Nothing committed exercised the port through wolfCrypt's own suites. Give both
samples an frdm_rw612 board overlay that turns the offload on; settings.h already
maps WC_USE_DEVID at WOLFSSL_ELS_PKC_DEVID, which is what the unmodified test and
benchmark read, and defining it also defines BENCH_DEVID, so the benchmark
measures every algorithm twice and labels the rows HW and SW.
Both suites pass on frdm_rw612.
- WOLFSSL_IP_ALT_NAME no longer requires NETWORKING with USER_IO or
CRYPTO_ONLY: the only socket use is the TLS layer's MatchIPv6(), which
is compiled out under WOLFSSL_USER_IO. prj-x25519-ed448.conf now
enables it with user I/O and no network stack.
- WOLFSSL_CERT_EXT no longer depends on WOLFSSL_CERT_GEN, matching
--enable-certext, since the macro also enables extension decoding.
- Add a wolfssl_tls_sock build with tls_cert.conf, so the TLS-only
options (post-handshake auth, IP SAN matching, kept peer cert) are
linked into a real handshake rather than dropped by the wolfCrypt test
app.
- Document the app-directory overlay fallback in zephyr-test.sh usage.
The wolfssl_test_cert, _x25519_ed448 and _ed25519_x448 twister scenarios
were not run by any workflow: zephyr.yml names its scenarios explicitly
and zephyr-4.x.yml builds from builds.txt instead of running twister.
Add all three to builds.txt, so each builds and runs on native_sim for
every Zephyr version in the 4.x matrix. The curve-split scenarios move
from extra_configs into prj-x25519-ed448.conf and prj-ed25519-x448.conf
so twister and the CI list read the same files, and zephyr-test.sh now
takes an overlay that is not in its own directory from the app
directory instead.
A Kconfig-configured wolfSSL could not enable CSR or key generation or
PKCS#7, so a consumer needing them, such as a certificate enrollment
client, had to supply a full settings file. Add options for
WOLFSSL_CERT_REQ, WOLFSSL_KEY_GEN, WOLFSSL_ALT_NAMES,
WOLFSSL_IP_ALT_NAME, WOLFSSL_CERT_NAME_ALL, WOLFSSL_PUBLIC_ASN and
HAVE_PKCS7, the last with the AES key wrap and X9.63 KDF that
--enable-pkcs7 adds, and for TLS 1.3 post-handshake authentication. All
default off. IP_ALT_NAME depends on NETWORKING, since its address
matching needs the socket address types.
Split WOLFSSL_CURVE25519 into X25519 and a new WOLFSSL_ED25519, which
defaults on with it so existing configurations keep Ed25519, and add
the same pair for Curve448 and Ed448.
PKCS#7 depends on RSA, ECC or ML-DSA, as settings.h requires a signing
algorithm.
A new wolfssl_test scenario turns every option on. Two more build each
X and Ed curve without its counterpart, one of them with WOLFSSL_USER_IO
and no network stack.
CONFIG_WOLFSSL_AES_CONSTANT_TIME left two holes that the option and
wolfPSA's psa_config.h check both missed.
GHASH. The module hardcoded GCM_SMALL, whose GMULT branches on every bit
of the hash subkey H. WOLFSSL_AES_TOUCH_LINES and WC_AES_BITSLICED only
change the AES block cipher core, so AES-GCM was not constant time with
the option on. The only constant-time C GHASH is the masked bitwise
multiply wolfCrypt builds when no GCM method is defined.
Add a GHASH choice. It defaults to that bitwise multiply, and offers the
4-bit and 8-bit tables as opt-ins that depend on !WOLFSSL_AES_CONSTANT_TIME.
GCM_SMALL is no longer offered on plain C builds: it is not constant
time either, and in a host autoconf build its GMAC ran at 16.6 MiB/s
against 162 MiB/s for the bitwise multiply and 726 MiB/s for the 4-bit
table.
Assembly. With CONFIG_WOLFCRYPT_ASM on Arm the Thumb2, ARM32 and AArch64
assembly replaces the C AES core outright, and it indexes 1 KB T-tables
with secret data. wolfCrypt has no macro to drop only the AES assembly,
and the build accepted touch-lines alongside it without a word: on
mps2/an521 the image linked AES_encrypt_block and L_AES_Thumb2_te_data.
