Add CB_ONLY mode for ML-KEM by padelsbach · Pull Request #11212 · wolfSSL/wolfssl

padelsbach · 2026-08-19T23:51:32Z

Description

Saves approx 14kB when enabled/offloaded.

Testing

Added new tests

Checklist

added tests
updated/added doxygen
updated appropriate READMEs
Updated manual and documentation

github-actions · 2026-08-20T00:16:32Z

padelsbach · 2026-08-20T22:44:17Z

jenkins retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11212

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 10
10 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11212

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 6
4 finding(s) posted as inline comments (see file-level comments below)

Required changes (2)

CB_ONLY_MLKEM strips ML-KEM assembly that retained helpers still call, breaking the link

File: wolfcrypt/src/wc_mlkem_poly.c:7199
Function: mlkem_to_bytes
Category: Logic errors

WOLF_CRYPTO_CB_ONLY_MLKEM now compiles out all of wc_mlkem_asm.S and the ARM *-mlkem-asm* files, but wc_mlkem_poly.c keeps mlkem_to_bytes/mlkem_from_bytes/mlkem_cmp/mlkem_gen_matrix/mlkem_csubq_c, which reference mlkem_to_bytes_avx2, mlkem_csubq_neon, mlkem_arm32_csubq etc. Any asm-enabled build (--enable-intelasm, --enable-armasm) fails to link; wc_MlKemKey_EncodePublicKey needs mlkem_to_bytes.

Recommendation: Keep the still-referenced assembly helpers compiled under CB_ONLY_MLKEM, or disable the asm paths consistently in wc_mlkem_poly.c for that mode.

Referenced code: wolfcrypt/src/wc_mlkem_poly.c:7199-7201 (3 lines)

CB_ONLY_MLKEM strips ML-KEM assembly while wc_mlkem_poly.c still calls it

File: wolfcrypt/src/wc_mlkem_poly.c:7104
Function: mlkem_from_bytes
Category: Preprocessor-conditional security bypass

WOLF_CRYPTO_CB_ONLY_MLKEM disables the whole of wc_mlkem_asm.S (and the ARM ML-KEM asm), but the new gating in wc_mlkem_poly.c leaves mlkem_from_bytes, mlkem_to_bytes and mlkem_cmp compiled with their asm dispatch intact. With USE_INTEL_SPEEDUP (or aarch64 WOLFSSL_ARMASM) the library fails to link on mlkem_from_bytes_avx2, mlkem_to_bytes_avx2, mlkem_cmp_avx2/_avx512, mlkem_cmp_neon. No added CI config enables asm, so this is uncaught.

Recommendation: Keep the byte-packing/compare assembly routines compiled under WOLF_CRYPTO_CB_ONLY_MLKEM, or force WC_MLKEM_NO_ASM in that mode, and add an asm-enabled CB_ONLY_MLKEM CI entry.

Referenced code: wolfcrypt/src/wc_mlkem_poly.c:7104-7106 (3 lines)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

philljj · 2026-08-31T17:11:33Z

Retest this please.

(no logs)

philljj

merge conflict in wolfcrypt test.c

philljj · 2026-09-04T23:17:52Z

Retest this please.

(all green except one hang in ready config)

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11212

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 4
3 finding(s) posted as inline comments (see file-level comments below)

Required changes (1)

ARM assembly builds with WOLF_CRYPTO_CB_ONLY_MLKEM lose mlkem_csubq while mlkem_to_bytes_c still calls it

File: wolfcrypt/src/wc_mlkem_poly.c:7337
Function: mlkem_to_bytes_c
Category: Preprocessor-conditional security bypass

mlkem_to_bytes_c is ungated and calls mlkem_csubq_c, which on WOLFSSL_ARMASM builds is a macro for mlkem_csubq_neon/mlkem_thumb2_csubq/mlkem_arm32_csubq (wc_mlkem.h:832/848/864). Those symbols now compile out with the ARM ML-KEM asm, so every ARM asm build with WOLF_CRYPTO_CB_ONLY_MLKEM fails to link wc_MlKemKey_EncodePrivateKey/EncodePublicKey. The Intel path was fixed at line 7365 but the ARM path was not.

Recommendation: Keep the C mlkem_csubq_c (or the ARM csubq asm) available when WOLF_CRYPTO_CB_ONLY_MLKEM is defined.

