Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder

.github/workflows/iperf.yml

@@ -111,9 +111,11 @@ jobs:
           mkdir -p $KEY_DIR
           cd $KEY_DIR
           # Generate RSA keys for iperf tests
+          # PBKDF2 keys HMAC with the passphrase, and FIPS modules before
+          # v6.0.0 reject HMAC keys under 14 bytes, so keep this >= 14.
           openssl genrsa -out rsa_private_unprotected.pem 2048
-          openssl rsa -in rsa_private_unprotected.pem -out rsa_private.pem -aes256 -passout 'pass:password'
-          openssl rsa -in rsa_private.pem -pubout -out rsa_public.pem -passin 'pass:password'
+          openssl rsa -in rsa_private_unprotected.pem -out rsa_private.pem -aes256 -passout 'pass:wolfprov-iperf-pass'
+          openssl rsa -in rsa_private.pem -pubout -out rsa_public.pem -passin 'pass:wolfprov-iperf-pass'
           # Create a credentials file for iperf
           # Username: mario, Password: rossi
           echo "mario,bf7a49a846d44b454a5d11e7acfaf13d138bbe0b7483aa3e050879700572709b" > credentials.csv

include/wolfprovider/settings.h

@@ -43,6 +43,13 @@
     #define WP_HAVE_DRBG_RESEED
 #endif
 
+/* The PKCS#8 encrypt/decrypt helpers need PKCS#8 and password-based key
+ * derivation. wolfSSL derives WOLFSSL_ENCRYPTED_KEYS from OPENSSL_EXTRA, which
+ * a FIPS build does not set even though both are present. */
+#if defined(HAVE_PKCS8) && !defined(NO_PWDBASED)
+    #define WP_HAVE_PKCS8_ENC
+#endif
+
 #define WP_HAVE_DIGEST
 #if !defined(NO_MD5)
     #define WP_HAVE_MD5

scripts/cmd_test/do-cmd-tests.sh

@@ -33,6 +33,7 @@ RUN_AES=0
 RUN_RSA=0
 RUN_ECC=0
 RUN_REQ=0
+RUN_PKCS8=0
 RUN_ALL=1
 
 show_help() {
@@ -50,6 +51,7 @@ TESTS (if none specified, all tests run):
     rsa                 Run RSA key generation test
     ecc                 Run ECC key generation test
     req                 Run certificate request test
+    pkcs8               Run PKCS#8 encryption command test
 
 ENVIRONMENT VARIABLES:
     OPENSSL_BIN              Path to OpenSSL binary (auto-detected with which(openssl) if not set)
@@ -92,6 +94,11 @@ while [[ $# -gt 0 ]]; do
             RUN_ALL=0
             shift
             ;;
+        pkcs8)
+            RUN_PKCS8=1
+            RUN_ALL=0
+            shift
+            ;;
         *)
             echo "Unknown option: $1"
             echo "Use --help for usage information"
@@ -107,6 +114,7 @@ if [ $RUN_ALL -eq 1 ]; then
     RUN_RSA=1
     RUN_ECC=1
     RUN_REQ=1
+    RUN_PKCS8=1
 fi
 
 source "${CMD_TEST_DIR}/cmd-test-common.sh"
@@ -168,6 +176,7 @@ AES_RESULT=0
 RSA_RESULT=0
 ECC_RESULT=0
 REQ_RESULT=0
+PKCS8_RESULT=0
 
 # Run the hash comparison test
 if [ $RUN_HASH -eq 1 ]; then
@@ -204,6 +213,12 @@ if [ $RUN_REQ -eq 1 ]; then
     REQ_RESULT=$?
 fi
 
+if [ $RUN_PKCS8 -eq 1 ]; then
+    echo -e "\n=== Running PKCS#8 Command Test ==="
+    "${REPO_ROOT}/scripts/cmd_test/pkcs8-cmd-test.sh"
+    PKCS8_RESULT=$?
+fi
+
 # Check results
 ALL_PASSED=1
 if [ $RUN_HASH -eq 1 ] && [ $HASH_RESULT -ne 0 ]; then
@@ -221,6 +236,9 @@ fi
 if [ $RUN_REQ -eq 1 ] && [ $REQ_RESULT -ne 0 ]; then
     ALL_PASSED=0
 fi
+if [ $RUN_PKCS8 -eq 1 ] && [ $PKCS8_RESULT -ne 0 ]; then
+    ALL_PASSED=0
+fi
 
