Remove liboqs and use WolfSSL's Kyber implementation

Remove references to liboqs and edit build flag/configs for each of the platform. Since WolfSSL would officially release their Kyber/ML-KEM implementations a few months later, we would use the git patch to essentially patch their PRs on top of the 5.7.4 release. The patch consists of the commits and code changes from the following PR from WolfSSL: - wolfSSL/wolfssl#8143 - wolfSSL/wolfssl#8172 - wolfSSL/wolfssl#8183 - wolfSSL/wolfssl#8185 Configuration for enabling ML-KEM/Kyber: 1. For only ML-KEM: ./configure --enable-kyber ./configure --enable-kyber=all,ml-kem 2. For just Kyber: ./configure --enable-kyber=all,original 3. For ML-KEM and Kyber ./configure --enable-kyber=all,original,ml-kem ./configure --enable-kyber=all,ml-kem,original
expressvpn · Nov 29, 2024 · 1e47a16 · 1e47a16
1 parent 57aa7ea
commit 1e47a16
Show file tree

Hide file tree

Showing 29 changed files with 3,746 additions and 379 deletions.
diff --git a/3rd_party_deps.yml b/3rd_party_deps.yml
@@ -6,7 +6,6 @@
       --disable-dh
       --disable-examples
       --disable-oldtls
-      --disable-sha3
       --disable-shared
       --disable-sys-ca-certs
       --disable-dilithium
@@ -23,6 +22,5 @@
       --enable-static
       --enable-tls13
       --enable-experimental
-  - :HE_LIBOQS_SOURCE: https://github.com/open-quantum-safe/liboqs
-  - :HE_LIBOQS_TAG: 0.9.2
-  - :HE_LIBOQS_BUILD_FLAGS: -DOQS_BUILD_ONLY_LIB=ON -DOQS_USE_OPENSSL=OFF -DOQS_MINIMAL_BUILD='KEM_kyber_512;KEM_kyber_768;KEM_kyber_1024;SIG_dilithium_2;SIG_dilithium_3;SIG_dilithium_5;SIG_falcon_512;SIG_falcon_1024'
+      --enable-sha3
+      --enable-kyber=all,original
diff --git a/Earthfile b/Earthfile
@@ -18,7 +18,7 @@ libhelium-deps:
     # Make the directory structure so that the config can be parsed
     # To improve caching we want to separate this out as the WolfSSL dependency
     # fetch and build are the slowest parts of the process.
-    RUN mkdir -p src include test/support third_party/wolfssl third_party/liboqs
+    RUN mkdir -p src include test/support third_party/wolfssl
     # Copy the patch files
     COPY --dir wolfssl ./
     # Build and fetch the dependencies

diff --git a/android.yml b/android.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DANDROID_ABI=$ARCH -DCMAKE_TOOLCHAIN_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -36,9 +19,13 @@
         - C_EXTRA_FLAGS= -fPIC -D_FORTIFY_SOURCE=2 -DWOLFSSL_MIN_RSA_BITS=2048 -DWOLFSSL_MIN_ECC_BITS=256 -DFP_MAX_BITS=8192 -fomit-frame-pointer -DWOLFSSL_NO_SPHINCS -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT
         - LIBS=-llog -landroid
       :build:
-        - git apply ../../wolfssl/fix-falcon-dilithm-flags.patch
+        - git apply ../../wolfssl/include-private-key-fields-for-kyber.patch
+        - git apply ../../wolfssl/make-kyber-mlkem-available.patch
+        - git apply ../../wolfssl/fix-kyber-mlkem-benchmark.patch
+        - git apply ../../wolfssl/fix-mlkem-get-curve-name.patch
+        - git apply ../../wolfssl/fix-kyber-get-curve-name.patch
         - autoreconf -i
-        - ./configure $CROSS_OPTS C_EXTRA_FLAGS="$C_EXTRA_FLAGS" --prefix=$(pwd)/../builds/wolfssl_build $HE_WOLFSSL_CONF_FLAGS --with-liboqs=$(pwd)/../liboqs/build --disable-crypttests
+        - ./configure $CROSS_OPTS C_EXTRA_FLAGS="$C_EXTRA_FLAGS" --prefix=$(pwd)/../builds/wolfssl_build $HE_WOLFSSL_CONF_FLAGS --disable-crypttests
         - make
         - make install
       :artifacts:

diff --git a/ios.yml b/ios.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build_universal
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - cp ../../cmake/apple.cmake ./apple.cmake
-        - cp ../../ios/liboqs-helper.sh ./liboqs-helper.sh
-        - "./liboqs-helper.sh -iphoneuniversal"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_ios
@@ -33,7 +16,11 @@
         :source: $HE_WOLFSSL_SOURCE
         :tag: $HE_WOLFSSL_TAG
       :build:
-        - git apply ../../wolfssl/fix-falcon-dilithm-flags.patch
+        - git apply ../../wolfssl/include-private-key-fields-for-kyber.patch
+        - git apply ../../wolfssl/make-kyber-mlkem-available.patch
+        - git apply ../../wolfssl/fix-kyber-mlkem-benchmark.patch
+        - git apply ../../wolfssl/fix-mlkem-get-curve-name.patch
+        - git apply ../../wolfssl/fix-kyber-get-curve-name.patch
         - autoreconf -i
         - "cp ../../ios/autotools-ios-helper.sh ./autotools-ios-helper.sh"
         - "./autotools-ios-helper.sh -iphoneuniversal"

