LMS support: simplify hash-sigs build.

docs/PQ.md

@@ -16,43 +16,33 @@ of cryptographically relevant quantum computers.
 ### Building with LMS Support
 
 LMS/HSS support in wolfCrypt requires the hash-sigs library ( https://github.com/cisco/hash-sigs ).
-The hash-sigs repo should be cloned to the `src` dir here
+Use the following procedure to prepare hash-sigs for building with wolfBoot:
 
 ```
-$ls lib/hash-sigs/
-lib  src
+$ cd lib
+$ mkdir hash-sigs
+$ls
+ CMakeLists.txt  hash-sigs  wolfssl  wolfTPM
+$ cd hash-sigs
+$ mkdir lib
+$ git clone https://github.com/cisco/hash-sigs.git src
+$ cd src
+$ git checkout b0631b8891295bf2929e68761205337b7c031726
+$ git apply ../../../tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch
 ```
 
-and checked out at this commit
-```
-b0631b8891295bf2929e68761205337b7c031726
-```
-
-In the file `sha256.h` update the `USE_OPENSSL` define to
-```
-#define USE_OPENSSL 0
-```
-
-Build hash-sigs with
-```
-$make hss_lib.a
-$make hss_verify.a
-```
-
-and place the built static libs here:
-```
-$ls lib/hash-sigs/lib/
-hss_lib.a  hss_verify.a
-```
+Nothing more is needed, as wolfBoot will automatically produce the required
+hash-sigs build artifacts.
 
 Note: the hash-sigs project only builds static libraries:
 - hss_verify.a: a single-threaded verify-only static lib.
 - hss_lib.a: a single-threaded static lib.
 - hss_lib_thread.a: a multi-threaded static lib.
 
-The keytools utility links against `hss_lib.a` as it needs full
-keygen, signing, and verifying functionality, while wolfBoot
-links with `hss_verify.a` as it needs verify functionality only.
+The keytools utility links against `hss_lib.a`, as it needs full
+keygen, signing, and verifying functionality. However wolfBoot
+links directly with the subset of objects in the `hss_verify.a`
+build rule, as it only requires verify functionality.
 
 ### Config
 

options.mk

@@ -316,8 +316,19 @@ ifeq ($(SIGN),LMS)
   LMSDIR = lib/hash-sigs
   KEYGEN_OPTIONS+=--lms
   SIGN_OPTIONS+=--lms
-  LIBS += $(LMSDIR)/lib/hss_verify.a
   WOLFCRYPT_OBJS+= \
+    ./$(LMSDIR)/src/hss_verify.o \
+    ./$(LMSDIR)/src/hss_verify_inc.o \
+    ./$(LMSDIR)/src/hss_common.o \
+    ./$(LMSDIR)/src/hss_thread_single.o \
+    ./$(LMSDIR)/src/hss_zeroize.o \
+    ./$(LMSDIR)/src/lm_common.o \
+    ./$(LMSDIR)/src/lm_ots_common.o \
+    ./$(LMSDIR)/src/lm_ots_verify.o \
+    ./$(LMSDIR)/src/lm_verify.o \
+    ./$(LMSDIR)/src/endian.o \
+    ./$(LMSDIR)/src/hash.o \
+    ./$(LMSDIR)/src/sha256.o \
     ./lib/wolfssl/wolfcrypt/src/ext_lms.o \
     ./lib/wolfssl/wolfcrypt/src/memory.o \
     ./lib/wolfssl/wolfcrypt/src/wc_port.o \

tools/keytools/Makefile

@@ -123,3 +123,12 @@ keygen: $(OBJS_VIRT) $(LIBS) keygen.o
 
 clean:
 	rm -f sign keygen *.o
+
+# The final make clean is to ensure a subsequent LMS wolfboot
+# hash-sigs build is separate from keytools.
+$(LMSDIR)/lib/hss_lib.a:
+	@echo "Building hss_lib.a"
+	$(Q)@$(MAKE) -C $(LMSDIR)/src/ -s clean
+	$(Q)@$(MAKE) -C $(LMSDIR)/src/ hss_lib.a
+	$(Q)cp $(LMSDIR)/src/hss_lib.a $(LMSDIR)/lib/
+	$(Q)@$(MAKE) -C $(LMSDIR)/src/ -s clean

tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch

@@ -0,0 +1,53 @@
+From 3819e0676bab0d91465c94c2602fc887d49f6230 Mon Sep 17 00:00:00 2001
+From: jordan <jordan@wolfssl.com>
+Date: Wed, 30 Aug 2023 21:16:25 -0500
+Subject: [PATCH 1/1] Patch to support wolfBoot LMS build.
+
+---
+ endian.c        | 2 +-
+ lm_ots_verify.c | 2 +-
+ sha256.h        | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/endian.c b/endian.c
+index acd2d36..29e5f6d 100644
+--- a/endian.c
++++ b/endian.c
+@@ -13,7 +13,7 @@ void put_bigendian( void *target, unsigned long long value, size_t bytes ) {
+ unsigned long long get_bigendian( const void *target, size_t bytes ) {
+     const unsigned char *b = target;
+     unsigned long long result = 0;
+-    int i;
++    size_t i;
+
+     for (i=0; i<bytes; i++) {
+         result = 256 * result + (b[i] & 0xff);
+diff --git a/lm_ots_verify.c b/lm_ots_verify.c
+index 9706edd..1c79659 100644
+--- a/lm_ots_verify.c
++++ b/lm_ots_verify.c
+@@ -89,7 +89,7 @@ bool lm_ots_validate_signature_compute(
+                                 PBLC_PREFIX_LEN );
+     }
+
+-    int i;
++    size_t i;
+     unsigned char tmp[ITER_MAX_LEN];
+
+     /* Preset the parts of tmp that don't change */
+diff --git a/sha256.h b/sha256.h
+index e4c8a9c..3282c90 100644
+--- a/sha256.h
++++ b/sha256.h
+@@ -5,7 +5,7 @@
+ #include EXT_SHA256_H
+ #else
+
+-#define USE_OPENSSL 1   /* We use the OpenSSL implementation for SHA-256 */
++#define USE_OPENSSL 0   /* We use the OpenSSL implementation for SHA-256 */
+                         /* (which is quite a bit faster than our portable */
+                         /* C version) */
+
+-- 
+2.40.0
+