A context starts in software and only wc_ecc_ctx_set_dev_id() sends the ECIES callback and the KDF, AES and HMAC steps to a device; tests, benchmark, docs and the os-check matrix are updated to match.
The config probe now uses the target include path, and ARM assembly builds in
both modes. Documents the ECIES hardware path, drops a dead protocol branch,
declines a zero length message, and builds the ECC request helpers only where
they are called. Benchmark rows no longer claim hardware they cannot reach.
stm32h563_OTP.bin is a generated one-time-programmable flashing artifact,
not source. Remove it from the tree and add it to the directory .gitignore
alongside the other generated outputs (app-falcon.*) so a local build can
no longer re-add it.
Move the AVX2 (__m256d+FMA) and AArch64 NEON FFT intrinsics, plus the three
internal seam headers (wc_falcon_{fpr,fft,poly}.h), into falcon.c so the native
implementation is one translation unit -- matching how sha256.c and chacha.c
carry their SIMD backends inline (only hand-written .S stays a separate file).
The blocks are gated by WOLFSSL_FALCON_FFT_AVX2 / _NEON and need no per-file
CFLAGS: AVX2 self-annotates every function with target("avx2,fma") and NEON is
AArch64-baseline. Per-backend FPC_* macros are undef'd before redefinition, as
sha512.c does for SHA_METHOD. Only the generated fpr x86-64 asm remains a file.
Merge the nine wc_falcon_*.c cores into wolfcrypt/src/falcon.c, matching the
one-file-per-algorithm convention (ed25519.c, wc_mldsa.c). Sign and keygen are
gated internally on WOLFSSL_FALCON_VERIFY_ONLY and the internal helpers become
static. The fpr/fft/poly primitives stay external (shared with the separate
AVX2/NEON FFT backends) so their three headers are retained; the other five
internal headers are removed.
Four fixes from PR review:
- zephyr/CMakeLists.txt: the native port split falcon.c into wc_falcon_*.c
translation units; add the portable sources so a Zephyr build with Falcon
links. x86-64 asm/AVX2 and the NEON backend are left out (not selected by any
Zephyr config).
- configure.ac: fold the standalone --enable-falcon-{asm,double,avx2,neon}
switches into comma-separated sub-options of --enable-falcon
(e.g. --enable-falcon=avx2), matching the common wolfSSL idiom. avx2/neon
imply the double backend after arch-gating so ignoring an unsupported vector
backend does not clobber an explicit 'double'. Sweep the qemu-falcon-neon doc
to the new spelling.
- configure.ac: align the Falcon line in the two feature summaries.
- falcon.c/falcon.h: drop the duplicate public-key copy kept behind the private
key. Its only remaining reader was wc_falcon_check_key, whose compare was
against a copy of the same bytes and so could never detect a real mismatch;
wc_falcon_export_private already rebuilds the concat layout on demand. Shrink
key->k from FALCON_MAX_PRV_KEY_SIZE to FALCON_MAX_KEY_SIZE (saves 1793 bytes
per key at level 5). check_key now verifies both halves are present and
documents a full cryptographic cross-check as a follow-up. Update the unit
test that relied on the old in-memory-copy compare.
Scrub the temporary "FN-DSA" name and the "FIPS 206" designation from all
in-tree comments, build text, and message strings, leaving the algorithm
named only as "Falcon". The eventual standardized name is not announced.
The differential known-answer test message ("wolfSSL FN-DSA differential
KAT") is a signed input, so the Falcon-512/1024 public keys and signatures
in wolfcrypt/test/test.c (and the mirrored Falcon-512 vector in
IDE/m33mu-falcon-verify/kat.h) were regenerated with liboqs over the new
message "wolfSSL Falcon differential KAT", preserving the differential
property (liboqs-produced signatures verified by the native verifier).
Verified: testwolfcrypt Falcon test passes; the m33mu verify-only harness
passes (BKPT 0x7f) with the regenerated vector.
Add wc_falcon_fft_neon.c, the 2-wide-double counterpart of the AVX2 FFT
backend: it processes two doubles per 128-bit vector with fused multiply-add
for the complex butterflies (falcon_FFT / falcon_iFFT), over the inline-double
fpr backend. Enabled with --enable-falcon-neon (AArch64; implies
--enable-falcon-double). Advanced SIMD is part of the ARMv8-A baseline, so no
special -march is needed; the scalar FFT/iFFT in wc_falcon_fft.c are excluded
under WOLFSSL_FALCON_FFT_NEON, and only the tail level (ht/t == 1) falls back to
scalar. Like the AVX2 backend, it does not promise bit-identical (no-FMA)
results; that is safe for the signing FFT (the sampler's determinism and
verification are unaffected).
Tested under qemu-system-aarch64 -machine virt (cortex-a53) via the new
IDE/qemu-falcon-neon bare-metal harness: a full keygen -> sign -> verify
round-trip at levels 1 and 5 accepts genuine signatures and rejects tampered
ones (NEON_FFT_PASS), with vector fmla v.2d confirmed in the FFT.
