Skip to content

Commit 88b42f7

Browse files
FrauschiFrauschi
committed
Add tests for individual ML-KEM levels (based on #9777)
Also fix minor problems found with these tests
1 parent deb4cc1 commit 88b42f7

5 files changed

Lines changed: 45 additions & 22 deletions

File tree

‎.github/workflows/pq-all.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ jobs:
2727
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-slhdsa --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"',
2828
'--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
2929
'--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
30+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
31+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
32+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3033
]
3134
name: make check
3235
if: github.repository_owner == 'wolfssl'

‎src/tls.c‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10875,11 +10875,18 @@ int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, word16 len, byte* data,
1087510875
}
1087610876
else if (ssl->options.side == WOLFSSL_SERVER_END &&
1087710877
WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group)) {
10878-
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10879-
keyShareEntry,
10880-
data, len);
10881-
if (ret != 0)
10882-
return ret;
10878+
if (TLSX_IsGroupSupported(group)) {
10879+
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10880+
keyShareEntry,
10881+
data, len);
10882+
if (ret != 0)
10883+
return ret;
10884+
}
10885+
else {
10886+
XFREE(keyShareEntry->ke, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
10887+
keyShareEntry->ke = NULL;
10888+
keyShareEntry->keLen = 0;
10889+
}
1088310890
}
1088410891
else
1088510892
#endif

‎tests/api.c‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31990,10 +31990,28 @@ static int test_dtls13_frag_ch_pq(void)
3199031990
const char *test_str = "test";
3199131991
int test_str_size;
3199231992
byte buf[255];
31993-
#ifdef WOLFSSL_MLKEM_KYBER
31993+
#if defined(WOLFSSL_MLKEM_KYBER)
31994+
#if !defined(WOLFSSL_NO_KYBER1024)
3199431995
int group = WOLFSSL_KYBER_LEVEL5;
31996+
const char *group_name = "KYBER_LEVEL5";
31997+
#elif !defined(WOLFSSL_NO_KYBER768)
31998+
int group = WOLFSSL_KYBER_LEVEL3;
31999+
const char *group_name = "KYBER_LEVEL3";
32000+
#else
32001+
int group = WOLFSSL_KYBER_LEVEL1;
32002+
const char *group_name = "KYBER_LEVEL1";
32003+
#endif
3199532004
#else
32005+
#if !defined(WOLFSSL_NO_ML_KEM_1024)
3199632006
int group = WOLFSSL_ML_KEM_1024;
32007+
const char *group_name = "ML_KEM_1024";
32008+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
32009+
int group = WOLFSSL_ML_KEM_768;
32010+
const char *group_name = "ML_KEM_768";
32011+
#else
32012+
int group = WOLFSSL_ML_KEM_512;
32013+
const char *group_name = "ML_KEM_512";
32014+
#endif
3199732015
#endif
3199832016

3199932017
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
@@ -32004,13 +32022,8 @@ static int test_dtls13_frag_ch_pq(void)
3200432022
ExpectIntEQ(wolfSSL_UseKeyShare(ssl_c, group), WOLFSSL_SUCCESS);
3200532023
ExpectIntEQ(wolfSSL_dtls13_allow_ch_frag(ssl_s, 1), WOLFSSL_SUCCESS);
3200632024
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
32007-
#ifdef WOLFSSL_MLKEM_KYBER
32008-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "KYBER_LEVEL5");
32009-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "KYBER_LEVEL5");
32010-
#else
32011-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "ML_KEM_1024");
32012-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "ML_KEM_1024");
32013-
#endif
32025+
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), group_name);
32026+
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), group_name);
3201432027
test_str_size = XSTRLEN("test") + 1;
3201532028
ExpectIntEQ(wolfSSL_write(ssl_c, test_str, test_str_size), test_str_size);
3201632029
ExpectIntEQ(wolfSSL_read(ssl_s, buf, sizeof(buf)), test_str_size);

‎tests/api/test_tls13.c‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -149,15 +149,15 @@ int test_tls13_apis(void)
149149
":P256_KYBER_LEVEL1"
150150
#elif !defined(WOLFSSL_NO_KYBER768)
151151
":P256_KYBER_LEVEL3"
152-
#else
152+
#elif !defined(WOLFSSL_NO_KYBER1024)
153153
":P256_KYBER_LEVEL5"
154154
#endif
155155
#else
156-
#ifndef WOLFSSL_NO_KYBER512
156+
#ifndef WOLFSSL_NO_ML_KEM_512
157157
":SecP256r1MLKEM512"
158-
#elif !defined(WOLFSSL_NO_KYBER768)
158+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
159159
":SecP384r1MLKEM768"
160-
#else
160+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
161161
":SecP521r1MLKEM1024"
162162
#endif
163163
#endif
@@ -173,15 +173,15 @@ int test_tls13_apis(void)
173173
":KYBER_LEVEL1"
174174
#elif !defined(WOLFSSL_NO_KYBER768)
175175
":KYBER_LEVEL3"
176-
#else
176+
#elif !defined(WOLFSSL_NO_KYBER1024)
177177
":KYBER_LEVEL5"
178178
#endif
179179
#else
180-
#ifndef WOLFSSL_NO_KYBER512
180+
#ifndef WOLFSSL_NO_ML_KEM_512
181181
":ML_KEM_512"
182-
#elif !defined(WOLFSSL_NO_KYBER768)
182+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
183183
":ML_KEM_768"
184-
#else
184+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
185185
":ML_KEM_1024"
186186
#endif
187187
#endif

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1742,7 +1742,7 @@ enum Misc {
17421742
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
17431743
#endif
17441744
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
1745-
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
1745+
MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */
17461746

17471747
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
17481748
RSA_PSS_RSAE_SHA256_MINOR = 0x04,

0 commit comments

Comments
 (0)