From 03af9a057fc674406af004bd3c7d40ec20e8c462 Mon Sep 17 00:00:00 2001 From: kaleb-himes Date: Fri, 11 Sep 2026 16:26:13 -0600 Subject: [PATCH] Fix build failures when NO_AES_DECRYPT is defined --- tests/api.c | 13 +++--- tests/api/test_aes.c | 2 + tests/api/test_pkcs12.c | 13 +++--- wolfcrypt/src/aes.c | 16 ++++---- wolfcrypt/src/port/cavium/cavium_nitrox.c | 4 +- wolfcrypt/src/port/intel/quickassist.c | 4 +- wolfcrypt/src/port/intel/quickassist_sync.c | 10 +++-- wolfcrypt/test/test.c | 4 +- wolfssl/internal.h | 40 ++++++++++++------- wolfssl/wolfcrypt/aes.h | 4 +- wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h | 4 +- wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h | 4 +- wolfssl/wolfcrypt/port/intel/quickassist.h | 4 +- wolfssl/wolfcrypt/settings.h | 10 +++++ 14 files changed, 81 insertions(+), 51 deletions(-) diff --git a/tests/api.c b/tests/api.c index 777336230c8..db792d12626 100644 --- a/tests/api.c +++ b/tests/api.c @@ -25653,8 +25653,8 @@ static int test_wc_CreateEncryptedPKCS8Key(void) { EXPECT_DECLS; #if defined(HAVE_PKCS8) && !defined(NO_PWDBASED) && defined(WOLFSSL_AES_256) \ - && !defined(NO_AES_CBC) && !defined(NO_RSA) && !defined(NO_SHA) && \ - !defined(NO_ASN_CRYPT) + && !defined(NO_AES_CBC) && defined(HAVE_AES_DECRYPT) && !defined(NO_RSA) && \ + !defined(NO_SHA) && !defined(NO_ASN_CRYPT) WC_RNG rng; byte* encKey = NULL; word32 encKeySz = 0; @@ -25696,7 +25696,8 @@ static int test_wc_CreateEncryptedPKCS8Key(void) #if defined(HAVE_PKCS8) && !defined(NO_ASN) && !defined(NO_PWDBASED) && \ !defined(NO_SHA) && !defined(NO_ASN_CRYPT) && ((defined(WOLFSSL_AES_256) && \ - !defined(NO_AES_CBC)) || !defined(NO_DES3) || !defined(NO_RC4)) + !defined(NO_AES_CBC) && defined(HAVE_AES_DECRYPT)) || !defined(NO_DES3) || \ + !defined(NO_RC4)) /* Encrypt a block-aligned plaintext PKCS#8 and verify the trailing encrypted * OCTET STRING length. expExtra is the padding expected: a full block for CBC * ciphers, 0 for stream ciphers. Also confirms a decrypt round-trip. */ @@ -25765,7 +25766,7 @@ static int test_wc_EncryptPKCS8Key_blockAligned(void) EXPECT_DECLS; #if defined(HAVE_PKCS8) && !defined(NO_ASN) && !defined(NO_PWDBASED) \ && defined(WOLFSSL_AES_256) && !defined(NO_AES_CBC) && !defined(NO_SHA) \ - && !defined(NO_ASN_CRYPT) + && defined(HAVE_AES_DECRYPT) && !defined(NO_ASN_CRYPT) EXPECT_TEST(enc_pkcs8_pad_check(PKCS5, PBES2, AES256CBCb, AES_BLOCK_SIZE)); #endif return EXPECT_RESULT(); @@ -25840,7 +25841,7 @@ static int test_wc_EncryptPKCS8Key_ex_goodHmac(void) EXPECT_DECLS; #if defined(HAVE_PKCS8) && !defined(NO_ASN) && !defined(NO_PWDBASED) \ && defined(WOLFSSL_AES_256) && !defined(NO_AES_CBC) && !defined(NO_ASN_CRYPT) \ - && !defined(NO_SHA256) && !defined(NO_HMAC) + && defined(HAVE_AES_DECRYPT) && !defined(NO_SHA256) && !defined(NO_HMAC) WC_RNG rng; word32 outSz = 0; word32 encSz = 0; @@ -37755,7 +37756,7 @@ static int test_certreq_sighash_algos(void) !defined(WOLFSSL_MAX_STRENGTH) && defined(HAVE_ECC) && \ !defined(NO_SHA256) && defined(WOLFSSL_SHA384) && \ defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC) && \ - !defined(WOLFSSL_NO_TLS12) + defined(HAVE_AES_DECRYPT) && !defined(WOLFSSL_NO_TLS12) WOLFSSL_CTX *ctx_c = NULL; WOLFSSL_CTX *ctx_s = NULL; WOLFSSL *ssl_c = NULL; diff --git a/tests/api/test_aes.c b/tests/api/test_aes.c index f557f130cc9..8bcf88024fb 100644 --- a/tests/api/test_aes.c +++ b/tests/api/test_aes.c @@ -713,6 +713,7 @@ static int test_wc_AesCbcEncryptDecrypt_BadArgs(Aes* aes, byte* key, ExpectIntEQ(wc_AesCbcEncrypt(NULL, cipher, plain, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); +#ifdef