Add an optional Cortex-M (ARMv7E-M / ARMv8-M) DSP-accelerated verify path,
auto-enabled on cores with the DSP extension (__ARM_FEATURE_DSP; Cortex-M4/M7/
M33). It is bit-identical to the scalar Barrett path (validated over 40k random
polynomials per level) and controlled by WOLFSSL_FALCON_NTT_DSP /
WOLFSSL_FALCON_NO_NTT_DSP.
- NTT/iNTT butterflies process two packed 16-bit coefficients per iteration:
SMLABB/SMLATB 16x16 twiddle multiplies (values are < q < 2^14), SADD16/
SSUB16 packed adds, and a USUB16+SEL packed conditional subtract of q.
- The pointwise multiply packs two coefficients per iteration (SMLABB/SMLATT).
- The squared l2-norm accumulates two coefficients per SMUAD (a.lo^2+a.hi^2).
Tested on the STM32H563 (Cortex-M33) emulator m33mu via the new
IDE/m33mu-falcon-verify harness: the DSP path accepts a genuine Falcon-512 KAT
signature and rejects a tampered one (BKPT 0x7f), with SMUAD/USUB16/SEL/SMLABB
confirmed present in the image.
Also fixes three latent verify-only (WOLFSSL_FALCON_VERIFY_ONLY) build issues
surfaced by the embedded target:
- falcon.h: include random.h unconditionally so WC_RNG is visible for the
always-declared wc_falcon_sign_msg prototype.
- falcon.c: define falcon_store_pub_behind_priv unconditionally
(wc_falcon_import_public, a verify-only op, calls it).
- falcon.c: silence unused inLen/rng in the verify-only sign stub.
Falcon was the last algorithm backed by liboqs; now that wolfCrypt has a
native Falcon implementation, liboqs is no longer needed. Remove the
integration entirely so liboqs does not appear as a build or SBOM dependency:
- configure: drop --with-liboqs (and the -loqs link), the BUILD_LIBOQS
conditional and the summary line.
- CMake: drop WOLFSSL_OQS, the duplicate liboqs-backed WOLFSSL_FALCON
option, the OQS cross-validation / find_package(OQS) block, the
FindOQS.cmake module, BUILD_OQS_HELPER, and HAVE_LIBOQS from options.h.in.
- Remove the wolfcrypt/src/port/liboqs port layer (liboqs.c/.h) and its
wolfSSL_liboqsInit/Close calls in wc_port.c.
- settings.h: drop HAVE_LIBOQS from the asym key import/export aggregates
(HAVE_FALCON already covers them) and from the experimental gate; add
HAVE_FALCON to the experimental gate so the unstandardized Falcon requires
WOLFSSL_EXPERIMENTAL_SETTINGS in every build system.
- Drop liboqs.c from the VS/Zephyr/INTIME project files, remove the liboqs
install from Docker, and update INSTALL/tls.c text (Falcon is native now).
No functional change to non-Falcon builds; the library links no liboqs.
The non-recursive automake "distdir" recipe inlines the entire $(DISTFILES)
list into a single shell command. Enumerating every IDE integration file
individually made that list large enough (~123 KB) that the recipe exceeded
the Linux MAX_ARG_STRLEN (128 KB) single-argument exec limit, so "make dist"
failed with:
/bin/bash: Argument list too long
make[2]: *** [distdir-am] Error 127
Replace the per-file EXTRA_DIST enumeration of the IDE directories with one
wholesale "EXTRA_DIST += IDE/<dir>" entry per directory (automake copies the
tree recursively). This collapses ~745 file entries into ~52 directory
entries and shrinks the top-level DISTFILES from ~123 KB to ~97 KB, well
under the limit.
The set of distributed IDE files is unchanged: a before/after "make dist"
diff shows no project file added or removed (only the now-unused include.am
build fragments are gone). Three directories that intentionally omit some
tracked files (apple-universal, MPLABX16, Renesas - private IDE configs,
.gitkeep placeholders, helper scripts) stay enumerated file-by-file.
iotsafe-raspberrypi: goto exit on cert-load failure (was return -1).
MQX server: replace bare return -1 with goto exit + guarded cleanup.
QNX client: correct cleanup-ladder jump targets to unwind properly.
initialize ctx and ssl to NULL
validate wolfIoTSafe_GetCert's int return before casting to uint32_t
- Add GCM_TABLE_4BIT
- Add build.bat for command line build
- f5419 mutex
- f6163 AES aadBuf
- Add debug_run.bat to write and run the example from CL
- Add UART message
- Messages are routed sci2_uart_charput(). To get back to Virtual Consol, it takes BSP_CFG_USER_CHARPUT_ENABLED 0.
f1535 error messaages typo
Eric Blankenhorn
David Garske
JacobBarthelmeh
night1rider
Aidan Garske
Sean Parkinson
kaleb-himes
Mark Atwood
Daniele Lacamera
Tobias Frauenschläger
Ruby Martin
Hideki Miyazaki
Emma Stensland
jordan
Daniel Pouzzner