Retire redundant WOLFSSL_WC_LMS and WOLFSSL_WC_XMSS macros

With external liblms/libxmss support removed, WOLFSSL_WC_LMS and
WOLFSSL_WC_XMSS no longer distinguish between backends - they are
tautologically equal to WOLFSSL_HAVE_LMS / WOLFSSL_HAVE_XMSS. Retire
them to avoid leaving dead vocabulary in the codebase.

- configure.ac: drop ENABLED_WC_LMS / ENABLED_WC_XMSS, stop defining
  -DWOLFSSL_WC_LMS / -DWOLFSSL_WC_XMSS, rename BUILD_WC_LMS /
  BUILD_WC_XMSS to BUILD_LMS / BUILD_XMSS, and remove the redundant
  "LMS/XMSS wolfSSL impl" summary echo lines
- CMakeLists.txt: drop -DWOLFSSL_WC_LMS definition alongside HAVE_LMS
- src/include.am: rename guard conditionals to BUILD_LMS / BUILD_XMSS
- Collapse "#if defined(HAVE_LMS) && defined(WC_LMS)" guards in
  wc_lms.c / wc_lms_impl.c / wc_lms.h and tests/api.c to just HAVE_LMS
- Drop the "#if !defined(WOLFSSL_WC_XMSS) #error" guard from wc_xmss.h
- settings.h: swap WC_LMS/WC_XMSS for HAVE_LMS/HAVE_XMSS in W64_WRAPPER
  and int encode/decode feature triggers
- test.c/test.h: drop redundant WOLFSSL_WC_LMS clause from the
  lms_test_verify_only gate
- benchmark.c: simplify "!defined(WOLFSSL_WC_LMS) || X" parameter-set
  gates (keep just X) and remove an XMSS pub-len check that only ran on
  the external backend
- user_settings_pq.h / user_settings_wolfboot_keytools.h: drop
  WOLFSSL_WC_LMS / WOLFSSL_WC_XMSS defines
- ChangeLog: document the macro removal

https://claude.ai/code/session_01CEeSVaiiJ6ziyya3CCz5RK

Author: claude

CMakeLists.txt

@@ -700,10 +700,8 @@ add_option(WOLFSSL_LMSSHA256192
 
 if (WOLFSSL_LMS)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS")
-    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_LMS")
 
     set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
-    set_wolfssl_definitions("WOLFSSL_WC_LMS"   RESULT)
 
     if (WOLFSSL_LMSSHA256192)
         list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHA256_192")

ChangeLog.md

@@ -8,6 +8,11 @@
   recognized. wolfSSL's own wolfCrypt implementations (`wc_lms` / `wc_xmss`)
   are now the only supported LMS/HSS and XMSS/XMSS^MT backends and are
   selected automatically by `--enable-lms` and `--enable-xmss`.
+* The `WOLFSSL_WC_LMS` and `WOLFSSL_WC_XMSS` macros, which previously selected
+  the wolfCrypt backend over the external libraries, are also retired.
+  Consumers that defined these in their `user_settings.h` should remove the
+  `#define` lines; `WOLFSSL_HAVE_LMS` / `WOLFSSL_HAVE_XMSS` are now the only
+  macros needed to enable the features.
 
 # wolfSSL Release 5.9.1 (Apr. 8, 2026)
 

configure.ac

@@ -1862,7 +1862,6 @@ then
 fi
 
 # XMSS
-ENABLED_WC_XMSS=no
 AC_ARG_ENABLE([xmss],
     [AS_HELP_STRING([--enable-xmss],[Enable stateful XMSS/XMSS^MT signatures (default: disabled)])],
     [ ENABLED_XMSS=$enableval ],
@@ -1890,12 +1889,10 @@ done
 
 if test "$ENABLED_XMSS" != "no"
 then
-    ENABLED_WC_XMSS=yes
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_XMSS -DWOLFSSL_WC_XMSS"
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_XMSS"
 fi
 
 # LMS
-ENABLED_WC_LMS=no
 AC_ARG_ENABLE([lms],
     [AS_HELP_STRING([--enable-lms],[Enable stateful LMS/HSS signatures (default: disabled)])],
     [ ENABLED_LMS=$enableval ],
@@ -1929,8 +1926,7 @@ done
 
 if test "$ENABLED_LMS" != "no"
 then
-    ENABLED_WC_LMS=yes
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_LMS -DWOLFSSL_WC_LMS"
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_LMS"
 fi
 
