luna - wolfssl/tests/api/test

   1/* test_slhdsa.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#ifdef WOLFSSL_HAVE_SLHDSA
  32    #include <wolfssl/wolfcrypt/wc_slhdsa.h>
  33#endif
  34#include <wolfssl/wolfcrypt/types.h>
  35#include <wolfssl/wolfcrypt/asn.h>
  36#include <wolfssl/wolfcrypt/asn_public.h>
  37#include <tests/api/api.h>
  38#include <tests/api/test_slhdsa.h>
  39
  40
  41#ifdef WOLFSSL_HAVE_SLHDSA
  42/* Pick the first available parameter set so tests that just need any one valid
  43 * SLH-DSA configuration compile and run in SHAKE-only, SHA-2-only, or mixed
  44 * builds. Preference order: SHAKE 128s/f, 192s/f, 256s/f, then the SHA-2
  45 * variants in the same order. */
  46#if defined(WOLFSSL_SLHDSA_PARAM_128S)
  47    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE128S
  48    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE128S_SIG_LEN
  49    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE128S_PRIV_LEN
  50    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE128S_PUB_LEN
  51    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE128S_SEED_LEN
  52#elif defined(WOLFSSL_SLHDSA_PARAM_128F)
  53    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE128F
  54    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE128F_SIG_LEN
  55    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE128F_PRIV_LEN
  56    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE128F_PUB_LEN
  57    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE128F_SEED_LEN
  58#elif defined(WOLFSSL_SLHDSA_PARAM_192S)
  59    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE192S
  60    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE192S_SIG_LEN
  61    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE192S_PRIV_LEN
  62    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE192S_PUB_LEN
  63    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE192S_SEED_LEN
  64#elif defined(WOLFSSL_SLHDSA_PARAM_192F)
  65    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE192F
  66    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE192F_SIG_LEN
  67    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE192F_PRIV_LEN
  68    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE192F_PUB_LEN
  69    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE192F_SEED_LEN
  70#elif defined(WOLFSSL_SLHDSA_PARAM_256S)
  71    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE256S
  72    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE256S_SIG_LEN
  73    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE256S_PRIV_LEN
  74    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE256S_PUB_LEN
  75    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE256S_SEED_LEN
  76#elif defined(WOLFSSL_SLHDSA_PARAM_256F)
  77    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHAKE256F
  78    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHAKE256F_SIG_LEN
  79    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHAKE256F_PRIV_LEN
  80    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHAKE256F_PUB_LEN
  81    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHAKE256F_SEED_LEN
  82#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)
  83    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_128S
  84    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_128S_SIG_LEN
  85    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_128S_PRIV_LEN
  86    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_128S_PUB_LEN
  87    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_128S_SEED_LEN
  88#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_128F)
  89    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_128F
  90    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_128F_SIG_LEN
  91    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_128F_PRIV_LEN
  92    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_128F_PUB_LEN
  93    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_128F_SEED_LEN
  94#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_192S)
  95    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_192S
  96    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_192S_SIG_LEN
  97    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_192S_PRIV_LEN
  98    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_192S_PUB_LEN
  99    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_192S_SEED_LEN
 100#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_192F)
 101    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_192F
 102    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_192F_SIG_LEN
 103    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_192F_PRIV_LEN
 104    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_192F_PUB_LEN
 105    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_192F_SEED_LEN
 106#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_256S)
 107    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_256S
 108    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_256S_SIG_LEN
 109    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_256S_PRIV_LEN
 110    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_256S_PUB_LEN
 111    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_256S_SEED_LEN
 112#elif defined(WOLFSSL_SLHDSA_PARAM_SHA2_256F)
 113    #define TEST_SLHDSA_DEFAULT_PARAM     SLHDSA_SHA2_256F
 114    #define TEST_SLHDSA_DEFAULT_SIG_LEN   WC_SLHDSA_SHA2_256F_SIG_LEN
 115    #define TEST_SLHDSA_DEFAULT_PRIV_LEN  WC_SLHDSA_SHA2_256F_PRIV_LEN
 116    #define TEST_SLHDSA_DEFAULT_PUB_LEN   WC_SLHDSA_SHA2_256F_PUB_LEN
 117    #define TEST_SLHDSA_DEFAULT_SEED_LEN  WC_SLHDSA_SHA2_256F_SEED_LEN
 118#endif
 119#endif /* WOLFSSL_HAVE_SLHDSA */
 120
 121
 122/*
 123 * Test basic init/free and NULL parameter handling for SLH-DSA key operations.
