_SM3;
- if (features & CPUID_AARCH64_FEAT_SM4)
- new_cpuid_flags |= CPUID_SM4;
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#elif defined(__linux__)
- /* https://community.arm.com/arm-community-blogs/b/operating-systems-blog/
- * posts/runtime-detection-of-cpu-features-on-an-armv8-a-cpu */
-
- #include
- #include
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- word64 hwcaps = getauxval(AT_HWCAP);
-
- #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- if (hwcaps & HWCAP_AES)
- new_cpuid_flags |= CPUID_AES;
- if (hwcaps & HWCAP_PMULL)
- new_cpuid_flags |= CPUID_PMULL;
- if (hwcaps & HWCAP_SHA2)
- new_cpuid_flags |= CPUID_SHA256;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA512
- if (hwcaps & HWCAP_SHA512)
- new_cpuid_flags |= CPUID_SHA512;
- #endif
- #if defined(HWCAP_ASIMDRDM) && !defined(WOLFSSL_AARCH64_NO_SQRDMLSH)
- if (hwcaps & HWCAP_ASIMDRDM)
- new_cpuid_flags |= CPUID_RDM;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- if (hwcaps & HWCAP_SHA3)
- new_cpuid_flags |= CPUID_SHA3;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM3
- if (hwcaps & HWCAP_SM3)
- new_cpuid_flags |= CPUID_SM3;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM4
- if (hwcaps & HWCAP_SM4)
- new_cpuid_flags |= CPUID_SM4;
- #endif
-
- (void)hwcaps;
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#elif defined(__ANDROID__) || defined(ANDROID)
- /* https://community.arm.com/arm-community-blogs/b/operating-systems-blog/
- * posts/runtime-detection-of-cpu-features-on-an-armv8-a-cpu */
-
- #include "cpu-features.h"
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- word64 features = android_getCpuFeatures();
-
- if (features & ANDROID_CPU_ARM_FEATURE_AES)
- new_cpuid_flags |= CPUID_AES;
- if (features & ANDROID_CPU_ARM_FEATURE_PMULL)
- new_cpuid_flags |= CPUID_PMULL;
- if (features & ANDROID_CPU_ARM_FEATURE_SHA2)
- new_cpuid_flags |= CPUID_SHA256;
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#elif defined(__APPLE__)
- /* https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/
- * determining_instruction_set_characteristics */
-
- #include
-
- static word64 cpuid_get_sysctlbyname(const char* name)
- {
- word64 ret = 0;
- size_t size = sizeof(ret);
-
- sysctlbyname(name, &ret, &size, NULL, 0);
-
- return ret;
- }
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_AES") != 0)
- new_cpuid_flags |= CPUID_AES;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_PMULL") != 0)
- new_cpuid_flags |= CPUID_PMULL;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_SHA256") != 0)
- new_cpuid_flags |= CPUID_SHA256;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_SHA512") != 0)
- new_cpuid_flags |= CPUID_SHA512;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_RDM") != 0)
- new_cpuid_flags |= CPUID_RDM;
- if (cpuid_get_sysctlbyname("hw.optional.arm.FEAT_SHA3") != 0)
- new_cpuid_flags |= CPUID_SHA3;
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM3
- new_cpuid_flags |= CPUID_SM3;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM4
- new_cpuid_flags |= CPUID_SM4;
- #endif
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#elif defined(__FreeBSD__) || defined(__OpenBSD__)
- /* https://man.freebsd.org/cgi/man.cgi?elf_aux_info(3) */
-
- #include
-
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- word64 features = 0;
-
- elf_aux_info(AT_HWCAP, &features, sizeof(features));
-
- if (features & CPUID_AARCH64_FEAT_AES)
- new_cpuid_flags |= CPUID_AES;
- if (features & CPUID_AARCH64_FEAT_AES_PMULL) {
- new_cpuid_flags |= CPUID_AES;
- new_cpuid_flags |= CPUID_PMULL;
- }
- if (features & CPUID_AARCH64_FEAT_SHA256)
- new_cpuid_flags |= CPUID_SHA256;
- if (features & CPUID_AARCH64_FEAT_SHA256_512)
- new_cpuid_flags |= CPUID_SHA256 | CPUID_SHA512;
- if (features & CPUID_AARCH64_FEAT_RDM)
- new_cpuid_flags |= CPUID_RDM;
- if (features & CPUID_AARCH64_FEAT_SHA3)
- new_cpuid_flags |= CPUID_SHA3;
- if (features & CPUID_AARCH64_FEAT_SM3)
- new_cpuid_flags |= CPUID_SM3;
- if (features & CPUID_AARCH64_FEAT_SM4)
- new_cpuid_flags |= CPUID_SM4;
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#else
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
- new_cpuid_flags |= CPUID_AES;
- new_cpuid_flags |= CPUID_PMULL;
- new_cpuid_flags |= CPUID_SHA256;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA512
- new_cpuid_flags |= CPUID_SHA512;
- #endif
- #ifndef WOLFSSL_AARCH64_NO_SQRDMLSH
- new_cpuid_flags |= CPUID_RDM;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
- new_cpuid_flags |= CPUID_SHA3;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM3
- new_cpuid_flags |= CPUID_SM3;
- #endif
- #ifdef WOLFSSL_ARMASM_CRYPTO_SM4
- new_cpuid_flags |= CPUID_SM4;
- #endif
-
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#endif
-#elif defined(HAVE_CPUID)
- static WC_INLINE void cpuid_set_flags(void)
- {
- if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
- cpuid_flags_t new_cpuid_flags = 0,
- old_cpuid_flags = WC_CPUID_INITIALIZER;
- (void)wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
- }
- }
-#endif
-
-#ifdef HAVE_CPUID
-
- cpuid_flags_t cpuid_get_flags(void)
- {
- cpuid_set_flags();
- return WOLFSSL_ATOMIC_LOAD(cpuid_flags);
- }
-
- void cpuid_select_flags(cpuid_flags_t flags)
- {
- WOLFSSL_ATOMIC_STORE(cpuid_flags, flags);
- }
-
- void cpuid_set_flag(cpuid_flags_t flag)
- {
- cpuid_flags_t current_flags = WOLFSSL_ATOMIC_LOAD(cpuid_flags);
- while (! wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, ¤t_flags, current_flags | flag))
- WC_RELAX_LONG_LOOP();
- }
-
- void cpuid_clear_flag(cpuid_flags_t flag)
- {
- cpuid_flags_t current_flags = WOLFSSL_ATOMIC_LOAD(cpuid_flags);
- while (! wolfSSL_Atomic_Uint_CompareExchange
- (&cpuid_flags, ¤t_flags, current_flags & ~flag))
- WC_RELAX_LONG_LOOP();
- }
-
-#endif /* HAVE_CPUID */
diff --git a/src/ssl/wolfssl/wolfcrypt/curve448.c b/src/ssl/wolfssl/wolfcrypt/curve448.c
deleted file mode 100644
index 74e2cee07..000000000
--- a/src/ssl/wolfssl/wolfcrypt/curve448.c
+++ /dev/null
@@ -1,729 +0,0 @@
-/* curve448.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* Implemented to: RFC 7748 */
-
-/* Based On Daniel J Bernstein's curve25519 Public Domain ref10 work.
- * Reworked for curve448 by Sean Parkinson.
- */
-
-#include
-
-#ifdef HAVE_CURVE448
-
-#include
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-int wc_curve448_make_pub(int public_size, byte* pub, int private_size,
- const byte* priv)
-{
- int ret;
- unsigned char basepoint[CURVE448_KEY_SIZE] = {5};
-
- if ((pub == NULL) || (priv == NULL)) {
- return ECC_BAD_ARG_E;
- }
- if ((public_size != CURVE448_PUB_KEY_SIZE) ||
- (private_size != CURVE448_KEY_SIZE)) {
- return ECC_BAD_ARG_E;
- }
-
- fe448_init();
-
- /* compute public key */
- ret = curve448(pub, priv, basepoint);
-
- return ret;
-}
-
-
-/* Make a new curve448 private/public key.
- *
- * rng [in] Random number generator.
- * keysize [in] Size of the key to generate.
- * key [in] Curve448 key object.
- * returns BAD_FUNC_ARG when rng or key are NULL,
- * ECC_BAD_ARG_E when keysize is not CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_make_key(WC_RNG* rng, int keysize, curve448_key* key)
-{
- int ret = 0;
-
- if ((key == NULL) || (rng == NULL)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* currently only a key size of 56 bytes is used */
- if ((ret == 0) && (keysize != CURVE448_KEY_SIZE)) {
- ret = ECC_BAD_ARG_E;
- }
-
- if (ret == 0) {
- /* random number for private key */
- ret = wc_RNG_GenerateBlock(rng, key->k, (word32)keysize);
- }
- if (ret == 0) {
- key->privSet = 1;
-
- /* clamp private */
- key->k[0] &= 0xfc;
- key->k[CURVE448_KEY_SIZE-1] |= 0x80;
-
- /* compute public */
- ret = wc_curve448_make_pub((int)sizeof(key->p), key->p,
- (int)sizeof(key->k), key->k);
- if (ret == 0) {
- key->pubSet = 1;
- }
- else {
- ForceZero(key->k, sizeof(key->k));
- XMEMSET(key->p, 0, sizeof(key->p));
- }
- }
-
- return ret;
-}
-
-#ifdef HAVE_CURVE448_SHARED_SECRET
-
-/* Calculate the shared secret from the private key and peer's public key.
- * Calculation over curve448.
- * Secret encoded big-endian.
- *
- * private_key [in] Curve448 private key.
- * public_key [in] Curve448 public key.
- * out [in] Array to hold shared secret.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * returns BAD_FUNC_ARG when a parameter is NULL or outLen is less than
- * CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_shared_secret(curve448_key* private_key,
- curve448_key* public_key,
- byte* out, word32* outLen)
-{
- return wc_curve448_shared_secret_ex(private_key, public_key, out, outLen,
- EC448_BIG_ENDIAN);
-}
-
-/* Calculate the shared secret from the private key and peer's public key.
- * Calculation over curve448.
- *
- * private_key [in] Curve448 private key.
- * public_key [in] Curve448 public key.
- * out [in] Array to hold shared secret.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * endian [in] Endianness to use when encoding number in array.
- * returns BAD_FUNC_ARG when a parameter is NULL or outLen is less than
- * CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_shared_secret_ex(curve448_key* private_key,
- curve448_key* public_key,
- byte* out, word32* outLen, int endian)
-{
- unsigned char o[CURVE448_PUB_KEY_SIZE];
- int ret = 0;
- int i;
-
- /* sanity check */
- if ((private_key == NULL) || (public_key == NULL) || (out == NULL) ||
- (outLen == NULL) || (*outLen < CURVE448_PUB_KEY_SIZE)) {
- ret = BAD_FUNC_ARG;
- }
- /* make sure we have a populated private and public key */
- if (ret == 0 && (!private_key->privSet || !public_key->pubSet)) {
- ret = ECC_BAD_ARG_E;
- }
-
- if (ret == 0) {
- ret = curve448(o, private_key->k, public_key->p);
- }
-#ifdef WOLFSSL_ECDHX_SHARED_NOT_ZERO
- if (ret == 0) {
- byte t = 0;
- for (i = 0; i < CURVE448_PUB_KEY_SIZE; i++) {
- t |= o[i];
- }
- if (t == 0) {
- ret = ECC_OUT_OF_RANGE_E;
- }
- }
-#endif
- if (ret == 0) {
- if (endian == EC448_BIG_ENDIAN) {
- /* put shared secret key in Big Endian format */
- for (i = 0; i < CURVE448_PUB_KEY_SIZE; i++) {
- out[i] = o[CURVE448_PUB_KEY_SIZE - i -1];
- }
- }
- else {
- /* put shared secret key in Little Endian format */
- XMEMCPY(out, o, CURVE448_PUB_KEY_SIZE);
- }
-
- *outLen = CURVE448_PUB_KEY_SIZE;
- }
-
- ForceZero(o, CURVE448_PUB_KEY_SIZE);
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448_SHARED_SECRET */
-
-#ifdef HAVE_CURVE448_KEY_EXPORT
-
-/* Export the curve448 public key.
- * Public key encoded big-endian.
- *
- * key [in] Curve448 public key.
- * out [in] Array to hold public key.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when outLen is less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_public(curve448_key* key, byte* out, word32* outLen)
-{
- return wc_curve448_export_public_ex(key, out, outLen, EC448_BIG_ENDIAN);
-}
-
-/* Export the curve448 public key.
- *
- * key [in] Curve448 public key.
- * out [in] Array to hold public key.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * endian [in] Endianness to use when encoding number in array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when outLen is less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_public_ex(curve448_key* key, byte* out, word32* outLen,
- int endian)
-{
- int ret = 0;
-
- if ((key == NULL) || (out == NULL) || (outLen == NULL)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* check and set outgoing key size */
- if ((ret == 0) && (*outLen < CURVE448_PUB_KEY_SIZE)) {
- *outLen = CURVE448_PUB_KEY_SIZE;
- ret = ECC_BAD_ARG_E;
- }
- if (ret == 0) {
- /* calculate public if missing */
- if (!key->pubSet) {
- ret = wc_curve448_make_pub((int)sizeof(key->p), key->p,
- (int)sizeof(key->k), key->k);
- key->pubSet = (ret == 0);
- }
- }
- if (ret == 0) {
- *outLen = CURVE448_PUB_KEY_SIZE;
- if (endian == EC448_BIG_ENDIAN) {
- int i;
- /* read keys in Big Endian format */
- for (i = 0; i < CURVE448_PUB_KEY_SIZE; i++) {
- out[i] = key->p[CURVE448_PUB_KEY_SIZE - i - 1];
- }
- }
- else {
- XMEMCPY(out, key->p, CURVE448_PUB_KEY_SIZE);
- }
- }
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448_KEY_EXPORT */
-
-#ifdef HAVE_CURVE448_KEY_IMPORT
-
-/* Import a curve448 public key from a byte array.
- * Public key encoded in big-endian.
- *
- * in [in] Array holding public key.
- * inLen [in] Number of bytes of data in array.
- * key [in] Curve448 public key.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when inLen is less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_public(const byte* in, word32 inLen, curve448_key* key)
-{
- return wc_curve448_import_public_ex(in, inLen, key, EC448_BIG_ENDIAN);
-}
-
-/* Import a curve448 public key from a byte array.
- *
- * in [in] Array holding public key.
- * inLen [in] Number of bytes of data in array.
- * key [in] Curve448 public key.
- * endian [in] Endianness of encoded number in byte array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when inLen is less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_public_ex(const byte* in, word32 inLen,
- curve448_key* key, int endian)
-{
- int ret = 0;
-
- /* sanity check */
- if ((key == NULL) || (in == NULL)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* check size of incoming keys */
- if ((ret == 0) && (inLen != CURVE448_PUB_KEY_SIZE)) {
- ret = ECC_BAD_ARG_E;
- }
-
- if (ret == 0) {
- if (endian == EC448_BIG_ENDIAN) {
- int i;
- /* read keys in Big Endian format */
- for (i = 0; i < CURVE448_PUB_KEY_SIZE; i++) {
- key->p[i] = in[CURVE448_PUB_KEY_SIZE - i - 1];
- }
- }
- else
- XMEMCPY(key->p, in, inLen);
- key->pubSet = 1;
- }
-
- return ret;
-}
-
-/* Check the public key value (big or little endian)
- *
- * pub [in] Public key bytes.
- * pubSz [in] Size of public key in bytes.
- * endian [in] Public key bytes passed in as big-endian or little-endian.
- * returns BAD_FUNC_ARGS when pub is NULL,
- * ECC_BAD_ARG_E when key length is not 56 bytes, public key value is
- * zero or one;
- * BUFFER_E when size of public key is zero;
- * 0 otherwise.
- */
-int wc_curve448_check_public(const byte* pub, word32 pubSz, int endian)
-{
- int ret = 0;
-
- if (pub == NULL) {
- ret = BAD_FUNC_ARG;
- }
-
- /* Check for empty key data */
- if ((ret == 0) && (pubSz == 0)) {
- ret = BUFFER_E;
- }
-
- /* Check key length */
- if ((ret == 0) && (pubSz != CURVE448_PUB_KEY_SIZE)) {
- ret = ECC_BAD_ARG_E;
- }
-
- if (ret == 0) {
- word32 i;
-
- if (endian == EC448_LITTLE_ENDIAN) {
- /* Check for value of zero or one */
- for (i = CURVE448_PUB_KEY_SIZE - 1; i > 0; i--) {
- if (pub[i] != 0) {
- break;
- }
- }
- if ((i == 0) && (pub[0] == 0 || pub[0] == 1)) {
- return ECC_BAD_ARG_E;
- }
- /* Check for order-1 or higher */
- for (i = CURVE448_PUB_KEY_SIZE - 1; i > 28; i--) {
- if (pub[i] != 0xff) {
- break;
- }
- }
- if ((i == 28) && (pub[i] == 0xff)) {
- return ECC_BAD_ARG_E;
- }
- if ((i == 28) && (pub[i] == 0xfe)) {
- for (--i; i > 0; i--) {
- if (pub[i] != 0xff) {
- break;
- }
- }
- if ((i == 0) && (pub[i] >= 0xfe)) {
- return ECC_BAD_ARG_E;
- }
- }
- }
- else {
- /* Check for value of zero or one */
- for (i = 0; i < CURVE448_PUB_KEY_SIZE-1; i++) {
- if (pub[i] != 0) {
- break;
- }
- }
- if ((i == CURVE448_PUB_KEY_SIZE - 1) &&
- (pub[i] == 0 || pub[i] == 1)) {
- ret = ECC_BAD_ARG_E;
- }
- /* Check for order-1 or higher */
- for (i = 0; i < 27; i++) {
- if (pub[i] != 0xff) {
- break;
- }
- }
- if ((i == 27) && (pub[i] == 0xff)) {
- return ECC_BAD_ARG_E;
- }
- if ((i == 27) && (pub[i] == 0xfe)) {
- for (++i; i < CURVE448_PUB_KEY_SIZE - 1; i--) {
- if (pub[i] != 0xff) {
- break;
- }
- }
- if ((i == CURVE448_PUB_KEY_SIZE) && (pub[i] >= 0xfe)) {
- return ECC_BAD_ARG_E;
- }
- }
- }
- }
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448_KEY_IMPORT */
-
-
-#ifdef HAVE_CURVE448_KEY_EXPORT
-
-/* Export the curve448 private key raw form.
- * Private key encoded big-endian.
- *
- * key [in] Curve448 private key.
- * out [in] Array to hold private key.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when outLen is less than CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_private_raw(curve448_key* key, byte* out, word32* outLen)
-{
- return wc_curve448_export_private_raw_ex(key, out, outLen,
- EC448_BIG_ENDIAN);
-}
-
-/* Export the curve448 private key raw form.
- *
- * key [in] Curve448 private key.
- * out [in] Array to hold private key.
- * outLen [in/out] On in, the number of bytes in array.
- * On out, the number bytes put into array.
- * endian [in] Endianness to use when encoding number in array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when outLen is less than CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_private_raw_ex(curve448_key* key, byte* out,
- word32* outLen, int endian)
-{
- int ret = 0;
-
- /* sanity check */
- if ((key == NULL) || (out == NULL) || (outLen == NULL)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* check size of outgoing buffer */
- if ((ret == 0) && (*outLen < CURVE448_KEY_SIZE)) {
- *outLen = CURVE448_KEY_SIZE;
- ret = ECC_BAD_ARG_E;
- }
- if (ret == 0) {
- *outLen = CURVE448_KEY_SIZE;
-
- if (endian == EC448_BIG_ENDIAN) {
- int i;
- /* put the key in Big Endian format */
- for (i = 0; i < CURVE448_KEY_SIZE; i++) {
- out[i] = key->k[CURVE448_KEY_SIZE - i - 1];
- }
- }
- else {
- XMEMCPY(out, key->k, CURVE448_KEY_SIZE);
- }
- }
-
- return ret;
-}
-
-/* Export the curve448 private and public keys in raw form.
- * Private and public key encoded big-endian.
- *
- * key [in] Curve448 private key.
- * priv [in] Array to hold private key.
- * privSz [in/out] On in, the number of bytes in private key array.
- * On out, the number bytes put into private key array.
- * pub [in] Array to hold public key.
- * pubSz [in/out] On in, the number of bytes in public key array.
- * On out, the number bytes put into public key array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE or pubSz is
- * less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_key_raw(curve448_key* key, byte* priv, word32 *privSz,
- byte* pub, word32 *pubSz)
-{
- return wc_curve448_export_key_raw_ex(key, priv, privSz, pub, pubSz,
- EC448_BIG_ENDIAN);
-}
-
-/* Export the curve448 private and public keys in raw form.
- *
- * key [in] Curve448 private key.
- * priv [in] Array to hold private key.
- * privSz [in/out] On in, the number of bytes in private key array.
- * On out, the number bytes put into private key array.
- * pub [in] Array to hold public key.
- * pubSz [in/out] On in, the number of bytes in public key array.
- * On out, the number bytes put into public key array.
- * endian [in] Endianness to use when encoding number in array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE or pubSz is
- * less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_export_key_raw_ex(curve448_key* key, byte* priv, word32 *privSz,
- byte* pub, word32 *pubSz, int endian)
-{
- int ret;
-
- /* export private part */
- ret = wc_curve448_export_private_raw_ex(key, priv, privSz, endian);
- if (ret == 0) {
- /* export public part */
- ret = wc_curve448_export_public_ex(key, pub, pubSz, endian);
- }
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448_KEY_EXPORT */
-
-#ifdef HAVE_CURVE448_KEY_IMPORT
-
-/* Import curve448 private and public keys from a byte arrays.
- * Private and public keys encoded in big-endian.
- *
- * piv [in] Array holding private key.
- * privSz [in] Number of bytes of data in private key array.
- * pub [in] Array holding public key.
- * pubSz [in] Number of bytes of data in public key array.
- * key [in] Curve448 private/public key.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE or pubSz is
- * less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_private_raw(const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz,
- curve448_key* key)
-{
- return wc_curve448_import_private_raw_ex(priv, privSz, pub, pubSz, key,
- EC448_BIG_ENDIAN);
-}
-
-/* Import curve448 private and public keys from a byte arrays.
- *
- * piv [in] Array holding private key.
- * privSz [in] Number of bytes of data in private key array.
- * pub [in] Array holding public key.
- * pubSz [in] Number of bytes of data in public key array.
- * key [in] Curve448 private/public key.
- * endian [in] Endianness of encoded numbers in byte arrays.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE or pubSz is
- * less than CURVE448_PUB_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_private_raw_ex(const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz,
- curve448_key* key, int endian)
-{
- int ret;
-
- /* import private part */
- ret = wc_curve448_import_private_ex(priv, privSz, key, endian);
- if (ret == 0) {
- /* import public part */
- return wc_curve448_import_public_ex(pub, pubSz, key, endian);
- }
-
- return ret;
-}
-
-/* Import curve448 private key from a byte array.
- * Private key encoded in big-endian.
- *
- * piv [in] Array holding private key.
- * privSz [in] Number of bytes of data in private key array.
- * key [in] Curve448 private/public key.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_private(const byte* priv, word32 privSz,
- curve448_key* key)
-{
- return wc_curve448_import_private_ex(priv, privSz, key, EC448_BIG_ENDIAN);
-}
-
-/* Import curve448 private key from a byte array.
- *
- * piv [in] Array holding private key.
- * privSz [in] Number of bytes of data in private key array.
- * key [in] Curve448 private/public key.
- * endian [in] Endianness of encoded number in byte array.
- * returns BAD_FUNC_ARG when a parameter is NULL,
- * ECC_BAD_ARG_E when privSz is less than CURVE448_KEY_SIZE,
- * 0 otherwise.
- */
-int wc_curve448_import_private_ex(const byte* priv, word32 privSz,
- curve448_key* key, int endian)
-{
- int ret = 0;
-
- /* sanity check */
- if ((key == NULL) || (priv == NULL)) {
- ret = BAD_FUNC_ARG;
- }
-
- /* check size of incoming keys */
- if ((ret == 0) && ((int)privSz != CURVE448_KEY_SIZE)) {
- ret = ECC_BAD_ARG_E;
- }
-
- if (ret == 0) {
- if (endian == EC448_BIG_ENDIAN) {
- int i;
- /* read the key in Big Endian format */
- for (i = 0; i < CURVE448_KEY_SIZE; i++) {
- key->k[i] = priv[CURVE448_KEY_SIZE - i - 1];
- }
- }
- else {
- XMEMCPY(key->k, priv, CURVE448_KEY_SIZE);
- }
-
- /* Clamp the key */
- key->k[0] &= 0xfc;
- key->k[CURVE448_KEY_SIZE-1] |= 0x80;
-
- key->privSet = 1;
- }
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448_KEY_IMPORT */
-
-
-/* Initialize the curve448 key.
