Skip to content

Commit 8c7a972

Browse files
authored
Merge pull request #211 from cconlon/v1.10
Prep for 1.10 release
2 parents 9515b27 + 4a0a1ed commit 8c7a972

8 files changed

Lines changed: 276 additions & 75 deletions

File tree

ChangeLog.md

Lines changed: 79 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,78 @@
1+
### wolfCrypt JNI Release 1.10.0 (04/15/2026)
2+
3+
Release 1.10.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
4+
5+
**New JCE Functionality:**
6+
- Add Cipher `RSA/ECB/OAEPWithSHA-256AndMGF1Padding` support (PR 188)
7+
- Add Cipher `RSA/ECB/OAEPWithSHA-1AndMGF1Padding` support (PR 191)
8+
- Add Cipher `WRAP_MODE` and `UNWRAP_MODE` support for RSA-based key wrapping (PR 197)
9+
- Add PKIX CertPathBuilder implementation using native wolfSSL `X509_STORE` (PR 190, 192, 198, 200)
10+
- Add `jdk.certpath.disabledAlgorithms` enforcement to CertPathBuilder and CertPathValidator (PR 200)
11+
- Register default FIPS error callback in `WolfCryptProvider` for FIPS error debugging (PR 207)
12+
- Enrich `WolfCryptException` with FIPS module status for `FIPS_NOT_ALLOWED_E` errors (PR 207)
13+
14+
**New JNI Functionality:**
15+
- Add hex string conversion via `WolfCrypt.toHexString()` and `WolfCrypt.hexStringToByteArray()` (PR 187)
16+
- Add PEM to DER conversion support for keys and certificates (PR 186)
17+
- Add `setFlags()` and `setVerificationTime()` methods to `WolfSSLX509StoreCtx` (PR 192)
18+
19+
**New Property Support:**
20+
- Add `wolfssl.skipLibraryLoad` system property for custom native library loading (PR 189)
21+
- Add `wolfjce.ioTimeout` system property for OCSP/CRL IO timeouts (PR 199)
22+
23+
**JNI and JCE Changes:**
24+
- Fix FIPS error callback lifecycle, deregister native callback in `JNI_OnUnload` (PR 203)
25+
- Fix Ed25519 signature verification passing message length instead of signature length (PR 205)
26+
- Fix `jlong` to `word32` pointer cast in `RsaFlattenPublicKey` and `RsaExportCrtKey` (PR 205)
27+
- Fix unsigned return value handling for `wc_RsaEncryptSize()` across RSA functions (PR 205, 206)
28+
- Add HMAC offset/length bounds validation for byte array and ByteBuffer variants (PR 205)
29+
- Improve NULL check handling in HMAC, Ed25519, Curve25519, and Pwdbased JNI wrappers (PR 205)
30+
- Add missing `releaseByteArray()` calls across ECC, RSA, ChaCha, and AES-GCM JNI functions (PR 205, 206)
31+
- Fix incorrect error code in `HmacFinal` hash size check (PR 205)
32+
- Return defensive copy of IV array from `engineGetIV()` (PR 205)
33+
- Fix `wc_ecc_import_private_raw()` not passing validated `curveId` to underlying import function (PR 206)
34+
- Zeroize encoded key byte array in `WolfCryptPBEKey.destroy()` (PR 206)
35+
- Use constant-time comparison for GMAC tag verification (PR 206)
36+
- Add missing AES-CTR and AES-OFB cleanup in `WolfCryptCipher.finalize()` (PR 206)
37+
- Fix signed integer overflow in JNI offset/length bounds checks (PR 206)
38+
- Add ByteBuffer bounds validation in SHA, MD5, and RNG native functions (PR 206)
39+
- Fix missing return after throw in SHA and MD5 copy NULL checks (PR 206)
40+
- Remove unused `wc_RsaPSS_VerifyInline` JNI wrapper that skipped padding check (PR 206)
41+
- Reduce `WC_RNG` struct allocations in `WolfCryptCipher` and `WolfCryptDhParameterGenerator` (PR 208)
42+
- Expand FIPS-compliant SecureRandom sanitization in `WolfCryptKeyGenerator` (PR 209)
43+
- Zero intermediate output buffers before free across JNI wrappers (PR 210)
44+
- Fix DH key export return value reset in success paths (PR 210)
45+
- Free internal AES struct in GMAC after use (PR 210)
46+
47+
**Example Changes:**
48+
- Add `CertPathBuilder` and `CertPathValidator` example (PR 190)
49+
- Update Android example project CMakeLists.txt file exclusion list (PR 198, 206)
50+
- Add JKS to BKS KeyStore conversion script for Android testing (PR 209)
51+
- Migrate Android example project from `jcenter()` to `mavenCentral()` and AndroidX (PR 209)
52+
- Add Gradle wrapper `distributionSha256Sum` to Android example project (PR 210)
53+
54+
**Testing Changes:**
55+
- Add Java 24 and 25 tests to GitHub Actions workflows (PR 193)
56+
- Add GitHub Actions workflow for Linux 32-bit testing with Java 17 (PR 194)
57+
- Add GitHub Actions workflow for UBSan undefined behavior testing (PR 195)
58+
- Add `ant spotbugs` target and GitHub Actions SpotBugs static analysis workflow (PR 204)
59+
- Add GitHub Actions workflow for Android FIPS Ready testing (PR 209)
60+
- Add GitHub Actions workflow for Java 9+ module (JPMS) testing (PR 196)
61+
- Fix threaded MessageDigest tests hanging on FIPS error (PR 207)
62+
- Improve JUnit test reliability for FIPS mode and CI environments (PR 209)
63+
- Pin Bouncy Castle dependency version with SHA-256 hash verification (PR 209)
64+
- Update Apache Ant CI dependency to 1.10.16 (PR 209)
65+
66+
**Misc Changes:**
67+
- Add Java 9+ module support (JPMS) for `jlink` compatibility (PR 196)
68+
- Fix Javadoc warnings about default constructors in `WolfCryptUtil` and `Asn` (PR 201)
69+
- Fix code issues and warnings found by SpotBugs static analysis (PR 204)
70+
- Update copyright dates to 2026 (PR 185)
71+
72+
The wolfCrypt JNI/JCE Manual is available at:
73+
https://www.wolfssl.com/documentation/manuals/wolfcryptjni/. For build
74+
instructions and more details, please check the manual.
75+
176
### wolfCrypt JNI Release 1.9.0 (12/31/2025)
277

