luna - wolfssl/tests/api/test_ossl

   1/* test_ossl_ec.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/openssl/ec.h>
  32#include <wolfssl/openssl/ecdh.h>
  33#include <wolfssl/openssl/pem.h>
  34#include <wolfssl/wolfcrypt/types.h>
  35#include <tests/api/api.h>
  36#include <tests/api/test_ossl_ec.h>
  37
  38/*******************************************************************************
  39 * EC OpenSSL compatibility API Testing
  40 ******************************************************************************/
  41
  42#if defined(HAVE_ECC) && !defined(OPENSSL_NO_PK)
  43
  44int test_wolfSSL_EC_GROUP(void)
  45{
  46    EXPECT_DECLS;
  47#ifdef OPENSSL_EXTRA
  48    EC_GROUP *group = NULL;
  49    EC_GROUP *group2 = NULL;
  50    EC_GROUP *group3 = NULL;
  51#ifndef HAVE_ECC_BRAINPOOL
  52    EC_GROUP *group4 = NULL;
  53#endif
  54    WOLFSSL_BIGNUM* order = NULL;
  55    int group_bits;
  56    int i;
  57    static const int knownEccNids[] = {
  58        NID_X9_62_prime192v1,
  59        NID_X9_62_prime192v2,
  60        NID_X9_62_prime192v3,
  61        NID_X9_62_prime239v1,
  62        NID_X9_62_prime239v2,
  63        NID_X9_62_prime239v3,
  64        NID_X9_62_prime256v1,
  65        NID_secp112r1,
  66        NID_secp112r2,
  67        NID_secp128r1,
  68        NID_secp128r2,
  69        NID_secp160r1,
  70        NID_secp160r2,
  71        NID_secp224r1,
  72        NID_secp384r1,
  73        NID_secp521r1,
  74        NID_secp160k1,
  75        NID_secp192k1,
  76        NID_secp224k1,
  77        NID_secp256k1,
  78        NID_brainpoolP160r1,
  79        NID_brainpoolP192r1,
  80        NID_brainpoolP224r1,
  81        NID_brainpoolP256r1,
  82        NID_brainpoolP320r1,
  83        NID_brainpoolP384r1,
  84        NID_brainpoolP512r1,
  85    };
  86    int knowEccNidsLen = (int)(sizeof(knownEccNids) / sizeof(*knownEccNids));
  87    static const int knownEccEnums[] = {
  88        ECC_SECP192R1,
  89        ECC_PRIME192V2,
  90        ECC_PRIME192V3,
  91        ECC_PRIME239V1,
  92        ECC_PRIME239V2,
  93        ECC_PRIME239V3,
  94        ECC_SECP256R1,
  95        ECC_SECP112R1,
  96        ECC_SECP112R2,
  97        ECC_SECP128R1,
  98        ECC_SECP128R2,
  99        ECC_SECP160R1,
 100        ECC_SECP160R2,
 101        ECC_SECP224R1,
 102        ECC_SECP384R1,
 103        ECC_SECP521R1,
 104        ECC_SECP160K1,
 105        ECC_SECP192K1,
 106        ECC_SECP224K1,
 107        ECC_SECP256K1,
 108        ECC_BRAINPOOLP160R1,
 109        ECC_BRAINPOOLP192R1,
 110        ECC_BRAINPOOLP224R1,
 111        ECC_BRAINPOOLP256R1,
 112        ECC_BRAINPOOLP320R1,
 113        ECC_BRAINPOOLP384R1,
 114        ECC_BRAINPOOLP512R1,
 115    };
 116    int knowEccEnumsLen = (int)(sizeof(knownEccEnums) / sizeof(*knownEccEnums));
 117
 118    ExpectNotNull(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
 119    ExpectNotNull(group2 = EC_GROUP_dup(group));
 120    ExpectNotNull(group3 = wolfSSL_EC_GROUP_new_by_curve_name(NID_secp384r1));
 121#ifndef HAVE_ECC_BRAINPOOL
 122    ExpectNotNull(group4 = wolfSSL_EC_GROUP_new_by_curve_name(
 123        NID_brainpoolP256r1));
 124#endif
 125
 126    ExpectNull(EC_GROUP_dup(NULL));
 127
 128    ExpectIntEQ(wolfSSL_EC_GROUP_get_curve_name(NULL), 0);
 129    ExpectIntEQ(wolfSSL_EC_GROUP_get_curve_name(group), NID_X9_62_prime256v1);
 130
 131    ExpectIntEQ((group_bits = EC_GROUP_order_bits(NULL)), 0);
 132    ExpectIntEQ((group_bits = EC_GROUP_order_bits(group)), 256);
 133#ifndef HAVE_ECC_BRAINPOOL
 134    ExpectIntEQ((group_bits = EC_GROUP_order_bits(group4)), 0);
 135#endif
 136
 137    ExpectIntEQ(wolfSSL_EC_GROUP_get_degree(NULL), 0);
 138    ExpectIntEQ(wolfSSL_EC_GROUP_get_degree(group), 256);
 139
 140    ExpectNotNull(order = BN_new());
 141    ExpectIntEQ(wolfSSL_EC_GROUP_get_order(NULL, NULL, NULL), 0);
 142    ExpectIntEQ(wolfSSL_EC_GROUP_get_order(group, NULL, NULL), 0);
 143    ExpectIntEQ(wolfSSL_EC_GROUP_get_order(NULL, order, NULL), 0);
 144    ExpectIntEQ(wolfSSL_EC_GROUP_get_order(group, order, NULL), 1);
 145    wolfSSL_BN_free(order);
 146
 147    ExpectNotNull(EC_GROUP_method_of(group));
 148
 149    ExpectIntEQ(EC_METHOD_get_field_type(NULL), 0);
 150    ExpectIntEQ(EC_METHOD_get_field_type(EC_GROUP_method_of(group)),
 151        NID_X9_62_prime_field);
 152
 153    ExpectIntEQ(wolfSSL_EC_GROUP_cmp(NULL, NULL, NULL), -1);
 154    ExpectIntEQ(wolfSSL_EC_GROUP_cmp(group, NULL, NULL), -1);
 155    ExpectIntEQ(wolfSSL_EC_GROUP_cmp(NULL, group, NULL), -1);
 156    ExpectIntEQ(wolfSSL_EC_GROUP_cmp(group, group3, NULL), 1);
 157
 158#ifndef NO_WOLFSSL_STUB
 159    wolfSSL_EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
 160#endif
 161
 162#ifndef HAVE_ECC_BRAINPOOL
 163    EC_GROUP_free(group4);
 164#endif
 165    EC_GROUP_free(group3);
 166    EC_GROUP_free(group2);
 167    EC_GROUP_free(group);
 168
 169    for (i = 0; i < knowEccNidsLen; i++) {
 170        group = NULL;
 171        ExpectNotNull(group = EC_GROUP_new_by_curve_name(knownEccNids[i]));
 172        ExpectIntGT(wolfSSL_EC_GROUP_get_degree(group), 0);
 173        EC_GROUP_free(group);
 174    }
 175    for (i = 0; i < knowEccEnumsLen; i++) {
 176        group = NULL;
 177        ExpectNotNull(group = EC_GROUP_new_by_curve_name(knownEccEnums[i]));
 178        ExpectIntEQ(wolfSSL_EC_GROUP_get_curve_name(group), knownEccNids[i]);
 179        EC_GROUP_free(group);
 180    }
 181#endif
 182   return EXPECT_RESULT();
 183}
 184
 185int test_wolfSSL_PEM_read_bio_ECPKParameters(void)
 186{
 187    EXPECT_DECLS;
 188#if !defined(NO_FILESYSTEM) && defined(OPENSSL_EXTRA) && !defined(NO_BIO)
 189    EC_GROUP *group = NULL;
 190    BIO* bio = NULL;
 191#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && \
 192    ECC_MIN_KEY_SZ <= 384 && !defined(NO_ECC_SECP)
 193    EC_GROUP *ret = NULL;
 194    static char ec_nc_p384[] = "-----BEGIN EC PARAMETERS-----\n"
 195                               "BgUrgQQAIg==\n"
 196                               "-----END EC PARAMETERS-----";
 197#endif
 198    static char ec_nc_bad_1[] = "-----BEGIN EC PARAMETERS-----\n"
 199                                "MAA=\n"
 200                                "-----END EC PARAMETERS-----";
 201    static char ec_nc_bad_2[] = "-----BEGIN EC PARAMETERS-----\n"
 202                                "BgA=\n"
 203                                "-----END EC PARAMETERS-----";
 204    static char ec_nc_bad_3[] = "-----BEGIN EC PARAMETERS-----\n"
 205                                "BgE=\n"
 206                                "-----END EC PARAMETERS-----";
 207    static char ec_nc_bad_4[] = "-----BEGIN EC PARAMETERS-----\n"
 208                                "BgE*\n"
 209                                "-----END EC PARAMETERS-----";
 210
 211    /* Test that first parameter, bio, being NULL fails. */
 212    ExpectNull(PEM_read_bio_ECPKParameters(NULL, NULL, NULL, NULL));
 213
 214    /* Test that reading named parameters works. */
 215    ExpectNotNull(bio = BIO_new(BIO_s_file()));
 216    ExpectIntEQ(BIO_read_filename(bio, eccKeyFile), WOLFSSL_SUCCESS);
 217    ExpectNotNull(group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL));
 218    ExpectIntEQ(EC_GROUP_get_curve_name(group), NID_X9_62_prime256v1);
 219    BIO_free(bio);
 220    bio = NULL;
 221    EC_GROUP_free(group);
 222    group = NULL;
 223
 224#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && \
 225    ECC_MIN_KEY_SZ <= 384 && !defined(NO_ECC_SECP)
 226    /* Test that reusing group works. */
 227    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_p384,
 228        sizeof(ec_nc_p384)));
 229    ExpectNotNull(group = PEM_read_bio_ECPKParameters(bio, &group, NULL, NULL));
 230    ExpectIntEQ(EC_GROUP_get_curve_name(group), NID_secp384r1);
 231    BIO_free(bio);
 232    bio = NULL;
 233    EC_GROUP_free(group);
 234    group = NULL;
 235
 236    /* Test that returning through group works. */
 237    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_p384,
 238        sizeof(ec_nc_p384)));
 239    ExpectNotNull(ret = PEM_read_bio_ECPKParameters(bio, &group, NULL, NULL));
 240    ExpectIntEQ(ret == group, 1);
 241    ExpectIntEQ(EC_GROUP_get_curve_name(group), NID_secp384r1);
 242    BIO_free(bio);
 243    bio = NULL;
 244    EC_GROUP_free(group);
 245    group = NULL;
 246#endif
 247
 248    /* Test 0x30, 0x00 (not and object id) fails. */
 249    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_bad_1,
 250        sizeof(ec_nc_bad_1)));
 251    ExpectNull(PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL));
 252    BIO_free(bio);
 253    bio = NULL;
 254
 255    /* Test 0x06, 0x00 (empty object id) fails. */
