Added support for ML-DSA in softhsm2-util

Author: antoinelochet

.github/workflows/ci.yml

@@ -143,35 +143,71 @@ jobs:
           make check || (find . -name test-suite.log -exec cat {} \; && false)
 
   windows:
-    name: Windows (${{ matrix.arch }}, ${{ matrix.backend }})
+    name: Windows (${{ matrix.arch }}, ${{ matrix.backend }}, OpenSSL ${{ matrix.ossl-version }})
     runs-on: windows-2022
     strategy:
       fail-fast: false
       matrix:
         include:
+          # OpenSSL 1.1.1n variants (+ Botan 2.19.3)
           - arch: x64
             backend: openssl
             target-platform: x64
-            build-options:
+            ossl-version: "1.1.1n"
+            botan-version: ""
+            build-options: ""
           - arch: x64
             backend: botan
             target-platform: x64
-            build-options: -DENABLE_ECC=OFF -DENABLE_EDDSA=OFF
+            ossl-version: "1.1.1n"
+            botan-version: "2.19.3"
+            build-options: "-DENABLE_ECC=OFF -DENABLE_EDDSA=OFF"
           - arch: x86
             backend: openssl
             target-platform: Win32
-            build-options: -DENABLE_ECC=OFF -DENABLE_EDDSA=OFF
+            ossl-version: "1.1.1n"
+            botan-version: ""
+            build-options: "-DENABLE_ECC=OFF -DENABLE_EDDSA=OFF"
+          # OpenSSL 3.4.1
+          - arch: x64
+            backend: openssl
+            target-platform: x64
+            ossl-version: "3.4.1"
+            botan-version: ""
+            build-options: ""
+          - arch: x86
+            backend: openssl
+            target-platform: Win32
+            ossl-version: "3.4.1"
+            botan-version: ""
+            build-options: "-DENABLE_ECC=OFF -DENABLE_EDDSA=OFF"
+          # OpenSSL 3.5.4 + ML-DSA (x64 only — 32-bit runner limitation)
+          - arch: x64
+            backend: openssl
+            target-platform: x64
+            ossl-version: "3.5.4"
+            botan-version: ""
+            build-options: "-DENABLE_MLDSA=ON"
+            mldsa-test: "true"
     steps:
       - uses: actions/checkout@v4
       - uses: ilammy/msvc-dev-cmd@v1
         with:
           arch: ${{ matrix.arch }}
       - name: Create vcpkg.json
-        run: >
-          echo '{ "dependencies": [ "openssl", "botan", "cppunit" ],
-                  "overrides": [ { "name": "openssl", "version-string": "1.1.1n" },
-                                 { "name": "botan",   "version-string": "2.19.3" } ],
-                  "builtin-baseline": "38d1652f152d36481f2f4e8a85c0f1e14f3769f7" }' > vcpkg.json
+        shell: pwsh
+        run: |
+          $deps = @("openssl", "cppunit")
+          $overrides = @(@{ name = "openssl"; "version-string" = "${{ matrix.ossl-version }}" })
+          if ("${{ matrix.backend }}" -eq "botan") {
+            $deps += "botan"
+            $overrides += @{ name = "botan"; "version-string" = "${{ matrix.botan-version }}" }
+          }
+          [ordered]@{
+            dependencies     = $deps
+            overrides        = $overrides
+            "builtin-baseline" = "38d1652f152d36481f2f4e8a85c0f1e14f3769f7"
+          } | ConvertTo-Json -Depth 5 | Out-File vcpkg.json -Encoding utf8
       - uses: seanmiddleditch/vcpkg-action@master
         id: vcpkg
         with:
@@ -186,5 +222,6 @@ jobs:
       - name: Test
         env:
           CTEST_OUTPUT_ON_FAILURE: 1
+          MLDSA_TEST: ${{ matrix.mldsa-test || '' }}
         run: |
           cmake --build build --target RUN_TESTS

