KMAC and cSHAKE: Add new algorithms

Add KMAC and cSHAKE as defined in SP 800-185.
Fixed the SHA-3 assembly usage on AMD chips to use the faster BMI version.

Author: SparkiDev

.github/workflows/cmake.yml

@@ -64,7 +64,9 @@ jobs:
             -DWOLFSSL_RNG:BOOL=yes -DWOLFSSL_RSA:BOOL=yes -DWOLFSSL_RSA_PSS:BOOL=yes \
             -DWOLFSSL_SESSION_TICKET:BOOL=ON -DWOLFSSL_SHA:BOOL=yes -DWOLFSSL_SHA224:BOOL=yes \
             -DWOLFSSL_SHA3:STRING=yes -DWOLFSSL_SHA384:BOOL=yes -DWOLFSSL_SHA512:BOOL=yes \
-            -DWOLFSSL_SHAKE128:STRING=yes -DWOLFSSL_SHAKE256:STRING=yes -DWOLFSSL_SINGLE_THREADED:BOOL=no \
+            -DWOLFSSL_SHAKE128:STRING=yes -DWOLFSSL_SHAKE256:STRING=yes \
+            -DWOLFSSL_CSHAKE:BOOL=yes -DWOLFSSL_KMAC:BOOL=yes \
+            -DWOLFSSL_SINGLE_THREADED:BOOL=no \
             -DWOLFSSL_SNI:BOOL=yes -DWOLFSSL_SP_MATH_ALL:BOOL=yes -DWOLFSSL_SRTP:BOOL=yes \
             -DWOLFSSL_STUNNEL:BOOL=yes -DWOLFSSL_SUPPORTED_CURVES:BOOL=yes -DWOLFSSL_SYS_CA_CERTS:BOOL=yes \
             -DWOLFSSL_TICKET_NONCE_MALLOC:BOOL=yes -DWOLFSSL_TLS13:BOOL=yes -DWOLFSSL_TLSV12:BOOL=yes \

.wolfssl_known_macro_extras

@@ -732,9 +732,7 @@ WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
 WOLFSSL_ARM_ARCH_NEON_64BIT
 WOLFSSL_ASCON_UNROLL
 WOLFSSL_ASN_EXTRA
-WOLFSSL_ASN_TEMPLATE_NEED_SET_INT32
 WOLFSSL_ASN_TEMPLATE_TYPE_CHECK
-WOLFSSL_ASYNC_CERT_YIELD
 WOLFSSL_ATECC508
 WOLFSSL_ATECC508A_NOSOFTECC
 WOLFSSL_ATECC508A_TLS
@@ -828,7 +826,6 @@ WOLFSSL_MANUALLY_SELECT_DEVICE_CONFIG
 WOLFSSL_MDK5
 WOLFSSL_MEM_FAIL_COUNT
 WOLFSSL_MICROCHIP_AESGCM
-WOLFSSL_MLKEM_DYNAMIC_KEYS
 WOLFSSL_MLKEM_INVNTT_UNROLL
 WOLFSSL_MLKEM_NO_MALLOC
 WOLFSSL_MLKEM_NTT_UNROLL
@@ -936,6 +933,8 @@ WOLFSSL_SERVER_EXAMPLE
 WOLFSSL_SETTINGS_FILE
 WOLFSSL_SGX_CPUID_AVX512_VAES
 WOLFSSL_SHA256_ALT_CH_MAJ
+WOLFSSL_SHA3_AVX2
+WOLFSSL_SHA3_NO_AVX2
 WOLFSSL_SHA3_PPC64_BLOCKS_N
 WOLFSSL_SHA512_HASHTYPE
 WOLFSSL_SHUTDOWNONCE

CMakeLists.txt

@@ -1341,6 +1341,28 @@ add_option("WOLFSSL_SHAKE128"
     "Enable wolfSSL SHAKE128 support (default: enabled on x86_64/aarch64)"
     "no" "yes;no;small")
 
+# cSHAKE and KMAC (NIST SP 800-185), both built on SHAKE. KMAC is built on
+# cSHAKE, so enabling KMAC also enables cSHAKE; cSHAKE can be enabled on its own.
+add_option("WOLFSSL_CSHAKE"
+    "Enable wolfSSL cSHAKE support (default: disabled)"
+    "no" "yes;no")
+
+add_option("WOLFSSL_KMAC"
+    "Enable wolfSSL KMAC support (default: disabled)"
+    "no" "yes;no")
+
+# KMAC is built on cSHAKE - enabling KMAC enables cSHAKE.
+if(WOLFSSL_KMAC)
+    override_cache(WOLFSSL_CSHAKE "yes")
+endif()
+
+# cSHAKE (and thus KMAC) require SHA-3 and SHAKE. Force-enable them.
+if(WOLFSSL_CSHAKE)
+    override_cache(WOLFSSL_SHA3 "yes")
+    override_cache(WOLFSSL_SHAKE128 "yes")
+    override_cache(WOLFSSL_SHAKE256 "yes")
+endif()
+
 # SHA512
 add_option("WOLFSSL_SHA512"
     "Enable wolfSSL SHA-512 support (default: enabled)"
@@ -2053,6 +2075,21 @@ else()
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_SHAKE128")
 endif()
 
