Improvements to C# PQC

dgarske · dgarske · commit 72c57dc12705 · 2026-04-13T15:30:57.000-07:00
diff --git a/wrapper/CSharp/user_settings.h b/wrapper/CSharp/user_settings.h
@@ -91,6 +91,7 @@
 #define HAVE_MLKEM
 #define WOLFSSL_WC_MLKEM
 #define WOLFSSL_HAVE_MLKEM
+/* Required for PQC with DTLS 1.3 (auto-enabled in settings.h, explicit for clarity) */
 #define WOLFSSL_DTLS_CH_FRAG
 #define HAVE_DILITHIUM
 #define WOLFSSL_WC_DILITHIUM
diff --git a/wrapper/CSharp/wolfCrypt-Test/wolfCrypt-Test.cs b/wrapper/CSharp/wolfCrypt-Test/wolfCrypt-Test.cs
@@ -871,15 +871,15 @@ private static void mldsa_test(wolfcrypt.MlDsaLevels level)
             if (ret == 0)
             {
                 Console.WriteLine("Testing ML-DSA Key Export...");
-                ret = DilithiumExportPrivateKey(key, out privateKey);
+                ret = wolfcrypt.DilithiumExportPrivateKey(key, out privateKey);
                 if (ret != 0)
                 {
                     Console.Error.WriteLine($"Failed to export private key. Error code: {ret}");
                 }
             }
             if (ret == 0)
             {
-                ret = DilithiumExportPublicKey(key, out publicKey);
+                ret = wolfcrypt.DilithiumExportPublicKey(key, out publicKey);
                 if (ret != 0)
                 {
                     Console.Error.WriteLine($"Failed to export public key. Error code: {ret}");
@@ -894,15 +894,15 @@ private static void mldsa_test(wolfcrypt.MlDsaLevels level)
             if (ret == 0)
             {
                 Console.WriteLine("Testing ML-DSA Key Import...");
-                ret = DilithiumImportPrivateKey(privateKey, key);
+                ret = wolfcrypt.DilithiumImportPrivateKey(privateKey, key);
                 if (ret != 0)
                 {
                     Console.Error.WriteLine($"Failed to import private key. Error code: {ret}");
                 }
             }
             if (ret == 0)
             {
-                ret = DilithiumImportPublicKey(publicKey, key);
+                ret = wolfcrypt.DilithiumImportPublicKey(publicKey, key);
                 if (ret != 0)
                 {
                     Console.Error.WriteLine($"Failed to import public key. Error code: {ret}");
diff --git a/wrapper/CSharp/wolfSSL_CSharp/wolfCrypt.cs b/wrapper/CSharp/wolfSSL_CSharp/wolfCrypt.cs
@@ -540,9 +540,9 @@ public class wolfcrypt
         [DllImport(wolfssl_dll)]
         private static extern int wc_dilithium_import_public(byte[] input, uint inputLen, IntPtr key);
         [DllImport(wolfssl_dll)]
-        private static extern int wc_dilithium_sign_msg(byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);
+        private static extern int wc_dilithium_sign_ctx_msg(byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);
         [DllImport(wolfssl_dll)]
-        private static extern int wc_dilithium_verify_msg(byte[] sig, uint sigLen, byte[] msg, uint msgLen, ref int res, IntPtr key);
+        private static extern int wc_dilithium_verify_ctx_msg(byte[] sig, uint sigLen, byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, ref int res, IntPtr key);
         [DllImport(wolfssl_dll)]
         private static extern int wc_MlDsaKey_GetPrivLen(IntPtr key, ref int len);
         [DllImport(wolfssl_dll)]
@@ -571,9 +571,9 @@ public class wolfcrypt
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
         private static extern int wc_dilithium_import_public(byte[] input, uint inputLen, IntPtr key);
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
-        private static extern int wc_dilithium_sign_msg(byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);
+        private static extern int wc_dilithium_sign_ctx_msg(byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
-        private static extern int wc_dilithium_verify_msg(byte[] sig, uint sigLen, byte[] msg, uint msgLen, ref int res, IntPtr key);
+        private static extern int wc_dilithium_verify_ctx_msg(byte[] sig, uint sigLen, byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, ref int res, IntPtr key);
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
         private static extern int wc_MlDsaKey_GetPrivLen(IntPtr key, ref int len);
         [DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]
@@ -2982,18 +2982,15 @@ public static IntPtr MlKemMakeKey(MlKemTypes type, IntPtr heap, int devId)
         /// <returns>0 on success, negative value on error.</returns>
         public static int MlKemFreeKey(ref IntPtr key)
         {
-            int ret = 0;
+            int ret;
 