 256    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_bad_2,
 257        sizeof(ec_nc_bad_2)));
 258    ExpectNull(PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL));
 259    BIO_free(bio);
 260    bio = NULL;
 261
 262    /* Test 0x06, 0x01 (badly formed object id) fails. */
 263    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_bad_3,
 264        sizeof(ec_nc_bad_3)));
 265    ExpectNull(PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL));
 266    BIO_free(bio);
 267    bio = NULL;
 268
 269    /* Test invalid PEM encoding - invalid character. */
 270    ExpectNotNull(bio = BIO_new_mem_buf((unsigned char*)ec_nc_bad_4,
 271        sizeof(ec_nc_bad_4)));
 272    ExpectNull(PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL));
 273    BIO_free(bio);
 274#endif
 275    return EXPECT_RESULT();
 276}
 277
 278int test_wolfSSL_i2d_ECPKParameters(void)
 279{
 280    EXPECT_DECLS;
 281#if defined(OPENSSL_EXTRA)
 282    EC_GROUP* grp = NULL;
 283    unsigned char p256_oid[] = {
 284        0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 285    };
 286    unsigned char *der = p256_oid;
 287    unsigned char out_der[sizeof(p256_oid)];
 288
 289    XMEMSET(out_der, 0, sizeof(out_der));
 290    ExpectNotNull(d2i_ECPKParameters(&grp, (const unsigned char **)&der,
 291            sizeof(p256_oid)));
 292    der = out_der;
 293    ExpectIntEQ(i2d_ECPKParameters(grp, &der), sizeof(p256_oid));
 294    ExpectBufEQ(p256_oid, out_der, sizeof(p256_oid));
 295    EC_GROUP_free(grp);
 296#endif
 297    return EXPECT_RESULT();
 298}
 299
 300int test_wolfSSL_EC_POINT(void)
 301{
 302    EXPECT_DECLS;
 303#if !defined(WOLFSSL_SP_MATH) && \
 304  (!defined(HAVE_FIPS) || (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION>2)))
 305
 306#ifdef OPENSSL_EXTRA
 307    BN_CTX* ctx = NULL;
 308    EC_GROUP* group = NULL;
 309#ifndef HAVE_ECC_BRAINPOOL
 310    EC_GROUP* group2 = NULL;
 311#endif
 312    EC_POINT* Gxy = NULL;
 313    EC_POINT* new_point = NULL;
 314    EC_POINT* set_point = NULL;
 315    EC_POINT* get_point = NULL;
 316    EC_POINT* infinity = NULL;
 317    EC_POINT* dup_point = NULL;
 318    BIGNUM* k = NULL;
 319    BIGNUM* Gx = NULL;
 320    BIGNUM* Gy = NULL;
 321    BIGNUM* Gz = NULL;
 322    BIGNUM* X = NULL;
 323    BIGNUM* Y = NULL;
 324    BIGNUM* set_point_bn = NULL;
 325    char* hexStr = NULL;
 326
 327    const char* kTest = "F4F8338AFCC562C5C3F3E1E46A7EFECD"
 328                        "17AF381913FF7A96314EA47055EA0FD0";
 329    /* NISTP256R1 Gx/Gy */
 330    const char* kGx   = "6B17D1F2E12C4247F8BCE6E563A440F2"
 331                        "77037D812DEB33A0F4A13945D898C296";
 332    const char* kGy   = "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
 333                        "2BCE33576B315ECECBB6406837BF51F5";
 334    const char* uncompG
 335                      = "046B17D1F2E12C4247F8BCE6E563A440F2"
 336                        "77037D812DEB33A0F4A13945D898C296"
 337                        "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
 338                        "2BCE33576B315ECECBB6406837BF51F5";
 339    const char* compG
 340                      = "036B17D1F2E12C4247F8BCE6E563A440F2"
 341                        "77037D812DEB33A0F4A13945D898C296";
 342
 343#ifndef HAVE_SELFTEST
 344    EC_POINT *tmp = NULL;
 345    size_t bin_len;
 346    unsigned int blen = 0;
 347    unsigned char* buf = NULL;
 348    unsigned char bufInf[1] = { 0x00 };
 349
 350    const unsigned char binUncompG[] = {
 351        0x04, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc,
 352        0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d,
 353        0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96,
 354        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb,
 355        0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31,
 356        0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
 357    };
 358    const unsigned char binUncompGBad[] = {
 359        0x09, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc,
 360        0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d,
 361        0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96,
 362        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb,
 363        0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31,
 364        0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
 365    };
 366
 367#ifdef HAVE_COMP_KEY
 368    const unsigned char binCompG[] = {
 369        0x03, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc,
 370        0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d,
 371        0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96,
 372    };
 373#endif
 374#endif
 375
 376    ExpectNotNull(ctx = BN_CTX_new());
 377    ExpectNotNull(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
 378#ifndef HAVE_ECC_BRAINPOOL
 379    /* Used to make groups curve_idx == -1. */
 380    ExpectNotNull(group2 = EC_GROUP_new_by_curve_name(NID_brainpoolP256r1));
 381#endif
 382
 383    ExpectNull(EC_POINT_new(NULL));
 384    ExpectNotNull(Gxy = EC_POINT_new(group));
 385    ExpectNotNull(new_point = EC_POINT_new(group));
 386    ExpectNotNull(set_point = EC_POINT_new(group));
 387    ExpectNotNull(X = BN_new());
 388    ExpectNotNull(Y = BN_new());
 389    ExpectNotNull(set_point_bn = BN_new());
 390
 391    ExpectNotNull(infinity = EC_POINT_new(group));
 392
 393    /* load test values */
 394    ExpectIntEQ(BN_hex2bn(&k,  kTest), WOLFSSL_SUCCESS);
 395    ExpectIntEQ(BN_hex2bn(&Gx, kGx),   WOLFSSL_SUCCESS);
 396    ExpectIntEQ(BN_hex2bn(&Gy, kGy),   WOLFSSL_SUCCESS);
 397    ExpectIntEQ(BN_hex2bn(&Gz, "1"),   WOLFSSL_SUCCESS);
 398
 399    /* populate coordinates for input point */
 400    if (Gxy != NULL) {
 401        Gxy->X = Gx;
 402        Gxy->Y = Gy;
 403        Gxy->Z = Gz;
 404    }
 405
 406    /* Test handling of NULL point. */
 407    EC_POINT_clear_free(NULL);
 408
 409    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(NULL, NULL,
 410        NULL, NULL, ctx), 0);
 411    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(group, NULL,
 412        NULL, NULL, ctx), 0);
 413    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(NULL, Gxy,
 414        NULL, NULL, ctx), 0);
 415    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(NULL, NULL,
 416        X, NULL, ctx), 0);
 417    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(NULL, NULL,
 418        NULL, Y, ctx), 0);
 419    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(NULL, Gxy,
 420        X, Y, ctx), 0);
 421    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(group, NULL,
 422        X, Y, ctx), 0);
 423    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(group, Gxy,
 424        NULL, Y, ctx), 0);
 425    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(group, Gxy,
 426        X, NULL, ctx), 0);
 427    /* Getting point at infinity returns an error. */
 428    ExpectIntEQ(wolfSSL_EC_POINT_get_affine_coordinates_GFp(group, infinity,
 429        X, Y, ctx), 0);
 430
 431#if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
 432    !defined(WOLFSSL_MICROCHIP_TA100) && \
 433    !defined(HAVE_SELFTEST) && !defined(WOLFSSL_SP_MATH) && \
 434    !defined(WOLF_CRYPTO_CB_ONLY_ECC)
 435    ExpectIntEQ(EC_POINT_add(NULL, NULL, NULL, NULL, ctx), 0);
 436    ExpectIntEQ(EC_POINT_add(group, NULL, NULL, NULL, ctx), 0);
 437    ExpectIntEQ(EC_POINT_add(NULL, new_point, NULL, NULL, ctx), 0);
 438    ExpectIntEQ(EC_POINT_add(NULL, NULL, new_point, NULL, ctx), 0);
 439    ExpectIntEQ(EC_POINT_add(NULL, NULL, NULL, Gxy, ctx), 0);
 440    ExpectIntEQ(EC_POINT_add(NULL, new_point, new_point, Gxy, ctx), 0);
 441    ExpectIntEQ(EC_POINT_add(group, NULL, new_point, Gxy, ctx), 0);
 442    ExpectIntEQ(EC_POINT_add(group, new_point, NULL, Gxy, ctx), 0);
 443    ExpectIntEQ(EC_POINT_add(group, new_point, new_point, NULL, ctx), 0);
 444
 445    ExpectIntEQ(EC_POINT_mul(NULL, NULL, Gx, Gxy, k, ctx), 0);
 446    ExpectIntEQ(EC_POINT_mul(NULL, new_point, Gx, Gxy, k, ctx), 0);
 447    ExpectIntEQ(EC_POINT_mul(group, NULL, Gx, Gxy, k, ctx), 0);
 448
 449    ExpectIntEQ(EC_POINT_add(group, new_point, new_point, Gxy, ctx), 1);
 450    /* perform point multiplication */
 451    ExpectIntEQ(EC_POINT_mul(group, new_point, Gx, Gxy, k, ctx), 1);
 452    ExpectIntEQ(BN_is_zero(new_point->X), 0);
 453    ExpectIntEQ(BN_is_zero(new_point->Y), 0);
 454    ExpectIntEQ(BN_is_zero(new_point->Z), 0);
 455    ExpectIntEQ(EC_POINT_mul(group, new_point, NULL, Gxy, k, ctx), 1);
 456    ExpectIntEQ(BN_is_zero(new_point->X), 0);
 457    ExpectIntEQ(BN_is_zero(new_point->Y), 0);
