Peer review fixes

Address wolfIP maintainer review on the supplicant PR:

- rp2350: replace ROSC entropy with the hardware TRNG at 0x400f0000.
  New rp2350_rng.h holds the TRNG register map + a dependency-free
  block reader (fail-closed on health-test errors); rp2350_rng.c feeds
  the 192-bit EHR straight to the DRBG seed. wolfIP_getrandom() now
  routes through a seeded WC_RNG (raw-TRNG fallback / non-crypto build).
- raspberry-pico-usb-server: replace the weak 3-LSB ADC sampler with
  von-Neumann debiased ROSC RANDOMBIT (RP2040 has no TRNG; no crypto
  consumer in this build). Drop the now-unused hardware_adc link.
- supplicant PMKSA: carry pmksa_pmkid / pmksa_have_pmkid through the
  init snapshot/restore so SAE fast reconnect survives re-init. Add a
  test that drives the real re-init path.
- sae confirm receive: bound the min length by sae.kck_len (32 for H&P,
  per-group hash for H2E) instead of a hardcoded 8+32.
- sae_crypto: fix H2E length comment (P-521 is 99, not 98).

Author: dgarske

.github/workflows/codespell.yml

@@ -23,4 +23,4 @@ jobs:
         uses: codespell-project/actions-codespell@v2
         with:
           skip: .git,./IDE,*.der,*.pem
-          ignore_words_list: inh,inout,keypair,nd,parm,rcv,ser,tha,HSI,TE,UE,Synopsys,synopsys,FRO
+          ignore_words_list: inh,inout,keypair,nd,parm,rcv,ser,tha,HSI,TE,UE,Synopsys,synopsys,FRO,ehr

src/port/raspberry-pico-usb-server/CMakeLists.txt

@@ -46,7 +46,8 @@ if (CMAKE_C_COMPILER_ID STREQUAL "GNU")
 elseif (CMAKE_C_COMPILER_ID STREQUAL "IAR")
 
 endif ()
-target_link_libraries(${PROJECT} PUBLIC hardware_adc)
+# rand.c seeds wolfIP_getrandom() from the ROSC RANDOMBIT register (part of
+# the pico core headers); no separate hardware library is required.
 
 # Configure compilation flags and libraries for the example without RTOS.
 # See the corresponding function in hw/bsp/FAMILY/family.cmake for details.

src/port/raspberry-pico-usb-server/src/rand.c

@@ -18,57 +18,70 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  */
+
+/* Entropy for wolfIP_getrandom() (see main.c): TCP initial sequence numbers,
+ * ephemeral ports, DHCP / DNS transaction ids.
+ *
+ * The RP2040 has no hardware TRNG, so this uses the ROSC (ring oscillator)
+ * RANDOMBIT jitter - the same source the pico-sdk pico_rand uses - von-Neumann
+ * debiased to remove first-order bias. This replaces the previous 3-LSB ADC
+ * sampler, which was slow (1 ms/sample) and weakly random. There is no
+ * cryptographic consumer in this build (no wolfCrypt / TLS is linked), so no
+ * SHA-256 conditioning stage is applied; debiased ROSC bits are sufficient for
+ * protocol randomization. A crypto build should instead feed a DRBG from a
+ * conditioned source (cf. the RP2350 hardware TRNG port).
+ */
 #include "pico/stdlib.h"
-#include "hardware/gpio.h"
-#include "hardware/adc.h"
+#include "hardware/structs/rosc.h"
 #include <string.h>
 
+/* Per debiased bit: raw pairs to sample before giving up on a differing pair.
+ * A healthy ROSC differs roughly every other sample; this budget is only
+ * approached on a hardware fault. */
+#define ROSC_VN_MAX_PAIRS 1024u
 
-#define IN3_PIN 29
-#define IN0_PIN 28
-#define IN1_PIN 27
-#define IN2_PIN 26
-
-const uint32_t IN[4] = {IN0_PIN, IN1_PIN, IN2_PIN, IN3_PIN};
-static int adc_initialized = 0;
-
-const int in_a[8] = { 0, 1, 2, 3, 1, 3, 0, 2 };
+/* One raw ROSC jitter bit, with a short settle so consecutive samples
+ * decorrelate. */
+static unsigned int rosc_raw_bit(void)
+{
+    volatile int d;
+    for (d = 0; d < 16; d++) {
+    }
+    return (unsigned int)(rosc_hw->randombit & 1u);
+}
 