HAVE_AES_DECRYPT ExpectIntEQ(wc_AesSetKey(aes, key, keyLen, iv, AES_DECRYPTION), 0); ExpectIntEQ(wc_AesCbcDecrypt(NULL, NULL, NULL, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); @@ -751,6 +752,7 @@ static int test_wc_AesCbcEncryptDecrypt_BadArgs(Aes* aes, byte* key, ExpectIntEQ(wc_AesCbcDecryptWithKey(NULL, cipher, WC_AES_BLOCK_SIZE * 2, key, keyLen, iv), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); +#endif /* HAVE_AES_DECRYPT */ return EXPECT_RESULT(); } diff --git a/tests/api/test_pkcs12.c b/tests/api/test_pkcs12.c index 7e8c899d969..428222eb769 100644 --- a/tests/api/test_pkcs12.c +++ b/tests/api/test_pkcs12.c @@ -177,19 +177,20 @@ int test_wc_PKCS12_create(void) #if !defined(NO_DES3) && !defined(NO_SHA) EXPECT_TEST(test_wc_PKCS12_create_once(PBE_SHA1_DES3, PBE_SHA1_DES3)); #endif -#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_256) && \ - !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) +#if defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) && !defined(NO_AES) && \ + !defined(NO_AES_256) && !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) /* Encoding certificate with PBE_AES256_CBC needs WOLFSSL_ASN_TEMPLATE */ EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES256_CBC, PBE_AES256_CBC)); #endif -#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_128) && \ - !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) +#if defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) && !defined(NO_AES) && \ + !defined(NO_AES_128) && !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) /* Encoding certificate with PBE_AES128_CBC needs WOLFSSL_ASN_TEMPLATE */ EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES128_CBC, PBE_AES128_CBC)); #endif /* Testing a mixture of 2 algorithms */ -#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_256) && \ - !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) && !defined(NO_DES3) +#if defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) && !defined(NO_AES) && \ + !defined(NO_AES_256) && !defined(NO_SHA) && \ + defined(WOLFSSL_ASN_TEMPLATE) && !defined(NO_DES3) EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES256_CBC, PBE_SHA1_DES3)); #endif #endif diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index 562e69c5974..916e6fc2b93 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -55,6 +55,8 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits * WOLFSSL_AES_EAX: Enable AES-EAX AEAD mode default: off * WOLFSSL_CMAC: Enable AES-CMAC (RFC 4493) default: off * HAVE_AESCCM: Enable AES-CCM mode default: off + * HAVE_AESCCM_DECRYPT: Enable AES-CCM decryption default: on + * (when HAVE_AESCCM is enabled) * HAVE_AES_KEYWRAP: Enable AES key wrap (RFC 3394) default: off * WOLFSSL_AES_KEYWRAP_PADDING: AES key wrap padding (RFC 5649) default: off * WOLFSSL_AES_CBC_LENGTH_CHECKS: Validate CBC input length default: off @@ -8979,7 +8981,7 @@ void AES_GCM_encrypt_vaes(const unsigned char *in, unsigned char *out, #endif /* HAVE_INTEL_AVX2 */ #endif /* HAVE_INTEL_AVX1 */ -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) void AES_GCM_decrypt_aesni(const unsigned char *in, unsigned char *out, const unsigned char* addt, const unsigned char* ivec, const unsigned char *tag, word32 nbytes, word32 abytes, @@ -9018,7 +9020,7 @@ void AES_GCM_decrypt_vaes(const unsigned char *in, unsigned char *out, #endif #endif /* HAVE_INTEL_AVX2 */ #endif /* HAVE_INTEL_AVX1 */ -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* WOLFSSL_AESNI */ @@ -15341,7 +15343,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, authIn, authInSz); } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESCCM_DECRYPT) int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, const byte* nonce, word32 nonceSz, const byte* authTag, word32 authTagSz, @@ -15410,7 +15412,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, return (kStatus_Success == status) ? 