             if (key == IntPtr.Zero)
             {
                 return BAD_FUNC_ARG;
             }
 
-            if (key != IntPtr.Zero)
-            {
-                ret = wc_MlKemKey_Delete(key, IntPtr.Zero);
-                key = IntPtr.Zero;
-            }
+            ret = wc_MlKemKey_Delete(key, IntPtr.Zero);
+            key = IntPtr.Zero;
             return ret;
         }
 
@@ -3017,10 +3014,10 @@ public static int MlKemEncodePublicKey(IntPtr key, out byte[] publicKey)
             try
             {
                 ret = wc_MlKemKey_PublicKeySize(key, ref pubLen);
-                if (ret !=0 || pubLen == 0)
+                if (ret != 0 || pubLen == 0)
                 {
                     log(ERROR_LOG, "Failed to get MlKem public key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
                 if (pubLen > int.MaxValue)
                 {
@@ -3066,10 +3063,10 @@ public static int MlKemEncodePrivateKey(IntPtr key, out byte[] privateKey)
             try
             {
                 ret = wc_MlKemKey_PrivateKeySize(key, ref privLen);
-                if (ret !=0 || privLen == 0)
+                if (ret != 0 || privLen == 0)
                 {
                     log(ERROR_LOG, "Failed to get MlKem private key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
                 if (privLen > int.MaxValue)
                 {
@@ -3123,14 +3120,14 @@ public static int MlKemDecodePublicKey(IntPtr key, byte[] publicKey)
                 if (ret != 0 || pubLen == 0)
                 {
                     log(ERROR_LOG, "Failed to get MlKem public key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
                 if ((uint)publicKey.Length != pubLen)
-                 {
-                     log(ERROR_LOG, "MlKem public key buffer length mismatch. Expected: " +
-                         pubLen + ", actual: " + publicKey.Length);
-                     return BUFFER_E;
-                 }
+                {
+                    log(ERROR_LOG, "MlKem public key buffer length mismatch. Expected: " +
+                        pubLen + ", actual: " + publicKey.Length);
+                    return BUFFER_E;
+                }
 
                 ret = wc_MlKemKey_DecodePublicKey(key, publicKey, pubLen);
                 if (ret != 0)
@@ -3172,12 +3169,12 @@ public static int MlKemDecodePrivateKey(IntPtr key, byte[] privateKey)
             try
             {
                 ret = wc_MlKemKey_PrivateKeySize(key, ref privLen);
-                if (privLen == 0)
+                if (ret != 0 || privLen == 0)
                 {
                     log(ERROR_LOG, "Failed to get MlKem private key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
-                
+
                 if ((uint)privateKey.Length != privLen)
                 {
                     log(ERROR_LOG, "MlKem private key buffer length mismatch. Required: " + privLen +
@@ -3416,18 +3413,15 @@ public static IntPtr DilithiumMakeKey(IntPtr heap, int devId, MlDsaLevels level)
         /// <returns>0 on success, negative value on error.</returns>
         public static int DilithiumFreeKey(ref IntPtr key)
         {
-            int ret = 0;
+            int ret;
 
             if (key == IntPtr.Zero)
             {
                 return BAD_FUNC_ARG;
             }
 
