Skip to content

Commit c3289f8

Browse files
FrauschiFrauschi
committed
Enable and use ML-KEM by default
* Enable ML-KEM by default in build systems (autoconf and CMake) * Only allow three to-be-standardized hybrid PQ/T combinations by default * Use X25519MLKEM768 as the default KeyShare in the ClientHello (if user does not override that). When Curve25519 is disabled, then either WOLFSSL_SECP384R1MLKEM1024 or WOLFSSL_SECP256R1MLKEM768 is used as default depending on the ECC configuration * Disable standalone ML-KEM in supported groups by default (enable with --enable-tls-mlkem-standalone) * Disable extra OQS-based hybrid PQ/T curves by default and gate behind --enable-experimental (enable with --enable-extra-pqc-hybrids) * Reorder the SupportedGroups extension to reflect the preferences * Reorder the preferredGroup array to also reflect the same preferences * Add async support for ML-KEM hybrids
1 parent 8169780 commit c3289f8

38 files changed

Lines changed: 1436 additions & 850 deletions

‎.github/workflows/async.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21+
'--enable-asynccrypt --enable-all --enable-dtls13 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
22+
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
23+
'--enable-asynccrypt --enable-all --enable-dtls13 --disable-pqc-hybrids --enable-tls-mlkem-standalone CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
24+
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-pqc-hybrids --enable-tls-mlkem-standalone CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
2125
'--enable-asynccrypt --enable-all --enable-dtls13 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
2226
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
2327
'--enable-ocsp CFLAGS="-DTEST_NONBLOCK_CERTS -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',

‎.github/workflows/cmake.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ jobs:
7373
-DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \
7474
-DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
7575
-DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \
76+
-DWOLFSSL_EXTRA_PQC_HYBRIDS:BOOL=yes -DWOLFSSL_TLS_NO_MLKEM_STANDALONE:BOOL=no \
7677
..
7778
cmake --build .
7879
ctest -j $(nproc)

‎.github/workflows/os-check.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@ jobs:
3838
'--enable-experimental --enable-kyber --enable-dtls --enable-dtls13
3939
--enable-dtls-frag-ch',
4040
'--enable-all --enable-dtls13 --enable-dtls-frag-ch',
41+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch --disable-mlkem',
42+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
43+
--enable-tls-mlkem-standalone',
44+
'--enable-all --enable-dtls13 --enable-dtls-frag-ch
45+
--enable-tls-mlkem-standalone --enable-experimental
46+
--enable-extra-pqc-hybrids',
4147
'--enable-dtls --enable-dtls13 --enable-dtls-frag-ch
4248
--enable-dtls-mtu',
4349
'--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation

‎.github/workflows/pq-all.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,13 @@ jobs:
2727
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-slhdsa --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"',
2828
'--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
2929
'--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"',
30-
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
30+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3131
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
32+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
33+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3234
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
35+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
36+
'--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --enable-tls-mlkem-standalone --disable-pqc-hybrids --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
3337
]
3438
name: make check
3539
if: github.repository_owner == 'wolfssl'

‎.github/workflows/psk.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21-
'--enable-psk C_EXTRA_FLAGS="-DWOLFSSL_STATIC_PSK -DWOLFSSL_OLDTLS_SHA2_CIPHERSUITES"',
22-
'--enable-psk C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh',
23-
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all',
24-
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all'
21+
'--enable-psk --disable-mlkem C_EXTRA_FLAGS="-DWOLFSSL_STATIC_PSK -DWOLFSSL_OLDTLS_SHA2_CIPHERSUITES"',
22+
'--enable-psk --disable-mlkem C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --disable-rsa --disable-ecc --disable-dh',
23+
'--disable-oldtls --disable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem',
24+
'--disable-oldtls --disable-tlsv12 --enable-tls13 --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding --disable-sp-math-all --disable-mlkem'
2525
]
2626
name: make check
2727
if: github.repository_owner == 'wolfssl'

