From 90f5d26a7982da8aa033b373108845cac6d86080 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 16 Oct 2026 11:37:51 -0600 Subject: [PATCH 1/5] F-15068: document the length-prefixed encodedEntry wrapper in the WolfSSLKeyStore WKS format Javadoc --- .../wolfssl/provider/jce/WolfSSLKeyStore.java | 66 ++++++++++--------- 1 file changed, 36 insertions(+), 30 deletions(-) diff --git a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java index 62f9389f..2adfd87c 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java @@ -118,42 +118,48 @@ * [WKSPrivateKey] * entryId (int / 1) * alias (UTF String) - * creationDate.getTime() (long) - * kdfSalt.length (int) - * kdfSalt (byte[]) - * kdfIterations (int) - * iv.length (int) - * iv (byte[]) - * encryptedKey.length (int) - * encryptedKey (byte[]) - * chain.length (int) - * FOR EACH CERT: - * chain[i].getType() (UTF String) - * chain[i].getEncoded().length (int) - * chain[i].getEncoced() (byte[]) - * hmac.length (int) - * hmac (HMAC-SHA512) (byte[]) + * encodedEntry.length (int) + * encodedEntry (byte[]), containing: + * creationDate.getTime() (long) + * kdfSalt.length (int) + * kdfSalt (byte[]) + * kdfIterations (int) + * iv.length (int) + * iv (byte[]) + * encryptedKey.length (int) + * encryptedKey (byte[]) + * chain.length (int) + * FOR EACH CERT: + * chain[i].getType() (UTF String) + * chain[i].getEncoded().length (int) + * chain[i].getEncoded() (byte[]) + * hmac.length (int) + * hmac (HMAC-SHA512) (byte[]) * [WKSSecretKey] * entryId (int / 3) * alias (UTF String) - * creationDate.getTime() (long) - * key.getAlgorithm() (UTF String) - * kdfSalt.length (int) - * kdfSalt (byte[]) - * kdfIterations (int) - * iv.length (int) - * iv (byte[]) - * encryptedKey.length (int) - * encryptedKey (byte[]) - * hmac.length (int) - * hmac (HMAC-SHA512) (byte[]) + * encodedEntry.length (int) + * encodedEntry (byte[]), containing: + * creationDate.getTime() (long) + * key.getAlgorithm() (UTF String) + * kdfSalt.length (int) + * kdfSalt (byte[]) + * kdfIterations (int) + * iv.length (int) + * iv (byte[]) + * encryptedKey.length (int) + * encryptedKey (byte[]) + * hmac.length (int) + * hmac (HMAC-SHA512) (byte[]) * [WKSCertificate] * entryId (int / 2) * alias (UTF String) - * creationDate.getTime() (long) - * cert.getType() (UTF String) - * cert.getEncoded().length (int) - * cert.getEncoced() (byte[]) + * encodedEntry.length (int) + * encodedEntry (byte[]), containing: + * creationDate.getTime() (long) + * cert.getType() (UTF String) + * cert.getEncoded().length (int) + * cert.getEncoded() (byte[]) * HMAC PBKDF2 salt length int * HMAC PBKDF2 salt (byte[]) * HMAC PBKDF2 iterations int From 052e15e9bec6609a09c0823821de6cf9050746e6 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 16 Oct 2026 11:45:19 -0600 Subject: [PATCH 2/5] F-15069: correct SlhDsa class Javadoc to describe deferred and DER-detected parameter sets --- src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java b/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java index 22468ff5..911704c4 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java +++ b/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java @@ -26,9 +26,12 @@ * *

Mirrors the native wolfCrypt {@code wc_SlhDsaKey_*} API. SLH-DSA is a * stateless hash-based signature scheme (formerly SPHINCS+). The parameter - * set is fixed at construction and maps directly to the native - * {@code enum SlhDsaParam} integer value. An empty FIPS 205 context is used - * by default.

+ * set maps directly to the native {@code enum SlhDsaParam} integer value. It + * is given to {@link #SlhDsa(int)}, or left unset by {@link #SlhDsa()} until + * {@link #importPublicKeyDer(byte[])} or {@link #importPrivateKeyDer(byte[])} + * detects it from the key's AlgorithmIdentifier OID. DER import always uses + * the OID's parameter set, replacing one given at construction. An empty + * FIPS 205 context is used by default.