-            if (key != IntPtr.Zero)
-            {
-                ret = wc_dilithium_delete(key, IntPtr.Zero);
-                key = IntPtr.Zero;
-            }
+            ret = wc_dilithium_delete(key, IntPtr.Zero);
+            key = IntPtr.Zero;
             return ret;
         }
 
@@ -3500,10 +3494,10 @@ public static int DilithiumExportPrivateKey(IntPtr key, out byte[] privateKey)
             try
             {
                 ret = wc_MlDsaKey_GetPrivLen(key, ref privLen);
-                if (privLen <= 0)
+                if (ret != 0 || privLen <= 0)
                 {
                     log(ERROR_LOG, "Failed to get Dilithium private key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
 
                 privateKey = new byte[privLen];
@@ -3550,10 +3544,10 @@ public static int DilithiumExportPublicKey(IntPtr key, out byte[] publicKey)
             try
             {
                 ret = wc_MlDsaKey_GetPubLen(key, ref pubLen);
-                if (pubLen <= 0)
+                if (ret != 0 || pubLen <= 0)
                 {
                     log(ERROR_LOG, "Failed to get Dilithium public key length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
 
                 publicKey = new byte[pubLen];
@@ -3602,10 +3596,10 @@ public static int DilithiumSignMsg(IntPtr key, byte[] msg, out byte[] sig)
             try
             {
                 ret = wc_MlDsaKey_GetSigLen(key, ref sigLen);
-                if (sigLen <= 0)
+                if (ret != 0 || sigLen <= 0)
                 {
                     log(ERROR_LOG, "Failed to get Dilithium signature length. Error code: " + ret);
-                    return ret;
+                    return (ret != 0) ? ret : BAD_FUNC_ARG;
                 }
 
                 sig = new byte[sigLen];
@@ -3614,9 +3608,10 @@ public static int DilithiumSignMsg(IntPtr key, byte[] msg, out byte[] sig)
                 if (rng == IntPtr.Zero)
                 {
                     log(ERROR_LOG, "Failed to create RNG for Dilithium signing.");
-                    return EXCEPTION_E;
+                    return MEMORY_E;
                 }
-                ret = wc_dilithium_sign_msg(msg, (uint)msg.Length, sig, ref outLen, key, rng);
+                /* FIPS 204 sign with empty context (ctx=null, ctxLen=0). */
+                ret = wc_dilithium_sign_ctx_msg(null, 0, msg, (uint)msg.Length, sig, ref outLen, key, rng);
                 if (ret != 0)
                 {
                     log(ERROR_LOG, "Failed to sign message with Dilithium key. Error code: " + ret);
@@ -3660,7 +3655,8 @@ public static int DilithiumVerifyMsg(IntPtr key, byte[] msg, byte[] sig)
 
             try
             {
-                ret = wc_dilithium_verify_msg(sig, (uint)sig.Length, msg, (uint)msg.Length, ref res, key);
+                /* FIPS 204 verify with empty context (ctx=null, ctxLen=0). */
+                ret = wc_dilithium_verify_ctx_msg(sig, (uint)sig.Length, null, 0, msg, (uint)msg.Length, ref res, key);
                 if (ret != 0)
                 {
                     log(ERROR_LOG, "Failed to verify message with Dilithium key. Error code: " + ret);
diff --git a/wrapper/CSharp/wolfSSL_CSharp/wolfSSL.cs b/wrapper/CSharp/wolfSSL_CSharp/wolfSSL.cs
@@ -795,8 +795,6 @@ public enum NamedGroup
             WOLFSSL_SECP521R1MLKEM1024    = 12109,
             WOLFSSL_X25519MLKEM512        = 12214,
             WOLFSSL_X448MLKEM768          = 12215,
-
-            WOLF_ENUM_DUMMY_LAST_ELEMENT = 0
         }
 
 

