Prefer X25519 for legacy WSS full handshakes

Prioritize X25519 while retaining enabled curve fallbacks and log the negotiated ECDHE group. Extend ABI checks, crypto benchmarks and backend group probes, and document the updated APP package.

tools/test_mbedtls_cert.c

@@ -8,10 +8,26 @@
 #include "mbedtls/platform_time.h"
 #include "mbedtls/gcm.h"
 #include "mbedtls/ssl_ciphersuites.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/ctr_drbg.h"
 #include "talkingq_wss.h"
 
-void *mbedtls_calloc(size_t n, size_t size) { return calloc(n, size); }
-void mbedtls_free(void *p) { free(p); }
+typedef union { size_t bytes; long double align; void *ptr; } alloc_header;
+static size_t live_bytes, peak_bytes;
+void *mbedtls_calloc(size_t n, size_t size) {
+    alloc_header *h;
+    size_t bytes;
+    if (size && n > (SIZE_MAX - sizeof(*h)) / size) return NULL;
+    bytes = n * size;
+    h = (alloc_header *)calloc(1, sizeof(*h) + bytes);
+    if (!h) return NULL;
+    h->bytes = bytes; live_bytes += bytes;
+    if (live_bytes > peak_bytes) peak_bytes = live_bytes;
+    return h + 1;
+}
+void mbedtls_free(void *p) {
+    if (p) { alloc_header *h = (alloc_header *)p - 1; live_bytes -= h->bytes; free(h); }
+}
 static time_t test_time;
 static time_t read_test_time(time_t *p) { if (p) *p = test_time; return test_time; }
 mbedtls_time_t (*mbedtls_time)(mbedtls_time_t *) = read_test_time;
@@ -26,6 +42,50 @@ int mbedtls_snprintf(char *buffer, size_t size, const char *format, ...)
     return result;
 }
 
+/* Deterministic entropy is confined to this host benchmark, never firmware. */
+static int test_entropy(void *ctx, unsigned char *out, size_t n)
+{
+    size_t i; unsigned int *counter = (unsigned int *)ctx;
+    for (i = 0; i < n; ++i) out[i] = (unsigned char)(++*counter);
+    return 0;
+}
+
+static void benchmark_ecdh(mbedtls_ecp_group_id id, const char *name)
+{
+    mbedtls_ecp_group peer, client;
+    mbedtls_ecp_point peer_q, client_q;
+    mbedtls_mpi peer_d, client_d, secret, expected;
+    mbedtls_ctr_drbg_context rng;
+    unsigned int counter = 0;
+    clock_t elapsed = 0, started;
+    size_t base;
+    int i;
+    mbedtls_ctr_drbg_init(&rng);
+    assert(mbedtls_ctr_drbg_seed(&rng, test_entropy, &counter, NULL, 0) == 0);
+    mbedtls_ecp_group_init(&peer); mbedtls_ecp_point_init(&peer_q); mbedtls_mpi_init(&peer_d);
+    assert(mbedtls_ecp_group_load(&peer, id) == 0);
+    assert(mbedtls_ecdh_gen_public(&peer, &peer_d, &peer_q, mbedtls_ctr_drbg_random, &rng) == 0);
+    base = live_bytes; peak_bytes = base;
+    for (i = 0; i < 20; ++i) {
+        mbedtls_ecp_group_init(&client); mbedtls_ecp_point_init(&client_q);
+        mbedtls_mpi_init(&client_d); mbedtls_mpi_init(&secret); mbedtls_mpi_init(&expected);
+        assert(mbedtls_ecp_group_load(&client, id) == 0);
+        started = clock();
+        assert(mbedtls_ecdh_gen_public(&client, &client_d, &client_q, mbedtls_ctr_drbg_random, &rng) == 0);
+        assert(mbedtls_ecdh_compute_shared(&client, &secret, &peer_q, &client_d, mbedtls_ctr_drbg_random, &rng) == 0);
+        elapsed += clock() - started;
+        assert(mbedtls_ecdh_compute_shared(&peer, &expected, &client_q, &peer_d, mbedtls_ctr_drbg_random, &rng) == 0);
+        assert(mbedtls_mpi_cmp_mpi(&secret, &expected) == 0);
+        mbedtls_mpi_free(&expected); mbedtls_mpi_free(&secret); mbedtls_mpi_free(&client_d);
+        mbedtls_ecp_point_free(&client_q); mbedtls_ecp_group_free(&client);
+        assert(live_bytes == base);
+    }
+    printf("Host fresh ECDH %s: %.2f ms, extra peak heap %zu bytes (20 runs, includes peer check heap)\n",
+           name, 1000.0 * elapsed / CLOCKS_PER_SEC / 20, peak_bytes - base);
+    mbedtls_ecp_group_free(&peer); mbedtls_ecp_point_free(&peer_q); mbedtls_mpi_free(&peer_d);
+    mbedtls_ctr_drbg_free(&rng);
+}
+
 int main(int argc, char **argv)
 {
     mbedtls_x509_crt root, chain;
@@ -63,12 +123,14 @@ int main(int argc, char **argv)
     printf("SDK server chain + hostname verify: %d, flags=0x%08x\n", ret, (unsigned int)flags);
     assert(ret == 0 && flags == 0);
     verify_started = clock();
+    peak_bytes = live_bytes;
     for (i = 0; i < 20; ++i) {
         ret = mbedtls_x509_crt_verify(&chain, &root, NULL, "banban.api.talkingq.com", &flags, NULL, NULL, 0);
         assert(ret == 0 && flags == 0);
     }
     printf("Host certificate chain verify average: %.2f ms (20 runs)\n",
            1000.0 * (clock() - verify_started) / CLOCKS_PER_SEC / 20);
+    printf("Host certificate verify peak heap: %zu bytes, ECP window: %d\n", peak_bytes, MBEDTLS_ECP_WINDOW_SIZE);
     mbedtls_ecp_group_init(&group);
     assert(mbedtls_ecp_group_load(&group, MBEDTLS_ECP_DP_SECP384R1) == 0);
 #ifdef MBEDTLS_ECP_NIST_OPTIM
@@ -96,6 +158,12 @@ int main(int argc, char **argv)
     mbedtls_gcm_free(&gcm);
     mbedtls_x509_crt_free(&chain);
     mbedtls_x509_crt_free(&root);
+    assert(live_bytes == 0);
+    benchmark_ecdh(MBEDTLS_ECP_DP_CURVE25519, "X25519");
+    benchmark_ecdh(MBEDTLS_ECP_DP_SECP256R1, "P-256");
+    benchmark_ecdh(MBEDTLS_ECP_DP_SECP384R1, "P-384");
+    benchmark_ecdh(MBEDTLS_ECP_DP_SECP521R1, "P-521");
+    assert(live_bytes == 0);
     puts("PASS: SDK ECDSA certificate chain, hostname, trust, dates, TLS suite and AES-GCM vector");
     return 0;
 }