diff --git a/ios/Lightway/Lightway.xcodeproj/project.pbxproj b/ios/Lightway/Lightway.xcodeproj/project.pbxproj
@@ -471,12 +471,10 @@
 				);
 				LIBRARY_SEARCH_PATHS = (
 					"$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib",
-					"$(PROJECT_DIR)/../../third_party/liboqs/build_universal/lib",
 				);
 				OTHER_CFLAGS = "";
 				OTHER_LDFLAGS = (
 					"-lwolfssl",
-					"-loqs",
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = com.expressvpn.Lightway;
 				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
@@ -514,12 +512,10 @@
 				);
 				LIBRARY_SEARCH_PATHS = (
 					"$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib",
-					"$(PROJECT_DIR)/../../third_party/liboqs/build_universal/lib",
 				);
 				OTHER_CFLAGS = "";
 				OTHER_LDFLAGS = (
 					"-lwolfssl",
-					"-loqs",
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = com.expressvpn.Lightway;
 				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";

diff --git a/ios/autotools-ios-helper.sh b/ios/autotools-ios-helper.sh
@@ -20,8 +20,6 @@ set -e
 export MIN_IOS_VERSION=12.0
 export MIN_TVOS_VERSION=17.0
 
-OQS_BUILD=${OQS_BUILD:-"$(pwd)/../liboqs/build_universal"}
-
 build() {
     # Compiler options
     export OPT_FLAGS="-O3"
@@ -57,18 +55,18 @@ build() {
         --enable-dtls-mtu \
         --enable-dtls-frag-ch \
         --enable-sp=yes,4096 \
-        --disable-sha3 \
         --disable-dh \
         --enable-curve25519 \
-        --with-liboqs="${OQS_BUILD}" \
         --enable-secure-renegotiation \
         --disable-shared \
         --disable-examples \
         --disable-sys-ca-certs \
         --enable-sni \
         --disable-crypttests \
         --enable-aes-bitsliced \
-        --enable-experimental
+        --enable-experimental \
+        --enable-sha3 \
+        --enable-kyber=all,original
     make clean
     mkdir -p "${EXEC_PREFIX}"
     make V=1 -j"${MAKE_JOBS}" --debug=j

diff --git a/ios/liboqs-helper.sh b/ios/liboqs-helper.sh
diff --git a/linux.yml b/linux.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -35,9 +18,13 @@
       :environment:
         - CFLAGS=-O3 -fPIC -D_FORTIFY_SOURCE=2 -DWOLFSSL_MIN_RSA_BITS=2048 -DWOLFSSL_MIN_ECC_BITS=256 -DUSE_CERT_BUFFERS_4096 -DUSE_CERT_BUFFERS_256 -DWOLFSSL_NO_SPHINCS -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT -Wno-error=stringop-overflow
       :build:
-        - git apply ../../wolfssl/fix-falcon-dilithm-flags.patch
+        - git apply ../../wolfssl/include-private-key-fields-for-kyber.patch
+        - git apply ../../wolfssl/make-kyber-mlkem-available.patch
+        - git apply ../../wolfssl/fix-kyber-mlkem-benchmark.patch
+        - git apply ../../wolfssl/fix-mlkem-get-curve-name.patch
+        - git apply ../../wolfssl/fix-kyber-get-curve-name.patch
         - "autoreconf -i"
-        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build --enable-aesni --enable-sp-asm --enable-intelasm"
+        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --enable-aesni --enable-sp-asm --enable-intelasm"
         - "make"
         - "make install"
       :artifacts:

diff --git a/linux_386.yml b/linux_386.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DCMAKE_TOOLCHAIN_FILE=.CMake/toolchain_x86.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -36,9 +19,13 @@
         - CFLAGS=-O3 -fPIC -D_FORTIFY_SOURCE=2 -DWOLFSSL_MIN_RSA_BITS=2048 -DWOLFSSL_MIN_ECC_BITS=256 -m32 -DUSE_CERT_BUFFERS_4096 -DUSE_CERT_BUFFERS_256 -DWOLFSSL_NO_SPHINCS -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT
         - LDFLAGS= -m32
       :build:
-        - git apply ../../wolfssl/fix-falcon-dilithm-flags.patch
+        - git apply ../../wolfssl/include-private-key-fields-for-kyber.patch
+        - git apply ../../wolfssl/make-kyber-mlkem-available.patch
+        - git apply ../../wolfssl/fix-kyber-mlkem-benchmark.patch
+        - git apply ../../wolfssl/fix-mlkem-get-curve-name.patch
+        - git apply ../../wolfssl/fix-kyber-get-curve-name.patch
         - "autoreconf -i"
-        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build --disable-asm --disable-sp-asm --disable-intelasm"
+        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build"
         - "make"
         - "make install"
       :artifacts:

diff --git a/linux_arm.yml b/linux_arm.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DCMAKE_TOOLCHAIN_FILE=.CMake/toolchain_armhf.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -35,9 +18,13 @@
       :environment:
         - CFLAGS=-O3 -fPIC -D_FORTIFY_SOURCE=2 -DWOLFSSL_MIN_RSA_BITS=2048 -DWOLFSSL_MIN_ECC_BITS=256 -DUSE_CERT_BUFFERS_4096 -DUSE_CERT_BUFFERS_256 -DWOLFSSL_NO_ATOMICS -DWOLFSSL_NO_SPHINCS -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT
       :build:
-        - git apply ../../wolfssl/fix-falcon-dilithm-flags.patch
+        - git apply ../../wolfssl/include-private-key-fields-for-kyber.patch
+        - git apply ../../wolfssl/make-kyber-mlkem-available.patch
+        - git apply ../../wolfssl/fix-kyber-mlkem-benchmark.patch
+        - git apply ../../wolfssl/fix-mlkem-get-curve-name.patch
+        - git apply ../../wolfssl/fix-kyber-get-curve-name.patch
         - "autoreconf -i"
-        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build"
+        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build"
         - "make"
         - "make install"
       :artifacts: