mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-17 22:11:33 +02:00
Andrew Hutchings
6176a5a77d
The direct ECDH APDU carries the peer public point in the command, so uploading the peer key to the SE050 on the applet >= 7.2 path wasted APDU round trips, consumed a persistent object slot per distinct peer in the default build, and added a failure path the derive does not need. Confine the upload, the keyId bookkeeping and the keyCreated cleanup to the pre-7.2 arm; on 7.2 builds a reference object is only taken when the peer public key is already SE050-resident. Also from review: validate the ECC direct-APDU response length against the curve size, mirroring the Curve25519 arm; scope the derive-key state (deriveKey, ctx_derive_key, deriveKeyCreated and their init and cleanup) into the pre-7.2 arm instead of voiding it; and reword the CI workflow comment to describe SE050_SIM_STRICT_ECDH as a regression guard, noting the pre-7.2 arm is hardware-verified (SE050C applet 3.1.1) until an 03_XX matrix leg exists. Verified: wolfCrypt suite passes against the strict simulator on the 07_02 build; the pre-7.2 arm compiles clean against an 03_XX SDK.