Falcon was the last algorithm backed by liboqs; now that wolfCrypt has a
native Falcon implementation, liboqs is no longer needed. Remove the
integration entirely so liboqs does not appear as a build or SBOM dependency:
- configure: drop --with-liboqs (and the -loqs link), the BUILD_LIBOQS
conditional and the summary line.
- CMake: drop WOLFSSL_OQS, the duplicate liboqs-backed WOLFSSL_FALCON
option, the OQS cross-validation / find_package(OQS) block, the
FindOQS.cmake module, BUILD_OQS_HELPER, and HAVE_LIBOQS from options.h.in.
- Remove the wolfcrypt/src/port/liboqs port layer (liboqs.c/.h) and its
wolfSSL_liboqsInit/Close calls in wc_port.c.
- settings.h: drop HAVE_LIBOQS from the asym key import/export aggregates
(HAVE_FALCON already covers them) and from the experimental gate; add
HAVE_FALCON to the experimental gate so the unstandardized Falcon requires
WOLFSSL_EXPERIMENTAL_SETTINGS in every build system.
- Drop liboqs.c from the VS/Zephyr/INTIME project files, remove the liboqs
install from Docker, and update INSTALL/tls.c text (Falcon is native now).
No functional change to non-Falcon builds; the library links no liboqs.
Add a complete native Falcon post-quantum lattice signature implementation to
wolfCrypt, replacing the liboqs wrapper. Full key generation, signing and
verification for Falcon-512 (level 1) and Falcon-1024 (level 5).
- Public API wc_falcon_* / falcon_key in falcon.c wraps the native core
(falcon_native_* in wc_falcon.c) plus wc_falcon_{fpr,fft,poly,sampler,
codec,keygen,sign,bigint}.c. No liboqs dependency.
- Portable, constant-time integer-emulated floating-point (fpr) backend is
the default; opt-in per-architecture acceleration:
--enable-falcon-double inline native double
--enable-falcon-asm x86-64 SSE2 out-of-line fpr asm
--enable-falcon-avx2 x86-64 AVX2 (4-wide) FFT
- Division-free (Barrett) integer NTT on the verify path, so no hardware
divide is required on Cortex-M / embedded targets.
- Verify uses a cached twiddle-factor NTT; signing uses the FFT / ffLDL tree
and discrete Gaussian sampler over the abstract fpr seam.
- test.c falcon_test (KAT verify + native keygen/sign/verify roundtrip);
scripts/falcon-interop.c and a CI workflow cross-check native<->liboqs in
both directions.
* Fix vector register restore on error paths in Sha3Update().
* Add SP 800-185 check against KMAC_FIPS_MIN_KEY in KmacInit() and
KMAC_FIPS_MIN_OUTPUT in KmacFinal(), returning KMAC_MIN_KEYLEN_E and
BAD_LENGTH_E respectively on failure.
* Use word32 rather than byte for wc_Sha3.i, wc_Cshake.count, wc_Kmac.count, and
related, and add explicit range checking where needed, to fix a -Wconversion,
fix possible overruns, obviate 14 casts, and eliminate (negligible) runtime
overhead from masking and promotions.
* add missing null key checks to wc_ed25519_verify_msg_init(), wc_ed25519_verify_msg_update(), and wc_ed25519_verify_msg_final().
* add WC_ARG_NOT_NULL() attributes to args of static functions as appropriate.
* add FIPS >v6 gates to new null key tests and a new invalid hash size test in test_wc_ed25519_sign_verify_ctx_ph() and test_wc_ed25519_verify_streaming().
* also inhibit recursive evaluation midway through random.h, fips.h, and fips_test.h (circular dependencies).
* add WC_FIPS_ENUM_CAST_ID_DEFINED to allow detection of fips_test.h incomplete evaluation.
wolfssl/wolfcrypt/aes.h: if HAVE_FIPS && !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, make wc_AesGcmEncrypt() a WOLFSSL_LOCAL, and if !_WC_BUILDING_AES_C, add a WC_DEPRECATED() attribute to it.
wolfssl/wolfcrypt/wc_compat.h, wolfssl/wolfcrypt/include.am, .wolfssl_known_macro_extras: add wc_compat.h: when HAVE_FIPS and !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, shim wc_AesGcmEncrypt() to remap it to FIPS-allowed APIs.
wolfssl/wolfcrypt/types.h: at the end, #ifndef BUILDING_WOLFSSL, #include <wolfssl/wolfcrypt/wc_compat.h>, to assure transparent shimming of wc_AesGcmEncrypt() for all outside callers.
wolfcrypt/src/evp.c, wolfcrypt/src/hpke.c, wolfcrypt/src/pkcs7.c, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.c, wolfssl/ssl.h: #include <wolfssl/wolfcrypt/wc_compat.h> to shim in-library/in-module calls to wc_AesGcmEncrypt().
src/internal.c: in TicketEncDec(), add const attributes to constable input args, and fix swapped out/in in calls to wc_AesGcmEncrypt().
tests/api/test_aes.c: in test_wc_AesGcmEncryptDecrypt(), skip longIV test if WC_TEST_AES_GCM_ENCRYPT_NO_NONSTD_IV (defined by wc_compat.h when needed).
wolfssl/wolfcrypt/error-crypt.h, wolfssl/error-ssl.h, wolfcrypt/src/error.c, src/internal.c:
* add FIPS_WRONG_API_E;
* put several error codes back into sequence in wc_GetErrorString() switch().
