ML-DSA Pure Cert Support

[stenslae]

• Self-signed certificate (CA) and CSR generation
• CA-based certificate signing
• Certificate verification
• Includes updated documentation and test coverage for ML-DSA workflows

Notes:

• X.509 extensions are currently not fully supported for ML-DSA
• wolfssl-x509(1) -text cannot fully decode ML-DSA SubjectPublicKey

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 3
2 finding(s) posted as inline comments (see file-level comments below)

High (1)

Missing derBuf allocation before wc_MlDsaKey_PrivateKeyToDer in ML-DSA key generation

File: src/genkey/clu_genkey.c:1428
Function: wolfCLU_genKey_ML_DSA
Category: Copy-paste errors

derBuf is NULL (initialized at line 1343, never allocated before the switch) when wc_MlDsaKey_PrivateKeyToDer(key, derBuf, (word32)keySz) is called in PRIV_ONLY_FILE/PRIV_AND_PUB_FILES, so private-key DER export writes to a NULL pointer or returns an error and no key file is produced. The equivalent Dilithium path (lines 1153–1158) correctly calls XMALLOC(keySz, ...) before the export.

Recommendation: Add buffer allocation immediately before the wc_MlDsaKey_PrivateKeyToDer call, matching the Dilithium pattern:

derBuf = (byte*)XMALLOC(keySz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (derBuf == NULL) {
    ret = MEMORY_E;
    break;
}

Referenced code: src/genkey/clu_genkey.c:1428-1430 (3 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[stenslae]

Slimmed down this PR by creating three other PRs from content out of direct scope of this, this PR needs PR #276 merged in before this one.

[philljj]

This pr branch has conflicts.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 3

High (2)

POSIX chmod-hardening code mistakenly duplicated into Windows branch, breaks Windows build

File: src/tools/clu_funcs.c:1321
Function: wolfCLU_OpenExistingSecureFile
Category: Copy-paste errors

The _WIN32 implementation of wolfCLU_OpenExistingSecureFile contains POSIX-only code (post.st_mode, S_IRWXG, S_IRWXO, fchmod, close) copied from the POSIX sibling function. post is never declared in this function and these symbols/headers aren't available on Windows, so this fails to compile under _WIN32.

Recommendation: Remove the erroneously duplicated POSIX chmod block from the Windows branch; it already exists correctly in the POSIX version of this function.

Referenced code: src/tools/clu_funcs.c:1321-1325 (5 lines)

---

ML-DSA self-sign bypasses CSR policy sanitization, allowing CA:TRUE/keyUsage injection

File: src/x509/clu_cert_setup.c:523
Function: wolfCLU_certSetup
Category: Certificate validation bypass

The x509 -req -signkey <ml-dsa-key> self-sign path calls wolfCLU_MLDSACertSign with policySanitized=1 hardcoded, but unlike the CA-signing call site in clu_x509_sign.c it never neutralizes the CSR's basicConstraints/keyUsage first, so an attacker-supplied CSR's CA:TRUE and keyUsage bits flow straight into the issued certificate. The same branch also skips the wolfSSL_X509_check_private_key match check the RSA/ECDSA branch performs just above it.

Recommendation: Neutralize x509's basicConstraints/keyUsage (as done before the policySanitized=1 call in clu_x509_sign.c) and re-add the private-key-matches-CSR check before signing.

Referenced code: src/x509/clu_cert_setup.c:523-525 (3 lines)

---

Low (1)

Duplicate self-reference check is dead code

File: src/sign-verify/clu_x509_verify.c:523
Function: wolfCLU_x509Verify
Category: Copy-paste errors

The identical -CAfile/verify-cert self-reference check (wolfCLU_PathsRefEqual + error) is added twice; since the first occurrence already sets ret to WOLFCLU_FATAL_ERROR on the same condition, the second block can never execute.

Recommendation: Remove the second, redundant self-reference check (around line 523-528).

Referenced code: src/sign-verify/clu_x509_verify.c:523-528 (6 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 1

High (1)

Heap buffer overflow copying CA cert DER into fixed-size buffer

File: src/x509/clu_x509_sign.c:460
Function: wolfCLU_GenChimeraCertSign
Category: Buffer overflows

caCertBuf is allocated with the fixed size LARGE_TEMP_SZ (11264), but caCertSz is overwritten by wolfSSL_X509_get_der(caCert, &caCertSz) with the actual (unbounded) DER length of the loaded -cert file before XMEMCPY(caCertBuf, tmpBuf, caCertSz) runs, with no check that caCertSz <= LARGE_TEMP_SZ.

Recommendation: Reject with an error if caCertSz > LARGE_TEMP_SZ before the XMEMCPY, same as the other fixed-size buffers in this function.

Referenced code: src/x509/clu_x509_sign.c:460-465 (6 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.