luna - wolfssl/tests/api/test

   1/* test_ecc.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/wolfcrypt/ecc.h>
  32#include <wolfssl/wolfcrypt/aes.h>
  33#include <wolfssl/wolfcrypt/types.h>
  34#include <tests/api/api.h>
  35#include <tests/api/test_ecc.h>
  36
  37int test_wc_ecc_get_curve_size_from_name(void)
  38{
  39    EXPECT_DECLS;
  40#ifdef HAVE_ECC
  41    #if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
  42        ExpectIntEQ(wc_ecc_get_curve_size_from_name("SECP256R1"), 32);
  43    #endif
  44    /* invalid case */
  45    ExpectIntEQ(wc_ecc_get_curve_size_from_name("BADCURVE"), -1);
  46    /* NULL input */
  47    ExpectIntEQ(wc_ecc_get_curve_size_from_name(NULL),
  48        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
  49#endif /* HAVE_ECC */
  50    return EXPECT_RESULT();
  51}
  52
  53int test_wc_ecc_get_curve_id_from_name(void)
  54{
  55    EXPECT_DECLS;
  56#ifdef HAVE_ECC
  57    #if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
  58        ExpectIntEQ(wc_ecc_get_curve_id_from_name("SECP256R1"),
  59            ECC_SECP256R1);
  60    #endif
  61    /* invalid case */
  62    ExpectIntEQ(wc_ecc_get_curve_id_from_name("BADCURVE"), -1);
  63    /* NULL input */
  64    ExpectIntEQ(wc_ecc_get_curve_id_from_name(NULL),
  65        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
  66#endif /* HAVE_ECC */
  67    return EXPECT_RESULT();
  68}
  69
  70int test_wc_ecc_get_curve_id_from_params(void)
  71{
  72    EXPECT_DECLS;
  73#ifdef HAVE_ECC
  74    const byte prime[] =
  75    {
  76        0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x01,
  77        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  78        0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,
  79        0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF
  80    };
  81
  82    const byte primeInvalid[] =
  83    {
  84        0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x01,
  85        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  86        0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,
  87        0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x01,0x01
  88    };
  89
  90    const byte Af[] =
  91    {
  92        0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x01,
  93        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  94        0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,
  95        0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFC
  96    };
  97
  98    const byte Bf[] =
  99    {
 100        0x5A,0xC6,0x35,0xD8,0xAA,0x3A,0x93,0xE7,
 101        0xB3,0xEB,0xBD,0x55,0x76,0x98,0x86,0xBC,
 102        0x65,0x1D,0x06,0xB0,0xCC,0x53,0xB0,0xF6,
 103        0x3B,0xCE,0x3C,0x3E,0x27,0xD2,0x60,0x4B
 104    };
 105
 106    const byte order[] =
 107    {
 108        0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,
 109        0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 110        0xBC,0xE6,0xFA,0xAD,0xA7,0x17,0x9E,0x84,
 111        0xF3,0xB9,0xCA,0xC2,0xFC,0x63,0x25,0x51
 112    };
 113
 114    const byte Gx[] =
 115    {
 116        0x6B,0x17,0xD1,0xF2,0xE1,0x2C,0x42,0x47,
 117        0xF8,0xBC,0xE6,0xE5,0x63,0xA4,0x40,0xF2,
 118        0x77,0x03,0x7D,0x81,0x2D,0xEB,0x33,0xA0,
 119        0xF4,0xA1,0x39,0x45,0xD8,0x98,0xC2,0x96
 120    };
 121
 122    const byte Gy[] =
 123    {
 124        0x4F,0xE3,0x42,0xE2,0xFE,0x1A,0x7F,0x9B,
 125        0x8E,0xE7,0xEB,0x4A,0x7C,0x0F,0x9E,0x16,
 126        0x2B,0xCE,0x33,0x57,0x6B,0x31,0x5E,0xCE,
 127        0xCB,0xB6,0x40,0x68,0x37,0xBF,0x51,0xF5
 128    };
 129
 130    int cofactor = 1;
 131    int fieldSize = 256;
 132
 133    #if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
 134        ExpectIntEQ(wc_ecc_get_curve_id_from_params(fieldSize,
 135            prime, sizeof(prime), Af, sizeof(Af), Bf, sizeof(Bf),
 136            order, sizeof(order), Gx, sizeof(Gx), Gy, sizeof(Gy), cofactor),
 137            ECC_SECP256R1);
 138    #endif
 139
 140    /* invalid case, fieldSize = 0 */
 141    ExpectIntEQ(wc_ecc_get_curve_id_from_params(0, prime, sizeof(prime),
 142        Af, sizeof(Af), Bf, sizeof(Bf), order, sizeof(order),
 143        Gx, sizeof(Gx), Gy, sizeof(Gy), cofactor), ECC_CURVE_INVALID);
 144
 145    /* invalid case, NULL prime */
 146    ExpectIntEQ(wc_ecc_get_curve_id_from_params(fieldSize, NULL, sizeof(prime),
 147        Af, sizeof(Af), Bf, sizeof(Bf), order, sizeof(order),
 148        Gx, sizeof(Gx), Gy, sizeof(Gy), cofactor),
 149        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 150
 151    /* invalid case, invalid prime */
 152    ExpectIntEQ(wc_ecc_get_curve_id_from_params(fieldSize,
 153        primeInvalid, sizeof(primeInvalid),
 154        Af, sizeof(Af), Bf, sizeof(Bf), order, sizeof(order),
 155        Gx, sizeof(Gx), Gy, sizeof(Gy), cofactor), ECC_CURVE_INVALID);
 156#endif
 157    return EXPECT_RESULT();
 158}
 159
 160int test_wc_ecc_get_curve_id_from_dp_params(void)
 161{
 162    EXPECT_DECLS;
 163#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC) && \
 164    !defined(HAVE_SELFTEST) && \
 165    !(defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION))
 166#if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
 167    ecc_key* key;
 168    const ecc_set_type* params = NULL;
 169    int ret;
 170#endif
 171    WOLFSSL_EC_KEY *ecKey = NULL;
 172
 173    #if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
 174        ExpectIntEQ(wc_ecc_get_curve_id_from_name("SECP256R1"), ECC_SECP256R1);
 175        ExpectNotNull(ecKey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
 176
 177        if (EXPECT_SUCCESS()) {
 178            ret = EC_KEY_generate_key(ecKey);
 179        } else
 180            ret = 0;
 181
 182        if (ret == 1) {
 183            /* normal test */
 184            key = (ecc_key*)ecKey->internal;
 185            if (key != NULL) {
 186                params = key->dp;
 187            }
 188
 189            ExpectIntEQ(wc_ecc_get_curve_id_from_dp_params(params),
 190                ECC_SECP256R1);
 191        }
 192    #endif
 193    /* invalid case, NULL input */
 194    ExpectIntEQ(wc_ecc_get_curve_id_from_dp_params(NULL),
 195        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 196
 197    wolfSSL_EC_KEY_free(ecKey);
 198#endif
 199    return EXPECT_RESULT();
 200}
 201
 202/*
 203 * Testing wc_ecc_make_key.
 204 */
 205int test_wc_ecc_make_key(void)
 206{
 207    EXPECT_DECLS;
 208#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
 209    ecc_key key;
 210    WC_RNG  rng;
 211    int     ret;
 212
 213    XMEMSET(&key, 0, sizeof(ecc_key));
 214    XMEMSET(&rng, 0, sizeof(WC_RNG));
 215
 216    ExpectIntEQ(wc_ecc_init(&key), 0);
 217    ExpectIntEQ(wc_InitRng(&rng), 0);
 218    ret = wc_ecc_make_key(&rng, KEY14, &key);
 219#if defined(WOLFSSL_ASYNC_CRYPT)
 220    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 221#endif
 222    ExpectIntEQ(ret, 0);
 223
 224    /* Pass in bad args. */
 225    ExpectIntEQ(wc_ecc_make_key(NULL, KEY14, &key),
 226        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 227    ExpectIntEQ(wc_ecc_make_key(&rng, KEY14, NULL),
 228        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 229
 230    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 231    wc_ecc_free(&key);
 232
 233#ifdef FP_ECC
 234    wc_ecc_fp_free();
 235#endif
 236#endif
 237    return EXPECT_RESULT();
 238} /* END test_wc_ecc_make_key */
 239
 240
 241/*
 242 * Testing wc_ecc_init()
 243 */
 244int test_wc_ecc_init(void)
 245{
 246    EXPECT_DECLS;
 247#ifdef HAVE_ECC
 248    ecc_key key;
 249
 250    XMEMSET(&key, 0, sizeof(ecc_key));
 251
 252    ExpectIntEQ(wc_ecc_init(&key), 0);
 253    /* Pass in bad args. */
 254    ExpectIntEQ(wc_ecc_init(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 255
 256    wc_ecc_free(&key);
 257#endif
 258    return EXPECT_RESULT();
 259} /* END test_wc_ecc_init */
 260
 261/*
 262 * Testing wc_ecc_check_key()
 263 */
 264int test_wc_ecc_check_key(void)
 265{
 266    EXPECT_DECLS;
 267#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
 268    ecc_key key;
 269    WC_RNG  rng;
 270    int     ret;
 271
 272    XMEMSET(&rng, 0, sizeof(rng));
 273    XMEMSET(&key, 0, sizeof(key));
 274
 275    ExpectIntEQ(wc_ecc_init(&key), 0);
 276    ExpectIntEQ(wc_InitRng(&rng), 0);
 277    ret = wc_ecc_make_key(&rng, KEY14, &key);
 278#if defined(WOLFSSL_ASYNC_CRYPT)
 279    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 280#endif
 281    ExpectIntEQ(ret, 0);
 282
 283    ExpectIntEQ(wc_ecc_check_key(&key), 0);
 284
 285    /* Pass in bad args. */
 286    ExpectIntEQ(wc_ecc_check_key(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 287
 288    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 289    wc_ecc_free(&key);
 290
 291#ifdef FP_ECC
 292    wc_ecc_fp_free();
 293#endif
 294#endif
 295    return EXPECT_RESULT();
 296} /* END test_wc_ecc_check_key */
 297
 298/*
 299 * Testing wc_ecc_get_generator()
 300 */
 301int test_wc_ecc_get_generator(void)
 302{
 303    EXPECT_DECLS;
 304#if defined(HAVE_ECC) && !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST) && \
 305    !defined(HAVE_FIPS) && defined(OPENSSL_EXTRA)
 306    ecc_point* pt = NULL;
 307
 308    ExpectNotNull(pt = wc_ecc_new_point());
 309
 310    ExpectIntEQ(wc_ecc_get_generator(pt, wc_ecc_get_curve_idx(ECC_SECP256R1)),
 311        MP_OKAY);
 312
 313    /* Test bad args. */
 314    /* Returns Zero for bad arg. */
 315    ExpectIntNE(wc_ecc_get_generator(pt, -1), MP_OKAY);
 316    ExpectIntNE(wc_ecc_get_generator(NULL, wc_ecc_get_curve_idx(ECC_SECP256R1)),
 317        MP_OKAY);
 318    /* If we ever get to 1000 curves increase this number */
 319    ExpectIntNE(wc_ecc_get_generator(pt, 1000), MP_OKAY);
 320    ExpectIntNE(wc_ecc_get_generator(NULL, -1), MP_OKAY);
 321
 322    wc_ecc_del_point(pt);
 323#endif
 324    return EXPECT_RESULT();
 325} /* END test_wc_ecc_get_generator */
 326
 327/*
 328 * Testing wc_ecc_size()
 329 */
 330int test_wc_ecc_size(void)
 331{
 332    EXPECT_DECLS;
 333#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
 334    WC_RNG      rng;
 335    ecc_key     key;
 336    int         ret;
 337
 338    XMEMSET(&key, 0, sizeof(ecc_key));
 339    XMEMSET(&rng, 0, sizeof(WC_RNG));
 340
 341    ExpectIntEQ(wc_ecc_init(&key), 0);
 342    ExpectIntEQ(wc_InitRng(&rng), 0);
 343    ret = wc_ecc_make_key(&rng, KEY14, &key);
 344#if defined(WOLFSSL_ASYNC_CRYPT)
 345    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 346#endif
 347    ExpectIntEQ(ret, 0);
 348
 349    ExpectIntEQ(wc_ecc_size(&key), KEY14);
 350    /* Test bad args. */
 351    /* Returns Zero for bad arg. */
 352    ExpectIntEQ(wc_ecc_size(NULL), 0);
 353
 354    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 355    wc_ecc_free(&key);
 356#endif
 357    return EXPECT_RESULT();
 358} /* END test_wc_ecc_size */
 359
 360int test_wc_ecc_params(void)
 361{
 362    EXPECT_DECLS;
 363    /* FIPS/CAVP self-test modules do not have `wc_ecc_get_curve_params`.
