Skip to content

Commit 06309c2

Browse files
FrauschiFrauschi
committed
Enable and use ML-KEM by default
* Enable ML-KEM by default * Only allow three to-be-standardized hybrid PQ/T combinatations by default * Use X25519MLKEM768 as the default KeyShare in the ClientHello (if user does not override that) * Disable standalone ML-KEM in supported groups by default (enable with --enable-tls-mlkem-standalone) * Disable extra OQS-based hybrid PQ/T curves by default and gate behind --enable-experimental (enable with --enable-extra-pqc-hybrids) * Reorder the SupportedGroups extension to reflect the preferences * Reorder the preferredGroup array to also reflect the same preferences * Enable DTLS1.3 ClientHello fragmentation by default when both DTLS1.3 and ML-KEM are enabled * Fix memory leak in TLS server PQC handling in case of ECH * Ensure PQ/T hybrids are properly tested in unit tests
1 parent 25db90a commit 06309c2

37 files changed

+1300
-819
lines changed

‎.github/workflows/async.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21-
'--enable-asynccrypt --enable-all --enable-dtls13 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
22-
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
21+
'--enable-asynccrypt --enable-all --enable-dtls13 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
22+
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
23+
'--enable-asynccrypt --enable-all --enable-dtls13 --disable-pqc-hybrids --enable-tls-mlkem-standalone CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
24+
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-pqc-hybrids --enable-tls-mlkem-standalone CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
2325
'--enable-ocsp CFLAGS="-DTEST_NONBLOCK_CERTS -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
2426
]
2527
name: make check

‎.github/workflows/cmake.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,9 @@ jobs:
6969
-DWOLFSSL_TICKET_NONCE_MALLOC:BOOL=yes -DWOLFSSL_TLS13:BOOL=yes -DWOLFSSL_TLSV12:BOOL=yes \
7070
-DWOLFSSL_TLSX:BOOL=yes -DWOLFSSL_TPM:BOOL=yes -DWOLFSSL_CLU:BOOL=yes -DWOLFSSL_USER_SETTINGS:BOOL=no \
7171
-DWOLFSSL_USER_SETTINGS_ASM:BOOL=no -DWOLFSSL_WOLFSSH:BOOL=ON -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes \
72-
-DWOLFSSL_MLKEM=1 -DWOLFSSL_LMS=1 -DWOLFSSL_LMSSHA256192=1 -DWOLFSSL_EXPERIMENTAL=1 \
73-
-DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \
74-
-DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
72+
-DWOLFSSL_MLKEM:BOOL=yes -DWOLFSSL_EXTRA_PQC_HYBRIDS:BOOL=yes -DWOLFSSL_LMS:BOOL=yes \
73+
-DWOLFSSL_LMSSHA256192:BOOL=yes -DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes \
74+
-DWOLFSSL_PKCS11:BOOL=yes -DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
7575
-DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \
7676
..
7777
cmake --build .

‎.github/workflows/os-check.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@ jobs:
3838
'--enable-experimental --enable-kyber --enable-dtls --enable-dtls13
3939
--enable-dtls-frag-ch',
4040
'--enable-all --enable-dtls13 --enable-dtls-frag-ch',
41+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch --disable-mlkem',
42+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
43+
--enable-tls-mlkem-standalone',
44+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
45+
--enable-tls-mlkem-standalone --enable-experimental
46+
--enable-extra-pqc-hybrids',
4147
'--enable-dtls --enable-dtls13 --enable-dtls-frag-ch
4248
--enable-dtls-mtu',
4349
'--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation

‎.github/workflows/psk.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21-
'--enable-psk C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh',
22-
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all',
23-
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all'
21+
'--enable-psk C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh --disable-mlkem',
22+
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem',
23+
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem'
2424
]
2525
name: make check
2626
if: github.repository_owner == 'wolfssl'

