Carries an application context string for signature schemes that accept + * one (for example SLH-DSA / FIPS 205, which allows a 0..255 byte context). + * Set it on a {@link java.security.Signature} via + * {@code Signature.setParameter(AlgorithmParameterSpec)}. The context may be + * set before or after {@code initSign}/{@code initVerify}. It persists across + * init calls until replaced. The signer and verifier must agree on the same + * context or verification fails. The default is an empty context, which + * matches X.509, CMS, and TLS usage.
+ */ +public class WolfCryptContextParameterSpec implements AlgorithmParameterSpec { + + /** Maximum context length in bytes (FIPS 205). */ + public static final int MAX_CONTEXT_LEN = 255; + + /** Context bytes, never null (empty array for an empty context). */ + private final byte[] context; + + /** + * Create a context parameter spec. + * + * @param context context bytes, may be null (treated as empty) and must + * be at most {@link #MAX_CONTEXT_LEN} bytes + * + * @throws IllegalArgumentException if {@code context} exceeds 255 bytes + */ + public WolfCryptContextParameterSpec(byte[] context) + throws IllegalArgumentException { + + if (context == null) { + this.context = new byte[0]; + } + else { + if (context.length > MAX_CONTEXT_LEN) { + throw new IllegalArgumentException( + "Context length exceeds " + MAX_CONTEXT_LEN + " bytes"); + } + this.context = context.clone(); + } + } + + /** + * Get the context bytes. + * + * @return a copy of the context bytes (empty array for an empty context) + */ + public byte[] getContext() { + return this.context.clone(); + } + + @Override + public String toString() { + return "WolfCryptContextParameterSpec(len=" + this.context.length + ")"; + } + + @Override + public boolean equals(Object obj) { + + WolfCryptContextParameterSpec other; + + if (this == obj) { + return true; + } + + if (!(obj instanceof WolfCryptContextParameterSpec)) { + return false; + } + other = (WolfCryptContextParameterSpec) obj; + + return Arrays.equals(this.context, other.context); + } + + @Override + public int hashCode() { + return Arrays.hashCode(this.context); + } +} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyPairGenerator.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyPairGenerator.java index 713432ff..f597fc9f 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyPairGenerator.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyPairGenerator.java @@ -57,6 +57,7 @@ import com.wolfssl.wolfcrypt.Dh; import com.wolfssl.wolfcrypt.MlDsa; import com.wolfssl.wolfcrypt.MlKem; +import com.wolfssl.wolfcrypt.SlhDsa; import com.wolfssl.wolfcrypt.Rng; import com.wolfssl.wolfcrypt.WolfCryptError; import com.wolfssl.wolfcrypt.WolfCryptException; @@ -72,7 +73,8 @@ enum KeyType { WC_ECC, WC_DH, WC_ML_DSA, - WC_ML_KEM + WC_ML_KEM, + WC_SLH_DSA } private KeyType type = null; @@ -84,36 +86,32 @@ enum KeyType { private byte[] dhP = null; private byte[] dhG = null; - /** - * ML-DSA parameter level ({@link MlDsa#ML_DSA_44} / {@code ML_DSA_65} / - * {@code ML_DSA_87}), or 0 if unset. Set in the constructor and - * updated by {@code initialize(AlgorithmParameterSpec)}. - */ - private int mlDsaLevel = 0; + /** Flag for "no PQC parameter set" in pqcParam and pqcLockedParam. + * Must be negative, 0 reserved for SLH-DSA-SHAKE-128s. */ + private static final int PQC_PARAM_UNSET = -1; /** - * For per-level {@code wcKeyPairGenMlDsa{44,65,87}} aliases, the level - * is fixed and {@code engineInitialize(AlgorithmParameterSpec)} must - * reject mismatching specs. 0 means the generic alias (any level via - * spec). Set via constructor by per-level subclasses. - */ - private int mlDsaLockedLevel = 0; + * PQC parameter set for WC_ML_DSA, WC_ML_KEM, and WC_SLH_DSA generators. + * Interpreted by this.type: an MlDsa.ML_DSA_* level, MlKem.ML_KEM_* level, + * or SlhDsa.SLH_DSA_* parameter set. Set to the per-family default in + * constructor. */ + private int pqcParam = PQC_PARAM_UNSET; /** - * ML-KEM parameter level ({@link MlKem#ML_KEM_512} / {@code ML_KEM_768} / - * {@code ML_KEM_1024}). Set in the constructor and updated by - * {@code initialize(AlgorithmParameterSpec)}. + * For per-parameter-set PQC subclasses wcKeyPairGenMlDsa{44,65,87}, + * wcKeyPairGenMlKem{512,768,1024}, wcKeyPairGenSlhDsa*, the parameter set + * is fixed and engineInitialize(AlgorithmParameterSpec) must reject + * mismatching specs. PQC_PARAM_UNSET means the generic alias (any param + * set via spec). */ - private int mlkemLevel = MlKem.ML_KEM_768; + private int pqcLockedParam = PQC_PARAM_UNSET; /** - * For per-level {@code wcKeyPairGenMlKem{512,768,1024}} aliases, the - * level is fixed and {@code engineInitialize(AlgorithmParameterSpec)} - * must reject mismatching specs. 0 means the generic alias (any level - * via spec, defaulting to ML-KEM-768). Set via constructor by per-level - * subclasses. + * True when the PQC parameter set was explicitly chosen, either by a + * per-set subclass or an engineInitialize(AlgorithmParameterSpec) call. + * When false, the generic generator is using its per-family default. */ - private int mlkemLockedLevel = 0; + private boolean pqcParamExplicit = false; private Rng rng = null; @@ -124,19 +122,20 @@ enum KeyType { private String algString; private WolfCryptKeyPairGenerator(KeyType type) { - this(type, 0); + this(type, PQC_PARAM_UNSET); } /** - * Create new WolfCryptKeyPairGenerator, optionally locking the parameter - * set level for the per-level PQC subclasses (wcKeyPairGenMlDsa{44,65,87} - * and wcKeyPairGenMlKem{512,768,1024}). + * Create new WolfCryptKeyPairGenerator, optionally locking the PQC param + * set for the per-parameter-set subclasses (wcKeyPairGenMlDsa{44,65,87}, + * wcKeyPairGenMlKem{512,768,1024}, and wcKeyPairGenSlhDsa*). * * @param type key type to generate - * @param lockedLevel fixed PQC parameter set level for per-level aliases, - * or 0 for the generic alias (any level via spec) + * @param lockedParam fixed PQC parameter set for per-set aliases, or + * PQC_PARAM_UNSET for the generic alias (any parameter set via + * spec). Ignored for non-PQC key types. */ - private WolfCryptKeyPairGenerator(KeyType type, int lockedLevel) { + private WolfCryptKeyPairGenerator(KeyType type, int lockedParam) { this.type = type; @@ -180,28 +179,38 @@ private WolfCryptKeyPairGenerator(KeyType type, int lockedLevel) { } } - /* Set defaults for ML-DSA key generation. Per-level subclasses - * pass their fixed level in, the generic alias defaults to - * ML-DSA-65, matching JDK 24 / JEP 497 default. */ - if (type == KeyType.WC_ML_DSA) { - this.mlDsaLockedLevel = lockedLevel; - this.mlDsaLevel = (lockedLevel != 0) ? - lockedLevel : MlDsa.ML_DSA_65; - } + /* Set defaults for PQC key generation (ML-DSA, ML-KEM, SLH-DSA). + * Per-set subclasses pass their fixed parameter set in. Generic + * aliases get the per-family default. */ + if (type == KeyType.WC_ML_DSA || type == KeyType.WC_ML_KEM || + type == KeyType.WC_SLH_DSA) { - /* Set defaults for ML-KEM key generation. Per-level subclasses pass - * their fixed level in. The generic alias defaults to ML-KEM-768, - * matching the JDK reference implementation default. */ - if (type == KeyType.WC_ML_KEM) { - this.mlkemLockedLevel = lockedLevel; - this.mlkemLevel = (lockedLevel != 0) ? - lockedLevel : MlKem.ML_KEM_768; + this.pqcLockedParam = lockedParam; + if (lockedParam != PQC_PARAM_UNSET) { + this.pqcParam = lockedParam; + this.pqcParamExplicit = true; + } + else { + switch (type) { + case WC_ML_DSA: + this.pqcParam = MlDsa.ML_DSA_65; + break; + case WC_ML_KEM: + this.pqcParam = MlKem.ML_KEM_768; + break; + default: + this.pqcParam = SlhDsa.SLH_DSA_SHA2_128F; + break; + } + this.pqcParamExplicit = false; + } } /* Initialize RNG for default key generation if needed. */ if (type == KeyType.WC_RSA || type == KeyType.WC_RSA_PSS || type == KeyType.WC_ECC || type == KeyType.WC_DH || - type == KeyType.WC_ML_DSA || type == KeyType.WC_ML_KEM) { + type == KeyType.WC_ML_DSA || type == KeyType.WC_ML_KEM || + type == KeyType.WC_SLH_DSA) { synchronized (rngLock) { if (this.rng == null) { @@ -219,26 +228,16 @@ private WolfCryptKeyPairGenerator(KeyType type, int lockedLevel) { @Override public synchronized void initialize(int keysize, SecureRandom random) { - if (type == KeyType.WC_ML_DSA) { - /* ML-DSA parameter sets (44/65/87) are not selected by integer - * key size. Callers must supply a NamedParameterSpec or a - * WolfPQCParameterSpec via initialize(AlgorithmParameterSpec). - * Matches JDK 24 / JEP 497 behavior. */ - throw new InvalidParameterException( - "ML-DSA does not accept integer key sizes: use " + - "initialize(AlgorithmParameterSpec) with a " + - "NamedParameterSpec or WolfPQCParameterSpec instead."); - } - - if (type == KeyType.WC_ML_KEM) { - /* ML-KEM parameter sets (512/768/1024) are selected by a named - * parameter spec, not an integer key size. Use a - * NamedParameterSpec or WolfPQCParameterSpec via - * initialize(AlgorithmParameterSpec), or the parameter-set- - * specific KeyPairGenerator name (ML-KEM-512/768/1024). */ + if (type == KeyType.WC_ML_DSA || type == KeyType.WC_ML_KEM || + type == KeyType.WC_SLH_DSA) { + /* PQC parameter sets are selected by a named parameter spec, not + * integer key size. Callers must supply a NamedParameterSpec or + * WolfPQCParameterSpec via initialize(AlgorithmParameterSpec), or + * use the parameter-set-specific KeyPairGenerator name. Matches + * JDK 24 / JEP 497 behavior. */ throw new InvalidParameterException( - "ML-KEM does not accept integer key sizes: use " + - "initialize(AlgorithmParameterSpec) with a " + + typeToString(this.type) + " does not accept integer key " + + "sizes: use initialize(AlgorithmParameterSpec) with a " + "NamedParameterSpec or WolfPQCParameterSpec instead."); } @@ -490,94 +489,53 @@ public synchronized void initialize(AlgorithmParameterSpec params, break; case WC_ML_DSA: - - int newLevel; - String mlDsaName = null; - - /* Fall back to our own AlgorithmParameterSpec subtype - * for JDK 8-10. */ - if (params instanceof WolfPQCParameterSpec) { - mlDsaName = ((WolfPQCParameterSpec) params).getName(); - } - /* JDK 11+ uses standard NamedParameterSpec via reflection. */ - else { - mlDsaName = - WolfPQCJdkCompat.namedParameterSpecGetName(params); - } - - if (mlDsaName == null) { - throw new InvalidAlgorithmParameterException( - "ML-DSA params must be a NamedParameterSpec " + - "(JDK 11+) or WolfPQCParameterSpec (JDK 8-10), got: " + - params.getClass().getName()); - } - - try { - newLevel = WolfPQCJdkCompat.paramNameToLevel(mlDsaName); - } - catch (IllegalArgumentException e) { - throw new InvalidAlgorithmParameterException( - "Unrecognized ML-DSA parameter set: " + mlDsaName); - } - - /* Per-level wcKeyPairGenMlDsa{44,65,87} aliases reject specs - * that don't match their locked level. */ - if (this.mlDsaLockedLevel != 0 && - newLevel != this.mlDsaLockedLevel) { - - throw new InvalidAlgorithmParameterException( - "Spec '" + mlDsaName + "' does not match the " + - "fixed parameter set for this KeyPairGenerator"); - } - - this.mlDsaLevel = newLevel; - log("init with ML-DSA spec: " + mlDsaName); - - break; - case WC_ML_KEM: + case WC_SLH_DSA: - int mlkemNewLevel; - String mlkemName = null; + String algName = typeToString(this.type); + int newParam; + String paramName = null; - /* Fall back to our own AlgorithmParameterSpec for JDK 8-10 */ + /* Fall back to our AlgorithmParameterSpec subtype for + * JDK 8-10. */ if (params instanceof WolfPQCParameterSpec) { - mlkemName = ((WolfPQCParameterSpec) params).getName(); + paramName = ((WolfPQCParameterSpec) params).getName(); } - /* JDK 11+ uses standard NamedParameterSpec via reflection */ + /* JDK 11+ uses standard NamedParameterSpec via reflection. */ else { - mlkemName = + paramName = WolfPQCJdkCompat.namedParameterSpecGetName(params); } - if (mlkemName == null) { + if (paramName == null) { throw new InvalidAlgorithmParameterException( - "ML-KEM params must be a NamedParameterSpec " + + algName + " params must be a NamedParameterSpec " + "(JDK 11+) or WolfPQCParameterSpec (JDK 8-10), got: " + params.getClass().getName()); } try { - mlkemNewLevel = - WolfPQCJdkCompat.mlkemParamNameToLevel(mlkemName); + newParam = pqcNameToParam(paramName); } catch (IllegalArgumentException e) { throw new InvalidAlgorithmParameterException( - "Unrecognized ML-KEM parameter set: " + mlkemName); + "Unrecognized " + algName + " parameter set: " + + paramName); } - /* Per-level wcKeyPairGenMlKem{512,768,1024} aliases reject - * specs that don't match their locked level. */ - if (this.mlkemLockedLevel != 0 && - mlkemNewLevel != this.mlkemLockedLevel) { + /* Per-parameter-set subclasses reject specs that don't + * match their locked parameter set. */ + if ((this.pqcLockedParam != PQC_PARAM_UNSET) && + (newParam != this.pqcLockedParam)) { throw new InvalidAlgorithmParameterException( - "Spec '" + mlkemName + "' does not match the " + + "Spec '" + paramName + "' does not match the " + "fixed parameter set for this KeyPairGenerator"); } - this.mlkemLevel = mlkemNewLevel; - log("init with ML-KEM spec: " + mlkemName); + this.pqcParam = newParam; + this.pqcParamExplicit = true; + log("init with " + algName + " spec: " + paramName); break; @@ -850,7 +808,7 @@ public synchronized KeyPair generateKeyPair() { case WC_ML_DSA: - if (this.mlDsaLevel == 0) { + if (this.pqcParam == PQC_PARAM_UNSET) { throw new RuntimeException( "ML-DSA level not set, call initialize() first"); } @@ -860,7 +818,7 @@ public synchronized KeyPair generateKeyPair() { byte[] mlDsaPrivDer = null; try { - mlDsa = new MlDsa(this.mlDsaLevel); + mlDsa = new MlDsa(this.pqcParam); synchronized (rngLock) { mlDsa.makeKey(this.rng); @@ -871,10 +829,10 @@ public synchronized KeyPair generateKeyPair() { WolfCryptMlDsaPublicKey mlDsaPub = new WolfCryptMlDsaPublicKey(mlDsaPubDer, - this.mlDsaLevel); + this.pqcParam); WolfCryptMlDsaPrivateKey mlDsaPriv = new WolfCryptMlDsaPrivateKey(mlDsaPrivDer, - this.mlDsaLevel); + this.pqcParam); pair = new KeyPair(mlDsaPub, mlDsaPriv); @@ -890,7 +848,61 @@ public synchronized KeyPair generateKeyPair() { } } - log("generated ML-DSA KeyPair, level " + this.mlDsaLevel); + log("generated ML-DSA KeyPair, level " + this.pqcParam); + + break; + + case WC_SLH_DSA: + + if (this.pqcParam == PQC_PARAM_UNSET) { + throw new RuntimeException( + "SLH-DSA param set not set, call initialize() first"); + } + + /* For generic generator, fall back from default to a param set + * compiled into native wolfSSL, so getInstance("SLH-DSA") works + * on varied build configs. */ + int slhDsaGenParam = this.pqcParam; + if (!this.pqcParamExplicit) { + slhDsaGenParam = resolveDefaultSlhDsaParam(); + } + + SlhDsa slhDsa = null; + byte[] slhDsaPubDer = null; + byte[] slhDsaPrivDer = null; + + try { + slhDsa = new SlhDsa(slhDsaGenParam); + + synchronized (rngLock) { + slhDsa.makeKey(this.rng); + } + + slhDsaPubDer = slhDsa.exportPublicKeyDer(true); + slhDsaPrivDer = slhDsa.exportPrivateKeyDer(); + + WolfCryptSlhDsaPublicKey slhDsaPub = + new WolfCryptSlhDsaPublicKey(slhDsaPubDer, + slhDsaGenParam); + WolfCryptSlhDsaPrivateKey slhDsaPriv = + new WolfCryptSlhDsaPrivateKey(slhDsaPrivDer, + slhDsaGenParam); + + pair = new KeyPair(slhDsaPub, slhDsaPriv); + + } + catch (WolfCryptException e) { + throw new RuntimeException(e); + } + finally { + zeroArray(slhDsaPubDer); + zeroArray(slhDsaPrivDer); + if (slhDsa != null) { + slhDsa.releaseNativeStruct(); + } + } + + log("generated SLH-DSA KeyPair, param " + slhDsaGenParam); break; @@ -911,16 +923,16 @@ public synchronized KeyPair generateKeyPair() { this.rng.generateBlock(MlKem.ML_KEM_SEED_SIZE); } - mlkem = new MlKem(this.mlkemLevel); + mlkem = new MlKem(this.pqcParam); mlkem.makeKeyFromSeed(mlkemSeed); mlkemPub = mlkem.exportPublic(); mlkemPriv = mlkem.exportPrivate(); WolfCryptMlKemPublicKey mlkemPubKey = - new WolfCryptMlKemPublicKey(this.mlkemLevel, mlkemPub); + new WolfCryptMlKemPublicKey(this.pqcParam, mlkemPub); WolfCryptMlKemPrivateKey mlkemPrivKey = - new WolfCryptMlKemPrivateKey(this.mlkemLevel, mlkemPriv, + new WolfCryptMlKemPrivateKey(this.pqcParam, mlkemPriv, mlkemSeed); pair = new KeyPair(mlkemPubKey, mlkemPrivKey); @@ -937,7 +949,7 @@ public synchronized KeyPair generateKeyPair() { } } - log("generated ML-KEM KeyPair, level " + this.mlkemLevel); + log("generated ML-KEM KeyPair, level " + this.pqcParam); break; @@ -949,6 +961,25 @@ public synchronized KeyPair generateKeyPair() { return pair; } + /* + * Resolve a PQC parameter-set name to its native value for this + * generator's key type: an MlDsa.ML_DSA_* level, an MlKem.ML_KEM_* + * level, or an SlhDsa.SLH_DSA_* parameter set. + * + * Throws IllegalArgumentException if the name is not a valid parameter + * set name for this key type. + */ + private int pqcNameToParam(String name) { + switch (this.type) { + case WC_ML_DSA: + return WolfPQCJdkCompat.paramNameToLevel(name); + case WC_ML_KEM: + return WolfPQCJdkCompat.mlkemParamNameToLevel(name); + default: + return WolfPQCJdkCompat.slhDsaNameToParam(name); + } + } + private String typeToString(KeyType type) { switch (type) { case WC_RSA: @@ -963,6 +994,8 @@ private String typeToString(KeyType type) { return "ML-DSA"; case WC_ML_KEM: return "ML-KEM"; + case WC_SLH_DSA: + return "SLH-DSA"; default: return "None"; } @@ -1106,6 +1139,195 @@ public wcKeyPairGenMlDsa87() { } } + /* Cached resolveDefaultSlhDsaParam() result. The parameter sets compiled + * into the loaded native library cannot change at runtime, so probe native + * availability only once. -1 means unresolved. */ + private static volatile int defaultSlhDsaParam = -1; + + /** + * Resolve the generic generator default SLH-DSA parameter set to one + * compiled into native wolfSSL. Prefers SLH-DSA-SHA2-128f, then falls back + * through the remaining sets so getInstance("SLH-DSA") works on varied + * native builds. The result is cached after the first probe. + * + * @return the first compiled-in parameter set from the preference order, + * or SLH-DSA-SHA2-128f if none could be probed. + */ + private static int resolveDefaultSlhDsaParam() { + + int resolved = defaultSlhDsaParam; + if (resolved >= 0) { + return resolved; + } + + int[] preference = { + SlhDsa.SLH_DSA_SHA2_128F, SlhDsa.SLH_DSA_SHAKE_128F, + SlhDsa.SLH_DSA_SHA2_128S, SlhDsa.SLH_DSA_SHAKE_128S, + SlhDsa.SLH_DSA_SHA2_192F, SlhDsa.SLH_DSA_SHAKE_192F, + SlhDsa.SLH_DSA_SHA2_192S, SlhDsa.SLH_DSA_SHAKE_192S, + SlhDsa.SLH_DSA_SHA2_256F, SlhDsa.SLH_DSA_SHAKE_256F, + SlhDsa.SLH_DSA_SHA2_256S, SlhDsa.SLH_DSA_SHAKE_256S + }; + + resolved = SlhDsa.SLH_DSA_SHA2_128F; + for (int param : preference) { + if (slhDsaParamAvailable(param)) { + resolved = param; + break; + } + } + + defaultSlhDsaParam = resolved; + return resolved; + } + + /** + * Check whether an SLH-DSA parameter set is compiled into native wolfSSL. + * Performs a native init (via publicKeySize) without generating a key. + * + * @param param SLH-DSA parameter set (0-11) + * + * @return true if the parameter set is available, false otherwise + */ + private static boolean slhDsaParamAvailable(int param) { + + try { + SlhDsa key = new SlhDsa(param); + try { + key.publicKeySize(); + return true; + } + finally { + key.releaseNativeStruct(); + } + } + catch (WolfCryptException e) { + return false; + } + } + + /** + * wolfCrypt SLH-DSA key pair generator (generic). The parameter set is + * selectable via {@code initialize(NamedParameterSpec)} or + * {@code initialize(WolfPQCParameterSpec)}. Defaults to SLH-DSA-SHA2-128f, + * falling back to a compiled-in set on partial native builds. + */ + public static final class wcKeyPairGenSlhDsa + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsa object */ + public wcKeyPairGenSlhDsa() { + super(KeyType.WC_SLH_DSA, PQC_PARAM_UNSET); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-128s key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_128s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_128s object */ + public wcKeyPairGenSlhDsaShake_128s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_128S); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-128f key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_128f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_128f object */ + public wcKeyPairGenSlhDsaShake_128f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_128F); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-192s key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_192s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_192s object */ + public wcKeyPairGenSlhDsaShake_192s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_192S); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-192f key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_192f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_192f object */ + public wcKeyPairGenSlhDsaShake_192f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_192F); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-256s key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_256s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_256s object */ + public wcKeyPairGenSlhDsaShake_256s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_256S); + } + } + + /** wolfCrypt SLH-DSA-SHAKE-256f key pair generator. */ + public static final class wcKeyPairGenSlhDsaShake_256f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaShake_256f object */ + public wcKeyPairGenSlhDsaShake_256f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHAKE_256F); + } + } + + /** wolfCrypt SLH-DSA-SHA2-128s key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_128s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_128s object */ + public wcKeyPairGenSlhDsaSha2_128s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_128S); + } + } + + /** wolfCrypt SLH-DSA-SHA2-128f key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_128f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_128f object */ + public wcKeyPairGenSlhDsaSha2_128f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_128F); + } + } + + /** wolfCrypt SLH-DSA-SHA2-192s key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_192s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_192s object */ + public wcKeyPairGenSlhDsaSha2_192s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_192S); + } + } + + /** wolfCrypt SLH-DSA-SHA2-192f key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_192f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_192f object */ + public wcKeyPairGenSlhDsaSha2_192f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_192F); + } + } + + /** wolfCrypt SLH-DSA-SHA2-256s key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_256s + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_256s object */ + public wcKeyPairGenSlhDsaSha2_256s() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_256S); + } + } + + /** wolfCrypt SLH-DSA-SHA2-256f key pair generator. */ + public static final class wcKeyPairGenSlhDsaSha2_256f + extends WolfCryptKeyPairGenerator { + /** Create new wcKeyPairGenSlhDsaSha2_256f object */ + public wcKeyPairGenSlhDsaSha2_256f() { + super(KeyType.WC_SLH_DSA, SlhDsa.SLH_DSA_SHA2_256F); + } + } + /** * wolfCrypt ML-KEM (FIPS 203) generic key pair generator. Accepts any of * the three ML-KEM parameter sets via diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptLmsKeyFactory.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptLmsKeyFactory.java index 57ee80ea..c49cc10e 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfCryptLmsKeyFactory.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptLmsKeyFactory.java @@ -100,6 +100,7 @@ protectedNative wolfCrypt provides a raw HSS/LMS public-key format - * (wc_LmsKey_Export/ImportPubRaw()) and no SPKI decode, so the X.509 - * SubjectPublicKeyInfo wrapping is done here until native wolfSSL gets that - * functionality. DER encoding reuses the shared - * {@link WolfCryptASN1Util} helpers. DER decoding uses a small - * self-contained strict reader. The LMS algorithm OID is - * {@code id-alg-hss-lms-hashsig = 1.2.840.113549.1.9.16.3.17} (RFC 8708, - * retained in RFC 9708).