 364        It was added after certifications */
 365#if defined(HAVE_ECC) && !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
 366    const ecc_set_type* ecc_set = NULL;
 367#if !defined(NO_ECC256) && !defined(NO_ECC_SECP)
 368    /* Test for SECP256R1 curve */
 369    int curve_id = ECC_SECP256R1;
 370    int curve_idx = 0;
 371
 372    ExpectIntNE(curve_idx = wc_ecc_get_curve_idx(curve_id), ECC_CURVE_INVALID);
 373    ExpectNotNull(ecc_set = wc_ecc_get_curve_params(curve_idx));
 374    ExpectIntEQ(ecc_set->id, curve_id);
 375#endif
 376    /* Test case when SECP256R1 is not enabled */
 377    /* Test that we get curve params for index 0 */
 378    ExpectNotNull(ecc_set = wc_ecc_get_curve_params(0));
 379#endif /* HAVE_ECC && !HAVE_FIPS && !HAVE_SELFTEST */
 380    return EXPECT_RESULT();
 381}
 382
 383/*
 384 * Testing wc_ecc_sign_hash() and wc_ecc_verify_hash()
 385 */
 386int test_wc_ecc_signVerify_hash(void)
 387{
 388    EXPECT_DECLS;
 389#if defined(HAVE_ECC) && defined(HAVE_ECC_SIGN) && !defined(NO_ASN) && \
 390    !defined(WC_NO_RNG)
 391    ecc_key key;
 392    WC_RNG  rng;
 393    int     ret;
 394#ifdef HAVE_ECC_VERIFY
 395    int     verify = 0;
 396#endif
 397    word32  siglen = ECC_BUFSIZE;
 398    byte    sig[ECC_BUFSIZE];
 399    byte    adjustedSig[ECC_BUFSIZE+1];
 400    byte    digest[] = TEST_STRING;
 401    word32  digestlen = (word32)TEST_STRING_SZ;
 402
 403    /* Init stack var */
 404    XMEMSET(&key, 0, sizeof(ecc_key));
 405    XMEMSET(&rng, 0, sizeof(WC_RNG));
 406    XMEMSET(sig, 0, siglen);
 407    XMEMSET(adjustedSig, 0, ECC_BUFSIZE+1);
 408
 409    /* Init structs. */
 410    ExpectIntEQ(wc_ecc_init(&key), 0);
 411    ExpectIntEQ(wc_InitRng(&rng), 0);
 412    ret = wc_ecc_make_key(&rng, KEY14, &key);
 413#if defined(WOLFSSL_ASYNC_CRYPT)
 414    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 415#endif
 416    ExpectIntEQ(ret, 0);
 417
 418    ExpectIntEQ(wc_ecc_sign_hash(digest, digestlen, sig, &siglen, &rng, &key),
 419        0);
 420
 421    /* Check bad args. */
 422    ExpectIntEQ(wc_ecc_sign_hash(NULL, digestlen, sig, &siglen, &rng, &key),
 423        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 424    ExpectIntEQ(wc_ecc_sign_hash(digest, digestlen, NULL, &siglen, &rng, &key),
 425        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 426    ExpectIntEQ(wc_ecc_sign_hash(digest, digestlen, sig, NULL, &rng, &key),
 427        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 428    ExpectIntEQ(wc_ecc_sign_hash(digest, digestlen, sig, &siglen, NULL, &key),
 429        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 430    ExpectIntEQ(wc_ecc_sign_hash(digest, digestlen, sig, &siglen, &rng, NULL),
 431        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 432#if (!defined(HAVE_FIPS) || FIPS_VERSION_GT(7,0)) && !defined(HAVE_SELFTEST)
 433    ExpectIntEQ(wc_ecc_sign_hash(digest, WC_MAX_DIGEST_SIZE+1, sig, &siglen,
 434        &rng, &key), WC_NO_ERR_TRACE(BAD_LENGTH_E));
 435#endif
 436
 437#ifdef HAVE_ECC_VERIFY
 438    ExpectIntEQ(wc_ecc_verify_hash(sig, siglen, digest, digestlen, &verify,
 439        &key), 0);
 440    ExpectIntEQ(verify, 1);
 441
 442    /* test check on length of signature passed in */
 443    XMEMCPY(adjustedSig, sig, siglen);
 444    adjustedSig[1] = adjustedSig[1] + 1; /* add 1 to length for extra byte */
 445#ifndef NO_STRICT_ECDSA_LEN
 446    ExpectIntNE(wc_ecc_verify_hash(adjustedSig, siglen+1, digest, digestlen,
 447        &verify, &key), 0);
 448#else
 449    /* if NO_STRICT_ECDSA_LEN is set then extra bytes after the signature
 450     * is allowed */
 451    ExpectIntEQ(wc_ecc_verify_hash(adjustedSig, siglen+1, digest, digestlen,
 452        &verify, &key), 0);
 453#endif
 454
 455    /* Test bad args. */
 456    ExpectIntEQ(wc_ecc_verify_hash(NULL, siglen, digest, digestlen, &verify,
 457        &key), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 458    ExpectIntEQ(wc_ecc_verify_hash(sig, siglen, NULL, digestlen, &verify, &key),
 459        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 460    ExpectIntEQ(wc_ecc_verify_hash(sig, siglen, digest, digestlen, NULL, &key),
 461        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 462    ExpectIntEQ(wc_ecc_verify_hash(sig, siglen, digest, digestlen, &verify,
 463        NULL), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 464#if (!defined(HAVE_FIPS) || FIPS_VERSION_GT(7,0)) && !defined(HAVE_SELFTEST)
 465    ExpectIntEQ(wc_ecc_verify_hash(sig, siglen, digest, WC_MAX_DIGEST_SIZE+1,
 466        &verify, &key), WC_NO_ERR_TRACE(BAD_LENGTH_E));
 467#endif
 468#endif /* HAVE_ECC_VERIFY */
 469
 470    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 471    wc_ecc_free(&key);
 472
 473#ifdef FP_ECC
 474    wc_ecc_fp_free();
 475#endif
 476#endif
 477    return EXPECT_RESULT();
 478} /*  END test_wc_ecc_sign_hash */
 479
 480/*
 481 * Testing wc_ecc_shared_secret()
 482 */
 483int test_wc_ecc_shared_secret(void)
 484{
 485    EXPECT_DECLS;
 486#if defined(HAVE_ECC) && defined(HAVE_ECC_DHE) && !defined(WC_NO_RNG)
 487    ecc_key     key;
 488    ecc_key     pubKey;
 489    WC_RNG      rng;
 490#if defined(NO_ECC256)
 491    int         ret;
 492#endif
 493    byte        out[KEY32];
 494    int         keySz = sizeof(out);
 495    word32      outlen = (word32)sizeof(out);
 496
 497#if defined(HAVE_ECC) && !defined(NO_ECC256)
 498    const char* qx =
 499        "bb33ac4c27504ac64aa504c33cde9f36db722dce94ea2bfacb2009392c16e861";
 500    const char* qy =
 501        "02e9af4dd302939a315b9792217ff0cf18da9111023486e82058330b803489d8";
 502    const char* d  =
 503        "45b66902739c6c85a1385b72e8e8c7acc4038d533504fa6c28dc348de1a8098c";
 504    const char* curveName = "SECP256R1";
 505    const byte expected_shared_secret[] =
 506        {
 507            0x65, 0xc0, 0xd4, 0x61, 0x17, 0xe6, 0x09, 0x75,
 508            0xf0, 0x12, 0xa0, 0x4d, 0x0b, 0x41, 0x30, 0x7a,
 509            0x51, 0xf0, 0xb3, 0xaf, 0x23, 0x8f, 0x0f, 0xdf,
 510            0xf1, 0xff, 0x23, 0x64, 0x28, 0xca, 0xf8, 0x06
 511        };
 512#endif
 513
 514    PRIVATE_KEY_UNLOCK();
 515
 516    /* Initialize variables. */
 517    XMEMSET(&key, 0, sizeof(ecc_key));
 518    XMEMSET(&pubKey, 0, sizeof(ecc_key));
 519    XMEMSET(&rng, 0, sizeof(WC_RNG));
 520    XMEMSET(out, 0, keySz);
 521
 522    ExpectIntEQ(wc_ecc_init(&key), 0);
 523    ExpectIntEQ(wc_ecc_init(&pubKey), 0);
 524    ExpectIntEQ(wc_InitRng(&rng), 0);
 525
 526#if !defined(NO_ECC256)
 527    ExpectIntEQ(wc_ecc_import_raw(&key, qx, qy, d, curveName), 0);
 528    ExpectIntEQ(wc_ecc_import_raw(&pubKey, qx, qy, NULL, curveName), 0);
 529#else
 530    ret = wc_ecc_make_key(&rng, keySz, &key);
 531#if defined(WOLFSSL_ASYNC_CRYPT)
 532    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 533#endif
 534    ExpectIntEQ(ret, 0);
 535    ret = wc_ecc_make_key(&rng, keySz, &key);
 536#if defined(WOLFSSL_ASYNC_CRYPT)
 537    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 538#endif
 539    ExpectIntEQ(ret, 0);
 540#endif
 541
 542#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
 543    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
 544    !defined(HAVE_SELFTEST)
 545    ExpectIntEQ(wc_ecc_set_rng(&key, &rng), 0);
 546#endif
 547
 548    ExpectIntEQ(wc_ecc_shared_secret(&key, &pubKey, out, &outlen), 0);
 549
 550#if !defined(NO_ECC256)
 551    ExpectIntEQ(XMEMCMP(out, expected_shared_secret, outlen), 0);
 552#endif
 553
 554    /* Test bad args. */
 555    ExpectIntEQ(wc_ecc_shared_secret(NULL, &pubKey, out, &outlen),
 556        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 557    ExpectIntEQ(wc_ecc_shared_secret(&key, NULL, out, &outlen),
 558        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 559    ExpectIntEQ(wc_ecc_shared_secret(&key, &pubKey, NULL, &outlen),
 560        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 561    ExpectIntEQ(wc_ecc_shared_secret(&key, &pubKey, out, NULL),
