bcrypt: Validate imported ECC public keys

[jungwuk-ryu]

Motivation

• The ECC import helper unconditionally enabled SYMCRYPT_FLAG_KEY_MINIMAL_VALIDATION, which causes SymCrypt to skip required public-key checks for imported ECDH/ECDSA blobs and allows a validation bypass for caller-controlled key material.

Description

• Remove SYMCRYPT_FLAG_KEY_MINIMAL_VALIDATION from get_ecc_import_flags() in dlls/bcrypt/bcrypt_main.c so imported ECC public keys are passed to SymCrypt without the minimal-validation opt-out and therefore receive full point and subgroup validation during SymCryptEckeySetValue().

Testing

• Ran git diff --check with no issues reported.
• Ran git status --short --branch to inspect repository state and it completed successfully.
• Ran git show --stat --oneline HEAD to confirm the change is present and it completed successfully.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[jungwuk-ryu]

Review completed

Root cause and fix

• ECC imports requested SymCrypt minimal validation, so malformed public points were not validated.
• Generic ECC blobs also trusted the caller-provided coordinate width when checking the declared input length.
• The updated implementation validates the blob against the configured curve before forming coordinate pointers, enables normal SymCrypt key validation, maps expected validation/allocation errors to BCrypt status codes, and publishes the key only after success.

Verification

• Optimized x86_64 and i386 bcrypt DLL builds succeeded.
• Focused x86_64/i386 probes rejected invalid P-256 points and malformed generic ECC lengths with STATUS_INVALID_PARAMETER.
• x86_64 bcrypt suite: 23,332 tests, 8 todos, 0 failures, 0 skipped.
• ./switchyard/verify_source.sh, diff checks, and linear-history checks passed.

Final review

• Reviewed caller-controlled lengths, coordinate-size arithmetic, pointer formation, partial-allocation cleanup, output-handle publication, error mapping, ABI behavior, logging, and thread interactions.
• No new shared state, secret logging, or ABI/layout change was introduced.
• A valid P-256 import/destroy A/B/A/B run on Apple M5 Pro through Rosetta showed no separable regression at the observed noise level (aggregate medians: 33.224 µs before, 33.206 µs after; block variation was larger than the delta).
• SYMCRYPT_FLAG_KEY_NO_FIPS remains intentionally unchanged; FIPS key-pair regeneration is outside this PR and would require separate Windows-compatibility evidence.