luna - wolfssl/src/keys.c

   1/* keys.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22
  23/* Name change compatibility layer no longer needs to be included here */
  24
  25#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
  26
  27#if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
  28
  29#include <wolfssl/internal.h>
  30#include <wolfssl/error-ssl.h>
  31#if defined(SHOW_SECRETS) || defined(CHACHA_AEAD_TEST)
  32    #ifndef NO_STDIO_FILESYSTEM
  33        #include <stdio.h>
  34    #endif
  35#endif
  36#ifdef NO_INLINE
  37    #include <wolfssl/wolfcrypt/misc.h>
  38#else
  39    #define WOLFSSL_MISC_INCLUDED
  40    #include <wolfcrypt/src/misc.c>
  41#endif
  42
  43#if defined(WOLFSSL_RENESAS_FSPSM_TLS) || defined(WOLFSSL_RENESAS_TSIP_TLS)
  44#include <wolfssl/wolfcrypt/port/Renesas/renesas_cmn.h>
  45#endif
  46
  47int SetCipherSpecs(WOLFSSL* ssl)
  48{
  49    int ret = GetCipherSpec(ssl->options.side, ssl->options.cipherSuite0,
  50                                ssl->options.cipherSuite, &ssl->specs,
  51                                &ssl->options);
  52    if (ret == 0) {
  53    #ifdef WOLFSSL_ALLOW_SSLV3
  54         /* SSLv3 (RFC 6101) defines MAC algorithms as MD5 and SHA-1. SHA-256
  55          * was introduced in TLS 1.2 (RFC 5246). SSL_hmac for old SSLv3
  56          * connections can not handle newer cipher suites that use digest sizes
  57          * larger than SHA-1 */
  58        if (ssl->version.major == SSLv3_MAJOR &&
  59                    ssl->version.minor == SSLv3_MINOR &&
  60                    ssl->specs.hash_size > WC_SHA_DIGEST_SIZE) {
  61                WOLFSSL_MSG("SSLv3 does not support SHA-256 or higher MAC");
  62                WOLFSSL_ERROR_VERBOSE(UNSUPPORTED_SUITE);
  63                return UNSUPPORTED_SUITE;
  64        }
  65    #endif /* WOLFSSL_ALLOW_SSLV3 */
  66
  67        /* set TLS if it hasn't been turned off */
  68        if (ssl->version.major == SSLv3_MAJOR &&
  69                ssl->version.minor >= TLSv1_MINOR) {
  70    #ifndef NO_TLS
  71            ssl->options.tls = 1;
  72        #if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_AEAD_ONLY)
  73            #if !defined(WOLFSSL_RENESAS_FSPSM_TLS) && \
  74                !defined(WOLFSSL_RENESAS_TSIP_TLS)
  75            ssl->hmac = TLS_hmac;
  76            #else
  77            ssl->hmac = Renesas_cmn_TLS_hmac;
  78            #endif
  79        #endif
  80            if (ssl->version.minor >= TLSv1_1_MINOR) {
  81                ssl->options.tls1_1 = 1;
  82                if (ssl->version.minor >= TLSv1_3_MINOR)
  83                    ssl->options.tls1_3 = 1;
  84            }
  85    #endif
  86        }
  87
  88    #if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
  89        if (IsAtLeastTLSv1_3(ssl->version) || ssl->specs.cipher_type != block)
  90           ssl->options.encThenMac = 0;
  91    #endif
  92
  93    #if defined(WOLFSSL_DTLS)
  94        if (ssl->options.dtls && ssl->version.major == DTLS_MAJOR) {
  95        #ifndef WOLFSSL_AEAD_ONLY
  96            #if !defined(WOLFSSL_RENESAS_FSPSM_TLS) && \
  97                !defined(WOLFSSL_RENESAS_TSIP_TLS)
  98            ssl->hmac = TLS_hmac;
  99            #else
 100            ssl->hmac = Renesas_cmn_TLS_hmac;
 101            #endif
 102        #endif
 103            ssl->options.tls = 1;
 104            ssl->options.tls1_1 = 1; /* DTLS 1.0 == TLS 1.1 */
 105        #ifdef WOLFSSL_DTLS13
 106            if (ssl->version.minor <= DTLSv1_3_MINOR)
 107                ssl->options.tls1_3 = 1;
 108        #endif
 109        }
 110    #endif
 111    }
 112    return ret;
 113}
 114
 115/**
 116 * Populate specs with the specification of the chosen ciphersuite. If opts is
 117 * not NULL then the appropriate options will also be set.
 118 *
 119 * @param side         [in] WOLFSSL_SERVER_END or WOLFSSL_CLIENT_END
 120 * @param cipherSuite0 [in]
 121 * @param cipherSuite  [in]
 122 * @param specs        [out] CipherSpecs
 123 * @param opts         [in/out] Options can be NULL
 124 * @return int (less than 0 on fail, 0 on success)
 125 */
 126int GetCipherSpec(word16 side, byte cipherSuite0, byte cipherSuite,
 127                      CipherSpecs* specs, Options* opts)
 128{
 129    word16 havePSK = 0;
 130    (void)havePSK;
 131    (void)side;
 132#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
 133    if (opts != NULL)
 134        havePSK = opts->havePSK;
 135#endif
 136#ifndef NO_WOLFSSL_CLIENT
 137    if (side == WOLFSSL_CLIENT_END) {
 138        /* server side verified before SetCipherSpecs call */
 139        if (VerifyClientSuite(havePSK, cipherSuite0, cipherSuite) != 1) {
 140            WOLFSSL_MSG("SetCipherSpecs() client has an unusable suite");
 141            WOLFSSL_ERROR_VERBOSE(UNSUPPORTED_SUITE);
 142            return UNSUPPORTED_SUITE;
 143        }
 144    }
 145#endif /* NO_WOLFSSL_CLIENT */
 146
 147    /* Initialize specs */
 148    XMEMSET(specs, 0, sizeof(CipherSpecs));
 149
 150    /* Chacha extensions, 0xcc */
 151    if (cipherSuite0 == CHACHA_BYTE) {
 152
 153    switch (cipherSuite) {
 154#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
 155    case TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256:
 156        specs->bulk_cipher_algorithm = wolfssl_chacha;
 157        specs->cipher_type           = aead;
 158        specs->mac_algorithm         = sha256_mac;
 159        specs->kea                   = ecc_diffie_hellman_kea;
 160        specs->sig_algo              = rsa_sa_algo;
 161        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 162        specs->pad_size              = PAD_SHA;
 163        specs->static_ecdh           = 0;
 164        specs->key_size              = CHACHA20_256_KEY_SIZE;
 165        specs->block_size            = CHACHA20_BLOCK_SIZE;
 166        specs->iv_size               = CHACHA20_IV_SIZE;
 167        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 168        if (opts != NULL)
 169            opts->oldPoly            = 1; /* use old poly1305 padding */
 170
 171        break;
 172#endif
 173
 174#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256
 175    case TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256:
 176        specs->bulk_cipher_algorithm = wolfssl_chacha;
 177        specs->cipher_type           = aead;
 178        specs->mac_algorithm         = sha256_mac;
 179        specs->kea                   = ecc_diffie_hellman_kea;
 180        specs->sig_algo              = ecc_dsa_sa_algo;
 181        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 182        specs->pad_size              = PAD_SHA;
 183        specs->static_ecdh           = 0;
 184        specs->key_size              = CHACHA20_256_KEY_SIZE;
 185        specs->block_size            = CHACHA20_BLOCK_SIZE;
 186        specs->iv_size               = CHACHA20_IV_SIZE;
 187        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 188        if (opts != NULL)
 189            opts->oldPoly            = 1; /* use old poly1305 padding */
 190
 191        break;
 192#endif
 193
 194#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
 195    case TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256:
 196        specs->bulk_cipher_algorithm = wolfssl_chacha;
 197        specs->cipher_type           = aead;
 198        specs->mac_algorithm         = sha256_mac;
 199        specs->kea                   = diffie_hellman_kea;
 200        specs->sig_algo              = rsa_sa_algo;
 201        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 202        specs->pad_size              = PAD_SHA;
 203        specs->static_ecdh           = 0;
 204        specs->key_size              = CHACHA20_256_KEY_SIZE;
 205        specs->block_size            = CHACHA20_BLOCK_SIZE;
 206        specs->iv_size               = CHACHA20_IV_SIZE;
 207        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 208        if (opts != NULL)
 209            opts->oldPoly            = 1; /* use old poly1305 padding */
 210
 211        break;
 212#endif
 213#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 214    case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
 215        specs->bulk_cipher_algorithm = wolfssl_chacha;
 216        specs->cipher_type           = aead;
 217        specs->mac_algorithm         = sha256_mac;
 218        specs->kea                   = ecc_diffie_hellman_kea;
 219        specs->sig_algo              = rsa_sa_algo;
 220        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 221        specs->pad_size              = PAD_SHA;
 222        specs->static_ecdh           = 0;
 223        specs->key_size              = CHACHA20_256_KEY_SIZE;
 224        specs->block_size            = CHACHA20_BLOCK_SIZE;
 225        specs->iv_size               = CHACHA20_IV_SIZE;
 226        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 227        if (opts != NULL)
 228            opts->oldPoly            = 0; /* use recent padding RFC */
 229
 230        break;
 231#endif
 232
 233#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
 234    case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
 235        specs->bulk_cipher_algorithm = wolfssl_chacha;
 236        specs->cipher_type           = aead;
 237        specs->mac_algorithm         = sha256_mac;
 238        specs->kea                   = ecc_diffie_hellman_kea;
 239        specs->sig_algo              = ecc_dsa_sa_algo;
 240        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 241        specs->pad_size              = PAD_SHA;
 242        specs->static_ecdh           = 0;
 243        specs->key_size              = CHACHA20_256_KEY_SIZE;
 244        specs->block_size            = CHACHA20_BLOCK_SIZE;
 245        specs->iv_size               = CHACHA20_IV_SIZE;
 246        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 247        if (opts != NULL)
 248            opts->oldPoly            = 0; /* use recent padding RFC */
 249
 250        break;
 251#endif
 252
 253#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 254    case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
 255        specs->bulk_cipher_algorithm = wolfssl_chacha;
 256        specs->cipher_type           = aead;
 257        specs->mac_algorithm         = sha256_mac;
 258        specs->kea                   = diffie_hellman_kea;
 259        specs->sig_algo              = rsa_sa_algo;
 260        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 261        specs->pad_size              = PAD_SHA;
 262        specs->static_ecdh           = 0;
 263        specs->key_size              = CHACHA20_256_KEY_SIZE;
 264        specs->block_size            = CHACHA20_BLOCK_SIZE;
 265        specs->iv_size               = CHACHA20_IV_SIZE;
 266        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 267        if (opts != NULL)
 268            opts->oldPoly            = 0; /* use recent padding RFC */
 269
 270        break;
 271#endif
 272
 273#ifdef BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256
 274    case TLS_PSK_WITH_CHACHA20_POLY1305_SHA256:
 275        specs->bulk_cipher_algorithm = wolfssl_chacha;
 276        specs->cipher_type           = aead;
 277        specs->mac_algorithm         = sha256_mac;
 278        specs->kea                   = psk_kea;
 279        specs->sig_algo              = anonymous_sa_algo;
 280        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 281        specs->pad_size              = PAD_SHA;
 282        specs->static_ecdh           = 0;
 283        specs->key_size              = CHACHA20_256_KEY_SIZE;
 284        specs->block_size            = CHACHA20_BLOCK_SIZE;
 285        specs->iv_size               = CHACHA20_IV_SIZE;
 286        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 287
 288        if (opts != NULL) {
 289            opts->oldPoly            = 0; /* use recent padding RFC */
 290            opts->usingPSK_cipher    = 1;
 291        }
 292        break;
 293#endif
 294
 295#ifdef BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256
 296    case TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256:
 297        specs->bulk_cipher_algorithm = wolfssl_chacha;
 298        specs->cipher_type           = aead;
 299        specs->mac_algorithm         = sha256_mac;
 300        specs->kea                   = ecdhe_psk_kea;
 301        specs->sig_algo              = anonymous_sa_algo;
 302        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 303        specs->pad_size              = PAD_SHA;
 304        specs->static_ecdh           = 0;
 305        specs->key_size              = CHACHA20_256_KEY_SIZE;
 306        specs->block_size            = CHACHA20_BLOCK_SIZE;
 307        specs->iv_size               = CHACHA20_IV_SIZE;
 308        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 309
 310        if (opts != NULL) {
 311            opts->oldPoly            = 0; /* use recent padding RFC */
 312            opts->usingPSK_cipher    = 1;
 313        }
 314        break;
 315#endif
 316
 317#ifdef BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256
 318    case TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256:
 319        specs->bulk_cipher_algorithm = wolfssl_chacha;
 320        specs->cipher_type           = aead;
 321        specs->mac_algorithm         = sha256_mac;
 322        specs->kea                   = dhe_psk_kea;
 323        specs->sig_algo              = anonymous_sa_algo;
 324        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 325        specs->pad_size              = PAD_SHA;
 326        specs->static_ecdh           = 0;
 327        specs->key_size              = CHACHA20_256_KEY_SIZE;
 328        specs->block_size            = CHACHA20_BLOCK_SIZE;
 329        specs->iv_size               = CHACHA20_IV_SIZE;
 330        specs->aead_mac_size         = POLY1305_AUTH_SZ;
 331
 332        if (opts != NULL) {
 333            opts->oldPoly            = 0; /* use recent padding RFC */
 334            opts->usingPSK_cipher    = 1;
 335        }
 336        break;
 337#endif
 338    default:
 339        WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs ChaCha");
 340        return UNSUPPORTED_SUITE;
 341    }
 342    }
 343
 344    /* ECC extensions, AES-CCM or TLS 1.3 Integrity-only */
 345    if (cipherSuite0 == ECC_BYTE) {
 346
 347    switch (cipherSuite) {
 348
 349#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
 350
 351#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 352    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
 353        specs->bulk_cipher_algorithm = wolfssl_aes;
 354        specs->cipher_type           = block;
 355        specs->mac_algorithm         = sha256_mac;
 356        specs->kea                   = ecc_diffie_hellman_kea;
 357        specs->sig_algo              = rsa_sa_algo;
 358        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 359        specs->pad_size              = PAD_SHA;
 360        specs->static_ecdh           = 0;
 361        specs->key_size              = AES_128_KEY_SIZE;
 362        specs->iv_size               = AES_IV_SIZE;
 363        specs->block_size            = WC_AES_BLOCK_SIZE;
 364
 365        break;
 366#endif
 367
 368#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 369    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
 370        specs->bulk_cipher_algorithm = wolfssl_aes;
 371        specs->cipher_type           = block;
 372        specs->mac_algorithm         = sha384_mac;
 373        specs->kea                   = ecc_diffie_hellman_kea;
 374        specs->sig_algo              = rsa_sa_algo;
 375        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 376        specs->pad_size              = PAD_SHA;
 377        specs->static_ecdh           = 0;
 378        specs->key_size              = AES_256_KEY_SIZE;
 379        specs->iv_size               = AES_IV_SIZE;
 380        specs->block_size            = WC_AES_BLOCK_SIZE;
 381
 382        break;
 383#endif
 384
 385#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
 386    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA :
 387        specs->bulk_cipher_algorithm = wolfssl_aes;
 388        specs->cipher_type           = block;
 389        specs->mac_algorithm         = sha_mac;
 390        specs->kea                   = ecc_diffie_hellman_kea;
 391        specs->sig_algo              = rsa_sa_algo;
 392        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 393        specs->pad_size              = PAD_SHA;
 394        specs->static_ecdh           = 0;
 395        specs->key_size              = AES_128_KEY_SIZE;
 396        specs->block_size            = WC_AES_BLOCK_SIZE;
 397        specs->iv_size               = AES_IV_SIZE;
 398
 399        break;
 400#endif
 401
 402#ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
 403    case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA :
 404        specs->bulk_cipher_algorithm = wolfssl_triple_des;
 405        specs->cipher_type           = block;
 406        specs->mac_algorithm         = sha_mac;
 407        specs->kea                   = ecc_diffie_hellman_kea;
 408        specs->sig_algo              = rsa_sa_algo;
 409        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 410        specs->pad_size              = PAD_SHA;
 411        specs->static_ecdh           = 0;
 412        specs->key_size              = DES3_KEY_SIZE;
 413        specs->block_size            = DES_BLOCK_SIZE;
 414/* DES_IV_SIZE is incorrectly 16 in FIPS v2. It should be 8, same as the
 415 * block size. */
 416#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
 417        specs->iv_size               = DES_BLOCK_SIZE;
 418#else
 419        specs->iv_size               = DES_IV_SIZE;
 420#endif
 421
 422        break;
 423#endif
 424
 425#ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
 426    case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
 427        specs->bulk_cipher_algorithm = wolfssl_rc4;
 428        specs->cipher_type           = stream;
 429        specs->mac_algorithm         = sha_mac;
 430        specs->kea                   = ecc_diffie_hellman_kea;
 431        specs->sig_algo              = rsa_sa_algo;
 432        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 433        specs->pad_size              = PAD_SHA;
 434        specs->static_ecdh           = 0;
 435        specs->key_size              = RC4_KEY_SIZE;
 436        specs->iv_size               = 0;
 437        specs->block_size            = 0;
 438
 439        break;
 440#endif
 441
 442#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
 443    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA :
 444        specs->bulk_cipher_algorithm = wolfssl_aes;
 445        specs->cipher_type           = block;
 446        specs->mac_algorithm         = sha_mac;
 447        specs->kea                   = ecc_diffie_hellman_kea;
 448        specs->sig_algo              = rsa_sa_algo;
 449        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 450        specs->pad_size              = PAD_SHA;
 451        specs->static_ecdh           = 0;
 452        specs->key_size              = AES_256_KEY_SIZE;
 453        specs->block_size            = WC_AES_BLOCK_SIZE;
 454        specs->iv_size               = AES_IV_SIZE;
 455
 456        break;
 457#endif
 458
 459#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 460    case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 :
 461        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 462        specs->cipher_type           = aead;
 463        specs->mac_algorithm         = sha256_mac;
 464        specs->kea                   = ecc_diffie_hellman_kea;
 465        specs->sig_algo              = rsa_sa_algo;
 466        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 467        specs->pad_size              = PAD_SHA;
 468        specs->static_ecdh           = 0;
 469        specs->key_size              = AES_128_KEY_SIZE;
 470        specs->block_size            = WC_AES_BLOCK_SIZE;
 471        specs->iv_size               = AESGCM_IMP_IV_SZ;
 472        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 473
 474        break;
 475#endif
 476
 477#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 478    case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 :
 479        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 480        specs->cipher_type           = aead;
 481        specs->mac_algorithm         = sha384_mac;
 482        specs->kea                   = ecc_diffie_hellman_kea;
 483        specs->sig_algo              = rsa_sa_algo;
 484        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 485        specs->pad_size              = PAD_SHA;
 486        specs->static_ecdh           = 0;
 487        specs->key_size              = AES_256_KEY_SIZE;
 488        specs->block_size            = WC_AES_BLOCK_SIZE;
 489        specs->iv_size               = AESGCM_IMP_IV_SZ;
 490        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 491
 492        break;
 493#endif
 494
 495#ifdef BUILD_TLS_ECDHE_PSK_WITH_NULL_SHA256
 496    case TLS_ECDHE_PSK_WITH_NULL_SHA256 :
 497        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
 498        specs->cipher_type           = stream;
 499        specs->mac_algorithm         = sha256_mac;
 500        specs->kea                   = ecdhe_psk_kea;
 501        specs->sig_algo              = anonymous_sa_algo;
 502        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 503        specs->pad_size              = PAD_SHA;
 504        specs->static_ecdh           = 0;
 505        specs->key_size              = 0;
 506        specs->block_size            = 0;
 507        specs->iv_size               = 0;
 508
 509        if (opts != NULL)
 510            opts->usingPSK_cipher    = 1;
 511        break;
 512#endif
 513
 514#ifdef BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
 515    case TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 :
 516        specs->bulk_cipher_algorithm = wolfssl_aes;
 517        specs->cipher_type           = block;
 518        specs->mac_algorithm         = sha256_mac;
 519        specs->kea                   = ecdhe_psk_kea;
 520        specs->sig_algo              = anonymous_sa_algo;