 458    ExpectIntEQ(BN_is_zero(new_point->Z), 0);
 459    ExpectIntEQ(EC_POINT_mul(group, new_point, Gx, NULL, NULL, ctx), 1);
 460    ExpectIntEQ(BN_is_zero(new_point->X), 0);
 461    ExpectIntEQ(BN_is_zero(new_point->Y), 0);
 462    ExpectIntEQ(BN_is_zero(new_point->Z), 0);
 463    ExpectIntEQ(EC_POINT_mul(group, new_point, NULL, NULL, NULL, ctx), 1);
 464    ExpectIntEQ(BN_is_zero(new_point->X), 1);
 465    ExpectIntEQ(BN_is_zero(new_point->Y), 1);
 466    ExpectIntEQ(BN_is_zero(new_point->Z), 1);
 467    /* Set point to something. */
 468    ExpectIntEQ(EC_POINT_add(group, new_point, Gxy, Gxy, ctx), 1);
 469#else
 470    ExpectIntEQ(EC_POINT_set_affine_coordinates_GFp(group, new_point, Gx, Gy,
 471        ctx), 1);
 472    ExpectIntEQ(BN_is_zero(new_point->X), 0);
 473    ExpectIntEQ(BN_is_zero(new_point->Y), 0);
 474    ExpectIntEQ(BN_is_zero(new_point->Z), 0);
 475#endif
 476
 477    /* check if point X coordinate is zero */
 478    ExpectIntEQ(BN_is_zero(new_point->X), 0);
 479
 480#if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || FIPS_VERSION_GT(2,0))
 481    ExpectIntEQ(EC_POINT_is_on_curve(group, new_point, ctx), 1);
 482#endif
 483
 484    /* extract the coordinates from point */
 485    ExpectIntEQ(EC_POINT_get_affine_coordinates_GFp(group, new_point, X, Y,
 486        ctx), WOLFSSL_SUCCESS);
 487
 488    /* check if point X coordinate is zero */
 489    ExpectIntEQ(BN_is_zero(X), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 490
 491    /* set the same X and Y points in another object */
 492    ExpectIntEQ(EC_POINT_set_affine_coordinates_GFp(group, set_point, X, Y,
 493        ctx), WOLFSSL_SUCCESS);
 494
 495    /* compare points as they should be the same */
 496    ExpectIntEQ(EC_POINT_cmp(NULL, NULL, NULL, ctx), -1);
 497    ExpectIntEQ(EC_POINT_cmp(group, NULL, NULL, ctx), -1);
 498    ExpectIntEQ(EC_POINT_cmp(NULL, new_point, NULL, ctx), -1);
 499    ExpectIntEQ(EC_POINT_cmp(NULL, NULL, set_point, ctx), -1);
 500    ExpectIntEQ(EC_POINT_cmp(NULL, new_point, set_point, ctx), -1);
 501    ExpectIntEQ(EC_POINT_cmp(group, NULL, set_point, ctx), -1);
 502    ExpectIntEQ(EC_POINT_cmp(group, new_point, NULL, ctx), -1);
 503    ExpectIntEQ(EC_POINT_cmp(group, new_point, set_point, ctx), 0);
 504
 505    /* Test copying */
 506    ExpectIntEQ(EC_POINT_copy(NULL, NULL), 0);
 507    ExpectIntEQ(EC_POINT_copy(NULL, set_point), 0);
 508    ExpectIntEQ(EC_POINT_copy(new_point, NULL), 0);
 509    ExpectIntEQ(EC_POINT_copy(new_point, set_point), 1);
 510
 511    /* Test duplicating */
 512    ExpectNull(EC_POINT_dup(NULL, group));
 513    ExpectNull(EC_POINT_dup(set_point, NULL));
 514    ExpectNotNull(dup_point = EC_POINT_dup(set_point, group));
 515    ExpectIntEQ(EC_POINT_cmp(group, dup_point, set_point, ctx), 0);
 516
 517    /* Test inverting */
 518    ExpectIntEQ(EC_POINT_invert(NULL, NULL, ctx), 0);
 519    ExpectIntEQ(EC_POINT_invert(NULL, new_point, ctx), 0);
 520    ExpectIntEQ(EC_POINT_invert(group, NULL, ctx), 0);
 521    ExpectIntEQ(EC_POINT_invert(group, new_point, ctx), 1);
 522
 523#if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
 524    !defined(WOLFSSL_MICROCHIP_TA100) && \
 525    !defined(HAVE_SELFTEST) && !defined(WOLFSSL_SP_MATH) && \
 526    !defined(WOLF_CRYPTO_CB_ONLY_ECC)
 527    {
 528        EC_POINT* orig_point = NULL;
 529        ExpectNotNull(orig_point = EC_POINT_new(group));
 530        ExpectIntEQ(EC_POINT_add(group, orig_point, set_point, set_point, NULL),
 531                    1);
 532        /* new_point should be set_point inverted so adding it will revert
 533         * the point back to set_point */
 534        ExpectIntEQ(EC_POINT_add(group, orig_point, orig_point, new_point,
 535                                 NULL), 1);
 536        ExpectIntEQ(EC_POINT_cmp(group, orig_point, set_point, NULL), 0);
 537        /* dup_point equals set_point so let's test with that too */
 538        ExpectIntEQ(EC_POINT_add(group, orig_point, dup_point, dup_point, NULL),
 539                    1);
 540        ExpectIntEQ(EC_POINT_add(group, orig_point, orig_point, new_point,
 541                                 NULL), 1);
 542        ExpectIntEQ(EC_POINT_cmp(group, orig_point, set_point, NULL), 0);
 543        EC_POINT_free(orig_point);
 544    }
 545#endif
 546
 547    /* Test getting affine converts from projective. */
 548    ExpectIntEQ(EC_POINT_copy(set_point, new_point), 1);
 549    /* Force non-affine coordinates */
 550    ExpectIntEQ(BN_add(new_point->Z, (WOLFSSL_BIGNUM*)BN_value_one(),
 551        (WOLFSSL_BIGNUM*)BN_value_one()), 1);
 552    if (new_point != NULL) {
 553        new_point->inSet = 0;
 554    }
 555    /* extract the coordinates from point */
 556    ExpectIntEQ(EC_POINT_get_affine_coordinates_GFp(group, new_point, X, Y,
 557        ctx), WOLFSSL_SUCCESS);
 558    /* check if point ordinates have changed. */
 559    ExpectIntNE(BN_cmp(X, set_point->X), 0);
 560    ExpectIntNE(BN_cmp(Y, set_point->Y), 0);
 561
 562    /* Test check for infinity */
 563#ifndef WOLF_CRYPTO_CB_ONLY_ECC
 564    ExpectIntEQ(EC_POINT_is_at_infinity(NULL, NULL), 0);
 565    ExpectIntEQ(EC_POINT_is_at_infinity(NULL, infinity), 0);
 566    ExpectIntEQ(EC_POINT_is_at_infinity(group, NULL), 0);
 567    ExpectIntEQ(EC_POINT_is_at_infinity(group, infinity), 1);
 568    ExpectIntEQ(EC_POINT_is_at_infinity(group, Gxy), 0);
 569#else
 570    ExpectIntEQ(EC_POINT_is_at_infinity(group, infinity), 0);
 571#endif
 572
 573    ExpectPtrEq(EC_POINT_point2bn(group, set_point,
 574        POINT_CONVERSION_UNCOMPRESSED, set_point_bn, ctx), set_point_bn);
 575
 576    /* check bn2hex */
 577    hexStr = BN_bn2hex(k);
 578    ExpectStrEQ(hexStr, kTest);
 579#if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM) && \
 580     defined(XFPRINTF)
 581    BN_print_fp(stderr, k);
 582    fprintf(stderr, "\n");
 583#endif
 584    XFREE(hexStr, NULL, DYNAMIC_TYPE_ECC);
 585
 586    hexStr = BN_bn2hex(Gx);
 587    ExpectStrEQ(hexStr, kGx);
 588#if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM) && \
 589     defined(XFPRINTF)
 590    BN_print_fp(stderr, Gx);
 591    fprintf(stderr, "\n");
 592#endif
 593    XFREE(hexStr, NULL, DYNAMIC_TYPE_ECC);
 594
 595    hexStr = BN_bn2hex(Gy);
 596    ExpectStrEQ(hexStr, kGy);
 597#if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM) && \
 598     defined(XFPRINTF)
 599    BN_print_fp(stderr, Gy);
 600    fprintf(stderr, "\n");
 601#endif
 602    XFREE(hexStr, NULL, DYNAMIC_TYPE_ECC);
 603
 604    /* Test point to hex */
 605    ExpectNull(EC_POINT_point2hex(NULL, NULL, POINT_CONVERSION_UNCOMPRESSED,
 606        ctx));
 607    ExpectNull(EC_POINT_point2hex(NULL, Gxy, POINT_CONVERSION_UNCOMPRESSED,
 608        ctx));
 609    ExpectNull(EC_POINT_point2hex(group, NULL, POINT_CONVERSION_UNCOMPRESSED,
 610        ctx));
 611#ifndef HAVE_ECC_BRAINPOOL
 612    /* Group not supported in wolfCrypt. */
 613    ExpectNull(EC_POINT_point2hex(group2, Gxy, POINT_CONVERSION_UNCOMPRESSED,
 614        ctx));
 615#endif
 616
 617    hexStr = EC_POINT_point2hex(group, Gxy, POINT_CONVERSION_UNCOMPRESSED, ctx);
 618    ExpectNotNull(hexStr);
 619    ExpectStrEQ(hexStr, uncompG);
 620    ExpectNotNull(get_point = EC_POINT_hex2point(group, hexStr, NULL, ctx));
 621    ExpectIntEQ(EC_POINT_cmp(group, Gxy, get_point, ctx), 0);
 622    XFREE(hexStr, NULL, DYNAMIC_TYPE_ECC);
 623
 624    hexStr = EC_POINT_point2hex(group, Gxy, POINT_CONVERSION_COMPRESSED, ctx);
 625    ExpectNotNull(hexStr);
 626    ExpectStrEQ(hexStr, compG);
 627    #if defined(HAVE_COMP_KEY) && !defined(HAVE_SELFTEST)
 628    ExpectNotNull(get_point = EC_POINT_hex2point
 629                                            (group, hexStr, get_point, ctx));
 630    ExpectIntEQ(EC_POINT_cmp(group, Gxy, get_point, ctx), 0);
 631    #endif
 632    XFREE(hexStr, NULL, DYNAMIC_TYPE_ECC);
 633    EC_POINT_free(get_point);
 634    get_point = NULL;
 635
 636    /* Regression: oversized compressed-point hex must not overflow the stack
 637     * buffer in wolfSSL_EC_POINT_hex2point(). The byte length decoded from
 638     * the hex string must be bounded by the curve's ordinate size. */
 639    {
 640        char tooLongHex[2 + 600 + 1];
 641        size_t i;
 642
 643        tooLongHex[0] = '0';
 644        tooLongHex[1] = '3';
 645        for (i = 2; i < sizeof(tooLongHex) - 1; i++)
 646            tooLongHex[i] = 'A';
 647        tooLongHex[sizeof(tooLongHex) - 1] = '\0';
 648        ExpectNull(EC_POINT_hex2point(group, tooLongHex, NULL, ctx));
 649
 650        /* Same with the "02" (even Y) prefix. */
 651        tooLongHex[1] = '2';
 652        ExpectNull(EC_POINT_hex2point(group, tooLongHex, NULL, ctx));
