From 786fa874191f22fe618a34ae22911759d6076e0e Mon Sep 17 00:00:00 2001 From: kaleb-himes Date: Mon, 12 Oct 2026 15:42:33 -0600 Subject: [PATCH] Build LMS and XMSS verify-only in FIPS v7 per SP 800-208 sec 8.1 --- IDE/WIN-PQ-FIPSv7/user_settings.h | 2 ++ configure.ac | 3 +++ 2 files changed, 5 insertions(+) diff --git a/IDE/WIN-PQ-FIPSv7/user_settings.h b/IDE/WIN-PQ-FIPSv7/user_settings.h index b07a19278c..4c1b9e3506 100644 --- a/IDE/WIN-PQ-FIPSv7/user_settings.h +++ b/IDE/WIN-PQ-FIPSv7/user_settings.h @@ -215,7 +215,9 @@ #define WOLFSSL_HAVE_LMS /* LMS (SP 800-208) */ #define WOLFSSL_LMS_SHA256_192 #define WOLFSSL_LMS_SHAKE256 + #define WOLFSSL_LMS_VERIFY_ONLY /* SP 800-208 sec 8.1 */ #define WOLFSSL_HAVE_XMSS /* XMSS (SP 800-208) */ + #define WOLFSSL_XMSS_VERIFY_ONLY /* SP 800-208 sec 8.1 */ #define WOLFSSL_HAVE_SLHDSA /* SLH-DSA (FIPS 205) */ #define WOLFSSL_WC_SLHDSA #define WOLFSSL_SLHDSA_PARAM_128S diff --git a/configure.ac b/configure.ac index 9a7e7c1f7b..11836e7a2d 100644 --- a/configure.ac +++ b/configure.ac @@ -7834,6 +7834,9 @@ AS_CASE([$FIPS_VERSION], [ENABLED_LMS="yes"]) # LMS: enable SHA-256/192 and SHAKE256 parameter sets for FIPS v7 AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LMS_SHA256_192 -DWOLFSSL_LMS_SHAKE256" + # SP 800-208 sec 8.1: LMS/XMSS keygen and signing are validated only in + # hardware modules; a software module verifies only (sec 8.2). + AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LMS_VERIFY_ONLY -DWOLFSSL_XMSS_VERIFY_ONLY" AS_IF([test "$ENABLED_SLHDSA" != "yes" && (test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_slhdsa" != "no")],