 521        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 522        specs->pad_size              = PAD_SHA;
 523        specs->static_ecdh           = 0;
 524        specs->key_size              = AES_128_KEY_SIZE;
 525        specs->block_size            = WC_AES_BLOCK_SIZE;
 526        specs->iv_size               = AES_IV_SIZE;
 527
 528        if (opts != NULL)
 529            opts->usingPSK_cipher    = 1;
 530        break;
 531#endif
 532
 533#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
 534
 535#if defined(HAVE_ECC) || (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) \
 536                      || (defined(HAVE_CURVE448) && defined(HAVE_ED448))
 537
 538#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 539    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
 540        specs->bulk_cipher_algorithm = wolfssl_aes;
 541        specs->cipher_type           = block;
 542        specs->mac_algorithm         = sha256_mac;
 543        specs->kea                   = ecc_diffie_hellman_kea;
 544        specs->sig_algo              = ecc_dsa_sa_algo;
 545        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 546        specs->pad_size              = PAD_SHA;
 547        specs->static_ecdh           = 0;
 548        specs->key_size              = AES_128_KEY_SIZE;
 549        specs->iv_size               = AES_IV_SIZE;
 550        specs->block_size            = WC_AES_BLOCK_SIZE;
 551
 552        break;
 553#endif
 554
 555#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 556    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
 557        specs->bulk_cipher_algorithm = wolfssl_aes;
 558        specs->cipher_type           = block;
 559        specs->mac_algorithm         = sha384_mac;
 560        specs->kea                   = ecc_diffie_hellman_kea;
 561        specs->sig_algo              = ecc_dsa_sa_algo;
 562        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 563        specs->pad_size              = PAD_SHA;
 564        specs->static_ecdh           = 0;
 565        specs->key_size              = AES_256_KEY_SIZE;
 566        specs->iv_size               = AES_IV_SIZE;
 567        specs->block_size            = WC_AES_BLOCK_SIZE;
 568
 569        break;
 570#endif
 571
 572#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
 573    case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA :
 574        specs->bulk_cipher_algorithm = wolfssl_triple_des;
 575        specs->cipher_type           = block;
 576        specs->mac_algorithm         = sha_mac;
 577        specs->kea                   = ecc_diffie_hellman_kea;
 578        specs->sig_algo              = ecc_dsa_sa_algo;
 579        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 580        specs->pad_size              = PAD_SHA;
 581        specs->static_ecdh           = 0;
 582        specs->key_size              = DES3_KEY_SIZE;
 583        specs->block_size            = DES_BLOCK_SIZE;
 584#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
 585        specs->iv_size               = DES_BLOCK_SIZE;
 586#else
 587        specs->iv_size               = DES_IV_SIZE;
 588#endif
 589
 590        break;
 591#endif
 592
 593#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
 594    case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
 595        specs->bulk_cipher_algorithm = wolfssl_rc4;
 596        specs->cipher_type           = stream;
 597        specs->mac_algorithm         = sha_mac;
 598        specs->kea                   = ecc_diffie_hellman_kea;
 599        specs->sig_algo              = ecc_dsa_sa_algo;
 600        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 601        specs->pad_size              = PAD_SHA;
 602        specs->static_ecdh           = 0;
 603        specs->key_size              = RC4_KEY_SIZE;
 604        specs->iv_size               = 0;
 605        specs->block_size            = 0;
 606
 607        break;
 608#endif
 609
 610#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 611    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA :
 612        specs->bulk_cipher_algorithm = wolfssl_aes;
 613        specs->cipher_type           = block;
 614        specs->mac_algorithm         = sha_mac;
 615        specs->kea                   = ecc_diffie_hellman_kea;
 616        specs->sig_algo              = ecc_dsa_sa_algo;
 617        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 618        specs->pad_size              = PAD_SHA;
 619        specs->static_ecdh           = 0;
 620        specs->key_size              = AES_128_KEY_SIZE;
 621        specs->block_size            = WC_AES_BLOCK_SIZE;
 622        specs->iv_size               = AES_IV_SIZE;
 623
 624        break;
 625#endif
 626
 627#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
 628    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA :
 629        specs->bulk_cipher_algorithm = wolfssl_aes;
 630        specs->cipher_type           = block;
 631        specs->mac_algorithm         = sha_mac;
 632        specs->kea                   = ecc_diffie_hellman_kea;
 633        specs->sig_algo              = ecc_dsa_sa_algo;
 634        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 635        specs->pad_size              = PAD_SHA;
 636        specs->static_ecdh           = 0;
 637        specs->key_size              = AES_256_KEY_SIZE;
 638        specs->block_size            = WC_AES_BLOCK_SIZE;
 639        specs->iv_size               = AES_IV_SIZE;
 640
 641        break;
 642#endif
 643
 644#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 645    case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 :
 646        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 647        specs->cipher_type           = aead;
 648        specs->mac_algorithm         = sha256_mac;
 649        specs->kea                   = ecc_diffie_hellman_kea;
 650        specs->sig_algo              = ecc_dsa_sa_algo;
 651        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 652        specs->pad_size              = PAD_SHA;
 653        specs->static_ecdh           = 0;
 654        specs->key_size              = AES_128_KEY_SIZE;
 655        specs->block_size            = WC_AES_BLOCK_SIZE;
 656        specs->iv_size               = AESGCM_IMP_IV_SZ;
 657        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 658
 659        break;
 660#endif
 661
 662#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 663    case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 :
 664        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 665        specs->cipher_type           = aead;
 666        specs->mac_algorithm         = sha384_mac;
 667        specs->kea                   = ecc_diffie_hellman_kea;
 668        specs->sig_algo              = ecc_dsa_sa_algo;
 669        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 670        specs->pad_size              = PAD_SHA;
 671        specs->static_ecdh           = 0;
 672        specs->key_size              = AES_256_KEY_SIZE;
 673        specs->block_size            = WC_AES_BLOCK_SIZE;
 674        specs->iv_size               = AESGCM_IMP_IV_SZ;
 675        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 676
 677        break;
 678#endif
 679
 680#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM
 681    case TLS_ECDHE_ECDSA_WITH_AES_128_CCM :
 682        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
 683        specs->cipher_type           = aead;
 684        specs->mac_algorithm         = sha256_mac;
 685        specs->kea                   = ecc_diffie_hellman_kea;
 686        specs->sig_algo              = ecc_dsa_sa_algo;
 687        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 688        specs->pad_size              = PAD_SHA;
 689        specs->static_ecdh           = 0;
 690        specs->key_size              = AES_128_KEY_SIZE;
 691        specs->block_size            = WC_AES_BLOCK_SIZE;
 692        specs->iv_size               = AESCCM_IMP_IV_SZ;
 693        specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
 694
 695        break;
 696#endif
 697
 698#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
 699    case TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 :
 700        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
 701        specs->cipher_type           = aead;
 702        specs->mac_algorithm         = sha256_mac;
 703        specs->kea                   = ecc_diffie_hellman_kea;
 704        specs->sig_algo              = ecc_dsa_sa_algo;
 705        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 706        specs->pad_size              = PAD_SHA;
 707        specs->static_ecdh           = 0;
 708        specs->key_size              = AES_128_KEY_SIZE;
 709        specs->block_size            = WC_AES_BLOCK_SIZE;
 710        specs->iv_size               = AESCCM_IMP_IV_SZ;
 711        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
 712
 713        break;
 714#endif
 715
 716#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
 717    case TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 :
 718        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
 719        specs->cipher_type           = aead;
 720        specs->mac_algorithm         = sha256_mac;
 721        specs->kea                   = ecc_diffie_hellman_kea;
 722        specs->sig_algo              = ecc_dsa_sa_algo;
 723        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 724        specs->pad_size              = PAD_SHA;
 725        specs->static_ecdh           = 0;
 726        specs->key_size              = AES_256_KEY_SIZE;
 727        specs->block_size            = WC_AES_BLOCK_SIZE;
 728        specs->iv_size               = AESCCM_IMP_IV_SZ;
 729        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
 730
 731        break;
 732#endif
 733
 734#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_NULL_SHA
 735    case TLS_ECDHE_ECDSA_WITH_NULL_SHA :
 736        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
 737        specs->cipher_type           = stream;
 738        specs->mac_algorithm         = sha_mac;
 739        specs->kea                   = ecc_diffie_hellman_kea;
 740        specs->sig_algo              = ecc_dsa_sa_algo;
 741        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 742        specs->pad_size              = PAD_SHA;
 743        specs->static_ecdh           = 0;
 744        specs->key_size              = 0;
 745        specs->block_size            = 0;
 746        specs->iv_size               = 0;
 747
 748    break;
 749#endif
 750
 751#endif /* HAVE_ECC || (CURVE25519 && ED25519) || (CURVE448 && ED448) */
 752
 753#if defined(HAVE_ECC)
 754
 755#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
 756    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
 757        specs->bulk_cipher_algorithm = wolfssl_aes;
 758        specs->cipher_type           = block;
 759        specs->mac_algorithm         = sha256_mac;
 760        specs->kea                   = ecc_diffie_hellman_kea;
 761        specs->sig_algo              = rsa_sa_algo;
 762        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 763        specs->pad_size              = PAD_SHA;
 764        specs->static_ecdh           = 1;
 765        specs->key_size              = AES_128_KEY_SIZE;
 766        specs->iv_size               = AES_IV_SIZE;
 767        specs->block_size            = WC_AES_BLOCK_SIZE;
 768
 769        break;
 770#endif
 771
 772#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
 773    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
 774        specs->bulk_cipher_algorithm = wolfssl_aes;
 775        specs->cipher_type           = block;
 776        specs->mac_algorithm         = sha256_mac;
 777        specs->kea                   = ecc_diffie_hellman_kea;
 778        specs->sig_algo              = ecc_dsa_sa_algo;
 779        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 780        specs->pad_size              = PAD_SHA;
 781        specs->static_ecdh           = 1;
 782        specs->key_size              = AES_128_KEY_SIZE;
 783        specs->iv_size               = AES_IV_SIZE;
 784        specs->block_size            = WC_AES_BLOCK_SIZE;
 785
 786        break;
 787#endif
 788
 789#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
 790    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
 791        specs->bulk_cipher_algorithm = wolfssl_aes;
 792        specs->cipher_type           = block;
 793        specs->mac_algorithm         = sha384_mac;
 794        specs->kea                   = ecc_diffie_hellman_kea;
 795        specs->sig_algo              = rsa_sa_algo;
 796        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 797        specs->pad_size              = PAD_SHA;
 798        specs->static_ecdh           = 1;
 799        specs->key_size              = AES_256_KEY_SIZE;
 800        specs->iv_size               = AES_IV_SIZE;
 801        specs->block_size            = WC_AES_BLOCK_SIZE;
 802
 803        break;
 804#endif
 805
 806#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
 807    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
 808        specs->bulk_cipher_algorithm = wolfssl_aes;
 809        specs->cipher_type           = block;
 810        specs->mac_algorithm         = sha384_mac;
 811        specs->kea                   = ecc_diffie_hellman_kea;
 812        specs->sig_algo              = ecc_dsa_sa_algo;
 813        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 814        specs->pad_size              = PAD_SHA;
 815        specs->static_ecdh           = 1;
 816        specs->key_size              = AES_256_KEY_SIZE;
 817        specs->iv_size               = AES_IV_SIZE;
 818        specs->block_size            = WC_AES_BLOCK_SIZE;
 819
 820        break;
 821#endif
 822
 823#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
 824    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA :
 825        specs->bulk_cipher_algorithm = wolfssl_aes;
 826        specs->cipher_type           = block;
 827        specs->mac_algorithm         = sha_mac;
 828        specs->kea                   = ecc_diffie_hellman_kea;
 829        specs->sig_algo              = rsa_sa_algo;
 830        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 831        specs->pad_size              = PAD_SHA;
 832        specs->static_ecdh           = 1;
 833        specs->key_size              = AES_128_KEY_SIZE;
 834        specs->block_size            = WC_AES_BLOCK_SIZE;
 835        specs->iv_size               = AES_IV_SIZE;
 836
 837        break;
 838#endif
 839
 840#ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
 841    case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA :
 842        specs->bulk_cipher_algorithm = wolfssl_triple_des;
 843        specs->cipher_type           = block;
 844        specs->mac_algorithm         = sha_mac;
 845        specs->kea                   = ecc_diffie_hellman_kea;
 846        specs->sig_algo              = rsa_sa_algo;
 847        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 848        specs->pad_size              = PAD_SHA;
 849        specs->static_ecdh           = 1;
 850        specs->key_size              = DES3_KEY_SIZE;
 851        specs->block_size            = DES_BLOCK_SIZE;
 852#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
 853        specs->iv_size               = DES_BLOCK_SIZE;
 854#else
 855        specs->iv_size               = DES_IV_SIZE;
 856#endif
 857
 858        break;
 859#endif
 860
 861#ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
 862    case TLS_ECDH_RSA_WITH_RC4_128_SHA :
 863        specs->bulk_cipher_algorithm = wolfssl_rc4;
 864        specs->cipher_type           = stream;
 865        specs->mac_algorithm         = sha_mac;
 866        specs->kea                   = ecc_diffie_hellman_kea;
 867        specs->sig_algo              = rsa_sa_algo;
 868        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 869        specs->pad_size              = PAD_SHA;
 870        specs->static_ecdh           = 1;
 871        specs->key_size              = RC4_KEY_SIZE;
 872        specs->iv_size               = 0;
 873        specs->block_size            = 0;
 874
 875        break;
 876#endif
 877
 878#ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
 879    case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA :
 880        specs->bulk_cipher_algorithm = wolfssl_triple_des;
 881        specs->cipher_type           = block;
 882        specs->mac_algorithm         = sha_mac;
 883        specs->kea                   = ecc_diffie_hellman_kea;
 884        specs->sig_algo              = ecc_dsa_sa_algo;
 885        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 886        specs->pad_size              = PAD_SHA;
 887        specs->static_ecdh           = 1;
 888        specs->key_size              = DES3_KEY_SIZE;
 889        specs->block_size            = DES_BLOCK_SIZE;
 890#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
 891        specs->iv_size               = DES_BLOCK_SIZE;
 892#else
 893        specs->iv_size               = DES_IV_SIZE;
 894#endif
 895
 896        break;
 897#endif
 898
 899#ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
 900    case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
 901        specs->bulk_cipher_algorithm = wolfssl_rc4;
 902        specs->cipher_type           = stream;
 903        specs->mac_algorithm         = sha_mac;
 904        specs->kea                   = ecc_diffie_hellman_kea;
 905        specs->sig_algo              = ecc_dsa_sa_algo;
 906        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 907        specs->pad_size              = PAD_SHA;
 908        specs->static_ecdh           = 1;
 909        specs->key_size              = RC4_KEY_SIZE;
 910        specs->iv_size               = 0;
 911        specs->block_size            = 0;
 912
 913        break;
 914#endif
 915
 916#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
 917    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA :
 918        specs->bulk_cipher_algorithm = wolfssl_aes;
 919        specs->cipher_type           = block;
 920        specs->mac_algorithm         = sha_mac;
 921        specs->kea                   = ecc_diffie_hellman_kea;
 922        specs->sig_algo              = rsa_sa_algo;
 923        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 924        specs->pad_size              = PAD_SHA;
 925        specs->static_ecdh           = 1;
 926        specs->key_size              = AES_256_KEY_SIZE;
 927        specs->block_size            = WC_AES_BLOCK_SIZE;
 928        specs->iv_size               = AES_IV_SIZE;
 929
 930        break;
 931#endif
 932
 933#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
 934    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA :
 935        specs->bulk_cipher_algorithm = wolfssl_aes;
 936        specs->cipher_type           = block;
 937        specs->mac_algorithm         = sha_mac;
 938        specs->kea                   = ecc_diffie_hellman_kea;
 939        specs->sig_algo              = ecc_dsa_sa_algo;
 940        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 941        specs->pad_size              = PAD_SHA;
 942        specs->static_ecdh           = 1;
 943        specs->key_size              = AES_128_KEY_SIZE;
 944        specs->block_size            = WC_AES_BLOCK_SIZE;
 945        specs->iv_size               = AES_IV_SIZE;
 946
 947        break;
 948#endif
 949
 950#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
 951    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA :
 952        specs->bulk_cipher_algorithm = wolfssl_aes;
 953        specs->cipher_type           = block;
 954        specs->mac_algorithm         = sha_mac;
 955        specs->kea                   = ecc_diffie_hellman_kea;
 956        specs->sig_algo              = ecc_dsa_sa_algo;
 957        specs->hash_size             = WC_SHA_DIGEST_SIZE;
 958        specs->pad_size              = PAD_SHA;
 959        specs->static_ecdh           = 1;
 960        specs->key_size              = AES_256_KEY_SIZE;
 961        specs->block_size            = WC_AES_BLOCK_SIZE;
 962        specs->iv_size               = AES_IV_SIZE;
 963
 964        break;
 965#endif
 966
 967#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
 968    case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 :
 969        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 970        specs->cipher_type           = aead;
 971        specs->mac_algorithm         = sha256_mac;
 972        specs->kea                   = ecc_diffie_hellman_kea;
 973        specs->sig_algo              = rsa_sa_algo;
 974        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
 975        specs->pad_size              = PAD_SHA;
 976        specs->static_ecdh           = 1;
 977        specs->key_size              = AES_128_KEY_SIZE;
 978        specs->block_size            = WC_AES_BLOCK_SIZE;
 979        specs->iv_size               = AESGCM_IMP_IV_SZ;
 980        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 981
 982        break;
 983#endif
 984
 985#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
 986    case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 :
 987        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
 988        specs->cipher_type           = aead;
 989        specs->mac_algorithm         = sha384_mac;
 990        specs->kea                   = ecc_diffie_hellman_kea;
 991        specs->sig_algo              = rsa_sa_algo;
 992        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
 993        specs->pad_size              = PAD_SHA;
 994        specs->static_ecdh           = 1;
 995        specs->key_size              = AES_256_KEY_SIZE;
 996        specs->block_size            = WC_AES_BLOCK_SIZE;
 997        specs->iv_size               = AESGCM_IMP_IV_SZ;
 998        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
 999
1000        break;
1001#endif
1002
1003#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
1004    case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 :
1005        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1006        specs->cipher_type           = aead;
