Add crypto callback only mode for ed25519

[padelsbach]

Description

Expand existing ed25519 crypto callback to support the "only" mode which strips the software implementation for use with HSM or other hardware accelerators.

make_key, check_key, make_pub, sign_msg and verify_msg supported. No streaming support.

Testing

Added unit test and updated CI workflow

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[padelsbach]

Jenkins retest this please

[github-actions]

retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10830

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B (+0.1%, 200,654 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B (+0.2%, 174,838 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 180,952 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +280 B, .text +64 B (+0.0%, 771,556 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B, .text -64 B (+0.1%, 212,986 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +276 B, .text +64 B (+0.1%, 279,800 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +280 B, .text +64 B (+0.1%, 325,400 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B, .text +64 B (+0.1%, 236,480 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B (+0.1%, 200,590 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +276 B, .text +64 B (+0.1%, 280,376 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +20 B, .rodata.str1.1 +250 B, .text +64 B (+0.1%, 236,480 B / 262,144 B, total: 90% used)

linuxkm-pie

• Data: __patchable_function_entries +16 B (+0.1%, 25,576 B)

linuxkm-standard

• Data: __patchable_function_entries +16 B (+0.0%, 48,264 B)

stm32-sim-stm32h753

• FLASH: .text +340 B (+0.2%, 183,736 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12

[padelsbach]

jenkins retest this please

[rizlik]

Great work, but the problem is that make_public and check-key survives and so ge_operations can't be removed from the build.
Given that the main goal of ONLY_ED25519 is to reduce code/data size, we should aim at removing all the software math.

I see two options:

1. Gating out the make_public and check_key with new gating macros
2. Adding two crypto callbacks for make_public and check_key

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: COMMENT
Findings: 1 total — 1 posted, 0 skipped

Posted findings

• [Low] Sign CB_ONLY path omits (void)ed25519Ctx suppression present in verify path — wolfcrypt/src/ed25519.c:445

Review generated by Skoll via Claude/Codex

[padelsbach]

Great work, but the problem is that make_public and check-key survives and so ge_operations can't be removed from the build. Given that the main goal of ONLY_ED25519 is to reduce code/data size, we should aim at removing all the software math.

I see two options:

1. Gating out the make_public and check_key with new gating macros
2. Adding two crypto callbacks for make_public and check_key

Option 2 added, following the pattern from ECC. The ge operations are completely gone, but I did have to inline a small chunk of math.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10830

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[padelsbach]

@Frauschi @rizlik CI finally green. Please re-review

[Frauschi]

LGTM

[rizlik]

WOLFSSL_CURVE25519_USE_ED25519 auto-define in fe_operations.h re-enable the math.

The config --enable-ed25519 --enable-cryptocb --disable-curve25519 + ONLY_ED25519 fails the linkage.

Probably disabling blinding also re-enable the math silently.

My suggestion is to gate the USE_ED25519 to !CB_ONLY_ED25519

[rizlik]

My suggestion is to gate the USE_ED25519 to !CB_ONLY_ED25519

If you prefer to do that in a follow-up PR I'm OK also to merge as it is now

[padelsbach]

My suggestion is to gate the USE_ED25519 to !CB_ONLY_ED25519

If you prefer to do that in a follow-up PR I'm OK also to merge as it is now

Excellent catch. I've pushed a commit to fix it and add a test case in CI.

For future reference, this was the problematic configure command:

./configure --enable-ed25519 --enable-cryptocb --disable-curve25519 CFLAGS="-O2 -DWOLF_CRYPTO_CB_ONLY_ED25519"

[philljj]

Looks good first pass, just two tiny questions.

[rizlik]

Does an extra comment need to be added, or is this resolved?

@philljj it can be addressed by the PR that adds CB_ONLY_CURVE25519, no need to block this one for this

[philljj]

Retest this please.

(Connection to github.com closed by remote host.).