Skip to content

Add benchmark coverage for every parameter set, ECC curve and RSA key size the build supports #662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dgarske wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add benchmark coverage for every parameter set, ECC curve and RSA key size the build supports #662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f245b0
bench: cover every parameter set, curve and RSA size the build supports
dgarske Nov 2, 2026
c9e769b
Run only the benchmark in the ML-DSA-44 trim CI configuration
dgarske Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/workflows/fwtpm-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,18 @@ jobs:
wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen --enable-dilithium --enable-mlkem --enable-experimental --enable-harden --disable-tls13 --disable-hkdf
build_only: false

# v1.85 PQC with one ML-DSA parameter set left out, so the server
# answers TPM_RC_PARMS for it. The benchmark walks every set, so it
# has to record that one as unsupported and carry on to the rest.
# The unit tests use ML-DSA-44 throughout, so only the benchmark
# runs, in its own step below.
- name: fwtpm-v185-mldsa-trim
os: ubuntu-latest
wolftpm_config: --enable-fwtpm --enable-swtpm --enable-v185
wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen --enable-dilithium --enable-mlkem --enable-experimental --enable-harden
build_only: true
extra_cflags: -DWOLFSSL_NO_ML_DSA_44

# Build-only: fwTPM with RSA disabled
- name: fwtpm-no-rsa
os: ubuntu-latest
Expand Down Expand Up @@ -391,6 +403,36 @@ jobs:
./examples/bench/bench -iter=1 | tee /tmp/fwtpm_no_sha1_bench.log
grep -E '^SHA1[[:space:]]+Skipped [(]not supported[)]$' /tmp/fwtpm_no_sha1_bench.log

- name: Run benchmark with ML-DSA-44 left out
if: matrix.name == 'fwtpm-v185-mldsa-trim'
run: |
set -euo pipefail
./src/fwtpm/fwtpm_server --clear > /tmp/fwtpm_mldsa_trim.log 2>&1 &
server_pid=$!
trap 'kill "$server_pid" 2>/dev/null || true' EXIT
sleep 1
kill -0 "$server_pid"
./examples/bench/bench -iter=1 | tee /tmp/fwtpm_mldsa_trim_bench.log
grep -E '^ML-DSA +44 key gen +Skipped [(]not supported[)]$' \

@embhorn embhorn Nov 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI covers the PQC skip path but not the new RSA and ECC dimensions · test

The new runtime step checks that ML-DSA-44 is skipped and ML-DSA-65 runs. It does not configure or assert any P-384, P-521, or RSA size above 2048 row, so the new ECC and RSA loops have no automated runtime coverage.

Suggested fix: Add a -iter=1 CI configuration with additional curves and RSA-3072 support, then assert that those rows run.

/tmp/fwtpm_mldsa_trim_bench.log
grep -E '^ML-DSA +65 key gen +[0-9]' /tmp/fwtpm_mldsa_trim_bench.log
grep -E '^ECDSA +384 verify +[0-9]' /tmp/fwtpm_mldsa_trim_bench.log
grep -E '^ECDSA +521 verify +[0-9]' /tmp/fwtpm_mldsa_trim_bench.log

- name: Run benchmark across RSA sizes
if: matrix.name == 'fwtpm-rsa4096'
run: |
set -euo pipefail
./src/fwtpm/fwtpm_server --clear > /tmp/fwtpm_rsa4096.log 2>&1 &
server_pid=$!
trap 'kill "$server_pid" 2>/dev/null || true' EXIT
sleep 1
kill -0 "$server_pid"
./examples/bench/bench -iter=1 | tee /tmp/fwtpm_rsa4096_bench.log
grep -E '^RSA +3072 Priv OAEP +[0-9]' /tmp/fwtpm_rsa4096_bench.log
grep -E '^RSA +4096 Priv OAEP +[0-9]' /tmp/fwtpm_rsa4096_bench.log
grep -E '^ECDSA +384 verify +[0-9]' /tmp/fwtpm_rsa4096_bench.log

- name: Print test-suite.log on failure
if: ${{ failure() && !matrix.build_only }}
run: |
Expand Down
Loading
Loading