Conversation
cconlon
changed the title
There was a problem hiding this comment.
Pull request overview
Adds AES Key Wrap (RFC 3394 / NIST SP 800-38F “KW”) support across the wolfCrypt JNI layer and the wolfJCE provider, including feature detection, provider registrations/aliases, AlgorithmParameters handling for 8-byte KW IVs, tests, and examples.
Changes:
- Introduces native + Java JNI wrapper
AesKeyWrapbacked bywc_AesKeyWrap_ex()/wc_AesKeyUnWrap_ex(), plusFeatureDetect.AesKeyWrapEnabled(). - Registers new wolfJCE
Cipherservices/aliases forAESWrap/AES/KW/*(including PKCS5Padding) and size-locked variants with NIST OIDs. - Adds extensive JUnit coverage (JNI + JCE), documentation updates, and build/IDE integration updates.
Reviewed changes
Copilot reviewed 26 out of 28 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/test/java/com/wolfssl/wolfcrypt/test/WolfCryptTestSuite.java | Adds AesKeyWrapTest to the wolfCrypt JNI test suite. |
| src/test/java/com/wolfssl/wolfcrypt/test/AesKeyWrapTest.java | New JNI-level AES Key Wrap test vectors, argument validation, offsets, and threading tests. |
| src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java | Adds WolfCryptCipherAesWrapTest to the wolfJCE test suite. |
| src/test/java/com/wolfssl/provider/jce/test/WolfCryptCipherTest.java | Extends generic cipher tests to include AES Key Wrap services and excludes KW from IV-consistency test. |
| src/test/java/com/wolfssl/provider/jce/test/WolfCryptCipherAesWrapTest.java | New wolfJCE AESWrap/AES-KW test coverage including interop, IV handling, and PKCS5Padding behavior. |
| src/test/java/com/wolfssl/provider/jce/test/WolfCryptAlgorithmParametersTest.java | Adds tests validating 8-byte KW IV support in AES AlgorithmParameters (DER + spec paths). |
| src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java | Adds native AesKeyWrapEnabled() feature detection hook. |
| src/main/java/com/wolfssl/wolfcrypt/AesKeyWrap.java | New Java JNI wrapper for AES Key Wrap with keying, wrap/unwrap APIs, and argument validation. |
| src/main/java/com/wolfssl/provider/jce/WolfCryptProvider.java | Registers AESWrap / AES-KW cipher services, aliases, OIDs, and size-locked variants when enabled. |
| src/main/java/com/wolfssl/provider/jce/WolfCryptCipher.java | Implements AES Key Wrap mode in the provider cipher engine (modes, padding, IV params, wrap/unwrap integration). |
| src/main/java/com/wolfssl/provider/jce/WolfCryptAesParameters.java | Expands AES AlgorithmParameters to accept/encode/decode both 16-byte AES IVs and 8-byte KW IVs. |
| spotbugs-exclude.xml | Suppresses SpotBugs “constructor throws” warning for AesKeyWrap. |
| scripts/infer.sh | Adds AesKeyWrap.java to the Infer static analysis compile list. |
| README.md | Documents build/configure requirements for enabling AES Key Wrap in native wolfSSL for wolfJCE services. |
| README_JCE.md | Documents AESWrap/AES-KW service names, behavior, IV handling, exceptions, and usage notes. |
| makefile.macosx | Adds jni_aeskeywrap.o to native build object list. |
| makefile.linux | Adds jni_aeskeywrap.o to native build object list. |
| jni/jni_feature_detect.c | Implements FeatureDetect.AesKeyWrapEnabled() native binding. |
| jni/jni_aeskeywrap.c | New JNI implementation bridging Java AesKeyWrap to wolfCrypt KW APIs with argument checks and zeroization. |
| jni/include/com_wolfssl_wolfcrypt_FeatureDetect.h | Declares JNI header for AesKeyWrapEnabled. |
| jni/include/com_wolfssl_wolfcrypt_AesKeyWrap.h | New generated JNI header for AesKeyWrap. |
| IDE/WIN/wolfcryptjni.vcxproj.filters | Adds AES Key Wrap JNI header/source to Visual Studio project filters. |
| IDE/WIN/wolfcryptjni.vcxproj | Adds AES Key Wrap JNI header/source to Visual Studio project. |
| IDE/WIN/README.md | Documents Windows build defines enabling AES Key Wrap. |
| IDE/Android/app/src/main/cpp/CMakeLists.txt | Enables HAVE_AES_KEYWRAP and includes jni_aeskeywrap.c in the Android build. |
| examples/provider/AesKeyWrapExample.sh | New script to run the AES Key Wrap provider example. |
| examples/provider/AesKeyWrapExample.java | New example demonstrating AESWrap usage, explicit IV, and PKCS5Padding for non-8-multiple encodings. |
| .github/workflows/windows-vs.yml | Updates CI user_settings.h defines to enable AES Key Wrap for Windows builds. |
Files not reviewed (2)
- jni/include/com_wolfssl_wolfcrypt_AesKeyWrap.h: Generated file
- jni/include/com_wolfssl_wolfcrypt_FeatureDetect.h: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
Retest this please Jenkins |
cconlon
requested review from
wolfSSL-Fenrir-bot
and removed request for
wolfSSL-Fenrir-bot
September 11, 2026 23:35
wolfSSL-Fenrir-bot
requested changes
Sep 14, 2026
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #269
Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds AES Key Wrap (RFC 3394 / NIST SP 800-38F KW) to wolfCrypt JNI and wolfJCE, via native
wc_AesKeyWrap_ex()/wc_AesKeyUnWrap_ex().AesKeyWrapclass (jni_aeskeywrap.c)FeatureDetect.AesKeyWrapEnabled()Cipherservices:AESWrap(aliasesAES/KW/NoPadding,AESKW),AESWrap_128/192/256(AES_NNN/KW/NoPadding, NIST OIDs), andAES/KW/PKCS5PaddingWRAP/UNWRAPandENCRYPT/DECRYPTmodes, optional 8-byte IV viaIvParameterSpecRequires native wolfSSL built with
--enable-aeskeywrap(included in--enable-all) to be enabled/registered. RFC 5649 KWP is not available in native wolfSSL and is out of scope.JUnit tests added, IDE projects updated, simple example app added (AesKeyWrapExample).