Update cert loading in ML-KEM tests

gencertbuf.pl

@@ -4,7 +4,7 @@
 # version 1.1
 # Updated 07/01/2014
 #
-# Copyright (C) 2006-2015 wolfSSL Inc.
+# Copyright (C) 2006-2026 wolfSSL Inc.
 #
 
 use strict;
@@ -406,6 +406,24 @@ for my $entry (@hbs_vectors) {
     print OUT_FILE "#endif /* $guard */\n\n";
 }
 
+# ML-KEM end-entity certificates and expandedKey form private keys
+print OUT_FILE "#if defined(WOLFSSL_HAVE_MLKEM)\n\n";
+
+for my $n (512, 768, 1024) {
+    for my $kind ("cert", "key") {
+        my $fname = "./certs/mlkem/mlkem${n}-${kind}.der";
+        my $sname = "mlkem${n}_${kind}_der";
+
+        print OUT_FILE "/* $fname */\n";
+        print OUT_FILE "static const unsigned char $sname\[] =\n{\n";
+        file_to_hex($fname);
+        print OUT_FILE "};\n";
+        print OUT_FILE "#define sizeof_$sname (sizeof($sname))\n\n";
+    }
+}
+
+print OUT_FILE "#endif /* WOLFSSL_HAVE_MLKEM */\n\n";
+
 # convert and print 256-bit cert/keys
 print OUT_FILE "#if defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)\n\n";
 for (my $i = 0; $i < $num_ecc; $i++) {

wolfcrypt/test/test.c

@@ -69335,15 +69335,10 @@ free_level:
  * certs/mlkem/README.txt for why - so nothing here expands a seed and the test
  * runs in WOLFSSL_MLKEM_NO_MAKE_KEY builds too, which is exactly what that key
  * format was chosen for. */
-#if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(NO_FILESYSTEM) && \
-    !defined(WOLFSSL_NO_MALLOC) && \
+#if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(WOLFSSL_NO_MALLOC) && \
     !defined(NO_ASN) && defined(WC_ENABLE_ASYM_KEY_IMPORT) && \
     defined(WC_ENABLE_ASYM_KEY_EXPORT)
 
-/* The largest committed ML-KEM DER is under 7 kB, and a static memory pool has
- * no bucket much beyond that. */
-#define MLKEM_CERT_DER_SZ (FOURK_BUF * 2)
-
 /* Parse the ML-KEM end-entity certificates, confirm the subject public key
  * carries the expected ML-KEM parameter set, and confirm the matching private
  * key reproduces that same public key. */
@@ -69352,66 +69347,50 @@ static wc_test_ret_t mlkem_cert_test(void)
     wc_test_ret_t ret = 0;
     int i;
     static const struct {
-        const char* cert;
-        const char* key;
+        const byte* cert;
+        word32      certSz;
+        const byte* key;
+        word32      keySz;
         int         level;
     } vectors[] = {
 #if defined(WOLFSSL_WC_ML_KEM_512) && !defined(WOLFSSL_NO_ML_KEM)
-        { CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem512-cert.der",
-          CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem512-key.der", WC_ML_KEM_512 },
+        { mlkem512_cert_der, sizeof_mlkem512_cert_der,
+          mlkem512_key_der, sizeof_mlkem512_key_der, WC_ML_KEM_512 },
 #endif
 #if defined(WOLFSSL_WC_ML_KEM_768) && !defined(WOLFSSL_NO_ML_KEM)
-        { CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem768-cert.der",
-          CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem768-key.der", WC_ML_KEM_768 },
+        { mlkem768_cert_der, sizeof_mlkem768_cert_der,
+          mlkem768_key_der, sizeof_mlkem768_key_der, WC_ML_KEM_768 },
 #endif
 #if defined(WOLFSSL_WC_ML_KEM_1024) && !defined(WOLFSSL_NO_ML_KEM)
-        { CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem1024-cert.der",
-          CERT_ROOT "mlkem" CERT_PATH_SEP "mlkem1024-key.der", WC_ML_KEM_1024 },
+        { mlkem1024_cert_der, sizeof_mlkem1024_cert_der,
+          mlkem1024_key_der, sizeof_mlkem1024_key_der, WC_ML_KEM_1024 },
 #endif
-        { NULL, NULL, 0 }
+        { NULL, 0, NULL, 0, 0 }
     };
 