- *
- * key [in] Curve448 key object.
- * returns BAD_FUNC_ARG when key is NULL,
- * 0 otherwise.
- */
-int wc_curve448_init(curve448_key* key)
-{
- int ret = 0;
-
- if (key == NULL) {
- ret = BAD_FUNC_ARG;
- }
-
- if (ret == 0) {
- XMEMSET(key, 0, sizeof(*key));
-
- fe448_init();
-
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Add("wc_curve448_init key->k", &key->k, CURVE448_KEY_SIZE);
- #endif
- }
-
- return ret;
-}
-
-
-/* Clears the curve448 key data.
- *
- * key [in] Curve448 key object.
- */
-void wc_curve448_free(curve448_key* key)
-{
- if (key != NULL) {
- ForceZero(key->k, sizeof(key->k));
- XMEMSET(key->p, 0, sizeof(key->p));
- key->pubSet = 0;
- key->privSet = 0;
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(key, sizeof(curve448_key));
- #endif
- }
-}
-
-
-/* Get the curve448 key's size.
- *
- * key [in] Curve448 key object.
- * returns 0 if key is NULL,
- * CURVE448_KEY_SIZE otherwise.
- */
-int wc_curve448_size(curve448_key* key)
-{
- int ret = 0;
-
- if (key != NULL) {
- ret = CURVE448_KEY_SIZE;
- }
-
- return ret;
-}
-
-#endif /* HAVE_CURVE448 */
-
diff --git a/src/ssl/wolfssl/wolfcrypt/des3.c b/src/ssl/wolfssl/wolfcrypt/des3.c
deleted file mode 100644
index 9c39196de..000000000
--- a/src/ssl/wolfssl/wolfcrypt/des3.c
+++ /dev/null
@@ -1,1982 +0,0 @@
-/* des3.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifndef NO_DES3
-
-#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && \
- (HAVE_FIPS_VERSION == 2 || HAVE_FIPS_VERSION == 3)
-
- /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
- #define FIPS_NO_WRAPPERS
-
- #ifdef USE_WINDOWS_API
- #pragma code_seg(".fipsA$d")
- #pragma const_seg(".fipsB$d")
- #endif
-#endif
-
-#include
-
-#ifdef WOLF_CRYPTO_CB
- #include
-#endif
-
-#if defined(WOLFSSL_TI_CRYPT)
- #include
-#else
-
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-
-/* Hardware Acceleration */
-#if defined(STM32_CRYPTO) && !defined(STM32_CRYPTO_AES_ONLY)
-
- /*
- * STM32F2/F4 hardware DES/3DES support through the standard
- * peripheral library. (See note in README).
- */
-
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- word32 *dkey = des->key;
-
- (void)dir;
-
- XMEMCPY(dkey, key, 8);
- #if !defined(WOLFSSL_STM32_CUBEMX) || defined(STM32_HAL_V2)
- ByteReverseWords(dkey, dkey, 8);
- #endif
-
- wc_Des_SetIV(des, iv);
-
- return 0;
- }
-
- int wc_Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
- {
- if (des == NULL || key == NULL)
- return BAD_FUNC_ARG;
-
- (void)dir;
-
- #ifndef WOLFSSL_STM32_CUBEMX
- {
- word32 *dkey1 = des->key[0];
- word32 *dkey2 = des->key[1];
- word32 *dkey3 = des->key[2];
-
- XMEMCPY(dkey1, key, 8); /* set key 1 */
- XMEMCPY(dkey2, key + 8, 8); /* set key 2 */
- XMEMCPY(dkey3, key + 16, 8); /* set key 3 */
-
- ByteReverseWords(dkey1, dkey1, 8);
- ByteReverseWords(dkey2, dkey2, 8);
- ByteReverseWords(dkey3, dkey3, 8);
- }
- #else
- /* CUBEMX wants keys in sequential memory */
- XMEMCPY(des->key[0], key, DES3_KEYLEN);
- #ifdef STM32_HAL_V2
- ByteReverseWords((word32*)des->key, (word32*)des->key, DES3_KEYLEN);
- #endif
- #endif
-
- return wc_Des3_SetIV(des, iv);
- }
-
- static void DesCrypt(Des* des, byte* out, const byte* in, word32 sz,
- int dir, int mode)
- {
- int ret;
- #ifdef WOLFSSL_STM32_CUBEMX
- CRYP_HandleTypeDef hcryp;
- #else
- word32 *dkey, *iv;
- CRYP_InitTypeDef DES_CRYP_InitStructure;
- CRYP_KeyInitTypeDef DES_CRYP_KeyInitStructure;
- CRYP_IVInitTypeDef DES_CRYP_IVInitStructure;
- #endif
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return;
- }
-
- #ifdef WOLFSSL_STM32_CUBEMX
- XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
- hcryp.Instance = CRYP;
- hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
- hcryp.Init.DataType = CRYP_DATATYPE_8B;
- hcryp.Init.pKey = (STM_CRYPT_TYPE*)des->key;
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)des->reg;
- #ifdef STM32_HAL_V2
- hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
- if (mode == DES_CBC)
- hcryp.Init.Algorithm = CRYP_DES_CBC;
- else
- hcryp.Init.Algorithm = CRYP_DES_ECB;
- #endif
-
- HAL_CRYP_Init(&hcryp);
-
- #ifdef STM32_HAL_V2
- if (dir == DES_ENCRYPTION) {
- HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in, sz, (uint32_t*)out,
- STM32_HAL_TIMEOUT);
- }
- else {
- HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in, sz, (uint32_t*)out,
- STM32_HAL_TIMEOUT);
- }
- /* save off IV */
- #ifdef WOLFSSL_STM32MP13
- des->reg[0] = ((CRYP_TypeDef *)(hcryp.Instance))->IV0LR;
- des->reg[1] = ((CRYP_TypeDef *)(hcryp.Instance))->IV0RR;
- #else
- des->reg[0] = hcryp.Instance->IV0LR;
- des->reg[1] = hcryp.Instance->IV0RR;
- #endif
- #else
- while (sz > 0) {
- /* if input and output same will overwrite input iv */
- XMEMCPY(des->tmp, in + sz - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
-
- if (mode == DES_CBC) {
- if (dir == DES_ENCRYPTION) {
- HAL_CRYP_DESCBC_Encrypt(&hcryp, (uint8_t*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
- else {
- HAL_CRYP_DESCBC_Decrypt(&hcryp, (uint8_t*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
- }
- else {
- if (dir == DES_ENCRYPTION) {
- HAL_CRYP_DESECB_Encrypt(&hcryp, (uint8_t*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
- else {
- HAL_CRYP_DESECB_Decrypt(&hcryp, (uint8_t*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
- }
-
- /* store iv for next call */
- XMEMCPY(des->reg, des->tmp, DES_BLOCK_SIZE);
-
- sz -= DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- out += DES_BLOCK_SIZE;
- }
- #endif /* STM32_HAL_V2 */
-
- HAL_CRYP_DeInit(&hcryp);
- #else
- dkey = des->key;
- iv = des->reg;
-
- /* crypto structure initialization */
- CRYP_KeyStructInit(&DES_CRYP_KeyInitStructure);
- CRYP_StructInit(&DES_CRYP_InitStructure);
- CRYP_IVStructInit(&DES_CRYP_IVInitStructure);
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set direction, mode, and datatype */
- if (dir == DES_ENCRYPTION) {
- DES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt;
- } else { /* DES_DECRYPTION */
- DES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- }
-
- if (mode == DES_CBC) {
- DES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_DES_CBC;
- } else { /* DES_ECB */
- DES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_DES_ECB;
- }
-
- DES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
- CRYP_Init(&DES_CRYP_InitStructure);
-
- /* load key into correct registers */
- DES_CRYP_KeyInitStructure.CRYP_Key1Left = dkey[0];
- DES_CRYP_KeyInitStructure.CRYP_Key1Right = dkey[1];
- CRYP_KeyInit(&DES_CRYP_KeyInitStructure);
-
- /* set iv */
- ByteReverseWords(iv, iv, DES_BLOCK_SIZE);
- DES_CRYP_IVInitStructure.CRYP_IV0Left = iv[0];
- DES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1];
- CRYP_IVInit(&DES_CRYP_IVInitStructure);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- while (sz > 0) {
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- /* if input and output same will overwrite input iv */
- XMEMCPY(des->tmp, in + sz - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
-
- CRYP_DataIn(*(uint32_t*)&in[0]);
- CRYP_DataIn(*(uint32_t*)&in[4]);
-
- /* wait until the complete message has been processed */
- while(CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&out[0] = CRYP_DataOut();
- *(uint32_t*)&out[4] = CRYP_DataOut();
-
- /* store iv for next call */
- XMEMCPY(des->reg, des->tmp, DES_BLOCK_SIZE);
-
- sz -= DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- out += DES_BLOCK_SIZE;
- }
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- #endif /* WOLFSSL_STM32_CUBEMX */
- wolfSSL_CryptHwMutexUnLock();
- }
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- DesCrypt(des, out, in, sz, DES_ENCRYPTION, DES_CBC);
- return 0;
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- DesCrypt(des, out, in, sz, DES_DECRYPTION, DES_CBC);
- return 0;
- }
-
- int wc_Des_EcbEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- DesCrypt(des, out, in, sz, DES_ENCRYPTION, DES_ECB);
- return 0;
- }
-
- static int Des3Crypt(Des3* des, byte* out, const byte* in, word32 sz,
- int dir)
- {
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- #ifdef WOLFSSL_STM32_CUBEMX
- {
- CRYP_HandleTypeDef hcryp;
-
- XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
- hcryp.Instance = CRYP;
- hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
- hcryp.Init.DataType = CRYP_DATATYPE_8B;
- hcryp.Init.pKey = (STM_CRYPT_TYPE*)des->key;
- hcryp.Init.pInitVect = (STM_CRYPT_TYPE*)des->reg;
- #ifdef STM32_HAL_V2
- hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
- hcryp.Init.Algorithm = CRYP_TDES_CBC;
- #endif
-
- HAL_CRYP_Init(&hcryp);
-
- #ifdef STM32_HAL_V2
- if (dir == DES_ENCRYPTION) {
- HAL_CRYP_Encrypt(&hcryp, (uint32_t*)in, sz, (uint32_t*)out,
- STM32_HAL_TIMEOUT);
- }
- else {
- HAL_CRYP_Decrypt(&hcryp, (uint32_t*)in, sz, (uint32_t*)out,
- STM32_HAL_TIMEOUT);
- }
- /* save off IV */
- #ifdef WOLFSSL_STM32MP13
- des->reg[0] = ((CRYP_TypeDef *)(hcryp.Instance))->IV0LR;
- des->reg[1] = ((CRYP_TypeDef *)(hcryp.Instance))->IV0RR;
- #else
- des->reg[0] = hcryp.Instance->IV0LR;
- des->reg[1] = hcryp.Instance->IV0RR;
- #endif
- #else
- while (sz > 0) {
- if (dir == DES_ENCRYPTION) {
- HAL_CRYP_TDESCBC_Encrypt(&hcryp, (byte*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
- else {
- HAL_CRYP_TDESCBC_Decrypt(&hcryp, (byte*)in,
- DES_BLOCK_SIZE, out, STM32_HAL_TIMEOUT);
- }
-
- /* store iv for next call */
- XMEMCPY(des->reg, out + sz - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
-
- sz -= DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- out += DES_BLOCK_SIZE;
- }
- #endif /* STM32_HAL_V2 */
-
- HAL_CRYP_DeInit(&hcryp);
- }
- #else
- {
- word32 *dkey1, *dkey2, *dkey3, *iv;
- CRYP_InitTypeDef DES3_CRYP_InitStructure;
- CRYP_KeyInitTypeDef DES3_CRYP_KeyInitStructure;
- CRYP_IVInitTypeDef DES3_CRYP_IVInitStructure;
-
- dkey1 = des->key[0];
- dkey2 = des->key[1];
- dkey3 = des->key[2];
- iv = des->reg;
-
- /* crypto structure initialization */
- CRYP_KeyStructInit(&DES3_CRYP_KeyInitStructure);
- CRYP_StructInit(&DES3_CRYP_InitStructure);
- CRYP_IVStructInit(&DES3_CRYP_IVInitStructure);
-
- /* reset registers to their default values */
- CRYP_DeInit();
-
- /* set direction, mode, and datatype */
- if (dir == DES_ENCRYPTION) {
- DES3_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt;
- } else {
- DES3_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt;
- }
-
- DES3_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_TDES_CBC;
- DES3_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
- CRYP_Init(&DES3_CRYP_InitStructure);
-
- /* load key into correct registers */
- DES3_CRYP_KeyInitStructure.CRYP_Key1Left = dkey1[0];
- DES3_CRYP_KeyInitStructure.CRYP_Key1Right = dkey1[1];
- DES3_CRYP_KeyInitStructure.CRYP_Key2Left = dkey2[0];
- DES3_CRYP_KeyInitStructure.CRYP_Key2Right = dkey2[1];
- DES3_CRYP_KeyInitStructure.CRYP_Key3Left = dkey3[0];
- DES3_CRYP_KeyInitStructure.CRYP_Key3Right = dkey3[1];
- CRYP_KeyInit(&DES3_CRYP_KeyInitStructure);
-
- /* set iv */
- ByteReverseWords(iv, iv, DES_BLOCK_SIZE);
- DES3_CRYP_IVInitStructure.CRYP_IV0Left = iv[0];
- DES3_CRYP_IVInitStructure.CRYP_IV0Right = iv[1];
- CRYP_IVInit(&DES3_CRYP_IVInitStructure);
-
- /* enable crypto processor */
- CRYP_Cmd(ENABLE);
-
- while (sz > 0)
- {
- /* flush IN/OUT FIFOs */
- CRYP_FIFOFlush();
-
- CRYP_DataIn(*(uint32_t*)&in[0]);
- CRYP_DataIn(*(uint32_t*)&in[4]);
-
- /* wait until the complete message has been processed */
- while(CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
-
- *(uint32_t*)&out[0] = CRYP_DataOut();
- *(uint32_t*)&out[4] = CRYP_DataOut();
-
- /* store iv for next call */
- XMEMCPY(des->reg, out + sz - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
-
- sz -= DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- out += DES_BLOCK_SIZE;
- }
-
- /* disable crypto processor */
- CRYP_Cmd(DISABLE);
- }
- #endif /* WOLFSSL_STM32_CUBEMX */
- return 0;
- }
-
- int wc_Des3_CbcEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- return Des3Crypt(des, out, in, sz, DES_ENCRYPTION);
- }
-
- int wc_Des3_CbcDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- return Des3Crypt(des, out, in, sz, DES_DECRYPTION);
- }
-
-#elif defined(HAVE_COLDFIRE_SEC)
-
- #include "sec.h"
- #include "mcf5475_sec.h"
- #include "mcf5475_siu.h"
-
- #if defined (HAVE_THREADX)
- #include "memory_pools.h"
- extern TX_BYTE_POOL mp_ncached; /* Non Cached memory pool */
- #endif
-
- #define DES_BUFFER_SIZE (DES_BLOCK_SIZE * 64)
- static unsigned char *desBuffIn = NULL;
- static unsigned char *desBuffOut = NULL;
- static byte *secIV;
- static byte *secKey;
- static volatile SECdescriptorType *secDesc;
-
- static wolfSSL_Mutex Mutex_DesSEC;
-
- #define SEC_DESC_DES_CBC_ENCRYPT 0x20500010
- #define SEC_DESC_DES_CBC_DECRYPT 0x20400010
- #define SEC_DESC_DES3_CBC_ENCRYPT 0x20700010
- #define SEC_DESC_DES3_CBC_DECRYPT 0x20600010
-
- #define DES_IVLEN 8
- #define DES_KEYLEN 8
- #define DES3_IVLEN 8
- #define DES3_KEYLEN 24
-
- extern volatile unsigned char __MBAR[];
-
- static void wc_Des_Cbc(byte* out, const byte* in, word32 sz,
- byte *key, byte *iv, word32 desc)
- {
- #ifdef DEBUG_WOLFSSL
- int ret; int stat1,stat2;
- #endif
- int size;
- volatile int v;
-
- wc_LockMutex(&Mutex_DesSEC) ;
-
- secDesc->length1 = 0x0;
- secDesc->pointer1 = NULL;
- if((desc==SEC_DESC_DES_CBC_ENCRYPT)||(desc==SEC_DESC_DES_CBC_DECRYPT)){
- secDesc->length2 = DES_IVLEN;
- secDesc->length3 = DES_KEYLEN;
- } else {
- secDesc->length2 = DES3_IVLEN;
- secDesc->length3 = DES3_KEYLEN;
- }
- secDesc->pointer2 = secIV;
- secDesc->pointer3 = secKey;
- secDesc->pointer4 = desBuffIn;
- secDesc->pointer5 = desBuffOut;
- secDesc->length6 = 0;
- secDesc->pointer6 = NULL;
- secDesc->length7 = 0x0;
- secDesc->pointer7 = NULL;
- secDesc->nextDescriptorPtr = NULL;
-
- while(sz) {
- XMEMCPY(secIV, iv, secDesc->length2);
- if((sz%DES_BUFFER_SIZE) == sz) {
- size = sz;
- sz = 0;
- } else {
- size = DES_BUFFER_SIZE;
- sz -= DES_BUFFER_SIZE;
- }
-
- XMEMCPY(desBuffIn, in, size);
- XMEMCPY(secKey, key, secDesc->length3);
-
- secDesc->header = desc;
- secDesc->length4 = size;
- secDesc->length5 = size;
- /* Point SEC to the location of the descriptor */
- MCF_SEC_FR0 = (uint32)secDesc;
- /* Initialize SEC and wait for encryption to complete */
- MCF_SEC_CCCR0 = 0x0000001a;
- /* poll SISR to determine when channel is complete */
- v=0;
- while((secDesc->header>> 24) != 0xff) {
- if(v++ > 1000)break;
- }
-
- #ifdef DEBUG_WOLFSSL
- ret = MCF_SEC_SISRH;
- stat1 = MCF_SEC_DSR;
- stat2 = MCF_SEC_DISR;
- if(ret & 0xe0000000) {
- /* db_printf("Des_Cbc(%x):ISRH=%08x, DSR=%08x, DISR=%08x\n", desc, ret, stat1, stat2); */
- }
- #endif
-
- XMEMCPY(out, desBuffOut, size);
-
- if ((desc==SEC_DESC_DES3_CBC_ENCRYPT)||(desc==SEC_DESC_DES_CBC_ENCRYPT)) {
- XMEMCPY((void*)iv, (void*)&(out[size-secDesc->length2]), secDesc->length2);
- } else {
- XMEMCPY((void*)iv, (void*)&(in[size-secDesc->length2]), secDesc->length2);
- }
-
- in += size;
- out += size;
-
- }
- wc_UnLockMutex(&Mutex_DesSEC) ;
-
- }
-
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- wc_Des_Cbc(out, in, sz, (byte *)des->key, (byte *)des->reg, SEC_DESC_DES_CBC_ENCRYPT);
- return 0;
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- wc_Des_Cbc(out, in, sz, (byte *)des->key, (byte *)des->reg, SEC_DESC_DES_CBC_DECRYPT);
- return 0;
- }
-
- int wc_Des3_CbcEncrypt(Des3* des3, byte* out, const byte* in, word32 sz)
- {
- wc_Des_Cbc(out, in, sz, (byte *)des3->key, (byte *)des3->reg, SEC_DESC_DES3_CBC_ENCRYPT);
- return 0;
- }
-
-
- int wc_Des3_CbcDecrypt(Des3* des3, byte* out, const byte* in, word32 sz)
- {
- wc_Des_Cbc(out, in, sz, (byte *)des3->key, (byte *)des3->reg, SEC_DESC_DES3_CBC_DECRYPT);
- return 0;
- }
-
- static void setParity(byte *buf, int len)
- {
- int i, j;
- byte v;
- int bits;
-
- for (i=0; i> 1;
- buf[i] = v << 1;
- bits = 0;
- for (j=0; j<7; j++) {
- bits += (v&0x1);
- v = v >> 1;
- }
- buf[i] |= (1 - (bits&0x1));
- }
-
- }
-
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- if(desBuffIn == NULL) {
- #if defined (HAVE_THREADX)
- int s1, s2, s3, s4, s5;
- s5 = tx_byte_allocate(&mp_ncached,(void *)&secDesc,
- sizeof(SECdescriptorType), TX_NO_WAIT);
- s1 = tx_byte_allocate(&mp_ncached,(void *)&desBuffIn, DES_BUFFER_SIZE, TX_NO_WAIT);
- s2 = tx_byte_allocate(&mp_ncached,(void *)&desBuffOut, DES_BUFFER_SIZE, TX_NO_WAIT);
- /* Don't know des or des3 to be used. Allocate larger buffers */
- s3 = tx_byte_allocate(&mp_ncached,(void *)&secKey, DES3_KEYLEN,TX_NO_WAIT);
- s4 = tx_byte_allocate(&mp_ncached,(void *)&secIV, DES3_IVLEN, TX_NO_WAIT);
- #else
- #warning "Allocate non-Cache buffers"
- #endif
-
- InitMutex(&Mutex_DesSEC);
- }
-
- XMEMCPY(des->key, key, DES_KEYLEN);
- setParity((byte *)des->key, DES_KEYLEN);
-
- if (iv) {
- XMEMCPY(des->reg, iv, DES_IVLEN);
- } else {
- XMEMSET(des->reg, 0x0, DES_IVLEN);
- }
- return 0;
- }
-
- int wc_Des3_SetKey(Des3* des3, const byte* key, const byte* iv, int dir)
- {
- if (des3 == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- if (desBuffIn == NULL) {
- #if defined (HAVE_THREADX)
- int s1, s2, s3, s4, s5;
- s5 = tx_byte_allocate(&mp_ncached,(void *)&secDesc,
- sizeof(SECdescriptorType), TX_NO_WAIT);
- s1 = tx_byte_allocate(&mp_ncached,(void *)&desBuffIn, DES_BUFFER_SIZE, TX_NO_WAIT);
- s2 = tx_byte_allocate(&mp_ncached,(void *)&desBuffOut, DES_BUFFER_SIZE, TX_NO_WAIT);
- s3 = tx_byte_allocate(&mp_ncached,(void *)&secKey, DES3_KEYLEN,TX_NO_WAIT);
- s4 = tx_byte_allocate(&mp_ncached,(void *)&secIV, DES3_IVLEN, TX_NO_WAIT);
- #else
- #warning "Allocate non-Cache buffers"
- #endif
-
- InitMutex(&Mutex_DesSEC);
- }
-
- XMEMCPY(des3->key[0], key, DES3_KEYLEN);
- setParity((byte *)des3->key[0], DES3_KEYLEN);
-
- if (iv) {
- XMEMCPY(des3->reg, iv, DES3_IVLEN);
- } else {
- XMEMSET(des3->reg, 0x0, DES3_IVLEN);
- }
- return 0;
-
- }
-#elif defined(FREESCALE_LTC_DES)
-
- #include "fsl_ltc.h"
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- byte* dkey;
-
- if (des == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- dkey = (byte*)des->key;
-
- XMEMCPY(dkey, key, 8);
-
- wc_Des_SetIV(des, iv);
-
- return 0;
- }
-
- int wc_Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
- {
- int ret = 0;
- byte* dkey1;
- byte* dkey2;
- byte* dkey3;
-
- if (des == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- dkey1 = (byte*)des->key[0];
- dkey2 = (byte*)des->key[1];
- dkey3 = (byte*)des->key[2];
-
- XMEMCPY(dkey1, key, 8); /* set key 1 */
- XMEMCPY(dkey2, key + 8, 8); /* set key 2 */
- XMEMCPY(dkey3, key + 16, 8); /* set key 3 */
-
- ret = wc_Des3_SetIV(des, iv);
- if (ret != 0)
- return ret;
-
- return ret;
- }
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- status_t status;
- status = LTC_DES_EncryptCbc(LTC_BASE, in, out, sz, (byte*)des->reg, (byte*)des->key);
- if (status == kStatus_Success)
- return 0;
- else
- return -1;
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- status_t status;
- status = LTC_DES_DecryptCbc(LTC_BASE, in, out, sz, (byte*)des->reg, (byte*)des->key);
- if (status == kStatus_Success)
- return 0;
- else
- return -1;
- }
-
- int wc_Des3_CbcEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- status_t status;
- status = LTC_DES3_EncryptCbc(LTC_BASE,
- in,
- out,
- sz,
- (byte*)des->reg,
- (byte*)des->key[0],
- (byte*)des->key[1],
- (byte*)des->key[2]);
- if (status == kStatus_Success)
- return 0;
- else
- return -1;
- }
-
- int wc_Des3_CbcDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- status_t status;
- status = LTC_DES3_DecryptCbc(LTC_BASE,
- in,
- out,
- sz,
- (byte*)des->reg,
- (byte*)des->key[0],
- (byte*)des->key[1],
- (byte*)des->key[2]);
- if (status == kStatus_Success)
- return 0;
- else
- return -1;
-
- }
-
-#elif defined(FREESCALE_MMCAU)
- /*
- * Freescale mmCAU hardware DES/3DES support through the CAU/mmCAU library.
