wolfCrypt JNI/JCE hardening fixes

examples/provider/CryptoBenchmark.sh

@@ -20,8 +20,9 @@ verify_sha256() {
   elif command -v shasum >/dev/null; then
     actual=$(shasum -a 256 "$file" | awk '{print $1}')
   else
-    echo "Warning: no sha256sum or shasum available, skipping hash verification"
-    return 0
+    echo "Error: no sha256sum or shasum found, refusing unverified $file"
+    rm -f "$file"
+    return 1
   fi
 
   if [ "$actual" != "$expected" ]; then
@@ -40,6 +41,13 @@ download_bc_jars() {
   local lib_dir="$LIB_DIR"
   local bc_url="https://repo1.maven.org/maven2/org/bouncycastle"
 
+  # Require a SHA-256 tool before any download, JARs are only added to the
+  # classpath after hash verification
+  if ! command -v sha256sum >/dev/null && ! command -v shasum >/dev/null; then
+    echo "failed (no sha256sum or shasum for hash verification)"
+    return 1
+  fi
+
   echo -n "Downloading Bouncy Castle JARs (version $bc_version)... "
   mkdir -p "$lib_dir" || {
     echo "failed (cannot create $lib_dir)"

jni/jni_aes.c

@@ -71,6 +71,7 @@ Java_com_wolfssl_wolfcrypt_Aes_native_1set_1key_1internal(
     byte* key = NULL;
     byte* iv  = NULL;
     word32 keySz = 0;
+    word32 ivSz = 0;
 
     aes = (Aes*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -81,10 +82,15 @@ Java_com_wolfssl_wolfcrypt_Aes_native_1set_1key_1internal(
     key = getByteArray(env, key_object);
     iv  = getByteArray(env, iv_object);
     keySz = getByteArrayLength(env, key_object);
+    ivSz = getByteArrayLength(env, iv_object);
 
-    ret = (!aes || !key) /* iv is optional */
-        ? BAD_FUNC_ARG
-        : wc_AesSetKey(aes, key, keySz, iv, opmode);
+    /* IV optional. If provided, reject under/oversized array. */
+    if (!aes || !key || (iv != NULL && ivSz != AES_BLOCK_SIZE)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        ret = wc_AesSetKey(aes, key, keySz, iv, opmode);
+    }
 
     if (ret != 0)
         throwWolfCryptExceptionFromError(env, ret);

jni/jni_aesctr.c

@@ -70,6 +70,7 @@ Java_com_wolfssl_wolfcrypt_AesCtr_native_1set_1key_1internal(
     byte* key = NULL;
     byte* iv  = NULL;
     word32 keySz = 0;
+    word32 ivSz = 0;
 
     aes = (Aes*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -80,8 +81,10 @@ Java_com_wolfssl_wolfcrypt_AesCtr_native_1set_1key_1internal(
     key = getByteArray(env, key_object);
     iv  = getByteArray(env, iv_object);
     keySz = getByteArrayLength(env, key_object);
+    ivSz = getByteArrayLength(env, iv_object);
 
-    if (aes == NULL || key == NULL || iv == NULL) {
+    /* wc_AesSetKey reads AES_BLOCK_SIZE IV bytes, reject a short array */
+    if (aes == NULL || key == NULL || iv == NULL || ivSz != AES_BLOCK_SIZE) {
         ret = BAD_FUNC_ARG;
     }
 

jni/jni_aesofb.c

@@ -71,6 +71,7 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1set_1key_1internal(
     byte* key = NULL;
     byte* iv  = NULL;
     word32 keySz = 0;
+    word32 ivSz = 0;
 
     aes = (Aes*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -81,8 +82,10 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1set_1key_1internal(
     key = getByteArray(env, key_object);
     iv  = getByteArray(env, iv_object);
     keySz = getByteArrayLength(env, key_object);
+    ivSz = getByteArrayLength(env, iv_object);
 
-    if (aes == NULL || key == NULL || iv == NULL) {
+    /* wc_AesSetKey reads AES_BLOCK_SIZE IV bytes, reject a short array */
+    if (aes == NULL || key == NULL || iv == NULL || ivSz != AES_BLOCK_SIZE) {
         ret = BAD_FUNC_ARG;
     }
 

jni/jni_chacha.c

@@ -72,15 +72,17 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Chacha_wc_1Chacha_1setIV
     int ret = 0;
     ChaCha* chacha = NULL;
     byte* iv   = NULL;
+    word32 ivSz = 0;
 
     chacha = (ChaCha*)(uintptr_t)getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         /* getNativeStruct may throw exception, prevent throwing another */
         return;
     }
     iv = getByteArray(env, iv_object);
+    ivSz = getByteArrayLength(env, iv_object);
 