Original file line number	Diff line number	Diff line change
`@@ -871,15 +871,15 @@ private static void mldsa_test(wolfcrypt.MlDsaLevels level)`
`871`	`871`	`if (ret == 0)`
`872`	`872`	`{`
`873`	`873`	`Console.WriteLine("Testing ML-DSA Key Export...");`
`874`		`- ret = DilithiumExportPrivateKey(key, out privateKey);`
	`874`	`+ ret = wolfcrypt.DilithiumExportPrivateKey(key, out privateKey);`
`875`	`875`	`if (ret != 0)`
`876`	`876`	`{`
`877`	`877`	`Console.Error.WriteLine($"Failed to export private key. Error code: {ret}");`
`878`	`878`	`}`
`879`	`879`	`}`
`880`	`880`	`if (ret == 0)`
`881`	`881`	`{`
`882`		`- ret = DilithiumExportPublicKey(key, out publicKey);`
	`882`	`+ ret = wolfcrypt.DilithiumExportPublicKey(key, out publicKey);`
`883`	`883`	`if (ret != 0)`
`884`	`884`	`{`
`885`	`885`	`Console.Error.WriteLine($"Failed to export public key. Error code: {ret}");`
`@@ -894,15 +894,15 @@ private static void mldsa_test(wolfcrypt.MlDsaLevels level)`
`894`	`894`	`if (ret == 0)`
`895`	`895`	`{`
`896`	`896`	`Console.WriteLine("Testing ML-DSA Key Import...");`
`897`		`- ret = DilithiumImportPrivateKey(privateKey, key);`
	`897`	`+ ret = wolfcrypt.DilithiumImportPrivateKey(privateKey, key);`
`898`	`898`	`if (ret != 0)`
`899`	`899`	`{`
`900`	`900`	`Console.Error.WriteLine($"Failed to import private key. Error code: {ret}");`
`901`	`901`	`}`
`902`	`902`	`}`
`903`	`903`	`if (ret == 0)`
`904`	`904`	`{`
`905`		`- ret = DilithiumImportPublicKey(publicKey, key);`
	`905`	`+ ret = wolfcrypt.DilithiumImportPublicKey(publicKey, key);`
`906`	`906`	`if (ret != 0)`
`907`	`907`	`{`
`908`	`908`	`Console.Error.WriteLine($"Failed to import public key. Error code: {ret}");`
Original file line number	Diff line number	Diff line change
`@@ -540,9 +540,9 @@ public class wolfcrypt`
`540`	`540`	`[DllImport(wolfssl_dll)]`
`541`	`541`	`private static extern int wc_dilithium_import_public(byte[] input, uint inputLen, IntPtr key);`
`542`	`542`	`[DllImport(wolfssl_dll)]`
`543`		`- private static extern int wc_dilithium_sign_msg(byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);`
	`543`	`+ private static extern int wc_dilithium_sign_ctx_msg(byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);`
`544`	`544`	`[DllImport(wolfssl_dll)]`
`545`		`- private static extern int wc_dilithium_verify_msg(byte[] sig, uint sigLen, byte[] msg, uint msgLen, ref int res, IntPtr key);`
	`545`	`+ private static extern int wc_dilithium_verify_ctx_msg(byte[] sig, uint sigLen, byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, ref int res, IntPtr key);`
`546`	`546`	`[DllImport(wolfssl_dll)]`
`547`	`547`	`private static extern int wc_MlDsaKey_GetPrivLen(IntPtr key, ref int len);`
`548`	`548`	`[DllImport(wolfssl_dll)]`
`@@ -571,9 +571,9 @@ public class wolfcrypt`
`571`	`571`	`[DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]`
