Crypto layer: Add missing input validation

[lealem47]

Description

Adding miscellaneous input validation throughout wolfcrypt files.

Testing

./configure --enable-all && make check

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR hardens wolfCrypt/wolfSSL by adding additional input validation and tightening default Diffie–Hellman parameter minimums to align with modern security guidance (2048-bit minimum by default, overridable for legacy use).

Changes:

• Introduces DH_MIN_SIZE (default 2048 bits) and aligns TLS-layer DH minimums with the DH primitive’s minimum.
• Adds/adjusts input validation to prevent overflow/wraparound and invalid arguments in KDF/PRF, ECC key import, RSA key generation, and DH operations.
• Updates an existing DH test to be conditionally compiled based on DH_MIN_SIZE.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/settings.h	Defines DH_MIN_SIZE with a secure default and legacy override mapping.
wolfssl/version.h	Updates library version macros (currently inconsistent with rest of repo).
wolfssl/internal.h	Aligns WOLFSSL_MIN_DHKEY_BITS default with DH_MIN_SIZE and enforces consistency.
wolfcrypt/src/rsa.c	Fixes heap usage in an OAEP error path and tightens RSA exponent validation under FIPS.
wolfcrypt/src/kdf.c	Adds null/length argument validation and prevents word32 wraparound in length checks.
wolfcrypt/src/ecc.c	Prevents potential word32 overflow when expanding compressed ECC point lengths.
wolfcrypt/src/dh.c	Rejects DH primes smaller than DH_MIN_SIZE and adds a null check in wc_DhCheckPubValue.
tests/api/test_dh.c	Gates a subgroup-check test on DH_MIN_SIZE (affects coverage in default builds).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +468 B (+0.7%, 64,563 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m3

• FLASH: .text +404 B (+0.3%, 122,517 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +448 B (+0.2%, 200,204 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +448 B (+0.7%, 67,147 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +192 B (+0.1%, 174,506 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +384 B (+0.2%, 180,888 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +448 B (+0.7%, 62,125 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +128 B (+0.0%, 769,028 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +448 B (+0.2%, 212,525 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +384 B (+0.1%, 279,024 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +128 B (+0.0%, 324,304 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +448 B (+0.7%, 62,125 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +384 B (+0.3%, 123,277 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +384 B (+0.2%, 235,774 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .text +384 B (+0.2%, 200,140 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +384 B (+0.1%, 279,600 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +384 B (+0.2%, 235,838 B / 262,144 B, total: 90% used)
  No memory changes detected for:
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

[lealem47]

Jenkins Retest this please

[Frauschi]

@lealem47 PRB-master-job failures are legit.

[Frauschi]

Jenkins retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 2 total — 2 posted, 0 skipped

Posted findings

• [Low] FIPS RSA exponent floor reuses WC_RSA_EXPONENT default macro — wolfcrypt/src/rsa.c:5415-5419
• [Info] Non-conforming indentation in wc_PRF NULL-argument check — wolfcrypt/src/kdf.c:92-94

Review generated by Skoll via Claude/Codex

[Frauschi]

🔵 [Low] FIPS RSA exponent floor reuses WC_RSA_EXPONENT default macro
💡 SUGGEST question

The new FIPS branch rejects e < WC_RSA_EXPONENT. WC_RSA_EXPONENT is defined in wolfssl/wolfcrypt/rsa.h as the default public exponent (65537L) and is user-overridable via -DWC_RSA_EXPONENT. It defaults to the correct FIPS minimum (2^16+1), so in the common case this is right. But repurposing the "default exponent" macro as a "minimum allowed exponent" for FIPS couples two unrelated concepts: if a user overrides WC_RSA_EXPONENT to a smaller value (e.g. 3), the FIPS floor silently weakens below the FIPS-required 65537, and if they raise it, valid FIPS keys could be rejected. A hardcoded literal (65537L) or a dedicated WC_RSA_MIN_EXPONENT-style macro would express the FIPS constraint unambiguously.

Suggestion:

Suggested change

	#if defined(HAVE_FIPS)
	#if defined(HAVE_FIPS)
	if (e < 65537L || (e & 1) == 0) {
	#else
	if (e < 3 || (e & 1) == 0) {
	#endif

[Frauschi]

⚪ [Info] Non-conforming indentation in wc_PRF NULL-argument check
🔧 NIT style

The new NULL-check block uses 3-space continuation indentation and a 2-space indent on the return, unlike the 4-space style used consistently in the sibling checks added to wc_PRF_TLSv1 (lines 241-246) and wc_PRF_TLS (lines 305-310) in the same PR, and unlike the rest of the file. Aligning it keeps the newly added validation blocks uniform.

Suggestion:

Suggested change

	if ((result == NULL && resLen != 0) || (secret == NULL && secLen != 0) ||
	if ((result == NULL && resLen != 0) || (secret == NULL && secLen != 0) ||
	(seed == NULL && seedLen != 0)) {
	return BAD_FUNC_ARG;
	}