378
Release 1.9.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
@@ -107,7 +182,7 @@ Release 1.9.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
107182

108183
The wolfCrypt JNI/JCE Manual is available at:
109184
https://www.wolfssl.com/documentation/manuals/wolfcryptjni/. For build
110-
instructions and more details comments, please check the manual.
185+
instructions and more details, please check the manual.
111186

112187
### wolfCrypt JNI Release 1.8.0 (01/23/2025)
113188

@@ -128,7 +203,7 @@ Release 1.8.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
128203

129204
The wolfCrypt JNI/JCE Manual is available at:
130205
https://www.wolfssl.com/documentation/manuals/wolfcryptjni/. For build
131-
instructions and more details comments, please check the manual.
206+
instructions and more details, please check the manual.
132207

133208
### wolfCrypt JNI Release 1.7.0 (11/11/2024)
134209

@@ -152,7 +227,7 @@ Release 1.7.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
152227

153228
The wolfCrypt JNI/JCE Manual is available at:
154229
https://www.wolfssl.com/documentation/manuals/wolfcryptjni/. For build
155-
instructions and more details comments, please check the manual.
230+
instructions and more details, please check the manual.
156231

157232
### wolfCrypt JNI Release 1.6.0 (4/17/2024)
158233

@@ -208,7 +283,7 @@ Release 1.6.0 of wolfCrypt JNI and JCE has bug fixes and new features including:
208283

209284
The wolfCrypt JNI/JCE Manual is available at:
210285
https://www.wolfssl.com/documentation/manuals/wolfcryptjni/. For build
211-
instructions and more details comments, please check the manual.
286+
instructions and more details, please check the manual.
212287

213288
### wolfCrypt JNI Release 1.5.0 (11/14/2022)
214289

IDE/WIN/README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,12 @@ section titled `/* Configuration */`:
138138
#define WOLFSSL_KEY_GEN
139139
#define HAVE_CRL
140140
#define OPENSSL_ALL
141+
#define WOLFSSL_SHA224
142+
#define HAVE_FFDHE_2048
143+
#define HAVE_FFDHE_3072
144+
#define HAVE_FFDHE_4096
145+
#define HAVE_FFDHE_Q
146+
#define WOLFSSL_VALIDATE_FFC_IMPORT
141147
#define WOLFSSL_PUBLIC_MP
142148
```
143149

@@ -210,6 +216,7 @@ and set the values for `HAVE_FIPS`, `HAVE_FIPS_VERSION`, and
210216
#define WOLFSSL_KEY_GEN
211217
#define HAVE_CRL
212218
#define OPENSSL_ALL
219+
#define HAVE_FFDHE_2048
213220
```
214221

