Remove liboqs for ML-KEM and ML-DSA, update for Falcon

Author: Frauschi

.wolfssl_known_macro_extras

@@ -299,6 +299,7 @@ HAVE_PKCS7_RSA_RAW_SIGN_CALLBACK
 HAVE_POCO_LIB
 HAVE_RTP_SYS
 HAVE_SECURE_GETENV
+HAVE_SPHINCS
 HAVE_STACK_SIZE_VERBOSE_LOG
 HAVE_THREADX
 HAVE_TM_TYPE

CMakeLists.txt

@@ -625,20 +625,23 @@ add_option(WOLFSSL_OQS
     "Enable integration with the OQS (Open Quantum Safe) liboqs library (default: disabled)"
     "no" "yes;no")
 
+# Falcon (provided via liboqs)
+add_option(WOLFSSL_FALCON
+    "Enable Falcon post-quantum signatures via liboqs (default: disabled)"
+    "no" "yes;no")
+
 # ML-KEM/Kyber
 add_option(WOLFSSL_MLKEM
     "Enable the wolfSSL PQ ML-KEM library (default: disabled)"
     "yes" "yes;no")
 
 if (WOLFSSL_MLKEM)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MLKEM")
-    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_MLKEM")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
 
     set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
-    set_wolfssl_definitions("WOLFSSL_WC_MLKEM"   RESULT)
     set_wolfssl_definitions("WOLFSSL_SHA3"       RESULT)
     set_wolfssl_definitions("WOLFSSL_SHAKE128"   RESULT)
     set_wolfssl_definitions("WOLFSSL_SHAKE256"   RESULT)
@@ -677,13 +680,11 @@ add_option(WOLFSSL_DILITHIUM
 
 if (WOLFSSL_DILITHIUM)
     list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_DILITHIUM")
-    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_DILITHIUM")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
 
     set_wolfssl_definitions("HAVE_DILITHIUM"       RESULT)
-    set_wolfssl_definitions("WOLFSSL_WC_DILITHIUM" RESULT)
     set_wolfssl_definitions("WOLFSSL_SHA3"         RESULT)
     set_wolfssl_definitions("WOLFSSL_SHAKE128"     RESULT)
     set_wolfssl_definitions("WOLFSSL_SHAKE256"     RESULT)
@@ -733,6 +734,15 @@ if (WOLFSSL_EXPERIMENTAL)
 
     set_wolfssl_definitions("WOLFSSL_EXPERIMENTAL_SETTINGS" RESULT)
 
+    # Cross-validate WOLFSSL_OQS and WOLFSSL_FALCON: liboqs is only linked
+    # when a liboqs-backed algorithm (Falcon) is actually enabled.
+    if (WOLFSSL_FALCON AND NOT WOLFSSL_OQS)
+        message(FATAL_ERROR "WOLFSSL_FALCON requires WOLFSSL_OQS.")
+    endif()
+    if (WOLFSSL_OQS AND NOT WOLFSSL_FALCON)
+        message(FATAL_ERROR "WOLFSSL_OQS requires WOLFSSL_FALCON.")
+    endif()
+
     # Checking for experimental feature: OQS
     message(STATUS "Looking for WOLFSSL_OQS")
     if (WOLFSSL_OQS)
@@ -749,6 +759,7 @@ if (WOLFSSL_EXPERIMENTAL)
             set_wolfssl_definitions("HAVE_LIBOQS"          RESULT)
             set_wolfssl_definitions("HAVE_TLS_EXTENSIONS"  RESULT)
             set_wolfssl_definitions("OPENSSL_EXTRA"        RESULT)
+            set_wolfssl_definitions("HAVE_FALCON"          RESULT)
 
         else()
             message(STATUS "Checking OQS - not found")
@@ -777,19 +788,15 @@ if (WOLFSSL_EXPERIMENTAL)
         message(STATUS "Warning: WOLFSSL_EXPERIMENTAL enabled, but no experimental features enabled.")
     endif()
 
-    # Sanity checks
-    if(WOLFSSL_OQS AND WOLFSSL_MLKEM)
-        message(FATAL_ERROR "Error: cannot enable both WOLFSSL_OQS and WOLFSSL_MLKEM at the same time.")
-    endif()
-    if(WOLFSSL_OQS AND WOLFSSL_DILITHIUM)
-        message(FATAL_ERROR "Error: cannot enable both WOLFSSL_OQS and WOLFSSL_DILITHIUM at the same time.")
-    endif()
 else()
     # Experimental mode not enabled, but were any experimental features enabled? Error out if so:
     message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - not found")
     if (WOLFSSL_OQS)
         message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
     endif()
+    if (WOLFSSL_FALCON)
+        message(FATAL_ERROR "Error: WOLFSSL_FALCON requires WOLFSSL_EXPERIMENTAL at this time.")
+    endif()
 endif()
 