 562        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 563    /* Invalid length */
 564    outlen = 1;
 565    ExpectIntEQ(wc_ecc_shared_secret(&key, &pubKey, out, &outlen),
 566        WC_NO_ERR_TRACE(BUFFER_E));
 567
 568    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 569    wc_ecc_free(&pubKey);
 570    wc_ecc_free(&key);
 571
 572#ifdef FP_ECC
 573    wc_ecc_fp_free();
 574#endif
 575
 576    PRIVATE_KEY_LOCK();
 577#endif
 578    return EXPECT_RESULT();
 579} /* END tests_wc_ecc_shared_secret */
 580
 581/*
 582 * testint wc_ecc_export_x963()
 583 */
 584int test_wc_ecc_export_x963(void)
 585{
 586    EXPECT_DECLS;
 587#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
 588    ecc_key key;
 589    WC_RNG  rng;
 590    byte    out[ECC_ASN963_MAX_BUF_SZ];
 591    word32  outlen = sizeof(out);
 592    int     ret;
 593
 594    PRIVATE_KEY_UNLOCK();
 595
 596    /* Initialize variables. */
 597    XMEMSET(&key, 0, sizeof(ecc_key));
 598    XMEMSET(&rng, 0, sizeof(WC_RNG));
 599    XMEMSET(out, 0, outlen);
 600
 601    ExpectIntEQ(wc_ecc_init(&key), 0);
 602    ExpectIntEQ(wc_InitRng(&rng), 0);
 603    ret = wc_ecc_make_key(&rng, KEY20, &key);
 604#if defined(WOLFSSL_ASYNC_CRYPT)
 605    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 606#endif
 607    ExpectIntEQ(ret, 0);
 608
 609    ExpectIntEQ(wc_ecc_export_x963(&key, out, &outlen), 0);
 610
 611    /* Test bad args. */
 612    ExpectIntEQ(wc_ecc_export_x963(NULL, out, &outlen),
 613        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 614    ExpectIntEQ(wc_ecc_export_x963(&key, NULL, &outlen),
 615        WC_NO_ERR_TRACE(LENGTH_ONLY_E));
 616    ExpectIntEQ(wc_ecc_export_x963(&key, out, NULL),
 617        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 618    key.idx = -4;
 619    ExpectIntEQ(wc_ecc_export_x963(&key, out, &outlen),
 620        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 621
 622    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 623    wc_ecc_free(&key);
 624
 625#ifdef FP_ECC
 626    wc_ecc_fp_free();
 627#endif
 628
 629    PRIVATE_KEY_LOCK();
 630#endif
 631    return EXPECT_RESULT();
 632} /* END test_wc_ecc_export_x963 */
 633
 634/*
 635 * Testing wc_ecc_export_x963_ex()
 636 * compile with --enable-compkey will use compression.
 637 */
 638int test_wc_ecc_export_x963_ex(void)
 639{
 640    EXPECT_DECLS;
 641#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
 642    ecc_key key;
 643    WC_RNG  rng;
 644    int     ret;
 645    byte    out[ECC_ASN963_MAX_BUF_SZ];
 646    word32  outlen = sizeof(out);
 647    #ifdef HAVE_COMP_KEY
 648        word32  badOutLen = 5;
 649    #endif
 650
 651    /* Init stack variables. */
 652    XMEMSET(&key, 0, sizeof(ecc_key));
 653    XMEMSET(&rng, 0, sizeof(WC_RNG));
 654    XMEMSET(out, 0, outlen);
 655    PRIVATE_KEY_UNLOCK();
 656
 657    ExpectIntEQ(wc_ecc_init(&key), 0);
 658    ExpectIntEQ(wc_InitRng(&rng), 0);
 659    ret = wc_ecc_make_key(&rng, KEY64, &key);
 660#if defined(WOLFSSL_ASYNC_CRYPT)
 661    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 662#endif
 663    ExpectIntEQ(ret, 0);
 664
 665#ifdef HAVE_COMP_KEY
 666    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &outlen, COMP), 0);
 667#else
 668    ExpectIntEQ(ret = wc_ecc_export_x963_ex(&key, out, &outlen, NOCOMP), 0);
 669#endif
 670
 671    /* Test bad args. */
 672#ifdef HAVE_COMP_KEY
 673    ExpectIntEQ(wc_ecc_export_x963_ex(NULL, out, &outlen, COMP),
 674        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 675    ExpectIntEQ(wc_ecc_export_x963_ex(&key, NULL, &outlen, COMP),
 676        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 677    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, NULL, COMP),
 678        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 679#if (defined(HAVE_FIPS) && (!defined(FIPS_VERSION_LT) || FIPS_VERSION_LT(5,3)))\
 680    || defined(HAVE_SELFTEST)
 681    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &badOutLen, COMP),
 682        WC_NO_ERR_TRACE(BUFFER_E));
 683#else
 684    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &badOutLen, COMP),
 685        WC_NO_ERR_TRACE(LENGTH_ONLY_E));
 686#endif
 687    key.idx = -4;
 688    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &outlen, COMP),
 689        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 690#else
 691    ExpectIntEQ(wc_ecc_export_x963_ex(NULL, out, &outlen, NOCOMP),
 692        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 693    ExpectIntEQ(wc_ecc_export_x963_ex(&key, NULL, &outlen, NOCOMP),
 694        WC_NO_ERR_TRACE(LENGTH_ONLY_E));
 695    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &outlen, 1),
 696        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
 697    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, NULL, NOCOMP),
 698        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 699    key.idx = -4;
 700    ExpectIntEQ(wc_ecc_export_x963_ex(&key, out, &outlen, NOCOMP),
 701        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 702#endif
 703    PRIVATE_KEY_LOCK();
 704
 705    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 706    wc_ecc_free(&key);
 707
 708#ifdef FP_ECC
 709    wc_ecc_fp_free();
 710#endif
 711#endif
 712    return EXPECT_RESULT();
 713} /* END test_wc_ecc_export_x963_ex */
 714
 715/*
 716 * testing wc_ecc_import_x963()
 717 */
 718int test_wc_ecc_import_x963(void)
 719{
 720    EXPECT_DECLS;
 721#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_IMPORT) && \
 722    defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
 723    ecc_key pubKey;
 724    ecc_key key;
 725    WC_RNG  rng;
 726    byte    x963[ECC_ASN963_MAX_BUF_SZ];
 727    word32  x963Len = (word32)sizeof(x963);
 728    int     ret;
 729
 730    /* Init stack variables. */
 731    XMEMSET(&key, 0, sizeof(ecc_key));
 732    XMEMSET(&pubKey, 0, sizeof(ecc_key));
 733    XMEMSET(&rng, 0, sizeof(WC_RNG));
 734    XMEMSET(x963, 0, x963Len);
 735
 736    ExpectIntEQ(wc_ecc_init(&pubKey), 0);
 737    ExpectIntEQ(wc_ecc_init(&key), 0);
 738    ExpectIntEQ(wc_InitRng(&rng), 0);
 739#if FIPS_VERSION3_GE(6,0,0)
 740    ret = wc_ecc_make_key(&rng, KEY32, &key);
 741#else
 742    ret = wc_ecc_make_key(&rng, KEY24, &key);
 743#endif
 744#if defined(WOLFSSL_ASYNC_CRYPT)
 745    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 746#endif
 747
 748    ExpectIntEQ(ret, 0);
 749
 750    PRIVATE_KEY_UNLOCK();
 751    ExpectIntEQ(wc_ecc_export_x963(&key, x963, &x963Len), 0);
 752    PRIVATE_KEY_LOCK();
 753
 754    ExpectIntEQ(wc_ecc_import_x963(x963, x963Len, &pubKey), 0);
 755
 756    /* Test bad args. */
 757    ExpectIntEQ(wc_ecc_import_x963(NULL, x963Len, &pubKey),
 758        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 759    ExpectIntEQ(wc_ecc_import_x963(x963, x963Len, NULL),
 760        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 761    ExpectIntEQ(wc_ecc_import_x963(x963, x963Len + 1, &pubKey),
 762        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 763
 764    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 765    wc_ecc_free(&key);
 766    wc_ecc_free(&pubKey);
 767
 768#ifdef FP_ECC
 769    wc_ecc_fp_free();
 770#endif
 771#endif
 772    return EXPECT_RESULT();
 773} /* END wc_ecc_import_x963 */
 774
 775/*
 776 * testing wc_ecc_import_x963() rejects an off-curve public point.
 777 *
 778 * Regression coverage for the invalid-curve attack: the legacy wrapper
 779 * wc_ecc_import_x963_ex (called by wc_ecc_import_x963()) must pass untrusted=1
 780 * to wc_ecc_import_x963_ex2 so that ECIES, PKCS#7 KARI, and EVP ECDH callers
 781 * validate that the imported point actually lies on the curve. Without that,
 782 * an attacker can feed a point from a weak twist and leak the victim's private
 783 * scalar modulo small primes (Biehl-Meyer-Mueller).