- * - *The DER reader here is intentionally self-contained and stricter than the - * general-purpose {@link WolfCryptASN1Util}: it checks every tag and rejects - * non-minimal long-form lengths, because it parses untrusted X.509 - * SubjectPublicKeyInfo input.
- * - *Public key (SubjectPublicKeyInfo):
- *
- * SEQUENCE {
- * algorithm SEQUENCE { OBJECT IDENTIFIER } -- parameters absent or NULL
- * subjectPublicKey BIT STRING -- raw HSS/LMS public key
- * }
- *
- * The raw HSS/LMS public key has two encodings in the wild: RFC 8708 / JDK
- * <= 23 wrap it in an extra inner OCTET STRING inside the BIT STRING.
- * RFC 9708 / JDK 24+ / BouncyCastle place the raw bytes directly. wolfJCE
- * writes the unwrapped RFC 9708 form and reads both.
- *
- * wolfJCE provides verify-only LMS/HSS support, so there is no private-key - * encoding here (matching the JDK SUN provider).
- */ -final class WolfCryptLmsUtil { - - /* DER tags used here. */ - private static final int TAG_BIT_STRING = 0x03; - private static final int TAG_OCTET_STRING = 0x04; - private static final int TAG_NULL = 0x05; - private static final int TAG_OID = 0x06; - private static final int TAG_SEQUENCE = 0x30; - - /* OID content bytes (no tag/length) for - * 1.2.840.113549.1.9.16.3.17 (id-alg-hss-lms-hashsig). */ - private static final byte[] OID_HSS_LMS = { - (byte)0x2A, (byte)0x86, (byte)0x48, (byte)0x86, (byte)0xF7, - (byte)0x0D, (byte)0x01, (byte)0x09, (byte)0x10, (byte)0x03, - (byte)0x11 - }; - - /** Private constructor, all methods are static. */ - private WolfCryptLmsUtil() { - } - - /** - * Encode a raw HSS/LMS public key as an X.509 SubjectPublicKeyInfo DER, - * RFC 9708 unwrapped form (raw key directly in the BIT STRING). - * - * @param rawPub raw HSS/LMS public key bytes - * - * @return X.509 SubjectPublicKeyInfo DER - */ - static byte[] encodePublicKeyDer(byte[] rawPub) { - - byte[] algId; - byte[] bitString; - - if (rawPub == null || rawPub.length == 0) { - throw new IllegalArgumentException( - "raw public key cannot be null or empty"); - } - - algId = WolfCryptASN1Util.encodeDERSequence( - WolfCryptASN1Util.encodeDERObjectIdentifier(OID_HSS_LMS)); - - /* RFC 9708 unwrapped form: the raw key sits directly in the BIT STRING - * (encodeDERBitString prepends the 0x00 unused-bits octet). */ - bitString = WolfCryptASN1Util.encodeDERBitString(rawPub); - - return WolfCryptASN1Util.encodeDERSequence(concat(algId, bitString)); - } - - /** - * Parse an X.509 SubjectPublicKeyInfo DER carrying an LMS/HSS public key - * and return the raw HSS/LMS public key bytes. Accepts both the RFC 9708 - * unwrapped form and the RFC 8708 form (raw key wrapped in an inner OCTET - * STRING). - * - * @param x509 X.509 SubjectPublicKeyInfo DER - * - * @return raw HSS/LMS public key bytes - * - * @throws IllegalArgumentException if the DER is malformed or not an LMS - * SubjectPublicKeyInfo - */ - static byte[] parsePublicKeyDer(byte[] x509) { - - int end; - int bsStart; - int bsEnd; - int contentStart; - int[] spki, algId, oid, bitStr, oct, nullParam; - - if (x509 == null || x509.length == 0) { - throw new IllegalArgumentException( - "encoded key cannot be null or empty"); - } - - /* outer SubjectPublicKeyInfo SEQUENCE, no trailing data */ - spki = readTLV(x509, 0, x509.length, TAG_SEQUENCE); - if (spki[1] != x509.length) { - throw bad("trailing data after SubjectPublicKeyInfo"); - } - end = spki[1]; - - /* AlgorithmIdentifier SEQUENCE { OID [, NULL] }. Parameters should be - * absent (RFC 8708/9708), but JDK <= 17 re-encodes them as an explicit - * NULL, so a single trailing NULL is also tolerated. */ - algId = readTLV(x509, spki[0], end, TAG_SEQUENCE); - oid = readTLV(x509, algId[0], algId[1], TAG_OID); - if (!regionEquals(x509, oid[0], oid[1], OID_HSS_LMS)) { - throw bad("not an LMS/HSS AlgorithmIdentifier OID"); - } - if (oid[1] != algId[1]) { - /* The parameters must be a single NULL (05 00) */ - if ((x509[oid[1]] & 0xFF) != TAG_NULL) { - throw bad("unexpected AlgorithmIdentifier parameters"); - } - nullParam = readTLV(x509, oid[1], algId[1], TAG_NULL); - if (nullParam[0] != nullParam[1] || nullParam[1] != algId[1]) { - throw bad("unexpected AlgorithmIdentifier parameters"); - } - } - - /* subjectPublicKey BIT STRING, no trailing data */ - bitStr = readTLV(x509, algId[1], end, TAG_BIT_STRING); - if (bitStr[1] != end) { - throw bad("trailing data after subjectPublicKey"); - } - bsStart = bitStr[0]; - bsEnd = bitStr[1]; - if (bsStart >= bsEnd) { - throw bad("empty subjectPublicKey BIT STRING"); - } - if ((x509[bsStart] & 0xFF) != 0x00) { - throw bad("unexpected unused bits in subjectPublicKey"); - } - contentStart = bsStart + 1; - if (contentStart >= bsEnd) { - throw bad("missing public key in subjectPublicKey"); - } - - /* RFC 8708 wraps the raw key in an OCTET STRING (tag 0x04). The raw - * HSS public key always begins with u32(L), L in 1..4, (ie byte - * 0x00), so a leading 0x04 unambiguously means the wrapped form. */ - if ((x509[contentStart] & 0xFF) == TAG_OCTET_STRING) { - oct = readTLV(x509, contentStart, bsEnd, TAG_OCTET_STRING); - if (oct[1] != bsEnd) { - throw bad("trailing data in wrapped public key"); - } - return Arrays.copyOfRange(x509, oct[0], oct[1]); - } - - return Arrays.copyOfRange(x509, contentStart, bsEnd); - } - - /* - * Parse a definite-form DER TLV at offset 'off' within [off, limit), - * requiring the given tag. Returns {contentStart, contentEnd}. Rejects - * indefinite/non-minimal lengths and overruns. - */ - private static int[] readTLV(byte[] in, int off, int limit, int tag) { - - int lenByte, contentStart, length, numLenBytes; - - if (off + 2 > limit) { - throw bad("truncated TLV header"); - } - - if ((in[off] & 0xFF) != tag) { - throw bad("unexpected tag 0x" + - Integer.toHexString(in[off] & 0xFF) + ", expected 0x" + - Integer.toHexString(tag)); - } - - lenByte = in[off + 1] & 0xFF; - - if (lenByte < 0x80) { - length = lenByte; - contentStart = off + 2; - } - else { - numLenBytes = lenByte & 0x7F; - - if (numLenBytes == 0 || numLenBytes > 4) { - throw bad("unsupported DER length form"); - } - - if (off + 2 + numLenBytes > limit) { - throw bad("truncated DER length"); - } - length = 0; - - for (int i = 0; i < numLenBytes; i++) { - length = (length << 8) | (in[off + 2 + i] & 0xFF); - } - - /* Values < 0x80 must use the short form. n-octet length must - * be n-octets long. */ - if (length < 0x80 || - length < (1 << ((numLenBytes - 1) * 8))) { - throw bad("non-minimal DER length"); - } - - contentStart = off + 2 + numLenBytes; - } - - /* contentStart <= limit was checked above, so limit - contentStart is - * non-negative and a crafted ~2GB long-form length cannot overflow - * the comparison. */ - if ((length < 0) || (length > limit - contentStart)) { - throw bad("DER length exceeds buffer"); - } - - return new int[] { contentStart, contentStart + length }; - } - - /* Compare a region of 'in' against 'expected'. */ - private static boolean regionEquals(byte[] in, int start, int end, - byte[] expected) { - - if ((end - start) != expected.length) { - return false; - } - - for (int i = 0; i < expected.length; i++) { - if (in[start + i] != expected[i]) { - return false; - } - } - - return true; - } - - /* Concatenate byte arrays. */ - private static byte[] concat(byte[]... parts) { - - ByteArrayOutputStream out = new ByteArrayOutputStream(); - for (byte[] p : parts) { - out.write(p, 0, p.length); - } - - return out.toByteArray(); - } - - private static IllegalArgumentException bad(String msg) { - return new IllegalArgumentException("LMS DER parse error: " + msg); - } -} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptMlDsaKeyFactory.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptMlDsaKeyFactory.java index 407811fa..536518ef 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfCryptMlDsaKeyFactory.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptMlDsaKeyFactory.java @@ -194,6 +194,8 @@ protected PublicKey engineGeneratePublic(KeySpec keySpec) protectedConverts between encoded forms ({@link PKCS8EncodedKeySpec} for private + * keys, {@link X509EncodedKeySpec} for public keys) and + * {@link WolfCryptSlhDsaPrivateKey} / {@link WolfCryptSlhDsaPublicKey} + * objects. The parameter set is carried in the encoded AlgorithmIdentifier + * OID (RFC 9909).
+ * + *The per-parameter-set factories (e.g. {@code SLH-DSA-SHA2-128f}) reject + * keys of a different parameter set. The generic {@code SLH-DSA} factory + * accepts keys of any parameter set.
+ */ +public class WolfCryptSlhDsaKeyFactory extends KeyFactorySpi { + + /** No required parameter set, accept any. */ + private static final int PARAM_ANY = -1; + + /** Required SLH-DSA parameter set for keys produced by this factory, one + * of {@code SlhDsa.SLH_DSA_*} (0-11), or {@link #PARAM_ANY} to accept any + * parameter set. */ + private final int requiredParam; + + /** + * Create a new wolfJCE SLH-DSA KeyFactory accepting any parameter set. + */ + public WolfCryptSlhDsaKeyFactory() { + this(PARAM_ANY); + } + + /** + * Create a new wolfJCE SLH-DSA KeyFactory with a required parameter set. + * + * @param requiredParam {@link #PARAM_ANY} to accept any parameter set, + * otherwise one of {@code SlhDsa.SLH_DSA_*} + */ + protected WolfCryptSlhDsaKeyFactory(int requiredParam) { + + this.requiredParam = requiredParam; + + log("created new SLH-DSA KeyFactory (requiredParam: " + + requiredParam + ")"); + } + + /** SLH-DSA-SHAKE-128s only KeyFactory. */ + public static final class wcSlhDsaShake_128s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_128s() { + super(SlhDsa.SLH_DSA_SHAKE_128S); + } + } + + /** SLH-DSA-SHAKE-128f only KeyFactory. */ + public static final class wcSlhDsaShake_128f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_128f() { + super(SlhDsa.SLH_DSA_SHAKE_128F); + } + } + + /** SLH-DSA-SHAKE-192s only KeyFactory. */ + public static final class wcSlhDsaShake_192s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_192s() { + super(SlhDsa.SLH_DSA_SHAKE_192S); + } + } + + /** SLH-DSA-SHAKE-192f only KeyFactory. */ + public static final class wcSlhDsaShake_192f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_192f() { + super(SlhDsa.SLH_DSA_SHAKE_192F); + } + } + + /** SLH-DSA-SHAKE-256s only KeyFactory. */ + public static final class wcSlhDsaShake_256s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_256s() { + super(SlhDsa.SLH_DSA_SHAKE_256S); + } + } + + /** SLH-DSA-SHAKE-256f only KeyFactory. */ + public static final class wcSlhDsaShake_256f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaShake_256f() { + super(SlhDsa.SLH_DSA_SHAKE_256F); + } + } + + /** SLH-DSA-SHA2-128s only KeyFactory. */ + public static final class wcSlhDsaSha2_128s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_128s() { + super(SlhDsa.SLH_DSA_SHA2_128S); + } + } + + /** SLH-DSA-SHA2-128f only KeyFactory. */ + public static final class wcSlhDsaSha2_128f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_128f() { + super(SlhDsa.SLH_DSA_SHA2_128F); + } + } + + /** SLH-DSA-SHA2-192s only KeyFactory. */ + public static final class wcSlhDsaSha2_192s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_192s() { + super(SlhDsa.SLH_DSA_SHA2_192S); + } + } + + /** SLH-DSA-SHA2-192f only KeyFactory. */ + public static final class wcSlhDsaSha2_192f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_192f() { + super(SlhDsa.SLH_DSA_SHA2_192F); + } + } + + /** SLH-DSA-SHA2-256s only KeyFactory. */ + public static final class wcSlhDsaSha2_256s + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_256s() { + super(SlhDsa.SLH_DSA_SHA2_256S); + } + } + + /** SLH-DSA-SHA2-256f only KeyFactory. */ + public static final class wcSlhDsaSha2_256f + extends WolfCryptSlhDsaKeyFactory { + /** Default constructor. */ + public wcSlhDsaSha2_256f() { + super(SlhDsa.SLH_DSA_SHA2_256F); + } + } + + /** + * Check a key parameter set against this factory's required parameter set. + * + * @param param parameter set of the key being produced or inspected + * + * @throws InvalidKeySpecException if the factory is parameter-set specific + * and the key parameter set does not match + */ + private void checkParamMatchesRequired(int param) + throws InvalidKeySpecException { + + if ((requiredParam != PARAM_ANY) && (param != requiredParam)) { + throw new InvalidKeySpecException( + "Key parameter set does not match KeyFactory: expected " + + WolfPQCJdkCompat.slhDsaParamToName(requiredParam) + + ", got " + WolfPQCJdkCompat.slhDsaParamToName(param)); + } + } + + private void log(String msg) { + WolfCryptDebug.log(getClass(), WolfCryptDebug.INFO, + () -> "[SLH-DSA KeyFactory] " + msg); + } + + @Override + protected PrivateKey engineGeneratePrivate(KeySpec keySpec) + throws InvalidKeySpecException { + + byte[] encoded; + + if (keySpec == null) { + throw new InvalidKeySpecException("KeySpec cannot be null"); + } + + if (!(keySpec instanceof PKCS8EncodedKeySpec)) { + throw new InvalidKeySpecException( + "Unsupported KeySpec type for SLH-DSA private key: " + + keySpec.getClass().getName() + + " (expected PKCS8EncodedKeySpec)"); + } + + encoded = ((PKCS8EncodedKeySpec) keySpec).getEncoded(); + if (encoded == null || encoded.length == 0) { + throw new InvalidKeySpecException( + "PKCS8EncodedKeySpec is empty"); + } + + try { + WolfCryptSlhDsaPrivateKey key = + new WolfCryptSlhDsaPrivateKey(encoded); + checkParamMatchesRequired(key.getParam()); + return key; + } + catch (IllegalArgumentException e) { + throw new InvalidKeySpecException(e.getMessage(), e); + } + } + + @Override + protected PublicKey engineGeneratePublic(KeySpec keySpec) + throws InvalidKeySpecException { + + byte[] encoded; + + if (keySpec == null) { + throw new InvalidKeySpecException("KeySpec cannot be null"); + } + + if (!(keySpec instanceof X509EncodedKeySpec)) { + throw new InvalidKeySpecException( + "Unsupported KeySpec type for SLH-DSA public key: " + + keySpec.getClass().getName() + + " (expected X509EncodedKeySpec)"); + } + + encoded = ((X509EncodedKeySpec) keySpec).getEncoded(); + if (encoded == null || encoded.length == 0) { + throw new InvalidKeySpecException( + "X509EncodedKeySpec is empty"); + } + + try { + WolfCryptSlhDsaPublicKey key = + new WolfCryptSlhDsaPublicKey(encoded); + checkParamMatchesRequired(key.getParam()); + return key; + } + catch (IllegalArgumentException e) { + throw new InvalidKeySpecException(e.getMessage(), e); + } + } + + @Override + protected{@link #getAlgorithm()} returns the family name {@code "SLH-DSA"}. The + * parameter set is exposed via {@link #getParams()}.
+ * + *{@link #getEncoded()} returns PKCS#8 PrivateKeyInfo DER (RFC 9909) + * generated via wolfCrypt {@code wc_SlhDsaKey_KeyToDer}. The encoded buffer + * is zeroed on {@link #destroy()}.
+ */ +public class WolfCryptSlhDsaPrivateKey implements PrivateKey, Destroyable { + + private static final long serialVersionUID = 1L; + + /** PKCS#8 PrivateKeyInfo DER. Zeroed on destroy(). */ + private byte[] encoded = null; + + /** SLH-DSA parameter set, one of {@code SlhDsa.SLH_DSA_*} (0-11). */ + private final int param; + + /** Track if object has been destroyed. */ + private boolean destroyed = false; + + /** Lock around use of destroyed boolean and encoded buffer. */ + private transient Object stateLock = new Object(); + + /** + * Create from PKCS#8 PrivateKeyInfo DER. The parameter set is detected + * from the AlgorithmIdentifier OID by wolfCrypt. + * + * @param pkcs8Der PKCS#8 PrivateKeyInfo DER + * + * @throws IllegalArgumentException if DER is malformed, not a + * recognized SLH-DSA PKCS#8, or private-key support for it is + * not compiled into native wolfSSL + */ + public WolfCryptSlhDsaPrivateKey(byte[] pkcs8Der) + throws IllegalArgumentException { + + if (pkcs8Der == null || pkcs8Der.length == 0) { + throw new IllegalArgumentException( + "Encoded key data cannot be null or empty"); + } + + try { + /* Parse PKCS#8 DER to verify correctness and detect param set */ + this.param = SlhDsa.parseAndValidateSlhDsaPrivateKeyDer(pkcs8Der); + } + catch (WolfCryptException e) { + throw decodeFailure(e); + } + + this.encoded = pkcs8Der.clone(); + } + + /** + * Create from PKCS#8 PrivateKeyInfo DER with explicit parameter set. The + * DER is validated by importing through wolfCrypt at construction and the + * detected parameter set must match {@code param}. + * + * @param pkcs8Der PKCS#8 PrivateKeyInfo DER + * @param param SLH-DSA parameter set, one of {@code SlhDsa.SLH_DSA_*} + * + * @throws IllegalArgumentException on invalid param, malformed DER, a + * parameter set mismatch, or private-key support not compiled + * into native wolfSSL + */ + public WolfCryptSlhDsaPrivateKey(byte[] pkcs8Der, int param) + throws IllegalArgumentException { + + int detected; + + validateParam(param); + + if (pkcs8Der == null || pkcs8Der.length == 0) { + throw new IllegalArgumentException( + "Encoded key data cannot be null or empty"); + } + + try { + detected = SlhDsa.parseAndValidateSlhDsaPrivateKeyDer(pkcs8Der); + } + catch (WolfCryptException e) { + throw decodeFailure(e); + } + + if (detected != param) { + throw new IllegalArgumentException( + "SLH-DSA PKCS#8 parameter set " + + WolfPQCJdkCompat.slhDsaParamToName(detected) + + " does not match requested " + + WolfPQCJdkCompat.slhDsaParamToName(param)); + } + + this.param = param; + this.encoded = pkcs8Der.clone(); + } + + /** + * Map a PKCS#8 decode failure to an IllegalArgumentException. + * + * @param e decode exception from parseAndValidateSlhDsaPrivateKeyDer + * + * @return IllegalArgumentException for the caller to throw + */ + private static IllegalArgumentException decodeFailure( + WolfCryptException e) { + + if (e.getError() == WolfCryptError.NOT_COMPILED_IN) { + return new IllegalArgumentException( + "SLH-DSA private-key support or this parameter set is " + + "not compiled into native wolfSSL", e); + } + + return new IllegalArgumentException( + "Not a valid SLH-DSA PKCS#8 DER: " + e.getMessage(), e); + } + + /** + * Validates SLH-DSA parameter set. + * + * @param param SLH-DSA parameter set to validate + * + * @throws IllegalArgumentException if param is not in range 0-11 + */ + private static void validateParam(int param) + throws IllegalArgumentException { + + if (param < SlhDsa.SLH_DSA_SHAKE_128S || + param > SlhDsa.SLH_DSA_SHA2_256F) { + + throw new IllegalArgumentException( + "Invalid SLH-DSA parameter set: " + param); + } + } + + /** + * Get the standard algorithm name for this key. + * + * @return "SLH-DSA" + */ + @Override + public String getAlgorithm() { + return "SLH-DSA"; + } + + /** + * Get the name of the primary encoding format for this key. + * + * @return "PKCS#8" + */ + @Override + public String getFormat() { + return "PKCS#8"; + } + + /** + * Get the PKCS#8 DER encoding of this key. + * + * @return PKCS#8 DER byte array, or null if the key has been destroyed + */ + @Override + public byte[] getEncoded() { + synchronized (stateLock) { + if (destroyed) { + return null; + } + return encoded.clone(); + } + } + + /** + * Get the AlgorithmParameterSpec for this key. + * + * @return JDK {@code NamedParameterSpec} on JDK 11+, else null + */ + public AlgorithmParameterSpec getParams() { + return WolfPQCJdkCompat.slhDsaNamedParameterSpec(this.param); + } + + /** + * Get the SLH-DSA parameter set. + * + * @return parameter set value, one of {@code SlhDsa.SLH_DSA_*} (0-11) + */ + public int getParam() { + return this.param; + } + + /** + * Destroy this key, zero the encoded buffer and mark destroyed. + */ + @Override + public void destroy() { + synchronized (stateLock) { + if (!destroyed) { + if (encoded != null) { + Arrays.fill(encoded, (byte) 0); + } + destroyed = true; + } + } + } + + /** + * Check if this key has been destroyed. + * + * @return true if destroyed, false otherwise + */ + @Override + public boolean isDestroyed() { + synchronized (stateLock) { + return destroyed; + } + } + + /** + * Hash code based on encoded key and parameter set. + * + * @return hash code, or 0 if destroyed + */ + @Override + public int hashCode() { + synchronized (stateLock) { + if (destroyed) { + return 0; + } + return Arrays.hashCode(encoded) ^ param; + } + } + + /** + * Equality based on encoded key and parameter set. + * + * @return true if obj is a PrivateKey with algorithm "SLH-DSA" and the + * same encoded key, false otherwise or if destroyed. + */ + @Override + public boolean equals(Object obj) { + + PrivateKey other; + byte[] otherEncoded; + String otherAlg; + + if (this == obj) { + return true; + } + + if (!(obj instanceof PrivateKey)) { + return false; + } + + other = (PrivateKey) obj; + otherEncoded = other.getEncoded(); + otherAlg = other.getAlgorithm(); + + synchronized (stateLock) { + if (destroyed) { + return false; + } + return otherEncoded != null && + "SLH-DSA".equals(otherAlg) && + Arrays.equals(this.encoded, otherEncoded); + } + } + + /** + * String representation of this key. + * + * @return string describing this key, or indicating destroyed state + */ + @Override + public String toString() { + synchronized (stateLock) { + if (destroyed) { + return "WolfCryptSlhDsaPrivateKey[DESTROYED]"; + } + return "WolfCryptSlhDsaPrivateKey[algorithm=SLH-DSA, " + + "params=" + WolfPQCJdkCompat.slhDsaParamToName(param) + + ", format=PKCS#8]"; + } + } + + /** + * Custom deserialization to reinitialize transient state after + * deserialization. + * + * @param in ObjectInputStream to read from + * + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a class cannot be found + */ + private void readObject(ObjectInputStream in) + throws IOException, ClassNotFoundException { + + in.defaultReadObject(); + stateLock = new Object(); + } +} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaPublicKey.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaPublicKey.java new file mode 100644 index 00000000..b6a50e28 --- /dev/null +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaPublicKey.java @@ -0,0 +1,339 @@ +/* WolfCryptSlhDsaPublicKey.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce; + +import java.io.IOException; +import java.io.ObjectInputStream; +import java.util.Arrays; +import java.security.PublicKey; +import java.security.spec.AlgorithmParameterSpec; +import javax.security.auth.Destroyable; + +import com.wolfssl.wolfcrypt.SlhDsa; +import com.wolfssl.wolfcrypt.WolfCryptError; +import com.wolfssl.wolfcrypt.WolfCryptException; + +/** + * wolfJCE SLH-DSA (FIPS 205) public key. + * + *{@link #getAlgorithm()} returns the family name {@code "SLH-DSA"}. The + * parameter set is exposed via {@link #getParams()}.
+ * + *{@link #getEncoded()} returns the X.509 SubjectPublicKeyInfo DER + * (RFC 9909) generated via wolfCrypt {@code wc_SlhDsaKey_PublicKeyToDer}.
+ */ +public class WolfCryptSlhDsaPublicKey implements PublicKey, Destroyable { + + private static final long serialVersionUID = 1L; + + /** X.509 SubjectPublicKeyInfo DER. */ + private byte[] encoded = null; + + /** SLH-DSA parameter set, one of {@code SlhDsa.SLH_DSA_*} (0-11). */ + private final int param; + + /** Track if object has been destroyed. */ + private boolean destroyed = false; + + /** Lock around use of destroyed boolean and encoded buffer. Cannot be + * final because it is reinitialized after deserialization. */ + private transient Object stateLock = new Object(); + + /** + * Create from X.509 SubjectPublicKeyInfo DER. The parameter set is + * detected from the AlgorithmIdentifier OID by wolfCrypt. + * + * @param x509Der X.509 SubjectPublicKeyInfo DER + * + * @throws IllegalArgumentException if DER is malformed, not a + * recognized SLH-DSA SPKI, or its parameter set is not + * compiled into native wolfSSL + */ + public WolfCryptSlhDsaPublicKey(byte[] x509Der) + throws IllegalArgumentException { + + if (x509Der == null || x509Der.length == 0) { + throw new IllegalArgumentException( + "Encoded key data cannot be null or empty"); + } + + /* Remove NULL AlgorithmIdentifier (JDK re-encoding) if present */ + x509Der = WolfCryptSpkiUtil.stripNullAlgIdParams(x509Der); + + try { + this.param = SlhDsa.parseAndValidateSlhDsaPublicKeyDer(x509Der); + } + catch (WolfCryptException e) { + throw decodeFailure(e); + } + + this.encoded = x509Der.clone(); + } + + /** + * Create from X.509 SubjectPublicKeyInfo DER with explicit parameter set. + * The DER is validated by importing through wolfCrypt at construction and + * the detected parameter set must match {@code param}. + * + * @param x509Der X.509 SubjectPublicKeyInfo DER + * @param param SLH-DSA parameter set, one of {@code SlhDsa.SLH_DSA_*} + * + * @throws IllegalArgumentException if param is invalid, DER is malformed, + * its parameter set does not match {@code param}, or its + * parameter set is not compiled into native wolfSSL. + */ + public WolfCryptSlhDsaPublicKey(byte[] x509Der, int param) + throws IllegalArgumentException { + + int detected; + + validateParam(param); + + if (x509Der == null || x509Der.length == 0) { + throw new IllegalArgumentException( + "Encoded key data cannot be null or empty"); + } + + /* Remove NULL AlgorithmIdentifier (JDK re-encoding) if present */ + x509Der = WolfCryptSpkiUtil.stripNullAlgIdParams(x509Der); + + try { + detected = SlhDsa.parseAndValidateSlhDsaPublicKeyDer(x509Der); + } + catch (WolfCryptException e) { + throw decodeFailure(e); + } + + if (detected != param) { + throw new IllegalArgumentException( + "SLH-DSA SPKI parameter set " + + WolfPQCJdkCompat.slhDsaParamToName(detected) + + " does not match requested " + + WolfPQCJdkCompat.slhDsaParamToName(param)); + } + + this.param = param; + this.encoded = x509Der.clone(); + } + + /** + * Map an SPKI decode failure to an IllegalArgumentException. + * + * @param e decode exception from parseAndValidateSlhDsaPublicKeyDer + * + * @return IllegalArgumentException for the caller to throw + */ + private static IllegalArgumentException decodeFailure( + WolfCryptException e) { + + if (e.getError() == WolfCryptError.NOT_COMPILED_IN) { + return new IllegalArgumentException( + "SLH-DSA parameter set is not compiled into native wolfSSL", e); + } + + return new IllegalArgumentException( + "Not a valid SLH-DSA X.509 SPKI DER: " + e.getMessage(), e); + } + + /** + * Validates SLH-DSA parameter set. + * + * @param param SLH-DSA parameter set to validate + * + * @throws IllegalArgumentException if param is not in range 0-11 + */ + private static void validateParam(int param) + throws IllegalArgumentException { + + if (param < SlhDsa.SLH_DSA_SHAKE_128S || + param > SlhDsa.SLH_DSA_SHA2_256F) { + + throw new IllegalArgumentException( + "Invalid SLH-DSA parameter set: " + param); + } + } + + /** + * Get the standard algorithm name for this key. + * + * @return "SLH-DSA" + */ + @Override + public String getAlgorithm() { + return "SLH-DSA"; + } + + /** + * Get the name of the primary encoding format for this key. + * + * @return "X.509" + */ + @Override + public String getFormat() { + return "X.509"; + } + + /** + * Get the X.509 SubjectPublicKeyInfo DER encoding of this key. + * + * @return X.509 DER, or null if the key has been destroyed + */ + @Override + public byte[] getEncoded() { + synchronized (stateLock) { + if (destroyed) { + return null; + } + return encoded.clone(); + } + } + + /** + * Get the AlgorithmParameterSpec for this key. + * + * @return JDK {@code NamedParameterSpec} on JDK 11+, else null + */ + public AlgorithmParameterSpec getParams() { + return WolfPQCJdkCompat.slhDsaNamedParameterSpec(this.param); + } + + /** + * Get the SLH-DSA parameter set. + * + * @return parameter set value, one of {@code SlhDsa.SLH_DSA_*} (0-11) + */ + public int getParam() { + return this.param; + } + + /** + * Destroy this key, zero the encoded buffer and mark destroyed. + */ + @Override + public void destroy() { + synchronized (stateLock) { + if (!destroyed) { + if (encoded != null) { + Arrays.fill(encoded, (byte) 0); + } + destroyed = true; + } + } + } + + /** + * Check if this key has been destroyed. + * + * @return true if destroyed, false otherwise + */ + @Override + public boolean isDestroyed() { + synchronized (stateLock) { + return destroyed; + } + } + + /** + * Hash code based on encoded key and parameter set. + * + * @return hash code, or 0 if destroyed + */ + @Override + public int hashCode() { + synchronized (stateLock) { + if (destroyed) { + return 0; + } + return Arrays.hashCode(encoded) ^ param; + } + } + + /** + * Equality based on algorithm and encoded key. The SLH-DSA parameter + * set is carried in the X.509 SPKI AlgorithmIdentifier OID, so byte + * equality of the encoded form also implies the same parameter set. + * + * @return true if obj is a PublicKey with algorithm "SLH-DSA" and the + * same X.509 SPKI encoding, false otherwise or if destroyed. + */ + @Override + public boolean equals(Object obj) { + + PublicKey other; + byte[] otherEncoded; + String otherAlg; + + if (this == obj) { + return true; + } + + if (!(obj instanceof PublicKey)) { + return false; + } + + other = (PublicKey) obj; + otherEncoded = other.getEncoded(); + otherAlg = other.getAlgorithm(); + + synchronized (stateLock) { + if (destroyed) { + return false; + } + return otherEncoded != null && + "SLH-DSA".equals(otherAlg) && + Arrays.equals(this.encoded, otherEncoded); + } + } + + /** + * String representation of this key. + * + * @return string describing this key, or indicating it is destroyed + */ + @Override + public String toString() { + synchronized (stateLock) { + if (destroyed) { + return "WolfCryptSlhDsaPublicKey[DESTROYED]"; + } + return "WolfCryptSlhDsaPublicKey[algorithm=SLH-DSA, " + + "params=" + WolfPQCJdkCompat.slhDsaParamToName(param) + + ", format=X.509, encoded.length=" + encoded.length + "]"; + } + } + + /** + * Custom deserialization to reinitialize transient state after + * deserialization. + * + * @param in ObjectInputStream to read from + * + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a class cannot be found + */ + private void readObject(ObjectInputStream in) + throws IOException, ClassNotFoundException { + + in.defaultReadObject(); + stateLock = new Object(); + } +} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaSignature.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaSignature.java new file mode 100644 index 00000000..89168123 --- /dev/null +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptSlhDsaSignature.java @@ -0,0 +1,685 @@ +/* WolfCryptSlhDsaSignature.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce; + +import java.io.ByteArrayOutputStream; +import java.security.InvalidAlgorithmParameterException; +import java.security.InvalidKeyException; +import java.security.InvalidParameterException; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.SignatureException; +import java.security.SignatureSpi; +import java.security.spec.AlgorithmParameterSpec; + +import com.wolfssl.wolfcrypt.SlhDsa; +import com.wolfssl.wolfcrypt.Rng; +import com.wolfssl.wolfcrypt.WolfCryptException; + +/** + * wolfJCE SLH-DSA (FIPS 205) signature provider. + * + *SLH-DSA is a one-shot signature scheme. This implementation buffers the + * message in a {@link ByteArrayOutputStream} during {@code engineUpdate} and + * consumes it on {@code engineSign} / {@code engineVerify}. This applies to + * the HashSLH-DSA (pre-hash) services as well: the full message is buffered + * and pre-hashed natively in one shot, so peak memory is proportional to + * message size. Incremental pre-hashing during update is a possible future + * enhancement for large-message use cases.
+ * + *An optional FIPS 205 context string (0..255 bytes, empty by default) can + * be set via {@code engineSetParameter(AlgorithmParameterSpec)} with a + * {@link WolfCryptContextParameterSpec}. The context persists across init + * calls until replaced. To reset, set a spec created with a null or empty + * context. The signer and verifier must agree on the same context otherwise + * verification fails.
+ * + *Inner classes restrict the accepted key parameter set; the generic + * {@link wcSlhDsa} accepts any SLH-DSA parameter set.
+ */ +public abstract class WolfCryptSlhDsaSignature extends SignatureSpi { + + /** No required parameter set, accept any. */ + private static final int PARAM_ANY = -1; + + /** Required SLH-DSA parameter set for this Signature instance, one of + * {@code SlhDsa.SLH_DSA_*} (0-11), or {@link #PARAM_ANY} for the generic + * implementation. */ + private final int requiredParam; + + /** True for the HashSLH-DSA (pre-hash) services, false for pure SLH-DSA. + * When true the message is pre-hashed natively per FIPS 205 Section + * 10.2.2 before signing/verifying. */ + private final boolean preHash; + + /** Native SLH-DSA wrapper (one per init). */ + private SlhDsa key = null; + + /** Set true when initialized for sign, false for verify. Undefined + * before first init call. */ + private boolean signing = false; + + /** FIPS 205 context string. Empty by default. Persists across init so it + * may be set via setParameter() before or after initSign/initVerify. */ + private byte[] context = new byte[0]; + + /** Reset keeps the backing array up to this size, larger buffers are + * reallocated so long-lived (cached/pooled) Signature objects do not pin + * one large message's worth of memory indefinitely. */ + private static final int BUFFER_RETAIN_MAX = 1024 * 1024; + + /** Buffered message bytes (SLH-DSA signs/verifies the whole message, not + * a streaming hash). */ + private ByteArrayOutputStream buffer = new ByteArrayOutputStream(); + + /** Lazily-initialized RNG used for sign operations. */ + private Rng rng = null; + + /** + * Construct with the required SLH-DSA parameter set. {@link #PARAM_ANY} + * means "any parameter set", used by the generic {@link wcSlhDsa} alias. + * + * @param requiredParam {@link #PARAM_ANY} or a {@code SlhDsa.SLH_DSA_*} + */ + protected WolfCryptSlhDsaSignature(int requiredParam) { + this(requiredParam, false); + } + + /** + * Construct with the required SLH-DSA parameter set and pre-hash mode. + * + * @param requiredParam {@link #PARAM_ANY} or a {@code SlhDsa.SLH_DSA_*} + * @param preHash true for HashSLH-DSA (pre-hash), false for pure SLH-DSA + */ + protected WolfCryptSlhDsaSignature(int requiredParam, boolean preHash) { + this.requiredParam = requiredParam; + this.preHash = preHash; + } + + /** Generic SLH-DSA Signature, accepts keys of any parameter set. */ + public static final class wcSlhDsa extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsa() { + super(PARAM_ANY); + } + } + + /** SLH-DSA-SHAKE-128s only. */ + public static final class wcSlhDsaShake_128s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_128s() { + super(SlhDsa.SLH_DSA_SHAKE_128S); + } + } + + /** SLH-DSA-SHAKE-128f only. */ + public static final class wcSlhDsaShake_128f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_128f() { + super(SlhDsa.SLH_DSA_SHAKE_128F); + } + } + + /** SLH-DSA-SHAKE-192s only. */ + public static final class wcSlhDsaShake_192s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_192s() { + super(SlhDsa.SLH_DSA_SHAKE_192S); + } + } + + /** SLH-DSA-SHAKE-192f only. */ + public static final class wcSlhDsaShake_192f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_192f() { + super(SlhDsa.SLH_DSA_SHAKE_192F); + } + } + + /** SLH-DSA-SHAKE-256s only. */ + public static final class wcSlhDsaShake_256s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_256s() { + super(SlhDsa.SLH_DSA_SHAKE_256S); + } + } + + /** SLH-DSA-SHAKE-256f only. */ + public static final class wcSlhDsaShake_256f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaShake_256f() { + super(SlhDsa.SLH_DSA_SHAKE_256F); + } + } + + /** SLH-DSA-SHA2-128s only. */ + public static final class wcSlhDsaSha2_128s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_128s() { + super(SlhDsa.SLH_DSA_SHA2_128S); + } + } + + /** SLH-DSA-SHA2-128f only. */ + public static final class wcSlhDsaSha2_128f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_128f() { + super(SlhDsa.SLH_DSA_SHA2_128F); + } + } + + /** SLH-DSA-SHA2-192s only. */ + public static final class wcSlhDsaSha2_192s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_192s() { + super(SlhDsa.SLH_DSA_SHA2_192S); + } + } + + /** SLH-DSA-SHA2-192f only. */ + public static final class wcSlhDsaSha2_192f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_192f() { + super(SlhDsa.SLH_DSA_SHA2_192F); + } + } + + /** SLH-DSA-SHA2-256s only. */ + public static final class wcSlhDsaSha2_256s + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_256s() { + super(SlhDsa.SLH_DSA_SHA2_256S); + } + } + + /** SLH-DSA-SHA2-256f only. */ + public static final class wcSlhDsaSha2_256f + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcSlhDsaSha2_256f() { + super(SlhDsa.SLH_DSA_SHA2_256F); + } + } + + /** Generic HashSLH-DSA (pre-hash) Signature, accepts any parameter set. */ + public static final class wcHashSlhDsa extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsa() { + super(PARAM_ANY, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-128s-WITH-SHA256 only. */ + public static final class wcHashSlhDsaSha2_128sWithSha256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_128sWithSha256() { + super(SlhDsa.SLH_DSA_SHA2_128S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-128f-WITH-SHA256 only. */ + public static final class wcHashSlhDsaSha2_128fWithSha256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_128fWithSha256() { + super(SlhDsa.SLH_DSA_SHA2_128F, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-192s-WITH-SHA512 only. */ + public static final class wcHashSlhDsaSha2_192sWithSha512 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_192sWithSha512() { + super(SlhDsa.SLH_DSA_SHA2_192S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-192f-WITH-SHA512 only. */ + public static final class wcHashSlhDsaSha2_192fWithSha512 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_192fWithSha512() { + super(SlhDsa.SLH_DSA_SHA2_192F, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-256s-WITH-SHA512 only. */ + public static final class wcHashSlhDsaSha2_256sWithSha512 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_256sWithSha512() { + super(SlhDsa.SLH_DSA_SHA2_256S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHA2-256f-WITH-SHA512 only. */ + public static final class wcHashSlhDsaSha2_256fWithSha512 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaSha2_256fWithSha512() { + super(SlhDsa.SLH_DSA_SHA2_256F, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-128s-WITH-SHAKE128 only. */ + public static final class wcHashSlhDsaShake_128sWithShake128 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_128sWithShake128() { + super(SlhDsa.SLH_DSA_SHAKE_128S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-128f-WITH-SHAKE128 only. */ + public static final class wcHashSlhDsaShake_128fWithShake128 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_128fWithShake128() { + super(SlhDsa.SLH_DSA_SHAKE_128F, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-192s-WITH-SHAKE256 only. */ + public static final class wcHashSlhDsaShake_192sWithShake256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_192sWithShake256() { + super(SlhDsa.SLH_DSA_SHAKE_192S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-192f-WITH-SHAKE256 only. */ + public static final class wcHashSlhDsaShake_192fWithShake256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_192fWithShake256() { + super(SlhDsa.SLH_DSA_SHAKE_192F, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-256s-WITH-SHAKE256 only. */ + public static final class wcHashSlhDsaShake_256sWithShake256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_256sWithShake256() { + super(SlhDsa.SLH_DSA_SHAKE_256S, true); + } + } + + /** HashSLH-DSA SLH-DSA-SHAKE-256f-WITH-SHAKE256 only. */ + public static final class wcHashSlhDsaShake_256fWithShake256 + extends WolfCryptSlhDsaSignature { + /** Default constructor. */ + public wcHashSlhDsaShake_256fWithShake256() { + super(SlhDsa.SLH_DSA_SHAKE_256F, true); + } + } + + /** + * Release any previously-loaded native key (subsequent init resets state). + */ + private void releaseKey() { + if (this.key != null) { + this.key.releaseNativeStruct(); + this.key = null; + } + } + + private void resetForInit() { + releaseKey(); + resetBuffer(); + } + + /** + * Clear the message buffer, reallocating when the prior message was large + * so the high-water-mark backing array is not retained for the life of + * this Signature object. + */ + private void resetBuffer() { + if (this.buffer.size() > BUFFER_RETAIN_MAX) { + this.buffer = new ByteArrayOutputStream(); + } + else { + this.buffer.reset(); + } + } + + private SlhDsa importPublicKeyForVerify(PublicKey pub) + throws InvalidKeyException { + + /* Native wolfJCE public key, parameter set already known. */ + if (pub instanceof WolfCryptSlhDsaPublicKey) { + WolfCryptSlhDsaPublicKey wp = (WolfCryptSlhDsaPublicKey) pub; + int param = wp.getParam(); + + checkParamMatchesRequired(param); + + return importKeyDer(wp.getEncoded(), param, true, + "Failed to import SLH-DSA public key"); + } + + /* Foreign key, must be X.509 SPKI form. */ + if (!"X.509".equalsIgnoreCase(pub.getFormat())) { + throw new InvalidKeyException( + "Unsupported PublicKey format for SLH-DSA: " + + pub.getFormat()); + } + + byte[] der = pub.getEncoded(); + if (der == null || der.length == 0) { + throw new InvalidKeyException( + "Cannot extract X.509 SPKI from PublicKey"); + } + + /* Remove NULL AlgorithmIdentifier (JDK re-encoding) if present */ + der = WolfCryptSpkiUtil.stripNullAlgIdParams(der); + + return importKeyDer(der, PARAM_ANY, true, + "Not a recognized SLH-DSA X.509 SPKI key"); + } + + private SlhDsa importPrivateKeyForSign(PrivateKey priv) + throws InvalidKeyException { + + /* Native wolfJCE private key, parameter set already known. */ + if (priv instanceof WolfCryptSlhDsaPrivateKey) { + WolfCryptSlhDsaPrivateKey wp = (WolfCryptSlhDsaPrivateKey) priv; + int param = wp.getParam(); + + checkParamMatchesRequired(param); + + return importKeyDer(wp.getEncoded(), param, false, + "Failed to import SLH-DSA private key"); + } + + if (!"PKCS#8".equalsIgnoreCase(priv.getFormat())) { + throw new InvalidKeyException( + "Unsupported PrivateKey format for SLH-DSA: " + + priv.getFormat()); + } + + byte[] der = priv.getEncoded(); + if (der == null || der.length == 0) { + throw new InvalidKeyException( + "Cannot extract PKCS#8 from PrivateKey"); + } + + return importKeyDer(der, PARAM_ANY, false, + "Not a recognized SLH-DSA PKCS#8 key"); + } + + /** + * Import key DER into a new native SlhDsa object, releasing the native + * struct before throwing on any failure. + * + * When param is PARAM_ANY the parameter set is detected by wolfSSL + * from DER AlgorithmIdentifier OID and checked against requiredParam + * after import. + * + * @param der key DER, X.509 SPKI if isPublic, otherwise PKCS#8 + * @param param known parameter set, or {@link #PARAM_ANY} to detect + * @param isPublic true for public key import, false for private + * @param errMsg InvalidKeyException message on import failure + * + * @return new SlhDsa object holding the imported key, caller owns the + * native struct + * + * @throws InvalidKeyException if the DER cannot be imported or the + * parameter set does not match a parameter-set specific Signature + */ + private SlhDsa importKeyDer(byte[] der, int param, boolean isPublic, + String errMsg) throws InvalidKeyException { + + SlhDsa k = null; + + try { + if (param != PARAM_ANY) { + k = new SlhDsa(param); + importDer(k, der, isPublic); + } + else { + /* Parameter set detected by wolfSSL from DER AlgoID OID */ + k = new SlhDsa(); + importDer(k, der, isPublic); + checkParamMatchesRequired(k.getParam()); + } + + return k; + } + catch (WolfCryptException | InvalidKeyException e) { + if (k != null) { + k.releaseNativeStruct(); + } + if (e instanceof InvalidKeyException) { + throw (InvalidKeyException)e; + } + throw new InvalidKeyException(errMsg, e); + } + } + + /* Run the native public or private DER import on key object */ + private static void importDer(SlhDsa k, byte[] der, boolean isPublic) { + + if (isPublic) { + k.importPublicKeyDer(der); + } + else { + k.importPrivateKeyDer(der); + } + } + + private void checkParamMatchesRequired(int keyParam) + throws InvalidKeyException { + + if (this.requiredParam == PARAM_ANY) { + return; /* generic wcSlhDsa: any parameter set OK */ + } + + if (keyParam != this.requiredParam) { + throw new InvalidKeyException( + "Key parameter set does not match Signature: expected " + + WolfPQCJdkCompat.slhDsaParamToName(this.requiredParam) + + ", got " + WolfPQCJdkCompat.slhDsaParamToName(keyParam)); + } + } + + private Rng getOrInitRng() { + + if (this.rng == null) { + this.rng = new Rng(); + this.rng.init(); + } + + return this.rng; + } + + @Override + protected void engineInitVerify(PublicKey publicKey) + throws InvalidKeyException { + + if (publicKey == null) { + throw new InvalidKeyException("PublicKey is null"); + } + + resetForInit(); + this.key = importPublicKeyForVerify(publicKey); + this.signing = false; + } + + @Override + protected void engineInitSign(PrivateKey privateKey) + throws InvalidKeyException { + + if (privateKey == null) { + throw new InvalidKeyException("PrivateKey is null"); + } + + resetForInit(); + this.key = importPrivateKeyForSign(privateKey); + this.signing = true; + } + + @Override + protected void engineUpdate(byte b) throws SignatureException { + + if (this.key == null) { + throw new SignatureException("Signature not initialized"); + } + + this.buffer.write(b); + } + + @Override + protected void engineUpdate(byte[] b, int off, int len) + throws SignatureException { + + if (this.key == null) { + throw new SignatureException("Signature not initialized"); + } + + /* Use subtraction form so a large off/len pair cannot overflow + * int and slip past the bounds check */ + if (b == null || off < 0 || len < 0 || len > b.length - off) { + throw new SignatureException("Invalid update arguments"); + } + + this.buffer.write(b, off, len); + } + + @Override + protected byte[] engineSign() throws SignatureException { + + if (this.key == null || !this.signing) { + throw new SignatureException( + "Signature not initialized for signing"); + } + + try { + byte[] msg = this.buffer.toByteArray(); + + if (this.preHash) { + return this.key.signPreHash(msg, this.context, + getOrInitRng()); + } + + return this.key.sign(msg, this.context, getOrInitRng()); + } + catch (WolfCryptException e) { + throw new SignatureException("SLH-DSA sign failed", e); + } + finally { + resetBuffer(); + } + } + + @Override + protected boolean engineVerify(byte[] sigBytes) + throws SignatureException { + + if (this.key == null || this.signing) { + throw new SignatureException( + "Signature not initialized for verification"); + } + + if (sigBytes == null) { + throw new SignatureException("Signature bytes are null"); + } + + try { + byte[] msg = this.buffer.toByteArray(); + + if (this.preHash) { + return this.key.verifyPreHash(sigBytes, msg, this.context); + } + + return this.key.verify(sigBytes, msg, this.context); + } + catch (WolfCryptException e) { + throw new SignatureException("SLH-DSA verify failed", e); + } + finally { + resetBuffer(); + } + } + + /** + * @deprecated unsupported. Use + * {@code engineSetParameter(AlgorithmParameterSpec)} with a + * {@link WolfCryptContextParameterSpec} to set a context. + */ + @Override + @Deprecated + protected void engineSetParameter(String param, Object value) + throws InvalidParameterException { + + throw new InvalidParameterException( + "Use setParameter(AlgorithmParameterSpec) with a " + + "WolfCryptContextParameterSpec to set an SLH-DSA context"); + } + + @Override + protected void engineSetParameter(AlgorithmParameterSpec params) + throws InvalidAlgorithmParameterException { + + if (params == null) { + throw new InvalidAlgorithmParameterException( + "AlgorithmParameterSpec cannot be null, use a " + + "WolfCryptContextParameterSpec to set or reset the " + + "SLH-DSA context"); + } + + if (params instanceof WolfCryptContextParameterSpec) { + this.context = ((WolfCryptContextParameterSpec) params) + .getContext(); + return; + } + + throw new InvalidAlgorithmParameterException( + "SLH-DSA only accepts WolfCryptContextParameterSpec, got: " + + params.getClass().getName()); + } + + /** + * @deprecated unsupported. + */ + @Override + @Deprecated + protected Object engineGetParameter(String param) + throws InvalidParameterException { + + throw new InvalidParameterException( + "SLH-DSA does not support getParameter(String)"); + } +} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptSpkiUtil.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptSpkiUtil.java new file mode 100644 index 00000000..f17b96ac --- /dev/null +++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptSpkiUtil.java @@ -0,0 +1,469 @@ +/* WolfCryptSpkiUtil.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce; + +import java.io.ByteArrayOutputStream; +import java.util.Arrays; + +/** + * ASN.1/DER X.509 SubjectPublicKeyInfo helpers for the hash-based signature + * public keys wolfJCE wraps in Java: LMS/HSS (RFC 8554) and XMSS/XMSS^MT + * (RFC 8391). Native wolfCrypt only provides raw public-key import/export + * for these algorithms (wc_LmsKey/wc_XmssKey Export/ImportPubRaw()) and no + * SPKI decode, so the SPKI wrapping is done here until native wolfSSL gets + * that functionality. + * + *DER encoding reuses the shared {@link WolfCryptASN1Util} + * helpers. DER decoding uses the strict reader here: it checks every + * tag and rejects indefinite and non-minimal lengths, because it parses + * untrusted X.509 SubjectPublicKeyInfo input. This reader is intentionally + * separate from and stricter than the general-purpose + * {@link WolfCryptASN1Util}.
