diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index f188b6f30c..5dd9e699d9 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -58,7 +58,7 @@ jobs:
-DWOLFSSL_OAEP:BOOL=yes -DWOLFSSL_OCSP:BOOL=yes -DWOLFSSL_OCSPSTAPLING:BOOL=ON \
-DWOLFSSL_OCSPSTAPLING_V2:BOOL=ON -DWOLFSSL_OLD_NAMES:BOOL=yes -DWOLFSSL_OLD_TLS:BOOL=yes \
-DWOLFSSL_OPENSSLALL:BOOL=yes -DWOLFSSL_OPENSSLEXTRA:BOOL=ON -DWOLFSSL_OPTFLAGS:BOOL=yes \
- -DWOLFSSL_OQS:BOOL=no -DWOLFSSL_PKCALLBACKS:BOOL=yes -DWOLFSSL_PKCS12:BOOL=yes \
+ -DWOLFSSL_PKCALLBACKS:BOOL=yes -DWOLFSSL_PKCS12:BOOL=yes \
-DWOLFSSL_PKCS7:BOOL=yes -DWOLFSSL_POLY1305:BOOL=yes -DWOLFSSL_POSTAUTH:BOOL=yes \
-DWOLFSSL_PWDBASED:BOOL=yes -DWOLFSSL_QUIC:BOOL=yes -DWOLFSSL_REPRODUCIBLE_BUILD:BOOL=no \
-DWOLFSSL_RNG:BOOL=yes -DWOLFSSL_RSA:BOOL=yes -DWOLFSSL_RSA_PSS:BOOL=yes \
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 519106b23e..7573095ec6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -917,16 +917,6 @@ endif()
set(WOLFSSL_SLOW_MATH "yes")
-# liboqs
-add_option(WOLFSSL_OQS
- "Enable integration with the OQS (Open Quantum Safe) liboqs library (default: disabled)"
- "no" "yes;no")
-
-# Falcon (provided via liboqs)
-add_option(WOLFSSL_FALCON
- "Enable Falcon post-quantum signatures via liboqs (default: disabled)"
- "no" "yes;no")
-
# ML-KEM/Kyber
add_option(WOLFSSL_MLKEM
"Enable the wolfSSL PQ ML-KEM library (default: disabled)"
@@ -1143,39 +1133,10 @@ if (WOLFSSL_EXPERIMENTAL)
set_wolfssl_definitions("WOLFSSL_EXPERIMENTAL_SETTINGS" RESULT)
- # Cross-validate WOLFSSL_OQS and WOLFSSL_FALCON: liboqs is only linked
- # when a liboqs-backed algorithm (Falcon) is actually enabled.
- if (WOLFSSL_FALCON AND NOT WOLFSSL_OQS)
- message(FATAL_ERROR "WOLFSSL_FALCON requires WOLFSSL_OQS.")
- endif()
- if (WOLFSSL_OQS AND NOT WOLFSSL_FALCON)
- message(FATAL_ERROR "WOLFSSL_OQS requires WOLFSSL_FALCON.")
- endif()
-
- # Checking for experimental feature: OQS
- message(STATUS "Looking for WOLFSSL_OQS")
- if (WOLFSSL_OQS)
+ # Native Falcon (FN-DSA) is an experimental feature (unstandardized; API
+ # name subject to change). It has no liboqs dependency.
