Code for QUIC support by helkoulak · Pull Request #24 · wolfSSL/rustls-wolfcrypt-provider

helkoulak · 2025-09-21T16:07:09Z

No description provided.

Copilot

Pull Request Overview

This PR adds QUIC support to the wolfcrypt provider by implementing the necessary cryptographic operations and packet protection algorithms required by the QUIC protocol.

Adds QUIC-specific header protection and packet encryption/decryption algorithms
Implements support for AES-128/256-GCM and ChaCha20-Poly1305 ciphers for QUIC
Configures cipher suites with QUIC key factories when the "quic" feature is enabled

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
wolfcrypt-rs/src/bindings.rs	Adds lint allowance for unnecessary transmutes
rustls-wolfcrypt-provider/src/types/mod.rs	Adds ChaCha cipher object type definition
rustls-wolfcrypt-provider/src/lib.rs	Reorganizes imports and adds conditional QUIC support to cipher suites
rustls-wolfcrypt-provider/src/hkdf.rs	Adds spacing for formatting
rustls-wolfcrypt-provider/src/error.rs	Adds spacing for formatting
rustls-wolfcrypt-provider/src/aead/quic.rs	Implements complete QUIC header protection and packet encryption
rustls-wolfcrypt-provider/Cargo.toml	Adds "quic" feature flag

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

rustls-wolfcrypt-provider/src/lib.rs

rustls-wolfcrypt-provider/src/aead/quic.rs

julek-wolfssl

Good stuff. Does quic get tested in the current CI workflows?

rustls-wolfcrypt-provider/src/hkdf.rs

rustls-wolfcrypt-provider/src/types/mod.rs

rustls-wolfcrypt-provider/src/error.rs

rustls-wolfcrypt-provider/Cargo.toml

gasbytes

Nice work.
There seems to be some formatting issues that the CI detected, please fix those.
Also address the github copilot reports (mainly some unwraps that need to be refactored to handle errors).
Run clippy locally before committing too, the CI should detect some lints with the newest version.
Thank you.

helkoulak · 2025-09-23T23:05:18Z

Good stuff. Does quic get tested in the current CI workflows?

Thank you. maybe we need to add --features quic in order for quic code to be compiled.

Nice work. There seems to be some formatting issues that the CI detected, please fix those. Also address the github copilot reports (mainly some unwraps that need to be refactored to handle errors). Run clippy locally before committing too, the CI should detect some lints with the newest version. Thank you.

Thank you. I have corrected the mentioned issues. Hopefully CI tests will runs without errors

gasbytes · 2025-09-25T10:20:23Z

Hello @helkoulak, there are still some clippy reports in the CI/CD apparently, it would be great if you could try and fix them.

Thank you. maybe we need to add --features quic in order for quic code to be compiled.

Yes, please feel free to update the current workflows to test that too.

helkoulak · 2025-09-26T11:44:34Z

Hello @helkoulak, there are still some clippy reports in the CI/CD apparently, it would be great if you could try and fix them.
No problem, I will fix them ASAP.

Thank you. maybe we need to add --features quic in order for quic code to be compiled.

Yes, please feel free to update the current workflows to test that too.
Thank you, will do that ASAP

julek-wolfssl

Great work. Still need to dive into src/aead.

.github/workflows/ubuntu-build.yml

julek-wolfssl · 2025-12-18T11:36:27Z

.github/workflows/ubuntu-build.yml

+          cd ../rustls-wolfcrypt-provider/
+          cargo build --all-features --release
+          cd ../..
+          git clone https://github.com/helkoulak/rustls_v0.23.35_test_files.git


Place these under .github/workflows/rustls or a similar path. I don't see a need to have this in a dedicated repo.

If I understand correctly, you are using these files to make modifications to rustls/rustls? If yes, then I would prefer to use a patch file for this. The patch file should be applied with patch -p1 < <path/to/patch/file> in the rustls/rustls root dir.

The idea here is to build a workspace that contains three packages, namely rustls, wolfcrypt-provider, and tests package. It is done this way to break the cyclic dependency between rustls and wolfcrypt-provider. The package tests is created from a modified copy of rustls/tests plus other files like build.rs and own Cargo.toml file.

Using a patch file will make in my opinion the script more difficult to understand. In addition to that, in each rustls version new tests are added and some are removed, so this makes the patch file valid for only a specific version of rustls.

julek-wolfssl · 2025-12-18T11:42:03Z

.github/workflows/ubuntu-build.yml

The same comments apply to macos-build.yml.

