[LinuxJedi]

Description

With WOLFSSL_SP_MATH and FP_ECC, wc_ecc_mulmod_ex() and wc_ecc_mulmod_ex2() pass the base point unchanged to sp_ecc_mulmod_256/384/521(). With FP_ECC the SP code caches a stripe table for each point it multiplies (sp_ecc_get_cache_256() and the 384/521 versions), keyed on the x and y ordinates only. A point with z other than 1 could therefore be multiplied using the table built from another point with the same x and y.

For example, (Gx, Gy, p - 1) is -G. Multiplying G, then -G as (Gx, Gy, p - 1), then G again returns -kG for the last call. Once a table exists for x = Gx and y = Gy, (Gx, Gy, 2) also gets -G's result. P-256, P-384 and P-521 are all affected. Without FP_ECC the SP code handles z != 1 correctly.

This build has no generic point arithmetic to convert the point to affine or to fall back to, so return ECC_BAD_ARG_E when z is not 1. Callers in the library only pass affine points. Other math configurations, and SP math without FP_ECC, are unchanged.

Testing

Added test_wc_ecc_mulmod_projective: on each SP-supported curve (P-256, P-384, P-521), multiplies G, then -G as (Gx, Gy, p - 1) with wc_ecc_mulmod() (and wc_ecc_mulmod_ex2() when WOLFSSL_PUBLIC_ECC_ADD_DBL is defined), then G again. Checks for kG, -kG (or ECC_BAD_ARG_E with SP math only and FP_ECC) and kG. Fails without the fix.

./tests/unit.test --api --group ecc and ./wolfcrypt/test/testwolfcrypt pass with:

• --enable-sp-math --enable-sp=yes,384,521 --disable-sp-asm --enable-fpecc CPPFLAGS=-DWOLFSSL_PUBLIC_MP, also with -DWOLFSSL_PUBLIC_ECC_ADD_DBL
• --enable-sp-math --enable-sp=yes,384,521 --disable-sp-asm, also with CPPFLAGS=-DWOLFSSL_PUBLIC_MP
• --enable-sp=ec256 --enable-fpecc --enable-smallstack, also with CPPFLAGS=-DWOLFSSL_PUBLIC_MP
• --enable-all

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753
• zephyr-frdm_rw612

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The new test’s curve-selection guards omit ECC_MIN_KEY_SZ, causing it to select excluded curves and fail in supported minimum-key-size configurations.

1 open issue

• Gate curve selection on ECC_MIN_KEY_SZ · New

What changed in this PR

This PR prevents incorrect ECC multiplication caused by SP point-cache collisions by rejecting non-affine base points in SP-math-only builds with FP_ECC.

Changes:

• Return ECC_BAD_ARG_E for base points with z != 1 in both multiplication entry points.
• Add regression coverage for P-256, P-384, and P-521, including checks that subsequent affine multiplication remains correct.
• Register the new test in the ECC API test group.

File	Description
wolfcrypt/​src/​ecc.c	Reject non-affine inputs in the affected multiplication paths.
tests/​api/​test_ecc.h	Declare and register the projective-point regression test.
tests/​api/​test_ecc.c	Test projective-point handling and subsequent affine results across supported curves.

_{Review effort: Balanced}