* move wc_static_assert()s from headers to corresponding .c files, to eliminate dependency on wolfcrypt/types.h;
* remove unneeded #include <wolfssl/wolfcrypt/types.h> from error-crypt.h.
The non-recursive automake "distdir" recipe inlines the entire $(DISTFILES)
list into a single shell command. Enumerating every IDE integration file
individually made that list large enough (~123 KB) that the recipe exceeded
the Linux MAX_ARG_STRLEN (128 KB) single-argument exec limit, so "make dist"
failed with:
/bin/bash: Argument list too long
make[2]: *** [distdir-am] Error 127
Replace the per-file EXTRA_DIST enumeration of the IDE directories with one
wholesale "EXTRA_DIST += IDE/<dir>" entry per directory (automake copies the
tree recursively). This collapses ~745 file entries into ~52 directory
entries and shrinks the top-level DISTFILES from ~123 KB to ~97 KB, well
under the limit.
The set of distributed IDE files is unchanged: a before/after "make dist"
diff shows no project file added or removed (only the now-unused include.am
build fragments are gone). Three directories that intentionally omit some
tracked files (apple-universal, MPLABX16, Renesas - private IDE configs,
.gitkeep placeholders, helper scripts) stay enumerated file-by-file.
WOLFSSL_OCSP_SCREEN_RESPONDER (from the OCSP AIA responder SSRF
screening work) is only ever enabled via
CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER, a form the check-source-text
"unknown macros" -D pattern does not match, so the subtest reports it as
an unrecognized macro and fails. Add it to .wolfssl_known_macro_extras.
Also fix the C lexical ordering of HWCAP2_SME, which sorted after
HWCAP_ASIMDRDM ('2' precedes '_' in the C locale) and tripped the "not
in C lexical order" warning.
CRL signature verification already supported post-quantum algorithms
through the shared ConfirmSignature() engine, but CRL generation did not:
wc_SignCRL_ex accepted only RSA and ECC keys and sized its signature
buffer for a classic signature.
Add wc_SignCRL_ex2, which takes an untyped key plus a keyType selector,
the same scheme wc_MakeCert_ex and wc_SignCert_ex use. It resolves the key
and reuses the existing CheckSigTypeForKey, GetSignatureBufferSz and
MakeSignature helpers, so the signature buffer is sized from the key and
post-quantum signatures get enough room. wc_SignCRL_ex keeps its original
RSA/ECC signature and becomes a thin wrapper, preserving the public API.
This enables CRL signing with ML-DSA, SLH-DSA, Ed25519, Ed448 and Falcon.
Stateful hash-based schemes (LMS/XMSS) are rejected with ALGO_ID_E, since a
CRL is reissued periodically and would exhaust the key's one-time signature
state. Under WOLFSSL_NO_MALLOC the signature must still fit the fixed
CertSignCtx.sig buffer, consistent with the certificate signing path.
Tests cover CRL sign and verify through the certificate manager for ML-DSA
(44/65/87), SLH-DSA (SHAKE and SHA2 128s), Ed25519 and Ed448, plus negative
cases for a tampered signature, a sigType and key-family mismatch, and
rejection of LMS/XMSS.
WOLFSSL_OCSP_SCREEN_RESPONDER (from the OCSP AIA responder SSRF
screening work) is only ever enabled via
CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER, a form the check-source-text
"unknown macros" -D pattern does not match, so the subtest reports it as
an unrecognized macro and fails. Add it to .wolfssl_known_macro_extras.
Also fix the C lexical ordering of HWCAP2_SME, which sorted after
HWCAP_ASIMDRDM ('2' precedes '_' in the C locale) and tripped the "not
in C lexical order" warning.
WOLFSSL_OCSP_CHECKALL is a scope flag ("always leaf, but all ?"), selecting
which certs are checked, not how hard to fail when one advertises no OCSP
responder in its AIA. Treating a missing responder as a hard failure breaks
any chain whose CA publishes no OCSP URI (e.g. Google GTS WR2), a
configuration that only grows as CAs drop responders. Strictness belongs in
its own opt-in flag.
- Keep CHECKALL scope-only; a cert with no responder soft-fails by default.
- Return distinct OCSP_NO_URL for "no responder", separate from a failed
lookup; stapling response handling stays best-effort (mapped to CERT_GOOD).
- Add WOLFSSL_OCSP_FAIL_IF_NOT_SUPPORTED (via OcspNoUrlPolicy) to refuse such
certs; independent of CHECKALL.
- Add test_ocsp_no_url_policy covering both halves.
- Add wolfIO_OcspDestAllowed(); block internal-range responder hosts
- Call it in EmbedOcspLookup before connect (CWE-918)
- Gate on WOLFSSL_OCSP_SCREEN_RESPONDER (off by default)
- Add unit tests and CI for both resolver paths
Daniele Lacamera
Sean Parkinson
Lealem Amedie
night1rider
philljj
Daniel Pouzzner
JacobBarthelmeh
aidan garske
Tobias Frauenschläger
John Safranek