[openssl/openssl] 65c4a6: Additional ML-KEM cleansing

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: 65c4a6765e49f8b7c58790f6fda1addd567fc7fa
      https://github.com/openssl/openssl/commit/65c4a6765e49f8b7c58790f6fda1addd567fc7fa
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_kem/ml_kem.c
    M providers/fips/fipsprov.c
    M providers/implementations/kem/ml_kem_kem.c
    M providers/implementations/kem/mlx_kem.c
    M providers/implementations/keymgmt/ml_kem_kmgmt.c
    M providers/implementations/keymgmt/mlx_kmgmt.c

  Log Message:
  -----------
  Additional ML-KEM cleansing

Also, mark X448MLKEM1024 as FIPS non-approved (backport of #26220)

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
MergeDate: Tue Aug 11 15:05:35 2026
(Merged from https://github.com/openssl/openssl/pull/32152)


  Commit: 8fc318aa18f761c24c8a23ef0f3db15c582764b7
      https://github.com/openssl/openssl/commit/8fc318aa18f761c24c8a23ef0f3db15c582764b7
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_dsa/ml_dsa_encoders.c
    M crypto/ml_dsa/ml_dsa_key.c
    M crypto/ml_dsa/ml_dsa_matrix.c
    M crypto/ml_dsa/ml_dsa_sample.c
    M crypto/ml_dsa/ml_dsa_sign.c
    M crypto/ml_dsa/ml_dsa_vector.h
    M providers/implementations/digests/ml_dsa_mu_prov.c
    M providers/implementations/keymgmt/ml_dsa_kmgmt.c
    M providers/implementations/signature/ml_dsa_sig.c

  Log Message:
  -----------
  Additional ML-DSA cleansing

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
MergeDate: Tue Aug 11 15:05:36 2026
(Merged from https://github.com/openssl/openssl/pull/32152)


  Commit: 7e5852f1a162706d6f5b40442e07fc6070ba6aea
      https://github.com/openssl/openssl/commit/7e5852f1a162706d6f5b40442e07fc6070ba6aea
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/slh_dsa/slh_dsa.c
    M crypto/slh_dsa/slh_dsa_hash_ctx.c
    M crypto/slh_dsa/slh_dsa_key.c
    M crypto/slh_dsa/slh_dsa_local.h
    M crypto/slh_dsa/slh_fors.c
    M crypto/slh_dsa/slh_hash.c
    M crypto/slh_dsa/slh_hypertree.c
    M crypto/slh_dsa/slh_wots.c
    M crypto/slh_dsa/slh_xmss.c
    M providers/implementations/keymgmt/slh_dsa_kmgmt.c
    M providers/implementations/signature/slh_dsa_sig.c

  Log Message:
  -----------
  slh-dsa: cleanse temporary copies of sensitive data

The hash functions worked on stack copies of the prehashed PK.seed context.
During signing these absorb SK.seed and WOTS+ chain secrets, and every call
left the final hash state on the stack.  Erasing it per call would burden the
innermost functions, which dominate signing time.

Give SLH_DSA_HASH_CTX a heap-allocated scratch context and use it in place of
the stack copies.  The working state now sits in one reusable buffer, erased
when the hash context is freed; the per-call copy is unchanged and stack use
goes down.  For the SHA2 parameter sets the buffer is sized to double as the
SHA-512 context of security categories 3 and 5.  The prehashed contexts are now
freed with OPENSSL_clear_free().

Erase the remaining temporaries holding secrets or data derived from them:
WOTS+ and FORS secret values, Merkle tree nodes, the message digest and
candidate FORS keys in sign and verify, the encoded message, and the caller's
signature buffer when signing fails part way.  Cleanse a wrong-length private
key that ossl_slh_dsa_key_fromdata() copied in before rejecting it.  The FORS
roots buffer held one root per tree but was sized for k * a nodes; shrink it to
k * n bytes and erase only the used length.

Performance is unchanged within noise; the SHAKE parameter sets measure a few
percent faster, likely because the working Keccak state now stays at one fixed
address rather than a fresh stack copy at each recursion depth.

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
MergeDate: Tue Aug 11 15:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/32152)


Compare: https://github.com/openssl/openssl/compare/6184f5cb3704...7e5852f1a162

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/6184f5-7e5852%40github.com.