Skip to content

Commit 5eff97a

Browse files
FrauschiFrauschi
committed
Add tests for individual ML-KEM levels (based on #9777)
Also fix minor problems found with these tests
1 parent cc08eba commit 5eff97a

7 files changed

Lines changed: 69 additions & 26 deletions

File tree

‎.github/workflows/pq-all.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,13 @@ jobs:
2727
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"',
2828
'--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
2929
'--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
30+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
31+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
32+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
33+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
34+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
35+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
36+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3037
]
3138
name: make check
3239
if: github.repository_owner == 'wolfssl'

‎configure.ac‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1864,14 +1864,20 @@ then
18641864
if test "$ENABLED_MLKEM" = "no"
18651865
then
18661866
ENABLED_PQC_HYBRIDS=no
1867+
elif test "$ENABLED_MLKEM768" = "" && test "$ENABLED_MLKEM1024" = ""; then
1868+
AC_MSG_NOTICE([PQC hybrid combinations require either ML-KEM 768 or ML-KEM 1024, but both disabled.])
1869+
ENABLED_PQC_HYBRIDS=no
18671870
else
18681871
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PQC_HYBRIDS"
18691872
fi
18701873
fi
18711874

1872-
if test "$ENABLED_MLKEM" = "yes" && test "$ENABLED_TLS13" = "yes" && test "$ENABLED_PQC_HYBRIDS" = "no" && test "$ENABLED_MLKEM_STANDALONE" = "no"
1875+
if test "$ENABLED_MLKEM" != "no"
18731876
then
1874-
AC_MSG_ERROR([Both hybrid PQ/T and standalone ML-KEM are disabled, so no PQC hybrid combinations will be available.])
1877+
if test "$ENABLED_PQC_HYBRIDS" = "no" && test "$ENABLED_MLKEM_STANDALONE" = "no" && test "$ENABLED_CRYPTONLY" = "no"
1878+
then
1879+
AC_MSG_ERROR([Both hybrid PQ/T and standalone ML-KEM are disabled, so no PQC hybrid combinations will be available.])
1880+
fi
18751881
fi
18761882

18771883
# Extra PQ/T Hybrid combinations

‎src/tls.c‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4510,14 +4510,15 @@ int TLSX_IsGroupSupported(int namedGroup)
45104510
#ifndef WOLFSSL_NO_ML_KEM_512
45114511
#ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
45124512
case WOLFSSL_ML_KEM_512:
4513+
break;
45134514
#endif /* !WOLFSSL_TLS_NO_MLKEM_STANDALONE */
45144515
#ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
45154516
case WOLFSSL_SECP256R1MLKEM512:
45164517
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
45174518
case WOLFSSL_X25519MLKEM512:
45184519
#endif /* HAVE_CURVE25519 */
4519-
#endif /* WOLFSSL_EXTRA_PQC_HYBRIDS */
45204520
break;
4521+
#endif /* WOLFSSL_EXTRA_PQC_HYBRIDS */
45214522
#endif /* WOLFSSL_NO_ML_KEM_512 */
45224523
#ifndef WOLFSSL_NO_ML_KEM_768
45234524
#ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
@@ -8504,9 +8505,8 @@ static int mlkem_id2type(int id, int *type)
85048505
#endif
85058506

85068507
#if defined(WOLFSSL_NO_ML_KEM_768) && defined(WOLFSSL_NO_ML_KEM_1024) && \
8507-
!defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
8508-
#error "Non-experimental PQC hybrid combinations require either "
8509-
"ML-KEM 768 or ML-KEM 1024"
8508+
defined(WOLFSSL_PQC_HYBRIDS)
8509+
#error "PQC hybrid combinations require either ML-KEM 768 or ML-KEM 1024"
85108510
#endif
85118511

85128512
/* Structures and objects needed for hybrid key exchanges using both classic
@@ -10922,11 +10922,18 @@ int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, word16 len, byte* data,
1092210922
#if !defined(WOLFSSL_ASYNC_CRYPT)
1092310923
if (ssl->options.side == WOLFSSL_SERVER_END &&
1092410924
WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group)) {
10925-
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10926-
keyShareEntry,
10927-
data, len);
10928-
if (ret != 0)
10929-
return ret;
10925+
if (TLSX_IsGroupSupported(group)) {
10926+
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10927+
keyShareEntry,
10928+
data, len);
10929+
if (ret != 0)
10930+
return ret;
10931+
}
10932+
else {
10933+
XFREE(keyShareEntry->ke, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
10934+
keyShareEntry->ke = NULL;
10935+
keyShareEntry->keLen = 0;
10936+
}
1093010937
}
1093110938
else
1093210939
#endif