+ if (WOLFSSL_FALCON)
set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
- message(STATUS "Looking for WOLFSSL_OQS - found")
-
- message(STATUS "Checking OQS")
- find_package(OQS)
- if (OQS_FOUND)
- message(STATUS "Checking OQS - found")
- list(APPEND WOLFSSL_LINK_LIBS ${OQS_LIBRARY})
- list(APPEND WOLFSSL_INCLUDE_DIRS ${OQS_INCLUDE_DIR})
-
- set_wolfssl_definitions("HAVE_LIBOQS" RESULT)
- set_wolfssl_definitions("HAVE_TLS_EXTENSIONS" RESULT)
- set_wolfssl_definitions("OPENSSL_EXTRA" RESULT)
- set_wolfssl_definitions("HAVE_FALCON" RESULT)
-
- else()
- message(STATUS "Checking OQS - not found")
- message(STATUS "WARNING: WOLFSSL_OQS enabled but not found: OQS_LIBRARY=${OQS_LIBRARY}, OQS_INCLUDE_DIR=${OQS_INCLUDE_DIR} ")
- endif()
- else()
- message(STATUS "Looking for WOLFSSL_OQS - not found")
endif()
# Checking for experimental feature: extra PQ/T hybrid combinations
@@ -1292,9 +1253,6 @@ if (WOLFSSL_EXPERIMENTAL)
else()
# Experimental mode not enabled, but were any experimental features enabled? Error out if so:
message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - not found")
- if (WOLFSSL_OQS)
- message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
- endif()
if (WOLFSSL_FALCON)
message(FATAL_ERROR "Error: WOLFSSL_FALCON requires WOLFSSL_EXPERIMENTAL at this time.")
endif()
diff --git a/Docker/Dockerfile b/Docker/Dockerfile
index d5b4832110..41f256a311 100644
--- a/Docker/Dockerfile
+++ b/Docker/Dockerfile
@@ -28,10 +28,6 @@ RUN ssh -o StrictHostKeyChecking=no -T git@github.com; cat ~/.ssh/known_hosts >>
RUN mkdir -p /opt/ccache/bin && for prog in gcc g++ cc c++ cpp arm-none-eabi-c++ arm-none-eabi-cpp arm-none-eabi-gcc arm-none-eabi-g++; do ln -s /usr/bin/ccache /opt/ccache/bin/$(basename $prog); done
ENV PATH /opt/ccache/bin:$PATH
-# install liboqs
-RUN git clone --single-branch https://github.com/open-quantum-safe/liboqs.git && cd liboqs && git checkout db08f12b5a96aa6582a82aac7f65cf8a4d8b231f \
- && mkdir build && cd build && cmake -DOQS_DIST_BUILD=ON -DOQS_USE_CPUFEATURE_INSTRUCTIONS=OFF -DOQS_USE_OPENSSL=0 .. && make -j8 all && make install && cd ../.. && rm -rf liboqs
-
RUN mkdir /opt/sources
# Install pkixssh to /opt/pkixssh for X509 interop testing with wolfSSH
diff --git a/IDE/INTIME-RTOS/Makefile b/IDE/INTIME-RTOS/Makefile
index 1157b93fce..783bf8f171 100644
--- a/IDE/INTIME-RTOS/Makefile
+++ b/IDE/INTIME-RTOS/Makefile
@@ -373,7 +373,6 @@ INCL_TARGS := wolfssl/callbacks.h \
wolfssl/wolfcrypt/port/kcapi/kcapi_hmac.h \
wolfssl/wolfcrypt/port/kcapi/kcapi_rsa.h \
wolfssl/wolfcrypt/port/kcapi/wc_kcapi.h \
- wolfssl/wolfcrypt/port/liboqs/liboqs.h \
wolfssl/wolfcrypt/port/maxim/maxq10xx.h \
wolfssl/wolfcrypt/port/nxp/dcp_port.h \
wolfssl/wolfcrypt/port/nxp/ksdk_port.h \
@@ -432,7 +431,6 @@ prodeng: "$(PROD_ENG)/rt/include/wolfssl572/wolfssl" "$(PROD_ENG)/rt/include/wol
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/cavium" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/cypress" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/devcrypto" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/espressif" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/intel" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/iotsafe" \
- "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/kcapi" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/liboqs" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/maxim" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/nxp" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/pic32" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/psa" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/Renesas" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/riscv" \
@@ -473,7 +471,6 @@ done
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/intel" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/iotsafe" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/kcapi" \
-"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/liboqs" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/maxim" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/nxp" \
"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/pic32" \
diff --git a/IDE/INTIME-RTOS/libwolfssl.vcxproj b/IDE/INTIME-RTOS/libwolfssl.vcxproj
index 4c238d4ac5..7225936a97 100644
--- a/IDE/INTIME-RTOS/libwolfssl.vcxproj
+++ b/IDE/INTIME-RTOS/libwolfssl.vcxproj
@@ -94,7 +94,6 @@
-
diff --git a/INSTALL b/INSTALL
index 058b5a1edf..aeefb8ce15 100644
--- a/INSTALL
+++ b/INSTALL
@@ -256,10 +256,12 @@
- ML-DSA (FIPS 204, CRYSTALS-Dilithium) (signature scheme)
- SLH-DSA (FIPS 205, SPHINCS+) (signature scheme)
- Falcon (signature scheme) is still provided through liboqs integration.
