[SparkiDev]

Description

misc.c: add ctHide32(), a value barrier that hides a value from the optimizer so mask formulas cannot be turned back into branches.
ML-KEM (mlkem_cmp_c) and FrodoKEM decapsulation: use ctHide32() on the ciphertext-comparison result so implicit rejection does not branch on ciphertext validity.
wc_RNG_TestSeed(): rewrite the RCT/APT loops branch-free. Barriers are enabled via WC_RNG_SEED_CT_BARRIER, defined by default on affected targets; other targets use plain comparisons. Also shorten the majority-vote dependency chain.

Fixes zd#22785, zd#22784, zd#22772

Testing

Checking of assembly output for different platforms.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text -12 B (-0.0%, 71,059 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text -12 B (-0.0%, 132,009 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text -64 B (-0.1%, 68,313 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text -64 B (-0.1%, 68,313 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text -64 B (-0.0%, 132,753 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m7-pq

• FLASH: .text -64 B (-0.0%, 313,936 B / 1,048,576 B, total: 30% used)

stm32-sim-stm32h753

• FLASH: .text -512 B (-0.3%, 203,564 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +20 B, text +10,016 B (+3.6%, 292,508 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

With WC_RNG_SEED_CT_BARRIER enabled, the accepted cutoff 0xffffffffU causes the constant-time comparison to incorrectly reject non-repeating seeds with ENTROPY_RT_E.

1 open issue

• Reject or correctly compare out-of-range RNG seed cutoffs · New

What changed in this PR

This PR hardens wolfCrypt’s constant-time code against compiler-introduced branches in KEM decapsulation and RNG seed health tests.

Changes:

• Adds the ctHide32() optimizer value barrier.
• Applies barriers to ML-KEM and FrodoKEM ciphertext-validity masks.
• Reworks RNG health-test loops with target-dependent barriers and a shorter majority-vote dependency chain.

File	Description
wolfssl/​wolfcrypt/​misc.h	Declares ctHide32().
wolfcrypt/​src/​wc_mlkem_poly.c	Protects the ciphertext-comparison mask with barriers.
wolfcrypt/​src/​wc_frodokem.c	Protects implicit-rejection mask generation with barriers.
wolfcrypt/​src/​random.c	Adds conditional barriers and rewrites seed health-test arithmetic.
wolfcrypt/​src/​misc.c	Implements the value barrier with assembly and volatile fallbacks.

_{Review effort: Balanced}

[SparkiDev]

@claude review

[claude]

I reviewed this PR and didn't find any bugs. It changes constant-time code in the RNG seed health tests and in ML-KEM/FrodoKEM implicit rejection, so a human crypto reviewer should still look at it.

What was reviewed:

• ctHide32 in misc.c/misc.h: the inline-asm guard, the volatile fallback, and that the NO_INLINE prototype matches.
• The wc_RNG_TestSeed rewrite. The RCT mask select still gives the same result now that prevByte is always updated. votes + (same<<1) - 1 matches the old vote update, including when take is set. The borrow formula in RngSeedCtGTE is correct across the full word32 range.
• The isEq/mlkem_cmp_c barrier wrapping. The inputs stay below 2^31, so the >> 31 formulas are still exact.
• Not done: no check of the generated assembly on Thumb-1, RISC-V, MSP430 or AVR. Whether the compiler still emits branches can only be confirmed by compiling for those targets.

Extended reasoning...

The change touches wolfCrypt constant-time code: misc.c/misc.h, the seed health tests in random.c, and the ML-KEM and FrodoKEM decapsulation comparisons. This is security-sensitive crypto code where the side-channel properties matter. The diff is small (about 127 lines) and reading it found no logic errors. Whether it works depends on the code the compiler generates for specific embedded targets, which reading the source cannot confirm. Because it is crypto hardening code, a human review is warranted rather than an automated approval.

[Copilot]

🟡 Changes recommended

The RNG health-test changes truncate accepted repetition-count cutoffs and mishandle large APT vote counts, causing false seed rejections or missed APT failures.

2 open issues

• Use a full-range APT zero test with barriers enabled · New
• Prevent cutoff overflow when narrowing to 32 bits · New

1 resolved since last review

• Reject or correctly compare out-of-range RNG seed cutoffs

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Constant-time guarantees require cryptography-maintainer validation of generated assembly across supported targets and compiler configurations, including volatile fallback and barrier-disabled paths, but those artifacts are unavailable.

No open issues 🎉

2 resolved since last review

• Prevent cutoff overflow when narrowing to 32 bits
• Use a full-range APT zero test with barriers enabled

_{Review effort: Balanced}