@@ -125,44 +125,64 @@ elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
125125 endif ()
126126
127127 # Add preprocessor defines to CFLAGS, these match those placed into
128- # wolfssl/options.h by configure if using: "./configure" on a Unix/Linux
129- # platform. The options below have been chosen to match a FIPS Ready build,
130- # and are based on the example user_settings.h file located here:
131- # https://github.com/wolfSSL/wolfssl/blob/master/examples/configs/user_settings_fipsv5.h
128+ # wolfssl/options.h by configure if using the following configure on a Unix/Linux
129+ # platform with a wolfSSL FIPS Ready GPLv3 bundle:
130+ #
131+ # ./configure --enable-fips=ready --enable-jni
132+ #
132133 # This list may be configurable depending on use case and desired
133134 # optimizations, being careful not to break FIPS compatibility if targeting
134- # FIPS proper in the future.
135- add_definitions (-DHAVE_FIPS -DHAVE_FIPS_VERSION=5 -DHAVE_FIPS_VERSION_MINOR=3
136- -DHAVE_HASHDRBG -DHAVE_THREAD_LS -DHAVE_REPRODUCIBLE_BUILD
137- -DFP_MAX_BITS=16384 -DSP_INT_BITS=8192 -DWOLFSSL_PUBLIC_MP
138- -DTFM_TIMING_RESISTANT -DECC_TIMING_RESISTANT -DWC_RSA_BLINDING
139- -DWC_RNG_SEED_CB -DWOLFSSL_VALIDATE_ECC_IMPORT -DWOLFSSL_VALIDATE_ECC_KEYGEN
140- -DWOLFSSL_VALIDATE_FFC_IMPORT
141- -DWOLFSSL_TLS13 -DHAVE_TLS_EXTENSIONS -DHAVE_ENCRYPT_THEN_MAC
142- -DHAVE_SUPPORTED_CURVES -DHAVE_EXTENDED_MASTER -DHAVE_ONE_TIME_AUTH
143- -DHAVE_SECURE_RENEGOTIATION -DHAVE_SERVER_RENEGOTIATION_INFO -DHAVE_SESSION_TICKET
144- -DWOLFSSL_USE_ALIGN -DWOLFSSL_BASE64_ENCODE -DHAVE_CRL
145- -DHAVE_EXT_CACHE -DWOLFSSL_VERIFY_CB_ALL_CERTS -DWOLFSSL_ALWAYS_VERIFY_CB
146- -DWOLFSSL_DH_EXTRA -DWOLFSSL_WOLFSSH -DOPENSSL_EXTRA -DOPENSSL_ALL
147- -DHAVE_FFDHE_Q -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096
148- -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DHAVE_DH_DEFAULT_PARAMS -DHAVE_PUBLIC_FFDHE
149- -DHAVE_ECC -DTFM_ECC256 -DECC_SHAMIR -DHAVE_ECC_CDH -DECC_USER_CURVES
150- -DHAVE_ECC256 -DHAVE_ECC384 -DHAVE_ECC521 -DWOLFSSL_ECDSA_SET_K
151- -DWC_RSA_PSS -DWOLFSSL_KEY_GEN -DWC_RSA_NO_PADDING
152- -DWOLFSSL_AES_COUNTER -DHAVE_AESCCM -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT
153- -DWOLFSSL_AES_OFB -DHAVE_AESGCM -DGCM_TABLE_4BIT -DWOLFSSL_CMAC
154- -DWOLFSSL_SHA224 -DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWOLFSSL_NO_SHAKE256
155- -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256 -DWOLFSSL_SHA3 -DHAVE_HKDF
156- -DNO_OLD_TLS -DNO_PSK -DNO_DO178
157- -DNO_RC4 -DNO_MD4 -DNO_MD5 -DNO_DES3 -DNO_DSA -DNO_RABBIT
158-
159- -DWOLFSSL_JNI -DHAVE_EX_DATA -DHAVE_OCSP -DHAVE_CRL_MONITOR
160- -DWOLFSSL_CERT_EXT -DWOLFSSL_CERT_GEN -DWOLFSSL_CERT_REQ
161- -DHAVE_SNI -DHAVE_ALPN -DWOLFSSL_ENCRYPTED_KEYS -DNO_ERROR_QUEUE
162- -DWOLFSSL_EITHER_SIDE -DWOLFSSL_PSS_LONG_SALT
163- -DWOLFSSL_TICKET_HAVE_ID -DWOLFSSL_ERROR_CODE_OPENSSL
164- -DWOLFSSL_EXTRA_ALERTS -DWOLFSSL_FORCE_CACHE_ON_TICKET
165- -DWOLFSSL_AKID_NAME -DHAVE_CTS -DKEEP_PEER_CERT -DSESSION_CERTS
135+ # FIPS proper in the future. Please contact support@wolfssl.com for assistance
136+ # properly compiling for use with wolfCrypt FIPS variants.