- To enable it, pass both --with-liboqs and --enable-falcon to configure
- (CMake: -DWOLFSSL_OQS=yes -DWOLFSSL_FALCON=yes). Passing --with-liboqs
- without --enable-falcon (or vice versa) is now an error.
+ Falcon (signature scheme) is provided by the native wolfSSL
+ implementation; liboqs is no longer required or supported. NIST is
+ standardizing Falcon as FN-DSA (FIPS 206, still a draft). Because it is
+ not yet standardized and its API name is subject to change, enable it with
+ --enable-falcon --enable-experimental (CMake: -DWOLFSSL_FALCON=yes
+ -DWOLFSSL_EXPERIMENTAL=yes).
The following NIST Competition Round 3 finalist algorithms were supported,
but have been removed after 5.3.3
diff --git a/cmake/functions.cmake b/cmake/functions.cmake
index b535edcc9e..6fdfad8954 100644
--- a/cmake/functions.cmake
+++ b/cmake/functions.cmake
@@ -264,7 +264,6 @@ function(generate_build_flags)
endif()
if(WOLFSSL_FALCON OR WOLFSSL_USER_SETTINGS)
set(BUILD_FALCON "yes" PARENT_SCOPE)
- set(BUILD_OQS_HELPER "yes" PARENT_SCOPE)
endif()
if(WOLFSSL_LMS OR WOLFSSL_USER_SETTINGS)
set(BUILD_WC_LMS "yes" PARENT_SCOPE)
@@ -832,11 +831,6 @@ function(generate_lib_src_list LIB_SOURCES)
wolfcrypt/src/wc_port.c
wolfcrypt/src/error.c)
- if(BUILD_OQS_HELPER)
- list(APPEND LIB_SOURCES
- wolfcrypt/src/port/liboqs/liboqs.c)
- endif()
-
if(BUILD_ARIA)
list(APPEND LIB_SOURCES
wolfcrypt/src/port/aria/aria-crypt.c
diff --git a/cmake/include.am b/cmake/include.am
index 709ffa65f2..14c23b9b19 100644
--- a/cmake/include.am
+++ b/cmake/include.am
@@ -9,7 +9,6 @@ EXTRA_DIST += cmake/config.in
EXTRA_DIST += cmake/functions.cmake
EXTRA_DIST += cmake/options.h.in
EXTRA_DIST += cmake/modules/FindARIA.cmake
-EXTRA_DIST += cmake/modules/FindOQS.cmake
if CMAKE_INSTALL
cmakedir = $(libdir)/cmake/wolfssl
diff --git a/cmake/modules/FindOQS.cmake b/cmake/modules/FindOQS.cmake
deleted file mode 100644
index 06661e446f..0000000000
--- a/cmake/modules/FindOQS.cmake
+++ /dev/null
@@ -1,20 +0,0 @@
-# Filename: FindOQS.cmake
-# Authors: darktohka (27 Jul, 2022)
-#
-# Usage:
-# find_package(OQS [REQUIRED] [QUIET])
-#
-# Once done this will define:
-# OQS_FOUND - system has liboqs
-# OQS_INCLUDE_DIR - the include directory containing oqs/
-# OQS_LIBRARY - the path to the liboqs library
-#
-
-find_path(OQS_INCLUDE_DIR NAMES "oqs/common.h")
-
-find_library(OQS_LIBRARY NAMES "oqs")
-
-mark_as_advanced(OQS_INCLUDE_DIR OQS_LIBRARY)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(OQS DEFAULT_MSG OQS_INCLUDE_DIR OQS_LIBRARY)
diff --git a/cmake/options.h.in b/cmake/options.h.in
index 085934ff50..431f2545d6 100644
--- a/cmake/options.h.in
+++ b/cmake/options.h.in
@@ -125,8 +125,6 @@ extern "C" {
#cmakedefine HAVE_HPKE