- * Documentation located in ColdFire/ColdFire+ CAU and Kinetis mmCAU
- * Software Library User Guide (See note in README).
- */
- #ifdef FREESCALE_MMCAU_CLASSIC
- #include "cau_api.h"
- #else
- #include "fsl_mmcau.h"
- #endif
-
- const unsigned char parityLookup[128] = {
- 1,0,0,1,0,1,1,0,0,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,1,0,1,1,0,
- 0,1,1,0,1,0,0,1,1,0,0,1,0,1,1,0,1,0,0,1,0,1,1,0,0,1,1,0,1,0,0,1,
- 0,1,1,0,1,0,0,1,1,0,0,1,0,1,1,0,1,0,0,1,0,1,1,0,0,1,1,0,1,0,0,1,
- 1,0,0,1,0,1,1,0,0,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,1,0,1,1,0
- };
-
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- int i = 0;
- byte* dkey;
-
-
- if (des == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- dkey = (byte*)des->key;
-
- XMEMCPY(dkey, key, 8);
-
- wc_Des_SetIV(des, iv);
-
- /* fix key parity, if needed */
- for (i = 0; i < 8; i++) {
- dkey[i] = ((dkey[i] & 0xFE) | parityLookup[dkey[i] >> 1]);
- }
-
- return 0;
- }
-
- int wc_Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
- {
- int i = 0, ret = 0;
- byte* dkey1;
- byte* dkey2;
- byte* dkey3;
-
- if (des == NULL || key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- dkey1 = (byte*)des->key[0];
- dkey2 = (byte*)des->key[1];
- dkey3 = (byte*)des->key[2];
-
- XMEMCPY(dkey1, key, 8); /* set key 1 */
- XMEMCPY(dkey2, key + 8, 8); /* set key 2 */
- XMEMCPY(dkey3, key + 16, 8); /* set key 3 */
-
- ret = wc_Des3_SetIV(des, iv);
- if (ret != 0)
- return ret;
-
- /* fix key parity if needed */
- for (i = 0; i < 8; i++)
- dkey1[i] = ((dkey1[i] & 0xFE) | parityLookup[dkey1[i] >> 1]);
-
- for (i = 0; i < 8; i++)
- dkey2[i] = ((dkey2[i] & 0xFE) | parityLookup[dkey2[i] >> 1]);
-
- for (i = 0; i < 8; i++)
- dkey3[i] = ((dkey3[i] & 0xFE) | parityLookup[dkey3[i] >> 1]);
-
- return ret;
- }
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
- byte *iv;
- byte temp_block[DES_BLOCK_SIZE];
-
- iv = (byte*)des->reg;
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_des_encrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- /* XOR block with IV for CBC */
- xorbuf(temp_block, iv, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if(ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_encrypt(temp_block, (byte*)des->key, out + offset);
- #else
- MMCAU_DES_EncryptEcb(temp_block, (byte*)des->key, out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
-
- /* store IV for next block */
- XMEMCPY(iv, out + offset - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
- }
-
- return ret;
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
- byte* iv;
- byte temp_block[DES_BLOCK_SIZE];
-
- iv = (byte*)des->reg;
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_des_decrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if(ret != 0) {
- return ret;
- }
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_decrypt(in + offset, (byte*)des->key, out + offset);
- #else
- MMCAU_DES_DecryptEcb(in + offset, (byte*)des->key, out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- /* XOR block with IV for CBC */
- xorbuf(out + offset, iv, DES_BLOCK_SIZE);
-
- /* store IV for next block */
- XMEMCPY(iv, temp_block, DES_BLOCK_SIZE);
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
- }
-
- return ret;
- }
-
- int wc_Des3_CbcEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
-
- byte *iv;
- byte temp_block[DES_BLOCK_SIZE];
-
- iv = (byte*)des->reg;
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad 3ede cau_des_encrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- /* XOR block with IV for CBC */
- xorbuf(temp_block, iv, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if(ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_encrypt(temp_block, (byte*)des->key[0], out + offset);
- cau_des_decrypt(out + offset, (byte*)des->key[1], out + offset);
- cau_des_encrypt(out + offset, (byte*)des->key[2], out + offset);
- #else
- MMCAU_DES_EncryptEcb(temp_block , (byte*)des->key[0], out + offset);
- MMCAU_DES_DecryptEcb(out + offset, (byte*)des->key[1], out + offset);
- MMCAU_DES_EncryptEcb(out + offset, (byte*)des->key[2], out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
-
- /* store IV for next block */
- XMEMCPY(iv, out + offset - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
- }
-
- return ret;
- }
-
- int wc_Des3_CbcDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
-
- byte* iv;
- byte temp_block[DES_BLOCK_SIZE];
-
- iv = (byte*)des->reg;
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad 3ede cau_des_decrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if(ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_decrypt(in + offset, (byte*)des->key[2], out + offset);
- cau_des_encrypt(out + offset, (byte*)des->key[1], out + offset);
- cau_des_decrypt(out + offset, (byte*)des->key[0], out + offset);
- #else
- MMCAU_DES_DecryptEcb(in + offset , (byte*)des->key[2], out + offset);
- MMCAU_DES_EncryptEcb(out + offset, (byte*)des->key[1], out + offset);
- MMCAU_DES_DecryptEcb(out + offset, (byte*)des->key[0], out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- /* XOR block with IV for CBC */
- xorbuf(out + offset, iv, DES_BLOCK_SIZE);
-
- /* store IV for next block */
- XMEMCPY(iv, temp_block, DES_BLOCK_SIZE);
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
- }
-
- return ret;
- }
-
-
-#ifdef WOLFSSL_DES_ECB
- /* One block, compatibility only */
- int wc_Des_EcbEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
- byte temp_block[DES_BLOCK_SIZE];
-
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_des_encrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_encrypt(temp_block, (byte*)des->key, out + offset);
- #else
- MMCAU_DES_EncryptEcb(temp_block, (byte*)des->key, out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
-
- }
- return ret;
-
- }
-
- int wc_Des_EcbDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
- byte temp_block[DES_BLOCK_SIZE];
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad cau_des_decrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_decrypt(in + offset, (byte*)des->key, out + offset);
- #else
- MMCAU_DES_DecryptEcb(in + offset, (byte*)des->key, out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
- }
-
- return ret;
- }
-
- int wc_Des3_EcbEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
-
- byte temp_block[DES_BLOCK_SIZE];
-
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad 3ede cau_des_encrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_encrypt(temp_block, (byte*)des->key[0], out + offset);
- cau_des_decrypt(out + offset, (byte*)des->key[1], out + offset);
- cau_des_encrypt(out + offset, (byte*)des->key[2], out + offset);
- #else
- MMCAU_DES_EncryptEcb(temp_block , (byte*)des->key[0], out + offset);
- MMCAU_DES_DecryptEcb(out + offset, (byte*)des->key[1], out + offset);
- MMCAU_DES_EncryptEcb(out + offset, (byte*)des->key[2], out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
-
- }
-
- return ret;
- }
-
- int wc_Des3_EcbDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- int offset = 0;
- int len = sz;
- int ret = 0;
-
- byte temp_block[DES_BLOCK_SIZE];
-
- #ifdef FREESCALE_MMCAU_CLASSIC
- if ((wc_ptr_t)out % WOLFSSL_MMCAU_ALIGNMENT) {
- WOLFSSL_MSG("Bad 3ede cau_des_decrypt alignment");
- return BAD_ALIGN_E;
- }
- #endif
-
- while (len > 0)
- {
- XMEMCPY(temp_block, in + offset, DES_BLOCK_SIZE);
-
- ret = wolfSSL_CryptHwMutexLock();
- if (ret != 0) {
- return ret;
- }
- #ifdef FREESCALE_MMCAU_CLASSIC
- cau_des_decrypt(in + offset, (byte*)des->key[2], out + offset);
- cau_des_encrypt(out + offset, (byte*)des->key[1], out + offset);
- cau_des_decrypt(out + offset, (byte*)des->key[0], out + offset);
- #else
- MMCAU_DES_DecryptEcb(in + offset , (byte*)des->key[2], out + offset);
- MMCAU_DES_EncryptEcb(out + offset, (byte*)des->key[1], out + offset);
- MMCAU_DES_DecryptEcb(out + offset, (byte*)des->key[0], out + offset);
- #endif
- wolfSSL_CryptHwMutexUnLock();
-
- len -= DES_BLOCK_SIZE;
- offset += DES_BLOCK_SIZE;
- }
-
- return ret;
- }
-#endif /* WOLFSSL_DES_ECB */
-
-
-#elif defined(WOLFSSL_PIC32MZ_CRYPT)
-
- /* PIC32MZ DES hardware requires size multiple of block size */
- #include
-
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- if (des == NULL || key == NULL || iv == NULL)
- return BAD_FUNC_ARG;
-
- XMEMCPY(des->key, key, DES_KEYLEN);
- XMEMCPY(des->reg, iv, DES_IVLEN);
-
- return 0;
- }
-
- int wc_Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
- {
- if (des == NULL || key == NULL || iv == NULL)
- return BAD_FUNC_ARG;
-
- XMEMCPY(des->key[0], key, DES3_KEYLEN);
- XMEMCPY(des->reg, iv, DES3_IVLEN);
-
- return 0;
- }
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key, DES_KEYLEN, des->reg, DES_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_ENCRYPTION, PIC32_ALGO_DES, PIC32_CRYPTOALGO_CBC);
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key, DES_KEYLEN, des->reg, DES_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_DECRYPTION, PIC32_ALGO_DES, PIC32_CRYPTOALGO_CBC);
- }
-
- int wc_Des3_CbcEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key[0], DES3_KEYLEN, des->reg, DES3_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_ENCRYPTION, PIC32_ALGO_TDES, PIC32_CRYPTOALGO_TCBC);
- }
-
- int wc_Des3_CbcDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key[0], DES3_KEYLEN, des->reg, DES3_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_DECRYPTION, PIC32_ALGO_TDES, PIC32_CRYPTOALGO_TCBC);
- }
-
- #ifdef WOLFSSL_DES_ECB
- int wc_Des_EcbEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key, DES_KEYLEN, des->reg, DES_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_ENCRYPTION, PIC32_ALGO_DES, PIC32_CRYPTOALGO_ECB);
- }
-
- int wc_Des3_EcbEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL)
- return BAD_FUNC_ARG;
-
- return wc_Pic32DesCrypt(des->key[0], DES3_KEYLEN, des->reg, DES3_IVLEN,
- out, in, (blocks * DES_BLOCK_SIZE),
- PIC32_ENCRYPTION, PIC32_ALGO_TDES, PIC32_CRYPTOALGO_TECB);
- }
- #endif /* WOLFSSL_DES_ECB */
-
-#else
- #define NEED_SOFT_DES
-
-#endif
-
-
-#ifdef NEED_SOFT_DES
-
- /* permuted choice table (key) */
- static const FLASH_QUALIFIER byte pc1[] = {
- 57, 49, 41, 33, 25, 17, 9,
- 1, 58, 50, 42, 34, 26, 18,
- 10, 2, 59, 51, 43, 35, 27,
- 19, 11, 3, 60, 52, 44, 36,
-
- 63, 55, 47, 39, 31, 23, 15,
- 7, 62, 54, 46, 38, 30, 22,
- 14, 6, 61, 53, 45, 37, 29,
- 21, 13, 5, 28, 20, 12, 4
- };
-
- /* number left rotations of pc1 */
- static const FLASH_QUALIFIER byte totrot[] = {
- 1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28
- };
-
- /* permuted choice key (table) */
- static const FLASH_QUALIFIER byte pc2[] = {
- 14, 17, 11, 24, 1, 5,
- 3, 28, 15, 6, 21, 10,
- 23, 19, 12, 4, 26, 8,
- 16, 7, 27, 20, 13, 2,
- 41, 52, 31, 37, 47, 55,
- 30, 40, 51, 45, 33, 48,
- 44, 49, 39, 56, 34, 53,
- 46, 42, 50, 36, 29, 32
- };
-
- /* End of DES-defined tables */
-
- /* bit 0 is left-most in byte */
- static const FLASH_QUALIFIER int bytebit[] = {
- 0200,0100,040,020,010,04,02,01
- };
-
- static const FLASH_QUALIFIER word32 Spbox[8][64] = {
- { 0x01010400,0x00000000,0x00010000,0x01010404,
- 0x01010004,0x00010404,0x00000004,0x00010000,
- 0x00000400,0x01010400,0x01010404,0x00000400,
- 0x01000404,0x01010004,0x01000000,0x00000004,
- 0x00000404,0x01000400,0x01000400,0x00010400,
- 0x00010400,0x01010000,0x01010000,0x01000404,
- 0x00010004,0x01000004,0x01000004,0x00010004,
- 0x00000000,0x00000404,0x00010404,0x01000000,
- 0x00010000,0x01010404,0x00000004,0x01010000,
- 0x01010400,0x01000000,0x01000000,0x00000400,
- 0x01010004,0x00010000,0x00010400,0x01000004,
- 0x00000400,0x00000004,0x01000404,0x00010404,
- 0x01010404,0x00010004,0x01010000,0x01000404,
- 0x01000004,0x00000404,0x00010404,0x01010400,
- 0x00000404,0x01000400,0x01000400,0x00000000,
- 0x00010004,0x00010400,0x00000000,0x01010004},
- { 0x80108020,0x80008000,0x00008000,0x00108020,
- 0x00100000,0x00000020,0x80100020,0x80008020,
- 0x80000020,0x80108020,0x80108000,0x80000000,
- 0x80008000,0x00100000,0x00000020,0x80100020,
- 0x00108000,0x00100020,0x80008020,0x00000000,
- 0x80000000,0x00008000,0x00108020,0x80100000,
- 0x00100020,0x80000020,0x00000000,0x00108000,
- 0x00008020,0x80108000,0x80100000,0x00008020,
- 0x00000000,0x00108020,0x80100020,0x00100000,
- 0x80008020,0x80100000,0x80108000,0x00008000,
- 0x80100000,0x80008000,0x00000020,0x80108020,
- 0x00108020,0x00000020,0x00008000,0x80000000,
- 0x00008020,0x80108000,0x00100000,0x80000020,
- 0x00100020,0x80008020,0x80000020,0x00100020,
- 0x00108000,0x00000000,0x80008000,0x00008020,
- 0x80000000,0x80100020,0x80108020,0x00108000},
- { 0x00000208,0x08020200,0x00000000,0x08020008,
- 0x08000200,0x00000000,0x00020208,0x08000200,
- 0x00020008,0x08000008,0x08000008,0x00020000,
- 0x08020208,0x00020008,0x08020000,0x00000208,
- 0x08000000,0x00000008,0x08020200,0x00000200,
- 0x00020200,0x08020000,0x08020008,0x00020208,
- 0x08000208,0x00020200,0x00020000,0x08000208,
- 0x00000008,0x08020208,0x00000200,0x08000000,
- 0x08020200,0x08000000,0x00020008,0x00000208,
- 0x00020000,0x08020200,0x08000200,0x00000000,
- 0x00000200,0x00020008,0x08020208,0x08000200,
- 0x08000008,0x00000200,0x00000000,0x08020008,
- 0x08000208,0x00020000,0x08000000,0x08020208,
- 0x00000008,0x00020208,0x00020200,0x08000008,
- 0x08020000,0x08000208,0x00000208,0x08020000,
- 0x00020208,0x00000008,0x08020008,0x00020200},
- { 0x00802001,0x00002081,0x00002081,0x00000080,
- 0x00802080,0x00800081,0x00800001,0x00002001,
- 0x00000000,0x00802000,0x00802000,0x00802081,
- 0x00000081,0x00000000,0x00800080,0x00800001,
- 0x00000001,0x00002000,0x00800000,0x00802001,
- 0x00000080,0x00800000,0x00002001,0x00002080,
- 0x00800081,0x00000001,0x00002080,0x00800080,
- 0x00002000,0x00802080,0x00802081,0x00000081,
- 0x00800080,0x00800001,0x00802000,0x00802081,
- 0x00000081,0x00000000,0x00000000,0x00802000,
- 0x00002080,0x00800080,0x00800081,0x00000001,
- 0x00802001,0x00002081,0x00002081,0x00000080,
- 0x00802081,0x00000081,0x00000001,0x00002000,
- 0x00800001,0x00002001,0x00802080,0x00800081,
- 0x00002001,0x00002080,0x00800000,0x00802001,
- 0x00000080,0x00800000,0x00002000,0x00802080},
- { 0x00000100,0x02080100,0x02080000,0x42000100,
- 0x00080000,0x00000100,0x40000000,0x02080000,
- 0x40080100,0x00080000,0x02000100,0x40080100,
- 0x42000100,0x42080000,0x00080100,0x40000000,
- 0x02000000,0x40080000,0x40080000,0x00000000,
- 0x40000100,0x42080100,0x42080100,0x02000100,
- 0x42080000,0x40000100,0x00000000,0x42000000,
- 0x02080100,0x02000000,0x42000000,0x00080100,
- 0x00080000,0x42000100,0x00000100,0x02000000,
- 0x40000000,0x02080000,0x42000100,0x40080100,
- 0x02000100,0x40000000,0x42080000,0x02080100,
- 0x40080100,0x00000100,0x02000000,0x42080000,
- 0x42080100,0x00080100,0x42000000,0x42080100,
- 0x02080000,0x00000000,0x40080000,0x42000000,
- 0x00080100,0x02000100,0x40000100,0x00080000,
- 0x00000000,0x40080000,0x02080100,0x40000100},
- { 0x20000010,0x20400000,0x00004000,0x20404010,
- 0x20400000,0x00000010,0x20404010,0x00400000,
- 0x20004000,0x00404010,0x00400000,0x20000010,
- 0x00400010,0x20004000,0x20000000,0x00004010,
- 0x00000000,0x00400010,0x20004010,0x00004000,
- 0x00404000,0x20004010,0x00000010,0x20400010,
- 0x20400010,0x00000000,0x00404010,0x20404000,
- 0x00004010,0x00404000,0x20404000,0x20000000,
- 0x20004000,0x00000010,0x20400010,0x00404000,
- 0x20404010,0x00400000,0x00004010,0x20000010,
- 0x00400000,0x20004000,0x20000000,0x00004010,
- 0x20000010,0x20404010,0x00404000,0x20400000,
- 0x00404010,0x20404000,0x00000000,0x20400010,
- 0x00000010,0x00004000,0x20400000,0x00404010,
- 0x00004000,0x00400010,0x20004010,0x00000000,
- 0x20404000,0x20000000,0x00400010,0x20004010},
- { 0x00200000,0x04200002,0x04000802,0x00000000,
- 0x00000800,0x04000802,0x00200802,0x04200800,
- 0x04200802,0x00200000,0x00000000,0x04000002,
- 0x00000002,0x04000000,0x04200002,0x00000802,
- 0x04000800,0x00200802,0x00200002,0x04000800,
- 0x04000002,0x04200000,0x04200800,0x00200002,
- 0x04200000,0x00000800,0x00000802,0x04200802,
- 0x00200800,0x00000002,0x04000000,0x00200800,
- 0x04000000,0x00200800,0x00200000,0x04000802,
- 0x04000802,0x04200002,0x04200002,0x00000002,
- 0x00200002,0x04000000,0x04000800,0x00200000,
- 0x04200800,0x00000802,0x00200802,0x04200800,
- 0x00000802,0x04000002,0x04200802,0x04200000,
- 0x00200800,0x00000000,0x00000002,0x04200802,
- 0x00000000,0x00200802,0x04200000,0x00000800,
- 0x04000002,0x04000800,0x00000800,0x00200002},
- { 0x10001040,0x00001000,0x00040000,0x10041040,
- 0x10000000,0x10001040,0x00000040,0x10000000,
- 0x00040040,0x10040000,0x10041040,0x00041000,
- 0x10041000,0x00041040,0x00001000,0x00000040,
- 0x10040000,0x10000040,0x10001000,0x00001040,
- 0x00041000,0x00040040,0x10040040,0x10041000,
- 0x00001040,0x00000000,0x00000000,0x10040040,
- 0x10000040,0x10001000,0x00041040,0x00040000,
- 0x00041040,0x00040000,0x10041000,0x00001000,
- 0x00000040,0x10040040,0x00001000,0x00041040,
- 0x10001000,0x00000040,0x10000040,0x10040000,
- 0x10040040,0x10000000,0x00040000,0x10001040,
- 0x00000000,0x10041040,0x00040040,0x10000040,
- 0x10040000,0x10001000,0x10001040,0x00000000,
- 0x10041040,0x00041000,0x00041000,0x00001040,
- 0x00001040,0x00040040,0x10000000,0x10041000}
- };
-
- static WC_INLINE void IPERM(word32* left, word32* right)
- {
- word32 work;
-
- *right = rotlFixed(*right, 4U);
- work = (*left ^ *right) & 0xf0f0f0f0;
- *left ^= work;
-
- *right = rotrFixed(*right^work, 20U);
- work = (*left ^ *right) & 0xffff0000;
- *left ^= work;
-
- *right = rotrFixed(*right^work, 18U);
- work = (*left ^ *right) & 0x33333333;
- *left ^= work;
-
- *right = rotrFixed(*right^work, 6U);
- work = (*left ^ *right) & 0x00ff00ff;
- *left ^= work;
-
- *right = rotlFixed(*right^work, 9U);
- work = (*left ^ *right) & 0xaaaaaaaa;
- *left = rotlFixed(*left^work, 1U);
- *right ^= work;
- }
-
- static WC_INLINE void FPERM(word32* left, word32* right)
- {
- word32 work;
-
- *right = rotrFixed(*right, 1U);
- work = (*left ^ *right) & 0xaaaaaaaa;
- *right ^= work;
-
- *left = rotrFixed(*left^work, 9U);
- work = (*left ^ *right) & 0x00ff00ff;
- *right ^= work;
-
- *left = rotlFixed(*left^work, 6U);
- work = (*left ^ *right) & 0x33333333;
- *right ^= work;
-
- *left = rotlFixed(*left^work, 18U);
- work = (*left ^ *right) & 0xffff0000;
- *right ^= work;
-
- *left = rotlFixed(*left^work, 20U);
- work = (*left ^ *right) & 0xf0f0f0f0;
- *right ^= work;
-
- *left = rotrFixed(*left^work, 4U);
- }
-
- static int DesSetKey(const byte* key, int dir, word32* out)
- {
- #define DES_KEY_BUFFER_SIZE (56+56+8)
- #ifdef WOLFSSL_SMALL_STACK
- byte* buffer = (byte*)XMALLOC(DES_KEY_BUFFER_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-
- if (buffer == NULL)
- return MEMORY_E;
- #else
- byte buffer[DES_KEY_BUFFER_SIZE];
- #endif
-
- {
- byte* const pc1m = buffer; /* place to modify pc1 into */
- byte* const pcr = pc1m + 56; /* place to rotate pc1 into */
- byte* const ks = pcr + 56;
- int i, j, l;
- int m;
-
- for (j = 0; j < 56; j++) { /* convert pc1 to bits of key */
- l = pc1[j] - 1; /* integer bit location */
- m = l & 07; /* find bit */
- pc1m[j] = (key[l >> 3] & /* find which key byte l is in */
- bytebit[m]) /* and which bit of that byte */
- ? 1 : 0; /* and store 1-bit result */
- }
-
- for (i = 0; i < 16; i++) { /* key chunk for each iteration */
- XMEMSET(ks, 0, 8); /* Clear key schedule */
-
- for (j = 0; j < 56; j++) /* rotate pc1 the right amount */
- pcr[j] =
- pc1m[(l = j + totrot[i]) < (j < 28 ? 28 : 56) ? l : l-28];
-
- /* rotate left and right halves independently */
- for (j = 0; j < 48; j++) { /* select bits individually */
- if (pcr[pc2[j] - 1]) { /* check bit that goes to ks[j] */
- l= j % 6; /* mask it in if it's there */
- ks[j/6] |= (byte)(bytebit[l] >> 2);
- }
- }
-
- /* Now convert to odd/even interleaved form for use in F */
- out[2*i] = ((word32) ks[0] << 24)
- | ((word32) ks[2] << 16)
- | ((word32) ks[4] << 8)
- | ((word32) ks[6]);
-
- out[2*i + 1] = ((word32) ks[1] << 24)
- | ((word32) ks[3] << 16)
- | ((word32) ks[5] << 8)
- | ((word32) ks[7]);
- }
-
- /* reverse key schedule order */
- if (dir == DES_DECRYPTION) {
- for (i = 0; i < 16; i += 2) {
- word32 swap = out[i];
- out[i] = out[DES_KS_SIZE - 2 - i];
- out[DES_KS_SIZE - 2 - i] = swap;
-
- swap = out[i + 1];
- out[i + 1] = out[DES_KS_SIZE - 1 - i];
- out[DES_KS_SIZE - 1 - i] = swap;
- }
- }
-
- WC_FREE_VAR_EX(buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
- }
-
- return 0;
- }
-
- int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
- {
- wc_Des_SetIV(des, iv);
-
- return DesSetKey(key, dir, des->key);
- }
-
- int wc_Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
- {
- int ret;
-
- if (des == NULL || key == NULL || dir < 0) {
- return BAD_FUNC_ARG;
- }
-
- XMEMSET(des->key, 0, sizeof(*(des->key)));
- XMEMSET(des->reg, 0, sizeof(*(des->reg)));
- XMEMSET(des->tmp, 0, sizeof(*(des->tmp)));
-
- #if defined(WOLF_CRYPTO_CB) || \
- (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES))
- #ifdef WOLF_CRYPTO_CB
- if (des->devId != INVALID_DEVID)
- #endif
- {
- XMEMCPY(des->devKey, key, DES3_KEYLEN);
- }
- #endif
-
- ret = DesSetKey(key + (dir == DES_ENCRYPTION ? 0:16), dir, des->key[0]);
- if (ret != 0)
- return ret;
-
- ret = DesSetKey(key + 8, !dir, des->key[1]);
- if (ret != 0)
- return ret;
-
- ret = DesSetKey(key + (dir == DES_DECRYPTION ? 0:16), dir, des->key[2]);
- if (ret != 0)
- return ret;
-
- return wc_Des3_SetIV(des, iv);
- }
-
- static void DesRawProcessBlock(word32* lIn, word32* rIn, const word32* kptr)
- {
- word32 l = *lIn, r = *rIn, i;
-
- for (i=0; i<8; i++)
- {
- word32 work = rotrFixed(r, 4U) ^ kptr[4*i+0];
- l ^= Spbox[6][(work) & 0x3f]
- ^ Spbox[4][(work >> 8) & 0x3f]
- ^ Spbox[2][(work >> 16) & 0x3f]
- ^ Spbox[0][(work >> 24) & 0x3f];
- work = r ^ kptr[4*i+1];
- l ^= Spbox[7][(work) & 0x3f]
- ^ Spbox[5][(work >> 8) & 0x3f]
- ^ Spbox[3][(work >> 16) & 0x3f]
- ^ Spbox[1][(work >> 24) & 0x3f];
-
- work = rotrFixed(l, 4U) ^ kptr[4*i+2];
- r ^= Spbox[6][(work) & 0x3f]
- ^ Spbox[4][(work >> 8) & 0x3f]
- ^ Spbox[2][(work >> 16) & 0x3f]
- ^ Spbox[0][(work >> 24) & 0x3f];
- work = l ^ kptr[4*i+3];
- r ^= Spbox[7][(work) & 0x3f]
- ^ Spbox[5][(work >> 8) & 0x3f]
- ^ Spbox[3][(work >> 16) & 0x3f]
- ^ Spbox[1][(work >> 24) & 0x3f];
- }
-
- *lIn = l; *rIn = r;
- }
-
- static void DesProcessBlock(Des* des, const byte* in, byte* out)
- {
- word32 l = 0, r = 0;
-
- XMEMCPY(&l, in, sizeof(l));
- XMEMCPY(&r, in + sizeof(l), sizeof(r));
- #ifdef LITTLE_ENDIAN_ORDER
- l = ByteReverseWord32(l);
- r = ByteReverseWord32(r);
- #endif
- IPERM(&l,&r);
-
- DesRawProcessBlock(&l, &r, des->key);
-
- FPERM(&l,&r);
- #ifdef LITTLE_ENDIAN_ORDER
- l = ByteReverseWord32(l);
- r = ByteReverseWord32(r);
- #endif
- XMEMCPY(out, &r, sizeof(r));
- XMEMCPY(out + sizeof(r), &l, sizeof(l));
- }
-
- static void Des3ProcessBlock(Des3* des, const byte* in, byte* out)
- {
- word32 l = 0, r = 0;
-
- XMEMCPY(&l, in, sizeof(l));
- XMEMCPY(&r, in + sizeof(l), sizeof(r));
- #ifdef LITTLE_ENDIAN_ORDER
- l = ByteReverseWord32(l);
- r = ByteReverseWord32(r);
- #endif
- IPERM(&l,&r);
-
- DesRawProcessBlock(&l, &r, des->key[0]);
- DesRawProcessBlock(&r, &l, des->key[1]);
- DesRawProcessBlock(&l, &r, des->key[2]);
-
- FPERM(&l,&r);
- #ifdef LITTLE_ENDIAN_ORDER
- l = ByteReverseWord32(l);
- r = ByteReverseWord32(r);
- #endif
- XMEMCPY(out, &r, sizeof(r));
- XMEMCPY(out + sizeof(r), &l, sizeof(l));
- }
-
- int wc_Des_CbcEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- while (blocks--) {
- xorbuf((byte*)des->reg, in, DES_BLOCK_SIZE);
- DesProcessBlock(des, (byte*)des->reg, (byte*)des->reg);
- XMEMCPY(out, des->reg, DES_BLOCK_SIZE);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
-
- int wc_Des_CbcDecrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- while (blocks--) {
- XMEMCPY(des->tmp, in, DES_BLOCK_SIZE);
- DesProcessBlock(des, (byte*)des->tmp, out);
- xorbuf(out, (byte*)des->reg, DES_BLOCK_SIZE);
- XMEMCPY(des->reg, des->tmp, DES_BLOCK_SIZE);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
-
- int wc_Des3_CbcEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- #ifdef WOLF_CRYPTO_CB
- if (des->devId != INVALID_DEVID) {
- int ret = wc_CryptoCb_Des3Encrypt(des, out, in, sz);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- /* fall-through when unavailable */
- }
- #endif
-
- #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES)
- if (des->asyncDev.marker == WOLFSSL_ASYNC_MARKER_3DES &&
- sz >= WC_ASYNC_THRESH_DES3_CBC) {
- #if defined(HAVE_CAVIUM)
- return NitroxDes3CbcEncrypt(des, out, in, sz);
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymDes3CbcEncrypt(&des->asyncDev, out, in, sz,
- (const byte*)des->devKey, DES3_KEYLEN, (byte*)des->reg, DES3_IVLEN);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&des->asyncDev, ASYNC_SW_DES3_CBC_ENCRYPT)) {
- WC_ASYNC_SW* sw = &des->asyncDev.sw;
- sw->des.des = des;
- sw->des.out = out;
- sw->des.in = in;
- sw->des.sz = sz;
- return WC_PENDING_E;
- }
- #endif
- }
- #endif /* WOLFSSL_ASYNC_CRYPT */
-
- blocks = sz / DES_BLOCK_SIZE;
- while (blocks--) {
- xorbuf((byte*)des->reg, in, DES_BLOCK_SIZE);
- Des3ProcessBlock(des, (byte*)des->reg, (byte*)des->reg);
- XMEMCPY(out, des->reg, DES_BLOCK_SIZE);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
-
-
- int wc_Des3_CbcDecrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- #ifdef WOLF_CRYPTO_CB
- if (des->devId != INVALID_DEVID) {
- int ret = wc_CryptoCb_Des3Decrypt(des, out, in, sz);
- if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
- return ret;
- /* fall-through when unavailable */
- }
- #endif
-
- #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES)
- if (des->asyncDev.marker == WOLFSSL_ASYNC_MARKER_3DES &&
- sz >= WC_ASYNC_THRESH_DES3_CBC) {
- #if defined(HAVE_CAVIUM)
- return NitroxDes3CbcDecrypt(des, out, in, sz);
- #elif defined(HAVE_INTEL_QA)
- return IntelQaSymDes3CbcDecrypt(&des->asyncDev, out, in, sz,
- (const byte*)des->devKey, DES3_KEYLEN, (byte*)des->reg, DES3_IVLEN);
- #elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&des->asyncDev, ASYNC_SW_DES3_CBC_DECRYPT)) {
- WC_ASYNC_SW* sw = &des->asyncDev.sw;
- sw->des.des = des;
- sw->des.out = out;
- sw->des.in = in;
- sw->des.sz = sz;
- return WC_PENDING_E;
- }
- #endif
- }
- #endif /* WOLFSSL_ASYNC_CRYPT */
-
- blocks = sz / DES_BLOCK_SIZE;
- while (blocks--) {
- XMEMCPY(des->tmp, in, DES_BLOCK_SIZE);
- Des3ProcessBlock(des, (byte*)des->tmp, out);
- xorbuf(out, (byte*)des->reg, DES_BLOCK_SIZE);
- XMEMCPY(des->reg, des->tmp, DES_BLOCK_SIZE);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
-
- #ifdef WOLFSSL_DES_ECB
- /* One block, compatibility only */
- int wc_Des_EcbEncrypt(Des* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- while (blocks--) {
