From 889d83b997f05036ebb20223e0f820b2ef2f501e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Jul 2026 20:14:10 +0200 Subject: [PATCH] Make sure KEM implementations don't return an empty shared secret If `set_public_key` is never called we won't have a shared secret to return. This aligns the implementations with the one in the openssl plugin. --- src/libstrongswan/plugins/botan/botan_kem.c | 8 ++++++-- src/libstrongswan/plugins/ml/ml_kem.c | 8 ++++++-- src/libstrongswan/plugins/wolfssl/wolfssl_kem.c | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/src/libstrongswan/plugins/botan/botan_kem.c b/src/libstrongswan/plugins/botan/botan_kem.c index 17d8549de..ab75df8a2 100644 --- a/src/libstrongswan/plugins/botan/botan_kem.c +++ b/src/libstrongswan/plugins/botan/botan_kem.c @@ -281,8 +281,12 @@ METHOD(key_exchange_t, set_public_key, bool, METHOD(key_exchange_t, get_shared_secret, bool, private_key_exchange_t *this, chunk_t *secret) { - *secret = chunk_clone(this->shared_secret); - return TRUE; + if (this->shared_secret.ptr != NULL) + { + *secret = chunk_clone(this->shared_secret); + return TRUE; + } + return FALSE; } METHOD(key_exchange_t, get_method, key_exchange_method_t, diff --git a/src/libstrongswan/plugins/ml/ml_kem.c b/src/libstrongswan/plugins/ml/ml_kem.c index 9da72ea61..e257e0c1f 100644 --- a/src/libstrongswan/plugins/ml/ml_kem.c +++ b/src/libstrongswan/plugins/ml/ml_kem.c @@ -942,8 +942,12 @@ METHOD(key_exchange_t, get_method, key_exchange_method_t, METHOD(key_exchange_t, get_shared_secret, bool, private_key_exchange_t *this, chunk_t *secret) { - *secret = chunk_clone(this->shared_secret); - return TRUE; + if (this->shared_secret.ptr != NULL) + { + *secret = chunk_clone(this->shared_secret); + return TRUE; + } + return FALSE; } #ifdef TESTABLE_KE diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c b/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c index 786aecab4..b763307b6 100644 --- a/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c +++ b/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c @@ -241,8 +241,12 @@ METHOD(key_exchange_t, set_public_key, bool, METHOD(key_exchange_t, get_shared_secret, bool, private_key_exchange_t *this, chunk_t *secret) { - *secret = chunk_clone(this->shared_secret); - return TRUE; + if (this->shared_secret.ptr != NULL) + { + *secret = chunk_clone(this->shared_secret); + return TRUE; + } + return FALSE; } METHOD(key_exchange_t, get_method, key_exchange_method_t,