[stenslae]

Description

In RSA public-only and verify-only builds (WOLFSSL_RSA_PUBLIC_ONLY/WOLFSSL_RSA_VERIFY_ONLY), constant-time exponentiation (_sp_exptmod_ex) is disabled to reduce code size. Montgomery modular exponentiation in sp_exptmod_nct only supports odd moduli, leaving no handler for even moduli in these configurations.

• Implemented _sp_exptmod_nct_generic() in sp_int.c.
• Routed mp_iseven(m) cases in sp_exptmod_nct to this fallback when _sp_exptmod_ex is omitted.

Testing

• Extended mp_test_exptmod() in test.c to test even moduli against both mp_exptmod_ex() and mp_exptmod_nct().
• Added cryptonly-rsapub-no-dh-public-mp test configuration to os-check-linux.json to ensure automated CI coverage for this configuration.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[stenslae]

@claude review

[Copilot]

🔵 Needs a closer look

Cryptographic arithmetic across feature-gated build variants needs final human validation despite no identified blocking findings.

No open issues 🎉

What changed in this PR

Adds even-modulus exponentiation support for RSA public-only and verify-only builds where the constant-time implementation is omitted.

Changes:

• Adds a non-constant-time fallback for even moduli.
• Extends regression tests with varied bases, exponents, and even moduli.
• Adds CI coverage for RSA public-only builds with public multiprecision APIs enabled.

File	Description
wolfcrypt/​test/​test.c	Tests even-modulus exponentiation through both APIs.
wolfcrypt/​src/​sp_int.c	Implements and routes calls to the even-modulus fallback.
.github/​configs/​os-check-linux.json	Adds a targeted RSA public-only CI configuration.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11849

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[SparkiDev]

Why are we handling even modulus values???
RSA/DH/ECC are not allowed to have even modulus values.

[stenslae]

Why are we handling even modulus values??? RSA/DH/ECC are not allowed to have even modulus values.

@SparkiDev
This isn't for RSA, which already rejects an even n. It's for the generic mp_exptmod API, which already supports even moduli, and mp_test tests that on master. With --enable-rsapub --disable-dh, the even-modulus branch is compiled out, so an even m goes through Montgomery and returns a wrong result with MP_OKAY.

If you'd rather not support even moduli there, I can return MP_VAL instead and skip that test for this build. Which do you prefer?

[stenslae]

@claude review

[Copilot]

🟡 Changes recommended

The branch rejects even moduli with MP_VAL instead of providing the promised fallback, so either the fallback must be implemented or the PR description corrected.

1 open issue

• Even-modulus exponentiation remains unsupported without the fast path · New

_{Review effort: Balanced}

[claude]

I reviewed the reworked version of this PR and didn't find any bugs. It changes the result of sp_exptmod_nct for even moduli in RSA public-only and verify-only builds, so a maintainer should still sign off on the new MP_VAL behaviour.

What was reviewed:

• The new even-modulus guard in sp_exptmod_nct matches the guard around both _sp_exptmod_ex definitions (line 13155), so the call can't reach an undefined function.
• The test's MP_VAL condition is the exact complement wherever sp_exptmod_nct is compiled (WOLFSSL_SP_MATH_ALL or WOLFSSL_HAVE_SP_DH). In non-SP_MATH_ALL builds DH is on, so the generic path is taken.
• In RSA public-only builds with DH on, an even modulus now goes to the generic path instead of falling through to Montgomery. The two new CI configs cover the DH-off and DH-on cases.

Extended reasoning...

The change touches the non-constant-time modular exponentiation in wolfcrypt/src/sp_int.c, its test in wolfcrypt/test/test.c and two CI build configs. This is crypto code: any caller that passes an even modulus in RSA verify-only or public-only builds without DH now gets MP_VAL instead of a silently wrong result. The approach has changed since my earlier review (the PR description still mentions a new generic fallback that isn't in the current diff), and a maintainer commented before the latest commits. Because this is crypto behaviour with an API-visible error change, approval was not appropriate.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11849

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max