- DesProcessBlock(des, in, out);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
-
- int wc_Des3_EcbEncrypt(Des3* des, byte* out, const byte* in, word32 sz)
- {
- word32 blocks = sz / DES_BLOCK_SIZE;
-
- if (des == NULL || out == NULL || in == NULL) {
- return BAD_FUNC_ARG;
- }
-
- while (blocks--) {
- Des3ProcessBlock(des, in, out);
-
- out += DES_BLOCK_SIZE;
- in += DES_BLOCK_SIZE;
- }
- return 0;
- }
- #endif /* WOLFSSL_DES_ECB */
-
-#endif /* NEED_SOFT_DES */
-
-
-void wc_Des_SetIV(Des* des, const byte* iv)
-{
- if (des && iv) {
- XMEMCPY(des->reg, iv, DES_BLOCK_SIZE);
- #if defined(STM32_CRYPTO) && !defined(STM32_CRYPTO_AES_ONLY) && defined(STM32_HAL_V2)
- ByteReverseWords(des->reg, des->reg, DES_BLOCK_SIZE);
- #endif
- }
- else if (des)
- XMEMSET(des->reg, 0, DES_BLOCK_SIZE);
-}
-
-int wc_Des3_SetIV(Des3* des, const byte* iv)
-{
- if (des == NULL) {
- return BAD_FUNC_ARG;
- }
- if (iv) {
- XMEMCPY(des->reg, iv, DES_BLOCK_SIZE);
- #if defined(STM32_CRYPTO) && !defined(STM32_CRYPTO_AES_ONLY) && defined(STM32_HAL_V2)
- ByteReverseWords(des->reg, des->reg, DES_BLOCK_SIZE);
- #endif
- }
- else
- XMEMSET(des->reg, 0, DES_BLOCK_SIZE);
-
- return 0;
-}
-
-
-/* Initialize Des3 for use with async device */
-int wc_Des3Init(Des3* des3, void* heap, int devId)
-{
- int ret = 0;
- if (des3 == NULL)
- return BAD_FUNC_ARG;
-
- des3->heap = heap;
-
-#ifdef WOLF_CRYPTO_CB
- des3->devId = devId;
- des3->devCtx = NULL;
-#else
- (void)devId;
-#endif
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES)
- ret = wolfAsync_DevCtxInit(&des3->asyncDev, WOLFSSL_ASYNC_MARKER_3DES,
- des3->heap, devId);
-#endif
-#if defined(WOLFSSL_CHECK_MEM_ZERO) && (defined(WOLF_CRYPTO_CB) || \
- (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES)))
- wc_MemZero_Add("DES3 devKey", &des3->devKey, sizeof(des3->devKey));
-#endif
-
- return ret;
-}
-
-/* Free Des3 from use with async device */
-void wc_Des3Free(Des3* des3)
-{
- if (des3 == NULL)
- return;
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES)
- wolfAsync_DevCtxFree(&des3->asyncDev, WOLFSSL_ASYNC_MARKER_3DES);
-#endif /* WOLFSSL_ASYNC_CRYPT */
-#if defined(WOLF_CRYPTO_CB) || \
- (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_3DES))
- ForceZero(des3->devKey, sizeof(des3->devKey));
-#endif
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Check(des3, sizeof(Des3));
-#endif
-}
-
-#endif /* WOLFSSL_TI_CRYPT */
-#endif /* NO_DES3 */
diff --git a/src/ssl/wolfssl/wolfcrypt/dh.c b/src/ssl/wolfssl/wolfcrypt/dh.c
deleted file mode 100644
index 1035cbc65..000000000
--- a/src/ssl/wolfssl/wolfcrypt/dh.c
+++ /dev/null
@@ -1,3329 +0,0 @@
-/* dh.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-#ifndef NO_DH
-
-#if defined(HAVE_FIPS) && \
- defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
-
- /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
- #define FIPS_NO_WRAPPERS
-
- #ifdef USE_WINDOWS_API
- #pragma code_seg(".fipsA$e")
- #pragma const_seg(".fipsB$e")
- #endif
-#endif
-
-#include
-
-#ifdef WOLFSSL_HAVE_SP_DH
-#include
-#endif
-
-#ifdef NO_INLINE
- #include
-#else
- #define WOLFSSL_MISC_INCLUDED
- #include
-#endif
-
-#if FIPS_VERSION3_GE(6,0,0)
- const unsigned int wolfCrypt_FIPS_dh_ro_sanity[2] =
- { 0x1a2b3c4d, 0x00000004 };
- int wolfCrypt_FIPS_DH_sanity(void)
- {
- return 0;
- }
-#endif
-
-#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && !defined(WOLFSSL_SP_ASM)
- /* force off unneeded vector register save/restore. */
- #undef SAVE_VECTOR_REGISTERS
- #define SAVE_VECTOR_REGISTERS(fail_clause) SAVE_NO_VECTOR_REGISTERS(fail_clause)
- #undef RESTORE_VECTOR_REGISTERS
- #define RESTORE_VECTOR_REGISTERS() RESTORE_NO_VECTOR_REGISTERS()
-#endif
-
-/*
-Possible DH enable options:
- * NO_RSA: Overall control of DH default: on (not defined)
- * WOLFSSL_OLD_PRIME_CHECK: Disables the new prime number check. It does not
- directly effect this file, but it does speed up DH
- removing the testing. It is not recommended to
- disable the prime checking. default: off
- * WOLFSSL_VALIDATE_DH_KEYGEN: Enable DH key gen consistency checking
- * (on for FIPS 140-3 or later) default: off
-*/
-
-
-#if !defined(USER_MATH_LIB) && !defined(WOLFSSL_DH_CONST)
- #include
- #define XPOW(x,y) pow((x),(y))
- #define XLOG(x) log((x))
-#else
- /* user's own math lib */
-#endif
-
-#ifdef HAVE_FFDHE_2048
-static const byte dh_ffdhe2048_p[] = {
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A,
- 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1,
- 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95,
- 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB,
- 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9,
- 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8,
- 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A,
- 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61,
- 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0,
- 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3,
- 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35,
- 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77,
- 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72,
- 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35,
- 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A,
- 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61,
- 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB,
- 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68,
- 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4,
- 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19,
- 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70,
- 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC,
- 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61,
- 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF,
- 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83,
- 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73,
- 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05,
- 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2,
- 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA,
- 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-static const byte dh_ffdhe2048_g[] = { 0x02 };
-#ifdef HAVE_FFDHE_Q
-static const byte dh_ffdhe2048_q[] = {
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
- 0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
- 0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
- 0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
- 0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
- 0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
- 0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
- 0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
- 0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
- 0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
- 0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
- 0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
- 0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
- 0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
- 0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
- 0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
- 0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
- 0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
- 0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
- 0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
- 0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
- 0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
- 0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
- 0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
- 0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
- 0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
- 0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
- 0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
- 0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
- 0x44, 0x35, 0xA1, 0x1C, 0x30, 0x94, 0x2E, 0x4B,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-#endif /* HAVE_FFDHE_Q */
-
-#ifdef HAVE_PUBLIC_FFDHE
-const DhParams* wc_Dh_ffdhe2048_Get(void)
-{
- static const DhParams ffdhe2048 = {
- #ifdef HAVE_FFDHE_Q
- dh_ffdhe2048_q, sizeof(dh_ffdhe2048_q),
- #endif /* HAVE_FFDHE_Q */
- dh_ffdhe2048_p, sizeof(dh_ffdhe2048_p),
- dh_ffdhe2048_g, sizeof(dh_ffdhe2048_g)
- };
- return &ffdhe2048;
-}
-#endif
-#endif
-
-#ifdef HAVE_FFDHE_3072
-static const byte dh_ffdhe3072_p[] = {
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A,
- 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1,
- 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95,
- 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB,
- 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9,
- 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8,
- 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A,
- 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61,
- 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0,
- 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3,
- 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35,
- 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77,
- 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72,
- 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35,
- 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A,
- 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61,
- 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB,
- 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68,
- 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4,
- 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19,
- 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70,
- 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC,
- 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61,
- 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF,
- 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83,
- 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73,
- 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05,
- 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2,
- 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA,
- 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC,
- 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B,
- 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38,
- 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07,
- 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE,
- 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C,
- 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70,
- 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44,
- 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3,
- 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF,
- 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E,
- 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D,
- 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA,
- 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E,
- 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF,
- 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C,
- 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0xC6, 0x2E, 0x37,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-static const byte dh_ffdhe3072_g[] = { 0x02 };
-#ifdef HAVE_FFDHE_Q
-static const byte dh_ffdhe3072_q[] = {
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
- 0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
- 0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
- 0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
- 0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
- 0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
- 0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
- 0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
- 0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
- 0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
- 0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
- 0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
- 0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
- 0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
- 0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
- 0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
- 0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
- 0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
- 0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
- 0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
- 0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
- 0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
- 0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
- 0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
- 0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
- 0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
- 0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
- 0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
- 0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
- 0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
- 0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
- 0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
- 0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
- 0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
- 0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
- 0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
- 0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
- 0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
- 0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
- 0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
- 0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
- 0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
- 0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
- 0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
- 0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
- 0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x63, 0x17, 0x1B,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-#endif /* HAVE_FFDHE_Q */
-
-#ifdef HAVE_PUBLIC_FFDHE
-const DhParams* wc_Dh_ffdhe3072_Get(void)
-{
- static const DhParams ffdhe3072 = {
- #ifdef HAVE_FFDHE_Q
- dh_ffdhe3072_q, sizeof(dh_ffdhe3072_q),
- #endif /* HAVE_FFDHE_Q */
- dh_ffdhe3072_p, sizeof(dh_ffdhe3072_p),
- dh_ffdhe3072_g, sizeof(dh_ffdhe3072_g)
- };
- return &ffdhe3072;
-}
-#endif
-#endif
-
-#ifdef HAVE_FFDHE_4096
-static const byte dh_ffdhe4096_p[] = {
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A,
- 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1,
- 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95,
- 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB,
- 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9,
- 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8,
- 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A,
- 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61,
- 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0,
- 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3,
- 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35,
- 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77,
- 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72,
- 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35,
- 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A,
- 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61,
- 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB,
- 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68,
- 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4,
- 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19,
- 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70,
- 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC,
- 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61,
- 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF,
- 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83,
- 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73,
- 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05,
- 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2,
- 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA,
- 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC,
- 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B,
- 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38,
- 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07,
- 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE,
- 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C,
- 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70,
- 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44,
- 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3,
- 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF,
- 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E,
- 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D,
- 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA,
- 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E,
- 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF,
- 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C,
- 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1,
- 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB,
- 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6,
- 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18,
- 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04,
- 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A,
- 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A,
- 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32,
- 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4,
- 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38,
- 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A,
- 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C,
- 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC,
- 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF,
- 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B,
- 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1,
- 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x65, 0x5F, 0x6A,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-static const byte dh_ffdhe4096_g[] = { 0x02 };
-#ifdef HAVE_FFDHE_Q
-static const byte dh_ffdhe4096_q[] = {
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
- 0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
- 0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
- 0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
- 0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
- 0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
- 0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
- 0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
- 0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
- 0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
- 0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
- 0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
- 0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
- 0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
- 0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
- 0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
- 0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
- 0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
- 0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
- 0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
- 0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
- 0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
- 0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
- 0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
- 0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
- 0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
- 0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
- 0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
- 0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
- 0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
- 0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
- 0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
- 0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
- 0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
- 0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
- 0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
- 0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
- 0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
- 0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
- 0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
- 0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
- 0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
- 0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
- 0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
- 0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
- 0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
- 0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
- 0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
- 0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
- 0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
- 0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
- 0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
- 0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
- 0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
- 0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
- 0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
- 0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
- 0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
- 0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
- 0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
- 0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
- 0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x32, 0xAF, 0xB5,
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-#endif /* HAVE_FFDHE_Q */
-
-#ifdef HAVE_PUBLIC_FFDHE
-const DhParams* wc_Dh_ffdhe4096_Get(void)
-{
- static const DhParams ffdhe4096 = {
- #ifdef HAVE_FFDHE_Q
- dh_ffdhe4096_q, sizeof(dh_ffdhe4096_q),
- #endif /* HAVE_FFDHE_Q */
- dh_ffdhe4096_p, sizeof(dh_ffdhe4096_p),
- dh_ffdhe4096_g, sizeof(dh_ffdhe4096_g)
- };
- return &ffdhe4096;
-}
-#endif
-#endif
-
-#ifdef HAVE_FFDHE_6144
-static const byte dh_ffdhe6144_p[] = {
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A,
- 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1,
- 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95,
- 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB,
- 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9,
- 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8,
- 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A,
- 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61,
- 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0,
- 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3,
- 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35,
- 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77,
- 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72,
- 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35,
- 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A,
- 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61,
- 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB,
- 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68,
- 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4,
- 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19,
- 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70,
- 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC,
- 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61,
- 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF,
- 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83,
- 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73,
- 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05,
- 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2,
- 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA,
- 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC,
- 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B,
- 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38,
- 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07,
- 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE,
- 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C,
- 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70,
- 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44,
- 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3,
- 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF,
- 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E,
- 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D,
- 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA,
- 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E,
- 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF,
- 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C,
- 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1,
- 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB,
- 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6,
- 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18,
- 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04,
- 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A,
- 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A,
- 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32,
- 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4,
- 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38,
- 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A,
- 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C,
- 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC,
- 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF,
- 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B,
- 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1,
- 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02,
- 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A,
- 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A,
- 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6,
- 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8,
- 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C,
- 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A,
- 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71,
- 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F,
- 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77,
- 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10,
- 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8,
- 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3,
- 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E,
- 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3,
- 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4,
