crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Merge pull request #11654 from dgarske/mldsa_small_mem

Browse Source 
Fix two problems with ML-DSA small-memory builds
This commit is contained in:
philljj
2026-10-07 20:54:16 -05:00
committed by GitHub
parent ddb5b32e37 8639f5259c
commit 799bd17483
2 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/configs/pq-all.json vendored
View File

@@ -186,6 +186,14 @@
"configure": ["--enable-mlkem", "--enable-mldsa",
"--enable-tls-mlkem-standalone", "--enable-session-ticket",
"--disable-rsa", "--disable-ecc", "--disable-dh"]},
{"name": "mldsa-verify-only-smallest-mem-no-asn1", "minutes": 2.0,
"comment": "The combination an embedded verifier actually ships: verify only, the smallest-memory verify path, and no ASN.1. Only this config reaches benchmark.c's no-sign branch, which verifies the baked bench_mldsa_NN_sig arrays rather than a signature it just made, so the signature and the imported public key have to be the same key pair. The existing no-ASN.1 rows build signing too, so they never take that branch. The benchmark exits 0 whether or not verification succeeded, and a level whose key import fails prints and moves on to the next one, so the run asserts a verify row for each of the three levels rather than just one. Built with -Werror=unused-function, as a verify-only build is where a helper loses its last caller.",
"check": false,
"extra_cflags": "-Werror=unused-function",
"configure": ["--disable-intelasm", "--enable-experimental",
"--enable-dilithium=yes,small,verify-only",
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFSSL_MLDSA_VERIFY_SMALLEST_MEM -DWOLFSSL_MLDSA_NO_ASN1 -DWOLFSSL_MLDSA_NO_LARGE_CODE"],
"run": [["sh", "-c", "out=$(./wolfcrypt/benchmark/benchmark -ml-dsa 2>&1) || exit 1; printf '%s\\n' \"$out\"; if printf '%s\\n' \"$out\" | grep -qE 'VerifyCtx failed|Failed to load (public|private) key'; then echo 'ML-DSA verify or key load failed' >&2; exit 1; fi; for lvl in 44 65 87; do printf '%s\\n' \"$out\" | grep -qE \"^ML-DSA +$lvl +verify\" || { echo \"no ML-DSA-$lvl verify row reported\" >&2; exit 1; }; done"]]},
{"name": "mldsa-dynamic-keys", "minutes": 1.8,
"configure": ["--enable-intelasm", "--enable-sp-asm",
"--enable-dilithium=yes", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]},

27
wolfcrypt/benchmark/benchmark.c
View File

@@ -18323,6 +18323,15 @@ void bench_mldsaKeySign(byte level)
#ifndef WOLFSSL_MLDSA_NO_ASN1
ret = wc_MlDsaKey_PublicKeyDecode(key, mldsa44_pub_spki,
sizeof_mldsa44_pub_spki, &idx);
#elif defined(WOLFSSL_MLDSA_NO_SIGN)
/* The baked signature above was made with
* certs/mldsa/mldsa44_priv-only.der and verifies only under that
* key. Take its raw encoding from the SPKI payload;
* bench_mldsa_44_pubkey is an unrelated key pair. */
ret = wc_MlDsaKey_ImportPubRaw(key,
mldsa44_pub_spki + sizeof_mldsa44_pub_spki -
WC_MLDSA_44_PUB_KEY_SIZE,
WC_MLDSA_44_PUB_KEY_SIZE);
#else
ret = wc_MlDsaKey_ImportPubRaw(key, bench_mldsa_44_pubkey,
sizeof_bench_mldsa_44_pubkey);
@@ -18338,6 +18347,15 @@ void bench_mldsaKeySign(byte level)
#ifndef WOLFSSL_MLDSA_NO_ASN1
ret = wc_MlDsaKey_PublicKeyDecode(key, mldsa65_pub_spki,
sizeof_mldsa65_pub_spki, &idx);
#elif defined(WOLFSSL_MLDSA_NO_SIGN)
/* The baked signature above was made with
* certs/mldsa/mldsa65_priv-only.der and verifies only under that
* key. Take its raw encoding from the SPKI payload;
* bench_mldsa_65_pubkey is an unrelated key pair. */
ret = wc_MlDsaKey_ImportPubRaw(key,
mldsa65_pub_spki + sizeof_mldsa65_pub_spki -
WC_MLDSA_65_PUB_KEY_SIZE,
WC_MLDSA_65_PUB_KEY_SIZE);
#else
ret = wc_MlDsaKey_ImportPubRaw(key, bench_mldsa_65_pubkey,
sizeof_bench_mldsa_65_pubkey);
@@ -18353,6 +18371,15 @@ void bench_mldsaKeySign(byte level)
#ifndef WOLFSSL_MLDSA_NO_ASN1
ret = wc_MlDsaKey_PublicKeyDecode(key, mldsa87_pub_spki,
sizeof_mldsa87_pub_spki, &idx);
#elif defined(WOLFSSL_MLDSA_NO_SIGN)
/* The baked signature above was made with
* certs/mldsa/mldsa87_priv-only.der and verifies only under that
* key. Take its raw encoding from the SPKI payload;
* bench_mldsa_87_pubkey is an unrelated key pair. */
ret = wc_MlDsaKey_ImportPubRaw(key,
mldsa87_pub_spki + sizeof_mldsa87_pub_spki -
WC_MLDSA_87_PUB_KEY_SIZE,
WC_MLDSA_87_PUB_KEY_SIZE);
#else
ret = wc_MlDsaKey_ImportPubRaw(key, bench_mldsa_87_pubkey,
sizeof_bench_mldsa_87_pubkey);