1007        specs->mac_algorithm         = sha256_mac;
1008        specs->kea                   = ecc_diffie_hellman_kea;
1009        specs->sig_algo              = ecc_dsa_sa_algo;
1010        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1011        specs->pad_size              = PAD_SHA;
1012        specs->static_ecdh           = 1;
1013        specs->key_size              = AES_128_KEY_SIZE;
1014        specs->block_size            = WC_AES_BLOCK_SIZE;
1015        specs->iv_size               = AESGCM_IMP_IV_SZ;
1016        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1017
1018        break;
1019#endif
1020
1021#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
1022    case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 :
1023        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1024        specs->cipher_type           = aead;
1025        specs->mac_algorithm         = sha384_mac;
1026        specs->kea                   = ecc_diffie_hellman_kea;
1027        specs->sig_algo              = ecc_dsa_sa_algo;
1028        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1029        specs->pad_size              = PAD_SHA;
1030        specs->static_ecdh           = 1;
1031        specs->key_size              = AES_256_KEY_SIZE;
1032        specs->block_size            = WC_AES_BLOCK_SIZE;
1033        specs->iv_size               = AESGCM_IMP_IV_SZ;
1034        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1035
1036        break;
1037#endif
1038
1039#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256
1040    case TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 :
1041        specs->bulk_cipher_algorithm = wolfssl_aria_gcm;
1042        specs->cipher_type           = aead;
1043        specs->mac_algorithm         = sha256_mac;
1044        specs->kea                   = ecc_diffie_hellman_kea;
1045        specs->sig_algo              = ecc_dsa_sa_algo;
1046        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1047        specs->pad_size              = PAD_SHA;
1048        specs->static_ecdh           = 0;
1049        specs->key_size              = ARIA_128_KEY_SIZE;
1050        specs->block_size            = ARIA_BLOCK_SIZE;
1051        specs->iv_size               = AESGCM_IMP_IV_SZ;
1052        specs->aead_mac_size         = ARIA_GCM_AUTH_SZ;
1053
1054        break;
1055#endif
1056
1057#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384
1058    case TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 :
1059        specs->bulk_cipher_algorithm = wolfssl_aria_gcm;
1060        specs->cipher_type           = aead;
1061        specs->mac_algorithm         = sha384_mac;
1062        specs->kea                   = ecc_diffie_hellman_kea;
1063        specs->sig_algo              = ecc_dsa_sa_algo;
1064        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1065        specs->pad_size              = PAD_SHA;
1066        specs->static_ecdh           = 0;
1067        specs->key_size              = ARIA_256_KEY_SIZE;
1068        specs->block_size            = ARIA_BLOCK_SIZE;
1069        specs->iv_size               = AESGCM_IMP_IV_SZ;
1070        specs->aead_mac_size         = ARIA_GCM_AUTH_SZ;
1071
1072        break;
1073#endif
1074
1075#endif /* HAVE_ECC */
1076
1077#ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
1078    case TLS_RSA_WITH_AES_128_CCM_8 :
1079        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1080        specs->cipher_type           = aead;
1081        specs->mac_algorithm         = sha256_mac;
1082        specs->kea                   = rsa_kea;
1083        specs->sig_algo              = rsa_sa_algo;
1084        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1085        specs->pad_size              = PAD_SHA;
1086        specs->static_ecdh           = 0;
1087        specs->key_size              = AES_128_KEY_SIZE;
1088        specs->block_size            = WC_AES_BLOCK_SIZE;
1089        specs->iv_size               = AESCCM_IMP_IV_SZ;
1090        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
1091
1092        break;
1093#endif
1094
1095#ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
1096    case TLS_RSA_WITH_AES_256_CCM_8 :
1097        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1098        specs->cipher_type           = aead;
1099        specs->mac_algorithm         = sha256_mac;
1100        specs->kea                   = rsa_kea;
1101        specs->sig_algo              = rsa_sa_algo;
1102        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1103        specs->pad_size              = PAD_SHA;
1104        specs->static_ecdh           = 0;
1105        specs->key_size              = AES_256_KEY_SIZE;
1106        specs->block_size            = WC_AES_BLOCK_SIZE;
1107        specs->iv_size               = AESCCM_IMP_IV_SZ;
1108        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
1109
1110        break;
1111#endif
1112
1113#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
1114    case TLS_PSK_WITH_AES_128_CCM_8 :
1115        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1116        specs->cipher_type           = aead;
1117        specs->mac_algorithm         = sha256_mac;
1118        specs->kea                   = psk_kea;
1119        specs->sig_algo              = anonymous_sa_algo;
1120        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1121        specs->pad_size              = PAD_SHA;
1122        specs->static_ecdh           = 0;
1123        specs->key_size              = AES_128_KEY_SIZE;
1124        specs->block_size            = WC_AES_BLOCK_SIZE;
1125        specs->iv_size               = AESCCM_IMP_IV_SZ;
1126        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
1127
1128        if (opts != NULL)
1129            opts->usingPSK_cipher    = 1;
1130        break;
1131#endif
1132
1133#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
1134    case TLS_PSK_WITH_AES_256_CCM_8 :
1135        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1136        specs->cipher_type           = aead;
1137        specs->mac_algorithm         = sha256_mac;
1138        specs->kea                   = psk_kea;
1139        specs->sig_algo              = anonymous_sa_algo;
1140        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1141        specs->pad_size              = PAD_SHA;
1142        specs->static_ecdh           = 0;
1143        specs->key_size              = AES_256_KEY_SIZE;
1144        specs->block_size            = WC_AES_BLOCK_SIZE;
1145        specs->iv_size               = AESCCM_IMP_IV_SZ;
1146        specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
1147
1148        if (opts != NULL)
1149            opts->usingPSK_cipher    = 1;
1150        break;
1151#endif
1152
1153#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
1154    case TLS_PSK_WITH_AES_128_CCM :
1155        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1156        specs->cipher_type           = aead;
1157        specs->mac_algorithm         = sha256_mac;
1158        specs->kea                   = psk_kea;
1159        specs->sig_algo              = anonymous_sa_algo;
1160        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1161        specs->pad_size              = PAD_SHA;
1162        specs->static_ecdh           = 0;
1163        specs->key_size              = AES_128_KEY_SIZE;
1164        specs->block_size            = WC_AES_BLOCK_SIZE;
1165        specs->iv_size               = AESCCM_IMP_IV_SZ;
1166        specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
1167
1168        if (opts != NULL)
1169            opts->usingPSK_cipher    = 1;
1170        break;
1171#endif
1172
1173#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
1174    case TLS_PSK_WITH_AES_256_CCM :
1175        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1176        specs->cipher_type           = aead;
1177        specs->mac_algorithm         = sha256_mac;
1178        specs->kea                   = psk_kea;
1179        specs->sig_algo              = anonymous_sa_algo;
1180        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1181        specs->pad_size              = PAD_SHA;
1182        specs->static_ecdh           = 0;
1183        specs->key_size              = AES_256_KEY_SIZE;
1184        specs->block_size            = WC_AES_BLOCK_SIZE;
1185        specs->iv_size               = AESCCM_IMP_IV_SZ;
1186        specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
1187
1188        if (opts != NULL)
1189            opts->usingPSK_cipher    = 1;
1190        break;
1191#endif
1192
1193#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
1194    case TLS_DHE_PSK_WITH_AES_128_CCM :
1195        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1196        specs->cipher_type           = aead;
1197        specs->mac_algorithm         = sha256_mac;
1198        specs->kea                   = dhe_psk_kea;
1199        specs->sig_algo              = anonymous_sa_algo;
1200        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1201        specs->pad_size              = PAD_SHA;
1202        specs->static_ecdh           = 0;
1203        specs->key_size              = AES_128_KEY_SIZE;
1204        specs->block_size            = WC_AES_BLOCK_SIZE;
1205        specs->iv_size               = AESCCM_IMP_IV_SZ;
1206        specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
1207
1208        if (opts != NULL)
1209            opts->usingPSK_cipher    = 1;
1210        break;
1211#endif
1212
1213#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
1214    case TLS_DHE_PSK_WITH_AES_256_CCM :
1215        specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1216        specs->cipher_type           = aead;
1217        specs->mac_algorithm         = sha256_mac;
1218        specs->kea                   = dhe_psk_kea;
1219        specs->sig_algo              = anonymous_sa_algo;
1220        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1221        specs->pad_size              = PAD_SHA;
1222        specs->static_ecdh           = 0;
1223        specs->key_size              = AES_256_KEY_SIZE;
1224        specs->block_size            = WC_AES_BLOCK_SIZE;
1225        specs->iv_size               = AESCCM_IMP_IV_SZ;
1226        specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
1227
1228        if (opts != NULL)
1229            opts->usingPSK_cipher    = 1;
1230        break;
1231#endif
1232
1233#if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER)
1234    #ifdef BUILD_TLS_SHA256_SHA256
1235    case TLS_SHA256_SHA256 :
1236        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1237        specs->cipher_type           = aead;
1238        specs->mac_algorithm         = sha256_mac;
1239        specs->kea                   = any_kea;
1240        specs->sig_algo              = any_sa_algo;
1241        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1242        specs->pad_size              = PAD_SHA;
1243        specs->static_ecdh           = 0;
1244        specs->key_size              = WC_SHA256_DIGEST_SIZE;
1245        specs->block_size            = 0;
1246        specs->iv_size               = WC_SHA256_DIGEST_SIZE;
1247        specs->aead_mac_size         = WC_SHA256_DIGEST_SIZE;
1248
1249        break;
1250    #endif
1251
1252    #ifdef BUILD_TLS_SHA384_SHA384
1253    case TLS_SHA384_SHA384 :
1254        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1255        specs->cipher_type           = aead;
1256        specs->mac_algorithm         = sha384_mac;
1257        specs->kea                   = any_kea;
1258        specs->sig_algo              = any_sa_algo;
1259        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1260        specs->pad_size              = PAD_SHA;
1261        specs->static_ecdh           = 0;
1262        specs->key_size              = WC_SHA384_DIGEST_SIZE;
1263        specs->block_size            = 0;
1264        specs->iv_size               = WC_SHA384_DIGEST_SIZE;
1265        specs->aead_mac_size         = WC_SHA384_DIGEST_SIZE;
1266
1267        break;
1268    #endif
1269#endif
1270
1271    default:
1272        WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs ECC");
1273        return UNSUPPORTED_SUITE;
1274    }   /* switch */
1275    }   /* if     */
1276
1277    /* TLSi v1.3 cipher suites, 0x13 */
1278    if (cipherSuite0 == TLS13_BYTE) {
1279        switch (cipherSuite) {
1280
1281#ifdef WOLFSSL_TLS13
1282    #ifdef BUILD_TLS_AES_128_GCM_SHA256
1283        case TLS_AES_128_GCM_SHA256 :
1284            specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1285            specs->cipher_type           = aead;
1286            specs->mac_algorithm         = sha256_mac;
1287            specs->kea                   = any_kea;
1288            specs->sig_algo              = any_sa_algo;
1289            specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1290            specs->pad_size              = PAD_SHA;
1291            specs->static_ecdh           = 0;
1292            specs->key_size              = AES_128_KEY_SIZE;
1293            specs->block_size            = WC_AES_BLOCK_SIZE;
1294            specs->iv_size               = AESGCM_NONCE_SZ;
1295            specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1296
1297            break;
1298    #endif
1299
1300    #ifdef BUILD_TLS_AES_256_GCM_SHA384
1301        case TLS_AES_256_GCM_SHA384 :
1302            specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1303            specs->cipher_type           = aead;
1304            specs->mac_algorithm         = sha384_mac;
1305            specs->kea                   = any_kea;
1306            specs->sig_algo              = any_sa_algo;
1307            specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1308            specs->pad_size              = PAD_SHA;
1309            specs->static_ecdh           = 0;
1310            specs->key_size              = AES_256_KEY_SIZE;
1311            specs->block_size            = WC_AES_BLOCK_SIZE;
1312            specs->iv_size               = AESGCM_NONCE_SZ;
1313            specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1314
1315            break;
1316    #endif
1317
1318    #ifdef BUILD_TLS_CHACHA20_POLY1305_SHA256
1319        case TLS_CHACHA20_POLY1305_SHA256 :
1320            specs->bulk_cipher_algorithm = wolfssl_chacha;
1321            specs->cipher_type           = aead;
1322            specs->mac_algorithm         = sha256_mac;
1323            specs->kea                   = any_kea;
1324            specs->sig_algo              = any_sa_algo;
1325            specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1326            specs->pad_size              = PAD_SHA;
1327            specs->static_ecdh           = 0;
1328            specs->key_size              = CHACHA20_256_KEY_SIZE;
1329            specs->block_size            = CHACHA20_BLOCK_SIZE;
1330            specs->iv_size               = CHACHA20_IV_SIZE;
1331            specs->aead_mac_size         = POLY1305_AUTH_SZ;
1332            if (opts != NULL)
1333                opts->oldPoly            = 0; /* use recent padding RFC */
1334
1335            break;
1336    #endif
1337
1338    #ifdef BUILD_TLS_AES_128_CCM_SHA256
1339        case TLS_AES_128_CCM_SHA256 :
1340            specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1341            specs->cipher_type           = aead;
1342            specs->mac_algorithm         = sha256_mac;
1343            specs->kea                   = any_kea;
1344            specs->sig_algo              = any_sa_algo;
1345            specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1346            specs->pad_size              = PAD_SHA;
1347            specs->static_ecdh           = 0;
1348            specs->key_size              = AES_128_KEY_SIZE;
1349            specs->block_size            = WC_AES_BLOCK_SIZE;
1350            specs->iv_size               = AESCCM_NONCE_SZ;
1351            specs->aead_mac_size         = AES_CCM_16_AUTH_SZ;
1352
1353            break;
1354    #endif
1355
1356    #ifdef BUILD_TLS_AES_128_CCM_8_SHA256
1357        case TLS_AES_128_CCM_8_SHA256 :
1358            specs->bulk_cipher_algorithm = wolfssl_aes_ccm;
1359            specs->cipher_type           = aead;
1360            specs->mac_algorithm         = sha256_mac;
1361            specs->kea                   = any_kea;
1362            specs->sig_algo              = any_sa_algo;
1363            specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1364            specs->pad_size              = PAD_SHA;
1365            specs->static_ecdh           = 0;
1366            specs->key_size              = AES_128_KEY_SIZE;
1367            specs->block_size            = WC_AES_BLOCK_SIZE;
1368            specs->iv_size               = AESCCM_NONCE_SZ;
1369            specs->aead_mac_size         = AES_CCM_8_AUTH_SZ;
1370
1371            break;
1372    #endif
1373#endif /* WOLFSSL_TLS13 */
1374        default:
1375            WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs TLS 1.3");
1376            return UNSUPPORTED_SUITE;
1377        }
1378    }
1379
1380    if (cipherSuite0 == ECDHE_PSK_BYTE) {
1381
1382    switch (cipherSuite) {
1383
1384#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
1385#ifdef BUILD_TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256
1386    case TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 :
1387        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1388        specs->cipher_type           = aead;
1389        specs->mac_algorithm         = sha256_mac;
1390        specs->kea                   = ecdhe_psk_kea;
1391        specs->sig_algo              = anonymous_sa_algo;
1392        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1393        specs->pad_size              = PAD_SHA;
1394        specs->static_ecdh           = 0;
1395        specs->key_size              = AES_128_KEY_SIZE;
1396        specs->block_size            = WC_AES_BLOCK_SIZE;
1397        specs->iv_size               = AESGCM_IMP_IV_SZ;
1398        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1399
1400        if (opts != NULL)
1401            opts->usingPSK_cipher    = 1;
1402        break;
1403#endif
1404#endif
1405
1406    default:
1407        WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs ECDHE_PSK");
1408        return UNSUPPORTED_SUITE;
1409    }
1410    }
1411
1412    if (cipherSuite0 == SM_BYTE) {
1413
1414    switch (cipherSuite) {
1415#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_SM4_CBC_SM3
1416    case TLS_ECDHE_ECDSA_WITH_SM4_CBC_SM3 :
1417        specs->bulk_cipher_algorithm = wolfssl_sm4_cbc;
1418        specs->cipher_type           = block;
1419        specs->mac_algorithm         = sm3_mac;
1420        specs->kea                   = ecc_diffie_hellman_kea;
1421        specs->sig_algo              = sm2_sa_algo;
1422        specs->hash_size             = WC_SM3_DIGEST_SIZE;
1423        specs->pad_size              = PAD_SHA;
1424        specs->static_ecdh           = 0;
1425        specs->key_size              = SM4_KEY_SIZE;
1426        specs->iv_size               = SM4_IV_SIZE;
1427        specs->block_size            = SM4_BLOCK_SIZE;
1428
1429        break;
1430#endif
1431
1432#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_SM4_GCM_SM3
1433    case TLS_ECDHE_ECDSA_WITH_SM4_GCM_SM3 :
1434        specs->bulk_cipher_algorithm = wolfssl_sm4_gcm;
1435        specs->cipher_type           = aead;
1436        specs->mac_algorithm         = sm3_mac;
1437        specs->kea                   = ecc_diffie_hellman_kea;
1438        specs->sig_algo              = sm2_sa_algo;
1439        specs->hash_size             = WC_SM3_DIGEST_SIZE;
1440        specs->pad_size              = PAD_SHA;
1441        specs->static_ecdh           = 0;
1442        specs->key_size              = SM4_KEY_SIZE;
1443        specs->block_size            = SM4_BLOCK_SIZE;
1444        specs->iv_size               = GCM_IMP_IV_SZ;
1445        specs->aead_mac_size         = SM4_GCM_AUTH_SZ;
1446
1447        break;
1448#endif
1449
1450#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_SM4_CCM_SM3
1451    case TLS_ECDHE_ECDSA_WITH_SM4_CCM_SM3 :
1452        specs->bulk_cipher_algorithm = wolfssl_sm4_ccm;
1453        specs->cipher_type           = aead;
1454        specs->mac_algorithm         = sm3_mac;
1455        specs->kea                   = ecc_diffie_hellman_kea;
1456        specs->sig_algo              = sm2_sa_algo;
1457        specs->hash_size             = WC_SM3_DIGEST_SIZE;
1458        specs->pad_size              = PAD_SHA;
1459        specs->static_ecdh           = 0;
1460        specs->key_size              = SM4_KEY_SIZE;
1461        specs->block_size            = SM4_BLOCK_SIZE;
1462        specs->iv_size               = CCM_IMP_IV_SZ;
1463        specs->aead_mac_size         = SM4_CCM_AUTH_SZ;
1464
1465        break;
1466#endif
1467
1468    default:
1469        WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs SM");
1470        return UNSUPPORTED_SUITE;
1471    }
1472    }
1473
1474    if (cipherSuite0 != ECC_BYTE &&
1475        cipherSuite0 != ECDHE_PSK_BYTE &&
1476        cipherSuite0 != CHACHA_BYTE &&
1477#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) && \
1478    (defined(WOLFSSL_SM4_CBC) || defined(WOLFSSL_SM4_GCM) || \
1479     defined(WOLFSSL_SM4_CCM))
1480        cipherSuite0 != SM_BYTE &&
1481#endif
1482        cipherSuite0 != TLS13_BYTE) {   /* normal suites */
1483    switch (cipherSuite) {
1484
1485#ifdef BUILD_TLS_SM4_GCM_SM3
1486    case TLS_SM4_GCM_SM3 :
1487        specs->bulk_cipher_algorithm = wolfssl_sm4_gcm;
1488        specs->cipher_type           = aead;
1489        specs->mac_algorithm         = sm3_mac;
1490        specs->kea                   = any_kea;
1491        specs->sig_algo              = any_sa_algo;
1492        specs->hash_size             = WC_SM3_DIGEST_SIZE;
1493        specs->pad_size              = PAD_SHA;
1494        specs->static_ecdh           = 0;
1495        specs->key_size              = SM4_KEY_SIZE;
1496        specs->block_size            = SM4_BLOCK_SIZE;
1497        specs->iv_size               = SM4_GCM_NONCE_SZ;
1498        specs->aead_mac_size         = SM4_GCM_AUTH_SZ;
1499
1500        break;
1501#endif
1502
1503#ifdef BUILD_TLS_SM4_CCM_SM3
1504    case TLS_SM4_CCM_SM3 :
