add support for crypto cb only with ECC and CAAM

[JacobBarthelmeh]

ZD17312

[JacobBarthelmeh]

This fixes checking if an imported private key is a black key when using WOLF_CRYPTO_CB_ONLY_ECC.

In ecc.c by default if a public key has been imported with the private key a validation of the key pair is done in order to test if the private key is encrypted or not :

10917         /* If using AES-ECB encrypted black keys check here if key is valid,    
10918          * if not valid than assume is an encrypted key. A public key is needed 
10919          * for testing validity. */                                             
10920         if (key->devId == WOLFSSL_CAAM_DEVID && (                               
10921             wc_ecc_get_curve_id(key->idx) == ECC_SECP256R1 ||                   
10922             wc_ecc_get_curve_id(key->idx) == ECC_SECP384R1)) {                  
10923             if ((pub != NULL) && (ret == MP_OKAY) &&                            
10924                 (_ecc_validate_public_key(key, 1, 1) != MP_OKAY)) {             
10925                 key->blackKey = CAAM_BLACK_KEY_ECB;                             
10926             }                                                                   
10927             else if ((pub == NULL) && (ret == MP_OKAY)) {                       
10928                 WOLFSSL_MSG("Assuming encrypted key with no public key to check");
10929                 key->blackKey = CAAM_BLACK_KEY_ECB;                             
10930             }                                                                   
10931             else {                                                              
10932                 WOLFSSL_MSG("Importing key that is not a black key!");          
10933             }                                                                   
10934         }    

Before this change if WOLF_CRYPTO_CB_ONLY_ECC was defined, then the call to _ecc_validate_public_key would return MP_OKAY. Leading to the assumption that the public / private key pair was able to be validated and that the private key was unencrypted. This would then cause an invalid ECC signature generated with the imported private key since the encrypted black key was being used as though it was a decrypted plain text key.

I created a simple blob test app and ran it on an RT1176 EVK board before and after the fix. It has the following code to print out the imported key type:

...
...
    ret = wc_caamOpenBlob_ex(blob, blobSz, decodedBlob, &decodedBlobSz, type, mod, modSz);
    PRINTF("\rret with good keymod = %d\n\r", ret);
    PRINTF("Decoded Blob : ");
    for (i = 0; i < decodedBlobSz; i++)
        PRINTF("%02X", decodedBlob[i]);
    PRINTF("\r\n");

    /* try to import the black key now */
    ret = wc_ecc_init_ex(&key, NULL, WOLFSSL_CAAM_DEVID);
    wc_ecc_import_private_key(decodedBlob, decodedBlobSz, pubKey, pubKeySz, &key);
    PRINTF("Is the imported key a BLACK KEY? %d\r\n", key.blackKey);
    wc_ecc_free(&key);
...
...

Building without WOLF_CRYPTO_CB_ONLY_ECC avoids this edge case, and importing only the private key without a public key also avoids this case since without the public key to validate the key pair it is assumed that the private key is an encrypted black key.

[JacobBarthelmeh]

retest this please Jenkins..