Skip to content

Add libacvp PQC test coverage - #351

Open
aidangarske wants to merge 1 commit into
wolfSSL:masterfrom
aidangarske:add-libacvp-pqc-tests
Open

Add libacvp PQC test coverage#351
aidangarske wants to merge 1 commit into
wolfSSL:masterfrom
aidangarske:add-libacvp-pqc-tests

Conversation

@aidangarske

@aidangarske aidangarske commented Jul 30, 2026

Copy link
Copy Markdown
Member
  • Adds wolfProvider integration coverage to pinned libacvp v2.3.1.
  • Exercises ML-KEM 512, 768, and 1024.
  • Exercises ML-DSA 44, 65, and 87.
  • Exercises SLH-DSA SHA2-128f.
  • Corrects two ML-KEM output-size queries in the OpenSSL adapter.
  • Supports normal and force-fail provider-routing tests.
  • Passes all eight wolfProvider CI matrix configurations.

Copilot AI review requested due to automatic review settings July 30, 2026 23:25
Copilot AI reviewed Jul 30, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@aidangarske aidangarske mentioned this pull request Jul 30, 2026
Open
4 tasks
@aidangarske
aidangarske requested a review from ColtonWilley July 30, 2026 23:33
@aidangarske aidangarske self-assigned this Jul 30, 2026
@aidangarske
aidangarske requested a review from padelsbach July 30, 2026 23:33
padelsbach
padelsbach previously approved these changes Aug 3, 2026
View reviewed changes
Comment thread wolfProvider/libacvp/libacvp-v2.3.1-wolfprov.patch
printf("Error initializing encapsulate in ML-KEM encap\n");
goto end;
}
- if (EVP_PKEY_encapsulate(pkey_ctx, NULL, &out_len, tc->k, &out_len_2) != 1) {

@padelsbach padelsbach Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a simple patch. Can you post a PR on Cisco's github?

@aidangarske aidangarske Aug 3, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't we have to wait for next version to pin to or pin to a commit? Id rather just keep one patch for the version it just supplies the tests

@padelsbach

padelsbach commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

@aidangarske, looking a bit closer, I think this is an issue in wolfprovider.

Commit e44edc66 made this change to deviate from OpenSSL, making WP more strict:

-    /* Size-only query: out == NULL with outLen/secretLen set per OpenSSL
-     * KEM encapsulate contract. Mixed-NULL is a caller bug, not a size
-     * query, so reject it explicitly. */
-    if (out == NULL) {
+    /* Size-only query: both output buffers NULL. A mixed-NULL request (one
+     * buffer NULL, the other not) is a caller bug, not a size query. */
+    if ((out == NULL) && (secret == NULL)) {

Can you add a test case in wolfprovider EVP_PKEY_encapsulate and _decapsulate? Should confirm that WP is off.

@padelsbach
padelsbach dismissed their stale review August 3, 2026 19:58

needs more investigation in WP vs OSSL

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@padelsbach padelsbach padelsbach left review comments
@ColtonWilley ColtonWilley Awaiting requested review from ColtonWilley

At least 1 approving review is required to merge this pull request.

Assignees

@aidangarske aidangarske

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@aidangarske @padelsbach