[padelsbach]

Description

Adds ML-DSA support to the software "device" used in crypto callback testing.

Testing

New tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

The new handlers allow invalid hash-algorithm requests to execute as plain-message signing or verification.

1 open finding

• Reject WC_HASH_TYPE_NONE in ML-DSA hash APIs · New

What changed in this PR

Adds ML-DSA support to the software crypto callback provider and enables existing tests for callback-only builds.

Changes:

• Implements ML-DSA callback handlers.
• Expands API and self-test coverage while retaining native-only guards.
• Combines ML-DSA and SLH-DSA in the all-algorithms CI configuration.

File	Description
wolfcrypt/​test/​test.c	Enables callback-backed ML-DSA self-tests.
tests/​swdev/​user_settings.h	Keeps native ML-DSA available in the provider.
tests/​swdev/​swdev.c	Adds ML-DSA operation dispatch.
tests/​swdev/​README.md	Documents ML-DSA callback-only support.
tests/​api/​test_mldsa.h	Defines shared implementation availability.
tests/​api/​test_mldsa.c	Enables API tests with swdev.
tests/​api/​test_mldsa_legacy.c	Enables legacy API testing with swdev.
tests/​api.c	Enables callback-backed ML-DSA CRL testing.
.github/​workflows/​cryptocb-only.yml	Consolidates combined-algorithm CI coverage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11753

Scan targets checked: wolfcrypt-bugs, wolfssl-bugs
Coverage: 3 of 5 in-scope changed file(s) opened by the reviewer; not opened: tests/api.c, tests/api/test_mldsa_legacy.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +32 B (+0.0%, 70,459 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +52 B (+0.0%, 130,769 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 209,948 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 73,015 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +192 B (+0.1%, 182,591 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 194,328 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +64 B (+0.1%, 67,673 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +8 B, .text +1,216 B (+0.2%, 796,140 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 223,552 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 311,716 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +128 B (+0.0%, 343,128 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +64 B (+0.1%, 67,673 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.0%, 131,537 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 249,230 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 209,948 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 312,676 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 249,294 B / 262,144 B, total: 95% used)

linuxkm-pie

• Data: __patchable_function_entries +64 B (+0.2%, 29,048 B)

linuxkm-standard

• Data: __patchable_function_entries +72 B (+0.1%, 52,040 B)

stm32-sim-stm32h753

• FLASH: .text +192 B (+0.1%, 205,616 B / 2,097,152 B, total: 10% used)

[padelsbach]

jenkins retest this please

[philljj]

Retest this please.

(fips-ready passed but hung?)

[philljj]

@claude review

[claude]

Findings marked 🟡 are optional suggestions and need no follow-up push.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 tests/api/test_mldsa.c — Conditional: native ML-DSA builds that add --enable-swdev and WOLFSSL_MLDSA_TEST_REJ_NTT_FAIL with MAKE_KEY_SMALL_MEM now fail test_mldsa_make_key_rej_ntt_fail. swdev now serves ML-DSA keygen, sign and verify for keys with no device. The test arms the fault hook in the main library, but the work runs in swdev's private copy, where the hook is never armed. Fix: exclude this test under WOLFSSL_SWDEV (add !defined(WOLFSSL_SWDEV) to the gate at test_mldsa.c:32756), as test_falcon.c:1241 does for FALCON_VERIFY_OOM_TEST.

  Why this was flagged

  I could not rule out this population from the checkout: no CI config combines --enable-swdev with WOLFSSL_MLDSA_TEST_REJ_NTT_FAIL, and pq-all.json:176/183/189/208 use the hook without swdev. In such a build, the test calls wc_mldsa_test_rej_ntt_fail(l + 1) (test_mldsa.c:32786) on the library's static mldsa_rej_ntt_fail_countdown (wc_mldsa.c:3021). It then calls wc_MlDsaKey_MakeKeyFromSeed on an INVALID_DEVID key. Under WOLF_CRYPTO_CB_FIND, wc_SwDev_FindCb (swdev_loader.c:79) sends that call to swdev, and swdev_mldsa_keygen (swdev.c:786-797) now runs it in swdev's own copy of wc_mldsa.c, where the countdown is a separate, unarmed static. The call returns 0 instead of BAD_STATE_E, and the disarm call returns the untouched countdown instead of 0. The SignCtx/VerifyCtx checks at 32837 and 32852 fail the same way. On the base branch, swdev_pqc_sig had no ML-DSA case and returned CRYPTOCB_UNAVAILABLE, so the main library ran the armed native path. The gate only checks WC_MLDSA_HAVE_NATIVE, which is still defined in native+swdev builds.

  Verification: Before this PR, swdev_pqc_sig had no WC_PQC_SIG_TYPE_MLDSA case, so it returned CRYPTOCB_UNAVAILABLE and the main library's native code ran with the armed hook. swdev's copy has its own static int mldsa_rej_ntt_fail_countdown (wc_mldsa.c:3021). The gate at test_mldsa.c:32756 checks only WC_MLDSA_HAVE_NATIVE, with no !defined(WOLFSSL_SWDEV).

[philljj]

Retest this please.

(fips v6 tests hung)

[philljj]

Tests good with multi-test with various gcc-c89, c89-clang-tidy, wolfssl-all, all-crypto, linuxkm, etc.