 124 */
 125int test_wc_slhdsa(void)
 126{
 127    EXPECT_DECLS;
 128#ifdef WOLFSSL_HAVE_SLHDSA
 129    /* `key` is only used by the per-variant Init/Free blocks below, so
 130     * gate its declaration on the same precondition (at least one
 131     * parameter set compiled in) to avoid -Wunused-variable when SLH-DSA
 132     * is enabled but no params are. */
 133#ifdef TEST_SLHDSA_DEFAULT_PARAM
 134    SlhDsaKey key;
 135
 136    /* Test NULL parameter handling for init. Use whichever variant the
 137     * build actually has so a SHA-2-only build doesn't pass a SHAKE param
 138     * id and conflate BAD_FUNC_ARG (NULL key) with NOT_COMPILED_IN
 139     * (variant disabled). */
 140    ExpectIntEQ(wc_SlhDsaKey_Init(NULL, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 141        INVALID_DEVID), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 142#endif
 143
 144    /* Test wc_SlhDsaKey_Free with NULL - should not crash. */
 145    wc_SlhDsaKey_Free(NULL);
 146
 147    /* Test valid init for each supported parameter set. Each block zeros
 148     * `key` first so a future regression where wc_SlhDsaKey_Free leaves
 149     * a residual field set cannot be papered over by the next Init's
 150     * partial reinitialisation. */
 151#ifdef WOLFSSL_SLHDSA_PARAM_128S
 152    XMEMSET(&key, 0, sizeof(key));
 153    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128S, NULL, INVALID_DEVID),
 154        0);
 155    wc_SlhDsaKey_Free(&key);
 156#endif
 157#ifdef WOLFSSL_SLHDSA_PARAM_128F
 158    XMEMSET(&key, 0, sizeof(key));
 159    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128F, NULL, INVALID_DEVID),
 160        0);
 161    wc_SlhDsaKey_Free(&key);
 162#endif
 163#ifdef WOLFSSL_SLHDSA_PARAM_192S
 164    XMEMSET(&key, 0, sizeof(key));
 165    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192S, NULL, INVALID_DEVID),
 166        0);
 167    wc_SlhDsaKey_Free(&key);
 168#endif
 169#ifdef WOLFSSL_SLHDSA_PARAM_192F
 170    XMEMSET(&key, 0, sizeof(key));
 171    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192F, NULL, INVALID_DEVID),
 172        0);
 173    wc_SlhDsaKey_Free(&key);
 174#endif
 175#ifdef WOLFSSL_SLHDSA_PARAM_256S
 176    XMEMSET(&key, 0, sizeof(key));
 177    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256S, NULL, INVALID_DEVID),
 178        0);
 179    wc_SlhDsaKey_Free(&key);
 180#endif
 181#ifdef WOLFSSL_SLHDSA_PARAM_256F
 182    XMEMSET(&key, 0, sizeof(key));
 183    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256F, NULL, INVALID_DEVID),
 184        0);
 185    wc_SlhDsaKey_Free(&key);
 186#endif
 187#ifdef WOLFSSL_SLHDSA_SHA2
 188#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
 189    XMEMSET(&key, 0, sizeof(key));
 190    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128S, NULL, INVALID_DEVID),
 191        0);
 192    wc_SlhDsaKey_Free(&key);
 193#endif
 194#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
 195    XMEMSET(&key, 0, sizeof(key));
 196    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128F, NULL, INVALID_DEVID),
 197        0);
 198    wc_SlhDsaKey_Free(&key);
 199#endif
 200#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
 201    XMEMSET(&key, 0, sizeof(key));
 202    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192S, NULL, INVALID_DEVID),
 203        0);
 204    wc_SlhDsaKey_Free(&key);
 205#endif
 206#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
 207    XMEMSET(&key, 0, sizeof(key));
 208    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192F, NULL, INVALID_DEVID),
 209        0);
 210    wc_SlhDsaKey_Free(&key);
 211#endif
 212#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
 213    XMEMSET(&key, 0, sizeof(key));
 214    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256S, NULL, INVALID_DEVID),
 215        0);
 216    wc_SlhDsaKey_Free(&key);
 217#endif
 218#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
 219    XMEMSET(&key, 0, sizeof(key));
 220    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256F, NULL, INVALID_DEVID),
 221        0);
 222    wc_SlhDsaKey_Free(&key);
 223#endif
 224#endif /* WOLFSSL_SLHDSA_SHA2 */
 225
 226#endif /* WOLFSSL_HAVE_SLHDSA */
 227    return EXPECT_RESULT();
 228}
 229
 230/*
 231 * Test size functions for SLH-DSA.