 if [ $ALL_PASSED -eq 1 ]; then
     echo -e "\n=== All Command-Line Tests Passed ==="
@@ -256,5 +274,8 @@ fi
 if [ $RUN_REQ -eq 1 ]; then
     echo "REQ Test Result: $REQ_RESULT (0=success)"
 fi
+if [ $RUN_PKCS8 -eq 1 ]; then
+    echo "PKCS#8 Test Result: $PKCS8_RESULT (0=success)"
+fi
 
 exit $((1 - ALL_PASSED))

scripts/cmd_test/pkcs8-cmd-test.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+# Verify that the pkey command honors -aes256 for provider private-key encoders.
+
+CMD_TEST_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+source "${CMD_TEST_DIR}/cmd-test-common.sh"
+source "${CMD_TEST_DIR}/clean-cmd-test.sh"
+
+if [ -z "${DO_CMD_TESTS:-}" ]; then
+    echo "This script is designed to be called from do-cmd-tests.sh"
+    exit 1
+fi
+
+cmd_test_init "pkcs8-cmd-test.log"
+clean_cmd_test "pkcs8"
+mkdir -p pkcs8_outputs
+FAIL=0
+
+test_pkey_cipher() {
+    local name=$1
+    local keygen=$2
+    local input="pkcs8_outputs/${name}.pem"
+    local output="pkcs8_outputs/${name}-encrypted.pem"
+
+    use_wolf_provider
+    if ! eval "$keygen" >"$input" 2>/dev/null; then
+        echo "[FAIL] ${name} key generation failed"
+        FAIL=1
+        return 1
+    fi
+    if ! $OPENSSL_BIN pkey -aes256 -passout pass:wolfprov-test-pass \
+            -in "$input" -out "$output" 2>/dev/null; then
+        echo "[FAIL] ${name} pkey encryption failed"
+        FAIL=1
+        return 1
+    fi
+    if ! grep -q "BEGIN ENCRYPTED PRIVATE KEY" "$output"; then
+        echo "[FAIL] ${name} pkey -aes256 produced an unencrypted key"
+        FAIL=1
+        return 1
+    else
+        echo "[PASS] ${name} pkey -aes256 produced EncryptedPrivateKeyInfo"
+        check_force_fail
+    fi
+    return 0
+}
+
+test_pkey_cipher "ec" "$OPENSSL_BIN genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1"
+if [ "${WOLFSSL_ISFIPS:-0}" != "1" ] &&
+    $OPENSSL_BIN list -public-key-algorithms -provider libwolfprov 2>/dev/null |
+        grep -q "ED25519"; then
+    test_pkey_cipher "ed25519" "$OPENSSL_BIN genpkey -algorithm ED25519"
+else
+    echo "[SKIP] Ed25519 is unavailable in this OpenSSL/provider build"
+fi
+if [ "${WOLFSSL_ISFIPS:-0}" != "1" ] &&
+    $OPENSSL_BIN list -public-key-algorithms -provider libwolfprov 2>/dev/null |
+        grep -q "X25519"; then
+    test_pkey_cipher "x25519" "$OPENSSL_BIN genpkey -algorithm X25519"
+else
+    echo "[SKIP] X25519 is unavailable in this OpenSSL/provider build"
+fi
+test_pkey_cipher "rsa" "$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048"
+
+# DH requires a generated parameter file before the private key can be made.
+use_wolf_provider
+if $OPENSSL_BIN genpkey -genparam -algorithm DH \
+        -pkeyopt dh_paramgen_prime_len:2048 \
+        -out pkcs8_outputs/dh-params.pem 2>/dev/null &&
+    test_pkey_cipher "dh" "$OPENSSL_BIN genpkey -paramfile pkcs8_outputs/dh-params.pem"; then
+    :
+else
+    echo "[FAIL] DH PKCS#8 command test failed"
+    FAIL=1
+fi
+
+# OpenSSL versions before 3.6 do not provide the standardized PQC names.
+for algorithm in ML-DSA-44 ML-DSA-65 ML-DSA-87; do
+    if $OPENSSL_BIN list -signature-algorithms -provider libwolfprov 2>/dev/null |
+            grep -q "${algorithm}"; then
+        test_pkey_cipher "${algorithm}" \
+            "$OPENSSL_BIN genpkey -algorithm ${algorithm}"
+    else
+        echo "[SKIP] ${algorithm} is unavailable in this OpenSSL/provider build"
+    fi
+done
+
+for algorithm in ML-KEM-512 ML-KEM-768 ML-KEM-1024; do
+    if $OPENSSL_BIN list -kem-algorithms -provider libwolfprov 2>/dev/null |
+            grep -q "${algorithm}"; then
+        test_pkey_cipher "${algorithm}" \
+            "$OPENSSL_BIN genpkey -algorithm ${algorithm}"
+    else
+        echo "[SKIP] ${algorithm} is unavailable in this OpenSSL/provider build"
+    fi
+done
+
+if [ "${WOLFPROV_FORCE_FAIL:-0}" = "1" ]; then
+    if [ "$FORCE_FAIL_PASSED" -eq 1 ]; then
+        echo "[FAIL] PKCS#8 command tests unexpectedly passed with force-fail"
+        exit 1
+    fi
+elif [ "$FAIL" -ne 0 ]; then
+    exit 1
+fi
+exit 0

