Skip to content

Commit f418b2d

Browse files
FrauschiFrauschi
committed
Add tests for individual ML-KEM levels (based on wolfSSL#9777)
Also fix minor problems found with these tests
1 parent 1cf2223 commit f418b2d

7 files changed

Lines changed: 69 additions & 26 deletions

File tree

‎.github/workflows/pq-all.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,13 @@ jobs:
2727
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"',
2828
'--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
2929
'--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
30+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
31+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
32+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
33+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
34+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
35+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
36+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3037
]
3138
name: make check
3239
if: github.repository_owner == 'wolfssl'

‎configure.ac‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1864,14 +1864,20 @@ then
18641864
if test "$ENABLED_MLKEM" = "no"
18651865
then
18661866
ENABLED_PQC_HYBRIDS=no
1867+
elif test "$ENABLED_MLKEM768" = "" && test "$ENABLED_MLKEM1024" = ""; then
1868+
AC_MSG_NOTICE([PQC hybrid combinations require either ML-KEM 768 or ML-KEM 1024, but both disabled.])
1869+
ENABLED_PQC_HYBRIDS=no
18671870
else
18681871
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PQC_HYBRIDS"
18691872
fi
18701873
fi
18711874

1872-
if test "$ENABLED_MLKEM" = "yes" && test "$ENABLED_TLS13" = "yes" && test "$ENABLED_PQC_HYBRIDS" = "no" && test "$ENABLED_MLKEM_STANDALONE" = "no"
1875+
if test "$ENABLED_MLKEM" != "no"
18731876
then
1874-
AC_MSG_ERROR([Both hybrid PQ/T and standalone ML-KEM are disabled, so no PQC hybrid combinations will be available.])
1877+
if test "$ENABLED_PQC_HYBRIDS" = "no" && test "$ENABLED_MLKEM_STANDALONE" = "no" && test "$ENABLED_CRYPTONLY" = "no"
1878+
then
1879+
AC_MSG_ERROR([Both hybrid PQ/T and standalone ML-KEM are disabled, so no PQC hybrid combinations will be available.])
1880+
fi
18751881
fi
18761882

18771883
# Extra PQ/T Hybrid combinations

‎src/tls.c‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4522,14 +4522,15 @@ int TLSX_IsGroupSupported(int namedGroup)
45224522
#ifndef WOLFSSL_NO_ML_KEM_512
45234523
#ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
45244524
case WOLFSSL_ML_KEM_512:
4525+
break;
45254526
#endif /* !WOLFSSL_TLS_NO_MLKEM_STANDALONE */
45264527
#ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
45274528
case WOLFSSL_SECP256R1MLKEM512:
45284529
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
45294530
case WOLFSSL_X25519MLKEM512:
45304531
#endif /* HAVE_CURVE25519 */
4531-
#endif /* WOLFSSL_EXTRA_PQC_HYBRIDS */
45324532
break;
4533+
#endif /* WOLFSSL_EXTRA_PQC_HYBRIDS */
45334534
#endif /* WOLFSSL_NO_ML_KEM_512 */
45344535
#ifndef WOLFSSL_NO_ML_KEM_768
45354536
#ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
@@ -8516,9 +8517,8 @@ static int mlkem_id2type(int id, int *type)
85168517
#endif
85178518

85188519
#if defined(WOLFSSL_NO_ML_KEM_768) && defined(WOLFSSL_NO_ML_KEM_1024) && \
8519-
!defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
8520-
#error "Non-experimental PQC hybrid combinations require either "
8521-
"ML-KEM 768 or ML-KEM 1024"
8520+
defined(WOLFSSL_PQC_HYBRIDS)
8521+
#error "PQC hybrid combinations require either ML-KEM 768 or ML-KEM 1024"
85228522
#endif
85238523

85248524
/* Structures and objects needed for hybrid key exchanges using both classic
@@ -10934,11 +10934,18 @@ int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, word16 len, byte* data,
1093410934
#if !defined(WOLFSSL_ASYNC_CRYPT)
1093510935
if (ssl->options.side == WOLFSSL_SERVER_END &&
1093610936
WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group)) {
10937-
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10938-
keyShareEntry,
10939-
data, len);
10940-
if (ret != 0)
10941-
return ret;
10937+
if (TLSX_IsGroupSupported(group)) {
10938+
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10939+
keyShareEntry,
10940+
data, len);
10941+
if (ret != 0)
10942+
return ret;
10943+
}
10944+
else {
10945+
XFREE(keyShareEntry->ke, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
10946+
keyShareEntry->ke = NULL;
10947+
keyShareEntry->keLen = 0;
10948+
}
1094210949
}
1094310950
else
1094410951
#endif

