From 9a83a7bf53106ae4726821ab8c04e700503f6ab7 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 25 Aug 2026 15:45:09 -0700
Subject: [PATCH 1/4] F-8683 - Correct RSA-PSS parameter reporting

---
 src/wp_rsa_kmgmt.c | 170 +++++++++++++++++++++++++++++++----------
 test/test_rsa.c    | 187 +++++++++++++++++++++++++++++++++++++++------
 2 files changed, 293 insertions(+), 64 deletions(-)

diff --git a/src/wp_rsa_kmgmt.c b/src/wp_rsa_kmgmt.c
index a9fe71b1..5b23fa35 100644
--- a/src/wp_rsa_kmgmt.c
+++ b/src/wp_rsa_kmgmt.c
@@ -99,6 +99,17 @@ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_COEFFICIENT1, NULL, 0)
     #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
 #endif
 
+/** SHA-224 Algorithm ID DER encoding in PSS parameters. */
+static const byte sha224AlgId[] = {
+    0xa0, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86,
+    0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
+};
+/** SHA-224 Algorithm ID with NULL DER encoding in PSS parameters. */
+static const byte sha224AlgIdNull[] = {
+    0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
+    0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05,
+    0x00
+};
 /** SHA-256 Algorithm ID DER encoding in PSS parameters. */
 static const byte sha256AlgId[] = {
     0xa0, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86,
@@ -133,6 +144,20 @@ static const byte sha512AlgIdNull[] = {
     0x00
 };
 
+/** MGF1 SHA-224 Algorithm ID DER encoding in PSS parameters. */
+static const byte mgf1Sha224AlgId[] = {
+    0xa1, 0x1a, 0x30, 0x18, 0x06, 0x09, 0x2a, 0x86,
+    0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
+    0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
+    0x03, 0x04, 0x02, 0x04
+};
+/** MGF1 SHA-224 Algorithm ID with NULL DER encoding in PSS parameters. */
+static const byte mgf1Sha224AlgIdNull[] = {
+    0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
+    0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
+    0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
+    0x03, 0x04, 0x02, 0x04, 0x05, 0x00
+};
 /** MGF1 SHA-256 Algorithm ID DER encoding in PSS parameters. */
 static const byte mgf1Sha256AlgId[] = {
     0xa1, 0x1a, 0x30, 0x18, 0x06, 0x09, 0x2a, 0x86,
@@ -624,8 +649,9 @@ static int wp_rsa_pss_params_set_pss_defaults(wp_RsaPssParams* pss)
 
     pss->hashType = WP_RSA_PSS_DIGEST_DEF;
     pss->mgf = WP_RSA_PSS_MGF_DEF;
-    XSTRNCPY(pss->mdName, "SHA-1", sizeof(pss->mdName));
-    XSTRNCPY(pss->mgfMdName, "SHA-1", sizeof(pss->mgfMdName));
+    XSTRNCPY(pss->mdName, OSSL_DIGEST_NAME_SHA1, sizeof(pss->mdName));
+    XSTRNCPY(pss->mgfMdName, OSSL_DIGEST_NAME_SHA1,
+        sizeof(pss->mgfMdName));
     pss->saltLen = WP_RSA_DEFAULT_SALT_LEN;
     pss->derTrailer = 1; /* Default: RFC8017 A.2.3 */
 
@@ -647,14 +673,18 @@ static int wp_rsa_pss_params_setup_mgf1_md(wp_RsaPssParams* pss,
     const char* mdName, const char* mdProps, OSSL_LIB_CTX* libCtx)
 {
     int ok = 1;
+    int mgf;
 
     WOLFPROV_ENTER(WP_LOG_COMP_RSA, "wp_rsa_pss_params_setup_mgf1_md");
 
-    OPENSSL_strlcpy(pss->mgfMdName, mdName, sizeof(pss->mgfMdName));
-    pss->mgf = wp_name_to_wc_mgf(libCtx, mdName, mdProps);
-    if (pss->mgf == WC_MGF1NONE) {
+    mgf = wp_name_to_wc_mgf(libCtx, mdName, mdProps);
+    if (mgf == WC_MGF1NONE) {
         ok = 0;
     }
+    else {
+        OPENSSL_strlcpy(pss->mgfMdName, mdName, sizeof(pss->mgfMdName));
+        pss->mgf = mgf;
+    }
 
     WOLFPROV_LEAVE(WP_LOG_COMP_RSA, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);
     return ok;
@@ -956,6 +986,10 @@ static int wp_digest_to_ossl_digest(enum wc_HashType hashType,
         *osslDigest = OSSL_DIGEST_NAME_SHA1;
         break;
 
+    case WC_HASH_TYPE_SHA224:
+        *osslDigest = OSSL_DIGEST_NAME_SHA2_224;
+        break;
+
     case WC_HASH_TYPE_SHA256:
         *osslDigest = OSSL_DIGEST_NAME_SHA2_256;
         break;
@@ -971,7 +1005,6 @@ static int wp_digest_to_ossl_digest(enum wc_HashType hashType,
     case WC_HASH_TYPE_NONE:
     case WC_HASH_TYPE_MD2:
     case WC_HASH_TYPE_MD4:
-    case WC_HASH_TYPE_SHA224:
     case WC_HASH_TYPE_MD5_SHA:
     case WC_HASH_TYPE_SHA3_224:
     case WC_HASH_TYPE_SHA3_256:
@@ -1019,8 +1052,9 @@ static int wp_rsa_get_params_pss(wp_RsaPssParams* pss,  OSSL_PARAM params[])
 
