Skip to content

ML-DSA rename #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dgarske merged 1 commit into from
May 20, 2026
Merged

ML-DSA rename #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/build-config-matrix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
- name: sha512-family
modifiers: "-WOLFSSL_SHA512 -WOLFSSL_SHA384 -HAVE_ED25519 -WOLFSSL_ED25519_STREAMING_VERIFY -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY +NO_SHA512"
- name: sha3-ed448
modifiers: "-WOLFSSL_SHA3 -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY"
modifiers: "-WOLFSSL_SHA3 -WOLFSSL_SHAKE128 -WOLFSSL_SHAKE256 -WOLFSSL_HAVE_MLDSA -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY"
- name: des3
modifiers: "-WOLFSSL_DES3 -WOLFSSL_DES_ECB +NO_DES3"
- name: aes-gcm
Expand Down Expand Up @@ -55,6 +55,10 @@ jobs:
modifiers: "-HAVE_CURVE448"
- name: ed448
modifiers: "-HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY"
- name: mldsa
modifiers: "-WOLFSSL_HAVE_MLDSA"
- name: mldsa-44-only
modifiers: "+WOLFSSL_NO_ML_DSA_65 +WOLFSSL_NO_ML_DSA_87"
- name: hkdf
modifiers: "-HAVE_HKDF -HAVE_ECC_ENCRYPT"
- name: tls-prf
Expand Down
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ WOLFCRYPT_SRC := \
$(WOLFSSL_PATH)/wolfcrypt/src/curve25519.c \
$(WOLFSSL_PATH)/wolfcrypt/src/curve448.c \
$(WOLFSSL_PATH)/wolfcrypt/src/des3.c \
$(WOLFSSL_PATH)/wolfcrypt/src/dilithium.c \
$(WOLFSSL_PATH)/wolfcrypt/src/dsa.c \
$(WOLFSSL_PATH)/wolfcrypt/src/ecc.c \
$(WOLFSSL_PATH)/wolfcrypt/src/ecc_fp.c \
Expand Down Expand Up @@ -63,9 +62,10 @@ WOLFCRYPT_SRC := \
$(WOLFSSL_PATH)/wolfcrypt/src/sp_int.c \
$(WOLFSSL_PATH)/wolfcrypt/src/sp_x86_64.c \
$(WOLFSSL_PATH)/wolfcrypt/src/tfm.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_encrypt.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_lms.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_lms_impl.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_encrypt.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_mldsa.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_mlkem.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_mlkem_poly.c \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_port.c \
Expand Down
3 changes: 3 additions & 0 deletions build-test/build-variant.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ WOLFSSL_SHA224
WOLFSSL_SHA384
WOLFSSL_SHA512
WOLFSSL_SHA3
WOLFSSL_SHAKE128
WOLFSSL_SHAKE256
WOLFSSL_DES3
WOLFSSL_DES_ECB
HAVE_AESGCM
Expand All @@ -66,6 +68,7 @@ WOLFSSL_ED25519_STREAMING_VERIFY
HAVE_CURVE448
HAVE_ED448
WOLFSSL_ED448_STREAMING_VERIFY
WOLFSSL_HAVE_MLDSA
"

flags="${BASELINE}"
Expand Down
125 changes: 62 additions & 63 deletions src/psa_mldsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,7 @@

#include <wolfssl/wolfcrypt/settings.h>

#if defined(WOLFSSL_PSA_ENGINE) && \
(defined(WOLFSSL_HAVE_DILITHIUM) || defined(HAVE_DILITHIUM) || \
defined(WOLFSSL_WC_DILITHIUM))
#if defined(WOLFSSL_PSA_ENGINE) && defined(WOLFSSL_HAVE_MLDSA)

#include <psa/crypto.h>
#include "psa_size.h"
Expand All @@ -38,7 +36,7 @@
#include <wolfssl/wolfcrypt/logging.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/mem_track.h>
#include <wolfssl/wolfcrypt/dilithium.h>
#include <wolfssl/wolfcrypt/wc_mldsa.h>