‎tests/api.c‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31286,19 +31286,38 @@ static int test_dtls13_frag_ch_pq(void)
3128631286
byte buf[255];
3128731287
#if !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
3128831288
#if defined(WOLFSSL_MLKEM_KYBER)
31289+
#if !defined(WOLFSSL_NO_KYBER1024)
3128931290
int group = WOLFSSL_KYBER_LEVEL5;
3129031291
const char *group_name = "KYBER_LEVEL5";
31292+
#elif !defined(WOLFSSL_NO_KYBER768)
31293+
int group = WOLFSSL_KYBER_LEVEL3;
31294+
const char *group_name = "KYBER_LEVEL3";
31295+
#else
31296+
int group = WOLFSSL_KYBER_LEVEL1;
31297+
const char *group_name = "KYBER_LEVEL1";
31298+
#endif
3129131299
#else
31300+
#if !defined(WOLFSSL_NO_ML_KEM_1024)
3129231301
int group = WOLFSSL_ML_KEM_1024;
3129331302
const char *group_name = "ML_KEM_1024";
31303+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
31304+
int group = WOLFSSL_ML_KEM_768;
31305+
const char *group_name = "ML_KEM_768";
31306+
#else
31307+
int group = WOLFSSL_ML_KEM_512;
31308+
const char *group_name = "ML_KEM_512";
31309+
#endif
3129431310
#endif
3129531311
#elif defined(WOLFSSL_PQC_HYBRIDS)
31296-
#if defined(HAVE_CURVE25519)
31312+
#if defined(HAVE_CURVE25519) && !defined(WOLFSSL_NO_ML_KEM_768)
3129731313
int group = WOLFSSL_X25519MLKEM768;
3129831314
const char *group_name = "X25519MLKEM768";
31299-
#else
31315+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
3130031316
int group = WOLFSSL_SECP256R1MLKEM768;
3130131317
const char *group_name = "SecP256r1MLKEM768";
31318+
#else
31319+
int group = WOLFSSL_SECP384R1MLKEM1024;
31320+
const char *group_name = "SecP384r1MLKEM1024";
3130231321
#endif
3130331322
#endif /* WOLFSSL_TLS_NO_MLKEM_STANDALONE */
3130431323

‎tests/api/test_dtls.c‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1619,15 +1619,23 @@ int test_dtls_rtx_across_epoch_change(void)
16191619
*into two messages */
16201620
int helloMsgCount = 2;
16211621
int groups[2] = {
1622-
#if defined(HAVE_CURVE25519) && defined(WOLFSSL_PQC_HYBRIDS)
1622+
#if defined(HAVE_CURVE25519) && defined(WOLFSSL_PQC_HYBRIDS) && \
1623+
!defined(WOLFSSL_NO_ML_KEM_768)
16231624
WOLFSSL_X25519MLKEM768,
1624-
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS)
1625+
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS) && \
1626+
!defined(WOLFSSL_NO_ML_KEM_768)
16251627
WOLFSSL_SECP256R1MLKEM768,
1628+
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS) && \
1629+
!defined(WOLFSSL_NO_ML_KEM_1024)
1630+
WOLFSSL_SECP384R1MLKEM1024,
16261631
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && \
16271632
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
16281633
WOLFSSL_ML_KEM_1024,
1629-
#else
1634+
#elif !defined(WOLFSSL_NO_ML_KEM_768) && \
1635+
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
16301636
WOLFSSL_ML_KEM_768,
1637+
#else
1638+
WOLFSSL_ML_KEM_512,
16311639
#endif
16321640
WOLFSSL_ECC_SECP256R1,
16331641
};

‎tests/api/test_tls13.c‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -160,12 +160,8 @@ int test_tls13_apis(void)
160160
":SecP256r1MLKEM512"
161161
#elif !defined(WOLFSSL_NO_ML_KEM_768) && defined(WOLFSSL_PQC_HYBRIDS)
162162
":SecP256r1MLKEM768"
163-
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && \
164-
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
165-
":ML_KEM_1024"
166-
#elif !defined(WOLFSSL_NO_ML_KEM_768) && \
167-
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
168-
":ML_KEM_768"
163+
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && defined(WOLFSSL_PQC_HYBRIDS)
164+
":SecP384r1MLKEM1024"
169165
#endif
170166
#endif
171167
#endif
@@ -184,11 +180,11 @@ int test_tls13_apis(void)
184180
":KYBER_LEVEL5"
185181
#endif
186182
#elif !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
187-
#ifndef WOLFSSL_NO_KYBER512
183+
#if !defined(WOLFSSL_NO_ML_KEM_512)
188184
":ML_KEM_512"
189-
#elif !defined(WOLFSSL_NO_KYBER768)
185+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
190186
":ML_KEM_768"
191-
#else
187+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
192188
":ML_KEM_1024"
193189
#endif
194190
#endif

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1742,7 +1742,7 @@ enum Misc {
17421742
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
17431743
#endif
17441744
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
1745-
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
1745+
MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */
17461746

17471747
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
17481748
RSA_PSS_RSAE_SHA256_MINOR = 0x04,

0 commit comments

Comments
 (0)