Skip to content

Fix issues found reviewing the wolfSSL manual #12038

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LinuxJedi wants to merge 7 commits into
base: master
Choose a base branch
from
+1,226 −509
Open

Fix issues found reviewing the wolfSSL manual #12038

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fa61357
Fix the "(null)" printed at the end of client and server usage
LinuxJedi Nov 6, 2026
5bf9a4e
Show the right key exchange group in tls_bench results
LinuxJedi Nov 6, 2026
efdf980
Use a default hybrid group in the INSTALL post-quantum example
LinuxJedi Nov 6, 2026
5eacf85
Correct configure help strings and the Intel QA sync define
LinuxJedi Nov 6, 2026
91c1e02
Correct build option descriptions in source comment blocks
LinuxJedi Nov 6, 2026
653f1a1
Fix Doxygen groups and API comment errors
LinuxJedi Nov 6, 2026
d1f301f
Document the Encrypted Client Hello API
LinuxJedi Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions INSTALL
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,13 +206,13 @@

For a quick start, you can run the client and server like this:

$ ./examples/server/server -v 4 --pqc SecP521r1MLKEM1024
$ ./examples/client/client -v 4 --pqc SecP521r1MLKEM1024
$ ./examples/server/server -v 4 --pqc SecP384r1MLKEM1024
$ ./examples/client/client -v 4 --pqc SecP384r1MLKEM1024

Look for the following line in the output of the server and client:

```
Using Post-Quantum KEM: SecP521r1MLKEM1024
Using Post-Quantum KEM: SecP384r1MLKEM1024
```

For authentication, you can generate a certificate chain using the Open
Expand All @@ -234,13 +234,13 @@
-A certs/mldsa87_root_cert.pem \
-c certs/mldsa44_entity_cert.pem \
-k certs/mldsa44_entity_key.pem \
--pqc SecP521r1MLKEM1024
--pqc SecP384r1MLKEM1024

$ examples/client/client -v 4 -l TLS_AES_256_GCM_SHA384 \
-A certs/mldsa44_root_cert.pem \
-c certs/mldsa87_entity_cert.pem \
-k certs/mldsa87_entity_key.pem \
--pqc SecP521r1MLKEM1024
--pqc SecP384r1MLKEM1024

Congratulations! You have just achieved a fully quantum-safe TLS 1.3
connection!
Expand Down
23 changes: 14 additions & 9 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,7 +398,7 @@ fi
# ./configure CFLAGS="-m32" LDFLAGS="-m32" && make
# The checks for sizeof long and long/long are run at the top of configure and require "-m32" to be set directly in the ./configure statement.
AC_ARG_ENABLE([32bit],
[AS_HELP_STRING([--enable-32bit],[Enables 32-bit support (default: disabled)])],
[AS_HELP_STRING([--enable-32bit],[Use 32-bit machine words (WC_32BIT_CPU) and leave out 64-bit only code. Does not add -m32 (default: disabled)])],
[ ENABLED_32BIT=$enableval ],
[ ENABLED_32BIT=no ]
)
Expand All @@ -420,7 +420,7 @@ then
fi

AC_ARG_ENABLE([64bit],
[AS_HELP_STRING([--enable-64bit],[Enables 64-bit support (default: disabled)])],
[AS_HELP_STRING([--enable-64bit],[Build only the 64-bit SP C code (sp_c64.c), not sp_c32.c (default: disabled)])],
[ ENABLED_64BIT=$enableval ],
[ ENABLED_64BIT=no ]
)
Expand Down Expand Up @@ -2909,11 +2909,16 @@ fi

# TLS v1.3 Draft 18 (Note: only final TLS v1.3 supported, here for backwards build compatibility)
AC_ARG_ENABLE([tls13-draft18],
[AS_HELP_STRING([--enable-tls13-draft18],[Enable wolfSSL TLS v1.3 Draft 18 (default: disabled)])],
[AS_HELP_STRING([--enable-tls13-draft18],[Obsolete and ignored, TLS v1.3 draft 18 is no longer supported (default: disabled)])],
[ ENABLED_TLS13_DRAFT18=$enableval ],
[ ENABLED_TLS13_DRAFT18=no ]
)

if test "$ENABLED_TLS13_DRAFT18" != "no"
then
AC_MSG_WARN([--enable-tls13-draft18 is obsolete and ignored, only the final TLS v1.3 (RFC 8446) is supported.])
fi

