Reject curve448 public key export from an unset key

[yosuke-wolfssl]

Problem

wc_curve448_export_public_ex() lazily derives the public key whenever key->pubSet is clear, but never checks key->privSet. wc_curve448_init() zeroes the whole key and wc_curve448_make_pub() does no clamping of its own, so this sequence succeeds and returns a public key for a key pair that does not exist:

curve448_key k;
wc_curve448_init(&k);
wc_curve448_export_public(&k, buf, &len);   /* returns 0 */

The ladder runs over the all-zero scalar, pubSet is set to 1, CURVE448_PUB_KEY_SIZE bytes are written and 0 is returned, with nothing to distinguish the result from a real export. Callers that treat a 0 return as "this key is usable" get a degenerate public value.

This is inconsistent with the rest of the file: wc_curve448_export_private_raw_ex() rejects !privSet, and wc_curve448_shared_secret_ex() rejects !privSet || !pubSet. Only the public exporter was missing the state check. Closes f-7076.

Fix (wolfcrypt/src/curve448.c)

Return ECC_BAD_ARG_E when neither component is set, before the lazy derivation:

    /* no public key to export and no private key to derive it from */
    if ((ret == 0) && (!key->pubSet) && (!key->privSet)) {
        ret = ECC_BAD_ARG_E;
    }

Keys holding only a private scalar, as produced by wc_curve448_import_private_ex(), still derive the public key on export as before. Doc comments on both the _ex function and the wc_curve448_export_public() wrapper are updated, along with the doxygen headers (English and Japanese).

Tests

test_wc_curve448_export_public_ex() gains an unset-key case: a second freshly wc_curve448_init()ed key, asserting ECC_BAD_ARG_E from both wc_curve448_export_public() and wc_curve448_export_public_ex().

Verification

• Build clean under --enable-curve25519 --enable-curve448 --enable-all-crypto, no warnings.
• ./tests/unit.test: 943 passed, 0 failed. testwolfcrypt exit 0.
• Negative control: without the guard the new assertions return 0 instead of ECC_BAD_ARG_E.
• test_wc_curve448_export_import_endian still passes, covering the privSet-only lazy-derivation path.

[Copilot]

Pull request overview

This PR fixes an invalid Curve448 key-state edge case where wc_curve448_export_public_ex() could derive and export a degenerate public key from an uninitialized (privSet==0 && pubSet==0) key. The change aligns public-key export behavior with existing private export and shared-secret APIs that already reject unset keys.

Changes:

• Add a key-state guard in wc_curve448_export_public_ex() to return ECC_BAD_ARG_E when neither public nor private key material is set.
• Update in-source and Doxygen (EN/JA) documentation to reflect the new error condition.
• Extend the Curve448 API tests to cover export attempts from a freshly-initialized, unset key.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
wolfcrypt/src/curve448.c	Reject public key export when both pubSet and privSet are unset, preventing lazy derivation from an all-zero scalar.
tests/api/test_curve448.c	Add a regression test asserting ECC_BAD_ARG_E for exporting from an unset key.
doc/dox_comments/header_files/curve448.h	Document the additional ECC_BAD_ARG_E condition for unset keys (English).
doc/dox_comments/header_files-ja/curve448.h	Document the additional ECC_BAD_ARG_E condition for unset keys (Japanese).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11154

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.