Skip to content

Commit f04b3d4

Browse files
FrauschiFrauschi
committed
wc_pkcs11: add ML-KEM PKCS#11 integration
1 parent 3fd13b8 commit f04b3d4

8 files changed

Lines changed: 1007 additions & 11 deletions

File tree

‎wolfcrypt/src/ext_mlkem.c‎

Lines changed: 77 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,27 +111,97 @@ int wc_MlKemKey_Init(MlKemKey* key, int type, void* heap, int devId)
111111

112112
/* Keep type for parameters. */
113113
key->type = type;
114+
key->heap = heap;
114115

115116
#ifdef WOLF_CRYPTO_CB
116117
key->devCtx = NULL;
117118
key->devId = devId;
119+
#endif
120+
#ifdef WOLF_PRIVATE_KEY_ID
121+
key->idLen = 0;
122+
key->labelLen = 0;
118123
#endif
119124
}
120125

121-
(void)heap;
122126
(void)devId;
123127

124128
return ret;
125129
}
126130

131+
#ifdef WOLF_PRIVATE_KEY_ID
132+
int wc_MlKemKey_Init_Id(MlKemKey* key, const unsigned char* id, int len,
133+
void* heap, int devId)
134+
{
135+
int ret = 0;
136+
137+
if (key == NULL) {
138+
ret = BAD_FUNC_ARG;
139+
}
140+
if (ret == 0 && (len < 0 || len > MLKEM_MAX_ID_LEN)) {
141+
ret = BUFFER_E;
142+
}
143+
144+
if (ret == 0) {
145+
ret = wc_MlKemKey_Init(key, WC_ML_KEM_1024, heap, devId);
146+
}
147+
if (ret == 0 && id != NULL && len != 0) {
148+
XMEMCPY(key->id, id, (size_t)len);
149+
key->idLen = len;
150+
}
151+
152+
return ret;
153+
}
154+
155+
int wc_MlKemKey_Init_Label(MlKemKey* key, const char* label, void* heap,
156+
int devId)
157+
{
158+
int ret = 0;
159+
int labelLen = 0;
160+
161+
if (key == NULL || label == NULL) {
162+
ret = BAD_FUNC_ARG;
163+
}
164+
if (ret == 0) {
165+
labelLen = (int)XSTRLEN(label);
166+
if ((labelLen == 0) || (labelLen > MLKEM_MAX_LABEL_LEN)) {
167+
ret = BUFFER_E;
168+
}
169+
}
170+
if (ret == 0) {
171+
ret = wc_MlKemKey_Init(key, WC_ML_KEM_1024, heap, devId);
172+
}
173+
if (ret == 0) {
174+
XMEMCPY(key->label, label, (size_t)labelLen);
175+
key->labelLen = labelLen;
176+
}
177+
178+
return ret;
179+
}
180+
#endif
181+
127182
/**
128183
* Free the Kyber key object.
129184
*
130185
* @param [in, out] key Kyber key object to dispose of.
131186
*/
132187
int wc_MlKemKey_Free(MlKemKey* key)
133188
{
189+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
190+
int ret = 0;
191+
#endif
192+
134193
if (key != NULL) {
194+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
195+
if (key->devId != INVALID_DEVID) {
196+
ret = wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
197+
WC_PK_TYPE_PQC_KEM_KEYGEN, WC_PQC_KEM_TYPE_KYBER, (void*)key);
198+
if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
199+
return ret;
200+
}
201+
/* fall-through to software cleanup */
202+
}
203+
(void)ret;
204+
#endif
135205
/* Ensure all private data is zeroed. */
136206
ForceZero(key, sizeof(*key));
137207
}
@@ -391,6 +461,10 @@ int wc_MlKemKey_MakeKey(MlKemKey* key, WC_RNG* rng)
391461
OQS_SUCCESS) {
392462
ret = BAD_FUNC_ARG;
393463
}
464+
else {
465+
key->pubKeySet = 1;
466+
key->prvKeySet = 1;
467+
}
394468
}
395469
wolfSSL_liboqsRngMutexUnlock();
396470
OQS_KEM_free(kem);
@@ -639,6 +713,7 @@ int wc_MlKemKey_DecodePrivateKey(MlKemKey* key, const unsigned char* in,
639713

640714
if (ret == 0) {
641715
XMEMCPY(key->priv, in, privLen);
716+
key->prvKeySet = 1;
642717
}
643718

644719
return ret;
@@ -679,6 +754,7 @@ int wc_MlKemKey_DecodePublicKey(MlKemKey* key, const unsigned char* in,
679754

