tests: derive the expected ECC rejection in the priv-only key test - #1187
Open
ejohnstown wants to merge 1 commit into
Open
tests: derive the expected ECC rejection in the priv-only key test#1187ejohnstown wants to merge 1 commit into
ejohnstown wants to merge 1 commit into
Conversation
wolfSSL master now rejects a private scalar outside [1, n-1] when importing one, so the zeroed key that test_IdentifyAsn1Key_EccPrivOnlyDerFailure builds fails in wc_EccPrivateKeyDecode instead of reaching the wc_ecc_make_pub fallback in IdentifyAsn1Key. The identify call then reports the key as unidentified, WS_UNIMPLEMENTED_E, rather than WS_CRYPTO_FAILED, and the test failed against any wolfSSL built from master. - decode the corrupted DER first and expect the rejection the linked wolfSSL performs, so the assertion stays strict on either library
ejohnstown
requested review from
wolfSSL-Fenrir-bot
and
a lite review from Copilot
August 20, 2026 22:50
wolfSSL-Fenrir-bot
approved these changes
Aug 20, 2026
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1187
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tests/unit.testfails against any wolfSSL built from master:wolfSSL master commit
8bffaff("Check ECC private key scalar range on import(F-1930, F-1931)", 2026-08-12) rejects a private scalar outside [1, n-1] at
import. The zeroed scalar that
test_IdentifyAsn1Key_EccPrivOnlyDerFailurebuilds now fails in
wc_EccPrivateKeyDecodewithECC_PRIV_KEY_Einstead ofdecoding and failing later in the
wc_ecc_make_pubfallback, soIdentifyAsn1Keynever setsnoPubKeyRetand returnsWS_UNIMPLEMENTED_Erather than the hard-coded
WS_CRYPTO_FAILEDthe test expected. The library isright either way -- the key is rejected -- only the stage differs.
The test now decodes the corrupted DER itself and expects whichever rejection
the linked wolfSSL performs, so the assertion stays strict on both released and
master wolfSSL and does not simply accept any error.
That commit is in no wolfSSL release, so this only shows up where wolfSSL comes
from master. Verified on x86_64 Linux against wolfSSL master
9ab8a4b--enable-all: the unpatched test reproduces the failure above, the patchedtest passes, and
make checkis 6 PASS / 2 SKIP / 0 FAIL. Also passes againstwolfSSL 5.9.2
--enable-allon macOS/arm64, Linux/arm64 and Linux/x86_64.