From f451eeb220ed52d232d95e7299cd404fe843f4d1 Mon Sep 17 00:00:00 2001 From: Gerardo Ravago Date: Thu, 13 Aug 2026 11:34:16 -0400 Subject: [PATCH 1/4] Add remaining SHA2 algorithms to the AWS-LC provider Register remaining SHA2 digests with OpenSSL's aliases and back it with AWS-LC's public SHA2 streaming API. Extend the parameterized frontend and backend suites so geometry, context copying, known-answer output, attribution, and short-output rejection cover the new variant. --- provider/ALGORITHM_SUPPORT.md | 2 +- provider/backend/operations/digests/sha2.c | 110 ++++++++++ provider/frontend/operations/digests/sha2.c | 188 ++++++++++++++++++ provider/frontend/registry.c | 10 + provider/internal/backend/digests.h | 4 + provider/internal/frontend/digests.h | 4 + .../backend/operations/digests/sha2_test.cc | 38 ++++ .../frontend/operations/digests/sha2_test.cc | 36 ++++ 8 files changed, 391 insertions(+), 1 deletion(-) diff --git a/provider/ALGORITHM_SUPPORT.md b/provider/ALGORITHM_SUPPORT.md index 8e1fa1902a..be9a195c18 100644 --- a/provider/ALGORITHM_SUPPORT.md +++ b/provider/ALGORITHM_SUPPORT.md @@ -18,7 +18,7 @@ None yet. | Family | Variants | |---|---| -| SHA-2 | `SHA2-224`, `SHA2-256` | +| SHA-2 | `SHA2-224`, `SHA2-256`, `SHA2-384`, `SHA2-512`, `SHA2-512/224`, `SHA2-512/256` | ## Key Encapsulation Mechanisms (`OSSL_OP_KEM`) diff --git a/provider/backend/operations/digests/sha2.c b/provider/backend/operations/digests/sha2.c index 0f1f86d8a7..57983a6658 100644 --- a/provider/backend/operations/digests/sha2.c +++ b/provider/backend/operations/digests/sha2.c @@ -81,3 +81,113 @@ int awslc_prov_sha256_copy(void *dst, const void *src) { *(SHA256_CTX *)dst = *(const SHA256_CTX *)src; return 1; } + +// SHA-384 + +size_t awslc_prov_sha384_ctx_size(void) { return sizeof(SHA512_CTX); } + +size_t awslc_prov_sha384_digest_size(void) { return SHA384_DIGEST_LENGTH; } + +size_t awslc_prov_sha384_block_size(void) { return SHA384_CBLOCK; } + +int awslc_prov_sha384_init(void *ctx) { return SHA384_Init((SHA512_CTX *)ctx); } + +int awslc_prov_sha384_update(void *ctx, const void *data, size_t len) { + return SHA384_Update((SHA512_CTX *)ctx, data, len); +} + +int awslc_prov_sha384_final(void *ctx, unsigned char *out, size_t out_size) { + if (out_size < SHA384_DIGEST_LENGTH) { + return 0; + } + return SHA384_Final(out, (SHA512_CTX *)ctx); +} + +void awslc_prov_sha384_copy(void *dst, const void *src) { + *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; +} + +// SHA-512 + +size_t awslc_prov_sha512_ctx_size(void) { return sizeof(SHA512_CTX); } + +size_t awslc_prov_sha512_digest_size(void) { return SHA512_DIGEST_LENGTH; } + +size_t awslc_prov_sha512_block_size(void) { return SHA512_CBLOCK; } + +int awslc_prov_sha512_init(void *ctx) { return SHA512_Init((SHA512_CTX *)ctx); } + +int awslc_prov_sha512_update(void *ctx, const void *data, size_t len) { + return SHA512_Update((SHA512_CTX *)ctx, data, len); +} + +int awslc_prov_sha512_final(void *ctx, unsigned char *out, size_t out_size) { + if (out_size < SHA512_DIGEST_LENGTH) { + return 0; + } + return SHA512_Final(out, (SHA512_CTX *)ctx); +} + +void awslc_prov_sha512_copy(void *dst, const void *src) { + *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; +} + +// SHA-512/224 + +size_t awslc_prov_sha512_224_ctx_size(void) { return sizeof(SHA512_CTX); } + +size_t awslc_prov_sha512_224_digest_size(void) { + return SHA512_224_DIGEST_LENGTH; +} + +size_t