Skip to content

Commit 41fad5f

Browse files
aidangarskeaidangarske
committed
Fix and expand tinytls13 footprint profile across CI configs
Make every --enable-tinytls13 spelling build and pass locally, and grow the CI matrix to cover them. These are fixes found while testing the configs the CI workflow had not actually exercised. - internal.h, internal.c, ssl_load.c: include ML-DSA and Falcon in the pkCurveOID member and producer guards so the PSK plus ML-DSA build compiles. - tls13.c: gate the DoTls13CertificateVerify definition on NO_CERTS to match its call site. - settings.h: let the AES-256 adder survive the floor, default the user_settings path to the SHA-256 floor, make WOLFSSL_NO_MALLOC opt-in so the test suite still runs, and keep ML-DSA ASN.1 for the cert profile. - configure.ac: drive ENABLED_ASM and emit WOLFSSL_NO_ASM for the small C floor, restrict SP math to P-256, strip ML-DSA ASN.1 only on the PSK floor, and print a notice for the reduced security cert verify. - examples: guard the cert loading paths for NO_CERTS and treat NO_CERTS as PSK mode in echoserver and echoclient. - Add examples/configs/tinytls13_smoke.c, an in memory TLS 1.3 handshake test that drives PSK, ECDSA, ML-DSA-65 and RSA-PSS chain verify, plus forced cipher suites, for builds with no example or unit test harness. - certs: add ECDSA leaves signed by the ML-DSA-65 and RSA-PSS CAs so the cert profiles drive a real PQC and PSS chain verify in CI. - .github/workflows/tinytls13.yml: cover every profile and adder, run the smoke handshake on the build verified configs, and least privilege the workflow token.
1 parent 8bce9f0 commit 41fad5f