I would consider moving the rustls tests into a separate workflow.

rustls-wolfcrypt-provider/src/lib.rs

julek-wolfssl · 2025-12-18T12:42:28Z

rustls-wolfcrypt-provider/src/sign/eddsa.rs

+impl Ed25519PrivateKey {
+    /// Extract ED25519 private and if available public key values from a PKCS#8 DER formatted key
+    fn extract_key_pair(input_key: &[u8]) -> Result<([u8; 32], Option<[u8; 32]>), rustls::Error> {
+        let mut public_key_raw: [u8; 32] = [0; ED25519_PUB_KEY_SIZE as usize];
+        let mut private_key_raw: [u8; 32] = [0; ED25519_KEY_SIZE as usize];
+        let mut skip_bytes: usize;
+        let mut key_sub_slice = input_key;
+
+        const SHORT_FORM_LEN_MAX: u8 = 127;
+        const TAG_SEQUENCE: u8 = 0x30;
+        const TAG_OCTET_SEQUENCE: u8 = 0x04;
+        const TAG_OPTIONAL_SET_OF_ATTRIBUTES: u8 = 0x80; //Implicit, context-specific, and primitive underlying type (SET OF)
+        const TAG_OPTIONAL_PUBLIC_KEY_BIT_STRING: u8 = 0x81; //Implicit, context-specific, and primitive underlying type (BIT STRING)
+
+        // The input key is encoded in PKCS#8 DER format with a structure as in
+        // https://www.rfc-editor.org/rfc/rfc5958.html
+        //
+        // AsymmetricKeyPackage ::= SEQUENCE SIZE (1..MAX) OF OneAsymmetricKey
+
+        // OneAsymmetricKey ::= SEQUENCE {
+        //     version                   Version,
+        //     privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
+        //     privateKey                PrivateKey,
+        //     attributes            [0] Attributes OPTIONAL,
+        //     ...,
+        //     [[2: publicKey        [1] PublicKey OPTIONAL ]],
+        //     ...
+        //     }
+
+        // The key structure must begin with a SEQUENCE tag with at least 2 bytes length if short
+        // length format is used
+        if key_sub_slice[0] != TAG_SEQUENCE || key_sub_slice.len() < 2 {
+            return Err(rustls::Error::General(
+                "Faulty PKCS#8 ED25519 private key structure".into(),
+            ));
+        }
+        // Check which length format and skip tag and length encoding bytes
+        if key_sub_slice[1] > SHORT_FORM_LEN_MAX {
+            skip_bytes = (2 + (key_sub_slice[1] & 0x7F)) as usize;
+        } else {
+            skip_bytes = 2;
+        }
+
+        // Skip version (3 bytes), algorithm ID sequence (0x30 + length encoding bytes + 5 ID bytes),
+        skip_bytes += 3 + 7;
+        key_sub_slice = input_key.get(skip_bytes..).unwrap();
+
+        // Check if next bytes are 0x04, 0x22, 0x04, 0x20
+        if !matches!(
+            key_sub_slice,
+            [TAG_OCTET_SEQUENCE, 0x22, TAG_OCTET_SEQUENCE, 0x20, ..]
+        ) {
+            return Err(rustls::Error::General(
+                "Faulty PKCS#8 ED25519 private key structure".into(),
+            ));
+        }
+
+        // Copy private key value
+        skip_bytes += 4;
+        key_sub_slice = input_key.get(skip_bytes..).unwrap();
+        private_key_raw.copy_from_slice(&key_sub_slice[..ED25519_KEY_SIZE as usize]);
+        skip_bytes += ED25519_KEY_SIZE as usize;
+        key_sub_slice = input_key.get(skip_bytes..).unwrap();
+
+        // Check if optional SET OF attributes exists and skip
+        if key_sub_slice.first() == Some(&TAG_OPTIONAL_SET_OF_ATTRIBUTES) {
+            skip_bytes += (2 + (key_sub_slice[1])) as usize;
+            key_sub_slice = input_key.get(skip_bytes..).unwrap();
+        }
+
+        // Check if optional public key value exists. If exists, skip tag, length encoding byte,
+        // and bits-used byte
+        if key_sub_slice.first() == Some(&TAG_OPTIONAL_PUBLIC_KEY_BIT_STRING) {
+            public_key_raw.copy_from_slice(&key_sub_slice[3..(3 + ED25519_KEY_SIZE as usize)]);
+            Ok((private_key_raw, Some(public_key_raw)))
+        } else {
+            Ok((private_key_raw, None))
+        }
+    }
+}
+