     if (pss->hashType != WP_RSA_PSS_DIGEST_DEF) {
         p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_RSA_DIGEST);
-        if ((p != NULL) && wp_digest_to_ossl_digest(pss->hashType, &osslDigest)
-                && !OSSL_PARAM_set_utf8_string(p, osslDigest)) {
+        if ((p != NULL) &&
+            (!wp_digest_to_ossl_digest(pss->hashType, &osslDigest) ||
+             !OSSL_PARAM_set_utf8_string(p, osslDigest))) {
             ok = 0;
         }
     }
@@ -1030,31 +1064,36 @@ static int wp_rsa_get_params_pss(wp_RsaPssParams* pss,  OSSL_PARAM params[])
         p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_RSA_MGF1_DIGEST);
         if (p != NULL) {
             const char* mgfName = NULL;
-            /* Convert mgf type to OpenSSL name via wp_digest_to_ossl_digest. */
-            if (pss->mgf != WP_RSA_PSS_MGF_DEF) {
-                enum wc_HashType mgfHash = WC_HASH_TYPE_NONE;
-                switch (pss->mgf) {
-                    case WC_MGF1SHA256: mgfHash = WC_HASH_TYPE_SHA256; break;
-                    case WC_MGF1SHA384: mgfHash = WC_HASH_TYPE_SHA384; break;
-                    case WC_MGF1SHA512: mgfHash = WC_HASH_TYPE_SHA512; break;
-                    default: break;
-                }
-                if (mgfHash != WC_HASH_TYPE_NONE) {
-                    if (!wp_digest_to_ossl_digest(mgfHash, &mgfName)) {
-                        ok = 0;
-                    }
-                }
-            }
-            /* Fall back to signing digest if MGF1 not explicitly set. */
-            if (ok && mgfName == NULL) {
-                if (!wp_digest_to_ossl_digest(pss->hashType, &mgfName)) {
-                    ok = 0;
-                }
+            enum wc_HashType mgfHash = WC_HASH_TYPE_NONE;
+
+            switch (pss->mgf) {
+            case WC_MGF1SHA1:
+                mgfHash = WC_HASH_TYPE_SHA;
+                break;
+
+            case WC_MGF1SHA224:
+                mgfHash = WC_HASH_TYPE_SHA224;
+                break;
+
+            case WC_MGF1SHA256:
+                mgfHash = WC_HASH_TYPE_SHA256;
+                break;
+
+            case WC_MGF1SHA384:
+                mgfHash = WC_HASH_TYPE_SHA384;
+                break;
+
+            case WC_MGF1SHA512:
+                mgfHash = WC_HASH_TYPE_SHA512;
+                break;
+
+            default:
+                break;
             }
-            if (ok && mgfName != NULL) {
-                if (!OSSL_PARAM_set_utf8_string(p, mgfName)) {
-                    ok = 0;
-                }
+            if ((mgfHash == WC_HASH_TYPE_NONE) ||
+                !wp_digest_to_ossl_digest(mgfHash, &mgfName) ||
+                !OSSL_PARAM_set_utf8_string(p, mgfName)) {
+                ok = 0;
             }
         }
     }
@@ -2465,7 +2504,11 @@ static int wp_rsa_pss_get_params(wp_Rsa* rsa, unsigned char* data, word32 len)
     word32 idx = 0;
     wp_RsaPssParams* pss = &rsa->pssParams;
 
-    ok = wp_rsa_find_oid(data, len, rsa_pkcs1_oid, RSA_PKCS1_OID_SZ, &idx);
+    ok = wp_rsa_pss_params_set_pss_defaults(pss);
+    if (ok) {
+        ok = wp_rsa_find_oid(data, len, rsa_pkcs1_oid, RSA_PKCS1_OID_SZ,
+            &idx);
+    }
     if (ok) {
         /* Step over PSS algorithm. */
         idx += 11;
@@ -2498,7 +2541,19 @@ static int wp_rsa_pss_get_params(wp_Rsa* rsa, unsigned char* data, word32 len)
     }
     if (ok && (data[idx] == 0xa0)) {
         /* Hash algorithm */
-        if (XMEMCMP(data + idx, sha256AlgId, sizeof(sha256AlgId)) == 0) {
+        if (XMEMCMP(data + idx, sha224AlgId, sizeof(sha224AlgId)) == 0) {
+            pss->hashType = WC_HASH_TYPE_SHA224;
+            XSTRNCPY(pss->mdName, "SHA224", sizeof(pss->mdName));
+            idx += sizeof(sha224AlgId);
+        }
+        else if (XMEMCMP(data + idx, sha224AlgIdNull,
+                         sizeof(sha224AlgIdNull)) == 0) {
+            pss->hashType = WC_HASH_TYPE_SHA224;
+            XSTRNCPY(pss->mdName, "SHA224", sizeof(pss->mdName));
+            idx += sizeof(sha224AlgIdNull);
+        }
+        else if (XMEMCMP(data + idx, sha256AlgId,
+                         sizeof(sha256AlgId)) == 0) {
             pss->hashType = WC_HASH_TYPE_SHA256;
             XSTRNCPY(pss->mdName, "SHA256", sizeof(pss->mdName));
             idx += sizeof(sha256AlgId);
@@ -2537,7 +2592,19 @@ static int wp_rsa_pss_get_params(wp_Rsa* rsa, unsigned char* data, word32 len)
     }
     if (ok && (data[idx] == 0xa1)) {
         /* MGF algorithm */
-        if (XMEMCMP(data + idx, mgf1Sha256AlgId,
+        if (XMEMCMP(data + idx, mgf1Sha224AlgId,
+                    sizeof(mgf1Sha224AlgId)) == 0) {
+            pss->mgf = WC_MGF1SHA224;
+            XSTRNCPY(pss->mgfMdName, "SHA224", sizeof(pss->mgfMdName));
+            idx += sizeof(mgf1Sha224AlgId);
+        }
+        else if (XMEMCMP(data + idx, mgf1Sha224AlgIdNull,
+                         sizeof(mgf1Sha224AlgIdNull)) == 0) {
+            pss->mgf = WC_MGF1SHA224;
+            XSTRNCPY(pss->mgfMdName, "SHA224", sizeof(pss->mgfMdName));
+            idx += sizeof(mgf1Sha224AlgIdNull);
+        }
+        else if (XMEMCMP(data + idx, mgf1Sha256AlgId,
                     sizeof(mgf1Sha256AlgId)) == 0) {
             pss->mgf = WC_MGF1SHA256;
             XSTRNCPY(pss->mgfMdName, "SHA256", sizeof(pss->mgfMdName));
@@ -2595,8 +2662,6 @@ static int wp_rsa_pss_get_params(wp_Rsa* rsa, unsigned char* data, word32 len)
     }
     /* TODO: handle optional trailer: 0xa3. */
     if (ok) {
-        /* Default trailer is 1. */
-        pss->derTrailer = 1;
         /* PSS parameters have been seen and set. */
         rsa->pssDefSet = 1;
     }
@@ -2899,7 +2964,7 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
 {
     int ok = 1;
     int i = 0;
-    int hashLen = 0;
+    int hashLen = WP_RSA_DEFAULT_SALT_LEN;
     const byte rsa_pss_oid[11] = {
         0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
         0x01, 0x01, 0x0a
@@ -2929,7 +2994,18 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
 