- 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1,
- 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92,
- 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6,
- 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82,
- 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE,
- 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C,
- 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E,
- 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46,
- 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A,
- 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17,
- 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03,
- 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04,
- 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6,
- 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69,
- 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1,
- 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4,
- 0xA4, 0x0E, 0x32, 0x9C, 0xD0, 0xE4, 0x0E, 0x65,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-static const byte dh_ffdhe6144_g[] = { 0x02 };
-#ifdef HAVE_FFDHE_Q
-static const byte dh_ffdhe6144_q[] = {
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
- 0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
- 0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
- 0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
- 0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
- 0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
- 0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
- 0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
- 0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
- 0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
- 0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
- 0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
- 0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
- 0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
- 0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
- 0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
- 0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
- 0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
- 0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
- 0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
- 0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
- 0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
- 0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
- 0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
- 0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
- 0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
- 0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
- 0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
- 0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
- 0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
- 0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
- 0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
- 0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
- 0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
- 0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
- 0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
- 0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
- 0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
- 0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
- 0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
- 0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
- 0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
- 0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
- 0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
- 0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
- 0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
- 0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
- 0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
- 0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
- 0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
- 0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
- 0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
- 0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
- 0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
- 0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
- 0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
- 0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
- 0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
- 0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
- 0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
- 0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
- 0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x06, 0xEC, 0x81,
- 0x05, 0xFE, 0xB2, 0x5B, 0x22, 0x81, 0xB6, 0x3D,
- 0x27, 0x33, 0xBE, 0x96, 0x1C, 0x29, 0x95, 0x1D,
- 0x11, 0xDD, 0x22, 0x21, 0x65, 0x7A, 0x9F, 0x53,
- 0x1D, 0xDA, 0x2A, 0x19, 0x4D, 0xBB, 0x12, 0x64,
- 0x48, 0xBD, 0xEE, 0xB2, 0x58, 0xE0, 0x7E, 0xA6,
- 0x59, 0xC7, 0x46, 0x19, 0xA6, 0x38, 0x0E, 0x1D,
- 0x66, 0xD6, 0x83, 0x2B, 0xFE, 0x67, 0xF6, 0x38,
- 0xCD, 0x8F, 0xAE, 0x1F, 0x27, 0x23, 0x02, 0x0F,
- 0x9C, 0x40, 0xA3, 0xFD, 0xA6, 0x7E, 0xDA, 0x3B,
- 0xD2, 0x92, 0x38, 0xFB, 0xD4, 0xD4, 0xB4, 0x88,
- 0x5C, 0x2A, 0x99, 0x17, 0x6D, 0xB1, 0xA0, 0x6C,
- 0x50, 0x07, 0x78, 0x49, 0x1A, 0x82, 0x88, 0xF1,
- 0x85, 0x5F, 0x60, 0xFF, 0xFC, 0xF1, 0xD1, 0x37,
- 0x3F, 0xD9, 0x4F, 0xC6, 0x0C, 0x18, 0x11, 0xE1,
- 0xAC, 0x3F, 0x1C, 0x6D, 0x00, 0x3B, 0xEC, 0xDA,
- 0x3B, 0x1F, 0x27, 0x25, 0xCA, 0x59, 0x5D, 0xE0,
- 0xCA, 0x63, 0x32, 0x8F, 0x3B, 0xE5, 0x7C, 0xC9,
- 0x77, 0x55, 0x60, 0x11, 0x95, 0x14, 0x0D, 0xFB,
- 0x59, 0xD3, 0x9C, 0xE0, 0x91, 0x30, 0x8B, 0x41,
- 0x05, 0x74, 0x6D, 0xAC, 0x23, 0xD3, 0x3E, 0x5F,
- 0x7C, 0xE4, 0x84, 0x8D, 0xA3, 0x16, 0xA9, 0xC6,
- 0x6B, 0x95, 0x81, 0xBA, 0x35, 0x73, 0xBF, 0xAF,
- 0x31, 0x14, 0x96, 0x18, 0x8A, 0xB1, 0x54, 0x23,
- 0x28, 0x2E, 0xE4, 0x16, 0xDC, 0x2A, 0x19, 0xC5,
- 0x72, 0x4F, 0xA9, 0x1A, 0xE4, 0xAD, 0xC8, 0x8B,
- 0xC6, 0x67, 0x96, 0xEA, 0xE5, 0x67, 0x7A, 0x01,
- 0xF6, 0x4E, 0x8C, 0x08, 0x63, 0x13, 0x95, 0x82,
- 0x2D, 0x9D, 0xB8, 0xFC, 0xEE, 0x35, 0xC0, 0x6B,
- 0x1F, 0xEE, 0xA5, 0x47, 0x4D, 0x6D, 0x8F, 0x34,
- 0xB1, 0x53, 0x4A, 0x93, 0x6A, 0x18, 0xB0, 0xE0,
- 0xD2, 0x0E, 0xAB, 0x86, 0xBC, 0x9C, 0x6D, 0x6A,
- 0x52, 0x07, 0x19, 0x4E, 0x68, 0x72, 0x07, 0x32,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-#endif /* HAVE_FFDHE_Q */
-
-#ifdef HAVE_PUBLIC_FFDHE
-const DhParams* wc_Dh_ffdhe6144_Get(void)
-{
- static const DhParams ffdhe6144 = {
- #ifdef HAVE_FFDHE_Q
- dh_ffdhe6144_q, sizeof(dh_ffdhe6144_q),
- #endif /* HAVE_FFDHE_Q */
- dh_ffdhe6144_p, sizeof(dh_ffdhe6144_p),
- dh_ffdhe6144_g, sizeof(dh_ffdhe6144_g)
- };
- return &ffdhe6144;
-}
-#endif
-#endif
-
-#ifdef HAVE_FFDHE_8192
-static const byte dh_ffdhe8192_p[] = {
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A,
- 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1,
- 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95,
- 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB,
- 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9,
- 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8,
- 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A,
- 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61,
- 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0,
- 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3,
- 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35,
- 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77,
- 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72,
- 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35,
- 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A,
- 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61,
- 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB,
- 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68,
- 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4,
- 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19,
- 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70,
- 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC,
- 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61,
- 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF,
- 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83,
- 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73,
- 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05,
- 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2,
- 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA,
- 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC,
- 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B,
- 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38,
- 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07,
- 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE,
- 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C,
- 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70,
- 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44,
- 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3,
- 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF,
- 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E,
- 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D,
- 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA,
- 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E,
- 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF,
- 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C,
- 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1,
- 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB,
- 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6,
- 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18,
- 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04,
- 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A,
- 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A,
- 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32,
- 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4,
- 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38,
- 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A,
- 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C,
- 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC,
- 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF,
- 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B,
- 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1,
- 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02,
- 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A,
- 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A,
- 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6,
- 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8,
- 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C,
- 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A,
- 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71,
- 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F,
- 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77,
- 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10,
- 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8,
- 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3,
- 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E,
- 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3,
- 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4,
- 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1,
- 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92,
- 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6,
- 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82,
- 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE,
- 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C,
- 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E,
- 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46,
- 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A,
- 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17,
- 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03,
- 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04,
- 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6,
- 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69,
- 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1,
- 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4,
- 0xA4, 0x0E, 0x32, 0x9C, 0xCF, 0xF4, 0x6A, 0xAA,
- 0x36, 0xAD, 0x00, 0x4C, 0xF6, 0x00, 0xC8, 0x38,
- 0x1E, 0x42, 0x5A, 0x31, 0xD9, 0x51, 0xAE, 0x64,
- 0xFD, 0xB2, 0x3F, 0xCE, 0xC9, 0x50, 0x9D, 0x43,
- 0x68, 0x7F, 0xEB, 0x69, 0xED, 0xD1, 0xCC, 0x5E,
- 0x0B, 0x8C, 0xC3, 0xBD, 0xF6, 0x4B, 0x10, 0xEF,
- 0x86, 0xB6, 0x31, 0x42, 0xA3, 0xAB, 0x88, 0x29,
- 0x55, 0x5B, 0x2F, 0x74, 0x7C, 0x93, 0x26, 0x65,
- 0xCB, 0x2C, 0x0F, 0x1C, 0xC0, 0x1B, 0xD7, 0x02,
- 0x29, 0x38, 0x88, 0x39, 0xD2, 0xAF, 0x05, 0xE4,
- 0x54, 0x50, 0x4A, 0xC7, 0x8B, 0x75, 0x82, 0x82,
- 0x28, 0x46, 0xC0, 0xBA, 0x35, 0xC3, 0x5F, 0x5C,
- 0x59, 0x16, 0x0C, 0xC0, 0x46, 0xFD, 0x82, 0x51,
- 0x54, 0x1F, 0xC6, 0x8C, 0x9C, 0x86, 0xB0, 0x22,
- 0xBB, 0x70, 0x99, 0x87, 0x6A, 0x46, 0x0E, 0x74,
- 0x51, 0xA8, 0xA9, 0x31, 0x09, 0x70, 0x3F, 0xEE,
- 0x1C, 0x21, 0x7E, 0x6C, 0x38, 0x26, 0xE5, 0x2C,
- 0x51, 0xAA, 0x69, 0x1E, 0x0E, 0x42, 0x3C, 0xFC,
- 0x99, 0xE9, 0xE3, 0x16, 0x50, 0xC1, 0x21, 0x7B,
- 0x62, 0x48, 0x16, 0xCD, 0xAD, 0x9A, 0x95, 0xF9,
- 0xD5, 0xB8, 0x01, 0x94, 0x88, 0xD9, 0xC0, 0xA0,
- 0xA1, 0xFE, 0x30, 0x75, 0xA5, 0x77, 0xE2, 0x31,
- 0x83, 0xF8, 0x1D, 0x4A, 0x3F, 0x2F, 0xA4, 0x57,
- 0x1E, 0xFC, 0x8C, 0xE0, 0xBA, 0x8A, 0x4F, 0xE8,
- 0xB6, 0x85, 0x5D, 0xFE, 0x72, 0xB0, 0xA6, 0x6E,
- 0xDE, 0xD2, 0xFB, 0xAB, 0xFB, 0xE5, 0x8A, 0x30,
- 0xFA, 0xFA, 0xBE, 0x1C, 0x5D, 0x71, 0xA8, 0x7E,
- 0x2F, 0x74, 0x1E, 0xF8, 0xC1, 0xFE, 0x86, 0xFE,
- 0xA6, 0xBB, 0xFD, 0xE5, 0x30, 0x67, 0x7F, 0x0D,
- 0x97, 0xD1, 0x1D, 0x49, 0xF7, 0xA8, 0x44, 0x3D,
- 0x08, 0x22, 0xE5, 0x06, 0xA9, 0xF4, 0x61, 0x4E,
- 0x01, 0x1E, 0x2A, 0x94, 0x83, 0x8F, 0xF8, 0x8C,
- 0xD6, 0x8C, 0x8B, 0xB7, 0xC5, 0xC6, 0x42, 0x4C,
- 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-static const byte dh_ffdhe8192_g[] = { 0x02 };
-#ifdef HAVE_FFDHE_Q
-static const byte dh_ffdhe8192_q[] = {
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
- 0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
- 0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
- 0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
- 0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
- 0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
- 0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
- 0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
- 0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
- 0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
- 0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
- 0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
- 0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
- 0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
- 0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
- 0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
- 0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
- 0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
- 0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
- 0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
- 0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
- 0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
- 0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
- 0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
- 0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
- 0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
- 0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
- 0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
- 0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
- 0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
- 0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
- 0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
- 0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
- 0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
- 0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
- 0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
- 0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
- 0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
- 0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
- 0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
- 0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
- 0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
- 0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
- 0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
- 0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
- 0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
- 0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
- 0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
- 0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
- 0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
- 0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
- 0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
- 0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
- 0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
- 0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
- 0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
- 0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
- 0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
- 0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
- 0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
- 0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
- 0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
- 0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x06, 0xEC, 0x81,
- 0x05, 0xFE, 0xB2, 0x5B, 0x22, 0x81, 0xB6, 0x3D,
- 0x27, 0x33, 0xBE, 0x96, 0x1C, 0x29, 0x95, 0x1D,
- 0x11, 0xDD, 0x22, 0x21, 0x65, 0x7A, 0x9F, 0x53,
- 0x1D, 0xDA, 0x2A, 0x19, 0x4D, 0xBB, 0x12, 0x64,
- 0x48, 0xBD, 0xEE, 0xB2, 0x58, 0xE0, 0x7E, 0xA6,
- 0x59, 0xC7, 0x46, 0x19, 0xA6, 0x38, 0x0E, 0x1D,
- 0x66, 0xD6, 0x83, 0x2B, 0xFE, 0x67, 0xF6, 0x38,
- 0xCD, 0x8F, 0xAE, 0x1F, 0x27, 0x23, 0x02, 0x0F,
- 0x9C, 0x40, 0xA3, 0xFD, 0xA6, 0x7E, 0xDA, 0x3B,
- 0xD2, 0x92, 0x38, 0xFB, 0xD4, 0xD4, 0xB4, 0x88,
- 0x5C, 0x2A, 0x99, 0x17, 0x6D, 0xB1, 0xA0, 0x6C,
- 0x50, 0x07, 0x78, 0x49, 0x1A, 0x82, 0x88, 0xF1,
- 0x85, 0x5F, 0x60, 0xFF, 0xFC, 0xF1, 0xD1, 0x37,
- 0x3F, 0xD9, 0x4F, 0xC6, 0x0C, 0x18, 0x11, 0xE1,
- 0xAC, 0x3F, 0x1C, 0x6D, 0x00, 0x3B, 0xEC, 0xDA,
- 0x3B, 0x1F, 0x27, 0x25, 0xCA, 0x59, 0x5D, 0xE0,
- 0xCA, 0x63, 0x32, 0x8F, 0x3B, 0xE5, 0x7C, 0xC9,
- 0x77, 0x55, 0x60, 0x11, 0x95, 0x14, 0x0D, 0xFB,
- 0x59, 0xD3, 0x9C, 0xE0, 0x91, 0x30, 0x8B, 0x41,
- 0x05, 0x74, 0x6D, 0xAC, 0x23, 0xD3, 0x3E, 0x5F,
- 0x7C, 0xE4, 0x84, 0x8D, 0xA3, 0x16, 0xA9, 0xC6,
- 0x6B, 0x95, 0x81, 0xBA, 0x35, 0x73, 0xBF, 0xAF,
- 0x31, 0x14, 0x96, 0x18, 0x8A, 0xB1, 0x54, 0x23,
- 0x28, 0x2E, 0xE4, 0x16, 0xDC, 0x2A, 0x19, 0xC5,
- 0x72, 0x4F, 0xA9, 0x1A, 0xE4, 0xAD, 0xC8, 0x8B,
- 0xC6, 0x67, 0x96, 0xEA, 0xE5, 0x67, 0x7A, 0x01,
- 0xF6, 0x4E, 0x8C, 0x08, 0x63, 0x13, 0x95, 0x82,
- 0x2D, 0x9D, 0xB8, 0xFC, 0xEE, 0x35, 0xC0, 0x6B,
- 0x1F, 0xEE, 0xA5, 0x47, 0x4D, 0x6D, 0x8F, 0x34,
- 0xB1, 0x53, 0x4A, 0x93, 0x6A, 0x18, 0xB0, 0xE0,
- 0xD2, 0x0E, 0xAB, 0x86, 0xBC, 0x9C, 0x6D, 0x6A,
- 0x52, 0x07, 0x19, 0x4E, 0x67, 0xFA, 0x35, 0x55,
- 0x1B, 0x56, 0x80, 0x26, 0x7B, 0x00, 0x64, 0x1C,
- 0x0F, 0x21, 0x2D, 0x18, 0xEC, 0xA8, 0xD7, 0x32,
- 0x7E, 0xD9, 0x1F, 0xE7, 0x64, 0xA8, 0x4E, 0xA1,
- 0xB4, 0x3F, 0xF5, 0xB4, 0xF6, 0xE8, 0xE6, 0x2F,
- 0x05, 0xC6, 0x61, 0xDE, 0xFB, 0x25, 0x88, 0x77,
- 0xC3, 0x5B, 0x18, 0xA1, 0x51, 0xD5, 0xC4, 0x14,
- 0xAA, 0xAD, 0x97, 0xBA, 0x3E, 0x49, 0x93, 0x32,
- 0xE5, 0x96, 0x07, 0x8E, 0x60, 0x0D, 0xEB, 0x81,
- 0x14, 0x9C, 0x44, 0x1C, 0xE9, 0x57, 0x82, 0xF2,
- 0x2A, 0x28, 0x25, 0x63, 0xC5, 0xBA, 0xC1, 0x41,
- 0x14, 0x23, 0x60, 0x5D, 0x1A, 0xE1, 0xAF, 0xAE,
- 0x2C, 0x8B, 0x06, 0x60, 0x23, 0x7E, 0xC1, 0x28,
- 0xAA, 0x0F, 0xE3, 0x46, 0x4E, 0x43, 0x58, 0x11,
- 0x5D, 0xB8, 0x4C, 0xC3, 0xB5, 0x23, 0x07, 0x3A,
- 0x28, 0xD4, 0x54, 0x98, 0x84, 0xB8, 0x1F, 0xF7,
- 0x0E, 0x10, 0xBF, 0x36, 0x1C, 0x13, 0x72, 0x96,
- 0x28, 0xD5, 0x34, 0x8F, 0x07, 0x21, 0x1E, 0x7E,
- 0x4C, 0xF4, 0xF1, 0x8B, 0x28, 0x60, 0x90, 0xBD,
- 0xB1, 0x24, 0x0B, 0x66, 0xD6, 0xCD, 0x4A, 0xFC,
- 0xEA, 0xDC, 0x00, 0xCA, 0x44, 0x6C, 0xE0, 0x50,
- 0x50, 0xFF, 0x18, 0x3A, 0xD2, 0xBB, 0xF1, 0x18,
- 0xC1, 0xFC, 0x0E, 0xA5, 0x1F, 0x97, 0xD2, 0x2B,
- 0x8F, 0x7E, 0x46, 0x70, 0x5D, 0x45, 0x27, 0xF4,
- 0x5B, 0x42, 0xAE, 0xFF, 0x39, 0x58, 0x53, 0x37,
- 0x6F, 0x69, 0x7D, 0xD5, 0xFD, 0xF2, 0xC5, 0x18,
- 0x7D, 0x7D, 0x5F, 0x0E, 0x2E, 0xB8, 0xD4, 0x3F,
- 0x17, 0xBA, 0x0F, 0x7C, 0x60, 0xFF, 0x43, 0x7F,
- 0x53, 0x5D, 0xFE, 0xF2, 0x98, 0x33, 0xBF, 0x86,
- 0xCB, 0xE8, 0x8E, 0xA4, 0xFB, 0xD4, 0x22, 0x1E,
- 0x84, 0x11, 0x72, 0x83, 0x54, 0xFA, 0x30, 0xA7,
- 0x00, 0x8F, 0x15, 0x4A, 0x41, 0xC7, 0xFC, 0x46,
- 0x6B, 0x46, 0x45, 0xDB, 0xE2, 0xE3, 0x21, 0x26,
- 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-#endif /* HAVE_FFDHE_Q */
-
-#ifdef HAVE_PUBLIC_FFDHE
-const DhParams* wc_Dh_ffdhe8192_Get(void)
-{
- static const DhParams ffdhe8192 = {
- #ifdef HAVE_FFDHE_Q
- dh_ffdhe8192_q, sizeof(dh_ffdhe8192_q),
- #endif /* HAVE_FFDHE_Q */
- dh_ffdhe8192_p, sizeof(dh_ffdhe8192_p),
- dh_ffdhe8192_g, sizeof(dh_ffdhe8192_g)
- };
- return &ffdhe8192;
-}
-#endif
-#endif
-
-int wc_InitDhKey_ex(DhKey* key, void* heap, int devId)
-{
- int ret = 0;
-
- if (key == NULL)
- return BAD_FUNC_ARG;
-
- key->heap = heap; /* for XMALLOC/XFREE in future */
- key->trustedGroup = 0;
-
-#ifdef WOLFSSL_DH_EXTRA
- if (mp_init_multi(&key->p, &key->g, &key->q, &key->pub, &key->priv, NULL) != MP_OKAY)
-#else
- if (mp_init_multi(&key->p, &key->g, &key->q, NULL, NULL, NULL) != MP_OKAY)
-#endif
- return MEMORY_E;
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
- /* handle as async */
- ret = wolfAsync_DevCtxInit(&key->asyncDev, WOLFSSL_ASYNC_MARKER_DH,
- key->heap, devId);
-#else
- (void)devId;
-#endif
-
- key->trustedGroup = 0;
-
-#ifdef WOLFSSL_KCAPI_DH
- key->handle = NULL;
-#endif
-
- return ret;
-}
-
-int wc_InitDhKey(DhKey* key)
-{
- return wc_InitDhKey_ex(key, NULL, INVALID_DEVID);
-}
-
-
-int wc_FreeDhKey(DhKey* key)
-{
- if (key) {
- mp_clear(&key->p);
- mp_clear(&key->g);
- mp_clear(&key->q);
- #ifdef WOLFSSL_DH_EXTRA
- mp_clear(&key->pub);
- mp_forcezero(&key->priv);
- #endif
-
- #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
- wolfAsync_DevCtxFree(&key->asyncDev, WOLFSSL_ASYNC_MARKER_DH);
- #endif
- #ifdef WOLFSSL_KCAPI_DH
- KcapiDh_Free(key);
- #endif
- }
- return 0;
-}
-
-
-static int _ffc_validate_public_key(DhKey* key, const byte* pub, word32 pubSz,
- const byte* prime, word32 primeSz, int partial);
-#if FIPS_VERSION_GE(5,0) || defined(WOLFSSL_VALIDATE_DH_KEYGEN)
-static int _ffc_pairwise_consistency_test(DhKey* key,
- const byte* pub, word32 pubSz, const byte* priv, word32 privSz);
-#endif
-
-#ifndef WOLFSSL_KCAPI_DH
-
-#ifndef WC_NO_RNG
-/* if defined to not use floating point values do not compile in */
-#ifndef WOLFSSL_DH_CONST
- static word32 DiscreteLogWorkFactor(word32 n)
- {
- /* assuming discrete log takes about the same time as factoring */
- if (n < 5)
- return 0;
- else
- return (word32)((double)2.4 * XPOW((double)n, 1.0/3.0) *
- XPOW(XLOG((double)n), 2.0/3.0) - 5);
- }
-#endif /* WOLFSSL_DH_CONST*/
-
-
-/* if not using fixed points use DiscreteLogWorkFactor function for unusual size
- otherwise round up on size needed */
-#ifndef WOLFSSL_DH_CONST
- #define WOLFSSL_DH_ROUND(x) WC_DO_NOTHING
-#else
- #define WOLFSSL_DH_ROUND(x) \
- do { \
- if (x % 128) { \
- x &= 0xffffff80;\
- x += 128; \
- } \
- } \
- while (0)
-#endif
-
-
-#ifndef WOLFSSL_NO_DH186
-/* validate that (L,N) match allowed sizes from SP 800-56A, Section 5.5.1.1.
- * modLen - represents L, the size of p in bits
- * divLen - represents N, the size of q in bits
- * return 0 on success, -1 on error */
-static int CheckDhLN(word32 modLen, word32 divLen)
-{
- int ret = -1;
-
- switch (modLen) {
- /* FA */
- case 1024:
- if (divLen == 160)
- ret = 0;
- break;
- /* FB, FC */
- case 2048:
- if (divLen == 224 || divLen == 256)
- ret = 0;
- break;
- default:
- break;
- }
-
- return ret;
-}
-
-
-/* Create DH private key
- *
- * Based on NIST SP 800-56Ar3
- * "5.6.1.1.3 Key Pair Generation Using Extra Random Bits"
- *
- * dh - pointer to initialized DhKey structure, needs to have dh->q
- * rng - pointer to initialized WC_RNG structure
- * priv - output location for generated private key
- * privSz - IN/OUT, size of priv buffer, size of generated private key
- *
- * return 0 on success, negative on error */
-static int GeneratePrivateDh186(DhKey* key, WC_RNG* rng, byte* priv,
- word32* privSz)
-{
- word32 qSz, pSz, cSz;
- int err;
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* tmpQ = NULL;
- mp_int* tmpX = NULL;
- byte* cBuf = NULL;
-#else
- mp_int tmpQ[1], tmpX[1];
- byte cBuf[DH_MAX_SIZE + 64 / WOLFSSL_BIT_SIZE];
-#endif
-
- /* Parameters validated in calling functions. */
-
- if (mp_iszero(&key->q) == MP_YES) {
- WOLFSSL_MSG("DH q parameter needed for FIPS 186-4 key generation");
- return BAD_FUNC_ARG;
- }
-
- qSz = (word32)mp_unsigned_bin_size(&key->q);
- pSz = (word32)mp_unsigned_bin_size(&key->p);
-
- /* verify (L,N) pair bit lengths */
- /* Trusted primes don't need to be checked. */
- if (!key->trustedGroup &&
- CheckDhLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) {
- WOLFSSL_MSG("DH param sizes do not match SP 800-56A requirements");
- return BAD_FUNC_ARG;
- }
-
- /* generate extra 64 bits so that bias from mod function is negligible */
- cSz = *privSz + (64 / WOLFSSL_BIT_SIZE);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- cBuf = (byte*)XMALLOC(cSz, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
- if (cBuf == NULL) {
- return MEMORY_E;
- }
- tmpQ = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (tmpQ == NULL) {
- XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
- return MEMORY_E;
- }
- tmpX = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (tmpX == NULL) {
- XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
- XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
-
-
- if ((err = mp_init_multi(tmpX, tmpQ, NULL, NULL, NULL, NULL))
- != MP_OKAY) {
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
- XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
- XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
-#endif
- return err;
- }
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- wc_MemZero_Add("GeneratePrivateDh186 cBuf", cBuf, cSz); /* cppcheck-suppress uninitvar */
- mp_memzero_add("GeneratePrivateDh186 tmpX", tmpX);
-#endif
- do {
- /* generate N+64 bits (c) from RBG into tmpX, making sure positive.