# TLS v1.3
AC_ARG_ENABLE([tls13],
[AS_HELP_STRING([--enable-tls13],[Enable wolfSSL TLS v1.3 (default: enabled)])],
Expand Down Expand Up @@ -3553,7 +3558,7 @@ fi

# One Error Queue per Thread
AC_ARG_ENABLE([error-queue-per-thread],
[AS_HELP_STRING([--enable-error-queue-per-thread],[Enable one error queue per thread. Requires thread local storage. (default: disabled)])],
[AS_HELP_STRING([--enable-error-queue-per-thread],[Enable one error queue per thread. Requires thread local storage. (default: enabled when thread local storage is available and not single threaded)])],
[ ENABLED_ERRORQUEUEPERTHREAD=$enableval ],
[ ENABLED_ERRORQUEUEPERTHREAD=check ]
)
Expand Down Expand Up @@ -4461,7 +4466,7 @@ AS_IF([ test "x$ENABLED_SNIFFER" = "xyes" ],

# AES-ECB
AC_ARG_ENABLE([aesecb],
[AS_HELP_STRING([--enable-aesecb],[Enable wolfSSL AES-ECB support (default: enabled)])],
[AS_HELP_STRING([--enable-aesecb],[Enable wolfSSL AES-ECB support (default: disabled)])],
[ ENABLED_AESECB=$enableval ],
[ ENABLED_AESECB=no ]
)
Expand All @@ -4486,7 +4491,7 @@ then
fi

# AES-CBC length checks (checks that input lengths are multiples of block size)
AC_ARG_ENABLE([aescbc_length_checks],
AC_ARG_ENABLE([aescbc-length-checks],
[AS_HELP_STRING([--enable-aescbc-length-checks],[Enable AES-CBC length validity checks (default: disabled)])],
[ ENABLED_AESCBC_LENGTH_CHECKS=$enableval ],
[ ENABLED_AESCBC_LENGTH_CHECKS=no ]
Expand Down Expand Up @@ -7323,7 +7328,7 @@ case $host_os in
esac

AC_ARG_ENABLE([asn-print],
[AS_HELP_STRING([--enable-asn-print],[Enable ASN Print API (default: enabled)])],
[AS_HELP_STRING([--enable-asn-print],[Enable ASN Print API (default: enabled on Linux, macOS and FreeBSD hosts)])],
[ ENABLED_ASN_PRINT=$enableval ],
[ ENABLED_ASN_PRINT=$DEF_ASN_PRINT ]
)
Expand Down Expand Up @@ -10106,7 +10111,7 @@ then
fi

AC_ARG_ENABLE([ticket-nonce-malloc],
[AS_HELP_STRING([--enable-ticket-nonce-malloc], [Enable dynamic allocation of ticket nonces (default: disabled)])],
[AS_HELP_STRING([--enable-ticket-nonce-malloc], [Enable dynamic allocation of ticket nonces (default: disabled, enabled by --enable-curl)])],
[ ENABLED_TICKET_NONCE_MALLOC=$enableval ],
[ ENABLED_TICKET_NONCE_MALLOC=no_implicit ]
)
Expand Down Expand Up @@ -11752,7 +11757,7 @@ AS_IF([test "x$ENABLED_INTEL_QA" = "xyes" || test "x$ENABLED_INTEL_QA_SYNC" = "x
[AC_MSG_CHECKING([for intelqa])
AS_IF([test "x$ENABLED_INTEL_QA" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_INTEL_QA -DDO_CRYPTO -DUSER_SPACE"; intelqa_opt=""],
[AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_INTEL_QA_SYNC -DQAT_USE_POLLING_THREAD -DO_CRYPTO -DUSER_SPACE"; intelqa_opt="-sync"])
[AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_INTEL_QA_SYNC -DQAT_USE_POLLING_THREAD -DDO_CRYPTO -DUSER_SPACE"; intelqa_opt="-sync"])
OLD_LIBS="$LIBS"
OLD_CPPFLAGS="$CPPFLAGS"

Expand Down
30 changes: 15 additions & 15 deletions doc/dox_comments/header_files/asn_public.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2209,7 +2209,7 @@ int wc_DsaKeyToParamsDer_ex(DsaKey* key, byte* output,
word32* outLen);

/*!
\ingroup DH
\ingroup Diffie-Hellman
\brief Encodes DH parameters to DER format.