137+ add_definitions (
138+ -DWOLFSSL_FIPS_READY -DHAVE_FIPS -DHAVE_FIPS_VERSION=7
139+ -DHAVE_FIPS_VERSION_MAJOR=7 -DHAVE_FIPS_VERSION_MINOR=0
140+ -DHAVE_FIPS_VERSION_PATCH=0 -DWC_RNG_SEED_CB -DHAVE_THREAD_LS
141+
142+ -DWOLFSSL_WOLFSSH -DNO_DO178 -DHAVE_REPRODUCIBLE_BUILD -DWC_NO_ASYNC_THREADING
143+ -DNO_OLD_TLS -DWOLFSSL_TLS13 -DHAVE_TLS_EXTENSIONS -DHAVE_SNI
144+ -DHAVE_KEYING_MATERIAL -DHAVE_TLS_EXTENSIONS -DHAVE_SUPPORTED_CURVES
145+ -DHAVE_EXTENDED_MASTER -DHAVE_ENCRYPT_THEN_MAC -DWOLFSSL_JNI -DHAVE_EX_DATA
146+ -DKEEP_PEER_CERT -DWOLFSSL_ALWAYS_VERIFY_CB -DWOLFSSL_DTLS -DOPENSSL_EXTRA
147+ -DOPENSSL_ALL -DWOLFSSL_ERROR_CODE_OPENSSL -DHAVE_CRL -DHAVE_CRL_MONITOR
148+ -DHAVE_OCSP -DPERSIST_SESSION_CACHE -DPERSIST_CERT_CACHE -DATOMIC_USER
149+ -DWOLFSSL_CERT_EXT -DWOLFSSL_CERT_GEN -DWOLFSSL_CERT_REQ -DWOLFSSL_KEY_GEN
150+ -DHAVE_ALPN -DWOLFSSL_ALT_CERT_CHAINS -DSESSION_CERTS -DWOLFSSL_ENCRYPTED_KEYS
151+ -DWOLFSSL_SYS_CA_CERTS -DWOLFSSL_ALT_NAMES -DWOLFSSL_EITHER_SIDE
152+ -DWOLFSSL_TICKET_HAVE_ID -DWOLFSSL_CERT_NAME_ALL
153+ -DHAVE_SERVER_RENEGOTIATION_INFO -DWOLFSSL_ASN_TEMPLATE -DWOLFSSL_ASN_PRINT
154+ -DWOLFSSL_BASE64_ENCODE -DERROR_QUEUE_PER_THREAD -DNO_ERROR_QUEUE
155+ -DTFM_TIMING_RESISTANT -DECC_TIMING_RESISTANT -DWOLFSSL_USE_ALIGN
156+ -DWOLFSSL_PUBLIC_MP
157+
158+ -DWC_RSA_BLINDING -DWC_RSA_PSS -DWOLFSSL_PSS_LONG_SALT -DWC_RSA_NO_PADDING
159+
160+ -DHAVE_ECC -DTFM_ECC256 -DECC_SHAMIR -DECC_MIN_KEY_SZ=192 -DHAVE_ECC_CDH
161+ -DECC_USER_CURVES -DHAVE_ECC192 -DHAVE_ECC224 -DHAVE_ECC256 -DHAVE_ECC384
162+ -DHAVE_ECC521 -DWOLFSSL_ECDSA_SET_K -DWOLFSSL_VALIDATE_ECC_IMPORT
163+ -DWOLFSSL_VALIDATE_ECC_KEYGEN
164+
165+ -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q -DHAVE_FFDHE_2048
166+ -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192
167+ -DHAVE_DH_DEFAULT_PARAMS
168+
169+ -DHAVE_HKDF -DHAVE_PBKDF2 -DHAVE_HASHDRBG -DWC_SRTP_KDF -DWOLFSSL_SRTP
170+
171+ -DHAVE_AESGCM -DGCM_TABLE_4BIT -DWOLFSSL_AESGCM_STREAM -DHAVE_AESCCM
172+ -DWOLFSSL_AES_COUNTER -DWOLFSSL_CMAC -DWOLFSSL_AES_OFB -DWOLFSSL_AES_CFB
173+ -DWOLFSSL_AES_XTS -DWOLFSSL_AESXTS_STREAM -DWOLFSSL_AES_DIRECT
174+ -DHAVE_AES_ECB -DHAVE_AES_KEYWRAP -DWOLFSSL_AES_XTS -DHAVE_AES_KEYWRAP
175+
176+ -DHAVE_ED25519 -DHAVE_ED25519_KEY_IMPORT -DHAVE_ED448 -DHAVE_ED448_KEY_IMPORT
177+ -DWOLFSSL_ED448_STREAMING_VERIFY
178+
179+ -DHAVE_CURVE25519 -DHAVE_CURVE448
180+
181+ -DWOLFSSL_SHA224 -DWOLFSSL_SHA384 -DWOLFSSL_SHA512 -DWOLFSSL_NOSHA512_224
182+ -DWOLFSSL_NOSHA512_256 -DWOLFSSL_SHA3 -DWOLFSSL_SHAKE128 -DWOLFSSL_SHAKE256
183+
184+ -DNO_DSA -DNO_RC4 -DNO_MD4 -DNO_DES3 -DNO_DES3_TLS_SUITES
185+
166186 -DSIZEOF_LONG=4 -DSIZEOF_LONG_LONG=8 -DWOLFSSL_CUSTOM_CONFIG
167187
168188 # For gethostbyname()
@@ -191,7 +211,8 @@ elseif("${WOLFSSL_MATH_LIB}" MATCHES "spmath")
191211 -DWOLFSSL_HAVE_SP_RSA -DWOLFSSL_SP_4096
192212 -DWOLFSSL_HAVE_SP_DH
193213 -DWOLFSSL_HAVE_SP_ECC -DWOLFSSL_SP_384 -DWOLFSSL_SP_521
194- -DWOLFSSL_SP_LARGE_CODE )
214+ -DWOLFSSL_SP_LARGE_CODE
215+ -DFP_MAX_BITS=16384 -DSP_INT_BITS=8192 )
195216
196217 # SP Math architecture-specific settings (ex: assembly optimizations)
197218 if ("${ANDROID_ABI} " MATCHES "arm64-v8a" )
@@ -203,8 +224,7 @@ elseif("${WOLFSSL_MATH_LIB}" MATCHES "spmath")
203224 # Not using ASM, need to use WOLFSSL_SP_MATH_ALL for SW-only implementation