0 : BAD_FUNC_ARG; } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESCCM_DECRYPT) int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, const byte* nonce, word32 nonceSz, const byte* authTag, word32 authTagSz, @@ -15458,7 +15460,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, } return 0; } -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESCCM_DECRYPT */ #else @@ -15773,7 +15775,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, return ret; } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESCCM_DECRYPT) /* Software AES - CCM Decrypt */ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, const byte* nonce, word32 nonceSz, @@ -15966,7 +15968,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, return ret; } -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESCCM_DECRYPT */ #endif /* software CCM */ /* abstract functions that call lower level AESCCM functions */ diff --git a/wolfcrypt/src/port/cavium/cavium_nitrox.c b/wolfcrypt/src/port/cavium/cavium_nitrox.c index c214e875777..5505c84d1e9 100644 --- a/wolfcrypt/src/port/cavium/cavium_nitrox.c +++ b/wolfcrypt/src/port/cavium/cavium_nitrox.c @@ -842,7 +842,7 @@ int NitroxAesGcmEncrypt(Aes* aes, authInSz, authIn, authTag); } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) int NitroxAesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz, const byte* key, word32 keySz, @@ -865,7 +865,7 @@ int NitroxAesGcmDecrypt(Aes* aes, return NitroxAesDecrypt(aes, AES_GCM, key, ivTmp, out, in, sz, authInSz, authIn, authTag); } -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #endif /* HAVE_AES_CBC || HAVE_AESGCM */ diff --git a/wolfcrypt/src/port/intel/quickassist.c b/wolfcrypt/src/port/intel/quickassist.c index 05d7e05a13c..40593020576 100644 --- a/wolfcrypt/src/port/intel/quickassist.c +++ b/wolfcrypt/src/port/intel/quickassist.c @@ -2627,7 +2627,7 @@ int IntelQaSymAesGcmEncrypt(WC_ASYNC_DEV* dev, CPA_CY_SYM_CIPHER_DIRECTION_ENCRYPT, CPA_CY_SYM_HASH_AES_GCM, authTag, authTagSz, authIn, authInSz); } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) int IntelQaSymAesGcmDecrypt(WC_ASYNC_DEV* dev, byte* out, const byte* in, word32 sz, const byte* key, word32 keySz, @@ -2641,7 +2641,7 @@ int IntelQaSymAesGcmDecrypt(WC_ASYNC_DEV* dev, CPA_CY_SYM_CIPHER_DIRECTION_DECRYPT, CPA_CY_SYM_HASH_AES_GCM, (byte*)authTag, authTagSz, authIn, authInSz); } -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #ifndef NO_DES3 diff --git a/wolfcrypt/src/port/intel/quickassist_sync.c b/wolfcrypt/src/port/intel/quickassist_sync.c index f9f0309a131..2e75c089fb0 100644 --- a/wolfcrypt/src/port/intel/quickassist_sync.c +++ b/wolfcrypt/src/port/intel/quickassist_sync.c @@ -203,11 +203,11 @@ static int IntelQaGetCyInstanceCount(void); static int IntelQaSymAesGcmEncrypt(IntelQaDev*, byte*, const byte*, word32, const byte*, word32, const byte*, word32, byte*, word32, const byte*, word32); - #ifdef HAVE_AES_DECRYPT + #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) static int IntelQaSymAesGcmDecrypt(IntelQaDev*, byte*, const byte*, word32, const byte*, word32, const byte*, word32, const byte*, word32, const byte*, word32); - #endif /* HAVE_AES_DECRYPT */ + #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #endif /* !NO_AES */ @@ -1173,7 +1173,7 @@ int