 653
 654        /* Truncated uncompressed input: prefix "04" with too few hex chars
 655         * to cover the curve's coordinates. Must return NULL without
 656         * reading past the end of the input string. */
 657        ExpectNull(EC_POINT_hex2point(group, "04AB", NULL, ctx));
 658
 659        /* Empty payload after a recognized prefix. */
 660        ExpectNull(EC_POINT_hex2point(group, "03", NULL, ctx));
 661        ExpectNull(EC_POINT_hex2point(group, "04", NULL, ctx));
 662
 663        /* Partially populated compressed input: must be rejected so that
 664         * wolfSSL_ECPoint_d2i() does not consume uninitialized stack
 665         * bytes as the X coordinate. */
 666        ExpectNull(EC_POINT_hex2point(group, "03AB", NULL, ctx));
 667        ExpectNull(EC_POINT_hex2point(group, "02ABCD", NULL, ctx));
 668
 669        /* Odd-length compressed payload: 2*key_sz + 1 hex chars after
 670         * the "03" prefix (P-256: 65 chars). A truncating-divide bound
 671         * (sz = XSTRLEN/2) would round down to key_sz and accept this;
 672         * an exact-length compare must reject it. */
 673        {
 674            char oddLenHex[2 + 65 + 1];
 675            for (i = 2; i < sizeof(oddLenHex) - 1; i++)
 676                oddLenHex[i] = 'A';
 677            oddLenHex[0] = '0';
 678            oddLenHex[1] = '3';
 679            oddLenHex[sizeof(oddLenHex) - 1] = '\0';
 680            ExpectNull(EC_POINT_hex2point(group, oddLenHex, NULL, ctx));
 681        }
 682    }
 683
 684    #if defined(HAVE_COMP_KEY) && !defined(HAVE_SELFTEST)
 685    /* Round-trip a compressed point with even Y ("02" prefix) to verify
 686     * that the prefix-to-parity flag is honored in the compressed branch. */
 687    {
 688        EC_POINT* even_point = NULL;
 689        EC_POINT* round_trip = NULL;
 690        char*     even_hex   = NULL;
 691
 692        ExpectNotNull(even_point = EC_POINT_dup(Gxy, group));
 693        ExpectIntEQ(EC_POINT_invert(group, even_point, ctx), 1);
 694        ExpectNotNull(even_hex = EC_POINT_point2hex(group, even_point,
 695            POINT_CONVERSION_COMPRESSED, ctx));
 696        /* P-256 G has odd Y; inverting flips Y parity so prefix is "02". */
 697        ExpectIntEQ(even_hex[1], '2');
 698        ExpectNotNull(round_trip = EC_POINT_hex2point(group, even_hex, NULL,
 699            ctx));
 700        ExpectIntEQ(EC_POINT_cmp(group, even_point, round_trip, ctx), 0);
 701
 702        XFREE(even_hex, NULL, DYNAMIC_TYPE_ECC);
 703        EC_POINT_free(round_trip);
 704        EC_POINT_free(even_point);
 705    }
 706    #endif
 707
 708#ifndef HAVE_SELFTEST
 709    /* Test point to oct */
 710    ExpectIntEQ(EC_POINT_point2oct(NULL, NULL, POINT_CONVERSION_UNCOMPRESSED,
 711        NULL, 0, ctx), 0);
 712    ExpectIntEQ(EC_POINT_point2oct(NULL, Gxy, POINT_CONVERSION_UNCOMPRESSED,
 713        NULL, 0, ctx), 0);
 714    ExpectIntEQ(EC_POINT_point2oct(group, NULL, POINT_CONVERSION_UNCOMPRESSED,
 715        NULL, 0, ctx), 0);
 716    bin_len = EC_POINT_point2oct(group, Gxy, POINT_CONVERSION_UNCOMPRESSED,
 717        NULL, 0, ctx);
 718    ExpectIntEQ(bin_len, sizeof(binUncompG));
 719    ExpectNotNull(buf = (unsigned char*)XMALLOC(bin_len, NULL,
 720         DYNAMIC_TYPE_ECC));
 721    ExpectIntEQ(EC_POINT_point2oct(group, Gxy, POINT_CONVERSION_UNCOMPRESSED,
 722        buf, bin_len, ctx), bin_len);
 723    ExpectIntEQ(XMEMCMP(buf, binUncompG, sizeof(binUncompG)), 0);
 724    XFREE(buf, NULL, DYNAMIC_TYPE_ECC);
 725
 726    /* Infinity (x=0, y=0) encodes as '0x00'. */
 727    ExpectIntEQ(EC_POINT_point2oct(group, infinity,
 728        POINT_CONVERSION_UNCOMPRESSED, NULL, 0, ctx), 1);
 729    ExpectIntEQ(EC_POINT_point2oct(group, infinity,
 730        POINT_CONVERSION_UNCOMPRESSED, bufInf, 0, ctx), 0);
 731    ExpectIntEQ(EC_POINT_point2oct(group, infinity,
 732        POINT_CONVERSION_UNCOMPRESSED, bufInf, 1, ctx), 1);
 733    ExpectIntEQ(bufInf[0], 0);
 734
 735    wolfSSL_EC_POINT_dump(NULL, NULL);
 736    /* Test point i2d */
 737    ExpectIntEQ(ECPoint_i2d(NULL, NULL, NULL, &blen), 0);
 738    ExpectIntEQ(ECPoint_i2d(NULL, Gxy, NULL, &blen), 0);
 739    ExpectIntEQ(ECPoint_i2d(group, NULL, NULL, &blen), 0);
 740    ExpectIntEQ(ECPoint_i2d(group, Gxy, NULL, NULL), 0);
 741    ExpectIntEQ(ECPoint_i2d(group, Gxy, NULL, &blen), 1);
 742    ExpectIntEQ(blen, sizeof(binUncompG));
 743    ExpectNotNull(buf = (unsigned char*)XMALLOC(blen, NULL, DYNAMIC_TYPE_ECC));
 744    blen--;
 745    ExpectIntEQ(ECPoint_i2d(group, Gxy, buf, &blen), 0);
 746    blen++;
 747    ExpectIntEQ(ECPoint_i2d(group, Gxy, buf, &blen), 1);
 748    ExpectIntEQ(XMEMCMP(buf, binUncompG, sizeof(binUncompG)), 0);
 749    XFREE(buf, NULL, DYNAMIC_TYPE_ECC);
 750
 751#ifdef HAVE_COMP_KEY
 752    /* Test point to oct compressed */
 753    bin_len = EC_POINT_point2oct(group, Gxy, POINT_CONVERSION_COMPRESSED, NULL,
 754        0, ctx);
 755    ExpectIntEQ(bin_len, sizeof(binCompG));
 756    ExpectNotNull(buf = (unsigned char*)XMALLOC(bin_len, NULL,
 757        DYNAMIC_TYPE_ECC));
 758    ExpectIntEQ(EC_POINT_point2oct(group, Gxy, POINT_CONVERSION_COMPRESSED, buf,
 759        bin_len, ctx), bin_len);
 760    ExpectIntEQ(XMEMCMP(buf, binCompG, sizeof(binCompG)), 0);
 761    XFREE(buf, NULL, DYNAMIC_TYPE_ECC);
 762#endif
 763
 764    /* Test point BN */
 765    ExpectNull(wolfSSL_EC_POINT_point2bn(NULL, NULL,
 766        POINT_CONVERSION_UNCOMPRESSED, NULL, ctx));
 767    ExpectNull(wolfSSL_EC_POINT_point2bn(NULL, Gxy,
 768        POINT_CONVERSION_UNCOMPRESSED, NULL, ctx));
 769    ExpectNull(wolfSSL_EC_POINT_point2bn(group, NULL,
 770        POINT_CONVERSION_UNCOMPRESSED, NULL, ctx));
 771    ExpectNull(wolfSSL_EC_POINT_point2bn(group, Gxy, 0, NULL, ctx));
 772
 773    /* Test oct to point */
 774    ExpectNotNull(tmp = EC_POINT_new(group));
 775    ExpectIntEQ(EC_POINT_oct2point(NULL, NULL, binUncompG, sizeof(binUncompG),
 776        ctx), 0);
 777    ExpectIntEQ(EC_POINT_oct2point(NULL, tmp, binUncompG, sizeof(binUncompG),
 778        ctx), 0);
 779    ExpectIntEQ(EC_POINT_oct2point(group, NULL, binUncompG, sizeof(binUncompG),
 780        ctx), 0);
 781    ExpectIntEQ(EC_POINT_oct2point(group, tmp, binUncompGBad,
 782        sizeof(binUncompGBad), ctx), 0);
 783    ExpectIntEQ(EC_POINT_oct2point(group, tmp, binUncompG, sizeof(binUncompG),
 784        ctx), 1);
 785    ExpectIntEQ(EC_POINT_cmp(group, tmp, Gxy, ctx), 0);
 786    EC_POINT_free(tmp);
 787    tmp = NULL;
 788
 789    /* Test setting BN ordinates. */
 790    ExpectNotNull(tmp = EC_POINT_new(group));
 791    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(NULL, NULL, NULL,
 792        NULL, ctx), 0);
 793    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(group, NULL, NULL,
 794        NULL, ctx), 0);
 795    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(NULL, tmp, NULL,
 796        NULL, ctx), 0);
 797    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(NULL, NULL, Gx,
 798        NULL, ctx), 0);
 799    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(NULL, NULL, NULL,
 800        Gy, ctx), 0);
 801    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(NULL, tmp, Gx, Gy,
 802        ctx), 0);
 803    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(group, NULL, Gx, Gy,
 804        ctx), 0);
 805    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(group, tmp, NULL,
 806        Gy, ctx), 0);
 807    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(group, tmp, Gx,
 808        NULL, ctx), 0);
 809    ExpectIntEQ(wolfSSL_EC_POINT_set_affine_coordinates_GFp(group, tmp, Gx, Gy,
 810        ctx), 1);
 811    EC_POINT_free(tmp);
 812    tmp = NULL;
 813
 814    /* Test point d2i */
 815    ExpectNotNull(tmp = EC_POINT_new(group));
 816    ExpectIntEQ(ECPoint_d2i(NULL, sizeof(binUncompG), NULL, NULL), 0);
 817    ExpectIntEQ(ECPoint_d2i(binUncompG, sizeof(binUncompG), NULL, NULL), 0);
 818    ExpectIntEQ(ECPoint_d2i(NULL, sizeof(binUncompG), group, NULL), 0);
 819    ExpectIntEQ(ECPoint_d2i(NULL, sizeof(binUncompG), NULL, tmp), 0);
 820    ExpectIntEQ(ECPoint_d2i(NULL, sizeof(binUncompG), group, tmp), 0);
 821    ExpectIntEQ(ECPoint_d2i(binUncompG, sizeof(binUncompG), NULL, tmp), 0);
 822    ExpectIntEQ(ECPoint_d2i(binUncompG, sizeof(binUncompG), group, NULL), 0);
 823    ExpectIntEQ(ECPoint_d2i(binUncompGBad, sizeof(binUncompG), group, tmp), 0);
 824    ExpectIntEQ(ECPoint_d2i(binUncompG, sizeof(binUncompG), group, tmp), 1);
 825    ExpectIntEQ(EC_POINT_cmp(group, tmp, Gxy, ctx), 0);
 826    EC_POINT_free(tmp);
 827    tmp = NULL;
 828
 829#ifdef HAVE_COMP_KEY
 830    /* Test oct compressed to point */
