diff --git a/src/genkey/clu_genkey.c b/src/genkey/clu_genkey.c index b9c512e8..ccc594c9 100644 --- a/src/genkey/clu_genkey.c +++ b/src/genkey/clu_genkey.c @@ -1559,7 +1559,7 @@ int wolfCLU_genKey_ML_DSA(WC_RNG* rng, char* fName, int directive, int fmt, } /* The call back function of the writing xmss key */ -#ifdef WOLFSSL_HAVE_XMSS +#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) enum wc_XmssRc wolfCLU_XmssKey_WriteCb(const byte * priv, word32 privSz, void * context) { @@ -1683,12 +1683,14 @@ enum wc_XmssRc wolfCLU_XmssKey_ReadCb(byte * priv, return WC_XMSS_RC_READ_TO_MEMORY; } -#endif /* WOLFSSL_HAVE_XMSS */ +#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ int wolfCLU_genKey_XMSS(WC_RNG* rng, char* fName, int directive, const char* paramStr) { -#ifdef WOLFSSL_HAVE_XMSS +/* XMSS key generation needs wc_XmssKey_MakeKey() and the private key + * callbacks, none of which exist in a verify-only wolfSSL build. */ +#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) int ret = 0; int fNameSz = 0; /* file name without append */ int fExtSz = 6; /* size of ".priv\0" and ".pub\0\0" */ @@ -1864,7 +1866,7 @@ int wolfCLU_genKey_XMSS(WC_RNG* rng, char* fName, (void)paramStr; return NOT_COMPILED_IN; -#endif /* HAVE_XMSS */ +#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ } #endif /* WOLFSSL_KEY_GEN && !NO_ASN*/ diff --git a/src/genkey/clu_genkey_setup.c b/src/genkey/clu_genkey_setup.c index 4c9b8838..3228373a 100644 --- a/src/genkey/clu_genkey_setup.c +++ b/src/genkey/clu_genkey_setup.c @@ -46,10 +46,12 @@ static void wolfCLU_genKeyHelp(void) ,"ml-dsa" ,"dilithium" #endif - #ifdef WOLFSSL_HAVE_XMSS + #if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) && \ + !defined(WOLFSSL_XMSS_VERIFY_ONLY) ,"xmss" ,"xmssmt" - #endif + #endif /* WOLFSSL_HAVE_XMSS && WOLFSSL_KEY_GEN && + * !WOLFSSL_XMSS_VERIFY_ONLY */ }; WOLFCLU_LOG(WOLFCLU_L0, "Available keys with current configure settings:"); @@ -73,14 +75,16 @@ static void wolfCLU_genKeyHelp(void) WOLFCLU_LOG(WOLFCLU_L0, "wolfssl -genkey ml-dsa -level " "[2|3|5] -out mykey -outform pem -output KEYPAIR"); #endif -#ifdef WOLFSSL_HAVE_XMSS +#if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) && \ + !defined(WOLFSSL_XMSS_VERIFY_ONLY) WOLFCLU_LOG(WOLFCLU_L0, "wolfssl -genkey xmss -height [10|16|20] -out mykey -outform raw" " -output KEYPAIR"); WOLFCLU_LOG(WOLFCLU_L0, "wolfssl -genkey xmssmt -height [20|40|60] -layer [2|4|8|3|6|12]" " -out mykey -outform raw -output KEYPAIR"); WOLFCLU_LOG(WOLFCLU_L0, "XMSS key file name must be something like \"XMSS-SHA2_10_256\"" "\nXMSS/XMSS^MT parametaers are determined by file name when signing"); -#endif +#endif /* WOLFSSL_HAVE_XMSS && WOLFSSL_KEY_GEN && + * !WOLFSSL_XMSS_VERIFY_ONLY */ WOLFCLU_LOG(WOLFCLU_L0, "\n\nThe above command would output the files: mykey.priv " " and mykey.pub\nChanging the -output option to just PRIV would only" @@ -474,7 +478,8 @@ int wolfCLU_genKeySetup(int argc, char** argv) #endif /* HAVE_DILITHIUM */ } else if (XSTRNCMP(keyType, "xmssmt", 6) == 0) { - #if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) + #if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) && \ + !defined(WOLFSSL_XMSS_VERIFY_ONLY) int directiveArg = wolfCLU_genKeyDirective(output); char xmssmtParam[XMSSMT_NAME_MAX_LEN + 1]; /* XMSS^MT parameter */ char xmssmtParamHead[] = "XMSSMT-SHA2_\0"; @@ -609,15 +614,23 @@ int wolfCLU_genKeySetup(int argc, char** argv) ret = wolfCLU_genKey_XMSS(&rng, keyOutFName, directiveArg, xmssmtParam); #else - wolfCLU_LogError("Invalid option, XMSS not enabled."); - WOLFCLU_LOG(WOLFCLU_L0, "Please re-configure wolfSSL with" - "--enable-xmss --enable-experimental andtry again"); + #ifdef WOLFSSL_XMSS_VERIFY_ONLY + wolfCLU_LogError("XMSS is verify-only in this wolfSSL build, as it " + "is in FIPS builds; key generation is not " + "available."); + #else + wolfCLU_LogError("Invalid option, XMSS key generation not enabled."); + WOLFCLU_LOG(WOLFCLU_L0, "Please re-configure wolfSSL with " + "--enable-xmss (and --enable-keygen) and try again."); + #endif wc_FreeRng(&rng); return NOT_COMPILED_IN; - #endif /* WOLFSSL_HAVE_XMSS */ + #endif /* WOLFSSL_HAVE_XMSS && WOLFSSL_KEY_GEN && + * !WOLFSSL_XMSS_VERIFY_ONLY */ } else if (XSTRNCMP(keyType, "xmss", 4) == 0) { - #if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) + #if defined(WOLFSSL_HAVE_XMSS) && defined(WOLFSSL_KEY_GEN) && \ + !defined(WOLFSSL_XMSS_VERIFY_ONLY) int directiveArg = wolfCLU_genKeyDirective(output); char xmssParam[XMSS_NAME_LEN + 1]; /* XMSS parameter */ char xmssParamHead[] = "XMSS-SHA2_"; @@ -683,12 +696,19 @@ int wolfCLU_genKeySetup(int argc, char** argv) ret = wolfCLU_genKey_XMSS(&rng, keyOutFName, directiveArg, xmssParam); #else - wolfCLU_LogError("Invalid option, XMSS not enabled."); - WOLFCLU_LOG(WOLFCLU_L0, "Please re-configure wolfSSL with" - "--enable-xmss --enable-experimental andtry again"); + #ifdef WOLFSSL_XMSS_VERIFY_ONLY + wolfCLU_LogError("XMSS is verify-only in this wolfSSL build, as it " + "is in FIPS builds; key generation is not " + "available."); + #else + wolfCLU_LogError("Invalid option, XMSS key generation not enabled."); + WOLFCLU_LOG(WOLFCLU_L0, "Please re-configure wolfSSL with " + "--enable-xmss (and --enable-keygen) and try again."); + #endif wc_FreeRng(&rng); return NOT_COMPILED_IN; - #endif /* WOLFSSL_HAVE_XMSS */ + #endif /* WOLFSSL_HAVE_XMSS && WOLFSSL_KEY_GEN && + * !WOLFSSL_XMSS_VERIFY_ONLY */ } else { wolfCLU_LogError("\"%s\" is an invalid key type, or not compiled in", keyType); diff --git a/src/sign-verify/clu_sign.c b/src/sign-verify/clu_sign.c index 63217f9f..c0a9625f 100644 --- a/src/sign-verify/clu_sign.c +++ b/src/sign-verify/clu_sign.c @@ -912,7 +912,9 @@ int wolfCLU_sign_data_dilithium (byte* data, char* out, word32 dataSz, char* pri int wolfCLU_sign_data_xmss(byte* data, char* out, int fSz, char* privKey) { -#ifdef WOLFSSL_HAVE_XMSS +/* Signing needs wc_XmssKey_Sign() and the private key callbacks, none of + * which exist in a verify-only wolfSSL build. */ +#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) int ret = 0; int fExtSz = 5; /* size of ".priv" */ XFILE outFile = NULL; /* output file */ @@ -1080,12 +1082,12 @@ int wolfCLU_sign_data_xmss(byte* data, char* out, int fSz, char* privKey) (void)privKey; return NOT_COMPILED_IN; -#endif /* WOLFSSL_HAVE_XMSS */ +#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ } int wolfCLU_sign_data_xmssmt(byte* data, char* out, int fSz, char* privKey) { -#ifdef WOLFSSL_HAVE_XMSS +#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) int ret = 0; int fExtSz = 5; /* size of ".priv" */ XFILE outFile = NULL; /* output file */ @@ -1274,7 +1276,7 @@ int wolfCLU_sign_data_xmssmt(byte* data, char* out, int fSz, char* privKey) (void)privKey; return NOT_COMPILED_IN; -#endif /* WOLFSSL_HAVE_XMSS */ +#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ } #endif /* !WOLFCLU_NO_FILESYSTEM */ diff --git a/src/sign-verify/clu_sign_verify_setup.c b/src/sign-verify/clu_sign_verify_setup.c index 7c52c8e8..460be98a 100644 --- a/src/sign-verify/clu_sign_verify_setup.c +++ b/src/sign-verify/clu_sign_verify_setup.c @@ -144,10 +144,10 @@ static void wolfCLU_signHelp(int keyType) ,"ml-dsa" ,"dilithium" #endif - #ifdef WOLFSSL_HAVE_XMSS + #if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) ,"xmss" ,"xmssmt" - #endif + #endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ }; WOLFCLU_LOG(WOLFCLU_L0, "\nAvailable keys with current configure settings:"); @@ -191,7 +191,7 @@ static void wolfCLU_signHelp(int keyType) " -in -out \n"); break; #endif - #ifdef WOLFSSL_HAVE_XMSS + #if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) case XMSS_SIG_VER: WOLFCLU_LOG(WOLFCLU_L0, "XMSS Sign Usage: \nwolfssl -xmss -sign -inkey " " -in -out \n"); @@ -202,7 +202,7 @@ static void wolfCLU_signHelp(int keyType) " -in -out \n"); WOLFCLU_LOG(WOLFCLU_L0, "***************************************************************"); break; - #endif + #endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ default: WOLFCLU_LOG(WOLFCLU_L0, "No valid key type defined.\n"); } diff --git a/wolfclu/genkey/clu_genkey.h b/wolfclu/genkey/clu_genkey.h index a670c5ef..ca7128ef 100644 --- a/wolfclu/genkey/clu_genkey.h +++ b/wolfclu/genkey/clu_genkey.h @@ -147,10 +147,12 @@ int wolfCLU_genKey_ML_DSA(WC_RNG* rng, char* fName, int directive, int fmt, * * return WOLFCLU_SUCCESS on success */ -#ifdef WOLFSSL_HAVE_XMSS +/* A verify-only wolfSSL XMSS build has no private key, so there is nothing + * for these callbacks to read or write. FIPS builds are verify-only. */ +#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY) enum wc_XmssRc wolfCLU_XmssKey_WriteCb(const byte* priv, word32 privSz, void* context); enum wc_XmssRc wolfCLU_XmssKey_ReadCb(byte* priv, word32 privSz, void* context); -#endif +#endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */ /** * generate a XMSS key