Executive brief
wolfEngine, a cryptographic engine used in TLS/DTLS connections, fails to properly generate unique nonces for AES-GCM encryption. This causes every encrypted record in a connection to use the same key-nonce pair, enabling attackers to recover the encryption keystream and forge authentication tags, potentially allowing message modification or impersonation in affected TLS 1.2 and DTLS 1.2 sessions.
Technical details
The vulnerability is a cryptographic nonce reuse flaw in wolfEngine's TLS 1.2 and DTLS 1.2 AES-GCM implementation. The 8-byte explicit nonce is generated once when the TLS write key is set but never incremented per record, violating GCM security requirements. This allows attackers to recover the keystream (XOR of ciphertexts reveals XOR of plaintexts with one known record) and extract the GHASH authentication key for tag forgery. The flaw is present in versions before 1.4.1. TLS 1.3, AES-CCM, and non-TLS cipher usage are unaffected. Patches are available in wolfEngine 1.4.1 and later.
Affected products
- wolfSSL wolfEngine before 1.4.1
Timeline
- 2026-08-28: disclosed