Update vendored Wycheproof RSA-OAEP vectors and remove workaround
- Dominant language
- Assembly
- Stars
- 830
- Forks
- 212
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 61
Description
In [c59b86c](https://github.com/aws/aws-lc/commit/c59b86ce876737af6e6170763e42b5a9ea0fb711), I added a workaround in `crypto/evp_extra/evp_test.cc` (lines 963-964) with the comment:
> AWS-LC enforces FIPS 800-56B Rev. 2 §7.1.2.1 which requires 1 < c < (n-1).
> But Wycheproof mistakenly marks some vectors with c values outside this range as valid.
This comment is incorrect. Wycheproof was not wrong---our vendored copy of `rsa_oaep_misc_test.json` was outdated. Upstream Wycheproof reclassified these vectors in [C2SP/wycheproof@df4e933](https://github.com/C2SP/wycheproof/commit/df4e933efef449fc88af0c06e028d425d84a9495) (May 1, 2025), changing 3 test cases from `valid` to `acceptable` and adding a `SmallIntegerCiphertext` flag, citing the same [SP 800-56B §7.1.2.1](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Br2.pdf) rationale.
#### Affected vectors
These 3 vectors have ciphertext values of 0 or 1, which fall outside the range `1 < c < (n-1)` required by SP 800-56B §7.1.2.1:
| Old tcId (vendored) | New tcId (upstream) | ct value | sha |
|---|---|---|---|
| 756 | 376 | 1 | SHA-256 |
| 765 | 385 | 1 | SHA-256 |
| 772 | 392 | 0 | SHA-384 |
All three are identical (same ct, msg, label, sha, mgfSha) across the old and new formats.
#### Fix
1. Update the vendored `third_party/wycheproof_testvectors/rsa_oaep_misc_test.json` to current upstream.
2. Remove the manual range-check override in `crypto/evp_extra/evp_test.cc` (~lines 963-978).
3. Add `"SmallIntegerCiphertext"` to the `IsValid` call; that is
```cpp
bool is_valid = result.IsValid({"SmallModulus", "SmallIntegerCiphertext"});
```
Contributor guide
Assessment
This issue has not been assessed yet.