Merge pull request #19 from danielinux/PSA-1.4

Update specs to PSA 1.4 + Low/Info fenrir fixes

Author: dgarske

.github/workflows/build-config-matrix.yml

@@ -26,7 +26,7 @@ jobs:
           - name: sha512-family
             modifiers: "-WOLFSSL_SHA512 -WOLFSSL_SHA384 -HAVE_ED25519 -WOLFSSL_ED25519_STREAMING_VERIFY -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY +NO_SHA512"
           - name: sha3-ed448
-            modifiers: "-WOLFSSL_SHA3 -WOLFSSL_SHAKE128 -WOLFSSL_SHAKE256 -WOLFSSL_HAVE_MLDSA -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY"
+            modifiers: "-WOLFSSL_SHA3 -WOLFSSL_SHAKE128 -WOLFSSL_SHAKE256 -WOLFSSL_HAVE_MLDSA -WOLFSSL_HAVE_MLKEM -HAVE_ED448 -WOLFSSL_ED448_STREAMING_VERIFY"
           - name: des3
             modifiers: "-WOLFSSL_DES3 -WOLFSSL_DES_ECB +NO_DES3"
           - name: aes-gcm
@@ -44,9 +44,9 @@ jobs:
           - name: des-ecb
             modifiers: "-WOLFSSL_DES_ECB"
           - name: cmac
-            modifiers: "-WOLFSSL_CMAC"
+            modifiers: "-WOLFSSL_CMAC -HAVE_CMAC_KDF"
           - name: chacha20-poly1305
-            modifiers: "-HAVE_CHACHA -HAVE_POLY1305"
+            modifiers: "-HAVE_CHACHA -HAVE_POLY1305 -HAVE_XCHACHA"
           - name: curve25519
             modifiers: "-HAVE_CURVE25519"
           - name: ed25519
@@ -59,6 +59,18 @@ jobs:
             modifiers: "-WOLFSSL_HAVE_MLDSA"
           - name: mldsa-44-only
             modifiers: "+WOLFSSL_NO_ML_DSA_65 +WOLFSSL_NO_ML_DSA_87"
+          - name: mlkem
+            modifiers: "-WOLFSSL_HAVE_MLKEM"
+          - name: lms-xmss
+            modifiers: "-WOLFSSL_HAVE_LMS -WOLFSSL_LMS_VERIFY_ONLY -WOLFSSL_HAVE_XMSS -WOLFSSL_XMSS_VERIFY_ONLY"
+          - name: ascon
+            modifiers: "-HAVE_ASCON"
+          - name: aes-keywrap
+            modifiers: "-HAVE_AES_KEYWRAP -WOLFSSL_AES_DIRECT"
+          - name: xchacha
+            modifiers: "-HAVE_XCHACHA"
+          - name: cmac-kdf
+            modifiers: "-HAVE_CMAC_KDF"
           - name: hkdf
             modifiers: "-HAVE_HKDF -HAVE_ECC_ENCRYPT"
           - name: tls-prf

.github/workflows/test-psa-api.yml

@@ -27,39 +27,44 @@ jobs:
         run: make -C test rebuild-wolfssl-psa
 
       - name: Build PSA API tests
-        run: make -C test psa_api_test psa_des3_stack_scrub_test psa_ecc_bit_inference_test psa_ecc_curve_id_test psa_random_size_test
+        run: >
+          make -C test
+          psa_api_test
+          psa_des3_stack_scrub_test
+          psa_ecc_bit_inference_test
+          psa_ecc_curve_id_test
+          psa_random_size_test
+          psa_rsa_pss_interop_test
+          psa_mldsa_test
+          psa_mlkem_test
+          psa_xof_test
+          psa_key_wrap_test
+          psa_sign_context_test
+          psa_lms_xmss_verify_test
+          psa_ascon_xchacha_test
+          psa_sp800_108_test
+          psa_14_misc_test
 
-      - name: Run PSA API test
+      - name: Run PSA API tests
         env:
           LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
         run: |
-          rm -rf test/.store
-          ./test/psa_api_test
-
-      - name: Run ECC bit inference test
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
-        run: |
-          rm -rf test/.store
-          ./test/psa_ecc_bit_inference_test
-
-      - name: Run DES3 stack scrub test
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
-        run: |
-          rm -rf test/.store
-          ./test/psa_des3_stack_scrub_test
-
-      - name: Run ECC curve id test
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
-        run: |
-          rm -rf test/.store
-          ./test/psa_ecc_curve_id_test
-
-      - name: Run random size test
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
-        run: |
-          rm -rf test/.store
-          ./test/psa_random_size_test
+          for t in psa_api_test \
+                   psa_ecc_bit_inference_test \
+                   psa_des3_stack_scrub_test \
+                   psa_ecc_curve_id_test \
+                   psa_random_size_test \
+                   psa_rsa_pss_interop_test \
+                   psa_mldsa_test \
+                   psa_mlkem_test \
+                   psa_xof_test \
+                   psa_key_wrap_test \
+                   psa_sign_context_test \
+                   psa_lms_xmss_verify_test \
+                   psa_ascon_xchacha_test \
+                   psa_sp800_108_test \
+                   psa_14_misc_test; do
+            echo "=== $t ==="
+            rm -rf test/.store
+            ./test/$t
+          done

.gitignore

@@ -19,3 +19,12 @@ wolfcrypt-psa-benchmark
 .store/
 *.log
 .codex
+test/psa_mldsa_test
+test/psa_mlkem_test
+test/psa_xof_test
+test/psa_key_wrap_test
+test/psa_sign_context_test
+test/psa_lms_xmss_verify_test
+test/psa_ascon_xchacha_test
+test/psa_sp800_108_test
+test/psa_14_misc_test

CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## Unreleased: PSA Certified Crypto API 1.4 + PQC extension 1.4
+
+Upgrade of the public API surface and implementation to PSA Certified
+Crypto API 1.4 Final and the PQC extension 1.4, built against current
+wolfSSL master.
+
+### Breaking changes
+
+- ML-DSA now follows the PSA 1.4 PQC extension: key bits are 128/192/256
+  (security strength, ML-DSA-44/65/87) instead of the previous 2/3/5
+  level convention, and the key-pair import/export format is the 32-byte
+  FIPS 204 seed xi (public keys remain raw pk bytes).
+- The nonstandard `psa_ml_dsa_generate_key/sign/verify` exports and the
+  `PSA_ML_DSA_PARAMETER_*` / `psa_ml_dsa_parameter_t` macros were removed;
+  use the standard PSA key management and signature APIs instead.
+
+### Added
+
+- Key encapsulation: `psa_encapsulate()` / `psa_decapsulate()` with
+  PSA_ALG_ML_KEM. ML-KEM key pairs use the 64-byte d||z seed format with
+  bits 512/768/1024; the shared secret is returned as a new key.
+- ML-DSA through the standard APIs: hedged and deterministic pure ML-DSA
+  via `psa_sign_message`/`psa_verify_message`, plus HashML-DSA variants
+  usable through both the message and hash entry points.
+- Context-aware signatures: `psa_sign_message_with_context()`,
+  `psa_verify_message_with_context()`, `psa_sign_hash_with_context()`,
+  `psa_verify_hash_with_context()` and PSA_ALG_EDDSA_CTX (Ed25519ctx),
+  with context support for Ed25519ph/Ed448 and the ML-DSA family.
+- Verify-only LMS/HSS and XMSS/XMSS^MT public-key support through
+  `psa_verify_message` (PSA_ALG_LMS/HSS/XMSS/XMSS_MT).
+- XOF API: incremental SHAKE128/SHAKE256 via `psa_xof_setup/update/
+  output/abort` (Ascon XOFs report NOT_SUPPORTED).
+- Key wrapping: `psa_wrap_key()` / `psa_unwrap_key()` with PSA_ALG_KW
+  (AES-KW, RFC 3394) and the new WRAP/UNWRAP usage flags (PSA_ALG_KWP
+  reports NOT_SUPPORTED).
+- Ascon-Hash256 and Ascon-AEAD128 (one-shot), XChaCha20-Poly1305
+  (one-shot, 24-byte nonce) with the PSA_KEY_TYPE_XCHACHA20/ASCON key
+  types.
+- SP800-108r1 counter-mode KDFs: PSA_ALG_SP800_108_COUNTER_HMAC(hash)
+  and PSA_ALG_SP800_108_COUNTER_CMAC.
+- `psa_check_key_usage()`, `psa_generate_key_custom()` and
+  `psa_key_derivation_output_key_custom()` (default parameters only).
+- 1.4 semantic change: ECDSA and deterministic ECDSA are treated as
+  equivalent when verifying signatures.
+- Complete 1.4 macro surface: PQC classifier/encoding macros (ML-DSA,
+  ML-KEM, SLH-DSA, LMS/HSS, XMSS), WPA3-SAE values, encapsulation and
+  key-wrap size macros, hash-suspend format constants, and PQC arms in
+  the signature/export size macros (PSA_SIGNATURE_MAX_SIZE is now 4627).
+- Stubs returning PSA_ERROR_NOT_SUPPORTED for the interruptible
+  operations, `psa_attach_key()` and `psa_hash_suspend/resume()`.
+  SLH-DSA key types are recognized but report NOT_SUPPORTED.
+- New coverage tests: ML-DSA, ML-KEM/KEM API, XOF, AES-KW, signature
+  contexts, LMS/XMSS verify, Ascon/XChaCha, SP800-108 and 1.4 misc.
+
+
 ## v5.9.1
 
 Initial official release of `wolfPSA`. This project follows wolfSSL version numbering.

Makefile

@@ -21,6 +21,7 @@ OBJ_PIC := $(patsubst src/%.c,$(OBJDIR_PIC)/%.o,$(SRC))
 
 WOLFCRYPT_SRC := \
 	$(WOLFSSL_PATH)/wolfcrypt/src/aes.c \
+	$(WOLFSSL_PATH)/wolfcrypt/src/ascon.c \
 	$(WOLFSSL_PATH)/wolfcrypt/src/asn.c \
 	$(WOLFSSL_PATH)/wolfcrypt/src/chacha.c \
 	$(WOLFSSL_PATH)/wolfcrypt/src/chacha20_poly1305.c \

build-test/build-variant.sh

@@ -69,6 +69,17 @@ HAVE_CURVE448
 HAVE_ED448
 WOLFSSL_ED448_STREAMING_VERIFY
 WOLFSSL_HAVE_MLDSA
+WOLFSSL_HAVE_MLKEM
+WOLFSSL_HAVE_LMS
+WOLFSSL_LMS_VERIFY_ONLY
+WOLFSSL_HAVE_XMSS
+WOLFSSL_XMSS_VERIFY_ONLY
+WOLFSSL_EXPERIMENTAL_SETTINGS
+HAVE_ASCON
+WOLFSSL_AES_DIRECT
+HAVE_AES_KEYWRAP
+HAVE_XCHACHA
+HAVE_CMAC_KDF
 "
 
 flags="${BASELINE}"