1505        specs->bulk_cipher_algorithm = wolfssl_sm4_ccm;
1506        specs->cipher_type           = aead;
1507        specs->mac_algorithm         = sm3_mac;
1508        specs->kea                   = any_kea;
1509        specs->sig_algo              = any_sa_algo;
1510        specs->hash_size             = WC_SM3_DIGEST_SIZE;
1511        specs->pad_size              = PAD_SHA;
1512        specs->static_ecdh           = 0;
1513        specs->key_size              = SM4_KEY_SIZE;
1514        specs->block_size            = SM4_BLOCK_SIZE;
1515        specs->iv_size               = SM4_CCM_NONCE_SZ;
1516        specs->aead_mac_size         = SM4_CCM_AUTH_SZ;
1517
1518        break;
1519#endif
1520
1521#ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
1522    case SSL_RSA_WITH_RC4_128_SHA :
1523        specs->bulk_cipher_algorithm = wolfssl_rc4;
1524        specs->cipher_type           = stream;
1525        specs->mac_algorithm         = sha_mac;
1526        specs->kea                   = rsa_kea;
1527        specs->sig_algo              = rsa_sa_algo;
1528        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1529        specs->pad_size              = PAD_SHA;
1530        specs->static_ecdh           = 0;
1531        specs->key_size              = RC4_KEY_SIZE;
1532        specs->iv_size               = 0;
1533        specs->block_size            = 0;
1534
1535        break;
1536#endif
1537
1538#ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
1539    case SSL_RSA_WITH_RC4_128_MD5 :
1540        specs->bulk_cipher_algorithm = wolfssl_rc4;
1541        specs->cipher_type           = stream;
1542        specs->mac_algorithm         = md5_mac;
1543        specs->kea                   = rsa_kea;
1544        specs->sig_algo              = rsa_sa_algo;
1545        specs->hash_size             = WC_MD5_DIGEST_SIZE;
1546        specs->pad_size              = PAD_MD5;
1547        specs->static_ecdh           = 0;
1548        specs->key_size              = RC4_KEY_SIZE;
1549        specs->iv_size               = 0;
1550        specs->block_size            = 0;
1551
1552        break;
1553#endif
1554
1555#ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
1556    case SSL_RSA_WITH_3DES_EDE_CBC_SHA :
1557        specs->bulk_cipher_algorithm = wolfssl_triple_des;
1558        specs->cipher_type           = block;
1559        specs->mac_algorithm         = sha_mac;
1560        specs->kea                   = rsa_kea;
1561        specs->sig_algo              = rsa_sa_algo;
1562        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1563        specs->pad_size              = PAD_SHA;
1564        specs->static_ecdh           = 0;
1565        specs->key_size              = DES3_KEY_SIZE;
1566        specs->block_size            = DES_BLOCK_SIZE;
1567#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
1568        specs->iv_size               = DES_BLOCK_SIZE;
1569#else
1570        specs->iv_size               = DES_IV_SIZE;
1571#endif
1572
1573        break;
1574#endif
1575
1576#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
1577    case TLS_RSA_WITH_AES_128_CBC_SHA :
1578        specs->bulk_cipher_algorithm = wolfssl_aes;
1579        specs->cipher_type           = block;
1580        specs->mac_algorithm         = sha_mac;
1581        specs->kea                   = rsa_kea;
1582        specs->sig_algo              = rsa_sa_algo;
1583        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1584        specs->pad_size              = PAD_SHA;
1585        specs->static_ecdh           = 0;
1586        specs->key_size              = AES_128_KEY_SIZE;
1587        specs->block_size            = WC_AES_BLOCK_SIZE;
1588        specs->iv_size               = AES_IV_SIZE;
1589
1590        break;
1591#endif
1592
1593#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
1594    case TLS_RSA_WITH_AES_128_CBC_SHA256 :
1595        specs->bulk_cipher_algorithm = wolfssl_aes;
1596        specs->cipher_type           = block;
1597        specs->mac_algorithm         = sha256_mac;
1598        specs->kea                   = rsa_kea;
1599        specs->sig_algo              = rsa_sa_algo;
1600        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1601        specs->pad_size              = PAD_SHA;
1602        specs->static_ecdh           = 0;
1603        specs->key_size              = AES_128_KEY_SIZE;
1604        specs->block_size            = WC_AES_BLOCK_SIZE;
1605        specs->iv_size               = AES_IV_SIZE;
1606
1607        break;
1608#endif
1609
1610#ifdef BUILD_TLS_RSA_WITH_NULL_MD5
1611    case TLS_RSA_WITH_NULL_MD5 :
1612        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1613        specs->cipher_type           = stream;
1614        specs->mac_algorithm         = md5_mac;
1615        specs->kea                   = rsa_kea;
1616        specs->sig_algo              = rsa_sa_algo;
1617        specs->hash_size             = WC_MD5_DIGEST_SIZE;
1618        specs->pad_size              = PAD_MD5;
1619        specs->static_ecdh           = 0;
1620        specs->key_size              = 0;
1621        specs->block_size            = 0;
1622        specs->iv_size               = 0;
1623
1624        break;
1625#endif
1626
1627#ifdef BUILD_TLS_RSA_WITH_NULL_SHA
1628    case TLS_RSA_WITH_NULL_SHA :
1629        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1630        specs->cipher_type           = stream;
1631        specs->mac_algorithm         = sha_mac;
1632        specs->kea                   = rsa_kea;
1633        specs->sig_algo              = rsa_sa_algo;
1634        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1635        specs->pad_size              = PAD_SHA;
1636        specs->static_ecdh           = 0;
1637        specs->key_size              = 0;
1638        specs->block_size            = 0;
1639        specs->iv_size               = 0;
1640
1641        break;
1642#endif
1643
1644#ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
1645    case TLS_RSA_WITH_NULL_SHA256 :
1646        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1647        specs->cipher_type           = stream;
1648        specs->mac_algorithm         = sha256_mac;
1649        specs->kea                   = rsa_kea;
1650        specs->sig_algo              = rsa_sa_algo;
1651        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1652        specs->pad_size              = PAD_SHA;
1653        specs->static_ecdh           = 0;
1654        specs->key_size              = 0;
1655        specs->block_size            = 0;
1656        specs->iv_size               = 0;
1657
1658        break;
1659#endif
1660
1661#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
1662    case TLS_RSA_WITH_AES_256_CBC_SHA :
1663        specs->bulk_cipher_algorithm = wolfssl_aes;
1664        specs->cipher_type           = block;
1665        specs->mac_algorithm         = sha_mac;
1666        specs->kea                   = rsa_kea;
1667        specs->sig_algo              = rsa_sa_algo;
1668        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1669        specs->pad_size              = PAD_SHA;
1670        specs->static_ecdh           = 0;
1671        specs->key_size              = AES_256_KEY_SIZE;
1672        specs->block_size            = WC_AES_BLOCK_SIZE;
1673        specs->iv_size               = AES_IV_SIZE;
1674
1675        break;
1676#endif
1677
1678#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
1679    case TLS_RSA_WITH_AES_256_CBC_SHA256 :
1680        specs->bulk_cipher_algorithm = wolfssl_aes;
1681        specs->cipher_type           = block;
1682        specs->mac_algorithm         = sha256_mac;
1683        specs->kea                   = rsa_kea;
1684        specs->sig_algo              = rsa_sa_algo;
1685        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1686        specs->pad_size              = PAD_SHA;
1687        specs->static_ecdh           = 0;
1688        specs->key_size              = AES_256_KEY_SIZE;
1689        specs->block_size            = WC_AES_BLOCK_SIZE;
1690        specs->iv_size               = AES_IV_SIZE;
1691
1692        break;
1693#endif
1694
1695#ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
1696    case TLS_PSK_WITH_AES_128_GCM_SHA256 :
1697        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1698        specs->cipher_type           = aead;
1699        specs->mac_algorithm         = sha256_mac;
1700        specs->kea                   = psk_kea;
1701        specs->sig_algo              = anonymous_sa_algo;
1702        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1703        specs->pad_size              = PAD_SHA;
1704        specs->static_ecdh           = 0;
1705        specs->key_size              = AES_128_KEY_SIZE;
1706        specs->block_size            = WC_AES_BLOCK_SIZE;
1707        specs->iv_size               = AESGCM_IMP_IV_SZ;
1708        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1709
1710        if (opts != NULL)
1711            opts->usingPSK_cipher    = 1;
1712        break;
1713#endif
1714
1715#ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
1716    case TLS_PSK_WITH_AES_256_GCM_SHA384 :
1717        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1718        specs->cipher_type           = aead;
1719        specs->mac_algorithm         = sha384_mac;
1720        specs->kea                   = psk_kea;
1721        specs->sig_algo              = anonymous_sa_algo;
1722        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1723        specs->pad_size              = PAD_SHA;
1724        specs->static_ecdh           = 0;
1725        specs->key_size              = AES_256_KEY_SIZE;
1726        specs->block_size            = WC_AES_BLOCK_SIZE;
1727        specs->iv_size               = AESGCM_IMP_IV_SZ;
1728        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1729
1730        if (opts != NULL)
1731            opts->usingPSK_cipher    = 1;
1732        break;
1733#endif
1734
1735#ifdef BUILD_TLS_DH_anon_WITH_AES_256_GCM_SHA384
1736    case TLS_DH_anon_WITH_AES_256_GCM_SHA384:
1737        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1738        specs->cipher_type           = aead;
1739        specs->mac_algorithm         = sha384_mac;
1740        specs->kea                   = diffie_hellman_kea;
1741        specs->sig_algo              = anonymous_sa_algo;
1742        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1743        specs->pad_size              = PAD_SHA;
1744        specs->static_ecdh           = 0;
1745        specs->key_size              = AES_256_KEY_SIZE;
1746        specs->block_size            = WC_AES_BLOCK_SIZE;
1747        specs->iv_size               = AESGCM_IMP_IV_SZ;
1748        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1749
1750        if (opts != NULL)
1751            opts->usingAnon_cipher   = 1;
1752        break;
1753#endif
1754
1755#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
1756    case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
1757        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1758        specs->cipher_type           = aead;
1759        specs->mac_algorithm         = sha256_mac;
1760        specs->kea                   = dhe_psk_kea;
1761        specs->sig_algo              = anonymous_sa_algo;
1762        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1763        specs->pad_size              = PAD_SHA;
1764        specs->static_ecdh           = 0;
1765        specs->key_size              = AES_128_KEY_SIZE;
1766        specs->block_size            = WC_AES_BLOCK_SIZE;
1767        specs->iv_size               = AESGCM_IMP_IV_SZ;
1768        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1769
1770        if (opts != NULL)
1771            opts->usingPSK_cipher    = 1;
1772        break;
1773#endif
1774
1775#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
1776    case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
1777        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
1778        specs->cipher_type           = aead;
1779        specs->mac_algorithm         = sha384_mac;
1780        specs->kea                   = dhe_psk_kea;
1781        specs->sig_algo              = anonymous_sa_algo;
1782        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1783        specs->pad_size              = PAD_SHA;
1784        specs->static_ecdh           = 0;
1785        specs->key_size              = AES_256_KEY_SIZE;
1786        specs->block_size            = WC_AES_BLOCK_SIZE;
1787        specs->iv_size               = AESGCM_IMP_IV_SZ;
1788        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
1789
1790        if (opts != NULL)
1791            opts->usingPSK_cipher    = 1;
1792        break;
1793#endif
1794
1795#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
1796    case TLS_PSK_WITH_AES_128_CBC_SHA256 :
1797        specs->bulk_cipher_algorithm = wolfssl_aes;
1798        specs->cipher_type           = block;
1799        specs->mac_algorithm         = sha256_mac;
1800        specs->kea                   = psk_kea;
1801        specs->sig_algo              = anonymous_sa_algo;
1802        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1803        specs->pad_size              = PAD_SHA;
1804        specs->static_ecdh           = 0;
1805        specs->key_size              = AES_128_KEY_SIZE;
1806        specs->block_size            = WC_AES_BLOCK_SIZE;
1807        specs->iv_size               = AES_IV_SIZE;
1808
1809        if (opts != NULL)
1810            opts->usingPSK_cipher    = 1;
1811        break;
1812#endif
1813
1814#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
1815    case TLS_PSK_WITH_AES_256_CBC_SHA384 :
1816        specs->bulk_cipher_algorithm = wolfssl_aes;
1817        specs->cipher_type           = block;
1818        specs->mac_algorithm         = sha384_mac;
1819        specs->kea                   = psk_kea;
1820        specs->sig_algo              = anonymous_sa_algo;
1821        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1822        specs->pad_size              = PAD_SHA;
1823        specs->static_ecdh           = 0;
1824        specs->key_size              = AES_256_KEY_SIZE;
1825        specs->block_size            = WC_AES_BLOCK_SIZE;
1826        specs->iv_size               = AES_IV_SIZE;
1827
1828        if (opts != NULL)
1829            opts->usingPSK_cipher    = 1;
1830        break;
1831#endif
1832
1833#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1834    case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
1835        specs->bulk_cipher_algorithm = wolfssl_aes;
1836        specs->cipher_type           = block;
1837        specs->mac_algorithm         = sha256_mac;
1838        specs->kea                   = dhe_psk_kea;
1839        specs->sig_algo              = anonymous_sa_algo;
1840        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1841        specs->pad_size              = PAD_SHA;
1842        specs->static_ecdh           = 0;
1843        specs->key_size              = AES_128_KEY_SIZE;
1844        specs->block_size            = WC_AES_BLOCK_SIZE;
1845        specs->iv_size               = AES_IV_SIZE;
1846
1847        if (opts != NULL)
1848            opts->usingPSK_cipher    = 1;
1849        break;
1850#endif
1851
1852#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1853    case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
1854        specs->bulk_cipher_algorithm = wolfssl_aes;
1855        specs->cipher_type           = block;
1856        specs->mac_algorithm         = sha384_mac;
1857        specs->kea                   = dhe_psk_kea;
1858        specs->sig_algo              = anonymous_sa_algo;
1859        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1860        specs->pad_size              = PAD_SHA;
1861        specs->static_ecdh           = 0;
1862        specs->key_size              = AES_256_KEY_SIZE;
1863        specs->block_size            = WC_AES_BLOCK_SIZE;
1864        specs->iv_size               = AES_IV_SIZE;
1865
1866        if (opts != NULL)
1867            opts->usingPSK_cipher    = 1;
1868        break;
1869#endif
1870
1871#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
1872    case TLS_PSK_WITH_AES_128_CBC_SHA :
1873        specs->bulk_cipher_algorithm = wolfssl_aes;
1874        specs->cipher_type           = block;
1875        specs->mac_algorithm         = sha_mac;
1876        specs->kea                   = psk_kea;
1877        specs->sig_algo              = anonymous_sa_algo;
1878        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1879        specs->pad_size              = PAD_SHA;
1880        specs->static_ecdh           = 0;
1881        specs->key_size              = AES_128_KEY_SIZE;
1882        specs->block_size            = WC_AES_BLOCK_SIZE;
1883        specs->iv_size               = AES_IV_SIZE;
1884
1885        if (opts != NULL)
1886            opts->usingPSK_cipher    = 1;
1887        break;
1888#endif
1889
1890#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
1891    case TLS_PSK_WITH_AES_256_CBC_SHA :
1892        specs->bulk_cipher_algorithm = wolfssl_aes;
1893        specs->cipher_type           = block;
1894        specs->mac_algorithm         = sha_mac;
1895        specs->kea                   = psk_kea;
1896        specs->sig_algo              = anonymous_sa_algo;
1897        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1898        specs->pad_size              = PAD_SHA;
1899        specs->static_ecdh           = 0;
1900        specs->key_size              = AES_256_KEY_SIZE;
1901        specs->block_size            = WC_AES_BLOCK_SIZE;
1902        specs->iv_size               = AES_IV_SIZE;
1903
1904        if (opts != NULL)
1905            opts->usingPSK_cipher    = 1;
1906        break;
1907#endif
1908
1909#ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
1910    case TLS_PSK_WITH_NULL_SHA256 :
1911        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1912        specs->cipher_type           = stream;
1913        specs->mac_algorithm         = sha256_mac;
1914        specs->kea                   = psk_kea;
1915        specs->sig_algo              = anonymous_sa_algo;
1916        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1917        specs->pad_size              = PAD_SHA;
1918        specs->static_ecdh           = 0;
1919        specs->key_size              = 0;
1920        specs->block_size            = 0;
1921        specs->iv_size               = 0;
1922
1923        if (opts != NULL)
1924            opts->usingPSK_cipher    = 1;
1925        break;
1926#endif
1927
1928#ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
1929    case TLS_PSK_WITH_NULL_SHA384 :
1930        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1931        specs->cipher_type           = stream;
1932        specs->mac_algorithm         = sha384_mac;
1933        specs->kea                   = psk_kea;
1934        specs->sig_algo              = anonymous_sa_algo;
1935        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1936        specs->pad_size              = PAD_SHA;
1937        specs->static_ecdh           = 0;
1938        specs->key_size              = 0;
1939        specs->block_size            = 0;
1940        specs->iv_size               = 0;
1941
1942        if (opts != NULL)
1943            opts->usingPSK_cipher    = 1;
1944        break;
1945#endif
1946
1947#ifdef BUILD_TLS_PSK_WITH_NULL_SHA
1948    case TLS_PSK_WITH_NULL_SHA :
1949        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1950        specs->cipher_type           = stream;
1951        specs->mac_algorithm         = sha_mac;
1952        specs->kea                   = psk_kea;
1953        specs->sig_algo              = anonymous_sa_algo;
1954        specs->hash_size             = WC_SHA_DIGEST_SIZE;
1955        specs->pad_size              = PAD_SHA;
1956        specs->static_ecdh           = 0;
1957        specs->key_size              = 0;
1958        specs->block_size            = 0;
1959        specs->iv_size               = 0;
1960
1961        if (opts != NULL)
1962            opts->usingPSK_cipher    = 1;
1963        break;
1964#endif
1965
1966#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
1967    case TLS_DHE_PSK_WITH_NULL_SHA256 :
1968        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1969        specs->cipher_type           = stream;
1970        specs->mac_algorithm         = sha256_mac;
1971        specs->kea                   = dhe_psk_kea;
1972        specs->sig_algo              = anonymous_sa_algo;
1973        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
1974        specs->pad_size              = PAD_SHA;
1975        specs->static_ecdh           = 0;
1976        specs->key_size              = 0;
1977        specs->block_size            = 0;
1978        specs->iv_size               = 0;
1979
1980        if (opts != NULL)
1981            opts->usingPSK_cipher    = 1;
1982        break;
1983#endif
1984
1985#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
1986    case TLS_DHE_PSK_WITH_NULL_SHA384 :
1987        specs->bulk_cipher_algorithm = wolfssl_cipher_null;
1988        specs->cipher_type           = stream;
1989        specs->mac_algorithm         = sha384_mac;
1990        specs->kea                   = dhe_psk_kea;
1991        specs->sig_algo              = anonymous_sa_algo;
1992        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
1993        specs->pad_size              = PAD_SHA;
1994        specs->static_ecdh           = 0;
1995        specs->key_size              = 0;
1996        specs->block_size            = 0;
1997        specs->iv_size               = 0;
1998
1999        if (opts != NULL)
2000            opts->usingPSK_cipher    = 1;
2001        break;
2002#endif
2003
2004#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
2005    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
2006        specs->bulk_cipher_algorithm = wolfssl_aes;
2007        specs->cipher_type           = block;
2008        specs->mac_algorithm         = sha256_mac;
2009        specs->kea                   = diffie_hellman_kea;
2010        specs->sig_algo              = rsa_sa_algo;
2011        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2012        specs->pad_size              = PAD_SHA;
2013        specs->static_ecdh           = 0;