Referenced code: wolfcrypt/src/wc_mlkem_poly.c:7337-7339 (3 lines)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

padelsbach · 2026-09-08T18:41:23Z

jenkins retest this please

philljj · 2026-09-08T20:49:15Z

Retest this please.

(PRB config A openssl test timeout)

padelsbach · 2026-09-22T17:07:23Z

retest this please

Copilot

Copilot review overview

🟡 Changes recommended

The option contract, callback-only tests, and Visual Studio ARM64 stripping have unresolved defects.

Review effort: Balanced
Findings: 3

Open (3)

Honor callback-only mode for default TLS ML-KEM · New
Gate pending ML-KEM test for native-only builds · New
Propagate callback-only ML-KEM guard to ARM64 Visual Studio builds · New

What changed in this PR

Adds an ML-KEM crypto-callback-only mode to reduce binary size by removing native lattice operations and assembly implementations.

Changes:

Routes ML-KEM operations exclusively through crypto callbacks.
Excludes native polynomial and assembly implementations.
Adds configuration validation, CI coverage, and callback-only tests.

File	Description
`.github/workflows/cryptocb-only.yml`	Adds ML-KEM callback-only CI configurations.
`configure.ac`	Enables callback-only ML-KEM for selected builds.
`tests/api/test_mlkem.c`	Gates native-only API tests.
`wolfcrypt/src/cryptocb.c`	Documents the new build option.
`wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S`	Excludes ARM32 assembly.
`wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c`	Excludes inline ARM32 assembly.
`wolfcrypt/src/port/arm/armv8-mlkem-asm.S`	Excludes AArch64 assembly.
`wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c`	Excludes inline AArch64 assembly.
`wolfcrypt/src/port/arm/thumb2-mlkem-asm.S`	Excludes Thumb-2 assembly.
`wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c`	Excludes inline Thumb-2 assembly.
`wolfcrypt/src/wc_mlkem.c`	Retains public dispatch APIs while removing native operations.
`wolfcrypt/src/wc_mlkem_asm.S`	Excludes x86 ML-KEM assembly.
`wolfcrypt/src/wc_mlkem_poly.c`	Removes native lattice math while retaining serialization helpers.
`wolfcrypt/test/test.c`	Adds callback-only dispatch and serialization tests.
`wolfssl/wolfcrypt/settings.h`	Validates callback-only configuration constraints.
`wolfssl/wolfcrypt/wc_mlkem.h`	Exposes native-implementation availability.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

philljj · 2026-10-01T21:35:17Z

Retest this please.

(network interruption orsomething)

philljj · 2026-10-01T22:05:20Z

cryptocb ci is angry:

  ../wolfcrypt/src/wc_mlkem.c: In function 'wc_MlKemKey_PrivateKeyDecode':
  ../wolfcrypt/src/wc_mlkem.c:3357:22: warning: implicit declaration of function 'mlkemkey_get_k'; did you mean 'mlkem_keygen'? [-Wimplicit-function-declaration]
   3357 |         int scrubK = mlkemkey_get_k(key);
        |                      ^~~~~~~~~~~~~~
        |                      mlkem_keygen

philljj

merge conflict from the shake cryptocb PR

…ue, windows arm64 asm

padelsbach requested a review from wolfSSL-Fenrir-bot August 20, 2026 22:44

wolfSSL-Fenrir-bot requested changes Aug 20, 2026

View reviewed changes

padelsbach force-pushed the cbonly-mlkem branch 3 times, most recently from 6ee7ab0 to 1e0d76c Compare August 24, 2026 20:23

padelsbach assigned wolfSSL-Bot Aug 24, 2026

padelsbach force-pushed the cbonly-mlkem branch from 1e0d76c to 30b3da0 Compare August 24, 2026 20:41

philljj requested review from philljj and wolfSSL-Fenrir-bot August 27, 2026 14:17

padelsbach force-pushed the cbonly-mlkem branch from 30b3da0 to 24c9732 Compare August 27, 2026 15:15

wolfSSL-Fenrir-bot requested changes Aug 27, 2026

View reviewed changes

Comment thread wolfcrypt/src/wc_mlkem_poly.c

Comment thread wolfcrypt/test/test.c Outdated

Comment thread wolfcrypt/test/test.c

padelsbach commented Aug 27, 2026

View reviewed changes

Comment thread wolfcrypt/src/wc_mlkem_poly.c

padelsbach commented Aug 27, 2026

View reviewed changes

Comment thread wolfcrypt/test/test.c Outdated

padelsbach commented Aug 27, 2026

View reviewed changes

Comment thread wolfcrypt/test/test.c

padelsbach force-pushed the cbonly-mlkem branch from 24c9732 to 3434b9d Compare August 27, 2026 18:12

