SE050: Fixes + NO_{RSA,ECDHE}_VERIFY options + simulator CI by rizlik · Pull Request #10219 · wolfSSL/wolfssl

rizlik · 2026-04-14T16:14:26Z

Description

Various fixes
SE050 simulator CI
SE050_RSA_NO_VERIFY
SE050_ECDSA_NO_VERIFY
SE050_ECDSA_NO_ECDHE

zd#21221 and others

- se050_ed25519_verify_msg: initialize *res = 0 at entry so failures don't leak a stale res = 1 from a prior good verify. - Ed25519 import functions: reset keyIdSet / keyId under WOLFSSL_SE050 in wc_ed25519_import_private_key_ex, wc_ed25519_import_private_only, wc_ed25519_import_public_ex so overwriting host-side key material invalidates any prior SE050 object binding. - New workflow .github/workflows/se050-sim.yml: builds wolfSSL against the NXP Plug&Trust SDK and runs the wolfCrypt tests against the SE050Sim simulator. Patches the upstream Dockerfile to use the PR's wolfSSL source. - ed25519_test SE050 adjustments: - Cap the RFC 8032 loop at 5 iters — iter 5's 1023 B msg exceeds NXP SDK SE05X_TLV_BUF_SIZE_CMD = 900. - rareEd verifies and private-only sign: expect WC_HW_E (SE050 delegates malformed-input rejection to the secure element) instead of BAD_FUNC_ARG / SIG_VERIFY_E. - Skip ed25519ctx_test / ed25519ph_test — SE050 port drops the context/prehash params so RFC 8032 ctx/ph vectors can't byte-match.

- se050_rsa_verify: when the function uploads only the public part of the key (keyCreated == 1), erase the transient SE050 object and don't persist keyIdSet = 1. A subsequent sign on the same RsaKey was reusing the public-only SE050 object and failing. Pre-existing bindings (from wc_RsaUseKeyId or a prior sign that uploaded a keypair) are preserved untouched. - rsa_keygen_test: add WOLFSSL_SE050 to the existing WOLFSSL_CRYPTOCELL guard around the export-then-decode round-trip. SE050-generated keys keep their private components in the secure element, so wc_RsaKeyToDer + wc_RsaPrivateKeyDecode cannot complete. Matching guard on the idx declaration to avoid an unused-variable warning.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR improves compatibility and CI coverage for the NXP SE050 backend by adding feature-disabling build options, adjusting tests/expected behaviors for SE050 constraints, and introducing a simulator-based GitHub Actions workflow.

Changes:

Add SE050-specific “NO_{RSA,ECDHE}_VERIFY” style options and route crypto operations to software when configured.
Fix SE050 key-binding behavior (avoid persisting public-only bindings) and tighten argument/error handling for several SE050 port functions.
Add a GitHub Actions workflow that builds against the SE050 simulator and runs wolfCrypt tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`wolfcrypt/test/test.c`	Skips/adjusts tests and expected error codes under SE050; adds a reload step to exercise public-only vs keypair bindings.
`wolfcrypt/src/rsa.c`	Adds a compile-time option to disable SE050 offloaded RSA PKCS#1 v1.5 verify path.
`wolfcrypt/src/port/nxp/se050_port.c`	Switches verify/import flows to transient objects and avoids persisting public-only bindings; improves hash-size error handling and argument checks.
`wolfcrypt/src/port/nxp/README_SE050.md`	Documents new SE050 build options for disabling ECDHE/ECDSA verify/RSA verify offload.
`wolfcrypt/src/ed25519.c`	Clears SE050 key bindings on key import so host material and SE050 object bindings don’t diverge.
`wolfcrypt/src/ecc.c`	Adds `WOLFSSL_SE050_NOECDHE` and `WOLFSSL_SE050_NO_ECDSA_VERIFY` routing to software paths.
`.wolfssl_known_macro_extras`	Registers the newly introduced SE050-related macros.
`.github/workflows/se050-sim.yml`	Adds CI job to test wolfCrypt against the SE050 simulator in Docker.

Comments suppressed due to low confidence (1)

wolfcrypt/test/test.c:1

The #endif comment is inconsistent with the #if condition (!defined(...) && !defined(...)). Please update the trailing comment to match the actual conditional, to avoid confusion during future maintenance/debugging of preprocessor paths.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-14T16:21:56Z

wolfcrypt/src/ecc.c

    #undef  HAVE_ECC_VERIFY_HELPER
    #define HAVE_ECC_VERIFY_HELPER
 #endif
+#if defined(WOLFSSL_SE050_NO_ECDSA_VERIFY)


HAVE_ECC_VERIFY_HELPER is being defined solely based on WOLFSSL_SE050_NO_ECDSA_VERIFY, without also requiring HAVE_ECC_VERIFY. Earlier logic in this file gates helper selection on defined(HAVE_ECC_VERIFY), and defining the helper macro when ECC verify is not compiled in can lead to inconsistent compilation paths (and potentially missing-symbol problems depending on how the helper is used later). Consider changing this condition to also require defined(HAVE_ECC_VERIFY).