#undef HAVE_KEYING_MATERIAL
#cmakedefine HAVE_KEYING_MATERIAL
-#undef HAVE_LIBOQS
-#cmakedefine HAVE_LIBOQS
#undef HAVE_MAX_FRAGMENT
#cmakedefine HAVE_MAX_FRAGMENT
#undef HAVE_OCSP
diff --git a/configure.ac b/configure.ac
index 4f11f63e41..fee61c9c14 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1820,53 +1820,6 @@ then
fi
fi
-# liboqs
-ENABLED_LIBOQS="no"
-tryliboqsdir=""
-AC_ARG_WITH([liboqs],
- [AS_HELP_STRING([--with-liboqs=PATH],[Path to liboqs install (default /usr/local) (requires --enable-experimental)])],
- [
- AS_IF([ test "$ENABLED_EXPERIMENTAL" != "yes" ],[ AC_MSG_ERROR([LIBOQS requires --enable-experimental.]) ])
- AC_MSG_CHECKING([for liboqs])
- LIBS="$LIBS -loqs"
- AM_CFLAGS="$AM_CFLAGS -pthread"
-
- AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
-
- if test "x$liboqs_linked" = "xno" ; then
- if test "x$withval" != "xno" ; then
- tryliboqsdir=$withval
- fi
- if test "x$withval" = "xyes" ; then
- tryliboqsdir="/usr/local"
- fi
-
- CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS -I$tryliboqsdir/include -pthread"
- LDFLAGS="$AM_LDFLAGS $LDFLAGS -L$tryliboqsdir/lib"
-
- AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
-
- if test "x$liboqs_linked" = "xno" ; then
- AC_MSG_ERROR([liboqs isn't found.
- If it's already installed, specify its path using --with-liboqs=/dir/])
- fi
- AC_MSG_RESULT([yes])
- AM_CPPFLAGS="$CPPFLAGS"
- AM_LDFLAGS="$AM_LDFLAGS -L$tryliboqsdir/lib"
- else
- AC_MSG_RESULT([yes])
- fi
-
- if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
- then
- ENABLED_OPENSSLEXTRA="yes"
- AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
- fi
-
- AM_CFLAGS="$AM_CFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS"
- ENABLED_LIBOQS="yes"
- ]
-)
# Falcon (legacy name for FN-DSA, now provided by the native implementation)
# Falcon post-quantum signatures. "Falcon" is the pre-standardization name; NIST
@@ -13019,7 +12972,6 @@ AM_CONDITIONAL([BUILD_OCSP_STAPLING_MULTI],[test "x$ENABLED_CERTIFICATE_STATUS_R
AM_CONDITIONAL([BUILD_OCSP_STAPLING_V2],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xyes"])
AM_CONDITIONAL([BUILD_CRL],[test "x$ENABLED_CRL" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CRL_MONITOR],[test "x$ENABLED_CRL_MONITOR" = "xyes"])
-AM_CONDITIONAL([BUILD_LIBOQS],[test "x$ENABLED_LIBOQS" = "xyes"])
AM_CONDITIONAL([BUILD_WNR],[test "x$ENABLED_WNR" = "xyes"])
AM_CONDITIONAL([BUILD_SRP],[test "x$ENABLED_SRP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([USE_VALGRIND],[test "x$ENABLED_VALGRIND" = "xyes"])
@@ -13600,7 +13552,6 @@ echo " * Persistent session cache: $ENABLED_SAVESESSION"
echo " * Persistent cert cache: $ENABLED_SAVECERT"
echo " * Atomic User Record Layer: $ENABLED_ATOMICUSER"
