[dgarske]

Description

Hardens secret-handling in ECC, ECCSI, SAKKE and the OpenSSL compatibility BN layer against timing side channels. Takes over #11159; its commits keep their author.

• ECCSI signing and SAKKE RSK derivation blind before inverting; SAKKE pairing and exponentiation use a Fermat inverse.
• Generic scalar multiplication with map set uses the constant-time map. SP curve paths are unchanged.
• FP_ECC under ECC_TIMING_RESISTANT uses a new constant-time comb.
• wolfSSL_BN_mod_inverse() blinds its operand when an RNG is available.
• Heap-math _ct primitives no longer branch on reduced operands, and ConstantCompare() loads are volatile and used for the ATECC GCM tag check.

Behavior changes

• FP_ECC with ECC_TIMING_RESISTANT: key generation, ECDH and signing are slower than the old variable-time comb, and FP_LUT defaults to 6 rather than 8, making ecc_mul2add() slower with a smaller table. --enable-sp remains fastest for the curves it covers. Heap math, a scalar longer than the modulus and a modulus too large for the comb use the ladder.
• wc_MakeSakkeRsk() instantiates an RNG per call and can fail on RNG errors; wc_MakeSakkeRsk_ex() is added to pass one. SAKKE with WC_NO_RNG is now a build error, configure and CMake reject it, and --enable-all-crypto leaves SAKKE off with --disable-rng.
• WOLFSSL_MP_INVMOD_CONSTANT_TIME is removed and has no effect. DSA signing and RSA key generation always use their blinded or Fermat inverse, and DSA draws one more random value.
• Heap-math mp_addmod_ct(), mp_submod_ct() and mp_div_2_mod_ct() return MP_VAL for a negative operand or one wider than the modulus.
• WOLFSSL_NO_CONST_CMP is no longer defined automatically. Minimal WOLFCRYPT_ONLY builds define WC_NO_CONST_CMP_API instead, leaving out only wc_ConstantCompare().

Resolves F-7097, F-7098, F-7099, F-7426, F-7427, F-15120, F-16129. ZD 22745.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +20 B (+0.0%, 70,735 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text -56 B (-0.0%, 131,625 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text -64 B (-0.0%, 208,908 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text -64 B (-0.1%, 73,399 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text -64 B (-0.0%, 181,587 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text -64 B (-0.0%, 195,736 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +192 B (+0.0%, 800,740 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pq

• FLASH: .text -64 B (-0.0%, 312,592 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text -64 B (-0.0%, 343,440 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text -64 B (-0.0%, 132,369 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m7-pq

• FLASH: .text -64 B (-0.0%, 313,424 B / 1,048,576 B, total: 30% used)

stm32-sim-stm32h753

• FLASH: .text -64 B (-0.0%, 203,628 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,488 B (+0.5%, 283,936 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Critical timing leaks remain in ECC exceptional branches and the modular-inversion fallback, while an unconditional table assertion also fails for the timing-resistant heap-math configuration.

3 open issues

• Retry exhaustion falls back to unblinded variable-time inversion · New
• Scalar-dependent exceptional branches remain in point addition · New
• Gate the table assertion for heap-math fallback · New

What changed in this PR

This PR hardens secret-dependent arithmetic in wolfCrypt and the OpenSSL compatibility layer against timing side channels, continuing the work from #11159.

Changes:

• Adds blinded or Fermat-based inversion paths and timing-resistant ECC mapping and fixed-point multiplication.
• Reworks heap-math constant-time helpers and comparison handling.
• Adds SAKKE RNG requirements, an RNG-accepting API, and regression and fault-injection coverage.

File	Description
wolfssl/​wolfcrypt/​settings.h	Separates exported comparison API suppression from internal availability.
wolfssl/​wolfcrypt/​sakke.h	Declares the RNG-accepting RSK API.
wolfssl/​wolfcrypt/​memory.h	Updates the comparison API guard.
wolfcrypt/​src/​sp_int.c	Enables modular multiplication for SAKKE.
wolfcrypt/​src/​sakke.c	Adds inversion blinding, Fermat conversion, and RNG handling.
wolfcrypt/​src/​rsa.c	Removes the alternate unblinded key-generation inverse.
wolfcrypt/​src/​port/​atmel/​atmel.c	Uses constant-time GCM tag comparison.
wolfcrypt/​src/​misc.c	Uses volatile comparison loads.
wolfcrypt/​src/​memory.c	Updates the exported comparison implementation guard.
wolfcrypt/​src/​integer.c	Reworks constant-time modular arithmetic helpers.
wolfcrypt/​src/​eccsi.c	Blinds signing inversion and clears temporary secrets.
wolfcrypt/​src/​ecc.c	Adds timing-resistant comb multiplication and mapping.
wolfcrypt/​src/​dsa.c	Always uses the blinded signing path.
wolfcrypt/​benchmark/​benchmark.c	Reuses the benchmark RNG for RSK generation.
tests/​unit-mcdc/​test_sakke_whitebox.c	Tests rejection of a noninvertible RSK input.
tests/​unit-mcdc/​test_sakke_fault_whitebox.c	Exercises blinding retries and exhaustion.
tests/​unit-mcdc/​test_integer_whitebox.c	Updates source-line references in comments.
tests/​unit-mcdc/​test_integer_fault_whitebox.c	Tests helper allocation failures and invalid arguments.
tests/​unit-mcdc/​test_eccsi_fault_whitebox.c	Tests signing blinding retries and limits.
tests/​unit-mcdc/​test_ecc_whitebox.c	Compares cached comb results with the ladder.
tests/​unit-mcdc/​test_ecc_fault_whitebox.c	Adapts calls to the new multiplier signature.
tests/​api/​test_wolfmath.h	Registers heap-math regression tests.
tests/​api/​test_wolfmath.c	Tests arithmetic results, aliasing, and input validation.
tests/​api/​test_sakke.c	Tests the RNG-accepting RSK API.
tests/​api/​test_ossl_bn.c	Tests composite-modulus inversion and aliasing.
tests/​api/​test_ecc.h	Registers ECC regression tests.
tests/​api/​test_ecc.c	Adds boundary-scalar and cache-consistency tests.
src/​ssl_bn.c	Adds best-effort inversion blinding and random-buffer clearing.
src/​pk_ec.c	Documents the variable-time Shamir path.
doc/​dox_comments/​header_files/​sakke.h	Adds the new SAKKE API to documentation.
doc/​dox_comments/​header_files/​doxygen_groups.h	Updates RSK documentation references.
doc/​dox_comments/​header_files-ja/​sakke.h	Adds the API to Japanese documentation.
doc/​dox_comments/​header_files-ja/​doxygen_groups.h	Updates Japanese RSK documentation references.
configure.ac	Enforces SAKKE RNG requirements and bundle selection.
CMakeLists.txt	Rejects SAKKE without RNG support.
.wolfssl_known_macro_extras	Updates recognized comparison and inversion macros.
.github/​configs/​os-check-linux.json	Adds fixed-point ECC and SP-math SAKKE configurations.

_{Review effort: Balanced}

[dgarske]

Jenkins retest this please. Size-config test RROR: Error cloning remote repo 'origin