Skip to content

Fix FIPS v6 or older build with crypto callbacks and SHA512#10557

Open
dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:cryptocb_fips
Open

Fix FIPS v6 or older build with crypto callbacks and SHA512#10557
dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:cryptocb_fips

Conversation

@dgarske
Copy link
Copy Markdown
Member

@dgarske dgarske commented May 29, 2026

Description

Commit 9cbc3f9 added a size_t digestSz parameter to
wc_CryptoCb_Sha512Hash (to dispatch SHA-512/224 and SHA-512/256 to
variant-specific provider callbacks). The live sha512.c was updated to the
5-arg call, but in a FIPS build sha512.c is a frozen snapshot pulled from a
tag by fips-check.sh, while cryptocb.c/.h live outside the FIPS boundary
and ship the latest signature. For FIPS v6 and earlier the snapshot still calls
the old 4-arg API, so the build fails with:

sha512.c: error: too few arguments to function 'wc_CryptoCb_Sha512Hash'

(reported on --enable-fips=v5, e.g. wolfTPM builds).

This conditionally drops the digestSz parameter from the declaration and
definition under defined(HAVE_FIPS) && FIPS_VERSION_LT(7,0), with a shimmed
digestSz = WC_SHA512_DIGEST_SIZE local so the single shared body behaves
identically to the pre-9cbc3f97 4-arg function. No sha512.c change; the public
wc_CryptoInfo.hash struct is untouched, so callback providers (wolfTPM, HSMs)
need no changes.

Fixes ZD21902 and ZD21780

Testing

FIPS_VERSION_LT(7,0) is the boundary, verified against the snapshot tags in
fips-check.sh and the version assignments in configure.ac:

FIPS option version sha512.c source API
v5 / cert4718 5.2.1 v5.2.1-stable (frozen) 4-arg
v5-RC12 5.2.0.1 WCv5.0-RC12 (frozen) 4-arg
v6 / wolfentropy 6.0 WCv6.0.0-RC5 (frozen) 4-arg
ready / dev 8.0 master (not overwritten) 5-arg
v7 (future) 7.0 snapshot picks up new sha512.c 5-arg

The tagged sha512.c for v5.2.1, RC12, and v6.0.0-RC5 were each confirmed to
call the 4-arg form; ready/dev leave sha512.c as live master (5-arg) and
report version 8, so they fall on the new-API side without special handling.

  • Non-FIPS cryptocb.c compiles clean with WOLF_CRYPTO_CB + WOLFSSL_SHA512.
  • Preprocessor expansion verified: non-FIPS -> 5 args, FIPS v5/v6 -> 4 args,
    FIPS v7 / ready / dev -> 5 args.

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

@dgarske dgarske self-assigned this May 29, 2026
@github-actions
Copy link
Copy Markdown

MemBrowse Memory Report

No memory changes detected for:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant