[kaleb-himes]

Description

• X25519 and X448 are opt-in and built past wolfcrypt_last.c, outside the v7 module boundary, in autotools and in Zephyr. They aren’t module algorithms. Combined with ML-KEM in the TLS 1.3 hybrid groups, the shared secrets go through the module’s HKDF, which is an approved key combiner (SP 800-227 §4.6.2; FIPS 140-3 IG D.S, Scenario 2, “Approved Key Combiner”: HKDF qualifies through SP 800-56C). FIPS builds don’t offer plain X25519/X448 by default.

• The module now joins the hybrid shared secrets. The new wc_Tls13_HybridSharedSecret() in kdf.c puts the ML-KEM and ECDH secrets in the order draft-ietf-tls-ecdhe-mlkem-03 §4.3 fixes for each group. In FIPS builds it allows only SecP256r1MLKEM768, X25519MLKEM768 and SecP384r1MLKEM1024 (§7 code points), with their fixed order and sizes. This meets IG D.S Scenario 2 items 4 (pre-defined hybrid sets) and 5 (the module controls the shared-secret ordering), which the KEM-Hybrid claim requires. tls.c calls it only when kdf.h defines WOLFSSL_HAVE_TLS13_HYBRID_SECRET, so FIPS v5/v6 builds with their frozen kdf.h keep today’s code.

• ML-KEM: a key whose key-pair test can’t finish is freed, so an untested key can’t be used (ISO/IEC 19790:2012 §7.10.3.3: every generated key pair gets a consistency test).

• ML-DSA: WOLFSSL_MLDSA_SIGN_CHECK_Y/_W0 are refused in FIPS builds. Their extra rejections change the signature FIPS 204 Algorithm 7 produces.

Fixes zd#

Testing

• --enable-fips=v7 --enable-curve25519 --enable-curve448 and default --enable-fips=v7: make check passes. A symbol check finds no outside code calling a wrapped module function directly; tls.o calls only the _fips join.
• Hybrid handshakes (examples client/server) on FIPS v7: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024 connect.
  Item 4 control: SecP256r1MLKEM512 and X448MLKEM768, built with --enable-experimental --enable-extra-pqc-hybrids, are refused with -173.
  Item 5 control: with tls.c’s order for SecP256r1MLKEM768 flipped, the module refuses it (-173).
• Non-FIPS with the extras: make check passes, and all five hybrid groups connect.
• Frozen-module fallback: a build without the new function, prototype and macro passes make check, tls.o has no reference to it, the new test is skipped, and the hybrids connect over the old path.
• New test_wc_Tls13_HybridSharedSecret: checks each group’s order against the draft, the buffer and argument errors, and in FIPS the unlisted-group, wrong-order and wrong-size refusals. It fails when the overlapping copy is one byte short.
• X25519/X448: plain X25519 isn’t offered by default in FIPS. It still negotiates when both peers explicitly configure it; that connection isn’t a FIPS TLS connection.
• ML-KEM: with allocation failures injected during the key-pair test, 8 of 300 untested keys could be exported before the change, and none after.
• ML-DSA: a FIPS build with either option stops at the #error. Deterministic signatures differ across the three builds.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 312,272 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 313,104 B / 1,048,576 B, total: 30% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,584 B (+0.6%, 284,032 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🔵 Needs a closer look

The FIPS v7 boundary and hybrid-combiner changes require specialist validation against licensed wrapper sources absent from this snapshot and actual Zephyr linker and integrity-test behavior.

No open issues 🎉

1 resolved since last review

• Heap-allocate ML-KEM key to avoid small-stack exhaustion

_{Review effort: Balanced}