215222
If also building wolfSSL JNI/JSSE, additional defines may be needed. Please

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,7 @@ on the current release):
217217
<dependency>
218218
<groupId>com.wolfssl</groupId>
219219
<artifactId>wolfcrypt-jni</artifactId>
220-
<version>1.9.0-SNAPSHOT</version>
220+
<version>1.10.0-SNAPSHOT</version>
221221
</dependency>
222222
</dependencies>
223223
...

build.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
<!-- versioning/manifest properties -->
2020
<property name="implementation.vendor" value="wolfSSL Inc." />
2121
<property name="implementation.title" value="wolfCrypt JNI" />
22-
<property name="implementation.version" value="1.9" />
22+
<property name="implementation.version" value="1.10" />
2323

2424
<!-- set properties for this build -->
2525
<property name="src.dir" value="src/main/java/" />

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<modelVersion>4.0.0</modelVersion>
55
<groupId>com.wolfssl</groupId>
66
<artifactId>wolfcrypt-jni</artifactId>
7-
<version>1.9.0-SNAPSHOT</version>
7+
<version>1.10.0-SNAPSHOT</version>
88
<packaging>jar</packaging>
99
<name>wolfcrypt-jni</name>
1010
<url>https://www.wolfssl.com</url>

src/main/java/com/wolfssl/provider/jce/WolfCryptProvider.java

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public void errorCallback(int ok, int err, String hash) {
8585
* Create new WolfCryptProvider object
8686
*/
8787
public WolfCryptProvider() {
88-
super("wolfJCE", 1.9, "wolfCrypt JCE Provider");
88+
super("wolfJCE", 1.10, "wolfCrypt JCE Provider");
8989

9090
/* Refresh debug flags in case system properties were set after
9191
* WolfCryptDebug class was first loaded (e.g., via JAVA_OPTS) */
@@ -198,9 +198,16 @@ private void registerServices() {
198198
if (FeatureDetect.ShaEnabled()) {
199199
put("Signature.SHA1withRSA",
200200
"com.wolfssl.provider.jce.WolfCryptSignature$wcSHA1wRSA");
201-
put("Signature.SHA1withECDSA",
201+
202+
/* FIPS 186-5 (wolfCrypt FIPS v7+) no longer allows SHA-1 for
203+
* ECDSA signatures. Only register SHA1withECDSA when not using
204+
* FIPS, or when using FIPS versions prior to v7 which follow
205+
* FIPS 186-4. */
206+
if (!Fips.enabled || Fips.fipsVersion < 7) {
207+
put("Signature.SHA1withECDSA",
202208
"com.wolfssl.provider.jce.WolfCryptSignature$wcSHA1wECDSA");
203-
put("Alg.Alias.Signature.1.2.840.10045.4.1", "SHA1withECDSA");
209+
put("Alg.Alias.Signature.1.2.840.10045.4.1", "SHA1withECDSA");
210+
}
204211
}
205212
if (FeatureDetect.Sha224Enabled()) {
206213
put("Signature.SHA224withRSA",

src/main/java/com/wolfssl/wolfcrypt/WolfCryptError.java

Lines changed: 144 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,18 @@ public enum WolfCryptError {
3333

3434
/* error codes match <wolfssl>/wolfssl/wolfcrypt/error-crypt.h */
3535

36-
/** errors -101 - -299 */
37-
MAX_CODE_E (-100),
36+
/** errors -97 - -1008 */
37+
MAX_CODE_E (-96),
38+
39+
/** MP dynamic memory allocation failed */
40+
MP_MEM (-97),
41+
/** MP value passed is not able to be used */
42+
MP_VAL (-98),
43+
/** MP non-blocking returning after partial completion */
44+
MP_WOULDBLOCK (-99),
45+
/** MP point not at infinity */
46+
MP_NOT_INF (-100),
47+
3848
/** opening random device error */
3949
OPEN_RAN_E (-101),
4050
/** reading random device error */
@@ -79,10 +89,21 @@ public enum WolfCryptError {
7989
/** got a mp zero result, not expected */
8090
MP_ZERO_E (-121),
8191

