Skip to content

Commit 01cb81d

Browse files
FrauschiFrauschi
committed
Enable and use ML-KEM by default
* Enable ML-KEM by default * Only allow three to-be-standardized hybrid PQ/T combinatations by default * Use X25519MLKEM768 as the default KeyShare in the ClientHello (if user does not override that) * Disable standalone ML-KEM in supported groups by default (enable with --enable-tls-mlkem-standalone) * Disable extra OQS-based hybrid PQ/T curves by default and gate behind --enable-experimental (enable with --enable-extra-pqc-hybrids) * Reorder the SupportedGroups extension to reflect the preferences * Reorder the preferredGroup array to also reflect the same preferences * Enable DTLS1.3 ClientHello fragmentation by default when both DTLS1.3 and ML-KEM are enabled * Fix memory leak in TLS server PQC handling in case of ECH
1 parent b56eeb9 commit 01cb81d

31 files changed

+1029
-805
lines changed

‎.github/workflows/cmake.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151
-DWOLFSSL_CURVE448:STRING=yes -DWOLFSSL_DEBUG:BOOL=yes -DWOLFSSL_DES3:BOOL=ON \
5252
-DWOLFSSL_DES3_TLS_SUITES:BOOL=no -DWOLFSSL_DH:STRING=yes -DWOLFSSL_DH_DEFAULT_PARAMS:BOOL=yes \
5353
-DWOLFSSL_DSA:BOOL=yes -DWOLFSSL_DTLS:BOOL=ON -DWOLFSSL_DTLS13:BOOL=yes \
54-
-DWOLFSSL_DTLS_CID:BOOL=yes -DWOLFSSL_ECC:STRING=yes \
54+
-DWOLFSSL_DTLS_CID:BOOL=yes -DWOLFSSL_DTLS_CH_FRAG:BOOL=yes -DWOLFSSL_ECC:STRING=yes \
5555
-DWOLFSSL_ECCCUSTCURVES:STRING=all -DWOLFSSL_ECCSHAMIR:BOOL=yes \
5656
-DWOLFSSL_ECH:BOOL=yes -DWOLFSSL_ED25519:BOOL=yes -DWOLFSSL_ED448:STRING=yes \
5757
-DWOLFSSL_ENCKEYS:BOOL=yes -DWOLFSSL_ENC_THEN_MAC:BOOL=yes -DWOLFSSL_ERROR_QUEUE:BOOL=yes \
@@ -77,10 +77,9 @@ jobs:
7777
-DWOLFSSL_TICKET_NONCE_MALLOC:BOOL=yes -DWOLFSSL_TLS13:BOOL=yes -DWOLFSSL_TLSV12:BOOL=yes \
7878
-DWOLFSSL_TLSX:BOOL=yes -DWOLFSSL_TPM:BOOL=yes -DWOLFSSL_CLU:BOOL=yes -DWOLFSSL_USER_SETTINGS:BOOL=no \
7979
-DWOLFSSL_USER_SETTINGS_ASM:BOOL=no -DWOLFSSL_WOLFSSH:BOOL=ON -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes \
80-
-DWOLFSSL_MLKEM=1 -DWOLFSSL_LMS=1 -DWOLFSSL_LMSSHA256192=1 -DWOLFSSL_EXPERIMENTAL=1 \
81-
-DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \
82-
-DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
83-
-DCMAKE_C_FLAGS="-DWOLFSSL_DTLS_CH_FRAG" \
80+
-DWOLFSSL_MLKEM:BOOL=yes -DWOLFSSL_EXTRA_PQC_HYBRIDS:BOOL=yes -DWOLFSSL_LMS:BOOL=yes \
81+
-DWOLFSSL_LMSSHA256192:BOOL=yes -DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes \
82+
-DWOLFSSL_PKCS11:BOOL=yes -DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
8483
..
8584
cmake --build .
8685
ctest -j $(nproc)

‎.github/workflows/os-check.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@ jobs:
3838
'--enable-experimental --enable-kyber --enable-dtls --enable-dtls13
3939
--enable-dtls-frag-ch',
4040
'--enable-all --enable-dtls13 --enable-dtls-frag-ch',
41+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch --disable-mlkem',
42+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
43+
--enable-tls-mlkem-standalone',
44+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
45+
--enable-tls-mlkem-standalone --enable-experimental
46+
--enable-extra-pqc-hybrids',
4147
'--enable-dtls --enable-dtls13 --enable-dtls-frag-ch
4248
--enable-dtls-mtu',
4349
'--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation

‎.github/workflows/psk.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21-
'--enable-psk C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh',
22-
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all',
23-
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all'
21+
'--enable-psk C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh --disable-mlkem',
22+
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem',
23+
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem'
2424
]
2525
name: make check
2626
if: github.repository_owner == 'wolfssl'

‎.github/workflows/rust-wrapper.yml‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -39,36 +39,36 @@ jobs:
3939
'',
4040
'--enable-all',
4141
'--enable-cryptonly --disable-examples',
42-
'--enable-cryptonly --disable-examples --disable-aes --disable-aesgcm',
43-
'--enable-cryptonly --disable-examples --disable-aescbc',
44-
'--enable-cryptonly --disable-examples --disable-aeseax',
45-
'--enable-cryptonly --disable-examples --disable-aesecb',
46-
'--enable-cryptonly --disable-examples --disable-aesccm',
47-
'--enable-cryptonly --disable-examples --disable-aescfb',
48-
'--enable-cryptonly --disable-examples --disable-aesctr',
49-
'--enable-cryptonly --disable-examples --disable-aescts',
50-
'--enable-cryptonly --disable-examples --disable-aesgcm',
51-
'--enable-cryptonly --disable-examples --disable-aesgcm-stream',
52-
'--enable-cryptonly --disable-examples --disable-aesofb',
53-
'--enable-cryptonly --disable-examples --disable-aesxts',
54-
'--enable-cryptonly --disable-examples --disable-cmac',
55-
'--enable-cryptonly --disable-examples --disable-dh',
56-
'--enable-cryptonly --disable-examples --disable-ecc',
57-
'--enable-cryptonly --disable-examples --disable-ed25519',
58-
'--enable-cryptonly --disable-examples --disable-ed25519-stream',
59-
'--enable-cryptonly --disable-examples --disable-ed448',
60-
'--enable-cryptonly --disable-examples --disable-ed448-stream',
61-
'--enable-cryptonly --disable-examples --disable-hkdf',
62-
'--enable-cryptonly --disable-examples --disable-hmac',
63-
'--enable-cryptonly --disable-examples --disable-rng',
64-
'--enable-cryptonly --disable-examples --disable-rsa',
65-
'--enable-cryptonly --disable-examples --disable-rsapss',
66-
'--enable-cryptonly --disable-examples --disable-sha224',
67-
'--enable-cryptonly --disable-examples --disable-sha3',
68-
'--enable-cryptonly --disable-examples --disable-sha384',
69-
'--enable-cryptonly --disable-examples --disable-sha512',
70-
'--enable-cryptonly --disable-examples --disable-shake128',
71-
'--enable-cryptonly --disable-examples --disable-shake256',
72-
'--enable-cryptonly --disable-examples --disable-srtp-kdf',
73-
'--enable-cryptonly --disable-examples --disable-x963kdf',
42+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aes --disable-aesgcm',
43+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescbc',
44+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aeseax',
45+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesecb',
46+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesccm',
47+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescfb',
48+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesctr',
49+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescts',
50+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm',
51+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm-stream',
52+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesofb',
53+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesxts',
54+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-cmac',
55+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-dh',
56+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ecc',
57+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519',
58+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519-stream',
59+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448',
60+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448-stream',
61+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hkdf',
62+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hmac',
63+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rng',
64+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsa',
65+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsapss',
66+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha224',
67+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha3',
68+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha384',
69+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha512',
70+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake128',
71+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake256',
72+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-srtp-kdf',
73+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-x963kdf',
7474
]

‎CMakeLists.txt‎

Lines changed: 84 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -427,6 +427,18 @@ if(WOLFSSL_DTLS_CID)
427427
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CID")
428428
endif()
429429