17 files changed

Lines changed: 507 additions & 39 deletions

File tree

‎.github/workflows/tinytls13.yml‎

Lines changed: 66 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ concurrency:
1515
cancel-in-progress: true
1616
# END OF COMMON SECTION
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
# Build + make check every --enable-tinytls13 spelling on one runner via
2023
# .github/scripts/parallel-make-check.py (see psk.yml for the pattern).
@@ -46,14 +49,25 @@ jobs:
4649
# Every tiny TLS 1.3 profile/adder spelling, so each is proven to build
4750
# and pass make check (which runs the TLS handshake test suite) out of
4851
# the box. Server is enabled where a config needs the server-side tests.
49-
- name: Build and make check all tinytls13 configs
52+
# The psk-p256 and cert-rsaverify configs strip to combinations
53+
# (ECDHE-only ECC without certs, RSA verify only) that the OpenSSL-compat
54+
# API unit suite (coupled to examples via BUILD_TESTS) does not gate for.
55+
# Rather than carry test-harness edits for those, they build static with
56+
# --disable-examples, skip make check ("check": false), and instead run
57+
# wolfcrypt/test/testwolfcrypt plus examples/configs/tinytls13_smoke.c
58+
# (a self-contained in-memory TLS 1.3 handshake) for real crypto and
59+
# handshake verification.
60+
- name: Build and test all tinytls13 configs
5061
run: |
5162
cat > "$RUNNER_TEMP/tinytls13-configs.json" <<'EOF'
5263
[
5364
{"name": "tinytls13-psk-x25519", "minutes": 1,
5465
"configure": ["--enable-tinytls13=psk,server", "--disable-mlkem"]},
55-
{"name": "tinytls13-psk-p256", "minutes": 1,
56-
"configure": ["--enable-tinytls13=psk,p256,server", "--disable-mlkem"]},
66+
{"name": "tinytls13-psk-p256", "minutes": 1, "check": false,
67+
"configure": ["--enable-tinytls13=psk,p256,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
68+
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
69+
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
70+
["./tinytls13_smoke"]]},
5771
{"name": "tinytls13-psk-staticmem", "minutes": 1,
5872
"configure": ["--enable-tinytls13=psk,server,staticmem", "--disable-mlkem"]},
5973
{"name": "tinytls13-psk-mldsa", "minutes": 1,
@@ -66,10 +80,56 @@ jobs:
6680
"configure": ["--enable-tinytls13=cert,server,sha384", "--disable-mlkem"]},
6781
{"name": "tinytls13-cert-mutualauth", "minutes": 1,
6882
"configure": ["--enable-tinytls13=cert,mutualauth,server", "--disable-mlkem"]},
69-
{"name": "tinytls13-cert-rsaverify", "minutes": 1,
70-
"configure": ["--enable-tinytls13=cert,server,rsaverify", "--disable-mlkem"]},
83+
{"name": "tinytls13-cert-rsaverify", "minutes": 1, "check": false,
84+
"configure": ["--enable-tinytls13=cert,server,rsaverify", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
85+
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
86+
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
87+
["./tinytls13_smoke"]]},
7188
{"name": "tinytls13-cert-mldsa", "minutes": 1,
72-
"configure": ["--enable-tinytls13=cert,server,mldsa", "--disable-mlkem"]}
89+
"configure": ["--enable-tinytls13=cert,server,mldsa", "--enable-static", "--disable-mlkem"],
90+
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
91+
["./tinytls13_smoke"]]},
92+
{"name": "tinytls13-psk-client-only", "minutes": 1,
93+
"configure": ["--enable-tinytls13=psk", "--disable-mlkem"]},
94+
{"name": "tinytls13-cert-client-only", "minutes": 1,
95+
"configure": ["--enable-tinytls13=cert", "--disable-mlkem"]},
96+
{"name": "tinytls13-psk-asm", "minutes": 1,
97+
"configure": ["--enable-tinytls13=psk,server,asm", "--disable-mlkem"]},
98+
{"name": "tinytls13-cert-asm", "minutes": 1,
99+
"configure": ["--enable-tinytls13=cert,server,asm", "--disable-mlkem"]},
100+
{"name": "tinytls13-cert-chacha", "minutes": 1, "check": false,
101+
"configure": ["--enable-tinytls13=cert,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
102+
"cflags": "-DHAVE_CHACHA -DHAVE_POLY1305",
103+
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
104+
["./tinytls13_smoke", "TLS13-CHACHA20-POLY1305-SHA256"]]},
105+
{"name": "tinytls13-cert-aes256", "minutes": 1, "check": false,
106+
"configure": ["--enable-tinytls13=cert,server,sha384", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
107+
"cflags": "-DWOLFSSL_AES_256",
108+
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
109+
["./tinytls13_smoke", "TLS13-AES256-GCM-SHA384"]]},
110+
{"name": "tinytls13-psk-mlkem", "minutes": 1,
111+
"configure": ["--enable-tinytls13=psk,server", "--enable-static"],
112+
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
113+
["./tinytls13_smoke", "-", "mlkem"]]},
114+
{"name": "tinytls13-cert-staticmem", "minutes": 1, "check": false,
115+
"configure": ["--enable-tinytls13=cert,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
116+
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
117+
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
118+
["./tinytls13_smoke"]]},
119+
{"name": "tinytls13-nomalloc", "minutes": 1, "check": false,
120+
"configure": ["--enable-tinytls13=psk,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests", "--disable-mlkem"],
121+
"cflags": "-DWOLFSSL_NO_MALLOC"},
122+
{"name": "tinytls13-combo-cert-mutualauth-sha384", "minutes": 1,
123+
"configure": ["--enable-tinytls13=cert,mutualauth,server,sha384", "--disable-mlkem"]},
124+
{"name": "tinytls13-combo-cert-mldsa-sha384", "minutes": 1,
125+
"configure": ["--enable-tinytls13=cert,server,mldsa,sha384", "--enable-static", "--disable-mlkem"],
126+
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
127+
["./tinytls13_smoke"]]},
128+
{"name": "tinytls13-bare", "minutes": 1,
129+
"configure": ["--enable-tinytls13", "--disable-mlkem"]},
130+
{"name": "tinytls13-usersettings", "minutes": 1, "check": false,
131+
"user_settings": "examples/configs/user_settings_tinytls13.h",
132+
"configure": ["--enable-usersettings", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests"]}
73133
]
74134
EOF
75135
.github/scripts/parallel-make-check.py \