-int custom_random_seed(unsigned char *output, unsigned int sz) {
-    uint32_t i;
-    uint32_t result = 0;
-    uint32_t rd = 0, wsz;
+/* von Neumann extractor: emit a bit only when a raw pair differs (10 -> 1,
+ * 01 -> 0). Falls back to a single raw bit if the pair budget is exhausted so
+ * a seed is always produced (best-effort, non-crypto path). */
+static unsigned int rosc_vn_bit(void)
+{
+    unsigned int a, b, tries;
 
-    if (!adc_initialized) {
-        adc_init();
-        for (i = 0; i < 4; i++) {
-            adc_gpio_init(IN[i]);
+    for (tries = 0; tries < ROSC_VN_MAX_PAIRS; tries++) {
+        a = rosc_raw_bit();
+        b = rosc_raw_bit();
+        if (a != b) {
+            return a;
         }
-        adc_initialized = 1;
-        sleep_ms(10);
     }
+    return rosc_raw_bit();
+}
 
-    /* Perform eight 3-bit samples with sources 0-1-2-4 */
-    for (i = 0; rd < sz; i = (i + 1) % 8) {
-        adc_select_input(in_a[i]);
-
-        /* Read the least significant 3 bits from the ADC */
-        result = (result << 3) | (adc_read() & 0x00000007);
-
-        /* Introduce a delay to capture environmental noise */
-        sleep_ms(1);
+int custom_random_seed(unsigned char *output, unsigned int sz)
+{
+    unsigned int  i, nbits;
+    unsigned char byte;
 
-        /* If we've completed eight samples, copy the result to the output */
-        if (i == 7) {
-            wsz = 3;
-            if (wsz > (sz - rd)) {
-                wsz = sz - rd;
-            }
+    if (output == NULL) {
+        return -1;
+    }
 
-            memcpy(output + rd, &result, wsz);
-            rd += wsz;
-            result = 0;
+    for (i = 0; i < sz; i++) {
+        byte = 0;
+        for (nbits = 0; nbits < 8u; nbits++) {
+            byte = (unsigned char)((byte << 1) | (rosc_vn_bit() & 1u));
         }
+        output[i] = byte;
     }
 
     return 0;

src/port/rp2350_cyw43439/main.c

@@ -26,36 +26,56 @@
 #include "cyw43439_driver.h"
 #include "cyw43439_wifi.h"
 #include "rp2350_clocks.h"
+#include "rp2350_rng.h"
 
 #if defined(WOLFIP_WITH_SUPPLICANT)
 #include "supplicant.h"
+#include <wolfssl/wolfcrypt/random.h>   /* WC_RNG for the DRBG-backed path */
 #endif
 
 extern void rp2350_uart_init(void);
 
