Skip to content

Commit e164bcb

Browse files
douzzerdouzzer
authored
Merge pull request #7904 from SparkiDev/kyber_tls_fixes
Kyber: fix TLS usage
2 parents 90152fe + 893a486 commit e164bcb

5 files changed

Lines changed: 127 additions & 16 deletions

File tree

‎examples/client/client.c‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -398,24 +398,43 @@ static void SetKeyShare(WOLFSSL* ssl, int onlyKeyShare, int useX25519,
398398
if (usePqc) {
399399
int group = 0;
400400

401+
#ifndef WOLFSSL_NO_KYBER512
401402
if (XSTRCMP(pqcAlg, "KYBER_LEVEL1") == 0) {
402403
group = WOLFSSL_KYBER_LEVEL1;
403404
}
404-
else if (XSTRCMP(pqcAlg, "KYBER_LEVEL3") == 0) {
405+
else
406+
#endif
407+
#ifndef WOLFSSL_NO_KYBER768
408+
if (XSTRCMP(pqcAlg, "KYBER_LEVEL3") == 0) {
405409
group = WOLFSSL_KYBER_LEVEL3;
406410
}
407-
else if (XSTRCMP(pqcAlg, "KYBER_LEVEL5") == 0) {
411+
else
412+
#endif
413+
#ifndef WOLFSSL_NO_KYBER1024
414+
if (XSTRCMP(pqcAlg, "KYBER_LEVEL5") == 0) {
408415
group = WOLFSSL_KYBER_LEVEL5;
409416
}
410-
else if (XSTRCMP(pqcAlg, "P256_KYBER_LEVEL1") == 0) {
417+
else
418+
#endif
419+
#ifndef WOLFSSL_NO_KYBER512
420+
if (XSTRCMP(pqcAlg, "P256_KYBER_LEVEL1") == 0) {
411421
group = WOLFSSL_P256_KYBER_LEVEL1;
412422
}
413-
else if (XSTRCMP(pqcAlg, "P384_KYBER_LEVEL3") == 0) {
423+
else
424+
#endif
425+
#ifndef WOLFSSL_NO_KYBER768
426+
if (XSTRCMP(pqcAlg, "P384_KYBER_LEVEL3") == 0) {
414427
group = WOLFSSL_P384_KYBER_LEVEL3;
415428
}
416-
else if (XSTRCMP(pqcAlg, "P521_KYBER_LEVEL5") == 0) {
429+
else
430+
#endif
431+
#ifndef WOLFSSL_NO_KYBER1024
432+
if (XSTRCMP(pqcAlg, "P521_KYBER_LEVEL5") == 0) {
417433
group = WOLFSSL_P521_KYBER_LEVEL5;
418-
} else {
434+
}
435+
else
436+
#endif
437+
{
419438
err_sys("invalid post-quantum KEM specified");
420439
}
421440

‎examples/server/server.c‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -710,24 +710,45 @@ static void SetKeyShare(WOLFSSL* ssl, int onlyKeyShare, int useX25519,
710710
else if (usePqc == 1) {
711711
#ifdef HAVE_PQC
712712
groups[count] = 0;
713+
#ifndef WOLFSSL_NO_KYBER512
713714
if (XSTRCMP(pqcAlg, "KYBER_LEVEL1") == 0) {
714715
groups[count] = WOLFSSL_KYBER_LEVEL1;
715716
}
716-
else if (XSTRCMP(pqcAlg, "KYBER_LEVEL3") == 0) {
717+
else
718+
#endif
719+
#ifndef WOLFSSL_NO_KYBER768
720+
if (XSTRCMP(pqcAlg, "KYBER_LEVEL3") == 0) {
717721
groups[count] = WOLFSSL_KYBER_LEVEL3;
718722
}
719-
else if (XSTRCMP(pqcAlg, "KYBER_LEVEL5") == 0) {
723+
else
724+
#endif
725+
#ifndef WOLFSSL_NO_KYBER1024
726+
if (XSTRCMP(pqcAlg, "KYBER_LEVEL5") == 0) {
720727
groups[count] = WOLFSSL_KYBER_LEVEL5;
721728
}
722-
else if (XSTRCMP(pqcAlg, "P256_KYBER_LEVEL1") == 0) {
729+
else
730+
#endif
731+
#ifndef WOLFSSL_NO_KYBER512
732+
if (XSTRCMP(pqcAlg, "P256_KYBER_LEVEL1") == 0) {
723733
groups[count] = WOLFSSL_P256_KYBER_LEVEL1;
724734
}
725-
else if (XSTRCMP(pqcAlg, "P384_KYBER_LEVEL3") == 0) {
735+
else
736+
#endif
737+
#ifndef WOLFSSL_NO_KYBER768
738+
if (XSTRCMP(pqcAlg, "P384_KYBER_LEVEL3") == 0) {
726739
groups[count] = WOLFSSL_P384_KYBER_LEVEL3;
727740
}
728-
else if (XSTRCMP(pqcAlg, "P521_KYBER_LEVEL5") == 0) {
741+
else
742+
#endif
743+
#ifndef WOLFSSL_NO_KYBER1024
744+
if (XSTRCMP(pqcAlg, "P521_KYBER_LEVEL5") == 0) {
729745
groups[count] = WOLFSSL_P521_KYBER_LEVEL5;
730746
}
747+
else
748+
#endif
749+
{
750+
err_sys("invalid post-quantum KEM specified");
751+
}
731752

732753
if (groups[count] == 0) {
733754
err_sys("invalid post-quantum KEM specified");

‎src/tls.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13141,7 +13141,7 @@ static int TLSX_PopulateSupportedGroups(WOLFSSL* ssl, TLSX** extensions)
1314113141
ret = TLSX_UseSupportedCurve(extensions, WOLFSSL_P384_KYBER_LEVEL3,
1314213142
ssl->heap);
1314313143
#endif
13144-
#ifdef WOLFSSL_KYBER768
13144+
#ifdef WOLFSSL_KYBER1024
1314513145
if (ret == WOLFSSL_SUCCESS)
1314613146
ret = TLSX_UseSupportedCurve(extensions, WOLFSSL_KYBER_LEVEL5,
1314713147
ssl->heap);

‎tests/api.c‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72803,7 +72803,13 @@ static int test_tls13_apis(void)
7280372803
#if defined(HAVE_ECC) && defined(HAVE_SUPPORTED_CURVES)
7280472804
int groups[2] = { WOLFSSL_ECC_SECP256R1,
7280572805
#ifdef WOLFSSL_HAVE_KYBER
72806+
#ifndef WOLFSSL_NO_KYBER512
7280672807
WOLFSSL_KYBER_LEVEL1
72808+
#elif !defined(WOLFSSL_NO_KYBER768)
72809+
WOLFSSL_KYBER_LEVEL3
72810+
#else
72811+
WOLFSSL_KYBER_LEVEL5
72812+
#endif
7280772813
#else
7280872814
WOLFSSL_ECC_SECP256R1
7280972815
#endif
@@ -72831,15 +72837,30 @@ static int test_tls13_apis(void)
7283172837
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
7283272838
"P-256:secp256r1"
7283372839
#if defined(WOLFSSL_HAVE_KYBER)
72840+
#ifndef WOLFSSL_NO_KYBER512
7283472841
":P256_KYBER_LEVEL1"
72842+
#elif !defined(WOLFSSL_NO_KYBER768)
72843+
":P256_KYBER_LEVEL3"
72844+
#else
72845+
":P256_KYBER_LEVEL5"
72846+
#endif
7283572847
#endif
7283672848
#endif
7283772849
#endif /* !defined(NO_ECC_SECP) */
7283872850
#if defined(WOLFSSL_HAVE_KYBER)
72851+
#ifndef WOLFSSL_NO_KYBER512
7283972852
":KYBER_LEVEL1"
72853+
#elif !defined(WOLFSSL_NO_KYBER768)
72854+
":KYBER_LEVEL3"
72855+
#else
72856+
":KYBER_LEVEL5"
72857+
#endif
7284072858
#endif
7284172859
"";
7284272860
#endif /* defined(OPENSSL_EXTRA) && defined(HAVE_ECC) */
72861+
#if defined(WOLFSSL_HAVE_KYBER)
72862+
int kyberLevel;
72863+
#endif
7284372864

7284472865
(void)ret;
7284572866

@@ -72969,17 +72990,24 @@ static int test_tls13_apis(void)
7296972990
#endif
7297072991

7297172992
#if defined(WOLFSSL_HAVE_KYBER)
72972-
ExpectIntEQ(wolfSSL_UseKeyShare(NULL, WOLFSSL_KYBER_LEVEL3), BAD_FUNC_ARG);
72993+
#ifndef WOLFSSL_NO_KYBER768
72994+
kyberLevel = WOLFSSL_KYBER_LEVEL3;
72995+
#elif !defined(WOLFSSL_NO_KYBER1024)
72996+
kyberLevel = WOLFSSL_KYBER_LEVEL5;
72997+
#else
72998+
kyberLevel = WOLFSSL_KYBER_LEVEL1;
72999+
#endif
73000+
ExpectIntEQ(wolfSSL_UseKeyShare(NULL, kyberLevel), BAD_FUNC_ARG);
7297373001
#ifndef NO_WOLFSSL_SERVER
72974-
ExpectIntEQ(wolfSSL_UseKeyShare(serverSsl, WOLFSSL_KYBER_LEVEL3),
73002+
ExpectIntEQ(wolfSSL_UseKeyShare(serverSsl, kyberLevel),
7297573003
WOLFSSL_SUCCESS);
7297673004
#endif
7297773005
#ifndef NO_WOLFSSL_CLIENT
7297873006
#ifndef WOLFSSL_NO_TLS12
72979-
ExpectIntEQ(wolfSSL_UseKeyShare(clientTls12Ssl, WOLFSSL_KYBER_LEVEL3),
73007+
ExpectIntEQ(wolfSSL_UseKeyShare(clientTls12Ssl, kyberLevel),
7298073008
BAD_FUNC_ARG);
7298173009
#endif
72982-
ExpectIntEQ(wolfSSL_UseKeyShare(clientSsl, WOLFSSL_KYBER_LEVEL3),
73010+
ExpectIntEQ(wolfSSL_UseKeyShare(clientSsl, kyberLevel),
7298373011
WOLFSSL_SUCCESS);
7298473012
#endif
7298573013
#endif

‎tests/suites.c‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,41 @@ static int IsValidCipherSuite(const char* line, char *suite, size_t suite_spc)
172172
return valid;
173173
}
174174

175+
#ifdef WOLFSSL_HAVE_KYBER
176+
static int IsKyberLevelAvailable(const char* line)
177+
{
178+
int available = 0;
179+
const char* find = "--pqc ";
180+
const char* begin = strstr(line, find);
181+
const char* end;
182+
183+
if (begin != NULL) {
184+
begin += 6;
185+
end = XSTRSTR(begin, " ");
186+
187+
if ((size_t)end - (size_t)begin == 12) {
188+
#ifndef WOLFSSL_NO_KYBER512
189+
if (XSTRNCMP(begin, "KYBER_LEVEL1", 12) == 0) {
190+
available = 1;
191+
}
192+
#endif
193+
#ifndef WOLFSSL_NO_KYBER768
194+
if (XSTRNCMP(begin, "KYBER_LEVEL3", 12) == 0) {
195+
available = 1;
196+
}
197+
#endif
198+
#ifndef WOLFSSL_NO_KYBER1024
199+
if (XSTRNCMP(begin, "KYBER_LEVEL5", 12) == 0) {
200+
available = 1;
201+
}
202+
#endif
203+
}
204+
}
205+
206+
return (begin == NULL) || available;
207+
}
208+
#endif
209+
175210
static int IsValidCert(const char* line)
176211
{
177212
int ret = 1;
@@ -356,6 +391,14 @@ static int execute_test_case(int svr_argc, char** svr_argv,
356391
#endif
357392
return NOT_BUILT_IN;
358393
}
394+
#ifdef WOLFSSL_HAVE_KYBER
395+
if (!IsKyberLevelAvailable(commandLine)) {
396+
#ifdef DEBUG_SUITE_TESTS
397+
printf("Kyber level not supported in build: %s\n", commandLine);
398+
#endif
399+
return NOT_BUILT_IN;
400+
}
401+
#endif
359402
if (!IsValidCert(commandLine)) {
360403
#ifdef DEBUG_SUITE_TESTS
361404
printf("certificate %s not supported in build\n", commandLine);

0 commit comments

Comments
 (0)