* Add link to security response process [skip ci]
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add security support info to PLATFORMS.md [skip ci]
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add SECURITY.md to Doxyfile
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Fix links for Doxygen
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* remove pqcrystals ml-kem patch that is no longer needed
Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
* Update mlkem-native to v1.0.0-beta [full tests] [extended tests]
Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
---------
Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
liboqsTargets.cmake is supposed to be adjacent liboqsConfig.cmake for the
latter to be functional. This change ensure that this condition is met in
the build directory, allowing other CMake projects to build against a liboqs
build directory (as should be possible, implied by the use of 'export()').
Signed-off-by: Richard Levitte <richard@levitte.org>
* Add threat model
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Update language around constant-time goals
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Update SECURITY.md
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
---------
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Update example files to use ML-KEM and ML-DSA
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Call example_sig_stfl in test_cmdline.py
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Bump jinja2 in /scripts/copy_from_upstream in the pip group (#2036)
Bumps the pip group in /scripts/copy_from_upstream with 1 update: [jinja2](https://github.com/pallets/jinja).
Updates `jinja2` from 3.1.4 to 3.1.5
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](https://github.com/pallets/jinja/compare/3.1.4...3.1.5)
---
updated-dependencies:
- dependency-name: jinja2
dependency-type: direct:production
dependency-group: pip
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Pablo Gutiérrez <pablogf@MSI.>
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* Avoid unresolved symbols from libcrypto when compiled with OQS_DLOPEN_OPENSSL (#2043)
* Do not assume OpenSSL memory functions when libcrypto is dlopened
Otherwise, when the OQS_DLOPEN_OPENSSL is defined but OpenSSL is
used only partially, e.g., with OQS_USE_SHA3_OPENSSL=ON, there will be
some unresolved symbols in the final artifact:
```
$ cmake -GNinja -DBUILD_SHARED_LIBS=ON -DOQS_USE_AES_OPENSSL=ON -DOQS_USE_AES_INSTRUCTIONS=OFF -DOQS_DIST_BUILD=ON -DOQS_USE_SHA3_OPENSSL=ON -DOQS_DLOPEN_OPENSSL=ON -DCMAKE_BUILD_TYPE=Debug -LAH ..
$ ninja
$ nm -g lib/liboqs.so.0.12.1-dev | grep '^[[:space:]]*U '
U __assert_fail@GLIBC_2.2.5
U CRYPTO_free
U CRYPTO_malloc
U dlopen@GLIBC_2.34
U dlsym@GLIBC_2.34
```
Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Wrap OpenSSL memory functions with OSSL_FUNC
This enables those OpenSSL memory functions can be either resolved at
build time or at run-time through dlopen. Note that we use CRYPTO_*
functions instead of OPENSSL_* as the latter are defined as a macro
and cannot be dynamically resolved.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---------
Signed-off-by: Daiki Ueno <dueno@redhat.com>
Signed-off-by: Pablo Gutiérrez <pablogf@MSI.>
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* Added sig_stfl.h path to .Doxyfile INPUT setting
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* added sig_stfl path to .Doxyfile INPUT setting
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* Update to public Ubuntu 24.04 ARM runner [full tests] (#2050)
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* Added Doxygen comments of algorithm identifiers until XMSSMT
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* commit
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* NVIDIA: Adding cuPQC as a backend for ML-KEM. (#2044)
* Adding cuPQC as a backend for ML-KEM.
Signed-off-by: Steven Reeves <sreeves@nvidia.com>
* Fixing transposition error that left out OQS_USE_CUPQC in CMake system.
Signed-off-by: Steven Reeves <sreeves@nvidia.com>
* Add CMake dependent options for cupqc. Fixed formatting in kem_ml_kem_####.c and kem/family/kem_scheme.c
Signed-off-by: Steven Reeves <sreeves@nvidia.com>
* Move cupqc_ml-kem source files to correctly named dir
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Stop piggybacking on pqcrystals-kyber-standard and move cupqc_ml-kem metadata to separate upstream repo
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Update licensing information
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Update PLATFORMS.md
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Fix kem_family cmakelists template
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Run copy_from_upsream.py and pull updated upstream
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Add cupqc build test to basic.yml
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Move cupqc build test from basic.yml to linux.yml
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Fix error in linux.yml
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* fixup! Fix error in linux.yml
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Redo cupqc build check
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Supply default CUDA arch to cupqc-buildcheck configuration stage
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Specify CUDAXX in cupqc-buildcheck
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
* Make cuPQC_DIR explicit in cupqc-buildcheck
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
---------
Signed-off-by: Steven Reeves <sreeves@nvidia.com>
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
Co-authored-by: Pravek Sharma <sharmapravek@gmail.com>
Signed-off-by: Pablo Gutiérrez <pablogf@MSI.>
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* added all algorithm identifiers Doxyfile comments for sig_stfl
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* added additional Doxygen comments to sig_stfl.h
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* fixed formatting
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* fixed return types errors
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
* included sig_stfl API Doxygen documentation [full tests]
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Pablo Gutiérrez <pablogf@MSI.>
Signed-off-by: Pablo Gutiérrez <pablogf@uma.es>
Signed-off-by: Daiki Ueno <dueno@redhat.com>
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Steven Reeves <sreeves@nvidia.com>
Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daiki Ueno <dueno@redhat.com>
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Co-authored-by: Steven I Reeves <sreeves@nvidia.com>
Co-authored-by: Pravek Sharma <sharmapravek@gmail.com>
As a follow-up of commit 64bceb37fafa9b90cf228965079de9ebd77a83b9,
this checks that the library artifacts don't contain any unresolved
symbols from libcrypto.so when it is dynamically loaded.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Do not assume OpenSSL memory functions when libcrypto is dlopened
Otherwise, when the OQS_DLOPEN_OPENSSL is defined but OpenSSL is
used only partially, e.g., with OQS_USE_SHA3_OPENSSL=ON, there will be
some unresolved symbols in the final artifact:
```
$ cmake -GNinja -DBUILD_SHARED_LIBS=ON -DOQS_USE_AES_OPENSSL=ON -DOQS_USE_AES_INSTRUCTIONS=OFF -DOQS_DIST_BUILD=ON -DOQS_USE_SHA3_OPENSSL=ON -DOQS_DLOPEN_OPENSSL=ON -DCMAKE_BUILD_TYPE=Debug -LAH ..