I would prefer to use the ASN parsing in wolfcrypt. You should use wc_Ed25519PrivateKeyDecode which will pick up both priv and pub keys. Then wc_ed25519_export_key can be used to export the raw values. Only downside I see is that privKeySet and pubKeySet are not checked in wc_ed25519_export_key. Feel free to apply the following patch to wolfSSL. I'll submit a PR to wolfssl in a second.

diff --git a/wolfcrypt/src/ed25519.c b/wolfcrypt/src/ed25519.c index a03efb5603..ff59e07310 100644 --- a/wolfcrypt/src/ed25519.c +++ b/wolfcrypt/src/ed25519.c @@ -1127,6 +1127,9 @@ int wc_ed25519_export_public(const ed25519_key* key, byte* out, word32* outLen) return BUFFER_E; } + if (!key->pubKeySet) + return PUBLIC_KEY_E; + *outLen = ED25519_PUB_KEY_SIZE; XMEMCPY(out, key->p, ED25519_PUB_KEY_SIZE); @@ -1368,7 +1371,7 @@ int wc_ed25519_export_private_only(const ed25519_key* key, byte* out, word32* ou int wc_ed25519_export_private(const ed25519_key* key, byte* out, word32* outLen) { /* sanity checks on arguments */ - if (key == NULL || out == NULL || outLen == NULL) + if (key == NULL || !key->privKeySet || out == NULL || outLen == NULL) return BAD_FUNC_ARG; if (*outLen < ED25519_PRV_KEY_SIZE) { @@ -1398,6 +1401,8 @@ int wc_ed25519_export_key(const ed25519_key* key, /* export public part */ ret = wc_ed25519_export_public(key, pub, pubSz); + if (ret == PUBLIC_KEY_E) + ret = 0; /* ignore no public key */ return ret; }

I have applied the patch file provided but unfortunately with no luck. As I have explained earlier in our email conversations, the problem lies in the function wc_Ed25519PrivateKeyDecode. It is unable to parse/recognize the public key part found in a PKCS8 DER formatted key pair. Luckily I was able to debug and record where the error exactly happens. I will send it to you per Email.

And the function extract_key_pair was the workaround

rustls-wolfcrypt-provider/src/aead/quic.rs

julek-wolfssl · 2025-12-18T14:29:01Z

rustls-wolfcrypt-provider/src/aead/quic.rs

Let's avoid unwrap. I see rust has some ways to use unwrap without panicking. libs shouldn't take down an app. None of the places where unwrap is used are places where failure is catastrophic. Instead an error should be returned and user should be allowed to handle it that way . Maybe unwrap_or_else is appropriate?

Fine for tests though.

I have replaced unwrap() completely with functions like ? and map_err to propagate errors instead of panicking.

gasbytes

Really nice work Hosam, I left a couple of comments.

.github/workflows/ubuntu-build.yml

gasbytes · 2025-12-19T11:36:29Z

.github/workflows/ubuntu-build.yml

Me and Juliusz were also thinking that it might be worth to add a feature to print the current provider being used via cargo, since you added the configuration option wolfcrypt-provider.
And add that step before running the testsuite, by grepping the output from stdout and confirming that we are running the full testsuite against the wolfcrypt-provider only.
That would be great.

If I understand correctly, this is already done. The command that runs the tests targets only the runner file all_test_suites.rs. And in this runner file you have macros that are annotated with #[cfg(feature = "wolfcrypt-provider")] and print the sentence tests_with_wolfcrypt_. So as per my understanding, there is no way the tests will run against other providers than wolfcrypt-provider. Or did I miss something here?

rustls-wolfcrypt-provider/src/aead/quic.rs

.github/workflows/macos-build.yml

rustls-wolfcrypt-provider/src/aead/quic.rs

rustls-wolfcrypt-provider/Cargo.toml

rustls-wolfcrypt-provider/src/aead/quic.rs

gasbytes

Great work Hosam, LGTM.

anhu · 2026-03-10T19:21:32Z

Contributor agreement signed, approved and filed.
wolfSSL members, please proceed in the pull request process.

gasbytes · 2026-03-20T11:27:45Z

@helkoulak please rebase your work against the latest main.
Thanks.

helkoulak · 2026-03-21T12:19:31Z

@helkoulak please rebase your work against the latest main. Thanks.

