Merge pull request #10211 from night1rider/mlkem-cryptocb-sha3-hashtype-bug

Mlkem cryptocb sha3 hashtype not reset after final call

Author: dgarske

.github/workflows/os-check.yml

@@ -105,6 +105,7 @@ jobs:
           '--enable-sessionexport --enable-dtls --enable-dtls13',
           '--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"',
           '--disable-tls --enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"',
+          '--enable-cryptocb --enable-keygen CPPFLAGS="-DWOLF_CRYPTO_CB_FIND"',
           '--disable-examples CPPFLAGS=-DWOLFSSL_NO_MALLOC',
           'CPPFLAGS=-DNO_WOLFSSL_CLIENT',
           'CPPFLAGS=-DNO_WOLFSSL_SERVER',

wolfcrypt/src/sha3.c

@@ -646,6 +646,12 @@ static int InitSha3(wc_Sha3* sha3)
 #ifdef WOLFSSL_HASH_FLAGS
     sha3->flags = 0;
 #endif
+#ifdef WOLF_CRYPTO_CB
+    /* Cached hash variant is tied to sponge state; clear it whenever the
+     * state is reset so reuse for a different SHA3 variant dispatches
+     * correctly through the crypto callback. */
+    sha3->hashType = WC_HASH_TYPE_NONE;
+#endif
 
 #ifdef USE_INTEL_SPEEDUP
     {

wolfcrypt/src/wc_mlkem.c

@@ -604,11 +604,11 @@ int wc_MlKemKey_MakeKey(MlKemKey* key, WC_RNG* rng)
     }
 
 #ifdef WOLF_CRYPTO_CB
-    if ((ret == 0)
-    #ifndef WOLF_CRYPTO_CB_FIND
-        && (key->devId != INVALID_DEVID)
-    #endif
-    ) {
+#ifndef WOLF_CRYPTO_CB_FIND
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+#else
+    if (ret == 0) {
+#endif
         ret = wc_CryptoCb_MakePqcKemKey(rng, WC_PQC_KEM_TYPE_KYBER,
                                         key->type, key);
         if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
@@ -1289,11 +1289,11 @@ int wc_MlKemKey_Encapsulate(MlKemKey* key, unsigned char* c, unsigned char* k,
     if (ret == 0) {
         ret = wc_MlKemKey_CipherTextSize(key, &ctlen);
     }
-    if ((ret == 0)
-    #ifndef WOLF_CRYPTO_CB_FIND
-        && (key->devId != INVALID_DEVID)
-    #endif
-    ) {
+#ifndef WOLF_CRYPTO_CB_FIND
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+#else
+    if (ret == 0) {
+#endif
         ret = wc_CryptoCb_PqcEncapsulate(c, ctlen, k, KYBER_SS_SZ, rng,
                                          WC_PQC_KEM_TYPE_KYBER, key);
         if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
@@ -1769,11 +1769,11 @@ int wc_MlKemKey_Decapsulate(MlKemKey* key, unsigned char* ss,
     }
 
 #ifdef WOLF_CRYPTO_CB
-    if ((ret == 0)
-    #ifndef WOLF_CRYPTO_CB_FIND
-        && (key->devId != INVALID_DEVID)
-    #endif
-    ) {
+#ifndef WOLF_CRYPTO_CB_FIND
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+#else
+    if (ret == 0) {
+#endif
         ret = wc_CryptoCb_PqcDecapsulate(ct, ctSz, ss, KYBER_SS_SZ,
                                          WC_PQC_KEM_TYPE_KYBER, key);
         if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))