[yosuke-wolfssl]

Problem

wc_ecc_gen_deterministic_k() keys every HMAC with hashType but sizes the RFC 6979 K/V state from the length of the digest being signed (VSz = KSz = hashSz). Nothing checks that the two agree, and wc_ecc_set_deterministic_ex() stores any hash type on the key.

Fix (wolfcrypt/src/ecc.c)

wc_ecc_gen_deterministic_k() returns BAD_FUNC_ARG when hashSz != wc_HashGetDigestSize(hashType). Through wc_ecc_sign_hash() the failure is reported as ECC_PRIV_KEY_E.

A mismatch is rejected rather than supported as the RFC 6979 §3.6 two-hash variant. This matches RSA-PSS and the ML-DSA/SLH-DSA pre-hash APIs, which already reject a digest whose length does not match the hash type.

The doxygen for wc_ecc_gen_deterministic_k() now documents the requirement and the BAD_FUNC_ARG return.

Closes f-17433.

Tests

New test_wc_ecc_deterministic_hash_type (P-256 key, runs on FIPS v7 and later):

hashType set	Digest	Expected
WC_HASH_TYPE_SHA256	32 bytes	0
WC_HASH_TYPE_SHA256	48 bytes	ECC_PRIV_KEY_E
WC_HASH_TYPE_SHA384	32 bytes	ECC_PRIV_KEY_E

Verification

• Without the fix, both mismatch cases return 0 and the test fails.
• --enable-ecc CPPFLAGS=-DWOLFSSL_ECDSA_DETERMINISTIC_K and --enable-all (variant): new test passes, ecc API group has 0 failures, testwolfcrypt passes including the RFC 6979 known-answer tests.
• GCC 13.3 on Ubuntu 24.04 builds cleanly under -Werror.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,664 B (+0.6%, 284,112 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Approval is blocked by an active critical portability issue in NO_HASH_WRAPPER builds, along with a configuration-specific test failure and incomplete public documentation.

3 open issues

• Avoid wc_HashGetDigestSize in NO_HASH_WRAPPER builds · New
• Exclude hardware and callback-only builds from the deterministic signing test · New
• Document the WC_HASH_TYPE_NONE hash-size inference exception · New

_{Review effort: Lite}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12060

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/ecc.h, tests/api/test_ecc.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[yosuke-wolfssl]

@claude review

[claude]

I reviewed this PR and didn't find any bugs. Because it changes the ECDSA deterministic-k (RFC 6979) path and is a deliberate behaviour change for callers, a human look is still worthwhile.

What was reviewed:

• The new wc_HmacSizeByType(hashType) != hashSz check in wc_ecc_gen_deterministic_k. It runs after the WC_HASH_TYPE_NONE mapping, so the default wc_ecc_set_deterministic path (32/48/64-byte digests) is unaffected.
• The existing direct callers: the KATs in wolfcrypt/test/test.c and tests/unit-mcdc/test_ecc_whitebox.c all pass a digest size that matches the hash type, so they keep passing.
• The trade-off: callers of wc_ecc_set_deterministic_ex that sign a digest of a different length (the RFC 6979 §3.6 two-hash variant) used to get signatures. Through wc_ecc_sign_hash they now get ECC_PRIV_KEY_E. The PR states this is intended. Whether it needs a release note is a maintainer call.
• I did not build or run anything, so the new test and the guard combinations were only checked by reading.

Extended reasoning...

The change adds one size check to wc_ecc_gen_deterministic_k in wolfcrypt/src/ecc.c, plus Doxygen updates and a new API test. It touches crypto code: ECDSA nonce generation. It tightens input validation and does not change how k is derived for inputs that are still accepted. I deferred because this is a crypto path and the change breaks callers that pair a hash type with a digest of a different length, which is a compatibility decision for maintainers. Earlier Copilot inline threads were resolved by the author after a follow-up commit, and nobody else has resolved them.