‎certs/mldsa/ecc-leaf-mldsa65.pem‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIOXDCCAVmgAwIBAgIUHkXMjMS80gZRjcfzBuyuhnlS9yEwCwYJYIZIAWUDBAMS
3+
MFoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
4+
bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRUwEwYDVQQDDAxUZXN0IG1sZHNhNjUwHhcN
5+
MjYwNjIyMTgyNjQwWhcNMzYwNjE5MTgyNjQwWjAUMRIwEAYDVQQDDAlsb2NhbGhv
6+
c3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS7M6xMJ1BKxkqlBMM83p8223It
7+
zpTqK/rLIAk5LBboYQLpr03TApOaMVuXkiF/8M8Y2pERAjSG6CBYMwuANInYo0Iw
8+
QDAdBgNVHQ4EFgQUXV0m76x+NvmbdhUrSiUCI++yiTAwHwYDVR0jBBgwFoAU0X7s
9+
9Um6d4uq1MDByuLMZZkKhxIwCwYJYIZIAWUDBAMSA4IM7gA9PW9GacDhmkuLlT+C
10+
a7WbLvUQDQh1o7x2+gkqNN9aYFnWM3FgafeDHJGfJOmGk7RWNh7RHCnT6MmUJFXL
11+
qlnC6Q0p7rQpIE/RmkfGcuLRvZyZkLhhgHMKQRhStjzzUYVUW74JKNhc7mp7nD2i
12+
xCGeO77hy2VP65AoioniSyg71x83eqnEvUAjjtaWYwc3SoDEoSYSf0E6emIjYvvh
13+
KMUXlnLxah5X3mw6ZQXp1FspKY8VY1UkXakz/rSamEd4gmv7/cow6eObAQilHrRX
14+
OSiVL4E/uv6qfCjTlWBvpjCDGQP6PTJKYGX3RgzVDptXtlFgRw5QCzBVRQdrUdxR
15+
nZjbbtQUn7bXyKEEQtDQ32aMqlvOkdrHpDg6Nto0MTdUv0YDfA+iM4KEKItoCvNm
16+
fyO9AMQj7+BrK8hgXSAooACq2cDdELpE0PqUAdVboLFcCOu69D2cZjM8G5IhEqZG
17+
aeCTchyGD6dOtpGP7uRdYj+b+4rF1gWUNLxvkwBM7DdeSGV//00zIfiVOpZNs8BG
18+
0TAe5mVIgE4WEnp9Z0n/zesh5HLhW6d8V8rpqAikcZMOBslzEcpZS4KZIID1A5It
19+
NnNGd5u69LyE3vbjjNpif0/75ns/P+z73iO2FJQ8PnRSlPwwhd8BEpSl6lrk5/ZY
20+
L7XjyROaFZz3Iwt/mvtZrYcFaUHcMmZY/y3SKfsuyueld38XP87vRmpDk98VsUgL
21+
dBr9+QgqZLKscADMQq3f6W66ziVQY5/gzTbRt/xSCf3hazi9/TTLqQvaUpckAdqD
22+
HHr4/mTQ/zXxmXNAXwan4OKQBqy26zgIjMbATincEwDSWvFNJwDcHyYt0Pg/+tqK
23+
fXAbkvaSF0BO64nW/EGtxHa2b8EkG9n9ivvYyzVLc8D6OF+wBuxTegF8tYTavKCP
24+
UzW11/fEh+xEnIgMQ2EzK6ElxiggvJvH/AH3GAJR4C34u+IjKHm7915hCti1C6yv
25+
6NmIfvwWRHMC+2XdyLe9mmVcw8uNsAV1OpbgyNGIP+nghBhunZ23Kk8jv/LjADkA
26+
5SCOZZuM8/PEMAA98kN4CcUcSyGh1+ZcG6ArtCWIeUzlECEZ8jq0TRoj/M+pJZ8J
