fix: EVP_CIPHER_iv_length returns 0 for AES-CFB128 and AES-OFB (ZD-21730)

[MarkAtwood]

Summary

wolfSSL_EVP_CIPHER_iv_length returns 0 for all CFB and OFB cipher descriptors (CFB1, CFB8, CFB128, OFB for all three key sizes). The correct IV length for these modes is 16 bytes (AES_BLOCK_SIZE). A 0 return causes callers that size their IV buffer from the descriptor to use a zero-length or uninitialized IV on every call — silent IV reuse that destroys semantic security.

Fixes Zendesk ticket ZD-21730.

---

Root cause

wolfSSL_EVP_CIPHER_iv_length is a string-comparison chain mapping cipher descriptor names to IV lengths. It has entries for AES-CBC, AES-GCM, AES-CCM, AES-CTR, AES-XTS, DES, ChaCha20, and SM4 — but the entire CFB and OFB sections are absent. No comparison matches "AES-128-CFB128" (or any CFB/OFB variant), so the function falls through to return 0.

The companion function wolfSSL_EVP_CIPHER_CTX_iv_length (which dispatches by integer cipherType from an initialized context) correctly returns WC_AES_BLOCK_SIZE for all CFB and OFB variants. The bug is isolated to the string-comparison version.

---

Why it was missed

1. Two parallel implementations with no enforced parity. CFB and OFB were added to the CTX-based function correctly but never added to the string-based function. No shared table or generated code links the two.

2. CFB/OFB are later additions. The string-comparison function was written when only CBC, GCM, CCM, and CTR existed. When CFB/OFB support was added later, the developer added cipher operations, string constants, and CTX dispatch — but did not audit the string-comparison function for completeness.

3. Test coverage matched the bug exactly. test_wolfSSL_EVP_CIPHER_iv_length covered only the modes present in the buggy function (CBC, GCM, CTR, DES, ChaCha20-Poly1305). No test ever called EVP_CIPHER_iv_length(EVP_aes_128_cfb128()).

4. Silent failure. Returning 0 is valid for stream ciphers (RC4), so no assertion fires. A caller must know independently that 0 is wrong for CFB128 to notice.

---

How we fixed it

wolfcrypt/src/evp.c — Added 12 missing entries to wolfSSL_EVP_CIPHER_iv_length inside the existing #ifndef NO_AES block, after the XTS section. Gated by the same compile guards as the corresponding string constant declarations (WOLFSSL_AES_CFB, WOLFSSL_NO_AES_CFB_1_8, WOLFSSL_AES_OFB, and per-keysize WOLFSSL_AES_128/192/256):

• AES-128/192/256-OFB → WC_AES_BLOCK_SIZE
• AES-128/192/256-CFB1 → WC_AES_BLOCK_SIZE (gated !WOLFSSL_NO_AES_CFB_1_8)
• AES-128/192/256-CFB8 → WC_AES_BLOCK_SIZE (gated !WOLFSSL_NO_AES_CFB_1_8)
• AES-128/192/256-CFB128 → WC_AES_BLOCK_SIZE

tests/api/test_evp_cipher.c — Extended test_wolfSSL_EVP_CIPHER_iv_length to include CFB128 and OFB NIDs in the nids[] / iv_lengths[] parallel arrays. These returned 0 before the fix and 16 after. The independent oracle is NIST SP 800-38A, which specifies a 16-byte IV for all AES feedback modes.

Test plan

• ./wolfcrypt/test/testwolfcrypt passes
• ./tests/unit.test passes (test 659 test_wolfSSL_EVP_CIPHER_iv_length passes and now covers CFB128 and OFB)
• EVP_CIPHER_iv_length(EVP_aes_128_cfb128()) returns 16, not 0

[Copilot]

Pull request overview

Fixes incorrect IV length reporting for AES CFB/OFB cipher descriptors in the OpenSSL-compat EVP API, preventing callers from accidentally using zero-length/uninitialized IVs.

Changes:

• Add missing AES-OFB and AES-CFB* name mappings to wolfSSL_EVP_CIPHER_iv_length() so they return WC_AES_BLOCK_SIZE instead of falling through to 0.
• Extend test_wolfSSL_EVP_CIPHER_iv_length to cover AES-CFB128 and AES-OFB NIDs.
• Tighten Curve25519 private scalar clamping validation to enforce RFC 7748 §5 rule requiring bit 6 of the last byte to be set, and add a regression test.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfcrypt/src/evp.c	Adds AES CFB/OFB descriptors to the string-based IV length mapping.
tests/api/test_evp_cipher.c	Adds coverage ensuring AES-CFB128 and AES-OFB IV lengths are 16 bytes.
wolfcrypt/src/curve25519.c	Enforces the missing RFC 7748 clamping invariant (last-byte bit 6 set).
tests/api/test_curve25519.c	Adds a regression test validating the stricter clamp check via wc_curve25519_make_pub().
tests/api/test_curve25519.h	Registers the new Curve25519 clamp-check test in the API test declarations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-tls12

The merge-base changed after approval.