Log message:
security/wolfssl: Updates to v4.6.0

Changes since v4.5.0:

wolfSSL Release 4.6.0 (December 22, 2020)

Release 4.6.0 of wolfSSL embedded TLS has bug fixes and new features including:

New Feature Additions

New Build Options

  * wolfSSL now enables linux kernel module support. Big news for Linux kernel
    module developers with crypto requirements! wolfCrypt and wolfSSL are now
    loadable as modules in the Linux kernel, providing the entire libwolfssl
    API natively to other kernel modules. For the first time on Linux, the
    entire TLS protocol stack can be loaded as a module, allowing fully
    kernel-resident TLS/DTLS endpoints with in-kernel handshaking.
    (--enable-linuxkm, --enable-linuxkm-defaults, --with-linux-source)
    (https://www.wolfssl.com/loading-wolfssl-into-the-linux-kernel/)
  * Build tests and updated instructions for use with Apple’s A12Z chipset
    \ 
(https://www.wolfssl.com/preliminary-cryptographic-benchmarks-on-new-apple-a12z-bionic-platform/)
  * Expansion of wolfSSL SP math implementation and addition of
    --enable-sp-math-all build option
  * Apache httpd w/TLS 1.3 support added
  * Sniffer support for TLS 1.3 and AES CCM
  * Support small memory footprint build with only TLS 1.3 and PSK without
    code for (EC)DHE and certificates

New Hardware Acceleration

  * Added support for NXP DCP (i.MX RT1060/1062) crypto co-processor
  * Add Silicon Labs hardware acceleration using SL SE Manager

New Algorithms

  * RC2 ECB/CBC added for use with PKCS#12 bundles
  * XChaCha and the XChaCha20-Poly1305 AEAD algorithm support added

Misc

  * Added support for 802.11Q VLAN frames to sniffer
  * Added OCSP function wolfSSL_get_ocsp_producedDate
  * Added API to set CPU ID flags cpuid_select_flags, cpuid_set_flag,
    cpuid_clear_flag
  * New DTLS/TLS non-blocking Secure Renegotiation example added to server.c
    and client.c

Fixes

Math Library

  * Fix mp_to_unsigned_bin_len out of bounds read with buffers longer than
    maximum MP
  * Fix for fp_read_radix_16 out of bounds read
  * Fix to add wrapper for new timing resistant wc_ecc_mulmod_ex2 function
    version in HW ECC acceleration
  * Handle an edge case with RSA-PSS encoding message to hash

Compatibility Layer Fixes

  * Fix for setting serial number wolfSSL_X509_set_serialNumber
  * Fix for setting ASN1 time not before / not after with WOLFSSL_X509
  * Fix for order of components in issuer name when using X509_sign
  * Fix for compatibility layer API DH_compute_key
  * EVP fix incorrect block size for GCM and buffer up AAD for
    encryption/decryption
  * EVP fix for AES-XTS key length return value and fix for string compare
    calls
  * Fix for mutex freeing during RNG failure case with EVP_KEY creation
  * Non blocking use with compatibility layer BIOs in TLS connections

Build Configuration

  * Fix for custom build with WOLFSSL_USER_MALLOC defined
  * ED448 compiler warning on Intel 32bit systems
  * CURVE448_SMALL build fix for 32bit systems with Curve448
  * Fix to build SP math with IAR
  * CMake fix to only set ranlib arguments for Mac, and for stray typo of
    , -> ;
  * Build with --enable-wpas=small fix
  * Fix for building fips ready using openssl extra
  * Fixes for building with Microchip (min/max and undef SHA_BLOCK_SIZE)
  * FIx for NO_FILESYSTEM build on Windows
  * Fixed SHA256 support for IMX-RT1060
  * Fix for ECC key gen with NO_TFM_64BIT

