[kareem-wolfssl]

Description

Fixes zd#22471, F-11837

Thanks to Eva Crystal (0xiviel), XSource Security for the ECDSA report!

Testing

Built in/added tests, provided reproducer

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

The ECDSA validation compares curve sizes rather than exact curve identities, allowing same-sized mismatched curves.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Strengthens TLS 1.3 validation for ECDSA signature schemes and Maximum Fragment Length responses.

Changes:

• Validates peer ECDSA certificate curves during CertificateVerify.
• Enforces TLS 1.3 MFL validation despite legacy extension handling.
• Adds regression tests for both behaviors.

File summaries

File	Description
wolfssl/internal.h	Exposes the ECC strength comparison helper.
src/internal.c	Makes the ECC helper externally accessible.
src/tls13.c	Adds ECDSA curve validation.
src/tls.c	Enforces TLS 1.3 MFL response checks.
tests/api/test_tls13.c	Tests ECDSA scheme/curve mismatches.
tests/api/test_tls13.h	Registers the new TLS 1.3 test.
tests/api/test_tls_parse.c	Tests TLS 1.3 MFL validation.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4-dtls13

• FLASH: .rodata +16 B, .text +256 B (+0.1%, 196,520 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +16 B, .text +128 B (+0.0%, 802,036 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +8 B, .text +256 B (+0.1%, 313,368 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 343,824 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +192 B (+0.1%, 250,094 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +8 B, .text +192 B (+0.1%, 314,200 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +192 B (+0.1%, 250,094 B / 262,144 B, total: 95% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +20 B, text +10,016 B (+3.6%, 292,508 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[0xiviel]

Re-ran the F03 checks at f4010ce, built from base 3babd37 plus the three PR commits, --enable-all --enable-dual-alg-certs, clang -O1.

• The attack case closes in both directions: a P-256 leaf announcing ecdsa_secp521r1_sha512 completed the handshake against an unpatched verifier (peer key 256 bits) and now fails SIG_VERIFY_E, both with the client verifying and with the server verifying in mutual TLS.
• Honest pairs still complete: P-256/SHA256, P-384/SHA384, P-521/SHA512. Controls unchanged: an unmodified sender still declines those pairings itself, and a wrong trust anchor still fails.
• --api on the PR base and on this head: zero failures either side, one added test.
• Preprocessor only, not run as handshakes: the SM2 site, since sm3.h needs wolfsm, and the alt-signature site, which needs a dual-algorithm certificate.
• Brainpool is now separated from the equal-size secp curves. secp256k1 keeps passing under ecdsa_secp256r1_sha256, which your comment covers.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11494

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 3 of 6 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_tls13.c, tests/api/test_tls_parse.c, wolfssl/internal.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot review overview

🟡 Changes recommended

The ECDSA validation compares curve sizes rather than exact curve identifiers, leaving same-sized curves such as secp256k1 incorrectly accepted.

Review effort: Balanced
Findings: 2

Open (2)

• Bind TLS 1.3 signature schemes to exact certificate curves · New
• This does not actually bind the signature scheme to its named curve: CmpEccStrength() compares…

[Frauschi]

The hybrid BOTH-mode regression needs fixing before this goes in. secp256k1 still gets through for the same reason the brainpool check was added, so it makes sense to close it here as well, on both the receive and the send side.

[Frauschi]

LGTM

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11494

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_tls13.h, tests/test-ecc-cust-curves.conf
Coverage: 9 of 9 in-scope changed file(s) opened by the reviewer

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[wolfSSL-Fenrir-bot]

ALTERNATIVE CKS signing path not bound to the alt ECC key's curve; new receiver check rejects it · Cryptographic correctness

The sender-side curve binding only checks the native key. In ALTERNATIVE mode, SendTls13CertificateVerify signs with the alt ECC key but uses the hash options.hashAlgo picked for the native key. Example: an RSA native key with a P-256 alt key under WOLFSSL_STRONGEST_HASH_SIG sends ecdsa_secp521r1_sha512. The new DoTls13CertificateVerify check rejects that, so these handshakes now fail.

Suggested fix: In the ALTERNATIVE branch, take the ECDSA hash from the alt key's curve (P-256/384/521 → SHA-256/384/512) and fail if the peer did not offer that scheme.
Basis: RFC 8446 §4.2.3: each ecdsa_secpXXXr1_shaYYY scheme fixes both the curve and the hash; §4.4.3: the CertificateVerify algorithm MUST be one offered in signature_algorithms.

[wolfSSL-Fenrir-bot]

New alt-key ECDSA curve rejection in BOTH mode has no test · Missing edge-case coverage on a function the PR also changed

No test reaches this rejection branch. test_dual_alg_both_ecdsa_mldsa only covers hybrids where the native key is ECC. It never uses an ML-DSA- or Falcon-native cert whose alt ECC key is on the wrong curve (e.g. MLDSA_44_P256 with a P-384 alt key). On that failure path peerAuthGood also stays 1 from the native verify.

Suggested fix: Add a BOTH-mode test with an ML-DSA-native cert and a P-384 alt key that asserts SIG_VERIFY_E on the client and checks the resulting peerAuthGood state.

Related known findings (similar but distinct; listed for context, not part of this finding)

• F-7651 (open): File/function: both are in DoTls13CertificateVerify and concern the WOLFSSL_DUAL_ALG_CERTS CKS-BOTH path. Operation: F-7651 is the BOTH branch skipping the advertised-scheme check and accepting an unadvertised composite. The candidate is that the new EccPeerCurveMatchesSigAlgo rejection for the alt ECC key has no test, and it also notes that peerAuthGood stays set. Root cause: F-7651 is a missing validation, while this is missing test coverage of a newly added check. Patch: F-7651 needs a validatio