Xilinx asu rsa standalone by night1rider · Pull Request #11052 · wolfSSL/wolfssl

+        (unsigned int)keySize, (unsigned int)status, (unsigned int)addl);
+
+    /* Fail-closed: only a clean VERIFIED status counts as verified. */
+    if (status == XST_SUCCESS &&


🟠 [Medium] PSS verify reports ASU transaction failures as an invalid signature · Incorrect error handling

wc_AsuRsaPssVerify sets ret = 0 regardless of status, so a failed submit, wait, or engine error leaves *res = 0 and RsaPssVerifyDevice turns it into SIG_VERIFY_E. Engine errors are indistinguishable from forged signatures, and no software fallback occurs. The raw, PSS-sign and OAEP paths in the same file return WC_HW_E here.

Related known finding #8257 (similar but distinct): Both involve ASU transaction error handling, but this finding is in wc_AsuRsaPssVerify and unconditionally converts a returned transaction/engine status into a signature verdict; #8257 is in wc_AsuTransact and submits despite a failed serialization-lock acquisition. The faulting operations and root causes differ, and correcting PSS status propagation would not fix lock handling.

Fix: Return WC_HW_E when status != XST_SUCCESS and only derive the *res verdict from a clean status with a verify pass/fail additional status.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

+    /* DMA the ciphertext into req->out, then copy to the (maybe non-DMA) caller. */
+    req->oaep.XAsu_RsaOpComp.OutputDataAddr = (u64)(UINTPTR)req->out;
+    req->oaep.XAsu_RsaOpComp.KeyCompAddr    = (u64)(UINTPTR)&req->key;
+    req->oaep.XAsu_RsaOpComp.Len            = info->pk.rsa.inLen;


🔵 [Low] OAEP encrypt does not validate the message against the OAEP capacity · Logic errors

hashLen is obtained but never used to bound info->pk.rsa.inLen. wolfSSL's caller only enforces the PKCS#1 v1.5 minimum (sz - 11), so messages longer than keySize - 2*hashLen - 2 (e.g. 191..245 bytes with SHA-256 and a 2048-bit key) reach the ASU, where software would have returned BAD_FUNC_ARG.

Fix: Reject or decline when info->pk.rsa.inLen > keySize - 2 * hashLen - 2 before submitting the request.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

+    XAsu_RsaOaepPaddingParams oaep;                    /* OAEP encrypt params */
+    XAsu_RsaPvtKeyComp        key;
+    byte                  out[XRSA_4096_KEY_SIZE];     /* DMA result, copied out */
+    byte                  scratch[XRSA_4096_KEY_SIZE]; /* PSS sign OutputDataAddr */


⚪ [Info] Comment on scratch buffer contradicts its use · Dead/unreachable code

scratch is documented as the "PSS sign OutputDataAddr", but wc_AsuRsaPssSign assigns req->out to OutputDataAddr and req->scratch to SignatureDataAddr. The mislabel obscures which field the hardware writes the signature into.

Fix: Reword the comment to say scratch backs the PSS-sign SignatureDataAddr.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

+                                    count, start, ret);                  \
+        } while (0)
+
+            RSA_PAD_BENCH("raw-public", wc_RsaDirect(msg, bytes, enc, &outLen,


🟠 [Medium] bench_rsa_pad passes an uninitialized outLen to wc_RsaDirect · Logic errors

outLen (declared at line 11232) is never initialized. wc_RsaDirect reads *outSz into key->dataLen (rsa.c:3353) and never writes it back on success, so both raw rows run on stack garbage: 0 gives BAD_FUNC_ARG, a value under the key width gives RSA_BUFFER_E.

Fix: Set outLen = bytes immediately before each wc_RsaDirect call.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

 }

+/* Off by default: define WOLFSSL_BENCH_RSA_PAD to build this extra sweep. */
+#if defined(WOLFSSL_BENCH_RSA_PAD) && \


🟠 [Medium] bench_rsa_pad guard omits the feature macros its API calls require · API contract violations

The body calls wc_RsaPSS_Sign/wc_RsaPSS_Verify, declared only under WC_RSA_PSS (rsa.h:375, :393), and wc_RsaDirect, declared only under WC_RSA_DIRECT/WC_RSA_NO_PADDING/OPENSSL_EXTRA* (rsa.h:499), but the guard requires none of them, so WOLFSSL_BENCH_RSA_PAD fails to compile on a plain RSA build.

