Add curve448 crypto callback support

.github/workflows/cryptocb-only.yml

@@ -117,9 +117,18 @@ jobs:
           {"name": "curve25519",
            "comment": "WOLF_CRYPTO_CB_ONLY_CURVE25519: strips software X25519 (keygen/shared-secret); swdev provides the software path via cryptocb. Nonblock and async X25519 have no callback path and are left disabled.",
            "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_CURVE25519"]},
+          {"name": "curve448",
+           "comment": "WOLF_CRYPTO_CB_ONLY_CURVE448: strips software X448 (keygen/shared-secret/make-pub/generic) including the fe448 field math; swdev provides the software path via cryptocb.",
+           "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_CURVE448"]},
+          {"name": "curve448-no-ed448",
+           "comment": "Same as curve448 but with ed448 off. ed448 is the only other user of the fe448 math, so without it the strip is complete and nothing must pull the math back in. The curve448 entry above keeps ed448 enabled, which leaves fe_448.c compiled and would hide such a regression at link time.",
+           "configure": ["--disable-ed448", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_CURVE448"]},
+          {"name": "curve448-onlycb-no-swdev",
+           "comment": "CB_ONLY_CURVE448 without swdev: runs curve448_onlycb_test, the only coverage of the cb-handled/cb-delegated (exampleVar 99/1) dispatch incl. make_pub/generic. cryptonly drops TLS so make check needs no software X448 provider.",
+           "configure": ["--disable-swdev", "--enable-cryptonly", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_CURVE448"]},
           {"name": "all",
-           "comment": "All seven ONLY_* macros at once: every supported software primitive is stripped and dispatched through cryptocb. Catches any cross-algorithm call that a single-strip entry would still resolve via the remaining software paths.",
-           "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_ECC -DWOLF_CRYPTO_CB_ONLY_RSA -DWOLF_CRYPTO_CB_ONLY_SHA256 -DWOLF_CRYPTO_CB_ONLY_SHA512 -DWOLF_CRYPTO_CB_ONLY_AES -DWOLF_CRYPTO_CB_ONLY_ED25519 -DWOLF_CRYPTO_CB_ONLY_CURVE25519"]}
+           "comment": "All eight ONLY_* macros at once: every supported software primitive is stripped and dispatched through cryptocb. Catches any cross-algorithm call that a single-strip entry would still resolve via the remaining software paths.",
+           "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_ECC -DWOLF_CRYPTO_CB_ONLY_RSA -DWOLF_CRYPTO_CB_ONLY_SHA256 -DWOLF_CRYPTO_CB_ONLY_SHA512 -DWOLF_CRYPTO_CB_ONLY_AES -DWOLF_CRYPTO_CB_ONLY_ED25519 -DWOLF_CRYPTO_CB_ONLY_CURVE25519 -DWOLF_CRYPTO_CB_ONLY_CURVE448"]}
           ]}
           EOF
           .github/scripts/parallel-make-check.py \

doc/dox_comments/header_files/curve448.h

@@ -158,6 +158,108 @@ int wc_curve448_shared_secret_ex(curve448_key* private_key,
 
 int wc_curve448_init(curve448_key* key);
 
+/*!
+    \ingroup Curve448
+    \brief This function initializes a Curve448 key with extended
+    parameters, allowing specification of custom heap and device ID
+    for hardware acceleration.
+
+    \return 0 On successfully initializing the key
+    \return BAD_FUNC_ARG If key is NULL
+
+    \param [in,out] key Pointer to the curve448_key structure to initialize.
+    \param [in] heap Pointer to heap hint for memory allocation (can be
+    NULL)
+    \param [in] devId Device ID for hardware acceleration (use
+    INVALID_DEVID for software only)
+
+    _Example_
+    \code
+    curve448_key key;
+    void* heap = NULL;
+    int devId = INVALID_DEVID;
+
+    int ret = wc_curve448_init_ex(&key, heap, devId);
+    if (ret != 0) {
+        // error initializing key
+    }
+    \endcode
+
+    \sa wc_curve448_init
+    \sa wc_curve448_free
+*/
+int wc_curve448_init_ex(curve448_key* key, void* heap, int devId);
+
+/*!
+    \ingroup Curve448
+    \brief This function allocates and initializes a new Curve448
+    key structure with extended parameters. The caller is responsible
+    for freeing the key with wc_curve448_delete. These New/Delete
+    functions are exposed to support allocation of the structure using
+    dynamic memory to provide better ABI compatibility.
+
+    \note This API is only available when WC_NO_CONSTRUCTORS is not defined.
+    WC_NO_CONSTRUCTORS is automatically defined when WOLFSSL_NO_MALLOC is
+    defined.
+
+    \return Pointer to newly allocated curve448_key on success
+    \return NULL on failure
+
+    \param [in] heap Pointer to heap hint for memory allocation (can be
+    NULL)
+    \param [in] devId Device ID for hardware acceleration (use
+    INVALID_DEVID for software only)
+    \param [out] result_code Pointer to store result code (0 on success)
+
+    _Example_
+    \code
+    int ret;
+    curve448_key* key;
+
+    key = wc_curve448_new(NULL, INVALID_DEVID, &ret);
+    if (key == NULL || ret != 0) {
+        // error allocating key
+    }
+    // use key
+    wc_curve448_delete(key, &key);
+    \endcode
+
+    \sa wc_curve448_delete
+    \sa wc_curve448_init_ex
+*/
+curve448_key* wc_curve448_new(void* heap, int devId, int* result_code);
+
+/*!
+    \ingroup Curve448
+    \brief This function frees a Curve448 key structure that was
+    allocated with wc_curve448_new and sets the pointer to NULL.
+    These New/Delete functions are exposed to support allocation of the
+    structure using dynamic memory to provide better ABI compatibility.
+
+    \note This API is only available when WC_NO_CONSTRUCTORS is not defined.
+    WC_NO_CONSTRUCTORS is automatically defined when WOLFSSL_NO_MALLOC is
+    defined.
+
+    \return 0 On successfully freeing the key
+    \return BAD_FUNC_ARG If key is NULL
+
+    \param [in,out] key Pointer to the curve448_key structure to free.
+    \param [out] key_p Pointer to the key pointer to set to NULL (can be
+    NULL)
+
+    _Example_
+    \code
+    int ret;
+    curve448_key* key = wc_curve448_new(NULL, INVALID_DEVID, &ret);
+    // use key
+    ret = wc_curve448_delete(key, &key);
+    \endcode
+
+    \sa wc_curve448_new
+    \sa wc_curve448_free
+*/
+int wc_curve448_delete(curve448_key* key, curve448_key** key_p);
+
 /*!
     \ingroup Curve448
 
