From cceed55f3e162cdfac5ffec295aa04d6084d1b92 Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Tue, 14 Oct 2025 18:06:47 +0000 Subject: [PATCH 1/6] Add OSSL_SIGNATURE_PARAM_NONCE_TYPE to ECDSA signature --- .../src/signature/p_scossl_ecdsa_signature.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/SymCryptProvider/src/signature/p_scossl_ecdsa_signature.c b/SymCryptProvider/src/signature/p_scossl_ecdsa_signature.c index ff92a1b9..f8a098f9 100644 --- a/SymCryptProvider/src/signature/p_scossl_ecdsa_signature.c +++ b/SymCryptProvider/src/signature/p_scossl_ecdsa_signature.c @@ -365,6 +365,24 @@ static SCOSSL_STATUS p_scossl_ecdsa_set_ctx_params(_Inout_ SCOSSL_ECDSA_CTX *ctx return SCOSSL_FAILURE; } +#ifdef OSSL_SIGNATURE_PARAM_NONCE_TYPE + if ((p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE)) != NULL) + { + unsigned int nonce_type; + if (!OSSL_PARAM_get_uint(p, &nonce_type)) + { + ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); + return SCOSSL_FAILURE; + } + + if (nonce_type != 0) + { + ERR_raise(ERR_LIB_PROV, PROV_R_NOT_SUPPORTED); + return SCOSSL_FAILURE; + } + } +#endif + return SCOSSL_SUCCESS; } @@ -399,6 +417,15 @@ static SCOSSL_STATUS p_scossl_ecdsa_get_ctx_params(_In_ SCOSSL_ECDSA_CTX *ctx, _ goto cleanup; } +#ifdef OSSL_SIGNATURE_PARAM_NONCE_TYPE + if ((p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE)) != NULL && + !OSSL_PARAM_set_uint(p, 0)) + { + ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); + goto cleanup; + } +#endif + if ((p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_ALGORITHM_ID)) != NULL) { int cbAid; From 248193f8795ed5d4c827503a2ae7ed80291454f1 Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Tue, 14 Oct 2025 20:42:10 +0000 Subject: [PATCH 2/6] Only optimize debug release builds --- cmake-toolchain/LinuxUserMode-AMD64.cmake | 4 +++- cmake-toolchain/LinuxUserMode-ARM.cmake | 4 +++- cmake-toolchain/LinuxUserMode-ARM64.cmake | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/cmake-toolchain/LinuxUserMode-AMD64.cmake b/cmake-toolchain/LinuxUserMode-AMD64.cmake index 14e9f10f..44c3988e 100644 --- a/cmake-toolchain/LinuxUserMode-AMD64.cmake +++ b/cmake-toolchain/LinuxUserMode-AMD64.cmake @@ -7,7 +7,9 @@ set(CMAKE_SYSTEM_PROCESSOR AMD64) # Define _AMD64_ to set up the correct SymCrypt macros, e.g. SYMCRYPT_CPU_AMD64 add_compile_options(-D_AMD64_) -add_compile_options(-O3) +if (CMAKE_BUILD_TYPE MATCHES Release|RelWithDebInfo) + add_compile_options(-O3) +endif() # Enable a baseline of features for the compiler to support everywhere # Other than for SSSE3 we do not expect the compiler to generate these instructions anywhere other than with intrinsics diff --git a/cmake-toolchain/LinuxUserMode-ARM.cmake b/cmake-toolchain/LinuxUserMode-ARM.cmake index a038293a..5b2b1f2b 100644 --- a/cmake-toolchain/LinuxUserMode-ARM.cmake +++ b/cmake-toolchain/LinuxUserMode-ARM.cmake @@ -25,4 +25,6 @@ if(NOT CMAKE_HOST_SYSTEM_PROCESSOR MATCHES armv8l|ARM$|ARM32|aarch32 AND NOT SCO endif() add_compile_options(-D_ARM_) -add_compile_options(-O3) \ No newline at end of file +if (CMAKE_BUILD_TYPE MATCHES Release|RelWithDebInfo) + add_compile_options(-O3) +endif() \ No newline at end of file diff --git a/cmake-toolchain/LinuxUserMode-ARM64.cmake b/cmake-toolchain/LinuxUserMode-ARM64.cmake index 6109b57d..50054442 100644 --- a/cmake-toolchain/LinuxUserMode-ARM64.cmake +++ b/cmake-toolchain/LinuxUserMode-ARM64.cmake @@ -32,4 +32,6 @@ endif() # Define _ARM64_ to set up the correct SymCrypt macros, e.g. SYMCRYPT_CPU_ARM64 add_compile_options(-D_ARM64_) -add_compile_options(-O3) \ No newline at end of file +if (CMAKE_BUILD_TYPE MATCHES Release|RelWithDebInfo) + add_compile_options(-O3) +endif() \ No newline at end of file From 5b02dd4dc7ffd34172f1af889585a4cda12c4d97 Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Tue, 14 Oct 2025 20:42:29 +0000 Subject: [PATCH 3/6] Only export EC public/private if available --- SymCryptProvider/src/keymgmt/p_scossl_ecc_keymgmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SymCryptProvider/src/keymgmt/p_scossl_ecc_keymgmt.c b/SymCryptProvider/src/keymgmt/p_scossl_ecc_keymgmt.c index cd15d1ee..67c11b92 100644 --- a/SymCryptProvider/src/keymgmt/p_scossl_ecc_keymgmt.c +++ b/SymCryptProvider/src/keymgmt/p_scossl_ecc_keymgmt.c @@ -1262,9 +1262,11 @@ static SCOSSL_STATUS p_scossl_ecc_keymgmt_export(_In_ SCOSSL_ECC_KEY_CTX *keyCtx goto cleanup; } - if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) + if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0 && + keyCtx->initialized) { - if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) + if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0 && + SymCryptEckeyHasPrivateKey(keyCtx->key)) { if (!p_scossl_ecc_keymgmt_get_private_key_bn(keyCtx, &bnPrivateKey, &cbPrivateKey) || !OSSL_PARAM_BLD_push_BN_pad(bld, OSSL_PKEY_PARAM_PRIV_KEY, bnPrivateKey, cbPrivateKey)) From d16815d8d8d2d5d3fa8e3f2e9478d7af49b13855 Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Fri, 17 Oct 2025 23:45:02 +0000 Subject: [PATCH 4/6] Fix HMAC dupctx --- ScosslCommon/inc/scossl_helpers.h | 1 + ScosslCommon/src/scossl_helpers.c | 1 + ScosslCommon/src/scossl_mac.c | 7 ++++++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ScosslCommon/inc/scossl_helpers.h b/ScosslCommon/inc/scossl_helpers.h index 06f1f85d..a7122a06 100644 --- a/ScosslCommon/inc/scossl_helpers.h +++ b/ScosslCommon/inc/scossl_helpers.h @@ -118,6 +118,7 @@ typedef enum { SCOSSL_ERR_F_GET_SYMCRYPT_HASH_ALGORITHM, SCOSSL_ERR_F_GET_SYMCRYPT_MAC_ALGORITHM, SCOSSL_ERR_F_HKDF_DERIVE, + SCOSSL_ERR_F_MAC_DUPCTX, SCOSSL_ERR_F_MAC_INIT, SCOSSL_ERR_F_MAC_SET_HMAC_MD, SCOSSL_ERR_F_RSA_DECRYPT, diff --git a/ScosslCommon/src/scossl_helpers.c b/ScosslCommon/src/scossl_helpers.c index 