2014        specs->key_size              = AES_128_KEY_SIZE;
2015        specs->block_size            = WC_AES_BLOCK_SIZE;
2016        specs->iv_size               = AES_IV_SIZE;
2017
2018        break;
2019#endif
2020
2021#ifdef BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
2022    case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA :
2023        specs->bulk_cipher_algorithm = wolfssl_triple_des;
2024        specs->cipher_type           = block;
2025        specs->mac_algorithm         = sha_mac;
2026        specs->kea                   = diffie_hellman_kea;
2027        specs->sig_algo              = rsa_sa_algo;
2028        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2029        specs->pad_size              = PAD_SHA;
2030        specs->static_ecdh           = 0;
2031        specs->key_size              = DES3_KEY_SIZE;
2032        specs->block_size            = DES_BLOCK_SIZE;
2033        specs->iv_size               = DES_IV_SIZE;
2034
2035        break;
2036#endif
2037
2038#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
2039    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
2040        specs->bulk_cipher_algorithm = wolfssl_aes;
2041        specs->cipher_type           = block;
2042        specs->mac_algorithm         = sha256_mac;
2043        specs->kea                   = diffie_hellman_kea;
2044        specs->sig_algo              = rsa_sa_algo;
2045        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2046        specs->pad_size              = PAD_SHA;
2047        specs->static_ecdh           = 0;
2048        specs->key_size              = AES_256_KEY_SIZE;
2049        specs->block_size            = WC_AES_BLOCK_SIZE;
2050        specs->iv_size               = AES_IV_SIZE;
2051
2052        break;
2053#endif
2054
2055#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
2056    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
2057        specs->bulk_cipher_algorithm = wolfssl_aes;
2058        specs->cipher_type           = block;
2059        specs->mac_algorithm         = sha_mac;
2060        specs->kea                   = diffie_hellman_kea;
2061        specs->sig_algo              = rsa_sa_algo;
2062        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2063        specs->pad_size              = PAD_SHA;
2064        specs->static_ecdh           = 0;
2065        specs->key_size              = AES_128_KEY_SIZE;
2066        specs->block_size            = WC_AES_BLOCK_SIZE;
2067        specs->iv_size               = AES_IV_SIZE;
2068
2069        break;
2070#endif
2071
2072#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
2073    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
2074        specs->bulk_cipher_algorithm = wolfssl_aes;
2075        specs->cipher_type           = block;
2076        specs->mac_algorithm         = sha_mac;
2077        specs->kea                   = diffie_hellman_kea;
2078        specs->sig_algo              = rsa_sa_algo;
2079        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2080        specs->pad_size              = PAD_SHA;
2081        specs->static_ecdh           = 0;
2082        specs->key_size              = AES_256_KEY_SIZE;
2083        specs->block_size            = WC_AES_BLOCK_SIZE;
2084        specs->iv_size               = AES_IV_SIZE;
2085
2086        break;
2087#endif
2088
2089#ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
2090    case TLS_RSA_WITH_AES_128_GCM_SHA256 :
2091        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
2092        specs->cipher_type           = aead;
2093        specs->mac_algorithm         = sha256_mac;
2094        specs->kea                   = rsa_kea;
2095        specs->sig_algo              = rsa_sa_algo;
2096        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2097        specs->pad_size              = PAD_SHA;
2098        specs->static_ecdh           = 0;
2099        specs->key_size              = AES_128_KEY_SIZE;
2100        specs->block_size            = WC_AES_BLOCK_SIZE;
2101        specs->iv_size               = AESGCM_IMP_IV_SZ;
2102        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
2103
2104        break;
2105#endif
2106
2107#ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
2108    case TLS_RSA_WITH_AES_256_GCM_SHA384 :
2109        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
2110        specs->cipher_type           = aead;
2111        specs->mac_algorithm         = sha384_mac;
2112        specs->kea                   = rsa_kea;
2113        specs->sig_algo              = rsa_sa_algo;
2114        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
2115        specs->pad_size              = PAD_SHA;
2116        specs->static_ecdh           = 0;
2117        specs->key_size              = AES_256_KEY_SIZE;
2118        specs->block_size            = WC_AES_BLOCK_SIZE;
2119        specs->iv_size               = AESGCM_IMP_IV_SZ;
2120        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
2121
2122        break;
2123#endif
2124
2125#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
2126    case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
2127        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
2128        specs->cipher_type           = aead;
2129        specs->mac_algorithm         = sha256_mac;
2130        specs->kea                   = diffie_hellman_kea;
2131        specs->sig_algo              = rsa_sa_algo;
2132        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2133        specs->pad_size              = PAD_SHA;
2134        specs->static_ecdh           = 0;
2135        specs->key_size              = AES_128_KEY_SIZE;
2136        specs->block_size            = WC_AES_BLOCK_SIZE;
2137        specs->iv_size               = AESGCM_IMP_IV_SZ;
2138        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
2139
2140        break;
2141#endif
2142
2143#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
2144    case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
2145        specs->bulk_cipher_algorithm = wolfssl_aes_gcm;
2146        specs->cipher_type           = aead;
2147        specs->mac_algorithm         = sha384_mac;
2148        specs->kea                   = diffie_hellman_kea;
2149        specs->sig_algo              = rsa_sa_algo;
2150        specs->hash_size             = WC_SHA384_DIGEST_SIZE;
2151        specs->pad_size              = PAD_SHA;
2152        specs->static_ecdh           = 0;
2153        specs->key_size              = AES_256_KEY_SIZE;
2154        specs->block_size            = WC_AES_BLOCK_SIZE;
2155        specs->iv_size               = AESGCM_IMP_IV_SZ;
2156        specs->aead_mac_size         = AES_GCM_AUTH_SZ;
2157
2158        break;
2159#endif
2160
2161#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
2162    case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA :
2163        specs->bulk_cipher_algorithm = wolfssl_camellia;
2164        specs->cipher_type           = block;
2165        specs->mac_algorithm         = sha_mac;
2166        specs->kea                   = rsa_kea;
2167        specs->sig_algo              = rsa_sa_algo;
2168        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2169        specs->pad_size              = PAD_SHA;
2170        specs->static_ecdh           = 0;
2171        specs->key_size              = CAMELLIA_128_KEY_SIZE;
2172        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2173        specs->iv_size               = CAMELLIA_IV_SIZE;
2174
2175        break;
2176#endif
2177
2178#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
2179    case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA :
2180        specs->bulk_cipher_algorithm = wolfssl_camellia;
2181        specs->cipher_type           = block;
2182        specs->mac_algorithm         = sha_mac;
2183        specs->kea                   = rsa_kea;
2184        specs->sig_algo              = rsa_sa_algo;
2185        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2186        specs->pad_size              = PAD_SHA;
2187        specs->static_ecdh           = 0;
2188        specs->key_size              = CAMELLIA_256_KEY_SIZE;
2189        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2190        specs->iv_size               = CAMELLIA_IV_SIZE;
2191
2192        break;
2193#endif
2194
2195#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
2196    case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
2197        specs->bulk_cipher_algorithm = wolfssl_camellia;
2198        specs->cipher_type           = block;
2199        specs->mac_algorithm         = sha256_mac;
2200        specs->kea                   = rsa_kea;
2201        specs->sig_algo              = rsa_sa_algo;
2202        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2203        specs->pad_size              = PAD_SHA;
2204        specs->static_ecdh           = 0;
2205        specs->key_size              = CAMELLIA_128_KEY_SIZE;
2206        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2207        specs->iv_size               = CAMELLIA_IV_SIZE;
2208
2209        break;
2210#endif
2211
2212#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
2213    case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
2214        specs->bulk_cipher_algorithm = wolfssl_camellia;
2215        specs->cipher_type           = block;
2216        specs->mac_algorithm         = sha256_mac;
2217        specs->kea                   = rsa_kea;
2218        specs->sig_algo              = rsa_sa_algo;
2219        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2220        specs->pad_size              = PAD_SHA;
2221        specs->static_ecdh           = 0;
2222        specs->key_size              = CAMELLIA_256_KEY_SIZE;
2223        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2224        specs->iv_size               = CAMELLIA_IV_SIZE;
2225
2226        break;
2227#endif
2228
2229#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
2230    case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA :
2231        specs->bulk_cipher_algorithm = wolfssl_camellia;
2232        specs->cipher_type           = block;
2233        specs->mac_algorithm         = sha_mac;
2234        specs->kea                   = diffie_hellman_kea;
2235        specs->sig_algo              = rsa_sa_algo;
2236        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2237        specs->pad_size              = PAD_SHA;
2238        specs->static_ecdh           = 0;
2239        specs->key_size              = CAMELLIA_128_KEY_SIZE;
2240        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2241        specs->iv_size               = CAMELLIA_IV_SIZE;
2242
2243        break;
2244#endif
2245
2246#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
2247    case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA :
2248        specs->bulk_cipher_algorithm = wolfssl_camellia;
2249        specs->cipher_type           = block;
2250        specs->mac_algorithm         = sha_mac;
2251        specs->kea                   = diffie_hellman_kea;
2252        specs->sig_algo              = rsa_sa_algo;
2253        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2254        specs->pad_size              = PAD_SHA;
2255        specs->static_ecdh           = 0;
2256        specs->key_size              = CAMELLIA_256_KEY_SIZE;
2257        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2258        specs->iv_size               = CAMELLIA_IV_SIZE;
2259
2260        break;
2261#endif
2262
2263#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
2264    case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
2265        specs->bulk_cipher_algorithm = wolfssl_camellia;
2266        specs->cipher_type           = block;
2267        specs->mac_algorithm         = sha256_mac;
2268        specs->kea                   = diffie_hellman_kea;
2269        specs->sig_algo              = rsa_sa_algo;
2270        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2271        specs->pad_size              = PAD_SHA;
2272        specs->static_ecdh           = 0;
2273        specs->key_size              = CAMELLIA_128_KEY_SIZE;
2274        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2275        specs->iv_size               = CAMELLIA_IV_SIZE;
2276
2277        break;
2278#endif
2279
2280#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
2281    case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
2282        specs->bulk_cipher_algorithm = wolfssl_camellia;
2283        specs->cipher_type           = block;
2284        specs->mac_algorithm         = sha256_mac;
2285        specs->kea                   = diffie_hellman_kea;
2286        specs->sig_algo              = rsa_sa_algo;
2287        specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2288        specs->pad_size              = PAD_SHA;
2289        specs->static_ecdh           = 0;
2290        specs->key_size              = CAMELLIA_256_KEY_SIZE;
2291        specs->block_size            = WC_CAMELLIA_BLOCK_SIZE;
2292        specs->iv_size               = CAMELLIA_IV_SIZE;
2293
2294        break;
2295#endif
2296
2297#ifdef BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
2298    case TLS_DH_anon_WITH_AES_128_CBC_SHA :
2299        specs->bulk_cipher_algorithm = wolfssl_aes;
2300        specs->cipher_type           = block;
2301        specs->mac_algorithm         = sha_mac;
2302        specs->kea                   = diffie_hellman_kea;
2303        specs->sig_algo              = anonymous_sa_algo;
2304        specs->hash_size             = WC_SHA_DIGEST_SIZE;
2305        specs->pad_size              = PAD_SHA;
2306        specs->static_ecdh           = 0;
2307        specs->key_size              = AES_128_KEY_SIZE;
2308        specs->block_size            = WC_AES_BLOCK_SIZE;
2309        specs->iv_size               = AES_IV_SIZE;
2310
2311        if (opts != NULL)
2312            opts->usingAnon_cipher   = 1;
2313        break;
2314#endif
2315
2316#ifdef BUILD_WDM_WITH_NULL_SHA256
2317        case WDM_WITH_NULL_SHA256 :
2318            specs->bulk_cipher_algorithm = wolfssl_cipher_null;
2319            specs->cipher_type           = stream;
2320            specs->mac_algorithm         = sha256_mac;
2321            specs->kea                   = no_kea;
2322            specs->sig_algo              = anonymous_sa_algo;
2323            specs->hash_size             = WC_SHA256_DIGEST_SIZE;
2324            specs->pad_size              = PAD_SHA;
2325
2326            break;
2327#endif
2328
2329    default:
2330        WOLFSSL_MSG("Unsupported cipher suite, SetCipherSpecs");
2331        WOLFSSL_ERROR_VERBOSE(UNSUPPORTED_SUITE);
2332        return UNSUPPORTED_SUITE;
2333    }  /* switch */
2334    }  /* if ECC / Normal suites else */
2335
2336    if (specs->sig_algo == anonymous_sa_algo && opts != NULL) {
2337        /* CLIENT/SERVER: No peer authentication to be performed. */
2338        opts->peerAuthGood = 1;
2339    }
2340
2341    return 0;
2342}
2343
2344
2345enum KeyStuff {
2346    MASTER_ROUNDS = 3,
2347    PREFIX        = 3,     /* up to three letters for master prefix */
2348    KEY_PREFIX    = 9      /* up to 9 prefix letters for key rounds */
2349
2350
2351};
2352
2353#ifndef NO_OLD_TLS
2354/* true or false, zero for error */
2355static int SetPrefix(byte* sha_input, int idx)
2356{
2357    switch (idx) {
2358    case 0:
2359        XMEMCPY(sha_input, "A", 1);
2360        break;
2361    case 1:
2362        XMEMCPY(sha_input, "BB", 2);
2363        break;
2364    case 2:
2365        XMEMCPY(sha_input, "CCC", 3);
2366        break;
2367    case 3:
2368        XMEMCPY(sha_input, "DDDD", 4);
2369        break;
2370    case 4:
2371        XMEMCPY(sha_input, "EEEEE", 5);
2372        break;
2373    case 5:
2374        XMEMCPY(sha_input, "FFFFFF", 6);
2375        break;
2376    case 6:
2377        XMEMCPY(sha_input, "GGGGGGG", 7);
2378        break;
2379    case 7:
2380        XMEMCPY(sha_input, "HHHHHHHH", 8);
2381        break;
2382    case 8:
2383        XMEMCPY(sha_input, "IIIIIIIII", 9);
2384        break;
2385    default:
2386        WOLFSSL_MSG("Set Prefix error, bad input");
2387        return 0;
2388    }
2389    return 1;
2390}
2391#endif
2392
2393
2394int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
2395                   int side, void* heap, int devId, WC_RNG* rng, int tls13)
2396{
2397    (void)rng;
2398    (void)tls13;
2399
2400#ifdef BUILD_ARC4
2401    if (specs->bulk_cipher_algorithm == wolfssl_rc4) {
2402        word32 sz = specs->key_size;
2403        if (enc && enc->arc4 == NULL) {
2404            enc->arc4 = (Arc4*)XMALLOC(sizeof(Arc4), heap, DYNAMIC_TYPE_CIPHER);
2405            if (enc->arc4 == NULL)
2406                 return MEMORY_E;
2407        }
2408        if (dec && dec->arc4 == NULL) {
2409            dec->arc4 = (Arc4*)XMALLOC(sizeof(Arc4), heap, DYNAMIC_TYPE_CIPHER);
2410            if (dec->arc4 == NULL)
2411                return MEMORY_E;
2412        }
2413
2414        if (enc) {
2415            if (wc_Arc4Init(enc->arc4, heap, devId) != 0) {
2416                WOLFSSL_MSG("Arc4Init failed in SetKeys");
2417                return ASYNC_INIT_E;
2418            }
2419        }
2420        if (dec) {
2421            if (wc_Arc4Init(dec->arc4, heap, devId) != 0) {
2422                WOLFSSL_MSG("Arc4Init failed in SetKeys");
2423                return ASYNC_INIT_E;
2424            }
2425        }
2426
2427        if (side == WOLFSSL_CLIENT_END) {
2428            if (enc)
2429                wc_Arc4SetKey(enc->arc4, keys->client_write_key, sz);
2430            if (dec)
2431                wc_Arc4SetKey(dec->arc4, keys->server_write_key, sz);
2432        }
2433        else {
2434            if (enc)
2435                wc_Arc4SetKey(enc->arc4, keys->server_write_key, sz);
2436            if (dec)
2437                wc_Arc4SetKey(dec->arc4, keys->client_write_key, sz);
2438        }
2439        if (enc)
2440            enc->setup = 1;
2441        if (dec)
2442            dec->setup = 1;
2443    }
2444#endif /* BUILD_ARC4 */
2445
2446
2447#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_CHAPOL_AEAD)
2448    /* Check that the max implicit iv size is sufficient */
2449    #if (AEAD_MAX_IMP_SZ < 12) /* CHACHA20_IMP_IV_SZ */
2450        #error AEAD_MAX_IMP_SZ is too small for ChaCha20
2451    #endif
2452    #if (MAX_WRITE_IV_SZ < 12) /* CHACHA20_IMP_IV_SZ */
2453        #error MAX_WRITE_IV_SZ is too small for ChaCha20
2454    #endif
2455
2456    if (specs->bulk_cipher_algorithm == wolfssl_chacha) {
2457        int chachaRet;
2458        if (enc && enc->chacha == NULL)
2459            enc->chacha =
2460                    (ChaCha*)XMALLOC(sizeof(ChaCha), heap, DYNAMIC_TYPE_CIPHER);
2461        if (enc && enc->chacha == NULL)
2462            return MEMORY_E;
2463    #ifdef WOLFSSL_CHECK_MEM_ZERO
2464        if (enc) {
2465            wc_MemZero_Add("SSL keys enc chacha", enc->chacha, sizeof(ChaCha));
2466        }
2467    #endif
2468        if (dec && dec->chacha == NULL)
2469            dec->chacha =
2470                    (ChaCha*)XMALLOC(sizeof(ChaCha), heap, DYNAMIC_TYPE_CIPHER);
2471        if (dec && dec->chacha == NULL)
2472            return MEMORY_E;
2473    #ifdef WOLFSSL_CHECK_MEM_ZERO
2474        if (dec) {
2475            wc_MemZero_Add("SSL keys dec chacha", dec->chacha, sizeof(ChaCha));
2476        }
2477    #endif
2478        if (side == WOLFSSL_CLIENT_END) {
2479            if (enc) {
2480                chachaRet = wc_Chacha_SetKey(enc->chacha, keys->client_write_key,
2481                                          specs->key_size);
2482                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
2483                        CHACHA20_IMP_IV_SZ);
2484                if (chachaRet != 0) return chachaRet;
2485            }
2486            if (dec) {
2487                chachaRet = wc_Chacha_SetKey(dec->chacha, keys->server_write_key,
2488                                          specs->key_size);
2489                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
2490                        CHACHA20_IMP_IV_SZ);
2491                if (chachaRet != 0) return chachaRet;
2492            }
2493        }
2494        else {
2495            if (enc) {
2496                chachaRet = wc_Chacha_SetKey(enc->chacha, keys->server_write_key,
2497                                          specs->key_size);
2498                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
2499                        CHACHA20_IMP_IV_SZ);
2500                if (chachaRet != 0) return chachaRet;
2501            }
2502            if (dec) {
2503                chachaRet = wc_Chacha_SetKey(dec->chacha, keys->client_write_key,
2504                                          specs->key_size);
2505                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
2506                        CHACHA20_IMP_IV_SZ);
2507                if (chachaRet != 0) return chachaRet;
2508            }
2509        }
2510
2511        if (enc)
2512            enc->setup = 1;
2513        if (dec)
2514            dec->setup = 1;
2515    }
2516#endif /* HAVE_CHACHA && HAVE_POLY1305 */
2517
2518#ifdef BUILD_DES3
2519    /* check that buffer sizes are sufficient */
2520    #if (MAX_WRITE_IV_SZ < 8) /* DES_IV_SIZE */
2521        #error MAX_WRITE_IV_SZ too small for 3DES
2522    #endif
2523
2524    if (specs->bulk_cipher_algorithm == wolfssl_triple_des) {
2525        int desRet = 0;
2526
2527        if (enc) {
2528            if (enc->des3 == NULL)
2529                enc->des3 = (Des3*)XMALLOC(sizeof(Des3), heap, DYNAMIC_TYPE_CIPHER);
2530            if (enc->des3 == NULL)
2531                return MEMORY_E;
2532            XMEMSET(enc->des3, 0, sizeof(Des3));
2533        }
2534        if (dec) {
2535            if (dec->des3 == NULL)
2536                dec->des3 = (Des3*)XMALLOC(sizeof(Des3), heap, DYNAMIC_TYPE_CIPHER);
2537            if (dec->des3 == NULL)
2538                return MEMORY_E;
2539            XMEMSET(dec->des3, 0, sizeof(Des3));
2540        }
2541
2542        if (enc) {
2543            if (wc_Des3Init(enc->des3, heap, devId) != 0) {
2544                WOLFSSL_MSG("Des3Init failed in SetKeys");
2545                return ASYNC_INIT_E;
2546            }
2547        }
2548        if (dec) {
2549            if (wc_Des3Init(dec->des3, heap, devId) != 0) {