padelsbach force-pushed the cbonly-mlkem branch 2 times, most recently from c45c30d to 0d7ec0f Compare September 3, 2026 03:36

philljj requested changes Sep 3, 2026

View reviewed changes

philljj assigned padelsbach and unassigned wolfSSL-Bot Sep 3, 2026

padelsbach force-pushed the cbonly-mlkem branch from 0d7ec0f to 643f207 Compare September 4, 2026 17:26

padelsbach assigned wolfSSL-Bot and unassigned padelsbach Sep 4, 2026

philljj requested a review from wolfSSL-Fenrir-bot September 7, 2026 17:23

wolfSSL-Fenrir-bot requested changes Sep 7, 2026

View reviewed changes

Comment thread wolfcrypt/src/wc_mlkem_poly.c

Comment thread wolfcrypt/src/wc_mlkem_poly.c

Comment thread wolfcrypt/test/test.c Outdated

padelsbach force-pushed the cbonly-mlkem branch from 643f207 to 1f6eb54 Compare September 8, 2026 17:03

padelsbach force-pushed the cbonly-mlkem branch from 1f6eb54 to ee45af2 Compare September 11, 2026 03:25

padelsbach force-pushed the cbonly-mlkem branch from ee45af2 to a986297 Compare September 18, 2026 23:14

padelsbach force-pushed the cbonly-mlkem branch from a986297 to e0487eb Compare September 29, 2026 17:06

Copilot AI balanced review requested due to automatic review settings October 1, 2026 00:13

padelsbach force-pushed the cbonly-mlkem branch from e0487eb to ed89d4a Compare October 1, 2026 00:13

Copilot started reviewing on behalf of padelsbach October 1, 2026 00:15 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread configure.ac Outdated

Comment thread tests/api/test_mlkem.c

Comment thread wolfcrypt/src/port/arm/armv8-mlkem-asm.S

padelsbach force-pushed the cbonly-mlkem branch from 8c58328 to 4f4d03d Compare October 1, 2026 16:50

philljj assigned padelsbach and unassigned wolfSSL-Bot Oct 1, 2026

padelsbach force-pushed the cbonly-mlkem branch from 4f4d03d to 3db50a4 Compare October 2, 2026 00:43

padelsbach assigned philljj and unassigned padelsbach Oct 2, 2026

padelsbach requested a review from philljj October 2, 2026 00:43

philljj requested changes Oct 2, 2026

View reviewed changes

philljj assigned padelsbach Oct 2, 2026

padelsbach force-pushed the cbonly-mlkem branch from 3db50a4 to 70bd595 Compare October 2, 2026 19:43

padelsbach removed their assignment Oct 2, 2026

padelsbach added 4 commits October 2, 2026 20:34

Add CB_ONLY mode for ML-KEM

4628df0

PR feedback: add precompiler checks, update test cases

59f10e6

PR feedback: cryptocb find handling, remove TLS requirement, test iss…

44c5d00

…ue, windows arm64 asm

Address test issue, update dox

a988163

padelsbach force-pushed the cbonly-mlkem branch from 70bd595 to a988163 Compare October 3, 2026 03:45

Conversation

padelsbach commented Aug 19, 2026

Description

Testing

Checklist

Uh oh!

github-actions Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

padelsbach commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11212

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11212

Required changes (2)

CB_ONLY_MLKEM strips ML-KEM assembly that retained helpers still call, breaking the link

CB_ONLY_MLKEM strips ML-KEM assembly while wc_mlkem_poly.c still calls it

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

philljj commented Aug 31, 2026

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

philljj commented Sep 4, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11212

Required changes (1)

ARM assembly builds with WOLF_CRYPTO_CB_ONLY_MLKEM lose mlkem_csubq while mlkem_to_bytes_c still calls it

Uh oh!

Uh oh!

Uh oh!

Uh oh!

padelsbach commented Sep 8, 2026

Uh oh!

philljj commented Sep 8, 2026

Uh oh!

padelsbach commented Sep 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

philljj commented Oct 1, 2026

Uh oh!

philljj commented Oct 1, 2026

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Aug 20, 2026 •

edited

Loading

padelsbach commented Aug 20, 2026 •

edited

Loading