Skip to content

Commit 71a8a55

Browse files
FrauschiFrauschi
authored
Merge pull request #10345 from douzzer/20260428-SLHDSA-fixes
20260428-SLHDSA-fixes
2 parents 468ee9e + f81f847 commit 71a8a55

6 files changed

Lines changed: 113 additions & 34 deletions

File tree

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -910,6 +910,7 @@ WOLFSSL_SHA512_HASHTYPE
910910
WOLFSSL_SHUTDOWNONCE
911911
WOLFSSL_SILABS_TRNG
912912
WOLFSSL_SLHDSA_FULL_HASH
913+
WOLFSSL_SLHDSA_NO_VERIFY_ONLY
913914
WOLFSSL_SNIFFER_NO_RECOVERY
914915
WOLFSSL_SP_ARM32_UDIV
915916
WOLFSSL_SP_FAST_NCT_EXPTMOD

‎tests/api/test_slhdsa.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
int test_wc_slhdsa(void)
4343
{
4444
EXPECT_DECLS;
45-
#ifdef WOLFSSL_HAVE_SLHDSA
45+
#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_NO_SHAKE)
4646
SlhDsaKey key;
4747

4848
/* Test NULL parameter handling for init. */
@@ -84,7 +84,7 @@ int test_wc_slhdsa(void)
8484
wc_SlhDsaKey_Free(&key);
8585
#endif
8686

87-
#endif /* WOLFSSL_HAVE_SLHDSA */
87+
#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_NO_SHAKE */
8888
return EXPECT_RESULT();
8989
}
9090

@@ -94,7 +94,7 @@ int test_wc_slhdsa(void)
9494
int test_wc_slhdsa_sizes(void)
9595
{
9696
EXPECT_DECLS;
97-
#ifdef WOLFSSL_HAVE_SLHDSA
97+
#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_NO_SHAKE)
9898
SlhDsaKey key;
9999

100100
/* Test NULL parameter handling for size functions. */
@@ -226,7 +226,7 @@ int test_wc_slhdsa_sizes(void)
226226
WC_SLHDSA_SHAKE256F_SIG_LEN);
227227
#endif
228228

229-
#endif /* WOLFSSL_HAVE_SLHDSA */
229+
#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_NO_SHAKE */
230230
return EXPECT_RESULT();
231231
}
232232

‎wolfcrypt/src/wc_slhdsa.c‎

Lines changed: 42 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -758,6 +758,7 @@ static int slhdsakey_hash_f_sha2(SlhDsaKey* key, const byte* pk_seed,
758758
return ret;
759759
}
760760

761+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
761762
/* SHA2 H function.
762763
*
763764
* FIPS 205. Section 11.2.
@@ -836,6 +837,7 @@ static int slhdsakey_hash_h_sha2(SlhDsaKey* key, const byte* pk_seed,
836837

837838
return ret;
838839
}
840+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
839841

840842
/* SHA2 H function with two separate n-byte halves.
841843
*
@@ -921,6 +923,7 @@ static int slhdsakey_hash_h_2_sha2(SlhDsaKey* key, const byte* pk_seed,
921923
return ret;
922924
}
923925

926+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
924927
/* SHA2 PRF function.
925928
*
926929
* FIPS 205. Section 11.2.
@@ -969,6 +972,7 @@ static int slhdsakey_hash_prf_sha2(SlhDsaKey* key, const byte* pk_seed,
969972

970973
return ret;
971974
}
975+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
972976

973977
/* SHA2 T_l streaming: start with address.
974978
*
@@ -1165,6 +1169,7 @@ static int slhdsakey_mgf1_sha2(SlhDsaKey* key, const byte* seed,
11651169
return ret;
11661170
}
11671171

1172+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
11681173
/* SHA2 PRF_msg function.
11691174
*
11701175
* FIPS 205. Section 11.2.
@@ -1226,6 +1231,7 @@ static int slhdsakey_prf_msg_sha2(SlhDsaKey* key, const byte* sk_prf,
12261231

12271232
return ret;
12281233
}
1234+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
12291235

12301236
/* SHA2 H_msg function.
12311237
*
@@ -1370,6 +1376,7 @@ static int slhdsakey_hash_f_shake(SlhDsaKey* key, const byte* pk_seed,
13701376
#endif
13711377
}
13721378

1379+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
13731380
static int slhdsakey_hash_h_shake(SlhDsaKey* key, const byte* pk_seed,
13741381
const word32* adrs, const byte* node, byte n, byte* hash)
13751382
{
@@ -1381,6 +1388,7 @@ static int slhdsakey_hash_h_shake(SlhDsaKey* key, const byte* pk_seed,
13811388
2 * n, NULL, 0, hash, n);
13821389
#endif
13831390
}
1391+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
13841392

13851393
static int slhdsakey_hash_h_2_shake(SlhDsaKey* key, const byte* pk_seed,
13861394
const word32* adrs, const byte* m1, const byte* m2, byte n, byte* hash)
@@ -1389,6 +1397,7 @@ static int slhdsakey_hash_h_2_shake(SlhDsaKey* key, const byte* pk_seed,
13891397
n, m2, n, hash, n);
13901398
}
13911399