\return 0 on success
Expand All @@ -2232,7 +2232,7 @@ int wc_DsaKeyToParamsDer_ex(DsaKey* key, byte* output,
int wc_DhParamsToDer(DhKey* key, byte* out, word32* outSz);

/*!
\ingroup DH
\ingroup Diffie-Hellman
\brief Encodes DH public key to DER format.

\return 0 on success
Expand All @@ -2255,7 +2255,7 @@ int wc_DhParamsToDer(DhKey* key, byte* out, word32* outSz);
int wc_DhPubKeyToDer(DhKey* key, byte* out, word32* outSz);

/*!
\ingroup DH
\ingroup Diffie-Hellman
\brief Encodes DH private key to DER format.

\return 0 on success
Expand Down Expand Up @@ -2827,7 +2827,7 @@ int wc_Curve25519KeyToDer(curve25519_key* key, byte* output, word32 outLen,
int withAlg);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Decodes Ed25519 private key from DER format.

\return 0 on success
Expand All @@ -2853,7 +2853,7 @@ int wc_Ed25519PrivateKeyDecode(const byte* input, word32* inOutIdx,
ed25519_key* key, word32 inSz);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Decodes Ed25519 private key from DER format with control over
validation of a bundled public key. When the DER contains a public key
and trusted is 0, the public key is validated with
Expand Down Expand Up @@ -2890,7 +2890,7 @@ int wc_Ed25519PrivateKeyDecode_ex(const byte* input, word32* inOutIdx,
ed25519_key* key, word32 inSz, int trusted);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Decodes Ed25519 public key from DER format.

\return 0 on success
Expand All @@ -2915,7 +2915,7 @@ int wc_Ed25519PublicKeyDecode(const byte* input, word32* inOutIdx,
ed25519_key* key, word32 inSz);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Encodes Ed25519 key to DER format.

\return Size on success
Expand All @@ -2938,7 +2938,7 @@ int wc_Ed25519KeyToDer(const ed25519_key* key, byte* output,
word32 outLen);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Encodes Ed25519 private key to DER format.

\return Size on success
Expand All @@ -2962,7 +2962,7 @@ int wc_Ed25519PrivateKeyToDer(const ed25519_key* key, byte* output,
word32 outLen);

/*!
\ingroup Ed25519
\ingroup ED25519
\brief Encodes Ed25519 public key to DER format.

\return Size on success
Expand All @@ -2987,7 +2987,7 @@ int wc_Ed25519PublicKeyToDer(const ed25519_key* key, byte* output,
word32 outLen, int withAlg);

/*!
\ingroup Ed448
\ingroup ED448
\brief Decodes Ed448 private key from DER format.

\return 0 on success
Expand All @@ -3013,7 +3013,7 @@ int wc_Ed448PrivateKeyDecode(const byte* input, word32* inOutIdx,
ed448_key* key, word32 inSz);

/*!
\ingroup Ed448
\ingroup ED448
\brief Decodes Ed448 private key from DER format with control over
validation of a bundled public key. When the DER contains a public key
and trusted is 0, the public key is validated with wc_ed448_check_key(),
Expand Down Expand Up @@ -3050,7 +3050,7 @@ int wc_Ed448PrivateKeyDecode_ex(const byte* input, word32* inOutIdx,
ed448_key* key, word32 inSz, int trusted);

/*!
\ingroup Ed448
\ingroup ED448
\brief Decodes Ed448 public key from DER format.

\return 0 on success
Expand All @@ -3075,7 +3075,7 @@ int wc_Ed448PublicKeyDecode(const byte* input, word32* inOutIdx,
ed448_key* key, word32 inSz);

/*!
\ingroup Ed448
\ingroup ED448
\brief Encodes Ed448 key to DER format.

\return Size on success
Expand All @@ -3097,7 +3097,7 @@ int wc_Ed448PublicKeyDecode(const byte* input, word32* inOutIdx,
int wc_Ed448KeyToDer(const ed448_key* key, byte* output, word32 outLen);

/*!
\ingroup Ed448
\ingroup ED448
\brief Encodes Ed448 private key to DER format.

\return Size on success
Expand All @@ -3121,7 +3121,7 @@ int wc_Ed448PrivateKeyToDer(const ed448_key* key, byte* output,
word32 outLen);

/*!
\ingroup Ed448
\ingroup ED448
\brief Encodes Ed448 public key to DER format.