‎.github/workflows/rust-wrapper.yml‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -39,36 +39,36 @@ jobs:
3939
'',
4040
'--enable-all',
4141
'--enable-cryptonly --disable-examples',
42-
'--enable-cryptonly --disable-examples --disable-aes --disable-aesgcm',
43-
'--enable-cryptonly --disable-examples --disable-aescbc',
44-
'--enable-cryptonly --disable-examples --disable-aeseax',
45-
'--enable-cryptonly --disable-examples --disable-aesecb',
46-
'--enable-cryptonly --disable-examples --disable-aesccm',
47-
'--enable-cryptonly --disable-examples --disable-aescfb',
48-
'--enable-cryptonly --disable-examples --disable-aesctr',
49-
'--enable-cryptonly --disable-examples --disable-aescts',
50-
'--enable-cryptonly --disable-examples --disable-aesgcm',
51-
'--enable-cryptonly --disable-examples --disable-aesgcm-stream',
52-
'--enable-cryptonly --disable-examples --disable-aesofb',
53-
'--enable-cryptonly --disable-examples --disable-aesxts',
54-
'--enable-cryptonly --disable-examples --disable-cmac',
55-
'--enable-cryptonly --disable-examples --disable-dh',
56-
'--enable-cryptonly --disable-examples --disable-ecc',
57-
'--enable-cryptonly --disable-examples --disable-ed25519',
58-
'--enable-cryptonly --disable-examples --disable-ed25519-stream',
59-
'--enable-cryptonly --disable-examples --disable-ed448',
60-
'--enable-cryptonly --disable-examples --disable-ed448-stream',
61-
'--enable-cryptonly --disable-examples --disable-hkdf',
62-
'--enable-cryptonly --disable-examples --disable-hmac',
63-
'--enable-cryptonly --disable-examples --disable-rng',
64-
'--enable-cryptonly --disable-examples --disable-rsa',
65-
'--enable-cryptonly --disable-examples --disable-rsapss',
66-
'--enable-cryptonly --disable-examples --disable-sha224',
67-
'--enable-cryptonly --disable-examples --disable-sha3',
68-
'--enable-cryptonly --disable-examples --disable-sha384',
69-
'--enable-cryptonly --disable-examples --disable-sha512',
70-
'--enable-cryptonly --disable-examples --disable-shake128',
71-
'--enable-cryptonly --disable-examples --disable-shake256',
72-
'--enable-cryptonly --disable-examples --disable-srtp-kdf',
73-
'--enable-cryptonly --disable-examples --disable-x963kdf',
42+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aes --disable-aesgcm',
43+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescbc',
44+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aeseax',
45+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesecb',
46+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesccm',
47+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescfb',
48+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesctr',
49+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescts',
50+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm',
51+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm-stream',
52+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesofb',
53+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesxts',
54+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-cmac',
55+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-dh',
56+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ecc',
57+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519',
58+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519-stream',
59+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448',
60+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448-stream',
61+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hkdf',
62+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hmac',
63+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rng',
64+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsa',
65+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsapss',
66+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha224',
67+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha3',
68+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha384',
69+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha512',
70+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake128',
71+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake256',
72+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-srtp-kdf',
73+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-x963kdf',
7474
]

‎.github/workflows/zephyr.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ jobs:
2525
zephyr-sdk: 0.16.3
2626
- zephyr-ref: v2.7.4
2727
zephyr-sdk: 0.16.3
28+
- zephyr-ref: v4.3.0
29+
zephyr-sdk: 0.17.4
2830
if: github.repository_owner == 'wolfssl'
2931
runs-on: ubuntu-22.04
3032
# This should be a safe limit for the tests to run.
31-
timeout-minutes: 25
33+
timeout-minutes: 45
3234
steps:
3335
- name: Install dependencies
3436
run: |

‎CMakeLists.txt‎

Lines changed: 81 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -610,13 +610,67 @@ add_option(WOLFSSL_OQS
610610
# ML-KEM/Kyber
611611
add_option(WOLFSSL_MLKEM
612612
"Enable the wolfSSL PQ ML-KEM library (default: disabled)"
613-
"no" "yes;no")
613+
"yes" "yes;no")
614+
615+
if (WOLFSSL_MLKEM)
616+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MLKEM")
617+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_MLKEM")
618+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
619+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
620+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
621+
622+
set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
623+
set_wolfssl_definitions("WOLFSSL_WC_MLKEM" RESULT)
624+
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
625+
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
626+
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
627+
endif()
628+
629+
# When MLKEM and DTLS 1.3 are both enabled, DTLS ClientHello fragmenting is
630+
# required (PQC keys in ClientHello can exceed MTU), so enable it automatically.
631+
if(WOLFSSL_MLKEM AND WOLFSSL_DTLS13 AND NOT WOLFSSL_DTLS_CH_FRAG)
632+
message(STATUS "MLKEM and DTLS 1.3 are enabled; enabling DTLS ClientHello fragmenting")
633+
override_cache(WOLFSSL_DTLS_CH_FRAG "yes")
634+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
635+
endif()
636+
637+
# Disable ML-KEM as standalone TLS key exchange (non-hybrid); when enabled (default), standalone is disabled
638+
add_option(WOLFSSL_TLS_NO_MLKEM_STANDALONE
639+
"Disable ML-KEM as standalone TLS key exchange (non-hybrid) (default: enabled, i.e. standalone disabled)"
640+
"yes" "yes;no")
641+
642+
if (WOLFSSL_TLS_NO_MLKEM_STANDALONE)
643+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_TLS_NO_MLKEM_STANDALONE")
644+
endif()
645+
646+
# PQ/T hybrid combinations
647+
add_option(WOLFSSL_PQC_HYBRIDS
648+
"Enable PQ/T hybrid combinations (default: enabled)"
649+
"yes" "yes;no")
650+
651+
if (WOLFSSL_PQC_HYBRIDS)
652+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PQC_HYBRIDS")
653+
endif()
614654

