In c59b86c, I added a workaround in crypto/evp_extra/evp_test.cc (lines 963-964) with the comment:
AWS-LC enforces FIPS 800-56B Rev. 2 §7.1.2.1 which requires 1 < c < (n-1).
But Wycheproof mistakenly marks some vectors with c values outside this range as valid.
This comment is incorrect. Wycheproof was not wrong---our vendored copy of rsa_oaep_misc_test.json was outdated. Upstream Wycheproof reclassified these vectors in C2SP/wycheproof@df4e933 (May 1, 2025), changing 3 test cases from valid to acceptable and adding a SmallIntegerCiphertext flag, citing the same SP 800-56B §7.1.2.1 rationale.
Affected vectors
These 3 vectors have ciphertext values of 0 or 1, which fall outside the range 1 < c < (n-1) required by SP 800-56B §7.1.2.1:
| Old tcId (vendored) |
New tcId (upstream) |
ct value |
sha |
| 756 |
376 |
1 |
SHA-256 |
| 765 |
385 |
1 |
SHA-256 |
| 772 |
392 |
0 |
SHA-384 |
All three are identical (same ct, msg, label, sha, mgfSha) across the old and new formats.
Fix
- Update the vendored
third_party/wycheproof_testvectors/rsa_oaep_misc_test.json to current upstream.
- Remove the manual range-check override in
crypto/evp_extra/evp_test.cc (~lines 963-978).
- Add
"SmallIntegerCiphertext" to the IsValid call; that is
bool is_valid = result.IsValid({"SmallModulus", "SmallIntegerCiphertext"});
In c59b86c, I added a workaround in
crypto/evp_extra/evp_test.cc(lines 963-964) with the comment:This comment is incorrect. Wycheproof was not wrong---our vendored copy of
rsa_oaep_misc_test.jsonwas outdated. Upstream Wycheproof reclassified these vectors in C2SP/wycheproof@df4e933 (May 1, 2025), changing 3 test cases fromvalidtoacceptableand adding aSmallIntegerCiphertextflag, citing the same SP 800-56B §7.1.2.1 rationale.Affected vectors
These 3 vectors have ciphertext values of 0 or 1, which fall outside the range
1 < c < (n-1)required by SP 800-56B §7.1.2.1:All three are identical (same ct, msg, label, sha, mgfSha) across the old and new formats.
Fix
third_party/wycheproof_testvectors/rsa_oaep_misc_test.jsonto current upstream.crypto/evp_extra/evp_test.cc(~lines 963-978)."SmallIntegerCiphertext"to theIsValidcall; that is