[Bug]: TLS 1.2 constant time HMAC computation fails with SHA384

[max-ag]

Contact Details

No response

Version

v5.8.0-stable

Description

Hmac_UpdateFinal_CT in src/tls.c:939 produces incorrect HMAC output for TLS 1.2 cipher suites using SHA-384 (didn't test with SHA-512, but I suspect the same issue).

Observations:

• Small messages (<100 bytes): Works correctly
• Large messages (>100 bytes): Wrong HMAC output
• SHA-256 with any message size: Works correctly
• Issue in multi-block processing specific to SHA-384 parameters (128-byte blocks, 48-byte digest)

Target: Probably irrelevant with this issue, but building on Ubuntu 24.04 (WSL).

Reproduction steps

bug_report_test.zip

mkdir build && cd build
cmake ..
cmake --build .
./bug_report_test

Expected Output:

========================================
wolfSSL HMAC-SHA384 Bug in TLS 1.2
========================================

Test 1 (Small message - PASS):
  Content: 32 bytes, Padding: 7 bytes, Record: 88 bytes
  Normal:  e68026b24242bf4d3d843c3f41acdc65...
  CT HMAC: e68026b24242bf4d3d843c3f41acdc65...
  Result: ✅ PASS (outputs match)

Test 2 (Larger message - FAIL):
  Content: 100 bytes, Padding: 5 bytes, Record: 154 bytes
  Normal:  3bc534aa8e1627cf939709c8fb5d9c07...
  CT HMAC: 123118093eac776ba730cdad9bcb2309...
  Result: ❌ FAIL (outputs differ)

========================================
Summary:
Hmac_UpdateFinal_CT produces incorrect
output for TLS 1.2 with SHA-384 cipher
suites (SHA-256 works fine).
========================================

Relevant log output

[kareem-wolfssl]

Hi @max-ag ,

Thanks for the detailed report and reproducer. I was able to reproduce this issue on 5.8.0, but not on the current master. Please retry with master and let me know if you still see this issue on your end.

Thanks,
Kareem

[max-ag]

I couldn't reproduce the issue on master (v5.8.4-stable). v5.8.2-stable is still vulnerable.

Looks like the issue might have been fixed with #9148, making some variables volatile so that the compiler doesn't optimize them out.

I'll close the ticket. Thanks.