From f96db74294690e87d2f3b7f759efb5312d8050f5 Mon Sep 17 00:00:00 2001 From: jordan Date: Wed, 30 Aug 2023 22:09:53 -0500 Subject: [PATCH] LMS support: simplify hash-sigs build. --- docs/PQ.md | 44 ++++++--------- options.mk | 13 ++++- tools/keytools/Makefile | 9 ++++ ...-Patch-to-support-wolfBoot-LMS-build.patch | 53 +++++++++++++++++++ 4 files changed, 91 insertions(+), 28 deletions(-) create mode 100644 tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch diff --git a/docs/PQ.md b/docs/PQ.md index 41349c696..21bae8e15 100644 --- a/docs/PQ.md +++ b/docs/PQ.md @@ -16,43 +16,33 @@ of cryptographically relevant quantum computers. ### Building with LMS Support LMS/HSS support in wolfCrypt requires the hash-sigs library ( https://github.com/cisco/hash-sigs ). -The hash-sigs repo should be cloned to the `src` dir here +Use the following procedure to prepare hash-sigs for building with wolfBoot: ``` -$ls lib/hash-sigs/ -lib src +$ cd lib +$ mkdir hash-sigs +$ls + CMakeLists.txt hash-sigs wolfssl wolfTPM +$ cd hash-sigs +$ mkdir lib +$ git clone https://github.com/cisco/hash-sigs.git src +$ cd src +$ git checkout b0631b8891295bf2929e68761205337b7c031726 +$ git apply ../../../tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch ``` -and checked out at this commit -``` -b0631b8891295bf2929e68761205337b7c031726 -``` - -In the file `sha256.h` update the `USE_OPENSSL` define to -``` -#define USE_OPENSSL 0 -``` - -Build hash-sigs with -``` -$make hss_lib.a -$make hss_verify.a -``` - -and place the built static libs here: -``` -$ls lib/hash-sigs/lib/ -hss_lib.a hss_verify.a -``` +Nothing more is needed, as wolfBoot will automatically produce the required +hash-sigs build artifacts. Note: the hash-sigs project only builds static libraries: - hss_verify.a: a single-threaded verify-only static lib. - hss_lib.a: a single-threaded static lib. - hss_lib_thread.a: a multi-threaded static lib. -The keytools utility links against `hss_lib.a` as it needs full -keygen, signing, and verifying functionality, while wolfBoot -links with `hss_verify.a` as it needs verify functionality only. +The keytools utility links against `hss_lib.a`, as it needs full +keygen, signing, and verifying functionality. However wolfBoot +links directly with the subset of objects in the `hss_verify.a` +build rule, as it only requires verify functionality. ### Config diff --git a/options.mk b/options.mk index 856729359..e3774ae0e 100644 --- a/options.mk +++ b/options.mk @@ -316,8 +316,19 @@ ifeq ($(SIGN),LMS) LMSDIR = lib/hash-sigs KEYGEN_OPTIONS+=--lms SIGN_OPTIONS+=--lms - LIBS += $(LMSDIR)/lib/hss_verify.a WOLFCRYPT_OBJS+= \ + ./$(LMSDIR)/src/hss_verify.o \ + ./$(LMSDIR)/src/hss_verify_inc.o \ + ./$(LMSDIR)/src/hss_common.o \ + ./$(LMSDIR)/src/hss_thread_single.o \ + ./$(LMSDIR)/src/hss_zeroize.o \ + ./$(LMSDIR)/src/lm_common.o \ + ./$(LMSDIR)/src/lm_ots_common.o \ + ./$(LMSDIR)/src/lm_ots_verify.o \ + ./$(LMSDIR)/src/lm_verify.o \ + ./$(LMSDIR)/src/endian.o \ + ./$(LMSDIR)/src/hash.o \ + ./$(LMSDIR)/src/sha256.o \ ./lib/wolfssl/wolfcrypt/src/ext_lms.o \ ./lib/wolfssl/wolfcrypt/src/memory.o \ ./lib/wolfssl/wolfcrypt/src/wc_port.o \ diff --git a/tools/keytools/Makefile b/tools/keytools/Makefile index ebb498a7a..e66b8abe7 100644 --- a/tools/keytools/Makefile +++ b/tools/keytools/Makefile @@ -123,3 +123,12 @@ keygen: $(OBJS_VIRT) $(LIBS) keygen.o clean: rm -f sign keygen *.o + +# The final make clean is to ensure a subsequent LMS wolfboot +# hash-sigs build is separate from keytools. +$(LMSDIR)/lib/hss_lib.a: + @echo "Building hss_lib.a" + $(Q)@$(MAKE) -C $(LMSDIR)/src/ -s clean + $(Q)@$(MAKE) -C $(LMSDIR)/src/ hss_lib.a + $(Q)cp $(LMSDIR)/src/hss_lib.a $(LMSDIR)/lib/ + $(Q)@$(MAKE) -C $(LMSDIR)/src/ -s clean diff --git a/tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch b/tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch new file mode 100644 index 000000000..3e6be117b --- /dev/null +++ b/tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch @@ -0,0 +1,53 @@ +From 3819e0676bab0d91465c94c2602fc887d49f6230 Mon Sep 17 00:00:00 2001 +From: jordan +Date: Wed, 30 Aug 2023 21:16:25 -0500 +Subject: [PATCH 1/1] Patch to support wolfBoot LMS build. + +--- + endian.c | 2 +- + lm_ots_verify.c | 2 +- + sha256.h | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/endian.c b/endian.c +index acd2d36..29e5f6d 100644 +--- a/endian.c ++++ b/endian.c +@@ -13,7 +13,7 @@ void put_bigendian( void *target, unsigned long long value, size_t bytes ) { + unsigned long long get_bigendian( const void *target, size_t bytes ) { + const unsigned char *b = target; + unsigned long long result = 0; +- int i; ++ size_t i; + + for (i=0; i