2550                WOLFSSL_MSG("Des3Init failed in SetKeys");
2551                return ASYNC_INIT_E;
2552            }
2553        }
2554
2555        if (side == WOLFSSL_CLIENT_END) {
2556            if (enc) {
2557                desRet = wc_Des3_SetKey(enc->des3, keys->client_write_key,
2558                                     keys->client_write_IV, DES_ENCRYPTION);
2559                if (desRet != 0) return desRet;
2560            }
2561            if (dec) {
2562                desRet = wc_Des3_SetKey(dec->des3, keys->server_write_key,
2563                                     keys->server_write_IV, DES_DECRYPTION);
2564                if (desRet != 0) return desRet;
2565            }
2566        }
2567        else {
2568            if (enc) {
2569                desRet = wc_Des3_SetKey(enc->des3, keys->server_write_key,
2570                                     keys->server_write_IV, DES_ENCRYPTION);
2571                if (desRet != 0) return desRet;
2572            }
2573            if (dec) {
2574                desRet = wc_Des3_SetKey(dec->des3, keys->client_write_key,
2575                                     keys->client_write_IV, DES_DECRYPTION);
2576                if (desRet != 0) return desRet;
2577            }
2578        }
2579        if (enc)
2580            enc->setup = 1;
2581        if (dec)
2582            dec->setup = 1;
2583    }
2584#endif /* BUILD_DES3 */
2585
2586#ifdef BUILD_AES
2587    /* check that buffer sizes are sufficient */
2588    #if (MAX_WRITE_IV_SZ < 16) /* AES_IV_SIZE */
2589        #error MAX_WRITE_IV_SZ too small for AES
2590    #endif
2591
2592    if (specs->bulk_cipher_algorithm == wolfssl_aes) {
2593        int aesRet = 0;
2594
2595        if (enc) {
2596            if (enc->aes == NULL) {
2597                enc->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2598                if (enc->aes == NULL)
2599                    return MEMORY_E;
2600            } else {
2601                wc_AesFree(enc->aes);
2602            }
2603
2604            XMEMSET(enc->aes, 0, sizeof(Aes));
2605        }
2606        if (dec) {
2607            if (dec->aes == NULL) {
2608                dec->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2609                if (dec->aes == NULL)
2610                    return MEMORY_E;
2611            } else {
2612                wc_AesFree(dec->aes);
2613            }
2614
2615            XMEMSET(dec->aes, 0, sizeof(Aes));
2616        }
2617        if (enc) {
2618            if (wc_AesInit(enc->aes, heap, devId) != 0) {
2619                WOLFSSL_MSG("AesInit failed in SetKeys");
2620                return ASYNC_INIT_E;
2621            }
2622        }
2623        if (dec) {
2624            if (wc_AesInit(dec->aes, heap, devId) != 0) {
2625                WOLFSSL_MSG("AesInit failed in SetKeys");
2626                return ASYNC_INIT_E;
2627            }
2628        }
2629
2630        if (side == WOLFSSL_CLIENT_END) {
2631            if (enc) {
2632                aesRet = wc_AesSetKey(enc->aes, keys->client_write_key,
2633                                   specs->key_size, keys->client_write_IV,
2634                                   AES_ENCRYPTION);
2635                if (aesRet != 0) return aesRet;
2636            }
2637            if (dec) {
2638                aesRet = wc_AesSetKey(dec->aes, keys->server_write_key,
2639                                   specs->key_size, keys->server_write_IV,
2640                                   AES_DECRYPTION);
2641                if (aesRet != 0) return aesRet;
2642            }
2643        }
2644        else {
2645            if (enc) {
2646                aesRet = wc_AesSetKey(enc->aes, keys->server_write_key,
2647                                   specs->key_size, keys->server_write_IV,
2648                                   AES_ENCRYPTION);
2649                if (aesRet != 0) return aesRet;
2650            }
2651            if (dec) {
2652                aesRet = wc_AesSetKey(dec->aes, keys->client_write_key,
2653                                   specs->key_size, keys->client_write_IV,
2654                                   AES_DECRYPTION);
2655                if (aesRet != 0) return aesRet;
2656            }
2657        }
2658        if (enc)
2659            enc->setup = 1;
2660        if (dec)
2661            dec->setup = 1;
2662    }
2663#endif /* BUILD_AES */
2664
2665#ifdef BUILD_AESGCM
2666    /* check that buffer sizes are sufficient */
2667    #if (AEAD_MAX_IMP_SZ < 4) /* AESGCM_IMP_IV_SZ */
2668        #error AEAD_MAX_IMP_SZ too small for AESGCM
2669    #endif
2670    #if (AEAD_MAX_EXP_SZ < 8) /* AESGCM_EXP_IV_SZ */
2671        #error AEAD_MAX_EXP_SZ too small for AESGCM
2672    #endif
2673    #if (MAX_WRITE_IV_SZ < 4) /* AESGCM_IMP_IV_SZ */
2674        #error MAX_WRITE_IV_SZ too small for AESGCM
2675    #endif
2676
2677    if (specs->bulk_cipher_algorithm == wolfssl_aes_gcm) {
2678        int gcmRet;
2679
2680        if (enc) {
2681            if (enc->aes == NULL) {
2682                enc->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2683                if (enc->aes == NULL)
2684                    return MEMORY_E;
2685            } else {
2686                wc_AesFree(enc->aes);
2687            }
2688
2689            XMEMSET(enc->aes, 0, sizeof(Aes));
2690        }
2691        if (dec) {
2692            if (dec->aes == NULL) {
2693                dec->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2694                if (dec->aes == NULL)
2695                    return MEMORY_E;
2696            } else {
2697                wc_AesFree(dec->aes);
2698            }
2699
2700            XMEMSET(dec->aes, 0, sizeof(Aes));
2701        }
2702
2703        if (enc) {
2704            if (wc_AesInit(enc->aes, heap, devId) != 0) {
2705                WOLFSSL_MSG("AesInit failed in SetKeys");
2706                return ASYNC_INIT_E;
2707            }
2708        }
2709        if (dec) {
2710            if (wc_AesInit(dec->aes, heap, devId) != 0) {
2711                WOLFSSL_MSG("AesInit failed in SetKeys");
2712                return ASYNC_INIT_E;
2713            }
2714        }
2715
2716        if (side == WOLFSSL_CLIENT_END) {
2717            if (enc) {
2718                gcmRet = wc_AesGcmSetKey(enc->aes, keys->client_write_key,
2719                                      specs->key_size);
2720                if (gcmRet != 0) return gcmRet;
2721                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
2722                        AEAD_MAX_IMP_SZ);
2723#if !defined(NO_PUBLIC_GCM_SET_IV) && \
2724    ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
2725    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
2726                if (!tls13) {
2727                    gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ,
2728                            keys->client_write_IV, AESGCM_IMP_IV_SZ, rng);
2729                    if (gcmRet != 0) return gcmRet;
2730                }
2731#endif
2732            }
2733            if (dec) {
2734                gcmRet = wc_AesGcmSetKey(dec->aes, keys->server_write_key,
2735                                      specs->key_size);
2736                if (gcmRet != 0) return gcmRet;
2737                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
2738                        AEAD_MAX_IMP_SZ);
2739            }
2740        }
2741        else {
2742            if (enc) {
2743                gcmRet = wc_AesGcmSetKey(enc->aes, keys->server_write_key,
2744                                      specs->key_size);
2745                if (gcmRet != 0) return gcmRet;
2746                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
2747                        AEAD_MAX_IMP_SZ);
2748#if !defined(NO_PUBLIC_GCM_SET_IV) && \
2749    ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
2750    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
2751                if (!tls13) {
2752                    gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ,
2753                            keys->server_write_IV, AESGCM_IMP_IV_SZ, rng);
2754                    if (gcmRet != 0) return gcmRet;
2755                }
2756#endif
2757            }
2758            if (dec) {
2759                gcmRet = wc_AesGcmSetKey(dec->aes, keys->client_write_key,
2760                                      specs->key_size);
2761                if (gcmRet != 0) return gcmRet;
2762                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
2763                        AEAD_MAX_IMP_SZ);
2764            }
2765        }
2766        if (enc)
2767            enc->setup = 1;
2768        if (dec)
2769            dec->setup = 1;
2770    }
2771#endif /* BUILD_AESGCM */
2772
2773#ifdef HAVE_AESCCM
2774    /* check that buffer sizes are sufficient (CCM is same size as GCM) */
2775    #if (AEAD_MAX_IMP_SZ < 4) /* AESGCM_IMP_IV_SZ */
2776        #error AEAD_MAX_IMP_SZ too small for AESCCM
2777    #endif
2778    #if (AEAD_MAX_EXP_SZ < 8) /* AESGCM_EXP_IV_SZ */
2779        #error AEAD_MAX_EXP_SZ too small for AESCCM
2780    #endif
2781    #if (MAX_WRITE_IV_SZ < 4) /* AESGCM_IMP_IV_SZ */
2782        #error MAX_WRITE_IV_SZ too small for AESCCM
2783    #endif
2784
2785    if (specs->bulk_cipher_algorithm == wolfssl_aes_ccm) {
2786        int CcmRet;
2787
2788        if (enc) {
2789            if (enc->aes == NULL) {
2790                enc->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2791                if (enc->aes == NULL)
2792                    return MEMORY_E;
2793            } else {
2794                wc_AesFree(enc->aes);
2795            }
2796
2797            XMEMSET(enc->aes, 0, sizeof(Aes));
2798        }
2799        if (dec) {
2800            if (dec->aes == NULL) {
2801                dec->aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_CIPHER);
2802                if (dec->aes == NULL)
2803                    return MEMORY_E;
2804            } else {
2805                wc_AesFree(dec->aes);
2806            }
2807            XMEMSET(dec->aes, 0, sizeof(Aes));
2808        }
2809
2810        if (enc) {
2811            if (wc_AesInit(enc->aes, heap, devId) != 0) {
2812                WOLFSSL_MSG("AesInit failed in SetKeys");
2813                return ASYNC_INIT_E;
2814            }
2815        }
2816        if (dec) {
2817            if (wc_AesInit(dec->aes, heap, devId) != 0) {
2818                WOLFSSL_MSG("AesInit failed in SetKeys");
2819                return ASYNC_INIT_E;
2820            }
2821        }
2822
2823        if (side == WOLFSSL_CLIENT_END) {
2824            if (enc) {
2825                CcmRet = wc_AesCcmSetKey(enc->aes, keys->client_write_key,
2826                                         specs->key_size);
2827                if (CcmRet != 0) {
2828                    return CcmRet;
2829                }
2830                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
2831                        AEAD_MAX_IMP_SZ);
2832#if !defined(NO_PUBLIC_CCM_SET_NONCE) && \
2833    ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
2834    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
2835                if (!tls13) {
2836                    CcmRet = wc_AesCcmSetNonce(enc->aes, keys->client_write_IV,
2837                            AEAD_NONCE_SZ);
2838                    if (CcmRet != 0) return CcmRet;
2839                }
2840#endif
2841            }
2842            if (dec) {
2843                CcmRet = wc_AesCcmSetKey(dec->aes, keys->server_write_key,
2844                                         specs->key_size);
2845                if (CcmRet != 0) {
2846                    return CcmRet;
2847                }
2848                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
2849                        AEAD_MAX_IMP_SZ);
2850            }
2851        }
2852        else {
2853            if (enc) {
2854                CcmRet = wc_AesCcmSetKey(enc->aes, keys->server_write_key,
2855                                         specs->key_size);
2856                if (CcmRet != 0) {
2857                    return CcmRet;
2858                }
2859                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
2860                        AEAD_MAX_IMP_SZ);
2861#if !defined(NO_PUBLIC_CCM_SET_NONCE) && \
2862    ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
2863    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
2864                if (!tls13) {
2865                    CcmRet = wc_AesCcmSetNonce(enc->aes, keys->server_write_IV,
2866                            AEAD_NONCE_SZ);
2867                    if (CcmRet != 0) return CcmRet;
2868                }
2869#endif
2870            }
2871            if (dec) {
2872                CcmRet = wc_AesCcmSetKey(dec->aes, keys->client_write_key,
2873                                         specs->key_size);
2874                if (CcmRet != 0) {
2875                    return CcmRet;
2876                }
2877                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
2878                        AEAD_MAX_IMP_SZ);
2879            }
2880        }
2881        if (enc)
2882            enc->setup = 1;
2883        if (dec)
2884            dec->setup = 1;
2885    }
2886#endif /* HAVE_AESCCM */
2887
2888#ifdef HAVE_ARIA
2889    /* check that buffer sizes are sufficient */
2890    #if (MAX_WRITE_IV_SZ < 16) /* AES_IV_SIZE */
2891        #error MAX_WRITE_IV_SZ too small for AES
2892    #endif
2893
2894    if (specs->bulk_cipher_algorithm == wolfssl_aria_gcm) {
2895        int ret = 0;
2896        MC_ALGID algo;
2897
2898        switch(specs->key_size) {
2899            case ARIA_128_KEY_SIZE:
2900                algo = MC_ALGID_ARIA_128BITKEY;
2901                break;
2902            case ARIA_192_KEY_SIZE:
2903                algo = MC_ALGID_ARIA_192BITKEY;
2904                break;
2905            case ARIA_256_KEY_SIZE:
2906                algo = MC_ALGID_ARIA_256BITKEY;
2907                break;
2908            default:
2909                return WOLFSSL_NOT_IMPLEMENTED; /* This should never happen */
2910        }
2911
2912        if (enc) {
2913            if (enc->aria == NULL) {
2914                enc->aria = (wc_Aria*)XMALLOC(sizeof(wc_Aria), heap, DYNAMIC_TYPE_CIPHER);
2915                if (enc->aria == NULL)
2916                    return MEMORY_E;
2917            } else {
2918                wc_AriaFreeCrypt(enc->aria);
2919            }
2920
2921            XMEMSET(enc->aria, 0, sizeof(wc_Aria));
2922            if (wc_AriaInitCrypt(enc->aria, algo) != 0) {
2923                WOLFSSL_MSG("AriaInit failed in SetKeys");
2924                return ASYNC_INIT_E;
2925            }
2926        }
2927        if (dec) {
2928            if (dec->aria == NULL) {
2929                dec->aria = (wc_Aria*)XMALLOC(sizeof(wc_Aria), heap, DYNAMIC_TYPE_CIPHER);
2930                if (dec->aria == NULL)
2931                    return MEMORY_E;
2932            } else {
2933                wc_AriaFreeCrypt(dec->aria);
2934            }
2935
2936            XMEMSET(dec->aria, 0, sizeof(wc_Aria));
2937            if (wc_AriaInitCrypt(dec->aria, algo) != 0) {
2938                WOLFSSL_MSG("AriaInit failed in SetKeys");
2939                return ASYNC_INIT_E;
2940            }
2941        }
2942
2943        if (side == WOLFSSL_CLIENT_END) {
2944            if (enc) {
2945                ret = wc_AriaSetKey(enc->aria, keys->client_write_key);
2946                if (ret != 0) return ret;
2947                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
2948                        AEAD_MAX_IMP_SZ);
2949                if (!tls13) {
2950                    ret = wc_AriaGcmSetIV(enc->aria, AESGCM_NONCE_SZ,
2951                            keys->client_write_IV, AESGCM_IMP_IV_SZ, rng);
2952                    if (ret != 0) return ret;
2953                }
2954            }
2955            if (dec) {
2956                ret = wc_AriaSetKey(dec->aria, keys->server_write_key);
2957                if (ret != 0) return ret;
2958                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
2959                        AEAD_MAX_IMP_SZ);
2960            }
2961        }
2962        else {
2963            if (enc) {
2964                ret = wc_AriaSetKey(enc->aria, keys->server_write_key);
2965                if (ret != 0) return ret;
2966                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
2967                        AEAD_MAX_IMP_SZ);
2968                if (!tls13) {
2969                    ret = wc_AriaGcmSetIV(enc->aria, AESGCM_NONCE_SZ,
2970                            keys->server_write_IV, AESGCM_IMP_IV_SZ, rng);
2971                    if (ret != 0) return ret;
2972                }
2973            }
2974            if (dec) {
2975                ret = wc_AriaSetKey(dec->aria, keys->client_write_key);
2976                if (ret != 0) return ret;
2977                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
2978                        AEAD_MAX_IMP_SZ);
2979            }
2980        }
2981        if (enc)
2982            enc->setup = 1;
2983        if (dec)
2984            dec->setup = 1;
2985    }
2986#endif /* HAVE_ARIA */
2987
2988#ifdef HAVE_CAMELLIA
2989    /* check that buffer sizes are sufficient */
2990    #if (MAX_WRITE_IV_SZ < 16) /* CAMELLIA_IV_SIZE */
2991        #error MAX_WRITE_IV_SZ too small for CAMELLIA
2992    #endif
2993
2994    if (specs->bulk_cipher_algorithm == wolfssl_camellia) {
2995        int camRet;
2996
2997        if (enc && enc->cam == NULL)
2998            enc->cam =
2999                (wc_Camellia*)XMALLOC(sizeof(wc_Camellia), heap, DYNAMIC_TYPE_CIPHER);
3000        if (enc && enc->cam == NULL)
3001            return MEMORY_E;
3002
3003        if (dec && dec->cam == NULL)
3004            dec->cam =
3005                (wc_Camellia*)XMALLOC(sizeof(wc_Camellia), heap, DYNAMIC_TYPE_CIPHER);
3006        if (dec && dec->cam == NULL)
3007            return MEMORY_E;
3008
3009        if (side == WOLFSSL_CLIENT_END) {
3010            if (enc) {
3011                camRet = wc_CamelliaSetKey(enc->cam, keys->client_write_key,
3012                                        specs->key_size, keys->client_write_IV);
3013                if (camRet != 0) return camRet;
3014            }
3015            if (dec) {
3016                camRet = wc_CamelliaSetKey(dec->cam, keys->server_write_key,
3017                                        specs->key_size, keys->server_write_IV);
3018                if (camRet != 0) return camRet;
3019            }
3020        }
3021        else {
3022            if (enc) {
3023                camRet = wc_CamelliaSetKey(enc->cam, keys->server_write_key,
3024                                        specs->key_size, keys->server_write_IV);
3025                if (camRet != 0) return camRet;
3026            }
3027            if (dec) {
3028                camRet = wc_CamelliaSetKey(dec->cam, keys->client_write_key,
3029                                        specs->key_size, keys->client_write_IV);
3030                if (camRet != 0) return camRet;
3031            }
3032        }
3033        if (enc)
3034            enc->setup = 1;
3035        if (dec)
3036            dec->setup = 1;
3037    }
3038#endif /* HAVE_CAMELLIA */
3039
3040#ifdef WOLFSSL_SM4_CBC
3041    /* check that buffer sizes are sufficient */
3042    #if (MAX_WRITE_IV_SZ < 16) /* AES_IV_SIZE */
3043        #error MAX_WRITE_IV_SZ too small for SM4_CBC
3044    #endif
3045
3046    if (specs->bulk_cipher_algorithm == wolfssl_sm4_cbc) {
3047        int sm4Ret = 0;
3048
3049        if (enc) {
3050            if (enc->sm4 == NULL) {
3051                enc->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3052                    DYNAMIC_TYPE_CIPHER);
3053                if (enc->sm4 == NULL)
3054                    return MEMORY_E;
3055            }
3056            else {
3057                wc_Sm4Free(enc->sm4);
3058            }
3059
3060            XMEMSET(enc->sm4, 0, sizeof(wc_Sm4));
3061        }
3062        if (dec) {
3063            if (dec->sm4 == NULL) {
3064                dec->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3065                    DYNAMIC_TYPE_CIPHER);
3066                if (dec->sm4 == NULL)
3067                    return MEMORY_E;
3068            }
3069            else {
3070                wc_Sm4Free(dec->sm4);
3071            }
3072
3073            XMEMSET(dec->sm4, 0, sizeof(wc_Sm4));
3074        }
3075        if (enc) {
3076            if (wc_Sm4Init(enc->sm4, heap, devId) != 0) {
3077                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3078                return ASYNC_INIT_E;
3079            }
3080        }
3081        if (dec) {
3082            if (wc_Sm4Init(dec->sm4, heap, devId) != 0) {
3083                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3084                return ASYNC_INIT_E;
3085            }
3086        }
3087
3088        if (side == WOLFSSL_CLIENT_END) {
3089            if (enc) {
3090                sm4Ret = wc_Sm4SetKey(enc->sm4, keys->client_write_key,
3091                    specs->key_size);
3092                if (sm4Ret != 0) return sm4Ret;
3093                sm4Ret = wc_Sm4SetIV(enc->sm4, keys->client_write_IV);
3094                if (sm4Ret != 0) return sm4Ret;
3095            }
3096            if (dec) {
3097                sm4Ret = wc_Sm4SetKey(dec->sm4, keys->server_write_key,
3098                    specs->key_size);
3099                if (sm4Ret != 0) return sm4Ret;
3100                sm4Ret = wc_Sm4SetIV(dec->sm4, keys->server_write_IV);
3101                if (sm4Ret != 0) return sm4Ret;
3102            }
3103        }
3104        else {
3105            if (enc) {
3106                sm4Ret = wc_Sm4SetKey(enc->sm4, keys->server_write_key,
3107                    specs->key_size);
3108                if (sm4Ret != 0) return sm4Ret;
3109                sm4Ret = wc_Sm4SetIV(enc->sm4, keys->server_write_IV);
3110                if (sm4Ret != 0) return sm4Ret;
3111            }
3112            if (dec) {
3113                sm4Ret = wc_Sm4SetKey(dec->sm4, keys->client_write_key,
3114                    specs->key_size);
3115                if (sm4Ret != 0) return sm4Ret;
3116                sm4Ret = wc_Sm4SetIV(dec->sm4, keys->client_write_IV);
3117                if (sm4Ret != 0) return sm4Ret;
3118            }
3119        }
3120        if (enc)
3121            enc->setup = 1;