1400+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
13921401
static int slhdsakey_hash_prf_shake(SlhDsaKey* key, const byte* pk_seed,
13931402
const byte* sk_seed, const word32* adrs, byte n, byte* hash)
13941403
{
@@ -1400,6 +1409,7 @@ static int slhdsakey_hash_prf_shake(SlhDsaKey* key, const byte* pk_seed,
14001409
sk_seed, n, NULL, 0, hash, n);
14011410
#endif
14021411
}
1412+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
14031413

14041414
#define HASH_PRF(k, pk_seed, sk_seed, adrs, n, o) \
14051415
(SLHDSA_IS_SHA2((k)->params->param) ? \
@@ -2014,7 +2024,7 @@ static int slhdsakey_shake256_set_seed_ha_hash_x4(word64* state,
20142024

20152025
return ret;
20162026
}
2017-
#endif
2027+
#endif /* WOLFSSL_SLHDSA_VERIFY_ONLY */
20182028

20192029
/* Get the four SHAKE-256 n-byte hash results.
20202030
*
@@ -2049,7 +2059,7 @@ do { \
20492059
((word8*)((state) + (o) - 2))[3] = (a) + 2; \
20502060
((word8*)((state) + (o) - 1))[3] = (a) + 3; \
20512061
} while (0)
2052-
#endif
2062+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
20532063

20542064
/* Set the chain address indices into the SHAKE-256 x4 state.
20552065
*
@@ -2093,7 +2103,7 @@ do { \
20932103
c32toa((ti) + 2, (byte*)&((word32*)((state) + (o) - 2))[1]); \
20942104
c32toa((ti) + 3, (byte*)&((word32*)((state) + (o) - 1))[1]); \
20952105
} while (0)
2096-
#endif
2106+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
20972107

20982108
/* Set the tree indices into the SHAKE-256 x4 state.
20992109
*
@@ -2435,7 +2445,7 @@ static int slhdsakey_chain_x4_16(byte* sk, const byte* pk_seed, byte* addr,
24352445
WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
24362446
return ret;
24372447
}
2438-
#endif
2448+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
24392449

24402450
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
24412451
/* Iterate the hash function 15 times with 4 hashes when n=24.
@@ -3979,10 +3989,6 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
39793989
const byte* msg, const byte* pk_seed, word32* adrs, byte* pk_sig)
39803990
{
39813991
int ret = 0;
3982-
byte idx[4] = {0};
3983-
int i;
3984-
byte ii;
3985-
sword8 j;
39863992
HashAddress wotspk_adrs;
39873993
byte n = key->params->n;
39883994
byte len = key->params->len;
@@ -3993,7 +3999,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
39933999
DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
39944000
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
39954001
if ((ret == 0) && (n == WC_SLHDSA_N_128)) {
3996-
ii = 0;
4002+
int i;
4003+
sword8 j;
4004+
byte ii = 0;
4005+
byte idx[4] = {0};
39974006
for (j = 0; j <= SLHDSA_WM1; j++) {
39984007
for (i = 0; i < len; i++) {
39994008
if ((sword8)msg[i] == j) {
@@ -4020,7 +4029,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
40204029
#endif
40214030
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
40224031
if ((ret == 0) && (n == 24)) {
4023-
ii = 0;
4032+
int i;
4033+
sword8 j;
4034+
byte ii = 0;
4035+
byte idx[4] = {0};
40244036
for (j = 0; j <= SLHDSA_WM1; j++) {
40254037
for (i = 0; i < len; i++) {
40264038
if ((sword8)msg[i] == j) {
@@ -4047,7 +4059,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
40474059
#endif
40484060
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
40494061
if ((ret == 0) && (n == 32)) {
4050-
ii = 0;
4062+
int i;
4063+
sword8 j;
4064+
byte ii = 0;
4065+
byte idx[4] = {0};
40514066
for (j = 0; j <= SLHDSA_WM1; j++) {
40524067
for (i = 0; i < len; i++) {
40534068
if ((sword8)msg[i] == j) {
@@ -4072,9 +4087,14 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
40724087
}
40734088
else
40744089
#endif
4075-
if (ret == 0) {
4076-
ret = NOT_COMPILED_IN;
4090+
{
4091+
(void)msg;
4092+
(void)key;
4093+
if (ret == 0) {
4094+
ret = NOT_COMPILED_IN;
4095+
}
40774096
}
4097+
40784098
if (ret == 0) {
40794099
HA_Copy(wotspk_adrs, adrs);
40804100
HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
@@ -4565,7 +4585,7 @@ static int slhdsakey_xmss_sign(SlhDsaKey* key, const byte* m,
45654585

45664586
return ret;
45674587
}
4568-
#endif
4588+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
45694589

