Repository navigation
Return the PKCS#11 verify codes for invalid and wrong-length signatures - #284
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the signature-verification return-code and recovery-buffer changes.
No open issues 🎉
What changed in this PR
This PR aligns wolfPKCS11 signature verification return codes with PKCS#11 requirements, addressing #267 and the raw RSA verification length issue in #268.
Changes:
- Distinguishes invalid signatures, wrong-length signatures, and invalid raw RSA data lengths.
- Sizes
C_VerifyRecoverbuffers against recovered data and preserves the operation for buffer-size retries. - Adds regression tests, updates existing expectations, and adds AES-CMAC CI coverage.
| File | Description |
|---|---|
| wolfpkcs11/internal.h | Declares signature-length and PSS hash-length helpers. |
| tests/verify_return_codes_test.c | Adds verification return-code and recovery-buffer regression tests. |
| tests/pkcs11v3test.c | Updates wrong-length HBS signature expectations. |
| tests/pkcs11test.c | Updates oversized raw RSA data and truncated HMAC expectations. |
| tests/include.am | Registers and links the new regression test. |
| src/internal.c | Maps invalid-signature errors and handles recovered-data buffer sizing. |
| src/crypto.c | Adds length checks and preserves recovery operations for buffer retries. |
| .github/workflows/unit-test.yml | Adds an AES-CMAC-enabled CI job. |
Review effort: Balanced
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #284
Scan targets checked: wolfpkcs11-src, wolfpkcs11-bugs
Not reviewed (no scan target covers them): .github/workflows/unit-test.yml, tests/include.am
Coverage: 5 of 6 in-scope changed file(s) opened by the reviewer; not opened: wolfpkcs11/internal.h
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Max
Frauschi
force-pushed
the
verify-return-codes
branch
from
November 6, 2026 10:02
075e5d7 to
9f830de
Compare
C_Verify turned every negative wolfCrypt error from the verify helpers into CKR_FUNCTION_FAILED, so a caller could not tell a bad signature from a token failure. - RSA PKCS#1 v1.5, PSS and raw verify: RSA_PAD_E, BAD_PADDING_E, PSS_SALTLEN_E and RSA_OUT_OF_RANGE_E (a signature at or above the modulus) now verify false, giving CKR_SIGNATURE_INVALID. PSS already did this for the first two. - ECDSA: r or s outside [1, n-1] fails wolfCrypt's range check with MP_VAL or MP_ZERO_E, which now verifies false. On P-521 any of the top seven bits of the 66-byte r or s hits this. - ML-DSA: a malformed hint gives SIG_VERIFY_E, which now verifies false. - C_Verify checks the signature length against the modulus for RSA, the parameter set for ML-DSA, HSS and XMSS, and the MAC length for HMAC and CMAC (also in C_VerifyFinal), and returns CKR_SIGNATURE_LEN_RANGE, ending the operation, as ECDSA and the TLS MAC already did. HMAC, HSS and XMSS gave CKR_SIGNATURE_INVALID for a wrong length; CMAC returned BUFFER_E and so CKR_FUNCTION_FAILED. When the ML-DSA, HSS or XMSS length cannot be read from the key, the check is left to the verify helper, as before. - Behavior change: an RSA PKCS#1 v1.5 or PSS signature shorter than the modulus, for example one whose leading zero byte a client dropped, verified before and now gives CKR_SIGNATURE_LEN_RANGE. RFC 8017 and PKCS#11 require exactly k bytes; raw RSA already required them. - CKM_RSA_X_509 verify data longer than the modulus, raw CKM_RSA_PKCS data longer than k - 11 and a raw CKM_RSA_PKCS_PSS hash that is not the PSS hash length give CKR_DATA_LEN_RANGE. C_VerifyRecover required an output buffer of the modulus size, so it rejected a buffer that was large enough for the recovered PKCS#1 message. It now recovers into a local buffer and returns CKR_BUFFER_TOO_SMALL with the exact recovered length, leaving the operation active, CKR_SIGNATURE_INVALID for an invalid signature and CKR_SIGNATURE_LEN_RANGE for a signature that is not the modulus length. Raw recovery asks wolfCrypt for exactly the modulus length and refuses a signature at or above the modulus itself, since wolfSSL v5.8.4 and older return the reduced value for it. A key larger than RSA_MAX_SIZE gives CKR_FUNCTION_FAILED, as in C_Verify. pkcs11test's raw RSA oversized-data and truncated HMAC cases and pkcs11v3test's HBS wrong-length case now expect CKR_DATA_LEN_RANGE and CKR_SIGNATURE_LEN_RANGE. The new verify_return_codes_test covers RSA (PKCS#1 v1.5, raw, PSS, and recover for both mechanisms), ECDSA P-521, ML-DSA-44, HMAC and CMAC. A new aescmac CI job builds wolfSSL with CMAC and runs make check with --enable-aescmac, which no job did before. Fixes F-15411. Fixes F-15416.
Frauschi
force-pushed
the
verify-return-codes
branch
from
November 6, 2026 11:35
9f830de to
1e2d159
Compare
LinuxJedi
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
C_VerifyreturnedCKR_FUNCTION_FAILEDfor many invalid or wrong-length signatures, andC_VerifyRecoverrejected buffers big enough for the recovered message. Both now return the codes PKCS#11 v3.2 §5.15 specifies.Fixes #267. Part of #268 (raw RSA verify data length).
Changes
CKR_SIGNATURE_INVALIDCKR_SIGNATURE_INVALIDCKR_SIGNATURE_INVALIDCKR_SIGNATURE_LEN_RANGEfromC_Verify/C_VerifyFinalCKM_RSA_X_509data longer than the modulus, rawCKM_RSA_PKCSdata longer than k-11 and a wrong-length rawCKM_RSA_PKCS_PSShash giveCKR_DATA_LEN_RANGEC_VerifyRecoversizes against the recovered data:CKR_BUFFER_TOO_SMALLreports the exact length and keeps the operation active; invalid and wrong-length signatures giveCKR_SIGNATURE_INVALID/CKR_SIGNATURE_LEN_RANGEBehavior change
CKR_SIGNATURE_LEN_RANGE, as RFC 8017 and PKCS#11 requireTesting
tests/verify_return_codes_test(RSA, ECDSA P-521, ML-DSA-44, HMAC, CMAC)aescmacCI job (--enable-aescmac, wolfSSL--enable-cmac)pkcs11test(raw RSA oversized data, truncated HMAC) andpkcs11v3test(HBS wrong length) now expectCKR_DATA_LEN_RANGE/CKR_SIGNATURE_LEN_RANGE