FrodoKEM: ASN.1 keys, X.509 certicates

Added support for encoding and decoding keys in ASN.1.
Added support for X.509 certificates and CSRs.
Generated certificates and CSRs. Not fo FrodoKEM-640 as is not in the specs.

Author: SparkiDev

.wolfssl_known_macro_extras

@@ -842,6 +842,7 @@ WOLFSSL_EXTRA
 WOLFSSL_FORCE_OCSP_NONCE_CHECK
 WOLFSSL_FRDM_K64
 WOLFSSL_FRDM_K64_JENKINS
+WOLFSSL_FRODOKEM_NO_ASN1
 WOLFSSL_FUNC_TIME
 WOLFSSL_FUNC_TIME_LOG
 WOLFSSL_GEN_CERT

certs/frodokem/README.txt

@@ -0,0 +1,42 @@
+FrodoKEM test key material for wolfSSL tests.
+
+IMPORTANT - these files are NOT generated by OpenSSL.
+
+FrodoKEM is a Key Encapsulation Mechanism (KEM). Neither OpenSSL nor the
+liboqs oqs-provider expose it as a certificate / key-encoding algorithm with
+the ISO/IEC 18033-2 key OIDs (arc 1.0.18033.2.2.7.x) that wolfSSL uses - their
+FrodoKEM support is KEM-only, for TLS key exchange, and is not going to be
+present as a signature/certificate algorithm. So, unlike the ML-DSA material
+in certs/mldsa/ (produced with OpenSSL 3.5+), these fixtures are generated by
+wolfSSL itself using wc_MakeCert_ex() / wc_MakeCertReq_ex().
+
+A KEM public key cannot sign, so the certificate and the request are signed by
+an ECC (P-256) issuer key; the FrodoKEM key is only ever the subject public
+key.
+
+Files (material is provided for parameter sets N in {976, 1344}; the 640 set
+has no standardised OID and cannot be encoded):
+  gen_frodokem.c              Generator (the "regeneration" tool; see below).
+  frodokem-ca-ecc-key.der     ECC P-256 issuer (CA) private key (DER / PEM).
+  frodokem-ca-ecc-key.pem
+  frodokem-ca-ecc-cert.der    Self-signed ECC issuer (CA) certificate.
+  frodokem-ca-ecc-cert.pem
+  frodokem<N>-key.der         FrodoKEM-<N> (SHAKE) private key, PKCS#8.
+  frodokem<N>-key.pem
+  frodokem<N>_pub-spki.der    FrodoKEM-<N> public key, SubjectPublicKeyInfo.
+  frodokem<N>-cert.der        FrodoKEM-<N> leaf certificate signed by the ECC
+  frodokem<N>-cert.pem        CA (subject key is FrodoKEM, signature is ECDSA).
+  frodokem<N>-req.der         FrodoKEM-<N> certificate request (PKCS#10),
+  frodokem<N>-req.pem         signed by the ECC key.
+
+Regenerating:
+  wolfSSL must be built with (at least):
+    --enable-experimental --enable-frodokem --enable-certgen --enable-certreq
+    --enable-certext --enable-keygen --enable-ecc
+    CPPFLAGS="-DHAVE_PKCS8 -DWOLFSSL_DER_TO_PEM"
+  then:
+    cc gen_frodokem.c -lwolfssl -o gen_frodokem
+    (cd certs/frodokem && ./gen_frodokem)
+
+  The keys are generated fresh each run, so the output bytes differ every time;
+  the committed copies are a stable snapshot for the test suite.

certs/frodokem/frodokem-ca-ecc-cert.der

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICEzCCAbmgAwIBAgIQLsJMxJ0pvxI9bYcdLnYYWTAKBggqhkjOPQQDAjBxMQsw
+CQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQ
+MA4GA1UECgwHd29sZlNTTDENMAsGA1UECwwEVGVzdDEdMBsGA1UEAwwURnJvZG9L
+RU0gVGVzdCBFQ0MgQ0EwIhgPMjAyNjA3MTIwNDE3MzhaGA8yMTI2MDYxOTA0MTcz
+OFowcTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3QxHTAbBgNVBAMM
+FEZyb2RvS0VNIFRlc3QgRUNDIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+lmrJv8E5Z9nxzcyFWnRcQDwQVK0yZW10dS1i2xWRHquf4YNX4C/TXwUVqCGaSgaT
+UxwbCF3QtR5y43n6rKNYmqMvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU41ak
+BnP4505sNDHigUVlOFv0K9gwCgYIKoZIzj0EAwIDSAAwRQIhAPRzykW9LJ8iATDl
+jIE5crF2/5YCg+RYMB2XG2VrVoeLAiBAVo3KhhWGCZgSlQ1JmlGSmFnLM7UaiXzE
+TeZ8oyaqXA==
+-----END CERTIFICATE-----

certs/frodokem/frodokem-ca-ecc-cert.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICBWOGxeT5BVTVs82QLQ71ahUMDedN3inIZhqsR+U89ToAoGCCqGSM49
+AwEHoUQDQgAElmrJv8E5Z9nxzcyFWnRcQDwQVK0yZW10dS1i2xWRHquf4YNX4C/T
+XwUVqCGaSgaTUxwbCF3QtR5y43n6rKNYmg==
+-----END EC PRIVATE KEY-----