Sniffer

  * Fixes for sniffer when using static ECC keys. Adds back TLS v1.2 static
    ECC key fallback detection and fixes new ECC RNG requirement for timing
    resistance
  * Fix for sniffer with SNI enabled to properly handle WOLFSSL_SUCCESS error
    code in ProcessClientHello
  * Fix for sniffer using HAVE_MAX_FRAGMENT in "certificate" type message
  * Fix build error with unused "ret" when building with \ 
WOLFSSL_SNIFFER_WATCH.
  * Fix to not treat cert/key not found as error in myWatchCb and
    WOLFSSL_SNIFFER_WATCH.
  * Sniffer fixes for handling TCP out-of-range sequence number
  * Fixes SSLv3 use of ECDH in sniffer

PKCS

  * PKCS#11 fix to generate ECC key for decrypt/sign or derive
  * Fix for resetting internal variables when parsing a malformed PKCS#7
    bundle with PKCS7_VerifySignedData()
  * Verify the extracted public key in wc_PKCS7_InitWithCert
  * Fix for internal buffer size when using decompression with PKCS#7

Misc

  * Pin the C# verify callback function to keep from garbage collection
  * DH fixes for when public key is owned and free’d after a handshake
  * Fix for TLS 1.3 early data packets
  * Fix for STM32 issue with some Cube HAL versions and STM32 example timeout
  * Fix mmCAU and LTC hardware mutex locking to prevent double lock
  * Fix potential race condition with CRL monitor
  * Fix for possible malformed encrypted key with 3DES causing negative length
  * AES-CTR performance fixed with AES-NI

Improvements/Optimizations
SP and Math

  * mp_radix_size adjustment for leading 0
  * Resolve implicit cast warnings with SP build
  * Change mp_sqr to return an error if the result won't fit into the fixed
    length dp
  * ARM64 assembly with clang improvements, clang doesn't always handle use of
    x29 (FP or Frame Pointer) in inline assembly code correctly - reworked
    sp_2048_sqr_8 to not use x29
  * SP mod exp changed to support exponents of different lengths
  * TFM div: fix initial value of size in q so clamping doesn't OOB read
  * Numerous stack depth improvements with --enable-smallstack
  * Improve cache resistance with Base64 operations

TLS 1.3

  * TLS 1.3 wolfSSL_peek want read return addition
  * TLS 1.3: Fix P-521 algorithm matching

PKCS

  * Improvements and refactoring to PKCS#11 key look up
  * PKCS #11 changes for signing and loading RSA public key from private
  * check PKCS#7 SignedData private key is valid before using it
  * check PKCS#7 VerifySignedData content length against total bundle size
    to avoid large malloc

Compatibility Layer

  * EVP add block size for more ciphers in wolfSSL_EVP_CIPHER_block_size()
  * Return long names instead of short names in wolfSSL_OBJ_obj2txt()
  * Add additional OpenSSL compatibility functions to update the version of
    Apache httpd supported
  * add "CCM8" variants to cipher_names "CCM-8" ciphers, for \ 
OpenSSL compat

Builds

  * Cortex-M SP ASM support for IAR 6.70
  * STM Cube pack support (IDE/STM32Cube)
  * Build option --enable-aesgcm=4bit added for AES-GCM GMULT using 4 bit
    table
  * Xilinx IDE updates to allow XTIME override for Xilinx, spelling fixes in
    Xilinx README.md, and add Xilinx SDK printf support
  * Added ED448 to the "all" options and ED448 check key null argument \ 
sanity
    check
  * Added ARC4, 3DES, nullcipher, BLAKE2, BLAKE2s, XChaCha, MD2, and MD4 to
    the “all” options
  * Added an --enable-all-crypto option, to enable only the wolfCrypt features
    of --enable-all, combinable with --enable-cryptonly
  * Added the ability to selectively remove features from --enable-all and
    --enable-all-crypto using specific --disable- options
  * Use Intel intrinsics with Windows for RDSEED and RDRAND
    (thanks to dr-m from MariaDB)
  * Add option to build with WOLFSSL_NO_CLIENT_AUTH
  * Updated build requirements for wolfSSH use to be less restrictive
  * lighttpd support update for v1.4.56
  * Added batch file to copy files to ESP-IDF folders and resolved warnings
    when using v4.0 ESP-IDF
  * Added --enable-stacksize=verbose, showing at a glance the stack high water
    mark for each subtest in testwolfcrypt