27+
Ll50p+wGB+maJeiFD05gKmtfAlKqgHH+TxqnTr8q+pVOlEnCMrEL6tNqWTkRwQ16
28+
t0EHstwfOjGuu+JA/1ENlfLDTHKYcmVFQv64MPHFGWknS5arj7A2Z63sxln1eCHH
29+
zzgN/eY+G5zjyYvSesCWc5MDz1JpHu8QUfO93PEVxovH/KBWcpPWI+9tNkfwPgZM
30+
dlJMalwyhvsPz45XMbpqP4UcIQlzLztk6J7KMfSYvbAUCR4aDo5HqLflHuM6MiS6
31+
saigxzmXNjomMOCM10HyHmfUSpVB5CLa9xG4ImGAFSz5eP2XTmxXQquGxf1dQlON
32+
6hfT9JW2KTNmhyjSbAmddRCXHCpUpa23GxJtw5zWelotzOYD3fN8OsSsv3Za3Exa
33+
zI6NzQ3qwZoz/7rpOAxENcZ6zA7qDs36ieqKVviaEO4Pb0ReudyE1WHoTlcUNbYK
34+
VnnFSnw8wewKxVbVCa2ic1F/x7wiDBh0BqC4biHTtJcC6iUPjKvO5JNITokuFeC9
35+
lTfRJg4Q2LWTEgfLh0wEMBhsUxRzA9MghDxfzA5BZa70//pm9pGCy6FDdVStbIxe
36+
FgGaVqHLtV47XHT2P8cHn6UszRGET4odF1S3J/Lqe9rk9p2JJECt6WhLRHUryie2
37+
hB+SfG00xmfP4eGyJEndd6ElqQ7grinVWikv9bq0MqVH3uvb8ZMLdK98gF7yZMyx
38+
xFXIOogdu0fn5qm43yrizuCLRiw1DXroS2X131ggTLJpObqauYx+gvReqma8fPX/
39+
LImlDAfgrUEGAMka3DaULRGWNNF5z5PyaIGyOokIWGvvN20ArM4J7DMzBQMzUZdz
40+
IgugrVwxzGlAW3By14S3talrdywbpdbrH/wMi7j6H/VHqyw3bx4cLydQlbjxb1d3
41+
B3wm2NgOKYIfvsqw9mHOh16XInqamwCys9LhoRiqR5DwFGyEElWuFZJq9uKQvoyo
42+
Vx1P++TDoGP6f4ycmF1kkZaKNDK7Awj+ugmGMVu95Ij74x533kfNgvUDK7ChcJfX
43+
1a3VwmBGvB51AZWzaDqqa7d6OWQkoE0NE3gPnDgbNo+vZ6+ElMSK2P9G53kBA50H
44+
UbU+T/++QF6m69d02hq7yyiSgaXpVeLtAGEHTswmx3HWzxEE1o3PIsa322xizUsJ
45+
JHmHdIpFVDvaYz4A7Per42qRfXahHAqzp0UrqERQQROuzfJAWltp35LBbJIr2BXk
46+
l1JYDvjP5plOJgeDGvl1lY+cblsuV1OzSCuXAi//ziFXTpvhrQ0r5zE96NwNl6Fm
47+
L09mVZfd0Ic+sBaB9Mw6fN9QpSGHj2P/F9+UePU981qv93PqZv2ZGKrbbRMQg9Hh
48+
DsXNddZZduhR91xS6gVXN2IMsRKTRh/zD06oVOZxq9ZCO+NtCYYtMwzgi1By4Wx6
49+
R+UBg/t/rqXuui4cFEwUgS2R66VGXKzenhq5fQl1xYJPTRn0fMZBa77QLs90D1Bw
50+
qIY0BggeSxJ0u1hR3D2opXq1bjJ/mkjki6xwzVVI/cnWB3BwKdzmVcQJesDzhCkc
51+
+kghJygggyyk2T6qYc/nIGf+2fe1vu8DuL969SVcW3WOzOgzzCEVCiGdD/3wMWL8
52+
2CLXUS6XBOTzEiahVB2u4ljuTe3pymRP8G3JLNNBvlpGAYxml/BbaKwJKJloO7Xy
