Derive ECC public key on private-only SEC1 decode

Author: Emma Stensland

.wolfssl_known_macro_extras

@@ -953,6 +953,7 @@ WOLFSSL_NO_DH186
 WOLFSSL_NO_DILITHIUM_LEGACY_GATES
 WOLFSSL_NO_DILITHIUM_LEGACY_NAMES
 WOLFSSL_NO_DTLS_SIZE_CHECK
+WOLFSSL_NO_ECC_DERIVE_PUB_ON_DECODE
 WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
 WOLFSSL_NO_ETM_ALERT
 WOLFSSL_NO_FENCE

doc/dox_comments/header_files/asn_public.h

@@ -2267,6 +2267,18 @@ int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
     input, parses the private key, and uses it to generate an ecc_key object,
     which it stores in key.
 
+    When the encoding carries only the private scalar, the public point is
+    derived on a best-effort basis; a failed derivation is logged but does not
+    fail the decode. Observable effects of a successful derivation: key->type
+    becomes ECC_PRIVATEKEY rather than ECC_PRIVATEKEY_ONLY, key->pubkey is
+    populated, and the decode costs an additional base-point scalar multiply.
+    Under ECC_TIMING_RESISTANT that multiply is blinded with the key's rng when
+    one was set via wc_ecc_set_rng() beforehand; no rng is created for the
+    derivation, so with none set the projective-coordinate randomization is
+    simply skipped. No derivation is attempted for a key with a devId set.
+    Define WOLFSSL_NO_ECC_DERIVE_PUB_ON_DECODE to disable the derivation
+    entirely.
+
     \return 0 On successfully decoding the private key and storing the result
     in the ecc_key struct
     \return ASN_PARSE_E: Returned if there is an error parsing the der file

src/internal.c

@@ -33195,10 +33195,15 @@ static int DecodePrivateKey_ex(WOLFSSL *ssl, byte keyType, const DerBuffer* key,
 
         /* Set start of data to beginning of buffer. */
         idx = 0;
-        /* Decode the key assuming it is an ECC private key. */
-        ret = wc_EccPrivateKeyDecode(key->buffer, &idx,
+        /* Decode the key assuming it is an ECC private key. Skip the
+         * best-effort public point derivation: the private scalar alone is
+         * enough for both uses of this key - signing (CertificateVerify /
+         * ServerKeyExchange) and, when static_ecdh is negotiated, static-ECDH
+         * shared-secret computation (wc_ecc_shared_secret() accepts an
+         * ECC_PRIVATEKEY_ONLY key) - and this runs once per handshake. */
+        ret = EccPrivateKeyDecodeEx(key->buffer, &idx,
                                      (ecc_key*)*hsKey,
-                                     key->length);
+                                     key->length, 0);
     #ifdef WOLF_PRIVATE_KEY_ID
         /* if using external key then allow using a public key */
         if (ret != 0 && (ssl->devId != INVALID_DEVID

src/ocsp.c

@@ -2452,7 +2452,10 @@ int wc_OcspResponder_AddSigner(OcspResponder* responder,
         if (ret == 0) {
             word32 idx = 0;
             ca->keyType = ECDSAk;
-            ret = wc_EccPrivateKeyDecode(keyDer, &idx, &ca->key.ecc, keyDerSz);
+            /* This key only ever signs OCSP responses (OcspResponseEncode);
+             * skip the best-effort public point derivation done on decode. */
+            ret = EccPrivateKeyDecodeEx(keyDer, &idx, &ca->key.ecc, keyDerSz,
+                                         0);
         }
         if (ret != 0)
             goto out;

src/sniffer.c

@@ -2836,8 +2836,12 @@ static int SetupKeys(const byte* input, int* sslBytes, SnifferSession* session,
         #endif
             if (ret == 0) {
                 idx = 0;
-                ret = wc_EccPrivateKeyDecode(args->keyBuf->buffer, &idx,
-                    &args->key->priv.ecc, args->keyBuf->length);
+                /* Skip the best-effort public point derivation done on
+                 * decode: this key only ever feeds wc_ecc_shared_secret(),
+                 * which accepts an ECC_PRIVATEKEY_ONLY key, and this runs
+                 * once per sniffed session. */
+                ret = EccPrivateKeyDecodeEx(args->keyBuf->buffer, &idx,
+                    &args->key->priv.ecc, args->keyBuf->length, 0);
                 if (ret != 0) {
                     SetError(ECC_DECODE_STR, error, session, FATAL_ERROR_STATE);
                 }

