ML-KEM memory safety

crypto/CMakeLists.txt

@@ -785,6 +785,7 @@ if(BUILD_TESTING)
     fipsmodule/evp/evp_ctx_test.cc
     fipsmodule/kdf/kdf_test.cc
     fipsmodule/md5/md5_test.cc
+    fipsmodule/ml_kem/ml_kem_test.cc
     fipsmodule/modes/gcm_test.cc
     fipsmodule/modes/xts_test.cc
     fipsmodule/pbkdf/pbkdf_test.cc

crypto/fipsmodule/evp/p_kem.c

@@ -67,9 +67,11 @@ static int pkey_kem_keygen_deterministic(EVP_PKEY_CTX *ctx,
   }
 
   KEM_KEY *key = KEM_KEY_new();
+  size_t pubkey_len = kem->public_key_len;
+  size_t secret_len = kem->secret_key_len;
   if (key == NULL ||
       !KEM_KEY_init(key, kem) ||
-      !kem->method->keygen_deterministic(key->public_key, key->secret_key, seed) ||
+      !kem->method->keygen_deterministic(key->public_key, &pubkey_len, key->secret_key, &secret_len, seed) ||
       !EVP_PKEY_assign(pkey, EVP_PKEY_KEM, key)) {
     KEM_KEY_free(key);
     return 0;
@@ -92,9 +94,11 @@ static int pkey_kem_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
   }
 
   KEM_KEY *key = KEM_KEY_new();
+  size_t pubkey_len = kem->public_key_len;
+  size_t secret_len = kem->secret_key_len;
   if (key == NULL ||
       !KEM_KEY_init(key, kem) ||
-      !kem->method->keygen(key->public_key, key->secret_key) ||
+      !kem->method->keygen(key->public_key, &pubkey_len, key->secret_key, &secret_len) ||
       !EVP_PKEY_set_type(pkey, EVP_PKEY_KEM)) {
     KEM_KEY_free(key);
     return 0;
@@ -172,7 +176,7 @@ static int pkey_kem_encapsulate_deterministic(EVP_PKEY_CTX *ctx,
     return 0;
   }
 
-  if (!kem->method->encaps_deterministic(ciphertext, shared_secret, key->public_key, seed)) {
+  if (!kem->method->encaps_deterministic(ciphertext, ciphertext_len, shared_secret, shared_secret_len, key->public_key, seed)) {
     return 0;
   }
 
@@ -235,7 +239,7 @@ static int pkey_kem_encapsulate(EVP_PKEY_CTX *ctx,
     return 0;
   }
 
-  if (!kem->method->encaps(ciphertext, shared_secret, key->public_key)) {
+  if (!kem->method->encaps(ciphertext, ciphertext_len, shared_secret, shared_secret_len, key->public_key)) {
     return 0;
   }
 
@@ -290,7 +294,7 @@ static int pkey_kem_decapsulate(EVP_PKEY_CTX *ctx,
     return 0;
   }
 
-  if (!kem->method->decaps(shared_secret, ciphertext, key->secret_key)) {
+  if (!kem->method->decaps(shared_secret, shared_secret_len, ciphertext, key->secret_key)) {
     return 0;
   }
 

crypto/fipsmodule/kem/internal.h

@@ -14,22 +14,31 @@ extern "C" {
 // KEM_METHOD structure and helper functions.
 typedef struct {
   int (*keygen_deterministic)(uint8_t *ctx,
+                              size_t *ctx_len,
                               uint8_t *pkey,
+                              size_t *pkey_len,
                               const uint8_t *seed);
 
   int (*keygen)(uint8_t *public_key,
-                uint8_t *secret_key);
+                size_t *public_key_len,
+                uint8_t *secret_key,
+                size_t *secret_key_len);
 
   int (*encaps_deterministic)(uint8_t *ciphertext,
+                              size_t *ciphertext_len,
                               uint8_t *shared_secret,
+                              size_t *shared_secret_len,
                               const uint8_t *public_key,
                               const uint8_t *seed);
 
   int (*encaps)(uint8_t *ciphertext,
+                size_t *ciphertext_len,
                 uint8_t *shared_secret,
+                size_t *shared_secret_len,
                 const uint8_t *public_key);
 