+ * + *SubjectPublicKeyInfo layout produced and parsed here:
+ *
+ * SEQUENCE {
+ * algorithm SEQUENCE { OBJECT IDENTIFIER } -- params absent or NULL
+ * subjectPublicKey BIT STRING -- raw public key
+ * }
+ *
+ *
+ * Encoding places the raw key directly in the BIT STRING: the RFC 9708 + * form for LMS ({@code id-alg-hss-lms-hashsig = 1.2.840.113549.1.9.16.3.17}, + * assigned in RFC 8708 and retained in RFC 9708) and the RFC 9802 form for + * XMSS/XMSS^MT ({@code id-alg-xmss-hashsig = 1.3.6.1.5.5.7.6.34}, + * {@code id-alg-xmssmt-hashsig = 1.3.6.1.5.5.7.6.35}). Parsing also accepts + * the raw key wrapped in an inner OCTET STRING (the RFC 8708 / JDK <= 23 + * form): the raw LMS and XMSS public keys always begin with a 4-byte + * big-endian word whose first byte is 0x00, so a leading 0x04 unambiguously + * means the wrapped form. Parsing also tolerates an explicit ASN.1 NULL in + * the AlgorithmIdentifier parameters, which the JDK X.509 stack re-encodes + * even where the RFCs say absent.
+ * + *wolfJCE provides verify-only LMS and XMSS support, so there are no + * private-key encodings here (matching the JDK SUN provider posture).
+ */ +final class WolfCryptSpkiUtil { + + /* DER tags used here. */ + private static final int TAG_BIT_STRING = 0x03; + private static final int TAG_OCTET_STRING = 0x04; + private static final int TAG_NULL = 0x05; + private static final int TAG_OID = 0x06; + private static final int TAG_SEQUENCE = 0x30; + + /* OID content bytes (no tag/length) for + * 1.2.840.113549.1.9.16.3.17 (id-alg-hss-lms-hashsig). */ + private static final byte[] OID_HSS_LMS = { + (byte)0x2A, (byte)0x86, (byte)0x48, (byte)0x86, (byte)0xF7, + (byte)0x0D, (byte)0x01, (byte)0x09, (byte)0x10, (byte)0x03, + (byte)0x11 + }; + + /* OID content bytes (no tag/length) for + * 1.3.6.1.5.5.7.6.34 (id-alg-xmss-hashsig). */ + private static final byte[] OID_XMSS = { + (byte)0x2B, (byte)0x06, (byte)0x01, (byte)0x05, (byte)0x05, + (byte)0x07, (byte)0x06, (byte)0x22 + }; + + /* OID content bytes (no tag/length) for + * 1.3.6.1.5.5.7.6.35 (id-alg-xmssmt-hashsig). */ + private static final byte[] OID_XMSSMT = { + (byte)0x2B, (byte)0x06, (byte)0x01, (byte)0x05, (byte)0x05, + (byte)0x07, (byte)0x06, (byte)0x23 + }; + + /* Index of OID_XMSSMT in the allowed-OID array used by + * parseXmssPublicKeyDer(). */ + private static final int OID_INDEX_XMSSMT = 1; + + /** Private constructor, all methods are static. */ + private WolfCryptSpkiUtil() { + } + + /** + * If the SubjectPublicKeyInfo AlgorithmIdentifier carries an explicit + * NULL parameters field, return a copy re-encoded with the parameters + * absent, otherwise return the input unchanged. + * + *JDK X.509 stack can re-encode an absent AlgorithmIdentifier param + * field as an explicit ASN.1 NULL when routing a certificate public key + * to a KeyFactory by OID. Native wolfSSL SLH-DSA SPKI decode requires + * the parameters to be absent (RFC 9909), so callers normalize with this + * before handing DER to native.
+ * + * @param spki X.509 SubjectPublicKeyInfo DER + * + * @return spki with an explicit NULL AlgorithmIdentifier parameters + * field removed, or the input reference unchanged + */ + static byte[] stripNullAlgIdParams(byte[] spki) { + + int[] outer, algId, oid, nullParam; + byte[] oidTlv; + byte[] restTlv; + byte[] newAlgId; + + if (spki == null || spki.length == 0) { + return spki; + } + + try { + /* outer SEQUENCE, AlgorithmIdentifier SEQUENCE { OID ... } */ + outer = readTLV(spki, 0, spki.length, TAG_SEQUENCE, "SPKI"); + algId = readTLV(spki, outer[0], outer[1], TAG_SEQUENCE, "SPKI"); + oid = readTLV(spki, algId[0], algId[1], TAG_OID, "SPKI"); + + if (oid[1] == algId[1]) { + /* parameters already absent */ + return spki; + } + + /* Only rewrite the single explicit NULL (05 00) form. */ + nullParam = readTLV(spki, oid[1], algId[1], TAG_NULL, "SPKI"); + if (nullParam[0] != nullParam[1] || nullParam[1] != algId[1]) { + return spki; + } + } + catch (IllegalArgumentException e) { + /* not the expected shape, let the native decoder report it */ + return spki; + } + + /* Rebuild: SEQUENCE { SEQUENCE { OID },Native wolfCrypt provides a raw XMSS public-key format - * (wc_XmssKey_Export/ImportPubRaw()) and no SPKI decode, so the X.509 - * SubjectPublicKeyInfo wrapping is done here until native wolfSSL gets that - * functionality. DER encoding reuses the shared - * {@link WolfCryptASN1Util} helpers. DER decoding uses a small - * self-contained strict reader. The XMSS algorithm OIDs are RFC 9802 - * {@code id-alg-xmss-hashsig = 1.3.6.1.5.5.7.6.34} and - * {@code id-alg-xmssmt-hashsig = 1.3.6.1.5.5.7.6.35}.
- * - *The DER reader here is intentionally self-contained and stricter than the - * general-purpose {@link WolfCryptASN1Util}: it checks every tag and rejects - * non-minimal long-form lengths, because it parses untrusted X.509 - * SubjectPublicKeyInfo input.
- * - *Public key (SubjectPublicKeyInfo):
- *
- * SEQUENCE {
- * algorithm SEQUENCE { OBJECT IDENTIFIER } -- parameters absent
- * subjectPublicKey BIT STRING -- raw XMSS public key
- * }
- *
- * RFC 9802 / BouncyCastle place the raw RFC 8391 public key
- * ({@code 4-byte param-set OID || root || SEED}) directly in the BIT STRING.
- * wolfJCE writes that unwrapped form and reads it. Defensively, an inner
- * OCTET STRING wrapper is also accepted on input: the raw XMSS public key
- * always begins with a 4-byte big-endian parameter-set OID whose first byte is
- * {@code 0x00}, so a leading {@code 0x04} unambiguously means the wrapped form.
- *
- * wolfJCE provides verify-only XMSS support, so there is no private-key - * encoding here.
- */ -final class WolfCryptXmssUtil { - - /* DER tags used here. */ - private static final int TAG_BIT_STRING = 0x03; - private static final int TAG_OCTET_STRING = 0x04; - private static final int TAG_NULL = 0x05; - private static final int TAG_OID = 0x06; - private static final int TAG_SEQUENCE = 0x30; - - /* OID content bytes (no tag/length) for - * 1.3.6.1.5.5.7.6.34 (id-alg-xmss-hashsig). */ - private static final byte[] OID_XMSS = { - (byte)0x2B, (byte)0x06, (byte)0x01, (byte)0x05, (byte)0x05, - (byte)0x07, (byte)0x06, (byte)0x22 - }; - - /* OID content bytes (no tag/length) for - * 1.3.6.1.5.5.7.6.35 (id-alg-xmssmt-hashsig). */ - private static final byte[] OID_XMSSMT = { - (byte)0x2B, (byte)0x06, (byte)0x01, (byte)0x05, (byte)0x05, - (byte)0x07, (byte)0x06, (byte)0x23 - }; - - /** Private constructor, all methods are static. */ - private WolfCryptXmssUtil() { - } - - /** - * Result of parsing an XMSS SubjectPublicKeyInfo: the raw RFC 8391 public - * key bytes and the family (single-tree XMSS vs multi-tree XMSS^MT), taken - * from the AlgorithmIdentifier OID. The family is needed because a raw - * XMSS public key's 4-byte OID prefix is ambiguous between the two - * registries. - */ - static final class ParsedPub { - /** Raw RFC 8391 public key ({@code OID || root || SEED}). */ - final byte[] raw; - /** True if the AlgorithmIdentifier was id-alg-xmssmt-hashsig. */ - final boolean isXmssMt; - - ParsedPub(byte[] raw, boolean isXmssMt) { - this.raw = raw; - this.isXmssMt = isXmssMt; - } - } - - /** - * Encode a raw XMSS/XMSS^MT public key as an X.509 SubjectPublicKeyInfo - * DER, RFC 9802 form (raw key directly in the BIT STRING). - * - * @param rawPub raw XMSS public key bytes - * @param isXmssMt true to use the XMSS^MT OID, false for single-tree XMSS - * - * @return X.509 SubjectPublicKeyInfo DER - */ - static byte[] encodePublicKeyDer(byte[] rawPub, boolean isXmssMt) { - - byte[] algId; - byte[] bitString; - - if (rawPub == null || rawPub.length == 0) { - throw new IllegalArgumentException( - "raw public key cannot be null or empty"); - } - - algId = WolfCryptASN1Util.encodeDERSequence( - WolfCryptASN1Util.encodeDERObjectIdentifier( - isXmssMt ? OID_XMSSMT : OID_XMSS)); - - /* RFC 9802 form: the raw key sits directly in the BIT STRING - * (encodeDERBitString prepends the 0x00 unused-bits octet). */ - bitString = WolfCryptASN1Util.encodeDERBitString(rawPub); - - return WolfCryptASN1Util.encodeDERSequence(concat(algId, bitString)); - } - - /** - * Parse an X.509 SubjectPublicKeyInfo DER carrying an XMSS or XMSS^MT - * public key and return the raw RFC 8391 public key bytes. Accepts either - * the {@code id-alg-xmss-hashsig} or {@code id-alg-xmssmt-hashsig} OID, and - * both the RFC 9802 unwrapped form and an inner OCTET STRING wrapped form. - * - * @param x509 X.509 SubjectPublicKeyInfo DER - * - * @return parsed raw XMSS public key bytes and family - * - * @throws IllegalArgumentException if the DER is malformed or not an XMSS - * SubjectPublicKeyInfo - */ - static ParsedPub parsePublicKeyDer(byte[] x509) { - - int end; - int bsStart; - int bsEnd; - int contentStart; - boolean isXmssMt; - int[] spki, algId, oid, bitStr, oct; - - if (x509 == null || x509.length == 0) { - throw new IllegalArgumentException( - "encoded key cannot be null or empty"); - } - - /* outer SubjectPublicKeyInfo SEQUENCE, no trailing data */ - spki = readTLV(x509, 0, x509.length, TAG_SEQUENCE); - if (spki[1] != x509.length) { - throw new IllegalArgumentException( - "trailing data after SubjectPublicKeyInfo"); - } - end = spki[1]; - - /* AlgorithmIdentifier SEQUENCE { OID [, parameters] }. - * OID selects the family (XMSS vs XMSS^MT). */ - algId = readTLV(x509, spki[0], end, TAG_SEQUENCE); - oid = readTLV(x509, algId[0], algId[1], TAG_OID); - if (regionEquals(x509, oid[0], oid[1], OID_XMSS)) { - isXmssMt = false; - } - else if (regionEquals(x509, oid[0], oid[1], OID_XMSSMT)) { - isXmssMt = true; - } - else { - throw new IllegalArgumentException( - "not an XMSS/XMSS^MT AlgorithmIdentifier OID"); - } - /* RFC 9802 says parameters field is absent for XMSS/XMSS^MT, but - * also accept an explicit ASN.1 NULL. JDK X.509 re-encodes the - * AlgorithmIdentifier with a NULL parameters field when it hands a - * certificate SubjectPublicKeyInfo to this KeyFactory by OID. */ - if (oid[1] != algId[1]) { - int[] params = readTLV(x509, oid[1], algId[1], TAG_NULL); - if (params[0] != params[1] || params[1] != algId[1]) { - throw new IllegalArgumentException( - "unexpected AlgorithmIdentifier parameters"); - } - } - - /* subjectPublicKey BIT STRING, no trailing data */ - bitStr = readTLV(x509, algId[1], end, TAG_BIT_STRING); - if (bitStr[1] != end) { - throw new IllegalArgumentException( - "trailing data after subjectPublicKey"); - } - bsStart = bitStr[0]; - bsEnd = bitStr[1]; - if (bsStart >= bsEnd) { - throw new IllegalArgumentException( - "empty subjectPublicKey BIT STRING"); - } - if ((x509[bsStart] & 0xFF) != 0x00) { - throw new IllegalArgumentException( - "unexpected unused bits in subjectPublicKey"); - } - contentStart = bsStart + 1; - if (contentStart >= bsEnd) { - throw new IllegalArgumentException( - "missing public key in subjectPublicKey"); - } - - /* The raw XMSS public key always begins with a 4-byte big-endian - * parameter-set OID whose first byte is 0x00, so a leading 0x04 - * unambiguously means the key was wrapped in an inner OCTET STRING. */ - if ((x509[contentStart] & 0xFF) == TAG_OCTET_STRING) { - oct = readTLV(x509, contentStart, bsEnd, TAG_OCTET_STRING); - if (oct[1] != bsEnd) { - throw new IllegalArgumentException( - "trailing data in wrapped public key"); - } - return new ParsedPub(Arrays.copyOfRange(x509, oct[0], oct[1]), - isXmssMt); - } - - return new ParsedPub(Arrays.copyOfRange(x509, contentStart, bsEnd), - isXmssMt); - } - - /* - * Parse a definite-form DER TLV at offset 'off' within [off, limit), - * requiring the given tag. Returns {contentStart, contentEnd}. Rejects - * indefinite/non-minimal lengths and overruns. - */ - private static int[] readTLV(byte[] in, int off, int limit, int tag) { - - int lenByte, contentStart, length, numLenBytes; - - if (off + 2 > limit) { - throw new IllegalArgumentException( - "truncated TLV header"); - } - - if ((in[off] & 0xFF) != tag) { - throw new IllegalArgumentException("unexpected tag 0x" + - Integer.toHexString(in[off] & 0xFF) + ", expected 0x" + - Integer.toHexString(tag)); - } - - lenByte = in[off + 1] & 0xFF; - - if (lenByte < 0x80) { - length = lenByte; - contentStart = off + 2; - } - else { - numLenBytes = lenByte & 0x7F; - - if (numLenBytes == 0 || numLenBytes > 4) { - throw new IllegalArgumentException( - "unsupported DER length form"); - } - - if (off + 2 + numLenBytes > limit) { - throw new IllegalArgumentException( - "truncated DER length"); - } - - /* The first length octet must be non-zero, otherwise the long - * form carries redundant leading zero octets (non-minimal). */ - if (in[off + 2] == 0x00) { - throw new IllegalArgumentException( - "non-minimal DER length (leading zero)"); - } - length = 0; - - for (int i = 0; i < numLenBytes; i++) { - length = (length << 8) | (in[off + 2 + i] & 0xFF); - } - - if (length < 0x80) { - throw new IllegalArgumentException( - "non-minimal DER length"); - } - - contentStart = off + 2 + numLenBytes; - } - - /* contentStart <= limit was checked above, so limit - contentStart is - * non-negative and a crafted ~2GB long-form length cannot overflow - * the comparison. */ - if ((length < 0) || (length > limit - contentStart)) { - throw new IllegalArgumentException( - "DER length exceeds buffer"); - } - - return new int[] { contentStart, contentStart + length }; - } - - /* Compare a region of 'in' against 'expected'. */ - private static boolean regionEquals(byte[] in, int start, int end, - byte[] expected) { - - if ((end - start) != expected.length) { - return false; - } - - for (int i = 0; i < expected.length; i++) { - if (in[start + i] != expected[i]) { - return false; - } - } - - return true; - } - - /* Concatenate byte arrays. */ - private static byte[] concat(byte[]... parts) { - - ByteArrayOutputStream out = new ByteArrayOutputStream(); - for (byte[] p : parts) { - out.write(p, 0, p.length); - } - - return out.toByteArray(); - } -} diff --git a/src/main/java/com/wolfssl/provider/jce/WolfPQCJdkCompat.java b/src/main/java/com/wolfssl/provider/jce/WolfPQCJdkCompat.java index af57c4b8..01d912bd 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfPQCJdkCompat.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfPQCJdkCompat.java @@ -27,6 +27,7 @@ import com.wolfssl.wolfcrypt.MlDsa; import com.wolfssl.wolfcrypt.MlKem; +import com.wolfssl.wolfcrypt.SlhDsa; /** * JDK reflection helpers for PQC named parameter specs. @@ -71,6 +72,20 @@ final class WolfPQCJdkCompat { NPS_ML_DSA_87 = resolveNamedParameterSpec(MlDsa.ML_DSA_87); } + /* Per-parameter-set NamedParameterSpec instances for SLH-DSA, indexed by + * the native SlhDsa parameter value (0-11). The JDK ships no SLH-DSA + * predefined constants, so on JDK 11+ these are constructed as + * NamedParameterSpec(name). null on JDK 8-10. */ + private static final AlgorithmParameterSpec[] NPS_SLH_DSA = + new AlgorithmParameterSpec[12]; + + static { + for (int p = SlhDsa.SLH_DSA_SHAKE_128S; + p <= SlhDsa.SLH_DSA_SHA2_256F; p++) { + NPS_SLH_DSA[p] = resolveSlhDsaNamedParamSpec(slhDsaParamToName(p)); + } + } + private WolfPQCJdkCompat() { } /** @@ -264,4 +279,147 @@ private static AlgorithmParameterSpec resolveNamedParameterSpec( return null; } } + + /** + * Map an SLH-DSA parameter set to its canonical FIPS 205 name. + * + * @param param one of {@code SlhDsa.SLH_DSA_*} (0-11) + * + * @return canonical name like {@code "SLH-DSA-SHA2-128f"} + * + * @throws IllegalArgumentException on unknown parameter set + */ + static String slhDsaParamToName(int param) { + + switch (param) { + case SlhDsa.SLH_DSA_SHAKE_128S: + return "SLH-DSA-SHAKE-128s"; + case SlhDsa.SLH_DSA_SHAKE_128F: + return "SLH-DSA-SHAKE-128f"; + case SlhDsa.SLH_DSA_SHAKE_192S: + return "SLH-DSA-SHAKE-192s"; + case SlhDsa.SLH_DSA_SHAKE_192F: + return "SLH-DSA-SHAKE-192f"; + case SlhDsa.SLH_DSA_SHAKE_256S: + return "SLH-DSA-SHAKE-256s"; + case SlhDsa.SLH_DSA_SHAKE_256F: + return "SLH-DSA-SHAKE-256f"; + case SlhDsa.SLH_DSA_SHA2_128S: + return "SLH-DSA-SHA2-128s"; + case SlhDsa.SLH_DSA_SHA2_128F: + return "SLH-DSA-SHA2-128f"; + case SlhDsa.SLH_DSA_SHA2_192S: + return "SLH-DSA-SHA2-192s"; + case SlhDsa.SLH_DSA_SHA2_192F: + return "SLH-DSA-SHA2-192f"; + case SlhDsa.SLH_DSA_SHA2_256S: + return "SLH-DSA-SHA2-256s"; + case SlhDsa.SLH_DSA_SHA2_256F: + return "SLH-DSA-SHA2-256f"; + default: + throw new IllegalArgumentException( + "Invalid SLH-DSA parameter set: " + param); + } + } + + /** + * Map a canonical SLH-DSA parameter-set name (ie: + * {@code "SLH-DSA-SHA2-128f"}) to the corresponding {@link SlhDsa} + * parameter set constant. Comparison is case-insensitive. + * + * @param name parameter-set name + * + * @return one of {@code SlhDsa.SLH_DSA_*} (0-11) + * + * @throws IllegalArgumentException on unrecognized name + */ + static int slhDsaNameToParam(String name) { + + if (name == null) { + throw new IllegalArgumentException("name is null"); + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-128s")) { + return SlhDsa.SLH_DSA_SHAKE_128S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-128f")) { + return SlhDsa.SLH_DSA_SHAKE_128F; + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-192s")) { + return SlhDsa.SLH_DSA_SHAKE_192S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-192f")) { + return SlhDsa.SLH_DSA_SHAKE_192F; + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-256s")) { + return SlhDsa.SLH_DSA_SHAKE_256S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHAKE-256f")) { + return SlhDsa.SLH_DSA_SHAKE_256F; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-128s")) { + return SlhDsa.SLH_DSA_SHA2_128S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-128f")) { + return SlhDsa.SLH_DSA_SHA2_128F; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-192s")) { + return SlhDsa.SLH_DSA_SHA2_192S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-192f")) { + return SlhDsa.SLH_DSA_SHA2_192F; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-256s")) { + return SlhDsa.SLH_DSA_SHA2_256S; + } + if (name.equalsIgnoreCase("SLH-DSA-SHA2-256f")) { + return SlhDsa.SLH_DSA_SHA2_256F; + } + throw new IllegalArgumentException( + "Unknown SLH-DSA parameter-set name: " + name); + } + + /** + * Return the cached {@code NamedParameterSpec} for the given SLH-DSA + * parameter set, resolved once at class load. + * + * @param param one of {@code SlhDsa.SLH_DSA_*} (0-11) + * + * @return JDK {@code NamedParameterSpec} on JDK 11+, else null + * + * @throws IllegalArgumentException on unknown parameter set + */ + static AlgorithmParameterSpec slhDsaNamedParameterSpec(int param) { + + if (param < SlhDsa.SLH_DSA_SHAKE_128S || + param > SlhDsa.SLH_DSA_SHA2_256F) { + throw new IllegalArgumentException( + "Invalid SLH-DSA parameter set: " + param); + } + return NPS_SLH_DSA[param]; + } + + /** + * Resolve a {@code NamedParameterSpec} for the given SLH-DSA name via + * reflection. The JDK ships no SLH-DSA predefined constants, so this only + * uses the {@code NamedParameterSpec(String)} constructor path. + * + * @param name canonical SLH-DSA parameter-set name + * + * @return JDK {@code NamedParameterSpec} on JDK 11+, else null + */ + private static AlgorithmParameterSpec resolveSlhDsaNamedParamSpec( + String name) { + + if (NPS_CLASS == null) { + /* Class doesn't exist in JDK 8-10, no spec to return. */ + return null; + } + + try { + return (AlgorithmParameterSpec) NPS_CLASS + .getConstructor(String.class).newInstance(name); + } catch (ReflectiveOperationException e) { + return null; + } + } } diff --git a/src/main/java/com/wolfssl/provider/jce/WolfPQCParameterSpec.java b/src/main/java/com/wolfssl/provider/jce/WolfPQCParameterSpec.java index 63ea042f..77b47e5d 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfPQCParameterSpec.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfPQCParameterSpec.java @@ -35,7 +35,9 @@ * {@code Signature}/{@code KEM}/{@code KeyPairGenerator} * algorithm-name conventions used in JDK 24 (JEP 497): {@code "ML-DSA-44"}, * {@code "ML-DSA-65"}, {@code "ML-DSA-87"}, {@code "ML-KEM-512"}, - * {@code "ML-KEM-768"}, {@code "ML-KEM-1024"}. + * {@code "ML-KEM-768"}, {@code "ML-KEM-1024"}, and the FIPS 205 SLH-DSA + * parameter-set names ({@code "SLH-DSA-SHA2-128s"} ... + * {@code "SLH-DSA-SHAKE-256f"}). */ public class WolfPQCParameterSpec implements AlgorithmParameterSpec { @@ -63,6 +65,54 @@ public class WolfPQCParameterSpec implements AlgorithmParameterSpec { public static final WolfPQCParameterSpec ML_KEM_1024 = new WolfPQCParameterSpec("ML-KEM-1024"); + /** SLH-DSA-SHAKE-128s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_128S = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-128s"); + + /** SLH-DSA-SHAKE-128f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_128F = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-128f"); + + /** SLH-DSA-SHAKE-192s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_192S = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-192s"); + + /** SLH-DSA-SHAKE-192f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_192F = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-192f"); + + /** SLH-DSA-SHAKE-256s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_256S = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-256s"); + + /** SLH-DSA-SHAKE-256f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHAKE_256F = + new WolfPQCParameterSpec("SLH-DSA-SHAKE-256f"); + + /** SLH-DSA-SHA2-128s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_128S = + new WolfPQCParameterSpec("SLH-DSA-SHA2-128s"); + + /** SLH-DSA-SHA2-128f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_128F = + new WolfPQCParameterSpec("SLH-DSA-SHA2-128f"); + + /** SLH-DSA-SHA2-192s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_192S = + new WolfPQCParameterSpec("SLH-DSA-SHA2-192s"); + + /** SLH-DSA-SHA2-192f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_192F = + new WolfPQCParameterSpec("SLH-DSA-SHA2-192f"); + + /** SLH-DSA-SHA2-256s (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_256S = + new WolfPQCParameterSpec("SLH-DSA-SHA2-256s"); + + /** SLH-DSA-SHA2-256f (FIPS 205). */ + public static final WolfPQCParameterSpec SLH_DSA_SHA2_256F = + new WolfPQCParameterSpec("SLH-DSA-SHA2-256f"); + private final String name; /** diff --git a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java index adbd5502..6b835e90 100644 --- a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java +++ b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java @@ -71,6 +71,7 @@ import com.wolfssl.wolfcrypt.Aes; import com.wolfssl.wolfcrypt.FeatureDetect; import com.wolfssl.wolfcrypt.MlDsa; +import com.wolfssl.wolfcrypt.SlhDsa; import com.wolfssl.wolfcrypt.Pwdbased; import com.wolfssl.wolfcrypt.WolfCrypt; import com.wolfssl.wolfcrypt.WolfSSLCertManager; @@ -1126,6 +1127,7 @@ public Key engineGetKey(String alias, char[] password) PrivateKey pKey = null; PKCS8EncodedKeySpec p8Spec = null; KeyFactory keyFact = null; + KeyFactory retryFact = null; SecretKey sKey = null; @@ -1170,36 +1172,57 @@ public Key engineGetKey(String alias, char[] password) keyFact = KeyFactory.getInstance("RSASSA-PSS"); } else if (algoId == Asn.ECDSAk) { keyFact = WolfCryptUtil.getKeyFactoryPreferWolfJCE("EC"); - } else if (algoId != 0 && - (algoId == Asn.ML_DSA_LEVEL2k || - algoId == Asn.ML_DSA_LEVEL3k || - algoId == Asn.ML_DSA_LEVEL5k)) { + } else if (isMlDsaAlgoId(algoId)) { keyFact = getMlDsaKeyFactory(); - } else if (algoId == 0 && FeatureDetect.MlDsaEnabled()) { + } else if (isSlhDsaAlgoId(algoId)) { + keyFact = getSlhDsaKeyFactory(); + } else if (algoId == 0 && (FeatureDetect.MlDsaEnabled() || + FeatureDetect.SlhDsaEnabled())) { /* Fallback for older native wolfSSL, getPkcs8AlgoID * returned 0 because native ToTraditional_ex() did not - * recognize ML-DSA OIDs. Let the ML-DSA KeyFactory - * validate, generatePrivate() below throws for - * non-ML-DSA DER (avoids a redundant pre-parse of - * the same PKCS#8). */ - log("using ML-DSA fallback for older native wolfSSL"); - keyFact = getMlDsaKeyFactory(); + * recognize ML-DSA or SLH-DSA OIDs. Let the PQC KeyFactory + * validate, generatePrivate() below throws for non-matching + * DER (avoids a redundant pre-parse of the same PKCS#8). + * Try ML-DSA first, then retry with SLH-DSA below if that + * rejects the encoding. */ + log("using PQC KeyFactory fallback for older " + + "native wolfSSL"); + if (FeatureDetect.MlDsaEnabled()) { + keyFact = getMlDsaKeyFactory(); + if (FeatureDetect.SlhDsaEnabled()) { + retryFact = getSlhDsaKeyFactory(); + } + } else { + keyFact = getSlhDsaKeyFactory(); + } } else { throw new NoSuchAlgorithmException( - "Only RSA, RSASSA-PSS, EC, and ML-DSA private " + - "key encoding supported: " + algoId); + "Only RSA, RSASSA-PSS, EC, ML-DSA, and SLH-DSA " + + "private key encoding supported: " + algoId); } try { pKey = keyFact.generatePrivate(p8Spec); - if (pKey == null) { - throw new UnrecoverableKeyException( - "Error generating PrivateKey from " + - "PKCS8EncodedKeySpec"); - } } catch (InvalidKeySpecException e) { + if (retryFact == null) { + throw newUnrecoverableKeyException( + "Invalid key spec for KeyFactory", e); + } + /* ML-DSA KeyFactory rejected DER, try SLH-DSA */ + try { + pKey = retryFact.generatePrivate(p8Spec); + } catch (InvalidKeySpecException e2) { + /* Keep the ML-DSA rejection visible alongside the + * SLH-DSA one from the retry */ + e2.addSuppressed(e); + throw newUnrecoverableKeyException( + "Invalid key spec for KeyFactory", e2); + } + } + if (pKey == null) { throw new UnrecoverableKeyException( - "Invalid key spec for KeyFactory"); + "Error generating PrivateKey from " + + "PKCS8EncodedKeySpec"); } } else if (entry instanceof WKSSecretKey) { @@ -1497,6 +1520,13 @@ private void checkCertificateChainMatchesPrivateKey( "trying Java-side match"); match = mlDsaCertMatchesPrivateKey(cert, pkcs8Key); } + if (!match && isSlhDsaAlgorithmName(key.getAlgorithm())) { + /* Native X509CheckPrivateKey() / EVP_PKCS82PKEY() cannot + * handle SLH-DSA, fall back to a Java-side match. */ + log("X509CheckPrivateKey returned false for SLH-DSA key, " + + "trying Java-side match"); + match = slhDsaCertMatchesPrivateKey(cert, pkcs8Key); + } if (!match) { throw new KeyStoreException("X509Certificate does not match " + "provided private key"); @@ -1623,6 +1653,189 @@ private static KeyFactory getMlDsaKeyFactory() } } + /** + * Java fallback for cert/private key match when native wolfSSL + * {@code X509CheckPrivateKey} can't handle SLH-DSA. + * + *Imports the PKCS#8 private into a wolfJCE SlhDsa, exports the derived + * public as X.509 SubjectPublicKeyInfo DER, and compares bytes against the + * cert's public key encoding. SLH-DSA SPKI DER is canonical, so byte + * equality is safe.
+ * + * @param cert the X.509 certificate to match + * @param pkcs8Key the PKCS#8-encoded SLH-DSA private key + * + * @return true if the cert's public key matches the private key + */ + private boolean slhDsaCertMatchesPrivateKey(X509Certificate cert, + byte[] pkcs8Key) { + + PublicKey certPub = null; + SlhDsa key = null; + byte[] certSpki = null; + byte[] derivedSpki = null; + + if (!FeatureDetect.SlhDsaEnabled()) { + return false; + } + + certPub = cert.getPublicKey(); + if (certPub == null || !isSlhDsaAlgorithmName(certPub.getAlgorithm())) { + return false; + } + + certSpki = certPub.getEncoded(); + if (certSpki == null) { + return false; + } + + /* Remove NULL AlgorithmIdentifier (JDK re-encoding) if present */ + certSpki = WolfCryptSpkiUtil.stripNullAlgIdParams(certSpki); + + try { + /* Parameter set auto-detected from the PKCS#8 OID. */ + key = new SlhDsa(); + key.importPrivateKeyDer(pkcs8Key); + derivedSpki = key.exportPublicKeyDer(true); + + return Arrays.equals(certSpki, derivedSpki); + } + catch (WolfCryptException e) { + return false; + } + finally { + if (key != null) { + key.releaseNativeStruct(); + } + } + } + + /** + * Check if a JCA algorithm name identifies SLH-DSA. + * + * Accepts the generic name, the FIPS 205 parameter-set names, and the + * raw OID strings that CertificateFactory implementations may return + * from getAlgorithm() for algorithms they do not recognize. + * + * @param algo algorithm name from Key.getAlgorithm(), may be null + * + * @return true if the name identifies an SLH-DSA key, otherwise false + */ + private static boolean isSlhDsaAlgorithmName(String algo) { + + if (algo == null) { + return false; + } + + if (algo.equalsIgnoreCase("SLH-DSA")) { + return true; + } + + /* Per-set names SLH-DSA-SHA2-* and SLH-DSA-SHAKE-*. */ + if (algo.regionMatches(true, 0, "SLH-DSA-", 0, 8)) { + return true; + } + + /* OID aliases 2.16.840.1.101.3.4.3.20 - .31. */ + if (algo.startsWith("2.16.840.1.101.3.4.3.")) { + try { + int last = Integer.parseInt( + algo.substring("2.16.840.1.101.3.4.3.".length())); + return last >= 20 && last <= 31; + } catch (NumberFormatException e) { + return false; + } + } + + return false; + } + + /** + * Get a KeyFactory for SLH-DSA, preferring the wolfJCE provider. + * + * @return KeyFactory for SLH-DSA + * + * @throws NoSuchAlgorithmException if no provider supports SLH-DSA + */ + private static KeyFactory getSlhDsaKeyFactory() + throws NoSuchAlgorithmException { + + try { + return KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + } catch (NoSuchProviderException | NoSuchAlgorithmException e) { + /* wolfJCE not registered by name (or built without SLH-DSA) */ + return KeyFactory.getInstance("SLH-DSA"); + } + } + + /** + * Create an UnrecoverableKeyException with a cause attached. + * UnrecoverableKeyException has no (String, Throwable) constructor, + * so the cause is chained via initCause(). + * + * @param msg exception message + * @param cause underlying exception to preserve + * + * @return new UnrecoverableKeyException with cause set + */ + private static UnrecoverableKeyException newUnrecoverableKeyException( + String msg, Throwable cause) { + + UnrecoverableKeyException e = new UnrecoverableKeyException(msg); + e.initCause(cause); + return e; + } + + /** + * Return true if the given native Key_Sum (the PKCS#8 AlgorithmIdentifier + * OID sum returned by Asn.getPkcs8AlgoID()) identifies one of the three + * FIPS 204 ML-DSA parameter sets. + * + * The algoId != 0 guard matters: on a native build without ML-DSA the + * Asn.ML_DSA_LEVEL*k constants resolve to 0, so an unrelated key whose + * algoId is 0 must not be misidentified as ML-DSA. + * + * @param algoId native Key_Sum value from Asn.getPkcs8AlgoID() + * + * @return true if algoId is one of the ML-DSA parameter-set OID sums + */ + private static boolean isMlDsaAlgoId(int algoId) { + return algoId != 0 && + (algoId == Asn.ML_DSA_LEVEL2k || + algoId == Asn.ML_DSA_LEVEL3k || + algoId == Asn.ML_DSA_LEVEL5k); + } + + /** + * Return true if the given native Key_Sum (the PKCS#8 AlgorithmIdentifier + * OID sum returned by Asn.getPkcs8AlgoID()) identifies one of the FIPS 205 + * SLH-DSA parameter sets. + * + * On a native build without SLH-DSA Asn.SLH_DSA_*k constants resolve to 0, + * so an unrelated key whose algoId is 0 must not be misidentified as + * SLH-DSA. + * + * @param algoId native Key_Sum value from Asn.getPkcs8AlgoID() + * + * @return true if algoId is one of the SLH-DSA parameter-set OID sums + */ + private static boolean isSlhDsaAlgoId(int algoId) { + + return algoId != 0 && + (algoId == Asn.SLH_DSA_SHA2_128Sk || + algoId == Asn.SLH_DSA_SHA2_128Fk || + algoId == Asn.SLH_DSA_SHA2_192Sk || + algoId == Asn.SLH_DSA_SHA2_192Fk || + algoId == Asn.SLH_DSA_SHA2_256Sk || + algoId == Asn.SLH_DSA_SHA2_256Fk || + algoId == Asn.SLH_DSA_SHAKE_128Sk || + algoId == Asn.SLH_DSA_SHAKE_128Fk || + algoId == Asn.SLH_DSA_SHAKE_192Sk || + algoId == Asn.SLH_DSA_SHAKE_192Fk || + algoId == Asn.SLH_DSA_SHAKE_256Sk || + algoId == Asn.SLH_DSA_SHAKE_256Fk); + } + /** * Assign the given key to an alias and protects it using the * provided password. diff --git a/src/main/java/com/wolfssl/wolfcrypt/Asn.java b/src/main/java/com/wolfssl/wolfcrypt/Asn.java index f816a790..a90a89cb 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/Asn.java +++ b/src/main/java/com/wolfssl/wolfcrypt/Asn.java @@ -58,6 +58,42 @@ public Asn() { /** ML-DSA-87 (FIPS 204) key value, from oid_sum.h Key_Sum enum. * OID 2.16.840.1.101.3.4.3.19. */ public static final int ML_DSA_LEVEL5k; + /** SLH-DSA-SHA2-128s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.20. */ + public static final int SLH_DSA_SHA2_128Sk; + /** SLH-DSA-SHA2-128f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.21. */ + public static final int SLH_DSA_SHA2_128Fk; + /** SLH-DSA-SHA2-192s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.22. */ + public static final int SLH_DSA_SHA2_192Sk; + /** SLH-DSA-SHA2-192f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.23. */ + public static final int SLH_DSA_SHA2_192Fk; + /** SLH-DSA-SHA2-256s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.24. */ + public static final int SLH_DSA_SHA2_256Sk; + /** SLH-DSA-SHA2-256f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.25. */ + public static final int SLH_DSA_SHA2_256Fk; + /** SLH-DSA-SHAKE-128s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.26. */ + public static final int SLH_DSA_SHAKE_128Sk; + /** SLH-DSA-SHAKE-128f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.27. */ + public static final int SLH_DSA_SHAKE_128Fk; + /** SLH-DSA-SHAKE-192s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.28. */ + public static final int SLH_DSA_SHAKE_192Sk; + /** SLH-DSA-SHAKE-192f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.29. */ + public static final int SLH_DSA_SHAKE_192Fk; + /** SLH-DSA-SHAKE-256s (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.30. */ + public static final int SLH_DSA_SHAKE_256Sk; + /** SLH-DSA-SHAKE-256f (FIPS 205) key value, from oid_sum.h Key_Sum enum. + * OID 2.16.840.1.101.3.4.3.31. */ + public static final int SLH_DSA_SHAKE_256Fk; /* Hash Sum values, from oid_sum.h Hash_Sum enum */ @@ -91,6 +127,18 @@ public Asn() { ML_DSA_LEVEL2k = getML_DSA_LEVEL2k(); ML_DSA_LEVEL3k = getML_DSA_LEVEL3k(); ML_DSA_LEVEL5k = getML_DSA_LEVEL5k(); + SLH_DSA_SHA2_128Sk = getSLH_DSA_SHA2_128Sk(); + SLH_DSA_SHA2_128Fk = getSLH_DSA_SHA2_128Fk(); + SLH_DSA_SHA2_192Sk = getSLH_DSA_SHA2_192Sk(); + SLH_DSA_SHA2_192Fk = getSLH_DSA_SHA2_192Fk(); + SLH_DSA_SHA2_256Sk = getSLH_DSA_SHA2_256Sk(); + SLH_DSA_SHA2_256Fk = getSLH_DSA_SHA2_256Fk(); + SLH_DSA_SHAKE_128Sk = getSLH_DSA_SHAKE_128Sk(); + SLH_DSA_SHAKE_128Fk = getSLH_DSA_SHAKE_128Fk(); + SLH_DSA_SHAKE_192Sk = getSLH_DSA_SHAKE_192Sk(); + SLH_DSA_SHAKE_192Fk = getSLH_DSA_SHAKE_192Fk(); + SLH_DSA_SHAKE_256Sk = getSLH_DSA_SHAKE_256Sk(); + SLH_DSA_SHAKE_256Fk = getSLH_DSA_SHAKE_256Fk(); MD5h = getMD5h(); SHAh = getSHAh(); @@ -128,6 +176,42 @@ public Asn() { /** Return value of native ML_DSA_LEVEL5k enum */ private static native int getML_DSA_LEVEL5k(); + /** Return value of native SLH_DSA_SHA2_128Sk enum */ + private static native int getSLH_DSA_SHA2_128Sk(); + + /** Return value of native SLH_DSA_SHA2_128Fk enum */ + private static native int getSLH_DSA_SHA2_128Fk(); + + /** Return value of native SLH_DSA_SHA2_192Sk enum */ + private static native int getSLH_DSA_SHA2_192Sk(); + + /** Return value of native SLH_DSA_SHA2_192Fk enum */ + private static native int getSLH_DSA_SHA2_192Fk(); + + /** Return value of native SLH_DSA_SHA2_256Sk enum */ + private static native int getSLH_DSA_SHA2_256Sk(); + + /** Return value of native SLH_DSA_SHA2_256Fk enum */ + private static native int getSLH_DSA_SHA2_256Fk(); + + /** Return value of native SLH_DSA_SHAKE_128Sk enum */ + private static native int getSLH_DSA_SHAKE_128Sk(); + + /** Return value of native SLH_DSA_SHAKE_128Fk enum */ + private static native int getSLH_DSA_SHAKE_128Fk(); + + /** Return value of native SLH_DSA_SHAKE_192Sk enum */ + private static native int getSLH_DSA_SHAKE_192Sk(); + + /** Return value of native SLH_DSA_SHAKE_192Fk enum */ + private static native int getSLH_DSA_SHAKE_192Fk(); + + /** Return value of native SLH_DSA_SHAKE_256Sk enum */ + private static native int getSLH_DSA_SHAKE_256Sk(); + + /** Return value of native SLH_DSA_SHAKE_256Fk enum */ + private static native int getSLH_DSA_SHAKE_256Fk(); + /** Return value of native MD5h enum */ private static native int getMD5h(); diff --git a/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java b/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java index c9d7baf9..ba4e17cb 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java +++ b/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java @@ -408,6 +408,16 @@ public class FeatureDetect { */ public static native boolean SlhDsaEnabled(); + /** + * Tests if SLH-DSA (FIPS 205) key generation and signing are compiled + * into the native wolfSSL library. False on verify-only native builds. + * + * @return true if enabled (WOLFSSL_HAVE_SLHDSA without + * WOLFSSL_SLHDSA_VERIFY_ONLY), otherwise false if not + * compiled in. + */ + public static native boolean SlhDsaKeyGenEnabled(); + /** * Tests if LMS/HSS (RFC 8554) is compiled into the native wolfSSL * library. diff --git a/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java b/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java new file mode 100644 index 00000000..0e90ad14 --- /dev/null +++ b/src/main/java/com/wolfssl/wolfcrypt/SlhDsa.java @@ -0,0 +1,1092 @@ +/* SlhDsa.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.wolfcrypt; + +/** + * Wrapper for the native WolfCrypt SLH-DSA (FIPS 205) implementation. + * + *Mirrors the native wolfCrypt {@code wc_SlhDsaKey_*} API. SLH-DSA is a + * stateless hash-based signature scheme (formerly SPHINCS+). The parameter + * set is fixed at construction and maps directly to the native + * {@code enum SlhDsaParam} integer value. An empty FIPS 205 context is used + * by default.
+ * + *Parameter set constants match the native {@code enum SlhDsaParam}: the + * six SHAKE sets are 0-5, the six SHA2 sets are 6-11. Note this ordering is + * the reverse of the NIST OID ordering (SHA2 OIDs come before SHAKE).
+ */ +public class SlhDsa extends NativeStruct { + + /** SLH-DSA-SHAKE-128s parameter set, NIST security category 1. */ + public static final int SLH_DSA_SHAKE_128S = 0; + + /** SLH-DSA-SHAKE-128f parameter set, NIST security category 1. */ + public static final int SLH_DSA_SHAKE_128F = 1; + + /** SLH-DSA-SHAKE-192s parameter set, NIST security category 3. */ + public static final int SLH_DSA_SHAKE_192S = 2; + + /** SLH-DSA-SHAKE-192f parameter set, NIST security category 3. */ + public static final int SLH_DSA_SHAKE_192F = 3; + + /** SLH-DSA-SHAKE-256s parameter set, NIST security category 5. */ + public static final int SLH_DSA_SHAKE_256S = 4; + + /** SLH-DSA-SHAKE-256f parameter set, NIST security category 5. */ + public static final int SLH_DSA_SHAKE_256F = 5; + + /** SLH-DSA-SHA2-128s parameter set, NIST security category 1. */ + public static final int SLH_DSA_SHA2_128S = 6; + + /** SLH-DSA-SHA2-128f parameter set, NIST security category 1. */ + public static final int SLH_DSA_SHA2_128F = 7; + + /** SLH-DSA-SHA2-192s parameter set, NIST security category 3. */ + public static final int SLH_DSA_SHA2_192S = 8; + + /** SLH-DSA-SHA2-192f parameter set, NIST security category 3. */ + public static final int SLH_DSA_SHA2_192F = 9; + + /** SLH-DSA-SHA2-256s parameter set, NIST security category 5. */ + public static final int SLH_DSA_SHA2_256S = 10; + + /** SLH-DSA-SHA2-256f parameter set, NIST security category 5. */ + public static final int SLH_DSA_SHA2_256F = 11; + + /** FIPS 205 maximum context length, in bytes. */ + public static final int SLH_DSA_MAX_CONTEXT_LEN = 255; + + /* Lowest and highest valid native enum SlhDsaParam values. */ + private static final int PARAM_MIN = 0; + private static final int PARAM_MAX = 11; + + /* Used by no-arg constructor before DER import detects the param set. */ + private static final int PARAM_UNSET = -1; + + private WolfCryptState state = WolfCryptState.UNINITIALIZED; + + /** Lock around object state. */ + protected final Object stateLock = new Object(); + + /** SLH-DSA parameter set. Volatile so {@link #getParam()} sees the latest + * value after the auto-detect refresh inside the DER import paths. */ + private volatile int param; + + /** + * Create a new SLH-DSA object for the given parameter set. + * + * @param param one of the {@code SLH_DSA_*} parameter set constants + * (0-11, matching native {@code enum SlhDsaParam}). + * + * @throws WolfCryptException if SLH-DSA is not compiled into native + * wolfCrypt or {@code param} is not a valid parameter set. + */ + public SlhDsa(int param) throws WolfCryptException { + + if (!FeatureDetect.SlhDsaEnabled()) { + throw new WolfCryptException( + WolfCryptError.NOT_COMPILED_IN.getCode()); + } + + if (param < PARAM_MIN || param > PARAM_MAX) { + throw new WolfCryptException(WolfCryptError.BAD_FUNC_ARG.getCode()); + } + + this.param = param; + /* Native struct lazy init in checkStateAndInitialize() */ + } + + /** + * Create a new SLH-DSA object with the parameter set deferred. The + * parameter set is auto-detected on the first + * {@link #importPublicKeyDer(byte[])} or + * {@link #importPrivateKeyDer(byte[])} call from the AlgorithmIdentifier + * OID. + * + *Cannot be used with {@link #makeKey(Rng)}, + * {@link #importPublicKey(byte[])}, or {@link #importPrivateKey(byte[])}. + * Those paths require the parameter set to be set up front, since raw key + * bytes do not carry it (and several sets share the same byte sizes).