 232 */
 233int test_wc_slhdsa_sizes(void)
 234{
 235    EXPECT_DECLS;
 236#ifdef WOLFSSL_HAVE_SLHDSA
 237    /* See test_wc_slhdsa() for the rationale on this guard. */
 238#ifdef TEST_SLHDSA_DEFAULT_PARAM
 239    SlhDsaKey key;
 240#endif
 241
 242    /* Test NULL parameter handling for size functions. */
 243#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 244    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 245#endif
 246    ExpectIntEQ(wc_SlhDsaKey_PublicSize(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 247    ExpectIntEQ(wc_SlhDsaKey_SigSize(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 248
 249    /* Test sizes for each parameter set. */
 250#ifdef WOLFSSL_SLHDSA_PARAM_128S
 251    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128S, NULL, INVALID_DEVID),
 252        0);
 253#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 254    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE128S_PRIV_LEN);
 255#endif
 256    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE128S_PUB_LEN);
 257    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE128S_SIG_LEN);
 258    wc_SlhDsaKey_Free(&key);
 259
 260#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 261    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE128S),
 262        WC_SLHDSA_SHAKE128S_PRIV_LEN);
 263#endif
 264    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE128S),
 265        WC_SLHDSA_SHAKE128S_PUB_LEN);
 266    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE128S),
 267        WC_SLHDSA_SHAKE128S_SIG_LEN);
 268#endif
 269
 270#ifdef WOLFSSL_SLHDSA_PARAM_128F
 271    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128F, NULL, INVALID_DEVID),
 272        0);
 273#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 274    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE128F_PRIV_LEN);
 275#endif
 276    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE128F_PUB_LEN);
 277    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE128F_SIG_LEN);
 278    wc_SlhDsaKey_Free(&key);
 279
 280#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 281    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE128F),
 282        WC_SLHDSA_SHAKE128F_PRIV_LEN);
 283#endif
 284    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE128F),
 285        WC_SLHDSA_SHAKE128F_PUB_LEN);
 286    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE128F),
 287        WC_SLHDSA_SHAKE128F_SIG_LEN);
 288#endif
 289
 290#ifdef WOLFSSL_SLHDSA_PARAM_192S
 291    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192S, NULL, INVALID_DEVID),
 292        0);
 293#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 294    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE192S_PRIV_LEN);
 295#endif
 296    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE192S_PUB_LEN);
 297    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE192S_SIG_LEN);
 298    wc_SlhDsaKey_Free(&key);
 299
 300#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 301    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE192S),
 302        WC_SLHDSA_SHAKE192S_PRIV_LEN);
 303#endif
 304    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE192S),
 305        WC_SLHDSA_SHAKE192S_PUB_LEN);
 306    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE192S),
 307        WC_SLHDSA_SHAKE192S_SIG_LEN);
 308#endif
 309
 310#ifdef WOLFSSL_SLHDSA_PARAM_192F
 311    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192F, NULL, INVALID_DEVID),
 312        0);
 313#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 314    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE192F_PRIV_LEN);
 315#endif
 316    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE192F_PUB_LEN);
 317    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE192F_SIG_LEN);
 318    wc_SlhDsaKey_Free(&key);
 319
 320#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 321    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE192F),
 322        WC_SLHDSA_SHAKE192F_PRIV_LEN);
 323#endif
 324    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE192F),
 325        WC_SLHDSA_SHAKE192F_PUB_LEN);
 326    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE192F),
 327        WC_SLHDSA_SHAKE192F_SIG_LEN);
 328#endif
 329
 330#ifdef WOLFSSL_SLHDSA_PARAM_256S
 331    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256S, NULL, INVALID_DEVID),
 332        0);
