Skip to content

Commit ae7509e

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #8813 from gojimmypi/espressif-mlkem-support
Adjust Espressif Examples for Post Quantum ML-KEM
2 parents 9ffca6b + a9db6d0 commit ae7509e

15 files changed

Lines changed: 420 additions & 124 deletions

File tree

‎.wolfssl_known_macro_extras‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ CONFIG_ESP_TLS_USING_WOLFSSL
8787
CONFIG_ESP_WIFI_PASSWORD
8888
CONFIG_ESP_WIFI_SSID
8989
CONFIG_ESP_WOLFSSL_ENABLE_KYBER
90+
CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
9091
CONFIG_ESP_WOLFSSL_ENABLE_WOLFSSH
9192
CONFIG_ESP_WOLFSSL_NO_ESP32_CRYPT
9293
CONFIG_ESP_WOLFSSL_NO_HW_AES
@@ -674,6 +675,7 @@ WOLFSSL_EDDSA_CHECK_PRIV_ON_SIGN
674675
WOLFSSL_EMNET
675676
WOLFSSL_ESPWROOM32
676677
WOLFSSL_EVP_PRINT
678+
WOLFSSL_EXPERIMENTAL_SETTINGS
677679
WOLFSSL_EXPORT_INT
678680
WOLFSSL_EXPORT_SPC_SZ
679681
WOLFSSL_EXTRA
@@ -690,6 +692,7 @@ WOLFSSL_HARDEN_TLS_ALLOW_OLD_TLS
690692
WOLFSSL_HARDEN_TLS_ALLOW_TRUNCATED_HMAC
691693
WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK
692694
WOLFSSL_HARDEN_TLS_NO_SCR_CHECK
695+
WOLFSSL_HAVE_MLKEM
693696
WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
694697
WOLFSSL_I2D_ECDSA_SIG_ALLOC
695698
WOLFSSL_IAR_ARM_TIME
@@ -702,6 +705,9 @@ WOLFSSL_IMXRT_DCP
702705
WOLFSSL_ISOTP
703706
WOLFSSL_KEIL
704707
WOLFSSL_KEIL_NET
708+
WOLFSSL_KYBER1024
709+
WOLFSSL_KYBER512
710+
WOLFSSL_KYBER768
705711
WOLFSSL_KYBER_NO_DECAPSULATE
706712
WOLFSSL_KYBER_NO_ENCAPSULATE
707713
WOLFSSL_KYBER_NO_MAKE_KEY
@@ -755,6 +761,9 @@ WOLFSSL_NO_KCAPI_HMAC_SHA256
755761
WOLFSSL_NO_KCAPI_HMAC_SHA384
756762
WOLFSSL_NO_KCAPI_HMAC_SHA512
757763
WOLFSSL_NO_KCAPI_SHA224
764+
WOLFSSL_NO_ML_KEM_1024
765+
WOLFSSL_NO_ML_KEM_512
766+
WOLFSSL_NO_ML_KEM_768
758767
WOLFSSL_NO_OCSP_DATE_CHECK
759768
WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK
760769
WOLFSSL_NO_OCSP_OPTIONAL_CERTS
@@ -817,6 +826,8 @@ WOLFSSL_SERVER_EXAMPLE
817826
WOLFSSL_SETTINGS_FILE
818827
WOLFSSL_SH224
819828
WOLFSSL_SHA256_ALT_CH_MAJ
829+
WOLFSSL_SHAKE128
830+
WOLFSSL_SHAKE256
820831
WOLFSSL_SHUTDOWNONCE
821832
WOLFSSL_SILABS_TRNG
822833
WOLFSSL_SM4_EBC
@@ -858,6 +869,7 @@ WOLFSSL_USE_FLASHMEM
858869
WOLFSSL_USE_OPTIONS_H
859870
WOLFSSL_USE_POPEN_HOST
860871
WOLFSSL_VALIDATE_DH_KEYGEN
872+
WOLFSSL_WC_MLKEM
861873
WOLFSSL_WC_XMSS_NO_SHA256
862874
WOLFSSL_WC_XMSS_NO_SHAKE256
863875
WOLFSSL_WICED_PSEUDO_UNIX_EPOCH_TIME

