Skip to content

Commit 10b9873

Browse files
FrauschiFrauschi
committed
Add tests for individual ML-KEM levels (based on #9777)
Also fix minor problems found with these tests
1 parent 76b1300 commit 10b9873

5 files changed

Lines changed: 45 additions & 22 deletions

File tree

‎.github/workflows/pq-all.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ jobs:
2727
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-slhdsa --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"',
2828
'--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
2929
'--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
30+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
31+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
32+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3033
]
3134
name: make check
3235
if: github.repository_owner == 'wolfssl'

‎src/tls.c‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10878,11 +10878,18 @@ int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, word16 len, byte* data,
1087810878
}
1087910879
else if (ssl->options.side == WOLFSSL_SERVER_END &&
1088010880
WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group)) {
10881-
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10882-
keyShareEntry,
10883-
data, len);
10884-
if (ret != 0)
10885-
return ret;
10881+
if (TLSX_IsGroupSupported(group)) {
10882+
ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl,
10883+
keyShareEntry,
10884+
data, len);
10885+
if (ret != 0)
10886+
return ret;
10887+
}
10888+
else {
10889+
XFREE(keyShareEntry->ke, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
10890+
keyShareEntry->ke = NULL;
10891+
keyShareEntry->keLen = 0;
10892+
}
1088610893
}
1088710894
else
1088810895
#endif

‎tests/api.c‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32024,10 +32024,28 @@ static int test_dtls13_frag_ch_pq(void)
3202432024
const char *test_str = "test";
3202532025
int test_str_size;
3202632026
byte buf[255];
32027-
#ifdef WOLFSSL_MLKEM_KYBER
32027+
#if defined(WOLFSSL_MLKEM_KYBER)
32028+
#if !defined(WOLFSSL_NO_KYBER1024)
3202832029
int group = WOLFSSL_KYBER_LEVEL5;
32030+
const char *group_name = "KYBER_LEVEL5";
32031+
#elif !defined(WOLFSSL_NO_KYBER768)
32032+
int group = WOLFSSL_KYBER_LEVEL3;
32033+
const char *group_name = "KYBER_LEVEL3";
32034+
#else
32035+
int group = WOLFSSL_KYBER_LEVEL1;
32036+
const char *group_name = "KYBER_LEVEL1";
32037+
#endif
3202932038
#else
32039+
#if !defined(WOLFSSL_NO_ML_KEM_1024)
3203032040
int group = WOLFSSL_ML_KEM_1024;
32041+
const char *group_name = "ML_KEM_1024";
32042+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
32043+
int group = WOLFSSL_ML_KEM_768;
32044+
const char *group_name = "ML_KEM_768";
32045+
#else
32046+
int group = WOLFSSL_ML_KEM_512;
32047+
const char *group_name = "ML_KEM_512";
32048+
#endif
3203132049
#endif
3203232050

3203332051
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
@@ -32038,13 +32056,8 @@ static int test_dtls13_frag_ch_pq(void)
3203832056
ExpectIntEQ(wolfSSL_UseKeyShare(ssl_c, group), WOLFSSL_SUCCESS);
3203932057
ExpectIntEQ(wolfSSL_dtls13_allow_ch_frag(ssl_s, 1), WOLFSSL_SUCCESS);
3204032058
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
32041-
#ifdef WOLFSSL_MLKEM_KYBER
32042-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "KYBER_LEVEL5");
32043-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "KYBER_LEVEL5");
32044-
#else
32045-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "ML_KEM_1024");
32046-
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "ML_KEM_1024");
32047-
#endif
32059+
ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), group_name);
32060+
ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), group_name);
3204832061
test_str_size = XSTRLEN("test") + 1;
3204932062
ExpectIntEQ(wolfSSL_write(ssl_c, test_str, test_str_size), test_str_size);
3205032063
ExpectIntEQ(wolfSSL_read(ssl_s, buf, sizeof(buf)), test_str_size);

‎tests/api/test_tls13.c‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -149,15 +149,15 @@ int test_tls13_apis(void)
149149
":P256_KYBER_LEVEL1"
150150
#elif !defined(WOLFSSL_NO_KYBER768)
151151
":P256_KYBER_LEVEL3"
152-
#else
152+
#elif !defined(WOLFSSL_NO_KYBER1024)
153153
":P256_KYBER_LEVEL5"
154154
#endif
155155
#else
156-
#ifndef WOLFSSL_NO_KYBER512
156+
#ifndef WOLFSSL_NO_ML_KEM_512
157157
":SecP256r1MLKEM512"
158-
#elif !defined(WOLFSSL_NO_KYBER768)
158+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
159159
":SecP384r1MLKEM768"
160-
#else
160+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
161161
":SecP521r1MLKEM1024"
162162
#endif
163163
#endif
@@ -173,15 +173,15 @@ int test_tls13_apis(void)
173173
":KYBER_LEVEL1"
174174
#elif !defined(WOLFSSL_NO_KYBER768)
175175
":KYBER_LEVEL3"
176-
#else
176+
#elif !defined(WOLFSSL_NO_KYBER1024)
177177
":KYBER_LEVEL5"
178178
#endif
179179
#else
180-
#ifndef WOLFSSL_NO_KYBER512
180+
#ifndef WOLFSSL_NO_ML_KEM_512
181181
":ML_KEM_512"
182-
#elif !defined(WOLFSSL_NO_KYBER768)
182+
#elif !defined(WOLFSSL_NO_ML_KEM_768)
183183
":ML_KEM_768"
184-
#else
184+
#elif !defined(WOLFSSL_NO_ML_KEM_1024)
185185
":ML_KEM_1024"
186186
#endif
187187
#endif

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1742,7 +1742,7 @@ enum Misc {
17421742
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
17431743
#endif
17441744
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
1745-
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
1745+
MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */
17461746

17471747
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
17481748
RSA_PSS_RSAE_SHA256_MINOR = 0x04,

0 commit comments

Comments
 (0)