Fix 2k reduction selection for even moduli

tests/api/test_wolfmath.c

@@ -170,6 +170,53 @@ int test_mp_rand(void)
     return EXPECT_RESULT();
 } /* End test_mp_rand */
 
+/* An even modulus with a zero low digit must not use single-digit 2k
+ * reduction: its setup value is 2^DIGIT_BIT and does not fit in a digit. */
+int test_mp_exptmod_even_2k(void)
+{
+    EXPECT_DECLS;
+#if defined(USE_INTEGER_HEAP_MATH) && defined(WOLFSSL_PUBLIC_MP) && \
+    defined(BN_MP_REDUCE_IS_2K_C) && defined(BN_S_MP_EXPTMOD_C)
+    mp_int g, x, p, y;
+
+    XMEMSET(&g, 0, sizeof(g));
+    XMEMSET(&x, 0, sizeof(x));
+    XMEMSET(&p, 0, sizeof(p));
+    XMEMSET(&y, 0, sizeof(y));
+    ExpectIntEQ(mp_init_multi(&g, &x, &p, &y, NULL, NULL), MP_OKAY);
+
+    /* p = 2^DIGIT_BIT, then p = 3 * 2^DIGIT_BIT. */
+    ExpectIntEQ(mp_set(&p, 1), MP_OKAY);
+    ExpectIntEQ(mp_mul_2d(&p, DIGIT_BIT, &p), MP_OKAY);
+    ExpectIntEQ(mp_reduce_is_2k(&p), MP_NO);
+    /* (p - 1)^2 mod p = 1. */
+    ExpectIntEQ(mp_sub_d(&p, 1, &g), MP_OKAY);
+    ExpectIntEQ(mp_set(&x, 2), MP_OKAY);
+    ExpectIntEQ(mp_exptmod(&g, &x, &p, &y), MP_OKAY);
+    ExpectIntEQ(mp_cmp_d(&y, 1), MP_EQ);
+
+    ExpectIntEQ(mp_set(&p, 3), MP_OKAY);
+    ExpectIntEQ(mp_mul_2d(&p, DIGIT_BIT, &p), MP_OKAY);
+    ExpectIntEQ(mp_reduce_is_2k(&p), MP_NO);
+    ExpectIntEQ(mp_sub_d(&p, 1, &g), MP_OKAY);
+    ExpectIntEQ(mp_exptmod(&g, &x, &p, &y), MP_OKAY);
+    ExpectIntEQ(mp_cmp_d(&y, 1), MP_EQ);
+
+    /* The adjacent modulus has a representable single-digit setup value. */
+    ExpectIntEQ(mp_add_d(&p, 1, &p), MP_OKAY);
+    ExpectIntEQ(mp_reduce_is_2k(&p), MP_YES);
+    ExpectIntEQ(mp_sub_d(&p, 1, &g), MP_OKAY);
+    ExpectIntEQ(mp_exptmod(&g, &x, &p, &y), MP_OKAY);
+    ExpectIntEQ(mp_cmp_d(&y, 1), MP_EQ);
+
+    mp_clear(&g);
+    mp_clear(&x);
+    mp_clear(&p);
+    mp_clear(&y);
+#endif
+    return EXPECT_RESULT();
+}
+
 /*
  * Testing wc_export_int
  */

tests/api/test_wolfmath.h

@@ -29,6 +29,7 @@ int test_mp_get_digit(void);
 int test_mp_get_rand_digit(void);
 int test_mp_cond_copy(void);
 int test_mp_rand(void);
+int test_mp_exptmod_even_2k(void);
 int test_wc_export_int(void);
 int test_wc_SpIntSizeDecisionCoverage(void);
 int test_wc_SpIntShiftDecisionCoverage(void);
@@ -43,6 +44,7 @@ int test_wc_SpIntExptGcdDecisionCoverage(void);
     TEST_DECL_GROUP("wolfmath", test_mp_get_rand_digit),   \
     TEST_DECL_GROUP("wolfmath", test_mp_cond_copy),     \
     TEST_DECL_GROUP("wolfmath", test_mp_rand),          \
+    TEST_DECL_GROUP("wolfmath", test_mp_exptmod_even_2k), \
     TEST_DECL_GROUP("wolfmath", test_wc_export_int),    \
     TEST_DECL_GROUP("wolfmath", test_wc_SpIntSizeDecisionCoverage),      \
     TEST_DECL_GROUP("wolfmath", test_wc_SpIntShiftDecisionCoverage),     \

wolfcrypt/src/integer.c

@@ -1971,6 +1971,11 @@ int mp_reduce_is_2k(mp_int *a)
    } else if (a->used == 1) {
       return MP_YES;
    } else if (a->used > 1) {
+      /* When a->dp[0] == 0, a cannot be reduced */
+      if (a->dp[0] == 0) {
+        return MP_NO;
+      }
+
       iy = mp_count_bits(a);
       iz = 1;
       iw = 1;