Fix NS350 RSA-4096 Failures#494
Merged
dgarske merged 6 commits intowolfSSL:masterfrom Apr 27, 2026
Merged
Conversation
The RSA encrypt/decrypt test with TPM_ALG_NULL padding hardcoded message.size = 256, which is only valid for 2048-bit RSA keys. With TPM_ALG_NULL padding the TPM returns a full modulus-sized plaintext on decrypt, so with a 4096-bit key the 256-byte message never equals the 512-byte plaintext and the test reports TPM_RC_TESTING. Derive the message size from the key's own keyBits so the test passes for any modulus size. Reported against wolfTPM 4.0.0 on Nations NS350 hardware (NSING).
MAX_PKCS7_SIZE aliased to MAX_CONTEXT_SIZE (2 KB), which is enough for an RSA-2048 signed blob but overflows at RSA-4096 where the signature alone is 512 B plus a ~1-1.5 KB cert and ASN.1 overhead. wc_PKCS7_EncodeSignedData then returned BUFFER_E (0xffffff7c). Gate on MAX_RSA_KEY_BITS so 2048-bit builds keep the exact same buffer size; 4096-bit builds (Nations NS350, Infineon SLB967x, or anyone overriding) get 4 KB.
nvram/read hardcoded the RSA SRK, so an ECC child key retrieved from NV would be loaded under the RSA parent and fail with TPM_RC_INTEGRITY. Switch the SRK selection to mirror the approach already used in keygen/keyload: inspect keyBlob.pub.publicArea.type and load the matching RSA or ECC SRK.
keyload defaulted srkAlg = TPM_ALG_ECC and only switched to RSA for TPM_ALG_RSA keys. A sealed KEYEDHASH blob (produced by examples/seal, which always uses the RSA SRK) therefore tried to load under the ECC SRK and failed with TPM_RC_INTEGRITY. SYMCIPHER blobs had the same issue. Invert the default to RSA (matching seal.c) and only switch to the ECC SRK when the stored key itself is ECC.
keygen defaulted srkAlg = TPM_ALG_ECC and only switched to RSA for RSA keys, so SYMCIPHER and KEYEDHASH blobs were created under the ECC SRK. After the prior keyload fix made keyload default to RSA (matching seal.c), a sym/keyedhash blob produced by keygen could not round-trip through keyload without a parent mismatch. Invert the default to RSA (matching seal.c and keyload.c) and only switch to the ECC SRK when the stored key itself is ECC. Keeps all three tools aligned so any blob round-trips without callers having to specify a parent.
MAX_PEM_SIZE aliased to MAX_CONTEXT_SIZE (2 KB), which is enough for an RSA-2048 self-signed cert but overflows at RSA-4096 where the signature alone is 512 B plus the cert body, ASN.1, and base64 overhead. wc_MakeCertReq / wc_MakeSelfSignedCert then returned BUFFER_E (0xffffff7c / 0xffffff53). Gate on MAX_RSA_KEY_BITS so 2048-bit builds keep the exact same buffer size; 4096-bit builds (Nations NS350, Infineon SLB967x, or anyone overriding) get 4 KB. Mirrors the fix already applied to examples/pkcs7/pkcs7.c.
There was a problem hiding this comment.
Pull request overview
Updates host-side example code to run cleanly on Nations NS350 with RSA-4096 builds by removing RSA-2048 assumptions, sizing buffers appropriately, and aligning SRK selection with stored key types / device transient limits.
Changes:
- Make RSA “no padding” encrypt/decrypt tests use modulus-sized plaintext buffers.
- Increase PKCS7/CSR output buffer sizing when
MAX_RSA_KEY_BITSis 4096. - Improve example robustness by selecting SRK algorithm based on key type and freeing a transient object slot earlier in
native_test.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| examples/wrap/wrap_test.c | Sizes RSA NULL-pad message to modulus length to support RSA-4096 decrypt behavior. |
| examples/pkcs7/pkcs7.c | Increases MAX_PKCS7_SIZE for RSA-4096 builds to prevent buffer overflow. |
| examples/nvram/read.c | Chooses SRK algorithm based on stored key type (RSA vs ECC) before loading. |
| examples/native/native_test.c | Flushes EK earlier to fit within small TPM transient object limits. |
| examples/keygen/keyload.c | Defaults SRK to RSA and only switches to ECC SRK for ECC child keys. |
| examples/keygen/keygen.c | Aligns SRK default/selection logic with keyload for consistent round-trips. |
| examples/csr/csr.c | Increases MAX_PEM_SIZE for RSA-4096 builds to prevent buffer overflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
aidangarske
force-pushed
the
fix-nations-ns350-failures
branch
from
88c40e5 to
26090da
Compare
aidangarske
force-pushed
the
fix-nations-ns350-failures
branch
from
26090da to
ebb98f1
Compare
dgarske
approved these changes
Apr 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix four host-side example failures against wolfTPM
4.0.0 on Nations NS350 with a 4096-bit RSA build, plus three same-class
issues uncovered while verifying the full example suite at RSA-4096.
No
src/orwolftpm/changesFixes
TPM_RC_TESTING (0x90a): message size hardcoded to256 bytes. Derive from
keyBits/8so RSA-4096 works. (6942a8e)BUFFER_E (0xffffff7c):MAX_PKCS7_SIZEwas 2 KB, toosmall for an RSA-4096 signed blob. Gate on
MAX_RSA_KEY_BITSso2048-bit builds are byte-identical. (90846ba)
TPM_RC_INTEGRITY: hardcoded RSA SRK failedto load an ECC child. Pick SRK from
keyBlob.pub.publicArea.type.(eea8741)
TPM_RC_INTEGRITY:seal.cusesRSA SRK but
keyloaddefaulted to ECC for KEYEDHASH blobs. Defaultkeyloadto RSA; switch to ECC only when the child is ECC. (34108a8)keyload/sealsoSYMCIPHER/KEYEDHASH blobs round-trip consistently. (52cdcdc)
MAX_PEM_SIZE; sameMAX_RSA_KEY_BITSgate. (ebb98f1)CreateLoadedso the testfits within NS350's 2-transient-object limit at RSA-4096. No-op on
TPMs with spare object memory. (88c40e5)