[SparkiDev]

Description

Added WC_MODEXP_TIMING_RESISTANT to perform constant time operations at a finer level.
Improved code to mitigate some of the performance loss.

Fixes zd#22770

Testing

./configure
./configure --enable-sp-math-all=huge
./configure --enable-sp-math-all=huge CFLAGS=-DWC_MODEXP_TIMING_RESISTANT

[SparkiDev]

https://github.com/wolfSSL/scripts/pull/711

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text -28 B (-0.0%, 71,167 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text -16 B (-0.0%, 132,213 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +448 B (+0.2%, 182,739 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +512 B (+0.3%, 197,016 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +448 B (+0.1%, 802,628 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +512 B (+0.2%, 223,892 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +512 B (+0.2%, 313,936 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +384 B (+0.1%, 344,336 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +512 B (+0.2%, 250,658 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +512 B (+0.2%, 314,768 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +512 B (+0.2%, 250,658 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

• FLASH: .text +512 B (+0.2%, 205,420 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +36 B, text +11,680 B (+4.2%, 294,188 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Integer-promotion errors can corrupt results with 8- or 16-bit digits, while assembly-enabled huge builds retain secret-dependent timing despite timing-resistant hardening.

2 open issues

• Cast promoted digit subtraction before computing the nonzero mask · New
• Use constant-time backends for hardened Karatsuba multiplication and squaring · New

What changed in this PR

This PR adds optional finer-grained timing hardening to wolfCrypt’s SP integer modular exponentiation while refactoring arithmetic helpers to reduce overhead.

Changes:

• Introduces WC_MODEXP_TIMING_RESISTANT for fixed-length working values and constant-time Montgomery reduction.
• Adds a hardened base-2 exponentiation path and separates unclamped multiplication and squaring from public wrappers.
• Revises constant-time clamping and Montgomery subtraction.

File	Description
wolfcrypt/​src/​sp_int.c	Implements exponentiation hardening and refactors supporting arithmetic.
.wolfssl_known_macro_extras	Registers the new timing-resistance macro.

_{Review effort: Balanced}

[SparkiDev]

Jenkins: retest this please

[Copilot]

🟡 Changes recommended

The hardened exponentiation path bypasses sign bookkeeping with WOLFSSL_SP_INT_NEGATIVE, causing negative bases to produce incorrect results such as -9 instead of 9 when squared.

1 open issue

• Hardened exponentiation preserves incorrect negative result sign · New

2 resolved since last review

• Use constant-time backends for hardened Karatsuba multiplication and squaring
• Cast promoted digit subtraction before computing the nonzero mask

_{Review effort: Balanced}

[SparkiDev]

@claude review

[Copilot]

🔵 Needs a closer look

The cryptographic constant-time changes span C, architecture-specific assembly, and word sizes, requiring specialist review and target-level disassembly and timing validation beyond source inspection.

No open issues 🎉

1 resolved since last review

• Hardened exponentiation preserves incorrect negative result sign

_{Review effort: Balanced}

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[SparkiDev]

Rebased and fixed .wolfssl_known_macro_extras conflict.