Remove liboqs dependency

Falcon was the last algorithm backed by liboqs; now that wolfCrypt has a
native Falcon implementation, liboqs is no longer needed. Remove the
integration entirely so liboqs does not appear as a build or SBOM dependency:

  - configure: drop --with-liboqs (and the -loqs link), the BUILD_LIBOQS
    conditional and the summary line.
  - CMake: drop WOLFSSL_OQS, the duplicate liboqs-backed WOLFSSL_FALCON
    option, the OQS cross-validation / find_package(OQS) block, the
    FindOQS.cmake module, BUILD_OQS_HELPER, and HAVE_LIBOQS from options.h.in.
  - Remove the wolfcrypt/src/port/liboqs port layer (liboqs.c/.h) and its
    wolfSSL_liboqsInit/Close calls in wc_port.c.
  - settings.h: drop HAVE_LIBOQS from the asym key import/export aggregates
    (HAVE_FALCON already covers them) and from the experimental gate; add
    HAVE_FALCON to the experimental gate so the unstandardized Falcon requires
    WOLFSSL_EXPERIMENTAL_SETTINGS in every build system.
  - Drop liboqs.c from the VS/Zephyr/INTIME project files, remove the liboqs
    install from Docker, and update INSTALL/tls.c text (Falcon is native now).

No functional change to non-Falcon builds; the library links no liboqs.

.github/workflows/cmake.yml

@@ -58,7 +58,7 @@ jobs:
             -DWOLFSSL_OAEP:BOOL=yes -DWOLFSSL_OCSP:BOOL=yes -DWOLFSSL_OCSPSTAPLING:BOOL=ON \
             -DWOLFSSL_OCSPSTAPLING_V2:BOOL=ON -DWOLFSSL_OLD_NAMES:BOOL=yes -DWOLFSSL_OLD_TLS:BOOL=yes \
             -DWOLFSSL_OPENSSLALL:BOOL=yes -DWOLFSSL_OPENSSLEXTRA:BOOL=ON -DWOLFSSL_OPTFLAGS:BOOL=yes \
-            -DWOLFSSL_OQS:BOOL=no -DWOLFSSL_PKCALLBACKS:BOOL=yes -DWOLFSSL_PKCS12:BOOL=yes \
+            -DWOLFSSL_PKCALLBACKS:BOOL=yes -DWOLFSSL_PKCS12:BOOL=yes \
             -DWOLFSSL_PKCS7:BOOL=yes -DWOLFSSL_POLY1305:BOOL=yes -DWOLFSSL_POSTAUTH:BOOL=yes \
             -DWOLFSSL_PWDBASED:BOOL=yes -DWOLFSSL_QUIC:BOOL=yes -DWOLFSSL_REPRODUCIBLE_BUILD:BOOL=no \
             -DWOLFSSL_RNG:BOOL=yes -DWOLFSSL_RSA:BOOL=yes -DWOLFSSL_RSA_PSS:BOOL=yes \

CMakeLists.txt

@@ -917,16 +917,6 @@ endif()
 
 set(WOLFSSL_SLOW_MATH "yes")
 
-# liboqs
-add_option(WOLFSSL_OQS
-    "Enable integration with the OQS (Open Quantum Safe) liboqs library (default: disabled)"
-    "no" "yes;no")
-
-# Falcon (provided via liboqs)
-add_option(WOLFSSL_FALCON
-    "Enable Falcon post-quantum signatures via liboqs (default: disabled)"
-    "no" "yes;no")
-
 # ML-KEM/Kyber
 add_option(WOLFSSL_MLKEM
     "Enable the wolfSSL PQ ML-KEM library (default: disabled)"
@@ -1143,39 +1133,10 @@ if (WOLFSSL_EXPERIMENTAL)
 
     set_wolfssl_definitions("WOLFSSL_EXPERIMENTAL_SETTINGS" RESULT)
 