430+
# DTLS 1.3 ClientHello fragmenting
431+
add_option("WOLFSSL_DTLS_CH_FRAG"
432+
"Enable wolfSSL DTLS 1.3 ClientHello fragmenting (default: disabled)"
433+
"no" "yes;no")
434+
435+
if(WOLFSSL_DTLS_CH_FRAG)
436+
if(NOT WOLFSSL_DTLS13)
437+
message(FATAL_ERROR "DTLS 1.3 Fragment ClientHello is supported only for DTLSv1.3")
438+
endif()
439+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
440+
endif()
441+
430442
# RNG
431443
add_option("WOLFSSL_RNG"
432444
"Enable compiling and using RNG (default: enabled)"
@@ -601,13 +613,58 @@ add_option(WOLFSSL_OQS
601613
# ML-KEM/Kyber
602614
add_option(WOLFSSL_MLKEM
603615
"Enable the wolfSSL PQ ML-KEM library (default: disabled)"
604-
"no" "yes;no")
616+
"yes" "yes;no")
617+
618+
if (WOLFSSL_MLKEM)
619+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MLKEM")
620+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_MLKEM")
621+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
622+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
623+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
624+
625+
set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
626+
set_wolfssl_definitions("WOLFSSL_WC_MLKEM" RESULT)
627+
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
628+
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
629+
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
630+
endif()
631+
632+
# When MLKEM and DTLS 1.3 are both enabled, DTLS ClientHello fragmenting is
633+
# required (PQC keys in ClientHello can exceed MTU), so enable it automatically.
634+
if(WOLFSSL_MLKEM AND WOLFSSL_DTLS13 AND NOT WOLFSSL_DTLS_CH_FRAG)
635+
message(STATUS "MLKEM and DTLS 1.3 are enabled; enabling DTLS ClientHello fragmenting")
636+
override_cache(WOLFSSL_DTLS_CH_FRAG "yes")
637+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
638+
endif()
639+
640+
# Disable ML-KEM as standalone TLS key exchange (non-hybrid); when enabled (default), standalone is disabled
641+
add_option(WOLFSSL_TLS_NO_MLKEM_STANDALONE
642+
"Disable ML-KEM as standalone TLS key exchange (non-hybrid) (default: enabled, i.e. standalone disabled)"
643+
"yes" "yes;no")
644+
645+
if (WOLFSSL_TLS_NO_MLKEM_STANDALONE)
646+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_TLS_NO_MLKEM_STANDALONE")
647+
endif()
605648

606649
# Dilithium
607650
add_option(WOLFSSL_DILITHIUM
608651
"Enable the wolfSSL PQ Dilithium (ML-DSA) implementation (default: disabled)"
609652
"no" "yes;no")
610653

654+
if (WOLFSSL_DILITHIUM)
655+
list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_DILITHIUM")
656+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_DILITHIUM")
657+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
658+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
659+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
660+
661+
set_wolfssl_definitions("HAVE_DILITHIUM" RESULT)
662+
set_wolfssl_definitions("WOLFSSL_WC_DILITHIUM" RESULT)
663+
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
664+
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
665+
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
666+
endif()
667+
611668
# LMS
612669
add_option(WOLFSSL_LMS
613670
"Enable the PQ LMS Stateful Hash-based Signature Scheme (default: disabled)"
@@ -617,11 +674,31 @@ add_option(WOLFSSL_LMSSHA256192
617674
"Enable the LMS SHA_256_192 truncated variant (default: disabled)"
618675
"no" "yes;no")
619676

677+
if (WOLFSSL_LMS)
678+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS")
679+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_LMS")
680+
681+
set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
682+
set_wolfssl_definitions("WOLFSSL_WC_LMS" RESULT)
683+
684+
if (WOLFSSL_LMSSHA256192)
685+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHA256_192")
686+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_LMS_SHA256_256")
687+
688+
set_wolfssl_definitions("WOLFSSL_LMS_SHA256_192" RESULT)
689+
set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
690+
endif()
691+
endif()
692+
620693
# Experimental features
621694
add_option(WOLFSSL_EXPERIMENTAL
622695
"Enable experimental features (default: disabled)"
623696
"no" "yes;no")
624697

698+
add_option(WOLFSSL_EXTRA_PQC_HYBRIDS
699+
"Enable extra PQ/T hybrid combinations (default: disabled)"
700+
"no" "yes;no")
701+
625702
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL")
626703
if (WOLFSSL_EXPERIMENTAL)
627704
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - found")
@@ -657,75 +734,14 @@ if (WOLFSSL_EXPERIMENTAL)
657734
message(STATUS "Looking for WOLFSSL_OQS - not found")
658735
endif()
659736