 784 */
 785int test_wc_ecc_import_x963_off_curve(void)
 786{
 787    EXPECT_DECLS;
 788/* point-on-curve validation inside wc_ecc_import_x963 is raw math stripped
 789 * by WOLF_CRYPTO_CB_ONLY_ECC; swdev cannot reach below the dispatch layer. */
 790#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_IMPORT) && \
 791    !defined(NO_ECC256) && !defined(NO_ECC_SECP) && \
 792    (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0)) && !defined(HAVE_SELFTEST) && \
 793    !defined(WOLF_CRYPTO_CB_ONLY_ECC)
 794    ecc_key pubKey;
 795    /* Uncompressed X9.63 P-256 point: 0x04 || Gx || Gy with the last byte
 796     * of Gy flipped by 1. Gx/Gy are the NIST P-256 generator coordinates;
 797     * modifying a single bit of Gy produces a point that is not on the
 798     * curve, so wc_ecc_import_x963 must reject it. */
 799    static const byte offCurveX963[] = {
 800        0x04,
 801        0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47,
 802        0xF8, 0xBC, 0xE6, 0xE5, 0x63, 0xA4, 0x40, 0xF2,
 803        0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB, 0x33, 0xA0,
 804        0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96,
 805        0x4F, 0xE3, 0x42, 0xE2, 0xFE, 0x1A, 0x7F, 0x9B,
 806        0x8E, 0xE7, 0xEB, 0x4A, 0x7C, 0x0F, 0x9E, 0x16,
 807        0x2B, 0xCE, 0x33, 0x57, 0x6B, 0x31, 0x5E, 0xCE,
 808        0xCB, 0xB6, 0x40, 0x68, 0x37, 0xBF, 0x51, 0xF4
 809    };
 810
 811    XMEMSET(&pubKey, 0, sizeof(ecc_key));
 812
 813    ExpectIntEQ(wc_ecc_init(&pubKey), 0);
 814
 815    /* Importing an off-curve point must fail. wc_ecc_import_x963() calls
 816     * wc_ecc_import_x963_ex() which ultimately calls wc_ecc_import_x963_ex2()
 817     * with the required untrusted=1 flag. */
 818    ExpectIntNE(wc_ecc_import_x963(offCurveX963, (word32)sizeof(offCurveX963),
 819                                   &pubKey), 0);
 820
 821    wc_ecc_free(&pubKey);
 822
 823#ifdef FP_ECC
 824    wc_ecc_fp_free();
 825#endif
 826#endif
 827    return EXPECT_RESULT();
 828} /* END test_wc_ecc_import_x963_off_curve */
 829
 830/*
 831 * testing wc_ecc_import_private_key()
 832 */
 833int test_wc_ecc_import_private_key(void)
 834{
 835    EXPECT_DECLS;
 836#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_IMPORT) && \
 837    defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
 838    ecc_key key;
 839    ecc_key keyImp;
 840    WC_RNG  rng;
 841    byte    privKey[ECC_PRIV_KEY_BUF]; /* Raw private key.*/
 842    byte    x963Key[ECC_ASN963_MAX_BUF_SZ];
 843    word32  privKeySz = (word32)sizeof(privKey);
 844    word32  x963KeySz = (word32)sizeof(x963Key);
 845    int     ret;
 846
 847    /* Init stack variables. */
 848    XMEMSET(&key, 0, sizeof(ecc_key));
 849    XMEMSET(&keyImp, 0, sizeof(ecc_key));
 850    XMEMSET(&rng, 0, sizeof(WC_RNG));
 851    XMEMSET(privKey, 0, privKeySz);
 852    XMEMSET(x963Key, 0, x963KeySz);
 853    PRIVATE_KEY_UNLOCK();
 854
 855    ExpectIntEQ(wc_ecc_init(&key), 0);
 856    ExpectIntEQ(wc_ecc_init(&keyImp), 0);
 857    ExpectIntEQ(wc_InitRng(&rng), 0);
 858    ret = wc_ecc_make_key(&rng, KEY48, &key);
 859#if defined(WOLFSSL_ASYNC_CRYPT)
 860    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 861#endif
 862    ExpectIntEQ(ret, 0);
 863
 864    PRIVATE_KEY_UNLOCK();
 865    ExpectIntEQ(wc_ecc_export_x963(&key, x963Key, &x963KeySz), 0);
 866    PRIVATE_KEY_LOCK();
 867    ExpectIntEQ(wc_ecc_export_private_only(&key, privKey, &privKeySz), 0);
 868
 869    ExpectIntEQ(wc_ecc_import_private_key(privKey, privKeySz, x963Key,
 870        x963KeySz, &keyImp), 0);
 871    /* Pass in bad args. */
 872    ExpectIntEQ(wc_ecc_import_private_key(privKey, privKeySz, x963Key,
 873        x963KeySz, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 874    ExpectIntEQ(wc_ecc_import_private_key(NULL, privKeySz, x963Key, x963KeySz,
 875        &keyImp), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 876    PRIVATE_KEY_LOCK();
 877
 878    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 879    wc_ecc_free(&keyImp);
 880    wc_ecc_free(&key);
 881
 882#ifdef FP_ECC
 883    wc_ecc_fp_free();
 884#endif
 885#endif
 886    return EXPECT_RESULT();
 887} /* END test_wc_ecc_import_private_key */
 888
 889/*
 890 * Testing wc_ecc_export_private_only()
 891 */
 892int test_wc_ecc_export_private_only(void)
 893{
 894    EXPECT_DECLS;
 895#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
 896    ecc_key key;
 897    WC_RNG  rng;
 898    byte    out[ECC_PRIV_KEY_BUF];
 899    word32  outlen = sizeof(out);
 900    int     ret;
 901
 902    /* Init stack variables. */
 903    XMEMSET(&key, 0, sizeof(ecc_key));
 904    XMEMSET(&rng, 0, sizeof(WC_RNG));
 905    XMEMSET(out, 0, outlen);
 906    PRIVATE_KEY_UNLOCK();
 907
 908    ExpectIntEQ(wc_ecc_init(&key), 0);
 909    ExpectIntEQ(wc_InitRng(&rng), 0);
 910    ret = wc_ecc_make_key(&rng, KEY32, &key);
 911#if defined(WOLFSSL_ASYNC_CRYPT)
 912    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
 913#endif
 914    ExpectIntEQ(ret, 0);
 915
 916    ExpectIntEQ(wc_ecc_export_private_only(&key, out, &outlen), 0);
 917    /* Pass in bad args. */
 918    ExpectIntEQ(wc_ecc_export_private_only(NULL, out, &outlen),
 919        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 920    ExpectIntEQ(wc_ecc_export_private_only(&key, NULL, &outlen),
 921        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 922    ExpectIntEQ(wc_ecc_export_private_only(&key, out, NULL),
 923        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 924    PRIVATE_KEY_LOCK();
 925
 926    DoExpectIntEQ(wc_FreeRng(&rng), 0);
 927    wc_ecc_free(&key);
 928
 929#ifdef FP_ECC
 930    wc_ecc_fp_free();
 931#endif
 932#endif
 933    return EXPECT_RESULT();
 934} /* END test_wc_ecc_export_private_only */
 935
 936/*
 937 * Testing wc_ecc_rs_to_sig()
 938 */
 939int test_wc_ecc_rs_to_sig(void)
 940{
 941    EXPECT_DECLS;
 942#if defined(HAVE_ECC) && !defined(NO_ASN)
 943    /* first [P-192,SHA-1] vector from FIPS 186-3 NIST vectors */
 944    const char* R = "6994d962bdd0d793ffddf855ec5bf2f91a9698b46258a63e";
 945    const char* S = "02ba6465a234903744ab02bc8521405b73cf5fc00e1a9f41";
 946    const char* zeroStr = "0";
 947    byte        sig[ECC_MAX_SIG_SIZE];
 948    word32      siglen = (word32)sizeof(sig);
 949    /* R and S max size is the order of curve. 2^192.*/
 950    int         keySz = KEY24;
 951    byte        r[KEY24];
 952    byte        s[KEY24];
 953    word32      rlen = (word32)sizeof(r);
 954    word32      slen = (word32)sizeof(s);
 955#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
 956    word32      zeroLen = 0;
 957#endif
 958
 959    /* Init stack variables. */
 960    XMEMSET(sig, 0, ECC_MAX_SIG_SIZE);
 961    XMEMSET(r, 0, keySz);
 962    XMEMSET(s, 0, keySz);
 963
 964    ExpectIntEQ(wc_ecc_rs_to_sig(R, S, sig, &siglen), 0);
 965    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, &rlen, s, &slen), 0);
 966    /* Test bad args. */
 967    ExpectIntEQ(wc_ecc_rs_to_sig(NULL, S, sig, &siglen),
 968        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 969    ExpectIntEQ(wc_ecc_rs_to_sig(R, NULL, sig, &siglen),
 970        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 971    ExpectIntEQ(wc_ecc_rs_to_sig(R, S, sig, NULL),
 972        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 973    ExpectIntEQ(wc_ecc_rs_to_sig(R, S, NULL, &siglen),
 974        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 975    ExpectIntEQ(wc_ecc_rs_to_sig(R, zeroStr, sig, &siglen),
 976        WC_NO_ERR_TRACE(MP_ZERO_E));
 977    ExpectIntEQ(wc_ecc_rs_to_sig(zeroStr, S, sig, &siglen),
 978        WC_NO_ERR_TRACE(MP_ZERO_E));
 979    ExpectIntEQ(wc_ecc_sig_to_rs(NULL, siglen, r, &rlen, s, &slen),
 980        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 981    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, NULL, &rlen, s, &slen),
 982        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 983    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, NULL, s, &slen),
 984        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 985    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, &rlen, NULL, &slen),
 986        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 987    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, &rlen, s, NULL),
 988        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
 989#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
 990    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, &zeroLen, s, &slen),
 991        WC_NO_ERR_TRACE(BUFFER_E));
 992    ExpectIntEQ(wc_ecc_sig_to_rs(sig, siglen, r, &rlen, s, &zeroLen),
 993        WC_NO_ERR_TRACE(BUFFER_E));
 994#endif
 995#endif
 996    return EXPECT_RESULT();
 997} /* END test_wc_ecc_rs_to_sig */
 998
 999int test_wc_ecc_import_raw(void)
1000{
1001    EXPECT_DECLS;
1002#if defined(HAVE_ECC) && !defined(NO_ECC256)
1003    ecc_key     key;
1004    const char* qx =
1005        "bb33ac4c27504ac64aa504c33cde9f36db722dce94ea2bfacb2009392c16e861";
1006    const char* qy =