-    # Cross-validate WOLFSSL_OQS and WOLFSSL_FALCON: liboqs is only linked
+    # Native Falcon (FN-DSA) is an experimental feature (unstandardized; API
-    # when a liboqs-backed algorithm (Falcon) is actually enabled.
+    # name subject to change). It has no liboqs dependency.
-    if (WOLFSSL_FALCON AND NOT WOLFSSL_OQS)
+    if (WOLFSSL_FALCON)
-        message(FATAL_ERROR "WOLFSSL_FALCON requires WOLFSSL_OQS.")
-    endif()
-    if (WOLFSSL_OQS AND NOT WOLFSSL_FALCON)
-        message(FATAL_ERROR "WOLFSSL_OQS requires WOLFSSL_FALCON.")
-    endif()
-
-    # Checking for experimental feature: OQS
-    message(STATUS "Looking for WOLFSSL_OQS")
-    if (WOLFSSL_OQS)
         set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
-        message(STATUS "Looking for WOLFSSL_OQS - found")
-
-        message(STATUS "Checking OQS")
-        find_package(OQS)
-        if (OQS_FOUND)
-            message(STATUS "Checking OQS - found")
-            list(APPEND WOLFSSL_LINK_LIBS ${OQS_LIBRARY})
-            list(APPEND WOLFSSL_INCLUDE_DIRS ${OQS_INCLUDE_DIR})
-
-            set_wolfssl_definitions("HAVE_LIBOQS"          RESULT)
-            set_wolfssl_definitions("HAVE_TLS_EXTENSIONS"  RESULT)
-            set_wolfssl_definitions("OPENSSL_EXTRA"        RESULT)
-            set_wolfssl_definitions("HAVE_FALCON"          RESULT)
-
-        else()
-            message(STATUS "Checking OQS - not found")
-            message(STATUS "WARNING: WOLFSSL_OQS enabled but not found: OQS_LIBRARY=${OQS_LIBRARY}, OQS_INCLUDE_DIR=${OQS_INCLUDE_DIR} ")
-        endif()
-    else()
-        message(STATUS "Looking for WOLFSSL_OQS - not found")
     endif()
 
     # Checking for experimental feature: extra PQ/T hybrid combinations
@@ -1292,9 +1253,6 @@ if (WOLFSSL_EXPERIMENTAL)
 else()
     # Experimental mode not enabled, but were any experimental features enabled? Error out if so:
     message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - not found")
-    if (WOLFSSL_OQS)
-        message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
-    endif()
     if (WOLFSSL_FALCON)
         message(FATAL_ERROR "Error: WOLFSSL_FALCON requires WOLFSSL_EXPERIMENTAL at this time.")
     endif()

Docker/Dockerfile

@@ -28,10 +28,6 @@ RUN ssh -o StrictHostKeyChecking=no -T git@github.com; cat ~/.ssh/known_hosts >>
 RUN mkdir -p /opt/ccache/bin && for prog in gcc g++ cc c++ cpp arm-none-eabi-c++ arm-none-eabi-cpp arm-none-eabi-gcc arm-none-eabi-g++; do ln -s /usr/bin/ccache /opt/ccache/bin/$(basename $prog); done
 ENV PATH /opt/ccache/bin:$PATH
 
-# install liboqs
-RUN git clone --single-branch https://github.com/open-quantum-safe/liboqs.git && cd liboqs && git checkout db08f12b5a96aa6582a82aac7f65cf8a4d8b231f \
-    && mkdir build && cd build && cmake -DOQS_DIST_BUILD=ON -DOQS_USE_CPUFEATURE_INSTRUCTIONS=OFF -DOQS_USE_OPENSSL=0 .. && make -j8 all && make install && cd ../.. && rm -rf liboqs
-
 RUN mkdir /opt/sources
 
 # Install pkixssh to /opt/pkixssh for X509 interop testing with wolfSSH

IDE/INTIME-RTOS/Makefile

@@ -373,7 +373,6 @@ INCL_TARGS := 	wolfssl/callbacks.h \
 	wolfssl/wolfcrypt/port/kcapi/kcapi_hmac.h \
 	wolfssl/wolfcrypt/port/kcapi/kcapi_rsa.h \
 	wolfssl/wolfcrypt/port/kcapi/wc_kcapi.h \
-	wolfssl/wolfcrypt/port/liboqs/liboqs.h \
 	wolfssl/wolfcrypt/port/maxim/maxq10xx.h \
 	wolfssl/wolfcrypt/port/nxp/dcp_port.h \
 	wolfssl/wolfcrypt/port/nxp/ksdk_port.h \
@@ -432,7 +431,6 @@ prodeng: "$(PROD_ENG)/rt/include/wolfssl572/wolfssl" "$(PROD_ENG)/rt/include/wol
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/cavium" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/cypress" \
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/devcrypto" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/espressif" \
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/intel" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/iotsafe" \
-	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/kcapi" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/liboqs" \
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/maxim" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/nxp" \
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/pic32" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/psa" \
 	"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/Renesas" "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/riscv" \
@@ -473,7 +471,6 @@ done
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/intel" \
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/iotsafe" \
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/kcapi" \
-"$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/liboqs" \
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/maxim" \
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/nxp" \
 "$(PROD_ENG)/rt/include/wolfssl572/wolfssl/wolfcrypt/port/pic32" \