680755
if (ret == 0) {
681756
XMEMCPY(key->pub, in, pubLen);
757+
key->pubKeySet = 1;
682758
}
683759

684760
return ret;

‎wolfcrypt/src/wc_mlkem.c‎

Lines changed: 78 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@
7575
#include <wolfssl/wolfcrypt/wc_mlkem.h>
7676
#include <wolfssl/wolfcrypt/hash.h>
7777
#include <wolfssl/wolfcrypt/memory.h>
78+
#ifdef WOLF_CRYPTO_CB
79+
#include <wolfssl/wolfcrypt/cryptocb.h>
80+
#endif
7881

7982
#ifdef NO_INLINE
8083
#include <wolfssl/wolfcrypt/misc.h>
@@ -298,9 +301,14 @@ int wc_MlKemKey_Init(MlKemKey* key, int type, void* heap, int devId)
298301
/* Cache heap pointer. */
299302
key->heap = heap;
300303
#ifdef WOLF_CRYPTO_CB
301-
/* Cache device id - not used in this algorithm yet. */
304+
key->devCtx = NULL;
305+
/* Cache device id. */
302306
key->devId = devId;
303307
#endif
308+
#ifdef WOLF_PRIVATE_KEY_ID
309+
key->idLen = 0;
310+
key->labelLen = 0;
311+
#endif
304312
key->flags = 0;
305313

306314
/* Zero out all data. */
@@ -322,6 +330,60 @@ int wc_MlKemKey_Init(MlKemKey* key, int type, void* heap, int devId)
322330
return ret;
323331
}
324332

333+
#ifdef WOLF_PRIVATE_KEY_ID
334+
int wc_MlKemKey_Init_Id(MlKemKey* key, const unsigned char* id, int len,
335+
void* heap, int devId)
336+
{
337+
int ret = 0;
338+
339+
if (key == NULL) {
340+
ret = BAD_FUNC_ARG;
341+
}
342+
if (ret == 0 && (len < 0 || len > MLKEM_MAX_ID_LEN)) {
343+
ret = BUFFER_E;
344+
}
345+
346+
if (ret == 0) {
347+
/* Use max level so PKCS#11 lookup has a key object to operate on. */
348+
ret = wc_MlKemKey_Init(key, WC_ML_KEM_1024, heap, devId);
349+
}
350+
if (ret == 0 && id != NULL && len != 0) {
351+
XMEMCPY(key->id, id, (size_t)len);
352+
key->idLen = len;
353+
}
354+
355+
return ret;
356+
}
357+
358+
int wc_MlKemKey_Init_Label(MlKemKey* key, const char* label, void* heap,
359+
int devId)
360+
{
361+
int ret = 0;
362+
int labelLen = 0;
363+
364+
if (key == NULL || label == NULL) {
365+
ret = BAD_FUNC_ARG;
366+
}
367+
if (ret == 0) {
368+
labelLen = (int)XSTRLEN(label);
369+
if ((labelLen == 0) || (labelLen > MLKEM_MAX_LABEL_LEN)) {
370+
ret = BUFFER_E;
371+
}
372+
}
373+
374+
if (ret == 0) {
375+
/* Use max level so PKCS#11 lookup has a key object to operate on. */
376+
ret = wc_MlKemKey_Init(key, WC_ML_KEM_1024, heap, devId);
377+
}
378+
if (ret == 0) {
379+
XMEMCPY(key->label, label, (size_t)labelLen);
380+
key->labelLen = labelLen;
381+
}
382+
383+
return ret;
384+
}
385+
#endif
386+
325387
/**
326388
* Free the Kyber key object.
327389
*
@@ -330,7 +392,22 @@ int wc_MlKemKey_Init(MlKemKey* key, int type, void* heap, int devId)
330392
*/
331393
int wc_MlKemKey_Free(MlKemKey* key)
332394
{
395+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
396+
int ret = 0;
397+
#endif
398+
333399
if (key != NULL) {
400+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
401+
if (key->devId != INVALID_DEVID) {
402+
ret = wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
403+
WC_PK_TYPE_PQC_KEM_KEYGEN, WC_PQC_KEM_TYPE_KYBER, (void*)key);
404+
if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
405+
return ret;
406+
}
407+
/* fall-through to software cleanup */
408+
}
409+
(void)ret;
410+
#endif
334411
/* Dispose of PRF object. */
335412
mlkem_prf_free(&key->prf);
336413
/* Dispose of hash object. */

0 commit comments

Comments
 (0)