[openssl/openssl] e0b716: Additional ML-KEM cleansing

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: e0b716092d83adb21524c10af4254c043c2a47c7
      https://github.com/openssl/openssl/commit/e0b716092d83adb21524c10af4254c043c2a47c7
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_kem/ml_kem.c
    M providers/fips/fipsprov.c
    M providers/implementations/kem/ml_kem_kem.c
    M providers/implementations/kem/mlx_kem.c
    M providers/implementations/keymgmt/ml_kem_kmgmt.c
    M providers/implementations/keymgmt/mlx_kmgmt.c

  Log Message:
  -----------
  Additional ML-KEM cleansing

Also, mark X448MLKEM1024 key management as FIPS non-approved (completion of #26220)

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 06:57:33 2026
(Merged from https://github.com/openssl/openssl/pull/32148)


  Commit: 63c17a531c7cd7f6aae0ebef4eb318505a4af87e
      https://github.com/openssl/openssl/commit/63c17a531c7cd7f6aae0ebef4eb318505a4af87e
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_dsa/ml_dsa_encoders.c
    M crypto/ml_dsa/ml_dsa_key.c
    M crypto/ml_dsa/ml_dsa_matrix.c
    M crypto/ml_dsa/ml_dsa_sample.c
    M crypto/ml_dsa/ml_dsa_sample_hw_x86_64.inc
    M crypto/ml_dsa/ml_dsa_sign.c
    M providers/implementations/digests/ml_dsa_mu_prov.c
    M providers/implementations/keymgmt/ml_dsa_kmgmt.c
    M providers/implementations/signature/ml_dsa_sig.c

  Log Message:
  -----------
  Additional ML-DSA cleansing

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 06:57:34 2026
(Merged from https://github.com/openssl/openssl/pull/32148)


  Commit: 7970e288ee43697956ae0a48ccb045155357a541
      https://github.com/openssl/openssl/commit/7970e288ee43697956ae0a48ccb045155357a541
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/slh_dsa/slh_dsa.c
    M crypto/slh_dsa/slh_dsa_hash_ctx.c
    M crypto/slh_dsa/slh_dsa_key.c
    M crypto/slh_dsa/slh_dsa_local.h
    M crypto/slh_dsa/slh_fors.c
    M crypto/slh_dsa/slh_hash.c
    M crypto/slh_dsa/slh_hypertree.c
    M crypto/slh_dsa/slh_wots.c
    M crypto/slh_dsa/slh_xmss.c
    M providers/implementations/keymgmt/slh_dsa_kmgmt.c
    M providers/implementations/signature/slh_dsa_sig.c

  Log Message:
  -----------
  slh-dsa: cleanse temporary copies of sensitive data

The hash functions worked on stack copies of the prehashed PK.seed context.
During signing these absorb SK.seed and WOTS+ chain secrets, and every call
left the final hash state on the stack.  Erasing it per call would burden the
innermost functions, which dominate signing time.

Give SLH_DSA_HASH_CTX a heap-allocated scratch context and use it in place of
the stack copies.  The working state now sits in one reusable buffer, erased
when the hash context is freed; the per-call copy is unchanged and stack use
goes down.  For the SHA2 parameter sets the buffer is sized to double as the
SHA-512 context of security categories 3 and 5.  The prehashed contexts are now
freed with OPENSSL_clear_free().

Erase the remaining temporaries holding secrets or data derived from them:
WOTS+ and FORS secret values, Merkle tree nodes, the message digest and
candidate FORS keys in sign and verify, the encoded message, and the caller's
signature buffer when signing fails part way.  Cleanse a wrong-length private
key that ossl_slh_dsa_key_fromdata() copied in before rejecting it.  The FORS
roots buffer held one root per tree but was sized for k * a nodes; shrink it to
k * n bytes and erase only the used length.

Performance is unchanged within noise; the SHAKE parameter sets measure a few
percent faster, likely because the working Keccak state now stays at one fixed
address rather than a fresh stack copy at each recursion depth.

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 06:57:36 2026
(Merged from https://github.com/openssl/openssl/pull/32148)


Compare: https://github.com/openssl/openssl/compare/a62c45948a9d...7970e288ee43

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/a62c45-7970e2%40github.com.