[SparkiDev]

Description

Use constant time Montgomery reduction and compares in ECC point operations, ECDH shared secret output and ECDSA signing mod n. Constant time, fixed length TFM modular exponentiation including base 2.

Fixes zd#22789, zd#22790, zd#22798

Testing

./configure --eable-sp-math-all
./configure --enable-fastmath

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +120 B (+0.2%, 71,287 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +136 B (+0.1%, 132,349 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +1,920 B (+0.9%, 211,468 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +128 B (+0.2%, 74,103 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +704 B (+0.4%, 183,507 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +1,408 B (+0.7%, 198,424 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +1,472 B (+0.2%, 804,164 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +1,408 B (+0.6%, 225,300 B / 262,144 B, total: 86% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +1,408 B (+0.4%, 315,344 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 344,400 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +128 B (+0.1%, 133,137 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +1,408 B (+0.6%, 252,066 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

• FLASH: .text +1,984 B (+0.9%, 211,532 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +1,408 B (+0.4%, 316,176 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +1,408 B (+0.6%, 252,066 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

• FLASH: .text +512 B (+0.2%, 205,932 B / 2,097,152 B, total: 10% used)

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Critical secret-dependent timing and memory-access leaks remain in ECC reductions, signing, and shared-secret export, while exponentiation now rejects supported boundary-size moduli.

4 open issues

• Fixed-length exporters still use secret-dependent memory access · New
• Signing multiplications have secret-dependent timing · New
• Constant-time reduction still uses early-exit clamping · New
• Padded multiplication rejects moduli at the accepted size limit · New

What changed in this PR

This PR strengthens timing resistance in wolfCrypt’s ECC operations and its TFM and SP arithmetic backends.

Changes:

• Routes ECC point arithmetic, mapping, and signing through constant-time helpers, and uses fixed-length ECDH output encoding.
• Adds fixed-width TFM modular exponentiation, including base-2 and nonblocking paths.
• Revises SP Montgomery reduction with masked subtraction and constant-time result-length calculation.

File	Description
wolfssl/​wolfcrypt/​tfm.h	Declares constant-time comparison functions for TFM.
wolfcrypt/​src/​tfm.c	Adds fixed-width exponentiation and constant-time reduction and comparison helpers.
wolfcrypt/​src/​sp_int.c	Updates constant-time Montgomery reduction and inversion paths.
wolfcrypt/​src/​ecc.c	Integrates timing-resistant arithmetic into ECC operations and shared-secret encoding.

_{Review effort: Balanced}

[SparkiDev]

@claude review

[Copilot]

🟡 Changes recommended

Four critical findings remain: an uninitialized multiplication temporary and capacity violations in multiplication, reduction, and padded export can produce invalid results or access memory out of bounds.

4 open issues

• Reduce the product in scratch space, not the output · New
• Initialize the third temporary before multiplication · New
• Respect the nonce output's capacity when clearing · New
• Bound export reads by the integer's capacity · New

4 resolved since last review

• Constant-time reduction still uses early-exit clamping
• Signing multiplications have secret-dependent timing
• Fixed-length exporters still use secret-dependent memory access
• Padded multiplication rejects moduli at the accepted size limit

_{Review effort: Balanced}

[SparkiDev]

@claude review