204225 add_definitions (-DWOLFSSL_SP_MATH_ALL )
205226 elseif ("${ANDROID_ABI} " MATCHES "x86_64" )
206- # Using ASM for SP, need to use WOLFSSL_SP_MATH instead of WOLFSSL_SP_MATH_ALL
207- add_definitions (-DWOLFSSL_SP_MATH )
227+ add_definitions (-DWOLFSSL_SP_MATH_ALL )
208228 add_definitions (-DWOLFSSL_SP_ASM -DWOLFSSL_SP_X86_64 -DWOLFSSL_SP_X86_64_ASM -DHAVE___UINT128_T )
209229 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sp_x86_64_asm.S)
210230 elseif ("${ANDROID_ABI} " MATCHES "x86" )
@@ -245,16 +265,21 @@ elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
245265 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wolfcrypt_first.c)
246266 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/hmac.c)
247267 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/random.c)
248- list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sha256.c)
249268 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/kdf.c)
250269 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/rsa.c)
251270 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/ecc.c)
252271 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/aes.c)
272+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sha256.c)
253273 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sha.c)
254274 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sha512.c)
255275 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/sha3.c)
256276 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/dh.c)
257277 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/cmac.c)
278+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/curve448.c)
279+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/ed448.c)
280+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/curve25519.c)
281+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/ed25519.c)
282+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/pwdbased.c)
258283 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/fips.c)
259284 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/fips_test.c)
260285 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wolfcrypt_last.c)
@@ -278,9 +303,18 @@ elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
278303 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/memory.c)
279304 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/asn.c)
280305 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/coding.c)
306+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/md5.c)
281307 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/pwdbased.c)
282308 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/pkcs12.c)
283309 list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/tfm.c)
310+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wc_lms.c)
311+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wc_lms_impl.c)
312+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wc_xmss.c)
313+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/wc_xmss_impl.c)
314+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/fe_operations.c)
315+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/ge_operations.c)
316+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/fe_448.c)
317+ list (APPEND CRYPTO_SOURCES ${wolfssl_DIR} /wolfcrypt/src/ge_448.c)
284318endif ()
285319
286320# wolfSSL will be compiled as a SHARED library
0 commit comments