[SparkiDev]

Description

• Without an RNG, operations on secrets (z_T, RSK, r) are constant time: reduction, inversion, field add/sub, ModExp and point mapping.
• New wc_SetSakkeRng(): blinding allows faster algorithms to be used. wc_MakeSakkeRsk() uses it rather than instantiating an RNG per call.
• Table lookups cache resistant unless WC_NO_CACHE_RESISTANT.
• SP P1024: constant time lookups (AVX2 on x86_64), table multiply and ModExp; fix AVX2 entry over-read, add vzeroupper; fix p1024_order guard for NO_ECC_CHECK_KEY builds.
• ecc_map_ex() constant time branch uses constant time reduction.
• Fix zMont not reset when making or importing a key.
• Tests and docs for wc_SetSakkeRng().

Fixes zd#22803

Testing

./configure --enable-sakke

[Copilot]

🔵 Needs a closer look

Security-sensitive constant-time arithmetic changes across ECC, six SP backends, and assembly implementations require specialist cryptographic review and target-specific correctness and side-channel validation beyond source inspection.

No open issues 🎉

What changed in this PR

This PR strengthens side-channel protection in wolfCrypt’s SAKKE implementation through constant-time arithmetic and cache-resistant lookups, with an optional RNG interface for blinding.

Changes:

• Harden secret-dependent P1024 operations across supported backends and use constant-time reduction in ECC point mapping.
• Add the wc_SetSakkeRng() interface, documentation, and tests for blinded operations.
• Correct x86 AVX2 table-read bounds, add vector-state cleanup, and adjust P1024 guards and key-generation buffer sizing.

File	Description
wolfssl/​wolfcrypt/​sakke.h	Declare the RNG setter and store a non-owned RNG pointer.
wolfssl/​wolfcrypt/​ecc.h	Allow extra random bytes to reduce key-generation bias.
wolfcrypt/​test/​test.c	Test RNG setter arguments and repeat SAKKE operations with blinding.
wolfcrypt/​src/​sp_x86_64.c	Harden P1024 lookups, multiplication, and exponentiation.
wolfcrypt/​src/​sp_x86_64_asm.S	Add AVX2 lookups, fix read bounds, and clear upper vector state.
wolfcrypt/​src/​sp_x86_64_asm.asm	Apply equivalent AVX2 changes to Windows assembly.
wolfcrypt/​src/​sp_riscv64.c	Harden RISC-V P1024 lookups and secret exponentiation.
wolfcrypt/​src/​sp_c64.c	Harden portable 64-bit P1024 operations.
wolfcrypt/​src/​sp_c32.c	Harden portable 32-bit P1024 operations.
wolfcrypt/​src/​sp_armthumb.c	Harden ARM Thumb P1024 operations.
wolfcrypt/​src/​sp_arm64.c	Harden ARM64 P1024 operations.
wolfcrypt/​src/​ecc.c	Keep constant-time point mapping in Montgomery form until final conversion.
doc/​dox_comments/​header_files/​sakke.h	Document RNG configuration, ownership, and intended performance benefits.
doc/​dox_comments/​header_files/​doxygen_groups.h	Recommend RNG setup in SAKKE usage flows.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4

• FLASH: .text +192 B (+0.1%, 209,740 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 197,344 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +128 B (+0.0%, 804,452 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +128 B (+0.1%, 224,204 B / 262,144 B, total: 86% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 314,320 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +128 B (+0.1%, 250,982 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

• FLASH: .text +128 B (+0.1%, 209,740 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 315,152 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 250,982 B / 262,144 B, total: 96% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +28 B, text +11,728 B (+4.2%, 294,228 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🔵 Needs a closer look

Constant-time changes across five arithmetic backends and two assembly formats require human security review and target-specific correctness and side-channel validation beyond the supplied configure-only testing.

No open issues 🎉

_{Review effort: Balanced}