WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Derive the expected ECC rejection in the priv-only key test 

wolfSSL master now rejects a private scalar outside [1, n-1] when importing
one, so the zeroed key that test_IdentifyAsn1Key_EccPrivOnlyDerFailure builds
fails in wc_EccPrivateKeyDecode instead of reaching the wc_ecc_make_pub
fallback in IdentifyAsn1Key. The identify call then reports the key as
unidentified, WS_UNIMPLEMENTED_E, rather than WS_CRYPTO_FAILED, and the test
failed against any wolfSSL built from master.

- decode the corrupted DER first and expect the rejection the linked wolfSSL
  performs, so the assertion stays strict on either library
pull/1185/head
John Safranek 2026-08-20 15:49:49 -07:00 committed by JacobBarthelmeh
parent e7c8dc2c2c
commit 17461f2271
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
tests/unit.c
View File

@ -11167,6 +11167,7 @@ static int test_IdentifyAsn1Key_EccPrivOnlyDerFailure(int curveSz,
byte* eccDer = NULL;
int eccDerSz;
int i;
int expected = WS_CRYPTO_FAILED;
WMEMSET(&eccKey, 0, sizeof(eccKey));
if (wc_ecc_init(&eccKey) != 0) {
@ -11209,12 +11210,30 @@ static int test_IdentifyAsn1Key_EccPrivOnlyDerFailure(int curveSz,
}
}
/* Some wolfSSL builds reject the zeroed scalar while decoding the DER,
* so IdentifyAsn1Key never reaches the derivation and reports the key
* as unidentified. Ask this build which rejection to expect. */
{
ecc_key probeKey;
word32 probeIdx = 0;
if (wc_ecc_init(&probeKey) != 0) {
WFREE(eccDer, NULL, 0);
return -6939;
}
if (wc_EccPrivateKeyDecode(eccDer, &probeIdx, &probeKey,
(word32)eccDerSz) != 0) {
expected = WS_UNIMPLEMENTED_E;
}
wc_ecc_free(&probeKey);
}
ret = IdentifyAsn1Key(eccDer, (word32)eccDerSz, 1, NULL, NULL);
WFREE(eccDer, NULL, 0);
if (ret != WS_CRYPTO_FAILED) {
printf("IdentifyAsn1Key: private-only ECC %s DER fallback derivation "
"expected WS_CRYPTO_FAILED, got %d\n", curveName, ret);
if (ret != expected) {
printf("IdentifyAsn1Key: private-only ECC %s DER rejection expected "
"%d, got %d\n", curveName, expected, ret);
return -6938;
}