Add SLH-DSA Support

[aidangarske]

Description

• Add FIPS 205 SLH-DSA support for all 12 parameter sets.
• Implement key management, signatures, encoders, and decoders.
• Support pure and external message encodings.
• Support deterministic and seeded test operations.
• Serialize operations that share mutable wolfSSL key state.
• Support signing builds and verify-only wolfSSL builds.
• Add OpenSSL KAT, interoperability, version-matrix, and unit coverage.
• Pass all 20 SLH-DSA unit tests and 497 OpenSSL KAT vectors.
• fixes the docker confusion and merges to main docker
• Adds more osp intgration tests for mldsa, mlkem, slh-dsa
• Adds simple example for PQC
• depends on Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder #453 which needs merged first
• depends on Add libacvp PQC test coverage osp#351
• Docs Document the wolfProvider post-quantum build options and defines documentation#274
• revert osp patch to point to osp master

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Frauschi]

🐺 Skoll Code Review

Overall recommendation:REQUEST_CHANGES
Findings: 12 total — 5 posted, 7 skipped

Posted findings

• [High] openssl_example.c rewrite hard-fails on the IDE/Android and IDE/XCODE flows — examples/openssl_example.c:47-75 (duplicated in examples/pqc_openssl_example.c:225-238)
• [Medium] KAT vector accounting: the verify-only SLH-DSA KAT can pass with zero vectors, the exact 3099 count is pinned against a floating OpenSSL tag, and the old 2602 comment was left behind — .github/workflows/wolfssl-versions-pqc.yml:204-214
• [Medium] WOLFSSL_SLHDSA_CONFIG is missing from the dependency cache key, undocumented in --help, and contradicted by INTEGRATION_GUIDE — scripts/utils-wolfssl.sh:64-70
• [Medium] Example build gating and portability: executableDir may trip -Wmaybe-uninitialized, and BUILD_PQC_EXAMPLE is true for verify-only SLH-DSA builds where the example always fails — examples/openssl_example.c:62-75; examples/pqc_openssl_example.c:225-238
• [Low] wp_mlkem_kem.c doc comment no longer matches the code it documents — src/wp_mlkem_kem.c:186

Skipped findings

• [High] libacvp PQC job likely cannot build runtest, so the whole workflow may no-op
• [Medium] SLH-DSA test coverage gaps: four guard paths and the deterministic-keygen seed length validation are unexercised
• [Low] CI workflow hygiene: example steps run before the dependency push, nginx-pqc adds per-workflow apt installs, and test.sh defaults WOLFPROV_ROOT to a path nothing produces
• [Low] wp_slhdsa_key_types uses opaque index arithmetic into a flat parameter array
• [Low] test_slhdsa.c hygiene: randomised input described as deterministic, a verify context initialised with sign-only params, mixed XMEM*/libc string calls, and redundant double cleanup
• [Low] SLH-DSA locking contract is looser than the mutex implies: the key mutex is held across the full multi-second sign and across thread-local CheckKey work, wp_slhdsa_get_key() hands out a raw pointer to guarded state, and construction-time hasPub/hasPriv writes are unlocked
• [Info] settings.h pulls a wolfSSL algorithm header into every translation unit

Review generated by Skoll via Claude/Codex

[Frauschi]

🐺 Skoll Code Review

Overall recommendation:APPROVE
Findings: 16 total — 7 posted, 9 skipped

Posted findings

• [Medium] SLH-DSA verify-only CI row is indistinguishable from the plain slhdsa row and cannot detect a lost WOLFSSL_SLHDSA_CONFIG — .github/workflows/wolfssl-versions-pqc.yml:183-191
• [Medium] wc_SlhDsaKey_CheckKey runs twice on every SLH-DSA keypair import — src/wp_slhdsa_kmgmt.c:854,895
• [Low] wp_slhdsa_validate holds keyMutex across a full key copy and wc_SlhDsaKey_CheckKey — src/wp_slhdsa_kmgmt.c:745-795
• [Low] nginx-pqc installs packages that are already baked into the test-deps image, against that image's stated policy — .github/workflows/nginx-pqc.yml:132-136
• [Low] Missing cast on OPENSSL_malloc return — src/wp_slhdsa_kmgmt.c:766
• [Low] if (dupPub) is not guarded by ok while the adjacent if (ok && dupPriv) is — src/wp_slhdsa_kmgmt.c:455
• [Low] word32 sigSz; declared uninitialized in wp_slhdsa_sign — src/wp_slhdsa_sig.c:344

Skipped findings

• [Low] run_vector_family silently mutates its caller's local counters via bash dynamic scoping
• [Low] 7 of 12 SLH-DSA AlgorithmIdentifier OID arcs are never exercised by any test
• [Low] extra_key gains a stray trailing dash on 7 of 8 matrix rows
• [Low] wp_slhdsa_validate nests refMutex inside keyMutex and runs the full CheckKey inside the shared key's critical section
• [Low] wp_slhdsa_sign and wp_slhdsa_verify hold the per-key mutex across the entire multi-second wolfSSL SLH-DSA operation
• [Info] Do not 'fix' SLH-DSA's export_object / verify_message_final to match ML-DSA and ECX -- SLH-DSA is the correct one
• [Info] Examples gate on the configure macro WOLFPROV_HAVE_* rather than the resolved WP_HAVE_*
• [Info] encData cleansed with post-encryption length instead of allocation size
• [Info] Three sites write hasPub/hasPriv without keyMutex, contradicting the invariant documented at wp_slhdsa_kmgmt.c:271

Review generated by Skoll via Claude/Codex

[Copilot]

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/INTEGRATION_GUIDE.md:171

• The updated PQC requirements still say that any OpenSSL 3.x is supported on the next line, but settings.h gates ML-KEM, ML-DSA, and SLH-DSA on OpenSSL 3.6+. Following this guide with OpenSSL 3.0–3.5 therefore ends in a compile-time error. Update the OpenSSL requirement to 3.6+.

- **wolfSSL**: v5.9.2-stable or later. v5.9.1-stable defines `HAVE_DILITHIUM` and exposes `wc_dilithium_sign_ctx_msg` (the older name for the FIPS 204 pure-mode signer) but does not yet ship the canonical `WOLFSSL_HAVE_MLDSA` macro, `<wolfssl/wolfcrypt/wc_mldsa.h>` header, or `wc_MlDsaKey_SignCtx` alias that wolfProvider gates on.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #455

Scan targets checked:wolfprovider-bugs, wolfprovider-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[padelsbach]

Can you add some A/B comparison scenarios to this file between WP and OSSL? Iiuc, the outputs should be byte identical

[aidangarske]

Added WP/OpenSSL A/B checks for identical seeded keys and deterministic signatures.

[padelsbach]

For interop testing, can you add PEM and DER file interop between WP and OSSL?

[aidangarske]

Added DER and PEM key-file interop in both directions.

[padelsbach]

The WP_HAVE_SLHDSA check is within the WP_HAVE_MLKEM check. Shouldn't these be orthogonal?

[aidangarske]

Made the SLH-DSA tests independent of the ML-KEM build guards.

[padelsbach]

AI tells me only 5 of the 12 of this table are covered by tests

[aidangarske]

Added keygen and metadata coverage for all 12 parameter sets.

[aidangarske]

Jenkins retest this please