awslc_prov_sha512_224_block_size(void) { return SHA512_CBLOCK; } + +int awslc_prov_sha512_224_init(void *ctx) { + return SHA512_224_Init((SHA512_CTX *)ctx); +} + +int awslc_prov_sha512_224_update(void *ctx, const void *data, size_t len) { + return SHA512_224_Update((SHA512_CTX *)ctx, data, len); +} + +int awslc_prov_sha512_224_final(void *ctx, unsigned char *out, + size_t out_size) { + if (out_size < SHA512_224_DIGEST_LENGTH) { + return 0; + } + return SHA512_224_Final(out, (SHA512_CTX *)ctx); +} + +void awslc_prov_sha512_224_copy(void *dst, const void *src) { + *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; +} + +// SHA-512/256 + +size_t awslc_prov_sha512_256_ctx_size(void) { return sizeof(SHA512_CTX); } + +size_t awslc_prov_sha512_256_digest_size(void) { + return SHA512_256_DIGEST_LENGTH; +} + +size_t awslc_prov_sha512_256_block_size(void) { return SHA512_CBLOCK; } + +int awslc_prov_sha512_256_init(void *ctx) { + return SHA512_256_Init((SHA512_CTX *)ctx); +} + +int awslc_prov_sha512_256_update(void *ctx, const void *data, size_t len) { + return SHA512_256_Update((SHA512_CTX *)ctx, data, len); +} + +int awslc_prov_sha512_256_final(void *ctx, unsigned char *out, + size_t out_size) { + if (out_size < SHA512_256_DIGEST_LENGTH) { + return 0; + } + return SHA512_256_Final(out, (SHA512_CTX *)ctx); +} + +void awslc_prov_sha512_256_copy(void *dst, const void *src) { + *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; +} diff --git a/provider/frontend/operations/digests/sha2.c b/provider/frontend/operations/digests/sha2.c index 1e3a513b95..651529aa52 100644 --- a/provider/frontend/operations/digests/sha2.c +++ b/provider/frontend/operations/digests/sha2.c @@ -192,3 +192,191 @@ static int awslc_prov_sha256_get_params(OSSL_PARAM params[]) { } AWSLC_PROV_FIXED_DIGEST_DISPATCH_TABLE(sha256); + +// SHA-384 + +AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha384); + +static void *awslc_prov_sha384_newctx(void *provctx) { + (void)provctx; + return awslc_prov_sha2_newctx(awslc_prov_sha384_ctx_size()); +} + +static void awslc_prov_sha384_freectx(void *dctx) { + awslc_prov_sha2_freectx(dctx, awslc_prov_sha384_ctx_size()); +} + +static void *awslc_prov_sha384_dupctx(void *dctx) { + return awslc_prov_sha2_dupctx(dctx, awslc_prov_sha384_ctx_size(), + awslc_prov_sha384_copy); +} + +static void awslc_prov_sha384_copyctx(void *outctx, void *inctx) { + awslc_prov_sha2_copyctx(outctx, inctx, awslc_prov_sha384_copy); +} + +static int awslc_prov_sha384_init_op(void *dctx, const OSSL_PARAM params[]) { + return awslc_prov_sha2_init_op(dctx, params, awslc_prov_sha384_init); +} + +static int awslc_prov_sha384_update_op(void *dctx, const unsigned char *in, + size_t inl) { + return awslc_prov_sha2_update_op(dctx, in, inl, awslc_prov_sha384_update); +} + +static int awslc_prov_sha384_final_op(void *dctx, unsigned char *out, + size_t *outl, size_t outsz) { + return awslc_prov_sha2_final_op(dctx, out, outl, outsz, + awslc_prov_sha384_final, + awslc_prov_sha384_digest_size()); +} + +static int awslc_prov_sha384_get_params(OSSL_PARAM params[]) { + return awslc_prov_sha2_get_params(params, awslc_prov_sha384_block_size(), + awslc_prov_sha384_digest_size()); +} + +AWSLC_PROV_FIXED_DIGEST_DISPATCH_TABLE(sha384); + +// SHA-512 + +AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512); + +static void *awslc_prov_sha512_newctx(void *provctx) { + (void)provctx; + return