CVPN-1615 Remove liboqs and use WolfSSL's Kyber implementation

Remove references to liboqs and edit build flag/configs for each of the platform. Since WolfSSL would officially release their Kyber/ML-KEM implementations a few months later, we would use the git patch to essentially patch their PRs on top of the 5.7.4 release. The patch consists of the commits and code changes from the following PR from WolfSSL: - wolfSSL/wolfssl#8143 - wolfSSL/wolfssl#8172 - wolfSSL/wolfssl#8183 - wolfSSL/wolfssl#8185 Configuration for enabling ML-KEM/Kyber: 1. For only ML-KEM: ./configure --enable-kyber ./configure --enable-kyber=all,ml-kem 2. For just Kyber: ./configure --enable-kyber=all,original 3. For ML-KEM and Kyber ./configure --enable-kyber=all,original,ml-kem ./configure --enable-kyber=all,ml-kem,original
expressvpn · Dec 3, 2024 · c590930 · c590930
1 parent c49ea2a
commit c590930
Show file tree

Hide file tree

Showing 27 changed files with 3,741 additions and 383 deletions.
diff --git a/3rd_party_deps.yml b/3rd_party_deps.yml
@@ -6,7 +6,6 @@
       --disable-dh
       --disable-examples
       --disable-oldtls
-      --disable-sha3
       --disable-shared
       --disable-sys-ca-certs
       --disable-dilithium
@@ -23,6 +22,5 @@
       --enable-static
       --enable-tls13
       --enable-experimental
-  - :HE_LIBOQS_SOURCE: https://github.com/open-quantum-safe/liboqs
-  - :HE_LIBOQS_TAG: 0.9.2
-  - :HE_LIBOQS_BUILD_FLAGS: -DOQS_BUILD_ONLY_LIB=ON -DOQS_USE_OPENSSL=OFF -DOQS_MINIMAL_BUILD='KEM_kyber_512;KEM_kyber_768;KEM_kyber_1024;SIG_dilithium_2;SIG_dilithium_3;SIG_dilithium_5;SIG_falcon_512;SIG_falcon_1024'
+      --enable-sha3
+      --enable-kyber=all,original
diff --git a/Earthfile b/Earthfile
@@ -18,7 +18,7 @@ libhelium-deps:
     # Make the directory structure so that the config can be parsed
     # To improve caching we want to separate this out as the WolfSSL dependency
     # fetch and build are the slowest parts of the process.
-    RUN mkdir -p src include test/support third_party/wolfssl third_party/liboqs
+    RUN mkdir -p src include test/support third_party/wolfssl
     # Copy the patch files
     COPY --dir wolfssl ./
     # Build and fetch the dependencies

diff --git a/android.yml b/android.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DANDROID_ABI=$ARCH -DCMAKE_TOOLCHAIN_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -38,7 +21,7 @@
       :build:
         - git apply ../../wolfssl/*.patch
         - autoreconf -i
-        - ./configure $CROSS_OPTS C_EXTRA_FLAGS="$C_EXTRA_FLAGS" --prefix=$(pwd)/../builds/wolfssl_build $HE_WOLFSSL_CONF_FLAGS --with-liboqs=$(pwd)/../liboqs/build --disable-crypttests
+        - ./configure $CROSS_OPTS C_EXTRA_FLAGS="$C_EXTRA_FLAGS" --prefix=$(pwd)/../builds/wolfssl_build $HE_WOLFSSL_CONF_FLAGS --disable-crypttests
         - make
         - make install
       :artifacts:

diff --git a/ios.yml b/ios.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build_universal
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - cp ../../cmake/apple.cmake ./apple.cmake
-        - cp ../../ios/liboqs-helper.sh ./liboqs-helper.sh
-        - "./liboqs-helper.sh -iphoneuniversal"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_ios

diff --git a/ios/Lightway/Lightway.xcodeproj/project.pbxproj b/ios/Lightway/Lightway.xcodeproj/project.pbxproj
@@ -101,7 +101,6 @@
 		DDA0C8C425F1DDFD00B7903F /* memory.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = memory.c; path = ../../src/he/memory.c; sourceTree = "<group>"; };
 		DDFE22BD2AD80FAD00172C79 /* pmtud.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = pmtud.h; path = ../../src/he/pmtud.h; sourceTree = "<group>"; };
 		DDFE22BE2AD80FAD00172C79 /* pmtud.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = pmtud.c; path = ../../src/he/pmtud.c; sourceTree = "<group>"; };
-		E0300B432A8DDF9800008A0A /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS16.4.sdk/System/Library/Frameworks/Security.framework; sourceTree = DEVELOPER_DIR; };
 		E09326E52AE8E8AB00DA4EE8 /* network.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = network.h; path = ../../src/he/network.h; sourceTree = "<group>"; };
 		E09326E62AE8E8AB00DA4EE8 /* network.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = network.c; path = ../../src/he/network.c; sourceTree = "<group>"; };
 		E0F60F0B2AEB923E00FAE456 /* mss.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = mss.h; path = ../../src/he/mss.h; sourceTree = "<group>"; };
@@ -201,7 +200,6 @@
 		9969C51E2463D880001960F0 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
-				E0300B432A8DDF9800008A0A /* Security.framework */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
@@ -469,15 +467,9 @@
 					"@executable_path/Frameworks",
 					"@loader_path/Frameworks",
 				);
-				LIBRARY_SEARCH_PATHS = (
-					"$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib",
-					"$(PROJECT_DIR)/../../third_party/liboqs/build_universal/lib",
-				);
+				LIBRARY_SEARCH_PATHS = "$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib";
 				OTHER_CFLAGS = "";
-				OTHER_LDFLAGS = (
-					"-lwolfssl",
-					"-loqs",
-				);
+				OTHER_LDFLAGS = "-lwolfssl";
 				PRODUCT_BUNDLE_IDENTIFIER = com.expressvpn.Lightway;
 				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
@@ -512,15 +504,9 @@
 					"@executable_path/Frameworks",
 					"@loader_path/Frameworks",
 				);
-				LIBRARY_SEARCH_PATHS = (
-					"$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib",
-					"$(PROJECT_DIR)/../../third_party/liboqs/build_universal/lib",
-				);
+				LIBRARY_SEARCH_PATHS = "$(PROJECT_DIR)/../../third_party/builds/wolfssl_ios/Release$(EFFECTIVE_PLATFORM_NAME)/lib";
 				OTHER_CFLAGS = "";
-				OTHER_LDFLAGS = (
-					"-lwolfssl",
-					"-loqs",
-				);
+				OTHER_LDFLAGS = "-lwolfssl";
 				PRODUCT_BUNDLE_IDENTIFIER = com.expressvpn.Lightway;
 				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
 				PROVISIONING_PROFILE_SPECIFIER = "";

