From 078aec9189083e33308eeb719225719ac046636a Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Tue, 21 Jul 2026 13:42:55 -0600 Subject: [PATCH] JNI: add missing PRIVATE_KEY_UNLOCK/LOCK around PBKDF2 and key exports --- jni/jni_ed25519.c | 7 +++++++ jni/jni_mldsa.c | 15 +++++++++++++++ jni/jni_mlkem.c | 7 +++++++ jni/jni_pwdbased.c | 7 +++++++ jni/jni_slhdsa.c | 5 +++++ 5 files changed, 41 insertions(+) diff --git a/jni/jni_ed25519.c b/jni/jni_ed25519.c index 063afd2a..2026bd81 100644 --- a/jni/jni_ed25519.c +++ b/jni/jni_ed25519.c @@ -27,6 +27,9 @@ #include #endif #include +#ifdef HAVE_FIPS + #include +#endif #include #include #include @@ -321,7 +324,9 @@ Java_com_wolfssl_wolfcrypt_Ed25519_wc_1ed25519_1export_1private( } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_ed25519_export_private(ed25519, output, &outputSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, outputSz); @@ -389,7 +394,9 @@ Java_com_wolfssl_wolfcrypt_Ed25519_wc_1ed25519_1export_1private_1only( } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_ed25519_export_private_only(ed25519, output, &outputSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, outputSz); diff --git a/jni/jni_mldsa.c b/jni/jni_mldsa.c index 20ef1aed..1d4c31a9 100644 --- a/jni/jni_mldsa.c +++ b/jni/jni_mldsa.c @@ -28,6 +28,9 @@ #endif #include +#ifdef HAVE_FIPS + #include +#endif #include #if defined(HAVE_DILITHIUM) || defined(WOLFSSL_HAVE_MLDSA) @@ -686,7 +689,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1exp } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_ExportPrivRaw(key, output, &outputSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, outputSz); if (result != NULL) { @@ -880,7 +885,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1Dilithium_1Key } /* Two-pass: first call with NULL output to get required size. */ + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_KeyToDer(key, NULL, 0); + PRIVATE_KEY_LOCK(); if (ret <= 0) { throwWolfCryptExceptionFromError(env, ret); return NULL; @@ -895,7 +902,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1Dilithium_1Key } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_KeyToDer(key, output, outputSz); + PRIVATE_KEY_LOCK(); if (ret > 0) { result = (*env)->NewByteArray(env, ret); if (result != NULL) { @@ -1138,7 +1147,9 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1make_1key ret = BAD_FUNC_ARG; } else { + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_MakeKeyFromSeed(key, seed); + PRIVATE_KEY_LOCK(); } if (ret != 0) { @@ -1938,7 +1949,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1Dilithium_1Pri } /* Two-pass: first call with NULL output to get required size. */ + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_PrivateKeyToDer(key, NULL, 0); + PRIVATE_KEY_LOCK(); if (ret <= 0) { throwWolfCryptExceptionFromError(env, ret); return NULL; @@ -1953,7 +1966,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1Dilithium_1Pri } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_MlDsaKey_PrivateKeyToDer(key, output, outputSz); + PRIVATE_KEY_LOCK(); if (ret > 0) { result = (*env)->NewByteArray(env, ret); if (result != NULL) { diff --git a/jni/jni_mlkem.c b/jni/jni_mlkem.c index d3eea734..c5bf4cde 100644 --- a/jni/jni_mlkem.c +++ b/jni/jni_mlkem.c @@ -27,6 +27,9 @@ #include #endif #include +#ifdef HAVE_FIPS + #include +#endif #include #include #ifdef WOLFSSL_HAVE_MLKEM @@ -444,7 +447,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlKem_wc_1mlkem_1decapsu } XMEMSET(output, 0, ssSz); + PRIVATE_KEY_UNLOCK(); ret = wc_MlKemKey_Decapsulate(key, output, ct, ctSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, ssSz); @@ -571,7 +576,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlKem_wc_1mlkem_1export_ } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_MlKemKey_EncodePrivateKey(key, output, outputSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, outputSz); diff --git a/jni/jni_pwdbased.c b/jni/jni_pwdbased.c index 70ea8923..0cda8e67 100644 --- a/jni/jni_pwdbased.c +++ b/jni/jni_pwdbased.c @@ -27,6 +27,9 @@ #include #endif #include +#ifdef HAVE_FIPS + #include +#endif #include #include @@ -67,8 +70,10 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PKCS12_1PBK salt = (byte*)(*env)->GetByteArrayElements(env, saltBuf, NULL); } + PRIVATE_KEY_UNLOCK(); ret = wc_PKCS12_PBKDF(outKey, pass, passBufLen, salt, sBufLen, iterations, kLen, typeH, id); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, kLen); if (result != NULL) { @@ -151,8 +156,10 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2 salt = (byte*)(*env)->GetByteArrayElements(env, saltBuf, NULL); } + PRIVATE_KEY_UNLOCK(); ret = wc_PBKDF2(outKey, pass, passBufLen, salt, sBufLen, iterations, kLen, hashType); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, kLen); if (result != NULL) { diff --git a/jni/jni_slhdsa.c b/jni/jni_slhdsa.c index 9a8b24df..f2770c4c 100644 --- a/jni/jni_slhdsa.c +++ b/jni/jni_slhdsa.c @@ -28,6 +28,9 @@ #endif #include +#ifdef HAVE_FIPS + #include +#endif #include #ifdef WOLFSSL_HAVE_SLHDSA @@ -1236,7 +1239,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_SlhDsa_wc_1SlhDsaKey_1ex } XMEMSET(output, 0, outputSz); + PRIVATE_KEY_UNLOCK(); ret = wc_SlhDsaKey_ExportPrivate(key, output, &outputSz); + PRIVATE_KEY_LOCK(); if (ret == 0) { result = (*env)->NewByteArray(env, outputSz); if (result != NULL) {