‎.github/workflows/rust-wrapper.yml‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -41,36 +41,36 @@ jobs:
4141
'--enable-all --enable-dilithium',
4242
'--enable-all --enable-mlkem',
4343
'--enable-cryptonly --disable-examples',
44-
'--enable-cryptonly --disable-examples --disable-aes --disable-aesgcm',
45-
'--enable-cryptonly --disable-examples --disable-aescbc',
46-
'--enable-cryptonly --disable-examples --disable-aeseax',
47-
'--enable-cryptonly --disable-examples --disable-aesecb',
48-
'--enable-cryptonly --disable-examples --disable-aesccm',
49-
'--enable-cryptonly --disable-examples --disable-aescfb',
50-
'--enable-cryptonly --disable-examples --disable-aesctr',
51-
'--enable-cryptonly --disable-examples --disable-aescts',
52-
'--enable-cryptonly --disable-examples --disable-aesgcm',
53-
'--enable-cryptonly --disable-examples --disable-aesgcm-stream',
54-
'--enable-cryptonly --disable-examples --disable-aesofb',
55-
'--enable-cryptonly --disable-examples --disable-aesxts',
56-
'--enable-cryptonly --disable-examples --disable-cmac',
57-
'--enable-cryptonly --disable-examples --disable-dh',
58-
'--enable-cryptonly --disable-examples --disable-ecc',
59-
'--enable-cryptonly --disable-examples --disable-ed25519',
60-
'--enable-cryptonly --disable-examples --disable-ed25519-stream',
61-
'--enable-cryptonly --disable-examples --disable-ed448',
62-
'--enable-cryptonly --disable-examples --disable-ed448-stream',
63-
'--enable-cryptonly --disable-examples --disable-hkdf',
64-
'--enable-cryptonly --disable-examples --disable-hmac',
65-
'--enable-cryptonly --disable-examples --disable-rng',
66-
'--enable-cryptonly --disable-examples --disable-rsa',
67-
'--enable-cryptonly --disable-examples --disable-rsapss',
68-
'--enable-cryptonly --disable-examples --disable-sha224',
69-
'--enable-cryptonly --disable-examples --disable-sha3',
70-
'--enable-cryptonly --disable-examples --disable-sha384',
71-
'--enable-cryptonly --disable-examples --disable-sha512',
72-
'--enable-cryptonly --disable-examples --disable-shake128',
73-
'--enable-cryptonly --disable-examples --disable-shake256',
74-
'--enable-cryptonly --disable-examples --disable-srtp-kdf',
75-
'--enable-cryptonly --disable-examples --disable-x963kdf',
44+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aes --disable-aesgcm',
45+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescbc',
46+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aeseax',
47+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesecb',
48+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesccm',
49+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescfb',
50+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesctr',
51+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aescts',
52+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm',
53+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesgcm-stream',
54+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesofb',
55+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-aesxts',
56+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-cmac',
57+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-dh',
58+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ecc',
59+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519',
60+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed25519-stream',
61+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448',
62+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-ed448-stream',
63+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hkdf',
64+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-hmac',
65+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rng',
66+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsa',
67+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-rsapss',
68+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha224',
69+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha3',
70+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha384',
71+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-sha512',
72+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake128',
73+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-shake256',
74+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-srtp-kdf',
75+
'--enable-cryptonly --disable-examples --disable-mlkem --disable-x963kdf',
7676
]

‎.github/workflows/zephyr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
if: github.repository_owner == 'wolfssl'
2929
runs-on: ubuntu-22.04
3030
# This should be a safe limit for the tests to run.
31-
timeout-minutes: 25
31+
timeout-minutes: 45
3232
steps:
3333
- name: Install dependencies
3434
run: |

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,7 @@ CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFSSH_ECHOSERVER
174174
CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFSSH_TEMPLATE
175175
CONFIG_WOLFSSL_HKDF
176176
CONFIG_WOLFSSL_MAX_FRAGMENT_LEN
177+
CONFIG_WOLFSSL_MLKEM
177178
CONFIG_WOLFSSL_NO_ASN_STRICT
178179
CONFIG_WOLFSSL_PSK
179180
CONFIG_WOLFSSL_RSA_PSS