$ ninja
$ nm -g lib/liboqs.so.0.12.1-dev | grep '^[[:space:]]*U '
U __assert_fail@GLIBC_2.2.5
U CRYPTO_free
U CRYPTO_malloc
U dlopen@GLIBC_2.34
U dlsym@GLIBC_2.34
```
Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Wrap OpenSSL memory functions with OSSL_FUNC
This enables those OpenSSL memory functions can be either resolved at
build time or at run-time through dlopen. Note that we use CRYPTO_*
functions instead of OPENSSL_* as the latter are defined as a macro
and cannot be dynamically resolved.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---------
Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Update script info
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Run copy_from_upstream
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* #1830 update scorecard to v5 (gh action 2.4.0)
Signed-off-by: Nigel Jones <jonesn@uk.ibm.com>
* Pin action version in unix.yml
Signed-off-by: Nigel Jones <jonesn@uk.ibm.com>
* Schedule only, no PR. Minor updates to scorecard
Signed-off-by: Nigel Jones <jonesn@uk.ibm.com>
---------
Signed-off-by: Nigel Jones <jonesn@uk.ibm.com>
* Trigger liboqs-java CI on commits to main
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Trigger liboqs-rust CI on commits to main
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Remove hardcoded build paths
This fixes#2018 using `helpers.get_current_build_dir_name()`
Signed-off-by: Iyán Méndez Veiga <me@iyanmv.com>
* Use a random build path in the basic build test
Signed-off-by: Iyán Méndez Veiga <me@iyanmv.com>
---------
Signed-off-by: Iyán Méndez Veiga <me@iyanmv.com>
* Update version numbers for 0.12.0-rc1
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Update list of supported versions
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Update release notes for 0.12.0-rc1
Fixes#1990 and #2004.
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Fix typo and workding [skip ci]
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
* Revise wording on API removal
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Update release date for rc1 [skip ci]
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
---------
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add defines for OQS version components
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Set OQS_VERSION_TEXT based on new OQS_VERSION_* macros
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Make OQS_VERSION_PRE_RELEASE optionally defined
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Add documentation about OQS_VERSION macros
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* Clarify wording about definition of OQS_VERSION_PRE_RELEASE
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
---------
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
Signed-off-by: Douglas Stebila <dstebila@users.noreply.github.com>
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Pull ML-DSA from pq-crystals upstream.
* Removes ML-DSA-ipd
* Adds support for context strings to OQS SIG API.
* Adding _with_ctx_str APIs, templating
* Adds ACVP tests for ML-DSA
* export symbols for acvp tests (dynamic linking)
* remove IPD intermediate values
* adds flag for ctx support
* Update constant-time passes after line nubmer and function name changes
* Update KATs
* API with checks for signatures without ctx support
* Additional test for signatures with ctx
* Change alg_version to FIPS204
* Update ML-DSA security claim to SUF-CMA, according to FIPS204
* Update src/sig/sig.h
* Fix test_alg_info
---------
Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
Co-authored-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Update patch to include version number change
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Run copy_from_upstream
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Generate patch with git diff
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Fix LMS crash
Signed-off-by: Norman Ashley <nashley@cisco.com>
* Fixed compile issue on Mac
Signed-off-by: Norman Ashley <nashley@cisco.com>
---------
Signed-off-by: Norman Ashley <nashley@cisco.com>
When OQS_DLOPEN_OPENSSL is designated and low-level primitives are
overridden with OQS_*_set_callbacks, OQS_destroy still indirectly
calls EVP_*_free from OpenSSL. This adds a extra NULL check to
avoid that.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Complete the revival of Travis and CROSS
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add Travis badge to README
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add a --delete option to copy_from_upstream to remove unwanted implementation subdirectories.
* Enable the --delete option in CI to detect files included by mistake
* Switch to git status --porcelain in CI for script stability
* Remove unused SPHINCS+ aarch64 implementation using the --delete option
Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