     for (i = 0; vectors[i].cert != NULL; i++) {
-        /* One key object and one file buffer at a time: a static memory pool
-         * has no room for both halves of the comparison at once. */
+        /* One key object at a time: a static memory pool has no room for
+         * both halves of the comparison at once. */
         MlKemKey* key = NULL;
-        XFILE f = XBADFILE;
-        byte* derBuf = NULL;
         byte* spki = NULL;
         byte* pubA = NULL;
         byte* pubB = NULL;
         word32 spkiSz = MLKEM_MAX_PUB_KEY_DER_SIZE;
         word32 pubSz = 0;
         word32 idx = 0;
-        size_t derSz = 0;
         int keyInit = 0;
 
         key = (MlKemKey*)XMALLOC(sizeof(MlKemKey), HEAP_HINT,
             DYNAMIC_TYPE_TMP_BUFFER);
-        derBuf = (byte*)XMALLOC(MLKEM_CERT_DER_SZ, HEAP_HINT,
-            DYNAMIC_TYPE_TMP_BUFFER);
         spki = (byte*)XMALLOC(spkiSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
-        if (key == NULL || derBuf == NULL || spki == NULL) {
+        if (key == NULL || spki == NULL) {
             ret = WC_TEST_RET_ENC_ERRNO;
             goto free_vector;
         }
 
-        f = XFOPEN(vectors[i].cert, "rb");
-        if (f == XBADFILE) {
-            ret = WC_TEST_RET_ENC_ERRNO;
-            goto free_vector;
-        }
-        derSz = XFREAD(derBuf, 1, MLKEM_CERT_DER_SZ, f);
-        XFCLOSE(f);
-        /* a full buffer means the file did not fit */
-        if ((derSz == 0) || (derSz == (size_t)MLKEM_CERT_DER_SZ)) {
-            ret = WC_TEST_RET_ENC_NC;
-            goto free_vector;
-        }
-
         /* Pull the SubjectPublicKeyInfo straight out of the certificate. */
-        ret = wc_GetSubjectPubKeyInfoDerFromCert(derBuf, (word32)derSz, spki,
-            &spkiSz);
+        ret = wc_GetSubjectPubKeyInfoDerFromCert(vectors[i].cert,
+            vectors[i].certSz, spki, &spkiSz);
         if (ret == 0) {
             ret = wc_MlKemKey_Init(key, vectors[i].level, HEAP_HINT, devId);
             if (ret == 0)
@@ -69441,25 +69420,13 @@ static wc_test_ret_t mlkem_cert_test(void)
         if (ret != 0)
             goto free_vector;
 
-        f = XFOPEN(vectors[i].key, "rb");
-        if (f == XBADFILE) {
-            ret = WC_TEST_RET_ENC_ERRNO;
-            goto free_vector;
-        }
-        derSz = XFREAD(derBuf, 1, MLKEM_CERT_DER_SZ, f);
-        XFCLOSE(f);
-        if ((derSz == 0) || (derSz == (size_t)MLKEM_CERT_DER_SZ)) {
-            ret = WC_TEST_RET_ENC_NC;
-            goto free_vector;
-        }
-
         ret = wc_MlKemKey_Init(key, vectors[i].level, HEAP_HINT, devId);
         if (ret == 0)
             keyInit = 1;
         if (ret == 0) {
             idx = 0;
-            ret = wc_MlKemKey_PrivateKeyDecode(key, derBuf, (word32)derSz,
-                &idx);
+            ret = wc_MlKemKey_PrivateKeyDecode(key, vectors[i].key,
+                vectors[i].keySz, &idx);
         }
         /* The private key must reproduce the certificate's public key. */
         if (ret == 0)
@@ -69476,7 +69443,6 @@ free_vector:
         XFREE(pubA, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
         XFREE(pubB, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
         XFREE(spki, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(derBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
 
         if (ret != 0)
             break;
@@ -70132,8 +70098,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mlkem_test(void)
         goto out;
 #endif
 
-#if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(NO_FILESYSTEM) && \
-    !defined(WOLFSSL_NO_MALLOC) && \
+#if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(WOLFSSL_NO_MALLOC) && \
     !defined(NO_ASN) && defined(WC_ENABLE_ASYM_KEY_IMPORT) && \
     defined(WC_ENABLE_ASYM_KEY_EXPORT)
     ret = mlkem_cert_test();