-    if (chacha == NULL || iv == NULL) {
+    if (chacha == NULL || iv == NULL || ivSz != CHACHA_IV_BYTES) {
         ret = BAD_FUNC_ARG;
     }
 
@@ -107,13 +109,16 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Chacha_wc_1Chacha_1setKey
     ChaCha* chacha = NULL;
     byte* key   = NULL;
     word32 keySz = 0;
+    jboolean keyIsCopy = JNI_FALSE;
 
     chacha = (ChaCha*)(uintptr_t)getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         /* getNativeStruct may throw exception, prevent throwing another */
         return;
     }
-    key   = getByteArray(env, key_object);
+    if (key_object != NULL) {
+        key = (byte*)(*env)->GetByteArrayElements(env, key_object, &keyIsCopy);
+    }
     keySz = getByteArrayLength(env, key_object);
 
     if (chacha == NULL || key == NULL) {
@@ -129,6 +134,14 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Chacha_wc_1Chacha_1setKey
 
     LogStr("wc_Chacha_SetKey(chacha=%p) = %d\n", chacha, ret);
 
+    if (key != NULL && keyIsCopy == JNI_TRUE) {
+    #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
+        !defined(WOLFSSL_NO_FORCE_ZERO)
+        wc_ForceZero(key, keySz);
+    #else
+        XMEMSET(key, 0, keySz);
+    #endif
+    }
     releaseByteArray(env, key_object, key, JNI_ABORT);
 #else
     throwNotCompiledInException(env);

jni/jni_des3.c

@@ -69,6 +69,8 @@ Java_com_wolfssl_wolfcrypt_Des3_native_1set_1key_1internal(
     Des3* des = NULL;
     byte* key = NULL;
     byte* iv  = NULL;
+    word32 keySz = 0;
+    word32 ivSz = 0;
 
     des = (Des3*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -78,10 +80,16 @@ Java_com_wolfssl_wolfcrypt_Des3_native_1set_1key_1internal(
 
     key = getByteArray(env, key_object);
     iv  = getByteArray(env, iv_object);
+    keySz = getByteArrayLength(env, key_object);
+    ivSz = getByteArrayLength(env, iv_object);
 
-    ret = (!des || !key) /* iv is optional */
-        ? BAD_FUNC_ARG
-        : wc_Des3_SetKey(des, key, iv, opmode);
+    if (!des || !key || keySz != DES3_KEY_SIZE ||
+        (iv != NULL && ivSz != DES_BLOCK_SIZE)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        ret = wc_Des3_SetKey(des, key, iv, opmode);
+    }
 
     if (ret != 0)
         throwWolfCryptExceptionFromError(env, ret);

jni/jni_mldsa.c

@@ -767,13 +767,16 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1import_1p
     wc_MlDsaKey* key = NULL;
     byte* in = NULL;
     word32 inLen = 0;
+    jboolean inIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         return;
     }
 
-    in = getByteArray(env, in_object);
+    if (in_object != NULL) {
+        in = (byte*)(*env)->GetByteArrayElements(env, in_object, &inIsCopy);
+    }
     inLen = getByteArrayLength(env, in_object);
 
     if (key == NULL || in == NULL) {
@@ -789,6 +792,9 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1import_1p
 
     LogStr("wc_MlDsaKey_ImportPrivRaw(key=%p) = %d\n", key, ret);
 
+    if (in != NULL && inIsCopy == JNI_TRUE) {
+        MLDSA_FORCE_ZERO(in, inLen);
+    }
     releaseByteArray(env, in_object, in, JNI_ABORT);
 #else
     (void)env;
@@ -1132,13 +1138,17 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1make_1key
     wc_MlDsaKey* key = NULL;
     byte* seed = NULL;
     word32 seedLen = 0;
+    jboolean seedIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         return;
     }
 
-    seed = getByteArray(env, seed_object);
+    if (seed_object != NULL) {
+        seed = (byte*)(*env)->GetByteArrayElements(env, seed_object,
+            &seedIsCopy);
+    }
     seedLen = getByteArrayLength(env, seed_object);
 
     /* Native API takes no seed length, seed must be exactly 32 bytes */
@@ -1158,6 +1168,9 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1make_1key
 
     LogStr("wc_MlDsaKey_MakeKeyFromSeed(key=%p) = %d\n", key, ret);
 
+    if (seed != NULL && seedIsCopy == JNI_TRUE) {
+        MLDSA_FORCE_ZERO(seed, seedLen);
+    }
     releaseByteArray(env, seed_object, seed, JNI_ABORT);
 #else
     (void)env;
@@ -1305,6 +1318,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
     word32 msgLen = 0;
     word32 seedLen = 0;
     word32 sigLen = 0;
+    jboolean seedIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -1328,7 +1342,8 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
     }
 
     if (seed_object != NULL) {
-        seed = getByteArray(env, seed_object);
+        seed = (byte*)(*env)->GetByteArrayElements(env, seed_object,
+            &seedIsCopy);
         seedLen = getByteArrayLength(env, seed_object);
     }
 