@@ -802,3 +904,48 @@ int wc_curve448_size(curve448_key* key);
 */
 int wc_curve448_make_pub(int public_size, byte* pub, int private_size,
                          const byte* priv);
+
+/*!
+    \ingroup Curve448
+    \brief This function performs a generic Curve448 scalar
+    multiplication with a custom basepoint. This allows computing
+    scalar * basepoint for any basepoint, not just the standard
+    generator. As in wc_curve448_shared_secret_ex, an all-zero result
+    is rejected (RFC 7748 section 6.2); build with
+    WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK to get the raw scalar
+    multiplication result instead.
+
+    \return 0 On successfully computing the result
+    \return ECC_BAD_ARG_E If any input parameter is NULL or a size is
+    invalid
+    \return ECC_OUT_OF_RANGE_E If the result is all-zero, i.e. the
+    basepoint was of small order
+
+    \param public_size Size of the output buffer (must be 56)
+    \param pub Pointer to buffer to store the result
+    \param private_size Size of the scalar (must be 56)
+    \param priv Pointer to buffer containing the scalar
+    \param basepoint_size Size of the basepoint (must be 56)
+    \param basepoint Pointer to buffer containing the basepoint
+
+    _Example_
+    \code
+    byte scalar[CURVE448_KEY_SIZE];
+    byte basepoint[CURVE448_KEY_SIZE];
+    byte result[CURVE448_PUB_KEY_SIZE];
+
+    // initialize scalar and basepoint
+    int ret = wc_curve448_generic(sizeof(result), result,
+                                  sizeof(scalar), scalar,
+                                  sizeof(basepoint), basepoint);
+    if (ret != 0) {
+        // error computing result
+    }
+    \endcode
+
+    \sa wc_curve448_make_pub
+    \sa wc_curve448_shared_secret
+*/
+int wc_curve448_generic(int public_size, byte* pub, int private_size,
+                        const byte* priv, int basepoint_size,
+                        const byte* basepoint);

src/internal.c

@@ -9275,7 +9275,8 @@ int AllocKey(WOLFSSL* ssl, int type, void** pKey)
     #endif /* WOLFSSL_HAVE_SLHDSA */
     #ifdef HAVE_CURVE448
         case DYNAMIC_TYPE_CURVE448:
-            ret = wc_curve448_init((curve448_key*)*pKey);
+            ret = wc_curve448_init_ex((curve448_key*)*pKey, ssl->heap,
+                                      ssl->devId);
             if (ret == 0)
                 key_inited = 1;
             break;
@@ -9373,7 +9374,8 @@ static int ReuseKey(WOLFSSL* ssl, int type, void* pKey)
     #ifdef HAVE_CURVE448
         case DYNAMIC_TYPE_CURVE448:
             wc_curve448_free((curve448_key*)pKey);
-            ret = wc_curve448_init((curve448_key*)pKey);
+            ret = wc_curve448_init_ex((curve448_key*)pKey, ssl->heap,
+                                      ssl->devId);
             break;
     #endif /* HAVE_CURVE448 */
     #if defined(HAVE_FALCON)

src/sniffer.c

@@ -3006,7 +3006,7 @@ static int SetupKeys(const byte* input, int* sslBytes, SnifferSession* session,
                 ret = BUFFER_E;
             }
             if (ret == 0) {
-                ret = wc_curve448_init(&args->key->priv.x448);
+                ret = wc_curve448_init_ex(&args->key->priv.x448, NULL, devId);
                 if (ret == 0) {
                     args->key->type = WC_PK_TYPE_CURVE448;
                     args->key->initPriv = 1;

src/ssl_api_pk.c

@@ -2429,7 +2429,7 @@ static int DetectStaticEphemeralKeyType(const byte* keyBuf, unsigned int keySz,
         WC_ALLOC_VAR_EX(x448Key, curve448_key, 1, heap,
                         DYNAMIC_TYPE_CURVE448, ret = MEMORY_E);
         if (ret == 0) {
-            ret = wc_curve448_init(x448Key);
+            ret = wc_curve448_init_ex(x448Key, heap, INVALID_DEVID);
         }
         if (ret == 0) {
             ret = wc_Curve448PrivateKeyDecode(keyBuf, &idx, x448Key,

src/tls.c

@@ -8509,7 +8509,8 @@ static int TLSX_KeyShare_GenX448Key(WOLFSSL *ssl, KeyShareEntry* kse)
         }
 
         /* Make an Curve448 key. */
-        ret = wc_curve448_init((curve448_key*)kse->key);
+        ret = wc_curve448_init_ex((curve448_key*)kse->key, ssl->heap,
+                                  ssl->devId);
         if (ret == 0) {
             key = (curve448_key*)kse->key;
             kse->keyLen = CURVE448_KEY_SIZE;