/* Convert ML-DSA parameter to wolfCrypt key type */
static int psa_ml_dsa_parameter_to_type(psa_ml_dsa_parameter_t parameter)
Expand All @@ -65,12 +63,12 @@ psa_status_t psa_ml_dsa_generate_key(psa_ml_dsa_parameter_t parameter,
size_t *public_key_length)
{
int ret;
dilithium_key key;
wc_MlDsaKey key;
int type;
WC_RNG rng;
word32 priv_len;
word32 pub_len;

/* Convert parameter to wolfCrypt key type */
type = psa_ml_dsa_parameter_to_type(parameter);
if (type < 0) {
Expand All @@ -80,54 +78,54 @@ psa_status_t psa_ml_dsa_generate_key(psa_ml_dsa_parameter_t parameter,
(wolfpsa_check_word32_length(public_key_size) != PSA_SUCCESS)) {
return PSA_ERROR_INVALID_ARGUMENT;
}

/* Initialize ML-DSA key */
ret = wc_dilithium_init_ex(&key, NULL, INVALID_DEVID);
ret = wc_MlDsaKey_Init(&key, NULL, INVALID_DEVID);
if (ret != 0) {
return wc_error_to_psa_status(ret);
}
ret = wc_dilithium_set_level(&key, (byte)type);
ret = wc_MlDsaKey_SetParams(&key, (byte)type);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Initialize RNG */
ret = wc_InitRng(&rng);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Generate key pair */
ret = wc_dilithium_make_key(&key, &rng);
ret = wc_MlDsaKey_MakeKey(&key, &rng);
if (ret != 0) {
wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

priv_len = (word32)private_key_size;
ret = wc_dilithium_export_private(&key, private_key, &priv_len);
ret = wc_MlDsaKey_ExportPrivRaw(&key, private_key, &priv_len);
if (ret != 0) {
wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

pub_len = (word32)public_key_size;
ret = wc_dilithium_export_public(&key, public_key, &pub_len);
ret = wc_MlDsaKey_ExportPubRaw(&key, public_key, &pub_len);
if (ret != 0) {
wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}
*private_key_length = priv_len;
*public_key_length = pub_len;

wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);

return PSA_SUCCESS;
}

Expand All @@ -142,12 +140,12 @@ psa_status_t psa_ml_dsa_sign(psa_ml_dsa_parameter_t parameter,
size_t *signature_length)
{
int ret;
dilithium_key key;
wc_MlDsaKey key;
int type;
int sig_size;
WC_RNG rng;
word32 sigLen;

/* Convert parameter to wolfCrypt key type */
type = psa_ml_dsa_parameter_to_type(parameter);
if (type < 0) {
Expand All @@ -158,56 +156,57 @@ psa_status_t psa_ml_dsa_sign(psa_ml_dsa_parameter_t parameter,
(wolfpsa_check_word32_length(signature_size) != PSA_SUCCESS)) {
return PSA_ERROR_INVALID_ARGUMENT;
}

/* Initialize ML-DSA key */
ret = wc_dilithium_init_ex(&key, NULL, INVALID_DEVID);
ret = wc_MlDsaKey_Init(&key, NULL, INVALID_DEVID);
if (ret != 0) {
return wc_error_to_psa_status(ret);
}
ret = wc_dilithium_set_level(&key, (byte)type);
ret = wc_MlDsaKey_SetParams(&key, (byte)type);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Import private key */
ret = wc_dilithium_import_private(private_key, (word32)private_key_size, &key);
ret = wc_MlDsaKey_ImportPrivRaw(&key, private_key, (word32)private_key_size);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Check signature buffer size */
sig_size = wc_dilithium_sig_size(&key);
sig_size = wc_MlDsaKey_SigSize(&key);
if (sig_size < 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(sig_size);
}
if (signature_size < (size_t)sig_size) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return PSA_ERROR_BUFFER_TOO_SMALL;
}

