Add CB_ONLY mode for ML-DSA

.github/workflows/cryptocb-only.yml

@@ -1,3 +1,3 @@
 name: cryptocb-only Tests
 
 # START OF COMMON SECTION
@@ -151,12 +151,24 @@
           {"name": "falcon-onlycb-no-swdev", "minutes": 1.0,
            "comment": "WOLF_CRYPTO_CB_ONLY_FALCON without swdev, which has no Falcon handlers: builds the Falcon key API that a callback-only build keeps, including its TLS and ASN callers, and runs the tests that need no device.",
            "configure": ["--disable-swdev", "--enable-falcon", "--enable-experimental", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_FALCON"]},
+          {"name": "mldsa", "minutes": 4.0,
+           "comment": "WOLF_CRYPTO_CB_ONLY_MLDSA: strips the software ML-DSA core (NTT, matrix expansion, rejection sampling, the sign/verify workers and the x86 assembly); key import/export, the size queries and the DER paths stay, and the cached matrix/vector fields stay in the key struct so its layout is unchanged. The in-tree cryptocb test registers a callback-only ML-DSA device and drives key generation, signing, verifying and the private-key check through it, so the successful dispatch path is covered and not just the no-device refusal.",
+           "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_MLDSA"]},
+          {"name": "mldsa-verify-only", "minutes": 4.0,
+           "comment": "WOLF_CRYPTO_CB_ONLY_MLDSA against a verify-only ML-DSA build. That combination drops WOLFSSL_MLDSA_CHECK_KEY and the signing entry points, so it catches a callback-only path that assumes an API which this configuration does not compile.",
+           "configure": ["--enable-mldsa=verify-only", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_MLDSA"]},
+          {"name": "mldsa-no-verify", "minutes": 4.0,
+           "comment": "WOLF_CRYPTO_CB_ONLY_MLDSA against a sign-only ML-DSA build (WOLFSSL_MLDSA_NO_VERIFY), the mirror of the verify-only entry.",
+           "configure": ["--enable-mldsa=sign", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_MLDSA"]},
           {"name": "shake-xof", "minutes": 4.0,
            "comment": "WOLF_CRYPTO_CB_SHAKE_XOF: swdev handles SHAKE absorb and squeeze. No ONLY_* strip exists for SHAKE, so software SHAKE stays in. ML-KEM and ML-DSA reach swdev_shake through WOLF_CRYPTO_CB_FIND, and cryptocb_test runs shake_cb_xof_test.",
            "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_SHAKE_XOF"]},
           {"name": "all", "minutes": 19,
-           "comment": "All nine ONLY_* macros at once: every supported software primitive is stripped and dispatched through cryptocb. Catches any cross-algorithm call that a single-strip entry would still resolve via the remaining software paths.",
+           "comment": "All nine ONLY_* macros that can share a build: every supported software primitive is stripped and dispatched through cryptocb. Catches any cross-algorithm call that a single-strip entry would still resolve via the remaining software paths. MLDSA is not here because this entry also enables SLH-DSA, and the TLS 1.3 suite then runs an SLH-DSA root with an ML-DSA-44 entity certificate: with the ML-DSA software path gone that handshake needs a registered device, which swdev does not provide yet. The all-mldsa entry below covers MLDSA alongside the rest.",
            "configure": ["--enable-slhdsa=yes,sha2", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_ECC -DWOLF_CRYPTO_CB_ONLY_RSA -DWOLF_CRYPTO_CB_ONLY_SHA256 -DWOLF_CRYPTO_CB_ONLY_SHA512 -DWOLF_CRYPTO_CB_ONLY_AES -DWOLF_CRYPTO_CB_ONLY_ED25519 -DWOLF_CRYPTO_CB_ONLY_CURVE25519 -DWOLF_CRYPTO_CB_ONLY_CURVE448 -DWOLF_CRYPTO_CB_ONLY_SLHDSA"]},
+          {"name": "all-mldsa", "minutes": 4.5,
+           "comment": "The 'all' set with MLDSA in place of SLHDSA, so a stripped ML-DSA still meets the other stripped primitives. SLH-DSA is left out because only that combination pulls in the ML-DSA-44 entity certificate test described above.",
+           "configure": ["CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_ECC -DWOLF_CRYPTO_CB_ONLY_RSA -DWOLF_CRYPTO_CB_ONLY_SHA256 -DWOLF_CRYPTO_CB_ONLY_SHA512 -DWOLF_CRYPTO_CB_ONLY_AES -DWOLF_CRYPTO_CB_ONLY_ED25519 -DWOLF_CRYPTO_CB_ONLY_CURVE25519 -DWOLF_CRYPTO_CB_ONLY_CURVE448 -DWOLF_CRYPTO_CB_ONLY_MLDSA"]},
           {"name": "only", "minutes": 4.0,
            "comment": "Same coverage as the \"all\" entry above, but driven by ./configure --enable-cryptocb=only instead of a hand-written CPPFLAGS list. This is the regression test for the configure option: it must emit exactly the WOLF_CRYPTO_CB_ONLY_* set that \"all\" passes by hand, for the algorithms this base enables. The \"all\" entry deliberately stays on explicit CPPFLAGS so a bug in the configure logic cannot silently weaken both. Note the base already passes --enable-cryptocb; this entry's flags are appended after the base, so --enable-cryptocb=only wins.",
            "configure": ["--enable-cryptocb=only"]},

