Add support for SHAKE by padelsbach · Pull Request #523 · wolfSSL/wolfHSM

padelsbach · 2026-09-16T23:20:16Z

Follows patterns from SHA3

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #523

Scan targets checked: wolfhsm-core-bugs, wolfhsm-crypto-bugs, wolfhsm-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

bigbrett · 2026-09-21T17:37:01Z

@padelsbach plz investigate fenrir issues and resolve + assign me back the bot if ready to go. That said we don't want to merge unless the upstream wolfCrypt stuff is all in first

Copilot

Copilot review overview

🟡 Changes recommended

Missing-server responses are not consistently converted into software fallback signals, causing SHAKE operations to fail in mixed-feature deployments.

Review effort: Balanced
Findings: 1

Open (1)

Convert SHAKE XOF unsupported status for software fallback · New

What changed in this PR

Adds SHAKE128/256 offload support following the existing SHA3 client/server architecture.

Changes:

Adds SHAKE wire messages, client APIs, callbacks, and server handling.
Adds extensive functional, validation, and fallback tests.
Adds SHAKE build variants and updates the wolfSSL dependency revision.

File	Description
`wolfhsm/wh_message_crypto.h`	Defines SHAKE wire formats and limits.
`wolfhsm/wh_client_crypto.h`	Declares SHAKE client APIs.
`src/wh_message_crypto.c`	Implements message translation.
`src/wh_client_crypto.c`	Implements SHAKE client offload.
`src/wh_client_cryptocb.c`	Adds wolfCrypt callback dispatch.
`src/wh_server_crypto.c`	Adds server-side SHAKE processing.
`test-refactor/client-server/wh_test_crypto_shake.c`	Adds comprehensive SHAKE tests.
`test-refactor/wh_test_list.c`	Registers the new tests.
`test-refactor/posix/Makefile`	Adds SHAKE build variants.
`test/config/user_settings.h`	Configures SHAKE and dependent algorithms.
`test/Makefile`	Configures wolfCrypt certificate paths.
`test/wh_test_check_struct_padding.c`	Checks new message padding.
`test-refactor/misc/wh_test_check_struct_padding.c`	Checks refactored-build padding.
`.github/workflows/build-and-test-refactor.yml`	Tests individual SHAKE configurations.
`.github/actions/checkout-wolfssl/action.yml`	Pins the required wolfSSL revision.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Frauschi

Looks good overall. Main issue is the silent software fallback for large outputs; a few smaller things inline.

Frauschi · 2026-10-27T16:45:55Z

+#endif
+                }
+                /* Output too big for one response; let software produce it */
+                if (ret == WH_ERROR_NOSPACE) {


Output above WH_MESSAGE_CRYPTO_SHAKE_MAX_INLINE_OUTPUT_SZ turns into CRYPTOCB_UNAVAILABLE here, so the hash silently finishes in software. We don't want a silent fallback on the offload path; this should either run on the HSM or fail. Absorb plus the chunked squeeze you already added could produce long outputs on the server.

Dropped the fallback

Frauschi · 2026-10-27T16:45:55Z

+
+    capacity = _ShakeUpdatePerCallCapacity(sha, v);
+    if (inLen > capacity) {
+        return WH_ERROR_BADARGS;


Other hash UpdateRequests return WH_ERROR_REQUEST_SIZE for an oversized inLen; SHAKE returns BADARGS. These SHAKE helpers are mostly copies of the SHA3 ones and already drifting, could they be shared since wc_Shake is a wc_Sha3?

Yep, added helper _Sha3PackUpdate

Frauschi · 2026-10-27T16:45:55Z

+        res.outSz = req.outSz;
+    }
+
+    ops.freeFn(shake);


shake, req and res hold sponge state derived from secret input (ML-DSA/ML-KEM seeds) and aren't zeroed. Can we wc_ForceZero them before returning, like the client side does?

Yes, good catch. Refactored _HandleShake to cleanup at the end

Frauschi · 2026-10-27T16:45:55Z

+        return WH_ERROR_BADARGS;
+    }
+    if ((op != WH_MESSAGE_CRYPTO_SHAKE_OP_ABSORB) &&
+        ((out == NULL) || (outSz == 0))) {


Rejecting out == NULL before receiving leaves the server's reply in the comm buffer, so the next request reads a stale response. Validate in the request path instead.

Reworked to receive the reply first, then reject

Frauschi · 2026-10-27T16:45:55Z

+    /* Save state so a software fallback does not absorb input twice */
+    _ShakeSaveState(sha, &saved);
+
+    ret = _ShakeUpdateAll(ctx, sha, v, in, inLen);


Move the outSz limit check before _ShakeUpdateAll, otherwise a too-large output streams all of in to the server first and then throws it away.