45704590
/* Compute XMSS public key from XMSS signature.
45714591
*
@@ -4759,7 +4779,7 @@ static int slhdsakey_ht_sign(SlhDsaKey* key, const byte* pk_fors,
47594779

47604780
return ret;
47614781
}
4762-
#endif
4782+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
47634783

47644784
/* Verify hypertree signature.
47654785
*
@@ -5788,7 +5808,7 @@ static int slhdsakey_fors_sign(SlhDsaKey* key, const byte* md,
57885808

57895809
return ret;
57905810
}
5791-
#endif
5811+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
57925812

57935813
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
57945814
/* F hash 4 simultaneously.
@@ -7223,7 +7243,7 @@ int wc_SlhDsaKey_SignMsgWithRandom(SlhDsaKey* key, const byte* mprime,
72237243
addRnd);
72247244
}
72257245

7226-
#endif
7246+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
72277247

72287248
/* Verify SLH-DSA signature.
72297249
*
@@ -7968,7 +7988,7 @@ int wc_SlhDsaKey_SignHash(SlhDsaKey* key, const byte* ctx, byte ctxSz,
79687988

79697989
return ret;
79707990
}
7971-
#endif
7991+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
79727992

79737993
/* Verify SLH-DSA signature.
79747994
*
@@ -8155,7 +8175,7 @@ int wc_SlhDsaKey_ImportPrivate(SlhDsaKey* key, const byte* priv, word32 privLen)
81558175

81568176
return ret;
81578177
}
8158-
#endif
8178+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
81598179

81608180
/* Import public key from data.
81618181
*
@@ -8268,7 +8288,7 @@ int wc_SlhDsaKey_ExportPrivate(SlhDsaKey* key, byte* priv, word32* privLen)
82688288

82698289
return ret;
82708290
}
8271-
#endif
8291+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
82728292

82738293
/* Export the public key.
82748294
*
@@ -8326,7 +8346,7 @@ int wc_SlhDsaKey_PrivateSize(SlhDsaKey* key)
83268346

83278347
return ret;
83288348
}
8329-
#endif
8349+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
83308350

83318351
/* Return the size of the public key for the parameters.
83328352
*
@@ -8429,7 +8449,7 @@ int wc_SlhDsaKey_PrivateSizeFromParam(enum SlhDsaParam param)
84298449

84308450
return ret;
84318451
}
8432-
#endif
8452+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
84338453

84348454
/* Return the size of the public key for the parameters.
84358455
*

‎wolfcrypt/test/test.c‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54234,9 +54234,7 @@ static wc_test_ret_t slhdsa_test_param(enum SlhDsaParam param)
5423454234

5423554235
wc_test_ret_t slhdsa_test(void)
5423654236
{
54237-
#if !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) || defined(WOLFSSL_SLHDSA_PARAM_128S)
54238-
int ret;
54239-
#endif
54237+
int ret = 0;
5424054238
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5424154239
WC_DECLARE_VAR(key_vfy, SlhDsaKey, 1, HEAP_HINT);
5424254240
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
@@ -55957,9 +55955,7 @@ wc_test_ret_t slhdsa_test(void)
5595755955
}
5595855956
}
5595955957
#endif
55960-
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
5596155958

55962-
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
5596355959
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5596455960
ret = slhdsa_test_param(SLHDSA_SHAKE128S);
5596555961
if (ret != 0) {
@@ -56044,17 +56040,25 @@ wc_test_ret_t slhdsa_test(void)
5604456040
goto out;
5604556041
}
5604656042
#endif
56047-
#endif
56043+
56044+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
56045+
56046+
#if defined(WOLFSSL_SLHDSA_VERIFY_ONLY) || \
56047+
defined(WOLFSSL_SLHDSA_PARAM_128S)
5604856048

5604956049
out:
5605056050

56051+
#endif
56052+
56053+
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5605156054
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
5605256055
if (key_vfy)
5605356056
#endif
5605456057
{
5605556058
wc_SlhDsaKey_Free(key_vfy);
5605656059
}
5605756060
WC_FREE_VAR_EX(key_vfy, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
56061+
#endif
5605856062
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
5605956063
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
5606056064
if (key)

‎wolfssl/wolfcrypt/settings.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4042,6 +4042,14 @@ extern void uITRON4_free(void *p) ;
40424042
#undef WOLFSSL_GENERAL_ALIGNMENT
40434043
#define WOLFSSL_GENERAL_ALIGNMENT SIZEOF_LONG
40444044
#endif
4045+
4046+
/* SLH-DSA signature generation is too computationally intensive to be
4047+
* appropriate in typical kernel deployments.
4048+
*/
4049+
#if !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
4050+
!defined(WOLFSSL_SLHDSA_NO_VERIFY_ONLY)
4051+
#define WOLFSSL_SLHDSA_VERIFY_ONLY
4052+
#endif
40454053
#endif /* WOLFSSL_KERNEL_MODE */
40464054

40474055
#if defined(WC_SYM_RELOC_TABLES) && defined(HAVE_FIPS) && \

0 commit comments

Comments
 (0)