awslc_prov_sha2_newctx(awslc_prov_sha512_ctx_size()); +} + +static void awslc_prov_sha512_freectx(void *dctx) { + awslc_prov_sha2_freectx(dctx, awslc_prov_sha512_ctx_size()); +} + +static void *awslc_prov_sha512_dupctx(void *dctx) { + return awslc_prov_sha2_dupctx(dctx, awslc_prov_sha512_ctx_size(), + awslc_prov_sha512_copy); +} + +static void awslc_prov_sha512_copyctx(void *outctx, void *inctx) { + awslc_prov_sha2_copyctx(outctx, inctx, awslc_prov_sha512_copy); +} + +static int awslc_prov_sha512_init_op(void *dctx, const OSSL_PARAM params[]) { + return awslc_prov_sha2_init_op(dctx, params, awslc_prov_sha512_init); +} + +static int awslc_prov_sha512_update_op(void *dctx, const unsigned char *in, + size_t inl) { + return awslc_prov_sha2_update_op(dctx, in, inl, awslc_prov_sha512_update); +} + +static int awslc_prov_sha512_final_op(void *dctx, unsigned char *out, + size_t *outl, size_t outsz) { + return awslc_prov_sha2_final_op(dctx, out, outl, outsz, + awslc_prov_sha512_final, + awslc_prov_sha512_digest_size()); +} + +static int awslc_prov_sha512_get_params(OSSL_PARAM params[]) { + return awslc_prov_sha2_get_params(params, awslc_prov_sha512_block_size(), + awslc_prov_sha512_digest_size()); +} + +AWSLC_PROV_FIXED_DIGEST_DISPATCH_TABLE(sha512); + +// SHA-512/224 + +AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512_224); + +static void *awslc_prov_sha512_224_newctx(void *provctx) { + (void)provctx; + return awslc_prov_sha2_newctx(awslc_prov_sha512_224_ctx_size()); +} + +static void awslc_prov_sha512_224_freectx(void *dctx) { + awslc_prov_sha2_freectx(dctx, awslc_prov_sha512_224_ctx_size()); +} + +static void *awslc_prov_sha512_224_dupctx(void *dctx) { + return awslc_prov_sha2_dupctx(dctx, awslc_prov_sha512_224_ctx_size(), + awslc_prov_sha512_224_copy); +} + +static void awslc_prov_sha512_224_copyctx(void *outctx, void *inctx) { + awslc_prov_sha2_copyctx(outctx, inctx, awslc_prov_sha512_224_copy); +} + +static int awslc_prov_sha512_224_init_op(void *dctx, + const OSSL_PARAM params[]) { + return awslc_prov_sha2_init_op(dctx, params, awslc_prov_sha512_224_init); +} + +static int awslc_prov_sha512_224_update_op(void *dctx, + const unsigned char *in, + size_t inl) { + return awslc_prov_sha2_update_op(dctx, in, inl, + awslc_prov_sha512_224_update); +} + +static int awslc_prov_sha512_224_final_op(void *dctx, unsigned char *out, + size_t *outl, size_t outsz) { + return awslc_prov_sha2_final_op(dctx, out, outl, outsz, + awslc_prov_sha512_224_final, + awslc_prov_sha512_224_digest_size()); +} + +static int awslc_prov_sha512_224_get_params(OSSL_PARAM params[]) { + return awslc_prov_sha2_get_params(params, + awslc_prov_sha512_224_block_size(), + awslc_prov_sha512_224_digest_size()); +} + +AWSLC_PROV_FIXED_DIGEST_DISPATCH_TABLE(sha512_224); + +// SHA-512/256 + +AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512_256); + +static void *awslc_prov_sha512_256_newctx(void *provctx) { + (void)provctx; + return awslc_prov_sha2_newctx(awslc_prov_sha512_256_ctx_size()); +} + +static void awslc_prov_sha512_256_freectx(void *dctx) { + awslc_prov_sha2_freectx(dctx, awslc_prov_sha512_256_ctx_size()); +} + +static void *awslc_prov_sha512_256_dupctx(void *dctx) { + return awslc_prov_sha2_dupctx(dctx, awslc_prov_sha512_256_ctx_size(), + awslc_prov_sha512_256_copy); +} + +static void awslc_prov_sha512_256_copyctx(void *outctx, void *inctx) { + awslc_prov_sha2_copyctx(outctx, inctx, awslc_prov_sha512_256_copy); +} + +static