‎CMakeLists.txt‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,7 +610,7 @@ add_option(WOLFSSL_OQS
610610
# ML-KEM/Kyber
611611
add_option(WOLFSSL_MLKEM
612612
"Enable the wolfSSL PQ ML-KEM library (default: disabled)"
613-
"no" "yes;no")
613+
"yes" "yes;no")
614614

615615
if (WOLFSSL_MLKEM)
616616
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MLKEM")
@@ -626,6 +626,32 @@ if (WOLFSSL_MLKEM)
626626
set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT)
627627
endif()
628628

629+
# When MLKEM and DTLS 1.3 are both enabled, DTLS ClientHello fragmenting is
630+
# required (PQC keys in ClientHello can exceed MTU), so enable it automatically.
631+
if(WOLFSSL_MLKEM AND WOLFSSL_DTLS13 AND NOT WOLFSSL_DTLS_CH_FRAG)
632+
message(STATUS "MLKEM and DTLS 1.3 are enabled; enabling DTLS ClientHello fragmenting")
633+
override_cache(WOLFSSL_DTLS_CH_FRAG "yes")
634+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
635+
endif()
636+
637+
# Disable ML-KEM as standalone TLS key exchange (non-hybrid); when enabled (default), standalone is disabled
638+
add_option(WOLFSSL_TLS_NO_MLKEM_STANDALONE
639+
"Disable ML-KEM as standalone TLS key exchange (non-hybrid) (default: enabled, i.e. standalone disabled)"
640+
"yes" "yes;no")
641+
642+
if (WOLFSSL_TLS_NO_MLKEM_STANDALONE)
643+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_TLS_NO_MLKEM_STANDALONE")
644+
endif()
645+
646+
# PQ/T hybrid combinations
647+
add_option(WOLFSSL_PQC_HYBRIDS
648+
"Enable PQ/T hybrid combinations (default: enabled)"
649+
"yes" "yes;no")
650+
651+
if (WOLFSSL_PQC_HYBRIDS)
652+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PQC_HYBRIDS")
653+
endif()
654+
629655
# Dilithium
630656
add_option(WOLFSSL_DILITHIUM
631657
"Enable the wolfSSL PQ Dilithium (ML-DSA) implementation (default: disabled)"
@@ -675,6 +701,10 @@ add_option(WOLFSSL_EXPERIMENTAL
675701
"Enable experimental features (default: disabled)"
676702
"no" "yes;no")
677703

704+
add_option(WOLFSSL_EXTRA_PQC_HYBRIDS
705+
"Enable extra PQ/T hybrid combinations (default: disabled)"
706+
"no" "yes;no")
707+
678708
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL")
679709
if (WOLFSSL_EXPERIMENTAL)
680710
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - found")
@@ -710,6 +740,16 @@ if (WOLFSSL_EXPERIMENTAL)
710740
message(STATUS "Looking for WOLFSSL_OQS - not found")
711741
endif()
712742

743+
# Checking for experimental feature: extra PQ/T hybrid combinations
744+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS")
745+
if (WOLFSSL_EXTRA_PQC_HYBRIDS)
746+
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
747+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - found")
748+
list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_EXTRA_PQC_HYBRIDS")
749+
else()
750+
message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - not found")
751+
endif()
752+
713753
# Other experimental feature detection can be added here...
714754

715755
# Were any experimental features found? Display a message.

‎IDE/WIN10/wolfssl-fips.vcxproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,8 @@
292292
<ClCompile Include="..\..\wolfcrypt\src\logging.c" />
293293
<ClCompile Include="..\..\wolfcrypt\src\md5.c" />
294294
<ClCompile Include="..\..\wolfcrypt\src\memory.c" />
295+
<ClCompile Include="..\..\wolfcrypt\src\wc_mlkem.c" />
296+
<ClCompile Include="..\..\wolfcrypt\src\wc_mlkem_poly.c" />
295297
<ClCompile Include="..\..\src\ocsp.c" />
296298
<ClCompile Include="..\..\wolfcrypt\src\sha3.c" />
297299
<ClCompile Include="..\..\wolfcrypt\src\sp_c32.c" />

0 commit comments

Comments
 (0)