3122        if (dec)
3123            dec->setup = 1;
3124    }
3125#endif /* WOLFSSL_SM4_CBC */
3126
3127#ifdef WOLFSSL_SM4_GCM
3128    /* check that buffer sizes are sufficient */
3129    #if (AEAD_MAX_IMP_SZ < 4) /* SM4-GCM_IMP_IV_SZ */
3130        #error AEAD_MAX_IMP_SZ too small for SM4-GCM
3131    #endif
3132    #if (AEAD_MAX_EXP_SZ < 8) /* SM4-GCM_EXP_IV_SZ */
3133        #error AEAD_MAX_EXP_SZ too small for SM4-GCM
3134    #endif
3135    #if (MAX_WRITE_IV_SZ < 4) /* SM4-GCM_IMP_IV_SZ */
3136        #error MAX_WRITE_IV_SZ too small for SM4-GCM
3137    #endif
3138
3139    if (specs->bulk_cipher_algorithm == wolfssl_sm4_gcm) {
3140        int gcmRet;
3141
3142        if (enc) {
3143            if (enc->sm4 == NULL) {
3144                enc->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3145                                            DYNAMIC_TYPE_CIPHER);
3146                if (enc->sm4 == NULL)
3147                    return MEMORY_E;
3148            } else {
3149                wc_Sm4Free(enc->sm4);
3150            }
3151
3152            XMEMSET(enc->sm4, 0, sizeof(wc_Sm4));
3153        }
3154        if (dec) {
3155            if (dec->sm4 == NULL) {
3156                dec->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3157                                            DYNAMIC_TYPE_CIPHER);
3158                if (dec->sm4 == NULL)
3159                    return MEMORY_E;
3160            } else {
3161                wc_Sm4Free(dec->sm4);
3162            }
3163
3164            XMEMSET(dec->sm4, 0, sizeof(wc_Sm4));
3165        }
3166
3167        if (enc) {
3168            if (wc_Sm4Init(enc->sm4, heap, devId) != 0) {
3169                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3170                return ASYNC_INIT_E;
3171            }
3172        }
3173        if (dec) {
3174            if (wc_Sm4Init(dec->sm4, heap, devId) != 0) {
3175                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3176                return ASYNC_INIT_E;
3177            }
3178        }
3179
3180        if (side == WOLFSSL_CLIENT_END) {
3181            if (enc) {
3182                gcmRet = wc_Sm4GcmSetKey(enc->sm4, keys->client_write_key,
3183                                      specs->key_size);
3184                if (gcmRet != 0) return gcmRet;
3185                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
3186                        AEAD_MAX_IMP_SZ);
3187            }
3188            if (dec) {
3189                gcmRet = wc_Sm4GcmSetKey(dec->sm4, keys->server_write_key,
3190                                      specs->key_size);
3191                if (gcmRet != 0) return gcmRet;
3192                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
3193                        AEAD_MAX_IMP_SZ);
3194            }
3195        }
3196        else {
3197            if (enc) {
3198                gcmRet = wc_Sm4GcmSetKey(enc->sm4, keys->server_write_key,
3199                                      specs->key_size);
3200                if (gcmRet != 0) return gcmRet;
3201                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
3202                        AEAD_MAX_IMP_SZ);
3203            }
3204            if (dec) {
3205                gcmRet = wc_Sm4GcmSetKey(dec->sm4, keys->client_write_key,
3206                                      specs->key_size);
3207                if (gcmRet != 0) return gcmRet;
3208                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
3209                        AEAD_MAX_IMP_SZ);
3210            }
3211        }
3212        if (enc)
3213            enc->setup = 1;
3214        if (dec)
3215            dec->setup = 1;
3216    }
3217#endif /* WOLFSSL_SM4_GCM */
3218
3219#ifdef WOLFSSL_SM4_CCM
3220    /* check that buffer sizes are sufficient (CCM is same size as GCM) */
3221    #if (AEAD_MAX_IMP_SZ < 4) /* SM4-CCM_IMP_IV_SZ */
3222        #error AEAD_MAX_IMP_SZ too small for SM4-CCM
3223    #endif
3224    #if (AEAD_MAX_EXP_SZ < 8) /* SM4-CCM_EXP_IV_SZ */
3225        #error AEAD_MAX_EXP_SZ too small for SM4-CCM
3226    #endif
3227    #if (MAX_WRITE_IV_SZ < 4) /* SM4-CCM_IMP_IV_SZ */
3228        #error MAX_WRITE_IV_SZ too small for SM4-CCM
3229    #endif
3230
3231    if (specs->bulk_cipher_algorithm == wolfssl_sm4_ccm) {
3232        int CcmRet;
3233
3234        if (enc) {
3235            if (enc->sm4 == NULL) {
3236                enc->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3237                                            DYNAMIC_TYPE_CIPHER);
3238                if (enc->sm4 == NULL)
3239                    return MEMORY_E;
3240            } else {
3241                wc_Sm4Free(enc->sm4);
3242            }
3243
3244            XMEMSET(enc->sm4, 0, sizeof(wc_Sm4));
3245        }
3246        if (dec) {
3247            if (dec->sm4 == NULL) {
3248                dec->sm4 = (wc_Sm4*)XMALLOC(sizeof(wc_Sm4), heap,
3249                                            DYNAMIC_TYPE_CIPHER);
3250                if (dec->sm4 == NULL)
3251                    return MEMORY_E;
3252            } else {
3253                wc_Sm4Free(dec->sm4);
3254            }
3255            XMEMSET(dec->sm4, 0, sizeof(wc_Sm4));
3256        }
3257
3258        if (enc) {
3259            if (wc_Sm4Init(enc->sm4, heap, devId) != 0) {
3260                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3261                return ASYNC_INIT_E;
3262            }
3263        }
3264        if (dec) {
3265            if (wc_Sm4Init(dec->sm4, heap, devId) != 0) {
3266                WOLFSSL_MSG("Sm4Init failed in SetKeys");
3267                return ASYNC_INIT_E;
3268            }
3269        }
3270
3271        if (side == WOLFSSL_CLIENT_END) {
3272            if (enc) {
3273                CcmRet = wc_Sm4SetKey(enc->sm4, keys->client_write_key,
3274                                      specs->key_size);
3275                if (CcmRet != 0) {
3276                    return CcmRet;
3277                }
3278                XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
3279                        AEAD_MAX_IMP_SZ);
3280            }
3281            if (dec) {
3282                CcmRet = wc_Sm4SetKey(dec->sm4, keys->server_write_key,
3283                                      specs->key_size);
3284                if (CcmRet != 0) {
3285                    return CcmRet;
3286                }
3287                XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
3288                        AEAD_MAX_IMP_SZ);
3289            }
3290        }
3291        else {
3292            if (enc) {
3293                CcmRet = wc_Sm4SetKey(enc->sm4, keys->server_write_key,
3294                                      specs->key_size);
3295                if (CcmRet != 0) {
3296                    return CcmRet;
3297                }
3298                XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
3299                        AEAD_MAX_IMP_SZ);
3300            }
3301            if (dec) {
3302                CcmRet = wc_Sm4SetKey(dec->sm4, keys->client_write_key,
3303                                      specs->key_size);
3304                if (CcmRet != 0) {
3305                    return CcmRet;
3306                }
3307                XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
3308                        AEAD_MAX_IMP_SZ);
3309            }
3310        }
3311        if (enc)
3312            enc->setup = 1;
3313        if (dec)
3314            dec->setup = 1;
3315    }
3316#endif /* WOLFSSL_SM4_CCM */
3317
3318#ifdef HAVE_NULL_CIPHER
3319    if (specs->bulk_cipher_algorithm == wolfssl_cipher_null) {
3320    #ifdef WOLFSSL_TLS13
3321        if (tls13) {
3322            int hmacRet;
3323            int hashType = WC_HASH_TYPE_NONE;
3324
3325            switch (specs->mac_algorithm) {
3326                case sha256_mac:
3327                    hashType = WC_SHA256;
3328                    break;
3329                case sha384_mac:
3330                    hashType = WC_SHA384;
3331                    break;
3332                default:
3333                    break;
3334            }
3335
3336            if (enc && enc->hmac == NULL) {
3337                enc->hmac = (Hmac*)XMALLOC(sizeof(Hmac), heap,
3338                                                           DYNAMIC_TYPE_CIPHER);
3339                if (enc->hmac == NULL)
3340                    return MEMORY_E;
3341
3342                if (wc_HmacInit(enc->hmac, heap, devId) != 0) {
3343                    WOLFSSL_MSG("HmacInit failed in SetKeys");
3344                    XFREE(enc->hmac, heap, DYNAMIC_TYPE_CIPHER);
3345                    enc->hmac = NULL;
3346                    return ASYNC_INIT_E;
3347                }
3348            }
3349
3350            if (dec && dec->hmac == NULL) {
3351                dec->hmac = (Hmac*)XMALLOC(sizeof(Hmac), heap,
3352                                                           DYNAMIC_TYPE_CIPHER);
3353                if (dec->hmac == NULL)
3354                    return MEMORY_E;
3355
3356                if (wc_HmacInit(dec->hmac, heap, devId) != 0) {
3357                    WOLFSSL_MSG("HmacInit failed in SetKeys");
3358                    XFREE(dec->hmac, heap, DYNAMIC_TYPE_CIPHER);
3359                    dec->hmac = NULL;
3360                    return ASYNC_INIT_E;
3361                }
3362            }
3363
3364            if (side == WOLFSSL_CLIENT_END) {
3365                if (enc) {
3366                    XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
3367                            specs->iv_size);
3368                    hmacRet = wc_HmacSetKey(enc->hmac, hashType,
3369                                       keys->client_write_key, specs->key_size);
3370                    if (hmacRet != 0) return hmacRet;
3371                }
3372                if (dec) {
3373                    XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
3374                            specs->iv_size);
3375                    hmacRet = wc_HmacSetKey(dec->hmac, hashType,
3376                                       keys->server_write_key, specs->key_size);
3377                    if (hmacRet != 0) return hmacRet;
3378                }
3379            }
3380            else {
3381                if (enc) {
3382                    XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
3383                            specs->iv_size);
3384                    hmacRet = wc_HmacSetKey(enc->hmac, hashType,
3385                                       keys->server_write_key, specs->key_size);
3386                    if (hmacRet != 0) return hmacRet;
3387                }
3388                if (dec) {
3389                    XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
3390                            specs->iv_size);
3391                    hmacRet = wc_HmacSetKey(dec->hmac, hashType,
3392                                       keys->client_write_key, specs->key_size);
3393                    if (hmacRet != 0) return hmacRet;
3394                }
3395            }
3396        }
3397    #endif
3398        if (enc)
3399            enc->setup = 1;
3400        if (dec)
3401            dec->setup = 1;
3402    }
3403#endif
3404
3405    if (enc) {
3406        keys->sequence_number_hi      = 0;
3407        keys->sequence_number_lo      = 0;
3408    }
3409    if (dec) {
3410        keys->peer_sequence_number_hi = 0;
3411        keys->peer_sequence_number_lo = 0;
3412    }
3413    (void)side;
3414    (void)heap;
3415    (void)enc;
3416    (void)dec;
3417    (void)specs;
3418    (void)devId;
3419
3420    return 0;
3421}
3422
3423
3424#ifdef HAVE_ONE_TIME_AUTH
3425/* set one time authentication keys */
3426static int SetAuthKeys(OneTimeAuth* authentication, Keys* keys,
3427                       CipherSpecs* specs, void* heap, int devId)
3428{
3429
3430#ifdef HAVE_POLY1305
3431        /* set up memory space for poly1305 */
3432        if (authentication && authentication->poly1305 == NULL)
3433            authentication->poly1305 =
3434                (Poly1305*)XMALLOC(sizeof(Poly1305), heap, DYNAMIC_TYPE_CIPHER);
3435        if (authentication && authentication->poly1305 == NULL)
3436            return MEMORY_E;
3437    #ifdef WOLFSSL_CHECK_MEM_ZERO
3438        wc_MemZero_Add("SSL auth keys poly1305", authentication->poly1305,
3439            sizeof(Poly1305));
3440    #endif
3441        if (authentication)
3442            authentication->setup = 1;
3443#endif
3444        (void)authentication;
3445        (void)heap;
3446        (void)keys;
3447        (void)specs;
3448        (void)devId;
3449
3450        return 0;
3451}
3452#endif /* HAVE_ONE_TIME_AUTH */
3453
3454#ifdef HAVE_SECURE_RENEGOTIATION
3455/* function name is for cache_status++
3456 * This function was added because of error incrementing enum type when
3457 * compiling with a C++ compiler.
3458 */
3459static void CacheStatusPP(SecureRenegotiation* cache)
3460{
3461    switch (cache->cache_status) {
3462        case SCR_CACHE_NULL:
3463            cache->cache_status = SCR_CACHE_NEEDED;
3464            break;
3465
3466        case SCR_CACHE_NEEDED:
3467            cache->cache_status = SCR_CACHE_COPY;
3468            break;
3469
3470        case SCR_CACHE_COPY:
3471            cache->cache_status = SCR_CACHE_PARTIAL;
3472            break;
3473
3474        case SCR_CACHE_PARTIAL:
3475            cache->cache_status = SCR_CACHE_COMPLETE;
3476            break;
3477
3478        case SCR_CACHE_COMPLETE:
3479            WOLFSSL_MSG("SCR Cache state Complete");
3480            break;
3481
3482        default:
3483            WOLFSSL_MSG("Unknown cache state!!");
3484    }
3485}
3486#endif /* HAVE_SECURE_RENEGOTIATION */
3487
3488
3489/* Set wc_encrypt/wc_decrypt or both sides of key setup
3490 * note: use wc_encrypt to avoid shadowing global encrypt
3491 * declared in unistd.h
3492 */
3493int SetKeysSide(WOLFSSL* ssl, enum encrypt_side side)
3494{
3495    int ret, copy = 0;
3496    Ciphers* wc_encrypt = NULL;
3497    Ciphers* wc_decrypt = NULL;
3498    Keys*    keys    = &ssl->keys;
3499
3500    (void)copy;
3501
3502#ifdef HAVE_SECURE_RENEGOTIATION
3503    if (ssl->secure_renegotiation &&
3504            ssl->secure_renegotiation->cache_status != SCR_CACHE_NULL) {
3505        keys = &ssl->secure_renegotiation->tmp_keys;
3506#ifdef WOLFSSL_DTLS
3507        /* For DTLS, copy is done in StoreKeys */
3508        if (!ssl->options.dtls)
3509#endif
3510            copy = 1;
3511    }
3512#endif /* HAVE_SECURE_RENEGOTIATION */
3513
3514    switch (side) {
3515        case ENCRYPT_SIDE_ONLY:
3516#ifdef WOLFSSL_DEBUG_TLS
3517            WOLFSSL_MSG("Provisioning ENCRYPT key");
3518            if (ssl->options.side == WOLFSSL_CLIENT_END) {
3519                WOLFSSL_BUFFER(keys->client_write_key, ssl->specs.key_size);
3520            }
3521            else {
3522                WOLFSSL_BUFFER(keys->server_write_key, ssl->specs.key_size);
3523            }
3524#endif
3525            wc_encrypt = &ssl->encrypt;
3526            break;
3527
3528        case DECRYPT_SIDE_ONLY:
3529#ifdef WOLFSSL_DEBUG_TLS
3530            WOLFSSL_MSG("Provisioning DECRYPT key");
3531            if (ssl->options.side == WOLFSSL_CLIENT_END) {
3532                WOLFSSL_BUFFER(keys->server_write_key, ssl->specs.key_size);
3533            }
3534            else {
3535                WOLFSSL_BUFFER(keys->client_write_key, ssl->specs.key_size);
3536            }
3537#endif
3538            wc_decrypt = &ssl->decrypt;
3539            break;
3540
3541        case ENCRYPT_AND_DECRYPT_SIDE:
3542#ifdef WOLFSSL_DEBUG_TLS
3543            WOLFSSL_MSG("Provisioning ENCRYPT key");
3544            if (ssl->options.side == WOLFSSL_CLIENT_END) {
3545                WOLFSSL_BUFFER(keys->client_write_key, ssl->specs.key_size);
3546            }
3547            else {
3548                WOLFSSL_BUFFER(keys->server_write_key, ssl->specs.key_size);
3549            }
3550            WOLFSSL_MSG("Provisioning DECRYPT key");
3551            if (ssl->options.side == WOLFSSL_CLIENT_END) {
3552                WOLFSSL_BUFFER(keys->server_write_key, ssl->specs.key_size);
3553            }
3554            else {
3555                WOLFSSL_BUFFER(keys->client_write_key, ssl->specs.key_size);
3556            }
3557#endif
3558            wc_encrypt = &ssl->encrypt;
3559            wc_decrypt = &ssl->decrypt;
3560            break;
3561
3562        default:
3563            return BAD_FUNC_ARG;
3564    }
3565
3566#ifdef HAVE_ONE_TIME_AUTH
3567    if (!ssl->auth.setup && ssl->specs.bulk_cipher_algorithm == wolfssl_chacha){
3568        ret = SetAuthKeys(&ssl->auth, keys, &ssl->specs, ssl->heap, ssl->devId);
3569        if (ret != 0)
3570           return ret;
3571    }
3572#endif
3573
3574#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
3575    ret = WC_NO_ERR_TRACE(PROTOCOLCB_UNAVAILABLE);
3576    if (ssl->ctx->EncryptKeysCb) {
3577        void* ctx = wolfSSL_GetEncryptKeysCtx(ssl);
3578        #if defined(WOLFSSL_RENESAS_FSPSM_TLS)
3579            FSPSM_ST* cbInfo = (FSPSM_ST*)ctx;
3580            cbInfo->internal->side = side;
3581        #elif defined(WOLFSSL_RENESAS_TSIP_TLS)
3582            TsipUserCtx* cbInfo = (TsipUserCtx*)ctx;
3583            cbInfo->internal->key_side = side;
3584        #endif
3585        ret = ssl->ctx->EncryptKeysCb(ssl, ctx);
3586    }
3587    if (!ssl->ctx->EncryptKeysCb ||
3588        ret == WC_NO_ERR_TRACE(PROTOCOLCB_UNAVAILABLE))
3589#endif
3590    {
3591        ret = SetKeys(wc_encrypt, wc_decrypt, keys, &ssl->specs, ssl->options.side,
3592                      ssl->heap, ssl->devId, ssl->rng, ssl->options.tls1_3);
3593    }
3594
3595    /* Zero the TLS-layer staging key buffers once the CryptoCB callback
3596     * has imported the key into a Secure Element.
3597     *
3598     * Convention: after a successful wc_AesSetKey / wc_AesGcmSetKey where
3599     * the CryptoCB handled the key import, the callback leaves
3600     * aes->devCtx != NULL and the software key schedule (aes->key,
3601     * aes->devKey, aes->gcm.H / aes->gcm.M0) is NOT populated.  The TLS
3602     * layer may therefore destroy its staging copy of the traffic key.
3603     *
3604     * Only the key buffers (client_write_key / server_write_key) are
3605     * zeroed.  The static IVs (client_write_IV / server_write_IV) and
3606     * the AEAD implicit-IV copies (aead_{enc,dec}_imp_IV) are NOT
3607     * zeroed: BuildTls13Nonce() in tls13.c reads keys->aead_*_imp_IV on
3608     * every AEAD record to construct the per-record nonce
3609     * (nonce = static_iv XOR seq_num, RFC 8446 Section 5.3).  Zeroing
3610     * them would break the record path or, if applied symmetrically on
3611     * both peers, silently degenerate the nonce to the bare sequence
3612     * number and break interop with any unpatched peer.  The static_iv
3613     * is not a confidentiality-critical secret in the same sense as
3614     * the traffic key; losing it does not compromise plaintext.
3615     *
3616     * Scope:
3617     *   - TLS 1.3 only.  TLS 1.2 additionally reads
3618     *     keys->{client,server}_write_key for rehandshake/secure
3619     *     renegotiation flows.
3620     *   - Non-DTLS.  Dtls13EpochCopyKeys (called from Dtls13NewEpoch)
3621     *     references keys->*_write_key for epoch switching; DTLS 1.3
3622     *     needs separate analysis.
3623     *   - Non-QUIC.  QUIC traffic secrets live outside these buffers
3624     *     but the interaction with stack-installed QUIC handlers has
3625     *     not been audited; exclude until it is.
3626     *
3627     * When called with ENCRYPT_SIDE_ONLY or DECRYPT_SIDE_ONLY, only the
3628     * buffer consumed by this call is zeroed; the complementary buffer
3629     * is written in a later SetKeysSide() from its own DeriveTls13Keys()
3630     * and StoreKeys() pair (StoreKeys gates on PROVISION_CLIENT /
3631     * PROVISION_SERVER so only the provisioned side is written).
3632     *
3633     * Ordering: this block must run AFTER SetKeys() (so offload has
3634     * happened) and BEFORE Dtls13SetRecordNumberKeys() /
3635     * wolfSSL_quic_keys_active() below, in case a future refactor in
3636     * either starts reading keys->*_write_key.  The DTLS and QUIC gates
3637     * in this block mean neither currently executes on the same ssl,
3638     * but keep the order explicit. */
3639#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_AES_SETKEY)
3640    if (ret == 0 && ssl->options.tls1_3 && !ssl->options.dtls
3641            && !WOLFSSL_IS_QUIC(ssl)) {
3642        int encOffloaded = (wc_encrypt != NULL && wc_encrypt->aes != NULL &&
3643                            wc_encrypt->aes->devCtx != NULL);
3644        int decOffloaded = (wc_decrypt != NULL && wc_decrypt->aes != NULL &&
3645                            wc_decrypt->aes->devCtx != NULL);
3646
3647        if (encOffloaded || decOffloaded) {
3648            if (ssl->options.side == WOLFSSL_CLIENT_END) {
3649                if (encOffloaded)
3650                    ForceZero(keys->client_write_key, ssl->specs.key_size);
3651                if (decOffloaded)
3652                    ForceZero(keys->server_write_key, ssl->specs.key_size);
3653            }
3654            else {
3655                if (encOffloaded)
3656                    ForceZero(keys->server_write_key, ssl->specs.key_size);
3657                if (decOffloaded)
3658                    ForceZero(keys->client_write_key, ssl->specs.key_size);
3659            }
3660        }
3661    }
3662#endif /* WOLF_CRYPTO_CB && WOLF_CRYPTO_CB_AES_SETKEY */
3663
3664#ifdef WOLFSSL_DTLS13
3665    if (ret == 0 && ssl->options.dtls && IsAtLeastTLSv1_3(ssl->version))
3666        ret = Dtls13SetRecordNumberKeys(ssl, side);
3667#endif /* WOLFSSL_DTLS13 */
3668#ifdef WOLFSSL_QUIC
3669    if (ret == 0 && WOLFSSL_IS_QUIC(ssl)) {
3670        ret = wolfSSL_quic_keys_active(ssl, side);
3671    }
3672#endif /* WOLFSSL_QUIC */
3673
3674#ifdef HAVE_SECURE_RENEGOTIATION
3675#ifdef WOLFSSL_DTLS
3676    if (ret == 0 && ssl->options.dtls && !ssl->options.tls1_3) {
3677        if (wc_encrypt)
3678            wc_encrypt->src = keys == &ssl->keys ? KEYS : SCR;
3679        if (wc_decrypt)
3680            wc_decrypt->src = keys == &ssl->keys ? KEYS : SCR;
3681    }
3682#endif
3683
3684    if (copy) {
3685        int clientCopy = 0;
3686
3687        /* Sanity check that keys == ssl->secure_renegotiation->tmp_keys.