echo " * Public Key Callbacks: $ENABLED_PKCALLBACKS"
-echo " * liboqs: $ENABLED_LIBOQS"
echo " * Falcon (native FN-DSA): $ENABLED_FALCON"
echo " * Whitewood netRandom: $ENABLED_WNR"
echo " * Server Name Indication: $ENABLED_SNI"
diff --git a/src/include.am b/src/include.am
index 04b39a7ea1..46a41998e1 100644
--- a/src/include.am
+++ b/src/include.am
@@ -2323,9 +2323,6 @@ if BUILD_FALCON_AVX2
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_falcon_fft_avx2.c
endif
-if BUILD_LIBOQS
-src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/liboqs/liboqs.c
-endif
if BUILD_LIBZ
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/compress.c
diff --git a/src/tls.c b/src/tls.c
index 661410b8e4..5f6498255a 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -91,7 +91,6 @@
* WOLFSSL_MLKEM_NO_MAKE_KEY: Disable ML-KEM key generation default: off
* WOLFSSL_MLKEM_NO_ENCAPSULATE: Disable ML-KEM encapsulation default: off
* WOLFSSL_MLKEM_NO_DECAPSULATE: Disable ML-KEM decapsulation default: off
- * HAVE_LIBOQS: Use liboqs for PQ algorithms default: off
*
* Curves:
* HAVE_SECRET_CALLBACK: Enable TLS secret callback default: off
@@ -4926,8 +4925,8 @@ int TLSX_IsGroupSupported(int namedGroup, int side)
#if !defined(HAVE_ECC) && !defined(HAVE_CURVE25519) && !defined(HAVE_CURVE448) \
&& !defined(HAVE_FFDHE) && !defined(WOLFSSL_HAVE_MLKEM)
-#error Elliptic Curves Extension requires Elliptic Curve Cryptography or liboqs groups. \
- Use --enable-ecc and/or --enable-liboqs in the configure script or \
+#error Elliptic Curves Extension requires Elliptic Curve Cryptography or ML-KEM groups. \
+ Use --enable-ecc and/or --enable-mlkem in the configure script or \
define HAVE_ECC. Alternatively use FFDHE for DH cipher suites.
#endif
diff --git a/wolfcrypt/src/include.am b/wolfcrypt/src/include.am
index 5125712417..fdd356e9ae 100644
--- a/wolfcrypt/src/include.am
+++ b/wolfcrypt/src/include.am
@@ -171,7 +171,6 @@ EXTRA_DIST += wolfcrypt/src/port/ti/ti-aes.c \
wolfcrypt/src/port/Renesas/README.md \
wolfcrypt/src/port/cypress/README.md \
wolfcrypt/src/port/cypress/psoc6_crypto.c \
- wolfcrypt/src/port/liboqs/liboqs.c \
wolfcrypt/src/port/maxim/max3266x.c \
wolfcrypt/src/ASN_TEMPLATE.md \
wolfcrypt/src/port/rpi_pico/pico.c \
diff --git a/wolfcrypt/src/port/liboqs/liboqs.c b/wolfcrypt/src/port/liboqs/liboqs.c
deleted file mode 100644
index 220f704c9e..0000000000
--- a/wolfcrypt/src/port/liboqs/liboqs.c
+++ /dev/null
@@ -1,136 +0,0 @@
-/* liboqs.c
- *
- * Copyright (C) 2006-2026 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include
-
-/*
-
-DESCRIPTION
-This library provides the support interfaces to the liboqs library providing
-implementations for Post-Quantum cryptography algorithms.
