Set PKCS#8 version correctly in SetAsymKeyDer() when publicKey is bundled

[cconlon]

Description

This PR fixes a bug in wolfSSL's PKCS#8 / RFC 5958 OneAsymmetricKey output. When a private-key DER bundles the optional publicKey field (Ed25519, Ed448, Curve25519, ML-DSA, Falcon), it was tagged as v1 (version=0) instead of v2 (version=1). The malformed envelope is rejected by JDK 24 SunJCE and is non-conformant with other implementations as well.

• Fixes SetAsymKeyDer() to write version=1 when pubKey != NULL, version=0 otherwise.
• Adjusts DecodeAsymKey_Assign() to accept both version=0 and version=1 on input, for backwards compatibility with pre-fix wolfSSL and liboqs DER.

Testing

• Updated test_SetAsymKeyDer() conditions 6-8 (bundled publicKey) to expect version=1
• Added test_DecodeAsymKey_lenient_versions() covering all four {v=0,v=1} × {pub absent,present} variants
• Added test_DecodeAsymKey_negative() for truncated, over-claimed length (short and long form), and non-SEQUENCE inputs
• Addedtest_wc_dilithium_oneasymkey_version() for ML-DSA-44/65/87 (bundled v=1, priv-only v=0, byte-exact round-trip).
• Updated tests/api/test_ed25519.c, test_ed448.c, test_curve25519.c, and test_curve448.c with per-algorithm *_oneasymkey_version regression tests with the same bundled/private-only assertions.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This pull request fixes RFC 5958 (PKCS#8 OneAsymmetricKey) encoding by correctly setting the version field to 1 when the optional publicKey element is included, while keeping 0 for private-only encodings, and it updates decoding logic/tests to be compatible with both versions on input.

Changes:

• Update SetAsymKeyDer() to emit version=1 when pubKey is present and version=0 otherwise.
• Relax DecodeAsymKey_Assign() to accept both version=0 and version=1 for compatibility.
• Add/extend API tests across ASN, Ed25519/Ed448, Curve25519/Curve448, and ML-DSA (Dilithium) to validate version handling and round-trips.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfcrypt/src/asn.c	Correct PKCS#8 OneAsymmetricKey version emission based on bundled publicKey; accept both v0/v1 on decode.
tests/api/test_mldsa.h	Register new ML-DSA OneAsymmetricKey version regression test.
tests/api/test_mldsa.c	Add ML-DSA OneAsymmetricKey version checks and byte-exact round-trip validation.
tests/api/test_ed448.h	Register Ed448 OneAsymmetricKey version regression test.
tests/api/test_ed448.c	Add Ed448 bundled vs private-only version assertions with round-trip.
tests/api/test_ed25519.h	Register Ed25519 OneAsymmetricKey version regression test.
tests/api/test_ed25519.c	Add Ed25519 bundled vs private-only version assertions with round-trip.
tests/api/test_curve448.h	Register Curve448 private-only OneAsymmetricKey version regression test.
tests/api/test_curve448.c	Add Curve448 private-only version assertion and round-trip.
tests/api/test_curve25519.h	Register Curve25519 OneAsymmetricKey version regression test.
tests/api/test_curve25519.c	Add Curve25519 bundled vs private-only version assertions with round-trip.
tests/api/test_asn.h	Register new ASN DecodeAsymKey leniency/negative tests.
tests/api/test_asn.c	Add DecodeAsymKey lenient version acceptance and negative parsing tests.
tests/api/api.h	Add small PKCS#8 test helpers to read/patch the OneAsymmetricKey version byte.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-tls12

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10427

Scan targets checked: wolfcrypt-bugs, wolfcrypt-src

No new issues found in the changed files. ✅