Skip to content

Commit

Permalink
Merge pull request #8494 from Laboratory-for-Safe-and-Secure-Systems/…
Browse files Browse the repository at this point in the history 
…various

Various fixes and improvements
  • Loading branch information
@SparkiDev
SparkiDev authored Feb 26, 2025
2 parents 92ed003 + 75d6307 commit 99f25c6
Show file tree
Hide file tree
Showing 13 changed files with 166 additions and 71 deletions.
12 changes: 10 additions & 2 deletions CMakeLists.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -655,6 +655,16 @@ else()
endif()
endif()

# LMS
add_option(WOLFSSL_LMS
"Enable the wolfSSL LMS implementation (default: disabled)"
"no" "yes;no")

# XMSS
add_option(WOLFSSL_XMSS
"Enable the wolfSSL XMSS implementation (default: disabled)"
"no" "yes;no")

# TODO: - Lean PSK
# - Lean TLS
# - Low resource
Expand All @@ -668,8 +678,6 @@ endif()
# - Atomic user record layer
# - Public key callbacks
# - Microchip/Atmel CryptoAuthLib
# - XMSS
# - LMS
# - dual-certs

# AES-CBC
Expand Down
16 changes: 16 additions & 0 deletions cmake/functions.cmake
View file
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,12 @@ function(generate_build_flags)
set(BUILD_EXT_KYBER "yes" PARENT_SCOPE)
set(BUILD_OQS_HELPER "yes" PARENT_SCOPE)
endif()
if(WOLFSSL_LMS OR WOLFSSL_USER_SETTINGS)
set(BUILD_WC_LMS "yes" PARENT_SCOPE)
endif()
if(WOLFSSL_XMSS OR WOLFSSL_USER_SETTINGS)
set(BUILD_WC_XMSS "yes" PARENT_SCOPE)
endif()
if(WOLFSSL_ARIA OR WOLFSSL_USER_SETTINGS)
message(STATUS "ARIA functions.cmake found WOLFSSL_ARIA")
# we cannot actually build, as we only have pre-compiled bin
Expand Down Expand Up @@ -818,6 +824,16 @@ function(generate_lib_src_list LIB_SOURCES)
list(APPEND LIB_SOURCES wolfcrypt/src/ext_kyber.c)
endif()

if(BUILD_WC_LMS)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_lms.c)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_lms_impl.c)
endif()

if(BUILD_WC_XMSS)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_xmss.c)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_xmss_impl.c)
endif()

if(BUILD_LIBZ)
list(APPEND LIB_SOURCES wolfcrypt/src/compress.c)
endif()
Expand Down
8 changes: 8 additions & 0 deletions cmake/options.h.in
View file
Original file line number Diff line number Diff line change
Expand Up @@ -382,6 +382,14 @@ extern "C" {
#cmakedefine HAVE_ECC_KOBLITZ
#undef HAVE_ECC_CDH
#cmakedefine HAVE_ECC_CDH
#undef WOLFSSL_HAVE_LMS
#cmakedefine WOLFSSL_HAVE_LMS
#undef WOLFSSL_WC_LMS
#cmakedefine WOLFSSL_WC_LMS
#undef WOLFSSL_HAVE_XMSS
#cmakedefine WOLFSSL_HAVE_XMSS
#undef WOLFSSL_WC_XMSS
#cmakedefine WOLFSSL_WC_XMSS

#ifdef __cplusplus
}
Expand Down
4 changes: 4 additions & 0 deletions src/internal.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8906,6 +8906,10 @@ void FreeHandshakeResources(WOLFSSL* ssl)
FreeKey(ssl, DYNAMIC_TYPE_FALCON, (void**)&ssl->peerFalconKey);
ssl->peerFalconKeyPresent = 0;
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM)
FreeKey(ssl, DYNAMIC_TYPE_DILITHIUM, (void**)&ssl->peerDilithiumKey);
ssl->peerDilithiumKeyPresent = 0;
#endif /* HAVE_DILITHIUM */
}

#ifdef HAVE_ECC
Expand Down
6 changes: 3 additions & 3 deletions src/ssl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18569,11 +18569,11 @@ const WOLFSSL_ObjectInfo wolfssl_object_info[] = {
"Dilithium Level 5", "Dilithium Level 5"},
#endif /* WOLFSSL_DILITHIUM_FIPS204_DRAFT */
{ CTC_ML_DSA_LEVEL2, ML_DSA_LEVEL2k, oidKeyType,
"ML_DSA Level 2", "ML_DSA Level 2"},
"ML-DSA 44", "ML-DSA 44"},
{ CTC_ML_DSA_LEVEL3, ML_DSA_LEVEL3k, oidKeyType,
"ML_DSA Level 3", "ML_DSA Level 3"},
"ML-DSA 65", "ML-DSA 65"},
{ CTC_ML_DSA_LEVEL5, ML_DSA_LEVEL5k, oidKeyType,
"ML_DSA Level 5", "ML_DSA Level 5"},
"ML-DSA 87", "ML-DSA 87"},
#endif /* HAVE_DILITHIUM */

