From 2b874236c87145417dcfc28306ccd3561c7fd6dd Mon Sep 17 00:00:00 2001 From: jackctj117 Date: Mon, 1 Dec 2025 14:05:39 -0700 Subject: [PATCH 1/3] Expand ECC tests to cover export and cache key cases --- test/wh_test_crypto.c | 286 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 264 insertions(+), 22 deletions(-) diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c index 686622b87..1e822dceb 100644 --- a/test/wh_test_crypto.c +++ b/test/wh_test_crypto.c @@ -310,60 +310,67 @@ static int whTest_CryptoRsa(whClientContext* ctx, int devId, WC_RNG* rng) #ifdef HAVE_ECC static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) { - (void)ctx; - int ret = WH_ERROR_OK; - ecc_key eccPrivate[1]; - ecc_key eccPublic[1]; + ecc_key bonnieKey[1]; + ecc_key clydeKey[1]; #define TEST_ECC_KEYSIZE 32 +#define TEST_ECC_CURVE_ID ECC_SECP256R1 uint8_t shared_ab[TEST_ECC_KEYSIZE] = {0}; uint8_t shared_ba[TEST_ECC_KEYSIZE] = {0}; uint8_t hash[TEST_ECC_KEYSIZE] = {0}; uint8_t sig[ECC_MAX_SIG_SIZE] = {0}; - - ret = wc_ecc_init_ex(eccPrivate, NULL, devId); + whKeyId keyIdPrivate = WH_KEYID_ERASED; + whKeyId checkKeyId = WH_KEYID_ERASED; + whNvmFlags flags = WH_NVM_FLAGS_USAGE_SIGN | WH_NVM_FLAGS_USAGE_VERIFY | + WH_NVM_FLAGS_USAGE_DERIVE; + uint8_t labelPrivate[WH_NVM_LABEL_LEN] = "ECC Private Key"; + + /* Test Case 1: Using ephemeral key (normal wolfCrypt flow) */ + ret = wc_ecc_init_ex(bonnieKey, NULL, devId); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex %d\n", ret); } else { - ret = wc_ecc_init_ex(eccPublic, NULL, devId); + ret = wc_ecc_init_ex(clydeKey, NULL, devId); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex %d\n", ret); } else { - ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, eccPrivate); + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, bonnieKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_make_key %d\n", ret); } else { - ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, eccPublic); + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, clydeKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_make_key %d\n", ret); } else { word32 secLen = TEST_ECC_KEYSIZE; - ret = wc_ecc_shared_secret(eccPrivate, eccPublic, - (byte*)shared_ab, &secLen); + ret = wc_ecc_shared_secret(bonnieKey, clydeKey, + (byte*)shared_ab, &secLen); if (ret != 0) { WH_ERROR_PRINT("Failed to compute secret %d\n", ret); } else { - ret = wc_ecc_shared_secret(eccPublic, eccPrivate, - (byte*)shared_ba, &secLen); + ret = wc_ecc_shared_secret(clydeKey, bonnieKey, + (byte*)shared_ba, &secLen); if (ret != 0) { WH_ERROR_PRINT("Failed to compute secret %d\n", ret); } else { if (memcmp(shared_ab, shared_ba, secLen) == 0) { - WH_TEST_PRINT("ECDH SUCCESS\n"); + WH_TEST_PRINT("ECC ephemeral ECDH SUCCESS\n"); } else { - WH_ERROR_PRINT("ECDH FAILED TO MATCH\n"); + WH_ERROR_PRINT( + "ECC ephemeral ECDH FAILED TO MATCH\n"); + ret = -1; } } } if (ret == 0) { - /*Use the shared secret as a random hash */ + /* Use the shared secret as a random hash */ memcpy(hash, shared_ba, sizeof(hash)); word32 sigLen = sizeof(sig); ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), (void*)sig, &sigLen, rng, - eccPrivate); + bonnieKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_sign_hash %d\n", ret); @@ -371,7 +378,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) int