-
-*/
-
-#include
-
-#if defined(HAVE_LIBOQS)
-
-/* RNG for liboqs */
-static WC_RNG liboqsDefaultRNG;
-static WC_RNG* liboqsCurrentRNG;
-
-static wolfSSL_Mutex liboqsRNGMutex;
-
-static int liboqs_init = 0;
-
-
-static void wolfSSL_liboqsGetRandomData(uint8_t* buffer, size_t numOfBytes)
-{
- int ret;
- word32 numOfBytes_word32;
-
- while (numOfBytes > 0) {
- numOfBytes_word32 = (word32)numOfBytes;
- /* On platforms where size_t is wider than word32, the cast above can
- * truncate. If numOfBytes does not fit into a word32 (including the
- * case where it is an exact multiple of 2^32 and truncates to 0),
- * generate the largest chunk that fits to guarantee forward progress
- * and avoid an infinite loop. */
- if ((size_t)numOfBytes_word32 != numOfBytes) {
- numOfBytes_word32 = 0xFFFFFFFFU;
- }
- ret = wc_RNG_GenerateBlock(liboqsCurrentRNG, buffer,
- numOfBytes_word32);
- if (ret != 0) {
- /* ToDo: liboqs exits program if RNG fails,
- * not sure what to do here
- */
- WOLFSSL_MSG_EX(
- "wc_RNG_GenerateBlock(..., %u) failed with ret %d "
- "in wolfSSL_liboqsGetRandomData().", numOfBytes_word32, ret
- );
- abort();
- }
- /* Advance the buffer so subsequent iterations append rather than
- * overwrite the previously generated bytes. */
- buffer += numOfBytes_word32;
- numOfBytes -= numOfBytes_word32;
- }
-}
-
-int wolfSSL_liboqsInit(void)
-{
- int ret = 0;
-
- if (liboqs_init == 0) {
- ret = wc_InitMutex(&liboqsRNGMutex);
- if (ret != 0) {
- return ret;
- }
- ret = wc_LockMutex(&liboqsRNGMutex);
- if (ret != 0) {
- return ret;
- }
- ret = wc_InitRng(&liboqsDefaultRNG);
- if (ret == 0) {
- OQS_init();
- liboqs_init = 1;
- }
- liboqsCurrentRNG = &liboqsDefaultRNG;
- wc_UnLockMutex(&liboqsRNGMutex);
-
- OQS_randombytes_custom_algorithm(wolfSSL_liboqsGetRandomData);
- }
-
- return ret;
-}
-
-void wolfSSL_liboqsClose(void)
-{
- wc_FreeRng(&liboqsDefaultRNG);
-}
-
-int wolfSSL_liboqsRngMutexLock(WC_RNG* rng)
-{
- int ret = wolfSSL_liboqsInit();
- if (ret == 0) {
- ret = wc_LockMutex(&liboqsRNGMutex);
- }
- if (ret == 0 && rng != NULL) {
- /* Update the pointer with the RNG to use. This is safe as we locked the mutex */
- liboqsCurrentRNG = rng;
- }
- return ret;
-}
-
-int wolfSSL_liboqsRngMutexUnlock(void)
-{
- liboqsCurrentRNG = &liboqsDefaultRNG;
-
- if (liboqs_init) {
- return wc_UnLockMutex(&liboqsRNGMutex);
- }
- else {
- return BAD_MUTEX_E;
- }
-}
-
-#endif /* HAVE_LIBOQS */
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 337edba61f..418c2d7eee 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -223,9 +223,6 @@ Threading/Mutex options:
#include
#endif
-#if defined(HAVE_LIBOQS)
- #include
-#endif
#if defined(FREERTOS) && defined(WOLFSSL_ESPIDF)
#include
@@ -759,11 +756,6 @@ int wolfCrypt_Init(void)
rpcmem_init();
#endif
-#if defined(HAVE_LIBOQS)
- if ((ret = wolfSSL_liboqsInit()) != 0) {
- WOLFCRYPT_INIT_RAISE_BAD_STATE();
- }
-#endif
#undef WOLFCRYPT_INIT_RAISE_BAD_STATE
@@ -918,9 +910,6 @@ int wolfCrypt_Cleanup(void)
wc_MemZero_Free();
#endif
-#if defined(HAVE_LIBOQS)
- wolfSSL_liboqsClose();
-#endif
{
int ret2 = wc_local_InitDownDone(&wolfcrypt_init_state);
diff --git a/wolfssl-VS2022.vcxproj b/wolfssl-VS2022.vcxproj
index d6cc484bf4..9e7f78151f 100644
--- a/wolfssl-VS2022.vcxproj
+++ b/wolfssl-VS2022.vcxproj
@@ -495,7 +495,6 @@
-
diff --git a/wolfssl.vcproj b/wolfssl.vcproj
index af99fc9753..514f5209d7 100644
--- a/wolfssl.vcproj
+++ b/wolfssl.vcproj
@@ -427,10 +427,6 @@
RelativePath=".\wolfcrypt\src\wolfevent.c"
>
-
-
-
diff --git a/wolfssl/wolfcrypt/include.am b/wolfssl/wolfcrypt/include.am