/* oidCurveType */
Expand Down
80 changes: 34 additions & 46 deletions src/tls13.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7181,7 +7181,7 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
ERROR_OUT(MATCH_SUITE_ERROR, exit_dch);
}

#ifdef HAVE_SESSION_TICKET
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
if (ssl->options.resuming) {
ssl->options.resuming = 0;
ssl->arrays->psk_keySz = 0;
Expand Down Expand Up @@ -9145,41 +9145,12 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl)
#endif
#if defined(HAVE_FALCON)
else if (ssl->hsType == DYNAMIC_TYPE_FALCON) {
falcon_key* fkey = (falcon_key*)ssl->hsKey;
byte level = 0;
if (wc_falcon_get_level(fkey, &level) != 0) {
ERROR_OUT(ALGO_ID_E, exit_scv);
}
if (level == 1) {
args->sigAlgo = falcon_level1_sa_algo;
}
else if (level == 5) {
args->sigAlgo = falcon_level5_sa_algo;
}
else {
ERROR_OUT(ALGO_ID_E, exit_scv);
}
args->sigAlgo = ssl->buffers.keyType;
}
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM)
else if (ssl->hsType == DYNAMIC_TYPE_DILITHIUM) {
dilithium_key* fkey = (dilithium_key*)ssl->hsKey;
byte level = 0;
if (wc_dilithium_get_level(fkey, &level) != 0) {
ERROR_OUT(ALGO_ID_E, exit_scv);
}
if (level == 2) {
args->sigAlgo = dilithium_level2_sa_algo;
}
else if (level == 3) {
args->sigAlgo = dilithium_level3_sa_algo;
}
else if (level == 5) {
args->sigAlgo = dilithium_level5_sa_algo;
}
else {
ERROR_OUT(ALGO_ID_E, exit_scv);
}
args->sigAlgo = ssl->buffers.keyType;
}
#endif /* HAVE_DILITHIUM */
else {
Expand Down Expand Up @@ -9463,9 +9434,11 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl)
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN)
if (ssl->hsType == DYNAMIC_TYPE_DILITHIUM) {
ret = wc_dilithium_sign_msg(args->sigData, args->sigDataSz,
sigOut, &args->sigLen,
(dilithium_key*)ssl->hsKey, ssl->rng);
ret = wc_dilithium_sign_ctx_msg(NULL, 0, args->sigData,
args->sigDataSz, sigOut,
&args->sigLen,
(dilithium_key*)ssl->hsKey,
ssl->rng);
args->length = (word16)args->sigLen;
}
#endif /* HAVE_DILITHIUM */
Expand Down Expand Up @@ -9557,11 +9530,9 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl)
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN)
if (ssl->hsAltType == DYNAMIC_TYPE_DILITHIUM) {
ret = wc_dilithium_sign_msg(args->altSigData,
args->altSigDataSz, sigOut,
&args->altSigLen,
(dilithium_key*)ssl->hsAltKey,
ssl->rng);
ret = wc_dilithium_sign_ctx_msg(NULL, 0, args->altSigData,
args->altSigDataSz, sigOut, &args->altSigLen,
(dilithium_key*)ssl->hsAltKey, ssl->rng);
}
#endif /* HAVE_DILITHIUM */

Expand Down Expand Up @@ -10546,6 +10517,10 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(void**)&ssl->peerFalconKey);
ssl->peerFalconKeyPresent = 0;
}
else if ((ret >= 0) && (res == 0)) {
WOLFSSL_MSG("Falcon signature verification failed");
ret = SIG_VERIFY_E;
}
}
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY)
Expand All @@ -10555,9 +10530,9 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(ssl->peerDilithiumKeyPresent)) {
int res = 0;
WOLFSSL_MSG("Doing Dilithium peer cert verify");
ret = wc_dilithium_verify_msg(sig, args->sigSz,
args->sigData, args->sigDataSz,
&res, ssl->peerDilithiumKey);
ret = wc_dilithium_verify_ctx_msg(sig, args->sigSz, NULL, 0,
args->sigData, args->sigDataSz,
&res, ssl->peerDilithiumKey);

if ((ret >= 0) && (res == 1)) {
/* CLIENT/SERVER: data verified with public key from
Expand All @@ -10568,6 +10543,10 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(void**)&ssl->peerDilithiumKey);
ssl->peerDilithiumKeyPresent = 0;
}
else if ((ret >= 0) && (res == 0)) {
WOLFSSL_MSG("Dilithium signature verification failed");
ret = SIG_VERIFY_E;
}
}
#endif /* HAVE_DILITHIUM */

Expand Down Expand Up @@ -10648,6 +10627,10 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(void**)&ssl->peerFalconKey);
ssl->peerFalconKeyPresent = 0;
}
else if ((ret >= 0) && (res == 0)) {
WOLFSSL_MSG("Falcon signature verification failed");
ret = SIG_VERIFY_E;
}
}
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY)
Expand All @@ -10657,9 +10640,10 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(ssl->peerDilithiumKeyPresent)) {
int res = 0;
WOLFSSL_MSG("Doing Dilithium peer cert alt verify");
ret = wc_dilithium_verify_msg(sig, args->altSignatureSz,
args->altSigData, args->altSigDataSz,
&res, ssl->peerDilithiumKey);
ret = wc_dilithium_verify_ctx_msg(sig, args->altSignatureSz,
NULL, 0, args->altSigData,
args->altSigDataSz, &res,
ssl->peerDilithiumKey);

if ((ret >= 0) && (res == 1)) {
/* CLIENT/SERVER: data verified with public key from
Expand All @@ -10670,6 +10654,10 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
(void**)&ssl->peerDilithiumKey);
ssl->peerDilithiumKeyPresent = 0;
}
else if ((ret >= 0) && (res == 0)) {
WOLFSSL_MSG("Dilithium signature verification failed");
ret = SIG_VERIFY_E;
}
}
#endif /* HAVE_DILITHIUM */

Expand Down
4 changes: 4 additions & 0 deletions wolfcrypt/src/asn.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17282,6 +17282,10 @@ int ConfirmSignature(SignatureCtx* sigCtx,
level = WC_ML_DSA_87_DRAFT;
}
#endif
else {
WOLFSSL_MSG("Invalid Dilithium key OID");
goto exit_cs;
}
sigCtx->verify = 0;
sigCtx->key.dilithium = (dilithium_key*)XMALLOC(
sizeof(dilithium_key), sigCtx->heap,
Expand Down
12 changes: 10 additions & 2 deletions wolfcrypt/src/cryptocb.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1043,7 +1043,8 @@ int wc_CryptoCb_MakePqcSignatureKey(WC_RNG* rng, int type, int keySize,
}

int wc_CryptoCb_PqcSign(const byte* in, word32 inlen, byte* out, word32 *outlen,
WC_RNG* rng, int type, void* key)
const byte* context, byte contextLen, word32 preHashType, WC_RNG* rng,
int type, void* key)
{
int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
int devId = INVALID_DEVID;
Expand All @@ -1068,6 +1069,9 @@ int wc_CryptoCb_PqcSign(const byte* in, word32 inlen, byte* out, word32 *outlen,
cryptoInfo.pk.pqc_sign.inlen = inlen;
cryptoInfo.pk.pqc_sign.out = out;
cryptoInfo.pk.pqc_sign.outlen = outlen;
cryptoInfo.pk.pqc_sign.context = context;
cryptoInfo.pk.pqc_sign.contextLen = contextLen;
cryptoInfo.pk.pqc_sign.preHashType = preHashType;
cryptoInfo.pk.pqc_sign.rng = rng;
cryptoInfo.pk.pqc_sign.key = key;
cryptoInfo.pk.pqc_sign.type = type;
Expand All @@ -1079,7 +1083,8 @@ int wc_CryptoCb_PqcSign(const byte* in, word32 inlen, byte* out, word32 *outlen,
}

int wc_CryptoCb_PqcVerify(const byte* sig, word32 siglen, const byte* msg,
word32 msglen, int* res, int type, void* key)
word32 msglen, const byte* context, byte contextLen, word32 preHashType,
int* res, int type, void* key)
{
int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
int devId = INVALID_DEVID;
Expand All @@ -1104,6 +1109,9 @@ int wc_CryptoCb_PqcVerify(const byte* sig, word32 siglen, const byte* msg,
cryptoInfo.pk.pqc_verify.siglen = siglen;
cryptoInfo.pk.pqc_verify.msg = msg;
cryptoInfo.pk.pqc_verify.msglen = msglen;
cryptoInfo.pk.pqc_verify.context = context;
cryptoInfo.pk.pqc_verify.contextLen = contextLen;
cryptoInfo.pk.pqc_verify.preHashType = preHashType;
cryptoInfo.pk.pqc_verify.res = res;
cryptoInfo.pk.pqc_verify.key = key;
cryptoInfo.pk.pqc_verify.type = type;
Expand Down
Loading

0 comments on commit 99f25c6

Please sign in to comment.