ECC

  * Performance increase for ECC verify only, using non constant time SP modinv
  * During ECC verify add validation of r and s before any use
  * Always use safe add and dbl with ECC
  * Timing resistant scalar multiplication updated with use of Joye double-add
    ladder
  * Update mp_jacobi function to reduce stack and increase performance for
    base ECC build
  * Reduce heap memory use with wc_EccPrivateKeyDecode, Improvement to
    ECC wc_ecc_sig_to_rs and wc_ecc_rs_raw_to_sig to reduce memory use (avoid \ 
the mp_int)
  * Improve StoreECC_DSA_Sig bounds checking

OCSP

  * OCSP improvement to handle extensions in singleResponse
  * support for OCSP request/response for multiple certificates
  * OCSP Must Staple option added to require OCSP stapling response
  * Add support for id-pkix-ocsp-nocheck extension

Misc

  * Additional code coverage added for ECC and RSA, PKCS#7, 3DES, EVP and
    Blake2b operations
  * DTLS MTU: check MTU on write
  * Refactor hash sig selection and add the macros WOLFSSL_STRONGEST_HASH_SIG
    (picks the strongest hash) and WOLFSSL_ECDSA_MATCH_HASH (will pick the
     hash to match the ECC curve)
  * Strict certificate version allowed from client, TLS 1.2 / 1.3 can not
    accept client certificates lower than version 3
  * wolfSSL_get_ciphers_compat(), skip the fake indicator ciphers like the
    renegotiation indication and the quantum-safe hybrid
  * When parsing session ticket, check TLS version to see whether they are
    version compatible
  * Additional sanity check for invalid ASN1 padding on integer type
  * Adding in ChaCha20 streaming feature with Mac and Intel assembly build
  * Sniffer build with --enable-oldtls option on

Log message:
security/wolfssl: Updates to v4.5.0

Changes since v4.4.0:

wolfSSL Release 4.5.0 (August 19, 2020)

If you have questions about this release, feel free to contact us on our
info@ address.

Release 4.5.0 of wolfSSL embedded TLS has bug fixes and new features including:

New Feature Additions

* Added Xilinx Vitis 2019.2 example and README updates
* TLS v1.3 is now enabled by default
* Building FIPS 140-2 code and test on Solaris
* Secure renegotiation with DTLS 1.2
* Update RSA calls for hardware acceleration with Xilsecure
* Additional OpenSSL compatibility layer functions added
* Cypress PSoC6 wolfCrypt driver added
* Added STM32CubeIDE support
* Added certificate parsing and inspection to C# wrapper layer
* TLS v1.3 sniffer support added
* TSIP v1.09 for target board GR-ROSE support added
* Added support for the "X72N Envision Kit" evaluation board
* Support for ECC nonblocking using the configure options
  "--enable-ecc=nonblock --enable-sp=yes,nonblock \ 
CFLAGS=-DWOLFSSL_PUBLIC_MP"
* Added wc_curve25519_make_pub function to generate a public key given the
  private one