-/* wolfIP entropy hook. The RP2350 ROSC (ring oscillator) jitter at
- * 0x400C8000 + 0x1C provides one random bit per read - good for ISN /
- * ephemeral-port seeding but not for crypto. For SAE keying material
- * the supplicant pulls entropy directly from wolfCrypt's RNG. */
-uint32_t wolfIP_getrandom(void)
+/* Best-effort hardware TRNG words for the non-crypto stack (TCP ISN,
+ * ephemeral ports, DHCP/DNS xids). Caches one 192-bit block and dispenses
+ * six 32-bit words so the hardware is read once per six calls. */
+static uint32_t rp2350_trng_word(void)
 {
-    static uint32_t lfsr;
-    uint32_t bit;
-    int i;
-    if (lfsr == 0U) {
-        for (i = 0; i < 32; i++) {
-            bit = (*(volatile uint32_t *)0x400C801CUL) & 1U;
-            lfsr = (lfsr << 1) | bit;
+    static uint32_t cache[RP2350_TRNG_EHR_WORDS];
+    static unsigned int have;
+    if (have == 0U) {
+        if (rp2350_trng_read_block(cache) != 0) {
+            /* Hardware fault on a best-effort path: return a non-zero
+             * constant so the stack still gets a usable value. */
+            return 0xDEADBEEFU;
         }
-        if (lfsr == 0U) lfsr = 0xDEADBEEFU;
+        have = RP2350_TRNG_EHR_WORDS;
+    }
+    return cache[--have];
+}
+
+/* wolfIP entropy hook. When the supplicant (and thus wolfCrypt) is present
+ * this returns bytes from the seeded Hash-DRBG - the same crypto-quality RNG
+ * the WPA/SAE keying uses, seeded from the hardware TRNG via
+ * CUSTOM_RAND_GENERATE_SEED (rp2350_wc_genseed). Otherwise it reads the
+ * hardware TRNG directly. */
+uint32_t wolfIP_getrandom(void)
+{
+#if defined(WOLFIP_WITH_SUPPLICANT)
+    static WC_RNG rng;
+    static int    rng_ready;
+    uint32_t      v;
+
+    if (!rng_ready && wc_InitRng(&rng) == 0) {
+        rng_ready = 1;
     }
-    /* Mix in one fresh ROSC bit per call on top of the LFSR. */
-    bit = (*(volatile uint32_t *)0x400C801CUL) & 1U;
-    /* Unsigned wrap (0 or 0xFFFFFFFF) for the feedback mask - avoids the
-     * signed-overflow cppcheck flags on -(int32_t)(...). */
-    lfsr = (lfsr >> 1) ^ ((0U - (lfsr & 1U)) & 0xD0000001U);
-    lfsr ^= bit;
-    return lfsr;
+    if (rng_ready
+        && wc_RNG_GenerateBlock(&rng, (unsigned char *)&v, sizeof(v)) == 0) {
+        return v;
+    }
+    /* DRBG unavailable (e.g. called before wolfCrypt is ready): fall back to
+     * the raw hardware TRNG so the TCP/IP stack still gets entropy. */
+#endif
+    return rp2350_trng_word();
 }
 
 /* wolfIP state - opaque struct allocated by wolfIP_init_static. */

src/port/rp2350_cyw43439/rp2350_rng.c

@@ -1,4 +1,4 @@
-/* rp2350_rng.c - RP2350 ring-oscillator entropy for wolfCrypt
+/* rp2350_rng.c - RP2350 hardware TRNG seed source for wolfCrypt
  *
  * Copyright (C) 2026 wolfSSL Inc.
  *
@@ -13,124 +13,47 @@
  * (CUSTOM_RAND_GENERATE_SEED in user_settings.h), which in turn generates the
  * WPA 4-way SNonce and the WPA3-SAE ephemeral rand/mask scalars.
  *
- * The RP2350 ROSC_RANDOMBIT register is documented as biased and strongly
- * autocorrelated and is explicitly NOT a cryptographic entropy source on its
- * own. So this does three things before handing bytes to the DRBG:
- *   1. von Neumann debiasing - sample raw ROSC bits in pairs and keep one only
- *      when the pair differs, removing first-order bias;
- *   2. heavy oversampling - a large debiased pool feeds each output block;
- *   3. cryptographic conditioning - SHA-256 over the pool produces the seed
- *      block, compressing a conservative per-bit entropy estimate into a
- *      full-entropy 256-bit block.
- * A startup/continuous health test fails closed (returns -1) if the oscillator
- * stops producing differing pairs, rather than emitting a weak seed.
+ * Entropy comes from the RP2350 hardware TRNG (0x400f0000): a ring-oscillator
+ * true-RNG with built-in autocorrelation, continuous (CRNGT) and von-Neumann
+ * health tests (RP2350 datasheet sec. 12.12). Its 192-bit EHR output is a NIST
+ * SP800-90B entropy source, so it is fed straight into the DRBG seed buffer -
+ * wolfCrypt's Hash-DRBG (SP800-90A) does the conditioning. The register access
+ * lives in rp2350_rng.h so the non-crypto wolfIP_getrandom() path can share it.
  *
- * NOTE: this conditioning is the minimum bar for enabling the SAE/EAP
- * supplicant paths on real hardware; if the RP2350 TRNG/SHA hardware entropy
- * peripheral is brought up later it should supersede the ROSC pool here.
+ * A block read fails closed (returns -1) if the source is stuck or a health
+ * test does not clear, rather than emitting a weak seed.
  */
 #include <stdint.h>
 #include <wolfssl/wolfcrypt/settings.h>
-#include <wolfssl/wolfcrypt/sha256.h>
+#include <wolfssl/wolfcrypt/memory.h>   /* wc_ForceZero */
 
