From dc491c4c4b94865dd60fb523eeb3c793fe95d243 Mon Sep 17 00:00:00 2001
From: aidan garske <aidan@wolfssl.com>
Date: Mon, 20 Jul 2026 13:35:39 -0700
Subject: [PATCH] Fall back to the exported EC point for PKCS11 verify when
 label or ID lookup finds none

---
 wolfcrypt/src/wc_pkcs11.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/wc_pkcs11.c b/wolfcrypt/src/wc_pkcs11.c
index f146e2d8aa5..7044b14e5e7 100644
--- a/wolfcrypt/src/wc_pkcs11.c
+++ b/wolfcrypt/src/wc_pkcs11.c
@@ -3949,7 +3949,7 @@ static int Pkcs11ECDSA_Verify(Pkcs11Session* session, wc_CryptoInfo* info)
                 ret = Pkcs11GetEccParams(session, publicKey, key);
             }
         }
-        else if (!mp_iszero(key->pubkey.x)) {
+        else if (!mp_iszero(key->pubkey.x) || !mp_iszero(key->pubkey.y)) {
             ret = Pkcs11CreateEccPublicKey(&publicKey, session, key,
                                            CKA_VERIFY);
             sessionKey = 1;
@@ -3957,6 +3957,14 @@ static int Pkcs11ECDSA_Verify(Pkcs11Session* session, wc_CryptoInfo* info)
         else
             ret = Pkcs11FindEccKey(&publicKey, CKO_PUBLIC_KEY, session,
                                    info->pk.eccsign.key, CKA_VERIFY);
+
+        /* keygen destroys the token public key, so fall back to the point. */
+        if (ret != 0 && (key->labelLen > 0 || key->idLen > 0) &&
+                (!mp_iszero(key->pubkey.x) || !mp_iszero(key->pubkey.y))) {
+            ret = Pkcs11CreateEccPublicKey(&publicKey, session, key,
+                                           CKA_VERIFY);
+            sessionKey = 1;
+        }
     }
 
     if (ret == 0) {