1007        "02e9af4dd302939a315b9792217ff0cf18da9111023486e82058330b803489d8";
1008    const char* d  =
1009        "45b66902739c6c85a1385b72e8e8c7acc4038d533504fa6c28dc348de1a8098c";
1010    const char* curveName = "SECP256R1";
1011#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1012    const char* kNullStr = "";
1013    int ret;
1014#endif
1015
1016    XMEMSET(&key, 0, sizeof(ecc_key));
1017
1018    ExpectIntEQ(wc_ecc_init(&key), 0);
1019
1020    /* Test good import */
1021    ExpectIntEQ(wc_ecc_import_raw(&key, qx, qy, d, curveName), 0);
1022
1023    /* Test bad args. */
1024    ExpectIntEQ(wc_ecc_import_raw(NULL, qx, qy, d, curveName),
1025        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1026    ExpectIntEQ(wc_ecc_import_raw(&key, NULL, qy, d, curveName),
1027        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1028    ExpectIntEQ(wc_ecc_import_raw(&key, qx, NULL, d, curveName),
1029        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1030    ExpectIntEQ(wc_ecc_import_raw(&key, qx, qy, d, NULL),
1031        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1032#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1033    #if !defined(USE_FAST_MATH) && !defined(WOLFSSL_SP_MATH)
1034        wc_ecc_free(&key);
1035    #endif
1036    ExpectIntLT(ret = wc_ecc_import_raw(&key, kNullStr, kNullStr, kNullStr,
1037        curveName), 0);
1038    ExpectTrue((ret == WC_NO_ERR_TRACE(ECC_INF_E)) ||
1039               (ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG)));
1040#endif
1041#if !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
1042    #if !defined(USE_FAST_MATH) && !defined(WOLFSSL_SP_MATH)
1043        wc_ecc_free(&key);
1044    #endif
1045#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1046    ExpectIntLT(ret = wc_ecc_import_raw(&key, "0", qy, d, curveName), 0);
1047    ExpectTrue((ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG)) ||
1048               (ret == WC_NO_ERR_TRACE(MP_VAL)));
1049#else
1050    ExpectIntEQ(wc_ecc_import_raw(&key, "0", qy, d, curveName), 0);
1051#endif
1052    #if !defined(USE_FAST_MATH) && !defined(WOLFSSL_SP_MATH)
1053        wc_ecc_free(&key);
1054    #endif
1055#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1056    ExpectIntLT(ret = wc_ecc_import_raw(&key, qx, "0", d, curveName), 0);
1057    ExpectTrue((ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG)) ||
1058               (ret == WC_NO_ERR_TRACE(MP_VAL)));
1059#else
1060    ExpectIntEQ(wc_ecc_import_raw(&key, qx, "0", d, curveName), 0);
1061#endif
1062    #if !defined(USE_FAST_MATH) && !defined(WOLFSSL_SP_MATH)
1063        wc_ecc_free(&key);
1064    #endif
1065    ExpectIntEQ(wc_ecc_import_raw(&key, "0", "0", d, curveName),
1066        WC_NO_ERR_TRACE(ECC_INF_E));
1067#endif
1068
1069    wc_ecc_free(&key);
1070#endif
1071    return EXPECT_RESULT();
1072} /* END test_wc_ecc_import_raw */
1073
1074int test_wc_ecc_import_unsigned(void)
1075{
1076    EXPECT_DECLS;
1077#if defined(HAVE_ECC) && !defined(NO_ECC256) && !defined(HAVE_SELFTEST) && \
1078    (!defined(HAVE_FIPS) || (defined(HAVE_FIPS_VERSION) && \
1079     HAVE_FIPS_VERSION >= 2))
1080    ecc_key    key;
1081    const byte qx[] = {
1082        0xbb, 0x33, 0xac, 0x4c, 0x27, 0x50, 0x4a, 0xc6,
1083        0x4a, 0xa5, 0x04, 0xc3, 0x3c, 0xde, 0x9f, 0x36,
1084        0xdb, 0x72, 0x2d, 0xce, 0x94, 0xea, 0x2b, 0xfa,
1085        0xcb, 0x20, 0x09, 0x39, 0x2c, 0x16, 0xe8, 0x61
1086    };
1087    const byte qy[] = {
1088        0x02, 0xe9, 0xaf, 0x4d, 0xd3, 0x02, 0x93, 0x9a,
1089        0x31, 0x5b, 0x97, 0x92, 0x21, 0x7f, 0xf0, 0xcf,
1090        0x18, 0xda, 0x91, 0x11, 0x02, 0x34, 0x86, 0xe8,
1091        0x20, 0x58, 0x33, 0x0b, 0x80, 0x34, 0x89, 0xd8
1092    };
1093    const byte d[] = {
1094        0x45, 0xb6, 0x69, 0x02, 0x73, 0x9c, 0x6c, 0x85,
1095        0xa1, 0x38, 0x5b, 0x72, 0xe8, 0xe8, 0xc7, 0xac,
1096        0xc4, 0x03, 0x8d, 0x53, 0x35, 0x04, 0xfa, 0x6c,
1097        0x28, 0xdc, 0x34, 0x8d, 0xe1, 0xa8, 0x09, 0x8c
1098    };
1099#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1100    const byte nullBytes[32] = {0};
1101    int ret;
1102#endif
1103    int        curveId = ECC_SECP256R1;
1104
1105    XMEMSET(&key, 0, sizeof(ecc_key));
1106
1107    ExpectIntEQ(wc_ecc_init(&key), 0);
1108
1109    ExpectIntEQ(wc_ecc_import_unsigned(&key, (byte*)qx, (byte*)qy, (byte*)d,
1110        curveId), 0);
1111    /* Test bad args. */
1112    ExpectIntEQ(wc_ecc_import_unsigned(NULL, (byte*)qx, (byte*)qy, (byte*)d,
1113        curveId), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1114    ExpectIntEQ(wc_ecc_import_unsigned(&key, NULL, (byte*)qy, (byte*)d,
1115        curveId), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1116    ExpectIntEQ(wc_ecc_import_unsigned(&key, (byte*)qx, NULL, (byte*)d,
1117        curveId), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1118    ExpectIntEQ(wc_ecc_import_unsigned(&key, (byte*)qx, (byte*)qy, (byte*)d,
1119        ECC_CURVE_INVALID), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1120#ifdef WOLFSSL_VALIDATE_ECC_IMPORT
1121    ExpectIntLT(ret = wc_ecc_import_unsigned(&key, (byte*)nullBytes,
1122        (byte*)nullBytes, (byte*)nullBytes, curveId), 0);
1123    ExpectTrue((ret == WC_NO_ERR_TRACE(ECC_INF_E)) ||
1124               (ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG)));
1125#endif
1126
1127    wc_ecc_free(&key);
1128#endif
1129    return EXPECT_RESULT();
1130} /* END test_wc_ecc_import_unsigned */
1131
1132/*
1133 * Testing wc_ecc_sig_size()
1134 */
1135int test_wc_ecc_sig_size(void)
1136{
1137    EXPECT_DECLS;
1138#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
1139    ecc_key key;
1140    WC_RNG  rng;
1141    int     keySz = KEY16;
1142    int     ret;
1143
1144    XMEMSET(&rng, 0, sizeof(rng));
1145    XMEMSET(&key, 0, sizeof(key));
1146
1147    ExpectIntEQ(wc_ecc_init(&key), 0);
1148    ExpectIntEQ(wc_InitRng(&rng), 0);
1149    ret = wc_ecc_make_key(&rng, keySz, &key);
1150#if defined(WOLFSSL_ASYNC_CRYPT)
1151    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1152#endif
1153    ExpectIntEQ(ret, 0);
1154
1155    ExpectIntLE(wc_ecc_sig_size(&key),
1156         (2 * keySz + SIG_HEADER_SZ + ECC_MAX_PAD_SZ));
1157
1158    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1159    wc_ecc_free(&key);
1160#endif
1161    return EXPECT_RESULT();
1162} /* END test_wc_ecc_sig_size */
1163
1164/*
1165 * Testing wc_ecc_ctx_new()
1166 */
1167int test_wc_ecc_ctx_new(void)
1168{
1169    EXPECT_DECLS;
1170#if defined(HAVE_ECC) && defined(HAVE_ECC_ENCRYPT) && !defined(WC_NO_RNG)
1171    WC_RNG    rng;
1172    ecEncCtx* cli = NULL;
1173    ecEncCtx* srv = NULL;
1174
1175    XMEMSET(&rng, 0, sizeof(WC_RNG));
1176
1177    ExpectIntEQ(wc_InitRng(&rng), 0);
1178    ExpectNotNull(cli = wc_ecc_ctx_new(REQ_RESP_CLIENT, &rng));
1179    ExpectNotNull(srv = wc_ecc_ctx_new(REQ_RESP_SERVER, &rng));
1180    wc_ecc_ctx_free(cli);
1181    cli = NULL;
1182    wc_ecc_ctx_free(srv);
1183
1184    /* Test bad args. */
1185    /* wc_ecc_ctx_new_ex() will free if returned NULL. */
1186    ExpectNull(cli = wc_ecc_ctx_new(0, &rng));
1187    ExpectNull(cli = wc_ecc_ctx_new(REQ_RESP_CLIENT, NULL));
1188
1189    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1190    wc_ecc_ctx_free(cli);
1191#endif
1192    return EXPECT_RESULT();
1193} /* END test_wc_ecc_ctx_new */
1194
1195/*
1196 * Tesing wc_ecc_reset()
1197 */
1198int test_wc_ecc_ctx_reset(void)
1199{
1200    EXPECT_DECLS;
1201#if defined(HAVE_ECC) && defined(HAVE_ECC_ENCRYPT) && !defined(WC_NO_RNG)
1202    ecEncCtx* ctx = NULL;
1203    WC_RNG    rng;
1204
1205    XMEMSET(&rng, 0, sizeof(rng));
1206
1207    ExpectIntEQ(wc_InitRng(&rng), 0);
1208    ExpectNotNull(ctx = wc_ecc_ctx_new(REQ_RESP_CLIENT, &rng));
1209
1210    ExpectIntEQ(wc_ecc_ctx_reset(ctx, &rng), 0);
1211
1212    /* Pass in bad args. */
1213    ExpectIntEQ(wc_ecc_ctx_reset(NULL, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1214    ExpectIntEQ(wc_ecc_ctx_reset(ctx, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1215
1216    wc_ecc_ctx_free(ctx);
1217    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1218#endif
1219    return EXPECT_RESULT();
1220} /* END test_wc_ecc_ctx_reset */
1221
1222/*
1223 * Testing wc_ecc_ctx_set_peer_salt() and wc_ecc_ctx_get_own_salt()
1224 */
1225int test_wc_ecc_ctx_set_peer_salt(void)
1226{
1227    EXPECT_DECLS;
1228#if defined(HAVE_ECC) && defined(HAVE_ECC_ENCRYPT) && !defined(WC_NO_RNG)
1229    WC_RNG      rng;
1230    ecEncCtx*   cliCtx      = NULL;
1231    ecEncCtx*   servCtx     = NULL;
1232    const byte* cliSalt     = NULL;
1233    const byte* servSalt    = NULL;
1234
1235    XMEMSET(&rng, 0, sizeof(rng));
1236
1237    ExpectIntEQ(wc_InitRng(&rng), 0);
1238    ExpectNotNull(cliCtx = wc_ecc_ctx_new(REQ_RESP_CLIENT, &rng));
1239    ExpectNotNull(servCtx = wc_ecc_ctx_new(REQ_RESP_SERVER, &rng));
1240
1241    /* Test bad args. */
1242    ExpectNull(cliSalt = wc_ecc_ctx_get_own_salt(NULL));
1243
1244    ExpectNotNull(cliSalt = wc_ecc_ctx_get_own_salt(cliCtx));