res = 0; ret = wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, sizeof(hash), - &res, eccPrivate); + &res, bonnieKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_verify_hash" " %d\n", @@ -379,10 +386,12 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } else { if (res == 1) { - WH_TEST_PRINT("ECC SIGN/VERIFY SUCCESS\n"); + WH_TEST_PRINT( + "ECC ephemeral SIGN/VERIFY SUCCESS\n"); } else { - WH_ERROR_PRINT("ECC SIGN/VERIFY FAIL\n"); + WH_ERROR_PRINT( + "ECC ephemeral SIGN/VERIFY FAIL\n"); ret = -1; } } @@ -390,9 +399,242 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } } } - wc_ecc_free(eccPublic); + wc_ecc_free(clydeKey); + } + wc_ecc_free(bonnieKey); + } + + /* Test Case 2: Using client export key */ + if (ret == 0) { + memset(shared_ab, 0, sizeof(shared_ab)); + memset(shared_ba, 0, sizeof(shared_ba)); + memset(sig, 0, sizeof(sig)); + + ret = wc_ecc_init_ex(bonnieKey, NULL, WH_DEV_ID); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wc_ecc_init_ex for export key %d\n", ret); + } + else { + ret = wc_ecc_init_ex(clydeKey, NULL, WH_DEV_ID); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wc_ecc_init_ex for export key %d\n", + ret); + } + else { + /* Server creates keys and exports them to client */ + ret = wh_Client_EccMakeExportKey(ctx, TEST_ECC_KEYSIZE, + TEST_ECC_CURVE_ID, bonnieKey); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wh_Client_EccMakeExportKey %d\n", + ret); + } + if (ret == 0) { + ret = wh_Client_EccMakeExportKey( + ctx, TEST_ECC_KEYSIZE, TEST_ECC_CURVE_ID, clydeKey); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to wh_Client_EccMakeExportKey %d\n", ret); + } + } + /* Test ECDH with exported keys */ + if (ret == 0) { + word32 secLen = TEST_ECC_KEYSIZE; + ret = wc_ecc_shared_secret(bonnieKey, clydeKey, + (byte*)shared_ab, &secLen); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to compute export key secret %d\n", ret); + } + } + if (ret == 0) { + word32 secLen = TEST_ECC_KEYSIZE; + ret = wc_ecc_shared_secret(clydeKey, bonnieKey, + (byte*)shared_ba, &secLen); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to compute export key secret %d\n", ret); + } + } + if (ret == 0) { + if (memcmp(shared_ab, shared_ba, TEST_ECC_KEYSIZE) != 0) { + WH_ERROR_PRINT("ECC export key ECDH FAILED TO MATCH\n"); + ret = -1; + } + else { + WH_TEST_PRINT("ECC export key ECDH SUCCESS\n"); + } + } + /* Test ECDSA sign/verify with exported keys */ + if (ret == 0) { + memcpy(hash, shared_ba, sizeof(hash)); + word32 sigLen = sizeof(sig); + ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), + (void*)sig, &sigLen, rng, bonnieKey); + if (ret != 0) { + WH_ERROR_PRINT("Failed to sign with export key %d\n", + ret); + } + else { + int res = 0; + ret = + wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, + sizeof(hash), &res, bonnieKey); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to verify with export key %d\n", ret); + } + else if (res != 1) { + WH_ERROR_PRINT("ECC export key SIGN/VERIFY FAIL\n"); + ret = -1; + } + else { + WH_TEST_PRINT( + "ECC export key SIGN/VERIFY SUCCESS\n"); + } + } + } + wc_ecc_free(clydeKey); + } + wc_ecc_free(bonnieKey); + } + } + + /* Test Case 3: Using keyCache key (key stays on server) + * Use only ONE cached key to avoid key cache space issues. + * For ECDH, use an ephemeral