index e49082f6ae..d10b3cb3dd 100644
--- a/wolfssl/wolfcrypt/include.am
+++ b/wolfssl/wolfcrypt/include.am
@@ -162,9 +162,6 @@ nobase_include_HEADERS+= wolfssl/wolfcrypt/port/aria/aria-crypt.h
nobase_include_HEADERS+= wolfssl/wolfcrypt/port/aria/aria-cryptocb.h
endif
-if BUILD_LIBOQS
-nobase_include_HEADERS+= wolfssl/wolfcrypt/port/liboqs/liboqs.h
-endif
if BUILD_ASYNCCRYPT
nobase_include_HEADERS+= wolfssl/wolfcrypt/async.h
diff --git a/wolfssl/wolfcrypt/port/liboqs/liboqs.h b/wolfssl/wolfcrypt/port/liboqs/liboqs.h
deleted file mode 100644
index cef5f2b815..0000000000
--- a/wolfssl/wolfcrypt/port/liboqs/liboqs.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* liboqs.h
- *
- * Copyright (C) 2006-2026 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
- \file wolfssl/wolfcrypt/port/liboqs/liboqs.h
-*/
-/*
-
-DESCRIPTION
-This library provides the support interfaces to the liboqs library providing
-implementations for Post-Quantum cryptography algorithms.
-*/
-
-#ifndef WOLF_CRYPT_LIBOQS_H
-#define WOLF_CRYPT_LIBOQS_H
-
-#include
-#include
-
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-#if defined(HAVE_LIBOQS)
-
-#include "oqs/oqs.h"
-
-
-int wolfSSL_liboqsInit(void);
-
-void wolfSSL_liboqsClose(void);
-
-int wolfSSL_liboqsRngMutexLock(WC_RNG* rng);
-
-int wolfSSL_liboqsRngMutexUnlock(void);
-
-#endif /* HAVE_LIBOQS */
-
-#ifdef __cplusplus
- } /* extern "C" */
-#endif
-
-#endif /* WOLF_CRYPT_LIBOQS_H */
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index 4ffa76afba..26edc5bcab 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -3703,7 +3703,7 @@
(defined(HAVE_CURVE448) && defined(HAVE_CURVE448_KEY_EXPORT)) || \
defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
defined(WOLFSSL_HAVE_FRODOKEM) || \
- defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
+ defined(WOLFSSL_HAVE_SLHDSA) || \
(defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
(defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
#define WC_ENABLE_ASYM_KEY_EXPORT
@@ -3716,7 +3716,7 @@
(defined(HAVE_CURVE448) && defined(HAVE_CURVE448_KEY_IMPORT)) || \
defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
defined(WOLFSSL_HAVE_FRODOKEM) || \
- defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
+ defined(WOLFSSL_HAVE_SLHDSA) || \
(defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
(defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
#define WC_ENABLE_ASYM_KEY_IMPORT
@@ -5174,7 +5174,7 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
* native wolfCrypt implementation in falcon.[ch] + wc_falcon*.[ch]; it no longer
* requires liboqs. HAVE_FALCON is the build gate. */
-#if (defined(HAVE_LIBOQS) || \
+#if (defined(HAVE_FALCON) || \
defined(WOLFSSL_DUAL_ALG_CERTS) || \
defined(HAVE_ASCON)) && \
!defined(WOLFSSL_EXPERIMENTAL_SETTINGS)
diff --git a/wrapper/CSharp/wolfssl.vcxproj b/wrapper/CSharp/wolfssl.vcxproj
index eea96f4983..159dcb8daa 100644
--- a/wrapper/CSharp/wolfssl.vcxproj
+++ b/wrapper/CSharp/wolfssl.vcxproj
@@ -361,7 +361,6 @@
-
diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt
index b5b8297e29..f13d724a7a 100644
--- a/zephyr/CMakeLists.txt
+++ b/zephyr/CMakeLists.txt
@@ -125,7 +125,6 @@ if(CONFIG_WOLFSSL)
zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfevent.c)
zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfmath.c)
- zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/liboqs/liboqs.c)
zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa.c)
zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_aes.c)
zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_hash.c)