IntelQaSymAesGcmEncrypt(IntelQaDev* dev, CPA_CY_SYM_CIPHER_DIRECTION_ENCRYPT, CPA_CY_SYM_HASH_AES_GCM, authTag, authTagSz, authIn, authInSz); } -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) int IntelQaSymAesGcmDecrypt(IntelQaDev* dev, byte* out, const byte* in, word32 sz, const byte* key, word32 keySz, @@ -1187,7 +1187,7 @@ int IntelQaSymAesGcmDecrypt(IntelQaDev* dev, CPA_CY_SYM_CIPHER_DIRECTION_DECRYPT, CPA_CY_SYM_HASH_AES_GCM, (byte*)authTag, authTagSz, authIn, authInSz); } -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #ifndef NO_DES3 @@ -1281,6 +1281,7 @@ int IntelQaSymSync_CryptoDevCb(int devId, struct wc_CryptoInfo* info, void* ctx) info->cipher.aesgcm_enc.authInSz); } else { + #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) Aes* aes = info->cipher.aesgcm_dec.aes; if (aes == NULL) return BAD_FUNC_ARG; @@ -1296,6 +1297,7 @@ int IntelQaSymSync_CryptoDevCb(int devId, struct wc_CryptoInfo* info, void* ctx) info->cipher.aesgcm_dec.authTagSz, info->cipher.aesgcm_dec.authIn, info->cipher.aesgcm_dec.authInSz); + #endif } } #endif /* HAVE_AESGCM */ diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 4310aefe208..4b5cae7581c 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -16964,16 +16964,18 @@ static wc_test_ret_t aes_no_key_set_test(void) if (wc_AesGcmEncrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, sizeof(iv), tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) if (wc_AesGcmDecrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, sizeof(iv), tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); #endif +#endif #ifdef HAVE_AESCCM if (wc_AesCcmEncrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, 13, tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESCCM_DECRYPT) if (wc_AesCcmDecrypt(aes, cipher, plain, WC_AES_BLOCK_SIZE, iv, 13, tag, sizeof(tag), NULL, 0) != WC_NO_ERR_TRACE(MISSING_KEY)) ERROR_OUT(WC_TEST_RET_ENC_NC, out); diff --git a/wolfssl/internal.h b/wolfssl/internal.h index f8fe59be7a0..5261b9e5e3a 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -268,6 +268,8 @@ #undef HAVE_AES_CBC #endif +/* AES-CBC suites need HAVE_AES_DECRYPT to decrypt records (see BUILD_AES). */ + /* When adding new ciphersuites, make sure that they have appropriate * guards for WOLFSSL_HARDEN_TLS. */ #if defined(WOLFSSL_HARDEN_TLS) && \ @@ -301,7 +303,8 @@ #endif /* !WOLFSSL_AEAD_ONLY */ #if !defined(NO_RSA) && !defined(NO_AES) && !defined(NO_TLS) - #if !defined(NO_SHA) && defined(HAVE_AES_CBC) + #if !defined(NO_SHA) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #if defined(WOLFSSL_STATIC_RSA) #ifdef WOLFSSL_AES_128 #define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA @@ -312,7 +315,8 @@ #endif #endif #if defined(WOLFSSL_STATIC_RSA) - #if !defined (NO_SHA256) && defined(HAVE_AES_CBC) + #if !defined (NO_SHA256) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #ifdef WOLFSSL_AES_128 #define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256 #endif @@ -369,7 +373,8 @@ #if defined(WOLFSSL_STATIC_PSK) #if !defined(NO_PSK) && !defined(NO_AES) && !defined(NO_TLS) - #if !defined(NO_SHA) + #if !defined(NO_SHA) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #ifdef WOLFSSL_AES_128 #define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA #endif @@ -379,7 +384,7 @@ #endif #ifndef NO_SHA256 #ifdef WOLFSSL_AES_128 - #ifdef HAVE_AES_CBC + #if defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256 #endif #ifdef HAVE_AESGCM @@ -398,7 +403,7 @@ #endif #endif #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) - #ifdef HAVE_AES_CBC + #if defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #define BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384 #endif #ifdef HAVE_AESGCM @@ -442,17 +447,20 @@ * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ #if !defined(NO_SHA) - #if defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) + #if defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA #endif - #if defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC) + #if defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #define BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA #endif #if !defined(NO_DES3) && !defined(NO_DES3_TLS_SUITES) #define BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA #endif #endif - #if !defined(NO_SHA256) && defined(HAVE_AES_CBC) + #if !defined(NO_SHA256) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #ifdef WOLFSSL_AES_128 #define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 #endif @@ -465,7 +473,7 @@ #if defined(HAVE_ANON) && !defined(NO_TLS) && !defined(NO_DH) && \ !defined(NO_AES) #if !defined(NO_SHA) && defined(HAVE_AES_CBC) && \ - defined(WOLFSSL_AES_128) + defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_128) #define BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA #endif #if defined(WOLFSSL_SHA384) && defined(HAVE_AESGCM) && \ @@ -481,7 +489,7 @@ * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ #ifndef NO_SHA256 #if !defined(NO_AES) && defined(WOLFSSL_AES_128) && \ - defined(HAVE_AES_CBC) + defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #define BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 #endif #ifdef HAVE_NULL_CIPHER @@ -490,7 +498,7 @@ #endif #ifdef WOLFSSL_SHA384 #if !defined(NO_AES) && defined(WOLFSSL_AES_256) && \ - defined(HAVE_AES_CBC) + defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #define BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 #endif #ifdef HAVE_NULL_CIPHER @@ -502,7 +510,8 @@ #if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \ defined(HAVE_CURVE448)) && !defined(NO_TLS) #if !defined(NO_AES) - #if !defined(NO_SHA) && defined(HAVE_AES_CBC) + #if !defined(NO_SHA) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #if !defined(NO_RSA) #ifdef WOLFSSL_AES_128 #define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA @@ -541,7 +550,7 @@ #endif #endif /* NO_SHA */ #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) && \ - defined(HAVE_AES_CBC) + defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #if !defined(NO_RSA) #define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) @@ -559,7 +568,7 @@ #endif #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) && \ - defined(HAVE_AES_CBC) + defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT) #if !defined(NO_RSA) #define BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) @@ -671,7 +680,8 @@ #endif #endif #if !defined(NO_PSK) && !defined(NO_SHA256) && !defined(NO_AES) && \ - defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) + defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) && \ + defined(HAVE_AES_DECRYPT) #define BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 #endif #if !defined(NO_PSK) && !defined(NO_SHA256) && !defined(NO_AES) && \ diff --git a/wolfssl/wolfcrypt/aes.h b/wolfssl/wolfcrypt/aes.h index 455f30088b7..8633dd44afd 100644 --- a/wolfssl/wolfcrypt/aes.h +++ b/wolfssl/wolfcrypt/aes.h @@ -1331,14 +1331,14 @@ WOLFSSL_LOCAL void AES_GCM_encrypt_update_RISCV64(const byte* key, int nr, byte* counter); WOLFSSL_LOCAL void AES_GCM_encrypt_final_RISCV64(byte* tag, byte* authTag, word32 tbytes, word32 nbytes, word32 abytes, byte* h, byte* initCtr); -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) WOLFSSL_LOCAL void