src/ssl_api_hs.c

@@ -1571,9 +1571,11 @@ void wolfSSL_set_accept_state(WOLFSSL* ssl)
                      * the check entirely. */
                     WOLFSSL_MSG("Unable to unmask private key");
                 }
-                /* Not an EC key, so withdraw the ECC capabilities. */
-                else if (wc_EccPrivateKeyDecode(privKey->buffer, &idx, key,
-                        privKey->length) != 0) {
+                /* Not an EC key, so withdraw the ECC capabilities. Pure
+                 * type/success probe - key is freed right below, so skip the
+                 * best-effort public point derivation done on decode. */
+                else if (EccPrivateKeyDecodeEx(privKey->buffer, &idx, key,
+                        privKey->length, 0) != 0) {
                     ssl->options.haveECDSAsig = 0;
                     ssl->options.haveECC = 0;
                     ssl->options.haveStaticECC = 0;

src/ssl_api_pk.c

@@ -2291,8 +2291,19 @@ int wolfSSL_StaticEphemeralKeyLoad(WOLFSSL* ssl, int keyAlgo, void* keyPtr)
             if (der != NULL) {
                 ecc_key* key = (ecc_key*)keyPtr;
                 WOLFSSL_MSG("Using static ECDH key");
-                ret = wc_EccPrivateKeyDecode(der->buffer, &idx, key,
-                    der->length);
+                /* Keep the best-effort public point derivation: the caller
+                 * (TLSX_KeyShare_GenEccKey) exports this key's public point
+                 * with wc_ecc_export_x963(), which fails ECC_PRIVATEONLY_E on
+                 * an ECC_PRIVATEKEY_ONLY key. Attach the RNG first so that
+                 * derivation's base-point multiply gets projective-coordinate
+                 * blinding on this long-lived static scalar, mirroring the
+                 * X25519 branch below and SetupKeys() in sniffer.c. */
+            #ifdef ECC_TIMING_RESISTANT
+                ret = wc_ecc_set_rng(key, ssl->rng);
+                if (ret == 0)
+            #endif
+                    ret = wc_EccPrivateKeyDecode(der->buffer, &idx, key,
+                        der->length);
             }
             break;
     #endif
@@ -2371,7 +2382,9 @@ static int DetectStaticEphemeralKeyType(const byte* keyBuf, unsigned int keySz,
             ret = wc_ecc_init_ex(eccKey, heap, INVALID_DEVID);
         }
         if (ret == 0) {
-            ret = wc_EccPrivateKeyDecode(keyBuf, &idx, eccKey, keySz);
+            /* Pure type probe - key is freed right below, so skip the
+             * best-effort public point derivation done on decode. */
+            ret = EccPrivateKeyDecodeEx(keyBuf, &idx, eccKey, keySz, 0);
             if (ret == 0) {
                 *keyAlgo = WC_PK_TYPE_ECDH;
             }

src/ssl_load.c

@@ -568,9 +568,11 @@ static int ProcessBufferTryDecodeEcc(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
 
     /* Initialize ECC key. */
     if (wc_ecc_init_ex(key, heap, devId) == 0) {
-        /* Decode as an ECC private key. */
+        /* Decode as an ECC private key. Skip the best-effort public point
+         * derivation - this only probes for the key format and size, and the
+         * key is freed below. */
         idx = 0;
-        ret = wc_EccPrivateKeyDecode(der->buffer, &idx, key, der->length);
+        ret = EccPrivateKeyDecodeEx(der->buffer, &idx, key, der->length, 0);
     #ifdef WOLF_PRIVATE_KEY_ID
         /* If that didn't work then maybe a public key if device ID or callback.
          */

tests/api/test_asn.c

@@ -23,6 +23,7 @@
 
 #include <tests/api/api.h>
 #include <tests/api/test_asn.h>
+#include <tests/api/test_oom.h>
 