`572`	`572`	`private static extern int wc_dilithium_import_public(byte[] input, uint inputLen, IntPtr key);`
`573`	`573`	`[DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]`
`574`		`- private static extern int wc_dilithium_sign_msg(byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);`
	`574`	`+ private static extern int wc_dilithium_sign_ctx_msg(byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, byte[] sig, ref uint sigLen, IntPtr key, IntPtr rng);`
`575`	`575`	`[DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]`
`576`		`- private static extern int wc_dilithium_verify_msg(byte[] sig, uint sigLen, byte[] msg, uint msgLen, ref int res, IntPtr key);`
	`576`	`+ private static extern int wc_dilithium_verify_ctx_msg(byte[] sig, uint sigLen, byte[] ctx, byte ctxLen, byte[] msg, uint msgLen, ref int res, IntPtr key);`
`577`	`577`	`[DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]`
`578`	`578`	`private static extern int wc_MlDsaKey_GetPrivLen(IntPtr key, ref int len);`
`579`	`579`	`[DllImport(wolfssl_dll, CallingConvention = CallingConvention.Cdecl)]`
`@@ -2982,18 +2982,15 @@ public static IntPtr MlKemMakeKey(MlKemTypes type, IntPtr heap, int devId)`
`2982`	`2982`	`/// <returns>0 on success, negative value on error.</returns>`
`2983`	`2983`	`public static int MlKemFreeKey(ref IntPtr key)`
`2984`	`2984`	`{`
`2985`		`- int ret = 0;`
	`2985`	`+ int ret;`
`2986`	`2986`
`2987`	`2987`	`if (key == IntPtr.Zero)`
`2988`	`2988`	`{`
`2989`	`2989`	`return BAD_FUNC_ARG;`
`2990`	`2990`	`}`
`2991`	`2991`
`2992`		`- if (key != IntPtr.Zero)`
`2993`		`- {`
`2994`		`- ret = wc_MlKemKey_Delete(key, IntPtr.Zero);`
`2995`		`- key = IntPtr.Zero;`
`2996`		`- }`
	`2992`	`+ ret = wc_MlKemKey_Delete(key, IntPtr.Zero);`
	`2993`	`+ key = IntPtr.Zero;`
`2997`	`2994`	`return ret;`
`2998`	`2995`	`}`
`2999`	`2996`
`@@ -3017,10 +3014,10 @@ public static int MlKemEncodePublicKey(IntPtr key, out byte[] publicKey)`
`3017`	`3014`	`try`
`3018`	`3015`	`{`
`3019`	`3016`	`ret = wc_MlKemKey_PublicKeySize(key, ref pubLen);`
`3020`		`- if (ret !=0 \|\| pubLen == 0)`
	`3017`	`+ if (ret != 0 \|\| pubLen == 0)`
`3021`	`3018`	`{`
`3022`	`3019`	`log(ERROR_LOG, "Failed to get MlKem public key length. Error code: " + ret);`
`3023`		`- return ret;`
	`3020`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3024`	`3021`	`}`
`3025`	`3022`	`if (pubLen > int.MaxValue)`
`3026`	`3023`	`{`
`@@ -3066,10 +3063,10 @@ public static int MlKemEncodePrivateKey(IntPtr key, out byte[] privateKey)`
`3066`	`3063`	`try`
`3067`	`3064`	`{`
`3068`	`3065`	`ret = wc_MlKemKey_PrivateKeySize(key, ref privLen);`
`3069`		`- if (ret !=0 \|\| privLen == 0)`
	`3066`	`+ if (ret != 0 \|\| privLen == 0)`
`3070`	`3067`	`{`
`3071`	`3068`	`log(ERROR_LOG, "Failed to get MlKem private key length. Error code: " + ret);`
`3072`		`- return ret;`
	`3069`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3073`	`3070`	`}`
