asn: add a helper to complete a private-only ECC key

SEC1 makes the public point optional. Derive it in one place that
blinds the multiply, waits on async and fails closed. In asn.c, not
ecc.c, so FIPS builds with a tagged ecc.c have it too.

Author: stenslae

doc/dox_comments/header_files/asn_public.h

@@ -2282,7 +2282,11 @@ int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
 
     \brief This function reads in an ECC private key from the input buffer,
     input, parses the private key, and uses it to generate an ecc_key object,
-    which it stores in key.
+    which it stores in key. If the input RFC 5915 DER encoding omits the
+    optional publicKey field, the key is left with type ECC_PRIVATEKEY_ONLY.
+    Callers requiring the public point (e.g. for export or verification)
+    can complete the key with wc_ecc_make_pub_ex(), passing an RNG so the
+    scalar multiply is blinded.
 
     \return 0 On successfully decoding the private key and storing the result
     in the ecc_key struct
@@ -2333,6 +2337,7 @@ int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
     \endcode
 
     \sa wc_RSA_PrivateKeyDecode
+    \sa wc_ecc_make_pub_ex
 */
 int wc_EccPrivateKeyDecode(const byte* input, word32* inOutIdx,
                                            ecc_key* key, word32 inSz);

tests/unit-mcdc/test_asn_keys_whitebox.c

@@ -2141,6 +2141,93 @@ static void wb_build_ecc_key_der(void) { WB_NOTE("HAVE_ECC/template off; wc_Buil
 static void wb_ecc_to_pkcs8(void) { WB_NOTE("HAVE_ECC/template off; eccToPKCS8 skipped"); }
 #endif
 
+/* ========================================================================
+ * Section B4b: wc_ecc_derive_pub_if_needed(), the contract
+ * wc_PKCS7_ImportECC(), the static ephemeral key loader and the EC_KEY
+ * loaders rely on. It is WOLFSSL_LOCAL, so tests/api cannot reach it. The
+ * NOT_COMPILED_IN / NO_VALID_DEVID / WC_KEY_SIZE_E tolerance needs a
+ * hardware, CB-only or SP-only build and is not reachable from here.
+ * ===================================================================== */
+#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
+static void wb_ecc_derive_pub_if_needed(void)
+{
+    WC_RNG rng;
+    ecc_key key;
+    int ret;
+
+    WB_NOTE("wc_ecc_derive_pub_if_needed(): NULL / full / private-only / "
+            "failed derivation");
+    ret = wc_ecc_derive_pub_if_needed(NULL, NULL);
+    WB_CHECK(ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG), "key==NULL");
+
+    if (wc_InitRng(&rng) != 0) {
+        WB_NOTE("wc_InitRng failed; skipped");
+        return;
+    }
+    if (wc_ecc_init(&key) != 0) {
+        WB_NOTE("wc_ecc_init failed; skipped");
+        wc_FreeRng(&rng);
+        return;
+    }
+    if (wc_ecc_make_key_ex(&rng, 0, &key, ECC_SECP256R1) != 0) {
+        WB_NOTE("wc_ecc_make_key_ex failed; skipped");
+        goto out;
+    }
+
+    /* A key that already holds its point is left untouched. A marker in
+     * pubkey.x tells an early return apart from a silent recompute. */
+    if (mp_set(key.pubkey.x, 1) == MP_OKAY) {
+        ret = wc_ecc_derive_pub_if_needed(&key, &rng);
+        WB_CHECK((ret == 0) && (key.type == ECC_PRIVATEKEY) &&
+            (mp_isone(key.pubkey.x) == MP_YES), "full key early-returns");
+    }
+
+    /* A private-only key is completed, replacing the marker. */
+    key.type = ECC_PRIVATEKEY_ONLY;
+    ret = wc_ecc_derive_pub_if_needed(&key, &rng);
+    WB_CHECK((ret == 0) && (key.type == ECC_PRIVATEKEY) &&
+        (mp_isone(key.pubkey.x) != MP_YES), "private-only key promoted");
+
+    /* So is an ECC_PRIVATEKEY with an all-zero point, as SetECKeyInternal()
+     * leaves when only the private key was set. */
+    mp_zero(key.pubkey.x);
+    mp_zero(key.pubkey.y);
+    ret = wc_ecc_derive_pub_if_needed(&key, &rng);
+    WB_CHECK((ret == 0) && (key.type == ECC_PRIVATEKEY) &&
+        !mp_iszero(key.pubkey.x), "zero point completed");
+
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_SP_MATH) && !defined(HAVE_SELFTEST) && \
+    !(defined(HAVE_FIPS) && FIPS_VERSION_LT(5,0))
+    /* No local RNG for a curve the SP fixed-base multiply handles. */
+    #if defined(WOLFSSL_HAVE_SP_ECC) && !defined(WOLFSSL_SP_NO_256)
+    WB_CHECK(ecc_derive_pub_uses_rng(&key) == 0, "SP P-256 takes no RNG");
+    #else
+    WB_CHECK(ecc_derive_pub_uses_rng(&key) == 1, "MP P-256 takes an RNG");
+    #endif
+#endif
+
+    /* A failed derivation leaves the key private-only. */
+    key.type = ECC_PRIVATEKEY_ONLY;
+    mp_zero(key.k);
+#ifdef WOLFSSL_ECC_BLIND_K
+    mp_zero(key.kb);
+#endif
+    ret = wc_ecc_derive_pub_if_needed(&key, &rng);
+    WB_CHECK((ret != 0) && (key.type == ECC_PRIVATEKEY_ONLY),
+        "zero scalar fails closed");
+
+out:
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+}
+#else
+static void wb_ecc_derive_pub_if_needed(void)
+{
+    WB_NOTE("HAVE_ECC off or WC_NO_RNG; skipped");
+}
+#endif
+
 /* ========================================================================
  * Section B5: DecodeAsymKey_Assign()/DecodeAsymKey()/DecodeAsymKeyPublic_
  * Assign()/DecodeAsymKeyPublic(), driven directly plus via SetAsymKeyDer()/
@@ -2778,6 +2865,7 @@ int main(void)
     wb_ecc_public_key_decode();
     wb_build_ecc_key_der();
     wb_ecc_to_pkcs8();
+    wb_ecc_derive_pub_if_needed();
     wb_decode_asym_key_assign_guard();
     wb_decode_asym_key_seed_arms();
     wb_decode_asym_key_roundtrip();

wolfcrypt/src/asn.c

@@ -35136,6 +35136,139 @@ int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx,
     return ret;
 }
 #endif /* WOLFSSL_ASN_TEMPLATE */
+
+#if defined(ECC_TIMING_RESISTANT) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_SP_MATH) && !defined(HAVE_SELFTEST) && \
+    !(defined(HAVE_FIPS) && FIPS_VERSION_LT(5,0))
+    #define ECC_DERIVE_PUB_LOCAL_RNG
+
+/* Whether deriving this key's point takes an RNG. The SP curves use a
+ * fixed-base multiply that takes none; this mirrors ecc_make_pub_sw(). */
+static int ecc_derive_pub_uses_rng(const ecc_key* key)
+{
+    int sp = 0;
+
+#ifdef WOLFSSL_HAVE_SP_ECC
+    if ((key->idx != ECC_CUSTOM_IDX) && (key->dp != NULL)) {
+        int id = key->dp->id;
+    #ifndef WOLFSSL_SP_NO_256
+        sp |= (id == ECC_SECP256R1);
+    #endif
+    #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SP_SM2)
+        sp |= (id == ECC_SM2P256V1);
+    #endif
+    #ifdef WOLFSSL_SP_384
+        sp |= (id == ECC_SECP384R1);
+    #endif
+    #ifdef WOLFSSL_SP_521
+        sp |= (id == ECC_SECP521R1);
+    #endif
+        (void)id;
+    }
+#else
+    (void)key;
+#endif
+
+    return !sp;
+}
+#endif
+
+/* Derive and cache the public point of a key that lacks one.
+ *
+ * SEC1/RFC 5915 makes the publicKey field optional, so
+ * wc_EccPrivateKeyDecode() can leave key->type == ECC_PRIVATEKEY_ONLY. The
+ * compatibility layer can also mark a key ECC_PRIVATEKEY with an all-zero
+ * point when only the private key was set.
+ * Lives here rather than in ecc.c so FIPS builds, which swap ecc.c for a
+ * tagged copy, have it too.
+ *
+ * key  private key to complete, cannot be NULL
+ * rng  RNG for a timing-resistant multiply, may be NULL: key->rng or a local
+ *      RNG is used instead
+ *
+ * returns 0 when the key holds a public point, or when the build or device
+ *         has no derivation and the key was left private-only. Callers that
+ *         need the point check key->type.
+ */
+int wc_ecc_derive_pub_if_needed(ecc_key* key, WC_RNG* rng)
+{
+    int ret = 0;
+#ifdef ECC_DERIVE_PUB_LOCAL_RNG
+    WC_DECLARE_VAR(tmpRng, WC_RNG, 1, NULL);
+    int initTmpRng = 0;
+#endif
+
+    if (key == NULL) {
+        return BAD_FUNC_ARG;
+    }
+    if ((key->type != ECC_PRIVATEKEY_ONLY) &&
+            !((key->type == ECC_PRIVATEKEY) && mp_iszero(key->pubkey.x) &&
+              mp_iszero(key->pubkey.y))) {
+        return 0;
+    }
+#ifdef WOLFSSL_CAAM
+    /* A black key holds an encrypted blob, not a scalar. */
+    if (key->blackKey != 0) {
+        return 0;
+    }
+#endif
+
+#ifdef ECC_DERIVE_PUB_LOCAL_RNG
+    /* The multi-precision multiply is only blinded when given an RNG. */
+    if (rng == NULL) {
+        rng = key->rng;
+    }
+    if ((rng == NULL) && ecc_derive_pub_uses_rng(key)) {
+        WC_ALLOC_VAR_EX(tmpRng, WC_RNG, 1, key->heap, DYNAMIC_TYPE_RNG,
+            ret = MEMORY_E);
+        if (ret == 0) {
+            ret = wc_InitRng_ex(tmpRng, key->heap, INVALID_DEVID);
+        }
+        if (ret == 0) {
+            initTmpRng = 1;
+            rng = tmpRng;
+        }
+    }
+#endif
+
+    if (ret == 0) {
+#if defined(HAVE_SELFTEST) || \
+    (defined(HAVE_FIPS) && FIPS_VERSION_LT(5,0))
+        (void)rng;
+        ret = wc_ecc_make_pub(key, NULL);
+#else
+        ret = wc_ecc_make_pub_ex(key, NULL, rng);
+#endif
+#ifdef WOLFSSL_ASYNC_CRYPT
+        /* Callers read key->type and key->pubkey as soon as this returns. */
+        ret = wc_AsyncWait(ret, &key->asyncDev, WC_ASYNC_FLAG_NONE);
+#endif
+        if (ret != 0) {
+            /* FIPS copies of ecc.c promote the key even when make-pub fails,
+             * and a pending derivation is promoted before the device has a
+             * point. */
+            key->type = ECC_PRIVATEKEY_ONLY;
+        }
+        /* No derivation in this build or device. WC_KEY_SIZE_E is an
+         * SP-only build without this curve. */
+        if ((ret == WC_NO_ERR_TRACE(NOT_COMPILED_IN)) ||
+                (ret == WC_NO_ERR_TRACE(NO_VALID_DEVID)) ||
+                (ret == WC_NO_ERR_TRACE(WC_KEY_SIZE_E))) {
+            ret = 0;
+        }
+    }
+
+#ifdef ECC_DERIVE_PUB_LOCAL_RNG
+    if (initTmpRng) {
+        wc_FreeRng(tmpRng);
+    }
+    WC_FREE_VAR_EX(tmpRng, key->heap, DYNAMIC_TYPE_RNG);
+    #undef ECC_DERIVE_PUB_LOCAL_RNG
+#endif
+
+    return ret;
+}
+
 #ifdef HAVE_ECC_KEY_EXPORT
 /* build DER formatted ECC key, include optional public key if requested,
  * return length on success, negative on error */

wolfssl/wolfcrypt/asn_public.h

@@ -858,9 +858,12 @@ WOLFSSL_API int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
 
 #ifdef HAVE_ECC
     /* private key helpers */
+    /* Note: if RFC 5915 DER omits publicKey, key->type is ECC_PRIVATEKEY_ONLY;
+     * call wc_ecc_make_pub_ex() with an RNG if the public point is needed. */
     WOLFSSL_ABI
     WOLFSSL_API int wc_EccPrivateKeyDecode(const byte* input, word32* inOutIdx,
                                            ecc_key* key, word32 inSz);
+    WOLFSSL_LOCAL int wc_ecc_derive_pub_if_needed(ecc_key* key, WC_RNG* rng);
     WOLFSSL_LOCAL int wc_BuildEccKeyDer(ecc_key* key, byte* output, word32 *outLen,
                                         int pubIn, int curveIn);
     WOLFSSL_ABI