1245    ExpectNotNull(servSalt = wc_ecc_ctx_get_own_salt(servCtx));
1246
1247    ExpectIntEQ(wc_ecc_ctx_set_peer_salt(cliCtx, servSalt), 0);
1248    /* Test bad args. */
1249    ExpectIntEQ(wc_ecc_ctx_set_peer_salt(NULL, servSalt),
1250        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1251    ExpectIntEQ(wc_ecc_ctx_set_peer_salt(cliCtx, NULL),
1252        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1253
1254    wc_ecc_ctx_free(cliCtx);
1255    wc_ecc_ctx_free(servCtx);
1256    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1257#endif
1258    return EXPECT_RESULT();
1259
1260} /* END test_wc_ecc_ctx_set_peer_salt */
1261
1262/*
1263 * Testing wc_ecc_ctx_set_info()
1264 */
1265int test_wc_ecc_ctx_set_info(void)
1266{
1267    EXPECT_DECLS;
1268#if defined(HAVE_ECC) && defined(HAVE_ECC_ENCRYPT) && !defined(WC_NO_RNG)
1269    ecEncCtx*   ctx = NULL;
1270    WC_RNG      rng;
1271    const char* optInfo = "Optional Test Info.";
1272    int         optInfoSz = (int)XSTRLEN(optInfo);
1273    const char* badOptInfo = NULL;
1274
1275    XMEMSET(&rng, 0, sizeof(rng));
1276
1277    ExpectIntEQ(wc_InitRng(&rng), 0);
1278    ExpectNotNull(ctx = wc_ecc_ctx_new(REQ_RESP_CLIENT, &rng));
1279
1280    ExpectIntEQ(wc_ecc_ctx_set_info(ctx, (byte*)optInfo, optInfoSz), 0);
1281    /* Test bad args. */
1282    ExpectIntEQ(wc_ecc_ctx_set_info(NULL, (byte*)optInfo, optInfoSz),
1283        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1284    ExpectIntEQ(wc_ecc_ctx_set_info(ctx, (byte*)badOptInfo, optInfoSz),
1285        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1286    ExpectIntEQ(wc_ecc_ctx_set_info(ctx, (byte*)optInfo, -1),
1287        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1288
1289    wc_ecc_ctx_free(ctx);
1290    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1291#endif
1292    return EXPECT_RESULT();
1293} /* END test_wc_ecc_ctx_set_info */
1294
1295/*
1296 * Testing wc_ecc_encrypt() and wc_ecc_decrypt()
1297 */
1298int test_wc_ecc_encryptDecrypt(void)
1299{
1300    EXPECT_DECLS;
1301#if defined(HAVE_ECC) && defined(HAVE_ECC_ENCRYPT) && !defined(WC_NO_RNG) && \
1302    defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128)
1303    ecc_key     srvKey;
1304    ecc_key     cliKey;
1305    ecc_key     tmpKey;
1306    WC_RNG      rng;
1307    int         ret;
1308    const char* msg   = "EccBlock Size 16";
1309    word32      msgSz = (word32)XSTRLEN("EccBlock Size 16");
1310#ifdef WOLFSSL_ECIES_OLD
1311    byte        out[(sizeof("EccBlock Size 16") - 1) + WC_SHA256_DIGEST_SIZE];
1312#elif defined(WOLFSSL_ECIES_GEN_IV)
1313    byte        out[KEY20 * 2 + 1 + AES_BLOCK_SIZE +
1314                    (sizeof("EccBlock Size 16") - 1) + WC_SHA256_DIGEST_SIZE];
1315#else
1316    byte        out[KEY20 * 2 + 1 + (sizeof("EccBlock Size 16") - 1) +
1317                    WC_SHA256_DIGEST_SIZE];
1318#endif
1319    word32      outSz = (word32)sizeof(out);
1320    byte        plain[sizeof("EccBlock Size 16")];
1321    word32      plainSz = (word32)sizeof(plain);
1322    int         keySz = KEY20;
1323
1324    /* Init stack variables. */
1325    XMEMSET(out, 0, outSz);
1326    XMEMSET(plain, 0, plainSz);
1327    XMEMSET(&rng, 0, sizeof(rng));
1328    XMEMSET(&srvKey, 0, sizeof(ecc_key));
1329    XMEMSET(&cliKey, 0, sizeof(ecc_key));
1330    XMEMSET(&tmpKey, 0, sizeof(ecc_key));
1331
1332    ExpectIntEQ(wc_InitRng(&rng), 0);
1333    ExpectIntEQ(wc_ecc_init(&cliKey), 0);
1334    ret = wc_ecc_make_key(&rng, keySz, &cliKey);
1335#if defined(WOLFSSL_ASYNC_CRYPT)
1336    ret = wc_AsyncWait(ret, &cliKey.asyncDev, WC_ASYNC_FLAG_NONE);
1337#endif
1338    ExpectIntEQ(ret, 0);
1339
1340    ExpectIntEQ(wc_ecc_init(&srvKey), 0);
1341    ret = wc_ecc_make_key(&rng, keySz, &srvKey);
1342#if defined(WOLFSSL_ASYNC_CRYPT)
1343    ret = wc_AsyncWait(ret, &srvKey.asyncDev, WC_ASYNC_FLAG_NONE);
1344#endif
1345    ExpectIntEQ(ret, 0);
1346
1347    ExpectIntEQ(wc_ecc_init(&tmpKey), 0);
1348
1349#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
1350    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
1351    !defined(HAVE_SELFTEST)
1352    ExpectIntEQ(wc_ecc_set_rng(&srvKey, &rng), 0);
1353    ExpectIntEQ(wc_ecc_set_rng(&cliKey, &rng), 0);
1354#endif
1355
1356    ExpectIntEQ(wc_ecc_encrypt(&cliKey, &srvKey, (byte*)msg, msgSz, out,
1357        &outSz, NULL), 0);
1358    /* Test bad args. */
1359    ExpectIntEQ(wc_ecc_encrypt(NULL, &srvKey, (byte*)msg, msgSz, out, &outSz,
1360        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1361    ExpectIntEQ(wc_ecc_encrypt(&cliKey, NULL, (byte*)msg, msgSz, out, &outSz,
1362        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1363    ExpectIntEQ(wc_ecc_encrypt(&cliKey, &srvKey, NULL, msgSz, out, &outSz,
1364        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1365    ExpectIntEQ(wc_ecc_encrypt(&cliKey, &srvKey, (byte*)msg, msgSz, NULL,
1366        &outSz, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1367    ExpectIntEQ(wc_ecc_encrypt(&cliKey, &srvKey, (byte*)msg, msgSz, out, NULL,
1368        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1369
1370#ifdef WOLFSSL_ECIES_OLD
1371    tmpKey.dp = cliKey.dp;
1372    tmpKey.idx = cliKey.idx;
1373    ExpectIntEQ(wc_ecc_copy_point(&cliKey.pubkey, &tmpKey.pubkey), 0);
1374#endif
1375
1376    ExpectIntEQ(wc_ecc_decrypt(&srvKey, &tmpKey, out, outSz, plain, &plainSz,
1377         NULL), 0);
1378    ExpectIntEQ(wc_ecc_decrypt(NULL, &tmpKey, out, outSz, plain, &plainSz,
1379         NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1380#ifdef WOLFSSL_ECIES_OLD
1381    /* NULL parameter allowed in new implementations - public key comes from
1382     * the message. */
1383    ExpectIntEQ(wc_ecc_decrypt(&srvKey, NULL, out, outSz, plain, &plainSz,
1384        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1385#endif
1386    ExpectIntEQ(wc_ecc_decrypt(&srvKey, &tmpKey, NULL, outSz, plain, &plainSz,
1387        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1388    ExpectIntEQ(wc_ecc_decrypt(&srvKey, &tmpKey, out, outSz, NULL, &plainSz,
1389        NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1390    ExpectIntEQ(wc_ecc_decrypt(&srvKey, &tmpKey, out, outSz, plain, NULL, NULL),
1391        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1392
1393    ExpectIntEQ(XMEMCMP(msg, plain, msgSz), 0);
1394
1395    wc_ecc_free(&tmpKey);
1396    wc_ecc_free(&srvKey);
1397    wc_ecc_free(&cliKey);
1398    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1399#endif
1400    return EXPECT_RESULT();
1401} /* END test_wc_ecc_encryptDecrypt */
1402
1403/*
1404 * Testing wc_ecc_del_point() and wc_ecc_new_point()
1405 */
1406int test_wc_ecc_del_point(void)
1407{
1408    EXPECT_DECLS;
1409#if defined(HAVE_ECC)
1410    ecc_point* pt = NULL;
1411
1412    ExpectNotNull(pt = wc_ecc_new_point());
1413    wc_ecc_del_point(pt);
1414#endif
1415    return EXPECT_RESULT();
1416} /* END test_wc_ecc_del_point */
1417
1418/*
1419 * Testing wc_ecc_point_is_at_infinity(), wc_ecc_export_point_der(),
1420 * wc_ecc_import_point_der(), wc_ecc_copy_point(), wc_ecc_point_is_on_curve(),
1421 * and wc_ecc_cmp_point()
1422 */
1423int test_wc_ecc_pointFns(void)
1424{
1425    EXPECT_DECLS;
1426#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && \
1427    !defined(WC_NO_RNG) && !defined(WOLFSSL_ATECC508A) && \
1428    !defined(WOLFSSL_ATECC608A) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
1429    !defined(WOLFSSL_MICROCHIP_TA100)
1430    ecc_key    key;
1431    WC_RNG     rng;
1432    int        ret;
1433    ecc_point* point = NULL;
1434    ecc_point* cpypt = NULL;
1435    int        idx = 0;
1436    int        keySz = KEY32;
1437    byte       der[DER_SZ(KEY32)];
1438    word32     derlenChk = 0;
1439    word32     derSz = DER_SZ(KEY32);
1440
1441    /* Init stack variables. */
1442    XMEMSET(der, 0, derSz);
1443    XMEMSET(&key, 0, sizeof(ecc_key));
1444    XMEMSET(&rng, 0, sizeof(WC_RNG));
1445
1446    ExpectIntEQ(wc_InitRng(&rng), 0);
1447    ExpectIntEQ(wc_ecc_init(&key), 0);
1448    ret = wc_ecc_make_key(&rng, keySz, &key);
1449#if defined(WOLFSSL_ASYNC_CRYPT)
1450    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1451#endif
1452    ExpectIntEQ(ret, 0);
1453
1454    ExpectNotNull(point = wc_ecc_new_point());
1455    ExpectNotNull(cpypt = wc_ecc_new_point());
1456
1457    /* Export */
1458    ExpectIntEQ(wc_ecc_export_point_der((idx = key.idx), &key.pubkey, NULL,
1459        &derlenChk), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
1460    /* Check length value. */
1461    ExpectIntEQ(derSz, derlenChk);
1462    ExpectIntEQ(wc_ecc_export_point_der((idx = key.idx), &key.pubkey, der,
1463        &derSz), 0);
1464    /* Test bad args. */
1465    ExpectIntEQ(wc_ecc_export_point_der(-2, &key.pubkey, der, &derSz),
1466        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1467    ExpectIntEQ(wc_ecc_export_point_der((idx = key.idx), NULL, der, &derSz),
1468        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1469    ExpectIntEQ(wc_ecc_export_point_der((idx = key.idx), &key.pubkey, der,