 #include <wolfssl/wolfcrypt/asn.h>
 #include <wolfssl/wolfcrypt/asn_public.h>
@@ -3051,3 +3052,207 @@ int test_wc_AsnFeatureCoverage(void)
 #endif /* !NO_ASN && HAVE_ECC && USE_CERT_BUFFERS_256 && !HAVE_FIPS */
     return EXPECT_RESULT();
 }
+
+#if defined(USE_WOLFSSL_MEMORY) && !defined(WOLFSSL_NO_MALLOC) && \
+    !defined(WOLFSSL_STATIC_MEMORY) && !defined(WOLFSSL_MEM_FAIL_COUNT) && \
+    !defined(WOLFSSL_FORCE_MALLOC_FAIL_TEST) && !defined(NO_ASN) && \
+    defined(HAVE_ECC) && !defined(NO_ECC_MAKE_PUB) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_NO_ECC_DERIVE_PUB_ON_DECODE) && \
+    defined(HAVE_ECC_KEY_EXPORT) && \
+    defined(USE_CERT_BUFFERS_256) && !defined(HAVE_FIPS) && \
+    !defined(HAVE_SELFTEST) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
+    !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
+    !defined(WOLFSSL_MICROCHIP_TA100) && !defined(WOLFSSL_CRYPTOCELL) && \
+    !defined(WOLFSSL_SILABS_SE_ACCEL) && !defined(WOLFSSL_KCAPI_ECC) && \
+    !defined(WOLFSSL_QNX_CAAM) && !defined(WOLFSSL_IMXRT1170_CAAM)
+/* Fail Nth alloc to target public key derive. */
+WOLFSSL_TEST_OOM_CALLBACKS(ecc_oom)
+#endif /* USE_WOLFSSL_MEMORY && ... */
+
+/* Decode should best-effort derive omitted SEC1 public point. */
+int test_wc_EccPrivateKeyDecode_derive_pub(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_ASN) && defined(HAVE_ECC) && !defined(NO_ECC_MAKE_PUB) && \
+    !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_NO_ECC_DERIVE_PUB_ON_DECODE) && \
+    defined(HAVE_ECC_KEY_EXPORT) && \
+    defined(USE_CERT_BUFFERS_256) && !defined(HAVE_FIPS) && \
+    !defined(HAVE_SELFTEST) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
+    !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
+    !defined(WOLFSSL_MICROCHIP_TA100) && !defined(WOLFSSL_CRYPTOCELL) && \
+    !defined(WOLFSSL_SILABS_SE_ACCEL) && !defined(WOLFSSL_KCAPI_ECC) && \
+    !defined(WOLFSSL_QNX_CAAM) && !defined(WOLFSSL_IMXRT1170_CAAM)
+    ecc_key fullKey;
+    ecc_key privOnlyKey;
+    WC_RNG  rng;
+    word32  idx;
+    byte    privOnlyDer[256];
+    int     privOnlyDerSz = 0;
+    byte    fullPub[256];
+    word32  fullPubSz = sizeof(fullPub);
+    byte    derivedPub[256];
+    word32  derivedPubSz = sizeof(derivedPub);
+
+    XMEMSET(&fullKey, 0, sizeof(fullKey));
+    XMEMSET(&privOnlyKey, 0, sizeof(privOnlyKey));
+    /* wc_FreeRng() below runs unconditionally, so rng must be safe to free
+     * even if wc_InitRng() fails. */
+    XMEMSET(&rng, 0, sizeof(rng));
+
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+
+    ExpectIntEQ(wc_ecc_init(&fullKey), 0);
+    idx = 0;
+    ExpectIntEQ(wc_EccPrivateKeyDecode(ecc_clikey_der_256, &idx, &fullKey,
+        sizeof_ecc_clikey_der_256), 0);
+    ExpectIntEQ(fullKey.type, ECC_PRIVATEKEY);
+    PRIVATE_KEY_UNLOCK();
+    ExpectIntEQ(wc_ecc_export_x963(&fullKey, fullPub, &fullPubSz), 0);
+    PRIVATE_KEY_LOCK();
+
+    /* Re-encode as private-key-only SEC1 DER. */
+    ExpectIntGT(privOnlyDerSz = wc_EccPrivateKeyToDer(&fullKey, privOnlyDer,
+        sizeof(privOnlyDer)), 0);
+
+    /* No RNG set: derivation still runs, but with key->rng NULL the
+     * projective-coordinate randomization is skipped even when
