API design: Curve25519 blinding forces throwaway RNG creation per shared_secret call

[MarkAtwood]

wolfSSL's Curve25519 scalar-multiply blinding (enabled by default) requires an RNG to be attached to the private-key struct via wc_curve25519_set_rng() before each scalar multiply. wc_curve25519_shared_secret_ex does not accept an RNG parameter inline.

This forces every DH operation to initialize a throwaway RNG, set it on the key, perform the multiply, and free the RNG — four extra steps per call, one of which (wc_InitRng) may touch the entropy source.

Current code required for every DH call:

WC_RNG rng;
wc_InitRng(&rng);
wc_curve25519_set_rng(&private_key, &rng);
wc_curve25519_shared_secret_ex(&private_key, &public_key, out, &outlen, EC25519_LITTLE_ENDIAN);
wc_FreeRng(&rng);

For high-throughput servers or entropy-constrained platforms (HSMs, TPMs, embedded), this is unnecessary overhead. Callers already have an RNG instance they would naturally reuse.

Requested fix: Accept an optional WC_RNG* parameter in wc_curve25519_shared_secret_ex so callers can pass an existing RNG rather than constructing a temporary one per operation. A NULL parameter could fall back to the current behavior for backward compatibility.

Migrated from internal tracking (ZD-21738).

[MarkAtwood]

Where this surfaces

This was discovered in wolfssl-rs, the Rust FFI wrapper for wolfCrypt.

Workaround in wolfcrypt/src/ecdh.rs (lines 161–219):

// wolfSSL enables Curve25519 blinding by default, which requires
// an RNG attached to the private key for scalar multiplication.
// Create a temporary RNG for this operation.
let mut rng = WC_RNG::zeroed();

let rc = unsafe { wc_InitRng(&mut rng) };
assert_eq!(rc, 0, "wc_InitRng failed (entropy source unavailable)");

let rc = unsafe { wc_curve25519_set_rng(&mut self.key, &mut rng) };
assert_eq!(rc, 0, "wc_curve25519_set_rng failed (null RNG)");
// ... perform DH ...
unsafe {
    wc_curve25519_free(&mut peer_key);
    wc_FreeRng(&mut rng);
}

The same per-call wc_InitRng/wc_FreeRng pattern also appears in ecdsa_native.rs (lines 332–345, 473–508) and ecdh.rs for ECC (lines 746–763, 888–925). Note: Curve448 does not use blinding, so no RNG is needed there.