- * Hash_DRBG uses SHA-256 which matches maximum
- * requested_security_strength of (L,N) */
- err = wc_RNG_GenerateBlock(rng, cBuf, cSz);
- if (err == MP_OKAY)
- err = mp_read_unsigned_bin(tmpX, cBuf, cSz);
- if (err != MP_OKAY) {
- mp_clear(tmpX);
- mp_clear(tmpQ);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
- XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
- XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
-#endif
- return err;
- }
- } while (mp_cmp_d(tmpX, 1) != MP_GT);
-
- ForceZero(cBuf, cSz);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- wc_MemZero_Check(cBuf, cSz);
-#endif
-
- /* tmpQ: M = min(2^N,q) - 1 */
- if (err == MP_OKAY)
- err = mp_2expt(tmpQ, (int)*privSz * 8);
-
- if (err == MP_OKAY) {
- if (mp_cmp(tmpQ, &key->q) == MP_GT) {
- err = mp_copy(&key->q, tmpQ);
- }
- }
-
- if (err == MP_OKAY)
- err = mp_sub_d(tmpQ, 1, tmpQ);
-
- /* x = c mod (M), tmpX holds c */
- if (err == MP_OKAY)
- err = mp_mod(tmpX, tmpQ, tmpX);
-
- /* x = c mod (M) + 1 */
- if (err == MP_OKAY)
- err = mp_add_d(tmpX, 1, tmpX);
-
- /* copy tmpX into priv */
- if (err == MP_OKAY) {
- pSz = (word32)mp_unsigned_bin_size(tmpX);
- if (pSz > *privSz) {
- WOLFSSL_MSG("DH private key output buffer too small");
- err = BAD_FUNC_ARG;
- } else {
- *privSz = pSz;
- err = mp_to_unsigned_bin(tmpX, priv);
- }
- }
-
- mp_forcezero(tmpX);
- mp_clear(tmpQ);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
- XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- mp_memzero_check(tmpX);
-#endif
-
- return err;
-}
-#endif /* WOLFSSL_NO_DH186 */
-#endif /* !WC_NO_RNG */
-
-static int GeneratePrivateDh(DhKey* key, WC_RNG* rng, byte* priv,
- word32* privSz)
-{
-#ifndef WC_NO_RNG
- int ret = 0;
- word32 sz = 0;
-
- if (mp_iseven(&key->p) == MP_YES) {
- ret = MP_VAL;
- }
- else
-#ifndef WOLFSSL_NO_DH186
- if (mp_iszero(&key->q) == MP_NO) {
-
- /* q param available, use NIST SP 800-56Ar3, "5.6.1.1.3 Key Pair
- * Generation Using Extra Random Bits" */
- ret = GeneratePrivateDh186(key, rng, priv, privSz);
-
- }
- else
-#endif
- {
-
- sz = (word32)mp_unsigned_bin_size(&key->p);
-
- /* Table of predetermined values from the operation
- 2 * DiscreteLogWorkFactor(sz * WOLFSSL_BIT_SIZE) /
- WOLFSSL_BIT_SIZE + 1
- Sizes in table checked against RFC 3526
- */
- WOLFSSL_DH_ROUND(sz); /* if using fixed points only, then round up */
- switch (sz) {
- case 128: sz = 21; break;
- case 256: sz = 29; break;
- case 384: sz = 34; break;
- case 512: sz = 39; break;
- case 640: sz = 42; break;
- case 768: sz = 46; break;
- case 896: sz = 49; break;
- case 1024: sz = 52; break;
- default:
- #ifndef WOLFSSL_DH_CONST
- /* if using floating points and size of p is not in table */
- sz = min(sz, 2 * DiscreteLogWorkFactor(sz * WOLFSSL_BIT_SIZE) /
- WOLFSSL_BIT_SIZE + 1);
- break;
- #else
- return BAD_FUNC_ARG;
- #endif
- }
-
- if (sz > *privSz)
- ret = WC_KEY_SIZE_E;
-
- if (ret == 0)
- ret = wc_RNG_GenerateBlock(rng, priv, sz);
-
- if (ret == 0) {
- priv[0] |= 0x0C;
- *privSz = sz;
- }
- }
-
- return ret;
-#else
- (void)key;
- (void)rng;
- (void)priv;
- (void)privSz;
- return NOT_COMPILED_IN;
-#endif /* WC_NO_RNG */
-}
-
-
-static int GeneratePublicDh(DhKey* key, byte* priv, word32 privSz,
- byte* pub, word32* pubSz)
-{
- int ret = 0;
-#ifndef WOLFSSL_SP_MATH
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* x;
- mp_int* y;
-#else
- mp_int x[1];
- mp_int y[1];
-#endif
-#endif
-
- if (*pubSz < (word32)mp_unsigned_bin_size(&key->p)) {
- return WC_KEY_SIZE_E;
- }
-
-#ifdef WOLFSSL_HAVE_SP_DH
-#ifndef WOLFSSL_SP_NO_2048
- if (mp_count_bits(&key->p) == 2048)
- return sp_DhExp_2048(&key->g, priv, privSz, &key->p, pub, pubSz);
-#endif
-#ifndef WOLFSSL_SP_NO_3072
- if (mp_count_bits(&key->p) == 3072)
- return sp_DhExp_3072(&key->g, priv, privSz, &key->p, pub, pubSz);
-#endif
-#ifdef WOLFSSL_SP_4096
- if (mp_count_bits(&key->p) == 4096)
- return sp_DhExp_4096(&key->g, priv, privSz, &key->p, pub, pubSz);
-#endif
-#endif
-
-#if !defined(WOLFSSL_SP_MATH)
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (x == NULL)
- return MEMORY_E;
- y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (y == NULL) {
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
- if (mp_init_multi(x, y, 0, 0, 0, 0) != MP_OKAY) {
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return MP_INIT_E;
- }
-
- if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY)
- ret = MP_READ_E;
-
- if (ret == 0 && mp_exptmod(&key->g, x, &key->p, y) != MP_OKAY)
- ret = MP_EXPTMOD_E;
-
- if (ret == 0 && mp_to_unsigned_bin(y, pub) != MP_OKAY)
- ret = MP_TO_E;
-
- if (ret == 0)
- *pubSz = (word32)mp_unsigned_bin_size(y);
-
- mp_clear(y);
- mp_forcezero(x);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
-#endif
-#else
- ret = WC_KEY_SIZE_E;
-#endif
-
- return ret;
-}
-
-/**
- * Given a DhKey with set params and a priv key, generate the corresponding
- * public key. If fips, does pub key validation.
- * */
-int wc_DhGeneratePublic(DhKey* key, byte* priv, word32 privSz,
- byte* pub, word32* pubSz)
-{
- int ret = 0;
-
- if (key == NULL || priv == NULL || privSz == 0 ||
- pub == NULL || pubSz == NULL) {
- return BAD_FUNC_ARG;
- }
-
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-
- ret = GeneratePublicDh(key, priv, privSz, pub, pubSz);
-
- #if FIPS_VERSION_GE(5,0) || defined(WOLFSSL_VALIDATE_DH_KEYGEN)
- if (ret == 0)
- ret = _ffc_validate_public_key(key, pub, *pubSz, NULL, 0, 0);
- if (ret == 0)
- ret = _ffc_pairwise_consistency_test(key, pub, *pubSz, priv, privSz);
- #endif /* FIPS V5 or later || WOLFSSL_VALIDATE_DH_KEYGEN */
-
- RESTORE_VECTOR_REGISTERS();
-
- return ret;
-}
-
-static int wc_DhGenerateKeyPair_Sync(DhKey* key, WC_RNG* rng,
- byte* priv, word32* privSz, byte* pub, word32* pubSz)
-{
- int ret;
-
- if (key == NULL || rng == NULL || priv == NULL || privSz == NULL ||
- pub == NULL || pubSz == NULL) {
- return BAD_FUNC_ARG;
- }
-
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-
- ret = GeneratePrivateDh(key, rng, priv, privSz);
-
- if (ret == 0)
- ret = GeneratePublicDh(key, priv, *privSz, pub, pubSz);
-#if FIPS_VERSION_GE(5,0) || defined(WOLFSSL_VALIDATE_DH_KEYGEN)
- if (ret == 0)
- ret = _ffc_validate_public_key(key, pub, *pubSz, NULL, 0, 0);
- if (ret == 0)
- ret = _ffc_pairwise_consistency_test(key, pub, *pubSz, priv, *privSz);
-#endif /* FIPS V5 or later || WOLFSSL_VALIDATE_DH_KEYGEN */
-
-
- RESTORE_VECTOR_REGISTERS();
-
- return ret;
-}
-#endif /* !WOLFSSL_KCAPI_DH */
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
-static int wc_DhGenerateKeyPair_Async(DhKey* key, WC_RNG* rng,
- byte* priv, word32* privSz, byte* pub, word32* pubSz)
-{
- int ret;
-
-#if defined(HAVE_INTEL_QA)
- word32 pBits;
-
- /* QAT DH sizes: 768, 1024, 1536, 2048, 3072 and 4096 bits */
- pBits = mp_unsigned_bin_size(&key->p) * 8;
- if (pBits == 768 || pBits == 1024 || pBits == 1536 ||
- pBits == 2048 || pBits == 3072 || pBits == 4096) {
- mp_int x;
-
- ret = mp_init(&x);
- if (ret != MP_OKAY)
- return ret;
-
- ret = GeneratePrivateDh(key, rng, priv, privSz);
- if (ret == 0)
- ret = mp_read_unsigned_bin(&x, priv, *privSz);
- if (ret == MP_OKAY)
- ret = wc_mp_to_bigint(&x, &x.raw);
- if (ret == MP_OKAY)
- ret = wc_mp_to_bigint(&key->p, &key->p.raw);
- if (ret == MP_OKAY)
- ret = wc_mp_to_bigint(&key->g, &key->g.raw);
- if (ret == MP_OKAY)
- ret = IntelQaDhKeyGen(&key->asyncDev, &key->p.raw, &key->g.raw,
- &x.raw, pub, pubSz);
- mp_clear(&x);
-
- return ret;
- }
-
-#elif defined(HAVE_CAVIUM)
- /* TODO: Not implemented - use software for now */
-
-#elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&key->asyncDev, ASYNC_SW_DH_GEN)) {
- WC_ASYNC_SW* sw = &key->asyncDev.sw;
- sw->dhGen.key = key;
- sw->dhGen.rng = rng;
- sw->dhGen.priv = priv;
- sw->dhGen.privSz = privSz;
- sw->dhGen.pub = pub;
- sw->dhGen.pubSz = pubSz;
- return WC_PENDING_E;
- }
-#endif
-
- /* otherwise use software DH */
- ret = wc_DhGenerateKeyPair_Sync(key, rng, priv, privSz, pub, pubSz);
-
- return ret;
-}
-#endif /* WOLFSSL_ASYNC_CRYPT && WC_ASYNC_ENABLE_DH */
-
-
-/* Check DH Public Key for invalid numbers, optionally allowing
- * the public key to be checked against the large prime (q).
- * If q is NULL, the q value of key is used.
- * Check per process in SP 800-56Ar3, section 5.6.2.3.1 or 2.
- *
- * key DH key group parameters.
- * pub Public Key.
- * pubSz Public Key size.
- * prime Large prime (q), optionally NULL to skip check
- * primeSz Size of large prime
- * partial Do the partial test process. (section 5.6.2.3.2)
- *
- * returns 0 on success or error code
- */
-static int _ffc_validate_public_key(DhKey* key, const byte* pub, word32 pubSz,
- const byte* prime, word32 primeSz, int partial)
-{
- int ret = 0;
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* y = NULL;
- mp_int* p = NULL;
- mp_int* q = NULL;
-#else
- mp_int y[1];
- mp_int p[1];
- mp_int q[1];
-#endif
-
- if (key == NULL || pub == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (y == NULL)
- return MEMORY_E;
- p = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (p == NULL) {
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
- q = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (q == NULL) {
- XFREE(p, key->heap, DYNAMIC_TYPE_DH);
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
-
- if (mp_init_multi(y, p, q, NULL, NULL, NULL) != MP_OKAY) {
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(q, key->heap, DYNAMIC_TYPE_DH);
- XFREE(p, key->heap, DYNAMIC_TYPE_DH);
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return MP_INIT_E;
- }
-
- SAVE_VECTOR_REGISTERS(ret = _svr_ret;);
-
- if (mp_read_unsigned_bin(y, pub, pubSz) != MP_OKAY) {
- ret = MP_READ_E;
- }
-
- if (ret == 0 && prime != NULL) {
- if (mp_read_unsigned_bin(q, prime, primeSz) != MP_OKAY)
- ret = MP_READ_E;
-
- } else if (mp_iszero(&key->q) == MP_NO) {
- /* use q available in DhKey */
- if (mp_copy(&key->q, q) != MP_OKAY)
- ret = MP_INIT_E;
- }
-
- /* SP 800-56Ar3, section 5.6.2.3.2 */
- /* pub (y) should not be 0 or 1 */
- if (ret == 0 && mp_cmp_d(y, 2) == MP_LT) {
- ret = MP_CMP_E;
- }
-
- /* pub (y) shouldn't be greater than or equal to p - 1 */
- if (ret == 0 && mp_copy(&key->p, p) != MP_OKAY) {
- ret = MP_INIT_E;
- }
- if (ret == 0 && mp_sub_d(p, 2, p) != MP_OKAY) {
- ret = MP_SUB_E;
- }
- if (ret == 0 && mp_cmp(y, p) == MP_GT) {
- ret = MP_CMP_E;
- }
-
- if (!partial) {
- if (ret == 0 && (prime != NULL || (mp_iszero(&key->q) == MP_NO) )) {
-
- /* restore key->p into p */
- if (mp_copy(&key->p, p) != MP_OKAY)
- ret = MP_INIT_E;
- }
-
- /* SP 800-56Ar3, section 5.6.2.3.1, process step 2 */
- if (ret == 0 && prime != NULL) {
-#ifdef WOLFSSL_HAVE_SP_DH
-#ifndef WOLFSSL_SP_NO_2048
- if (mp_count_bits(&key->p) == 2048) {
- ret = sp_ModExp_2048(y, q, p, y);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#ifndef WOLFSSL_SP_NO_3072
- if (mp_count_bits(&key->p) == 3072) {
- ret = sp_ModExp_3072(y, q, p, y);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#ifdef WOLFSSL_SP_4096
- if (mp_count_bits(&key->p) == 4096) {
- ret = sp_ModExp_4096(y, q, p, y);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#endif
-
- {
-#if !defined(WOLFSSL_SP_MATH)
- /* calculate (y^q) mod(p), store back into y */
- if (mp_exptmod(y, q, p, y) != MP_OKAY)
- ret = MP_EXPTMOD_E;
-#else
- ret = WC_KEY_SIZE_E;
-#endif
- }
-
- /* verify above == 1 */
- if (ret == 0 && mp_cmp_d(y, 1) != MP_EQ)
- ret = MP_CMP_E;
- }
- }
-
- mp_clear(y);
- mp_clear(p);
- mp_clear(q);
-
- RESTORE_VECTOR_REGISTERS();
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(q, key->heap, DYNAMIC_TYPE_DH);
- XFREE(p, key->heap, DYNAMIC_TYPE_DH);
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
-#endif
-
- return ret;
-}
-
-
-/* Performs a full public-key validation routine. */
-int wc_DhCheckPubKey_ex(DhKey* key, const byte* pub, word32 pubSz,
- const byte* prime, word32 primeSz)
-{
- return _ffc_validate_public_key(key, pub, pubSz, prime, primeSz, 0);
-}
-
-
-/* Check DH Public Key for invalid numbers. Performs a partial public-key
- * validation routine.
- *
- * key DH key group parameters.
- * pub Public Key.
- * pubSz Public Key size.
- *
- * returns 0 on success or error code
- */
-int wc_DhCheckPubKey(DhKey* key, const byte* pub, word32 pubSz)
-{
- return _ffc_validate_public_key(key, pub, pubSz, NULL, 0, 1);
-}
-
-
-/**
- * Quick validity check of public key value against prime.
- * Checks are:
- * - Public key not 0 or 1
- * - Public key not equal to prime or prime - 1
- * - Public key not bigger than prime.
- *
- * prime Big-endian encoding of prime in bytes.
- * primeSz Size of prime in bytes.
- * pub Big-endian encoding of public key in bytes.
- * pubSz Size of public key in bytes.
- */
-int wc_DhCheckPubValue(const byte* prime, word32 primeSz, const byte* pub,
- word32 pubSz)
-{
- int ret = 0;
- word32 i;
-
- for (i = 0; i < pubSz && pub[i] == 0; i++) {
- }
- pubSz -= i;
- pub += i;
-
- if (pubSz == 0 || (pubSz == 1 && pub[0] == 1))
- ret = MP_VAL;
- else if (pubSz == primeSz) {
- for (i = 0; i < pubSz-1 && pub[i] == prime[i]; i++) {
- }
- if (i == pubSz-1 && (pub[i] == prime[i] || pub[i] == prime[i] - 1))
- ret = MP_VAL;
- else if (pub[i] > prime[i])
- ret = MP_VAL;
- }
- else if (pubSz > primeSz)
- ret = MP_VAL;
-
- return ret;
-}
-
-
-/* Check DH Private Key for invalid numbers, optionally allowing
- * the private key to be checked against the large prime (q).
- * Check per process in SP 800-56Ar3, section 5.6.2.1.2.
- *
- * key DH key group parameters.
- * priv Private Key.
- * privSz Private Key size.
- * prime Large prime (q), optionally NULL to skip check
- * primeSz Size of large prime
- *
- * returns 0 on success or error code
- */
-int wc_DhCheckPrivKey_ex(DhKey* key, const byte* priv, word32 privSz,
- const byte* prime, word32 primeSz)
-{
- int ret = 0;
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* x = NULL;
- mp_int* q = NULL;
-#else
- mp_int x[1];
- mp_int q[1];
-#endif
-
- if (key == NULL || priv == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (x == NULL)
- return MEMORY_E;
- q = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (q == NULL) {
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
-
- if (mp_init_multi(x, q, NULL, NULL, NULL, NULL) != MP_OKAY) {
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(q, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return MP_INIT_E;
- }
-
- if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY) {
- ret = MP_READ_E;
- }
-
- if (ret == 0) {
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- mp_memzero_add("wc_DhCheckPrivKey_ex x", x);
- #endif
- if (prime != NULL) {
- if (mp_read_unsigned_bin(q, prime, primeSz) != MP_OKAY)
- ret = MP_READ_E;
- }
- else if (mp_iszero(&key->q) == MP_NO) {
- /* use q available in DhKey */
- if (mp_copy(&key->q, q) != MP_OKAY)
- ret = MP_INIT_E;
- }
- }
-
- /* priv (x) should not be 0 */
- if (ret == 0) {
- if (mp_cmp_d(x, 0) == MP_EQ)
- ret = MP_CMP_E;
- }
-
- if (ret == 0) {
- if (mp_iszero(q) == MP_NO) {
- /* priv (x) shouldn't be greater than q - 1 */
- if (mp_copy(&key->q, q) != MP_OKAY)
- ret = MP_INIT_E;
- if (ret == 0) {
- if (mp_sub_d(q, 1, q) != MP_OKAY)
- ret = MP_SUB_E;
- }
- if (ret == 0) {
- if (mp_cmp(x, q) == MP_GT)
- ret = DH_CHECK_PRIV_E;
- }
- }
- }
-
- mp_forcezero(x);
- mp_clear(q);
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(q, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- mp_memzero_check(x);
-#endif
-
- return ret;
-}
-
-
-/* Check DH Private Key for invalid numbers
- *
- * key DH key group parameters.
- * priv Private Key.
- * privSz Private Key size.
- *
- * returns 0 on success or error code
- */
-int wc_DhCheckPrivKey(DhKey* key, const byte* priv, word32 privSz)
-{
- return wc_DhCheckPrivKey_ex(key, priv, privSz, NULL, 0);
-}
-
-
-/* Performs a Pairwise Consistency Test on an FFC key pair. */
-/* Check DH Keys for pair-wise consistency per process in
- * SP 800-56Ar3, section 5.6.2.1.4, method (b) for FFC. */
-static int _ffc_pairwise_consistency_test(DhKey* key,
- const byte* pub, word32 pubSz, const byte* priv, word32 privSz)
-{
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* publicKey = NULL;
- mp_int* privateKey = NULL;
- mp_int* checkKey = NULL;
-#else
- mp_int publicKey[1];
- mp_int privateKey[1];
- mp_int checkKey[1];
-#endif
- int ret = 0;
-
- if (key == NULL || pub == NULL || priv == NULL)
- return BAD_FUNC_ARG;
- if (mp_iseven(&key->p) == MP_YES)
- return MP_VAL;
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- publicKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (publicKey == NULL)
- return MEMORY_E;
- privateKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (privateKey == NULL) {
- XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
- checkKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (checkKey == NULL) {
- XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
- XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
-
- if (mp_init_multi(publicKey, privateKey, checkKey,
- NULL, NULL, NULL) != MP_OKAY) {
-
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
- XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
- XFREE(checkKey, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return MP_INIT_E;
- }
-
- SAVE_VECTOR_REGISTERS(ret = _svr_ret;);
-
- /* Load the private and public keys into big integers. */
- if (mp_read_unsigned_bin(publicKey, pub, pubSz) != MP_OKAY ||
- mp_read_unsigned_bin(privateKey, priv, privSz) != MP_OKAY) {
-
- ret = MP_READ_E;
- }
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- mp_memzero_add("_ffc_pairwise_consistency_test privateKey", privateKey);
-#endif
-
- /* Calculate checkKey = g^privateKey mod p */
- if (ret == 0) {
-#ifdef WOLFSSL_HAVE_SP_DH
-#ifndef WOLFSSL_SP_NO_2048
- if (mp_count_bits(&key->p) == 2048) {
- ret = sp_ModExp_2048(&key->g, privateKey, &key->p, checkKey);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#ifndef WOLFSSL_SP_NO_3072
- if (mp_count_bits(&key->p) == 3072) {
- ret = sp_ModExp_3072(&key->g, privateKey, &key->p, checkKey);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#ifdef WOLFSSL_SP_4096
- if (mp_count_bits(&key->p) == 4096) {
- ret = sp_ModExp_4096(&key->g, privateKey, &key->p, checkKey);
- if (ret != 0)
- ret = MP_EXPTMOD_E;
- }
- else
-#endif
-#endif
- {
-#if !defined(WOLFSSL_SP_MATH)
- if (mp_exptmod(&key->g, privateKey, &key->p, checkKey) != MP_OKAY)
- ret = MP_EXPTMOD_E;
-#else
- ret = WC_KEY_SIZE_E;
-#endif
- }
- }
-
- /* Compare the calculated public key to the supplied check value. */
- if (ret == 0) {
- if (mp_cmp(checkKey, publicKey) != MP_EQ)
- ret = MP_CMP_E;
- }
-
- mp_forcezero(privateKey);
- mp_clear(publicKey);
- mp_clear(checkKey);
-
- RESTORE_VECTOR_REGISTERS();
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(checkKey, key->heap, DYNAMIC_TYPE_DH);
- XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
- XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- mp_memzero_check(privateKey);
-#endif
-
- return ret;
-}
-
-
-/* Check DH Keys for pair-wise consistency per process in
- * SP 800-56Ar3, section 5.6.2.1.4, method (b) for FFC.
- *
- * key DH key group parameters.
- * pub Public Key.
- * pubSz Public Key size.
- * priv Private Key.
- * privSz Private Key size.
