[SparkiDev]

Description

Added WC_MODEXP_TIMING_RESISTANT to perform constant time operations at a finer level.
Improved code to mitigate some of the performance loss.

Fixes zd#22770

Testing

./configure
./configure --enable-sp-math-all=huge
./configure --enable-sp-math-all=huge CFLAGS=-DWC_MODEXP_TIMING_RESISTANT

[SparkiDev]

https://github.com/wolfSSL/scripts/pull/711

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text -28 B (-0.0%, 71,043 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text -16 B (-0.0%, 132,005 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +512 B (+0.3%, 182,547 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +512 B (+0.3%, 196,760 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text -64 B (-0.1%, 68,313 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +512 B (+0.1%, 802,404 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +448 B (+0.2%, 223,572 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +512 B (+0.2%, 313,616 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +320 B (+0.1%, 344,080 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text -64 B (-0.1%, 68,313 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text -64 B (-0.0%, 132,753 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +448 B (+0.2%, 250,338 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +448 B (+0.1%, 314,448 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +448 B (+0.2%, 250,338 B / 262,144 B, total: 95% used)

stm32-sim-stm32h753

• FLASH: .text +448 B (+0.2%, 204,524 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +20 B, text +10,000 B (+3.6%, 292,492 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m7

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Integer-promotion errors can corrupt results with 8- or 16-bit digits, while assembly-enabled huge builds retain secret-dependent timing despite timing-resistant hardening.

2 open issues

• Cast promoted digit subtraction before computing the nonzero mask · New
• Use constant-time backends for hardened Karatsuba multiplication and squaring · New

What changed in this PR

This PR adds optional finer-grained timing hardening to wolfCrypt’s SP integer modular exponentiation while refactoring arithmetic helpers to reduce overhead.

Changes:

• Introduces WC_MODEXP_TIMING_RESISTANT for fixed-length working values and constant-time Montgomery reduction.
• Adds a hardened base-2 exponentiation path and separates unclamped multiplication and squaring from public wrappers.
• Revises constant-time clamping and Montgomery subtraction.

File	Description
wolfcrypt/​src/​sp_int.c	Implements exponentiation hardening and refactors supporting arithmetic.
.wolfssl_known_macro_extras	Registers the new timing-resistance macro.

_{Review effort: Balanced}

[SparkiDev]

Jenkins: retest this please

[Copilot]

🟡 Changes recommended

The hardened exponentiation path bypasses sign bookkeeping with WOLFSSL_SP_INT_NEGATIVE, causing negative bases to produce incorrect results such as -9 instead of 9 when squared.

1 open issue

• Hardened exponentiation preserves incorrect negative result sign · New

2 resolved since last review

• Use constant-time backends for hardened Karatsuba multiplication and squaring
• Cast promoted digit subtraction before computing the nonzero mask

_{Review effort: Balanced}