diff --git a/ios/autotools-ios-helper.sh b/ios/autotools-ios-helper.sh
@@ -20,8 +20,6 @@ set -e
 export MIN_IOS_VERSION=12.0
 export MIN_TVOS_VERSION=17.0
 
-OQS_BUILD=${OQS_BUILD:-"$(pwd)/../liboqs/build_universal"}
-
 build() {
     # Compiler options
     export OPT_FLAGS="-O3"
@@ -57,18 +55,18 @@ build() {
         --enable-dtls-mtu \
         --enable-dtls-frag-ch \
         --enable-sp=yes,4096 \
-        --disable-sha3 \
         --disable-dh \
         --enable-curve25519 \
-        --with-liboqs="${OQS_BUILD}" \
         --enable-secure-renegotiation \
         --disable-shared \
         --disable-examples \
         --disable-sys-ca-certs \
         --enable-sni \
         --disable-crypttests \
         --enable-aes-bitsliced \
-        --enable-experimental
+        --enable-experimental \
+        --enable-sha3 \
+        --enable-kyber=all,original
     make clean
     mkdir -p "${EXEC_PREFIX}"
     make V=1 -j"${MAKE_JOBS}" --debug=j

diff --git a/ios/liboqs-helper.sh b/ios/liboqs-helper.sh
diff --git a/linux.yml b/linux.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -37,7 +20,7 @@
       :build:
         - git apply ../../wolfssl/*.patch
         - "autoreconf -i"
-        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build --enable-aesni --enable-sp-asm --enable-intelasm"
+        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --enable-aesni --enable-sp-asm --enable-intelasm"
         - "make"
         - "make install"
       :artifacts:

diff --git a/linux_386.yml b/linux_386.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DCMAKE_TOOLCHAIN_FILE=.CMake/toolchain_x86.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -38,7 +21,7 @@
       :build:
         - git apply ../../wolfssl/*.patch
         - "autoreconf -i"
-        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build --disable-asm --disable-sp-asm --disable-intelasm"
+        - "./configure $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --disable-asm --disable-sp-asm --disable-intelasm"
         - "make"
         - "make install"
       :artifacts:

diff --git a/linux_arm.yml b/linux_arm.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DCMAKE_TOOLCHAIN_FILE=.CMake/toolchain_armhf.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -37,7 +20,7 @@
       :build:
         - git apply ../../wolfssl/*.patch
         - "autoreconf -i"
-        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build"
+        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build"
         - "make"
         - "make install"
       :artifacts:

diff --git a/linux_arm64.yml b/linux_arm64.yml
@@ -8,23 +8,6 @@
 
 :dependencies:
   :libraries:
-    - :name: liboqs
-      :source_path: third_party/liboqs
-      :artifact_path: third_party/liboqs/build
-      :fetch:
-        :method: :git
-        :source: $HE_LIBOQS_SOURCE
-        :tag: $HE_LIBOQS_TAG
-      :build:
-        - "mkdir -p build"
-        - "cd build && cmake -DCMAKE_TOOLCHAIN_FILE=.CMake/toolchain_arm64.cmake $HE_LIBOQS_BUILD_FLAGS .."
-        - "cd build && make all"
-      :artifacts:
-        :includes:
-          - include
-          - include/oqs
-        :static_libraries:
-          - lib/liboqs.a
     - :name: WolfSSL
       :source_path: third_party/wolfssl
       :artifact_path: third_party/builds/wolfssl_build
@@ -37,7 +20,7 @@
       :build:
         - git apply ../../wolfssl/*.patch
         - "autoreconf -i"
-        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --with-liboqs=$(pwd)/../liboqs/build --enable-sp-asm --enable-armasm"
+        - "./configure --host=$CROSS_COMPILE $HE_WOLFSSL_CONF_FLAGS --prefix=$(pwd)/../builds/wolfssl_build --enable-sp-asm --enable-armasm"
         - "make"
         - "make install"
       :artifacts: