[stenslae]

Description

Added support from deriving public keys from ML-DSA private keys with a new API. Added test coverage.

Dependent on PR #11419

wolfSSL/wolfssh#1120

Testing

Added test coverage.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-pq

• FLASH: .text +512 B (+0.2%, 310,332 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +576 B (+0.2%, 311,292 B / 1,048,576 B, total: 30% used)

linuxkm-pie

• Data: __patchable_function_entries +40 B (+0.1%, 28,840 B)

linuxkm-standard

• Data: __patchable_function_entries +16 B (+0.0%, 51,960 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 6 total — 4 posted, 2 skipped

Posted findings

• [High] wc_MlDsaKey_MakePublicKey mishandles buffers in the small-mem path (aSet, h, s1) — wolfcrypt/src/wc_mldsa.c:10413-10665
• [Medium] wc_EccPrivateKeyDecode now unconditionally derives the public point — wolfcrypt/src/asn.c:32722-32745
• [Low] Dead/empty guard branch before t0Scratch allocation — wolfcrypt/src/wc_mldsa.c:10458-10467
• [Medium] Duplicated t = A o NTT(s1) + s2 kernel - extract shared helper with keygen — wolfcrypt/src/wc_mldsa.c:10479-10635

Skipped findings

• [Medium] No test coverage for small-mem / cache-macro configurations of MakePublicKey
• [Medium] ML-DSA secret vectors left unzeroed in wc_MlDsaKey_MakePublicKey under SMALL_MEM + CACHE_PRIV_VECTORS

Review generated by Skoll via Claude/Codex

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Copilot]

Copilot review overview

🟡 Changes recommended

Verification still accepts unset public keys, and existing-key validation does not fully confirm private/public consistency.

Review effort: Balanced
Findings: 2

Open (2)

• Reject verification when the public key is missing · New
• Validate all private-key components when public key is already set · New

What changed in this PR

This PR adds ML-DSA public-key derivation from private keys and related consistency checks.

Changes:

• Adds wc_MlDsaKey_MakePublicKey.
• Refactors shared t computation for standard and small-memory builds.
• Adds derivation, cache, mismatch, and allocation-failure tests.

File	Description
wolfssl/​wolfcrypt/​wc_mldsa.h	Declares the derivation API and feature gate.
wolfcrypt/​src/​wc_mldsa.c	Implements derivation and shared computation helpers.
tests/​include.am	Documents the shared fault-allocation header.
tests/​api/​test_mldsa.h	Registers new tests.
tests/​api/​test_mldsa.c	Tests derivation and failure paths.
doc/​dox_comments/​header_files/​wc_mldsa.h	Documents the new API.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_mldsa.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: none
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot review overview

🟡 Changes recommended

The already-set public-key path can accept mathematically unrelated key halves when the imported tr is forged.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Validate all private-key components when public key is already set
• Test MakePublicKey when MLDSA verification is disabled · New

Resolved since last review (1)

• Reject verification when the public key is missing

[Copilot]

Copilot review overview

🟡 Changes recommended

Functional tests currently skip supported make-only ML-DSA configurations.

Review effort: Balanced
Findings: 1

Open (1)

• Run make-only ML-DSA derivation and mismatch tests · New

Resolved since last review (2)

• Validate all private-key components when public key is already set
• Test MakePublicKey when MLDSA verification is disabled

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 3 of 3 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot review overview

🟡 Changes recommended

The small-memory hash-error path can process uninitialized polynomial data before returning.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid post-processing uninitialized data after expansion failure · New

Resolved since last review (1)

• Run make-only ML-DSA derivation and mismatch tests

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfssl-src, wolfssl-bugs
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[MarkAtwood]

Heads-up on overlap: for #11671 I have a small patch that makes wc_MlDsaKey_PrivateKeyDecode reject a key whose [1] publicKey doesn't match the private key, by checking tr == SHAKE256(pk) before import. It duplicates the tr check in your wc_MlDsaKey_MakePublicKey. It goes up after #11674 merges; if this PR lands first I'll switch it to your helper.

[Copilot]

🔵 Needs a closer look

Cryptographic derivation and its compile-time configuration matrix warrant final human review despite comprehensive tests.

0 open findings

1 resolved since last review

• Avoid post-processing uninitialized data after expansion failure

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 4 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_mldsa.c, tests/unit-mcdc/test_mldsa_hash_fault_whitebox.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The small-memory POLY64 error path reads uninitialized data, and the API documentation misstates devId-bound behavior.

2 open findings

• Guard t64 reduction when matrix expansion fails · New
• Allow derivation with imported software private key material · New

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 3 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_mldsa.c, tests/unit-mcdc/test_mldsa_hash_fault_whitebox.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🔵 Needs a closer look

Cryptographic derivation spans numerous memory, hardware-callback, caching, and build configurations requiring final human validation.

0 open findings

2 resolved since last review

• Guard t64 reduction when matrix expansion fails
• Allow derivation with imported software private key material

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10985

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 2 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_mldsa.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[padelsbach]

jenkins retest this please

[padelsbach]

Will merge after #11416

[padelsbach]

@stenslae, can you please resolve the conflicts?

[stenslae]

retest this please