peer key. */ + if (ret == 0) { + memset(shared_ab, 0, sizeof(shared_ab)); + memset(shared_ba, 0, sizeof(shared_ba)); + memset(sig, 0, sizeof(sig)); + keyIdPrivate = WH_KEYID_ERASED; + + /* Server creates and caches one key */ + ret = wh_Client_EccMakeCacheKey(ctx, TEST_ECC_KEYSIZE, + TEST_ECC_CURVE_ID, &keyIdPrivate, flags, + sizeof(labelPrivate), labelPrivate); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wh_Client_EccMakeCacheKey %d\n", ret); + } + if (ret == 0) { + /* Init the cached key struct and associate with server key ID */ + ret = wc_ecc_init_ex(bonnieKey, NULL, WH_DEV_ID); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wc_ecc_init_ex for cache key %d\n", + ret); + } + else { + ret = wh_Client_EccSetKeyId(bonnieKey, keyIdPrivate); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wh_Client_EccSetKeyId %d\n", ret); + } + /* Verify key ID was set correctly */ + if (ret == 0) { + ret = wh_Client_EccGetKeyId(bonnieKey, &checkKeyId); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wh_Client_EccGetKeyId %d\n", + ret); + } + else if (checkKeyId != keyIdPrivate) { + WH_ERROR_PRINT( + "ECC key ID mismatch: got %u, expected %u\n", + checkKeyId, keyIdPrivate); + ret = -1; + } + } + /* Set curve parameters (required since key data isn't exported) + */ + if (ret == 0) { + ret = wc_ecc_set_curve(bonnieKey, TEST_ECC_KEYSIZE, + TEST_ECC_CURVE_ID); + if (ret != 0) { + WH_ERROR_PRINT("Failed to wc_ecc_set_curve %d\n", ret); + } + } + /* Create ephemeral peer key for ECDH test */ + if (ret == 0) { + ret = wc_ecc_init_ex(clydeKey, NULL, WH_DEV_ID); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to wc_ecc_init_ex for peer key %d\n", ret); + } + else { + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, clydeKey); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to wc_ecc_make_key for peer %d\n", ret); + } + /* Test ECDH: cached key with ephemeral peer */ + if (ret == 0) { + word32 secLen = TEST_ECC_KEYSIZE; + ret = wc_ecc_shared_secret( + bonnieKey, clydeKey, (byte*)shared_ab, &secLen); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to compute cache key secret %d\n", + ret); + } + } + if (ret == 0) { + word32 secLen = TEST_ECC_KEYSIZE; + ret = wc_ecc_shared_secret( + clydeKey, bonnieKey, (byte*)shared_ba, &secLen); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to compute peer secret %d\n", ret); + } + } + if (ret == 0) { + if (memcmp(shared_ab, shared_ba, + TEST_ECC_KEYSIZE) != 0) { + WH_ERROR_PRINT( + "ECC cache key ECDH FAILED TO MATCH\n"); + ret = -1; + } + else { + WH_TEST_PRINT("ECC cache key ECDH SUCCESS\n"); + } + } + wc_ecc_free(clydeKey); + } + } + /* Test ECDSA sign/verify with cached key */ + if (ret == 0) { + memcpy(hash, shared_ba, sizeof(hash)); + word32 sigLen = sizeof(sig); + ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), + (void*)sig, &sigLen, rng, bonnieKey); + if (ret != 0) { + WH_ERROR_PRINT("Failed to sign with cache key %d\n", + ret); + } + else { + int res = 0; + ret = + wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, + sizeof(hash), &res, bonnieKey); + if (ret != 0) { + WH_ERROR_PRINT( + "Failed to verify with cache key %d\n", ret); + } + else if (res != 1) { + WH_ERROR_PRINT("ECC cache key SIGN/VERIFY FAIL\n"); + ret = -1; + } + else { + WH_TEST_PRINT( + "ECC cache key SIGN/VERIFY