3688         * Otherwise the memcpy calls would copy overlapping memory
3689         * and cause UB. Fail early. */
3690        if (keys == &ssl->keys)
3691            return BAD_FUNC_ARG;
3692
3693        if (ssl->options.side == WOLFSSL_CLIENT_END && wc_encrypt)
3694            clientCopy = 1;
3695        else if (ssl->options.side == WOLFSSL_SERVER_END && wc_decrypt)
3696            clientCopy = 1;
3697
3698        if (clientCopy) {
3699    #ifndef WOLFSSL_AEAD_ONLY
3700            XMEMCPY(ssl->keys.client_write_MAC_secret,
3701                    keys->client_write_MAC_secret, WC_MAX_DIGEST_SIZE);
3702    #endif
3703            XMEMCPY(ssl->keys.client_write_key,
3704                    keys->client_write_key, AES_256_KEY_SIZE);
3705            XMEMCPY(ssl->keys.client_write_IV,
3706                    keys->client_write_IV, MAX_WRITE_IV_SZ);
3707        } else {
3708    #ifndef WOLFSSL_AEAD_ONLY
3709            XMEMCPY(ssl->keys.server_write_MAC_secret,
3710                    keys->server_write_MAC_secret, WC_MAX_DIGEST_SIZE);
3711    #endif
3712            XMEMCPY(ssl->keys.server_write_key,
3713                    keys->server_write_key, AES_256_KEY_SIZE);
3714            XMEMCPY(ssl->keys.server_write_IV,
3715                    keys->server_write_IV, MAX_WRITE_IV_SZ);
3716        }
3717        if (wc_encrypt) {
3718            ssl->keys.sequence_number_hi = keys->sequence_number_hi;
3719            ssl->keys.sequence_number_lo = keys->sequence_number_lo;
3720            #ifdef HAVE_AEAD
3721                if (ssl->specs.cipher_type == aead) {
3722                    /* Initialize the AES-GCM/CCM explicit IV to a zero. */
3723                    XMEMCPY(ssl->keys.aead_exp_IV, keys->aead_exp_IV,
3724                            AEAD_MAX_EXP_SZ);
3725
3726                    /* Initialize encrypt implicit IV by encrypt side */
3727                    if (ssl->options.side == WOLFSSL_CLIENT_END) {
3728                        XMEMCPY(ssl->keys.aead_enc_imp_IV,
3729                                keys->client_write_IV, AEAD_MAX_IMP_SZ);
3730                    } else {
3731                        XMEMCPY(ssl->keys.aead_enc_imp_IV,
3732                                keys->server_write_IV, AEAD_MAX_IMP_SZ);
3733                    }
3734                }
3735            #endif
3736        }
3737        if (wc_decrypt) {
3738            ssl->keys.peer_sequence_number_hi = keys->peer_sequence_number_hi;
3739            ssl->keys.peer_sequence_number_lo = keys->peer_sequence_number_lo;
3740            #ifdef HAVE_AEAD
3741                if (ssl->specs.cipher_type == aead) {
3742                    /* Initialize decrypt implicit IV by decrypt side */
3743                    if (ssl->options.side == WOLFSSL_SERVER_END) {
3744                        XMEMCPY(ssl->keys.aead_dec_imp_IV,
3745                                keys->client_write_IV, AEAD_MAX_IMP_SZ);
3746                    } else {
3747                        XMEMCPY(ssl->keys.aead_dec_imp_IV,
3748                                keys->server_write_IV, AEAD_MAX_IMP_SZ);
3749                    }
3750                }
3751            #endif
3752        }
3753        CacheStatusPP(ssl->secure_renegotiation);
3754    }
3755#endif /* HAVE_SECURE_RENEGOTIATION */
3756
3757    return ret;
3758}
3759
3760
3761/* TLS can call too */
3762int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side)
3763{
3764    size_t sz;
3765    int i = 0;
3766    Keys* keys = &ssl->keys;
3767#ifdef WOLFSSL_DTLS
3768    /* In case of DTLS, ssl->keys is updated here */
3769    int scr_copy = 0;
3770#endif
3771
3772#ifdef HAVE_SECURE_RENEGOTIATION
3773    if (ssl->secure_renegotiation &&
3774            ssl->secure_renegotiation->cache_status == SCR_CACHE_NEEDED) {
3775        keys = &ssl->secure_renegotiation->tmp_keys;
3776#ifdef WOLFSSL_DTLS
3777        if (ssl->options.dtls) {
3778            /* epoch is incremented after StoreKeys is called */
3779            ssl->secure_renegotiation->tmp_keys.dtls_epoch = ssl->keys.dtls_epoch + 1;
3780            /* we only need to copy keys on second and future renegotiations */
3781            if (ssl->keys.dtls_epoch > 1)
3782                scr_copy = 1;
3783            ssl->encrypt.src = KEYS_NOT_SET;
3784            ssl->decrypt.src = KEYS_NOT_SET;
3785        }
3786#endif
3787        CacheStatusPP(ssl->secure_renegotiation);
3788    }
3789#endif /* HAVE_SECURE_RENEGOTIATION */
3790
3791#ifdef WOLFSSL_MULTICAST
3792    if (ssl->options.haveMcast) {
3793        /* Use the same keys for encrypt and decrypt. */
3794        if (ssl->specs.cipher_type != aead) {
3795            sz = ssl->specs.hash_size;
3796    #ifndef WOLFSSL_AEAD_ONLY
3797
3798    #ifdef WOLFSSL_DTLS
3799            if (scr_copy) {
3800                XMEMCPY(ssl->keys.client_write_MAC_secret,
3801                        keys->client_write_MAC_secret, sz);
3802                XMEMCPY(ssl->keys.server_write_MAC_secret,
3803                        keys->server_write_MAC_secret, sz);
3804            }
3805    #endif
3806            XMEMCPY(keys->client_write_MAC_secret,&keyData[i], sz);
3807            XMEMCPY(keys->server_write_MAC_secret,&keyData[i], sz);
3808    #endif
3809            i += (int)sz;
3810        }
3811        sz = ssl->specs.key_size;
3812    #ifdef WOLFSSL_DTLS
3813        if (scr_copy) {
3814            XMEMCPY(ssl->keys.client_write_key,
3815                    keys->client_write_key, sz);
3816            XMEMCPY(ssl->keys.server_write_key,
3817                    keys->server_write_key, sz);
3818        }
3819    #endif
3820        XMEMCPY(keys->client_write_key, &keyData[i], sz);
3821        XMEMCPY(keys->server_write_key, &keyData[i], sz);
3822        i += (int)sz;
3823
3824        sz = ssl->specs.iv_size;
3825    #ifdef WOLFSSL_DTLS
3826        if (scr_copy) {
3827            XMEMCPY(ssl->keys.client_write_IV,
3828                    keys->client_write_IV, sz);
3829            XMEMCPY(ssl->keys.server_write_IV,
3830                    keys->server_write_IV, sz);
3831        }
3832    #endif
3833        XMEMCPY(keys->client_write_IV, &keyData[i], sz);
3834        XMEMCPY(keys->server_write_IV, &keyData[i], sz);
3835
3836#ifdef HAVE_AEAD
3837        if (ssl->specs.cipher_type == aead) {
3838            /* Initialize the AES-GCM/CCM explicit IV to a zero. */
3839        #ifdef WOLFSSL_DTLS
3840            if (scr_copy) {
3841                XMEMCPY(ssl->keys.aead_exp_IV,
3842                        keys->aead_exp_IV, AEAD_MAX_EXP_SZ);
3843            }
3844        #endif
3845            XMEMSET(keys->aead_exp_IV, 0, AEAD_MAX_EXP_SZ);
3846        }
3847#endif /* HAVE_AEAD */
3848
3849        return 0;
3850    }
3851#endif /* WOLFSSL_MULTICAST */
3852
3853    if (ssl->specs.cipher_type != aead) {
3854        sz = ssl->specs.hash_size;
3855        if (side & PROVISION_CLIENT) {
3856    #ifndef WOLFSSL_AEAD_ONLY
3857        #ifdef WOLFSSL_DTLS
3858            if (scr_copy)
3859                XMEMCPY(ssl->keys.client_write_MAC_secret,
3860                        keys->client_write_MAC_secret, sz);
3861        #endif
3862            XMEMCPY(keys->client_write_MAC_secret,&keyData[i], sz);
3863    #endif
3864            i += (int)sz;
3865        }
3866        if (side & PROVISION_SERVER) {
3867    #ifndef WOLFSSL_AEAD_ONLY
3868        #ifdef WOLFSSL_DTLS
3869            if (scr_copy)
3870                XMEMCPY(ssl->keys.server_write_MAC_secret,
3871                        keys->server_write_MAC_secret, sz);
3872        #endif
3873            XMEMCPY(keys->server_write_MAC_secret,&keyData[i], sz);
3874    #endif
3875            i += (int)sz;
3876        }
3877    }
3878    sz = ssl->specs.key_size;
3879    if (side & PROVISION_CLIENT) {
3880    #ifdef WOLFSSL_DTLS
3881        if (scr_copy)
3882            XMEMCPY(ssl->keys.client_write_key,
3883                    keys->client_write_key, sz);
3884    #endif
3885        XMEMCPY(keys->client_write_key, &keyData[i], sz);
3886        i += (int)sz;
3887    }
3888    if (side & PROVISION_SERVER) {
3889    #ifdef WOLFSSL_DTLS
3890        if (scr_copy)
3891            XMEMCPY(ssl->keys.server_write_key,
3892                    keys->server_write_key, sz);
3893    #endif
3894        XMEMCPY(keys->server_write_key, &keyData[i], sz);
3895        i += (int)sz;
3896    }
3897
3898    sz = ssl->specs.iv_size;
3899    if (side & PROVISION_CLIENT) {
3900    #ifdef WOLFSSL_DTLS
3901        if (scr_copy)
3902            XMEMCPY(ssl->keys.client_write_IV,
3903                    keys->client_write_IV, sz);
3904    #endif
3905        XMEMCPY(keys->client_write_IV, &keyData[i], sz);
3906        i += (int)sz;
3907    }
3908    if (side & PROVISION_SERVER) {
3909    #ifdef WOLFSSL_DTLS
3910        if (scr_copy)
3911            XMEMCPY(ssl->keys.server_write_IV,
3912                    keys->server_write_IV, sz);
3913    #endif
3914        XMEMCPY(keys->server_write_IV, &keyData[i], sz);
3915    }
3916
3917#ifdef HAVE_AEAD
3918    if (ssl->specs.cipher_type == aead) {
3919        /* Initialize the AES-GCM/CCM explicit IV to a zero. */
3920    #ifdef WOLFSSL_DTLS
3921        if (scr_copy)
3922            XMEMMOVE(ssl->keys.aead_exp_IV,
3923                    keys->aead_exp_IV, AEAD_MAX_EXP_SZ);
3924    #endif
3925        XMEMSET(keys->aead_exp_IV, 0, AEAD_MAX_EXP_SZ);
3926    }
3927#endif
3928
3929    return 0;
3930}
3931
3932#ifndef NO_OLD_TLS
3933int DeriveKeys(WOLFSSL* ssl)
3934{
3935    int    length = 2 * ssl->specs.hash_size +
3936                    2 * ssl->specs.key_size  +
3937                    2 * ssl->specs.iv_size;
3938    int    rounds = (length + WC_MD5_DIGEST_SIZE - 1 ) / WC_MD5_DIGEST_SIZE;
3939    int    ret = 0;
3940
3941#ifdef WOLFSSL_SMALL_STACK
3942    byte*  shaOutput;
3943    byte*  md5Input;
3944    byte*  shaInput;
3945    byte*  keyData;
3946    wc_Md5* md5;
3947    wc_Sha* sha;
3948#else
3949    byte   shaOutput[WC_SHA_DIGEST_SIZE];
3950    byte   md5Input[SECRET_LEN + WC_SHA_DIGEST_SIZE];
3951    byte   shaInput[KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN];
3952    byte   keyData[KEY_PREFIX * WC_MD5_DIGEST_SIZE];
3953    wc_Md5 md5[1];
3954    wc_Sha sha[1];
3955#endif
3956
3957#ifdef WOLFSSL_SMALL_STACK
3958    shaOutput = (byte*)XMALLOC(WC_SHA_DIGEST_SIZE,
3959                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
3960    md5Input  = (byte*)XMALLOC(SECRET_LEN + WC_SHA_DIGEST_SIZE,
3961                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
3962    shaInput  = (byte*)XMALLOC(KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN,
3963                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
3964    keyData   = (byte*)XMALLOC(KEY_PREFIX * WC_MD5_DIGEST_SIZE,
3965                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
3966    md5       =  (wc_Md5*)XMALLOC(sizeof(wc_Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3967    sha       =  (wc_Sha*)XMALLOC(sizeof(wc_Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3968
3969    if (shaOutput == NULL || md5Input == NULL || shaInput == NULL ||
3970        keyData   == NULL || md5      == NULL || sha      == NULL) {
3971        XFREE(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3972        XFREE(md5Input, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3973        XFREE(shaInput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3974        XFREE(keyData, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3975        XFREE(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3976        XFREE(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3977
3978        return MEMORY_E;
3979    }
3980#endif
3981
3982    XMEMSET(shaOutput, 0, WC_SHA_DIGEST_SIZE);
3983    ret = wc_InitMd5(md5);
3984    if (ret == 0) {
3985        ret = wc_InitSha(sha);
3986    }
3987    if (ret == 0) {
3988        int i;
3989
3990        XMEMCPY(md5Input, ssl->arrays->masterSecret, SECRET_LEN);
3991
3992        for (i = 0; i < rounds; ++i) {
3993            int j   = i + 1;
3994            int idx = j;
3995
3996            if (!SetPrefix(shaInput, i)) {
3997                ret = PREFIX_ERROR;
3998                break;
3999            }
4000
4001            XMEMCPY(shaInput + idx, ssl->arrays->masterSecret, SECRET_LEN);
4002            idx += SECRET_LEN;
4003            XMEMCPY(shaInput + idx, ssl->arrays->serverRandom, RAN_LEN);
4004            idx += RAN_LEN;
4005            XMEMCPY(shaInput + idx, ssl->arrays->clientRandom, RAN_LEN);
4006            if (ret == 0) {
4007                ret = wc_ShaUpdate(sha, shaInput,
4008                    (KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN) - KEY_PREFIX +
4009                        (word32)(j));
4010            }
4011            if (ret == 0) {
4012                ret = wc_ShaFinal(sha, shaOutput);
4013            }
4014
4015            XMEMCPY(md5Input + SECRET_LEN, shaOutput, WC_SHA_DIGEST_SIZE);
4016            if (ret == 0) {
4017                ret = wc_Md5Update(md5, md5Input, SECRET_LEN + WC_SHA_DIGEST_SIZE);
4018            }
4019            if (ret == 0) {
4020                ret = wc_Md5Final(md5, keyData + i * WC_MD5_DIGEST_SIZE);
4021            }
4022        }
4023
4024        if (ret == 0)
4025            ret = StoreKeys(ssl, keyData, PROVISION_CLIENT_SERVER);
4026    }
4027
4028#ifdef WOLFSSL_CHECK_MEM_ZERO
4029    wc_MemZero_Add("DeriveKeys shaOutput", shaOutput, WC_SHA_DIGEST_SIZE);
4030    wc_MemZero_Add("DeriveKeys md5Input", md5Input,
4031                   SECRET_LEN + WC_SHA_DIGEST_SIZE);
4032    wc_MemZero_Add("DeriveKeys shaInput", shaInput,
4033                   KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN);
4034    wc_MemZero_Add("DeriveKeys keyData", keyData,
4035                   KEY_PREFIX * WC_MD5_DIGEST_SIZE);
4036#endif
4037    ForceZero(shaOutput, WC_SHA_DIGEST_SIZE);
4038    ForceZero(md5Input, SECRET_LEN + WC_SHA_DIGEST_SIZE);
4039    ForceZero(shaInput, KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN);
4040    ForceZero(keyData, KEY_PREFIX * WC_MD5_DIGEST_SIZE);
4041#ifdef WOLFSSL_CHECK_MEM_ZERO
4042    wc_MemZero_Check(shaOutput, WC_SHA_DIGEST_SIZE);
4043    wc_MemZero_Check(md5Input, SECRET_LEN + WC_SHA_DIGEST_SIZE);
4044    wc_MemZero_Check(shaInput, KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN);
4045    wc_MemZero_Check(keyData, KEY_PREFIX * WC_MD5_DIGEST_SIZE);
4046#endif
4047
4048    WC_FREE_VAR_EX(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4049    WC_FREE_VAR_EX(md5Input, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4050    WC_FREE_VAR_EX(shaInput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4051    WC_FREE_VAR_EX(keyData, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4052    WC_FREE_VAR_EX(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4053    WC_FREE_VAR_EX(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4054
4055    return ret;
4056}
4057
4058
4059static void CleanPreMaster(WOLFSSL* ssl)
4060{
4061    int sz = (int)(ssl->arrays->preMasterSz);
4062
4063#ifdef WOLFSSL_CHECK_MEM_ZERO
4064    wc_MemZero_Add("CleanPreMaster preMasterSecret",
4065                   ssl->arrays->preMasterSecret, sz);
4066#endif
4067
4068    ForceZero(ssl->arrays->preMasterSecret, sz);
4069
4070#ifdef WOLFSSL_CHECK_MEM_ZERO
4071    wc_MemZero_Check(ssl->arrays->preMasterSecret, sz);
4072#endif
4073
4074    XFREE(ssl->arrays->preMasterSecret, ssl->heap, DYNAMIC_TYPE_SECRET);
4075    ssl->arrays->preMasterSecret = NULL;
4076    ssl->arrays->preMasterSz = 0;
4077}
4078
4079
4080/* Create and store the master secret see page 32, 6.1 */
4081static int MakeSslMasterSecret(WOLFSSL* ssl)
4082{
4083    int    i, ret;
4084    word32 idx;
4085    word32 pmsSz = ssl->arrays->preMasterSz;
4086
4087#ifdef WOLFSSL_SMALL_STACK
4088    byte*  shaOutput;
4089    byte*  md5Input;
4090    byte*  shaInput;
4091    wc_Md5* md5;
4092    wc_Sha* sha;
4093#else
4094    byte   shaOutput[WC_SHA_DIGEST_SIZE];
4095    byte   md5Input[ENCRYPT_LEN + WC_SHA_DIGEST_SIZE];
4096    byte   shaInput[PREFIX + ENCRYPT_LEN + 2 * RAN_LEN];
4097    wc_Md5 md5[1];
4098    wc_Sha sha[1];
4099#endif
4100
4101    if (ssl->arrays->preMasterSecret == NULL) {
4102        return BAD_FUNC_ARG;
4103    }
4104
4105#ifdef SHOW_SECRETS
4106    {
4107        word32 j;
4108        printf("pre master secret: ");
4109        for (j = 0; j < pmsSz; j++)
4110            printf("%02x", ssl->arrays->preMasterSecret[j]);
4111        printf("\n");
4112    }
4113#endif
4114
4115#ifdef WOLFSSL_SMALL_STACK
4116    shaOutput = (byte*)XMALLOC(WC_SHA_DIGEST_SIZE,
4117                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
4118    md5Input  = (byte*)XMALLOC(ENCRYPT_LEN + WC_SHA_DIGEST_SIZE,
4119                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
4120    shaInput  = (byte*)XMALLOC(PREFIX + ENCRYPT_LEN + 2 * RAN_LEN,
4121                                            NULL, DYNAMIC_TYPE_TMP_BUFFER);
4122    md5       =  (wc_Md5*)XMALLOC(sizeof(wc_Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
4123    sha       =  (wc_Sha*)XMALLOC(sizeof(wc_Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
4124
4125    if (shaOutput == NULL || md5Input == NULL || shaInput == NULL ||
4126                             md5      == NULL || sha      == NULL) {
4127        XFREE(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4128        XFREE(md5Input, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4129        XFREE(shaInput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4130        XFREE(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4131        XFREE(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4132
4133        return MEMORY_E;
4134    }
4135#endif
4136#ifdef WOLFSSL_CHECK_MEM_ZERO
4137    wc_MemZero_Add("MakeSslMasterSecret md5Input", md5Input,
4138                   ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
4139    wc_MemZero_Add("MakeSslMasterSecret shaInput", shaInput,
4140                   PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4141#endif
4142
4143    XMEMSET(shaOutput, 0, WC_SHA_DIGEST_SIZE);
4144
4145    ret = wc_InitMd5(md5);
4146    if (ret == 0) {
4147        ret = wc_InitSha(sha);
4148    }
4149    if (ret == 0) {
4150        XMEMCPY(md5Input, ssl->arrays->preMasterSecret, pmsSz);
4151
4152        for (i = 0; i < MASTER_ROUNDS; ++i) {
4153            byte prefix[KEY_PREFIX];      /* only need PREFIX bytes but static */
4154            if (!SetPrefix(prefix, i)) {  /* analysis thinks will overrun      */
4155                ret = PREFIX_ERROR;
4156                break;
4157            }
4158
4159            idx = 0;
4160            XMEMCPY(shaInput, prefix, (size_t)(i + 1));
4161            idx += (word32)(i + 1);
4162
4163            XMEMCPY(shaInput + idx, ssl->arrays->preMasterSecret, pmsSz);
4164            idx += pmsSz;
4165            XMEMCPY(shaInput + idx, ssl->arrays->clientRandom, RAN_LEN);
4166            idx += RAN_LEN;
4167            XMEMCPY(shaInput + idx, ssl->arrays->serverRandom, RAN_LEN);
4168            idx += RAN_LEN;
4169            if (ret == 0) {
4170                ret = wc_ShaUpdate(sha, shaInput, idx);
4171            }
4172            if (ret == 0) {
4173                ret = wc_ShaFinal(sha, shaOutput);
4174            }
4175            idx = pmsSz;  /* preSz */
4176            XMEMCPY(md5Input + idx, shaOutput, WC_SHA_DIGEST_SIZE);
4177            idx += WC_SHA_DIGEST_SIZE;
4178            if (ret == 0) {
4179                ret = wc_Md5Update(md5, md5Input, idx);
4180            }
4181            if (ret == 0) {
4182                ret = wc_Md5Final(md5,
4183                            &ssl->arrays->masterSecret[i * WC_MD5_DIGEST_SIZE]);
4184            }
4185        }
4186
4187#ifdef SHOW_SECRETS
4188        {
4189            word32 j;
4190            printf("master secret: ");
4191            for (j = 0; j < SECRET_LEN; j++)
4192                printf("%02x", ssl->arrays->masterSecret[j]);
4193            printf("\n");
4194        }
4195#endif
4196
4197        if (ret == 0)
4198            ret = DeriveKeys(ssl);
4199    }
4200
4201    ForceZero(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
4202    ForceZero(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4203#ifdef WOLFSSL_CHECK_MEM_ZERO
4204    wc_MemZero_Check(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
4205    wc_MemZero_Check(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4206#endif
4207
4208    WC_FREE_VAR_EX(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4209    WC_FREE_VAR_EX(md5Input, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4210    WC_FREE_VAR_EX(shaInput, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4211    WC_FREE_VAR_EX(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4212    WC_FREE_VAR_EX(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4213
4214    CleanPreMaster(ssl);
4215
4216    return ret;
4217}
4218#endif
4219
4220
4221/* Master wrapper, doesn't use SSL stack space in TLS mode */
4222int MakeMasterSecret(WOLFSSL* ssl)
4223{
4224    /* append secret to premaster : premaster | SerSi | CliSi */
4225#ifndef NO_OLD_TLS
4226    if (ssl->options.tls) return MakeTlsMasterSecret(ssl);
4227    return MakeSslMasterSecret(ssl);
4228#elif !defined(WOLFSSL_NO_TLS12) && !defined(NO_TLS)
4229    return MakeTlsMasterSecret(ssl);
4230#else
4231    (void)ssl;
4232    return 0;
4233#endif
4234}
4235
4236#endif /* !WOLFCRYPT_ONLY && !NO_TLS */