Commit c2651f0db8 for openssl.org

commit c2651f0db8b8b309aabdb6386c9d0bf32825242e
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Wed Oct 28 14:05:09 2026 +0400

    Reject unsupported nonce lengths for Ascon-AEAD128

    Ascon-AEAD128 uses a fixed 16 byte nonce (passed as the EVP IV),
    but the IV length was not among its settable parameters.
    EVP_CTRL_AEAD_SET_IVLEN therefore reported success, while the provider
    ignored the value, and the subsequent init copied 16 bytes
    from the caller's nonce buffer.

    Accept the IV length parameter and fail with PROV_R_INVALID_IV_LENGTH
    unless it is 16.

    Assisted-by: Claude Code:claude-opus-5-5
    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Sun Nov  8 12:50:51 2026
    Merged-from: https://github.com/openssl/openssl/pull/33512

diff --git a/providers/implementations/ciphers/cipher_ascon_aead128.c b/providers/implementations/ciphers/cipher_ascon_aead128.c
index d4ae002ad8..024b896bce 100644
--- a/providers/implementations/ciphers/cipher_ascon_aead128.c
+++ b/providers/implementations/ciphers/cipher_ascon_aead128.c
@@ -473,6 +473,20 @@ static int ascon_aead128_set_ctx_params(void *vctx, const OSSL_PARAM params[])
         }
     }

+    if (p.ivlen != NULL) {
+        size_t iv_len = 0;
+
+        if (!OSSL_PARAM_get_size_t(p.ivlen, &iv_len)) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
+            return 0;
+        }
+        /* The nonce length is fixed */
+        if (iv_len != ASCON_AEAD_NONCE_LEN) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
+            return 0;
+        }
+    }
+
     if (p.tag != NULL) {
         /* when data is NULL, this is a request to set tag length */
         if (p.tag->data == NULL) {
diff --git a/providers/implementations/ciphers/cipher_ascon_aead128.inc.in b/providers/implementations/ciphers/cipher_ascon_aead128.inc.in
index 407b9a29c9..213aed4ab8 100644
--- a/providers/implementations/ciphers/cipher_ascon_aead128.inc.in
+++ b/providers/implementations/ciphers/cipher_ascon_aead128.inc.in
@@ -22,5 +22,6 @@ use OpenSSL::paramnames qw(produce_param_decoder);
 {- produce_param_decoder('ascon_aead128_set_ctx_params',
                          (['OSSL_CIPHER_PARAM_AEAD_TAG',    'tag',    'octet_string'],
                           ['OSSL_CIPHER_PARAM_AEAD_TAGLEN', 'taglen', 'size_t'],
+                          ['OSSL_CIPHER_PARAM_AEAD_IVLEN',  'ivlen',  'size_t'],
                          )); -}

diff --git a/test/recipes/30-test_evp_data/evpciph_ascon_aead128.txt b/test/recipes/30-test_evp_data/evpciph_ascon_aead128.txt
index 7443f358d6..89b5d15b31 100644
--- a/test/recipes/30-test_evp_data/evpciph_ascon_aead128.txt
+++ b/test/recipes/30-test_evp_data/evpciph_ascon_aead128.txt
@@ -18898,3 +18898,25 @@ Reason = bad decrypt

 # TestCount: 121

+
+Title = Ascon AEAD 128 only accepts a 16 byte nonce
+
+# Same as the first test with the last byte of the IV removed
+Cipher = ascon-aead128
+Key = 68143878109DE6D99EB51700335475DA
+IV = 57254555E1B4B4EF38E895E37A88A8
+Plaintext =
+AAD =
+Tag = F341833ACC65733F95A3E5E64B20BB0F
+Ciphertext =
+Result = INVALID_IV_LENGTH
+
+# Same as the first test with a byte appended to the IV
+Cipher = ascon-aead128
+Key = 68143878109DE6D99EB51700335475DA
+IV = 57254555E1B4B4EF38E895E37A88A8A300
+Plaintext =
+AAD =
+Tag = F341833ACC65733F95A3E5E64B20BB0F
+Ciphertext =
+Result = INVALID_IV_LENGTH