53+
M1JZ7tno/yTCsvtY2OIMmlfkgaPQhOVwSSlXEZeHxGZZ9pe0QLYsKdBQCfoAFXpq
54+
YXdXtzaC3virEUKLkAp4vUGez6bMMjw1LfL8Lp6eW3szPmFrwzU3fMCGQPq7Clsw
55+
E2ZzrgM6Tdt4YsXp0ZLmaNbGtTi0WuQikSor4QZjr1zH2jWFs9kVW9T+1iKkKGUC
56+
AVwV+PbVtQsyp0gCA9mGFDdrZBH+U8KVn9wGF6I8+UwToWPnDNTYM2jVRpl8DWui
57+
xSBq1TxArIZD7T2xX2988zevcYDKs4w1AHj+27j6kmGZW2NGDVvdmHj/xxRuw9WV
58+
4tZAlLzavkGEo6/ngGJkdmPW1OAyGhKhpvGqjABMM1HfppvFNHxfyXQfLVroEog3
59+
/q+U1RsEs5mfHfWc1wNdL0FBYqTvgkarxUwKZzm48yeGVdO5GE4bTXgCxHLGi3Av
60+
aIzMEYJ5qNBIOhp629i2AV14CgPhQjaTZq+OkI3Gr7gKkTDZrJiU/THEUZs08KpJ
61+
8FUnWTzkZ0fZoMx8jnx2QXGmii/79S1PnzGzvxN5f8rM5xG/br9g3qEpJ23Yi9PH
62+
QqCtm7GVeKEcx1WLd7gZ4UMu4MpXhOmrDKG6du245KVq20AdzEckVWOq5ObGmBV7
63+
IYrhrfjojculsXuYse/+q3+vzlSevsz9f/N42pEITGGeAkaUdL6aQrxqjsLW7gNY
64+
82H9BbpCqw2UEGX44+sAMViszTrpy34Px16+svZfzdbhsUJdCpoi49Yuf7IdH4iY
65+
DJMVN9TNrTEUOZCB6trzbK8I0NDWYOvEBVHl5D0qB1LDqdN9Sc0Fj1dVgaC2Ihx9
66+
6c3+9m43zJTIstS+YTQbyZ67ADFnCxY8/eRN0ZDRymWnlTnR7r+ceNvzprUaF3XN
67+
ihpVNN3fGsWaejbCWND8YHDj+F5hLTXJLZ5sqzk/CU0doHbkhnai8WHUFdKYVZRl
68+
6PDML7snxqobWGv690ECgixrqQkdBtiEKIAOGk0wwJfDIyzyhB1lFRT8bafOnKCX
69+
DiHFSfDjVIg0rLANtivOXUCXctv07JoL+jCqpC0WOHe5ch5BNRDnruXhErbu4ZJw
70+
xZxrafS7+79U0MQAum2SSTCYnJE96VzNUzDdZg9z1ZKEVjhp9eAEfzQdZf0JwmQs
71+
gZvaPyOdJ+i1bndol4NOstjx3QHsiPimvkInYlPwaaRvaUDwmucIRAIWAk0X3ZkU
72+
X6iC7zLeLPiGUNpsI2FJHVD5eG1bivhsWFLRvHC6pHfCMSfCcw8wLTsbx0rwrQaA
73+
YntZeGqc45E7f+Ef6d+6Yg80O73F9iZBHrCwVg4E4wMxzDw91xoKtbMdOoWIRTn4
74+
BGR9+HjGK8tH7lpj5vP2EAoNFW+m25vu6tvCebUdZyWuGgnFQc7WyvLiCiNoCo5K
75+
DJb+XcYkOSb0YGt1HCcZCkZ0jjUN9qH1YQfCAoOI98/YhUiL4z9FAVfdM3OhUopT
76+
MZGUffqI1C+OZeSvGE4GZDdIUxznJ6JURSxS93X/BUyD89U1I86Jn5wAkRH4sjKO
77+
lipqwbk8EY1UkfszCSFkQJTXjDxciY7CDBpYaXHG5fJCYpPX2NoEUFR+hKy0uCxM
78+
bYCvvMX5/h8xU1Rof5WptbzH6wAAAAAAAAAFDRMbJDA=
79+
-----END CERTIFICATE-----