‎IDE/Espressif/ESP-IDF/examples/template/components/wolfssl/Kconfig‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -401,24 +401,25 @@ menu "wolfSSL"
401401
when performance is critical. See also metrics for counting instances.
402402

403403
endmenu # wolfSSL Hardware Acceleration
404+
404405
# -----------------------------------------------------------------------------------------------------------------
405406

406407
# -----------------------------------------------------------------------------------------------------------------
407-
menu "wolfSSL Experimental Options"
408+
menu "wolfSSL Post Quantum Kyber KEM PQ"
408409

409-
config ESP_WOLFSSL_EXPERIMENTAL_SETTINGS
410-
bool "Enable wolfSSL Experimental Settings"
410+
config ESP_WOLFSSL_ENABLE_MLKEM
411+
bool "Enable ML-KEM (Kyber Post Quantum)"
411412
default n
412413
help
413-
Enables experimental settings for wolfSSL. See documentation.
414+
bool "Enable wolfSSL ML-KEM"
414415

415-
config ESP_WOLFSSL_ENABLE_KYBER
416-
bool "Enable wolfSSL Kyber"
416+
config WOLFSSL_ENABLE_KYBER
417+
bool "Enable Kyber (Round 3)"
417418
default n
418419
help
419-
Enable debugging messages for wolfSSL. See user_settings.h for additional debug options.
420+
Enable old compatibility with Kyber Round 3 (enables experimental settings)
420421

421-
endmenu # wolfSSL Experimental Options
422+
endmenu # wolfSSL Post Quantum Kyber KEM PQ
422423
# -----------------------------------------------------------------------------------------------------------------
423424

424425
# -----------------------------------------------------------------------------------------------------------------
@@ -435,6 +436,11 @@ menu "wolfSSL"
435436
help
436437
Enable a loop wrapper for benchmark, http_client, and wolfssl test apps.
437438

439+
config ESP_WOLFSSL_EXPERIMENTAL_SETTINGS
440+
bool "Enable wolfSSL Experimental Settings"
441+
default n
442+
help
443+
Enables experimental settings for wolfSSL. See documentation.
438444
endmenu # wolfSSL Debug Options
439445
# -----------------------------------------------------------------------------------------------------------------
440446

‎IDE/Espressif/ESP-IDF/examples/template/components/wolfssl/include/user_settings.h‎

Lines changed: 43 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -209,18 +209,40 @@
209209
/* the code is older or does not have application name defined. */
210210
#endif /* Example wolfSSL Configuration app settings */
211211

212-
/* Experimental Kyber */
213-
#ifdef CONFIG_WOLFSSL_ENABLE_KYBER
212+
/* Optional MLKEM (Kyber Post Quantum) */
213+
/* ./configure --enable-mlkem */
214+
/* See Kconfig / menuconfig ESP_WOLFSSL_ENABLE_MLKEM */
215+
#ifdef CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
214216
/* Kyber typically needs a minimum 10K stack */
215-
#define WOLFSSL_EXPERIMENTAL_SETTINGS
216217
#define WOLFSSL_HAVE_MLKEM
217218
#define WOLFSSL_WC_MLKEM
218-
#define WOLFSSL_SHA3
219+
#define WOLFSSL_SHAKE128
220+
#define WOLFSSL_SHAKE256
221+
222+
/* Old code points to keep compatibility with Kyber Round 3. */
223+
/* ./configure --enable-kyber=all --enable-experimental */
224+
#if defined(CONFIG_WOLFSSL_ENABLE_KYBER)
225+
#define WOLFSSL_MLKEM_KYBER
226+
#define WOLFSSL_EXPERIMENTAL_SETTINGS
227+
#endif
228+
219229
#if defined(CONFIG_IDF_TARGET_ESP8266)
220230
/* With limited RAM, we'll disable some of the Kyber sizes: */
221231
#define WOLFSSL_NO_KYBER1024
222232
#define WOLFSSL_NO_KYBER768
233+
#define WOLFSSL_NO_ML_KEM_1024
234+
#define WOLFSSL_NO_ML_KEM_768
223235
#define NO_SESSION_CACHE
236+
#else
237+
/* Only needed for older wolfssl versions, see mlkem.h */
238+
#define WOLFSSL_KYBER1024
239+
/* optional alternative sizes: */
240+
/* #define WOLFSSL_KYBER768 */
241+
/* #define WOLFSSL_KYBER512 */
242+
/* -- or disable a specific one: */
243+
/* #define WOLFSSL_NO_ML_KEM_1024 */
244+
/* #define WOLFSSL_NO_ML_KEM_768 */
245+
/* #define WOLFSSL_NO_ML_KEM_512 */
224246
#endif
225247
#endif
226248