 831    ExpectNotNull(tmp = EC_POINT_new(group));
 832    ExpectIntEQ(EC_POINT_oct2point(group, tmp, binCompG, sizeof(binCompG), ctx),
 833        1);
 834    ExpectIntEQ(EC_POINT_cmp(group, tmp, Gxy, ctx), 0);
 835    EC_POINT_free(tmp);
 836    tmp = NULL;
 837
 838    /* Test point d2i - compressed */
 839    ExpectNotNull(tmp = EC_POINT_new(group));
 840    ExpectIntEQ(ECPoint_d2i(binCompG, sizeof(binCompG), group, tmp), 1);
 841    ExpectIntEQ(EC_POINT_cmp(group, tmp, Gxy, ctx), 0);
 842    EC_POINT_free(tmp);
 843    tmp = NULL;
 844#endif
 845#endif
 846
 847    /* test BN_mod_add */
 848    ExpectIntEQ(BN_mod_add(new_point->Z, (WOLFSSL_BIGNUM*)BN_value_one(),
 849        (WOLFSSL_BIGNUM*)BN_value_one(), (WOLFSSL_BIGNUM*)BN_value_one(), NULL),
 850        1);
 851    ExpectIntEQ(BN_is_zero(new_point->Z), 1);
 852
 853    /* cleanup */
 854    BN_free(X);
 855    BN_free(Y);
 856    BN_free(k);
 857    BN_free(set_point_bn);
 858    EC_POINT_free(infinity);
 859    EC_POINT_free(dup_point);
 860    EC_POINT_free(new_point);
 861    EC_POINT_free(set_point);
 862    EC_POINT_clear_free(Gxy);
 863#ifndef HAVE_ECC_BRAINPOOL
 864    EC_GROUP_free(group2);
 865#endif
 866    EC_GROUP_free(group);
 867    BN_CTX_free(ctx);
 868#endif
 869#endif /* !WOLFSSL_SP_MATH && ( !HAVE_FIPS || HAVE_FIPS_VERSION > 2) */
 870    return EXPECT_RESULT();
 871}
 872
 873int test_wolfSSL_SPAKE(void)
 874{
 875    EXPECT_DECLS;
 876
 877#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC) && !defined(WOLFSSL_ATECC508A) \
 878    && !defined(WOLFSSL_ATECC608A) && !defined(HAVE_SELFTEST) && \
 879       !defined(WOLFSSL_MICROCHIP_TA100) && \
 880       !defined(WOLFSSL_SP_MATH) && !defined(WOLF_CRYPTO_CB_ONLY_ECC)
 881    BIGNUM* x = NULL; /* kdc priv */
 882    BIGNUM* y = NULL; /* client priv */
 883    BIGNUM* w = NULL; /* shared value */
 884    byte M_bytes[] = {
 885        /* uncompressed */
 886        0x04,
 887        /* x */
 888        0x88, 0x6e, 0x2f, 0x97, 0xac, 0xe4, 0x6e, 0x55, 0xba, 0x9d, 0xd7, 0x24,
 889        0x25, 0x79, 0xf2, 0x99, 0x3b, 0x64, 0xe1, 0x6e, 0xf3, 0xdc, 0xab, 0x95,
 890        0xaf, 0xd4, 0x97, 0x33, 0x3d, 0x8f, 0xa1, 0x2f,
 891        /* y */
 892        0x5f, 0xf3, 0x55, 0x16, 0x3e, 0x43, 0xce, 0x22, 0x4e, 0x0b, 0x0e, 0x65,
 893        0xff, 0x02, 0xac, 0x8e, 0x5c, 0x7b, 0xe0, 0x94, 0x19, 0xc7, 0x85, 0xe0,
 894        0xca, 0x54, 0x7d, 0x55, 0xa1, 0x2e, 0x2d, 0x20
 895    };
 896    EC_POINT* M = NULL; /* shared value */
 897    byte N_bytes[] = {
 898        /* uncompressed */
 899        0x04,
 900        /* x */
 901        0xd8, 0xbb, 0xd6, 0xc6, 0x39, 0xc6, 0x29, 0x37, 0xb0, 0x4d, 0x99, 0x7f,
 902        0x38, 0xc3, 0x77, 0x07, 0x19, 0xc6, 0x29, 0xd7, 0x01, 0x4d, 0x49, 0xa2,
 903        0x4b, 0x4f, 0x98, 0xba, 0xa1, 0x29, 0x2b, 0x49,
 904        /* y */
 905        0x07, 0xd6, 0x0a, 0xa6, 0xbf, 0xad, 0xe4, 0x50, 0x08, 0xa6, 0x36, 0x33,
 906        0x7f, 0x51, 0x68, 0xc6, 0x4d, 0x9b, 0xd3, 0x60, 0x34, 0x80, 0x8c, 0xd5,
 907        0x64, 0x49, 0x0b, 0x1e, 0x65, 0x6e, 0xdb, 0xe7
 908    };
 909    EC_POINT* N = NULL; /* shared value */
 910    EC_POINT* T = NULL; /* kdc pub */
 911    EC_POINT* tmp1 = NULL; /* kdc pub */
 912    EC_POINT* tmp2 = NULL; /* kdc pub */
 913    EC_POINT* S = NULL; /* client pub */
 914    EC_POINT* client_secret = NULL;
 915    EC_POINT* kdc_secret = NULL;
 916    EC_GROUP* group = NULL;
 917    BN_CTX* bn_ctx = NULL;
 918
 919    /* Values taken from a test run of Kerberos 5 */
 920
 921    ExpectNotNull(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
 922    ExpectNotNull(bn_ctx = BN_CTX_new());
 923
 924    ExpectNotNull(M = EC_POINT_new(group));
 925    ExpectNotNull(N = EC_POINT_new(group));
 926    ExpectNotNull(T = EC_POINT_new(group));
 927    ExpectNotNull(tmp1 = EC_POINT_new(group));
 928    ExpectNotNull(tmp2 = EC_POINT_new(group));
 929    ExpectNotNull(S = EC_POINT_new(group));
 930    ExpectNotNull(client_secret = EC_POINT_new(group));
 931    ExpectNotNull(kdc_secret = EC_POINT_new(group));
 932    ExpectIntEQ(BN_hex2bn(&x, "DAC3027CD692B4BDF0EDFE9B7D0E4E7"
 933                              "E5D8768A725EAEEA6FC68EC239A17C0"), 1);
 934    ExpectIntEQ(BN_hex2bn(&y, "6F6A1D394E26B1655A54B26DCE30D49"
 935                              "90CC47EBE08F809EF3FF7F6AEAABBB5"), 1);
 936    ExpectIntEQ(BN_hex2bn(&w, "1D992AB8BA851B9BA05353453D81EE9"
 937                              "506AB395478F0AAB647752CF117B36250"), 1);
 938    ExpectIntEQ(EC_POINT_oct2point(group, M, M_bytes, sizeof(M_bytes), bn_ctx),
 939                1);
 940    ExpectIntEQ(EC_POINT_oct2point(group, N, N_bytes, sizeof(N_bytes), bn_ctx),
 941                1);
 942
 943    /* Function pattern similar to ossl_keygen and ossl_result in krb5 */
 944
 945    /* kdc */
 946    /* T=x*P+w*M */
 947    /* All in one function call */
 948    ExpectIntEQ(EC_POINT_mul(group, T, x, M, w, bn_ctx), 1);
 949    /* Spread into separate calls */
 950    ExpectIntEQ(EC_POINT_mul(group, tmp1, x, NULL, NULL, bn_ctx), 1);
 951    ExpectIntEQ(EC_POINT_mul(group, tmp2, NULL, M, w, bn_ctx), 1);
 952    ExpectIntEQ(EC_POINT_add(group, tmp1, tmp1, tmp2, bn_ctx),
 953                1);
 954    ExpectIntEQ(EC_POINT_cmp(group, T, tmp1, bn_ctx), 0);
 955    /* client */
 956    /* S=y*P+w*N */
 957    /* All in one function call */
 958    ExpectIntEQ(EC_POINT_mul(group, S, y, N, w, bn_ctx), 1);
 959    /* Spread into separate calls */
 960    ExpectIntEQ(EC_POINT_mul(group, tmp1, y, NULL, NULL, bn_ctx), 1);
 961    ExpectIntEQ(EC_POINT_mul(group, tmp2, NULL, N, w, bn_ctx), 1);
 962    ExpectIntEQ(EC_POINT_add(group, tmp1, tmp1, tmp2, bn_ctx),
 963                1);
 964    ExpectIntEQ(EC_POINT_cmp(group, S, tmp1, bn_ctx), 0);
 965    /* K=y*(T-w*M) */
 966    ExpectIntEQ(EC_POINT_mul(group, client_secret, NULL, M, w, bn_ctx), 1);
 967    ExpectIntEQ(EC_POINT_invert(group, client_secret, bn_ctx), 1);
 968    ExpectIntEQ(EC_POINT_add(group, client_secret, T, client_secret, bn_ctx),
 969                1);
 970    ExpectIntEQ(EC_POINT_mul(group, client_secret, NULL, client_secret, y,
 971                             bn_ctx), 1);
 972    /* kdc */
 973    /* K=x*(S-w*N) */
 974    ExpectIntEQ(EC_POINT_mul(group, kdc_secret, NULL, N, w, bn_ctx), 1);
 975    ExpectIntEQ(EC_POINT_invert(group, kdc_secret, bn_ctx), 1);
 976    ExpectIntEQ(EC_POINT_add(group, kdc_secret, S, kdc_secret, bn_ctx),
 977                1);
 978    ExpectIntEQ(EC_POINT_mul(group, kdc_secret, NULL, kdc_secret, x, bn_ctx),
 979                1);
 980
 981    /* kdc_secret == client_secret */
 982    ExpectIntEQ(EC_POINT_cmp(group, client_secret, kdc_secret, bn_ctx), 0);
 983
 984    BN_free(x);
 985    BN_free(y);
 986    BN_free(w);
 987    EC_POINT_free(M);
 988    EC_POINT_free(N);
 989    EC_POINT_free(T);
 990    EC_POINT_free(tmp1);
 991    EC_POINT_free(tmp2);
 992    EC_POINT_free(S);
 993    EC_POINT_free(client_secret);
 994    EC_POINT_free(kdc_secret);
 995    EC_GROUP_free(group);
 996    BN_CTX_free(bn_ctx);
 997#endif
 998    return EXPECT_RESULT();
 999}
1000
1001int test_wolfSSL_EC_KEY_generate(void)
1002{
1003    EXPECT_DECLS;
1004#ifdef OPENSSL_EXTRA
1005    WOLFSSL_EC_KEY* key = NULL;
1006#ifndef HAVE_ECC_BRAINPOOL
1007    WOLFSSL_EC_GROUP* group = NULL;
1008#endif
1009
1010    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1011
1012    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(NULL), 0);
1013    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(key), 1);
1014    wolfSSL_EC_KEY_free(key);
1015    key = NULL;
1016
1017#ifndef HAVE_ECC_BRAINPOOL
1018    ExpectNotNull(group = wolfSSL_EC_GROUP_new_by_curve_name(
1019        NID_brainpoolP256r1));
1020    ExpectNotNull(key = wolfSSL_EC_KEY_new());
1021    ExpectIntEQ(wolfSSL_EC_KEY_set_group(key, group), 1);
1022    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(key), 0);
1023    wolfSSL_EC_KEY_free(key);
1024    wolfSSL_EC_GROUP_free(group);
1025#endif
1026#endif
1027    return EXPECT_RESULT();
1028}
1029
1030int test_EC_i2d(void)
1031{
1032    EXPECT_DECLS;
1033#if defined(OPENSSL_EXTRA) && !defined(HAVE_FIPS)
1034    EC_KEY *key = NULL;
1035    EC_KEY *copy = NULL;
1036    int len = 0;
1037    unsigned char *buf = NULL;
1038    unsigned char *p = NULL;
1039    const unsigned char *tmp = NULL;
1040    const unsigned char octBad[] = {
1041        0x09, 0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc,
1042        0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d,
1043        0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96,
1044        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb,