`3074`	`3071`	`if (privLen > int.MaxValue)`
`3075`	`3072`	`{`
`@@ -3123,14 +3120,14 @@ public static int MlKemDecodePublicKey(IntPtr key, byte[] publicKey)`
`3123`	`3120`	`if (ret != 0 \|\| pubLen == 0)`
`3124`	`3121`	`{`
`3125`	`3122`	`log(ERROR_LOG, "Failed to get MlKem public key length. Error code: " + ret);`
`3126`		`- return ret;`
	`3123`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3127`	`3124`	`}`
`3128`	`3125`	`if ((uint)publicKey.Length != pubLen)`
`3129`		`- {`
`3130`		`- log(ERROR_LOG, "MlKem public key buffer length mismatch. Expected: " +`
`3131`		`- pubLen + ", actual: " + publicKey.Length);`
`3132`		`- return BUFFER_E;`
`3133`		`- }`
	`3126`	`+ {`
	`3127`	`+ log(ERROR_LOG, "MlKem public key buffer length mismatch. Expected: " +`
	`3128`	`+ pubLen + ", actual: " + publicKey.Length);`
	`3129`	`+ return BUFFER_E;`
	`3130`	`+ }`
`3134`	`3131`
`3135`	`3132`	`ret = wc_MlKemKey_DecodePublicKey(key, publicKey, pubLen);`
`3136`	`3133`	`if (ret != 0)`
`@@ -3172,12 +3169,12 @@ public static int MlKemDecodePrivateKey(IntPtr key, byte[] privateKey)`
`3172`	`3169`	`try`
`3173`	`3170`	`{`
`3174`	`3171`	`ret = wc_MlKemKey_PrivateKeySize(key, ref privLen);`
`3175`		`- if (privLen == 0)`
	`3172`	`+ if (ret != 0 \|\| privLen == 0)`
`3176`	`3173`	`{`
`3177`	`3174`	`log(ERROR_LOG, "Failed to get MlKem private key length. Error code: " + ret);`
`3178`		`- return ret;`
	`3175`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3179`	`3176`	`}`
`3180`		`-`
	`3177`	`+`
`3181`	`3178`	`if ((uint)privateKey.Length != privLen)`
`3182`	`3179`	`{`
`3183`	`3180`	`log(ERROR_LOG, "MlKem private key buffer length mismatch. Required: " + privLen +`
`@@ -3416,18 +3413,15 @@ public static IntPtr DilithiumMakeKey(IntPtr heap, int devId, MlDsaLevels level)`
`3416`	`3413`	`/// <returns>0 on success, negative value on error.</returns>`
`3417`	`3414`	`public static int DilithiumFreeKey(ref IntPtr key)`
`3418`	`3415`	`{`
`3419`		`- int ret = 0;`
	`3416`	`+ int ret;`
`3420`	`3417`
`3421`	`3418`	`if (key == IntPtr.Zero)`
`3422`	`3419`	`{`
`3423`	`3420`	`return BAD_FUNC_ARG;`
`3424`	`3421`	`}`
`3425`	`3422`
`3426`		`- if (key != IntPtr.Zero)`
`3427`		`- {`
`3428`		`- ret = wc_dilithium_delete(key, IntPtr.Zero);`
`3429`		`- key = IntPtr.Zero;`
`3430`		`- }`
	`3423`	`+ ret = wc_dilithium_delete(key, IntPtr.Zero);`
	`3424`	`+ key = IntPtr.Zero;`
`3431`	`3425`	`return ret;`
`3432`	`3426`	`}`
`3433`	`3427`
`@@ -3500,10 +3494,10 @@ public static int DilithiumExportPrivateKey(IntPtr key, out byte[] privateKey)`
`3500`	`3494`	`try`
`3501`	`3495`	`{`
`3502`	`3496`	`ret = wc_MlDsaKey_GetPrivLen(key, ref privLen);`
`3503`		`- if (privLen <= 0)`
	`3497`	`+ if (ret != 0 \|\| privLen <= 0)`
`3504`	`3498`	`{`
`3505`	`3499`	`log(ERROR_LOG, "Failed to get Dilithium private key length. Error code: " + ret);`
`3506`		`- return ret;`
