Ensure the ECDSA signature scheme is bound to the certificate curve. Always validate MFL for TLS 1.3, even when WOLFSSL_OLD_UNSUPPORTED_EXTENSION is defined.

[kareem-wolfssl]

Description

Fixes zd#22471, F-11837

Thanks to Eva Crystal (0xiviel), XSource Security for the ECDSA report!

Testing

Built in/added tests, provided reproducer

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

The ECDSA validation compares curve sizes rather than exact curve identities, allowing same-sized mismatched curves.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Strengthens TLS 1.3 validation for ECDSA signature schemes and Maximum Fragment Length responses.

Changes:

• Validates peer ECDSA certificate curves during CertificateVerify.
• Enforces TLS 1.3 MFL validation despite legacy extension handling.
• Adds regression tests for both behaviors.

File summaries

File	Description
wolfssl/internal.h	Exposes the ECC strength comparison helper.
src/internal.c	Makes the ECC helper externally accessible.
src/tls13.c	Adds ECDSA curve validation.
src/tls.c	Enforces TLS 1.3 MFL response checks.
tests/api/test_tls13.c	Tests ECDSA scheme/curve mismatches.
tests/api/test_tls13.h	Registers the new TLS 1.3 test.
tests/api/test_tls_parse.c	Tests TLS 1.3 MFL validation.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 191,108 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 789,084 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 307,056 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 245,982 B / 262,144 B, total: 94% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 307,952 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 245,982 B / 262,144 B, total: 94% used)

linuxkm-standard

• Data: __patchable_function_entries +16 B (+0.0%, 51,344 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• linuxkm-pie
• stm32-sim-stm32h753

[0xiviel]

Re-ran the F03 checks at f4010ce, built from base 3babd37 plus the three PR commits, --enable-all --enable-dual-alg-certs, clang -O1.

• The attack case closes in both directions: a P-256 leaf announcing ecdsa_secp521r1_sha512 completed the handshake against an unpatched verifier (peer key 256 bits) and now fails SIG_VERIFY_E, both with the client verifying and with the server verifying in mutual TLS.
• Honest pairs still complete: P-256/SHA256, P-384/SHA384, P-521/SHA512. Controls unchanged: an unmodified sender still declines those pairings itself, and a wrong trust anchor still fails.
• --api on the PR base and on this head: zero failures either side, one added test.
• Preprocessor only, not run as handshakes: the SM2 site, since sm3.h needs wolfsm, and the alt-signature site, which needs a dual-algorithm certificate.
• Brainpool is now separated from the equal-size secp curves. secp256k1 keeps passing under ecdsa_secp256r1_sha256, which your comment covers.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11494

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 3 of 6 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_tls13.c, tests/api/test_tls_parse.c, wolfssl/internal.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot review overview

🟡 Changes recommended

The ECDSA validation compares curve sizes rather than exact curve identifiers, leaving same-sized curves such as secp256k1 incorrectly accepted.

Review effort: Balanced
Findings: 2

Open (2)

• Bind TLS 1.3 signature schemes to exact certificate curves · New
• This does not actually bind the signature scheme to its named curve: CmpEccStrength() compares…

[kareem-wolfssl]

This isn't possible as RFC 8446 defines no ECDSA codepoint for secp256k1 at all, so any TLS 1.3 use of it
must borrow secp256r1's. secp256k1 has roughly equivalent security as secp256r1, so this is not a security issue.