From b741dd8cfd5674f859a7465dd7700db98f03f359 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Thu, 20 Aug 2026 13:52:18 +0100 Subject: [PATCH 1/3] Fix ASN guards for RSA key DER export WOLFSSL_SE050 enables WOLFSSL_KEY_TO_DER, but the original ASN implementation only compiled SetASNIntMP and SetBitString when unrelated features such as ECC or key generation were enabled. An ECC-free SE050 build therefore compiled the RSA DER callers without these helpers and failed at link time. Include WOLFSSL_KEY_TO_DER in both helper guards, while retaining the NO_CERTS constraint for the public-key BIT STRING encoder. This allows SE050 RSA builds to disable HAVE_ECC without unresolved ASN symbols. --- wolfcrypt/src/asn.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index c639a62484..063394c10e 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -3534,8 +3534,10 @@ WOLFSSL_LOCAL int SetASNInt(int len, byte firstByte, byte* output) #endif #ifndef WOLFSSL_ASN_TEMPLATE -#if !defined(NO_DSA) || defined(HAVE_ECC) || (defined(WOLFSSL_CERT_GEN) && \ - !defined(NO_RSA)) || ((defined(WOLFSSL_KEY_GEN) || \ +#if !defined(NO_DSA) || defined(HAVE_ECC) || \ + (!defined(NO_RSA) && defined(WOLFSSL_KEY_TO_DER)) || \ + (defined(WOLFSSL_CERT_GEN) && !defined(NO_RSA)) || \ + ((defined(WOLFSSL_KEY_GEN) || \ (!defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)) || \ defined(OPENSSL_EXTRA)) && !defined(NO_RSA)) /* Set the DER/BER encoding of the ASN.1 INTEGER element with an mp_int. @@ -4048,11 +4050,12 @@ int CheckBitString(const byte* input, word32* inOutIdx, int* len, #endif } -/* RSA (with CertGen or KeyGen) OR ECC OR ED25519 OR ED448 (with CertGen or - * KeyGen) OR CRL */ +/* RSA (with CertGen, KeyGen or KeyToDer) OR ECC OR ED25519 OR ED448 (with + * CertGen or KeyGen) OR CRL */ #if (!defined(NO_RSA) && \ (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN) || \ - defined(OPENSSL_EXTRA))) || \ + defined(OPENSSL_EXTRA) || \ + (defined(WOLFSSL_KEY_TO_DER) && !defined(NO_CERTS)))) || \ (defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)) || \ ((defined(HAVE_ED25519) || defined(HAVE_ED448)) && \ (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN) || \ From 0ae2ef095fc54bf3028ce8df5758b9d2789b1ed9 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Fri, 21 Aug 2026 12:55:15 +0100 Subject: [PATCH 2/3] Add RSA key-to-DER ASN regression build Exercise original ASN with RSA key export while ECC, DSA, and DH are disabled. This configuration reproduces the missing ASN helper guards fixed by the preceding commit and protects the minimal SE05x build from regression. --- .github/workflows/disable-pk-algs.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/disable-pk-algs.yml b/.github/workflows/disable-pk-algs.yml index 880bbb8293..3ee9a17057 100644 --- a/.github/workflows/disable-pk-algs.yml +++ b/.github/workflows/disable-pk-algs.yml @@ -76,6 +76,9 @@ jobs: "configs": [ {"name": "rsa-dh", "minutes": 1.2, "configure": ["--enable-rsa", "--enable-dh"]}, + {"name": "rsa-key-to-der-original-asn", "minutes": 1.2, + "configure": ["--enable-rsa", "--enable-asn=original", + "--disable-dsa", "CPPFLAGS=-DWOLFSSL_KEY_TO_DER"]}, {"name": "ecc", "minutes": 1.2, "configure": ["--enable-ecc"]}, {"name": "rsa-curve25519", "minutes": 1.2, From 9de9f6639c5e6484334475541013d64a21e9a9e2 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Fri, 21 Aug 2026 13:34:29 +0100 Subject: [PATCH 3/3] Limit ASN guard regression to build check The full unit suite has an unrelated SNI runtime failure with the original ASN implementation. Keep this regression focused on configure, compile, and link, which catches the missing SetASNIntMP guard on the parent revision. --- .github/workflows/disable-pk-algs.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/disable-pk-algs.yml b/.github/workflows/disable-pk-algs.yml index 3ee9a17057..22fe8a0c4b 100644 --- a/.github/workflows/disable-pk-algs.yml +++ b/.github/workflows/disable-pk-algs.yml @@ -76,7 +76,8 @@ jobs: "configs": [ {"name": "rsa-dh", "minutes": 1.2, "configure": ["--enable-rsa", "--enable-dh"]}, - {"name": "rsa-key-to-der-original-asn", "minutes": 1.2, + {"name": "rsa-key-to-der-original-asn", "minutes": 0.3, + "check": false, "configure": ["--enable-rsa", "--enable-asn=original", "--disable-dsa", "CPPFLAGS=-DWOLFSSL_KEY_TO_DER"]}, {"name": "ecc", "minutes": 1.2,