WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-4434: honor caller-provided saltLen in Rsa.wc_RsaPSS_VerifyCheck() JNI wrapper

pull/236/head
Chris Conlon 2026-07-02 14:37:31 -06:00
parent d686a437ea
commit 957c941fc4
2 changed files with 66 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
jni/jni_rsa.c
View File

@ -46,6 +46,11 @@
#define RNG WC_RNG
#endif
/* RSA_PSS_SALT_LEN_DEFAULT not in FIPSv2 */
#ifndef RSA_PSS_SALT_LEN_DEFAULT
#define RSA_PSS_SALT_LEN_DEFAULT (-1)
#endif
JNIEXPORT jlong JNICALL
Java_com_wolfssl_wolfcrypt_Rsa_mallocNativeStruct(
JNIEnv* env, jobject this)
@ -1717,11 +1722,29 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPSS_1VerifyCheck(
if (ret == 0) {
XMEMSET(output, 0, outputSz);
ret = wc_RsaPSS_VerifyCheck(signature, signatureSz, output, outputSz,
digest, digestSz, (enum wc_HashType)hashType, mgf, key);
}
if (ret > 0) {
result = JNI_TRUE;
if ((saltLen == RSA_PSS_SALT_LEN_DEFAULT) ||
(saltLen == (int)digestSz)) {
ret = wc_RsaPSS_VerifyCheck(signature, signatureSz, output,
outputSz, digest, digestSz, (enum wc_HashType)hashType,
mgf, key);
if (ret > 0) {
result = JNI_TRUE;
}
}
else {
/* Non-default salt length */
ret = wc_RsaPSS_Verify_ex(signature, signatureSz, output,
outputSz, (enum wc_HashType)hashType, mgf, saltLen, key);
if (ret > 0) {
/* Verify PSS padding against the provided digest */
ret = wc_RsaPSS_CheckPadding_ex(digest, digestSz, output,
(word32)ret, (enum wc_HashType)hashType, saltLen, 0);
if (ret == 0) {
result = JNI_TRUE;
}
}
}
}
LogStr("wc_RsaPSS_VerifyCheck(sig, sigSz, out, outSz, digest, "

38
src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java
View File

@ -1261,6 +1261,44 @@ public class RsaTest {
digest, WolfCrypt.WC_HASH_TYPE_SHA256, Rsa.WC_MGF1SHA256, 32);
assertTrue("RSA-PSS check verification failed", verified);
/* Test with non-default salt length,
* saltLen != digest length must be honored on verify */
signature = key.rsaPssSign(digest,
WolfCrypt.WC_HASH_TYPE_SHA256, Rsa.WC_MGF1SHA256, 16, rng);
assertNotNull(signature);
assertTrue(signature.length > 0);
verified = key.rsaPssVerifyWithDigest(signature, message,
digest, WolfCrypt.WC_HASH_TYPE_SHA256, Rsa.WC_MGF1SHA256, 16);
assertTrue("RSA-PSS check verification failed with " +
"non-default salt length", verified);
/* Verification with wrong salt length should fail */
try {
verified = key.rsaPssVerifyWithDigest(signature, message,
digest, WolfCrypt.WC_HASH_TYPE_SHA256,
Rsa.WC_MGF1SHA256, 32);
} catch (WolfCryptException e) {
/* native error acceptable here, treat as not verified */
verified = false;
}
assertFalse("RSA-PSS check verification passed with " +
"mismatched salt length", verified);
/* Test special value RSA_PSS_SALT_LEN_DEFAULT, sign uses
* salt length equal to digest length */
signature = key.rsaPssSign(digest,
WolfCrypt.WC_HASH_TYPE_SHA256, Rsa.WC_MGF1SHA256,
Rsa.RSA_PSS_SALT_LEN_DEFAULT, rng);
assertNotNull(signature);
assertTrue(signature.length > 0);
verified = key.rsaPssVerifyWithDigest(signature, message,
digest, WolfCrypt.WC_HASH_TYPE_SHA256, Rsa.WC_MGF1SHA256,
Rsa.RSA_PSS_SALT_LEN_DEFAULT);
assertTrue("RSA-PSS check verification failed with " +
"RSA_PSS_SALT_LEN_DEFAULT", verified);
} catch (Exception e) {
fail("RSA-PSS check verification test failed: " + e.getMessage());
}