Will do ASAP. Thank you

…the case of rejected early data

…allowed

…ders like aws and ring as the order affects the success of some rustls tests

…ey value are provided with DER PKCS8 formatted private key

…stls default provider to reduce the code changes by hand when testing

…e tests::ffdhe

…AesGcmSetKey must be used and not wc_AesSetKey

…king and to propagate errors instead.

helkoulak · 2026-04-01T11:07:19Z

Branch has been rebased against the latest main

julek-wolfssl requested review from Copilot, gasbytes and julek-wolfssl September 22, 2025 10:14

Copilot AI reviewed Sep 22, 2025

View reviewed changes

julek-wolfssl requested changes Sep 22, 2025

View reviewed changes

rustls-wolfcrypt-provider/src/hkdf.rs Outdated Show resolved Hide resolved

rustls-wolfcrypt-provider/src/types/mod.rs Show resolved Hide resolved

rustls-wolfcrypt-provider/src/error.rs Outdated Show resolved Hide resolved

rustls-wolfcrypt-provider/Cargo.toml Show resolved Hide resolved

gasbytes requested changes Sep 22, 2025

View reviewed changes

gasbytes assigned helkoulak Sep 22, 2025

helkoulak closed this Sep 23, 2025

helkoulak reopened this Sep 23, 2025

helkoulak requested review from gasbytes and julek-wolfssl September 23, 2025 23:09

julek-wolfssl requested changes Dec 18, 2025

View reviewed changes

gasbytes requested changes Dec 19, 2025

View reviewed changes

helkoulak requested review from gasbytes and julek-wolfssl January 14, 2026 17:08

gasbytes previously approved these changes Jan 28, 2026

View reviewed changes

helkoulak dismissed gasbytes’s stale review via fc1b3b6 March 22, 2026 19:56

helkoulak force-pushed the quic-support branch from 1a61314 to fc1b3b6 Compare March 22, 2026 19:56

helkoulak requested a review from gasbytes March 22, 2026 20:05

helkoulak added 4 commits March 27, 2026 17:32

Rebasing branch 1

a47e30a

Rebasing branch 2

617cf00

Rebasing branch 3

1825584

rebasing branch 4

9b41b7f

helkoulak added 28 commits March 27, 2026 17:32

Adjust workflow to build features code

f02a8b6

Rebasing branch 5

b2f1c44

Add missing algorithm identifier

d774e27

Decrypt function should not panic in case of decrypt error to handle …

7cd2390

…the case of rejected early data

See commit cd879e1

ab8008e

In case peer misbehaves and sends plain text after it is not anymore …

0083cba

…allowed

Rebasing 7

3a474d2

Make the order of supported cipher suites compatible with other provi…

fcc37ea

…ders like aws and ring as the order affects the success of some rustls tests

Consider the case where nither the SET OF attributes nor the public k…

0fecc29

…ey value are provided with DER PKCS8 formatted private key

Rebasing 7

e7cce19

Minor code changes to make wolfcrypt-provider more compatible with ru…

0e6b22d

…stls default provider to reduce the code changes by hand when testing

The implementation of this function is required by some tests in suit…

20bda5c

…e tests::ffdhe

Adjust ubuntu and macos work flows to run tests against rustlsv0.23.35

1220bbf

Install go as it is required for installing aws-lc-fips-sys v0.13.10

b54ebd8

Key must be set before encrypting with aes object to get correct tag

90f7342

For correct tag calculation in AES GCM mode in macOS the function wc_…

972c19b

…AesGcmSetKey must be used and not wc_AesSetKey

Replace unwrap() with constructs such as ? and map_err to avoid panic…

42bd60f

…king and to propagate errors instead.

Rebasing 8

1051f77

Store raw key bytes of ChaCha object when setKey

11d4009

Remove unnecessary import

a769d4d

Remove allow(clippy::type_complexity) and fix readability issue

6d63f32

Rebasing 9

6518c58

Run rustls tests in a separate yml file

e6f1e77

Fix script title

67a8540

Fix formatting error resulting from wrongly ordered imports

203387d

Fix tag names from v0.23.35 to v/0.23.35

8c84d41

Fix path of provider in building step

1d1dcf0

Use zeroize::Zeroizing instead of der::zeroize

9e94096

helkoulak force-pushed the quic-support branch from 25b7ad6 to 9e94096 Compare March 27, 2026 16:46

Conversation

helkoulak commented Sep 21, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

julek-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gasbytes left a comment

Choose a reason for hiding this comment

Uh oh!

helkoulak commented Sep 23, 2025

Uh oh!

gasbytes commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

helkoulak commented Sep 26, 2025

Uh oh!

julek-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

helkoulak Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gasbytes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gasbytes commented Sep 25, 2025 •

edited

Loading

helkoulak Jan 8, 2026 •

edited

Loading