- *
- * returns 0 on success or error code
- */
-int wc_DhCheckKeyPair(DhKey* key, const byte* pub, word32 pubSz,
- const byte* priv, word32 privSz)
-{
- return _ffc_pairwise_consistency_test(key, pub, pubSz, priv, privSz);
-}
-
-
-int wc_DhGenerateKeyPair(DhKey* key, WC_RNG* rng,
- byte* priv, word32* privSz, byte* pub, word32* pubSz)
-{
- int ret;
-
- if (key == NULL || rng == NULL || priv == NULL || privSz == NULL ||
- pub == NULL || pubSz == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_KCAPI_DH
- (void)priv;
- (void)privSz;
- ret = KcapiDh_MakeKey(key, pub, pubSz);
-#else
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
- if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_DH) {
- ret = wc_DhGenerateKeyPair_Async(key, rng, priv, privSz, pub, pubSz);
- }
- else
-#endif
- {
- ret = wc_DhGenerateKeyPair_Sync(key, rng, priv, privSz, pub, pubSz);
- }
-#endif /* WOLFSSL_KCAPI_DH */
-
- return ret;
-}
-
-#ifndef WOLFSSL_KCAPI_DH
-static int wc_DhAgree_Sync(DhKey* key, byte* agree, word32* agreeSz,
- const byte* priv, word32 privSz, const byte* otherPub, word32 pubSz, int ct)
-{
- int ret = 0;
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int* y = NULL;
-#if !defined(WOLFSSL_SP_MATH)
- mp_int* x = NULL;
- mp_int* z = NULL;
-#endif
-#else
- mp_int y[1];
-#if !defined(WOLFSSL_SP_MATH)
- mp_int x[1];
- mp_int z[1];
-#endif
-#endif
-
- if (mp_iseven(&key->p) == MP_YES) {
- return MP_VAL;
- }
-#ifdef WOLFSSL_VALIDATE_FFC_IMPORT
- if (wc_DhCheckPrivKey(key, priv, privSz) != 0) {
- WOLFSSL_MSG("wc_DhAgree wc_DhCheckPrivKey failed");
- return DH_CHECK_PRIV_E;
- }
-
- if (wc_DhCheckPubKey(key, otherPub, pubSz) != 0) {
- WOLFSSL_MSG("wc_DhAgree wc_DhCheckPubKey failed");
- return DH_CHECK_PUB_E;
- }
-#endif
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (y == NULL)
- return MEMORY_E;
-#if !defined(WOLFSSL_SP_MATH)
- x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (x == NULL) {
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
- z = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
- if (z == NULL) {
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- return MEMORY_E;
- }
-#endif
-#endif
-
-#ifdef WOLFSSL_HAVE_SP_DH
- if (0
-#ifndef WOLFSSL_SP_NO_2048
- || mp_count_bits(&key->p) == 2048
-#endif
-#ifndef WOLFSSL_SP_NO_3072
- || mp_count_bits(&key->p) == 3072
-#endif
-#ifdef WOLFSSL_SP_4096
- || mp_count_bits(&key->p) == 4096
-#endif
- ) {
- int i = (int)*agreeSz - 1;
-
- if (mp_init(y) != MP_OKAY)
- ret = MP_INIT_E;
-
- if (ret == 0) {
- SAVE_VECTOR_REGISTERS(ret = _svr_ret;);
-
- if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
- ret = MP_READ_E;
-
- if (ret == 0) {
- #ifndef WOLFSSL_SP_NO_2048
- if (mp_count_bits(&key->p) == 2048) {
- ret = sp_DhExp_2048(y, priv, privSz, &key->p, agree,
- agreeSz);
- }
- #endif
- #ifndef WOLFSSL_SP_NO_3072
- if (mp_count_bits(&key->p) == 3072) {
- ret = sp_DhExp_3072(y, priv, privSz, &key->p, agree,
- agreeSz);
- }
- #endif
- #ifdef WOLFSSL_SP_4096
- if (mp_count_bits(&key->p) == 4096) {
- ret = sp_DhExp_4096(y, priv, privSz, &key->p, agree,
- agreeSz);
- }
- #endif
- }
-
- mp_clear(y);
-
- RESTORE_VECTOR_REGISTERS();
- }
-
- /* make sure agree is > 1 (SP800-56A, 5.7.1.1) */
- if ((ret == 0) &&
- ((*agreeSz == 0) || ((*agreeSz == 1) && (agree[0] == 1))))
- {
- ret = MP_VAL;
- }
-
- if ((ret == 0) && ct) {
- volatile word16 mask = 0xff;
- sword16 o = (sword16)(*agreeSz - 1);
-
- *agreeSz = (word32)(i + 1);
- for (; i >= 0 ; i--) {
- agree[i] = agree[o] & (byte)mask;
- mask = ctMask16LT(0, (int)o);
- o = (sword16)(o + (sword16)mask);
- }
- }
-
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- #if !defined(WOLFSSL_SP_MATH)
- XFREE(z, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- #endif
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return ret;
- }
-#endif
-
-#if !defined(WOLFSSL_SP_MATH)
- if (mp_init_multi(x, y, z, 0, 0, 0) != MP_OKAY) {
- #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- XFREE(z, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
- #endif
- return MP_INIT_E;
- }
-#if defined(WOLFSSL_SP_MATH_ALL)
- if (ct) {
- /* TFM and Integer implementations keep high words zero.
- * SP math implementation needs all words set to zero as it doesn't
- * ensure unused words are zero. */
- mp_forcezero(x);
- }
-#endif
-
- SAVE_VECTOR_REGISTERS(ret = _svr_ret;);
-
- if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY)
- ret = MP_READ_E;
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- if (ret == 0)
- mp_memzero_add("wc_DhAgree_Sync x", x);
-#endif
-
- if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
- ret = MP_READ_E;
-
- if (ret == 0) {
- if (ct) {
- int bits;
-
- /* x is mod q but if q not available, use p (> q). */
- if (mp_iszero(&key->q) == MP_NO) {
- bits = mp_count_bits(&key->q);
- }
- else {
- bits = mp_count_bits(&key->p);
- }
- /* Exponentiate to the maximum words of a valid x to ensure a
- * constant time operation. */
- ret = mp_exptmod_ex(y, x, (bits + DIGIT_BIT - 1) / DIGIT_BIT,
- &key->p, z);
- }
- else {
- ret = mp_exptmod(y, x, &key->p, z);
- }
- if (ret != MP_OKAY)
- ret = MP_EXPTMOD_E;
- }
-
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- if (ret == 0)
- mp_memzero_add("wc_DhAgree_Sync z", z);
-#endif
-
- /* make sure z is not one (SP800-56A, 5.7.1.1) */
- if (ret == 0 && (mp_cmp_d(z, 1) == MP_EQ))
- ret = MP_VAL;
-
- if (ret == 0) {
- if (ct) {
- /* Put the secret into a buffer in constant time. */
- ret = mp_to_unsigned_bin_len_ct(z, agree, (int)*agreeSz);
- }
- else {
- ret = mp_to_unsigned_bin(z, agree);
- if (ret == MP_OKAY)
- *agreeSz = (word32)mp_unsigned_bin_size(z);
- }
- }
-
- mp_forcezero(z);
- mp_clear(y);
- mp_forcezero(x);
-
- RESTORE_VECTOR_REGISTERS();
-
-#else
- (void)ct;
- ret = WC_KEY_SIZE_E;
-#endif
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
-#if !defined(WOLFSSL_SP_MATH)
- XFREE(z, key->heap, DYNAMIC_TYPE_DH);
- XFREE(x, key->heap, DYNAMIC_TYPE_DH);
-#endif
- XFREE(y, key->heap, DYNAMIC_TYPE_DH);
-#elif defined(WOLFSSL_CHECK_MEM_ZERO)
- mp_memzero_check(x);
- mp_memzero_check(z);
-#endif
-
- return ret;
-}
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
-static int wc_DhAgree_Async(DhKey* key, byte* agree, word32* agreeSz,
- const byte* priv, word32 privSz, const byte* otherPub, word32 pubSz)
-{
- int ret;
-
-#if defined(HAVE_INTEL_QA)
- word32 pBits;
-
- /* QAT DH sizes: 768, 1024, 1536, 2048, 3072 and 4096 bits */
- pBits = mp_unsigned_bin_size(&key->p) * 8;
- if (pBits == 768 || pBits == 1024 || pBits == 1536 ||
- pBits == 2048 || pBits == 3072 || pBits == 4096) {
- ret = wc_mp_to_bigint(&key->p, &key->p.raw);
- if (ret == MP_OKAY)
- ret = IntelQaDhAgree(&key->asyncDev, &key->p.raw,
- agree, agreeSz, priv, privSz, otherPub, pubSz);
- return ret;
- }
-
-#elif defined(HAVE_CAVIUM)
- /* TODO: Not implemented - use software for now */
-
-#elif defined(WOLFSSL_ASYNC_CRYPT_SW)
- if (wc_AsyncSwInit(&key->asyncDev, ASYNC_SW_DH_AGREE)) {
- WC_ASYNC_SW* sw = &key->asyncDev.sw;
- sw->dhAgree.key = key;
- sw->dhAgree.agree = agree;
- sw->dhAgree.agreeSz = agreeSz;
- sw->dhAgree.priv = priv;
- sw->dhAgree.privSz = privSz;
- sw->dhAgree.otherPub = otherPub;
- sw->dhAgree.pubSz = pubSz;
- return WC_PENDING_E;
- }
-#endif
-
- /* otherwise use software DH */
- ret = wc_DhAgree_Sync(key, agree, agreeSz, priv, privSz, otherPub, pubSz,
- 0);
-
- return ret;
-}
-#endif /* WOLFSSL_ASYNC_CRYPT */
-#endif /* !WOLFSSL_KCAPI_DH */
-
-int wc_DhAgree(DhKey* key, byte* agree, word32* agreeSz, const byte* priv,
- word32 privSz, const byte* otherPub, word32 pubSz)
-{
- int ret = 0;
-
- if (key == NULL || agree == NULL || agreeSz == NULL || priv == NULL ||
- otherPub == NULL) {
- return BAD_FUNC_ARG;
- }
-
-#ifdef WOLFSSL_KCAPI_DH
- (void)priv;
- (void)privSz;
- ret = KcapiDh_SharedSecret(key, otherPub, pubSz, agree, agreeSz);
-#else
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
- if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_DH) {
- ret = wc_DhAgree_Async(key, agree, agreeSz, priv, privSz, otherPub,
- pubSz);
- }
- else
-#endif
- {
- ret = wc_DhAgree_Sync(key, agree, agreeSz, priv, privSz, otherPub,
- pubSz, 0);
- }
-#endif /* WOLFSSL_KCAPI_DH */
-
- return ret;
-}
-
-int wc_DhAgree_ct(DhKey* key, byte* agree, word32 *agreeSz, const byte* priv,
- word32 privSz, const byte* otherPub, word32 pubSz)
-{
- word32 requested_agreeSz;
-
- if (key == NULL || agree == NULL || agreeSz == NULL || priv == NULL ||
- otherPub == NULL) {
- return BAD_FUNC_ARG;
- }
-
- requested_agreeSz = (word32)mp_unsigned_bin_size(&key->p);
- if (requested_agreeSz > *agreeSz) {
- return BUFFER_E;
- }
- *agreeSz = requested_agreeSz;
-
- return wc_DhAgree_Sync(key, agree, agreeSz, priv, privSz, otherPub, pubSz,
- 1);
-}
-
-#ifdef WOLFSSL_DH_EXTRA
-WOLFSSL_LOCAL int wc_DhKeyCopy(DhKey* src, DhKey* dst)
-{
- int ret;
-
- if (!src || !dst || src == dst) {
- WOLFSSL_MSG("Parameters not provided or are the same");
- return BAD_FUNC_ARG;
- }
-
- if ((ret = mp_copy(&src->p, &dst->p)) != MP_OKAY) {
- WOLFSSL_MSG("mp_copy error");
- return ret;
- }
-
- if ((ret = mp_copy(&src->g, &dst->g)) != MP_OKAY) {
- WOLFSSL_MSG("mp_copy error");
- return ret;
- }
-
- if ((ret = mp_copy(&src->q, &dst->q)) != MP_OKAY) {
- WOLFSSL_MSG("mp_copy error");
- return ret;
- }
-
- if ((ret = mp_copy(&src->pub, &dst->pub)) != MP_OKAY) {
- WOLFSSL_MSG("mp_copy error");
- return ret;
- }
-
- if ((ret = mp_copy(&src->priv, &dst->priv)) != MP_OKAY) {
- WOLFSSL_MSG("mp_copy error");
- return ret;
- }
-#ifdef WOLFSSL_CHECK_MEM_ZERO
- mp_memzero_add("wc_DhKeyCopy dst->priv", &dst->priv);
-#endif
-
- dst->heap = src->heap;
-
- return MP_OKAY;
-}
-
-/* Sets private and public key in DhKey if both are available, otherwise sets
- either private or public key, depending on which is available. */
-int wc_DhImportKeyPair(DhKey* key, const byte* priv, word32 privSz,
- const byte* pub, word32 pubSz)
-{
- byte havePriv, havePub;
-
- if (key == NULL) {
- return BAD_FUNC_ARG;
- }
-
- havePriv = ( (priv != NULL) && (privSz > 0) );
- havePub = ( (pub != NULL) && (pubSz > 0) );
-
- if (!havePub && !havePriv) {
- WOLFSSL_MSG("No Public or Private Key to Set");
- return BAD_FUNC_ARG;
- }
-
- /* Set Private Key */
- if (havePriv) {
- /* may have leading 0 */
- if (priv[0] == 0) {
- privSz--; priv++;
- }
- if (mp_init(&key->priv) != MP_OKAY)
- havePriv = 0;
- }
- if (havePriv) {
- if (mp_read_unsigned_bin(&key->priv, priv, privSz) != MP_OKAY) {
- mp_clear(&key->priv);
- havePriv = 0;
- } else {
- WOLFSSL_MSG("DH Private Key Set");
- #ifdef WOLFSSL_CHECK_MEM_ZERO
- mp_memzero_add("wc_DhImportKeyPair key->priv", &key->priv);
- #endif
- }
- }
-
- /* Set Public Key */
- if (havePub) {
- /* may have leading 0 */
- if (pub[0] == 0) {
- pubSz--; pub++;
- }
- if (mp_init(&key->pub) != MP_OKAY)
- havePub = 0;
- }
- if (havePub) {
- if (mp_read_unsigned_bin(&key->pub, pub, pubSz) != MP_OKAY) {
- mp_clear(&key->pub);
- havePub = 0;
- if (havePriv) {
- mp_forcezero(&key->priv);
- havePriv = 0; /* set to 0 to error out with failed read pub */
- }
- } else {
- WOLFSSL_MSG("DH Public Key Set");
- }
- }
-
- if (havePriv == 0 && havePub == 0) {
- return MEMORY_E;
- }
-
- return 0;
-}
-
-/* Can be used with WOLFSSL_DH_EXTRA when key is loaded with
- wc_DhKeyDecode or wc_DhImportKeyPair */
-int wc_DhExportKeyPair(DhKey* key, byte* priv, word32* pPrivSz,
- byte* pub, word32* pPubSz)
-{
- int ret = 0;
-
- if (key == NULL || (priv && pPrivSz == NULL) || (pub && pPubSz == NULL)) {
- return BAD_FUNC_ARG;
- }
-
- if (priv) {
- word32 privSz = (word32)mp_unsigned_bin_size(&key->priv);
- if (privSz > *pPrivSz) {
- return BUFFER_E;
- }
- *pPrivSz = privSz;
- ret |= mp_to_unsigned_bin(&key->priv, priv);
- }
-
- if (pub) {
- word32 pubSz = (word32)mp_unsigned_bin_size(&key->pub);
- if (pubSz > *pPubSz) {
- return BUFFER_E;
- }
- *pPubSz = pubSz;
- ret |= mp_to_unsigned_bin(&key->pub, pub);
- }
-
- if (ret != 0)
- ret = ASN_DH_KEY_E;
- return ret;
-}
-
-#endif /* WOLFSSL_DH_EXTRA */
-
-static int _DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
- word32 gSz, const byte* q, word32 qSz, int trusted,
- WC_RNG* rng)
-{
- int ret = 0;
- mp_int* keyP = NULL;
- mp_int* keyG = NULL;
-
- if (key == NULL || p == NULL || g == NULL || pSz == 0 || gSz == 0) {
- ret = BAD_FUNC_ARG;
- }
-
- SAVE_VECTOR_REGISTERS(return _svr_ret;);
-
- if (ret == 0) {
- /* may have leading 0 */
- if (p[0] == 0) {
- pSz--; p++;
- }
-
- if (g[0] == 0) {
- gSz--; g++;
- }
-
- if (q != NULL) {
- if (q[0] == 0) {
- qSz--; q++;
- }
- }
-
- if (mp_init(&key->p) != MP_OKAY)
- ret = MP_INIT_E;
- }
-
- if (ret == 0) {
- if (mp_read_unsigned_bin(&key->p, p, pSz) != MP_OKAY)
- ret = ASN_DH_KEY_E;
- else
- keyP = &key->p;
- }
-
- if (ret == 0 && !trusted) {
- int isPrime = 0;
-
- /* Short-circuit the primality check for p if it is one of the named
- * public moduli (known primes) from RFC 7919.
- */
- #ifdef HAVE_FFDHE_2048
- if ((pSz == sizeof(dh_ffdhe2048_p)) &&
- (XMEMCMP(p, dh_ffdhe2048_p, sizeof(dh_ffdhe2048_p)) == 0))
- {
- isPrime = 1;
- }
- else
- #endif
- #ifdef HAVE_FFDHE_3072
- if ((pSz == sizeof(dh_ffdhe3072_p)) &&
- (XMEMCMP(p, dh_ffdhe3072_p, sizeof(dh_ffdhe3072_p)) == 0))
- {
- isPrime = 1;
- }
- else
- #endif
- #ifdef HAVE_FFDHE_4096
- if ((pSz == sizeof(dh_ffdhe4096_p)) &&
- (XMEMCMP(p, dh_ffdhe4096_p, sizeof(dh_ffdhe4096_p)) == 0))
- {
- isPrime = 1;
- }
- else
- #endif
- #ifdef HAVE_FFDHE_6144
- if ((pSz == sizeof(dh_ffdhe6144_p)) &&
- (XMEMCMP(p, dh_ffdhe6144_p, sizeof(dh_ffdhe6144_p)) == 0))
- {
- isPrime = 1;
- }
- else
- #endif
- #ifdef HAVE_FFDHE_8192
- if ((pSz == sizeof(dh_ffdhe8192_p)) &&
- (XMEMCMP(p, dh_ffdhe8192_p, sizeof(dh_ffdhe8192_p)) == 0))
- {
- isPrime = 1;
- }
- else
- #endif
- {
- if (rng != NULL)
- ret = mp_prime_is_prime_ex(keyP, 8, &isPrime, rng);
- else
- ret = mp_prime_is_prime(keyP, 8, &isPrime);
- }
-
- if (ret == 0 && isPrime == 0)
- ret = DH_CHECK_PUB_E;
- }
-
- if (ret == 0 && mp_init(&key->g) != MP_OKAY)
- ret = MP_INIT_E;
- if (ret == 0) {
- if (mp_read_unsigned_bin(&key->g, g, gSz) != MP_OKAY)
- ret = ASN_DH_KEY_E;
- else
- keyG = &key->g;
- }
-
- if (ret == 0 && q != NULL) {
- if (mp_init(&key->q) != MP_OKAY)
- ret = MP_INIT_E;
- }
- if (ret == 0 && q != NULL) {
- if (mp_read_unsigned_bin(&key->q, q, qSz) != MP_OKAY)
- ret = MP_INIT_E;
- else
- key->trustedGroup = trusted;
- }
-
- if (ret != 0 && key != NULL) {
- if (keyG)
- mp_clear(keyG);
- if (keyP)
- mp_clear(keyP);
- }
-
- RESTORE_VECTOR_REGISTERS();
-
- return ret;
-}
-
-
-int wc_DhSetCheckKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
- word32 gSz, const byte* q, word32 qSz, int trusted,
- WC_RNG* rng)
-{
- return _DhSetKey(key, p, pSz, g, gSz, q, qSz, trusted, rng);
-}
-
-
-int wc_DhSetKey_ex(DhKey* key, const byte* p, word32 pSz, const byte* g,
- word32 gSz, const byte* q, word32 qSz)
-{
- return _DhSetKey(key, p, pSz, g, gSz, q, qSz, 0, NULL);
-}
-
-
-/* not in asn anymore since no actual asn types used */
-int wc_DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
- word32 gSz)
-{
- /* This should not have trusted set. */
- return _DhSetKey(key, p, pSz, g, gSz, NULL, 0, 1, NULL);
-}
-
-
-int wc_DhSetNamedKey(DhKey* key, int name)
-{
- const byte* p = NULL;
- const byte* g = NULL;
- const byte* q = NULL;
- word32 pSz = 0, gSz = 0, qSz = 0;
-
- switch (name) {
- #ifdef HAVE_FFDHE_2048
- case WC_FFDHE_2048:
- p = dh_ffdhe2048_p;
- pSz = sizeof(dh_ffdhe2048_p);
- g = dh_ffdhe2048_g;
- gSz = sizeof(dh_ffdhe2048_g);
- #ifdef HAVE_FFDHE_Q
- q = dh_ffdhe2048_q;
- qSz = sizeof(dh_ffdhe2048_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_2048 */
- #ifdef HAVE_FFDHE_3072
- case WC_FFDHE_3072:
- p = dh_ffdhe3072_p;
- pSz = sizeof(dh_ffdhe3072_p);
- g = dh_ffdhe3072_g;
- gSz = sizeof(dh_ffdhe3072_g);
- #ifdef HAVE_FFDHE_Q
- q = dh_ffdhe3072_q;
- qSz = sizeof(dh_ffdhe3072_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_3072 */
- #ifdef HAVE_FFDHE_4096
- case WC_FFDHE_4096:
- p = dh_ffdhe4096_p;
- pSz = sizeof(dh_ffdhe4096_p);
- g = dh_ffdhe4096_g;
- gSz = sizeof(dh_ffdhe4096_g);
- #ifdef HAVE_FFDHE_Q
- q = dh_ffdhe4096_q;
- qSz = sizeof(dh_ffdhe4096_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_4096 */
- #ifdef HAVE_FFDHE_6144
- case WC_FFDHE_6144:
- p = dh_ffdhe6144_p;
- pSz = sizeof(dh_ffdhe6144_p);
- g = dh_ffdhe6144_g;
- gSz = sizeof(dh_ffdhe6144_g);
- #ifdef HAVE_FFDHE_Q
- q = dh_ffdhe6144_q;
- qSz = sizeof(dh_ffdhe6144_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_6144 */
- #ifdef HAVE_FFDHE_8192
- case WC_FFDHE_8192:
- p = dh_ffdhe8192_p;
- pSz = sizeof(dh_ffdhe8192_p);
- g = dh_ffdhe8192_g;
- gSz = sizeof(dh_ffdhe8192_g);
- #ifdef HAVE_FFDHE_Q
- q = dh_ffdhe8192_q;
- qSz = sizeof(dh_ffdhe8192_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_8192 */
- default:
- break;
- }
- return _DhSetKey(key, p, pSz, g, gSz, q, qSz, 1, NULL);
-}
-
-
-word32 wc_DhGetNamedKeyMinSize(int name)
-{
- word32 size;
-
- switch (name) {
- #ifdef HAVE_FFDHE_2048
- case WC_FFDHE_2048:
- size = 29;
- break;
- #endif /* HAVE_FFDHE_2048 */
- #ifdef HAVE_FFDHE_3072
- case WC_FFDHE_3072:
- size = 34;
- break;
- #endif /* HAVE_FFDHE_3072 */
- #ifdef HAVE_FFDHE_4096
- case WC_FFDHE_4096:
- size = 39;
- break;
- #endif /* HAVE_FFDHE_4096 */
- #ifdef HAVE_FFDHE_6144
- case WC_FFDHE_6144:
- size = 46;
- break;
- #endif /* HAVE_FFDHE_6144 */
- #ifdef HAVE_FFDHE_8192
- case WC_FFDHE_8192:
- size = 52;
- break;
- #endif /* HAVE_FFDHE_8192 */
- default:
- size = 0;
- }
-
- return size;
-}
-
-
-/* Returns 1: params match
- * 0: params differ */
-int wc_DhCmpNamedKey(int name, int noQ,
- const byte* p, word32 pSz,
- const byte* g, word32 gSz,
- const byte* q, word32 qSz)
-{
- const byte* pCmp = NULL;
- const byte* qCmp = NULL;
- const byte* gCmp = NULL;
- word32 pCmpSz = 0, qCmpSz = 0, gCmpSz = 0;
- int cmp = 0, goodName = 1;
-
- switch (name) {
- #ifdef HAVE_FFDHE_2048
- case WC_FFDHE_2048:
- pCmp = dh_ffdhe2048_p;
- pCmpSz = sizeof(dh_ffdhe2048_p);
- gCmp = dh_ffdhe2048_g;
- gCmpSz = sizeof(dh_ffdhe2048_g);
- #ifdef HAVE_FFDHE_Q
- qCmp = dh_ffdhe2048_q;
