WolfSSL
/
wolfcrypt-py
mirror of https://github.com/wolfSSL/wolfcrypt-py.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Update AESGCM test 

Read minimum supported tag size from settings and make the
test less ambiguous.
pull/126/head
Martijn de Milliano 2026-06-26 00:31:05 +02:00
parent aec3f2d553
commit fc5ea53605
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/build_ffi.py
View File

@ -379,6 +379,9 @@ def get_features(local_wolfssl, features):
features["ML_DSA_NO_CTX"] = 1 if '#define WOLFSSL_DILITHIUM_NO_CTX' in defines else 0
features["ML_KEM"] = 1 if '#define WOLFSSL_HAVE_MLKEM' in defines else 0
features["HKDF"] = 1 if "#define HAVE_HKDF" in defines else 0
# Try to read minimum AESGCM authentication tag size from settings, else use default.
min_auth_tag_sz = re.search(r'#define\s+WOLFSSL_MIN_AUTH_TAG_SZ\s+(\d+)', '\n'.join(defines))
features["MIN_AUTH_TAG_SZ"] = int(min_auth_tag_sz.group(1)) if min_auth_tag_sz else 12
if '#define HAVE_FIPS' in defines:
if not fips:
@ -499,6 +502,7 @@ def build_ffi(local_wolfssl, features):
int ML_DSA_ENABLED = {features["ML_DSA"]};
int ML_DSA_NO_CTX = {features["ML_DSA_NO_CTX"]};
int HKDF_ENABLED = {features["HKDF"]};
int MIN_AUTH_TAG_SZ = {features["MIN_AUTH_TAG_SZ"]};
"""
ffibuilder.set_source( "wolfcrypt._ffi", init_source_string,
@ -540,6 +544,7 @@ def build_ffi(local_wolfssl, features):
extern int ML_DSA_ENABLED;
extern int ML_DSA_NO_CTX;
extern int HKDF_ENABLED;
extern int MIN_AUTH_TAG_SZ;
typedef unsigned char byte;
typedef unsigned int word32;
@ -1375,6 +1380,7 @@ def main(ffibuilder):
"ML_KEM": 1,
"ML_DSA": 1,
"HKDF": 1,
"MIN_AUTH_TAG_SZ": 12,
}
# Ed448 requires SHAKE256, which isn't part of the Windows build, yet.

13
tests/test_aesgcmstream.py
View File

@ -25,7 +25,7 @@ from wolfcrypt._ffi import lib as _lib
if _lib.AESGCM_STREAM_ENABLED:
import pytest
from wolfcrypt.utils import t2b
from wolfcrypt.exceptions import WolfCryptError, WolfCryptApiError
from wolfcrypt.exceptions import WolfCryptError
from binascii import hexlify as b2h
from wolfcrypt.ciphers import AesGcmStream
@ -139,16 +139,11 @@ if _lib.AESGCM_STREAM_ENABLED:
AesGcmStream(key, iv, tag_bytes=bad)
# Valid NIST sizes: verify the resulting tag has the requested length.
for good in (4, 8, 12, 13, 14, 15, 16):
if good < _lib.MIN_AUTH_TAG_SZ:
continue
gcm = AesGcmStream(key, iv, tag_bytes=good)
gcm.encrypt("hello world")
try:
tag = gcm.final()
except WolfCryptApiError as exception:
if "(-173)" in str(exception) and good < 12:
# Probably this authentication tag size is not supported,
# the minimum is 12 by default. Ignore.
continue
raise
tag = gcm.final()
assert len(tag) == good
def test_decrypt_rejects_wrong_tag_length():