-/* ROSC random-bit register (RP2350: ROSC base 0x400C8000, RANDOMBIT
- * at offset 0x1C). Bit 0 is the raw oscillator-jitter bit. */
-#define ROSC_RANDOMBIT (*(volatile uint32_t *)0x400C801CUL)
-
-/* Per debiased bit: how many raw pairs to sample before declaring the
- * oscillator stuck. A healthy ROSC produces a differing pair roughly every
- * other sample, so this budget is only hit on a hardware fault. */
-#define ROSC_VN_MAX_PAIRS 1024U
-/* Debiased bytes hashed into each 32-byte conditioned output block. */
-#define ROSC_POOL_BYTES   64U
-
-static unsigned int rosc_bit(void)
-{
-    volatile int d;
-    /* Let the ROSC bit settle so consecutive raw samples decorrelate. */
-    for (d = 0; d < 16; d++) {
-    }
-    return (unsigned int)(ROSC_RANDOMBIT & 1U);
-}
-
-/* von Neumann extractor: emit a bit only when a raw pair differs (10 -> 1,
- * 01 -> 0). Returns 0 and sets *out_bit on success, -1 if the per-bit pair
- * budget is exhausted (oscillator stuck). */
-static int rosc_vn_bit(unsigned int *out_bit)
-{
-    unsigned int a, b, tries;
-
-    for (tries = 0; tries < ROSC_VN_MAX_PAIRS; tries++) {
-        a = rosc_bit();
-        b = rosc_bit();
-        if (a != b) {
-            *out_bit = a;
-            return 0;
-        }
-    }
-    return -1;
-}
+#include "rp2350_rng.h"
 
 int rp2350_wc_genseed(unsigned char *output, unsigned int sz)
 {
-    wc_Sha256     sha;
-    unsigned char digest[WC_SHA256_DIGEST_SIZE];
-    unsigned char pool[ROSC_POOL_BYTES];
-    unsigned int  produced;
-    unsigned int  pi, nbits, bit, take, j;
-    unsigned char byte;
-    int           ret;
+    uint32_t     block[RP2350_TRNG_EHR_WORDS];
+    unsigned int produced, take, i;
 
     if (output == NULL) {
         return -1;
     }
 
     for (produced = 0; produced < sz; ) {
-        /* Fill the pool with von Neumann-debiased ROSC bits. */
-        for (pi = 0; pi < ROSC_POOL_BYTES; pi++) {
-            byte = 0;
-            for (nbits = 0; nbits < 8U; nbits++) {
-                if (rosc_vn_bit(&bit) != 0) {
-                    /* Health test failed: fail closed, do not emit weak seed. */
-                    wc_ForceZero(pool, sizeof(pool));
-                    return -1;
-                }
-                byte = (unsigned char)((byte << 1) | (bit & 1U));
-            }
-            pool[pi] = byte;
-        }
-
-        /* SHA-256 conditioner over the pool (+ running offset so per-block
-         * hashes never collide even on an identical pool). */
-        ret = wc_InitSha256(&sha);
-        if (ret == 0) {
-            ret = wc_Sha256Update(&sha, pool, (word32)sizeof(pool));
-        }
-        if (ret == 0) {
-            ret = wc_Sha256Update(&sha, (const unsigned char *)&produced,
-                                  (word32)sizeof(produced));
-        }
-        if (ret == 0) {
-            ret = wc_Sha256Final(&sha, digest);
-        }
-        wc_Sha256Free(&sha);
-        if (ret != 0) {
-            wc_ForceZero(pool, sizeof(pool));
-            wc_ForceZero(digest, sizeof(digest));
+        if (rp2350_trng_read_block(block) != 0) {
+            /* Health test failed: fail closed, do not emit a weak seed. */
+            wc_ForceZero(block, sizeof(block));
             return -1;
         }
-
         take = sz - produced;
-        if (take > (unsigned int)sizeof(digest)) {
-            take = (unsigned int)sizeof(digest);
+        if (take > (unsigned int)sizeof(block)) {
+            take = (unsigned int)sizeof(block);
         }
-        for (j = 0; j < take; j++) {
-            output[produced + j] = digest[j];
+        for (i = 0; i < take; i++) {
+            output[produced + i] = ((const unsigned char *)block)[i];
         }
         produced += take;
     }
 
-    wc_ForceZero(pool, sizeof(pool));
-    wc_ForceZero(digest, sizeof(digest));
+    wc_ForceZero(block, sizeof(block));
     return 0;
 }