   int (*decaps)(uint8_t *shared_secret,
+                size_t *shared_secret_len,
                 const uint8_t *ciphertext,
                 const uint8_t *secret_key);
 } KEM_METHOD;

crypto/fipsmodule/kem/kem.c

@@ -17,33 +17,42 @@ static const uint8_t kOIDMLKEM768[]  = {0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04
 static const uint8_t kOIDMLKEM1024[] = {0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x03};
 
 static int ml_kem_1024_keygen_deterministic(uint8_t *public_key,
-                                                uint8_t *secret_key,
-                                                const uint8_t *seed) {
-  return ml_kem_1024_keypair_deterministic(public_key, secret_key, seed) == 0;
+                                            size_t *public_len,
+                                            uint8_t *secret_key,
+                                            size_t *secret_len,
+                                            const uint8_t *seed) {
+  return ml_kem_1024_keypair_deterministic(public_key, public_len, secret_key, secret_len, seed) == 0;
 }
 
 static int ml_kem_1024_keygen(uint8_t *public_key,
-                                  uint8_t *secret_key) {
-  return ml_kem_1024_keypair(public_key, secret_key) == 0;
+                              size_t *public_len,
+                              uint8_t *secret_key,
+                              size_t *secret_len) {
+  return ml_kem_1024_keypair(public_key, public_len, secret_key, secret_len) == 0;
 }
 
 static int ml_kem_1024_encaps_deterministic(uint8_t *ciphertext,
-                                                uint8_t *shared_secret,
-                                                const uint8_t *public_key,
-                                                const uint8_t *seed) {
-  return ml_kem_1024_encapsulate_deterministic(ciphertext, shared_secret, public_key, seed) == 0;
+                                            size_t *ciphertext_len,
+                                            uint8_t *shared_secret,
+                                            size_t *shared_secret_len,
+                                            const uint8_t *public_key,
+                                            const uint8_t *seed) {
+  return ml_kem_1024_encapsulate_deterministic(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key, seed) == 0;
 }
 
 static int ml_kem_1024_encaps(uint8_t *ciphertext,
-                                  uint8_t *shared_secret,
-                                  const uint8_t *public_key) {
-  return ml_kem_1024_encapsulate(ciphertext, shared_secret, public_key) == 0;
+                              size_t *ciphertext_len,
+                              uint8_t *shared_secret,
+                              size_t *shared_secret_len,
+                              const uint8_t *public_key) {
+  return ml_kem_1024_encapsulate(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key) == 0;
 }
 
 static int ml_kem_1024_decaps(uint8_t *shared_secret,
-                                  const uint8_t *ciphertext,
-                                  const uint8_t *secret_key) {
-  return ml_kem_1024_decapsulate(shared_secret, ciphertext, secret_key) == 0;
+                              size_t *shared_secret_len,
+                              const uint8_t *ciphertext,
+                              const uint8_t *secret_key) {
+  return ml_kem_1024_decapsulate(shared_secret, shared_secret_len, ciphertext, secret_key) == 0;
 }
 
 DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_1024_method) {
@@ -55,33 +64,42 @@ DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_1024_method) {
 }
 
 static int ml_kem_768_keygen_deterministic(uint8_t *public_key,
-                                               uint8_t *secret_key,
-                                               const uint8_t *seed) {
-  return ml_kem_768_keypair_deterministic(public_key, secret_key, seed) == 0;
+                                           size_t *public_len,
+                                           uint8_t *secret_key,
+                                           size_t *secret_len,
+                                           const uint8_t *seed) {
+  return ml_kem_768_keypair_deterministic(public_key, public_len, secret_key, secret_len, seed) == 0;
 }
 
 static int ml_kem_768_keygen(uint8_t *public_key,
-                                 uint8_t *secret_key) {
-  return ml_kem_768_keypair(public_key, secret_key) == 0;
+                             size_t *public_len,
+                             uint8_t *secret_key,
+                             size_t *secret_len) {
+  return ml_kem_768_keypair(public_key, public_len, secret_key, secret_len) == 0;
 }
 