‎certs/mldsa/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ EXTRA_DIST += \
3131
certs/mldsa/mldsa65-key.pem \
3232
certs/mldsa/mldsa65-cert.pem \
3333
certs/mldsa/mldsa65-cert.der \
34+
certs/mldsa/ecc-leaf-mldsa65.pem \
3435
certs/mldsa/mldsa87-key.pem \
3536
certs/mldsa/mldsa87-cert.pem \
3637
certs/mldsa/mldsa87-cert.der \

‎certs/rsapss/ecc-leaf-rsapss.pem‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDNDCCAeigAwIBAgIUJdePE8BDNOOIsd+cyrHxNRYrF/0wQQYJKoZIhvcNAQEK
3+
MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
4+
AKIDAgEgMIGyMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UE
5+
BwwHQm96ZW1hbjEXMBUGA1UECgwOd29sZlNTTF9SU0FQU1MxEjAQBgNVBAsMCUNB
6+
LVJTQVBTUzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZIhvcNAQkB
7+
FhBpbmZvQHdvbGZzc2wuY29tMRcwFQYKCZImiZPyLGQBAQwHd29sZlNTTDAeFw0y
8+
NjA2MjIxODI2NDBaFw0zNjA2MTkxODI2NDBaMBQxEjAQBgNVBAMMCWxvY2FsaG9z
9+
dDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLszrEwnUErGSqUEwzzenzbbci3O
10+
lOor+ssgCTksFuhhAumvTdMCk5oxW5eSIX/wzxjakRECNIboIFgzC4A0idijQjBA
11+
MB0GA1UdDgQWBBRdXSbvrH42+Zt2FStKJQIj77KJMDAfBgNVHSMEGDAWgBSeDODT
12+
37ZL8xljXMpsk4aiFFORMTBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUA
13+
oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggEBAElprEznMP8A
14+
0b5c12vOMkAWT1jxpXGwDeVNkgZS+RfC82OI7UMN7kzlpjGaHts/JMUIvCTmIyNA
15+
I47x6JteFsnJklrk40Q4Om1ANOI1Zw8Jf/pX9mqwU4uOkto1PzTP7t0EICBr0UG4
16+
JV97K/+9GT2HJccS6UEh6hG2BySYHAFnG7SoBgXm6a2tGTR/Cfz9ZUY8+Cy87F3k
17+
3q9sCB3oqP+REOAM7FN/0Va2eY24nHZkno7sGsl2kDTx3vacBjHkx6u/KaaahB5K
18+
Snb3aGwrksRALpjRHOnz5wYCEtOkLOde0v1sktaVtroVRNXW2pS6iCXPpNApRJyv
19+
MFCkuGEo+gc=
20+
-----END CERTIFICATE-----

