Hi,

I have looked into ECC signature, especially into the example at \wolfssl-examples-master\signature\ecc-sign-verify. This compiles and runs. In the example a key is produced and with this key signing and subsequent verification is done. I wanted to have it more realistic, so that the key generation, the code signing and the verification are separated from each others.
So I splitted this into 4 independent files "keymake", "sign", "verify" and a "main"  (here for simplicity put together). in "keymake" I generated "der" data for the public key and the private key , in "sign" I signed a hash, in "validate" I validated the signature, and in "main" I call all three others, taking care that these others only know what they need to know.

(condensed) code is:

//some stuff, used separately in all modules, here  put in one place for simplicity
#define BYTE_SZ 8
static ecc_key key;   //got stack corruption when I use it as a local var
static WC_RNG rng;

//creates a key and corresponding public and private der data
int keymake(  int eccKeySz,  char* der_file_private,  int* der_file_private_size,
  char* der_file_public,  int* der_file_public_size)
{
  int ret;
  int verified = 0;
  int byteField = (512 + (BYTE_SZ - 1)) / BYTE_SZ;

  wolfCrypt_Init();
  ret = wc_ecc_init(&key);
  ret = wc_InitRng(&rng);
  ret = wc_ecc_make_key(&rng, byteField, &key);
  *der_file_private_size = wc_EccPrivateKeyToDer(&key, der_file_private, *der_file_private_size);
  //???? what is parameter 4 ?
  *der_file_public_size = wc_EccPublicKeyToDer(&key, der_file_public, *der_file_public_size, ECC_SECP256R1);
}

//creates a signature of a hash using private der data
int sign(  char* hash,  int hash_size,  char* der_file_private,  int der_file_private_size,
  char* signature,  int* signature_size)
{
  int ret;
  wc_ecc_init(&key);
  word32 idx = 0;
  wc_EccPrivateKeyDecode(der_file_private, &idx, &key, der_file_private_size);
  ret = wc_InitRng(&rng);
  ret = wc_ecc_sign_hash(hash, sizeof(hash), signature, signature_size, &rng, &key);
}

//verifies a signature of a hash using public der data
int verify(  char* hash,  int hash_size,  char* der_file_public,  int der_file_public_size,
  char* signature,  int signature_size)
{
  int ret;
  int verified = 0;
  word32 idx = 0;
  wc_ecc_init(&key);  //set up a new one
  ret = wc_EccPublicKeyDecode(der_file_public, &idx, &key, der_file_public_size);
  ret = wc_ecc_verify_hash(signature, signature_size, hash, hash_size, &verified, &key);
  if ((ret != 0) || verified != 1) { printf("verification failed\n"); return(-1)}
  return(0);
}

int main(int argc, char** argv)
{
  unsigned char hash[32] = {
                            0x3b, 0x07, 0x54, 0x5c, 0xfd, 0x4f, 0xb7, 0xb5,
                            0xaf, 0xa7, 0x7a, 0x25, 0x33, 0xa5, 0x50, 0x70,
                            0x4a, 0x65, 0x3e, 0x72, 0x7e, 0xcd, 0xd4, 0x5b,
                            0x1b, 0x36, 0x96, 0x96, 0xca, 0x4f, 0x9b, 0x6f
  };
  byte der_file_private[1000];
  int der_file_private_size = 1000;
  byte der_file_public[1000];
  int  der_file_public_size = 1000;
  byte signature[ECC_MAX_SIG_SIZE];
  int signature_size = ECC_MAX_SIG_SIZE;

  int ret;

  ret = keymake(256, der_file_private, &der_file_private_size, der_file_public, &der_file_public_size);
  ret = sign(hash, sizeof(hash), der_file_private, der_file_private_size, signature, &signature_size);
  ret = verify(hash, sizeof(hash), der_file_public, der_file_public_size, signature, signature_size);
  printf("verify ret=%i\n", ret);
}

All this compiles, runs, there are no run time errors, but the last thing in verify(),  wc_ecc_verify_hash(signature, signature_size, hash, hash_size, &verified, &key), returns a 0 in "verified", failing the whole thing.

Can anyone of the people who do that all the time point me to my mistake? The only change to the (working) \wolfssl-examples-master\signature\ecc-sign-verify example  is that I tried to create public and private key as "der"-data and use them instead of the generated key. Also, there is the 4th parameter in wc_EccPublicKeyToDer(), which I just guessed as ECC_SECP256R1, This may be an issue.