 # SLH-DSA
@@ -11437,8 +11433,8 @@ AM_CONDITIONAL([BUILD_FE448], [test "x$ENABLED_FE448" = "xyes" || test "x$ENABLE
 AM_CONDITIONAL([BUILD_GE448], [test "x$ENABLED_GE448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_CURVE448],[test "x$ENABLED_CURVE448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_CURVE448_SMALL],[test "x$ENABLED_CURVE448_SMALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
-AM_CONDITIONAL([BUILD_WC_LMS],[test "x$ENABLED_WC_LMS" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
-AM_CONDITIONAL([BUILD_WC_XMSS],[test "x$ENABLED_WC_XMSS" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_LMS],[test "x$ENABLED_LMS" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_XMSS],[test "x$ENABLED_XMSS" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_WC_SLHDSA],[test "x$ENABLED_SLHDSA" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_WC_MLKEM],[test "x$ENABLED_WC_MLKEM" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_DILITHIUM],[test "x$ENABLED_DILITHIUM" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
@@ -11985,9 +11981,7 @@ echo "   * CURVE448:                   $ENABLED_CURVE448"
 echo "   * ED448:                      $ENABLED_ED448"
 echo "   * ED448 streaming:            $ENABLED_ED448_STREAM"
 echo "   * LMS:                        $ENABLED_LMS"
-echo "   * LMS wolfSSL impl:           $ENABLED_WC_LMS"
 echo "   * XMSS:                       $ENABLED_XMSS"
-echo "   * XMSS wolfSSL impl:          $ENABLED_WC_XMSS"
 echo "   * SLH-DSA                     $ENABLED_SLHDSA"
 echo "   * MLKEM:                      $ENABLED_MLKEM"
 echo "   * MLKEM wolfSSL impl:         $ENABLED_WC_MLKEM"

examples/configs/user_settings_pq.h

@@ -105,7 +105,6 @@ extern "C" {
 /* ------------------------------------------------- */
 #if 0 /* LMS signatures */
     #define WOLFSSL_HAVE_LMS
-    #define WOLFSSL_WC_LMS
     #ifndef LMS_LEVELS
         #define LMS_LEVELS 2
     #endif
@@ -122,7 +121,6 @@ extern "C" {
 /* ------------------------------------------------- */
 #if 0 /* XMSS signatures */
     #define WOLFSSL_HAVE_XMSS
-    #define WOLFSSL_WC_XMSS
     #ifndef WOLFSSL_XMSS_MAX_HEIGHT
         #define WOLFSSL_XMSS_MAX_HEIGHT 20
     #endif

examples/configs/user_settings_wolfboot_keytools.h

@@ -131,7 +131,6 @@ extern "C" {
 
 #if 1 /* LMS */
     #define WOLFSSL_HAVE_LMS
-    #define WOLFSSL_WC_LMS
     #ifndef LMS_LEVELS
         #define LMS_LEVELS 1
     #endif
@@ -145,7 +144,6 @@ extern "C" {
 
 #if 1 /* XMSS */
     #define WOLFSSL_HAVE_XMSS
-    #define WOLFSSL_WC_XMSS
     #ifndef WOLFSSL_XMSS_MAX_HEIGHT
         #define WOLFSSL_XMSS_MAX_HEIGHT 32
     #endif

src/include.am

@@ -1438,12 +1438,12 @@ endif BUILD_INTELASM
 endif !BUILD_X86_ASM
 endif
 
-if BUILD_WC_LMS
+if BUILD_LMS
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_lms.c
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_lms_impl.c
 endif
 
-if BUILD_WC_XMSS
+if BUILD_XMSS
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_xmss.c
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_xmss_impl.c
 endif

tests/api.c

@@ -35037,8 +35037,7 @@ int stopOnFail = 0;
 int test_wc_LmsKey_sign_verify(void);
 int test_wc_LmsKey_reload_cache(void);
 
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS) && \
-    !defined(WOLFSSL_LMS_VERIFY_ONLY)
+#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
 
 #include <wolfssl/wolfcrypt/wc_lms.h>
 #include <wolfssl/wolfcrypt/lms.h>
@@ -35094,7 +35093,7 @@ static int test_lms_init_key(LmsKey* key, WC_RNG* rng)
     return 0;
 }
 
