Skip to content

SLH-DSA: fix configure parameter set options and reduced-build tests #11907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Arpan0995 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

SLH-DSA: fix configure parameter set options and reduced-build tests #11907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 72 additions & 4 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2761,10 +2761,10 @@ do
SLHDSA_PARAM_256F=yes
;;
no-s)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SLHDSA_PARAM_NO_SMALL"
SLHDSA_NO_SMALL=yes
;;
no-f)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SLHDSA_PARAM_NO_FAST"
SLHDSA_NO_FAST=yes
;;
sha2)
SLHDSA_SHA2=yes
Expand Down Expand Up @@ -2800,16 +2800,74 @@ do
SLHDSA_PARAM_SHA2_256F=yes
;;
no-sha2-s)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SLHDSA_PARAM_NO_SHA2_SMALL"
SLHDSA_NO_SHA2_SMALL=yes
;;
no-sha2-f)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SLHDSA_PARAM_NO_SHA2_FAST"
SLHDSA_NO_SHA2_FAST=yes
;;
*)
AC_MSG_ERROR([Invalid choice for SLH-DSA []: $ENABLED_SLHDSA.])
break;;
esac
done

# If SLH-DSA is enabled but no parameter set was named, for example
# --enable-slhdsa=verify-only or =small, enable the SHAKE parameter sets as
# 'yes' does. The SHA2 parameter sets stay opt-in.
if test "$ENABLED_SLHDSA" != "no" && test "$SLHDSA_SHA2" != "yes" && \
test "$SLHDSA_PARAM_128S" != "yes" && test "$SLHDSA_PARAM_128F" != "yes" && \
test "$SLHDSA_PARAM_192S" != "yes" && test "$SLHDSA_PARAM_192F" != "yes" && \
test "$SLHDSA_PARAM_256S" != "yes" && test "$SLHDSA_PARAM_256F" != "yes"
then
SLHDSA_PARAM_128S=yes
SLHDSA_PARAM_128F=yes
SLHDSA_PARAM_192S=yes
SLHDSA_PARAM_192F=yes
SLHDSA_PARAM_256S=yes
SLHDSA_PARAM_256F=yes
fi

# no-s, no-f, no-sha2-s and no-sha2-f take that group out of the sets
# selected above, including sets named explicitly. A positive set macro
# overrides a group 'NO' macro in wc_slhdsa.h, so the group is removed here
# rather than with a CFLAG.
if test "$SLHDSA_NO_SMALL" = "yes"
then
SLHDSA_PARAM_128S=no
SLHDSA_PARAM_192S=no
SLHDSA_PARAM_256S=no
fi
if test "$SLHDSA_NO_FAST" = "yes"
then
SLHDSA_PARAM_128F=no
SLHDSA_PARAM_192F=no
SLHDSA_PARAM_256F=no
fi
if test "$SLHDSA_NO_SHA2_SMALL" = "yes"
then
SLHDSA_PARAM_SHA2_128S=no
SLHDSA_PARAM_SHA2_192S=no
SLHDSA_PARAM_SHA2_256S=no
fi
if test "$SLHDSA_NO_SHA2_FAST" = "yes"
then
SLHDSA_PARAM_SHA2_128F=no
SLHDSA_PARAM_SHA2_192F=no
SLHDSA_PARAM_SHA2_256F=no
fi

# If that leaves no SHA2 parameter set, leave the SHA2 family out too, with
# its SHA-256, SHA-512 and HMAC requirements.
if test "$SLHDSA_PARAM_SHA2_128S" != "yes" && \
test "$SLHDSA_PARAM_SHA2_128F" != "yes" && \
test "$SLHDSA_PARAM_SHA2_192S" != "yes" && \
test "$SLHDSA_PARAM_SHA2_192F" != "yes" && \
test "$SLHDSA_PARAM_SHA2_256S" != "yes" && \
test "$SLHDSA_PARAM_SHA2_256F" != "yes"
then
SLHDSA_SHA2=no
fi

# SINGLE THREADED
AC_ARG_ENABLE([singlethreaded],
[AS_HELP_STRING([--enable-singlethreaded],[Enable wolfSSL single threaded (default: disabled)])],
Expand Down Expand Up @@ -9248,6 +9306,16 @@ then

AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_SLHDSA"

# Checked here, after the FIPS section, which may still select sets.
if test "$SLHDSA_SHA2" != "yes" && \
test "$SLHDSA_PARAM_128S" != "yes" && test "$SLHDSA_PARAM_128F" != "yes" && \
test "$SLHDSA_PARAM_192S" != "yes" && test "$SLHDSA_PARAM_192F" != "yes" && \
test "$SLHDSA_PARAM_256S" != "yes" && test "$SLHDSA_PARAM_256F" != "yes"
then
AC_MSG_ERROR([SLH-DSA: $ENABLED_SLHDSA leaves no parameter sets. Remove a \
no-s/no-f/no-sha2-s/no-sha2-f option or name a set it does not exclude.])
fi

# SLH-DSA is an X.509 certificate signature algorithm, so keep the
# certificate/ASN code enabled (mirrors ML-DSA) - otherwise a build with
# RSA, ECC and DH disabled turns ASN off and cannot authenticate a peer.
Expand Down
16 changes: 12 additions & 4 deletions tests/api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31036,7 +31036,10 @@ static int test_wc_MakeCRL_max_crlnum(void)
!defined(NO_ASN) && \
((defined(WOLFSSL_HAVE_MLDSA) && defined(WOLFSSL_PEM_TO_DER) && \
!defined(WOLFSSL_MLDSA_NO_SIGN) && !defined(WOLFSSL_MLDSA_NO_ASN1)) || \
(defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)) || \
(defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
(defined(WOLFSSL_SLHDSA_PARAM_128S) || \
(defined(WOLFSSL_SLHDSA_SHA2) && \
defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)))) || \
(defined(HAVE_ED25519) && defined(HAVE_ED25519_SIGN)) || \
(defined(HAVE_ED448) && defined(HAVE_ED448_SIGN)))
/* Build a CRL, sign it with the given CA key through wc_MakeCRL_ex +
Expand Down Expand Up @@ -31265,19 +31268,24 @@ static int test_wc_SignCRL_slhdsa(void)
EXPECT_DECLS;
#if defined(WOLFSSL_CERT_GEN) && defined(HAVE_CRL) && !defined(NO_FILESYSTEM) && \
!defined(NO_ASN) && defined(WOLFSSL_HAVE_SLHDSA) && \
!defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
!defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
(defined(WOLFSSL_SLHDSA_PARAM_128S) || \
(defined(WOLFSSL_SLHDSA_SHA2) && defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)))
/* Only the 128s parameter sets have root certificates; run each case only
* when its parameter set is compiled in. */
static const struct {
const char* certDer;
const char* keyDer;
int keyType;
int sigType;
int param;
} cases[] = {
/* SHAKE variants are always built with --enable-slhdsa. */
#ifdef WOLFSSL_SLHDSA_PARAM_128S
{ "./certs/slhdsa/root-slhdsa-shake-128s.der",
"./certs/slhdsa/root-slhdsa-shake-128s-priv.der",
SLH_DSA_SHAKE_128S_TYPE, CTC_SLH_DSA_SHAKE_128S, SLHDSA_SHAKE128S },
#ifdef WOLFSSL_SLHDSA_SHA2
#endif
#if defined(WOLFSSL_SLHDSA_SHA2) && defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)
{ "./certs/slhdsa/root-slhdsa-sha2-128s.der",
"./certs/slhdsa/root-slhdsa-sha2-128s-priv.der",
SLH_DSA_SHA2_128S_TYPE, CTC_SLH_DSA_SHA2_128S, SLHDSA_SHA2_128S },
Expand Down
16 changes: 2 additions & 14 deletions tests/api/test_slhdsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2966,20 +2966,8 @@ int test_wc_slhdsa_param_disabled(void)
* documented purpose. The probe also validates the contract from the
* other side -- Init must succeed for an enabled param. */
haveEnabled = 0;
#if defined(WOLFSSL_SLHDSA_PARAM_128S)
enabledProbe = SLHDSA_SHAKE128S; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_PARAM_128F)
enabledProbe = SLHDSA_SHAKE128F; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_PARAM_192S)
enabledProbe = SLHDSA_SHAKE192S; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_PARAM_192F)
enabledProbe = SLHDSA_SHAKE192F; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_PARAM_256S)
enabledProbe = SLHDSA_SHAKE256S; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_PARAM_256F)
enabledProbe = SLHDSA_SHAKE256F; haveEnabled = 1;
#elif defined(WOLFSSL_SLHDSA_SHA2) && defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)
enabledProbe = SLHDSA_SHA2_128S; haveEnabled = 1;
#ifdef TEST_SLHDSA_DEFAULT_PARAM
enabledProbe = TEST_SLHDSA_DEFAULT_PARAM; haveEnabled = 1;
#endif
ExpectIntEQ(haveEnabled, 1);
if (haveEnabled) {
Expand Down
Loading