* *

Parameter set constants match the native {@code enum SlhDsaParam}: the * six SHAKE sets are 0-5, the six SHA2 sets are 6-11. Note this ordering is From 0b27a2f3424e6bc881c7855469ae5920ed3a26d5 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 16 Oct 2026 11:57:01 -0600 Subject: [PATCH 3/5] F-15070: correct LMS verify comment to say which returns map to false and which throw --- jni/jni_lms.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/jni/jni_lms.c b/jni/jni_lms.c index a310ecc4..a8fcd75b 100644 --- a/jni/jni_lms.c +++ b/jni/jni_lms.c @@ -230,7 +230,8 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_wolfcrypt_Lms_wc_1LmsKey_1verify result = JNI_TRUE; } else if (ret != SIG_VERIFY_E && ret != SIG_TYPE_E && ret != BUFFER_E) { - /* Treat these returns as failed verification */ + /* Verify error, type does not match, and wrong sig length leave result + * false. Other returns are an error. */ throwWolfCryptExceptionFromError(env, ret); } From 4cd464faace869b8965e3bbc76c37282b566dce3 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 16 Oct 2026 12:13:19 -0600 Subject: [PATCH 4/5] F-15083: document the block-aligned AES-CBC update() length requirement in Aes Javadoc --- src/main/java/com/wolfssl/wolfcrypt/Aes.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/main/java/com/wolfssl/wolfcrypt/Aes.java b/src/main/java/com/wolfssl/wolfcrypt/Aes.java index 902d915f..01fe3f19 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/Aes.java +++ b/src/main/java/com/wolfssl/wolfcrypt/Aes.java @@ -26,6 +26,16 @@ /** * Wrapper for the native WolfCrypt AES implementation. * + *

Operates in AES-CBC mode. As with native wc_AesCbcEncrypt() and + * wc_AesCbcDecrypt(), the length passed to update() must be a multiple of + * {@link #BLOCK_SIZE}. Native wolfCrypt always rejects other lengths when + * decrypting. When encrypting it rejects them only when built with + * WOLFSSL_AES_CBC_LENGTH_CHECKS, otherwise it processes whole blocks only, + * and output bytes past the last whole block are not written, although + * update() still returns the full length. Pad input with + * {@link BlockCipher#padPKCS7(byte[], int)} or buffer partial blocks before + * calling update().

+ * * @author wolfSSL Inc. */ public class Aes extends BlockCipher { From c00dc5d0436d3cf73a7dad8cedcac471a7c724af Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 16 Oct 2026 12:17:50 -0600 Subject: [PATCH 5/5] F-15082: document that Fips.DhAgree() agree must hold the full DH shared secret --- src/main/java/com/wolfssl/wolfcrypt/Fips.java | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/wolfssl/wolfcrypt/Fips.java b/src/main/java/com/wolfssl/wolfcrypt/Fips.java index 5864a071..9244845c 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/Fips.java +++ b/src/main/java/com/wolfssl/wolfcrypt/Fips.java @@ -1823,9 +1823,14 @@ public static int DhGenerateKeyPair(Dh key, Rng rng, byte[] priv, * Creates the agreement agree of size agreeSz using Dh key private priv of * size privSz and peer's public key otherPub of size pubSz. * + * As with native wc_DhAgree(), agree must hold the full shared secret, + * which can be as long as the DH prime p. Native does not check agreeSz + * against the secret length. + * * @param key the Dh object. * @param agree the agree buffer. - * @param agreeSz the agree length. + * @param agreeSz on input the size of agree, on output the length of the + * shared secret. * @param priv the private part buffer. * @param privSz the private part length. * @param otherPub the peer's public part buffer. @@ -1845,9 +1850,14 @@ public static int DhAgree(Dh key, ByteBuffer agree, long[] agreeSz, * Creates the agreement agree of size agreeSz using Dh key private priv of * size privSz and peer's public key otherPub of size pubSz. * + * As with native wc_DhAgree(), agree must hold the full shared secret, + * which can be as long as the DH prime p. Native does not check agreeSz + * against the secret length. + * * @param key the Dh object. * @param agree the agree buffer. - * @param agreeSz the agree length. + * @param agreeSz on input the size of agree, on output the length of the + * shared secret. * @param priv the private part buffer. * @param privSz the private part length. * @param otherPub the peer's public part buffer.