-#endif /* WOLFSSL_HAVE_LMS && WOLFSSL_WC_LMS && !WOLFSSL_LMS_VERIFY_ONLY */
+#endif /* WOLFSSL_HAVE_LMS && !WOLFSSL_LMS_VERIFY_ONLY */
 
 /*
  * Test basic LMS sign/verify with multiple signings.
@@ -35103,8 +35102,7 @@ static int test_lms_init_key(LmsKey* key, WC_RNG* rng)
 int test_wc_LmsKey_sign_verify(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS) && \
-    !defined(WOLFSSL_LMS_VERIFY_ONLY)
+#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
     LmsKey  key;
     WC_RNG  rng;
     byte    msg[] = "test message for LMS signing";
@@ -35153,8 +35151,7 @@ int test_wc_LmsKey_sign_verify(void)
 int test_wc_LmsKey_reload_cache(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS) && \
-    !defined(WOLFSSL_LMS_VERIFY_ONLY)
+#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
     LmsKey  key;
     LmsKey  vkey;
     WC_RNG  rng;

wolfcrypt/benchmark/benchmark.c

@@ -11411,10 +11411,8 @@ static void bench_lms_sign_verify(enum wc_LmsParm parm, byte* pub)
 
 #ifndef WOLFSSL_WC_LMS_SMALL
     do {
-    #ifdef WOLFSSL_WC_LMS
         key.priv.inited = 0;
         key.state = WC_LMS_STATE_PARMSET;
-    #endif
         ret = wc_LmsKey_Reload(&key);
         if (ret) {
             printf("wc_LmsKey_Reload failed: %d\n", ret);
@@ -11553,7 +11551,7 @@ void bench_lms(void)
 
 #ifndef WOLFSSL_NO_LMS_SHA256_256
 #ifdef BENCH_LMS_SLOW_KEYGEN
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_HEIGHT >= 15)
+#if (LMS_MAX_HEIGHT >= 15)
     bench_lms_keygen(WC_LMS_PARM_L1_H15_W2, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L1_H15_W2, pub);
     bench_lms_keygen(WC_LMS_PARM_L1_H15_W4, pub);
@@ -11562,8 +11560,7 @@ void bench_lms(void)
     #define LMS_PARAMS_BENCHED
 #endif
 #endif
-#if !defined(WOLFSSL_WC_LMS) || ((LMS_MAX_LEVELS >= 2) && \
-        (LMS_MAX_HEIGHT >= 10))
+#if (LMS_MAX_LEVELS >= 2) && (LMS_MAX_HEIGHT >= 10)
     bench_lms_keygen(WC_LMS_PARM_L2_H10_W2, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L2_H10_W2, pub);
     bench_lms_keygen(WC_LMS_PARM_L2_H10_W4, pub);
@@ -11575,33 +11572,32 @@ void bench_lms(void)
     bench_lms_sign_verify(WC_LMS_PARM_L2_H10_W8, pub);
 #endif
 #endif
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_LEVELS >= 3)
+#if (LMS_MAX_LEVELS >= 3)
     bench_lms_keygen(WC_LMS_PARM_L3_H5_W4, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L3_H5_W4, pub);
     bench_lms_keygen(WC_LMS_PARM_L3_H5_W8, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L3_H5_W8, pub);
     #undef LMS_PARAMS_BENCHED
     #define LMS_PARAMS_BENCHED
 #endif
-#if !defined(WOLFSSL_WC_LMS) || ((LMS_MAX_LEVELS >= 3) && \
-        (LMS_MAX_HEIGHT >= 10))
+#if (LMS_MAX_LEVELS >= 3) && (LMS_MAX_HEIGHT >= 10)
     bench_lms_keygen(WC_LMS_PARM_L3_H10_W4, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L3_H10_W4, pub);
 #endif
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_LEVELS >= 4)
+#if (LMS_MAX_LEVELS >= 4)
     bench_lms_keygen(WC_LMS_PARM_L4_H5_W8, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L4_H5_W8, pub);
 #endif
 
-#if defined(WOLFSSL_WC_LMS) && !defined(LMS_PARAMS_BENCHED)
+#ifndef LMS_PARAMS_BENCHED
     bench_lms_keygen(WC_LMS_PARM_L1_H5_W1, pub);
     bench_lms_sign_verify(WC_LMS_PARM_L1_H5_W1, pub);
 #endif
 #endif /* !WOLFSSL_NO_LMS_SHA256_256 */
 