Fixes

* PIC32MZ hardware cache and large hashes fix
* AES-GCM use with EVP layer in compatibility layer code
* Fix for RSA_LOW_MEM with ARM build of SP code
* Sanity check on tag length with AES-CCM to conform with RFC 3610
* Fixes for 32 and 64 bit software implementations of SP code when
  WOLFSSL_SP_CACHE_RESISTANT is defined
* GCC warning fixes for GCC 9 and later
* Sanity check on HKDF expand length to conform with RFC 5869
* Fixes for STM32 CubeMX HAL with AES-GCM
* Fixed point cache look up table (LUT) implementation fixes
* Fix for ARM 32bit SP code when calling div word
* Fix for potential out of bounds read when parsing CRLs
* Fix for potential out of bounds read with RSA unpadding
* AES-CCM optimized counter fix
* Updates to Xcode projects for new files and features
* Fix for adding CRL’s to a WOLFSSL_X509_STORE structure
* FIPSv2 build with opensslall build fixes
* Fixes for CryptoCell use with ECC and signature wrappers
* Fix for mod calculation with SP code dealing with 3072 bit keys
* Fix for handling certificates with multiple OU’s in name
* Fix for SP math implementation of sp_add_d and add a sanity check on
  rshb range
* Fix for sanity check on padding with DES3 conversion of PEM to DER
* Sanity check for potential out of bounds read with fp_read_radix_16
* Additional checking of ECC scalars.
* Fixing the FIPS Ready build w.r.t. ecc.c.
* When processing certificate names with OpenSSL compatibility layer
  enabled, unknown name item types were getting handled as having NID 0,
  and failing. Added a couple more items to what is handled correctly,
  and ignoring anything that is an unknown type.

Improvements/Optimizations

* TLS 1.3 certificate verify update to handle 8192 bit RSA keys
* wpa_supplicant support with reduced code size option
* TLS 1.3 alerts encrypted when possible
* Many minor coverity fixes added
* Error checking when parsing PKCS12 DER
* IAR warning in test.c resolved
* ATECC608A improvements for use with Harmony 3 and PIC32 MZ
* Support for AES-GCM and wc_SignatureVerifyHash with static memory and no
  malloc’s
* Enable SNI by default with JNI/JSSE builds
* NetBSD GCC compiler warnings resolved
* Additional test cases and code coverage added including curve25519 and
  curve448 tests
* Option for user defined mutexes with WOLFSSL_USER_MUTEX
* Sniffer API’s for loading buffer directly
* Fixes and improvements from going through the DO-178 process were added
* Doxygen updates and fixes for auto documentation generation
* Changed the configure option for FIPS Ready builds to be
  `--enable-fips=ready`.

This release of wolfSSL includes fixes for 6 security vulnerabilities.

wolfSSL version 4.5.0 contains 6 vulnerability fixes: 2 fixes for TLS 1.3,
2 side channel attack mitigations, 1 fix for a potential private key leak
in a specific use case, 1 fix for DTLS.