     /* Digest */
     if (XSTRNCMP(mdName, "SHA1", 5) != 0) {
-        if ((XMEMCMP(mdName, "SHA256", 7) == 0) ||
+        if ((XSTRCASECMP(mdName, "SHA224") == 0) ||
+            (XSTRCASECMP(mdName, OSSL_DIGEST_NAME_SHA2_224) == 0)) {
+            if (pssAlgId != NULL) {
+                XMEMCPY(pssAlgId + i, sha224AlgIdNull,
+                    sizeof(sha224AlgIdNull));
+                pssAlgId[seq1LenIdx] += sizeof(sha224AlgIdNull);
+                pssAlgId[seq2LenIdx] += sizeof(sha224AlgIdNull);
+            }
+            i += sizeof(sha224AlgIdNull);
+            hashLen = 28;
+        }
+        else if ((XMEMCMP(mdName, "SHA256", 7) == 0) ||
             (XMEMCMP(mdName, "sha256", 7) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, sha256AlgIdNull, sizeof(sha256AlgIdNull));
@@ -2963,7 +3039,17 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
     }
     /* MGF algorithm - assumes MGF1 with a digest. */
     if (XSTRNCMP(mgf1MdName, "SHA1", 5) != 0) {
-        if ((XMEMCMP(mgf1MdName, "SHA256", 7) == 0) ||
+        if ((XSTRCASECMP(mgf1MdName, "SHA224") == 0) ||
+            (XSTRCASECMP(mgf1MdName, OSSL_DIGEST_NAME_SHA2_224) == 0)) {
+            if (pssAlgId != NULL) {
+                XMEMCPY(pssAlgId + i, mgf1Sha224AlgIdNull,
+                    sizeof(mgf1Sha224AlgIdNull));
+                pssAlgId[seq1LenIdx] += sizeof(mgf1Sha224AlgIdNull);
+                pssAlgId[seq2LenIdx] += sizeof(mgf1Sha224AlgIdNull);
+            }
+            i += sizeof(mgf1Sha224AlgIdNull);
+        }
+        else if ((XMEMCMP(mgf1MdName, "SHA256", 7) == 0) ||
             (XMEMCMP(mgf1MdName, "sha256", 7) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, mgf1Sha256AlgIdNull,
@@ -3023,8 +3109,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
         saltLen = hashLen;
     }
 #endif
-    /* Encode salt length if not 0. */
-    if (saltLen != 0) {
+    /* Encode salt length if not the default. */
+    if (saltLen != WP_RSA_DEFAULT_SALT_LEN) {
         if (saltLen < 0x80) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, saltLenDer, sizeof(saltLenDer));
diff --git a/test/test_rsa.c b/test/test_rsa.c
index b595b9c4..c2225c80 100644
--- a/test/test_rsa.c
+++ b/test/test_rsa.c
@@ -2658,16 +2658,28 @@ int test_rsa_kem_prefix_match(void* data)
     return err;
 }
 
-static int test_rsa_pss_mgf1_get_params_helper(OSSL_LIB_CTX *libCtx)
+static int test_rsa_pss_mgf1_get_params_helper(OSSL_LIB_CTX *libCtx,
+    const EVP_MD *md, const EVP_MD *mgf1Md, int roundTrip)
 {
     int err = 0;
     EVP_PKEY *pkey = NULL;
+    EVP_PKEY *decoded = NULL;
     EVP_PKEY_CTX *pkeyCtx = NULL;
-    OSSL_PARAM params[2];
+    OSSL_PARAM params[4];
+    EVP_MD *gotMd = NULL;
+    EVP_MD *gotMgf1Md = NULL;
+    char mdName[64] = "";
     char mgfMdName[64] = "";
-    char *pmgfMdName = mgfMdName;
+    unsigned char *der = NULL;
+    unsigned char *encoded = NULL;
+    const unsigned char *p;
+    int derLen = 0;
+    int encodedLen = 0;
+    int saltLen = 0;
+    int defaultMd = EVP_MD_is_a(md, OSSL_DIGEST_NAME_SHA1);
+    int defaultMgf1Md = EVP_MD_is_a(mgf1Md, OSSL_DIGEST_NAME_SHA1);
+    OSSL_LIB_CTX *checkCtx = libCtx;
 
-    /* Generate RSA-PSS key with SHA-256 for signing, SHA-384 for MGF1. */
     pkeyCtx = EVP_PKEY_CTX_new_from_name(libCtx, "RSA-PSS", NULL);
     if (pkeyCtx == NULL) {
         PRINT_ERR_MSG("Failed to create RSA-PSS context");
@@ -2680,11 +2692,11 @@ static int test_rsa_pss_mgf1_get_params_helper(OSSL_LIB_CTX *libCtx)
         err = EVP_PKEY_CTX_set_rsa_keygen_bits(pkeyCtx, 2048) <= 0;
     }
     if (err == 0) {
-        err = EVP_PKEY_CTX_set_rsa_pss_keygen_md(pkeyCtx, EVP_sha256()) <= 0;
+        err = EVP_PKEY_CTX_set_rsa_pss_keygen_md(pkeyCtx, md) <= 0;
     }
     if (err == 0) {
         err = EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(pkeyCtx,
-                EVP_sha384()) <= 0;
+                mgf1Md) <= 0;
     }
     if (err == 0) {
         err = EVP_PKEY_keygen(pkeyCtx, &pkey) <= 0;
@@ -2692,32 +2704,118 @@ static int test_rsa_pss_mgf1_get_params_helper(OSSL_LIB_CTX *libCtx)
     EVP_PKEY_CTX_free(pkeyCtx);
     pkeyCtx = NULL;
 