 333#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 334    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE256S_PRIV_LEN);
 335#endif
 336    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE256S_PUB_LEN);
 337    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE256S_SIG_LEN);
 338    wc_SlhDsaKey_Free(&key);
 339
 340#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 341    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE256S),
 342        WC_SLHDSA_SHAKE256S_PRIV_LEN);
 343#endif
 344    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE256S),
 345        WC_SLHDSA_SHAKE256S_PUB_LEN);
 346    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE256S),
 347        WC_SLHDSA_SHAKE256S_SIG_LEN);
 348#endif
 349
 350#ifdef WOLFSSL_SLHDSA_PARAM_256F
 351    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256F, NULL, INVALID_DEVID),
 352        0);
 353#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 354    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHAKE256F_PRIV_LEN);
 355#endif
 356    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHAKE256F_PUB_LEN);
 357    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHAKE256F_SIG_LEN);
 358    wc_SlhDsaKey_Free(&key);
 359
 360#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 361    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHAKE256F),
 362        WC_SLHDSA_SHAKE256F_PRIV_LEN);
 363#endif
 364    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHAKE256F),
 365        WC_SLHDSA_SHAKE256F_PUB_LEN);
 366    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHAKE256F),
 367        WC_SLHDSA_SHAKE256F_SIG_LEN);
 368#endif
 369
 370#ifdef WOLFSSL_SLHDSA_SHA2
 371#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
 372    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128S, NULL, INVALID_DEVID),
 373        0);
 374#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 375    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_128S_PRIV_LEN);
 376#endif
 377    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_128S_PUB_LEN);
 378    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_128S_SIG_LEN);
 379    wc_SlhDsaKey_Free(&key);
 380
 381#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 382    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_128S),
 383        WC_SLHDSA_SHA2_128S_PRIV_LEN);
 384#endif
 385    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_128S),
 386        WC_SLHDSA_SHA2_128S_PUB_LEN);
 387    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_128S),
 388        WC_SLHDSA_SHA2_128S_SIG_LEN);
 389#endif
 390
 391#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
 392    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128F, NULL, INVALID_DEVID),
 393        0);
 394#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 395    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_128F_PRIV_LEN);
 396#endif
 397    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_128F_PUB_LEN);
 398    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_128F_SIG_LEN);
 399    wc_SlhDsaKey_Free(&key);
 400
 401#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 402    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_128F),
 403        WC_SLHDSA_SHA2_128F_PRIV_LEN);
 404#endif
 405    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_128F),
 406        WC_SLHDSA_SHA2_128F_PUB_LEN);
 407    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_128F),
 408        WC_SLHDSA_SHA2_128F_SIG_LEN);
 409#endif
 410
 411#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
 412    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192S, NULL, INVALID_DEVID),
 413        0);
 414#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 415    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_192S_PRIV_LEN);
 416#endif
 417    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_192S_PUB_LEN);
 418    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_192S_SIG_LEN);
 419    wc_SlhDsaKey_Free(&key);
 420
 421#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 422    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_192S),
 423        WC_SLHDSA_SHA2_192S_PRIV_LEN);
 424#endif
 425    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_192S),
 426        WC_SLHDSA_SHA2_192S_PUB_LEN);
 427    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_192S),
 428        WC_SLHDSA_SHA2_192S_SIG_LEN);
 429#endif
 430
