[stenslae]

Description

RFC 5915 makes the publicKey field of an ECC private key optional. wc_EccPrivateKeyDecode() leaves such a key as ECC_PRIVATEKEY_ONLY. Several callers then used the key as if it had a point, or tried to derive it in ways that never compiled in.

• Added wc_ecc_derive_pub_if_needed(key, rng). It derives the point of a private-only key, waits on async devices, and resets the key to private-only if derivation fails, so an all-zero point is never cached.

• A private-only key loaded for the tls static ephemeral key share now gets its point derived. If derivation fails, the handshake fails instead of quietly generating a different key.

• PKCS#7 signing now derives the point if needed before wc_ecc_check_key().

• d2i_ECPrivateKey, EC_KEY_LoadDer, and PEM_write_*ECPrivateKey share one helper, wolfssl_ec_key_derive_pub(), which uses an RNG to blind the scalar multiply.

• EVP_PKEY_set1_EC_KEY/assign_EC_KEY and EVP_PKEY_cmp use the same blinded helper and copy the derived point back into the EC_KEY. As before, they fail if the point can't be derived.

• EC_KEY_set_private_key() with no public key: the key is now private-only, not a key with an all-zero point

• under WOLFSSL_ECC_BLIND_K, the plain copy of the private scalar made while reading an EC_KEY is now wiped

Testing

Added coverage over pr changes.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +104 B (+0.1%, 71,299 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +104 B (+0.1%, 132,333 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 209,612 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +128 B (+0.2%, 74,103 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +64 B (+0.0%, 182,355 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 196,632 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +320 B (+0.0%, 802,436 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +128 B (+0.1%, 223,508 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 313,552 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.0%, 133,073 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +128 B (+0.1%, 250,274 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 209,612 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 314,384 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 250,274 B / 262,144 B, total: 95% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +36 B, text +10,544 B (+3.7%, 293,052 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m4-rsa-only
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The helper can cause NO_ASN link failures and unnecessarily fail hardware-only derivation paths during RNG initialization.

4 open findings

• ASN-disabled builds fail to link due to unguarded ECC helper calls · New
• Premature RNG initialization breaks hardware-only private-key fallback · New
• Document wc_ecc_make_pub_ex fallback for unsupported configurations · New
• Document wc_ecc_make_pub fallback for older FIPS ECC builds · New

What changed in this PR

Adds public-point derivation for SEC1 ECC private keys that omit the optional public key.

Changes:

• Introduces a shared ECC public-point derivation helper.
• Integrates derivation into PKCS7, static ephemeral, and OpenSSL-compatible loaders.
• Adds API and white-box regression coverage.

File	Description
wolfssl/​wolfcrypt/​asn_public.h	Declares and documents the helper.
wolfcrypt/​src/​pkcs7.c	Completes imported PKCS7 ECC keys.
wolfcrypt/​src/​evp.c	Completes keys during EVP operations.
wolfcrypt/​src/​asn.c	Implements conditional public-point derivation.
tests/​unit-mcdc/​test_asn_keys_whitebox.c	Tests helper internals.
tests/​api/​test_ssl_pk.h	Registers static-key tests.
tests/​api/​test_ssl_pk.c	Tests static ephemeral private-only keys.
tests/​api/​test_pkcs7.h	Registers PKCS7 coverage.
tests/​api/​test_pkcs7.c	Tests PKCS7 private-only keys.
tests/​api/​test_ossl_ec.c	Expands OpenSSL compatibility tests.
tests/​api/​test_asn.h	Registers ASN tests.
tests/​api/​test_asn.c	Tests decode and explicit derivation.
tests/​api/​api.h	Adds ECC derivation capability detection.
src/​ssl_api_pk.c	Derives static ECDH public points.
src/​pk_ec.c	Updates EC loaders and private-only handling.
doc/​dox_comments/​header_files/​asn_public.h	Documents private-only decoding.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 5 of 11 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_asn.c, tests/api/test_ossl_ec.c, tests/api/test_pkcs7.c, tests/api/test_ssl_pk.c, tests/unit-mcdc/test_asn_keys_whitebox.c, wolfssl/wolfcrypt/asn_public.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

🟡 Changes recommended

Hardware-callback derivation can be blocked by unnecessary RNG initialization, and failed transactional loads can corrupt retained PKCS#8 metadata.

2 open findings

• Preserve PKCS#8 header metadata when key loading fails · New
• Defer software RNG creation until device callback declines · New

4 resolved since last review

• ASN-disabled builds fail to link due to unguarded ECC helper calls
• Premature RNG initialization breaks hardware-only private-key fallback
• Document wc_ecc_make_pub fallback for older FIPS ECC builds
• Document wc_ecc_make_pub_ex fallback for unsupported configurations

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 7 of 12 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_asn.c, tests/api/test_pkcs7.c, tests/api/test_ssl_pk.c, wolfssl/wolfcrypt/asn_public.h, wolfssl/wolfcrypt/ecc.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

A pending EC_MAKE_PUB callback in callback-only async builds is polled instead of re-invoked, causing an infinite wait that can hang TLS key-share generation.

3 open issues

• Reinvoke pending ECC callbacks instead of polling forever · New
• Defer software RNG creation until device callback declines
• Preserve PKCS#8 header metadata when key loading fails

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 11 of 13 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_asn.c, wolfssl/wolfcrypt/asn_public.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

Key loading can fail for pending callbacks in mixed-backend builds, and private-only public-key derivation can leak three existing coordinate allocations with heap math enabled.

2 open issues

• Free existing coordinate buffers before public-key derivation · New
• Reinvoke pending make-pub callbacks for the accepted backend · New

3 resolved since last review

• Reinvoke pending ECC callbacks instead of polling forever
• Defer software RNG creation until device callback declines
• Preserve PKCS#8 header metadata when key loading fails

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

🟡 Changes recommended

The new test leaks coordinate buffers under USE_INTEGER_HEAP_MATH because repeated key derivation overwrites the existing pointers without freeing them.

1 open issue

• Repeated derivation leaks heap-backed coordinates · New

2 resolved since last review

• Reinvoke pending make-pub callbacks for the accepted backend
• Free existing coordinate buffers before public-key derivation

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfssl-src, wolfssl-bugs
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 0 of 1 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_asn.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

EC key handling can expose stale public coordinates after synchronization failures, while PKCS#8 assignment still bypasses public-point derivation and can reject private-only keys.

2 open issues

• Restore private-only state when external key synchronization fails · New
• Derive and synchronize EC public keys before encoding branch · New

1 resolved since last review

• Repeated derivation leaks heap-backed coordinates

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs
Unchanged since last review (not re-run): wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The RNG documentation needs qualification because SP-accelerated base-point calls do not receive the RNG, so passing it does not guarantee multiplication blinding on every backend.

1 open issue

• Clarify RNG blinding limitations for SP-accelerated ECC · New

2 resolved since last review

• Derive and synchronize EC public keys before encoding branch
• Restore private-only state when external key synchronization fails

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11420

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/asn_public.h, tests/api/api.h, tests/api/test_asn.h, tests/api/test_pkcs7.h, tests/api/test_ssl_pk.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.