-    /* Now retrieve the MGF1 digest param and verify it's SHA-384 not SHA-256. */
+    if ((err == 0) && roundTrip) {
+        derLen = i2d_PUBKEY(pkey, &der);
+        err = derLen <= 0;
+    }
+    if ((err == 0) && roundTrip) {
+        p = der;
+        decoded = d2i_PUBKEY_ex(NULL, &p, derLen, wpLibCtx, NULL);
+        err = decoded == NULL;
+    }
+    if ((err == 0) && roundTrip && defaultMd && defaultMgf1Md) {
+        encodedLen = i2d_PUBKEY(decoded, &encoded);
+        if ((encodedLen != derLen) ||
+            (memcmp(encoded, der, (size_t)derLen) != 0)) {
+            PRINT_ERR_MSG("RSA-PSS public key encoding mismatch");
+            err = 1;
+        }
+    }
+    if ((err == 0) && roundTrip) {
+        EVP_PKEY_free(pkey);
+        pkey = decoded;
+        decoded = NULL;
+        checkCtx = wpLibCtx;
+    }
     if (err == 0) {
-        params[0] = OSSL_PARAM_construct_utf8_string(
-            OSSL_PKEY_PARAM_RSA_MGF1_DIGEST, pmgfMdName, sizeof(mgfMdName));
-        params[1] = OSSL_PARAM_construct_end();
+        params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_RSA_DIGEST,
+            mdName, sizeof(mdName));
+        params[1] = OSSL_PARAM_construct_utf8_string(
+            OSSL_PKEY_PARAM_RSA_MGF1_DIGEST, mgfMdName, sizeof(mgfMdName));
+        params[2] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_RSA_PSS_SALTLEN,
+            &saltLen);
+        params[3] = OSSL_PARAM_construct_end();
         err = EVP_PKEY_get_params(pkey, params) != 1;
     }
-    if (err == 0) {
-        /* The fix ensures MGF1 digest (SHA-384) is returned, not the
-         * signing digest (SHA-256). Verify it contains "384" and not "256". */
-        if (strstr(mgfMdName, "384") == NULL) {
-            PRINT_ERR_MSG("MGF1 digest should contain '384' but got: %s",
-                          mgfMdName);
+    if ((err == 0) && !defaultMd) {
+        gotMd = EVP_MD_fetch(checkCtx, mdName, NULL);
+        if ((gotMd == NULL) ||
+            !EVP_MD_is_a(gotMd, EVP_MD_get0_name(md))) {
+            PRINT_ERR_MSG("Unexpected RSA-PSS digest: %s", mdName);
             err = 1;
         }
-        else if (strstr(mgfMdName, "256") != NULL) {
-            PRINT_ERR_MSG("MGF1 digest should not contain '256' but got: %s",
-                          mgfMdName);
+    }
+    if ((err == 0) && defaultMd && OSSL_PARAM_modified(&params[0])) {
+        PRINT_ERR_MSG("Unexpected RSA-PSS digest: %s", mdName);
+        err = 1;
+    }
+    if ((err == 0) && roundTrip && (saltLen != 20)) {
+        PRINT_ERR_MSG("Unexpected RSA-PSS salt length: %d", saltLen);
+        err = 1;
+    }
+    if (err == 0) {
+        gotMgf1Md = EVP_MD_fetch(checkCtx, mgfMdName, NULL);
+        if ((gotMgf1Md == NULL) ||
+            !EVP_MD_is_a(gotMgf1Md, EVP_MD_get0_name(mgf1Md))) {
+            PRINT_ERR_MSG("Unexpected RSA-PSS MGF1 digest: %s", mgfMdName);
             err = 1;
         }
         else {
-            PRINT_MSG("MGF1 digest correctly returned: %s", mgfMdName);
+            PRINT_MSG("RSA-PSS digests: %s, %s", mdName, mgfMdName);
         }
     }
 
+    EVP_MD_free(gotMgf1Md);
+    EVP_MD_free(gotMd);
+    OPENSSL_free(encoded);
+    OPENSSL_free(der);
+    EVP_PKEY_free(decoded);
+    EVP_PKEY_free(pkey);
+    return err;
+}
+
+static int test_rsa_pss_mgf1_rejected(void)
+{
+    int err = 0;
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *pkey = NULL;
+    EVP_MD *mgf1Md = NULL;
+    char mgf1Name[64] = "";
+    size_t mgf1NameLen = 0;
+
+    ctx = EVP_PKEY_CTX_new_from_name(wpLibCtx, "RSA-PSS", NULL);
+    err = ctx == NULL;
+    if (err == 0) {
+        err = EVP_PKEY_keygen_init(ctx) <= 0;
+    }
+    if (err == 0) {
+        err = EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048) <= 0;
+    }
+    if (err == 0) {
+        err = EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx, EVP_sha256()) <= 0;
+    }
+    if (err == 0) {
+        err = EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(ctx,
+            EVP_sha3_256()) > 0;
+        ERR_clear_error();
+    }
+    if (err == 0) {
+        err = EVP_PKEY_keygen(ctx, &pkey) <= 0;
+    }
+    if (err == 0) {
+        err = EVP_PKEY_get_utf8_string_param(pkey,
+            OSSL_PKEY_PARAM_RSA_MGF1_DIGEST, mgf1Name, sizeof(mgf1Name),
+            &mgf1NameLen) != 1;
+    }
+    if (err == 0) {
+        mgf1Md = EVP_MD_fetch(wpLibCtx, mgf1Name, NULL);
+        err = (mgf1Md == NULL) || !EVP_MD_is_a(mgf1Md,
+            OSSL_DIGEST_NAME_SHA2_256);
+    }
+
+    EVP_MD_free(mgf1Md);
     EVP_PKEY_free(pkey);
+    EVP_PKEY_CTX_free(ctx);
     return err;
 }
 
@@ -2728,10 +2826,55 @@ int test_rsa_pss_mgf1_get_params(void *data)
     (void)data;
 