615655
# Dilithium
616656
add_option(WOLFSSL_DILITHIUM
617657
"Enable the wolfSSL PQ Dilithium (ML-DSA) implementation (default: disabled)"
618658
"no" "yes;no")
619659

660+
if (WOLFSSL_DILITHIUM)
661+
list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_DILITHIUM")
662+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_DILITHIUM")
663+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
664+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
665+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
666+
667+
set_wolfssl_definitions("HAVE_DILITHIUM" RESULT)
668+
set_wolfssl_definitions("WOLFSSL_WC_DILITHIUM" RESULT)
669+
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
670+
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
671+
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
672+
endif()
673+
620674
# LMS
621675
add_option(WOLFSSL_LMS
622676
"Enable the PQ LMS Stateful Hash-based Signature Scheme (default: disabled)"
@@ -626,11 +680,31 @@ add_option(WOLFSSL_LMSSHA256192
626680
"Enable the LMS SHA_256_192 truncated variant (default: disabled)"
627681
"no" "yes;no")
628682

683+
if (WOLFSSL_LMS)
684+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS")
685+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_LMS")
686+
687+
set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
688+
set_wolfssl_definitions("WOLFSSL_WC_LMS" RESULT)
689+
690+
if (WOLFSSL_LMSSHA256192)
691+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHA256_192")
692+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_LMS_SHA256_256")
693+
694+
set_wolfssl_definitions("WOLFSSL_LMS_SHA256_192" RESULT)
695+
set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
696+
endif()
697+
endif()
698+
629699
# Experimental features
630700
add_option(WOLFSSL_EXPERIMENTAL
631701
"Enable experimental features (default: disabled)"
632702
"no" "yes;no")
633703

704+
add_option(WOLFSSL_EXTRA_PQC_HYBRIDS
705+
"Enable extra PQ/T hybrid combinations (default: disabled)"
706+
"no" "yes;no")
707+
634708
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL")
635709
if (WOLFSSL_EXPERIMENTAL)
636710
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - found")
@@ -666,75 +740,14 @@ if (WOLFSSL_EXPERIMENTAL)
666740
message(STATUS "Looking for WOLFSSL_OQS - not found")
667741
endif()
668742