GHASH under the Arm assembly is a table or the bitwise multiply that
branches on H, never the masked one. So the constant-time option is no
longer available where the module builds the Arm symmetric assembly -
ARMv7-M and ARMv8-M mainline, 32-bit Cortex-A/R and AArch64 - and the
GHASH choice defaults to the 4-bit table there, with GCM_SMALL kept as
a tableless option. A hidden WOLFCRYPT_ARM_SYMMETRIC_ASM now holds that
core list, and user_settings.h and CMakeLists.txt test it instead of
repeating the condition. AArch64 parts with the crypto extension lose the
option too, because Kconfig cannot see that compiler feature. ARMv6-M
and ARMv8-M baseline keep it: they get assembly for the SP math only.
x86_64 is unaffected: USE_INTEL_SPEEDUP leaves the C AES core in place,
so touch-lines takes effect.
FIPS v2 and v5 pin an aes.c older than the masked multiply: v5 builds
it only under AES_GCM_GMULT_CT and v2 not at all. Both keep GCM_SMALL as
their default, so a validated build keeps its boundary object. Under v5
the constant-time choice also defines AES_GCM_GMULT_CT; under v2 it is
not offered, and neither is the 4-bit table, which v2's aes.c predates.
FIPS v6 and later have the masked multiply by default and can still
pick GCM_SMALL to keep an existing boundary object.
A configuration that set both options now gets a Kconfig warning and
the option turned off, instead of table-based AES under a constant-time
label.
New wolfssl_test scenarios cover the two tables and the constant-time
AES core on qemu_x86, and the 8-bit table under the Thumb2 and AArch64
assembly. All thirteen wolfssl_test scenarios pass on
qemu_x86, qemu_x86_64, qemu_cortex_a53 and mps2/an521/cpu0, and the
symbols confirm each one linked the GHASH it selected.
Four options guarded the assembly - WOLFCRYPT_ARMASM, its THUMB2 companion,
WOLFCRYPT_INTELASM, and nothing at all for the single-precision math - and
between them they could not express a working configuration on any target.
WOLFCRYPT_ARMASM_THUMB2 selected the thumb2 sources but nothing defined
WOLFSSL_ARMASM_THUMB2, so the link failed on AES_*_AARCH32. WOLFCRYPT_INTELASM
named the 32-bit sources while user_settings.h declared WOLFSSL_X86_64_BUILD,
so aes_asm.S compiled to an empty object and aes_gcm_x86_asm.S emitted 32-bit
code into a 64-bit build.
Only one combination is ever right for a given board, so the four collapse
into WOLFCRYPT_ASM and the module derives the rest from the CPU Zephyr
reports. ARMv6-M and ARMv8-M baseline get no symmetric assembly - the Thumb2
port uses UBFX and LDRD, which those cores do not have - and keep the Thumb
math.
Each ARM port sets two single-precision macros. WOLFSSL_SP_<cpu>_ASM compiles
the per-size backend; the unsuffixed WOLFSSL_SP_<cpu> enables the inline-asm
word primitives in sp_int.c, which is what the generic WOLFSSL_SP_MATH_ALL
path uses for every other size and curve. Defining only the _ASM half, as this
module did, left Brainpool, custom curves and any uncovered RSA or DH size
with no assembly at all.
Every ARM profile needs WOLFSSL_ARMASM_NO_HW_CRYPTO unless the toolchain says
otherwise. The ARMv8-32 sources carry no .arch_extension, so a plain ARMv7
part rejects aese.8 outright; the AArch64 ones do carry it and always
assemble, which moves the failure rather than removing it, since cpuid.c has
no ID registers to read here and reports AES, PMULL and SHA-256 present
whenever the macro is unset. Key it on __ARM_FEATURE_CRYPTO, and the ARMv8.1
RDMA opt-out on __ARM_FEATURE_QRDMX for the same reason.
ML-KEM's small-memory key generation and encapsulation are dropped where the
assembly is on for x86_64 or AArch64: wc_mlkem.c rejects that combination with
an #error rather than falling back.
Neither 32-bit x86 nor the x86_64 single-precision assembly is offered. The
latter is worth recording: sp_x86_64_asm.S is AVX throughout and sp_x86_64.c
calls into it with no CPUID dispatch and no scalar counterpart, while Zephyr
never sets CR4.OSXSAVE, so those instructions fault.