ret = wc_InitRng(&rng);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Sign message (ML-DSA pure, empty context per FIPS 204) */
sigLen = (word32)signature_size;
ret = wc_dilithium_sign_ctx_msg(NULL, 0, message, (word32)message_length,
signature, &sigLen, &key, &rng);
ret = wc_MlDsaKey_SignCtx(&key, NULL, 0,
signature, &sigLen,
message, (word32)message_length, &rng);
if (ret != 0) {
wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}
*signature_length = sigLen;

wc_FreeRng(&rng);
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);

return PSA_SUCCESS;
}

Expand All @@ -221,10 +220,10 @@ psa_status_t psa_ml_dsa_verify(psa_ml_dsa_parameter_t parameter,
size_t signature_length)
{
int ret;
dilithium_key key;
wc_MlDsaKey key;
int type;
int verify_res = 0;

/* Convert parameter to wolfCrypt key type */
type = psa_ml_dsa_parameter_to_type(parameter);
if (type < 0) {
Expand All @@ -235,41 +234,41 @@ psa_status_t psa_ml_dsa_verify(psa_ml_dsa_parameter_t parameter,
(wolfpsa_check_word32_length(signature_length) != PSA_SUCCESS)) {
return PSA_ERROR_INVALID_ARGUMENT;
}

/* Initialize ML-DSA key */
ret = wc_dilithium_init_ex(&key, NULL, INVALID_DEVID);
ret = wc_MlDsaKey_Init(&key, NULL, INVALID_DEVID);
if (ret != 0) {
return wc_error_to_psa_status(ret);
}
ret = wc_dilithium_set_level(&key, (byte)type);
ret = wc_MlDsaKey_SetParams(&key, (byte)type);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Import public key */
ret = wc_dilithium_import_public(public_key, (word32)public_key_size, &key);
ret = wc_MlDsaKey_ImportPubRaw(&key, public_key, (word32)public_key_size);
if (ret != 0) {
wc_dilithium_free(&key);
wc_MlDsaKey_Free(&key);
return wc_error_to_psa_status(ret);
}

/* Verify signature (ML-DSA pure, empty context per FIPS 204) */
ret = wc_dilithium_verify_ctx_msg(signature, (word32)signature_length,
NULL, 0, message, (word32)message_length,
&verify_res, &key);
wc_dilithium_free(&key);
ret = wc_MlDsaKey_VerifyCtx(&key, signature, (word32)signature_length,
NULL, 0,
message, (word32)message_length, &verify_res);

wc_MlDsaKey_Free(&key);

if (ret != 0) {
return wc_error_to_psa_status(ret);
}

if (verify_res != 1) {
return PSA_ERROR_INVALID_SIGNATURE;
}

return PSA_SUCCESS;
}

#endif /* WOLFSSL_PSA_ENGINE && DILITHIUM */
#endif /* WOLFSSL_PSA_ENGINE && WOLFSSL_HAVE_MLDSA */
4 changes: 2 additions & 2 deletions src/psa_pq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ psa_status_t psa_pq_check_key_type_supported(psa_key_type_t type)
case PSA_KEY_TYPE_ML_KEM_PUBLIC_KEY:
return PSA_SUCCESS;
#endif
#if defined(WOLFSSL_HAVE_DILITHIUM)
#if defined(WOLFSSL_HAVE_MLDSA)
case PSA_KEY_TYPE_ML_DSA_KEY_PAIR:
case PSA_KEY_TYPE_ML_DSA_PUBLIC_KEY:
return PSA_SUCCESS;
Expand Down Expand Up @@ -87,7 +87,7 @@ psa_status_t psa_pq_check_key_size_valid(psa_key_type_t type, size_t bits)
}
return PSA_ERROR_INVALID_ARGUMENT;
#endif
#if defined(WOLFSSL_HAVE_DILITHIUM)
#if defined(WOLFSSL_HAVE_MLDSA)
case PSA_KEY_TYPE_ML_DSA_KEY_PAIR:
case PSA_KEY_TYPE_ML_DSA_PUBLIC_KEY:
/* ML-DSA key sizes: 2, 3, 5 (security levels) */
Expand Down
Loading
Loading