     PRINT_MSG("Test OpenSSL RSA-PSS MGF1 digest get_params");
-    err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx);
+    err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx, EVP_sha256(),
+        EVP_sha384(), 0);
     if (err == 0) {
         PRINT_MSG("Test wolfProvider RSA-PSS MGF1 digest get_params");
-        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx);
+        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx, EVP_sha256(),
+            EVP_sha384(), 0);
+    }
+#ifdef WP_HAVE_SHA224
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx, EVP_sha224(),
+            EVP_sha256(), 1);
+    }
+#endif
+#ifdef WP_HAVE_SHA1
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx, EVP_sha256(),
+            EVP_sha1(), 0);
+    }
+#endif
+#ifdef WP_HAVE_SHA224
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx, EVP_sha256(),
+            EVP_sha224(), 1);
+    }
+#endif
+#ifdef WP_HAVE_SHA1
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx, EVP_sha1(),
+            EVP_sha256(), 0);
+    }
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(wpLibCtx, EVP_sha1(),
+            EVP_sha256(), 0);
+    }
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx, EVP_sha256(),
+            EVP_sha1(), 1);
+    }
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx, EVP_sha1(),
+            EVP_sha256(), 1);
+    }
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_get_params_helper(osslLibCtx, EVP_sha1(),
+            EVP_sha1(), 1);
+    }
+#endif
+    if (err == 0) {
+        err = test_rsa_pss_mgf1_rejected();
     }
 
     return err;

From f3e6f836bd91fab121cb942d982e6829e5d02323 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 25 Aug 2026 15:45:15 -0700
Subject: [PATCH 2/4] F-8684 - Initialize digest duplication destinations

---
 src/wp_digests.c   |  13 ++---
 test/test_digest.c | 136 +++++++++++++++++++++++++++++++++++++++++++++
 test/unit.c        |   4 ++
 test/unit.h        |   2 +
 4 files changed, 148 insertions(+), 7 deletions(-)

diff --git a/src/wp_digests.c b/src/wp_digests.c
index 7bd3f1a7..fa588b71 100644
--- a/src/wp_digests.c
+++ b/src/wp_digests.c
@@ -80,7 +80,7 @@ static CTX* name##_newctx(WOLFPROV_CTX* provCtx)                               \
 static void name##_freectx(CTX* ctx)                                           \
 {                                                                              \
     free(ctx);                                                                 \
-    OPENSSL_free(ctx);                                                         \
+    OPENSSL_clear_free(ctx, sizeof(*ctx));                                     \
 }
 
 /** Implement duplicating a digest object. */
@@ -96,13 +96,13 @@ static CTX* name##_dupctx(CTX* src)                                            \
 {                                                                              \
     CTX* dst = NULL;                                                           \
     if (wolfssl_prov_is_running()) {                                           \
-        dst = OPENSSL_malloc(sizeof(*src));                                    \
+        dst = OPENSSL_zalloc(sizeof(*dst));                                    \
     }                                                                          \
     if (dst != NULL) {                                                         \
         int rc;                                                                \
         rc = copy(src, dst);                                                   \
         if (rc != 0) {                                                         \
-            OPENSSL_free(dst);                                                 \
+            OPENSSL_clear_free(dst, sizeof(*dst));                             \
             dst = NULL;                                                        \
         }                                                                      \
     }                                                                          \
@@ -670,7 +670,7 @@ static int name##_final(CTX* ctx, unsigned char* out, size_t* outLen,          \
 static void name##_freectx(CTX* ctx)                                           \
 {                                                                              \
     free(&ctx->obj);                                                           \
-    OPENSSL_free(ctx);                                                         \
+    OPENSSL_clear_free(ctx, sizeof(*ctx));                                     \
 }
 
 /** Implement duplicating an XOF object. */
@@ -686,14 +686,14 @@ static CTX* name##_dupctx(CTX* src)                                            \
 {                                                                              \
     CTX* dst = NULL;                                                           \
     if (wolfssl_prov_is_running()) {                                           \
-        dst = OPENSSL_malloc(sizeof(*src));                                    \
+        dst = OPENSSL_zalloc(sizeof(*dst));                                    \
     }                                                                          \
     if (dst != NULL) {                                                         \
         int rc;                                                                \
         rc = copy(&src->obj, &dst->obj);                                       \
         if (rc != 0) {                                                         \
             WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, #copy, rc);  \
-            OPENSSL_free(dst);                                                 \
+            OPENSSL_clear_free(dst, sizeof(*dst));                             \
             dst = NULL;                                                        \
         }                                                                      \
         else {                                                                 \
@@ -807,4 +807,3 @@ IMPLEMENT_XOF(shake, wp_shake_256, wc_Shake, wp_ShakeCtx,
               wc_Shake256_Copy, wc_Shake256_Free)
 
 #endif
-
diff --git a/test/test_digest.c b/test/test_digest.c
index 5b30132c..e3cb89bf 100644
--- a/test/test_digest.c
+++ b/test/test_digest.c
@@ -283,6 +283,142 @@ int test_shake_256(void *data)
 