Fix: Add the missing macros to the outer guard, or wrap the PSS and raw rows in their own #ifdef WC_RSA_PSS / wc_RsaDirect availability checks.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

+    /* DMA the ciphertext into req->out, then copy to the (maybe non-DMA) caller. */
+    req->oaep.XAsu_RsaOpComp.OutputDataAddr = (u64)(UINTPTR)req->out;
+    req->oaep.XAsu_RsaOpComp.KeyCompAddr    = (u64)(UINTPTR)&req->key;
+    req->oaep.XAsu_RsaOpComp.Len            = info->pk.rsa.inLen;


🔵 [Low] OAEP encrypt offload skips the message-length check software enforces · Cryptographic correctness

info->pk.rsa.inLen is passed to the ASU without checking inLen <= keySize - 2*hashLen - 2. RsaPublicEncryptEx only enforces the generic sz - RSA_MIN_PAD_SZ bound, so e.g. a 200-byte message with SHA-512 OAEP and a 2048-bit key reaches the hardware, where software returns BAD_FUNC_ARG (RsaPad_OAEP, rsa.c:1372).

Fix: Decline with CRYPTOCB_UNAVAILABLE when info->pk.rsa.inLen > keySize - 2 * hashLen - 2.

wolfSSL-Fenrir-bot · 2026-08-11T21:28:32Z

+                                    count, start, ret);                  \
+        } while (0)
+
+            RSA_PAD_BENCH("raw-public", wc_RsaDirect(msg, bytes, enc, &outLen,


🔵 [Low] Uninitialized outLen passed to wc_RsaDirect in bench_rsa_pad · Integer overflow / underflow

outLen (declared at line 11232) is never initialized before its address is passed to wc_RsaDirect, which reads it (key->dataLen = *outSz) and compares it against the key width in wc_RsaFunctionSync. The raw-public/raw-private rows therefore pass or fail on an indeterminate stack value.

Fix: Initialize outLen = bytes before the first wc_RsaDirect call.

night1rider self-assigned this Aug 4, 2026

night1rider requested a review from wolfSSL-Fenrir-bot August 4, 2026 20:40

wolfSSL-Fenrir-bot reviewed Aug 4, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

night1rider commented Aug 5, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

night1rider commented Aug 5, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

night1rider commented Aug 5, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rsa.c

night1rider added 2 commits August 11, 2026 09:44

Xilinx Versal Gen2 ASU port: RSA offload

0ce2b19

Benchmark: RSA raw, PKCS#1 v1.5, PSS and OAEP across 2048/3072/4096

6d3f1ae

night1rider force-pushed the Xilinx-ASU-RSA-standalone branch from 280c0f1 to 6d3f1ae Compare August 11, 2026 16:58

night1rider requested a review from wolfSSL-Fenrir-bot August 11, 2026 17:59

wolfSSL-Fenrir-bot reviewed Aug 11, 2026

View reviewed changes

night1rider added 4 commits August 11, 2026 13:34

Xilinx Versal Gen2 ASU port: decline raw RSA input that is not the ke…

53c6189

…y width

Xilinx Versal Gen2 ASU port: reject an RSA output buffer smaller than…

6c46a2c

… the key width

Xilinx Versal Gen2 ASU port: auto-enable WOLF_CRYPTO_CB_RSA_PAD with …

fc5306c

…the RSA engine

Xilinx Versal Gen2 ASU port: guard RSA private-key paths with WOLFSSL…

e530e0c

…_RSA_PUBLIC_ONLY

night1rider force-pushed the Xilinx-ASU-RSA-standalone branch from 42baf35 to e530e0c Compare August 11, 2026 20:49

night1rider requested a review from wolfSSL-Fenrir-bot August 11, 2026 20:50

wolfSSL-Fenrir-bot reviewed Aug 11, 2026

View reviewed changes

Uh oh!

Conversation

night1rider commented Aug 4, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11052

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11052

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11052

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 4, 2026 •

edited

Loading