1045        0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31,
1046        0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
1047    };
1048
1049    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1050    ExpectIntEQ(EC_KEY_generate_key(key), 1);
1051    ExpectIntGT((len = i2d_EC_PUBKEY(key, NULL)), 0);
1052    ExpectNotNull(buf = (unsigned char*)XMALLOC(len, NULL,
1053        DYNAMIC_TYPE_TMP_BUFFER));
1054    p = buf;
1055    ExpectIntEQ(i2d_EC_PUBKEY(key, &p), len);
1056
1057    ExpectNull(o2i_ECPublicKey(NULL, NULL, -1));
1058    ExpectNull(o2i_ECPublicKey(&copy, NULL, -1));
1059    ExpectNull(o2i_ECPublicKey(&key, NULL, -1));
1060    ExpectNull(o2i_ECPublicKey(NULL, &tmp, -1));
1061    ExpectNull(o2i_ECPublicKey(NULL, NULL, 0));
1062    ExpectNull(o2i_ECPublicKey(&key, NULL, 0));
1063    ExpectNull(o2i_ECPublicKey(&key, &tmp, 0));
1064    tmp = buf;
1065    ExpectNull(o2i_ECPublicKey(NULL, &tmp, 0));
1066    ExpectNull(o2i_ECPublicKey(&copy, &tmp, 0));
1067    ExpectNull(o2i_ECPublicKey(NULL, &tmp, -1));
1068    ExpectNull(o2i_ECPublicKey(&key, &tmp, -1));
1069
1070    ExpectIntEQ(i2o_ECPublicKey(NULL, NULL), 0);
1071    ExpectIntEQ(i2o_ECPublicKey(NULL, &buf), 0);
1072
1073    tmp = buf;
1074    ExpectNull(d2i_ECPrivateKey(NULL, &tmp, 0));
1075    ExpectNull(d2i_ECPrivateKey(NULL, &tmp, 1));
1076    ExpectNull(d2i_ECPrivateKey(&copy, &tmp, 0));
1077    ExpectNull(d2i_ECPrivateKey(&copy, &tmp, 1));
1078    ExpectNull(d2i_ECPrivateKey(&key, &tmp, 0));
1079
1080    {
1081        EC_KEY *pubkey = NULL;
1082        BIO* bio = NULL;
1083
1084        ExpectNotNull(bio = BIO_new(BIO_s_mem()));
1085        ExpectIntGT(BIO_write(bio, buf, len), 0);
1086        ExpectNotNull(d2i_EC_PUBKEY_bio(bio, &pubkey));
1087
1088        BIO_free(bio);
1089        EC_KEY_free(pubkey);
1090    }
1091
1092    ExpectIntEQ(i2d_ECPrivateKey(NULL, &p), 0);
1093    ExpectIntEQ(i2d_ECPrivateKey(NULL, NULL), 0);
1094
1095    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer(NULL, NULL, -1), -1);
1096    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(NULL, NULL, -1, 0), -1);
1097    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, NULL, -1, 0), -1);
1098    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(NULL, buf, -1, 0), -1);
1099    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(NULL, NULL, 0, 0), -1);
1100    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(NULL, NULL, -1,
1101        WOLFSSL_EC_KEY_LOAD_PUBLIC), -1);
1102    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(NULL, buf, len,
1103        WOLFSSL_EC_KEY_LOAD_PUBLIC), -1);
1104    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, NULL, len,
1105        WOLFSSL_EC_KEY_LOAD_PUBLIC), -1);
1106    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, buf, -1,
1107        WOLFSSL_EC_KEY_LOAD_PUBLIC), -1);
1108    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, buf, len, 0), -1);
1109    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, buf, len,
1110        WOLFSSL_EC_KEY_LOAD_PRIVATE), -1);
1111    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, octBad, sizeof(octBad),
1112        WOLFSSL_EC_KEY_LOAD_PRIVATE), -1);
1113    ExpectIntEQ(wolfSSL_EC_KEY_LoadDer_ex(key, octBad, sizeof(octBad),
1114        WOLFSSL_EC_KEY_LOAD_PUBLIC), -1);
1115
1116    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1117    buf = NULL;
1118    buf = NULL;
1119
1120    ExpectIntGT((len = i2d_ECPrivateKey(key, NULL)), 0);
1121    ExpectNotNull(buf = (unsigned char*)XMALLOC(len, NULL,
1122        DYNAMIC_TYPE_TMP_BUFFER));
1123    p = buf;
1124    ExpectIntEQ(i2d_ECPrivateKey(key, &p), len);
1125
1126    p = NULL;
1127    ExpectIntEQ(i2d_ECPrivateKey(key, &p), len);
1128    XFREE(p, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1129    p = NULL;
1130
1131    /* Bad point is also an invalid private key. */
1132    tmp = octBad;
1133    ExpectNull(d2i_ECPrivateKey(&copy, &tmp, sizeof(octBad)));
1134    tmp = buf;
1135    ExpectNotNull(d2i_ECPrivateKey(&copy, &tmp, len));
1136    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1137    buf = NULL;
1138    buf = NULL;
1139
1140    ExpectIntGT((len = i2o_ECPublicKey(key, NULL)), 0);
1141    ExpectNotNull(buf = (unsigned char*)XMALLOC(len, NULL,
1142        DYNAMIC_TYPE_TMP_BUFFER));
1143    p = buf;
1144    ExpectIntGT((len = i2o_ECPublicKey(key, &p)), 0);
1145    p = NULL;
1146    ExpectIntGT((len = i2o_ECPublicKey(key, &p)), 0);
1147    tmp = buf;
1148    ExpectNotNull(o2i_ECPublicKey(&copy, &tmp, len));
1149    tmp = octBad;
1150    ExpectNull(o2i_ECPublicKey(&key, &tmp, sizeof(octBad)));
1151
1152    ExpectIntEQ(EC_KEY_check_key(NULL), 0);
1153    ExpectIntEQ(EC_KEY_check_key(key), 1);
1154
1155    XFREE(p, NULL, DYNAMIC_TYPE_OPENSSL);
1156    XFREE(buf, NULL, DYNAMIC_TYPE_OPENSSL);
1157
1158    EC_KEY_free(key);
1159    EC_KEY_free(copy);
1160#endif
1161    return EXPECT_RESULT();
1162}
1163
1164int test_wolfSSL_EC_curve(void)
1165{
1166    EXPECT_DECLS;
1167#if defined(OPENSSL_EXTRA)
1168    int nid = NID_secp160k1;
1169    const char* nid_name = NULL;
1170
1171    ExpectNull(EC_curve_nid2nist(NID_sha256));
1172
1173    ExpectNotNull(nid_name = EC_curve_nid2nist(nid));
1174    ExpectIntEQ(XMEMCMP(nid_name, "K-160", XSTRLEN("K-160")), 0);
1175
1176    ExpectIntEQ(EC_curve_nist2nid("INVALID"), 0);
1177    ExpectIntEQ(EC_curve_nist2nid(nid_name), nid);
1178#endif
1179    return EXPECT_RESULT();
1180}
1181
1182int test_wolfSSL_EC_KEY_dup(void)
1183{
1184    EXPECT_DECLS;
1185#if defined(OPENSSL_ALL) && !defined(NO_CERTS)
1186    WOLFSSL_EC_KEY* ecKey = NULL;
1187    WOLFSSL_EC_KEY* dupKey = NULL;
1188    ecc_key* srcKey = NULL;
1189    ecc_key* destKey = NULL;
1190
1191    ExpectNotNull(ecKey = wolfSSL_EC_KEY_new());
1192    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(ecKey), 1);
1193
1194    /* Valid cases */
1195    ExpectNotNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1196    ExpectIntEQ(EC_KEY_check_key(dupKey), 1);
1197
1198    /* Compare pubkey */
1199    if (ecKey != NULL) {
1200        srcKey = (ecc_key*)ecKey->internal;
1201    }
1202    if (dupKey != NULL) {
1203        destKey = (ecc_key*)dupKey->internal;
1204    }
1205    ExpectIntEQ(wc_ecc_cmp_point(&srcKey->pubkey, &destKey->pubkey), 0);
1206
1207    /* compare EC_GROUP */
1208    ExpectIntEQ(wolfSSL_EC_GROUP_cmp(ecKey->group, dupKey->group, NULL), MP_EQ);
1209
1210    /* compare EC_POINT */
1211    ExpectIntEQ(wolfSSL_EC_POINT_cmp(ecKey->group, ecKey->pub_key, \
1212                dupKey->pub_key, NULL), MP_EQ);
1213
1214    /* compare BIGNUM */
1215    ExpectIntEQ(wolfSSL_BN_cmp(ecKey->priv_key, dupKey->priv_key), MP_EQ);
1216    wolfSSL_EC_KEY_free(dupKey);
1217    dupKey = NULL;
1218
1219    /* Invalid cases */
1220    /* NULL key */
1221    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(NULL));
1222    /* NULL ecc_key */
1223    if (ecKey != NULL) {
1224        wc_ecc_free((ecc_key*)ecKey->internal);
1225        XFREE(ecKey->internal, NULL, DYNAMIC_TYPE_ECC);
1226        ecKey->internal = NULL; /* Set ecc_key to NULL */
1227    }
1228    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1229    wolfSSL_EC_KEY_free(ecKey);
1230    ecKey = NULL;
1231    wolfSSL_EC_KEY_free(dupKey);
1232    dupKey = NULL;
1233
1234    /* NULL Group */
1235    ExpectNotNull(ecKey = wolfSSL_EC_KEY_new());
1236    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(ecKey), 1);
1237    if (ecKey != NULL) {
1238        wolfSSL_EC_GROUP_free(ecKey->group);
1239        ecKey->group = NULL; /* Set group to NULL */
1240    }
1241    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1242    wolfSSL_EC_KEY_free(ecKey);
1243    ecKey = NULL;
1244    wolfSSL_EC_KEY_free(dupKey);
1245    dupKey = NULL;
1246
1247    /* NULL public key */
1248    ExpectNotNull(ecKey = wolfSSL_EC_KEY_new());
1249    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(ecKey), 1);
1250    if (ecKey != NULL) {
1251        wc_ecc_del_point((ecc_point*)ecKey->pub_key->internal);
1252        ecKey->pub_key->internal = NULL; /* Set ecc_point to NULL */
1253    }
1254
1255    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1256    if (ecKey != NULL) {
1257        wolfSSL_EC_POINT_free(ecKey->pub_key);
1258        ecKey->pub_key = NULL; /* Set pub_key to NULL */
1259    }
1260    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1261    wolfSSL_EC_KEY_free(ecKey);
1262    ecKey = NULL;
1263    wolfSSL_EC_KEY_free(dupKey);
1264    dupKey = NULL;
1265
1266    /* NULL private key */
1267    ExpectNotNull(ecKey = wolfSSL_EC_KEY_new());
1268    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(ecKey), 1);
1269