	`3500`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3507`	`3501`	`}`
`3508`	`3502`
`3509`	`3503`	`privateKey = new byte[privLen];`
`@@ -3550,10 +3544,10 @@ public static int DilithiumExportPublicKey(IntPtr key, out byte[] publicKey)`
`3550`	`3544`	`try`
`3551`	`3545`	`{`
`3552`	`3546`	`ret = wc_MlDsaKey_GetPubLen(key, ref pubLen);`
`3553`		`- if (pubLen <= 0)`
	`3547`	`+ if (ret != 0 \|\| pubLen <= 0)`
`3554`	`3548`	`{`
`3555`	`3549`	`log(ERROR_LOG, "Failed to get Dilithium public key length. Error code: " + ret);`
`3556`		`- return ret;`
	`3550`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3557`	`3551`	`}`
`3558`	`3552`
`3559`	`3553`	`publicKey = new byte[pubLen];`
`@@ -3602,10 +3596,10 @@ public static int DilithiumSignMsg(IntPtr key, byte[] msg, out byte[] sig)`
`3602`	`3596`	`try`
`3603`	`3597`	`{`
`3604`	`3598`	`ret = wc_MlDsaKey_GetSigLen(key, ref sigLen);`
`3605`		`- if (sigLen <= 0)`
	`3599`	`+ if (ret != 0 \|\| sigLen <= 0)`
`3606`	`3600`	`{`
`3607`	`3601`	`log(ERROR_LOG, "Failed to get Dilithium signature length. Error code: " + ret);`
`3608`		`- return ret;`
	`3602`	`+ return (ret != 0) ? ret : BAD_FUNC_ARG;`
`3609`	`3603`	`}`
`3610`	`3604`
`3611`	`3605`	`sig = new byte[sigLen];`
`@@ -3614,9 +3608,10 @@ public static int DilithiumSignMsg(IntPtr key, byte[] msg, out byte[] sig)`
`3614`	`3608`	`if (rng == IntPtr.Zero)`
`3615`	`3609`	`{`
`3616`	`3610`	`log(ERROR_LOG, "Failed to create RNG for Dilithium signing.");`
`3617`		`- return EXCEPTION_E;`
	`3611`	`+ return MEMORY_E;`
`3618`	`3612`	`}`
`3619`		`- ret = wc_dilithium_sign_msg(msg, (uint)msg.Length, sig, ref outLen, key, rng);`
	`3613`	`+ /* FIPS 204 sign with empty context (ctx=null, ctxLen=0). */`
	`3614`	`+ ret = wc_dilithium_sign_ctx_msg(null, 0, msg, (uint)msg.Length, sig, ref outLen, key, rng);`
`3620`	`3615`	`if (ret != 0)`
`3621`	`3616`	`{`
`3622`	`3617`	`log(ERROR_LOG, "Failed to sign message with Dilithium key. Error code: " + ret);`
`@@ -3660,7 +3655,8 @@ public static int DilithiumVerifyMsg(IntPtr key, byte[] msg, byte[] sig)`
`3660`	`3655`
`3661`	`3656`	`try`
`3662`	`3657`	`{`
`3663`		`- ret = wc_dilithium_verify_msg(sig, (uint)sig.Length, msg, (uint)msg.Length, ref res, key);`
	`3658`	`+ /* FIPS 204 verify with empty context (ctx=null, ctxLen=0). */`
	`3659`	`+ ret = wc_dilithium_verify_ctx_msg(sig, (uint)sig.Length, null, 0, msg, (uint)msg.Length, ref res, key);`
`3664`	`3660`	`if (ret != 0)`
`3665`	`3661`	`{`
`3666`	`3662`	`log(ERROR_LOG, "Failed to verify message with Dilithium key. Error code: " + ret);`
Original file line number	Diff line number	Diff line change
`@@ -795,8 +795,6 @@ public enum NamedGroup`
`795`	`795`	`WOLFSSL_SECP521R1MLKEM1024 = 12109,`
`796`	`796`	`WOLFSSL_X25519MLKEM512 = 12214,`
`797`	`797`	`WOLFSSL_X448MLKEM768 = 12215,`
`798`		`-`
`799`		`- WOLF_ENUM_DUMMY_LAST_ELEMENT = 0`
`800`	`798`	`}`
`801`	`799`
`802`	`800`