configure.ac

@@ -12118,6 +12118,9 @@ then
     if test "$ENABLED_SLHDSA" != "no"; then
         AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_ONLY_SLHDSA"
     fi
+    if test "$ENABLED_MLDSA" != "no"; then
+        AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_ONLY_MLDSA"
+    fi
 fi
 
 if test "$ENABLED_CRYPTOCB_SW_TEST" = "no"

tests/api.c

@@ -29908,6 +29908,7 @@ static int test_wc_SignCRL_mldsa(void)
     EXPECT_DECLS;
 #if defined(WOLFSSL_CERT_GEN) && defined(HAVE_CRL) && !defined(NO_FILESYSTEM) && \
     !defined(NO_ASN) && defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_PEM_TO_DER) && !defined(WOLFSSL_MLDSA_NO_SIGN) && \
     !defined(WOLFSSL_MLDSA_NO_ASN1)
     static const struct {

tests/api/test_mldsa.c

@@ -711,7 +711,8 @@ int test_mldsa(void)
 int test_mldsa_sign_pubonly_fails(void)
 {
     EXPECT_DECLS;
-#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)
+#if (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && \
+    defined(WC_MLDSA_HAVE_NATIVE)
 #if defined(WOLFSSL_HAVE_MLDSA) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
@@ -804,6 +805,7 @@ int test_mldsa_make_key(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
     wc_MlDsaKey* key;
     WC_RNG rng;
@@ -844,7 +846,7 @@ int test_mldsa_make_key(void)
 int test_mldsa_sign(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA) && \
+#if defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && defined(WOLFSSL_MLDSA_NO_CTX)
     wc_MlDsaKey* key;
     wc_MlDsaKey* importKey = NULL;
@@ -1031,7 +1033,7 @@ int test_mldsa_sign(void)
 int test_mldsa_verify(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA) && \
+#if defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY) && defined(WOLFSSL_MLDSA_NO_CTX) && \
     (!defined(WOLFSSL_NO_ML_DSA_44) || !defined(WOLFSSL_MLDSA_NO_SIGN))
     wc_MlDsaKey* key;
@@ -1264,6 +1266,7 @@ int test_mldsa_sign_vfy(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && !defined(WOLFSSL_MLDSA_NO_VERIFY)
     wc_MlDsaKey* key;
@@ -1352,6 +1355,7 @@ int test_mldsa_check_key(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_MLDSA_CHECK_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
     wc_MlDsaKey* checkKey;
@@ -3024,6 +3028,7 @@ int test_mldsa_der(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_ASN1) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
     wc_MlDsaKey* key;
@@ -3228,6 +3233,7 @@ int test_mldsa_der(void)
 }
 
 #if defined(WOLFSSL_HAVE_MLDSA) && !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
 
 /* Decode, re-export, byte-compare. Asserts version=1 on the bundled form and
@@ -3296,6 +3302,7 @@ int test_mldsa_oneasymkey_version(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
     #ifndef WOLFSSL_NO_ML_DSA_44
         ExpectIntEQ(mldsa_oneasymkey_version_check(WC_ML_DSA_44),
@@ -3317,6 +3324,7 @@ int test_mldsa_make_key_from_seed(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY)
     wc_MlDsaKey* key;
 #ifndef WOLFSSL_NO_ML_DSA_44
@@ -7784,7 +7792,7 @@ int test_mldsa_make_key_from_seed(void)
 int test_mldsa_sig_kats(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA) && \
+#if defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && defined(WOLFSSL_MLDSA_NO_CTX)
     wc_MlDsaKey* key;
 #ifndef WOLFSSL_NO_ML_DSA_44
@@ -12604,6 +12612,7 @@ int test_mldsa_sign_ctx_kats(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN)
     wc_MlDsaKey* key;
     word32 sigLen;
@@ -16842,6 +16851,7 @@ int test_mldsa_verify_ctx_kats(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY)
     wc_MlDsaKey* key;
     int res;
@@ -20363,7 +20373,7 @@ int test_mldsa_verify_ctx_kats(void)
 int test_mldsa_verify_kats(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA) && \
+#if defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY) && defined(WOLFSSL_MLDSA_NO_CTX)
     wc_MlDsaKey* key;
     int res;
@@ -24635,6 +24645,7 @@ int test_mldsa_sign_mu_kats(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && !defined(WOLFSSL_MLDSA_NO_SIGN) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0))
     wc_MlDsaKey* key = NULL;
     word32 sigLen;
@@ -27499,6 +27510,7 @@ int test_mldsa_verify_mu_kats(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && !defined(WOLFSSL_MLDSA_NO_VERIFY) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0))
     wc_MlDsaKey* key = NULL;
     byte* sigBuf = NULL;
@@ -29695,6 +29707,7 @@ int test_mldsa_verify_mu_kats(void)
 }
 
 #if !defined(NO_ASN) && defined(HAVE_PKCS8) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_HAVE_MLDSA) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_ASN1) && defined(WOLFSSL_ASN_TEMPLATE)
@@ -29763,6 +29776,7 @@ int test_mldsa_PrivateKeyDecode_OpenSSL_form(void)
     EXPECT_DECLS;
 
 #if !defined(NO_ASN) && defined(HAVE_PKCS8) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_HAVE_MLDSA) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_ASN1) && defined(WOLFSSL_ASN_TEMPLATE)
@@ -29856,6 +29870,7 @@ int test_mldsa_pkcs8_import_OpenSSL_form(void)
 {
     EXPECT_DECLS;
 #if !defined(NO_ASN) && defined(HAVE_PKCS8) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_HAVE_MLDSA) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && \
@@ -29930,6 +29945,7 @@ int test_mldsa_pkcs8_export_import_wolfSSL_form(void)
 {
     EXPECT_DECLS;
 #if !defined(NO_ASN) && defined(HAVE_PKCS8) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     defined(WOLFSSL_HAVE_MLDSA) && !defined(NO_TLS) && \
     (!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
@@ -30044,7 +30060,7 @@ int test_mldsa_pkcs8_export_import_wolfSSL_form(void)
 int test_mldsa_encode_w1_large_values(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA) && \
+#if defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
     (!defined(WOLFSSL_MLDSA_NO_SIGN) || \
      !defined(WOLFSSL_MLDSA_NO_VERIFY))
 
@@ -30177,7 +30193,8 @@ int test_mldsa_pkcs12(void)
 {
     EXPECT_DECLS;
 #if !defined(NO_ASN) && defined(HAVE_PKCS12) && \
-    defined(WOLFSSL_HAVE_MLDSA) && defined(WOLFSSL_MLDSA_PRIVATE_KEY) && \
+    defined(WOLFSSL_HAVE_MLDSA) && defined(WC_MLDSA_HAVE_NATIVE) && \
+    defined(WOLFSSL_MLDSA_PRIVATE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_ASN1) && \
     !defined(NO_TLS) && !defined(NO_PWDBASED) && !defined(NO_HMAC) && \
     !defined(NO_CERTS) && !defined(NO_DES3) && \
@@ -30562,6 +30579,7 @@ int test_mldsa_verify_hash(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY)
     wc_MlDsaKey key;
@@ -30602,6 +30620,7 @@ int test_dilithium_hash(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY)
     wc_MlDsaKey key;
@@ -30815,6 +30834,7 @@ int test_wc_MldsaFeatureCoverage(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
     !defined(WOLFSSL_MLDSA_VERIFY_ONLY) && \
     !defined(WOLFSSL_MLDSA_NO_SIGN) && \
@@ -30904,7 +30924,8 @@ int test_wc_MldsaFeatureCoverage(void)
 int test_wc_MldsaDecisionCoverage2(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_MLDSA)
+#if defined(WOLFSSL_HAVE_MLDSA) && \
+    defined(WC_MLDSA_HAVE_NATIVE)
     wc_MlDsaKey key;
     int inited = 0;
 
@@ -31757,6 +31778,7 @@ int test_wc_MlDsaKey_seed_service_indicator(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_HAVE_MLDSA) && !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && \
+    defined(WC_MLDSA_HAVE_NATIVE) && \
     !defined(WOLFSSL_MLDSA_VERIFY_ONLY)
     wc_MlDsaKey key;
     byte seed[MLDSA_SEED_SZ];

tests/api/test_mldsa_legacy.c

@@ -373,7 +373,8 @@ int test_mldsa_legacy_shim(void)
 #if !defined(WOLFSSL_MLDSA_NO_MAKE_KEY) && !defined(WOLFSSL_MLDSA_NO_SIGN) && \
     !defined(WOLFSSL_MLDSA_NO_VERIFY) && !defined(WOLFSSL_NO_ML_DSA_44) && \
     defined(WOLFSSL_MLDSA_PUBLIC_KEY) && defined(WOLFSSL_MLDSA_PRIVATE_KEY) && \
-    !defined(WC_NO_RNG)
+    !defined(WC_NO_RNG) && \
+    defined(WC_MLDSA_HAVE_NATIVE)
     {
         dilithium_key  key;        /* legacy typedef */
         WC_RNG         rng;

wolfcrypt/src/cryptocb.c

@@ -66,6 +66,7 @@ Crypto Callback Build Options:
  * WOLF_CRYPTO_CB_ONLY_AES: Use only callbacks for AES          default: off
  * WOLF_CRYPTO_CB_ONLY_ED25519: Use only callbacks for Ed25519  default: off
  * WOLF_CRYPTO_CB_ONLY_CURVE25519: Use only callbacks for X25519 default: off
+ * WOLF_CRYPTO_CB_ONLY_MLDSA: Use only callbacks for ML-DSA    default: off
  * WOLF_CRYPTO_CB_SHAKE_XOF: Dispatch SHAKE absorb and squeeze  default: off
  *                      as well as update and final. Off by
  *                      default because a callback that predates