669-
# Checking for experimental feature: WOLFSSL_MLKEM
670-
message(STATUS "Looking for WOLFSSL_MLKEM")
671-
if (WOLFSSL_MLKEM)
672-
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
673-
674-
message(STATUS "Automatically set related requirements for ML-KEM:")
675-
add_definitions("-DWOLFSSL_HAVE_MLKEM")
676-
add_definitions("-DWOLFSSL_WC_MLKEM")
677-
add_definitions("-DWOLFSSL_SHA3")
678-
add_definitions("-DWOLFSSL_SHAKE128")
679-
add_definitions("-DWOLFSSL_SHAKE256")
680-
681-
set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
682-
set_wolfssl_definitions("WOLFSSL_WC_MLKEM" RESULT)
683-
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
684-
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
685-
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
686-
message(STATUS "Looking for WOLFSSL_MLKEM - found")
687-
else()
688-
message(STATUS "Looking for WOLFSSL_MLKEM - not found")
689-
endif()
690-
691-
# Checking for experimental feature: WOLFSSL_LMS
692-
message(STATUS "Looking for WOLFSSL_LMS")
693-
if (WOLFSSL_LMS)
694-
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 2)
695-
696-
message(STATUS "Automatically set related requirements for LMS")
697-
add_definitions("-DWOLFSSL_HAVE_LMS")
698-
add_definitions("-DWOLFSSL_WC_LMS")
699-
set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
700-
set_wolfssl_definitions("WOLFSSL_WC_LMS" RESULT)
701-
message(STATUS "Looking for WOLFSSL_LMS - found")
702-
# Checking for experimental feature: WOLFSSL_LMSSHA256192
703-
if (WOLFSSL_LMSSHA256192)
704-
message(STATUS "Automatically set related requirements for LMS SHA256-192")
705-
add_definitions("-DWOLFSSL_LMS_SHA256_192")
706-
add_definitions("-DWOLFSSL_NO_LMS_SHA256_256")
707-
set_wolfssl_definitions("WOLFSSL_LMS_SHA256_192" RESULT)
708-
set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
709-
message(STATUS "Looking for WOLFSSL_LMSSHA256192 - found")
710-
else()
711-
message(STATUS "Looking for WOLFSSL_LMSSHA256192 - not found")
712-
endif()
713-
else()
714-
message(STATUS "Looking for WOLFSSL_LMS - not found")
715-
endif()
716-
717-
# Checking for experimental feature: Dilithium
718-
message(STATUS "Looking for WOLFSSL_DILITHIUM")
719-
if (WOLFSSL_DILITHIUM)
743+
# Checking for experimental feature: extra PQ/T hybrid combinations
744+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS")
745+
if (WOLFSSL_EXTRA_PQC_HYBRIDS)
720746
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
721-
722-
message(STATUS "Automatically set related requirements for Dilithium:")
723-
add_definitions("-DHAVE_DILITHIUM")
724-
add_definitions("-DWOLFSSL_WC_DILITHIUM")
725-
add_definitions("-DWOLFSSL_SHA3")
726-
add_definitions("-DWOLFSSL_SHAKE128")
727-
add_definitions("-DWOLFSSL_SHAKE256")
728-
729-
message(STATUS "Automatically set related requirements for Dilithium:")
730-
set_wolfssl_definitions("HAVE_DILITHIUM" RESULT)
731-
set_wolfssl_definitions("WOLFSSL_WC_DILITHIUM" RESULT)
732-
set_wolfssl_definitions("WOLFSSL_SHA3" RESULT)
733-
set_wolfssl_definitions("WOLFSSL_SHAKE128" RESULT)
734-
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
735-
message(STATUS "Looking for WOLFSSL_DILITHIUM - found")
747+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - found")
748+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_EXTRA_PQC_HYBRIDS")
736749
else()
737-
message(STATUS "Looking for WOLFSSL_DILITHIUM - not found")
750+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - not found")
738751
endif()
739752

740753
# Other experimental feature detection can be added here...
@@ -759,12 +772,6 @@ else()
759772
if (WOLFSSL_OQS)
760773
message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
761774
endif()
762-
if(WOLFSSL_MLKEM)
763-
message(FATAL_ERROR "Error: WOLFSSL_MLKEM requires WOLFSSL_EXPERIMENTAL at this time.")
764-
endif()
765-
if(WOLFSSL_DILITHIUM)
766-
message(FATAL_ERROR "Error: WOLFSSL_DILITHIUM requires WOLFSSL_EXPERIMENTAL at this time.")
767-
endif()
768775
endif()
769776

770777
# LMS

‎cmake/options.h.in‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,8 @@ extern "C" {
380380
#cmakedefine WOLFSSL_HAVE_MLKEM
381381
#undef WOLFSSL_WC_MLKEM
382382
#cmakedefine WOLFSSL_WC_MLKEM
383+
#undef WOLFSSL_TLS_NO_MLKEM_STANDALONE
384+
#cmakedefine WOLFSSL_TLS_NO_MLKEM_STANDALONE
383385
#undef WOLFSSL_WC_DILITHIUM
384386
#cmakedefine WOLFSSL_WC_DILITHIUM
385387
#undef NO_WOLFSSL_STUB
@@ -408,6 +410,10 @@ extern "C" {
408410
#cmakedefine WOLFSSL_WC_XMSS
409411
#undef WC_RSA_DIRECT
410412
#cmakedefine WC_RSA_DIRECT
413+
#undef WOLFSSL_PQC_HYBRIDS
414+
#cmakedefine WOLFSSL_PQC_HYBRIDS
415+
#undef WOLFSSL_EXTRA_PQC_HYBRIDS
416+
#cmakedefine WOLFSSL_EXTRA_PQC_HYBRIDS
411417

412418
#ifdef __cplusplus
413419
}

0 commit comments

Comments
 (0)