+     * ECC_TIMING_RESISTANT is on - EccDerivePubBestEffort() does not stand
+     * up a temporary RNG. */
+    ExpectIntEQ(wc_ecc_init(&privOnlyKey), 0);
+    idx = 0;
+    ExpectIntEQ(wc_EccPrivateKeyDecode(privOnlyDer, &idx, &privOnlyKey,
+        (word32)privOnlyDerSz), 0);
+    ExpectIntEQ(privOnlyKey.type, ECC_PRIVATEKEY);
+    PRIVATE_KEY_UNLOCK();
+    ExpectIntEQ(wc_ecc_export_x963(&privOnlyKey, derivedPub, &derivedPubSz),
+        0);
+    PRIVATE_KEY_LOCK();
+    ExpectIntEQ(derivedPubSz, fullPubSz);
+    ExpectBufEQ(derivedPub, fullPub, fullPubSz);
+    wc_ecc_free(&privOnlyKey);
+
+    /* Setting an RNG blinds the scalar mult; same derived point. */
+    derivedPubSz = sizeof(derivedPub);
+    ExpectIntEQ(wc_ecc_init(&privOnlyKey), 0);
+    ExpectIntEQ(wc_ecc_set_rng(&privOnlyKey, &rng), 0);
+    idx = 0;
+    ExpectIntEQ(wc_EccPrivateKeyDecode(privOnlyDer, &idx, &privOnlyKey,
+        (word32)privOnlyDerSz), 0);
+
+    /* Public point derived, key fully usable. */
+    ExpectIntEQ(privOnlyKey.type, ECC_PRIVATEKEY);
+    PRIVATE_KEY_UNLOCK();
+    ExpectIntEQ(wc_ecc_export_x963(&privOnlyKey, derivedPub, &derivedPubSz),
+        0);
+    PRIVATE_KEY_LOCK();
+    ExpectIntEQ(derivedPubSz, fullPubSz);
+    ExpectBufEQ(derivedPub, fullPub, fullPubSz);
+
+    wc_ecc_free(&privOnlyKey);
+    wc_ecc_free(&fullKey);
+
+#if defined(PLUTON_CRYPTO_ECC) || defined(WOLF_CRYPTO_CB)
+    /* devId key left ECC_PRIVATEKEY_ONLY: device derives it. */
+    ExpectIntEQ(wc_ecc_init_ex(&privOnlyKey, NULL, 1), 0);
+    ExpectIntEQ(wc_ecc_set_rng(&privOnlyKey, &rng), 0);
+    idx = 0;
+    ExpectIntEQ(wc_EccPrivateKeyDecode(privOnlyDer, &idx, &privOnlyKey,
+        (word32)privOnlyDerSz), 0);
+    ExpectIntEQ(privOnlyKey.type, ECC_PRIVATEKEY_ONLY);
+    wc_ecc_free(&privOnlyKey);
+#endif
+
+#if defined(USE_WOLFSSL_MEMORY) && !defined(WOLFSSL_NO_MALLOC) && \
+    !defined(WOLFSSL_STATIC_MEMORY) && !defined(WOLFSSL_MEM_FAIL_COUNT) && \
+    !defined(WOLFSSL_FORCE_MALLOC_FAIL_TEST)
+    {
+        wolfSSL_Malloc_cb prevMalloc = NULL;
+        wolfSSL_Free_cb prevFree = NULL;
+        wolfSSL_Realloc_cb prevRealloc = NULL;
+        int allocatorsSet = 0;
+        int totalAllocCount = 0;
+        int i;
+
+        ExpectIntEQ(wolfSSL_GetAllocators(&prevMalloc, &prevFree, &prevRealloc),
+            0);
+        ExpectIntEQ(wolfSSL_SetAllocators(ecc_oom_malloc_cb, ecc_oom_free_cb,
+            ecc_oom_realloc_cb), 0);
+        if (EXPECT_SUCCESS()) {
+            allocatorsSet = 1;
+        }
+
+        /* Count the allocations one decode-with-derive makes. Injection is
+         * armed only around the decode so wc_ecc_init() is never starved. */
+        ecc_oom_count = 0;
+        ecc_oom_fail_at = 0;
+        ecc_oom_failed = 0;
+        ExpectIntEQ(wc_ecc_init(&privOnlyKey), 0);
+        idx = 0;
+        ecc_oom_active = 1;
+        ExpectIntEQ(wc_EccPrivateKeyDecode(privOnlyDer, &idx, &privOnlyKey,
+            (word32)privOnlyDerSz), 0);
+        ecc_oom_active = 0;
+        totalAllocCount = ecc_oom_count;
+        wc_ecc_free(&privOnlyKey);
+        /* The armed window must actually have allocated something, or the
+         * loop below passes vacuously without exercising any OOM path. */