 /******************************************************************************/
 
+static int test_digest_dupctx_helper(const char *name, int xof)
+{
+    static const unsigned char part1[] = "digest-dupctx-part1";
+    static const unsigned char part2[] = "digest-dupctx-part2";
+    EVP_MD *md = NULL;
+    EVP_MD *refMd = NULL;
+    EVP_MD_CTX *a = NULL;
+    EVP_MD_CTX *b = NULL;
+    EVP_MD_CTX *ref = NULL;
+    unsigned char outA[64];
+    unsigned char outB[64];
+    unsigned char outRef[64];
+    unsigned int outALen = sizeof(outA);
+    unsigned int outBLen = sizeof(outB);
+    unsigned int outRefLen = sizeof(outRef);
+    int err;
+
+    md = EVP_MD_fetch(wpLibCtx, name, "");
+    refMd = EVP_MD_fetch(osslLibCtx, name, "");
+    err = (md == NULL) || (refMd == NULL);
+    if (err == 0) {
+        a = EVP_MD_CTX_new();
+        b = EVP_MD_CTX_new();
+        ref = EVP_MD_CTX_new();
+        err = (a == NULL) || (b == NULL) || (ref == NULL);
+    }
+    if (err == 0) {
+        err = (EVP_DigestInit_ex(a, md, NULL) != 1) ||
+            (EVP_DigestInit_ex(ref, refMd, NULL) != 1);
+    }
+    if (err == 0) {
+        err = (EVP_DigestUpdate(a, part1, sizeof(part1)) != 1) ||
+            (EVP_DigestUpdate(ref, part1, sizeof(part1)) != 1);
+    }
+    if (err == 0) {
+        err = EVP_MD_CTX_copy_ex(b, a) != 1;
+    }
+    if (err == 0) {
+        err = (EVP_DigestUpdate(a, part2, sizeof(part2)) != 1) ||
+            (EVP_DigestUpdate(b, part2, sizeof(part2)) != 1) ||
+            (EVP_DigestUpdate(ref, part2, sizeof(part2)) != 1);
+    }
+    if ((err == 0) && xof) {
+        err = (EVP_DigestFinalXOF(a, outA, sizeof(outA)) != 1) ||
+            (EVP_DigestFinalXOF(b, outB, sizeof(outB)) != 1) ||
+            (EVP_DigestFinalXOF(ref, outRef, sizeof(outRef)) != 1);
+    }
+    if ((err == 0) && !xof) {
+        err = (EVP_DigestFinal_ex(a, outA, &outALen) != 1) ||
+            (EVP_DigestFinal_ex(b, outB, &outBLen) != 1) ||
+            (EVP_DigestFinal_ex(ref, outRef, &outRefLen) != 1);
+    }
+    if ((err == 0) && ((outALen != outBLen) || (outALen != outRefLen) ||
+            (memcmp(outA, outRef, outALen) != 0) ||
+            (memcmp(outB, outRef, outBLen) != 0))) {
+        PRINT_ERR_MSG("Digest dupctx mismatch: %s", name);
+        err = 1;
+    }
+
+    EVP_MD_CTX_free(ref);
+    EVP_MD_CTX_free(b);
+    EVP_MD_CTX_free(a);
+    EVP_MD_free(refMd);
+    EVP_MD_free(md);
+    return err;
+}
+
+int test_digest_dupctx(void *data)
+{
+    static const struct {
+        const char *name;
+        int xof;
+    } digests[] = {
+#if defined(WP_HAVE_MD5) && \
+    (!defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS))
+        { "MD5", 0 },
+#endif
+#if defined(WP_HAVE_MD5_SHA1) && \
+    (!defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS))
+        { "MD5-SHA1", 0 },
+#endif
+#ifdef WP_HAVE_SHA1
+        { "SHA1", 0 },
+#endif
+#ifdef WP_HAVE_SHA224
+        { "SHA-224", 0 },
+#endif
+#ifdef WP_HAVE_SHA256
+        { "SHA256", 0 },
+#endif
+#ifdef WP_HAVE_SHA384
+        { "SHA384", 0 },
+#endif
+#ifdef WP_HAVE_SHA512
+        { "SHA-512", 0 },
+#endif
+#if defined(WP_HAVE_SHA512) && defined(WP_HAVE_SHA512_224) && \
+    !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
+        { "SHA512-224", 0 },
+#endif
+#if defined(WP_HAVE_SHA512) && defined(WP_HAVE_SHA512_256) && \
+    !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
+        { "SHA512-256", 0 },
+#endif
+#ifdef WP_HAVE_SHA3_224
+        { "SHA3-224", 0 },
+#endif
+#ifdef WP_HAVE_SHA3_256
+        { "SHA3-256", 0 },
+#endif
+#ifdef WP_HAVE_SHA3_384
+        { "SHA3-384", 0 },
+#endif
+#ifdef WP_HAVE_SHA3_512
+        { "SHA3-512", 0 },
+#endif
+#ifdef WP_HAVE_SHAKE_256
+        { "SHAKE-256", 1 },
+#endif
+        { NULL, 0 }
+    };
+    int err = 0;
+    size_t i;
+
+    (void)data;
+
+    for (i = 0; (err == 0) && (digests[i].name != NULL); i++) {
+        PRINT_MSG("Digest dupctx: %s", digests[i].name);
+        err = test_digest_dupctx_helper(digests[i].name, digests[i].xof);
+    }
+
+    return err;
+}
+
+/******************************************************************************/
+
 /**
  * Test that digest produces consistent results when data is fed in many small
  * updates vs. a single large update. Exercises the chunked update path
diff --git a/test/unit.c b/test/unit.c
index 87152438..c5e45591 100644
--- a/test/unit.c
+++ b/test/unit.c
@@ -211,6 +211,9 @@ TEST_CASE test_case[] = {
 #endif
 #ifdef WP_HAVE_SHAKE_256
     TEST_DECL(test_shake_256, NULL),
+#endif
+#ifdef WP_HAVE_DIGEST
+    TEST_DECL(test_digest_dupctx, NULL),
 #endif
     TEST_DECL(test_digest_multi_update, NULL),
 #ifdef WP_HAVE_HMAC
@@ -252,6 +255,7 @@ TEST_CASE test_case[] = {
 #ifdef WP_HAVE_DES3CBC
     #if !defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS)
         TEST_DECL(test_des3_cbc, NULL),
+        TEST_DECL(test_des3_cbc_reinit, NULL),
         TEST_DECL(test_des3_cbc_stream, NULL),
         TEST_DECL(test_des3_cbc_bad_pad, NULL),
         TEST_DECL(test_des3_cbc_large_update, NULL),
diff --git a/test/unit.h b/test/unit.h
index a023ee21..d459e569 100644
--- a/test/unit.h
+++ b/test/unit.h
@@ -146,6 +146,7 @@ int test_sha3_512(void *data);
 #ifdef WP_HAVE_SHAKE_256
 int test_shake_256(void *data);
 #endif
+int test_digest_dupctx(void *data);
 
 #endif /* WP_HAVE_DIGEST */
 
@@ -195,6 +196,7 @@ int test_sshkdf(void *data);
 
 #ifdef WP_HAVE_DES3CBC
 int test_des3_cbc(void *data);
+int test_des3_cbc_reinit(void *data);
 int test_des3_cbc_stream(void *data);
 int test_des3_cbc_bad_pad(void *data);
 int test_des3_cbc_large_update(void *data);