+ * + * @throws WolfCryptException if SLH-DSA not compiled into native wolfCrypt. + */ + public SlhDsa() throws WolfCryptException { + + if (!FeatureDetect.SlhDsaEnabled()) { + throw new WolfCryptException( + WolfCryptError.NOT_COMPILED_IN.getCode()); + } + + this.param = PARAM_UNSET; + /* Native struct lazy init in checkStateAndInitialize(). Parameter set + * is detected later by DER import. */ + } + + @Override + public void releaseNativeStruct() { + synchronized (stateLock) { + if ((state != WolfCryptState.UNINITIALIZED) && + (state != WolfCryptState.RELEASED)) { + + synchronized (pointerLock) { + wc_SlhDsaKey_free(); + } + super.releaseNativeStruct(); + state = WolfCryptState.RELEASED; + } + } + } + + /** + * Allocate native SlhDsaKey struct. + * + * @return native allocated pointer + * + * @throws OutOfMemoryError when malloc fails + */ + protected native long mallocNativeStruct() throws OutOfMemoryError; + + private native void wc_SlhDsaKey_init(int param); + private native void wc_SlhDsaKey_free(); + private native int wc_SlhDsaKey_get_param(); + private native void wc_SlhDsaKey_make_key(Rng rng); + private native void wc_SlhDsaKey_make_key_with_seeds(byte[] skSeed, + byte[] skPrf, byte[] pkSeed); + private native byte[] wc_SlhDsaKey_sign(byte[] ctx, byte[] msg, Rng rng); + private native byte[] wc_SlhDsaKey_sign_deterministic(byte[] ctx, + byte[] msg); + private native byte[] wc_SlhDsaKey_sign_hash(byte[] ctx, int hashAlg, + byte[] hash, Rng rng); + private native byte[] wc_SlhDsaKey_sign_msg_prehash(byte[] ctx, byte[] msg, + Rng rng); + private native boolean wc_SlhDsaKey_verify(byte[] sig, byte[] ctx, + byte[] msg); + private native boolean wc_SlhDsaKey_verify_hash(byte[] sig, byte[] ctx, + int hashAlg, byte[] hash); + private native boolean wc_SlhDsaKey_verify_msg_prehash(byte[] sig, + byte[] ctx, byte[] msg); + private native byte[] wc_SlhDsaKey_export_public(); + private native byte[] wc_SlhDsaKey_export_private(); + private native void wc_SlhDsaKey_import_public(byte[] in); + private native void wc_SlhDsaKey_import_private(byte[] in); + private native byte[] wc_SlhDsaKey_PublicKeyToDer(boolean withAlg); + private native byte[] wc_SlhDsaKey_KeyToDer(); + private native void wc_SlhDsaKey_PublicKeyDecode(byte[] der); + private native void wc_SlhDsaKey_PrivateKeyDecode(byte[] der); + private native int wc_SlhDsaKey_pub_size(); + private native int wc_SlhDsaKey_priv_size(); + private native int wc_SlhDsaKey_sig_size(); + private native void wc_SlhDsaKey_check_key(); + + /** + * Allocate, initialize, and set the parameter set. State advances + * UNINITIALIZED to INITIALIZED on success. + * + * @throws IllegalStateException if releaseNativeStruct() has been called + * or initialization fails + */ + private synchronized void checkStateAndInitialize() + throws IllegalStateException { + + synchronized (stateLock) { + if (state == WolfCryptState.RELEASED) { + throw new IllegalStateException("Object has been released"); + } + + if (state == WolfCryptState.UNINITIALIZED) { + synchronized (pointerLock) { + initNativeStruct(); + try { + if (this.param != PARAM_UNSET) { + wc_SlhDsaKey_init(this.param); + } + else { + /* No-arg object, init placeholder. Real set is + * detected later from DER import. */ + initDeferredPlaceholder(); + } + } catch (WolfCryptException e) { + /* Init failed for every candidate parameter set. + * The struct was already allocated, free it since + * state stays UNINITIALIZED and releaseNativeStruct() + * would otherwise skip it. */ + super.releaseNativeStruct(); + throw e; + } + } + state = WolfCryptState.INITIALIZED; + } + } + } + + /** + * Native initialize the already allocated struct with the first + * compiled-in parameter set, for a deferred (no-arg) object whose real + * parameter set is detected later from DER import OID. Caller holds + * pointerLock. The native struct is reused across attempts. Native Init + * validates the parameter set before touching the struct, so retrying a + * different set after a failure is safe. + * + * @throws WolfCryptException if no parameter set is compiled in + */ + private void initDeferredPlaceholder() throws WolfCryptException { + + WolfCryptException lastErr = null; + + for (int p = PARAM_MIN; p <= PARAM_MAX; p++) { + try { + wc_SlhDsaKey_init(p); + return; + + } catch (WolfCryptException e) { + lastErr = e; + } + } + + if (lastErr != null) { + throw lastErr; + } + + throw new WolfCryptException(WolfCryptError.NOT_COMPILED_IN.getCode()); + } + + /** + * Throw exception if this object already has a key loaded. + * + * @throws IllegalStateException if state is READY (key loaded) + */ + private void throwIfKeyExists() throws IllegalStateException { + + synchronized (stateLock) { + if (state == WolfCryptState.READY) { + throw new IllegalStateException("Object already has a key"); + } + } + } + + /** + * Throw exception if this object does not have a key loaded. + * + * @throws IllegalStateException if state is not READY (no key loaded) + */ + private void throwIfKeyNotLoaded() throws IllegalStateException { + + synchronized (stateLock) { + if (state != WolfCryptState.READY) { + throw new IllegalStateException( + "No key available to perform the operation"); + } + } + } + + /** + * Reject operations that require the parameter set up front (raw imports, + * keygen) when this object was created via the no-arg constructor and has + * not yet auto-detected via a DER import. + * + * @throws WolfCryptException if the parameter set is not set + */ + private void requireParamSet() throws WolfCryptException { + + if (this.param == PARAM_UNSET) { + throw new WolfCryptException( + WolfCryptError.BAD_FUNC_ARG.getCode()); + } + } + + /** + * Throw exception if FIPS 205 context exceeds maximum length. + * + * @param ctx context bytes, may be null + * + * @throws IllegalArgumentException if ctx length exceeds 255 + */ + private static void checkCtxLength(byte[] ctx) + throws IllegalArgumentException { + + if (ctx != null && ctx.length > SLH_DSA_MAX_CONTEXT_LEN) { + throw new IllegalArgumentException( + "SLH-DSA context length exceeds 255 bytes"); + } + } + + /** + * Get the security parameter n, in bytes, for an SLH-DSA parameter set. + * + * @param param SLH-DSA parameter set (0-11) + * + * @return n in bytes (16, 24, or 32) + * + * @throws WolfCryptException if {@code param} is not a valid parameter + * set (including {@code -1} from {@link #getParam()} on a no-arg + * object before DER import) + */ + public static int paramToN(int param) throws WolfCryptException { + + if (param < PARAM_MIN || param > PARAM_MAX) { + throw new WolfCryptException(WolfCryptError.BAD_FUNC_ARG.getCode()); + } + + /* Both the SHAKE (0-5) and SHA2 (6-11) blocks order the sets as + * 128s,128f,192s,192f,256s,256f, so (param % 6) / 2 gives the + * category index 0=128, 1=192, 2=256 and n = 16 + 8 * index. */ + return 16 + 8 * ((param % 6) / 2); + } + + /** + * Get the parameter set selected for this object. + * + * @return one of the {@code SLH_DSA_*} constants (0-11), or {@code -1} if + * the no-arg constructor was used and no DER has been imported yet. + */ + public int getParam() { + return this.param; + } + + /** + * Generate an SLH-DSA key pair for this object's parameter set. + * + * @param rng initialized {@link Rng} + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if a key has already been loaded or the + * object has been released + */ + public void makeKey(Rng rng) + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_make_key(rng); + } + state = WolfCryptState.READY; + } + } + + /** + * Generate an SLH-DSA key pair deterministically from the three secret + * seeds, implements FIPS 205 SLH-DSA.KeyGen_internal. Mainly useful for + * known answer tests, general key generation should use + * {@link #makeKey(Rng)}. + * + * @param skSeed SK.seed value, must be {@code paramToN(param)} bytes + * @param skPrf SK.prf value, must be {@code paramToN(param)} bytes + * @param pkSeed PK.seed value, must be {@code paramToN(param)} bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if any seed is null or not the expected + * length + * @throws IllegalStateException if a key has already been loaded or the + * object has been released + */ + public void makeKeyWithSeeds(byte[] skSeed, byte[] skPrf, byte[] pkSeed) + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + + int n = paramToN(this.param); + if (skSeed == null || skSeed.length != n || + skPrf == null || skPrf.length != n || + pkSeed == null || pkSeed.length != n) { + throw new IllegalArgumentException( + "SLH-DSA keygen seeds must each be " + n + " bytes"); + } + + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_make_key_with_seeds(skSeed, skPrf, pkSeed); + } + state = WolfCryptState.READY; + } + } + + /** + * Sign {@code msg} with an empty FIPS 205 context. + * + * @param msg message to sign (may be empty, must not be null) + * @param rng initialized {@link Rng} + * + * @return signature bytes, length matches {@link #signatureSize()} + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] sign(byte[] msg, Rng rng) + throws WolfCryptException, IllegalStateException { + + return sign(msg, null, rng); + } + + /** + * Sign {@code msg} with the given FIPS 205 context. + * + * @param msg message to sign (may be empty, must not be null) + * @param ctx context bytes (may be null or empty for an empty context; + * length must be 0..255 per FIPS 205) + * @param rng initialized {@link Rng} + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] sign(byte[] msg, byte[] ctx, Rng rng) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_sign(ctx, msg, rng); + } + } + + /** + * Sign {@code msg} deterministically with the given FIPS 205 context. + * Mainly useful for known answer tests, general signing should use + * {@link #sign(byte[], byte[], Rng)}. + * + * @param msg message to sign (may be empty, must not be null) + * @param ctx context bytes (may be null or empty for an empty context; + * length must be 0..255 per FIPS 205) + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] signDeterministic(byte[] msg, byte[] ctx) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_sign_deterministic(ctx, msg); + } + } + + /** + * Sign a message digest with an empty FIPS 205 context, implements + * HashSLH-DSA (pre-hash variant) from FIPS 205 Section 10.2.2. + * + * @param hash digest of the message to sign + * @param hashAlg hash algorithm used to compute {@code hash}, one of the + * {@code WolfCrypt.WC_HASH_TYPE_*} values + * @param rng initialized {@link Rng} + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] signHash(byte[] hash, int hashAlg, Rng rng) + throws WolfCryptException, IllegalStateException { + + return signHash(hash, hashAlg, null, rng); + } + + /** + * Sign a message digest with the given FIPS 205 context, implements + * HashSLH-DSA (pre-hash variant) from FIPS 205 Section 10.2.2. + * + * @param hash digest of the message to sign + * @param hashAlg hash algorithm used to compute {@code hash}, one of the + * {@code WolfCrypt.WC_HASH_TYPE_*} values + * @param ctx context bytes (may be null or empty for an empty context; + * length must be 0..255 per FIPS 205) + * @param rng initialized {@link Rng} + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] signHash(byte[] hash, int hashAlg, byte[] ctx, Rng rng) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_sign_hash(ctx, hashAlg, hash, rng); + } + } + + /** + * Verify {@code sig} over {@code msg} with an empty context. + * + * @param sig signature to verify + * @param msg message bytes + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verify(byte[] sig, byte[] msg) + throws WolfCryptException, IllegalStateException { + + return verify(sig, msg, null); + } + + /** + * Verify {@code sig} over {@code msg} with the given context. + * + * @param sig signature to verify + * @param msg message bytes + * @param ctx context bytes (may be null or empty; length 0..255) + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verify(byte[] sig, byte[] msg, byte[] ctx) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_verify(sig, ctx, msg); + } + } + + /** + * Sign {@code msg} using HashSLH-DSA (pre-hash variant) from FIPS 205 + * Section 10.2.2 with an empty context. + * + *The message is hashed with the parameter set's standardized pre-hash + * function (SHA-256 for SHA2-128, SHA-512 for SHA2-192/256, SHAKE128 for + * SHAKE-128, SHAKE256 for SHAKE-192/256) and the resulting digest is signed + * as HashSLH-DSA. The hashing is performed natively.
+ * + * @param msg message to sign (may be empty, must not be null) + * @param rng initialized {@link Rng} + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] signPreHash(byte[] msg, Rng rng) + throws WolfCryptException, IllegalStateException { + + return signPreHash(msg, null, rng); + } + + /** + * Sign {@code msg} using HashSLH-DSA (pre-hash variant) from FIPS 205 + * Section 10.2.2 with the given context. + * + *The message is hashed with the parameter set's standardized pre-hash + * function and the resulting digest is signed as HashSLH-DSA. The hashing + * is performed natively.
+ * + * @param msg message to sign (may be empty, must not be null) + * @param ctx context bytes (may be null or empty for an empty context; + * length must be 0..255 per FIPS 205) + * @param rng initialized {@link Rng} + * + * @return signature bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] signPreHash(byte[] msg, byte[] ctx, Rng rng) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_sign_msg_prehash(ctx, msg, rng); + } + } + + /** + * Verify {@code sig} over {@code msg} using HashSLH-DSA (pre-hash variant) + * from FIPS 205 Section 10.2.2 with an empty context. + * + * @param sig signature to verify + * @param msg message bytes + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verifyPreHash(byte[] sig, byte[] msg) + throws WolfCryptException, IllegalStateException { + + return verifyPreHash(sig, msg, null); + } + + /** + * Verify {@code sig} over {@code msg} using HashSLH-DSA (pre-hash variant) + * from FIPS 205 Section 10.2.2 with the given context. + * + * @param sig signature to verify + * @param msg message bytes + * @param ctx context bytes (may be null or empty; length 0..255) + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verifyPreHash(byte[] sig, byte[] msg, byte[] ctx) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_verify_msg_prehash(sig, ctx, msg); + } + } + + /** + * Verify {@code sig} over a message digest with an empty context, + * implements HashSLH-DSA (pre-hash variant) from FIPS 205 Section 10.2.2. + * + * @param sig signature to verify + * @param hash digest of the message that was signed + * @param hashAlg hash algorithm used to compute {@code hash}, one of the + * {@code WolfCrypt.WC_HASH_TYPE_*} values + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verifyHash(byte[] sig, byte[] hash, int hashAlg) + throws WolfCryptException, IllegalStateException { + + return verifyHash(sig, hash, hashAlg, null); + } + + /** + * Verify {@code sig} over a message digest with the given context, + * implements HashSLH-DSA (pre-hash variant) from FIPS 205 Section 10.2.2. + * + * @param sig signature to verify + * @param hash digest of the message that was signed + * @param hashAlg hash algorithm used to compute {@code hash}, one of the + * {@code WolfCrypt.WC_HASH_TYPE_*} values + * @param ctx context bytes (may be null or empty; length 0..255) + * + * @return true if signature verifies, false otherwise + * + * @throws WolfCryptException if native operation fails + * @throws IllegalArgumentException if {@code ctx} length exceeds 255 + * @throws IllegalStateException if no key is loaded or object released + */ + public boolean verifyHash(byte[] sig, byte[] hash, int hashAlg, byte[] ctx) + throws WolfCryptException, IllegalStateException { + + checkCtxLength(ctx); + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_verify_hash(sig, ctx, hashAlg, hash); + } + } + + /** + * Export raw public key bytes for this object's SLH-DSA parameter set. + * + * @return public key as a byte array (2n bytes) + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] exportPublicKey() + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_export_public(); + } + } + + /** + * Export raw private key bytes for this object's SLH-DSA parameter set. + * + * @return private key as a byte array (4n bytes) + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] exportPrivateKey() + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_export_private(); + } + } + + /** + * Import a raw SLH-DSA public key matching this object's parameter set. + * + * @param in raw public key bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if a key is already loaded or object + * released + */ + public void importPublicKey(byte[] in) + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_import_public(in); + } + state = WolfCryptState.READY; + } + } + + /** + * Import a raw SLH-DSA private key matching this object's parameter set. + * + * @param in raw private key bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if a key is already loaded or object + * released + */ + public void importPrivateKey(byte[] in) + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_import_private(in); + } + state = WolfCryptState.READY; + } + } + + /** + * Check that the loaded private and public key halves form a consistent + * SLH-DSA key pair. + * + * @throws WolfCryptException if the key pair is inconsistent or the native + * operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public void checkKey() + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + wc_SlhDsaKey_check_key(); + } + } + + /** + * Export public key as DER, optionally wrapped in a SubjectPublicKeyInfo + * AlgorithmIdentifier (X.509 SPKI). + * + * @param withAlg if true, output is X.509 SubjectPublicKeyInfo; if false, + * output is the raw key DER without the AlgorithmIdentifier + * wrapper. + * + * @return DER-encoded public key + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] exportPublicKeyDer(boolean withAlg) + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_PublicKeyToDer(withAlg); + } + } + + /** + * Export private key as PKCS#8 PrivateKeyInfo DER (RFC 9909). For SLH-DSA + * the private key is a flat OCTET STRING, there is no separate + * private-only form. + * + * @return PKCS#8 DER-encoded private key + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if no key is loaded or object released + */ + public byte[] exportPrivateKeyDer() + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyNotLoaded(); + + synchronized (pointerLock) { + return wc_SlhDsaKey_KeyToDer(); + } + } + + /** + * Import a public key from X.509 SubjectPublicKeyInfo DER. The parameter + * set is auto-detected from the AlgorithmIdentifier OID. + * + * @param der X.509 SPKI DER bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if a key is already loaded or object + * released + */ + public void importPublicKeyDer(byte[] der) + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_PublicKeyDecode(der); + /* Refresh param from native, which detects it from the OID. */ + this.param = wc_SlhDsaKey_get_param(); + } + state = WolfCryptState.READY; + } + } + + /** + * Import a private key from PKCS#8 PrivateKeyInfo DER. The parameter set + * is auto-detected from the AlgorithmIdentifier OID. + * + * @param der PKCS#8 DER bytes + * + * @throws WolfCryptException if native operation fails + * @throws IllegalStateException if a key is already loaded or object + * released + */ + public void importPrivateKeyDer(byte[] der) + throws WolfCryptException, IllegalStateException { + + checkStateAndInitialize(); + throwIfKeyExists(); + + synchronized (stateLock) { + synchronized (pointerLock) { + wc_SlhDsaKey_PrivateKeyDecode(der); + this.param = wc_SlhDsaKey_get_param(); + } + state = WolfCryptState.READY; + } + } + + /** + * Get raw public key size, in bytes, for this object's parameter set. + * + *For parameter set, requires either the explicit param constructor, + * or a no-arg object after a DER import has detected it.
+ * + * @return public key size in bytes + * + * @throws WolfCryptException if native operation fails or the parameter + * set is not yet set + * @throws IllegalStateException if the object has been released + */ + public int publicKeySize() + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + synchronized (pointerLock) { + return wc_SlhDsaKey_pub_size(); + } + } + + /** + * Get raw private key size, in bytes, for this object's parameter set. + * + *For parameter set, requires either the explicit param constructor, + * or a no-arg object after a DER import has detected it.
+ * + * @return private key size in bytes + * + * @throws WolfCryptException if native operation fails or the parameter + * set is not yet set + * @throws IllegalStateException if the object has been released + */ + public int privateKeySize() + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + synchronized (pointerLock) { + return wc_SlhDsaKey_priv_size(); + } + } + + /** + * Get signature size, in bytes, for this object's parameter set. + * + *For parameter set, requires either the explicit param constructor, + * or a no-arg object after a DER import has detected it.
+ * + * @return signature size in bytes + * + * @throws WolfCryptException if native operation fails or the parameter + * set is not yet set + * @throws IllegalStateException if the object has been released + */ + public int signatureSize() + throws WolfCryptException, IllegalStateException { + + requireParamSet(); + checkStateAndInitialize(); + synchronized (pointerLock) { + return wc_SlhDsaKey_sig_size(); + } + } + + /** + * Parse and validate an X.509 SubjectPublicKeyInfo DER blob carrying an + * SLH-DSA public key, return the parameter set encoded in the + * AlgorithmIdentifier OID. + * + *The decoded native key is freed before this method returns, only the + * parameter set is retained.
+ * + * @param x509Der X.509 SubjectPublicKeyInfo DER bytes + * + * @return one of the {@code SLH_DSA_*} parameter set constants (0-11) + * + * @throws WolfCryptException if the DER is malformed or the OID is not a + * recognized SLH-DSA parameter set + */ + public static int parseAndValidateSlhDsaPublicKeyDer(byte[] x509Der) + throws WolfCryptException { + + return parseAndValidate(x509Der, true); + } + + /** + * Parse and validate a PKCS#8 PrivateKeyInfo DER blob carrying an SLH-DSA + * private key, return the parameter set encoded in the + * AlgorithmIdentifier OID. + * + *The decoded native key is freed before this method returns, only the + * parameter set is retained.