IDE/INTIME-RTOS/libwolfssl.vcxproj

@@ -94,7 +94,6 @@
     <ClCompile Include="..\..\wolfcrypt\src\wolfmath.c" />
     <ClCompile Include="..\..\wolfcrypt\src\wc_pkcs11.c" />
     <ClCompile Include="..\..\wolfcrypt\src\wc_slhdsa.c" />
-    <ClCompile Include="..\..\wolfcrypt\src\port\liboqs\liboqs.c" />
 
   </ItemGroup>
   <ItemGroup>

INSTALL

@@ -256,10 +256,12 @@
     - ML-DSA (FIPS 204, CRYSTALS-Dilithium) (signature scheme)
     - SLH-DSA (FIPS 205, SPHINCS+) (signature scheme)
 
-    Falcon (signature scheme) is still provided through liboqs integration.
+    Falcon (signature scheme) is provided by the native wolfSSL
-    To enable it, pass both --with-liboqs and --enable-falcon to configure
+    implementation; liboqs is no longer required or supported. NIST is
-    (CMake: -DWOLFSSL_OQS=yes -DWOLFSSL_FALCON=yes). Passing --with-liboqs
+    standardizing Falcon as FN-DSA (FIPS 206, still a draft). Because it is
-    without --enable-falcon (or vice versa) is now an error.
+    not yet standardized and its API name is subject to change, enable it with
+    --enable-falcon --enable-experimental (CMake: -DWOLFSSL_FALCON=yes
+    -DWOLFSSL_EXPERIMENTAL=yes).
 
     The following NIST Competition Round 3 finalist algorithms were supported,
     but have been removed after 5.3.3

cmake/functions.cmake

@@ -264,7 +264,6 @@ function(generate_build_flags)
     endif()
     if(WOLFSSL_FALCON OR WOLFSSL_USER_SETTINGS)
         set(BUILD_FALCON "yes" PARENT_SCOPE)
-        set(BUILD_OQS_HELPER "yes" PARENT_SCOPE)
     endif()
     if(WOLFSSL_LMS OR WOLFSSL_USER_SETTINGS)
         set(BUILD_WC_LMS "yes" PARENT_SCOPE)
@@ -832,11 +831,6 @@ function(generate_lib_src_list LIB_SOURCES)
         wolfcrypt/src/wc_port.c
         wolfcrypt/src/error.c)
 
-    if(BUILD_OQS_HELPER)
-        list(APPEND LIB_SOURCES
-            wolfcrypt/src/port/liboqs/liboqs.c)
-    endif()
-
     if(BUILD_ARIA)
         list(APPEND LIB_SOURCES
             wolfcrypt/src/port/aria/aria-crypt.c

cmake/include.am

@@ -9,7 +9,6 @@ EXTRA_DIST += cmake/config.in
 EXTRA_DIST += cmake/functions.cmake
 EXTRA_DIST += cmake/options.h.in
 EXTRA_DIST += cmake/modules/FindARIA.cmake
-EXTRA_DIST += cmake/modules/FindOQS.cmake
 
 if CMAKE_INSTALL
 cmakedir = $(libdir)/cmake/wolfssl

cmake/modules/FindOQS.cmake

@@ -1,20 +0,0 @@
-# Filename: FindOQS.cmake
-# Authors: darktohka (27 Jul, 2022)
-#
-# Usage:
-#   find_package(OQS [REQUIRED] [QUIET])
-#
-# Once done this will define:
-#   OQS_FOUND       - system has liboqs
-#   OQS_INCLUDE_DIR - the include directory containing oqs/
-#   OQS_LIBRARY     - the path to the liboqs library
-#
-
-find_path(OQS_INCLUDE_DIR NAMES "oqs/common.h")
-
-find_library(OQS_LIBRARY NAMES "oqs")
-
-mark_as_advanced(OQS_INCLUDE_DIR OQS_LIBRARY)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(OQS DEFAULT_MSG OQS_INCLUDE_DIR OQS_LIBRARY)