‎tests/api.c‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31079,19 +31079,38 @@ static int test_dtls13_frag_ch_pq(void)
3107931079
byte buf[255];
3108031080
#if !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
3108131081
#if defined(WOLFSSL_MLKEM_KYBER)
31082+
#if !defined(WOLFSSL_NO_KYBER1024)
3108231083
int group = WOLFSSL_KYBER_LEVEL5;
3108331084
const char *group_name = "KYBER_LEVEL5";
31085+
#elif !defined(WOLFSSL_NO_KYBER768)
31086+
int group = WOLFSSL_KYBER_LEVEL3;
31087+
const char *group_name = "KYBER_LEVEL3";
31088+
#else
31089+
int group = WOLFSSL_KYBER_LEVEL1;
31090+
const char *group_name = "KYBER_LEVEL1";
31091+
#endif
3108431092
#else
31093+
#if !defined(WOLFSSL_NO_ML_KEM_1024)
3108531094
int group = WOLFSSL_ML_KEM_1024;
3108631095
const char *group_name = "ML_KEM_1024";
31096+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
31097+
int group = WOLFSSL_ML_KEM_768;
31098+
const char *group_name = "ML_KEM_768";
31099+
#else
31100+
int group = WOLFSSL_ML_KEM_512;
31101+
const char *group_name = "ML_KEM_512";
31102+
#endif
3108731103
#endif
3108831104
#elif defined(WOLFSSL_PQC_HYBRIDS)
31089-
#if defined(HAVE_CURVE25519)
31105+
#if defined(HAVE_CURVE25519) && !defined(WOLFSSL_NO_ML_KEM_768)
3109031106
int group = WOLFSSL_X25519MLKEM768;
3109131107
const char *group_name = "X25519MLKEM768";
31092-
#else
31108+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
3109331109
int group = WOLFSSL_SECP256R1MLKEM768;
3109431110
const char *group_name = "SecP256r1MLKEM768";
31111+
#else
31112+
int group = WOLFSSL_SECP384R1MLKEM1024;
31113+
const char *group_name = "SecP384r1MLKEM1024";
3109531114
#endif
3109631115
#endif /* WOLFSSL_TLS_NO_MLKEM_STANDALONE */
3109731116

‎tests/api/test_dtls.c‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1619,15 +1619,23 @@ int test_dtls_rtx_across_epoch_change(void)
16191619
*into two messages */
16201620
int helloMsgCount = 2;
16211621
int groups[2] = {
1622-
#if defined(HAVE_CURVE25519) && defined(WOLFSSL_PQC_HYBRIDS)
1622+
#if defined(HAVE_CURVE25519) && defined(WOLFSSL_PQC_HYBRIDS) && \
1623+
!defined(WOLFSSL_NO_ML_KEM_768)
16231624
WOLFSSL_X25519MLKEM768,
1624-
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS)
1625+
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS) && \
1626+
!defined(WOLFSSL_NO_ML_KEM_768)
16251627
WOLFSSL_SECP256R1MLKEM768,
1628+
#elif defined(HAVE_ECC) && defined(WOLFSSL_PQC_HYBRIDS) && \
1629+
!defined(WOLFSSL_NO_ML_KEM_1024)
1630+
WOLFSSL_SECP384R1MLKEM1024,
16261631
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && \
16271632
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
16281633
WOLFSSL_ML_KEM_1024,
1629-
#else
1634+
#elif !defined(WOLFSSL_NO_ML_KEM_768) && \
1635+
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
16301636
WOLFSSL_ML_KEM_768,
1637+
#else
1638+
WOLFSSL_ML_KEM_512,
16311639
#endif
16321640
WOLFSSL_ECC_SECP256R1,
16331641
};

‎tests/api/test_tls13.c‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -160,12 +160,8 @@ int test_tls13_apis(void)
160160
":SecP256r1MLKEM512"
161161
#elif !defined(WOLFSSL_NO_ML_KEM_768) && defined(WOLFSSL_PQC_HYBRIDS)
162162
":SecP256r1MLKEM768"
163-
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && \
164-
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
165-
":ML_KEM_1024"
166-
#elif !defined(WOLFSSL_NO_ML_KEM_768) && \
167-
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
168-
":ML_KEM_768"
163+
#elif !defined(WOLFSSL_NO_ML_KEM_1024) && defined(WOLFSSL_PQC_HYBRIDS)
164+
":SecP384r1MLKEM1024"
169165
#endif
170166
#endif
171167
#endif
@@ -184,11 +180,11 @@ int test_tls13_apis(void)
184180
":KYBER_LEVEL5"
185181
#endif
186182
#elif !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
187-
#ifndef WOLFSSL_NO_KYBER512
183+
#if !defined(WOLFSSL_NO_ML_KEM_512)
188184
":ML_KEM_512"
189-
#elif !defined(WOLFSSL_NO_KYBER768)
185+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
190186
":ML_KEM_768"
191-
#else
187+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
192188
":ML_KEM_1024"
193189
#endif
194190
#endif

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1742,7 +1742,7 @@ enum Misc {
17421742
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
17431743
#endif
17441744
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
1745-
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
1745+
MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */
17461746

17471747
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
17481748
RSA_PSS_RSAE_SHA256_MINOR = 0x04,

0 commit comments

Comments
 (0)