+ * + * @param pkcs8Der PKCS#8 PrivateKeyInfo DER bytes + * + * @return one of the {@code SLH_DSA_*} parameter set constants (0-11) + * + * @throws WolfCryptException if the DER is malformed or the OID is not a + * recognized SLH-DSA parameter set + */ + public static int parseAndValidateSlhDsaPrivateKeyDer(byte[] pkcs8Der) + throws WolfCryptException { + + return parseAndValidate(pkcs8Der, false); + } + + /** + * Parse an SLH-DSA DER blob to determine the parameter set. + * + * Imports the DER once via wc_SlhDsaKey_Public/PrivateKeyDecode, which + * validates the ASN.1 encoding and detects the parameter set from the + * AlgorithmIdentifier OID. Native wolfSSL detects the OID. + * + * @param der DER-encoded key blob (X.509 SPKI for public, PKCS#8 for + * private) + * @param isPublic true if this is a public key DER blob, false if private + * + * @return one of the {@code SLH_DSA_*} parameter set constants (0-11) + * + * @throws WolfCryptException if the DER is malformed or the OID is not a + * recognized SLH-DSA parameter set. + */ + private static int parseAndValidate(byte[] der, boolean isPublic) + throws WolfCryptException { + + if (der == null || der.length == 0) { + throw new WolfCryptException(WolfCryptError.BAD_FUNC_ARG.getCode()); + } + + try { + SlhDsa k = new SlhDsa(); + try { + if (isPublic) { + k.importPublicKeyDer(der); + } + else { + k.importPrivateKeyDer(der); + } + return k.getParam(); + } + finally { + k.releaseNativeStruct(); + } + } + catch (WolfCryptException e) { + /* Pass through NOT_COMPILED_IN, normalize other decode + * failures to ASN_PARSE_E. */ + if (e.getError() == WolfCryptError.NOT_COMPILED_IN) { + throw e; + } + throw new WolfCryptException(WolfCryptError.ASN_PARSE_E.getCode()); + } + } +} diff --git a/src/main/java/com/wolfssl/wolfcrypt/WolfCryptError.java b/src/main/java/com/wolfssl/wolfcrypt/WolfCryptError.java index b2159bff..cae53934 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/WolfCryptError.java +++ b/src/main/java/com/wolfssl/wolfcrypt/WolfCryptError.java @@ -483,8 +483,10 @@ public enum WolfCryptError { SEQ_OVERFLOW_E (-1008), /** ML-DSA Pairwise Consistency Test failure */ ML_DSA_PCT_E (-1016), + /** SLH-DSA Conditional Algorithm Self-Test (CAST) KAT failure */ + SLH_DSA_KAT_FIPS_E (-1018), - /** Update this to indicate last error */ + /** Historical marker mirroring an older native WC_LAST_E value */ WC_LAST_E (-1008), /** Last usable code */ diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptLmsKeyFactoryTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptLmsKeyFactoryTest.java index ffd98a38..f1994127 100644 --- a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptLmsKeyFactoryTest.java +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptLmsKeyFactoryTest.java @@ -222,6 +222,44 @@ public void generatePublicAcceptsNullAlgorithmParameters() assertArrayEquals(noParams.getEncoded(), withNull.getEncoded()); } + /* Both SPKI body forms are accepted: RFC 9708 with the raw key directly + * in the BIT STRING, and RFC 8708 with an inner OCTET STRING wrapping + * it. Both normalize to the canonical RFC 9708 encoding, so getEncoded() + * and getKeySpec() output can differ from the bytes a caller passed in. */ + @Test + public void wrappedFormNormalizesToUnwrapped() throws Exception { + assumeEnabled(); + + KeyFactory kf = KeyFactory.getInstance("LMS", "wolfJCE"); + PublicKey unwrapped = importTc1Key(kf); + byte[] canonical = unwrapped.getEncoded(); + + /* BIT STRING carries OCTET STRING { raw key } instead of the raw + * key directly. */ + byte[] algId = tlv(0x30, HSS_LMS_OID); + byte[] bitString = tlv(0x03, concat(new byte[] { 0x00 }, + tlv(0x04, RFC8554_TC1_PK))); + final byte[] spkiWrapped = tlv(0x30, concat(algId, bitString)); + + PublicKey wrapped = + kf.generatePublic(new X509EncodedKeySpec(spkiWrapped)); + + assertEquals(unwrapped, wrapped); + assertArrayEquals(canonical, wrapped.getEncoded()); + + /* getKeySpec() of a foreign key holding the wrapped encoding also + * returns the canonical unwrapped form: keys are normalized + * through translateKey(), not passed through byte-for-byte. */ + PublicKey foreign = new PublicKey() { + public String getAlgorithm() { return "HSS/LMS"; } + public String getFormat() { return "X.509"; } + public byte[] getEncoded() { return spkiWrapped.clone(); } + }; + X509EncodedKeySpec spec = + kf.getKeySpec(foreign, X509EncodedKeySpec.class); + assertArrayEquals(canonical, spec.getEncoded()); + } + @Test public void privateKeySpecRejected() throws Exception { assumeEnabled(); diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyFactoryTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyFactoryTest.java new file mode 100644 index 00000000..c1ebc752 --- /dev/null +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyFactoryTest.java @@ -0,0 +1,303 @@ +/* WolfCryptSlhDsaKeyFactoryTest.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce.test; + +import static org.junit.Assert.*; +import org.junit.Assume; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.TestRule; + +import java.security.KeyFactory; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Provider; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.Security; +import java.security.spec.PKCS8EncodedKeySpec; +import java.security.spec.X509EncodedKeySpec; +import java.security.spec.InvalidKeySpecException; + +import com.wolfssl.provider.jce.WolfCryptProvider; +import com.wolfssl.wolfcrypt.FeatureDetect; +import com.wolfssl.wolfcrypt.test.TimedTestWatcher; + +/** + * wolfJCE tests for the SLH-DSA KeyFactory service. + */ +public class WolfCryptSlhDsaKeyFactoryTest { + + private static final String GEN_NAME = "SLH-DSA-SHA2-128f"; + + private static boolean slhDsaEnabled = false; + private static boolean genAvailable = false; + private static KeyPair kp = null; + + @Rule(order = Integer.MIN_VALUE) + public TestRule testWatcher = TimedTestWatcher.create(); + + @BeforeClass + public static void setUp() throws Exception { + System.out.println("JCE WolfCryptSlhDsaKeyFactoryTest Class"); + + Security.insertProviderAt(new WolfCryptProvider(), 1); + Provider p = Security.getProvider("wolfJCE"); + assertNotNull(p); + + slhDsaEnabled = FeatureDetect.SlhDsaEnabled(); + if (!slhDsaEnabled) { + System.out.println("SLH-DSA test skipped: NOT_COMPILED_IN"); + return; + } + + try { + kp = KeyPairGenerator.getInstance(GEN_NAME, "wolfJCE") + .generateKeyPair(); + genAvailable = true; + } catch (Exception e) { + /* SHA2-128f not compiled into this build */ + } + } + + private void assumeReady() { + Assume.assumeTrue("SLH-DSA not compiled in", slhDsaEnabled); + Assume.assumeTrue(GEN_NAME + " not available", genAvailable); + } + + @Test + public void publicKeyX509RoundTrip() throws Exception { + assumeReady(); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + byte[] spki = kp.getPublic().getEncoded(); + + PublicKey pub = kf.generatePublic(new X509EncodedKeySpec(spki)); + assertEquals("SLH-DSA", pub.getAlgorithm()); + assertEquals("X.509", pub.getFormat()); + assertArrayEquals(spki, pub.getEncoded()); + + X509EncodedKeySpec spec = + kf.getKeySpec(pub, X509EncodedKeySpec.class); + assertArrayEquals(spki, spec.getEncoded()); + } + + @Test + public void privateKeyPkcs8RoundTrip() throws Exception { + assumeReady(); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + byte[] pkcs8 = kp.getPrivate().getEncoded(); + + PrivateKey priv = kf.generatePrivate(new PKCS8EncodedKeySpec(pkcs8)); + assertEquals("SLH-DSA", priv.getAlgorithm()); + assertEquals("PKCS#8", priv.getFormat()); + assertArrayEquals(pkcs8, priv.getEncoded()); + + PKCS8EncodedKeySpec spec = + kf.getKeySpec(priv, PKCS8EncodedKeySpec.class); + assertArrayEquals(pkcs8, spec.getEncoded()); + } + + @Test + public void generatePublicRejectsPkcs8() throws Exception { + assumeReady(); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + try { + kf.generatePublic( + new PKCS8EncodedKeySpec(kp.getPrivate().getEncoded())); + fail("expected InvalidKeySpecException"); + } catch (InvalidKeySpecException e) { + /* expected */ + } + } + + @Test + public void generatePrivateRejectsX509() throws Exception { + assumeReady(); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + try { + kf.generatePrivate( + new X509EncodedKeySpec(kp.getPublic().getEncoded())); + fail("expected InvalidKeySpecException"); + } catch (InvalidKeySpecException e) { + /* expected */ + } + } + + @Test + public void translateKey() throws Exception { + assumeReady(); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + PublicKey pub = (PublicKey) kf.translateKey(kp.getPublic()); + assertEquals("SLH-DSA", pub.getAlgorithm()); + assertArrayEquals(kp.getPublic().getEncoded(), pub.getEncoded()); + } + + @Test + public void getInstanceForAllNames() throws Exception { + Assume.assumeTrue("SLH-DSA not compiled in", slhDsaEnabled); + + KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + + for (String n : PARAM_NAMES) { + KeyFactory.getInstance(n, "wolfJCE"); + } + + /* OID aliases .20 - .31 */ + for (int i = 0; i < 12; i++) { + KeyFactory.getInstance( + "2.16.840.1.101.3.4.3." + (20 + i), "wolfJCE"); + } + } + + @Test + public void perSetFactoryRejectsMismatchedKey() throws Exception { + assumeReady(); + + /* A parameter-set-locked KeyFactory must reject keys of a + * different set. kp is SLH-DSA-SHA2-128f. */ + KeyFactory kf = + KeyFactory.getInstance("SLH-DSA-SHAKE-128s", "wolfJCE"); + + try { + kf.generatePublic( + new X509EncodedKeySpec(kp.getPublic().getEncoded())); + fail("expected InvalidKeySpecException for set mismatch"); + } catch (InvalidKeySpecException e) { + /* expected */ + } + + try { + kf.generatePrivate( + new PKCS8EncodedKeySpec(kp.getPrivate().getEncoded())); + fail("expected InvalidKeySpecException for set mismatch"); + } catch (InvalidKeySpecException e) { + /* expected */ + } + } + + @Test + public void nullAlgorithmIdParametersAccepted() throws Exception { + assumeReady(); + + /* RFC 9909 omits the AlgorithmIdentifier parameters for SLH-DSA, + * but the JDK X.509 stack can re-encode a certificate + * SubjectPublicKeyInfo with an explicit NULL parameters field when + * it hands the public key to this KeyFactory by OID. That form + * must decode to the same key as the canonical no-parameters form. */ + byte[] spki = kp.getPublic().getEncoded(); + + /* Recover the raw public key bytes via the JNI layer. */ + com.wolfssl.wolfcrypt.SlhDsa k = new com.wolfssl.wolfcrypt.SlhDsa(); + byte[] rawPub; + try { + k.importPublicKeyDer(spki); + rawPub = k.exportPublicKey(); + } + finally { + k.releaseNativeStruct(); + } + + /* Rebuild the SPKI with AlgorithmIdentifier parameters = NULL. */ + byte[] algIdNull = tlv(0x30, concat(SHA2_128F_OID, + new byte[] { (byte) 0x05, (byte) 0x00 })); + byte[] bitString = tlv(0x03, + concat(new byte[] { 0x00 }, rawPub)); + byte[] spkiNull = tlv(0x30, concat(algIdNull, bitString)); + + KeyFactory kf = KeyFactory.getInstance("SLH-DSA", "wolfJCE"); + PublicKey pub = kf.generatePublic(new X509EncodedKeySpec(spkiNull)); + assertEquals("SLH-DSA", pub.getAlgorithm()); + + /* The NULL-parameters form normalizes to the same canonical RFC 9909 + * (absent-parameters) encoding. */ + assertArrayEquals(spki, pub.getEncoded()); + + /* getKeySpec() of a foreign key holding the NULL-parameters form + * also returns the canonical encoding: keys are normalized through + * translateKey(), not passed through byte-for-byte. */ + final byte[] foreignEncoded = spkiNull; + PublicKey foreign = new PublicKey() { + public String getAlgorithm() { + return "SLH-DSA"; + } + public String getFormat() { + return "X.509"; + } + public byte[] getEncoded() { + return foreignEncoded.clone(); + } + }; + + X509EncodedKeySpec normalized = + kf.getKeySpec(foreign, X509EncodedKeySpec.class); + + assertArrayEquals(spki, normalized.getEncoded()); + } + + /* OID TLV for 2.16.840.1.101.3.4.3.21 (id-slh-dsa-sha2-128f). */ + private static final byte[] SHA2_128F_OID = { + (byte) 0x06, (byte) 0x09, (byte) 0x60, (byte) 0x86, (byte) 0x48, + (byte) 0x01, (byte) 0x65, (byte) 0x03, (byte) 0x04, (byte) 0x03, + (byte) 0x15 + }; + + /* All 12 per-set KeyFactory service names. */ + private static final String[] PARAM_NAMES = { + "SLH-DSA-SHA2-128s", "SLH-DSA-SHA2-128f", + "SLH-DSA-SHA2-192s", "SLH-DSA-SHA2-192f", + "SLH-DSA-SHA2-256s", "SLH-DSA-SHA2-256f", + "SLH-DSA-SHAKE-128s", "SLH-DSA-SHAKE-128f", + "SLH-DSA-SHAKE-192s", "SLH-DSA-SHAKE-192f", + "SLH-DSA-SHAKE-256s", "SLH-DSA-SHAKE-256f" + }; + + /* DER TLV with a definite length (content up to 0xFFFF bytes). */ + private static byte[] tlv(int tag, byte[] content) { + int n = content.length; + byte[] len; + if (n < 0x80) { + len = new byte[] { (byte) n }; + } else if (n < 0x100) { + len = new byte[] { (byte) 0x81, (byte) n }; + } else { + len = new byte[] { (byte) 0x82, (byte) (n >> 8), (byte) n }; + } + byte[] out = new byte[1 + len.length + n]; + out[0] = (byte) tag; + System.arraycopy(len, 0, out, 1, len.length); + System.arraycopy(content, 0, out, 1 + len.length, n); + return out; + } + + private static byte[] concat(byte[] a, byte[] b) { + byte[] out = new byte[a.length + b.length]; + System.arraycopy(a, 0, out, 0, a.length); + System.arraycopy(b, 0, out, a.length, b.length); + return out; + } +} diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyPairGeneratorTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyPairGeneratorTest.java new file mode 100644 index 00000000..17ad1fb4 --- /dev/null +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyPairGeneratorTest.java @@ -0,0 +1,183 @@ +/* WolfCryptSlhDsaKeyPairGeneratorTest.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce.test; + +import static org.junit.Assert.*; +import org.junit.Assume; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.TestRule; + +import java.security.InvalidAlgorithmParameterException; +import java.security.InvalidParameterException; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Provider; +import java.security.Security; + +import com.wolfssl.provider.jce.WolfCryptProvider; +import com.wolfssl.provider.jce.WolfPQCParameterSpec; +import com.wolfssl.wolfcrypt.FeatureDetect; +import com.wolfssl.wolfcrypt.SlhDsa; +import com.wolfssl.wolfcrypt.test.TimedTestWatcher; + +/** + * wolfJCE tests for the SLH-DSA KeyPairGenerator service. + */ +public class WolfCryptSlhDsaKeyPairGeneratorTest { + + /* All 12 FIPS 205 parameter set service names. */ + private static final String[] PARAM_NAMES = { + "SLH-DSA-SHA2-128s", "SLH-DSA-SHA2-128f", + "SLH-DSA-SHA2-192s", "SLH-DSA-SHA2-192f", + "SLH-DSA-SHA2-256s", "SLH-DSA-SHA2-256f", + "SLH-DSA-SHAKE-128s", "SLH-DSA-SHAKE-128f", + "SLH-DSA-SHAKE-192s", "SLH-DSA-SHAKE-192f", + "SLH-DSA-SHAKE-256s", "SLH-DSA-SHAKE-256f" + }; + + /* Fast-signing sets used for the keygen round trips. */ + private static final String[] FAST_NAMES = { + "SLH-DSA-SHA2-128f", "SLH-DSA-SHAKE-128f" + }; + + private static boolean slhDsaEnabled = false; + + @Rule(order = Integer.MIN_VALUE) + public TestRule testWatcher = TimedTestWatcher.create(); + + @BeforeClass + public static void setUp() { + System.out.println("JCE WolfCryptSlhDsaKeyPairGeneratorTest Class"); + + Security.insertProviderAt(new WolfCryptProvider(), 1); + Provider p = Security.getProvider("wolfJCE"); + assertNotNull(p); + + /* Gate on keygen support, KeyPairGenerator.SLH-DSA services are + * not registered on verify-only native builds. */ + slhDsaEnabled = FeatureDetect.SlhDsaKeyGenEnabled(); + if (!slhDsaEnabled) { + System.out.println("SLH-DSA keygen test skipped: " + + "NOT_COMPILED_IN"); + } + } + + private void assumeEnabled() { + Assume.assumeTrue("SLH-DSA keygen not compiled in", slhDsaEnabled); + } + + private static boolean available(String name) { + try { + KeyPairGenerator.getInstance(name, "wolfJCE").generateKeyPair(); + return true; + + } catch (Exception e) { + return false; + } + } + + @Test + public void getInstanceForAllNames() throws Exception { + assumeEnabled(); + + KeyPairGenerator.getInstance("SLH-DSA", "wolfJCE"); + for (String n : PARAM_NAMES) { + KeyPairGenerator.getInstance(n, "wolfJCE"); + } + + /* OID aliases .20 - .31 */ + for (int i = 0; i < 12; i++) { + KeyPairGenerator.getInstance( + "2.16.840.1.101.3.4.3." + (20 + i), "wolfJCE"); + } + } + + @Test + public void umbrellaDefaultsToSha2128f() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair kp = KeyPairGenerator.getInstance("SLH-DSA", "wolfJCE") + .generateKeyPair(); + assertNotNull(kp); + assertEquals("SLH-DSA", kp.getPublic().getAlgorithm()); + + /* The umbrella default must encode as the SHA2-128f OID (.21). The + * SubjectPublicKeyInfo carries the parameter-set OID. */ + byte[] spki = kp.getPublic().getEncoded(); + int param = SlhDsa.parseAndValidateSlhDsaPublicKeyDer(spki); + assertEquals(SlhDsa.SLH_DSA_SHA2_128F, param); + } + + @Test + public void perSetKeygenRoundTrip() throws Exception { + assumeEnabled(); + + for (String n : FAST_NAMES) { + if (!available(n)) { + continue; + } + KeyPair kp = KeyPairGenerator.getInstance(n, "wolfJCE") + .generateKeyPair(); + assertNotNull(kp); + assertEquals("SLH-DSA", kp.getPublic().getAlgorithm()); + assertEquals("SLH-DSA", kp.getPrivate().getAlgorithm()); + assertEquals("X.509", kp.getPublic().getFormat()); + assertEquals("PKCS#8", kp.getPrivate().getFormat()); + } + } + + @Test + public void initializeWithIntKeySizeRejected() throws Exception { + assumeEnabled(); + + KeyPairGenerator kpg = + KeyPairGenerator.getInstance("SLH-DSA", "wolfJCE"); + + try { + kpg.initialize(2048); + fail("expected InvalidParameterException for integer key size"); + } catch (InvalidParameterException e) { + /* expected, SLH-DSA has no integer key sizes */ + } + } + + @Test + public void perSetGeneratorLocksParam() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHAKE-128f")); + + /* A per-set generator must not be re-pointed at a different set. */ + KeyPairGenerator kpg = + KeyPairGenerator.getInstance("SLH-DSA-SHAKE-128f", "wolfJCE"); + + try { + kpg.initialize(WolfPQCParameterSpec.SLH_DSA_SHA2_256S); + fail("expected InvalidAlgorithmParameterException for " + + "set mismatch"); + } catch (InvalidAlgorithmParameterException e) { + /* expected */ + } + } +} diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyTest.java new file mode 100644 index 00000000..38f015e6 --- /dev/null +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaKeyTest.java @@ -0,0 +1,149 @@ +/* WolfCryptSlhDsaKeyTest.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce.test; + +import static org.junit.Assert.*; +import org.junit.Assume; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.TestRule; + +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Provider; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.Security; + +import javax.security.auth.Destroyable; + +import com.wolfssl.provider.jce.WolfCryptProvider; +import com.wolfssl.wolfcrypt.FeatureDetect; +import com.wolfssl.wolfcrypt.test.TimedTestWatcher; + +/** + * wolfJCE tests for the SLH-DSA PublicKey and PrivateKey classes. + */ +public class WolfCryptSlhDsaKeyTest { + + private static final String GEN_NAME = "SLH-DSA-SHA2-128f"; + + private static boolean slhDsaEnabled = false; + private static boolean genAvailable = false; + private static KeyPair kp = null; + + @Rule(order = Integer.MIN_VALUE) + public TestRule testWatcher = TimedTestWatcher.create(); + + @BeforeClass + public static void setUp() throws Exception { + System.out.println("JCE WolfCryptSlhDsaKeyTest Class"); + + Security.insertProviderAt(new WolfCryptProvider(), 1); + Provider p = Security.getProvider("wolfJCE"); + assertNotNull(p); + + slhDsaEnabled = FeatureDetect.SlhDsaEnabled(); + if (!slhDsaEnabled) { + System.out.println("SLH-DSA test skipped: NOT_COMPILED_IN"); + return; + } + + try { + kp = KeyPairGenerator.getInstance(GEN_NAME, "wolfJCE") + .generateKeyPair(); + genAvailable = true; + } catch (Exception e) { + /* not available */ + } + } + + private void assumeReady() { + Assume.assumeTrue("SLH-DSA not compiled in", slhDsaEnabled); + Assume.assumeTrue(GEN_NAME + " not available", genAvailable); + } + + @Test + public void publicKeyProperties() { + assumeReady(); + + PublicKey pub = kp.getPublic(); + assertEquals("SLH-DSA", pub.getAlgorithm()); + assertEquals("X.509", pub.getFormat()); + assertNotNull(pub.getEncoded()); + assertTrue(pub.getEncoded().length > 0); + } + + @Test + public void privateKeyProperties() { + assumeReady(); + + PrivateKey priv = kp.getPrivate(); + assertEquals("SLH-DSA", priv.getAlgorithm()); + assertEquals("PKCS#8", priv.getFormat()); + assertNotNull(priv.getEncoded()); + assertTrue(priv.getEncoded().length > 0); + } + + @Test + public void getEncodedReturnsCopy() { + assumeReady(); + + PublicKey pub = kp.getPublic(); + byte[] a = pub.getEncoded(); + byte[] b = pub.getEncoded(); + assertNotSame(a, b); + assertArrayEquals(a, b); + + /* Mutating the returned array must not affect the key. */ + a[0] ^= (byte)0xFF; + assertFalse(java.util.Arrays.equals(a, pub.getEncoded())); + } + + @Test + public void equalsAndHashCode() { + assumeReady(); + + PublicKey pub = kp.getPublic(); + assertEquals(pub, pub); + assertEquals(pub.hashCode(), pub.hashCode()); + assertNotEquals(pub, null); + assertNotEquals(pub, "not a key"); + } + + @Test + public void privateKeyDestroyable() throws Exception { + assumeReady(); + + /* Generate a throwaway key to destroy. */ + KeyPair tmp = KeyPairGenerator.getInstance(GEN_NAME, "wolfJCE") + .generateKeyPair(); + PrivateKey priv = tmp.getPrivate(); + assertTrue(priv instanceof Destroyable); + + Destroyable d = (Destroyable) priv; + assertFalse(d.isDestroyed()); + d.destroy(); + assertTrue(d.isDestroyed()); + } +} diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaSignatureTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaSignatureTest.java new file mode 100644 index 00000000..dea9b62b --- /dev/null +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSlhDsaSignatureTest.java @@ -0,0 +1,519 @@ +/* WolfCryptSlhDsaSignatureTest.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.provider.jce.test; + +import static org.junit.Assert.