ECC, TFM: constant time point arithmetic, signing and modexp by SparkiDev · Pull Request #12109 · wolfSSL/wolfssl

SparkiDev · 2026-11-12T05:57:36Z

Description

Use constant time Montgomery reduction and compares in ECC point operations, ECDH shared secret output and ECDSA signing mod n. Constant time, fixed length TFM modular exponentiation including base 2.

Fixes zd#22789, zd#22790, zd#22798

Testing

./configure --eable-sp-math-all
./configure --enable-fastmath

github-actions · 2026-11-12T06:01:52Z

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

FLASH: .text +120 B (+0.2%, 71,287 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

FLASH: .text +136 B (+0.1%, 132,349 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

FLASH: .text +1,920 B (+0.9%, 211,468 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-baremetal

FLASH: .text +128 B (+0.2%, 74,103 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

FLASH: .text +704 B (+0.4%, 183,507 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

FLASH: .text +1,408 B (+0.7%, 198,424 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .text +1,472 B (+0.2%, 804,164 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

FLASH: .text +1,408 B (+0.6%, 225,300 B / 262,144 B, total: 86% used)

gcc-arm-cortex-m4-pq

FLASH: .text +1,408 B (+0.4%, 315,344 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

FLASH: .text +64 B (+0.0%, 344,400 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

FLASH: .text +128 B (+0.1%, 133,137 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

FLASH: .text +1,408 B (+0.6%, 252,066 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

FLASH: .text +1,984 B (+0.9%, 211,532 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m7-pq

FLASH: .text +1,408 B (+0.4%, 316,176 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

FLASH: .text +1,408 B (+0.6%, 252,066 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

FLASH: .text +512 B (+0.2%, 205,932 B / 2,097,152 B, total: 10% used)

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

Copilot

🟡 Changes recommended

Critical secret-dependent timing and memory-access leaks remain in ECC reductions, signing, and shared-secret export, while exponentiation now rejects supported boundary-size moduli.

4 open issues

What changed in this PR

This PR strengthens timing resistance in wolfCrypt’s ECC operations and its TFM and SP arithmetic backends.

Changes:

Routes ECC point arithmetic, mapping, and signing through constant-time helpers, and uses fixed-length ECDH output encoding.
Adds fixed-width TFM modular exponentiation, including base-2 and nonblocking paths.
Revises SP Montgomery reduction with masked subtraction and constant-time result-length calculation.

File	Description
`wolfssl/wolfcrypt/tfm.h`	Declares constant-time comparison functions for TFM.
`wolfcrypt/src/tfm.c`	Adds fixed-width exponentiation and constant-time reduction and comparison helpers.
`wolfcrypt/src/sp_int.c`	Updates constant-time Montgomery reduction and inversion paths.
`wolfcrypt/src/ecc.c`	Integrates timing-resistant arithmetic into ECC operations and shared-secret encoding.

_{Review effort: Balanced}

SparkiDev · 2026-11-12T06:43:09Z

@claude review

Copilot

🟡 Changes recommended

Four critical findings remain: an uninitialized multiplication temporary and capacity violations in multiplication, reduction, and padded export can produce invalid results or access memory out of bounds.

4 open issues

4 resolved since last review

_{Review effort: Balanced}

SparkiDev · 2026-11-12T07:14:27Z

@claude review

Copilot

🟡 Changes recommended

Unresolved critical defects can cause out-of-bounds memory access, silently incorrect exponentiation results after allocation failures, and secret-dependent timing in elliptic-curve operations.

4 open issues

4 resolved since last review

_{Review effort: Balanced}

Use constant time Montgomery reduction and compares in ECC point operations, ECDH shared secret output and ECDSA signing mod n. Constant time, fixed length TFM modular exponentiation including base 2.

SparkiDev self-assigned this Nov 12, 2026

Copilot AI balanced review requested due to automatic review settings November 12, 2026 05:57

Copilot started reviewing on behalf of SparkiDev November 12, 2026 05:58

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/ecc.c Resolved

Comment thread wolfcrypt/src/ecc.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

SparkiDev force-pushed the ecc_sp_int_ct_fix branch from 58072bc to 23d0e51 Compare November 12, 2026 06:42

SparkiDev requested a balanced review from Copilot November 12, 2026 06:43

Copilot started reviewing on behalf of SparkiDev November 12, 2026 06:43

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/sp_int.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

claude Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

SparkiDev force-pushed the ecc_sp_int_ct_fix branch from 23d0e51 to d7e25ec Compare November 12, 2026 07:13

SparkiDev requested a balanced review from Copilot November 12, 2026 07:14

Copilot started reviewing on behalf of SparkiDev November 12, 2026 07:14

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/ecc.c Resolved

Comment thread wolfcrypt/src/sp_int.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

Comment thread wolfcrypt/src/tfm.c Resolved

claude Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/sp_int.c Resolved

ECC, TFM: constant time point arithmetic, signing and modexp

da600b8

Use constant time Montgomery reduction and compares in ECC point operations, ECDH shared secret output and ECDSA signing mod n. Constant time, fixed length TFM modular exponentiation including base 2.

SparkiDev force-pushed the ecc_sp_int_ct_fix branch from d7e25ec to da600b8 Compare November 12, 2026 07:40

SparkiDev requested a balanced review from Copilot November 12, 2026 07:41

Copilot started reviewing on behalf of SparkiDev November 12, 2026 07:41

View session

Conversation

SparkiDev commented Nov 12, 2026

Description

Testing

Uh oh!

github-actions Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SparkiDev commented Nov 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SparkiDev commented Nov 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Nov 12, 2026 •

edited

Loading