 #ifdef WOLFSSL_LMS_SHA256_192
 #ifdef BENCH_LMS_SLOW_KEYGEN
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_HEIGHT >= 15)
+#if (LMS_MAX_HEIGHT >= 15)
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L1_H15_W2, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L1_H15_W2, pub);
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L1_H15_W4, pub);
@@ -11610,8 +11606,7 @@ void bench_lms(void)
     #define LMS_PARAMS_BENCHED
 #endif
 #endif
-#if !defined(WOLFSSL_WC_LMS) || ((LMS_MAX_LEVELS >= 2) && \
-        (LMS_MAX_HEIGHT >= 10))
+#if (LMS_MAX_LEVELS >= 2) && (LMS_MAX_HEIGHT >= 10)
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L2_H10_W2, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L2_H10_W2, pub);
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L2_H10_W4, pub);
@@ -11623,25 +11618,24 @@ void bench_lms(void)
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L2_H10_W8, pub);
 #endif
 #endif
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_LEVELS >= 3)
+#if (LMS_MAX_LEVELS >= 3)
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L3_H5_W4, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L3_H5_W4, pub);
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L3_H5_W8, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L3_H5_W8, pub);
     #undef LMS_PARAMS_BENCHED
     #define LMS_PARAMS_BENCHED
 #endif
-#if !defined(WOLFSSL_WC_LMS) || ((LMS_MAX_LEVELS >= 3) && \
-        (LMS_MAX_HEIGHT >= 10))
+#if (LMS_MAX_LEVELS >= 3) && (LMS_MAX_HEIGHT >= 10)
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L3_H10_W4, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L3_H10_W4, pub);
 #endif
-#if !defined(WOLFSSL_WC_LMS) || (LMS_MAX_LEVELS >= 4)
+#if (LMS_MAX_LEVELS >= 4)
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L4_H5_W8, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L4_H5_W8, pub);
 #endif
 
-#if defined(WOLFSSL_WC_LMS) && !defined(LMS_PARAMS_BENCHED)
+#ifndef LMS_PARAMS_BENCHED
     bench_lms_keygen(WC_LMS_PARM_SHA256_192_L1_H5_W1, pub);
     bench_lms_sign_verify(WC_LMS_PARM_SHA256_192_L1_H5_W1, pub);
 #endif
@@ -11722,13 +11716,6 @@ static void bench_xmss_sign_verify(const char * params)
         printf("wc_XmssKey_GetPubLen failed: %d\n", ret);
         goto exit_xmss_sign_verify;
     }
-#ifndef WOLFSSL_WC_XMSS
-    if (pkSz != XMSS_SHA256_PUBLEN) {
-        printf("error: xmss pub len: got %u, expected %d\n", pkSz,
-                XMSS_SHA256_PUBLEN);
-        goto exit_xmss_sign_verify;
-    }
-#endif
 
     ret = wc_XmssKey_GetPrivLen(&key, &skSz);
     if (ret != 0 || skSz <= 0) {

wolfcrypt/src/wc_lms.c

@@ -21,7 +21,7 @@
 
 #include <wolfssl/wolfcrypt/libwolfssl_sources.h>
 
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS)
+#ifdef WOLFSSL_HAVE_LMS
 #include <wolfssl/wolfcrypt/wc_lms.h>
 
 #ifdef NO_INLINE
@@ -1358,4 +1358,4 @@ const byte * wc_LmsKey_GetKidFromPrivRaw(const byte * priv, word32 privSz)
 
 #endif
 
-#endif /* WOLFSSL_HAVE_LMS && WOLFSSL_WC_LMS */
+#endif /* WOLFSSL_HAVE_LMS */

wolfcrypt/src/wc_lms_impl.c

@@ -48,7 +48,7 @@
     #include <wolfcrypt/src/misc.c>
 #endif
 
-#if defined(WOLFSSL_HAVE_LMS) && defined(WOLFSSL_WC_LMS)
+#ifdef WOLFSSL_HAVE_LMS
 
 /* Length of R in bytes. */
 #define LMS_R_LEN           4
@@ -3730,5 +3730,5 @@ int wc_hss_verify(LmsState* state, const byte* pub, const byte* msg,
     return ret;
 }
 
-#endif /* WOLFSSL_HAVE_LMS && WOLFSSL_WC_LMS */
+#endif /* WOLFSSL_HAVE_LMS */