scripts/test-wp-cs.sh

@@ -36,21 +36,33 @@ prepend() { # Usage: cmd 2>&1 | prepend "sometext "
     while read line; do echo "${1}${line}"; done
 }
 
-check_process_running() {
-    if [ "$1" = "-1" ]; then
-        echo 1
-    else
-        ps -p $1 > /dev/null
-        echo $?
-    fi
-}
-
 kill_servers() {
     if [ "$(jobs -p)" != "" ]; then
-        kill $(jobs -p)
+        kill $(jobs -p) 2>/dev/null || true
     fi
 }
 
+wait_for_server() {
+    local log_offset=$1
+    local retries=100
+
+    while [ "$retries" -gt 0 ]; do
+        if tail -c "+$((log_offset + 1))" "$LOG_FILE" 2>/dev/null |
+                grep -q "\[server\] ACCEPT"; then
+            return 0
+        fi
+        if ! kill -0 "$OPENSSL_SERVER_PID" 2>/dev/null; then
+            printf "OpenSSL server exited before accepting connections\n"
+            return 1
+        fi
+        retries=$((retries - 1))
+        sleep 0.1
+    done
+
+    printf "OpenSSL server did not accept connections within 10 seconds\n"
+    return 1
+}
+
 do_cleanup() {
     sleep 0.5 # flush buffers
     kill_servers
@@ -183,19 +195,20 @@ generate_port() {
 }
 
 start_openssl_server() { # usage: start_openssl_server [extraArgs]
+    local log_offset
+
     kill_servers
+    log_offset=$(wc -c < "$LOG_FILE")
 
     stdbuf -oL -eL $OPENSSL_BIN s_server -www $1 \
          -cert $CERT_DIR/server-cert.pem -key $CERT_DIR/server-key.pem \
          -dcert $CERT_DIR/server-ecc.pem -dkey $CERT_DIR/ecc-key.pem \
          -accept $OPENSSL_PORT $OPENSSL_ALL_CIPHERS \
          2>&1 | prepend "[server] " >>$LOG_FILE &
-    OPENSSL_SERVER_PID=$(($! - 1))
-
-    sleep 0.5
+    OPENSSL_SERVER_PID=$!
 
-    if [ $(check_process_running $OPENSSL_SERVER_PID) != "0" ]; then
-        printf "OpenSSL server might have failed to start (PID=$OPENSSL_SERVER_PID)\n"
+    if ! wait_for_server "$log_offset"; then
+        return 1
     fi
 }
 
@@ -304,12 +317,13 @@ if [ "${AM_BWRAPPED-}" != "yes" ]; then
 fi
 
 printf "Client testing\n" | tee $LOG_FILE
-start_openssl_server
+start_openssl_server || exit 1
 do_client_test "-provider-path $WOLFPROV_PATH -provider $WOLFPROV_NAME"
 kill_servers
 
 printf "Server testing\n" | tee -a $LOG_FILE
-start_openssl_server "-provider-path $WOLFPROV_PATH -provider $WOLFPROV_NAME"
+start_openssl_server \
+    "-provider-path $WOLFPROV_PATH -provider $WOLFPROV_NAME" || exit 1
 do_client_test
 kill_servers