‎certs/rsapss/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
#
44

55
EXTRA_DIST += \
6+
certs/rsapss/ecc-leaf-rsapss.pem \
67
certs/rsapss/ca-rsapss.der \
78
certs/rsapss/ca-rsapss.pem \
89
certs/rsapss/ca-rsapss-key.der \

‎configure.ac‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -940,13 +940,14 @@ if test "x$enable_tinytls13" != "x" && test "x$enable_tinytls13" != "xno"
940940
then
941941
tinytls13_cert=no
942942
tinytls13_p256=no
943+
tinytls13_asm=no
943944
for v in `echo $enable_tinytls13 | tr ',' ' '`
944945
do
945946
case $v in
946947
cert|mutualauth) tinytls13_cert=yes ;;
947948
p256) tinytls13_p256=yes ;;
948949
rsaverify) enable_rsa=yes ;;
949-
asm) enable_asm=yes ;;
950+
asm) tinytls13_asm=yes ;;
950951
mldsa) enable_mldsa=yes ;;
951952
sha384) enable_sha384=yes; enable_sha512=yes ;;
952953
esac
@@ -957,6 +958,18 @@ then
957958
test "x$enable_sha384" = "x" && enable_sha384=no
958959
test "x$enable_sha512" = "x" && enable_sha512=no
959960

961+
# Small-C floor by default: no platform assembly unless the asm adder is
962+
# selected. ENABLED_ASM (resolved above) is the variable the downstream
963+
# assembly decisions read; emit the no-asm defines here too, since the
964+
# WOLFSSL_NO_ASM emission earlier ran before this block.
965+
if test "$tinytls13_asm" = "yes"
966+
then
967+
ENABLED_ASM=yes
968+
else
969+
ENABLED_ASM=no
970+
AM_CFLAGS="$AM_CFLAGS -DTFM_NO_ASM -DWOLFSSL_NO_ASM"
971+
fi
972+
960973
# TLS 1.3 only, no legacy TLS / renegotiation / extras.
961974
enable_tls13=yes
962975
enable_oldtls=no
@@ -970,7 +983,9 @@ then
970983
if test "$tinytls13_cert" = "yes"
971984
then
972985
enable_ecc=yes
973-
enable_sp=yes
986+
# P-256 only SP math to match the documented footprint; bare "yes"
987+
# would also pull in P-384/P-521 on 64-bit hosts.
988+
enable_sp="yes,256"
974989
test "x$enable_asn" = "x" && enable_asn=template
975990
test "x$enable_rsa" = "x" && enable_rsa=no
976991
else
@@ -979,7 +994,7 @@ then
979994
if test "$tinytls13_p256" = "yes"
980995
then
981996
enable_ecc=yes
982-
enable_sp=yes
997+
enable_sp="yes,256"
983998
else
984999
test "x$enable_ecc" = "x" && enable_ecc=no
9851000
enable_curve25519=yes
@@ -2903,7 +2918,9 @@ AC_ARG_ENABLE([tinytls13],
29032918
[AS_HELP_STRING([--enable-tinytls13@<:@=LIST@:>@],
29042919
[Enable tiny TLS 1.3 footprint build. LIST is comma-separated from:
29052920
psk cert server mutualauth staticmem asm p256 sha384 mldsa rsaverify
2906-
(default: disabled; bare flag = psk)])],
2921+
(default: disabled; bare flag = psk). NOTE: the cert profile is a
2922+
reduced-security verify (no name constraints, relaxed ASN, no CRL)
2923+
meant for a known or pinned CA, not public-internet PKI.])],
29072924
[ ENABLED_TINYTLS13=$enableval ],
29082925
[ ENABLED_TINYTLS13=no ]
29092926
)
@@ -2918,6 +2935,7 @@ then
29182935
# Feature switches were aligned early (MATH LIBRARY SELECTION section);
29192936
# here we only emit the umbrella + adder macros (settings.h does the rest).
29202937
tinytls13_base=psk
2938+
tinytls13_mldsa=no
29212939
for v in `echo $ENABLED_TINYTLS13 | tr ',' ' '`
29222940
do
29232941
case $v in
@@ -2931,15 +2949,25 @@ then
29312949
p256) AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DECC_USER_CURVES" ;;
29322950
rsaverify) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_RSA_VERIFY" ;;
29332951
sha384) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA384" ;;
2934-
mldsa) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_MLDSA -DWOLFSSL_DILITHIUM_VERIFY_ONLY -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_ASN1 -DWOLFSSL_NO_ML_DSA_44 -DWOLFSSL_NO_ML_DSA_87" ;;
2952+
mldsa) tinytls13_mldsa=yes
2953+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_MLDSA -DWOLFSSL_DILITHIUM_VERIFY_ONLY -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_NO_ML_DSA_44 -DWOLFSSL_NO_ML_DSA_87" ;;
29352954
no) ;;
29362955
*) AC_MSG_ERROR([Invalid --enable-tinytls13 value: $v. Valid: psk cert server mutualauth staticmem asm p256 sha384 mldsa rsaverify.]) ;;
29372956
esac
29382957
done
29392958