660-
# Checking for experimental feature: WOLFSSL_MLKEM
661-
message(STATUS "Looking for WOLFSSL_MLKEM")
662-
if (WOLFSSL_MLKEM)
663-
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
664-
665-
message(STATUS "Automatically set related requirements for ML-KEM:")
666-
add_definitions("-DWOLFSSL_HAVE_MLKEM")
667-
add_definitions("-DWOLFSSL_WC_MLKEM")
668-
add_definitions("-DWOLFSSL_SHA3")
669-
add_definitions("-DWOLFSSL_SHAKE128")
670-
add_definitions("-DWOLFSSL_SHAKE256")
671-
672-
set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
673-
set_wolfssl_definitions("WOLFSSL_WC_MLKEM" RESULT)
674-
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
675-
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
676-
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
677-
message(STATUS "Looking for WOLFSSL_MLKEM - found")
678-
else()
679-
message(STATUS "Looking for WOLFSSL_MLKEM - not found")
680-
endif()
681-
682-
# Checking for experimental feature: WOLFSSL_LMS
683-
message(STATUS "Looking for WOLFSSL_LMS")
684-
if (WOLFSSL_LMS)
685-
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 2)
686-
687-
message(STATUS "Automatically set related requirements for LMS")
688-
add_definitions("-DWOLFSSL_HAVE_LMS")
689-
add_definitions("-DWOLFSSL_WC_LMS")
690-
set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
691-
set_wolfssl_definitions("WOLFSSL_WC_LMS" RESULT)
692-
message(STATUS "Looking for WOLFSSL_LMS - found")
693-
# Checking for experimental feature: WOLFSSL_LMSSHA256192
694-
if (WOLFSSL_LMSSHA256192)
695-
message(STATUS "Automatically set related requirements for LMS SHA256-192")
696-
add_definitions("-DWOLFSSL_LMS_SHA256_192")
697-
add_definitions("-DWOLFSSL_NO_LMS_SHA256_256")
698-
set_wolfssl_definitions("WOLFSSL_LMS_SHA256_192" RESULT)
699-
set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
700-
message(STATUS "Looking for WOLFSSL_LMSSHA256192 - found")
701-
else()
702-
message(STATUS "Looking for WOLFSSL_LMSSHA256192 - not found")
703-
endif()
704-
else()
705-
message(STATUS "Looking for WOLFSSL_LMS - not found")
706-
endif()
707-
708-
# Checking for experimental feature: Dilithium
709-
message(STATUS "Looking for WOLFSSL_DILITHIUM")
710-
if (WOLFSSL_DILITHIUM)
737+
# Checking for experimental feature: extra PQ/T hybrid combinations
738+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS")
739+
if (WOLFSSL_EXTRA_PQC_HYBRIDS)
711740
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
712-
713-
message(STATUS "Automatically set related requirements for Dilithium:")
714-
add_definitions("-DHAVE_DILITHIUM")
715-
add_definitions("-DWOLFSSL_WC_DILITHIUM")
716-
add_definitions("-DWOLFSSL_SHA3")
717-
add_definitions("-DWOLFSSL_SHAKE128")
718-
add_definitions("-DWOLFSSL_SHAKE256")
719-
720-
message(STATUS "Automatically set related requirements for Dilithium:")
721-
set_wolfssl_definitions("HAVE_DILITHIUM" RESULT)
722-
set_wolfssl_definitions("WOLFSSL_WC_DILITHIUM" RESULT)
723-
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
724-
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
725-
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
726-
message(STATUS "Looking for WOLFSSL_DILITHIUM - found")
741+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - found")
742+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_EXTRA_PQC_HYBRIDS")
727743
else()
728-
message(STATUS "Looking for WOLFSSL_DILITHIUM - not found")
744+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - not found")
729745
endif()
730746

731747
# Other experimental feature detection can be added here...
@@ -750,12 +766,6 @@ else()
750766
if (WOLFSSL_OQS)
751767
message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
752768
endif()
753-
if(WOLFSSL_MLKEM)
754-
message(FATAL_ERROR "Error: WOLFSSL_MLKEM requires WOLFSSL_EXPERIMENTAL at this time.")
755-
endif()
756-
if(WOLFSSL_DILITHIUM)
757-
message(FATAL_ERROR "Error: WOLFSSL_DILITHIUM requires WOLFSSL_EXPERIMENTAL at this time.")
758-
endif()
759769
endif()
760770

761771
# LMS

‎cmake/options.h.in‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,8 @@ extern "C" {
374374
#cmakedefine WOLFSSL_HAVE_MLKEM
375375
#undef WOLFSSL_WC_MLKEM
376376
#cmakedefine WOLFSSL_WC_MLKEM
377+
#undef WOLFSSL_TLS_NO_MLKEM_STANDALONE
378+
#cmakedefine WOLFSSL_TLS_NO_MLKEM_STANDALONE
377379
#undef WOLFSSL_WC_DILITHIUM
378380
#cmakedefine WOLFSSL_WC_DILITHIUM
379381
#undef NO_WOLFSSL_STUB
@@ -400,6 +402,8 @@ extern "C" {
400402
#cmakedefine WOLFSSL_HAVE_XMSS
401403
#undef WOLFSSL_WC_XMSS
402404
#cmakedefine WOLFSSL_WC_XMSS
405+
#undef WOLFSSL_EXTRA_PQC_HYBRIDS
406+
#cmakedefine WOLFSSL_EXTRA_PQC_HYBRIDS
403407

404408
#ifdef __cplusplus
405409
}

0 commit comments

Comments
 (0)