92+
/** AES-EAX Authentication check failure */
93+
AES_EAX_AUTH_E (-122),
94+
/** No longer usable for operation */
95+
KEY_EXHAUSTED_E (-123),
96+
8297
/** out of memory error */
8398
MEMORY_E (-125),
8499
/** var state modified by different thread */
85100
VAR_STATE_CHANGE_E (-126),
101+
/** FIPS Module in degraded mode */
102+
FIPS_DEGRADED_E (-127),
103+
/** Module CODE too big */
104+
FIPS_CODE_SZ_E (-128),
105+
/** Module DATA too big */
106+
FIPS_DATA_SZ_E (-129),
86107

87108
/** RSA wrong block type for RSA function */
88109
RSA_WRONG_TYPE_E (-130),
@@ -143,14 +164,22 @@ public enum WolfCryptError {
143164
ASN_SIG_KEY_E (-157),
144165
/** ASN key init error, invalid input */
145166
ASN_DH_KEY_E (-158),
146-
/** ASN ntru key decode error, invalid input */
147-
ASN_NTRU_KEY_E (-159),
167+
/** SRTP-KDF Known Answer Test Failure */
168+
KDF_SRTP_KAT_FIPS_E (-159),
148169
/** ASN unsupported critical extension */
149170
ASN_CRIT_EXT_E (-160),
150171
/** ASN alternate name error */
151172
ASN_ALT_NAME_E (-161),
152173
/** ASN no PEM header found */
153174
ASN_NO_PEM_HEADER (-162),
175+
/** Ed25519 Known answer test failure */
176+
ED25519_KAT_FIPS_E (-163),
177+
/** Ed448 Known answer test failure */
178+
ED448_KAT_FIPS_E (-164),
179+
/** PBKDF2 Known answer test failure */
180+
PBKDF2_KAT_FIPS_E (-165),
181+
/** Error for private/public key mismatch */
182+
WC_KEY_MISMATCH_E (-166),
154183

155184
/** ECC input argument of wrong type */
156185
ECC_BAD_ARG_E (-170),
@@ -170,6 +199,8 @@ public enum WolfCryptError {
170199
ALT_NAME_E (-177),
171200
/** missing key usage extension */
172201
BAD_OCSP_RESPONDER (-178),
202+
/** CRL date error */
203+
CRL_CERT_DATE_ERR (-179),
173204

174205
/** AES-GCM Authentication check failure */
175206
AES_GCM_AUTH_E (-180),
@@ -290,6 +321,9 @@ public enum WolfCryptError {
290321
/** Hash Type not enabled/available */
291322
HASH_TYPE_E (-232),
292323