1470        NULL), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1471
1472    /* Import */
1473    ExpectIntEQ(wc_ecc_import_point_der(der, derSz, idx, point), 0);
1474    ExpectIntEQ(wc_ecc_cmp_point(&key.pubkey, point), 0);
1475    /* Test bad args. */
1476    ExpectIntEQ( wc_ecc_import_point_der(NULL, derSz, idx, point),
1477        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1478    ExpectIntEQ(wc_ecc_import_point_der(der, derSz, idx, NULL),
1479        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1480    ExpectIntEQ(wc_ecc_import_point_der(der, derSz, -1, point),
1481        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1482    ExpectIntEQ(wc_ecc_import_point_der(der, derSz + 1, idx, point),
1483        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1484
1485    /* Copy */
1486    ExpectIntEQ(wc_ecc_copy_point(point, cpypt), 0);
1487    /* Test bad args. */
1488    ExpectIntEQ(wc_ecc_copy_point(NULL, cpypt), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1489    ExpectIntEQ(wc_ecc_copy_point(point, NULL), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1490
1491    /* Compare point */
1492    ExpectIntEQ(wc_ecc_cmp_point(point, cpypt), 0);
1493    /* Test bad args. */
1494    ExpectIntEQ(wc_ecc_cmp_point(NULL, cpypt), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1495    ExpectIntEQ(wc_ecc_cmp_point(point, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1496
1497    /* At infinity if return == 1, otherwise return == 0. */
1498    ExpectIntEQ(wc_ecc_point_is_at_infinity(point), 0);
1499    /* Test bad args. */
1500    ExpectIntEQ(wc_ecc_point_is_at_infinity(NULL),
1501        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1502
1503#if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || \
1504    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION>2)))
1505    /* On curve if ret == 0 */
1506    ExpectIntEQ(wc_ecc_point_is_on_curve(point, idx), 0);
1507    /* Test bad args. */
1508    ExpectIntEQ(wc_ecc_point_is_on_curve(NULL, idx),
1509        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1510    ExpectIntEQ(wc_ecc_point_is_on_curve(point, 1000),
1511        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1512#endif /* !HAVE_SELFTEST && (!HAVE_FIPS || HAVE_FIPS_VERSION > 2) */
1513
1514    /* Free */
1515    wc_ecc_del_point(point);
1516    wc_ecc_del_point(cpypt);
1517    wc_ecc_free(&key);
1518    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1519#endif
1520    return EXPECT_RESULT();
1521} /* END test_wc_ecc_pointFns */
1522
1523/*
1524 * Testing wc_ecc_shared_secret_ssh()
1525 */
1526int test_wc_ecc_shared_secret_ssh(void)
1527{
1528    EXPECT_DECLS;
1529#if defined(HAVE_ECC) && defined(HAVE_ECC_DHE) && \
1530    !defined(WC_NO_RNG) && !defined(WOLFSSL_ATECC508A) && \
1531    !defined(WOLFSSL_ATECC608A) && !defined(PLUTON_CRYPTO_ECC) && \
1532    !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
1533    !defined(WOLFSSL_MICROCHIP_TA100)
1534    ecc_key key;
1535    ecc_key key2;
1536    WC_RNG  rng;
1537    int     ret;
1538    int     keySz = KEY32;
1539#if FIPS_VERSION3_GE(6,0,0)
1540    int     key2Sz = KEY28;
1541#else
1542    int     key2Sz = KEY24;
1543#endif
1544    byte    secret[KEY32];
1545    word32  secretLen = (word32)keySz;
1546
1547    /* Init stack variables. */
1548    XMEMSET(&key, 0, sizeof(ecc_key));
1549    XMEMSET(&key2, 0, sizeof(ecc_key));
1550    XMEMSET(&rng, 0, sizeof(WC_RNG));
1551    XMEMSET(secret, 0, secretLen);
1552    PRIVATE_KEY_UNLOCK();
1553
1554    /* Make keys */
1555    ExpectIntEQ(wc_ecc_init(&key), 0);
1556    ExpectIntEQ(wc_InitRng(&rng), 0);
1557    ret = wc_ecc_make_key(&rng, keySz, &key);
1558#if defined(WOLFSSL_ASYNC_CRYPT)
1559    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1560#endif
1561    ExpectIntEQ(ret, 0);
1562    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1563
1564    ExpectIntEQ(wc_ecc_init(&key2), 0);
1565    ExpectIntEQ(wc_InitRng(&rng), 0);
1566    ret = wc_ecc_make_key(&rng, key2Sz, &key2);
1567#if defined(WOLFSSL_ASYNC_CRYPT)
1568    ret = wc_AsyncWait(ret, &key2.asyncDev, WC_ASYNC_FLAG_NONE);
1569#endif
1570    ExpectIntEQ(ret, 0);
1571
1572#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
1573    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
1574    !defined(HAVE_SELFTEST)
1575    ExpectIntEQ(wc_ecc_set_rng(&key, &rng), 0);
1576#endif
1577
1578    ExpectIntEQ(wc_ecc_shared_secret_ssh(&key, &key2.pubkey, secret,
1579        &secretLen), 0);
1580    /* Pass in bad args. */
1581    ExpectIntEQ(wc_ecc_shared_secret_ssh(NULL, &key2.pubkey, secret,
1582        &secretLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1583    ExpectIntEQ(wc_ecc_shared_secret_ssh(&key, NULL, secret, &secretLen),
1584        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1585    ExpectIntEQ(wc_ecc_shared_secret_ssh(&key, &key2.pubkey, NULL, &secretLen),
1586        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1587    ExpectIntEQ(wc_ecc_shared_secret_ssh(&key, &key2.pubkey, secret, NULL),
1588        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1589    key.type = ECC_PUBLICKEY;
1590    ExpectIntEQ(wc_ecc_shared_secret_ssh(&key, &key2.pubkey, secret,
1591        &secretLen), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1592    PRIVATE_KEY_LOCK();
1593
1594    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1595    wc_ecc_free(&key);
1596    wc_ecc_free(&key2);
1597
1598#ifdef FP_ECC
1599    wc_ecc_fp_free();
1600#endif
1601#endif
1602    return EXPECT_RESULT();
1603} /* END test_wc_ecc_shared_secret_ssh */
1604
1605/*
1606 * Testing wc_ecc_verify_hash_ex() and wc_ecc_verify_hash_ex()
1607 */
1608int test_wc_ecc_verify_hash_ex(void)
1609{
1610    EXPECT_DECLS;
1611#if defined(HAVE_ECC) && defined(HAVE_ECC_SIGN) && defined(WOLFSSL_PUBLIC_MP) \
1612    && !defined(WC_NO_RNG) && !defined(WOLFSSL_ATECC508A) && \
1613       !defined(WOLFSSL_ATECC608A) && !defined(WOLFSSL_KCAPI_ECC) && \
1614       !defined(WOLFSSL_MICROCHIP_TA100)
1615    ecc_key       key;
1616    WC_RNG        rng;
1617    int           ret;
1618    mp_int        r;
1619    mp_int        s;
1620    mp_int        z;
1621    unsigned char hash[] = "Everyone gets Friday off.EccSig";
1622    unsigned char iHash[] = "Everyone gets Friday off.......";
1623    unsigned char shortHash[] = TEST_STRING;
1624    word32        hashlen = sizeof(hash);
1625    word32        iHashLen = sizeof(iHash);
1626    word32        shortHashLen = sizeof(shortHash);
1627    int           keySz = KEY32;
1628    int           verify_ok = 0;
1629
1630    XMEMSET(&key, 0, sizeof(ecc_key));
1631    XMEMSET(&rng, 0, sizeof(WC_RNG));
1632    XMEMSET(&r, 0, sizeof(mp_int));
1633    XMEMSET(&s, 0, sizeof(mp_int));
1634    XMEMSET(&z, 0, sizeof(mp_int));
1635
1636    /* Initialize r, s and z. */
1637    ExpectIntEQ(mp_init_multi(&r, &s, &z, NULL, NULL, NULL), MP_OKAY);
1638
1639    ExpectIntEQ(wc_ecc_init(&key), 0);
1640    ExpectIntEQ(wc_InitRng(&rng), 0);
1641    ret = wc_ecc_make_key(&rng, keySz, &key);
1642#if defined(WOLFSSL_ASYNC_CRYPT)
1643    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1644#endif
1645    ExpectIntEQ(ret, 0);
1646
1647    ExpectIntEQ(wc_ecc_sign_hash_ex(hash, hashlen, &rng, &key, &r, &s), 0);
1648    /* verify_ok should be 1. */
1649    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, hash, hashlen, &verify_ok, &key),
1650        0);
1651    ExpectIntEQ(verify_ok, 1);
1652
1653    /* verify_ok should be 0 */
1654    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, iHash, iHashLen, &verify_ok,
1655        &key), 0);
1656    ExpectIntEQ(verify_ok, 0);
1657
1658    /* verify_ok should be 0. */
1659    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, shortHash, shortHashLen,
1660        &verify_ok, &key), 0);
1661    ExpectIntEQ(verify_ok, 0);
1662
1663    /* Test bad args. */
1664    ExpectIntEQ(wc_ecc_sign_hash_ex(NULL, hashlen, &rng, &key, &r, &s),
1665        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1666    ExpectIntEQ(wc_ecc_sign_hash_ex(hash, hashlen, NULL, &key, &r, &s),
1667        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1668    ExpectIntEQ(wc_ecc_sign_hash_ex(hash, hashlen, &rng, NULL, &r, &s),
1669        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1670    ExpectIntEQ(wc_ecc_sign_hash_ex(hash, hashlen, &rng, &key, NULL, &s),
1671        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1672    ExpectIntEQ(wc_ecc_sign_hash_ex(hash, hashlen, &rng, &key, &r, NULL),
1673        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1674    /* Test bad args. */
1675    ExpectIntEQ(wc_ecc_verify_hash_ex(NULL, &s, shortHash, shortHashLen,
1676        &verify_ok, &key), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1677    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, NULL, shortHash, shortHashLen,
1678        &verify_ok, &key), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1679    ExpectIntEQ(wc_ecc_verify_hash_ex(&z, &s, shortHash, shortHashLen,