+# cSHAKE / KMAC
+if(WOLFSSL_CSHAKE)
+    if(NOT WOLFSSL_SHA3)
+        message(FATAL_ERROR "Must have SHA-3 enabled: --enable-sha3")
+    endif()
+    # SHA-3 (and hence SHAKE/cSHAKE/KMAC) is only emitted for non-32-bit builds;
+    # keep these in step so they are never defined without SHAKE.
+    if(NOT WOLFSSL_32BIT)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CSHAKE")
+        if(WOLFSSL_KMAC)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_KMAC")
+        endif()
+    endif()
+endif()
+
 # POLY1305
 set(POLY1305_DEFAULT "yes")
 if(WOLFSSL_FIPS)

cmake/options.h.in

@@ -359,6 +359,10 @@ extern "C" {
 #cmakedefine WOLFSSL_SHAKE128
 #undef WOLFSSL_SHAKE256
 #cmakedefine WOLFSSL_SHAKE256
+#undef WOLFSSL_CSHAKE
+#cmakedefine WOLFSSL_CSHAKE
+#undef WOLFSSL_KMAC
+#cmakedefine WOLFSSL_KMAC
 #undef WOLFSSL_SRTP
 #cmakedefine WOLFSSL_SRTP
 #undef WOLFSSL_SYS_CA_CERTS

configure.ac

@@ -1681,6 +1681,8 @@ then
         test "$enable_aesxts_stream" = "" && test "$enable_aesxts" = "yes" && enable_aesxts_stream=yes
         test "$enable_shake128" = "" && enable_shake128=yes
         test "$enable_shake256" = "" && enable_shake256=yes
+        test "$enable_cshake" = "" && enable_cshake=yes
+        test "$enable_kmac" = "" && enable_kmac=yes
         test "$enable_compkey" = "" && enable_compkey=yes
         # AFALG lacks AES-ECB
         test "$enable_srtp_kdf" = "" && test "$enable_afalg" != "yes" && enable_srtp_kdf=yes
@@ -4874,6 +4876,49 @@ then
     fi
 fi
 
+# cSHAKE and KMAC (NIST SP 800-185), both built on SHAKE. KMAC is built on
+# cSHAKE, so enabling KMAC also enables cSHAKE; cSHAKE can be enabled on its own.
+AC_ARG_ENABLE([cshake],
+    [AS_HELP_STRING([--enable-cshake],[Enable wolfSSL cSHAKE support (default: disabled)])],
+    [ ENABLED_CSHAKE=$enableval ],
+    [ ENABLED_CSHAKE=no ]
+    )
+
+AC_ARG_ENABLE([kmac],
+    [AS_HELP_STRING([--enable-kmac],[Enable wolfSSL KMAC support (default: disabled)])],
+    [ ENABLED_KMAC=$enableval ],
+    [ ENABLED_KMAC=no ]
+    )
+
+# KMAC is built on cSHAKE - enabling KMAC enables cSHAKE.
+if test "$ENABLED_KMAC" != "no"
+then
+    ENABLED_CSHAKE=yes
+fi
+
+# cSHAKE (and thus KMAC) require SHA-3 and SHAKE. Force-enable them (unless
+# explicitly disabled).
+if test "$ENABLED_CSHAKE" != "no"
+then
+    if test "$ENABLED_SHA3" = "no"
+    then
+        AC_MSG_ERROR([cshake requires SHA-3: --enable-sha3])
+    fi
+    ENABLED_SHA3=yes
+    if test "$ENABLED_SHAKE128" != "no"
+    then
+        ENABLED_SHAKE128=yes
+    fi
+    if test "$ENABLED_SHAKE256" != "no"
+    then
+        ENABLED_SHAKE256=yes
+    fi
+    if test "$ENABLED_SHAKE128" = "no" && test "$ENABLED_SHAKE256" = "no"
+    then
+        AC_MSG_ERROR([cshake requires SHAKE128 and/or SHAKE256])
+    fi
+fi
+
 # SHA512
 AC_ARG_ENABLE([sha512],
     [AS_HELP_STRING([--enable-sha512],[Enable wolfSSL SHA-512 support (default: enabled)])],
@@ -7683,6 +7728,24 @@ else
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"
 fi
 
+# Set cSHAKE / KMAC flags. Both are built on SHAKE, so re-check here (after any
+# later logic - e.g. FIPS < 6 - may have force-disabled SHAKE) and fail with a
+# clear configure error rather than a confusing compile-time #error. KMAC
+# implies cSHAKE (ENABLED_CSHAKE was set above), so the SHAKE check on the
+# cSHAKE branch also covers KMAC.
+if test "$ENABLED_CSHAKE" != "no"
+then
+    if test "$ENABLED_SHAKE128" = "no" && test "$ENABLED_SHAKE256" = "no"
+    then
+        AC_MSG_ERROR([cshake requires SHAKE128 and/or SHAKE256, disabled in this configuration (for example by FIPS < 6)])
+    fi
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CSHAKE"
+fi
+if test "$ENABLED_KMAC" != "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KMAC"
+fi
+
 # MLKEM CFLAG processing (after FIPS section for sandwich pattern)
 if test "$ENABLED_MLKEM" != "no"
 then
@@ -13099,6 +13162,8 @@ echo "   * SHA-512:                    $ENABLED_SHA512"
 echo "   * SHA3:                       $ENABLED_SHA3"
 echo "   * SHAKE128:                   $ENABLED_SHAKE128"
 echo "   * SHAKE256:                   $ENABLED_SHAKE256"
+echo "   * cSHAKE:                     $ENABLED_CSHAKE"
+echo "   * KMAC:                       $ENABLED_KMAC"
 echo "   * SM3:                        $ENABLED_SM3"
 echo "   * BLAKE2B:                    $ENABLED_BLAKE2B"
 echo "   * BLAKE2S:                    $ENABLED_BLAKE2S"