mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-05 18:50:50 +02:00

Files

T

Tobias Frauenschläger 9393d62591 Replace liboqs SPHINCS+ with SLH-DSA in certificate layer

Replace the liboqs-based pre-standardization SPHINCS+ implementation
with the native FIPS 205 SLH-DSA implementation across the
certificate / ASN.1 / X.509 layers, and add SLH-DSA-rooted test
certificates plus TLS 1.3 .conf scenarios that exercise the new
verification path. All liboqs SPHINCS+ code is removed.

This enables SLH-DSA for certificate chain authentication: CA
certificates signed with SLH-DSA, certificate signature verification
against an SLH-DSA root. TLS 1.3 entity authentication via
CertificateVerify with SLH-DSA will be added in a follow-up PR.

Follows RFC 9909 (X.509 Algorithm Identifiers for SLH-DSA) and
NIST FIPS 205. Supports both SHAKE and SHA-2 parameter families
across all twelve standardized variants.

DER codec:
- New PrivateKeyDecode, PublicKeyDecode, KeyToDer, PrivateKeyToDer,
  PublicKeyToDer with RFC 9909 encoding (bare OCTET STRING containing
  4*n raw bytes = SK.seed || SK.prf || PK.seed || PK.root, no nested
  wrapper). OID auto-detection across all twelve SHAKE / SHA-2 variants.
- PublicKeyDecode raw-bytes fast path mirrors wc_Falcon_PublicKeyDecode
  and wc_Dilithium_PublicKeyDecode so callers (notably
  wolfssl_x509_make_der and ConfirmSignature, which pass the raw
  BIT STRING contents stashed by StoreKey) decode correctly. Honours
  the caller's *inOutIdx start offset.
- Error paths in Private/PublicKeyDecode preserve params/flags/
  inOutIdx and only ForceZero the buffer half each helper actually
  writes; skip the wipe entirely on BAD_LENGTH_E (no bytes touched).
- ImportPublic uses |= on flags so a Private-then-Public import
  sequence retains FLAG_PRIVATE.

OID dispatch:
- 12 standardized NIST OIDs (6 SHAKE + 6 SHA-2) per RFC 9909. The
  pre-standardization OID-collision mechanism is removed since NIST
  OIDs do not collide.
- wc_SlhDsaOidToParam / wc_SlhDsaOidToCertType return NOT_COMPILED_IN
  (rather than -1) for recognised SLH-DSA OIDs whose parameter set
  isn't built; wc_IsSlhDsaOid recognises both. The x509 dispatch
  surfaces this as a precise diagnostic instead of the generic
  "No public key found".
- wc_GetKeyOID picks a placeholder parameter from whatever variant is
  compiled in and #errors at compile time if none is.
- asn_orig.c EncodeCert / EncodeCertReq accept SHA-2 SLH-DSA keyTypes
  alongside SHAKE.

Tests and fixtures:
- Test cert chain in certs/slhdsa/: SLH-DSA-SHAKE-128s and
  SLH-DSA-SHA2-128s self-signed roots that sign reused ML-DSA-44
  entity keys (server + client), plus the gen script
  (gen-slhdsa-mldsa-certs.sh, OpenSSL >= 3.5).
- New TLS 1.3 .conf scenarios under tests/suites.c dispatch:
  test-tls13-slhdsa-shake.conf, test-tls13-slhdsa-sha2.conf, and a
  wrong-CA negative test test-tls13-slhdsa-fail.conf.
- DER round-trip and on-disk decode tests; bench_slhdsa_*_key.der
  fixtures regenerated with wolfSSL's own encoder so the codec is
  pinned to RFC 9909.
- New unit test test_wc_slhdsa_x509_i2d_roundtrip exercises the raw
  PublicKeyDecode entry point that wolfssl_x509_make_der relies on.
- test_wc_slhdsa_check_key now tests both Public-then-Private and
  Private-then-Public import orderings.

Build / ABI:
- DYNAMIC_TYPE_SPHINCS = 98 kept as RESERVED with a tombstone comment
  for ABI stability; new code should use DYNAMIC_TYPE_SLHDSA (107).
- All build system / IDE project files updated; SPHINCS+ sources,
  headers, and test data removed.
- Dead bench_slhdsa_*_key arrays removed from gencertbuf.pl and
  certs_test.h; the .der files on disk drive the decode tests.

2026-04-30 18:32:07 +02:00

consumer

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

modules

ARIA cipher cmake (#6600 )

2023-09-19 10:57:02 -07:00

Config.cmake.in

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

config.in

add uintptr_t to config.h fixing curl cmake build error

2024-09-26 10:31:31 -06:00

functions.cmake

Replace liboqs SPHINCS+ with SLH-DSA in certificate layer

2026-04-30 18:32:07 +02:00

include.am

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

options.h.in

Remove liboqs for ML-KEM and ML-DSA, update for Falcon

2026-04-30 11:03:06 +02:00

README.md

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

wolfssl-config-version.cmake.in

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

wolfssl-targets.cmake.in

CMake fixes and improvements

2026-02-02 10:26:58 +01:00

README.md

wolfSSL CMake

This directory contains some supplementary functions for the CMakeLists.txt in the root.

See also cmake notes in the INSTALL documentation file. When building with autoconf/automake, CMake package files are installed by default under $(libdir)/cmake/wolfssl to support find_package(wolfssl). Disable with ./configure --disable-cmake-install.

If new CMake build options are added cmake/options.h.in must also be updated.

For more information on building wolfSSL, see the wolfSSL Manual.

In summary for cmake:

# From the root of the wolfSSL repo:

mkdir -p out
pushd out
cmake ..
cmake --build .

# View the available ciphers with:
./examples/client/client -e
popd

CMake Presets

The CMakePresets.json; see [cmake-presets(https://cmake.org/cmake/help/latest/manual/cmake-presets.7.html)

Cross-platform and cross-IDE.
Standardized CMake feature (since CMake 3.19+, recommended after 3.21).
Works in Visual Studio, VS Code, CLI, CI systems, etc..

Visual Studio Settings

There's also a Visual Studio specific file: CMakeSettings.json. This the file that supports the GUI CMake settings.

See the Microsoft CMakeSettings.json schema reference

Visual Studio (2022 v17.1 and later):

Prefers CMakePresets.json if it exists.
Falls back to CMakeSettings.json if no presets are found.
Lets you override or extend presets via CMakeSettings.json.

Recommendations:

Use CMakePresets.json to define shared, cross-platform presets.
Use CMakeSettings.json to define Visual Studio-specific overrides, like:
- Custom output directories
- Specific environment variables
- *UI-related tweaks