[dgarske]

Under SQRTMOD_USE_MOD_EXP, mp_sqrtmod_prime() used the exponent (p-1)/4 for a prime that is 5 mod 8, which never yields a root, so a compressed secp224k1 point decompressed to a wrong y; it also returned a value for an x with no square root. It now uses Atkin's method for p = 5 mod 8, squares the result and returns MP_VAL when it is not a root, and keeps its small stack footprint; a prime that is 1 mod 8 (P-224) stays unsupported under that define and the crypt test skips it there. The generated sp_ecc_uncompress_256/384/521() now square the recovered y as well, reducing both sides below the modulus first as sp_<n>_map_<w>() does, so a trusted compressed import in SP builds can no longer produce a point off the curve. Also reported by @mimoex (ZD 22735) and Resolves F-16899.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,584 B (+0.6%, 284,032 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Critical issues remain: an unguarded test helper breaks feature-disabled builds, and noncanonical field comparisons reject valid compressed P-256 and P-521 points.

3 open issues

• Guard the helper when ECC features are disabled · New
• Normalize the P-521 square before comparing · New
• Canonicalize P-256 operands before comparing · New

What changed in this PR

This PR corrects compressed ECC point recovery in wolfCrypt and adds checks to reject coordinates with no valid square root.

Changes:

• Uses Atkin’s method for primes congruent to 5 modulo 8 under SQRTMOD_USE_MOD_EXP, with square-back validation.
• Adds recovered-root validation across nine generated single-precision arithmetic backends.
• Adds compressed-point regression tests and skips unsupported P-224 round trips under SQRTMOD_USE_MOD_EXP.

File	Description
wolfcrypt/​test/​test.c	Skips unsupported compressed P-224 round trips.
wolfcrypt/​src/​sp_x86_64.c	Adds root validation for x86-64 decompression.
wolfcrypt/​src/​sp_riscv64.c	Adds root validation for RISC-V decompression.
wolfcrypt/​src/​sp_dsp32.c	Adds root validation for DSP P-256 decompression.
wolfcrypt/​src/​sp_cortexm.c	Adds root validation for Cortex-M decompression.
wolfcrypt/​src/​sp_c64.c	Adds root validation for portable 64-bit decompression.
wolfcrypt/​src/​sp_c32.c	Adds root validation for portable 32-bit decompression.
wolfcrypt/​src/​sp_armthumb.c	Adds root validation for ARM Thumb decompression.
wolfcrypt/​src/​sp_arm64.c	Adds root validation for ARM64 decompression.
wolfcrypt/​src/​sp_arm32.c	Adds root validation for ARM32 decompression.
wolfcrypt/​src/​ecc.c	Corrects modular square-root calculation and validates results.
tests/​api/​test_ecc.h	Registers the compressed-point regression test.
tests/​api/​test_ecc.c	Adds known-point, no-root, and round-trip tests.

_{Review effort: Balanced}

[dgarske]

Jenkins retest this please "Found unhandled java.io.IOException exception:" and FIleExceptions.

[SparkiDev]

Put #if guard around the prime mod 8 = 5 code.
It is not regularly needed and should be dropped when the user defines something.