 static int ml_kem_768_encaps_deterministic(uint8_t *ciphertext,
-                                               uint8_t *shared_secret,
-                                               const uint8_t *public_key,
-                                               const uint8_t *seed) {
-  return ml_kem_768_encapsulate_deterministic(ciphertext, shared_secret, public_key, seed) == 0;
+                                           size_t *ciphertext_len,
+                                           uint8_t *shared_secret,
+                                           size_t *shared_secret_len,
+                                           const uint8_t *public_key,
+                                           const uint8_t *seed) {
+  return ml_kem_768_encapsulate_deterministic(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key, seed) == 0;
 }
 
 static int ml_kem_768_encaps(uint8_t *ciphertext,
-                                 uint8_t *shared_secret,
-                                 const uint8_t *public_key) {
-  return ml_kem_768_encapsulate(ciphertext, shared_secret, public_key) == 0;
+                             size_t *ciphertext_len,
+                             uint8_t *shared_secret,
+                             size_t *shared_secret_len,
+                             const uint8_t *public_key) {
+  return ml_kem_768_encapsulate(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key) == 0;
 }
 
 static int ml_kem_768_decaps(uint8_t *shared_secret,
-                                 const uint8_t *ciphertext,
-                                 const uint8_t *secret_key) {
-  return ml_kem_768_decapsulate(shared_secret, ciphertext, secret_key) == 0;
+                             size_t *shared_secret_len,
+                             const uint8_t *ciphertext,
+                             const uint8_t *secret_key) {
+  return ml_kem_768_decapsulate(shared_secret, shared_secret_len, ciphertext, secret_key) == 0;
 }
 
 DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_768_method) {
@@ -93,33 +111,42 @@ DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_768_method) {
 }
 
 static int ml_kem_512_keygen_deterministic(uint8_t *public_key,
-                                               uint8_t *secret_key,
-                                               const uint8_t *seed) {
-  return ml_kem_512_keypair_deterministic(public_key, secret_key, seed) == 0;
+                                           size_t *public_len,
+                                           uint8_t *secret_key,
+                                           size_t *secret_len,
+                                           const uint8_t *seed) {
+  return ml_kem_512_keypair_deterministic(public_key, public_len, secret_key, secret_len, seed) == 0;
 }
 
 static int ml_kem_512_keygen(uint8_t *public_key,
-                             uint8_t *secret_key) {
-  return ml_kem_512_keypair(public_key, secret_key) == 0;
+                             size_t *public_len,
+                             uint8_t *secret_key,
+                             size_t *secret_len) {
+  return ml_kem_512_keypair(public_key, public_len, secret_key, secret_len) == 0;
 }
 
 static int ml_kem_512_encaps_deterministic(uint8_t *ciphertext,
-                                               uint8_t *shared_secret,
-                                               const uint8_t *public_key,
-                                               const uint8_t *seed) {
-  return ml_kem_512_encapsulate_deterministic(ciphertext, shared_secret, public_key, seed) == 0;
+                                           size_t *ciphertext_len,
+                                           uint8_t *shared_secret,
+                                           size_t *shared_secret_len,
+                                           const uint8_t *public_key,
+                                           const uint8_t *seed) {
+  return ml_kem_512_encapsulate_deterministic(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key, seed) == 0;
 }
 
 static int ml_kem_512_encaps(uint8_t *ciphertext,
+                             size_t *ciphertext_len,
                              uint8_t *shared_secret,
+                             size_t *shared_secret_len,
                              const uint8_t *public_key) {
-  return ml_kem_512_encapsulate(ciphertext, shared_secret, public_key) == 0;
+  return ml_kem_512_encapsulate(ciphertext, ciphertext_len, shared_secret, shared_secret_len, public_key) == 0;
 }
 
 static int ml_kem_512_decaps(uint8_t *shared_secret,
+                             size_t *shared_secret_len,
                              const uint8_t *ciphertext,
                              const uint8_t *secret_key) {
-  return ml_kem_512_decapsulate(shared_secret, ciphertext, secret_key) == 0;
+  return ml_kem_512_decapsulate(shared_secret, shared_secret_len, ciphertext, secret_key) == 0;
 }
 
 DEFINE_LOCAL_DATA(KEM_METHOD, kem_ml_kem_512_method) {