Suggested change

#if defined(WOLFSSL_SE050_NO_ECDSA_VERIFY)

#if defined(WOLFSSL_SE050_NO_ECDSA_VERIFY) && defined(HAVE_ECC_VERIFY)

Copilot · 2026-04-14T16:21:57Z

wolfcrypt/src/port/nxp/README_SE050.md

 Disables using the SE050 for RSA, useful for the SE050E which does not have
 RSA support.

+**`WOLFSSL_SE050_NOECDHE`**


The new macro name WOLFSSL_SE050_NOECDHE is inconsistent with nearby SE050 option naming that uses _NO_... (e.g., WOLFSSL_SE050_NO_RSA, WOLFSSL_SE050_NO_TRNG, WOLFSSL_SE050_NO_ECDSA_VERIFY, WOLFSSL_SE050_NO_RSA_VERIFY). For consistency and discoverability, consider renaming this to WOLFSSL_SE050_NO_ECDHE (and optionally providing a temporary compatibility alias if needed).

Suggested change

**`WOLFSSL_SE050_NOECDHE`**

**`WOLFSSL_SE050_NO_ECDHE`**

Copilot · 2026-04-14T16:21:57Z

.github/workflows/se050-sim.yml

+env:
+  SE050SIM_REF: main


CI is pulling and building an external repository from a mutable branch (SE050SIM_REF: main). This reduces reproducibility and increases supply-chain risk (the same PR could test against different simulator code over time). Prefer pinning SE050SIM_REF to an immutable tag or commit SHA, and consider cloning with --depth 1 to reduce checkout time.

Copilot · 2026-04-14T16:21:58Z

.github/workflows/se050-sim.yml

+      - name: Clone SE050 simulator
+        run: |
+          git clone https://github.com/LinuxJedi/SE050Sim se050sim
+          cd se050sim && git checkout "$SE050SIM_REF"


CI is pulling and building an external repository from a mutable branch (SE050SIM_REF: main). This reduces reproducibility and increases supply-chain risk (the same PR could test against different simulator code over time). Prefer pinning SE050SIM_REF to an immutable tag or commit SHA, and consider cloning with --depth 1 to reduce checkout time.

Copilot · 2026-04-14T16:21:58Z

.github/workflows/se050-sim.yml

+    timeout-minutes: 30
+    steps:
+      - name: Checkout wolfSSL (PR source)
+        uses: actions/checkout@v4


The workflow consumes GitHub Actions by version tag (@v4, @v3, @v5). For stronger supply-chain hardening, pin these actions to full commit SHAs (optionally with a comment indicating the corresponding release tag) to prevent unintended changes if a tag is moved.

Copilot · 2026-04-14T16:21:58Z

.github/workflows/se050-sim.yml

+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build wolfCrypt-SE050 test image
+        uses: docker/build-push-action@v5


The workflow consumes GitHub Actions by version tag (@v4, @v3, @v5). For stronger supply-chain hardening, pin these actions to full commit SHAs (optionally with a comment indicating the corresponding release tag) to prevent unintended changes if a tag is moved.

LinuxJedi and others added 9 commits April 14, 2026 18:05

Address items in code review

931893c

se050: fix RSA Encrypt with only pubkey setting keyId

fff6f3f

se050: initialize keyId to abide compilers

ed2e230

test: rsa: reset RSA key between operation

e6a7be8

se050: refuse invalid digest sz in ECDSA

0fbfbb8

se050: skip ecc_test_buffers (invalid digest sz)

5cd2db0

se050: add support for SE050 SIGN ONLY options

f55ecb5

Copilot AI review requested due to automatic review settings April 14, 2026 16:14

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Copilot started reviewing on behalf of rizlik April 14, 2026 16:59 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SE050: Fixes + NO_{RSA,ECDHE}_VERIFY options + simulator CI#10219

SE050: Fixes + NO_{RSA,ECDHE}_VERIFY options + simulator CI#10219
rizlik wants to merge 9 commits intowolfSSL:masterfrom
rizlik:se050

rizlik commented Apr 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	#if defined(WOLFSSL_SE050_NO_ECDSA_VERIFY)
	#if defined(WOLFSSL_SE050_NO_ECDSA_VERIFY) && defined(HAVE_ECC_VERIFY)

Conversation

rizlik commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rizlik commented Apr 14, 2026 •

edited

Loading