* In earlier versions of wolfSSL there exists a potential man in the middle
  attack on TLS 1.3 clients. Malicious attackers with a privileged network
  position can impersonate TLS 1.3 servers and bypass authentication. Users
  that have applications with client side code and have TLS 1.3 turned on,
  should update to the latest version of wolfSSL. Users that do not have
  TLS 1.3 turned on, or that are server side only, are NOT affected by this
  report. Thanks to Gerald Doussot from NCC group for the report.
* Denial of service attack on TLS 1.3 servers from repetitively sending
  ChangeCipherSpecs messages. This denial of service results from the
  relatively low effort of sending a ChangeCipherSpecs message versus the
  effort of the server to process that message. Users with TLS 1.3 servers are
  recommended to update to the most recent version of wolfSSL which limits the
  number of TLS 1.3 ChangeCipherSpecs that can be received in order to avoid
  this DoS attack. CVE-2020-12457 was reserved for the report. Thanks to
  Lenny Wang of Tencent Security Xuanwu LAB.
* Potential cache timing attacks on public key operations in builds that are
  not using SP (single precision). Users that have a system where malicious
  agents could execute code on the system, are not using the SP build with
  wolfSSL, and are doing private key operations on the system (such as signing
  with a private key) are recommended to regenerate private keys and update to
  the most recent version of wolfSSL. CVE-2020-15309 is reserved for this
  issue. Thanks to Ida Bruhns from Universität zu Lübeck for the report.
* When using SGX with EC scalar multiplication the possibility of side-channel
  attacks are present. To mitigate the risk of side channel attacks wolfSSL’s
  single precision EC operations should be used instead. Release 4.5.0 turns
  this on be default now with SGX builds and in previous versions of wolfSSL
  this can be turned on by using the WOLFSSL_SP macros. Thank you to
  Alejandro Cabrera Aldaya, Cesar Pereida García and Billy Bob Brumley from
  the Network and Information Security Group (NISEC) at Tampere University for
  the report.
* Leak of private key in the case that PEM format private keys are bundled in
  with PEM certificates into a single file. This is due to the
  misclassification of certificate type versus private key type when parsing
  through the PEM file. To be affected, wolfSSL would need to have been built
  with OPENSSL_EXTRA (--enable-opensslextra). Some build variants such as
  --enable-all and --enable-opensslall also turn on this code path, checking
  wolfssl/options.h for OPENSSL_EXTRA will show if the macro was used with the
  build. If having built with the opensslextra enable option and having placed
  PEM certificates with PEM private keys in the same file when loading up the
  certificate file, then we recommend updating wolfSSL for this use case and
  also recommend regenerating any private keys in the file.
* During the handshake, clear application_data messages in epoch 0 are
  processed and returned to the application. Fixed by dropping received
  application_data messages in epoch 0. Thank you to Paul Fiterau of Uppsala
  University and Robert Merget of Ruhr-University Bochum for the report.

For additional vulnerability information visit the vulnerability page at
https://www.wolfssl.com/docs/security-vulnerabilities/

See INSTALL file for build instructions.
More info can be found on-line at https://wolfssl.com/wolfSSL/Docs.html

Log message:
security/wolfssl: Updates to v4.4.0

Changes since v4.3.0:

wolfSSL Release 4.4.0 (04/22/2020)

If you have questions about this release, feel free to contact us on our
info@ address.

Release 4.4.0 of wolfSSL embedded TLS has bug fixes and new features including:
New Feature Additions

  * Hexagon support.
  * DSP builds to offload ECC verify operations.
  * Certificate Manager callback support.
  * New APIs for running updates to ChaCha20/Poly1305 AEAD.
  * Support for use with Apache.
  * Add support for IBM s390x.
  * PKCS8 support for ED25519.
  * OpenVPN support.
  * Add P384 curve support to SP.
  * Add BIO and EVP API.
  * Add AES-OFB mode.
  * Add AES-CFB mode.
  * Add Curve448, X448, and Ed448.
  * Add Renesas Synergy S7G2 build and hardware acceleration.

Fixes

  * Fix for RSA public encrypt / private sign with RSA key sizes over 2048-bit.
  * Correct misspellings.
  * Secure renegotiation fix.
  * Fix memory leak when using ATECC and non-SECP256R1 curves for sign, verify,
    or shared secret.
  * Fix for K64 MMCAU with WOLFSSL_SMALL_STACK_CACHE.
  * Fix the RSA verify only build.
  * Fix in SP C implementation for small stack.
  * Fix using the auth key id extension is set, hash might not be present.
  * Fix when flattening certificate structure to include the subject alt names.
  * Fixes for building with ECC sign/verify only.
  * Fix for ECC and no cache resistance.
  * Fix memory leak in DSA.
  * Fix build on minGW.
  * Fix PemToDer() call in ProcessBuffer() to set more than ECC.
  * Fix for using RSA without SHA-512.
  * Add some close tags to the echoserver HTTP example output.
  * Miscellaneous fixes and updates for static analysis reports.
  * Fixes for time structure support.
  * Fixes for VxWorks support.
  * Fixes for Async crypto support.
  * Fix cache resist compile to work with SP C code.
  * Fixes for Curve25519 x64 asm.
  * Fix for SP x64 div.
  * Fix for DTLS edge case where CCS and Finished come out of order and the
    retransmit pool gets flushed.
  * Fix for infinite loop in SHA-1 with small inputs. Thanks to Peter W.
  * Fix for FIPS Hmac where wc_HmacInit() isn't used. wc_HmacSetKey() needs
    to initialize the Hmac structure. Type is set to NONE, and checked against
    NONE, not 0.
  * Fixes for SP RSA private operations.
  * Fixes for Xilinx SDK and Zynq UltraScale+ MPSoC
  * Fix leak when building with HAVE_AESGCM and NO_AES_DECRYPT. Thanks G.G.
  * Fixes for building ECC without ASN.
  * Fix for async TLSv1.3 issues.
  * Fix wc_KeyPemToDer() with PKCS1 and empty key.
  * Omit -fomit-frame-pointer from CFLAGS in configure.ac.