From e64c4050cc6c074e659b00ce00be8f219e188f09 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 25 Aug 2026 15:45:20 -0700
Subject: [PATCH 3/4] F-10408 - Preserve DES3 CBC IV during key-only reinit

---
 src/wp_des.c       |   5 +-
 test/test_cipher.c | 209 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 212 insertions(+), 2 deletions(-)

diff --git a/src/wp_des.c b/src/wp_des.c
index 896dbb80..be9f8d37 100644
--- a/src/wp_des.c
+++ b/src/wp_des.c
@@ -306,7 +306,9 @@ static int wp_des3_block_init(wp_Des3BlockCtx *ctx, const unsigned char *key,
             ok = 0;
         }
         if (ok) {
-            int rc = wc_Des3_SetKey(&ctx->des3, key, iv,
+            int rc = wc_Des3_SetKey(&ctx->des3, key,
+                (ctx->ivSet && (ctx->mode == EVP_CIPH_CBC_MODE)) ?
+                    ctx->iv : NULL,
                 enc ? DES_ENCRYPTION : DES_DECRYPTION);
             if (rc != 0) {
                 WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, "wc_Des3_SetKey", rc);
@@ -941,4 +943,3 @@ IMPLEMENT_DES3_BLOCK_NULL(cbc)
 
 #endif
 #endif /* WP_HAVE_DES3CBC */
-
diff --git a/test/test_cipher.c b/test/test_cipher.c
index 09650492..eaab96f1 100644
--- a/test/test_cipher.c
+++ b/test/test_cipher.c
@@ -444,6 +444,215 @@ int test_des3_cbc(void *data)
 
 /******************************************************************************/
 
+int test_des3_cbc_reinit(void *data)
+{
+    unsigned char key[24];
+    unsigned char iv[8];
+    unsigned char iv2[8];
+    unsigned char zeroIv[8] = { 0 };
+    unsigned char msg[16];
+    unsigned char expected[sizeof(msg)];
+    unsigned char expected2[sizeof(msg)];
+    unsigned char expectedZero[sizeof(msg)];
+    unsigned char encrypted[sizeof(msg)];
+    unsigned char decrypted[sizeof(msg)];
+    EVP_CIPHER *ocipher = NULL;
+    EVP_CIPHER *wcipher = NULL;
+    EVP_CIPHER_CTX *ctx = NULL;
+    int outLen = 0;
+    int finalLen = 0;
+    int err = 0;
+    size_t i;
+
+    (void)data;
+
+    for (i = 0; i < sizeof(key); i++) {
+        key[i] = (unsigned char)(i + 1);
+    }
+    for (i = 0; i < sizeof(iv); i++) {
+        iv[i] = (unsigned char)(i + 9);
+        iv2[i] = (unsigned char)(i + 33);
+    }
+    for (i = 0; i < sizeof(msg); i++) {
+        msg[i] = (unsigned char)(i + 17);
+    }
+
+    ocipher = EVP_CIPHER_fetch(osslLibCtx, "DES-EDE3-CBC", "");
+    wcipher = EVP_CIPHER_fetch(wpLibCtx, "DES-EDE3-CBC", "");
+    err = (ocipher == NULL) || (wcipher == NULL);
+    if (err == 0) {
+        err = test_cipher_enc(ocipher, key, iv, msg, sizeof(msg), expected,
+            0);
+    }
+    if (err == 0) {
+        err = test_cipher_enc(ocipher, key, iv2, msg, sizeof(msg), expected2,
+            0);
+    }
+    if (err == 0) {
+        err = test_cipher_enc(ocipher, key, zeroIv, msg, sizeof(msg),
+            expectedZero, 0);
+    }
+    if (err == 0) {
+        ctx = EVP_CIPHER_CTX_new();
+        err = ctx == NULL;
+    }
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, wcipher, NULL, NULL, iv) != 1;
+    }
+    if (err == 0) {
+        err = EVP_CIPHER_CTX_set_padding(ctx, 0) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptUpdate(ctx, encrypted, &outLen, msg,
+            sizeof(msg)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptFinal_ex(ctx, encrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(expected)) ||
+            (memcmp(encrypted, expected, sizeof(expected)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC split encrypt mismatch");
+        err = 1;
+    }
+    outLen = 0;
+    finalLen = 0;
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptUpdate(ctx, encrypted, &outLen, msg,
+            sizeof(msg)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptFinal_ex(ctx, encrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(expected)) ||
+            (memcmp(encrypted, expected, sizeof(expected)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC reinit encrypt mismatch");
+        err = 1;
+    }
+    outLen = 0;
+    finalLen = 0;
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv2) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptUpdate(ctx, encrypted, &outLen, msg,
+            sizeof(msg)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptFinal_ex(ctx, encrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(expected2)) ||
+            (memcmp(encrypted, expected2, sizeof(expected2)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC new IV mismatch");
+        err = 1;
+    }
+
+    EVP_CIPHER_CTX_free(ctx);
+    ctx = NULL;
+    outLen = 0;
+    finalLen = 0;
+
+    if (err == 0) {
+        ctx = EVP_CIPHER_CTX_new();
+        err = ctx == NULL;
+    }
+    if (err == 0) {
+        err = EVP_DecryptInit_ex(ctx, wcipher, NULL, NULL, iv) != 1;
+    }
+    if (err == 0) {
+        err = EVP_CIPHER_CTX_set_padding(ctx, 0) != 1;
+    }
+    if (err == 0) {
+        err = EVP_DecryptInit_ex(ctx, NULL, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_DecryptUpdate(ctx, decrypted, &outLen, expected,
+            sizeof(expected)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_DecryptFinal_ex(ctx, decrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(msg)) ||
+            (memcmp(decrypted, msg, sizeof(msg)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC split decrypt mismatch");
+        err = 1;
+    }
+    outLen = 0;
+    finalLen = 0;
+    if (err == 0) {
+        err = EVP_DecryptInit_ex(ctx, NULL, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_DecryptUpdate(ctx, decrypted, &outLen, expected,
+            sizeof(expected)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_DecryptFinal_ex(ctx, decrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(msg)) ||
+            (memcmp(decrypted, msg, sizeof(msg)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC reinit decrypt mismatch");
+        err = 1;
+    }
+
+    EVP_CIPHER_CTX_free(ctx);
+    ctx = NULL;
+    outLen = 0;
+    finalLen = 0;
+
+    if (err == 0) {
+        ctx = EVP_CIPHER_CTX_new();
+        err = ctx == NULL;
+    }
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, wcipher, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_CIPHER_CTX_set_padding(ctx, 0) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptUpdate(ctx, encrypted, &outLen, msg,
+            sizeof(msg)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptFinal_ex(ctx, encrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(expectedZero)) ||
+            (memcmp(encrypted, expectedZero, sizeof(expectedZero)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC zero IV mismatch");
+        err = 1;
+    }
+    outLen = 0;
+    finalLen = 0;
+    if (err == 0) {
+        err = EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptUpdate(ctx, encrypted, &outLen, msg,
+            sizeof(msg)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_EncryptFinal_ex(ctx, encrypted + outLen, &finalLen) != 1;
+    }
+    if ((err == 0) && ((outLen + finalLen != (int)sizeof(expectedZero)) ||
+            (memcmp(encrypted, expectedZero, sizeof(expectedZero)) != 0))) {
+        PRINT_ERR_MSG("DES3-CBC zero IV reinit mismatch");
+        err = 1;
+    }
+
+    EVP_CIPHER_CTX_free(ctx);
+    EVP_CIPHER_free(wcipher);
+    EVP_CIPHER_free(ocipher);
+    return err;
+}
+
+/******************************************************************************/
+
 int test_des3_cbc_stream(void *data)
 {
     int err;