 431#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
 432    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192F, NULL, INVALID_DEVID),
 433        0);
 434#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 435    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_192F_PRIV_LEN);
 436#endif
 437    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_192F_PUB_LEN);
 438    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_192F_SIG_LEN);
 439    wc_SlhDsaKey_Free(&key);
 440
 441#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 442    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_192F),
 443        WC_SLHDSA_SHA2_192F_PRIV_LEN);
 444#endif
 445    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_192F),
 446        WC_SLHDSA_SHA2_192F_PUB_LEN);
 447    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_192F),
 448        WC_SLHDSA_SHA2_192F_SIG_LEN);
 449#endif
 450
 451#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
 452    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256S, NULL, INVALID_DEVID),
 453        0);
 454#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 455    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_256S_PRIV_LEN);
 456#endif
 457    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_256S_PUB_LEN);
 458    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_256S_SIG_LEN);
 459    wc_SlhDsaKey_Free(&key);
 460
 461#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 462    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_256S),
 463        WC_SLHDSA_SHA2_256S_PRIV_LEN);
 464#endif
 465    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_256S),
 466        WC_SLHDSA_SHA2_256S_PUB_LEN);
 467    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_256S),
 468        WC_SLHDSA_SHA2_256S_SIG_LEN);
 469#endif
 470
 471#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
 472    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256F, NULL, INVALID_DEVID),
 473        0);
 474#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 475    ExpectIntEQ(wc_SlhDsaKey_PrivateSize(&key), WC_SLHDSA_SHA2_256F_PRIV_LEN);
 476#endif
 477    ExpectIntEQ(wc_SlhDsaKey_PublicSize(&key), WC_SLHDSA_SHA2_256F_PUB_LEN);
 478    ExpectIntEQ(wc_SlhDsaKey_SigSize(&key), WC_SLHDSA_SHA2_256F_SIG_LEN);
 479    wc_SlhDsaKey_Free(&key);
 480
 481#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
 482    ExpectIntEQ(wc_SlhDsaKey_PrivateSizeFromParam(SLHDSA_SHA2_256F),
 483        WC_SLHDSA_SHA2_256F_PRIV_LEN);
 484#endif
 485    ExpectIntEQ(wc_SlhDsaKey_PublicSizeFromParam(SLHDSA_SHA2_256F),
 486        WC_SLHDSA_SHA2_256F_PUB_LEN);
 487    ExpectIntEQ(wc_SlhDsaKey_SigSizeFromParam(SLHDSA_SHA2_256F),
 488        WC_SLHDSA_SHA2_256F_SIG_LEN);
 489#endif
 490#endif /* WOLFSSL_SLHDSA_SHA2 */
 491
 492#endif /* WOLFSSL_HAVE_SLHDSA */
 493    return EXPECT_RESULT();
 494}
 495
 496/*
 497 * Test key generation for SLH-DSA.
 498 */
 499int test_wc_slhdsa_make_key(void)
 500{
 501    EXPECT_DECLS;
 502#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
 503    SlhDsaKey key;
 504    WC_RNG rng;
 505
 506    XMEMSET(&rng, 0, sizeof(WC_RNG));
 507    ExpectIntEQ(wc_InitRng(&rng), 0);
 508
 509    /* Test NULL parameter handling. */
 510    ExpectIntEQ(wc_SlhDsaKey_MakeKey(NULL, &rng),
 511        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 512
 513#ifdef WOLFSSL_SLHDSA_PARAM_128S
 514    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128S, NULL, INVALID_DEVID),
 515        0);
 516    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, NULL),
 517        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 518    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 519    wc_SlhDsaKey_Free(&key);
 520#endif
 521
 522#ifdef WOLFSSL_SLHDSA_PARAM_128F
 523    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128F, NULL, INVALID_DEVID),
 524        0);
 525    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 526    wc_SlhDsaKey_Free(&key);
 527#endif
 528
 529#ifdef WOLFSSL_SLHDSA_PARAM_192S
 530    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192S, NULL, INVALID_DEVID),
 531        0);
 532    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 533    wc_SlhDsaKey_Free(&key);
 534#endif
 535
 536#ifdef WOLFSSL_SLHDSA_PARAM_192F
 537    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192F, NULL, INVALID_DEVID),
 538        0);
