20260713-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED-etc#10920

Merged

JacobBarthelmeh merged 18 commits into

wolfSSL:masterfrom

douzzer:20260713-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED-etc

Jul 20, 2026

Commits on Jul 20, 2026

Implement FIPS shimming for wc_AesGcmEncrypt():
douzzer
committed
linuxkm/lkcapi_aes_glue.c: in the inner streaming loops for AES-GCM and AES-XTS (AesGcmCrypt_1(), km_AesXtsEncrypt(), and km_AesXtsDecrypt()), bypass FIPS wrappers to avoid frivolous overhead, with…
douzzer
committed
wolfcrypt/src/aes.c: revert atomic refactor of checkedAESNI, haveAESNI, and intel_flags (3f3ebcac58 / #10871) to avoid frivolous atomic access overhead. Also use regular int, not cpuid_flags_atomi…
douzzer
committed
wolfssl/wolfcrypt/wc_compat.h, wolfssl/wolfcrypt/fips_test.h, .wolfssl_known_macro_extras:
douzzer
committed
wolfcrypt/src/ed25519.c, tests/api/test_ed25519.c:
douzzer
committed
configure.ac: add --enable-all-quantum-crypto "Enable all quantum-resistant asymmetric algorithms (default: disabled)".
douzzer
committed
wolfcrypt/src/ed25519.c: whitespace fix (from AI review).
douzzer
committed
wolfssl/wolfcrypt/error-crypt.h: #include <wolfssl/wolfcrypt/wc_port.h> where previously #include <wolfssl/wolfcrypt/types.h>, to retain standalone compilability without provoking circular dependen…
douzzer
committed
wolfssl/wolfcrypt/wc_compat.h: FIPS v2 compatibility.
douzzer
committed
wolfssl/wolfcrypt/wc_compat.h: in non-streaming wc_AesGcmEncrypt_compat_shim(), restore aes->reg to the supplied IV after wc_AesGcmEncrypt_ex() increments it, supporting the EVP access pattern.
douzzer
committed
configure.ac: don't include CShake or KMAC in enable-all-crypto when building FIPS < v7.
douzzer
committed
wolfssl/wolfcrypt/settings.h: add assert that WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED isn't defined in old FIPS builds.
douzzer
committed
wolfcrypt/src/kdf.c, wolfssl/wolfcrypt/kdf.h: use "hash_type", not "hash", for the hash type in wc_PRF_fips(), for clarity and consistency.
douzzer
committed
configure.ac: fix DH dependencies for FIPS v7 (implicit --disable-dh).
douzzer
committed
linuxkm/linuxkm-fips-hash-wrapper.sh: fix dependency on SHA-2 coreKey.
douzzer
committed
wolfcrypt/src/sha3.c, wolfssl/wolfcrypt/sha3.h, wolfssl/wolfcrypt/error-crypt.h, wolfcrypt/src/error.c:
douzzer
committed
configure.ac: more FIPS v7/ready/dev DH purging: omit HAVE_FFDHE_* too.
douzzer
committed
linuxkm/Makefile: fix module-update-fips-hash recipe to allow SHA512 verifyCore.
douzzer
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

20260713-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED-etc#10920

20260713-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED-etc#10920
JacobBarthelmeh merged 18 commits into
wolfSSL:masterfrom
douzzer:20260713-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED-etc

Commits on Jul 20, 2026

Implement FIPS shimming for wc_AesGcmEncrypt():

linuxkm/lkcapi_aes_glue.c: in the inner streaming loops for AES-GCM and AES-XTS (AesGcmCrypt_1(), km_AesXtsEncrypt(), and km_AesXtsDecrypt()), bypass FIPS wrappers to avoid frivolous overhead, with…

wolfcrypt/src/aes.c: revert atomic refactor of checkedAESNI, haveAESNI, and intel_flags (3f3ebcac58 / #10871) to avoid frivolous atomic access overhead. Also use regular int, not cpuid_flags_atomi…

wolfssl/wolfcrypt/wc_compat.h, wolfssl/wolfcrypt/fips_test.h, .wolfssl_known_macro_extras:

wolfcrypt/src/ed25519.c, tests/api/test_ed25519.c:

configure.ac: add --enable-all-quantum-crypto "Enable all quantum-resistant asymmetric algorithms (default: disabled)".

wolfcrypt/src/ed25519.c: whitespace fix (from AI review).

wolfssl/wolfcrypt/error-crypt.h: #include <wolfssl/wolfcrypt/wc_port.h> where previously #include <wolfssl/wolfcrypt/types.h>, to retain standalone compilability without provoking circular dependen…

wolfssl/wolfcrypt/wc_compat.h: FIPS v2 compatibility.

wolfssl/wolfcrypt/wc_compat.h: in non-streaming wc_AesGcmEncrypt_compat_shim(), restore aes->reg to the supplied IV after wc_AesGcmEncrypt_ex() increments it, supporting the EVP access pattern.

configure.ac: don't include CShake or KMAC in enable-all-crypto when building FIPS < v7.

wolfssl/wolfcrypt/settings.h: add assert that WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED isn't defined in old FIPS builds.

wolfcrypt/src/kdf.c, wolfssl/wolfcrypt/kdf.h: use "hash_type", not "hash", for the hash type in wc_PRF_fips(), for clarity and consistency.

configure.ac: fix DH dependencies for FIPS v7 (implicit --disable-dh).

linuxkm/linuxkm-fips-hash-wrapper.sh: fix dependency on SHA-2 coreKey.

wolfcrypt/src/sha3.c, wolfssl/wolfcrypt/sha3.h, wolfssl/wolfcrypt/error-crypt.h, wolfcrypt/src/error.c:

configure.ac: more FIPS v7/ready/dev DH purging: omit HAVE_FFDHE_* too.

linuxkm/Makefile: fix module-update-fips-hash recipe to allow SHA512 verifyCore.