From fb75e5a80907ba2a25f9d1cf4dc9df4841d16c6c Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Mon, 31 Aug 2026 14:47:16 -0700
Subject: [PATCH 4/4] Match RSA-PSS SHA256/384/512 digest names
 case-insensitively

---
 src/wp_rsa_kmgmt.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/wp_rsa_kmgmt.c b/src/wp_rsa_kmgmt.c
index 5b23fa35..5163b97f 100644
--- a/src/wp_rsa_kmgmt.c
+++ b/src/wp_rsa_kmgmt.c
@@ -3005,8 +3005,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             i += sizeof(sha224AlgIdNull);
             hashLen = 28;
         }
-        else if ((XMEMCMP(mdName, "SHA256", 7) == 0) ||
-            (XMEMCMP(mdName, "sha256", 7) == 0)) {
+        else if ((XSTRCASECMP(mdName, "SHA256") == 0) ||
+            (XSTRCASECMP(mdName, OSSL_DIGEST_NAME_SHA2_256) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, sha256AlgIdNull, sizeof(sha256AlgIdNull));
                 pssAlgId[seq1LenIdx] += sizeof(sha256AlgIdNull);
@@ -3015,8 +3015,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             i += sizeof(sha256AlgIdNull);
             hashLen = 32;
         }
-        else if ((XMEMCMP(mdName, "SHA384", 7) == 0) ||
-                 (XMEMCMP(mdName, "sha384", 7) == 0)) {
+        else if ((XSTRCASECMP(mdName, "SHA384") == 0) ||
+            (XSTRCASECMP(mdName, OSSL_DIGEST_NAME_SHA2_384) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, sha384AlgIdNull, sizeof(sha384AlgIdNull));
                 pssAlgId[seq1LenIdx] += sizeof(sha384AlgIdNull);
@@ -3025,8 +3025,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             i += sizeof(sha384AlgIdNull);
             hashLen = 48;
         }
-        else if ((XMEMCMP(mdName, "SHA512", 7) == 0) ||
-                 (XMEMCMP(mdName, "sha512", 7) == 0)) {
+        else if ((XSTRCASECMP(mdName, "SHA512") == 0) ||
+            (XSTRCASECMP(mdName, OSSL_DIGEST_NAME_SHA2_512) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, sha512AlgIdNull, sizeof(sha512AlgIdNull));
                 pssAlgId[seq1LenIdx] += sizeof(sha512AlgIdNull);
@@ -3049,8 +3049,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             }
             i += sizeof(mgf1Sha224AlgIdNull);
         }
-        else if ((XMEMCMP(mgf1MdName, "SHA256", 7) == 0) ||
-            (XMEMCMP(mgf1MdName, "sha256", 7) == 0)) {
+        else if ((XSTRCASECMP(mgf1MdName, "SHA256") == 0) ||
+            (XSTRCASECMP(mgf1MdName, OSSL_DIGEST_NAME_SHA2_256) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, mgf1Sha256AlgIdNull,
                     sizeof(mgf1Sha256AlgIdNull));
@@ -3059,8 +3059,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             }
             i += sizeof(mgf1Sha256AlgIdNull);
         }
-        else if ((XMEMCMP(mgf1MdName, "SHA384", 7) == 0) ||
-                 (XMEMCMP(mgf1MdName, "sha384", 7) == 0)) {
+        else if ((XSTRCASECMP(mgf1MdName, "SHA384") == 0) ||
+            (XSTRCASECMP(mgf1MdName, OSSL_DIGEST_NAME_SHA2_384) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, mgf1Sha384AlgIdNull,
                     sizeof(mgf1Sha384AlgIdNull));
@@ -3069,8 +3069,8 @@ int wp_rsa_pss_encode_alg_id(const wp_Rsa* rsa, const char* mdName,
             }
             i += sizeof(mgf1Sha384AlgIdNull);
         }
-        else if ((XMEMCMP(mgf1MdName, "SHA512", 7) == 0) ||
-                 (XMEMCMP(mgf1MdName, "sha512", 7) == 0)) {
+        else if ((XSTRCASECMP(mgf1MdName, "SHA512") == 0) ||
+            (XSTRCASECMP(mgf1MdName, OSSL_DIGEST_NAME_SHA2_512) == 0)) {
             if (pssAlgId != NULL) {
                 XMEMCPY(pssAlgId + i, mgf1Sha512AlgIdNull,
                     sizeof(mgf1Sha512AlgIdNull));