Add TPM MLDSA authentication for post quantum TLS 1.3 with example and tests - #559
Open
aidangarske wants to merge 1 commit into
Open
Add TPM MLDSA authentication for post quantum TLS 1.3 with example and tests#559aidangarske wants to merge 1 commit into
aidangarske wants to merge 1 commit into
Conversation
aidangarske
changed the title
aidangarske
marked this pull request as draft
July 22, 2026 22:34
aidangarske
force-pushed
the
mldsa-tls-cryptocb
branch
from
July 22, 2026 22:58
654b254 to
1907755
Compare
aidangarske
marked this pull request as ready for review
July 22, 2026 23:09
aidangarske
force-pushed
the
mldsa-tls-cryptocb
branch
from
July 23, 2026 00:08
1907755 to
ae462a2
Compare
aidangarske
force-pushed
the
mldsa-tls-cryptocb
branch
from
July 23, 2026 01:02
ae462a2 to
0063c16
Compare
dgarske
requested changes
Jul 27, 2026
| @@ -0,0 +1,242 @@ | |||
| /* tls_client_pq.c | |||
Member
There was a problem hiding this comment.
Did you consider extend the existing tls_client and tls_server examples to support PQC? Would love to hear your thoughts on it.
| @@ -0,0 +1,221 @@ | |||
| #!/bin/bash | |||
Member
There was a problem hiding this comment.
I'd prefer to see the run_examples.sh extended to support the PQC instead of a separate test script.
| unsigned short useSymmetricOnTPM:1; /* if set indicates desire to use symmetric algorithms on TPM */ | ||
| #endif | ||
| unsigned short useFIPSMode:1; /* if set requires FIPS mode on TPM and no fallback to software algos */ | ||
| #ifdef WOLFTPM_MLDSA_SIGN |
Member
There was a problem hiding this comment.
Putting this at end of structure is good for binary compatiblity, but I would sure love to see it above the bit-fields. I'm okay with it staying here.
| @@ -0,0 +1,299 @@ | |||
| /* gen_pqc_certs.c | |||
Member
There was a problem hiding this comment.
Wow, this is nice! Using our wolfCrypt API's for cert gen! Very nice! I could see this also being a standalone example in wolfssl-examples.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ML‑KEM key exchange runs in wolfSSL.
tls_client_pq (ML‑KEM key exchange, CA‑verified). CLI‑selectable ML‑DSA set (44/65/87) and ML‑KEM group (512/768/1024 + hybrid SECP256R1MLKEM768 /
X25519MLKEM768).
tests/tls_pq_e2e.sh drives the full PQC handshake end‑to‑end across the group/param matrix.
via WOLFSSL_MLDSA_NO_MAKE_KEY/_NO_SIGN); e2e gated on BUILD_SWTPM_TCP.
needs Route wc_MlDsaKey_SignCtx through the crypto callback before the prvKeySet check for device keys wolfssl#10979