Update AWS-LC and update wycheproof for new checks (#14466)

Author: alex

.github/workflows/ci.yml

@@ -42,8 +42,8 @@ jobs:
           - {VERSION: "3.14", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.2.1"}}
           # Latest commit on the BoringSSL main branch, as of Mar 10, 2026.
           - {VERSION: "3.14", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "476f4835186050a44f7fe6f088abbd279b634194"}}
-          # Latest tag of AWS-LC main branch, as of Mar 03, 2026.
-          - {VERSION: "3.14", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "aws-lc", VERSION: "v1.69.0"}}
+          # Latest tag of AWS-LC main branch, as of Mar 12, 2026.
+          - {VERSION: "3.14", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "aws-lc", VERSION: "v1.70.0"}}
           # Latest commit on the OpenSSL master branch, as of Sep 04, 2025.
           - {VERSION: "3.14", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "ceb45f64bde3d299c7ef529e5cd5372e4a421366"}}
           # Builds with various Rust versions. Includes MSRV and next

tests/wycheproof/test_rsa.py

@@ -8,6 +8,7 @@
 import pytest
 
 from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import padding, rsa
 
@@ -249,7 +250,13 @@ def test_rsa_oaep_encryption(backend, wycheproof):
     if backend._fips_enabled and key.key_size < backend._fips_rsa_min_key_size:
         pytest.skip("Invalid params for FIPS. <2048 bit keys are disallowed")
 
-    if wycheproof.valid or wycheproof.acceptable:
+    if wycheproof.valid or (
+        wycheproof.acceptable
+        and not (
+            rust_openssl.CRYPTOGRAPHY_IS_AWSLC
+            and wycheproof.has_flag("SmallIntegerCiphertext")
+        )
+    ):
         pt = key.decrypt(
             binascii.unhexlify(wycheproof.testcase["ct"]), padding_algo
         )