324+
/** Invalid FIPS Version defined */
325+
FIPS_INVALID_VER_E (-233),
326+
293327
/** Key size error, either too small or large */
294328
WC_KEY_SIZE_E (-234),
295329
/** ASN Cert Gen, invalid country code size */
@@ -340,15 +374,117 @@ public enum WolfCryptError {
340374
ECDSA_PAT_FIPS_E (-255),
341375
/** DH KAT failure */
342376
DH_KAT_FIPS_E (-256),
343-
377+
/** AESCCM KAT failure */
378+
AESCCM_KAT_FIPS_E (-257),
379+
/** SHA-3 KAT failure */
380+
SHA3_KAT_FIPS_E (-258),
381+
/** ECDHE KAT failure */
382+
ECDHE_KAT_FIPS_E (-259),
383+
/** AES-GCM invocation counter overflow */
384+
AES_GCM_OVERFLOW_E (-260),
385+
/** AES-CCM invocation counter overflow */
386+
AES_CCM_OVERFLOW_E (-261),
387+
/** RSA Key Pair-Wise Consistency check fail */
388+
RSA_KEY_PAIR_E (-262),
389+
/** DH Check Priv Key error */
390+
DH_CHECK_PRIV_E (-263),
391+
/** AF_ALG socket error */
392+
WC_AFALG_SOCK_E (-264),
393+
/** /dev/crypto error */
394+
WC_DEVCRYPTO_E (-265),
395+
/** zlib init error */
396+
ZLIB_INIT_ERROR (-266),
397+
/** zlib compression error */
398+
ZLIB_COMPRESS_ERROR (-267),
399+
/** zlib decompression error */
400+
ZLIB_DECOMPRESS_ERROR (-268),
401+
/** No signer in PKCS#7 signed data msg */
402+
PKCS7_NO_SIGNER_E (-269),
403+
/** PKCS7 operations wants more input */
404+
WC_PKCS7_WANT_READ_E (-270),
405+
/** Crypto callback unavailable */
406+
CRYPTOCB_UNAVAILABLE (-271),
407+
/** Signature needs verified by caller */
408+
PKCS7_SIGNEEDS_CHECK (-272),
409+
/** PSS salt length not recoverable */
410+
PSS_SALTLEN_RECOVER_E (-273),
411+
/** ChaCha20Poly1305 limit overflow */
412+
CHACHA_POLY_OVERFLOW (-274),
413+
/** ASN self-signed certificate error */
414+
ASN_SELF_SIGNED_E (-275),
415+
/** SAKKE derivation verification error */
416+
SAKKE_VERIFY_FAIL_E (-276),
417+
/** IV was not set */
418+
MISSING_IV (-277),
419+
/** Key was not set */
420+
MISSING_KEY (-278),
421+
/** Value of length parameter is invalid */
422+
BAD_LENGTH_E (-279),
423+
/** ECDSA KAT failure */
424+
ECDSA_KAT_FIPS_E (-280),
425+
/** RSA Pairwise failure */
426+
RSA_PAT_FIPS_E (-281),
427+
/** TLS12 KDF KAT failure */
428+
KDF_TLS12_KAT_FIPS_E (-282),
429+
/** TLS13 KDF KAT failure */
430+
KDF_TLS13_KAT_FIPS_E (-283),
431+
/** SSH KDF KAT failure */
432+
KDF_SSH_KAT_FIPS_E (-284),
433+
/** DHE Pairwise Consistency Test failure */
434+
DHE_PCT_E (-285),
435+
/** ECDHE Pairwise Consistency Test failure */
436+
ECC_PCT_E (-286),
344437
/** Cannot export private key */
345438
FIPS_PRIVATE_KEY_LOCKED_E (-287),
439+
/** Protocol callback unavailable */
440+
PROTOCOLCB_UNAVAILABLE (-288),
441+
/** AES-SIV authentication failed */
442+
AES_SIV_AUTH_E (-289),
443+
/** No valid device ID */
444+
NO_VALID_DEVID (-290),
445+
/** Input/output failure */
446+
IO_FAILED_E (-291),
447+
/** System/library call failed */
448+
SYSLIB_FAILED_E (-292),
449+
/** Callback return to indicate HW has PSK */
450+
USE_HW_PSK (-293),
451+
/** Entropy Repetition Test failed */
452+
ENTROPY_RT_E (-294),
453+
/** Entropy Adaptive Proportion Test failed */
454+
ENTROPY_APT_E (-295),
455+
/** Invalid ASN.1 - depth check */
456+
ASN_DEPTH_E (-296),
457+
/** ASN.1 length invalid */
458+
ASN_LEN_E (-297),
459+
/** SM4-GCM Authentication check failure */
460+
SM4_GCM_AUTH_E (-298),
461+
/** SM4-CCM Authentication check failure */
462+
SM4_CCM_AUTH_E (-299),
463+
464+
/** Deadlock averted -- retry the call */
465+
DEADLOCK_AVERTED_E (-1000),
466+
/** ASCON Authentication check failure */
467+
ASCON_AUTH_E (-1001),
468+
/** Crypto acceleration is currently inhibited */
469+
WC_ACCEL_INHIBIT_E (-1002),
470+
/** Bad index */
471+
BAD_INDEX_E (-1003),
472+
/** Process interrupted */
473+
INTERRUPTED_E (-1004),
474+
/** Encoded public key does not match stored hash */
475+
MLKEM_PUB_HASH_E (-1005),
476+
/** Object is busy */
477+
BUSY_E (-1006),
478+
/** Operation was redundant or preempted */
479+
ALREADY_E (-1007),
480+
/** Sequence counter would overflow */
481+
SEQ_OVERFLOW_E (-1008),
346482

347483
/** Update this to indicate last error */
348-
WC_LAST_E (-299),
484+
WC_LAST_E (-1008),
349485

350-
/** errors -101 - -299 */
351-
MIN_CODE_E (-300),
486+
/** Last usable code */
487+
MIN_CODE_E (-1999),
352488

353489
/** OCSP Certificate revoked */
354490
OCSP_CERT_REVOKED (-360),

0 commit comments

Comments
 (0)