PR feedback: reorder cert gen, reuse rng, compiler gates, update comment

2026-10-24 04:09:07 +03:00 · 2026-10-21 07:10:47 -07:00
parent cba6e48b55
commit c161875a37
4 changed files with 51 additions and 44 deletions
--- a/certs/renewcerts.sh
+++ b/certs/renewcerts.sh
@@ -1125,27 +1125,9 @@ run_renewcerts(){
    echo "End of section"
    echo "---------------------------------------------------------------------"
    ############################################################
-    ########## store DER files as buffers ######################
-    ############################################################
-    echo "Changing directory to wolfssl root..."
-    echo ""
-    cd ../ || exit 1
-    echo "Execute ./gencertbuf.pl..."
-    echo ""
-    ./gencertbuf.pl
-    check_result $? "gencertbuf.pl"
-    echo "End of section"
-    echo "---------------------------------------------------------------------"
-    ############################################################
    ########## generate the new crls ###########################
    ############################################################

-    echo "Change directory to wolfssl/certs"
-    echo ""
-    cd ./certs || { echo "Failed to switch to dir ./certs"; exit 1; }
-    echo "We are back in the certs directory"
-    echo ""
-
    echo "Updating the crls..."
    echo ""
    cd ./crl || { echo "Failed to switch to dir ./crl"; exit 1; }
@@ -1522,6 +1504,19 @@ EOF
    echo "certificates; they are generated by wolfSSL - see certs/frodokem/)"
    echo "---------------------------------------------------------------------"

+    ############################################################
+    ########## store DER files as buffers ######################
+    ############################################################
+    echo "Changing directory to wolfssl root..."
+    echo ""
+    cd ../ || exit 1
+    echo "Execute ./gencertbuf.pl..."
+    echo ""
+    ./gencertbuf.pl
+    check_result $? "gencertbuf.pl"
+    echo "End of section"
+    echo "---------------------------------------------------------------------"
+
    #cleanup the file system now that we're done
    echo "Performing final steps, cleaning up the file system..."
    echo ""
@@ -1550,7 +1545,6 @@ check_result $? "make clean"
 touch certs/.rnd || exit 1

 run_renewcerts
-cd ../ || exit 1
 rm -f ./certs/wolfssl.cnf
 rm -f certs/.rnd

--- a/gencertbuf.pl
+++ b/gencertbuf.pl
@@ -407,9 +407,14 @@ for my $entry (@hbs_vectors) {
 }

 # ML-KEM end-entity certificates and expandedKey form private keys
-print OUT_FILE "#if defined(WOLFSSL_HAVE_MLKEM)\n\n";
+print OUT_FILE "#if defined(WOLFSSL_HAVE_MLKEM) && " .
+    "!defined(WOLFSSL_NO_ML_KEM)\n\n";

 for my $n (512, 768, 1024) {
+    my $noLevel = "WOLFSSL_NO_ML_KEM_${n}";
+
+    print OUT_FILE "#if !defined($noLevel)\n\n";
+
    for my $kind ("cert", "key") {
        my $fname = "./certs/mlkem/mlkem${n}-${kind}.der";
        my $sname = "mlkem${n}_${kind}_der";
@@ -420,9 +425,11 @@ for my $n (512, 768, 1024) {
        print OUT_FILE "};\n";
        print OUT_FILE "#define sizeof_$sname (sizeof($sname))\n\n";
    }
+
+    print OUT_FILE "#endif /* !$noLevel */\n\n";
 }

-print OUT_FILE "#endif /* WOLFSSL_HAVE_MLKEM */\n\n";
+print OUT_FILE "#endif /* WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM */\n\n";

 # convert and print 256-bit cert/keys
 print OUT_FILE "#if defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)\n\n";
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -69344,16 +69344,12 @@ free_level:
    #define MLKEM_CERT_TEST_KEM
 #endif

