[dgarske]

Description

The RTL8735B HUK ECDSA sign path (wc_Rtl8735b_EccKey via ecc_key->devCtx) only accepted an AES-GCM-wrapped scalar, so a blob wrapped with AES-ECB under the HUK, the layout STM32 DHUK uses for wc_ecc_import_wrapped_private(), could not be signed with. It now treats a key with iv, ivSz, tag and tagSz all NULL/0 as ECB-wrapped (block-padded, scalar in the first plainLen bytes), rejects a partial IV/tag set, and leaves GCM unchanged and recommended.

The HUK device also implements the key-store interface (WOLF_CRYPTO_CB_KEYSTORE): wc_KeyStore_ImportWrapped() unwraps an AES key wrapped under the HUK (RFC 3394, or raw ECB like STM32 DHUK blobs) into a hardware key-storage slot, and an Aes made with wc_AesInit_Id() then runs GCM, ECB, CBC or CTR from that slot, so the key is in RAM only during the import.

Testing

Tested on an RTL8735B EVB with both ECC wrap formats and both AES key-store formats (AES-128 and AES-256), using the example in wolfSSL/wolfssl-examples#655. Host self-test cases cover the format checks, key references, slot bookkeeping and import checks, and the rtl8735b CI workflow gains a key-store build.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata -8 B, text +3,688 B (+1.3%, 286,152 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}