From 10b98733f24547ca6cd0d829c4b5f5b8bababb64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Tue, 17 Feb 2026 15:45:27 +0100 Subject: [PATCH] Add tests for individual ML-KEM levels (based on #9777) Also fix minor problems found with these tests --- .github/workflows/pq-all.yml | 3 +++ src/tls.c | 17 ++++++++++++----- tests/api.c | 29 +++++++++++++++++++++-------- tests/api/test_tls13.c | 16 ++++++++-------- wolfssl/internal.h | 2 +- 5 files changed, 45 insertions(+), 22 deletions(-) diff --git a/.github/workflows/pq-all.yml b/.github/workflows/pq-all.yml index 3b724a30ba..cabd5f367c 100644 --- a/.github/workflows/pq-all.yml +++ b/.github/workflows/pq-all.yml @@ -27,6 +27,9 @@ jobs: '--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem --enable-lms --enable-xmss --enable-slhdsa --enable-dilithium --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ"', '--disable-intelasm --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"', '--disable-intelasm --enable-smallstack --enable-smallstackcache --enable-all --enable-testcert --enable-acert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-quic --with-sys-crypto-policy --enable-experimental --enable-mlkem=yes,kyber,ml-kem,small --enable-lms=yes,small --enable-xmss=yes,small --enable-slhdsa=yes,small --enable-dilithium=yes,small --enable-dual-alg-certs --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_DILITHIUM_SIGN_SMALL_MEM -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_MAKE_KEY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_LARGE_CODE"', + '--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,512 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"', + '--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,768 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"', + '--enable-intelasm --enable-sp-asm --enable-all --enable-testcert --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch --enable-dtlscid --enable-mlkem=make,enc,dec,1024 --disable-qt CPPFLAGS="-pedantic -Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"', ] name: make check if: github.repository_owner == 'wolfssl' diff --git a/src/tls.c b/src/tls.c index 951918579a..a4dc98e592 100644 --- a/src/tls.c +++ b/src/tls.c @@ -10878,11 +10878,18 @@ int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, word16 len, byte* data, } else if (ssl->options.side == WOLFSSL_SERVER_END && WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group)) { - ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl, - keyShareEntry, - data, len); - if (ret != 0) - return ret; + if (TLSX_IsGroupSupported(group)) { + ret = TLSX_KeyShare_HandlePqcHybridKeyServer((WOLFSSL*)ssl, + keyShareEntry, + data, len); + if (ret != 0) + return ret; + } + else { + XFREE(keyShareEntry->ke, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY); + keyShareEntry->ke = NULL; + keyShareEntry->keLen = 0; + } } else #endif diff --git a/tests/api.c b/tests/api.c index 2527fd756d..573a916a67 100644 --- a/tests/api.c +++ b/tests/api.c @@ -32024,10 +32024,28 @@ static int test_dtls13_frag_ch_pq(void) const char *test_str = "test"; int test_str_size; byte buf[255]; -#ifdef WOLFSSL_MLKEM_KYBER +#if defined(WOLFSSL_MLKEM_KYBER) + #if !defined(WOLFSSL_NO_KYBER1024) int group = WOLFSSL_KYBER_LEVEL5; + const char *group_name = "KYBER_LEVEL5"; + #elif !defined(WOLFSSL_NO_KYBER768) + int group = WOLFSSL_KYBER_LEVEL3; + const char *group_name = "KYBER_LEVEL3"; + #else + int group = WOLFSSL_KYBER_LEVEL1; + const char *group_name = "KYBER_LEVEL1"; + #endif #else + #if !defined(WOLFSSL_NO_ML_KEM_1024) int group = WOLFSSL_ML_KEM_1024; + const char *group_name = "ML_KEM_1024"; + #elif !defined(WOLFSSL_NO_ML_KEM_768) + int group = WOLFSSL_ML_KEM_768; + const char *group_name = "ML_KEM_768"; + #else + int group = WOLFSSL_ML_KEM_512; + const char *group_name = "ML_KEM_512"; + #endif #endif XMEMSET(&test_ctx, 0, sizeof(test_ctx)); @@ -32038,13 +32056,8 @@ static int test_dtls13_frag_ch_pq(void) ExpectIntEQ(wolfSSL_UseKeyShare(ssl_c, group), WOLFSSL_SUCCESS); ExpectIntEQ(wolfSSL_dtls13_allow_ch_frag(ssl_s, 1), WOLFSSL_SUCCESS); ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0); -#ifdef WOLFSSL_MLKEM_KYBER - ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "KYBER_LEVEL5"); - ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "KYBER_LEVEL5"); -#else - ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), "ML_KEM_1024"); - ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), "ML_KEM_1024"); -#endif + ExpectStrEQ(wolfSSL_get_curve_name(ssl_c), group_name); + ExpectStrEQ(wolfSSL_get_curve_name(ssl_s), group_name); test_str_size = XSTRLEN("test") + 1; ExpectIntEQ(wolfSSL_write(ssl_c, test_str, test_str_size), test_str_size); ExpectIntEQ(wolfSSL_read(ssl_s, buf, sizeof(buf)), test_str_size); diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c index c2ab587383..6e5b1930e5 100644 --- a/tests/api/test_tls13.c +++ b/tests/api/test_tls13.c @@ -149,15 +149,15 @@ int test_tls13_apis(void) ":P256_KYBER_LEVEL1" #elif !defined(WOLFSSL_NO_KYBER768) ":P256_KYBER_LEVEL3" - #else + #elif !defined(WOLFSSL_NO_KYBER1024) ":P256_KYBER_LEVEL5" #endif #else - #ifndef WOLFSSL_NO_KYBER512 + #ifndef WOLFSSL_NO_ML_KEM_512 ":SecP256r1MLKEM512" - #elif !defined(WOLFSSL_NO_KYBER768) + #elif !defined(WOLFSSL_NO_ML_KEM_768) ":SecP384r1MLKEM768" - #else + #elif !defined(WOLFSSL_NO_ML_KEM_1024) ":SecP521r1MLKEM1024" #endif #endif @@ -173,15 +173,15 @@ int test_tls13_apis(void) ":KYBER_LEVEL1" #elif !defined(WOLFSSL_NO_KYBER768) ":KYBER_LEVEL3" - #else + #elif !defined(WOLFSSL_NO_KYBER1024) ":KYBER_LEVEL5" #endif #else - #ifndef WOLFSSL_NO_KYBER512 + #ifndef WOLFSSL_NO_ML_KEM_512 ":ML_KEM_512" - #elif !defined(WOLFSSL_NO_KYBER768) + #elif !defined(WOLFSSL_NO_ML_KEM_768) ":ML_KEM_768" - #else + #elif !defined(WOLFSSL_NO_ML_KEM_1024) ":ML_KEM_1024" #endif #endif diff --git a/wolfssl/internal.h b/wolfssl/internal.h index 74c65432de..e40ded4e7d 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -1742,7 +1742,7 @@ enum Misc { ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */ #endif MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */ - MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */ + MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */ NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */ RSA_PSS_RSAE_SHA256_MINOR = 0x04,