SUCCESS\n"); + } + } + } + wc_ecc_free(bonnieKey); + } } - wc_ecc_free(eccPrivate); + /* Evict server key regardless of test success */ + (void)wh_Client_KeyEvict(ctx, keyIdPrivate); + } + + if (ret == 0) { + WH_TEST_PRINT("ECC SUCCESS\n"); } return ret; } From 27aae75e16f8754e37bc1dac66528a2f43c0ddd5 Mon Sep 17 00:00:00 2001 From: jackctj117 Date: Wed, 10 Dec 2025 10:33:07 -0700 Subject: [PATCH 2/3] Changed keys to bob and alice --- test/wh_test_crypto.c | 72 +++++++++++++++++++++---------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c index 1e822dceb..9b397cf09 100644 --- a/test/wh_test_crypto.c +++ b/test/wh_test_crypto.c @@ -311,44 +311,44 @@ static int whTest_CryptoRsa(whClientContext* ctx, int devId, WC_RNG* rng) static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) { int ret = WH_ERROR_OK; - ecc_key bonnieKey[1]; - ecc_key clydeKey[1]; + ecc_key bobKey[1]; + ecc_key aliceKey[1]; #define TEST_ECC_KEYSIZE 32 #define TEST_ECC_CURVE_ID ECC_SECP256R1 uint8_t shared_ab[TEST_ECC_KEYSIZE] = {0}; uint8_t shared_ba[TEST_ECC_KEYSIZE] = {0}; uint8_t hash[TEST_ECC_KEYSIZE] = {0}; uint8_t sig[ECC_MAX_SIG_SIZE] = {0}; - whKeyId keyIdPrivate = WH_KEYID_ERASED; - whKeyId checkKeyId = WH_KEYID_ERASED; + whKeyId keyIdPrivate = WH_KEYID_ERASED; + whKeyId checkKeyId = WH_KEYID_ERASED; whNvmFlags flags = WH_NVM_FLAGS_USAGE_SIGN | WH_NVM_FLAGS_USAGE_VERIFY | WH_NVM_FLAGS_USAGE_DERIVE; uint8_t labelPrivate[WH_NVM_LABEL_LEN] = "ECC Private Key"; /* Test Case 1: Using ephemeral key (normal wolfCrypt flow) */ - ret = wc_ecc_init_ex(bonnieKey, NULL, devId); + ret = wc_ecc_init_ex(bobKey, NULL, devId); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex %d\n", ret); } else { - ret = wc_ecc_init_ex(clydeKey, NULL, devId); + ret = wc_ecc_init_ex(aliceKey, NULL, devId); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex %d\n", ret); } else { - ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, bonnieKey); + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_make_key %d\n", ret); } else { - ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, clydeKey); + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, aliceKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_make_key %d\n", ret); } else { word32 secLen = TEST_ECC_KEYSIZE; - ret = wc_ecc_shared_secret(bonnieKey, clydeKey, + ret = wc_ecc_shared_secret(bobKey, aliceKey, (byte*)shared_ab, &secLen); if (ret != 0) { WH_ERROR_PRINT("Failed to compute secret %d\n", ret); } else { - ret = wc_ecc_shared_secret(clydeKey, bonnieKey, + ret = wc_ecc_shared_secret(aliceKey, bobKey, (byte*)shared_ba, &secLen); if (ret != 0) { WH_ERROR_PRINT("Failed to compute secret %d\n", @@ -370,7 +370,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) word32 sigLen = sizeof(sig); ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), (void*)sig, &sigLen, rng, - bonnieKey); + bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_sign_hash %d\n", ret); @@ -378,7 +378,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) int res = 0; ret = wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, sizeof(hash), - &res, bonnieKey); + &res, bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_verify_hash" " %d\n", @@ -399,9 +399,9 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } } } - wc_ecc_free(clydeKey); + wc_ecc_free(aliceKey); } - wc_ecc_free(bonnieKey); + wc_ecc_free(bobKey); } /* Test