1270    if (ecKey != NULL) {
1271        wolfSSL_BN_free(ecKey->priv_key);
1272        ecKey->priv_key = NULL; /* Set priv_key to NULL */
1273    }
1274    ExpectNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1275
1276    wolfSSL_EC_KEY_free(ecKey);
1277    ecKey = NULL;
1278    wolfSSL_EC_KEY_free(dupKey);
1279    dupKey = NULL;
1280
1281    /* Test EC_KEY_up_ref */
1282    ExpectNotNull(ecKey = wolfSSL_EC_KEY_new());
1283    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(ecKey), WOLFSSL_SUCCESS);
1284    ExpectIntEQ(wolfSSL_EC_KEY_up_ref(NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1285    ExpectIntEQ(wolfSSL_EC_KEY_up_ref(ecKey), WOLFSSL_SUCCESS);
1286    /* reference count doesn't follow duplicate */
1287    ExpectNotNull(dupKey = wolfSSL_EC_KEY_dup(ecKey));
1288    ExpectIntEQ(wolfSSL_EC_KEY_up_ref(dupKey), WOLFSSL_SUCCESS); /* +1 */
1289    ExpectIntEQ(wolfSSL_EC_KEY_up_ref(dupKey), WOLFSSL_SUCCESS); /* +2 */
1290    wolfSSL_EC_KEY_free(dupKey); /* 3 */
1291    wolfSSL_EC_KEY_free(dupKey); /* 2 */
1292    wolfSSL_EC_KEY_free(dupKey); /* 1, free */
1293    wolfSSL_EC_KEY_free(ecKey);  /* 2 */
1294    wolfSSL_EC_KEY_free(ecKey);  /* 1, free */
1295#endif
1296    return EXPECT_RESULT();
1297}
1298
1299int test_wolfSSL_EC_KEY_set_group(void)
1300{
1301    EXPECT_DECLS;
1302#if defined(HAVE_ECC) && !defined(NO_ECC256) && !defined(NO_ECC_SECP) && \
1303    defined(OPENSSL_EXTRA)
1304    EC_KEY   *key    = NULL;
1305    EC_GROUP *group  = NULL;
1306    const EC_GROUP *group2 = NULL;
1307
1308    ExpectNotNull(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
1309    ExpectNotNull(key = EC_KEY_new());
1310
1311    ExpectNull(EC_KEY_get0_group(NULL));
1312    ExpectIntEQ(EC_KEY_set_group(NULL, NULL), 0);
1313    ExpectIntEQ(EC_KEY_set_group(key, NULL), 0);
1314    ExpectIntEQ(EC_KEY_set_group(NULL, group), 0);
1315
1316    ExpectIntEQ(EC_KEY_set_group(key, group), WOLFSSL_SUCCESS);
1317    ExpectNotNull(group2 = EC_KEY_get0_group(key));
1318    ExpectIntEQ(EC_GROUP_cmp(group2, group, NULL), 0);
1319
1320    EC_GROUP_free(group);
1321    EC_KEY_free(key);
1322#endif
1323    return EXPECT_RESULT();
1324}
1325
1326int test_wolfSSL_EC_KEY_set_conv_form(void)
1327{
1328    EXPECT_DECLS;
1329#if defined(HAVE_ECC) && defined(OPENSSL_EXTRA) && !defined(NO_BIO) && \
1330    !defined(NO_FILESYSTEM)
1331    BIO* bio = NULL;
1332    EC_KEY* key = NULL;
1333
1334    /* Error condition: NULL key. */
1335    ExpectIntLT(EC_KEY_get_conv_form(NULL), 0);
1336
1337    ExpectNotNull(bio = BIO_new_file("./certs/ecc-keyPub.pem", "rb"));
1338    ExpectNotNull(key = PEM_read_bio_EC_PUBKEY(bio, NULL, NULL, NULL));
1339    /* Conversion form defaults to uncompressed. */
1340    ExpectIntEQ(EC_KEY_get_conv_form(key), POINT_CONVERSION_UNCOMPRESSED);
1341#ifdef HAVE_COMP_KEY
1342    /* Explicitly set to compressed. */
1343    EC_KEY_set_conv_form(key, POINT_CONVERSION_COMPRESSED);
1344    ExpectIntEQ(EC_KEY_get_conv_form(key), POINT_CONVERSION_COMPRESSED);
1345#else
1346    /* Will still work just won't change anything. */
1347    EC_KEY_set_conv_form(key, POINT_CONVERSION_COMPRESSED);
1348    ExpectIntEQ(EC_KEY_get_conv_form(key), POINT_CONVERSION_UNCOMPRESSED);
1349    EC_KEY_set_conv_form(key, POINT_CONVERSION_UNCOMPRESSED);
1350    ExpectIntEQ(EC_KEY_get_conv_form(key), POINT_CONVERSION_UNCOMPRESSED);
1351#endif
1352    EC_KEY_set_conv_form(NULL, POINT_CONVERSION_UNCOMPRESSED);
1353
1354    BIO_free(bio);
1355    EC_KEY_free(key);
1356#endif
1357    return EXPECT_RESULT();
1358}
1359
1360int test_wolfSSL_EC_KEY_private_key(void)
1361{
1362    EXPECT_DECLS;
1363#if defined(OPENSSL_EXTRA) && !defined(NO_BIO)
1364    WOLFSSL_EC_KEY* key = NULL;
1365    WOLFSSL_BIGNUM* priv = NULL;
1366    WOLFSSL_BIGNUM* priv2 = NULL;
1367    WOLFSSL_BIGNUM* bn = NULL;
1368
1369    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1370    ExpectNotNull(priv = wolfSSL_BN_new());
1371    ExpectNotNull(priv2 = wolfSSL_BN_new());
1372    ExpectIntNE(BN_set_word(priv, 2), 0);
1373    ExpectIntNE(BN_set_word(priv2, 2), 0);
1374
1375    ExpectNull(wolfSSL_EC_KEY_get0_private_key(NULL));
1376    /* No private key set. */
1377    ExpectNull(wolfSSL_EC_KEY_get0_private_key(key));
1378
1379    ExpectIntEQ(wolfSSL_EC_KEY_set_private_key(NULL, NULL), 0);
1380    ExpectIntEQ(wolfSSL_EC_KEY_set_private_key(key, NULL), 0);
1381    ExpectIntEQ(wolfSSL_EC_KEY_set_private_key(NULL, priv), 0);
1382
1383    ExpectIntEQ(wolfSSL_EC_KEY_set_private_key(key, priv), 1);
1384    ExpectNotNull(bn = wolfSSL_EC_KEY_get0_private_key(key));
1385    ExpectPtrNE(bn, priv);
1386    ExpectIntEQ(wolfSSL_EC_KEY_set_private_key(key, priv2), 1);
1387    ExpectNotNull(bn = wolfSSL_EC_KEY_get0_private_key(key));
1388    ExpectPtrNE(bn, priv2);
1389
1390    wolfSSL_BN_free(priv2);
1391    wolfSSL_BN_free(priv);
1392    wolfSSL_EC_KEY_free(key);
1393#endif
1394    return EXPECT_RESULT();
1395}
1396
1397int test_wolfSSL_EC_KEY_public_key(void)
1398{
1399    EXPECT_DECLS;
1400#if defined(OPENSSL_EXTRA) && !defined(NO_BIO)
1401    WOLFSSL_EC_KEY* key = NULL;
1402    WOLFSSL_EC_POINT* pub = NULL;
1403    WOLFSSL_EC_POINT* point = NULL;
1404
1405    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1406
1407    ExpectNull(wolfSSL_EC_KEY_get0_public_key(NULL));
1408    ExpectNotNull(wolfSSL_EC_KEY_get0_public_key(key));
1409
1410    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(key), 1);
1411
1412    ExpectNotNull(pub = wolfSSL_EC_KEY_get0_public_key(key));
1413
1414    ExpectIntEQ(wolfSSL_EC_KEY_set_public_key(NULL, NULL), 0);
1415    ExpectIntEQ(wolfSSL_EC_KEY_set_public_key(key, NULL), 0);
1416    ExpectIntEQ(wolfSSL_EC_KEY_set_public_key(NULL, pub), 0);
1417
1418    ExpectIntEQ(wolfSSL_EC_KEY_set_public_key(key, pub), 1);
1419    ExpectNotNull(point = wolfSSL_EC_KEY_get0_public_key(key));
1420    ExpectPtrEq(point, pub);
1421
1422    wolfSSL_EC_KEY_free(key);
1423#endif
1424    return EXPECT_RESULT();
1425}
1426
1427int test_wolfSSL_EC_KEY_print_fp(void)
1428{
1429    EXPECT_DECLS;
1430#if defined(HAVE_ECC) && ((defined(HAVE_ECC224) && defined(HAVE_ECC256)) || \
1431    defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 224 && \
1432    defined(OPENSSL_EXTRA) && defined(XFPRINTF) && !defined(NO_FILESYSTEM) && \
1433    !defined(NO_STDIO_FILESYSTEM)
1434    EC_KEY* key = NULL;
1435
1436    /* Bad file pointer. */
1437    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(NULL, key, 0),
1438        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1439    /* NULL key. */
1440    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(stderr, NULL, 0),
1441        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1442    ExpectNotNull((key = wolfSSL_EC_KEY_new_by_curve_name(NID_secp224r1)));
1443    /* Negative indent. */
1444    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(stderr, key, -1),
1445        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1446
1447    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(stderr, key, 4), WOLFSSL_SUCCESS);
1448    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(key), WOLFSSL_SUCCESS);
1449    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(stderr, key, 4), WOLFSSL_SUCCESS);
1450    wolfSSL_EC_KEY_free(key);
1451
1452    ExpectNotNull((key = wolfSSL_EC_KEY_new_by_curve_name(
1453        NID_X9_62_prime256v1)));
1454    ExpectIntEQ(wolfSSL_EC_KEY_generate_key(key), WOLFSSL_SUCCESS);
1455    ExpectIntEQ(wolfSSL_EC_KEY_print_fp(stderr, key, 4), WOLFSSL_SUCCESS);
1456    wolfSSL_EC_KEY_free(key);
1457#endif
1458    return EXPECT_RESULT();
1459}
1460
1461int test_wolfSSL_EC_get_builtin_curves(void)
1462{
1463    EXPECT_DECLS;
1464#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
1465#if !defined(HAVE_FIPS) || (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION>2))
1466    EC_builtin_curve* curves = NULL;
1467    size_t crv_len = 0;
1468    size_t i = 0;
1469
1470    ExpectIntGT((crv_len = EC_get_builtin_curves(NULL, 0)), 0);
1471    ExpectNotNull(curves = (EC_builtin_curve*)XMALLOC(
1472        sizeof(EC_builtin_curve) * crv_len, NULL, DYNAMIC_TYPE_TMP_BUFFER));
1473
1474    ExpectIntEQ((EC_get_builtin_curves(curves, 0)), crv_len);
1475    ExpectIntEQ(EC_get_builtin_curves(curves, crv_len), crv_len);
1476
1477    for (i = 0; EXPECT_SUCCESS() && (i < crv_len); i++) {
1478        if (curves[i].comment != NULL) {
1479            ExpectStrEQ(OBJ_nid2sn(curves[i].nid), curves[i].comment);
1480        }
1481    }
1482
1483    if (crv_len > 1) {
1484        ExpectIntEQ(EC_get_builtin_curves(curves, crv_len - 1), crv_len - 1);
1485    }
1486