-/* Parse the ML-KEM end-entity certificates, confirm the subject public key
- * carries the expected ML-KEM parameter set, and confirm the matching private
- * key reproduces that same public key. */
-static wc_test_ret_t mlkem_cert_test(void)
+/* Check each ML-KEM cert's parameter set, that its private key matches the
+ * public key and, when available, an encapsulate/decapsulate round trip. */
+static wc_test_ret_t mlkem_cert_test(WC_RNG* rng)
 {
    wc_test_ret_t ret = 0;
    int i;
-#ifdef MLKEM_CERT_TEST_KEM
-    WC_RNG rng;
-#endif
    static const struct {
        const byte* cert;
        word32      certSz;
@@ -69361,30 +69357,27 @@ static wc_test_ret_t mlkem_cert_test(void)
        word32      keySz;
        int         level;
    } vectors[] = {
-#if defined(WOLFSSL_WC_ML_KEM_512) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_512)
        { mlkem512_cert_der, sizeof_mlkem512_cert_der,
          mlkem512_key_der, sizeof_mlkem512_key_der, WC_ML_KEM_512 },
 #endif
-#if defined(WOLFSSL_WC_ML_KEM_768) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_768)
        { mlkem768_cert_der, sizeof_mlkem768_cert_der,
          mlkem768_key_der, sizeof_mlkem768_key_der, WC_ML_KEM_768 },
 #endif
-#if defined(WOLFSSL_WC_ML_KEM_1024) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_1024)
        { mlkem1024_cert_der, sizeof_mlkem1024_cert_der,
          mlkem1024_key_der, sizeof_mlkem1024_key_der, WC_ML_KEM_1024 },
 #endif
        { NULL, 0, NULL, 0, 0 }
    };

-#ifdef MLKEM_CERT_TEST_KEM
-    ret = wc_InitRng_ex(&rng, HEAP_HINT, devId);
-    if (ret != 0)
-        return WC_TEST_RET_ENC_EC(ret);
+#ifndef MLKEM_CERT_TEST_KEM
+    (void)rng;
 #endif

    for (i = 0; vectors[i].cert != NULL; i++) {
-        /* One key object at a time: a static memory pool has no room for
-         * both halves of the comparison at once. */
+        /* One key at a time: a static memory pool has no room for two. */
        MlKemKey* key = NULL;
        byte* spki = NULL;
        byte* pubA = NULL;
@@ -69443,7 +69436,7 @@ static wc_test_ret_t mlkem_cert_test(void)
                ret = WC_TEST_RET_ENC_ERRNO;
        }
        if (ret == 0)
-            ret = wc_MlKemKey_Encapsulate(key, ct, ssA, &rng);
+            ret = wc_MlKemKey_Encapsulate(key, ct, ssA, rng);
 #endif
        if (keyInit) {
            wc_MlKemKey_Free(key);
@@ -69490,9 +69483,6 @@ free_vector:
        if (ret != 0)
            break;
    }
-#ifdef MLKEM_CERT_TEST_KEM
-    wc_FreeRng(&rng);
-#endif
    return ret;
 }
 #undef MLKEM_CERT_TEST_KEM
@@ -70148,7 +70138,11 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mlkem_test(void)
 #if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(WOLFSSL_NO_MALLOC) && \
    !defined(NO_ASN) && !defined(NO_CERTS) && \
    defined(WC_ENABLE_ASYM_KEY_IMPORT) && defined(WC_ENABLE_ASYM_KEY_EXPORT)
-    ret = mlkem_cert_test();
+#ifndef WC_NO_RNG
+    ret = mlkem_cert_test(&rng);
+#else
+    ret = mlkem_cert_test(NULL);
+#endif
    if (ret != 0)
        goto out;
 #endif
--- a/wolfssl/certs_test.h
+++ b/wolfssl/certs_test.h
@@ -11928,7 +11928,9 @@ static const unsigned char bench_slhdsa_sha2_128s_msg[] =

 #endif /* WOLFSSL_HAVE_SLHDSA */

-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM)
+
+#if !defined(WOLFSSL_NO_ML_KEM_512)

 /* ./certs/mlkem/mlkem512-cert.der */
 static const unsigned char mlkem512_cert_der[] =
@@ -12688,6 +12690,10 @@ static const unsigned char mlkem512_key_der[] =
 };
 #define sizeof_mlkem512_key_der (sizeof(mlkem512_key_der))

+#endif /* !WOLFSSL_NO_ML_KEM_512 */
+
+#if !defined(WOLFSSL_NO_ML_KEM_768)
+
 /* ./certs/mlkem/mlkem768-cert.der */
 static const unsigned char mlkem768_cert_der[] =
 {
@@ -13561,6 +13567,10 @@ static const unsigned char mlkem768_key_der[] =
 };
 #define sizeof_mlkem768_key_der (sizeof(mlkem768_key_der))

+#endif /* !WOLFSSL_NO_ML_KEM_768 */
+
+#if !defined(WOLFSSL_NO_ML_KEM_1024)
+
 /* ./certs/mlkem/mlkem1024-cert.der */
 static const unsigned char mlkem1024_cert_der[] =
 {
@@ -14549,7 +14559,9 @@ static const unsigned char mlkem1024_key_der[] =
 };
 #define sizeof_mlkem1024_key_der (sizeof(mlkem1024_key_der))

-#endif /* WOLFSSL_HAVE_MLKEM */
+#endif /* !WOLFSSL_NO_ML_KEM_1024 */
+
+#endif /* WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM */

 #if defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)