Repository navigation
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the XMSS verify-only compatibility changes.
No open issues 🎉
What changed in this PR
This PR adapts wolfCLU to verify-only XMSS configurations, addressing build errors with wolfSSL FIPS Ready and FIPS v7+.
Changes:
- Excludes XMSS private-key callbacks, key generation, and signing implementations from verify-only builds.
- Hides unavailable XMSS/XMSSMT generation and signing options from help output.
- Adds explicit errors when key generation is requested in verify-only builds.
| File | Description |
|---|---|
wolfclu/genkey/clu_genkey.h |
Guards private-key callback declarations against verify-only builds. |
src/sign-verify/clu_sign.c |
Uses the unavailable-feature fallback for XMSS/XMSSMT signing in verify-only builds. |
src/sign-verify/clu_sign_verify_setup.c |
Hides XMSS/XMSSMT signing help when unavailable. |
src/genkey/clu_genkey.c |
Guards XMSS callbacks and key generation implementations. |
src/genkey/clu_genkey_setup.c |
Updates generation guards, help output, and error messages. |
Review effort: Balanced
sebastian-carpenter
left a comment
sebastian-carpenter
left a comment
There was a problem hiding this comment.
Might be good to add xmss verify-only to the github CI
| WOLFCLU_LOG(WOLFCLU_L0, "Please re-configure wolfSSL with" | ||
| "--enable-xmss --enable-experimental andtry again"); | ||
| #ifdef WOLFSSL_XMSS_VERIFY_ONLY | ||
| wolfCLU_LogError("XMSS is verify-only in this wolfSSL build, as it " |
There was a problem hiding this comment.
It might be better to guard this log (and the others) in two ways. One which tests HAVE_FIPS and logs that XMSS key gen is not possible due to FIPS constraints. And the other which says verify only is set so wolfssl would have to be rebuilt appropriately.
Also this can technically be printed even when XMSS is not configured. Add WOLFSSL_HAVE_XMSS
| @@ -1080,12 +1082,12 @@ int wolfCLU_sign_data_xmss(byte* data, char* out, int fSz, char* privKey) | |||
| (void)privKey; | |||
|
|
|||
| return NOT_COMPILED_IN; | |||
There was a problem hiding this comment.
LOW-3: Sign in a verify-only build fails with only a bare error code, unlike genkey [NIT] (question)
File: src/sign-verify/clu_sign.c:1078-1085,1272-1279; src/sign-verify/clu_sign_verify_setup.c:194-207
Function: wolfCLU_sign_data_xmss / wolfCLU_sign_data_xmssmt / wolfCLU_signHelp
Confidence: High
In a verify-only build, wolfssl -xmss -sign ... gets through argument parsing and reads the input file. wolfCLU_sign_data still dispatches XMSS_SIG_VER (it's guarded only by WOLFSSL_HAVE_XMSS), and the new stub returns NOT_COMPILED_IN without logging anything. The user sees only Error returned: -174. from clu_main.c. wolfssl -xmss -sign -help prints "No valid key type defined." for an algorithm the build does support for verify. The genkey path in this same diff prints a clear verify-only reason, so a FIPS user gets an explanation for genkey but not for sign. Staying silent does match the sibling sign stubs (rsa, ed25519, dilithium also return NOT_COMPILED_IN without a message), so this is optional.
Code:
#else
(void)data;
(void)out;
(void)fSz;
(void)privKey;
return NOT_COMPILED_IN;
#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */
Recommendation: Either keep the silent behavior to match the sibling sign stubs, or add the same one-line verify-only error to both XMSS sign stubs so genkey and sign behave the same way.
| */ | ||
| #ifdef WOLFSSL_HAVE_XMSS | ||
| /* A verify-only wolfSSL XMSS build has no private key, so there is nothing | ||
| * for these callbacks to read or write. FIPS builds are verify-only. */ |
There was a problem hiding this comment.
drop the FIPS reference in the comment. This can be derived from the logging change
Fixes build errors when wolfssl is built with
./configure --enable-fips=ready --enable-wolfcluwolfSSL FIPS Ready and v7+ only enables XMSS for verify only, this PR accommodate that build within wolfCLU.