cmake/options.h.in

@@ -125,8 +125,6 @@ extern "C" {
 #cmakedefine HAVE_HPKE
 #undef HAVE_KEYING_MATERIAL
 #cmakedefine HAVE_KEYING_MATERIAL
-#undef HAVE_LIBOQS
-#cmakedefine HAVE_LIBOQS
 #undef HAVE_MAX_FRAGMENT
 #cmakedefine HAVE_MAX_FRAGMENT
 #undef HAVE_OCSP

configure.ac

@@ -1820,53 +1820,6 @@ then
     fi
 fi
 
-# liboqs
-ENABLED_LIBOQS="no"
-tryliboqsdir=""
-AC_ARG_WITH([liboqs],
-    [AS_HELP_STRING([--with-liboqs=PATH],[Path to liboqs install (default /usr/local) (requires --enable-experimental)])],
-    [
-        AS_IF([ test "$ENABLED_EXPERIMENTAL" != "yes" ],[ AC_MSG_ERROR([LIBOQS requires --enable-experimental.]) ])
-        AC_MSG_CHECKING([for liboqs])
-        LIBS="$LIBS -loqs"
-        AM_CFLAGS="$AM_CFLAGS -pthread"
-
-        AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <oqs/common.h>]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
-
-        if test "x$liboqs_linked" = "xno" ; then
-            if test "x$withval" != "xno" ; then
-                tryliboqsdir=$withval
-            fi
-            if test "x$withval" = "xyes" ; then
-                tryliboqsdir="/usr/local"
-            fi
-
-            CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS -I$tryliboqsdir/include -pthread"
-            LDFLAGS="$AM_LDFLAGS $LDFLAGS -L$tryliboqsdir/lib"
-
-            AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <oqs/common.h>]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
-
-            if test "x$liboqs_linked" = "xno" ; then
-                AC_MSG_ERROR([liboqs isn't found.
-                If it's already installed, specify its path using --with-liboqs=/dir/])
-            fi
-            AC_MSG_RESULT([yes])
-            AM_CPPFLAGS="$CPPFLAGS"
-            AM_LDFLAGS="$AM_LDFLAGS -L$tryliboqsdir/lib"
-        else
-            AC_MSG_RESULT([yes])
-        fi
-
-        if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
-        then
-            ENABLED_OPENSSLEXTRA="yes"
-            AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
-        fi
-
-        AM_CFLAGS="$AM_CFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS"
-        ENABLED_LIBOQS="yes"
-    ]
-)
 
 # Falcon (legacy name for FN-DSA, now provided by the native implementation)
 # Falcon post-quantum signatures. "Falcon" is the pre-standardization name; NIST
@@ -13019,7 +12972,6 @@ AM_CONDITIONAL([BUILD_OCSP_STAPLING_MULTI],[test "x$ENABLED_CERTIFICATE_STATUS_R
 AM_CONDITIONAL([BUILD_OCSP_STAPLING_V2],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xyes"])
 AM_CONDITIONAL([BUILD_CRL],[test "x$ENABLED_CRL" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_CRL_MONITOR],[test "x$ENABLED_CRL_MONITOR" = "xyes"])
-AM_CONDITIONAL([BUILD_LIBOQS],[test "x$ENABLED_LIBOQS" = "xyes"])
 AM_CONDITIONAL([BUILD_WNR],[test "x$ENABLED_WNR" = "xyes"])
 AM_CONDITIONAL([BUILD_SRP],[test "x$ENABLED_SRP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([USE_VALGRIND],[test "x$ENABLED_VALGRIND" = "xyes"])
@@ -13600,7 +13552,6 @@ echo "   * Persistent session cache:   $ENABLED_SAVESESSION"
 echo "   * Persistent cert    cache:   $ENABLED_SAVECERT"
 echo "   * Atomic User Record Layer:   $ENABLED_ATOMICUSER"
 echo "   * Public Key Callbacks:       $ENABLED_PKCALLBACKS"
-echo "   * liboqs:                     $ENABLED_LIBOQS"
 echo "   * Falcon (native FN-DSA):     $ENABLED_FALCON"
 echo "   * Whitewood netRandom:        $ENABLED_WNR"
 echo "   * Server Name Indication:     $ENABLED_SNI"

src/include.am

@@ -2323,9 +2323,6 @@ if BUILD_FALCON_AVX2
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_falcon_fft_avx2.c
 endif
 