1680        &verify_ok, &key), WC_NO_ERR_TRACE(MP_ZERO_E));
1681    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &z, shortHash, shortHashLen,
1682        &verify_ok, &key), WC_NO_ERR_TRACE(MP_ZERO_E));
1683    ExpectIntEQ(wc_ecc_verify_hash_ex(&z, &z, shortHash, shortHashLen,
1684        &verify_ok, &key), WC_NO_ERR_TRACE(MP_ZERO_E));
1685    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, NULL, shortHashLen, &verify_ok,
1686        &key), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1687    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, shortHash, shortHashLen, NULL,
1688        &key), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1689    ExpectIntEQ(wc_ecc_verify_hash_ex(&r, &s, shortHash, shortHashLen,
1690        &verify_ok, NULL), WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1691
1692    wc_ecc_free(&key);
1693    mp_free(&r);
1694    mp_free(&s);
1695    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1696#endif
1697    return EXPECT_RESULT();
1698} /* END test_wc_ecc_verify_hash_ex */
1699
1700/*
1701 * Testing wc_ecc_mulmod()
1702 */
1703int test_wc_ecc_mulmod(void)
1704{
1705    EXPECT_DECLS;
1706#if defined(HAVE_ECC) && !defined(WC_NO_RNG) && \
1707    !(defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A) || \
1708      defined(WOLFSSL_MICROCHIP_TA100) || \
1709      defined(WOLFSSL_VALIDATE_ECC_IMPORT)) && \
1710    !defined(WOLF_CRYPTO_CB_ONLY_ECC)
1711    ecc_key     key1;
1712    ecc_key     key2;
1713    ecc_key     key3;
1714    WC_RNG      rng;
1715    int         ret;
1716
1717    XMEMSET(&key1, 0, sizeof(ecc_key));
1718    XMEMSET(&key2, 0, sizeof(ecc_key));
1719    XMEMSET(&key3, 0, sizeof(ecc_key));
1720    XMEMSET(&rng, 0, sizeof(WC_RNG));
1721
1722    ExpectIntEQ(wc_ecc_init(&key1), 0);
1723    ExpectIntEQ(wc_ecc_init(&key2), 0);
1724    ExpectIntEQ(wc_ecc_init(&key3), 0);
1725    ExpectIntEQ(wc_InitRng(&rng), 0);
1726    ret = wc_ecc_make_key(&rng, KEY32, &key1);
1727#if defined(WOLFSSL_ASYNC_CRYPT)
1728    ret = wc_AsyncWait(ret, &key1.asyncDev, WC_ASYNC_FLAG_NONE);
1729#endif
1730    ExpectIntEQ(ret, 0);
1731    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1732
1733    ExpectIntEQ(wc_ecc_import_raw_ex(&key2, key1.dp->Gx, key1.dp->Gy,
1734        key1.dp->Af, ECC_SECP256R1), 0);
1735    ExpectIntEQ(wc_ecc_import_raw_ex(&key3, key1.dp->Gx, key1.dp->Gy,
1736        key1.dp->prime, ECC_SECP256R1), 0);
1737
1738    ExpectIntEQ(wc_ecc_mulmod(wc_ecc_key_get_priv(&key1), &key2.pubkey,
1739        &key3.pubkey, wc_ecc_key_get_priv(&key2), wc_ecc_key_get_priv(&key3),
1740        1), 0);
1741
1742    /* Test bad args. */
1743    ExpectIntEQ(ret = wc_ecc_mulmod(NULL, &key2.pubkey, &key3.pubkey,
1744        wc_ecc_key_get_priv(&key2), wc_ecc_key_get_priv(&key3), 1),
1745        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1746    ExpectIntEQ(wc_ecc_mulmod(wc_ecc_key_get_priv(&key1), NULL, &key3.pubkey,
1747        wc_ecc_key_get_priv(&key2), wc_ecc_key_get_priv(&key3), 1),
1748        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1749    ExpectIntEQ(wc_ecc_mulmod(wc_ecc_key_get_priv(&key1), &key2.pubkey, NULL,
1750        wc_ecc_key_get_priv(&key2), wc_ecc_key_get_priv(&key3), 1),
1751        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1752    ExpectIntEQ(wc_ecc_mulmod(wc_ecc_key_get_priv(&key1), &key2.pubkey,
1753        &key3.pubkey, wc_ecc_key_get_priv(&key2), NULL, 1),
1754        WC_NO_ERR_TRACE(ECC_BAD_ARG_E));
1755
1756    wc_ecc_free(&key1);
1757    wc_ecc_free(&key2);
1758    wc_ecc_free(&key3);
1759
1760#ifdef FP_ECC
1761    wc_ecc_fp_free();
1762#endif
1763#endif /* HAVE_ECC && !WOLFSSL_ATECC508A */
1764    return EXPECT_RESULT();
1765} /* END test_wc_ecc_mulmod */
1766
1767/*
1768 * Testing wc_ecc_is_valid_idx()
1769 */
1770int test_wc_ecc_is_valid_idx(void)
1771{
1772    EXPECT_DECLS;
1773#if defined(HAVE_ECC) && !defined(WC_NO_RNG)
1774    ecc_key key;
1775    WC_RNG  rng;
1776    int     ret;
1777    int     iVal = -2;
1778    int     iVal2 = 3000;
1779
1780    XMEMSET(&key, 0, sizeof(ecc_key));
1781    XMEMSET(&rng, 0, sizeof(WC_RNG));
1782
1783    ExpectIntEQ(wc_ecc_init(&key), 0);
1784    ExpectIntEQ(wc_InitRng(&rng), 0);
1785    ret = wc_ecc_make_key(&rng, 32, &key);
1786#if defined(WOLFSSL_ASYNC_CRYPT)
1787    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1788#endif
1789    ExpectIntEQ(ret, 0);
1790
1791    ExpectIntEQ(wc_ecc_is_valid_idx(key.idx), 1);
1792    /* Test bad args. */
1793    ExpectIntEQ(wc_ecc_is_valid_idx(iVal), 0);
1794    ExpectIntEQ(wc_ecc_is_valid_idx(iVal2), 0);
1795
1796    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1797    wc_ecc_free(&key);
1798
1799#ifdef FP_ECC
1800    wc_ecc_fp_free();
1801#endif
1802#endif
1803    return EXPECT_RESULT();
1804} /* END test_wc_ecc_is_valid_idx */
1805
1806/*
1807 * Testing wc_ecc_get_curve_id_from_oid()
1808 */
1809int test_wc_ecc_get_curve_id_from_oid(void)
1810{
1811    EXPECT_DECLS;
1812#if defined(HAVE_ECC) && !defined(NO_ECC256) && !defined(HAVE_SELFTEST) && \
1813    !defined(HAVE_FIPS)
1814    const byte oid[] = {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x07};
1815    word32 len = sizeof(oid);
1816
1817    /* Bad Cases */
1818    ExpectIntEQ(wc_ecc_get_curve_id_from_oid(NULL, len),
1819        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1820    ExpectIntEQ(wc_ecc_get_curve_id_from_oid(oid, 0), ECC_CURVE_INVALID);
1821    /* Good Case */
1822    ExpectIntEQ(wc_ecc_get_curve_id_from_oid(oid, len), ECC_SECP256R1);
1823#endif
1824    return EXPECT_RESULT();
1825} /* END test_wc_ecc_get_curve_id_from_oid */
1826
1827/*
1828 * Testing wc_ecc_sig_size_calc()
1829 */
1830int test_wc_ecc_sig_size_calc(void)
1831{
1832    EXPECT_DECLS;
1833#if defined(HAVE_ECC) && !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST)
1834    ecc_key key;
1835    WC_RNG  rng;
1836    int     sz = 0;
1837    int     ret;
1838
1839    XMEMSET(&key, 0, sizeof(ecc_key));
1840    XMEMSET(&rng, 0, sizeof(WC_RNG));
1841
1842    ExpectIntEQ(wc_ecc_init(&key), 0);
1843    ExpectIntEQ(wc_InitRng(&rng), 0);
1844    ret = wc_ecc_make_key(&rng, 16, &key);
1845#if defined(WOLFSSL_ASYNC_CRYPT)
1846    ret = wc_AsyncWait(ret, &key.asyncDev, WC_ASYNC_FLAG_NONE);
1847#endif
1848#if FIPS_VERSION3_GE(6,0,0)
1849    ExpectIntEQ(ret, WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1850#else
1851    ExpectIntEQ(ret, 0);
1852#endif
1853#if FIPS_VERSION3_LT(6,0,0)
1854    sz = key.dp->size;
1855    ExpectIntGT(wc_ecc_sig_size_calc(sz), 0);
1856#else
1857    (void) sz;
1858#endif
1859
1860    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1861    wc_ecc_free(&key);
1862#endif
1863    return EXPECT_RESULT();
1864} /* END test_wc_ecc_sig_size_calc */
1865
1866/*
1867 * Testing wc_EccPrivateKeyToDer
1868 */
1869int test_wc_EccPrivateKeyToDer(void)
1870{
1871    EXPECT_DECLS;
1872#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && !defined(WC_NO_RNG)
1873    byte    output[ONEK_BUF];
1874    ecc_key eccKey;
1875    WC_RNG  rng;
1876    word32  inLen = 0;
1877    word32  outLen = 0;
1878    int     ret;
1879
1880    XMEMSET(&eccKey, 0, sizeof(ecc_key));
1881    XMEMSET(&rng, 0, sizeof(WC_RNG));
1882    PRIVATE_KEY_UNLOCK();
1883
1884    ExpectIntEQ(wc_InitRng(&rng), 0);
1885    ExpectIntEQ(wc_ecc_init(&eccKey), 0);
1886    ret = wc_ecc_make_key(&rng, KEY14, &eccKey);
1887#if defined(WOLFSSL_ASYNC_CRYPT)
1888    ret = wc_AsyncWait(ret, &eccKey.asyncDev, WC_ASYNC_FLAG_NONE);
1889#endif
1890    ExpectIntEQ(ret, 0);
1891
1892    /* Bad Cases */
1893    ExpectIntEQ(wc_EccPrivateKeyToDer(NULL, NULL, 0),
1894        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1895    ExpectIntEQ(wc_EccPrivateKeyToDer(NULL, output, inLen),
1896        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1897    inLen = wc_EccPrivateKeyToDer(&eccKey, NULL, 0);
1898    ExpectIntGT(inLen, 0);
1899    ExpectIntEQ(wc_EccPrivateKeyToDer(&eccKey, output, 0),
1900        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1901
1902    /* Good Case */
1903    ExpectIntGT(outLen = (word32)wc_EccPrivateKeyToDer(&eccKey, output, inLen),
1904        0);
1905
1906    wc_ecc_free(&eccKey);
1907    DoExpectIntEQ(wc_FreeRng(&rng), 0);
1908
1909#if defined(OPENSSL_EXTRA) && defined(HAVE_ALL_CURVES)
1910    {
1911        /* test importing private only into a PKEY struct */
1912        EC_KEY*   ec = NULL;
1913        EVP_PKEY* pkey = NULL;
1914        const unsigned char* der;
1915
1916        der = output;
1917        ExpectNotNull(pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &der, outLen));
1918
1919        der = output;
1920        ExpectNotNull(ec = d2i_ECPrivateKey(NULL, &der, outLen));
1921        ExpectIntEQ(EVP_PKEY_assign_EC_KEY(pkey, ec), SSL_SUCCESS);
1922        if (EXPECT_FAIL()) {
1923            EC_KEY_free(ec);
1924        }
1925        EVP_PKEY_free(pkey); /* EC_KEY should be free'd by free'ing pkey */
1926    }
1927#endif
1928    PRIVATE_KEY_LOCK();
1929#endif
1930    return EXPECT_RESULT();
1931} /* End test_wc_EccPrivateKeyToDer */
1932