[openssl/openssl] 329938: Additional ML-KEM cleansing

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 329938c1c4e9d1559dcd8123ac093f76b64f8d0c
      https://github.com/openssl/openssl/commit/329938c1c4e9d1559dcd8123ac093f76b64f8d0c
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_kem/ml_kem.c
    M providers/fips/fipsprov.c
    M providers/implementations/kem/ml_kem_kem.c
    M providers/implementations/kem/mlx_kem.c
    M providers/implementations/keymgmt/ml_kem_kmgmt.c
    M providers/implementations/keymgmt/mlx_kmgmt.c

  Log Message:
  -----------
  Additional ML-KEM cleansing

Also, mark X448MLKEM1024 as FIPS non-approved (backport of #26220)

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 15:06:57 2026
(Merged from https://github.com/openssl/openssl/pull/32167)


  Commit: 54c77a1a85e0958db4ca4da26e39cab97d55160a
      https://github.com/openssl/openssl/commit/54c77a1a85e0958db4ca4da26e39cab97d55160a
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/ml_dsa/ml_dsa_encoders.c
    M crypto/ml_dsa/ml_dsa_key.c
    M crypto/ml_dsa/ml_dsa_matrix.c
    M crypto/ml_dsa/ml_dsa_sample.c
    M crypto/ml_dsa/ml_dsa_sign.c
    M crypto/ml_dsa/ml_dsa_vector.h
    M providers/implementations/keymgmt/ml_dsa_kmgmt.c

  Log Message:
  -----------
  Additional ML-DSA cleansing

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 15:06:58 2026
(Merged from https://github.com/openssl/openssl/pull/32167)


  Commit: dbb7cb4a983e5329b6a8a74898815533bcedb5f8
      https://github.com/openssl/openssl/commit/dbb7cb4a983e5329b6a8a74898815533bcedb5f8
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-08-11 (Tue, 11 Aug 2026)

  Changed paths:
    M crypto/slh_dsa/slh_dsa.c
    M crypto/slh_dsa/slh_dsa_hash_ctx.c
    M crypto/slh_dsa/slh_dsa_key.c
    M crypto/slh_dsa/slh_dsa_local.h
    M crypto/slh_dsa/slh_fors.c
    M crypto/slh_dsa/slh_hash.c
    M crypto/slh_dsa/slh_hypertree.c
    M crypto/slh_dsa/slh_wots.c
    M crypto/slh_dsa/slh_xmss.c
    M providers/implementations/keymgmt/slh_dsa_kmgmt.c
    M providers/implementations/signature/slh_dsa_sig.c

  Log Message:
  -----------
  slh-dsa: cleanse temporary copies of sensitive data

Erase the temporaries that hold secrets or data derived from them:
WOTS+ chain secrets, Merkle tree nodes, the message digest and
candidate FORS keys in sign and verify, the MGF1 seed and PRF-msg
output buffers, the encoded message (which may contain confidential
content), and the caller's signature buffer when signing fails part
way through.  Also cleanse a private key of unexpected length that
ossl_slh_dsa_key_fromdata() copied into the key before rejecting it.

The SHA2 hash functions kept the digest and the concatenated child
nodes in local stack buffers, abandoned on every call.  Erasing them
per call measurably slows the innermost functions, so move them into
a scratch buffer in SLH_DSA_HASH_CTX that is erased when the context
is freed.  The SHAKE hash functions write straight to the caller's
buffer and need no scratch.

The key material copies built by slh_dsa_export() were freed with
OSSL_PARAM_free(), which only wipes the secure-heap data block.  This
branch has no OSSL_PARAM_clear_free(), so wipe the copies explicitly
before freeing.

The FORS roots buffer in ossl_slh_fors_pk_from_sig() was sized as if
it held k * a nodes, but only one root per tree is ever written.
Shrink it to k * n bytes maximum and erase only the used length.

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 11 15:07:00 2026
(Merged from https://github.com/openssl/openssl/pull/32167)


Compare: https://github.com/openssl/openssl/compare/b74ed29f8977...dbb7cb4a983e

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/b74ed2-dbb7cb%40github.com.