Limit and check is only on the server now

Frauschi · 2026-10-27T16:45:55Z

+            memcpy(out, (uint8_t*)(res + 1), outSz);
+        }
+        if (op == WH_MESSAGE_CRYPTO_SHAKE_OP_HASH) {
+            ret = v->resetFn(sha);


Minor: SHA3 resets with v->initFn, SHAKE with wc_Shake*_Reset, which frees and re-inits and can dispatch a FREE back into the callback. Using initFn would keep them consistent.

Switched to v->initFn

Frauschi · 2026-10-27T16:45:55Z


+#if defined(WOLF_CRYPTO_CB_SHAKE_XOF) && \
+    (defined(WOLFSSL_SHAKE128) || defined(WOLFSSL_SHAKE256))
+/* Declining an unknown op is safe as the wc_Shake state is still current */


Nit: some new comments explain reasoning rather than code (this one, "Additive to avoid unsigned wrap", "A silent decline would still match software..."). I'd drop or shorten them.

I usually comment about "why" and let the code describe "how". But these have been cleaned up

…ffer and comment cleanup

padelsbach force-pushed the crypto-cb-shake branch from a7b236f to c242d8b Compare September 18, 2026 20:11

padelsbach marked this pull request as ready for review September 18, 2026 20:41

padelsbach assigned padelsbach and bigbrett and unassigned padelsbach Sep 18, 2026

padelsbach requested review from bigbrett and wolfSSL-Fenrir-bot September 18, 2026 21:41

wolfSSL-Fenrir-bot requested changes Sep 18, 2026

View reviewed changes

Comment thread test-refactor/client-server/wh_test_crypto_shake.c

Comment thread src/wh_client_crypto.c

Comment thread src/wh_client_crypto.c Outdated

Comment thread src/wh_client_crypto.c Outdated

Comment thread test-refactor/client-server/wh_test_crypto_shake.c

padelsbach mentioned this pull request Sep 18, 2026

SHA-3: zeroize working buffers #525

Closed

bigbrett assigned padelsbach and unassigned bigbrett Sep 21, 2026

padelsbach assigned bigbrett and padelsbach and unassigned padelsbach and bigbrett Sep 21, 2026

padelsbach mentioned this pull request Sep 24, 2026

Add crypto callback for SHAKE absorb and squeeze ops wolfSSL/wolfssl#11548

Merged

1 of 4 tasks

padelsbach changed the title ~~Add crypto callback for SHAKE~~ Add support for SHAKE Sep 25, 2026

Copilot AI balanced review requested due to automatic review settings October 3, 2026 03:32

padelsbach force-pushed the crypto-cb-shake branch from d767420 to e8f26b1 Compare October 3, 2026 03:32

Copilot started reviewing on behalf of padelsbach October 3, 2026 03:33

View session

Copilot AI reviewed Oct 3, 2026

View reviewed changes

Comment thread src/wh_client_cryptocb.c

padelsbach force-pushed the crypto-cb-shake branch from 9b2cb26 to ee8fea0 Compare October 9, 2026 21:40

padelsbach added 7 commits October 23, 2026 10:36

Add crypto callback for SHAKE

27a4815

PR feedback: reject Keccak mode, zeroization, test updates

eec0417

Cleanup comments and a couple unrelated changes

99d0df8

Add WOLF_CRYPTO_CB_SHAKE_XOF

7d6bfe3

Integrate absorb and squeeze from wolfSSL

4f4f45c

PR feedback: add wc_Shake*_Reset(), add/update test cases

1ee299f

Fix scan-build issue

7b729ca

SHAKE: clean up comments

0455f93

padelsbach force-pushed the crypto-cb-shake branch from ee8fea0 to 0455f93 Compare October 23, 2026 18:24

padelsbach assigned bigbrett and unassigned padelsbach Oct 23, 2026

Address clang-format-18 issues

477a09a

bigbrett assigned Frauschi and rizlik and unassigned bigbrett Oct 26, 2026

bigbrett requested review from Frauschi and rizlik October 26, 2026 15:15

Frauschi reviewed Oct 27, 2026

View reviewed changes

Frauschi assigned padelsbach and unassigned Frauschi Oct 27, 2026

PR feedback: disable shake fallback, reuse with SHA3, zeroization, bu…

4d26017

…ffer and comment cleanup

padelsbach assigned Frauschi and unassigned padelsbach Oct 28, 2026

padelsbach requested a review from Frauschi October 28, 2026 18:09

Conversation

padelsbach commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #523

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bigbrett commented Sep 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

padelsbach commented Sep 16, 2026 •

edited

Loading