-if BUILD_LIBOQS
-src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/liboqs/liboqs.c
-endif
 
 if BUILD_LIBZ
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/compress.c

src/tls.c

@@ -91,7 +91,6 @@
  * WOLFSSL_MLKEM_NO_MAKE_KEY: Disable ML-KEM key generation       default: off
  * WOLFSSL_MLKEM_NO_ENCAPSULATE: Disable ML-KEM encapsulation     default: off
  * WOLFSSL_MLKEM_NO_DECAPSULATE: Disable ML-KEM decapsulation     default: off
- * HAVE_LIBOQS:              Use liboqs for PQ algorithms          default: off
  *
  * Curves:
  * HAVE_SECRET_CALLBACK:     Enable TLS secret callback            default: off
@@ -4926,8 +4925,8 @@ int TLSX_IsGroupSupported(int namedGroup, int side)
 
 #if !defined(HAVE_ECC) && !defined(HAVE_CURVE25519) && !defined(HAVE_CURVE448) \
                        && !defined(HAVE_FFDHE) && !defined(WOLFSSL_HAVE_MLKEM)
-#error Elliptic Curves Extension requires Elliptic Curve Cryptography or liboqs groups. \
+#error Elliptic Curves Extension requires Elliptic Curve Cryptography or ML-KEM groups. \
-       Use --enable-ecc and/or --enable-liboqs in the configure script or \
+       Use --enable-ecc and/or --enable-mlkem in the configure script or \
        define HAVE_ECC. Alternatively use FFDHE for DH cipher suites.
 #endif
 

wolfcrypt/src/include.am

@@ -171,7 +171,6 @@ EXTRA_DIST += wolfcrypt/src/port/ti/ti-aes.c \
               wolfcrypt/src/port/Renesas/README.md \
               wolfcrypt/src/port/cypress/README.md \
               wolfcrypt/src/port/cypress/psoc6_crypto.c \
-              wolfcrypt/src/port/liboqs/liboqs.c \
               wolfcrypt/src/port/maxim/max3266x.c \
               wolfcrypt/src/ASN_TEMPLATE.md \
               wolfcrypt/src/port/rpi_pico/pico.c \

wolfcrypt/src/port/liboqs/liboqs.c

@@ -1,136 +0,0 @@
-/* liboqs.c
- *
- * Copyright (C) 2006-2026 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
-
-/*
-
-DESCRIPTION
-This library provides the support interfaces to the liboqs library providing
-implementations for Post-Quantum cryptography algorithms.
-
-*/
-
-#include <wolfssl/wolfcrypt/port/liboqs/liboqs.h>
-
-#if defined(HAVE_LIBOQS)
-
-/* RNG for liboqs */
-static WC_RNG liboqsDefaultRNG;
-static WC_RNG* liboqsCurrentRNG;
-
-static wolfSSL_Mutex liboqsRNGMutex;
-
-static int liboqs_init = 0;
-
-
-static void wolfSSL_liboqsGetRandomData(uint8_t* buffer, size_t numOfBytes)
-{
-    int ret;
-    word32 numOfBytes_word32;
-
-    while (numOfBytes > 0) {
-        numOfBytes_word32 = (word32)numOfBytes;
-        /* On platforms where size_t is wider than word32, the cast above can
-         * truncate. If numOfBytes does not fit into a word32 (including the
-         * case where it is an exact multiple of 2^32 and truncates to 0),
-         * generate the largest chunk that fits to guarantee forward progress
-         * and avoid an infinite loop. */
-        if ((size_t)numOfBytes_word32 != numOfBytes) {
-            numOfBytes_word32 = 0xFFFFFFFFU;
-        }
-        ret = wc_RNG_GenerateBlock(liboqsCurrentRNG, buffer,
-                                   numOfBytes_word32);
-        if (ret != 0) {
-            /* ToDo: liboqs exits program if RNG fails,
-             * not sure what to do here
-             */
-            WOLFSSL_MSG_EX(
-                "wc_RNG_GenerateBlock(..., %u) failed with ret %d "
-                "in wolfSSL_liboqsGetRandomData().", numOfBytes_word32, ret
-                );
-            abort();
-        }
-        /* Advance the buffer so subsequent iterations append rather than
-         * overwrite the previously generated bytes. */
-        buffer += numOfBytes_word32;
-        numOfBytes -= numOfBytes_word32;
-    }
-}
-
-int wolfSSL_liboqsInit(void)
-{
-    int ret = 0;
-
-    if (liboqs_init == 0) {
-        ret = wc_InitMutex(&liboqsRNGMutex);
-        if (ret != 0) {
-            return ret;
-        }
-        ret = wc_LockMutex(&liboqsRNGMutex);
-        if (ret != 0) {
-            return ret;
-        }
-        ret = wc_InitRng(&liboqsDefaultRNG);
-        if (ret == 0) {
-            OQS_init();
-            liboqs_init = 1;
-        }
-        liboqsCurrentRNG = &liboqsDefaultRNG;
-        wc_UnLockMutex(&liboqsRNGMutex);
-
-        OQS_randombytes_custom_algorithm(wolfSSL_liboqsGetRandomData);
-    }
-
-    return ret;
-}
-
-void wolfSSL_liboqsClose(void)
-{
-    wc_FreeRng(&liboqsDefaultRNG);
-}
-
-int wolfSSL_liboqsRngMutexLock(WC_RNG* rng)
-{
-    int ret = wolfSSL_liboqsInit();
-    if (ret == 0) {
-        ret = wc_LockMutex(&liboqsRNGMutex);
-    }
-    if (ret == 0 && rng != NULL) {
-        /* Update the pointer with the RNG to use. This is safe as we locked the mutex */
-        liboqsCurrentRNG = rng;
-    }
-    return ret;
-}
-
-int wolfSSL_liboqsRngMutexUnlock(void)
-{
-    liboqsCurrentRNG = &liboqsDefaultRNG;
-
-    if (liboqs_init) {
-        return wc_UnLockMutex(&liboqsRNGMutex);
-    }
-    else {
-        return BAD_MUTEX_E;
-    }
-}
-
-#endif /* HAVE_LIBOQS */