Case 2: Using client export key */ @@ -410,12 +410,12 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) memset(shared_ba, 0, sizeof(shared_ba)); memset(sig, 0, sizeof(sig)); - ret = wc_ecc_init_ex(bonnieKey, NULL, WH_DEV_ID); + ret = wc_ecc_init_ex(bobKey, NULL, WH_DEV_ID); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex for export key %d\n", ret); } else { - ret = wc_ecc_init_ex(clydeKey, NULL, WH_DEV_ID); + ret = wc_ecc_init_ex(aliceKey, NULL, WH_DEV_ID); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex for export key %d\n", ret); @@ -423,14 +423,14 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) else { /* Server creates keys and exports them to client */ ret = wh_Client_EccMakeExportKey(ctx, TEST_ECC_KEYSIZE, - TEST_ECC_CURVE_ID, bonnieKey); + TEST_ECC_CURVE_ID, bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to wh_Client_EccMakeExportKey %d\n", ret); } if (ret == 0) { ret = wh_Client_EccMakeExportKey( - ctx, TEST_ECC_KEYSIZE, TEST_ECC_CURVE_ID, clydeKey); + ctx, TEST_ECC_KEYSIZE, TEST_ECC_CURVE_ID, aliceKey); if (ret != 0) { WH_ERROR_PRINT( "Failed to wh_Client_EccMakeExportKey %d\n", ret); @@ -439,7 +439,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) /* Test ECDH with exported keys */ if (ret == 0) { word32 secLen = TEST_ECC_KEYSIZE; - ret = wc_ecc_shared_secret(bonnieKey, clydeKey, + ret = wc_ecc_shared_secret(bobKey, aliceKey, (byte*)shared_ab, &secLen); if (ret != 0) { WH_ERROR_PRINT( @@ -448,7 +448,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } if (ret == 0) { word32 secLen = TEST_ECC_KEYSIZE; - ret = wc_ecc_shared_secret(clydeKey, bonnieKey, + ret = wc_ecc_shared_secret(aliceKey, bobKey, (byte*)shared_ba, &secLen); if (ret != 0) { WH_ERROR_PRINT( @@ -469,7 +469,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) memcpy(hash, shared_ba, sizeof(hash)); word32 sigLen = sizeof(sig); ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), - (void*)sig, &sigLen, rng, bonnieKey); + (void*)sig, &sigLen, rng, bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to sign with export key %d\n", ret); @@ -478,7 +478,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) int res = 0; ret = wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, - sizeof(hash), &res, bonnieKey); + sizeof(hash), &res, bobKey); if (ret != 0) { WH_ERROR_PRINT( "Failed to verify with export key %d\n", ret); @@ -493,9 +493,9 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } } } - wc_ecc_free(clydeKey); + wc_ecc_free(aliceKey); } - wc_ecc_free(bonnieKey); + wc_ecc_free(bobKey); } } @@ -517,19 +517,19 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } if (ret == 0) { /* Init the cached key struct and associate with server key ID */ - ret = wc_ecc_init_ex(bonnieKey, NULL, WH_DEV_ID); + ret = wc_ecc_init_ex(bobKey, NULL, WH_DEV_ID); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_init_ex for cache key %d\n", ret); } else { - ret = wh_Client_EccSetKeyId(bonnieKey, keyIdPrivate); + ret = wh_Client_EccSetKeyId(bobKey, keyIdPrivate); if (ret != 0) { WH_ERROR_PRINT("Failed to wh_Client_EccSetKeyId %d\n", ret); } /* Verify key ID was set correctly */ if (ret == 0) { - ret = wh_Client_EccGetKeyId(bonnieKey, &checkKeyId); + ret = wh_Client_EccGetKeyId(bobKey, &checkKeyId); if (ret != 0) { WH_ERROR_PRINT("Failed to wh_Client_EccGetKeyId %d\n", ret); @@ -544,7 +544,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) /* Set curve parameters (required since key data isn't exported) */ if (ret == 0) { - ret = wc_ecc_set_curve(bonnieKey, TEST_ECC_KEYSIZE, + ret = wc_ecc_set_curve(bobKey, TEST_ECC_KEYSIZE, TEST_ECC_CURVE_ID); if (ret != 0) { WH_ERROR_PRINT("Failed to wc_ecc_set_curve %d\n", ret); @@ -552,13 +552,13 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } /* Create ephemeral peer key for ECDH test */ if (ret == 0) { - ret = wc_ecc_init_ex(clydeKey, NULL, WH_DEV_ID); + ret = wc_ecc_init_ex(aliceKey, NULL, WH_DEV_ID); if (ret != 0) { WH_ERROR_PRINT( "Failed to wc_ecc_init_ex for peer key %d\n", ret); } else { - ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, clydeKey); + ret = wc_ecc_make_key(rng, TEST_ECC_KEYSIZE, aliceKey); if (ret != 0) { WH_ERROR_PRINT( "Failed to wc_ecc_make_key for peer %d\n", ret); @@ -567,7 +567,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) if (ret == 0) { word32 secLen = TEST_ECC_KEYSIZE; ret = wc_ecc_shared_secret( - bonnieKey, clydeKey, (byte*)shared_ab, &secLen); + bobKey, aliceKey, (byte*)shared_ab, &secLen); if (ret != 0) { WH_ERROR_PRINT( "Failed to compute cache key secret %d\n", @@ -577,7 +577,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) if (ret == 0) { word32 secLen = TEST_ECC_KEYSIZE; ret = wc_ecc_shared_secret( - clydeKey, bonnieKey, (byte*)shared_ba, &secLen); + aliceKey, bobKey, (byte*)shared_ba, &secLen); if (ret != 0) { WH_ERROR_PRINT( "Failed to compute peer secret %d\n", ret); @@ -594,7 +594,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) WH_TEST_PRINT("ECC cache key ECDH SUCCESS\n"); } } - wc_ecc_free(clydeKey); + wc_ecc_free(aliceKey); } } /* Test ECDSA sign/verify with cached key */ @@ -602,7 +602,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) memcpy(hash, shared_ba, sizeof(hash)); word32 sigLen = sizeof(sig); ret = wc_ecc_sign_hash((void*)hash, sizeof(hash), - (void*)sig, &sigLen, rng, bonnieKey); + (void*)sig, &sigLen, rng, bobKey); if (ret != 0) { WH_ERROR_PRINT("Failed to sign with cache key %d\n", ret); @@ -611,7 +611,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) int res = 0; ret = wc_ecc_verify_hash((void*)sig, sigLen, (void*)hash, - sizeof(hash), &res, bonnieKey); + sizeof(hash), &res, bobKey); if (ret != 0) { WH_ERROR_PRINT( "Failed to verify with cache key %d\n", ret); @@ -626,7 +626,7 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } } } - wc_ecc_free(bonnieKey); + wc_ecc_free(bobKey); } } /* Evict server key regardless of test success */ From c9153e366952bdcf02303505041b1a11bcf8d43b Mon Sep 17 00:00:00 2001 From: jackctj117 Date: Fri, 12 Dec 2025 12:02:47 -0700 Subject: [PATCH 3/3] Added the guard to only evict if the keyId is valid --- test/wh_test_crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c index 9b397cf09..5c667d154 100644 --- a/test/wh_test_crypto.c +++ b/test/wh_test_crypto.c @@ -630,7 +630,9 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng) } } /* Evict server key regardless of test success */ - (void)wh_Client_KeyEvict(ctx, keyIdPrivate); + if (!WH_KEYID_ISERASED(keyIdPrivate)) { + (void)wh_Client_KeyEvict(ctx, keyIdPrivate); + } } if (ret == 0) {