+        ExpectIntGE(totalAllocCount, 1);
+
+        /* Fail each allocation in turn. Whatever fails, decode must never
+         * report a derived public key it does not have: the key comes back
+         * either fully derived and correct, or still ECC_PRIVATEKEY_ONLY. */
+        for (i = 1; EXPECT_SUCCESS() && (i <= totalAllocCount); i++) {
+            int decodeRet;
+
+            ecc_oom_count = 0;
+            ecc_oom_fail_at = i;
+            ecc_oom_failed = 0;
+            derivedPubSz = sizeof(derivedPub);
+
+            ExpectIntEQ(wc_ecc_init(&privOnlyKey), 0);
+            idx = 0;
+            ecc_oom_active = 1;
+            decodeRet = wc_EccPrivateKeyDecode(privOnlyDer, &idx, &privOnlyKey,
+                (word32)privOnlyDerSz);
+            ecc_oom_active = 0;
+            /* The injection must actually have fired, otherwise this
+             * iteration passes vacuously without exercising any OOM path. */
+            ExpectIntEQ(ecc_oom_failed, 1);
+
+            /* A failure inside the decode itself is fine; only the
+             * best-effort derivation is required to be non-fatal. */
+            if (decodeRet == 0) {
+                ExpectIntNE(privOnlyKey.type, ECC_PUBLICKEY);
+                if (privOnlyKey.type == ECC_PRIVATEKEY) {
+                    PRIVATE_KEY_UNLOCK();
+                    ExpectIntEQ(wc_ecc_export_x963(&privOnlyKey, derivedPub,
+                        &derivedPubSz), 0);
+                    PRIVATE_KEY_LOCK();
+                    ExpectIntEQ(derivedPubSz, fullPubSz);
+                    ExpectBufEQ(derivedPub, fullPub, fullPubSz);
+                }
+                else {
+                    ExpectIntEQ(privOnlyKey.type, ECC_PRIVATEKEY_ONLY);
+                }
+            }
+
+            wc_ecc_free(&privOnlyKey);
+        }
+
+        ecc_oom_active = 0;
+        ecc_oom_fail_at = 0;
+
+        if (allocatorsSet) {
+            (void)wolfSSL_SetAllocators(prevMalloc, prevFree, prevRealloc);
+        }
+    }
+#endif /* USE_WOLFSSL_MEMORY */
+
+    wc_FreeRng(&rng);
+#endif /* !NO_ASN && HAVE_ECC && !NO_ECC_MAKE_PUB &&
+        * !WOLFSSL_NO_ECC_DERIVE_PUB_ON_DECODE && HAVE_ECC_KEY_EXPORT &&
+        * USE_CERT_BUFFERS_256 && !HAVE_FIPS && !HAVE_SELFTEST &&
+        * !WOLF_CRYPTO_CB_ONLY_ECC */
+    return EXPECT_RESULT();
+}

tests/api/test_asn.h

@@ -46,6 +46,7 @@ int test_ToTraditional_ex_mldsa_bad_params(void);
 int test_wc_SignCert_buffer_bounds(void);
 int test_wc_AsnDecisionCoverage(void);
 int test_wc_AsnFeatureCoverage(void);
+int test_wc_EccPrivateKeyDecode_derive_pub(void);
 
 #define TEST_ASN_DECLS                                              \
     TEST_DECL_GROUP("asn", test_SetAsymKeyDer),                     \
@@ -69,6 +70,7 @@ int test_wc_AsnFeatureCoverage(void);
     TEST_DECL_GROUP("asn", test_ToTraditional_ex_mldsa_bad_params), \
     TEST_DECL_GROUP("asn", test_wc_SignCert_buffer_bounds),         \
     TEST_DECL_GROUP("asn", test_wc_AsnDecisionCoverage),           \
-    TEST_DECL_GROUP("asn", test_wc_AsnFeatureCoverage)
+    TEST_DECL_GROUP("asn", test_wc_AsnFeatureCoverage),            \
+    TEST_DECL_GROUP("asn", test_wc_EccPrivateKeyDecode_derive_pub)
 
 #endif /* WOLFCRYPT_TEST_ASN_H */