*; +import org.junit.Assume; +import org.junit.BeforeClass; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.TestRule; + +import java.util.Arrays; + +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Provider; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.Security; +import java.security.Signature; +import java.security.InvalidKeyException; + +import com.wolfssl.provider.jce.WolfCryptProvider; +import com.wolfssl.provider.jce.WolfCryptContextParameterSpec; +import com.wolfssl.wolfcrypt.FeatureDetect; +import com.wolfssl.wolfcrypt.test.TimedTestWatcher; + +/** + * wolfJCE tests for the SLH-DSA Signature service. + */ +public class WolfCryptSlhDsaSignatureTest { + + private static final String[] PARAM_NAMES = { + "SLH-DSA-SHA2-128s", "SLH-DSA-SHA2-128f", + "SLH-DSA-SHA2-192s", "SLH-DSA-SHA2-192f", + "SLH-DSA-SHA2-256s", "SLH-DSA-SHA2-256f", + "SLH-DSA-SHAKE-128s", "SLH-DSA-SHAKE-128f", + "SLH-DSA-SHAKE-192s", "SLH-DSA-SHAKE-192f", + "SLH-DSA-SHAKE-256s", "SLH-DSA-SHAKE-256f" + }; + + /* Fast-signing sets for end-to-end round trips. */ + private static final String[] FAST_NAMES = { + "SLH-DSA-SHA2-128f", "SLH-DSA-SHAKE-128f" + }; + + /* HashSLH-DSA per-set service names, in the same order as their + * FIPS 205 OID aliases 2.16.840.1.101.3.4.3.35 - .46. */ + private static final String[] PREHASH_NAMES = { + "SLH-DSA-SHA2-128s-WITH-SHA256", + "SLH-DSA-SHA2-128f-WITH-SHA256", + "SLH-DSA-SHA2-192s-WITH-SHA512", + "SLH-DSA-SHA2-192f-WITH-SHA512", + "SLH-DSA-SHA2-256s-WITH-SHA512", + "SLH-DSA-SHA2-256f-WITH-SHA512", + "SLH-DSA-SHAKE-128s-WITH-SHAKE128", + "SLH-DSA-SHAKE-128f-WITH-SHAKE128", + "SLH-DSA-SHAKE-192s-WITH-SHAKE256", + "SLH-DSA-SHAKE-192f-WITH-SHAKE256", + "SLH-DSA-SHAKE-256s-WITH-SHAKE256", + "SLH-DSA-SHAKE-256f-WITH-SHAKE256" + }; + + private static final byte[] MSG = "SLH-DSA JCE message".getBytes(); + + private static boolean slhDsaEnabled = false; + + @Rule(order = Integer.MIN_VALUE) + public TestRule testWatcher = TimedTestWatcher.create(); + + @BeforeClass + public static void setUp() { + System.out.println("JCE WolfCryptSlhDsaSignatureTest Class"); + + Security.insertProviderAt(new WolfCryptProvider(), 1); + Provider p = Security.getProvider("wolfJCE"); + assertNotNull(p); + + slhDsaEnabled = FeatureDetect.SlhDsaEnabled(); + if (!slhDsaEnabled) { + System.out.println("SLH-DSA test skipped: NOT_COMPILED_IN"); + } + } + + private void assumeEnabled() { + Assume.assumeTrue("SLH-DSA not compiled in", slhDsaEnabled); + } + + private static boolean available(String name) { + try { + KeyPairGenerator.getInstance(name, "wolfJCE").generateKeyPair(); + return true; + + } catch (Exception e) { + return false; + } + } + + private static KeyPair genKey(String name) throws Exception { + return KeyPairGenerator.getInstance(name, "wolfJCE").generateKeyPair(); + } + + @Test + public void getInstanceForAllNames() throws Exception { + assumeEnabled(); + + Signature.getInstance("SLH-DSA", "wolfJCE"); + + for (String n : PARAM_NAMES) { + Signature.getInstance(n, "wolfJCE"); + } + + for (int i = 0; i < 12; i++) { + Signature.getInstance( + "2.16.840.1.101.3.4.3." + (20 + i), "wolfJCE"); + } + } + + @Test + public void signVerifyUmbrella() throws Exception { + assumeEnabled(); + + for (String n : FAST_NAMES) { + if (!available(n)) { + continue; + } + + KeyPair kp = genKey(n); + + /* Umbrella "SLH-DSA" Signature works with any parameter-set key. */ + Signature signer = Signature.getInstance("SLH-DSA", "wolfJCE"); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + assertNotNull(sig); + + Signature verifier = Signature.getInstance("SLH-DSA", "wolfJCE"); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue("verify, " + n, verifier.verify(sig)); + + /* Tampered message must fail. */ + Signature v2 = Signature.getInstance("SLH-DSA", "wolfJCE"); + v2.initVerify(kp.getPublic()); + byte[] bad = MSG.clone(); + bad[0] ^= 0x01; + v2.update(bad); + assertFalse("tampered, " + n, v2.verify(sig)); + } + } + + @Test + public void signVerifyPerSetName() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHAKE-128f")); + + KeyPair kp = genKey("SLH-DSA-SHAKE-128f"); + + Signature signer = + Signature.getInstance("SLH-DSA-SHAKE-128f", "wolfJCE"); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + Signature verifier = + Signature.getInstance("SLH-DSA-SHAKE-128f", "wolfJCE"); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue(verifier.verify(sig)); + } + + @Test + public void perSetSignatureRejectsMismatchedKey() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHAKE-128f")); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair shake = genKey("SLH-DSA-SHAKE-128f"); + + /* A SHA2-128f-named Signature must reject a SHAKE-128f key. */ + Signature signer = + Signature.getInstance("SLH-DSA-SHA2-128f", "wolfJCE"); + + try { + signer.initSign(shake.getPrivate()); + fail("expected InvalidKeyException for parameter-set mismatch"); + } catch (InvalidKeyException e) { + /* expected */ + } + } + + @Test + public void perSetPreHashSignatureRejectsMismatchedKey() + throws Exception { + + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHAKE-128f")); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair shake = genKey("SLH-DSA-SHAKE-128f"); + + /* A SHA2-128f pre-hash-named Signature must reject a SHAKE-128f */ + Signature signer = Signature.getInstance( + "SLH-DSA-SHA2-128f-WITH-SHA256", "wolfJCE"); + + try { + signer.initSign(shake.getPrivate()); + fail("expected InvalidKeyException for parameter-set mismatch"); + } catch (java.security.InvalidKeyException e) { + /* expected */ + } + } + + @Test + public void contextStringRoundTrip() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair kp = genKey("SLH-DSA-SHA2-128f"); + byte[] ctx = "application-context".getBytes(); + + Signature signer = Signature.getInstance("SLH-DSA", "wolfJCE"); + signer.setParameter(new WolfCryptContextParameterSpec(ctx)); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + /* Verify with the same context succeeds. */ + Signature verifier = Signature.getInstance("SLH-DSA", "wolfJCE"); + verifier.setParameter(new WolfCryptContextParameterSpec(ctx)); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue("same ctx verifies", verifier.verify(sig)); + + /* Verify with empty context (default) must fail. */ + Signature v2 = Signature.getInstance("SLH-DSA", "wolfJCE"); + v2.initVerify(kp.getPublic()); + v2.update(MSG); + assertFalse("empty ctx must not verify", v2.verify(sig)); + + /* Verify with a different context must fail. */ + Signature v3 = Signature.getInstance("SLH-DSA", "wolfJCE"); + v3.setParameter(new WolfCryptContextParameterSpec("other".getBytes())); + v3.initVerify(kp.getPublic()); + v3.update(MSG); + assertFalse("different ctx must not verify", v3.verify(sig)); + } + + @Test + public void contextPersistsAcrossInit() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair kp = genKey("SLH-DSA-SHA2-128f"); + byte[] ctx = "persistent-context".getBytes(); + + /* Documented behavior: a context set via setParameter() persists + * across init calls until replaced, matching how JCA providers + * treat setParameter() state (for example PSS parameters in + * SunRsaSign). */ + Signature signer = Signature.getInstance("SLH-DSA", "wolfJCE"); + signer.setParameter(new WolfCryptContextParameterSpec(ctx)); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig1 = signer.sign(); + + /* Re-init the same instance, the context still applies. */ + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig2 = signer.sign(); + + Signature verifier = Signature.getInstance("SLH-DSA", "wolfJCE"); + verifier.setParameter(new WolfCryptContextParameterSpec(ctx)); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue("first sig verifies with ctx", verifier.verify(sig1)); + verifier.update(MSG); + assertTrue("sig after re-init verifies with ctx", + verifier.verify(sig2)); + + /* And must not verify against the empty-context default. */ + Signature v2 = Signature.getInstance("SLH-DSA", "wolfJCE"); + v2.initVerify(kp.getPublic()); + v2.update(MSG); + assertFalse("sig after re-init must not verify with empty ctx", + v2.verify(sig2)); + } + + @Test + public void contextSpecRejectsTooLong() { + assumeEnabled(); + + byte[] tooLong = new byte[256]; + try { + new WolfCryptContextParameterSpec(tooLong); + fail("expected IllegalArgumentException for ctx > 255"); + + } catch (IllegalArgumentException e) { + /* expected */ + } + } + + @Test + public void crossKeyVerificationFails() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair kpA = genKey("SLH-DSA-SHA2-128f"); + KeyPair kpB = genKey("SLH-DSA-SHA2-128f"); + + Signature signer = Signature.getInstance("SLH-DSA", "wolfJCE"); + signer.initSign(kpA.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + Signature verifier = Signature.getInstance("SLH-DSA", "wolfJCE"); + verifier.initVerify(kpB.getPublic()); + verifier.update(MSG); + assertFalse("other key must not verify", verifier.verify(sig)); + } + + @Test + public void hashSlhDsaGetInstance() throws Exception { + assumeEnabled(); + + Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + + for (String n : PREHASH_NAMES) { + Signature.getInstance(n, "wolfJCE"); + } + + /* OID aliases .35 - .46, same order as PREHASH_NAMES */ + for (int i = 0; i < PREHASH_NAMES.length; i++) { + Signature.getInstance( + "2.16.840.1.101.3.4.3." + (35 + i), "wolfJCE"); + } + } + + @Test + public void hashSlhDsaSignVerify() throws Exception { + assumeEnabled(); + + for (String n : new String[] { "SLH-DSA-SHA2-128f", + "SLH-DSA-SHAKE-128f" }) { + if (!available(n)) { + continue; + } + KeyPair kp = genKey(n); + + /* Umbrella HASH-SLH-DSA works with any SLH-DSA key. */ + Signature signer = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + Signature verifier = + Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue("HASH-SLH-DSA verify, " + n, verifier.verify(sig)); + + /* Tampered message must fail. */ + Signature v2 = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + v2.initVerify(kp.getPublic()); + byte[] bad = MSG.clone(); + bad[0] ^= 0x01; + v2.update(bad); + assertFalse("HASH-SLH-DSA tampered, " + n, v2.verify(sig)); + + /* Pure SLH-DSA and HashSLH-DSA use different domain separation + * (M' prefix 0x00 vs 0x01), so a pure signature must NOT verify + * as pre-hash. */ + Signature pureSigner = + Signature.getInstance("SLH-DSA", "wolfJCE"); + pureSigner.initSign(kp.getPrivate()); + pureSigner.update(MSG); + byte[] pureSig = pureSigner.sign(); + Signature hv = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + hv.initVerify(kp.getPublic()); + hv.update(MSG); + assertFalse("pure sig must not verify as pre-hash, " + n, + hv.verify(pureSig)); + } + } + + @Test + public void hashSlhDsaPerSetSignVerify() throws Exception { + assumeEnabled(); + + /* Per-parameter-set pre-hash services, paired with the plain name + * used to generate a key of that set. The fast 128f sets keep test + * time bounded. */ + String[][] pairs = new String[][] { + { "SLH-DSA-SHA2-128f", "SLH-DSA-SHA2-128f-WITH-SHA256" }, + { "SLH-DSA-SHAKE-128f", "SLH-DSA-SHAKE-128f-WITH-SHAKE128" } + }; + + for (String[] pair : pairs) { + String keyName = pair[0]; + String sigName = pair[1]; + + if (!available(keyName)) { + continue; + } + KeyPair kp = genKey(keyName); + + Signature signer = Signature.getInstance(sigName, "wolfJCE"); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + Signature verifier = Signature.getInstance(sigName, "wolfJCE"); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue(sigName + " verify", verifier.verify(sig)); + + /* Tampered message must fail. */ + Signature v2 = Signature.getInstance(sigName, "wolfJCE"); + v2.initVerify(kp.getPublic()); + byte[] bad = MSG.clone(); + bad[0] ^= 0x01; + v2.update(bad); + assertFalse(sigName + " tampered", v2.verify(sig)); + + /* The per-set service and the umbrella HASH-SLH-DSA use the + * same FIPS 205 Section 10.2.2 pre-hash for a given key, so + * signatures must interop between the two. */ + Signature hv = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + hv.initVerify(kp.getPublic()); + hv.update(MSG); + assertTrue("umbrella verifies per-set sig, " + sigName, + hv.verify(sig)); + } + } + + @Test + public void hashSlhDsaContextRoundTrip() throws Exception { + assumeEnabled(); + Assume.assumeTrue(available("SLH-DSA-SHA2-128f")); + + KeyPair kp = genKey("SLH-DSA-SHA2-128f"); + byte[] ctx = "prehash-context".getBytes(); + + /* Sign pre-hash with a non-empty FIPS 205 context. */ + Signature signer = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + signer.setParameter(new WolfCryptContextParameterSpec(ctx)); + signer.initSign(kp.getPrivate()); + signer.update(MSG); + byte[] sig = signer.sign(); + + /* Verify with the same context succeeds. */ + Signature verifier = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + verifier.setParameter(new WolfCryptContextParameterSpec(ctx)); + verifier.initVerify(kp.getPublic()); + verifier.update(MSG); + assertTrue("same ctx verifies pre-hash", verifier.verify(sig)); + + /* Verify with the default empty context must fail. */ + Signature v2 = Signature.getInstance("HASH-SLH-DSA", "wolfJCE"); + v2.initVerify(kp.getPublic()); + v2.update(MSG); + assertFalse("empty ctx must not verify pre-hash", v2.verify(sig)); + } + + @Test + public void contextParameterSpecBehavior() { + + /* null context normalizes to an empty context */ + WolfCryptContextParameterSpec empty = + new WolfCryptContextParameterSpec(null); + assertNotNull(empty.getContext()); + assertEquals(0, empty.getContext().length); + + /* Constructor copies its input, later caller mutation of the + * source array must not change the spec */ + byte[] src = "spec-context".getBytes(); + WolfCryptContextParameterSpec spec = + new WolfCryptContextParameterSpec(src); + src[0] ^= (byte)0xFF; + assertFalse("ctor must copy input", + Arrays.equals(src, spec.getContext())); + + /* getContext() returns a copy, mutating it must not change the + * spec */ + byte[] out = spec.getContext(); + out[0] ^= (byte)0xFF; + assertArrayEquals("getContext must return a copy", + "spec-context".getBytes(), spec.getContext()); + + /* equals/hashCode compare by content */ + WolfCryptContextParameterSpec same = + new WolfCryptContextParameterSpec("spec-context".getBytes()); + WolfCryptContextParameterSpec other = + new WolfCryptContextParameterSpec("different".getBytes()); + assertEquals(spec, same); + assertEquals(spec.hashCode(), same.hashCode()); + assertFalse("different contexts must not be equal", + spec.equals(other)); + } +} diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptXmssKeyFactoryTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptXmssKeyFactoryTest.java index 37302bf0..96275420 100644 --- a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptXmssKeyFactoryTest.java +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptXmssKeyFactoryTest.java @@ -233,7 +233,7 @@ public void wrappedOctetStringSpkiAccepted() throws Exception { assumeEnabled(); /* Some encoders wrap the raw RFC 8391 public key in an inner OCTET - * STRING inside the BIT STRING; WolfCryptXmssUtil accepts that form + * STRING inside the BIT STRING; WolfCryptSpkiUtil accepts that form * and normalizes it to the same RFC 9802 (unwrapped) encoding. */ byte[] octet = tlv(0x04, XMSS_SHA2_10_256_PK); byte[] algId = tlv(0x30, XMSS_OID); diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java b/src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java index 31bb5ce0..634b5fc8 100644 --- a/src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java @@ -53,6 +53,10 @@ WolfCryptMlDsaKeyPairGeneratorTest.class, WolfCryptMlDsaKeyFactoryTest.class, WolfCryptMlDsaInteropTest.class, + WolfCryptSlhDsaKeyTest.class, + WolfCryptSlhDsaSignatureTest.class, + WolfCryptSlhDsaKeyPairGeneratorTest.class, + WolfCryptSlhDsaKeyFactoryTest.class, WolfCryptMlKemKeyPairGeneratorTest.class, WolfCryptMlKemKeyFactoryTest.class, WolfCryptMlKemKemTest.class, diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java index 43dd3a7e..6f17a95f 100644 --- a/src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java @@ -175,6 +175,17 @@ public class WolfSSLKeyStoreTest { * examples/certs/xmss/. Loaded only if FeatureDetect.XmssEnabled(). */ private static String xmssRootCertDer = null; + /* SLH-DSA self-signed root certs/keys from wolfssl/certs/slhdsa/. Loaded + * only if FeatureDetect.SlhDsaEnabled() is true. */ + private static String slhDsaSha2KeyPem = null; + private static String slhDsaSha2CertPem = null; + private static String slhDsaShakeKeyPem = null; + private static String slhDsaShakeCertPem = null; + private static PrivateKey keySlhDsaSha2 = null; + private static Certificate certSlhDsaSha2 = null; + private static PrivateKey keySlhDsaShake = null; + private static Certificate certSlhDsaShake = null; + /* Example .jks KeyStore file paths */ private static String clientJKS = null; /* client.jks */ @@ -507,6 +518,32 @@ private static void createTestObjects() } } } + + /* Load SLH-DSA self-signed test certs/keys if SLH-DSA compiled in. */ + if (FeatureDetect.SlhDsaEnabled()) { + if (new File(slhDsaSha2KeyPem).exists()) { + try { + keySlhDsaSha2 = + pemFileToPrivateKey(slhDsaSha2KeyPem, "SLH-DSA"); + certSlhDsaSha2 = certFileToCertificate(slhDsaSha2CertPem); + } + catch (Exception e) { + keySlhDsaSha2 = null; + certSlhDsaSha2 = null; + } + } + if (new File(slhDsaShakeKeyPem).exists()) { + try { + keySlhDsaShake = + pemFileToPrivateKey(slhDsaShakeKeyPem, "SLH-DSA"); + certSlhDsaShake = certFileToCertificate(slhDsaShakeCertPem); + } + catch (Exception e) { + keySlhDsaShake = null; + certSlhDsaShake = null; + } + } + } } @BeforeClass @@ -634,6 +671,16 @@ public static void testSetupAndProviderInstallation() caMlDsa87WKS = certPre.concat("examples/certs/ca-mldsa87.wks"); + /* SLH-DSA test material paths */ + slhDsaSha2KeyPem = certPre.concat( + "examples/certs/slhdsa/root-slhdsa-sha2-128s-priv.pem"); + slhDsaSha2CertPem = certPre.concat( + "examples/certs/slhdsa/root-slhdsa-sha2-128s.pem"); + slhDsaShakeKeyPem = certPre.concat( + "examples/certs/slhdsa/root-slhdsa-shake-128s-priv.pem"); + slhDsaShakeCertPem = certPre.concat( + "examples/certs/slhdsa/root-slhdsa-shake-128s.pem"); + /* Test if file exists. Skip tests gracefully if cert files not * available (eg running on Android). */ File f = new File(serverCertDer); @@ -3238,6 +3285,14 @@ private void assumeMlDsaAvailable() { serverKeyMlDsa44, serverKeyMlDsa65, serverKeyMlDsa87); } + private void assumeSlhDsaAvailable() { + Assume.assumeTrue("SLH-DSA not compiled in native wolfSSL", + FeatureDetect.SlhDsaEnabled()); + Assume.assumeTrue("SLH-DSA test keys not loadable on this build " + + "(see examples/certs/slhdsa/)", + (keySlhDsaSha2 != null) || (keySlhDsaShake != null)); + } + private void assumeMlDsaWksAvailable() { assumeMlDsaAvailable(); File f = new File(serverMlDsa44WKS); @@ -3382,6 +3437,59 @@ public void testStoreLoadByteBufferMlDsa() throws Exception { assertTrue(reload.isCertificateEntry("trust")); } + /** + * Store SLH-DSA private keys + self-signed certs into a WKS KeyStore, + * write to a byte stream, reload, and verify keys and certs round trip. + */ + @Test + public void testStoreLoadByteBufferSlhDsa() throws Exception { + + int expected = 0; + + assumeSlhDsaAvailable(); + + KeyStore store = KeyStore.getInstance(storeType, storeProvider); + store.load(null, storePass.toCharArray()); + + if (keySlhDsaSha2 != null) { + store.setKeyEntry("slhSha2", keySlhDsaSha2, storePass.toCharArray(), + new Certificate[]{ certSlhDsaSha2 }); + store.setCertificateEntry("trustSha2", certSlhDsaSha2); + expected += 2; + } + if (keySlhDsaShake != null) { + store.setKeyEntry("slhShake", keySlhDsaShake, + storePass.toCharArray(), new Certificate[]{ certSlhDsaShake }); + expected += 1; + } + assertEquals(expected, store.size()); + + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + store.store(baos, storePass.toCharArray()); + byte[] wksBytes = baos.toByteArray(); + assertTrue(wksBytes.length > 0); + + KeyStore reload = KeyStore.getInstance(storeType, storeProvider); + reload.load(new ByteArrayInputStream(wksBytes), + storePass.toCharArray()); + assertEquals(expected, reload.size()); + + if (keySlhDsaSha2 != null) { + assertEquals(keySlhDsaSha2, + reload.getKey("slhSha2", storePass.toCharArray())); + assertEquals(certSlhDsaSha2, reload.getCertificate("slhSha2")); + assertEquals(certSlhDsaSha2, + reload.getCertificate("trustSha2")); + assertTrue(reload.isCertificateEntry("trustSha2")); + } + if (keySlhDsaShake != null) { + assertEquals(keySlhDsaShake, + reload.getKey("slhShake", storePass.toCharArray())); + assertEquals(certSlhDsaShake, + reload.getCertificate("slhShake")); + } + } + /** * Load each prebuilt ML-DSA WKS keystore file from disk (built by * examples/certs/BuildMlDsaKeystores.java), retrieve the key and cert, diff --git a/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java b/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java index 86aebf6c..6c7da8ac 100644 --- a/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java +++ b/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java @@ -119,15 +119,17 @@ public void testGetMinRsaSize() { * Helper to make an RSA key, retrying on transient PRIME_GEN_E up to * {@link #MAKE_KEY_MAX_ATTEMPTS} times. Any other error, or a PRIME_GEN_E * on the final attempt, is propagated. Each attempt uses a fresh key. + * + * @return new Rsa object holding the generated key, caller must + * release with releaseNativeStruct() */ - private void makeKeyWithRetry(int size, long e, Rng rng) { + private Rsa makeKeyWithRetry(int size, long e, Rng rng) { for (int i = 0; i < MAKE_KEY_MAX_ATTEMPTS; i++) { Rsa key = new Rsa(); try { key.makeKey(size, e, rng); - key.releaseNativeStruct(); - return; + return key; } catch (WolfCryptException ex) { key.releaseNativeStruct(); if (ex.getError() == WolfCryptError.PRIME_GEN_E && @@ -138,6 +140,9 @@ private void makeKeyWithRetry(int size, long e, Rng rng) { throw ex; } } + + /* Not reachable, the loop always returns or throws */ + throw new IllegalStateException("RSA makeKey retry loop exited"); } @Test @@ -146,20 +151,19 @@ public void testMakeKey() { /* FIPS after 2425 doesn't allow 1024-bit RSA key gen */ if ((Fips.enabled && Fips.fipsVersion < 5) || (!Fips.enabled && Rsa.RSA_MIN_SIZE <= 1024)) { - makeKeyWithRetry(1024, 65537, rng); + makeKeyWithRetry(1024, 65537, rng).releaseNativeStruct(); } - makeKeyWithRetry(2048, 65537, rng); - makeKeyWithRetry(3072, 65537, rng); - makeKeyWithRetry(4096, 65537, rng); + makeKeyWithRetry(2048, 65537, rng).releaseNativeStruct(); + makeKeyWithRetry(3072, 65537, rng).releaseNativeStruct(); + makeKeyWithRetry(4096, 65537, rng).releaseNativeStruct(); } @Test public void testDerExportImportSignVerify() { /* generate new 2048-bit key */ - Rsa key = new Rsa(); - key.makeKey(2048, 65537, rng); + Rsa key = makeKeyWithRetry(2048, 65537, rng); /* export key to DER */ byte[] rsaDer = key.exportPrivateDer(); @@ -306,8 +310,7 @@ public void rsaPrivateToPkcs8() { key.releaseNativeStruct(); /* Test that generated key encodes without error */ - key = new Rsa(); - key.makeKey(1024, 65537, rng); + key = makeKeyWithRetry(1024, 65537, rng); pkcs8 = key.privateKeyEncodePKCS8(); assertTrue(pkcs8 != null); assertTrue(pkcs8.length != 0); @@ -1369,11 +1372,10 @@ public void testRsaPssComprehensiveMgfTesting() { return; } - Rsa key = new Rsa(); Rng rng = new Rng(); rng.init(); - key.makeKey(2048, 65537, rng); + Rsa key = makeKeyWithRetry(2048, 65537, rng); String message = "Comprehensive MGF testing"; @@ -1453,11 +1455,10 @@ public void testRsaPssErrorConditions() { return; } - Rsa key = new Rsa(); Rng rng = new Rng(); rng.init(); - key.makeKey(2048, 65537, rng); + Rsa key = makeKeyWithRetry(2048, 65537, rng); String message = "Error condition testing"; byte[] digest = sha256(message.getBytes()); @@ -1506,11 +1507,10 @@ public void testRsaPssIndividualMgfTypes() { return; } - Rsa key = new Rsa(); Rng rng = new Rng(); rng.init(); - key.makeKey(2048, 65537, rng); + Rsa key = makeKeyWithRetry(2048, 65537, rng); String message = "Individual MGF testing"; diff --git a/src/test/java/com/wolfssl/wolfcrypt/test/SlhDsaTest.java b/src/test/java/com/wolfssl/wolfcrypt/test/SlhDsaTest.java new file mode 100644 index 00000000..67830330 --- /dev/null +++ b/src/test/java/com/wolfssl/wolfcrypt/test/SlhDsaTest.java @@ -0,0 +1,1761 @@ +/* SlhDsaTest.java + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +package com.wolfssl.wolfcrypt.test; + +import static org.junit.Assert.*; + +import java.util.ArrayList; +import java.util.Arrays; + +import org.junit.Assume; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.Rule; +import org.junit.rules.TestRule; + +import com.wolfssl.wolfcrypt.FeatureDetect; +import com.wolfssl.wolfcrypt.SlhDsa; +import com.wolfssl.wolfcrypt.Rng; +import com.wolfssl.wolfcrypt.Sha256; +import com.wolfssl.wolfcrypt.Sha512; +import com.wolfssl.wolfcrypt.WolfCrypt; +import com.wolfssl.wolfcrypt.WolfCryptError; +import com.wolfssl.wolfcrypt.WolfCryptException; + +public class SlhDsaTest { + + /* All 12 FIPS 205 parameter sets, matching native enum SlhDsaParam. */ + private static final int[] ALL_PARAMS = { + SlhDsa.SLH_DSA_SHAKE_128S, SlhDsa.SLH_DSA_SHAKE_128F, + SlhDsa.SLH_DSA_SHAKE_192S, SlhDsa.SLH_DSA_SHAKE_192F, + SlhDsa.SLH_DSA_SHAKE_256S, SlhDsa.SLH_DSA_SHAKE_256F, + SlhDsa.SLH_DSA_SHA2_128S, SlhDsa.SLH_DSA_SHA2_128F, + SlhDsa.SLH_DSA_SHA2_192S, SlhDsa.SLH_DSA_SHA2_192F, + SlhDsa.SLH_DSA_SHA2_256S, SlhDsa.SLH_DSA_SHA2_256F + }; + + /* FIPS 205 Table 2 sizes, indexed by parameter set 0-11. */ + private static final int[] EXPECTED_PUB_SIZE = { + 32, 32, 48, 48, 64, 64, 32, 32, 48, 48, 64, 64 + }; + private static final int[] EXPECTED_PRIV_SIZE = { + 64, 64, 96, 96, 128, 128, 64, 64, 96, 96, 128, 128 + }; + private static final int[] EXPECTED_SIG_SIZE = { + 7856, 17088, 16224, 35664, 29792, 49856, + 7856, 17088, 16224, 35664, 29792, 49856 + }; + + /* Cheap-to-run parameter sets used for the sign/verify round trips, kept + * to the 128-bit category to bound test time. The larger and 's' sets are + * exercised by the size checks and the NIST KAT vectors. */ + private static final int[] CORE_PARAMS = { + SlhDsa.SLH_DSA_SHAKE_128S, SlhDsa.SLH_DSA_SHAKE_128F, + SlhDsa.SLH_DSA_SHA2_128S, SlhDsa.SLH_DSA_SHA2_128F + }; + + private static Rng rng = new Rng(); + private static final Object rngLock = new Object(); + private static boolean slhDsaEnabled = false; + + /* Parameter sets actually compiled into this native wolfSSL build. */ + private static final ArrayList