.gitignore

@@ -81,5 +81,5 @@ src/lib/test/softhsm2-reset-on-fork.conf
 src/lib/test/softhsm2-mech.conf
 src/lib/test/softhsm2-negative-mech.conf
 src/lib/test/softhsm2.conf
-src/lib/test/tokens/64d6c3fe-1575-1736-1d26-5ccb28440ea7/
-src/lib/test/tokens/dummy
+src/lib/test/tokens
+src/bin/util/test/tokens

cmake/modules/CompilerOptions.cmake

@@ -370,6 +370,27 @@ elseif(WITH_CRYPTO_BACKEND STREQUAL "openssl")
         message(STATUS "OpenSSL: Support for EDDSA is disabled")
     endif(ENABLE_EDDSA)
 
+    # acx_openssl_mldsa.m4
+    if(ENABLE_MLDSA)
+        # ML-DSA
+        set(testfile ${CMAKE_SOURCE_DIR}/cmake/modules/tests/test_openssl_mldsa.c)
+        try_run(RUN_MLDSA COMPILE_RESULT
+                "${CMAKE_BINARY_DIR}/prebuild_santity_tests" ${testfile}
+                LINK_LIBRARIES ${CRYPTO_LIBS}
+                CMAKE_FLAGS
+                    "-DINCLUDE_DIRECTORIES=${CRYPTO_INCLUDES}"
+                )
+        if(COMPILE_RESULT AND RUN_MLDSA EQUAL 0)
+            set(WITH_ML_DSA 1)
+            message(STATUS "OpenSSL: Found ML-DSA")
+        else()
+            set(error_msg "OpenSSL: Cannot find ML-DSA! OpenSSL library has no ML-DSA support!")
+            message(FATAL_ERROR ${error_msg})
+        endif()
+    else(ENABLE_MLDSA)
+        message(STATUS "OpenSSL: Support for ML-DSA is disabled")
+    endif(ENABLE_MLDSA)
+
     # acx_openssl_gost.m4
     if(ENABLE_GOST)
         set(testfile ${CMAKE_SOURCE_DIR}/cmake/modules/tests/test_openssl_gost.c)

cmake/modules/tests/test_openssl_mldsa.c

@@ -0,0 +1,12 @@
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+int main()
+{
+    EVP_PKEY_CTX *ctx;
+    ctx = EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
+    
+    if (ctx == NULL)
+        return 1;
+    EVP_PKEY_CTX_free(ctx);
+    return 0;
+}

configure.ac

@@ -232,6 +232,7 @@ AC_CONFIG_FILES([
 	src/bin/keyconv/Makefile
 	src/bin/migrate/Makefile
 	src/bin/util/Makefile
+	src/bin/util/test/Makefile
 ])
 
 AC_OUTPUT

m4/acx_openssl_mldsa.m4

@@ -20,6 +20,7 @@ AC_DEFUN([ACX_OPENSSL_MLDSA],[
     					EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
 						if (pctx == NULL)
 							return 1;
+						EVP_PKEY_CTX_free(pctx);
 						return 0;
 				}
 			]])

src/bin/util/CMakeLists.txt

@@ -43,3 +43,7 @@ install(TARGETS ${PROJECT_NAME}
 install(FILES ${PROJECT_NAME}.1
         DESTINATION ${CMAKE_INSTALL_MANDIR}/man1
         )
+
+if(BUILD_TESTS)
+    add_subdirectory(test)
+endif(BUILD_TESTS)

src/bin/util/Makefile.am

@@ -36,6 +36,8 @@ if WITH_BOTAN
 softhsm2_util_SOURCES +=	softhsm2-util-botan.cpp
 endif
 
+SUBDIRS =		test
+
 EXTRA_DIST =		$(srcdir)/CMakeLists.txt \
 			$(srcdir)/*.h \
 			$(srcdir)/*.cpp