- qCmpSz = sizeof(dh_ffdhe2048_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_2048 */
- #ifdef HAVE_FFDHE_3072
- case WC_FFDHE_3072:
- pCmp = dh_ffdhe3072_p;
- pCmpSz = sizeof(dh_ffdhe3072_p);
- gCmp = dh_ffdhe3072_g;
- gCmpSz = sizeof(dh_ffdhe3072_g);
- #ifdef HAVE_FFDHE_Q
- qCmp = dh_ffdhe3072_q;
- qCmpSz = sizeof(dh_ffdhe3072_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_3072 */
- #ifdef HAVE_FFDHE_4096
- case WC_FFDHE_4096:
- pCmp = dh_ffdhe4096_p;
- pCmpSz = sizeof(dh_ffdhe4096_p);
- gCmp = dh_ffdhe4096_g;
- gCmpSz = sizeof(dh_ffdhe4096_g);
- #ifdef HAVE_FFDHE_Q
- qCmp = dh_ffdhe4096_q;
- qCmpSz = sizeof(dh_ffdhe4096_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_4096 */
- #ifdef HAVE_FFDHE_6144
- case WC_FFDHE_6144:
- pCmp = dh_ffdhe6144_p;
- pCmpSz = sizeof(dh_ffdhe6144_p);
- gCmp = dh_ffdhe6144_g;
- gCmpSz = sizeof(dh_ffdhe6144_g);
- #ifdef HAVE_FFDHE_Q
- qCmp = dh_ffdhe6144_q;
- qCmpSz = sizeof(dh_ffdhe6144_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_6144 */
- #ifdef HAVE_FFDHE_8192
- case WC_FFDHE_8192:
- pCmp = dh_ffdhe8192_p;
- pCmpSz = sizeof(dh_ffdhe8192_p);
- gCmp = dh_ffdhe8192_g;
- gCmpSz = sizeof(dh_ffdhe8192_g);
- #ifdef HAVE_FFDHE_Q
- qCmp = dh_ffdhe8192_q;
- qCmpSz = sizeof(dh_ffdhe8192_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_8192 */
- default:
- goodName = 0;
- }
-
- if (goodName) {
- cmp = (pSz == pCmpSz) && (gSz == gCmpSz) &&
- (noQ || ((qCmp != NULL) && (qSz == qCmpSz) &&
- XMEMCMP(q, qCmp, qCmpSz) == 0)) &&
- (XMEMCMP(p, pCmp, pCmpSz) == 0) &&
- (XMEMCMP(g, gCmp, gCmpSz) == 0);
- }
-
- return cmp;
-}
-
-
-int wc_DhGetNamedKeyParamSize(int name, word32* p, word32* g, word32* q)
-{
- word32 pSz = 0, gSz = 0, qSz = 0;
-
- switch (name) {
- #ifdef HAVE_FFDHE_2048
- case WC_FFDHE_2048:
- pSz = sizeof(dh_ffdhe2048_p);
- gSz = sizeof(dh_ffdhe2048_g);
- #ifdef HAVE_FFDHE_Q
- qSz = sizeof(dh_ffdhe2048_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_2048 */
- #ifdef HAVE_FFDHE_3072
- case WC_FFDHE_3072:
- pSz = sizeof(dh_ffdhe3072_p);
- gSz = sizeof(dh_ffdhe3072_g);
- #ifdef HAVE_FFDHE_Q
- qSz = sizeof(dh_ffdhe3072_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_3072 */
- #ifdef HAVE_FFDHE_4096
- case WC_FFDHE_4096:
- pSz = sizeof(dh_ffdhe4096_p);
- gSz = sizeof(dh_ffdhe4096_g);
- #ifdef HAVE_FFDHE_Q
- qSz = sizeof(dh_ffdhe4096_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_4096 */
- #ifdef HAVE_FFDHE_6144
- case WC_FFDHE_6144:
- pSz = sizeof(dh_ffdhe6144_p);
- gSz = sizeof(dh_ffdhe6144_g);
- #ifdef HAVE_FFDHE_Q
- qSz = sizeof(dh_ffdhe6144_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_6144 */
- #ifdef HAVE_FFDHE_8192
- case WC_FFDHE_8192:
- pSz = sizeof(dh_ffdhe8192_p);
- gSz = sizeof(dh_ffdhe8192_g);
- #ifdef HAVE_FFDHE_Q
- qSz = sizeof(dh_ffdhe8192_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_8192 */
- default:
- break;
- }
-
- if (p != NULL) *p = pSz;
- if (g != NULL) *g = gSz;
- if (q != NULL) *q = qSz;
-
- return 0;
-}
-
-
-int wc_DhCopyNamedKey(int name,
- byte* p, word32* pSz, byte* g, word32* gSz, byte* q, word32* qSz)
-{
- const byte* pC = NULL;
- const byte* gC = NULL;
- const byte* qC = NULL;
- word32 pCSz = 0, gCSz = 0, qCSz = 0;
-
- switch (name) {
- #ifdef HAVE_FFDHE_2048
- case WC_FFDHE_2048:
- pC = dh_ffdhe2048_p;
- pCSz = sizeof(dh_ffdhe2048_p);
- gC = dh_ffdhe2048_g;
- gCSz = sizeof(dh_ffdhe2048_g);
- #ifdef HAVE_FFDHE_Q
- qC = dh_ffdhe2048_q;
- qCSz = sizeof(dh_ffdhe2048_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_2048 */
- #ifdef HAVE_FFDHE_3072
- case WC_FFDHE_3072:
- pC = dh_ffdhe3072_p;
- pCSz = sizeof(dh_ffdhe3072_p);
- gC = dh_ffdhe3072_g;
- gCSz = sizeof(dh_ffdhe3072_g);
- #ifdef HAVE_FFDHE_Q
- qC = dh_ffdhe3072_q;
- qCSz = sizeof(dh_ffdhe3072_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_3072 */
- #ifdef HAVE_FFDHE_4096
- case WC_FFDHE_4096:
- pC = dh_ffdhe4096_p;
- pCSz = sizeof(dh_ffdhe4096_p);
- gC = dh_ffdhe4096_g;
- gCSz = sizeof(dh_ffdhe4096_g);
- #ifdef HAVE_FFDHE_Q
- qC = dh_ffdhe4096_q;
- qCSz = sizeof(dh_ffdhe4096_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_4096 */
- #ifdef HAVE_FFDHE_6144
- case WC_FFDHE_6144:
- pC = dh_ffdhe6144_p;
- pCSz = sizeof(dh_ffdhe6144_p);
- gC = dh_ffdhe6144_g;
- gCSz = sizeof(dh_ffdhe6144_g);
- #ifdef HAVE_FFDHE_Q
- qC = dh_ffdhe6144_q;
- qCSz = sizeof(dh_ffdhe6144_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_6144 */
- #ifdef HAVE_FFDHE_8192
- case WC_FFDHE_8192:
- pC = dh_ffdhe8192_p;
- pCSz = sizeof(dh_ffdhe8192_p);
- gC = dh_ffdhe8192_g;
- gCSz = sizeof(dh_ffdhe8192_g);
- #ifdef HAVE_FFDHE_Q
- qC = dh_ffdhe8192_q;
- qCSz = sizeof(dh_ffdhe8192_q);
- #endif /* HAVE_FFDHE_Q */
- break;
- #endif /* HAVE_FFDHE_8192 */
- default:
- break;
- }
-
- if (p != NULL && pC != NULL)
- XMEMCPY(p, pC, pCSz);
- if (pSz != NULL)
- *pSz = pCSz;
- if (g != NULL && gC != NULL)
- XMEMCPY(g, gC, gCSz);
- if (gSz != NULL)
- *gSz = gCSz;
- if (q != NULL && qC != NULL)
- XMEMCPY(q, qC, qCSz);
- if (qSz != NULL)
- *qSz = qCSz;
-
- return 0;
-}
-
-
-#ifdef WOLFSSL_KEY_GEN
-
-/* modulus_size in bits */
-int wc_DhGenerateParams(WC_RNG *rng, int modSz, DhKey *dh)
-{
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- mp_int *tmp = NULL, *tmp2 = NULL;
-#else
- mp_int tmp[1], tmp2[2];
-#endif
- word32 groupSz = 0, bufSz = 0,
- primeCheckCount = 0;
- int primeCheck = MP_NO,
- ret = 0;
-#ifdef WOLFSSL_NO_MALLOC
- unsigned char buf[DH_MAX_SIZE / WOLFSSL_BIT_SIZE];
-#else
- unsigned char *buf = NULL;
-#endif
-
-#if !defined(WOLFSSL_SMALL_STACK) || defined(WOLFSSL_NO_MALLOC)
- XMEMSET(tmp, 0, sizeof(tmp));
- XMEMSET(tmp2, 0, sizeof(tmp2));
-#endif
-
- if (rng == NULL || dh == NULL)
- ret = BAD_FUNC_ARG;
-
- /* set group size in bytes from modulus size
- * FIPS 186-4 defines valid values (1024, 160) (2048, 256) (3072, 256)
- */
- if (ret == 0) {
- switch (modSz) {
- case 1024:
- groupSz = 20;
- break;
- case 2048:
- case 3072:
- groupSz = 32;
- break;
- default:
- #if !defined(HAVE_FIPS) && defined(WOLFSSL_NO_DH186)
- /* in non fips mode attempt to match strength of group size with
- * mod size */
- if (modSz < 2048)
- groupSz = 20;
- else
- groupSz = 32;
- #else
- ret = BAD_FUNC_ARG;
- #endif
- break;
- }
- }
-
- if (ret == 0) {
- /* modulus size in bytes */
- modSz /= WOLFSSL_BIT_SIZE;
-
- if ((word32)modSz < groupSz) {
- WOLFSSL_MSG("DH modSz was too small");
- ret = BAD_FUNC_ARG;
- }
- }
-
- if (ret == 0) {
- bufSz = (word32)modSz - groupSz;
-
-#ifdef WOLFSSL_NO_MALLOC
- if (bufSz > sizeof(buf))
- ret = MEMORY_E;
-#else
- /* allocate ram */
- buf = (unsigned char *)XMALLOC(bufSz,
- dh->heap, DYNAMIC_TYPE_TMP_BUFFER);
- if (buf == NULL)
- ret = MEMORY_E;
-#endif
- }
-
- /* make a random string that will be multiplied against q */
- if (ret == 0)
- ret = wc_RNG_GenerateBlock(rng, buf, bufSz);
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- if (ret == 0) {
- if ((tmp = (mp_int *)XMALLOC(sizeof(*tmp), NULL,
- DYNAMIC_TYPE_WOLF_BIGINT)) == NULL) {
- ret = MEMORY_E;
- }
- else {
- XMEMSET(tmp, 0, sizeof(*tmp));
- }
- }
- if (ret == 0) {
- if ((tmp2 = (mp_int *)XMALLOC(sizeof(*tmp2), NULL,
- DYNAMIC_TYPE_WOLF_BIGINT)) == NULL) {
- ret = MEMORY_E;
- }
- else {
- XMEMSET(tmp2, 0, sizeof(*tmp2));
- }
- }
-#endif
-
- SAVE_VECTOR_REGISTERS(ret = _svr_ret;);
-
- if (ret == 0) {
- /* force magnitude */
- buf[0] |= 0xC0;
- /* force even */
- buf[bufSz - 1] &= 0xfe;
-
- if (mp_init_multi(tmp, tmp2, &dh->p, &dh->q, &dh->g, 0)
- != MP_OKAY) {
- ret = MP_INIT_E;
- }
- }
-
- if (ret == 0) {
- if (mp_read_unsigned_bin(tmp2, buf, bufSz) != MP_OKAY)
- ret = MP_READ_E;
- }
-
- /* make our prime q */
- if (ret == 0) {
- if (mp_rand_prime(&dh->q, (int)groupSz, rng, NULL) != MP_OKAY)
- ret = PRIME_GEN_E;
- }
-
- /* p = random * q */
- if (ret == 0) {
- if (mp_mul(&dh->q, tmp2, &dh->p) != MP_OKAY)
- ret = MP_MUL_E;
- }
-
- /* p = random * q + 1, so q is a prime divisor of p-1 */
- if (ret == 0) {
- if (mp_add_d(&dh->p, 1, &dh->p) != MP_OKAY)
- ret = MP_ADD_E;
- }
-
- /* tmp = 2q */
- if (ret == 0) {
- if (mp_add(&dh->q, &dh->q, tmp) != MP_OKAY)
- ret = MP_ADD_E;
- }
-
- /* loop until p is prime */
- if (ret == 0) {
- for (;;) {
- if (mp_prime_is_prime_ex(&dh->p, 8, &primeCheck, rng) != MP_OKAY)
- ret = PRIME_GEN_E;
-
- if (primeCheck != MP_YES) {
- /* p += 2q */
- if (mp_add(tmp, &dh->p, &dh->p) != MP_OKAY)
- ret = MP_ADD_E;
- else
- primeCheckCount++;
- }
-
- if (ret != 0 || primeCheck == MP_YES)
- break;
-
- /* linuxkm: release the kernel for a moment before iterating. */
- RESTORE_VECTOR_REGISTERS();
- SAVE_VECTOR_REGISTERS(ret = _svr_ret; break;);
- };
- }
-
- /* tmp2 += (2*loop_check_prime)
- * to have p = (q * tmp2) + 1 prime
- */
- if ((ret == 0) && (primeCheckCount)) {
- if (mp_add_d(tmp2, 2 * primeCheckCount, tmp2) != MP_OKAY)
- ret = MP_ADD_E;
- }
-
- /* find a value g for which g^tmp2 != 1 */
- if ((ret == 0) && (mp_set(&dh->g, 1) != MP_OKAY))
- ret = MP_ZERO_E;
-
- if (ret == 0) {
- do {
- if (mp_add_d(&dh->g, 1, &dh->g) != MP_OKAY)
- ret = MP_ADD_E;
- else if (mp_exptmod(&dh->g, tmp2, &dh->p, tmp) != MP_OKAY)
- ret = MP_EXPTMOD_E;
- } while (ret == 0 && mp_cmp_d(tmp, 1) == MP_EQ);
- }
-
- if (ret == 0) {
- /* at this point tmp generates a group of order q mod p */
-#ifndef USE_FAST_MATH
- /* Exchanging is quick when the data pointer can be copied. */
- mp_exch(tmp, &dh->g);
-#else
- mp_copy(tmp, &dh->g);
-#endif
- }
-
- /* clear the parameters if there was an error */
- if ((ret != 0) && (dh != NULL)) {
- mp_clear(&dh->q);
- mp_clear(&dh->p);
- mp_clear(&dh->g);
- }
-
- RESTORE_VECTOR_REGISTERS();
-
-#ifndef WOLFSSL_NO_MALLOC
- if (buf != NULL)
-#endif
- {
- ForceZero(buf, bufSz);
-#ifndef WOLFSSL_NO_MALLOC
- if (dh != NULL) {
- XFREE(buf, dh->heap, DYNAMIC_TYPE_TMP_BUFFER);
- }
-#endif
- }
-
-#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
- if (tmp != NULL) {
- mp_clear(tmp);
- XFREE(tmp, NULL, DYNAMIC_TYPE_WOLF_BIGINT);
- }
- if (tmp2 != NULL) {
- mp_clear(tmp2);
- XFREE(tmp2, NULL, DYNAMIC_TYPE_WOLF_BIGINT);
- }
-#else
- mp_clear(tmp);
- mp_clear(tmp2);
-#endif
-
- return ret;
-}
-
-#endif /* WOLFSSL_KEY_GEN */
-
-/* Export raw DH parameters from DhKey structure
- *
- * dh - pointer to initialized DhKey structure
- * p - output location for DH (p) parameter
- * pSz - [IN/OUT] size of output buffer for p, size of p
- * q - output location for DH (q) parameter
- * qSz - [IN/OUT] size of output buffer for q, size of q
- * g - output location for DH (g) parameter
- * gSz - [IN/OUT] size of output buffer for g, size of g
- *
- * If p, q, and g pointers are all passed in as NULL, the function
- * will set pSz, qSz, and gSz to the required output buffer sizes for p,
- * q, and g. In this case, the function will return LENGTH_ONLY_E.
- *
- * returns 0 on success, negative upon failure
- */
-int wc_DhExportParamsRaw(DhKey* dh, byte* p, word32* pSz,
- byte* q, word32* qSz, byte* g, word32* gSz)
-{
- int ret = 0;
- word32 pLen = 0, qLen = 0, gLen = 0;
-
- if (dh == NULL || pSz == NULL || qSz == NULL || gSz == NULL)
- ret = BAD_FUNC_ARG;
-
- /* get required output buffer sizes */
- if (ret == 0) {
- pLen = (word32)mp_unsigned_bin_size(&dh->p);
- qLen = (word32)mp_unsigned_bin_size(&dh->q);
- gLen = (word32)mp_unsigned_bin_size(&dh->g);
-
- /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */
- if (p == NULL && q == NULL && g == NULL) {
- *pSz = pLen;
- *qSz = qLen;
- *gSz = gLen;
- ret = WC_NO_ERR_TRACE(LENGTH_ONLY_E);
- }
- }
-
- if (ret == 0) {
- if (p == NULL || q == NULL || g == NULL)
- ret = BAD_FUNC_ARG;
- }
-
- /* export p */
- if (ret == 0) {
- if (*pSz < pLen) {
- WOLFSSL_MSG("Output buffer for DH p parameter too small, "
- "required size placed into pSz");
- *pSz = pLen;
- ret = BUFFER_E;
- }
- }
-
- if (ret == 0) {
- *pSz = pLen;
- if (mp_to_unsigned_bin(&dh->p, p) != MP_OKAY)
- ret = MP_TO_E;
- }
-
- /* export q */
- if (ret == 0) {
- if (*qSz < qLen) {
- WOLFSSL_MSG("Output buffer for DH q parameter too small, "
- "required size placed into qSz");
- *qSz = qLen;
- ret = BUFFER_E;
- }
- }
-
- if (ret == 0) {
- *qSz = qLen;
- if (mp_to_unsigned_bin(&dh->q, q) != MP_OKAY)
- ret = MP_TO_E;
- }
-
- /* export g */
- if (ret == 0) {
- if (*gSz < gLen) {
- WOLFSSL_MSG("Output buffer for DH g parameter too small, "
- "required size placed into gSz");
- *gSz = gLen;
- ret = BUFFER_E;
- }
- }
-
- if (ret == 0) {
- *gSz = gLen;
- if (mp_to_unsigned_bin(&dh->g, g) != MP_OKAY)
- ret = MP_TO_E;
- }
-
- return ret;
-}
-
-#endif /* NO_DH */
diff --git a/src/ssl/wolfssl/wolfcrypt/dilithium.c b/src/ssl/wolfssl/wolfcrypt/dilithium.c
deleted file mode 100644
index 994c70c21..000000000
--- a/src/ssl/wolfssl/wolfcrypt/dilithium.c
+++ /dev/null
@@ -1,12505 +0,0 @@
-/* dilithium.c
- *
- * Copyright (C) 2006-2025 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/* Based on ed448.c and Reworked for Dilithium by Anthony Hu.
- * WolfSSL implementation by Sean Parkinson.
- */
-
-/* Possible Dilithium/ML-DSA options:
- *
- * HAVE_DILITHIUM Default: OFF
- * Enables the code in this file to be compiled.
- * WOLFSSL_WC_DILITHIUM Default: OFF
- * Compiles the wolfSSL implementation of dilithium.
- *
- * WOLFSSL_NO_ML_DSA_44 Default: OFF
- * Does not compile in parameter set ML-DSA-44 and any code specific to that
- * parameter set.
- * WOLFSSL_NO_ML_DSA_65 Default: OFF
- * Does not compile in parameter set ML-DSA-65 and any code specific to that
- * parameter set.
- * WOLFSSL_NO_ML_DSA_87 Default: OFF
- * Does not compile in parameter set ML-DSA-87 and any code specific to that
- * parameter set.
- *
- * WOLFSSL_DILITHIUM_NO_LARGE_CODE Default: OFF
- * Compiles smaller, fast code with speed trade-off.
- * WOLFSSL_DILITHIUM_SMALL Default: OFF
- * Compiles to small code size with a speed trade-off.
- * WOLFSSL_DILITHIUM_VERIFY_ONLY Default: OFF
- * Compiles in only the verification and public key operations.
- * WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM Default: OFF
- * Compiles verification implementation that uses smaller amounts of memory.
- * WOLFSSL_DILITHIUM_VERIFY_NO_MALLOC Default: OFF
- * Only works with WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM.
- * Don't allocate memory with XMALLOC. Memory is pinned against key.
- * WOLFSSL_DILITHIUM_ASSIGN_KEY Default: OFF
- * Key data is assigned into Dilithium key rather than copied.
- * Life of key data passed in is tightly coupled to life of Dilithium key.
- * Cannot be used when make key is enabled.
- * WOLFSSL_DILITHIUM_SIGN_SMALL_MEM Default: OFF
- * Compiles signature implementation that uses smaller amounts of memory but
- * is considerably slower.
- * WOLFSSL_DILITHIUM_SIGN_SMALL_MEM_PRECALC Default: OFF
- * Compiles signature implementation that uses smaller amounts of memory but
- * is considerably slower. Allocates vectors and decodes private key data
- * into them upfront.
- * WOLFSSL_DILITHIUM_SIGN_SMALL_MEM_PRECALC_A Default: OFF
- * Compiles signature implementation that uses smaller amounts of memory but
- * is slower. Allocates matrix A and calculates it upfront.
- * WOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM Default: OFF
- * Compiles key generation implementation that uses smaller amounts of memory
- * but is slower.
- * WOLFSSL_DILITHIUM_SMALL_MEM_POLY64 Default: OFF
- * Compiles the small memory implementations to use a 64-bit polynomial.
- * Uses 2KB of memory but is slightly quicker (2.75-7%).
- *
- * WOLFSSL_DILITHIUM_ALIGNMENT Default: 8
- * Use to indicate whether loading and storing of words needs to be aligned.
- * Default is to use WOLFSSL_GENERAL_ALIGNMENT - should be 4 on some ARM CPUs.
- * Set this value explicitly if specific Dilithium implementation alignment is
- * needed.
- *
- * WOLFSSL_DILITHIUM_NO_ASN1 Default: OFF
- * Disables any ASN.1 encoding or decoding code.
- * WOLFSSL_DILITHIUM_REVERSE_HASH_OID Default: OFF
- * Reverse the DER encoded hash oid when signing and verifying a pre-hashed
- * message.
- *
- * WC_DILITHIUM_CACHE_MATRIX_A Default: OFF
- * Enable caching of the A matrix on import.
- * Less work is required in sign and verify operations.
- * WC_DILITHIUM_CACHE_PRIV_VECTORS Default: OFF
- * Enable caching of private key vectors on import.
- * Enables WC_DILITHIUM_CACHE_MATRIX_A.
- * Less work is required in sign operations.
- * WC_DILITHIUM_CACHE_PUB_VECTORS Default: OFF
- * Enable caching of public key vectors on import.
- * Enables WC_DILITHIUM_CACHE_MATRIX_A.
- * Less work is required in sign operations.
- * WC_DILITHIUM_FIXED_ARRAY Default: OFF
- * Make the matrix and vectors of cached data fixed arrays that have
- * maximumal sizes for the configured parameters.
- * Useful in low dynamic memory situations.
- *
- * WOLFSSL_DILITHIUM_SIGN_CHECK_Y Default: OFF
- * Check vector y is in required range as an early check on valid vector z.
- * Falsely reports invalid in approximately 1-2% of checks.
- * All valid reports are true.
- * Fast fail gives faster signing times on average.
- * DO NOT enable this if implementation must be conformant to FIPS 204.
- * WOLFSSL_DILITHIUM_SIGN_CHECK_W0 Default: OFF
- * Check vector w0 is in required range as an early check on valid vector r0.
- * Falsely reports invalid in approximately 3-5% of checks.
- * All valid reports are true.
- * Fast fail gives faster signing times on average.
- * DO NOT enable this if implementation must be conformant to FIPS 204.
- *
- * DILITHIUM_MUL_SLOW Default: OFF
- * Define when multiplying by Q / 44 is slower than masking.
- * Only applies to ML-DSA-44.
- * DILITHIUM_MUL_44_SLOW Default: OFF
- * Define when multiplying by 44 is slower than by 11.
- * Only applies to ML-DSA-44.
- * DILITHIUM_MUL_11_SLOW Default: OFF
- * Define when multiplying by 11 is slower than adding and shifting.
- * Only applies to ML-DSA-44.
- * DILITHIUM_MUL_QINV_SLOW Default: OFF
- * Define when multiplying by QINV 0x3802001 is slower than add, subtract and
- * shift equivalent.
- * DILITHIUM_MUL_Q_SLOW Default: OFF
- * Define when multiplying by Q 0x7fe001 is slower than add, subtract and
- * shift equivalent.
- */
-
-#include