wolfcrypt/src/wc_port.c

@@ -223,9 +223,6 @@ Threading/Mutex options:
     #include <wolfssl/wolfcrypt/port/psa/psa.h>
 #endif
 
-#if defined(HAVE_LIBOQS)
-    #include <wolfssl/wolfcrypt/port/liboqs/liboqs.h>
-#endif
 
 #if defined(FREERTOS) && defined(WOLFSSL_ESPIDF)
     #include <freertos/FreeRTOS.h>
@@ -759,11 +756,6 @@ int wolfCrypt_Init(void)
         rpcmem_init();
 #endif
 
-#if defined(HAVE_LIBOQS)
-        if ((ret = wolfSSL_liboqsInit()) != 0) {
-            WOLFCRYPT_INIT_RAISE_BAD_STATE();
-        }
-#endif
 
 #undef WOLFCRYPT_INIT_RAISE_BAD_STATE
 
@@ -918,9 +910,6 @@ int wolfCrypt_Cleanup(void)
         wc_MemZero_Free();
     #endif
 
-#if defined(HAVE_LIBOQS)
-        wolfSSL_liboqsClose();
-#endif
 
         {
             int ret2 = wc_local_InitDownDone(&wolfcrypt_init_state);

wolfssl-VS2022.vcxproj

@@ -495,7 +495,6 @@
     <ClCompile Include="wolfcrypt\src\wc_slhdsa.c" />
     <ClCompile Include="wolfcrypt\src\wolfmath.c" />
     <ClCompile Include="wolfcrypt\src\wolfevent.c" />
-    <ClCompile Include="wolfcrypt\src\port\liboqs\liboqs.c" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="resource.h" />

wolfssl.vcproj

@@ -427,10 +427,6 @@
 				RelativePath=".\wolfcrypt\src\wolfevent.c"
 				>
 			</File>
-			<File
-				RelativePath=".\wolfcrypt\src\port\liboqs\liboqs.c"
-				>
-			</File>
 		</Filter>
 		<Filter
 			Name="Header Files"

wolfssl.vcxproj

@@ -495,7 +495,6 @@
     <ClCompile Include="wolfcrypt\src\wc_slhdsa.c" />
     <ClCompile Include="wolfcrypt\src\wolfmath.c" />
     <ClCompile Include="wolfcrypt\src\wolfevent.c" />
-    <ClCompile Include="wolfcrypt\src\port\liboqs\liboqs.c" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="resource.h" />

wolfssl/wolfcrypt/include.am

@@ -162,9 +162,6 @@ nobase_include_HEADERS+= wolfssl/wolfcrypt/port/aria/aria-crypt.h
 nobase_include_HEADERS+= wolfssl/wolfcrypt/port/aria/aria-cryptocb.h
 endif
 