@@ -532,7 +554,7 @@
532554
/* Adjust wait-timeout count if you see timeout in RSA HW acceleration.
533555
* Set to very large number and enable WOLFSSL_HW_METRICS to determine max. */
534556
#ifndef ESP_RSA_TIMEOUT_CNT
535-
#define ESP_RSA_TIMEOUT_CNT 0xFF0000
557+
#define ESP_RSA_TIMEOUT_CNT 0xFF0000
536558
#endif
537559

538560
/* hash limit for test.c */
@@ -560,8 +582,6 @@
560582
defined(WOLFSSL_SP_RISCV32)
561583
#endif
562584

563-
#define WOLFSSL_SMALL_STACK
564-
565585

566586
#define HAVE_VERSION_EXTENDED_INFO
567587
/* #define HAVE_WC_INTROSPECTION */
@@ -936,6 +956,8 @@ Turn on timer debugging (used when CPU cycles not available)
936956
#define ATCA_WOLFSSL
937957
*/
938958

959+
/* optional SM4 Ciphers. See github.com/wolfSSL/wolfsm */
960+
939961
/***************************** Certificate Macros *****************************
940962
*
941963
* The section below defines macros used in typically all of the wolfSSL
@@ -1027,9 +1049,14 @@ Turn on timer debugging (used when CPU cycles not available)
10271049
#define WOLFSSL_BASE16
10281050
#else
10291051
#if defined(USE_CERT_BUFFERS_2048)
1030-
#define USE_CERT_BUFFERS_256
1052+
#ifdef USE_CERT_BUFFERS_1024
1053+
#error "USE_CERT_BUFFERS_1024 is already defined. Pick one."
1054+
#endif
1055+
10311056
/* Be sure to include in app when using example certs: */
1032-
/* #include <wolfssl/certs_test.h> */
1057+
#include <wolfssl/certs_test.h>
1058+
1059+
#define USE_CERT_BUFFERS_256
10331060
#define CTX_CA_CERT ca_cert_der_2048
10341061
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_2048
10351062
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1
@@ -1049,9 +1076,14 @@ Turn on timer debugging (used when CPU cycles not available)
10491076
#define CTX_CLIENT_KEY_TYPE WOLFSSL_FILETYPE_ASN1
10501077

10511078
#elif defined(USE_CERT_BUFFERS_1024)
1052-
#define USE_CERT_BUFFERS_256
1079+
#ifdef USE_CERT_BUFFERS_2048
1080+
#error "USE_CERT_BUFFERS_2048 is already defined. Pick one."
1081+
#endif
1082+
10531083
/* Be sure to include in app when using example certs: */
1054-
/* #include <wolfssl/certs_test.h> */
1084+
#include <wolfssl/certs_test.h>
1085+
1086+
#define USE_CERT_BUFFERS_256
10551087
#define CTX_CA_CERT ca_cert_der_1024
10561088
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_1024
10571089
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1

‎IDE/Espressif/ESP-IDF/examples/wolfssl_benchmark/components/wolfssl/Kconfig‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -401,24 +401,25 @@ menu "wolfSSL"
401401
when performance is critical. See also metrics for counting instances.
402402

403403
endmenu # wolfSSL Hardware Acceleration
404+
404405
# -----------------------------------------------------------------------------------------------------------------
405406

406407
# -----------------------------------------------------------------------------------------------------------------
407-
menu "wolfSSL Experimental Options"
408+
menu "wolfSSL Post Quantum Kyber KEM PQ"
408409

409-
config ESP_WOLFSSL_EXPERIMENTAL_SETTINGS
410-
bool "Enable wolfSSL Experimental Settings"
410+
config ESP_WOLFSSL_ENABLE_MLKEM
411+
bool "Enable ML-KEM (Kyber Post Quantum)"
411412
default n
412413
help
413-
Enables experimental settings for wolfSSL. See documentation.
414+
bool "Enable wolfSSL ML-KEM"
414415

415-
config ESP_WOLFSSL_ENABLE_KYBER
416-
bool "Enable wolfSSL Kyber"
416+
config WOLFSSL_ENABLE_KYBER
417+
bool "Enable Kyber (Round 3)"
417418
default n
418419
help
419-
Enable debugging messages for wolfSSL. See user_settings.h for additional debug options.
420+
Enable old compatibility with Kyber Round 3 (enables experimental settings)
420421

421-
endmenu # wolfSSL Experimental Options
422+
endmenu # wolfSSL Post Quantum Kyber KEM PQ
422423
# -----------------------------------------------------------------------------------------------------------------
423424

424425
# -----------------------------------------------------------------------------------------------------------------
@@ -435,6 +436,11 @@ menu "wolfSSL"
435436
help
436437
Enable a loop wrapper for benchmark, http_client, and wolfssl test apps.
437438

439+
config ESP_WOLFSSL_EXPERIMENTAL_SETTINGS
440+
bool "Enable wolfSSL Experimental Settings"
441+
default n
442+
help
443+
Enables experimental settings for wolfSSL. See documentation.
438444
endmenu # wolfSSL Debug Options
439445
# -----------------------------------------------------------------------------------------------------------------
440446

‎IDE/Espressif/ESP-IDF/examples/wolfssl_benchmark/components/wolfssl/include/user_settings.h‎

Lines changed: 43 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -209,18 +209,40 @@
209209
/* the code is older or does not have application name defined. */
210210
#endif /* Example wolfSSL Configuration app settings */
211211

212-
/* Experimental Kyber */
213-
#ifdef CONFIG_WOLFSSL_ENABLE_KYBER
212+
/* Optional MLKEM (Kyber Post Quantum) */
213+
/* ./configure --enable-mlkem */
214+
/* See Kconfig / menuconfig ESP_WOLFSSL_ENABLE_MLKEM */
215+
#ifdef CONFIG_ESP_WOLFSSL_ENABLE_MLKEM
214216
/* Kyber typically needs a minimum 10K stack */
215-
#define WOLFSSL_EXPERIMENTAL_SETTINGS
216217
#define WOLFSSL_HAVE_MLKEM
217218
#define WOLFSSL_WC_MLKEM
218-
#define WOLFSSL_SHA3
219+
#define WOLFSSL_SHAKE128
220+
#define WOLFSSL_SHAKE256
221+
222+
/* Old code points to keep compatibility with Kyber Round 3. */
223+
/* ./configure --enable-kyber=all --enable-experimental */
224+
#if defined(CONFIG_WOLFSSL_ENABLE_KYBER)
225+
#define WOLFSSL_MLKEM_KYBER
226+
#define WOLFSSL_EXPERIMENTAL_SETTINGS
227+
#endif
228+
219229
#if defined(CONFIG_IDF_TARGET_ESP8266)
220230
/* With limited RAM, we'll disable some of the Kyber sizes: */
221231
#define WOLFSSL_NO_KYBER1024
222232
#define WOLFSSL_NO_KYBER768
233+
#define WOLFSSL_NO_ML_KEM_1024
234+
#define WOLFSSL_NO_ML_KEM_768
223235
#define NO_SESSION_CACHE
236+
#else
237+
/* Only needed for older wolfssl versions, see mlkem.h */
238+
#define WOLFSSL_KYBER1024
239+
/* optional alternative sizes: */
240+
/* #define WOLFSSL_KYBER768 */
241+
/* #define WOLFSSL_KYBER512 */
242+
/* -- or disable a specific one: */
243+
/* #define WOLFSSL_NO_ML_KEM_1024 */
244+
/* #define WOLFSSL_NO_ML_KEM_768 */
245+
/* #define WOLFSSL_NO_ML_KEM_512 */
224246
#endif
225247
#endif
226248

@@ -532,7 +554,7 @@
532554
/* Adjust wait-timeout count if you see timeout in RSA HW acceleration.
533555
* Set to very large number and enable WOLFSSL_HW_METRICS to determine max. */
534556
#ifndef ESP_RSA_TIMEOUT_CNT
535-
#define ESP_RSA_TIMEOUT_CNT 0xFF0000
557+
#define ESP_RSA_TIMEOUT_CNT 0xFF0000
536558
#endif
537559

538560
/* hash limit for test.c */
@@ -560,8 +582,6 @@
560582
defined(WOLFSSL_SP_RISCV32)
561583
#endif
562584

563-
#define WOLFSSL_SMALL_STACK
564-
565585

566586
#define HAVE_VERSION_EXTENDED_INFO
567587
/* #define HAVE_WC_INTROSPECTION */
@@ -936,6 +956,8 @@ Turn on timer debugging (used when CPU cycles not available)
936956
#define ATCA_WOLFSSL
937957
*/
938958

959+
/* optional SM4 Ciphers. See github.com/wolfSSL/wolfsm */
960+
939961
/***************************** Certificate Macros *****************************
940962
*
941963
* The section below defines macros used in typically all of the wolfSSL
@@ -1027,9 +1049,14 @@ Turn on timer debugging (used when CPU cycles not available)
10271049
#define WOLFSSL_BASE16
10281050
#else
10291051
#if defined(USE_CERT_BUFFERS_2048)
1030-
#define USE_CERT_BUFFERS_256
1052+
#ifdef USE_CERT_BUFFERS_1024
1053+
#error "USE_CERT_BUFFERS_1024 is already defined. Pick one."
1054+
#endif
1055+
10311056
/* Be sure to include in app when using example certs: */
1032-
/* #include <wolfssl/certs_test.h> */
1057+
#include <wolfssl/certs_test.h>
1058+
1059+
#define USE_CERT_BUFFERS_256
10331060
#define CTX_CA_CERT ca_cert_der_2048
10341061
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_2048
10351062
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1
@@ -1049,9 +1076,14 @@ Turn on timer debugging (used when CPU cycles not available)
10491076
#define CTX_CLIENT_KEY_TYPE WOLFSSL_FILETYPE_ASN1
10501077

10511078
#elif defined(USE_CERT_BUFFERS_1024)
1052-
#define USE_CERT_BUFFERS_256
1079+
#ifdef USE_CERT_BUFFERS_2048
1080+
#error "USE_CERT_BUFFERS_2048 is already defined. Pick one."
1081+
#endif
1082+
10531083
/* Be sure to include in app when using example certs: */
1054-
/* #include <wolfssl/certs_test.h> */
1084+
#include <wolfssl/certs_test.h>
1085+
1086+
#define USE_CERT_BUFFERS_256
10551087
#define CTX_CA_CERT ca_cert_der_1024
10561088
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_1024
10571089
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1

0 commit comments

Comments
 (0)