AES_GCM_decrypt_update_RISCV64(const byte* key, int nr, byte* out, const byte* in, word32 nbytes, byte* tag, byte* h, byte* counter); WOLFSSL_LOCAL void AES_GCM_decrypt_final_RISCV64(byte* tag, const byte* authTag, word32 tbytes, word32 nbytes, word32 abytes, byte* h, byte* initCtr, int* res); -#endif +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* WOLFSSL_AESGCM_STREAM */ #endif /* HAVE_AESGCM */ #endif /* WOLFSSL_RISCV_ASM */ diff --git a/wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h b/wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h index c3e6cb9474e..84ae9b1d99d 100644 --- a/wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h +++ b/wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h @@ -170,14 +170,14 @@ WOLFSSL_LOCAL int NitroxCheckRequests(struct WC_ASYNC_DEV* dev, const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); - #ifdef HAVE_AES_DECRYPT + #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) WOLFSSL_LOCAL int NitroxAesGcmDecrypt(struct Aes* aes, byte* out, const byte* in, word32 sz, const byte* key, word32 keySz, const byte* iv, word32 ivSz, const byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); - #endif /* HAVE_AES_DECRYPT */ + #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #endif /* !NO_AES */ diff --git a/wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h b/wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h index 05231f82b3c..bd4a8acb1e2 100644 --- a/wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h +++ b/wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h @@ -131,12 +131,12 @@ int wc_Psoc6_Aes_GcmEncrypt(struct Aes* aes, byte* out, const byte* in, word32 sz, const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); -#ifdef HAVE_AES_DECRYPT +#if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) int wc_Psoc6_Aes_GcmDecrypt(struct Aes* aes, byte* out, const byte* in, word32 sz, const byte* iv, word32 ivSz, const byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); -#endif /* HAVE_AES_DECRYPT */ +#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #endif /* NO_AES */ diff --git a/wolfssl/wolfcrypt/port/intel/quickassist.h b/wolfssl/wolfcrypt/port/intel/quickassist.h index 268a9949a83..16698c3f0aa 100644 --- a/wolfssl/wolfcrypt/port/intel/quickassist.h +++ b/wolfssl/wolfcrypt/port/intel/quickassist.h @@ -401,14 +401,14 @@ WOLFSSL_LOCAL int IntelQaGetCyInstanceCount(void); const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); - #ifdef HAVE_AES_DECRYPT + #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) WOLFSSL_LOCAL int IntelQaSymAesGcmDecrypt(struct WC_ASYNC_DEV* dev, byte* out, const byte* in, word32 sz, const byte* key, word32 keySz, const byte* iv, word32 ivSz, const byte* authTag, word32 authTagSz, const byte* authIn, word32 authInSz); - #endif /* HAVE_AES_DECRYPT */ + #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #endif /* HAVE_AESGCM */ #endif /* !NO_AES */ diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index a57a4c06b7d..41c40aa0986 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3835,6 +3835,16 @@ #undef HAVE_AES_DECRYPT #define HAVE_AES_DECRYPT #endif + /* GCM and CCM decrypt only use AES encrypt, so keep them with + * NO_AES_DECRYPT. TLS always needs them, so the opt-outs are crypto only. */ + #if !defined(NO_AESGCM_DECRYPT) || !defined(WOLFCRYPT_ONLY) + #undef HAVE_AESGCM_DECRYPT + #define HAVE_AESGCM_DECRYPT + #endif + #if !defined(NO_AESCCM_DECRYPT) || !defined(WOLFCRYPT_ONLY) + #undef HAVE_AESCCM_DECRYPT + #define HAVE_AESCCM_DECRYPT + #endif #ifndef NO_AES_CBC #undef HAVE_AES_CBC #define HAVE_AES_CBC