\return Size on success
Expand Down
28 changes: 14 additions & 14 deletions doc/dox_comments/header_files/cryptocb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*!
\ingroup CryptoCb
\ingroup Crypto

\brief This function registers a unique device identifier (devID) and
callback function for offloading crypto operations to external
Expand Down Expand Up @@ -120,7 +120,7 @@
int wc_CryptoCb_RegisterDevice(int devId, CryptoDevCallbackFunc cb, void* ctx);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief This function reports whether a crypto callback device identifier
(devID) is currently registered. It is useful for checking registration
Expand All @@ -146,7 +146,7 @@ int wc_CryptoCb_RegisterDevice(int devId, CryptoDevCallbackFunc cb, void* ctx);
int wc_CryptoCb_IsDeviceRegistered(int devId);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief This function un-registers a unique device identifier (devID)
callback function.
Expand All @@ -169,7 +169,7 @@ int wc_CryptoCb_IsDeviceRegistered(int devId);
void wc_CryptoCb_UnRegisterDevice(int devId);

/*!
\ingroup CryptoCb
\ingroup Crypto
\brief This function returns the default device ID for crypto
callbacks. This is useful when you want to get the device ID that
was set as the default for the library.
Expand All @@ -190,7 +190,7 @@ void wc_CryptoCb_UnRegisterDevice(int devId);
int wc_CryptoCb_DefaultDevID(void);

/*!
\ingroup CryptoCb
\ingroup Crypto
\brief This function sets a callback for finding crypto devices.
The callback is invoked when a device ID needs to be resolved to
a device context. This is useful for dynamic device management.
Expand All @@ -215,7 +215,7 @@ int wc_CryptoCb_DefaultDevID(void);
void wc_CryptoCb_SetDeviceFindCb(CryptoDevCallbackFind cb);

/*!
\ingroup CryptoCb
\ingroup Crypto
\brief This function converts a wc_CryptoInfo structure to a
human-readable string for debugging purposes. The string is printed
to stdout and describes the cryptographic operation being performed.
Expand All @@ -240,7 +240,7 @@ void wc_CryptoCb_SetDeviceFindCb(CryptoDevCallbackFind cb);
void wc_CryptoCb_InfoString(wc_CryptoInfo* info);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Import an AES key into a CryptoCB device for hardware offload.

Expand Down Expand Up @@ -310,7 +310,7 @@ void wc_CryptoCb_InfoString(wc_CryptoInfo* info);
int wc_CryptoCb_AesSetKey(Aes* aes, const byte* key, word32 keySz);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload deriving an ECC public key Q = d*G from its private key to a
CryptoCB device.
Expand Down Expand Up @@ -339,7 +339,7 @@ int wc_CryptoCb_AesSetKey(Aes* aes, const byte* key, word32 keySz);
int wc_CryptoCb_EccMakePub(ecc_key* key, ecc_point* pubOut);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload validating an ECC key to a CryptoCB device.

Expand Down Expand Up @@ -370,7 +370,7 @@ int wc_CryptoCb_EccMakePub(ecc_key* key, ecc_point* pubOut);
int wc_CryptoCb_EccCheckPubKey(ecc_key* key, int checkOrder, int checkPriv);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload deriving an Ed25519 public key from its private key to a
CryptoCB device.
Expand Down Expand Up @@ -399,7 +399,7 @@ int wc_CryptoCb_Ed25519MakePub(ed25519_key* key, byte* pubKey,
word32 pubKeySz);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload validating an Ed25519 key to a CryptoCB device.

Expand All @@ -423,7 +423,7 @@ int wc_CryptoCb_Ed25519MakePub(ed25519_key* key, byte* pubKey,
int wc_CryptoCb_Ed25519CheckKey(ed25519_key* key);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload Ed448 key generation to a CryptoCB device.

Expand All @@ -450,7 +450,7 @@ int wc_CryptoCb_Ed25519CheckKey(ed25519_key* key);
int wc_CryptoCb_Ed448Gen(WC_RNG* rng, int keySize, ed448_key* key);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload deriving an Ed448 public key from its private key to a
CryptoCB device.
Expand All @@ -476,7 +476,7 @@ int wc_CryptoCb_Ed448Gen(WC_RNG* rng, int keySize, ed448_key* key);
int wc_CryptoCb_Ed448MakePub(ed448_key* key, byte* pubKey, word32 pubKeySz);

/*!
\ingroup CryptoCb
\ingroup Crypto

\brief Offload validating an Ed448 key to a CryptoCB device.

Expand Down
Loading
Loading