Skip to content

Update vendored Wycheproof RSA-OAEP vectors and remove workaround #3097

@sgmenda

Description

@sgmenda

In c59b86c, I added a workaround in crypto/evp_extra/evp_test.cc (lines 963-964) with the comment:

AWS-LC enforces FIPS 800-56B Rev. 2 §7.1.2.1 which requires 1 < c < (n-1).
But Wycheproof mistakenly marks some vectors with c values outside this range as valid.

This comment is incorrect. Wycheproof was not wrong---our vendored copy of rsa_oaep_misc_test.json was outdated. Upstream Wycheproof reclassified these vectors in C2SP/wycheproof@df4e933 (May 1, 2025), changing 3 test cases from valid to acceptable and adding a SmallIntegerCiphertext flag, citing the same SP 800-56B §7.1.2.1 rationale.

Affected vectors

These 3 vectors have ciphertext values of 0 or 1, which fall outside the range 1 < c < (n-1) required by SP 800-56B §7.1.2.1:

Old tcId (vendored) New tcId (upstream) ct value sha
756 376 1 SHA-256
765 385 1 SHA-256
772 392 0 SHA-384

All three are identical (same ct, msg, label, sha, mgfSha) across the old and new formats.

Fix

  1. Update the vendored third_party/wycheproof_testvectors/rsa_oaep_misc_test.json to current upstream.
  2. Remove the manual range-check override in crypto/evp_extra/evp_test.cc (~lines 963-978).
  3. Add "SmallIntegerCiphertext" to the IsValid call; that is
    bool is_valid = result.IsValid({"SmallModulus", "SmallIntegerCiphertext"});

Metadata

Metadata

Assignees

Labels

vectorsRelated to third-party test vectors

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions