Repository navigation
Conversation
refuses SHA-1 HKDF (HkdfDigestAllowed() in fips.c), and the caller-seeded SLH-DSA keygen and SLH-DSA/ML-DSA signing services return the WC_FIPS_NOT_APPROVED indicator on success. Accordingly, gate out hkdf_test's SHA-1 vectors, and change the call sites that predate the SEED_OK convention to expect SEED_OK (slh_dsa_param_test, the WOLFSSL_TEST_PQC_SEED_KAT blocks) or to absorb the indicator where the calling contract has no ride for it (myCryptoDevCb, the devId sw/hw comparison in cryptocb_pqc_mldsa_test). No behavior changes in builds without WC_HAVE_FIPS_INDICATOR.
wc_MlKemKey_EncapsulateWithRandom returns WC_FIPS_NOT_APPROVED on success. Change the KAT-vector call sites and the WC_NO_RNG arm of the parameter loop to expect SEED_OK, absorb the indicator in the devId sw/hw comparison (cryptocb_pqc_mlkem_encap), and add NB_STEP_SEEDED()/NB_RUN_SEEDED() for the caller-seeded calls in the ML-KEM and ML-DSA non-blocking tests, which also covers the seeded keygen and signing indicators there. Calls under NB_START() are left in flight and never return the indicator, so they are unchanged.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The FIPS v7 wrapper sources are missing, requiring module-owner review against the matching bundle to confirm SHA-1 HKDF rejection gates and seeded-operation indicators across nonblocking and crypto-callback paths.
No open issues 🎉
What changed in this PR
Updates wolfCrypt self-tests to handle WC_HAVE_FIPS_INDICATOR return values and FIPS v7 restrictions.
Changes:
- Skips SHA-1 HKDF tests when FIPS v7 approved-mode gates are enabled.
- Handles
SEED_OKin caller-seeded ML-KEM, ML-DSA, and SLH-DSA tests, including nonblocking paths. - Normalizes seeded success returns to zero in callback implementations and related tests.
| File | Description |
|---|---|
wolfcrypt/test/test.c |
Adjusts HKDF guards and post-quantum test return handling for FIPS indicator compatibility. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tested with
with and without
LIBWOLFSSL_CONFIGURE_ARGS_OVERRIDE=CFLAGS=-DWC_HAVE_FIPS_INDICATOR