@@ -1345,6 +1360,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
             releaseByteArray(env, msg_object, msg, JNI_ABORT);
         }
         if (seed != NULL) {
+            if (seedIsCopy == JNI_TRUE) {
+                MLDSA_FORCE_ZERO(seed, seedLen);
+            }
             releaseByteArray(env, seed_object, seed, JNI_ABORT);
         }
         return NULL;
@@ -1409,6 +1427,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
         releaseByteArray(env, msg_object, msg, JNI_ABORT);
     }
     if (seed_object != NULL) {
+        if (seed != NULL && seedIsCopy == JNI_TRUE) {
+            MLDSA_FORCE_ZERO(seed, seedLen);
+        }
         releaseByteArray(env, seed_object, seed, JNI_ABORT);
     }
 #else
@@ -1439,6 +1460,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
     word32 hashLen = 0;
     word32 seedLen = 0;
     word32 sigLen = 0;
+    jboolean seedIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -1462,7 +1484,8 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
     }
 
     if (seed_object != NULL) {
-        seed = getByteArray(env, seed_object);
+        seed = (byte*)(*env)->GetByteArrayElements(env, seed_object,
+            &seedIsCopy);
         seedLen = getByteArrayLength(env, seed_object);
     }
 
@@ -1479,6 +1502,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
             releaseByteArray(env, hash_object, hash, JNI_ABORT);
         }
         if (seed != NULL) {
+            if (seedIsCopy == JNI_TRUE) {
+                MLDSA_FORCE_ZERO(seed, seedLen);
+            }
             releaseByteArray(env, seed_object, seed, JNI_ABORT);
         }
         return NULL;
@@ -1543,6 +1569,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1sig
         releaseByteArray(env, hash_object, hash, JNI_ABORT);
     }
     if (seed_object != NULL) {
+        if (seed != NULL && seedIsCopy == JNI_TRUE) {
+            MLDSA_FORCE_ZERO(seed, seedLen);
+        }
         releaseByteArray(env, seed_object, seed, JNI_ABORT);
     }
 #else
@@ -1673,6 +1702,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1MlDsaKey_1Sign
     word32 muLen = 0;
     word32 seedLen = 0;
     word32 sigLen = 0;
+    jboolean seedIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -1690,7 +1720,8 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1MlDsaKey_1Sign
     }
 
     if (seed_object != NULL) {
-        seed = getByteArray(env, seed_object);
+        seed = (byte*)(*env)->GetByteArrayElements(env, seed_object,
+            &seedIsCopy);
         seedLen = getByteArrayLength(env, seed_object);
     }
 
@@ -1703,6 +1734,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1MlDsaKey_1Sign
             releaseByteArray(env, mu_object, mu, JNI_ABORT);
         }
         if (seed != NULL) {
+            if (seedIsCopy == JNI_TRUE) {
+                MLDSA_FORCE_ZERO(seed, seedLen);
+            }
             releaseByteArray(env, seed_object, seed, JNI_ABORT);
         }
         return NULL;
@@ -1758,6 +1792,9 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1MlDsaKey_1Sign
         releaseByteArray(env, mu_object, mu, JNI_ABORT);
     }
     if (seed_object != NULL) {
+        if (seed != NULL && seedIsCopy == JNI_TRUE) {
+            MLDSA_FORCE_ZERO(seed, seedLen);
+        }
         releaseByteArray(env, seed_object, seed, JNI_ABORT);
     }
 #else
@@ -1859,13 +1896,17 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1import_1k
     byte* pub = NULL;
     word32 privLen = 0;
     word32 pubLen = 0;
+    jboolean privIsCopy = JNI_FALSE;
 
     key = (wc_MlDsaKey*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         return;
     }
 
-    priv = getByteArray(env, priv_object);
+    if (priv_object != NULL) {
+        priv = (byte*)(*env)->GetByteArrayElements(env, priv_object,
+            &privIsCopy);
+    }
     privLen = getByteArrayLength(env, priv_object);
     pub = getByteArray(env, pub_object);
     pubLen = getByteArrayLength(env, pub_object);
@@ -1883,6 +1924,9 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_MlDsa_wc_1dilithium_1import_1k
 
     LogStr("wc_MlDsaKey_ImportKey(key=%p) = %d\n", key, ret);
 
+    if (priv != NULL && privIsCopy == JNI_TRUE) {
+        MLDSA_FORCE_ZERO(priv, privLen);
+    }
     releaseByteArray(env, priv_object, priv, JNI_ABORT);
     releaseByteArray(env, pub_object, pub, JNI_ABORT);
 #else