2959+
# ML-DSA on the PSK floor never parses a certificate, so drop the ASN.1/
2960+
# X.509 surface for footprint. The cert profile needs it to decode and
2961+
# verify ML-DSA certificates, so keep ASN.1 there.
2962+
if test "$tinytls13_mldsa" = "yes" && test "$tinytls13_base" != "cert"
2963+
then
2964+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DILITHIUM_NO_ASN1"
2965+
fi
2966+
29402967
if test "$tinytls13_base" = "cert"
29412968
then
29422969
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_CERT"
2970+
AC_MSG_NOTICE([tiny TLS 1.3 cert profile is a reduced-security verify: no name constraints, relaxed ASN, no CRL. For a known or pinned CA, not public-internet PKI.])
29432971
else
29442972
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13"
29452973
fi

‎examples/configs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ Example wolfSSL configuration file templates for use when autoconf is not availa
1818
* `user_settings_stm32.h`: Example configuration file generated from the wolfSSL STM32 Cube pack.
1919
* `user_settings_tls12.h`: Example for TLS v1.2 client only, ECC only, AES-GCM only, SHA2-256 only.
2020
* `user_settings_tls13.h`: TLS 1.3 only configuration (no TLS 1.2). Modern cipher suites with X25519/X448 key exchange.
21+
* `user_settings_tinytls13.h`: Smallest TLS 1.3 only footprint profile. PSK + ECDHE floor (no X.509) with opt-in adders: `cert` (minimal X.509 verify), `server`, `mutualauth`, `staticmem`, `asm`, `p256`, `sha384`, `mldsa`, `rsaverify`. Pairs with `--enable-tinytls13`. See `tinytls13_smoke.c` for the self-contained handshake check used by `--disable-examples` builds.
2122
* `user_settings_dtls13.h`: DTLS 1.3 for IoT and embedded. Includes connection ID support and smaller MTU options.
2223
* `user_settings_pq.h`: Post-quantum TLS with ML-KEM (Kyber) key exchange and ML-DSA (Dilithium) certificates.
2324
* `user_settings_openssl_compat.h`: OpenSSL compatibility layer for drop-in replacement. Enables OPENSSL_ALL and related APIs.

‎examples/configs/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ EXTRA_DIST += examples/configs/user_settings_template.h
2424
EXTRA_DIST += examples/configs/user_settings_tls12.h
2525
EXTRA_DIST += examples/configs/user_settings_tls13.h
2626
EXTRA_DIST += examples/configs/user_settings_tinytls13.h
27+
EXTRA_DIST += examples/configs/tinytls13_smoke.c
2728
EXTRA_DIST += examples/configs/user_settings_wolfboot_keytools.h
2829
EXTRA_DIST += examples/configs/user_settings_wolfssh.h
2930
EXTRA_DIST += examples/configs/user_settings_wolftpm.h

0 commit comments

Comments
 (0)