Skip to content

Honor WC_SIG_MIN_HASH_TYPE override in signature decision test #11026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dgarske merged 2 commits into from
Aug 3, 2026
+23 −16
Merged

Honor WC_SIG_MIN_HASH_TYPE override in signature decision test #11026

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79cbfce
Honor WC_SIG_MIN_HASH_TYPE override in signature decision test
kojo1 Jul 31, 2026
d065792
Move WC_SIG_MIN_HASH_TYPE default into signature.h
kojo1 Aug 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions tests/api/test_signature.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,13 @@
#include <tests/api/api.h>
#include <tests/api/test_signature.h>

/* Effective hash floor used by wc_SignatureVerify/Generate; mirrors the
* default in wolfcrypt/src/signature.c. A build may lower it (e.g.
* --enable-wolfclu defines WC_SIG_MIN_HASH_TYPE=WC_HASH_TYPE_MD5). */
#ifndef WC_SIG_MIN_HASH_TYPE
Comment thread
dgarske marked this conversation as resolved.
Outdated
#define WC_SIG_MIN_HASH_TYPE WC_HASH_TYPE_SHA256
#endif

/* Testing wc_SignatureGetSize() for signature type ECC */
int test_wc_SignatureGetSize_ecc(void)
{
Expand Down Expand Up @@ -337,10 +344,14 @@ int test_wc_SignatureDecisionCoverage(void)

#ifndef NO_SHA
/* Hash weaker than WC_SIG_MIN_HASH_TYPE (default SHA-256)
* rejected by wc_SignatureCheckHashStrength() */
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
* rejected by wc_SignatureCheckHashStrength(). Only assert
* when SHA-1 is below the effective floor of this build. */
if (wc_HashGetDigestSize(WC_SIG_MIN_HASH_TYPE) >
wc_HashGetDigestSize(WC_HASH_TYPE_SHA)) {
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
}
#endif

/* Real signature that fails verification: SIG_VERIFY_E.
Expand Down Expand Up @@ -518,8 +529,11 @@ int test_wc_SignatureDecisionCoverage(void)
}

#ifndef NO_SHA
/* Weak hash rejected before any hashing/signing occurs */
{
/* Weak hash rejected before any hashing/signing occurs. Only
* assert when SHA-1 is below the effective floor of this
* build. */
if (wc_HashGetDigestSize(WC_SIG_MIN_HASH_TYPE) >
wc_HashGetDigestSize(WC_HASH_TYPE_SHA)) {
word32 lenCopy = (word32)eccSigMax;
ExpectIntEQ(wc_SignatureGenerate(WC_HASH_TYPE_SHA, sig_type,
data, data_len, genSig, &lenCopy, &ecc, key_len, &rng),
Expand Down
Loading