From c81c794fd9b0f09c16f9fcf4004f94db3de7dec2 Mon Sep 17 00:00:00 2001 From: Marco Oliverio Date: Mon, 21 Sep 2026 11:58:04 +0000 Subject: [PATCH 1/2] test: gate make-pub test on !NO_ECC_MAKE_PUB instead of !WOLF_CRYPTO_CB_ONLY_ECC The CB-only predicate conflated 'no local SW ECC math' with 'make-pub unavailable'. --- test-refactor/client-server/wh_test_crypto_ecc.c | 11 +++++++++-- test/wh_test_crypto.c | 11 +++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/test-refactor/client-server/wh_test_crypto_ecc.c b/test-refactor/client-server/wh_test_crypto_ecc.c index 7d3eeccbe..452112327 100644 --- a/test-refactor/client-server/wh_test_crypto_ecc.c +++ b/test-refactor/client-server/wh_test_crypto_ecc.c @@ -683,7 +683,7 @@ static int _whTest_CryptoEccMakeCacheKeyArgs(whClientContext* ctx) return ret; } -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if !defined(NO_ECC_MAKE_PUB) || !defined(WOLF_CRYPTO_CB_ONLY_ECC) /* Build a private-key-only ECC key bound to devId, along with a locally * generated reference keypair holding the public point it must derive to. */ @@ -731,6 +731,9 @@ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) return 0; } +#endif /* !NO_ECC_MAKE_PUB || !WOLF_CRYPTO_CB_ONLY_ECC */ + +#if !defined(NO_ECC_MAKE_PUB) /* Exercise WC_PK_TYPE_EC_MAKE_PUB, both for a key the client holds and for one * resident on the server. Also covers exporting the public half of a resident * private-only key, which requires the server to derive it. */ @@ -1030,7 +1033,9 @@ static int _whTest_CryptoEccMakePub(whClientContext* ctx) } return ret; } +#endif /* !NO_ECC_MAKE_PUB */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) #ifdef HAVE_ECC_CHECK_KEY /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and * a keypair whose public point does not belong to its private scalar. */ @@ -2420,8 +2425,10 @@ int whTest_Crypto_Ecc(whClientContext* ctx) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccExportPublicKey(ctx)); WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCacheKeyAndExportPublic(ctx)); WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakeCacheKeyArgs(ctx)); -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if !defined(NO_ECC_MAKE_PUB) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakePub(ctx)); +#endif /* !NO_ECC_MAKE_PUB */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) #ifdef HAVE_ECC_CHECK_KEY WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCheckPubKey(ctx)); #endif /* HAVE_ECC_CHECK_KEY */ diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c index 35aca8cac..e284058aa 100644 --- a/test/wh_test_crypto.c +++ b/test/wh_test_crypto.c @@ -1912,7 +1912,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) return ret; } -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if !defined(NO_ECC_MAKE_PUB) || !defined(WOLF_CRYPTO_CB_ONLY_ECC) /* Build a private-key-only ECC key bound to devId, along with a locally * generated reference keypair holding the public point it must derive to. @@ -1962,6 +1962,9 @@ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) return 0; } +#endif /* !NO_ECC_MAKE_PUB || !WOLF_CRYPTO_CB_ONLY_ECC */ + +#if !defined(NO_ECC_MAKE_PUB) /* Exercise WC_PK_TYPE_EC_MAKE_PUB, both for a key the client holds and for one * resident on the server. Also covers exporting the public half of a resident * private-only key, which requires the server to derive it. */ @@ -2251,7 +2254,9 @@ static int whTest_CryptoEccMakePub(whClientContext* ctx, int devId, WC_RNG* rng) } return ret; } +#endif /* !NO_ECC_MAKE_PUB */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) #ifdef HAVE_ECC_CHECK_KEY /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and * a keypair whose public point does not belong to its private scalar. */ @@ -18897,10 +18902,12 @@ int whTest_CryptoClientConfig(whClientConfig* config) if (ret == 0) { ret = whTest_CryptoEccCacheDuplicate(client); } -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if !defined(NO_ECC_MAKE_PUB) if (ret == 0) { ret = whTest_CryptoEccMakePub(client, WH_CLIENT_DEVID(client), rng); } +#endif /* !NO_ECC_MAKE_PUB */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) #ifdef HAVE_ECC_CHECK_KEY if (ret == 0) { ret = whTest_CryptoEccCheckPubKey(client, WH_CLIENT_DEVID(client), rng); From 49f35d645a7048614a703d0c48313d87069dc3a5 Mon Sep 17 00:00:00 2001 From: Marco Oliverio Date: Thu, 22 Oct 2026 13:50:32 +0000 Subject: [PATCH 2/2] test: gate check-pub test on HAVE_ECC_CHECK_KEY instead of !WOLF_CRYPTO_CB_ONLY_ECC --- .../client-server/wh_test_crypto_ecc.c | 33 +++++++------- test/wh_test_crypto.c | 45 ++++++++++--------- 2 files changed, 43 insertions(+), 35 deletions(-) diff --git a/test-refactor/client-server/wh_test_crypto_ecc.c b/test-refactor/client-server/wh_test_crypto_ecc.c index 452112327..5371799f9 100644 --- a/test-refactor/client-server/wh_test_crypto_ecc.c +++ b/test-refactor/client-server/wh_test_crypto_ecc.c @@ -683,7 +683,12 @@ static int _whTest_CryptoEccMakeCacheKeyArgs(whClientContext* ctx) return ret; } -#if !defined(NO_ECC_MAKE_PUB) || !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) || defined(WOLF_CRYPTO_CB_FIND) +#define WH_TEST_ECC_LOCAL_KEYGEN +#endif + +#if defined(WH_TEST_ECC_LOCAL_KEYGEN) && \ + (!defined(NO_ECC_MAKE_PUB) || defined(HAVE_ECC_CHECK_KEY)) /* Build a private-key-only ECC key bound to devId, along with a locally * generated reference keypair holding the public point it must derive to. */ @@ -721,6 +726,10 @@ static int whTest_MakePrivOnlyEccKey(int devId, WC_RNG* rng, ecc_key* refKey, return ret; } +#endif /* WH_TEST_ECC_LOCAL_KEYGEN && \ + (!NO_ECC_MAKE_PUB || HAVE_ECC_CHECK_KEY) */ + +#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN) /* Compare an ecc_point against the public point of key */ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) { @@ -731,9 +740,6 @@ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) return 0; } -#endif /* !NO_ECC_MAKE_PUB || !WOLF_CRYPTO_CB_ONLY_ECC */ - -#if !defined(NO_ECC_MAKE_PUB) /* Exercise WC_PK_TYPE_EC_MAKE_PUB, both for a key the client holds and for one * resident on the server. Also covers exporting the public half of a resident * private-only key, which requires the server to derive it. */ @@ -1033,10 +1039,9 @@ static int _whTest_CryptoEccMakePub(whClientContext* ctx) } return ret; } -#endif /* !NO_ECC_MAKE_PUB */ +#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */ -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) -#ifdef HAVE_ECC_CHECK_KEY +#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN) /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and * a keypair whose public point does not belong to its private scalar. */ static int _whTest_CryptoEccCheckPubKey(whClientContext* ctx) @@ -1224,9 +1229,7 @@ static int _whTest_CryptoEccCheckPubKey(whClientContext* ctx) } return ret; } -#endif /* HAVE_ECC_CHECK_KEY */ - -#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */ +#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */ #if !defined(WOLF_CRYPTO_CB_ONLY_ECC) @@ -2425,13 +2428,13 @@ int whTest_Crypto_Ecc(whClientContext* ctx) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccExportPublicKey(ctx)); WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCacheKeyAndExportPublic(ctx)); WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakeCacheKeyArgs(ctx)); -#if !defined(NO_ECC_MAKE_PUB) +#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakePub(ctx)); -#endif /* !NO_ECC_MAKE_PUB */ -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) -#ifdef HAVE_ECC_CHECK_KEY +#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */ +#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCheckPubKey(ctx)); -#endif /* HAVE_ECC_CHECK_KEY */ +#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCrossVerify(ctx)); WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccAsync(ctx)); #endif /* !WOLF_CRYPTO_CB_ONLY_ECC */ diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c index e284058aa..30f0d535a 100644 --- a/test/wh_test_crypto.c +++ b/test/wh_test_crypto.c @@ -1912,7 +1912,16 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) return ret; } -#if !defined(NO_ECC_MAKE_PUB) || !defined(WOLF_CRYPTO_CB_ONLY_ECC) +/* The make-pub and check-pub tests build their reference keys with software + * keygen on INVALID_DEVID keys. A