8ada248b..ce3f6ff1 100644 --- a/ScosslCommon/src/scossl_helpers.c +++ b/ScosslCommon/src/scossl_helpers.c @@ -78,6 +78,7 @@ static ERR_STRING_DATA SCOSSL_ERR_function_strings[] = { {ERR_PACK(0, SCOSSL_ERR_F_GET_SYMCRYPT_HASH_ALGORITHM, 0), "scossl_get_symcrypt_hash_algorithm"}, {ERR_PACK(0, SCOSSL_ERR_F_GET_SYMCRYPT_MAC_ALGORITHM, 0), "scossl_get_symcrypt_hmac_algorithm"}, {ERR_PACK(0, SCOSSL_ERR_F_HKDF_DERIVE, 0), "scossl_hkdf_derive"}, + {ERR_PACK(0, SCOSSL_ERR_F_MAC_DUPCTX, 0), "scossl_mac_dupctx"}, {ERR_PACK(0, SCOSSL_ERR_F_MAC_INIT, 0), "scossl_mac_init"}, {ERR_PACK(0, SCOSSL_ERR_F_MAC_SET_HMAC_MD, 0), "scossl_mac_set_hmac_md"}, {ERR_PACK(0, SCOSSL_ERR_F_RSA_DECRYPT, 0), "scossl_rsa_decrypt"}, diff --git a/ScosslCommon/src/scossl_mac.c b/ScosslCommon/src/scossl_mac.c index f217f1c0..1dec07f7 100644 --- a/ScosslCommon/src/scossl_mac.c +++ b/ScosslCommon/src/scossl_mac.c @@ -118,6 +118,11 @@ SCOSSL_MAC_CTX *scossl_mac_dupctx(SCOSSL_MAC_CTX *ctx) if (ctx->macState != NULL) { + if (copyCtx->expandedKey == NULL) + { + SCOSSL_LOG_ERROR(SCOSSL_ERR_F_MAC_DUPCTX, ERR_R_INTERNAL_ERROR, + "Missing expandedKey in mac context when attempting to copy macState"); + } SCOSSL_COMMON_ALIGNED_ALLOC_EX(macState, OPENSSL_malloc, SCOSSL_MAC_STATE, ctx->pMac->stateSize); if (macState == NULL) { @@ -125,7 +130,7 @@ SCOSSL_MAC_CTX *scossl_mac_dupctx(SCOSSL_MAC_CTX *ctx) } copyCtx->macState = macState; - ctx->pMacEx->stateCopyFunc(ctx->macState, ctx->expandedKey, copyCtx->macState); + ctx->pMacEx->stateCopyFunc(ctx->macState, copyCtx->expandedKey, copyCtx->macState); } } From 837deeae61685b61485a808a33160222b8018c45 Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Fri, 17 Oct 2025 23:45:18 +0000 Subject: [PATCH 5/6] Bump version to 1.9.4 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 16aaebf0..d3e0ae01 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,7 +1,7 @@ cmake_minimum_required(VERSION 3.13.0) project(SymCrypt-OpenSSL - VERSION 1.9.3 + VERSION 1.9.4 DESCRIPTION "The SymCrypt engine and provider for OpenSSL (SCOSSL)" HOMEPAGE_URL "https://github.com/microsoft/SymCrypt-OpenSSL") From b816b8149c43005e8cb764a718b10c01ec357adf Mon Sep 17 00:00:00 2001 From: Maxwell Moyer-McKee Date: Mon, 20 Oct 2025 23:51:08 +0000 Subject: [PATCH 6/6] Add goto cleanup --- ScosslCommon/src/scossl_mac.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ScosslCommon/src/scossl_mac.c b/ScosslCommon/src/scossl_mac.c index 1dec07f7..b7c191a5 100644 --- a/ScosslCommon/src/scossl_mac.c +++ b/ScosslCommon/src/scossl_mac.c @@ -122,6 +122,7 @@ SCOSSL_MAC_CTX *scossl_mac_dupctx(SCOSSL_MAC_CTX *ctx) { SCOSSL_LOG_ERROR(SCOSSL_ERR_F_MAC_DUPCTX, ERR_R_INTERNAL_ERROR, "Missing expandedKey in mac context when attempting to copy macState"); + goto cleanup; } SCOSSL_COMMON_ALIGNED_ALLOC_EX(macState, OPENSSL_malloc, SCOSSL_MAC_STATE, ctx->pMac->stateSize); if (macState == NULL)