wolfssl
wolfssl copied to clipboard
Fix PQC and hybrid certificate regressions
Hi all,
Due to recent changes in the logic to decode private keys and to parse the TLS1.3 CertificateVerify message, some regressions regarding PQC private keys and hybrid certificates have been introduced:
- Decoding PQC private keys failed, as the PKCS8 header of a decoded DER file is now already removed before parsing the key.
- The key size wasn't properly stored in the context for PQC keys after decoding a certificate (always the maximum size)
- The two 16-bit size values in case of a hybrid signature in the CertificateVerify message have been incorrectly decoded as 32-bit values instead of 16-bit values. This resulted in wrong values, leading to segmentation faults.
All three regressions are fixed with the changes in this commit.
Can one of the admins verify this patch?
Thanks @Frauschi. Okay to test. Contributor agreement on file.
@anhu please regression test this PR #7576 and #7577 ?
Tested. Works as expected.