Improvements/Optimizations

  * Qt 5.12 and 5.13 support.
  * Added more digest types to Cryptocell RSA sign/verify.
  * Some memory usage improvements.
  * Speed improvements for mp_rand.
  * Improvements to CRL and OCSP support.
  * Refactor Poly1305 AEAD/MAC to reduce duplicate code.
  * Add blinding to RSA key gen.
  * Improvements to blinding.
  * Improvement and expansion of OpenSSL Compatibility Layer.
  * Improvements to ChaCha20.
  * Improvements to X.509 processing.
  * Improvements to ECC support.
  * Improvement in detecting 64-bit support.
  * Refactor to combine duplicate ECC parameter parsing code.
  * Improve keyFormat to be set by algId and let later key parsing produce fail.
  * Add test cases for 3072-bit and 4096-bit RSA keys.
  * Improve signature wrapper and DH test cases.
  * Improvements to the configure.ac script.
  * Added constant time RSA q modinv p.
  * Improve performance of SP Intel 64-bit asm.
  * Added a few more functions to the ABI list.
  * Improve TLS bidirectional shutdown behavior.
  * OpenSSH 8.1 support.
  * Improve performance of RSA/DH operations on x64.
  * Add support for PKCS7/CMS Enveloped data with fragmented encrypted content.
  * Example linker description for FIPS builds to enforce object ordering.
  * C# wrapper improvements. Added TLS client example and TLSv1.3 methods.
  * Allow setting MTU in DTLS.
  * Improve PKCS12 create for outputting encrypted bundles.
  * Constant time EC map to affine for private operations.
  * Improve performance of RSA public key ops with TFM.
  * Smaller table version of AES encrypt/decrypt.
  * Support IAR with position independent code (ROPI).
  * Improve speed of AArch64 assembly.
  * Support AES-CTR with AES-NI.
  * Support AES-CTR on esp32.
  * Add a no malloc option for small SP math.

This release of wolfSSL includes fixes for 2 security vulnerabilities.

  * For fast math, use a constant time modular inverse when mapping to affine
    when operation involves a private key - keygen, calc shared secret, sign.
    Thank you to Alejandro Cabrera Aldaya, Cesar Pereida García and
    Billy Bob Brumley from the Network and Information Security Group (NISEC)
    at Tampere University for the report.

  * Change constant time and cache resistant ECC mulmod. Ensure points being
    operated on change to make constant time. Thank you to Pietro Borrello at
    Sapienza University of Rome.

For additional vulnerability information visit the vulnerability page at
https://www.wolfssl.com/docs/security-vulnerabilities/

See INSTALL file for build instructions.
More info can be found on-line at https://wolfssl.com/wolfSSL/Docs.html

Log message:
security/wolfssl: Updates the comment on mutex test failure.

Adds the version of -current where the tests have been fixed.

Log message:
Import of wolfssl v4.3.0 as security/woflssl

WolfSSL is an embedded SSL Library for programmers building security
functionality into their applications and devices.