[openssl/openssl] 99969c: Additional ML-KEM cleansing

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 99969c550d5ea189144ed5fcf59daf7a5632123d
      https://github.com/openssl/openssl/commit/99969c550d5ea189144ed5fcf59daf7a5632123d
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_kem/ml_kem.c
    M providers/fips/fipsprov.c
    M providers/implementations/kem/ml_kem_kem.c.in
    M providers/implementations/kem/mlx_kem.c
    M providers/implementations/keymgmt/ml_kem_kmgmt.c.in
    M providers/implementations/keymgmt/mlx_kmgmt.c.in

  Log Message:
  -----------
  Additional ML-KEM cleansing

Also, mark X448MLKEM1024 as FIPS non-approved (backport of #26220)

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 13:56:01 2026
(Merged from https://github.com/openssl/openssl/pull/32159)


  Commit: 873179bdc668dd32fa022bb367c0e3fcbb97dbfc
      https://github.com/openssl/openssl/commit/873179bdc668dd32fa022bb367c0e3fcbb97dbfc
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_dsa/ml_dsa_encoders.c
    M crypto/ml_dsa/ml_dsa_key.c
    M crypto/ml_dsa/ml_dsa_matrix.c
    M crypto/ml_dsa/ml_dsa_sample.c
    M crypto/ml_dsa/ml_dsa_sign.c
    M crypto/ml_dsa/ml_dsa_vector.h
    M providers/implementations/keymgmt/ml_dsa_kmgmt.c.in
    M providers/implementations/signature/ml_dsa_sig.c.in

  Log Message:
  -----------
  Additional ML-DSA cleansing

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 13:56:04 2026
(Merged from https://github.com/openssl/openssl/pull/32159)


  Commit: 3a95a436ee527d6f172c64d8cf3add9ed17bac06
      https://github.com/openssl/openssl/commit/3a95a436ee527d6f172c64d8cf3add9ed17bac06
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/slh_dsa/slh_dsa.c
    M crypto/slh_dsa/slh_dsa_hash_ctx.c
    M crypto/slh_dsa/slh_dsa_key.c
    M crypto/slh_dsa/slh_dsa_local.h
    M crypto/slh_dsa/slh_fors.c
    M crypto/slh_dsa/slh_hash.c
    M crypto/slh_dsa/slh_hypertree.c
    M crypto/slh_dsa/slh_wots.c
    M crypto/slh_dsa/slh_xmss.c
    M providers/implementations/keymgmt/slh_dsa_kmgmt.c.in
    M providers/implementations/signature/slh_dsa_sig.c.in

  Log Message:
  -----------
  slh-dsa: cleanse temporary copies of sensitive data

Erase the temporaries that hold secrets or data derived from them:
WOTS+ chain secrets, Merkle tree nodes, the message digest and
candidate FORS keys in sign and verify, the MGF1 seed and PRF-msg
output buffers, the encoded message (which may contain confidential
content), and the caller's signature buffer when signing fails part
way through.  Also cleanse a private key of unexpected length that
ossl_slh_dsa_key_fromdata() copied into the key before rejecting it.

The SHA2 hash functions kept the digest and the concatenated child
nodes in local stack buffers, abandoned on every call.  Erasing them
per call measurably slows the innermost functions, so move them into
a scratch buffer in SLH_DSA_HASH_CTX that is erased when the context
is freed.  The SHAKE hash functions write straight to the caller's
buffer and need no scratch.

The key material copies built by slh_dsa_export() were freed with
OSSL_PARAM_free(), which only wipes the secure-heap data block.  This
branch has no OSSL_PARAM_clear_free(), so wipe the copies explicitly
before freeing.

The FORS roots buffer in ossl_slh_fors_pk_from_sig() was sized as if
it held k * a nodes, but only one root per tree is ever written.
Shrink it to k * n bytes maximum and erase only the used length.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 13:56:06 2026
(Merged from https://github.com/openssl/openssl/pull/32159)


Compare: https://github.com/openssl/openssl/compare/581983aa5fcf...3a95a436ee52

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/581983-3a95a4%40github.com.