int awslc_prov_sha512_256_init_op(void *dctx, + const OSSL_PARAM params[]) { + return awslc_prov_sha2_init_op(dctx, params, awslc_prov_sha512_256_init); +} + +static int awslc_prov_sha512_256_update_op(void *dctx, + const unsigned char *in, + size_t inl) { + return awslc_prov_sha2_update_op(dctx, in, inl, + awslc_prov_sha512_256_update); +} + +static int awslc_prov_sha512_256_final_op(void *dctx, unsigned char *out, + size_t *outl, size_t outsz) { + return awslc_prov_sha2_final_op(dctx, out, outl, outsz, + awslc_prov_sha512_256_final, + awslc_prov_sha512_256_digest_size()); +} + +static int awslc_prov_sha512_256_get_params(OSSL_PARAM params[]) { + return awslc_prov_sha2_get_params(params, + awslc_prov_sha512_256_block_size(), + awslc_prov_sha512_256_digest_size()); +} + +AWSLC_PROV_FIXED_DIGEST_DISPATCH_TABLE(sha512_256); diff --git a/provider/frontend/registry.c b/provider/frontend/registry.c index 91e6bd6012..bd19ff18e3 100644 --- a/provider/frontend/registry.c +++ b/provider/frontend/registry.c @@ -29,6 +29,16 @@ static const OSSL_ALGORITHM awslc_prov_digests[] = { // PROV_NAMES_SHA2_256 AWSLC_PROV_ALG("SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1", sha256, "AWS-LC SHA2-256 implementation"), + AWSLC_PROV_ALG("SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2", sha384, + "AWS-LC SHA2-384 implementation"), + AWSLC_PROV_ALG("SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3", sha512, + "AWS-LC SHA2-512 implementation"), + AWSLC_PROV_ALG( + "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5", + sha512_224, "AWS-LC SHA2-512/224 implementation"), + AWSLC_PROV_ALG( + "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6", + sha512_256, "AWS-LC SHA2-512/256 implementation"), {NULL, NULL, NULL, NULL}}; const OSSL_ALGORITHM *awslc_prov_query_operation(void *provctx, diff --git a/provider/internal/backend/digests.h b/provider/internal/backend/digests.h index 81132d58ce..254b3464f3 100644 --- a/provider/internal/backend/digests.h +++ b/provider/internal/backend/digests.h @@ -44,6 +44,10 @@ extern "C" { // SHA-2, from backend/operations/digests/sha2.c. AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha224); AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha256); +AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha384); +AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha512); +AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha512_224); +AWSLC_PROV_DECLARE_DIGEST_BACKEND(sha512_256); #if defined(__cplusplus) } // extern "C" diff --git a/provider/internal/frontend/digests.h b/provider/internal/frontend/digests.h index fb958096ed..40629f871a 100644 --- a/provider/internal/frontend/digests.h +++ b/provider/internal/frontend/digests.h @@ -66,6 +66,10 @@ int awslc_prov_digest_get_params(OSSL_PARAM params[], size_t block_size, // frontend/operations/digests/sha2.c AWSLC_PROV_DECLARE_DIGEST_TABLE(sha224); AWSLC_PROV_DECLARE_DIGEST_TABLE(sha256); +AWSLC_PROV_DECLARE_DIGEST_TABLE(sha384); +AWSLC_PROV_DECLARE_DIGEST_TABLE(sha512); +AWSLC_PROV_DECLARE_DIGEST_TABLE(sha512_224); +AWSLC_PROV_DECLARE_DIGEST_TABLE(sha512_256); #if defined(__cplusplus) } // extern "C" diff --git a/provider/test/backend/operations/digests/sha2_test.cc b/provider/test/backend/operations/digests/sha2_test.cc index 1f68d44cd3..fd0eb7aced 100644 --- a/provider/test/backend/operations/digests/sha2_test.cc +++ b/provider/test/backend/operations/digests/sha2_test.cc @@ -25,6 +25,30 @@ const std::vector kSha256Abc = { 0xde, 0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad}; +const std::vector kSha384Abc = { + 0xcb, 0x00, 0x75, 0x3f, 0x45, 0xa3, 0x5e, 0x8b, 0xb5, 0xa0, 0x3d, 0x69, + 0x9a, 0xc6, 0x50, 0x07, 0x27, 0x2c, 0x32, 0xab, 0x0e, 0xde, 0xd1, 0x63, + 0x1a, 0x8b, 0x60, 0x5a, 0x43, 0xff, 0x5b, 0xed, 0x80, 0x86, 0x07, 0x2b, + 0xa1, 0xe7, 0xcc, 0x23, 0x58, 0xba, 0xec, 0xa1, 0x34, 0xc8, 0x25, 0xa7}; + +const std::vector kSha512Abc = { + 0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, + 0x49, 0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, + 0x7e, 0xa2, 0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, + 0x92, 0x99, 0x2a, 0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, + 0xa3, 0xfe, 0xeb, 0xbd, 0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, + 0x0e, 0x2a, 0x9a, 0xc9, 0x4f, 0xa5, 0x4c, 0xa4, 0x9f}; + +const std::vector kSha512_224Abc = { + 0x46, 0x34, 0x27, 0x0f, 0x70, 0x7b, 0x6a, 0x54, 0xda, 0xae, + 0x75, 0x30, 0x46, 0x08, 0x42, 0xe2, 0x0e, 0x37, 0xed, 0x26, + 0x5c, 0xee, 0xe9, 0xa4, 0x3e, 0x89, 0x24, 0xaa}; + +const std::vector kSha512_256Abc = { + 0x53, 0x04, 0x8e, 0x26, 0x81, 0x94, 0x1e, 0xf9, 0x9b, 0x2e, 0x29, + 0xb7, 0x6b, 0x4c, 0x7d, 0xab, 0xe4, 0xc2, 0xd0, 0xc6, 0x34, 0xfc, + 0x6d, 0x46, 0xe0, 0xe2, 0xf1, 0x31, 0x07, 0xe7, 0xaf, 0x23}; + // One row per algorithm the back side wraps. struct BackendDigest { const char *name; @@ -43,6 +67,20 @@ const BackendDigest kBackendDigests[] = { {"SHA-256", awslc_prov_sha256_ctx_size, awslc_prov_sha256_digest_size, awslc_prov_sha256_init, awslc_prov_sha256_update, awslc_prov_sha256_final, &kSha256Abc}, + {"SHA-384", awslc_prov_sha384_ctx_size, awslc_prov_sha384_digest_size, + awslc_prov_sha384_init, awslc_prov_sha384_update, + awslc_prov_sha384_final, &kSha384Abc}, + {"SHA-512", awslc_prov_sha512_ctx_size, awslc_prov_sha512_digest_size, + awslc_prov_sha512_init, awslc_prov_sha512_update, + awslc_prov_sha512_final, &kSha512Abc}, + {"SHA-512/224", awslc_prov_sha512_224_ctx_size, + awslc_prov_sha512_224_digest_size, awslc_prov_sha512_224_init, + awslc_prov_sha512_224_update, awslc_prov_sha512_224_final, + &kSha512_224Abc}, + {"SHA-512/256", awslc_prov_sha512_256_ctx_size, + awslc_prov_sha512_256_digest_size, awslc_prov_sha512_256_init, + awslc_prov_sha512_256_update, awslc_prov_sha512_256_final, + &kSha512_256Abc}, }; class BackendDigestTest : public testing::TestWithParam {}; diff --git a/provider/test/frontend/operations/digests/sha2_test.cc b/provider/test/frontend/operations/digests/sha2_test.cc index 28e2443228..af6f7d0cc7 100644 --- a/provider/test/frontend/operations/digests/sha2_test.cc +++ b/provider/test/frontend/operations/digests/sha2_test.cc @@ -47,6 +47,42 @@ constexpr DigestSpec kDigests[] = { 1, "abc", "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"}, + {"SHA2-384", + {"SHA2-384", "SHA-384", "SHA384", "2.16.840.1.101.3.4.2.2"}, + 48, + 128, + 0, + 1, + "abc", + "cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed" + "8086072ba1e7cc2358baeca134c825a7"}, + {"SHA2-512", + {"SHA2-512", "SHA-512", "SHA512", "2.16.840.1.101.3.4.2.3"}, + 64, + 128, + 0, + 1, + "abc", + "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a" + "2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f"}, + {"SHA2-512/224", + {"SHA2-512/224", "SHA-512/224", "SHA512-224", + "2.16.840.1.101.3.4.2.5"}, + 28, + 128, + 0, + 