Both set(TOOLCHAIN_C_FLAGS ...) calls go: Zephyr applies that variable
globally before it add_subdirectory's modules, so the assignment ran after the
flags were consumed and never reached the parent scope either.
HAVE___UINT128_T is defined wherever the compiler has the type, since with
user settings nobody sets it and sp_int.c fails on an undeclared sp_int_word.
One wolfssl_test scenario per port covers the option: qemu_x86_64 for Intel,
qemu_cortex_a53 for AArch64, and mps2/an521/cpu0 for Thumb2. AArch64 gets a
second at -mcpu=cortex-a53+crypto, since the guard above keeps the hardware
blocks out of the first and the .arch_extension directives would otherwise
never be assembled here.
Measured on frdm_rw612, ops/sec: ECDSA P-256 sign 16 to 136, verify 10 to 102,
RSA-2048 public 86 to 194.
Kconfig.tls-generic is a copy of Zephyr's mbedTLS file with the symbol prefix
renamed, which is why a wolfSSL module carries options named after mbedTLS
internals. Renaming was all that happened: of its 53 config symbols, exactly
two reach any code, WOLFSSL_TLS_VERSION_1_2 and _1_3. Checked every symbol
against the whole workspace; the other 51 appear only in that file, so
CONFIG_WOLFSSL_ECP_DP_SECP384R1_ENABLED=y has always done nothing.
Three are worse than inert: WOLFSSL_TLS_VERSION_1_0, _1_1 and _1_3 select
symbols that are defined nowhere, and Kconfig accepts that silently, so the
reader sees a mechanism that does not exist.
Delete the file and move the two live symbols into the module's own Kconfig,
next to WOLFSSL_DTLS, keeping the settings-file dependency. The dead selects
go with it, as do four dead options the TLS samples were setting and a stale
entry in .wolfssl_known_macro_extras.
TLS 1.3 gains a default of y. The old file had 1.2 on and 1.3 off, Zephyr's
mbedTLS default from 2018, while wolfSSL's own configure enables both. Keeping
1.2 as well preserves interop with the TLS 1.2-only peers embedded deployments
still meet; a 1.3-only build works by clearing the 1.2 option.
That default is also what first reached DefTicketEncCb(), hence the wolfio
byte-order fix earlier in this branch.
The build-profile options only write the module's user_settings.h, which is
never read when the application supplies its own settings file. So
CONFIG_WOLFSSL_ECC_384=y alongside a settings file was accepted and silently
ignored, as was every other feature option.
They now depend on not having one. This needs a tracking bool, because
WOLFSSL_SETTINGS_FILE is a string symbol and Kconfig evaluates a string in a
logical context as always-false, which would have made every one of these
dependencies quietly unsatisfiable.
FIPS is gated on the master switch rather than each version: on the choice
members alone the version prompt would stay visible with nothing selectable,
while CMake still compiled the FIPS bundle.
Kconfig.tls-generic is left alone here - only two of its 53 symbols reach any
code, so gating the rest would make dead options look conditional, and the
commit after this one deletes it. Options that drive the build rather than the
wolfCrypt configuration stay selectable either way.
The curve Kconfigs decide which curves wolfCrypt compiles and which SP
implementation backs them, and getting that pairing wrong fails at runtime
with WC_KEY_SIZE_E rather than at build time. Two wolfssl_test scenarios pin
the combinations that matter: the NIST curves on their per-curve SP paths, and
the Brainpool set that forces the generic backend, with no P-521 present to
lend it a curve ceiling.
wc_port.h guarded a sys_clock_gettime()/sys_clock_settime() remap with
"#ifndef CLOCK_REALTIME". On Zephyr 4.3 and newer the same header includes
<time.h>, and both picolibc and newlib define CLOCK_REALTIME as 1. The guard was
therefore always false, the whole block was skipped, and z_time() called
clock_gettime() - a symbol Zephyr only defines when the application enables
CONFIG_POSIX_TIMERS, which is itself gated behind CONFIG_POSIX_SYSTEM_INTERFACES.
A build without them failed:
test.c:3657:9: error: implicit declaration of function 'clock_settime';
did you mean 'sys_clock_settime'?
Making the remap unconditional fixes that build but hands every consumer a
library-wide rewrite of two POSIX names. wc_port.h is reached from every
wolfCrypt header, so an application calling clock_gettime() would silently get
sys_clock_gettime(), which reports failure as a negative errno instead of -1
plus errno, and code that stores a function pointer under either name would stop
compiling depending on its include order.
Drop the macros and name the Zephyr API at the three places that need it -
z_time(), the wolfCrypt test's dummy wallclock and the threaded TLS sample -
keeping the POSIX call for Zephyr versions without SYS_CLOCK_REALTIME.
sys_clock_gettime() lives in lib/os/clock.c and is core Zephyr rather than
POSIX, so a Zephyr build no longer has to enable the POSIX layer just to satisfy
wc_port.c.
* Enable ML-KEM by default in build systems (autoconf and CMake)
* Only allow three to-be-standardized hybrid PQ/T combinations by
default
* Use X25519MLKEM768 as the default KeyShare in the ClientHello (if user
does not override that). When Curve25519 is disabled, then either
WOLFSSL_SECP384R1MLKEM1024 or WOLFSSL_SECP256R1MLKEM768 is used as
default depending on the ECC configuration
* Disable standalone ML-KEM in supported groups by default (enable with
--enable-tls-mlkem-standalone)
* Disable extra OQS-based hybrid PQ/T curves by default and gate
behind --enable-experimental (enable with --enable-extra-pqc-hybrids)
* Reorder the SupportedGroups extension to reflect the preferences
* Reorder the preferredGroup array to also reflect the same preferences
* Add async support for ML-KEM hybrids
* Store in extensions the full octet string
Store in WOLFSSL_X509_EXTENSION.value always the full contents of the
OCTET STRING of the extension, instead of different type of data
depending on the type of extension. Previously this was only done for
unknown extensions.
* Avoid local variables in 'DecodeExtKeyUsageInternal'
There is a great performance loss on configs using 'WOLFSSL_NO_MALLOC',
'WOLFSSL_STATIC_MEMORY' and 'USE_FAST_MATH' if function
'DecodeExtKeyUsageInternal' uses intermediate variables. This can be
observed running the Zephyr test 'wolfssl_test/prj-no-malloc.conf'.
Avoid using intermediate variables, and use raw pointers to the final
destination instead.
* Add missing calls to 'FreeDecodedCert'
* Return error code from 'wolfSSL_ASN1_STRING_into_old_ext_fmt'
* Fix lines larger than 80
* Allow NULL parameters for 'DecodeAuthKeyId'
* Add comment explaining build option '--enable-old-extdata-fmt'
* Test full OCTET STRING in tests/api.c
* wolfSSL_X509V3_EXT_d2i: Honor 'WOLFSSL_SMALL_STACK'
* zephyr/wolfssl_test_no_malloc: Increase test timeout
* wolfSSL_X509V3_EXT_d2i: Extract repeated code into common part
* wolfcrypt: Remove 'WOLFSSL_LOCAL' from .c files
* wolfcrypt: Change location of functions to make diff easier
- Need to call fs_file_t_init() before calling fs_open()
- 0 is a valid POSIX socket number
- Include stdio.h when needed to simplify macro logic
- Define Zephyr specific macros in CMakeLists.txt to make for a better user experience
* zephyr wolfssl_tls_sock: fix project name
* zephyr tls_sock.c: don't include options.h when using user settings
* zephyr: define XSTAT_TYPE for use with XSTAT
- Add CONFIG_PTHREAD_IPC when using threads
- Add logging config suggestions
- test.c: fix undefined `ret` error
- Increase stack size for samples
- Ignore ASN_BEFORE_DATE_E in examples
- wc_port.h: add missing posix thread includes
- wc_port.h: move definitions to relevant section
- benchmark.c: fix missing `arc` and `argv` errors
- benchmark.c: fflush does not work on stdout in Zephyr
- Update z_fs_open implementation to support flags
* PSA: set AES key bits, define PSA_ALG_NONE/PSA_KEY_ID_NULL if needed
* Zephyr: add TimeNowInMilliseconds() for tls13.c, clock_settime() for test.c, update CMakeLists.txt
* Skip including unistd.h for Zephyr in benchmark.c
* Zephyr: update README, add nRF5340dk support to wolfssl_test sample app
* Zephyr: add wolfCrypt benchmark sample app
* Zephyr: add nRF5340 support to tls_thread sample app
* PSA: use specific hash algo with psa_sign/verify_hash()
* Zephyr: add support for PSA Crypto API with PK callbacks to wolfssl_tls_threaded sample app
* Zephyr: add new files to zephyr/include.am