 # LMS

IDE/Espressif/ESP-IDF/examples/template/components/wolfssl/component.mk

@@ -203,7 +203,6 @@ COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed25519.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed448.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/error.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/evp.o
-# COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_mlkem.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_lms.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_xmss.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/falcon.o

IDE/Espressif/ESP-IDF/examples/template/components/wolfssl/include/user_settings.h

@@ -215,7 +215,6 @@
 #ifdef CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
     /* Kyber typically needs a minimum 10K stack */
     #define WOLFSSL_HAVE_MLKEM
-    #define WOLFSSL_WC_MLKEM
     #define WOLFSSL_SHAKE128
     #define WOLFSSL_SHAKE256
 
@@ -234,7 +233,7 @@
         #define WOLFSSL_NO_ML_KEM_768
         #define NO_SESSION_CACHE
     #else
-        /* Only needed for older wolfssl versions, see mlkem.h */
+        /* Only needed for older wolfssl versions, see wc_mlkem.h */
         #define WOLFSSL_KYBER1024
         /* optional alternative sizes:    */
         /* #define WOLFSSL_KYBER768       */

IDE/Espressif/ESP-IDF/examples/wolfssl_benchmark/components/wolfssl/component.mk

@@ -203,7 +203,6 @@ COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed25519.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed448.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/error.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/evp.o
-# COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_mlkem.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_lms.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_xmss.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/falcon.o

IDE/Espressif/ESP-IDF/examples/wolfssl_benchmark/components/wolfssl/include/user_settings.h

@@ -215,7 +215,6 @@
 #ifdef CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
     /* Kyber typically needs a minimum 10K stack */
     #define WOLFSSL_HAVE_MLKEM
-    #define WOLFSSL_WC_MLKEM
     #define WOLFSSL_SHAKE128
     #define WOLFSSL_SHAKE256
 
@@ -234,7 +233,7 @@
         #define WOLFSSL_NO_ML_KEM_768
         #define NO_SESSION_CACHE
     #else
-        /* Only needed for older wolfssl versions, see mlkem.h */
+        /* Only needed for older wolfssl versions, see wc_mlkem.h */
         #define WOLFSSL_KYBER1024
         /* optional alternative sizes:    */
         /* #define WOLFSSL_KYBER768       */

IDE/Espressif/ESP-IDF/examples/wolfssl_client/components/wolfssl/component.mk

@@ -203,7 +203,6 @@ COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed25519.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed448.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/error.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/evp.o
-# COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_mlkem.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_lms.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_xmss.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/falcon.o

IDE/Espressif/ESP-IDF/examples/wolfssl_client/components/wolfssl/include/user_settings.h

@@ -215,7 +215,6 @@
 #ifdef CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
     /* Kyber typically needs a minimum 10K stack */
     #define WOLFSSL_HAVE_MLKEM
-    #define WOLFSSL_WC_MLKEM
     #define WOLFSSL_SHAKE128
     #define WOLFSSL_SHAKE256
 
@@ -234,7 +233,7 @@
         #define WOLFSSL_NO_ML_KEM_768
         #define NO_SESSION_CACHE
     #else
-        /* Only needed for older wolfssl versions, see mlkem.h */
+        /* Only needed for older wolfssl versions, see wc_mlkem.h */
         #define WOLFSSL_KYBER1024
         /* optional alternative sizes:    */
         /* #define WOLFSSL_KYBER768       */

IDE/Espressif/ESP-IDF/examples/wolfssl_client/main/client-tls.c

@@ -41,8 +41,7 @@
 #undef USE_WOLFSSL_ESP_SDK_WIFI
 #include <wolfssl/ssl.h>
 
-#if defined(WOLFSSL_WC_MLKEM)
-    #include <wolfssl/wolfcrypt/mlkem.h>
+#if defined(WOLFSSL_HAVE_MLKEM)
     #include <wolfssl/wolfcrypt/wc_mlkem.h>
 #endif
 #if defined(USE_CERT_BUFFERS_2048) || defined(USE_CERT_BUFFERS_1024)

IDE/Espressif/ESP-IDF/examples/wolfssl_server/components/wolfssl/component.mk

@@ -203,7 +203,6 @@ COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed25519.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ed448.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/error.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/evp.o
-# COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_mlkem.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_lms.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/ext_xmss.o
 COMPONENT_OBJS += $(WOLFSSL_ROOT)/wolfcrypt/src/falcon.o