-if BUILD_LIBOQS
-nobase_include_HEADERS+= wolfssl/wolfcrypt/port/liboqs/liboqs.h
-endif
 
 if BUILD_ASYNCCRYPT
 nobase_include_HEADERS+= wolfssl/wolfcrypt/async.h

wolfssl/wolfcrypt/port/liboqs/liboqs.h

@@ -1,62 +0,0 @@
-/* liboqs.h
- *
- * Copyright (C) 2006-2026 wolfSSL Inc.
- *
- * This file is part of wolfSSL.
- *
- * wolfSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * wolfSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
- */
-
-/*!
-    \file wolfssl/wolfcrypt/port/liboqs/liboqs.h
-*/
-/*
-
-DESCRIPTION
-This library provides the support interfaces to the liboqs library providing
-implementations for Post-Quantum cryptography algorithms.
-*/
-
-#ifndef WOLF_CRYPT_LIBOQS_H
-#define WOLF_CRYPT_LIBOQS_H
-
-#include <wolfssl/wolfcrypt/types.h>
-#include <wolfssl/wolfcrypt/random.h>
-
-
-#ifdef __cplusplus
-    extern "C" {
-#endif
-
-#if defined(HAVE_LIBOQS)
-
-#include "oqs/oqs.h"
-
-
-int wolfSSL_liboqsInit(void);
-
-void wolfSSL_liboqsClose(void);
-
-int wolfSSL_liboqsRngMutexLock(WC_RNG* rng);
-
-int wolfSSL_liboqsRngMutexUnlock(void);
-
-#endif /* HAVE_LIBOQS */
-
-#ifdef __cplusplus
-    } /* extern "C" */
-#endif
-
-#endif /* WOLF_CRYPT_LIBOQS_H */

wolfssl/wolfcrypt/settings.h

@@ -3703,7 +3703,7 @@
      (defined(HAVE_CURVE448)   && defined(HAVE_CURVE448_KEY_EXPORT)) || \
       defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
       defined(WOLFSSL_HAVE_FRODOKEM) || \
-      defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
+      defined(WOLFSSL_HAVE_SLHDSA) || \
      (defined(WOLFSSL_HAVE_LMS)  && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
      (defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
     #define WC_ENABLE_ASYM_KEY_EXPORT
@@ -3716,7 +3716,7 @@
      (defined(HAVE_CURVE448)   && defined(HAVE_CURVE448_KEY_IMPORT)) || \
       defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
       defined(WOLFSSL_HAVE_FRODOKEM) || \
-      defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
+      defined(WOLFSSL_HAVE_SLHDSA) || \
      (defined(WOLFSSL_HAVE_LMS)  && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
      (defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
     #define WC_ENABLE_ASYM_KEY_IMPORT
@@ -5174,7 +5174,7 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
  * native wolfCrypt implementation in falcon.[ch] + wc_falcon*.[ch]; it no longer
  * requires liboqs. HAVE_FALCON is the build gate. */
 
-#if (defined(HAVE_LIBOQS) ||                                            \
+#if (defined(HAVE_FALCON) ||                                            \
      defined(WOLFSSL_DUAL_ALG_CERTS) ||                                 \
      defined(HAVE_ASCON)) &&                                            \
     !defined(WOLFSSL_EXPERIMENTAL_SETTINGS)

wrapper/CSharp/wolfssl.vcxproj

@@ -361,7 +361,6 @@
     <ClCompile Include="..\..\wolfcrypt\src\wc_slhdsa.c" />
     <ClCompile Include="..\..\wolfcrypt\src\wolfmath.c" />
     <ClCompile Include="..\..\wolfcrypt\src\wolfevent.c" />
-    <ClCompile Include="..\..\wolfcrypt\src\port\liboqs\liboqs.c" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="resource.h" />

zephyr/CMakeLists.txt

@@ -125,7 +125,6 @@ if(CONFIG_WOLFSSL)
     zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfevent.c)
     zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfmath.c)
 
-    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/liboqs/liboqs.c)
     zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa.c)
     zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_aes.c)
     zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_hash.c)