callback-only client can only do that when + * a find callback routes the key to a device. */ +#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) || defined(WOLF_CRYPTO_CB_FIND) +#define WH_TEST_ECC_LOCAL_KEYGEN +#endif + +#if defined(WH_TEST_ECC_LOCAL_KEYGEN) && \ + (!defined(NO_ECC_MAKE_PUB) || defined(HAVE_ECC_CHECK_KEY) || \ + defined(WOLFHSM_CFG_DMA)) /* Build a private-key-only ECC key bound to devId, along with a locally * generated reference keypair holding the public point it must derive to. @@ -1952,6 +1961,10 @@ static int whTest_MakePrivOnlyEccKey(int devId, WC_RNG* rng, ecc_key* refKey, return ret; } +#endif /* WH_TEST_ECC_LOCAL_KEYGEN && \ + (!NO_ECC_MAKE_PUB || HAVE_ECC_CHECK_KEY || WOLFHSM_CFG_DMA) */ + +#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN) /* Compare an ecc_point against the public point of key */ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) { @@ -1962,9 +1975,6 @@ static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key) return 0; } -#endif /* !NO_ECC_MAKE_PUB || !WOLF_CRYPTO_CB_ONLY_ECC */ - -#if !defined(NO_ECC_MAKE_PUB) /* Exercise WC_PK_TYPE_EC_MAKE_PUB, both for a key the client holds and for one * resident on the server. Also covers exporting the public half of a resident * private-only key, which requires the server to derive it. */ @@ -2254,10 +2264,9 @@ static int whTest_CryptoEccMakePub(whClientContext* ctx, int devId, WC_RNG* rng) } return ret; } -#endif /* !NO_ECC_MAKE_PUB */ +#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */ -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) -#ifdef HAVE_ECC_CHECK_KEY +#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN) /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and * a keypair whose public point does not belong to its private scalar. */ static int whTest_CryptoEccCheckPubKey(whClientContext* ctx, int devId, @@ -2436,9 +2445,7 @@ static int whTest_CryptoEccCheckPubKey(whClientContext* ctx, int devId, } return ret; } -#endif /* HAVE_ECC_CHECK_KEY */ - -#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */ +#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */ #ifdef WOLFHSM_CFG_DMA /* Generic-transport DMA smoke test: cache an ECC keypair, export the @@ -2529,11 +2536,11 @@ static int whTest_CryptoEccExportPublicDma(whClientContext* ctx, int devId, wc_ecc_free(pubKey); } -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) +#if defined(WH_TEST_ECC_LOCAL_KEYGEN) /* A resident PRIVATE-only key carries no public half, so the DMA public * export must derive it on the server first. Mirrors the non-DMA - * private-only export covered by whTest_CryptoEccMakePub. Skipped in - * CB_ONLY builds along with the software reference-key helper. */ + * private-only export covered by whTest_CryptoEccMakePub. Skipped when + * the client cannot run the software reference-key helper. */ if (ret == 0) { ecc_key refKey[1]; ecc_key privOnlyKey[1]; @@ -2586,7 +2593,7 @@ static int whTest_CryptoEccExportPublicDma(whClientContext* ctx, int devId, #else /* devId is only consumed by the private-only sub-test above */ (void)devId; -#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */ +#endif /* WH_TEST_ECC_LOCAL_KEYGEN */ if (!WH_KEYID_ISERASED(keyId)) { (void)wh_Client_KeyEvict(ctx, keyId); @@ -18902,18 +18909,16 @@ int whTest_CryptoClientConfig(whClientConfig* config) if (ret == 0) { ret = whTest_CryptoEccCacheDuplicate(client); } -#if !defined(NO_ECC_MAKE_PUB) +#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN) if (ret == 0) { ret = whTest_CryptoEccMakePub(client, WH_CLIENT_DEVID(client), rng); } -#endif /* !NO_ECC_MAKE_PUB */ -#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) -#ifdef HAVE_ECC_CHECK_KEY +#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */ +#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN) if (ret == 0) { ret = whTest_CryptoEccCheckPubKey(client, WH_CLIENT_DEVID(client), rng); } -#endif /* HAVE_ECC_CHECK_KEY */ -#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */ +#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */ #if defined(HAVE_ECC_SIGN) && defined(HAVE_ECC_VERIFY) && \ !defined(WOLF_CRYPTO_CB_ONLY_ECC) if (ret == 0) {