1, + "abc", + "4634270f707b6a54daae7530460842e20e37ed265ceee9a43e8924aa"}, + {"SHA2-512/256", + {"SHA2-512/256", "SHA-512/256", "SHA512-256", + "2.16.840.1.101.3.4.2.6"}, + 32, + 128, + 0, + 1, + "abc", + "53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23"}, }; // Renders |len| bytes as lowercase hex so a failure names the actual digest rather From 6b75ea4043c10e6f45a2cf76dcf5fee9bc278471 Mon Sep 17 00:00:00 2001 From: Gerardo Ravago Date: Thu, 3 Sep 2026 13:40:01 -0400 Subject: [PATCH 2/4] Reject NULL arguments across the SHA-2 backend The back side is reachable by a consumer that calls a dispatch slot directly rather than through EVP, so it cannot rely on the front side having already screened its arguments. Guard every entry point instead of dereferencing whatever arrives. The out_size rationale moves to the file header rather than repeating per algorithm, and the registry rows all name the names.h macro they copy so a future row has a checkable source. --- provider/backend/operations/digests/sha2.c | 52 +++++++++++++++++++--- provider/frontend/registry.c | 4 ++ 2 files changed, 50 insertions(+), 6 deletions(-) diff --git a/provider/backend/operations/digests/sha2.c b/provider/backend/operations/digests/sha2.c index 57983a6658..134127ecff 100644 --- a/provider/backend/operations/digests/sha2.c +++ b/provider/backend/operations/digests/sha2.c @@ -90,20 +90,31 @@ size_t awslc_prov_sha384_digest_size(void) { return SHA384_DIGEST_LENGTH; } size_t awslc_prov_sha384_block_size(void) { return SHA384_CBLOCK; } -int awslc_prov_sha384_init(void *ctx) { return SHA384_Init((SHA512_CTX *)ctx); } +int awslc_prov_sha384_init(void *ctx) { + if (ctx == NULL) { + return 0; + } + return SHA384_Init((SHA512_CTX *)ctx); +} int awslc_prov_sha384_update(void *ctx, const void *data, size_t len) { + if (ctx == NULL || (data == NULL && len != 0)) { + return 0; + } return SHA384_Update((SHA512_CTX *)ctx, data, len); } int awslc_prov_sha384_final(void *ctx, unsigned char *out, size_t out_size) { - if (out_size < SHA384_DIGEST_LENGTH) { + if (ctx == NULL || out == NULL || out_size < SHA384_DIGEST_LENGTH) { return 0; } return SHA384_Final(out, (SHA512_CTX *)ctx); } void awslc_prov_sha384_copy(void *dst, const void *src) { + if (dst == NULL || src == NULL) { + return; + } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; } @@ -115,20 +126,31 @@ size_t awslc_prov_sha512_digest_size(void) { return SHA512_DIGEST_LENGTH; } size_t awslc_prov_sha512_block_size(void) { return SHA512_CBLOCK; } -int awslc_prov_sha512_init(void *ctx) { return SHA512_Init((SHA512_CTX *)ctx); } +int awslc_prov_sha512_init(void *ctx) { + if (ctx == NULL) { + return 0; + } + return SHA512_Init((SHA512_CTX *)ctx); +} int awslc_prov_sha512_update(void *ctx, const void *data, size_t len) { + if (ctx == NULL || (data == NULL && len != 0)) { + return 0; + } return SHA512_Update((SHA512_CTX *)ctx, data, len); } int awslc_prov_sha512_final(void *ctx, unsigned char *out, size_t out_size) { - if (out_size < SHA512_DIGEST_LENGTH) { + if (ctx == NULL || out == NULL || out_size < SHA512_DIGEST_LENGTH) { return 0; } return SHA512_Final(out, (SHA512_CTX *)ctx); } void awslc_prov_sha512_copy(void *dst, const void *src) { + if (dst == NULL || src == NULL) { + return; + } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; } @@ -143,22 +165,31 @@ size_t awslc_prov_sha512_224_digest_size(void) { size_t awslc_prov_sha512_224_block_size(void) { return SHA512_CBLOCK; } int awslc_prov_sha512_224_init(void *ctx) { + if (ctx == NULL) { + return 0; + } return SHA512_224_Init((SHA512_CTX *)ctx); } int awslc_prov_sha512_224_update(void *ctx, const void *data, size_t len) { + if (ctx == NULL || (data == NULL && len != 0)) { + return 0; + } return SHA512_224_Update((SHA512_CTX *)ctx, data, len); } int awslc_prov_sha512_224_final(void *ctx, unsigned char *out, size_t out_size) { - if (out_size < SHA512_224_DIGEST_LENGTH) { + if (ctx == NULL || out == NULL || out_size < SHA512_224_DIGEST_LENGTH) { return 0; } return SHA512_224_Final(out, (SHA512_CTX *)ctx); } void awslc_prov_sha512_224_copy(void *dst, const void *src) { + if (dst == NULL || src == NULL) { + return; + } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; } @@ -173,21 +204,30 @@ size_t awslc_prov_sha512_256_digest_size(void) { size_t awslc_prov_sha512_256_block_size(void) { return SHA512_CBLOCK; } int awslc_prov_sha512_256_init(void *ctx) { + if (ctx == NULL) { + return 0; + } return SHA512_256_Init((SHA512_CTX *)ctx); } int awslc_prov_sha512_256_update(void *ctx, const void *data, size_t len) { + if (ctx == NULL || (data == NULL && len != 0)) { + return 0; + } return SHA512_256_Update((SHA512_CTX *)ctx, data, len); } int awslc_prov_sha512_256_final(void *ctx, unsigned char *out, size_t out_size) { - if (out_size < SHA512_256_DIGEST_LENGTH) { + if (ctx == NULL || out == NULL || out_size < SHA512_256_DIGEST_LENGTH) { return 0; } return SHA512_256_Final(out, (SHA512_CTX *)ctx); } void awslc_prov_sha512_256_copy(void *dst, const void *src) { + if (dst == NULL || src == NULL) { + return; + } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; } diff --git a/provider/frontend/registry.c b/provider/frontend/registry.c index bd19ff18e3..c586ca36a6 100644 --- a/provider/frontend/registry.c +++ b/provider/frontend/registry.c @@ -29,13 +29,17 @@ static const OSSL_ALGORITHM awslc_prov_digests[] = { // PROV_NAMES_SHA2_256 AWSLC_PROV_ALG("SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1", sha256, "AWS-LC SHA2-256 implementation"), + // PROV_NAMES_SHA2_384 AWSLC_PROV_ALG("SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2", sha384, "AWS-LC SHA2-384 implementation"), + // PROV_NAMES_SHA2_512 AWSLC_PROV_ALG("SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3", sha512, "AWS-LC SHA2-512 implementation"), + // PROV_NAMES_SHA2_512_224 AWSLC_PROV_ALG( "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5", sha512_224, "AWS-LC SHA2-512/224 implementation"), + // PROV_NAMES_SHA2_512_256 AWSLC_PROV_ALG( "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6", sha512_256, "AWS-LC SHA2-512/256 implementation"), From 234584565c19d1d58a835f56e717e1eba13cfa15 Mon Sep 17 00:00:00 2001 From: Gerardo Ravago Date: Fri, 4 Sep 2026 14:12:42 -0400 Subject: [PATCH 3/4] inline new context function --- provider/frontend/operations/digests/sha2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/provider/frontend/operations/digests/sha2.c b/provider/frontend/operations/digests/sha2.c index 651529aa52..9c3fa3d956 100644 --- a/provider/frontend/operations/digests/sha2.c +++ b/provider/frontend/operations/digests/sha2.c @@ -199,7 +199,7 @@ AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha384); static void *awslc_prov_sha384_newctx(void *provctx) { (void)provctx; - return awslc_prov_sha2_newctx(awslc_prov_sha384_ctx_size()); + return awslc_prov_zalloc(awslc_prov_sha384_ctx_size()); } static void awslc_prov_sha384_freectx(void *dctx) { @@ -244,7 +244,7 @@ AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512); static void *awslc_prov_sha512_newctx(void *provctx) { (void)provctx; - return awslc_prov_sha2_newctx(awslc_prov_sha512_ctx_size()); + return awslc_prov_zalloc(awslc_prov_sha512_ctx_size()); } static void awslc_prov_sha512_freectx(void *dctx) { @@ -289,7 +289,7 @@ AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512_224); static void *awslc_prov_sha512_224_newctx(void *provctx) { (void)provctx; - return awslc_prov_sha2_newctx(awslc_prov_sha512_224_ctx_size()); + return awslc_prov_zalloc(awslc_prov_sha512_224_ctx_size()); } static void awslc_prov_sha512_224_freectx(void *dctx) { @@ -338,7 +338,7 @@ AWSLC_PROV_DECLARE_FIXED_DIGEST_SLOTS(sha512_256); static void *awslc_prov_sha512_256_newctx(void *provctx) { (void)provctx; - return awslc_prov_sha2_newctx(awslc_prov_sha512_256_ctx_size()); + return awslc_prov_zalloc(awslc_prov_sha512_256_ctx_size()); } static void awslc_prov_sha512_256_freectx(void *dctx) { From 62c3260dc3032391496092e1b6d034fcade85cc3 Mon Sep 17 00:00:00 2001 From: Gerardo Ravago Date: Fri, 4 Sep 2026 16:10:21 -0400 Subject: [PATCH 4/4] Return a result from the remaining SHA-2 copy functions The digests.h declaration macro gives every algorithm an int-returning copy, but SHA-384, SHA-512, SHA-512/224 and SHA-512/256 were still defined as void, so the branch did not compile. Match the declaration and report a rejected NULL the way the other two already do. --- provider/backend/operations/digests/sha2.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/provider/backend/operations/digests/sha2.c b/provider/backend/operations/digests/sha2.c index 134127ecff..334d0a19f3 100644 --- a/provider/backend/operations/digests/sha2.c +++ b/provider/backend/operations/digests/sha2.c @@ -111,11 +111,12 @@ int awslc_prov_sha384_final(void *ctx, unsigned char *out, size_t out_size) { return SHA384_Final(out, (SHA512_CTX *)ctx); } -void awslc_prov_sha384_copy(void *dst, const void *src) { +int awslc_prov_sha384_copy(void *dst, const void *src) { if (dst == NULL || src == NULL) { - return; + return 0; } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; + return 1; } // SHA-512 @@ -147,11 +148,12 @@ int awslc_prov_sha512_final(void *ctx, unsigned char *out, size_t out_size) { return SHA512_Final(out, (SHA512_CTX *)ctx); } -void awslc_prov_sha512_copy(void *dst, const void *src) { +int awslc_prov_sha512_copy(void *dst, const void *src) { if (dst == NULL || src == NULL) { - return; + return 0; } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; + return 1; } // SHA-512/224 @@ -186,11 +188,12 @@ int awslc_prov_sha512_224_final(void *ctx, unsigned char *out, return SHA512_224_Final(out, (SHA512_CTX *)ctx); } -void awslc_prov_sha512_224_copy(void *dst, const void *src) { +int awslc_prov_sha512_224_copy(void *dst, const void *src) { if (dst == NULL || src == NULL) { - return; + return 0; } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; + return 1; } // SHA-512/256 @@ -225,9 +228,10 @@ int awslc_prov_sha512_256_final(void *ctx, unsigned char *out, return SHA512_256_Final(out, (SHA512_CTX *)ctx); } -void awslc_prov_sha512_256_copy(void *dst, const void *src) { +int awslc_prov_sha512_256_copy(void *dst, const void *src) { if (dst == NULL || src == NULL) { - return; + return 0; } *(SHA512_CTX *)dst = *(const SHA512_CTX *)src; + return 1; }