[SparkiDev]

Description

Use constant time Montgomery reduction and compares in ECC point operations, ECDH shared secret output and ECDSA signing mod n. Constant time, fixed length TFM modular exponentiation including base 2.

Fixes zd#22789, zd#22790, zd#22798

Testing

./configure --eable-sp-math-all
./configure --enable-fastmath

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +120 B (+0.2%, 71,287 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +136 B (+0.1%, 132,349 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +1,536 B (+0.7%, 211,084 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +128 B (+0.2%, 74,103 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +448 B (+0.2%, 183,251 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +896 B (+0.5%, 197,912 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +1,024 B (+0.1%, 803,716 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +896 B (+0.4%, 224,788 B / 262,144 B, total: 86% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +896 B (+0.3%, 314,832 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 344,400 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +128 B (+0.2%, 68,569 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +128 B (+0.1%, 133,137 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +896 B (+0.4%, 251,554 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

• FLASH: .text +1,536 B (+0.7%, 211,084 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +896 B (+0.3%, 315,664 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +896 B (+0.4%, 251,554 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

• FLASH: .text +512 B (+0.2%, 205,932 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +36 B, text +11,680 B (+4.2%, 294,188 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Critical secret-dependent timing and memory-access leaks remain in ECC reductions, signing, and shared-secret export, while exponentiation now rejects supported boundary-size moduli.

4 open issues

• Fixed-length exporters still use secret-dependent memory access · New
• Signing multiplications have secret-dependent timing · New
• Constant-time reduction still uses early-exit clamping · New
• Padded multiplication rejects moduli at the accepted size limit · New

What changed in this PR

This PR strengthens timing resistance in wolfCrypt’s ECC operations and its TFM and SP arithmetic backends.

Changes:

• Routes ECC point arithmetic, mapping, and signing through constant-time helpers, and uses fixed-length ECDH output encoding.
• Adds fixed-width TFM modular exponentiation, including base-2 and nonblocking paths.
• Revises SP Montgomery reduction with masked subtraction and constant-time result-length calculation.

File	Description
wolfssl/​wolfcrypt/​tfm.h	Declares constant-time comparison functions for TFM.
wolfcrypt/​src/​tfm.c	Adds fixed-width exponentiation and constant-time reduction and comparison helpers.
wolfcrypt/​src/​sp_int.c	Updates constant-time Montgomery reduction and inversion paths.
wolfcrypt/​src/​ecc.c	Integrates timing-resistant arithmetic into ECC operations and shared-secret encoding.

_{Review effort: Balanced}

[SparkiDev]

@claude review

[Copilot]

🟡 Changes recommended

Four critical findings remain: an uninitialized multiplication temporary and capacity violations in multiplication, reduction, and padded export can produce invalid results or access memory out of bounds.

4 open issues

• Reduce the product in scratch space, not the output · New
• Initialize the third temporary before multiplication · New
• Respect the nonce output's capacity when clearing · New
• Bound export reads by the integer's capacity · New

4 resolved since last review

• Constant-time reduction still uses early-exit clamping
• Signing multiplications have secret-dependent timing
• Fixed-length exporters still use secret-dependent memory access
• Padded multiplication rejects moduli at the accepted size limit

_{Review effort: Balanced}

[SparkiDev]

@claude review

[Copilot]

🟡 Changes recommended

Unresolved critical defects can cause out-of-bounds memory access, silently incorrect exponentiation results after allocation failures, and secret-dependent timing in elliptic-curve operations.

4 open issues

• Use fixed-width multiplication for the custom-curve constant-time path · New
• Sign-extend zero digits before converting to sp_size_t · New
• Prevent MULX from writing past the temporary for unaligned lengths · New
• Propagate multiplication failures before advancing to reduction · New

4 resolved since last review

• Bound export reads by the integer's capacity
• Respect the nonce output's capacity when clearing
• Initialize the third temporary before multiplication
• Reduce the product in scratch space, not the output

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The newly accepted FP_SIZE / 2-digit modulus boundary lacks regression tests asserting successful returns and known results for both base 2 and a general base, including under ALT_ECC_SIZE and MULX configurations.

1 open issue

• Add asserted exponentiation tests at the modulus size boundary · New

4 resolved since last review

• Propagate multiplication failures before advancing to reduction
• Prevent MULX from writing past the temporary for unaligned lengths
• Sign-extend zero digits before converting to sp_size_t
• Use fixed-width multiplication for the custom-curve constant-time path

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical issues remain: some ECC configurations permit out-of-bounds coordinate accesses, while others use secret-dependent, variable-time multiplication despite ECC timing resistance being enabled.

2 open issues

• Bound ECC scratch digit access by the coordinate capacity · New
• Honor ECC timing resistance in the fast-math reduction path · New

1 resolved since last review

• Add asserted exponentiation tests at the modulus size boundary

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Changes to core cryptographic arithmetic across multiple backends and configurations require specialist review and target-specific correctness and timing validation before approval.

No open issues 🎉

2 resolved since last review

• Honor ECC timing resistance in the fast-math reduction path
• Bound ECC scratch digit access by the coordinate capacity

_{Review effort: Balanced}