1487    XFREE(curves, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1488#endif /* !HAVE_FIPS || HAVE_FIPS_VERSION > 2 */
1489#endif /* OPENSSL_EXTRA || OPENSSL_ALL */
1490    return EXPECT_RESULT();
1491}
1492
1493int test_wolfSSL_ECDSA_SIG(void)
1494{
1495    EXPECT_DECLS;
1496#ifdef OPENSSL_EXTRA
1497    WOLFSSL_ECDSA_SIG* sig = NULL;
1498    WOLFSSL_ECDSA_SIG* sig2 = NULL;
1499    WOLFSSL_BIGNUM* r = NULL;
1500    WOLFSSL_BIGNUM* s = NULL;
1501    const WOLFSSL_BIGNUM* r2 = NULL;
1502    const WOLFSSL_BIGNUM* s2 = NULL;
1503    const unsigned char* cp = NULL;
1504    unsigned char* p = NULL;
1505    unsigned char outSig[8];
1506    unsigned char sigData[8] =
1507                             { 0x30, 0x06, 0x02, 0x01, 0x01, 0x02, 0x01, 0x01 };
1508    unsigned char sigDataBad[8] =
1509                             { 0x30, 0x07, 0x02, 0x01, 0x01, 0x02, 0x01, 0x01 };
1510
1511    wolfSSL_ECDSA_SIG_free(NULL);
1512
1513    ExpectNotNull(sig = wolfSSL_ECDSA_SIG_new());
1514    ExpectNotNull(r = wolfSSL_BN_new());
1515    ExpectNotNull(s = wolfSSL_BN_new());
1516    ExpectIntEQ(wolfSSL_BN_set_word(r, 1), 1);
1517    ExpectIntEQ(wolfSSL_BN_set_word(s, 1), 1);
1518
1519    wolfSSL_ECDSA_SIG_get0(NULL, NULL, NULL);
1520    wolfSSL_ECDSA_SIG_get0(NULL, &r2, NULL);
1521    wolfSSL_ECDSA_SIG_get0(NULL, NULL, &s2);
1522    wolfSSL_ECDSA_SIG_get0(NULL, &r2, &s2);
1523    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(NULL, NULL, NULL), 0);
1524    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(sig, NULL, NULL), 0);
1525    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(NULL, r, NULL), 0);
1526    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(NULL, NULL, s), 0);
1527    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(NULL, r, s), 0);
1528    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(sig, NULL, s), 0);
1529    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(sig, r, NULL), 0);
1530
1531    r2 = NULL;
1532    s2 = NULL;
1533    wolfSSL_ECDSA_SIG_get0(NULL, &r2, &s2);
1534    ExpectNull(r2);
1535    ExpectNull(s2);
1536    ExpectIntEQ(wolfSSL_ECDSA_SIG_set0(sig, r, s), 1);
1537    if (EXPECT_FAIL()) {
1538        wolfSSL_BN_free(r);
1539        wolfSSL_BN_free(s);
1540    }
1541    wolfSSL_ECDSA_SIG_get0(sig, &r2, &s2);
1542    ExpectPtrEq(r2, r);
1543    ExpectPtrEq(s2, s);
1544    r2 = NULL;
1545    wolfSSL_ECDSA_SIG_get0(sig, &r2, NULL);
1546    ExpectPtrEq(r2, r);
1547    s2 = NULL;
1548    wolfSSL_ECDSA_SIG_get0(sig, NULL, &s2);
1549    ExpectPtrEq(s2, s);
1550
1551    /* r and s are freed when sig is freed. */
1552    wolfSSL_ECDSA_SIG_free(sig);
1553    sig = NULL;
1554
1555    ExpectNull(wolfSSL_d2i_ECDSA_SIG(NULL, NULL, sizeof(sigData)));
1556    cp = sigDataBad;
1557    ExpectNull(wolfSSL_d2i_ECDSA_SIG(NULL, &cp, sizeof(sigDataBad)));
1558    cp = sigData;
1559    ExpectNotNull((sig = wolfSSL_d2i_ECDSA_SIG(NULL, &cp, sizeof(sigData))));
1560    ExpectIntEQ((cp == sigData + 8), 1);
1561    cp = sigData;
1562    ExpectNull(wolfSSL_d2i_ECDSA_SIG(&sig, NULL, sizeof(sigData)));
1563    ExpectNotNull((sig2 = wolfSSL_d2i_ECDSA_SIG(&sig, &cp, sizeof(sigData))));
1564    ExpectIntEQ((sig == sig2), 1);
1565    cp = outSig;
1566
1567    p = outSig;
1568    ExpectIntEQ(wolfSSL_i2d_ECDSA_SIG(NULL, &p), 0);
1569    ExpectIntEQ(wolfSSL_i2d_ECDSA_SIG(NULL, NULL), 0);
1570    ExpectIntEQ(wolfSSL_i2d_ECDSA_SIG(sig, NULL), 8);
1571    ExpectIntEQ(wolfSSL_i2d_ECDSA_SIG(sig, &p), sizeof(sigData));
1572    ExpectIntEQ((p == outSig + 8), 1);
1573    ExpectIntEQ(XMEMCMP(sigData, outSig, 8), 0);
1574
1575    p = NULL;
1576    ExpectIntEQ(wolfSSL_i2d_ECDSA_SIG(sig, &p), 8);
1577#ifndef WOLFSSL_I2D_ECDSA_SIG_ALLOC
1578    ExpectNull(p);
1579#else
1580    ExpectNotNull(p);
1581    ExpectIntEQ(XMEMCMP(p, outSig, 8), 0);
1582    XFREE(p, NULL, DYNAMIC_TYPE_OPENSSL);
1583#endif
1584
1585    wolfSSL_ECDSA_SIG_free(sig);
1586#endif
1587    return EXPECT_RESULT();
1588}
1589
1590int test_ECDSA_size_sign(void)
1591{
1592    EXPECT_DECLS;
1593#if defined(OPENSSL_EXTRA) && !defined(NO_ECC256) && !defined(NO_ECC_SECP)
1594    EC_KEY* key = NULL;
1595    ECDSA_SIG* ecdsaSig = NULL;
1596    int id;
1597    byte hash[WC_MAX_DIGEST_SIZE];
1598    byte hash2[WC_MAX_DIGEST_SIZE];
1599    byte sig[ECC_MAX_SIG_SIZE];
1600    unsigned int sigSz = sizeof(sig);
1601
1602    XMEMSET(hash, 123, sizeof(hash));
1603    XMEMSET(hash2, 234, sizeof(hash2));
1604
1605    id = wc_ecc_get_curve_id_from_name("SECP256R1");
1606    ExpectIntEQ(id, ECC_SECP256R1);
1607
1608    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1609    ExpectIntEQ(EC_KEY_generate_key(key), 1);
1610
1611    ExpectIntGE(ECDSA_size(NULL), 0);
1612
1613    ExpectIntEQ(ECDSA_sign(0, hash, sizeof(hash), sig, &sigSz, NULL), 0);
1614    ExpectIntEQ(ECDSA_sign(0, NULL, sizeof(hash), sig, &sigSz, key), 0);
1615    ExpectIntEQ(ECDSA_sign(0, hash, sizeof(hash), NULL, &sigSz, key), 0);
1616    ExpectIntEQ(ECDSA_verify(0, hash, sizeof(hash), sig, (int)sigSz, NULL), 0);
1617    ExpectIntEQ(ECDSA_verify(0, NULL, sizeof(hash), sig, (int)sigSz, key), 0);
1618    ExpectIntEQ(ECDSA_verify(0, hash, sizeof(hash), NULL, (int)sigSz, key), 0);
1619
1620    ExpectIntEQ(ECDSA_sign(0, hash, sizeof(hash), sig, &sigSz, key), 1);
1621    ExpectIntGE(ECDSA_size(key), sigSz);
1622    ExpectIntEQ(ECDSA_verify(0, hash, sizeof(hash), sig, (int)sigSz, key), 1);
1623    ExpectIntEQ(ECDSA_verify(0, hash2, sizeof(hash2), sig, (int)sigSz, key), 0);
1624
1625    ExpectNull(ECDSA_do_sign(NULL, sizeof(hash), NULL));
1626    ExpectNull(ECDSA_do_sign(NULL, sizeof(hash), key));
1627    ExpectNull(ECDSA_do_sign(hash, sizeof(hash), NULL));
1628    ExpectNotNull(ecdsaSig = ECDSA_do_sign(hash, sizeof(hash), key));
1629    ExpectIntEQ(ECDSA_do_verify(NULL, sizeof(hash), NULL, NULL), -1);
1630    ExpectIntEQ(ECDSA_do_verify(hash, sizeof(hash), NULL, NULL), -1);
1631    ExpectIntEQ(ECDSA_do_verify(NULL, sizeof(hash), ecdsaSig, NULL), -1);
1632    ExpectIntEQ(ECDSA_do_verify(NULL, sizeof(hash), NULL, key), -1);
1633    ExpectIntEQ(ECDSA_do_verify(NULL, sizeof(hash), ecdsaSig, key), -1);
1634    ExpectIntEQ(ECDSA_do_verify(hash, sizeof(hash), NULL, key), -1);
1635    ExpectIntEQ(ECDSA_do_verify(hash, sizeof(hash), ecdsaSig, NULL), -1);
1636    ExpectIntEQ(ECDSA_do_verify(hash, sizeof(hash), ecdsaSig, key), 1);
1637    ExpectIntEQ(ECDSA_do_verify(hash2, sizeof(hash2), ecdsaSig, key), 0);
1638    ECDSA_SIG_free(ecdsaSig);
1639
1640    EC_KEY_free(key);
1641#endif /* OPENSSL_EXTRA && !NO_ECC256 && !NO_ECC_SECP */
1642    return EXPECT_RESULT();
1643}
1644
1645int test_ECDH_compute_key(void)
1646{
1647    EXPECT_DECLS;
1648#if defined(OPENSSL_EXTRA) && !defined(NO_ECC256) && !defined(NO_ECC_SECP) && \
1649    !defined(WOLF_CRYPTO_CB_ONLY_ECC)
1650    EC_KEY* key1 = NULL;
1651    EC_KEY* key2 = NULL;
1652    EC_POINT* pub1 = NULL;
1653    EC_POINT* pub2 = NULL;
1654    byte secret1[32];
1655    byte secret2[32];
1656    int i;
1657
1658    ExpectNotNull(key1 = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1659    ExpectIntEQ(EC_KEY_generate_key(key1), 1);
1660    ExpectNotNull(pub1 = wolfSSL_EC_KEY_get0_public_key(key1));
1661    ExpectNotNull(key2 = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
1662    ExpectIntEQ(EC_KEY_generate_key(key2), 1);
1663    ExpectNotNull(pub2 = wolfSSL_EC_KEY_get0_public_key(key2));
1664
1665    ExpectIntEQ(ECDH_compute_key(NULL, sizeof(secret1), NULL, NULL, NULL), 0);
1666    ExpectIntEQ(ECDH_compute_key(secret1, sizeof(secret1), NULL, NULL, NULL),
1667        0);
1668    ExpectIntEQ(ECDH_compute_key(NULL, sizeof(secret1), pub2, NULL, NULL), 0);
1669    ExpectIntEQ(ECDH_compute_key(NULL, sizeof(secret1), NULL, key1, NULL), 0);
1670    ExpectIntEQ(ECDH_compute_key(NULL, sizeof(secret1), pub2, key1, NULL), 0);
1671    ExpectIntEQ(ECDH_compute_key(secret1, sizeof(secret1), NULL, key1, NULL),
1672        0);
1673    ExpectIntEQ(ECDH_compute_key(secret1, sizeof(secret1), pub2, NULL, NULL),
1674        0);
1675
1676    ExpectIntEQ(ECDH_compute_key(secret1, sizeof(secret1) - 16, pub2, key1,
1677        NULL), 0);
1678
1679    ExpectIntEQ(ECDH_compute_key(secret1, sizeof(secret1), pub2, key1, NULL),
1680        sizeof(secret1));
1681    ExpectIntEQ(ECDH_compute_key(secret2, sizeof(secret2), pub1, key2, NULL),
1682        sizeof(secret2));
1683
1684    for (i = 0; i < (int)sizeof(secret1); i++) {
1685        ExpectIntEQ(secret1[i], secret2[i]);
1686    }
1687
1688    EC_KEY_free(key2);
1689    EC_KEY_free(key1);
1690#endif /* OPENSSL_EXTRA && !NO_ECC256 && !NO_ECC_SECP &&
1691        * !WOLF_CRYPTO_CB_ONLY_ECC */
1692    return EXPECT_RESULT();
1693}
1694
1695#endif /* HAVE_ECC && !OPENSSL_NO_PK */
1696
1697