mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-05 23:20:49 +02:00

Files

T

Tobias Frauenschläger 9393d62591 Replace liboqs SPHINCS+ with SLH-DSA in certificate layer

Replace the liboqs-based pre-standardization SPHINCS+ implementation
with the native FIPS 205 SLH-DSA implementation across the
certificate / ASN.1 / X.509 layers, and add SLH-DSA-rooted test
certificates plus TLS 1.3 .conf scenarios that exercise the new
verification path. All liboqs SPHINCS+ code is removed.

This enables SLH-DSA for certificate chain authentication: CA
certificates signed with SLH-DSA, certificate signature verification
against an SLH-DSA root. TLS 1.3 entity authentication via
CertificateVerify with SLH-DSA will be added in a follow-up PR.

Follows RFC 9909 (X.509 Algorithm Identifiers for SLH-DSA) and
NIST FIPS 205. Supports both SHAKE and SHA-2 parameter families
across all twelve standardized variants.

DER codec:
- New PrivateKeyDecode, PublicKeyDecode, KeyToDer, PrivateKeyToDer,
  PublicKeyToDer with RFC 9909 encoding (bare OCTET STRING containing
  4*n raw bytes = SK.seed || SK.prf || PK.seed || PK.root, no nested
  wrapper). OID auto-detection across all twelve SHAKE / SHA-2 variants.
- PublicKeyDecode raw-bytes fast path mirrors wc_Falcon_PublicKeyDecode
  and wc_Dilithium_PublicKeyDecode so callers (notably
  wolfssl_x509_make_der and ConfirmSignature, which pass the raw
  BIT STRING contents stashed by StoreKey) decode correctly. Honours
  the caller's *inOutIdx start offset.
- Error paths in Private/PublicKeyDecode preserve params/flags/
  inOutIdx and only ForceZero the buffer half each helper actually
  writes; skip the wipe entirely on BAD_LENGTH_E (no bytes touched).
- ImportPublic uses |= on flags so a Private-then-Public import
  sequence retains FLAG_PRIVATE.

OID dispatch:
- 12 standardized NIST OIDs (6 SHAKE + 6 SHA-2) per RFC 9909. The
  pre-standardization OID-collision mechanism is removed since NIST
  OIDs do not collide.
- wc_SlhDsaOidToParam / wc_SlhDsaOidToCertType return NOT_COMPILED_IN
  (rather than -1) for recognised SLH-DSA OIDs whose parameter set
  isn't built; wc_IsSlhDsaOid recognises both. The x509 dispatch
  surfaces this as a precise diagnostic instead of the generic
  "No public key found".
- wc_GetKeyOID picks a placeholder parameter from whatever variant is
  compiled in and #errors at compile time if none is.
- asn_orig.c EncodeCert / EncodeCertReq accept SHA-2 SLH-DSA keyTypes
  alongside SHAKE.

Tests and fixtures:
- Test cert chain in certs/slhdsa/: SLH-DSA-SHAKE-128s and
  SLH-DSA-SHA2-128s self-signed roots that sign reused ML-DSA-44
  entity keys (server + client), plus the gen script
  (gen-slhdsa-mldsa-certs.sh, OpenSSL >= 3.5).
- New TLS 1.3 .conf scenarios under tests/suites.c dispatch:
  test-tls13-slhdsa-shake.conf, test-tls13-slhdsa-sha2.conf, and a
  wrong-CA negative test test-tls13-slhdsa-fail.conf.
- DER round-trip and on-disk decode tests; bench_slhdsa_*_key.der
  fixtures regenerated with wolfSSL's own encoder so the codec is
  pinned to RFC 9909.
- New unit test test_wc_slhdsa_x509_i2d_roundtrip exercises the raw
  PublicKeyDecode entry point that wolfssl_x509_make_der relies on.
- test_wc_slhdsa_check_key now tests both Public-then-Private and
  Private-then-Public import orderings.

Build / ABI:
- DYNAMIC_TYPE_SPHINCS = 98 kept as RESERVED with a tombstone comment
  for ABI stability; new code should use DYNAMIC_TYPE_SLHDSA (107).
- All build system / IDE project files updated; SPHINCS+ sources,
  headers, and test data removed.
- Dead bench_slhdsa_*_key arrays removed from gencertbuf.pl and
  certs_test.h; the .der files on disk drive the decode tests.

2026-04-30 18:32:07 +02:00

wolfcrypt_test.X

Few more spelling mistakes

2024-11-01 12:59:01 -04:00

wolfssl.X

Replace liboqs SPHINCS+ with SLH-DSA in certificate layer

2026-04-30 18:32:07 +02:00

include.am

MICROCHIP PIC24 support and example project

2024-01-29 12:50:00 -07:00

main.c

update Copyright year

2026-02-18 09:52:21 -07:00

README.md

Final set of spelling fixes

2024-11-01 12:59:01 -04:00

user_settings.h

clean up trailing whitespace and misplaced CRLFs, add missing final newlines, remove stray UTF8 nonprintables (BOMs) and ASCIIfy stray homoglyphs (spaces and apostrophes), guided by expanded coverage in wolfssl-multi-test check-source-text.

2024-09-05 14:52:18 -05:00

README.md

wolfSSL MPLAB X Project Files for XC16

This directory contains project files for the Microchip MPLAB X IDE. These projects have been set up to use the Microchip PIC24 Starter Kit and the Microchip XC16 compiler.

In order to generate the necessary auto-generated MPLAB X files, make sure to import the wolfssl.X project into your MPLAB X workspace before trying to build the wolfCrypt test. This will correctly set up the respective project's Makefiles.

Included Project Files

wolfSSL library (wolfssl.X)

This project builds a static wolfSSL library. The settings for this project are in user_settings.h:

<wolfssl_root>/IDE/MPLABX16/user_settings.h

After this project has been built, the compiled library will be located at:

<wolfssl_root>/IDE/MPLABX16/wolfssl.X/dist/default/production/wolfssl.X.a

wolfCrypt Test App (wolfcrypt_test.X)

This project tests the wolfCrypt cryptography modules. It is generally a good idea to run this first on an embedded system after compiling wolfSSL in order to verify all underlying crypto is working correctly. This project depends on files generated by Microchip's MCC tool to view the UART output. Follow the steps below to generate that code.

Generating MCC UART code

Open the MPLAB Code Configurator application.
Set the Project path to the wolfSSL/IDE/MPLABX16 and enter your PIC device into the interface.
Select MCC Classic as the content type and click Finish.
Under the Device Resources section, find the UART entry and add the UART1 peripheral.
Note the UART settings and check the Enable UART Interrupts and Redirect Printf to UART boxes.
Click the Generate button.

Note : If using an older version of xc16, you may have to add the following to user_settings.h.

#define WOLFSSL_HAVE_MIN
#define WOLFSSL_HAVE_MAX

Support

Please send questions or comments to support@wolfssl.com