 539    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 540    wc_SlhDsaKey_Free(&key);
 541#endif
 542
 543#ifdef WOLFSSL_SLHDSA_PARAM_256S
 544    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256S, NULL, INVALID_DEVID),
 545        0);
 546    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 547    wc_SlhDsaKey_Free(&key);
 548#endif
 549
 550#ifdef WOLFSSL_SLHDSA_PARAM_256F
 551    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256F, NULL, INVALID_DEVID),
 552        0);
 553    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 554    wc_SlhDsaKey_Free(&key);
 555#endif
 556
 557#ifdef WOLFSSL_SLHDSA_SHA2
 558#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
 559    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128S, NULL, INVALID_DEVID),
 560        0);
 561    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 562    wc_SlhDsaKey_Free(&key);
 563#endif
 564#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
 565    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128F, NULL, INVALID_DEVID),
 566        0);
 567    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 568    wc_SlhDsaKey_Free(&key);
 569#endif
 570#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
 571    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192S, NULL, INVALID_DEVID),
 572        0);
 573    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 574    wc_SlhDsaKey_Free(&key);
 575#endif
 576#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
 577    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192F, NULL, INVALID_DEVID),
 578        0);
 579    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 580    wc_SlhDsaKey_Free(&key);
 581#endif
 582#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
 583    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256S, NULL, INVALID_DEVID),
 584        0);
 585    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 586    wc_SlhDsaKey_Free(&key);
 587#endif
 588#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
 589    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256F, NULL, INVALID_DEVID),
 590        0);
 591    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 592    wc_SlhDsaKey_Free(&key);
 593#endif
 594#endif /* WOLFSSL_SLHDSA_SHA2 */
 595
 596    /* Test MakeKeyWithRandom. */
 597#ifdef TEST_SLHDSA_DEFAULT_PARAM
 598    {
 599        byte sk_seed[TEST_SLHDSA_DEFAULT_SEED_LEN];
 600        byte sk_prf[TEST_SLHDSA_DEFAULT_SEED_LEN];
 601        byte pk_seed[TEST_SLHDSA_DEFAULT_SEED_LEN];
 602
 603        XMEMSET(sk_seed, 0x01, sizeof(sk_seed));
 604        XMEMSET(sk_prf, 0x02, sizeof(sk_prf));
 605        XMEMSET(pk_seed, 0x03, sizeof(pk_seed));
 606
 607        /* Test NULL parameter handling. */
 608        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(NULL, sk_seed,
 609            sizeof(sk_seed), sk_prf, sizeof(sk_prf), pk_seed, sizeof(pk_seed)),
 610            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 611
 612        ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 613            INVALID_DEVID), 0);
 614        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(&key, NULL, sizeof(sk_seed),
 615            sk_prf, sizeof(sk_prf), pk_seed, sizeof(pk_seed)),
 616            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 617        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(&key, sk_seed,
 618            sizeof(sk_seed), NULL, sizeof(sk_prf), pk_seed, sizeof(pk_seed)),
 619            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 620        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(&key, sk_seed,
 621            sizeof(sk_seed), sk_prf, sizeof(sk_prf), NULL, sizeof(pk_seed)),
 622            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 623        /* Test wrong size. */
 624        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(&key, sk_seed, 8,
 625            sk_prf, sizeof(sk_prf), pk_seed, sizeof(pk_seed)),
 626            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 627
 628        ExpectIntEQ(wc_SlhDsaKey_MakeKeyWithRandom(&key, sk_seed,
 629            sizeof(sk_seed), sk_prf, sizeof(sk_prf), pk_seed, sizeof(pk_seed)),
 630            0);
 631        wc_SlhDsaKey_Free(&key);
 632    }
 633#endif
 634
 635    wc_FreeRng(&rng);
 636#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
 637    return EXPECT_RESULT();
 638}
 639
 640/*
 641 * Test signing for SLH-DSA.
 642 */
 643int test_wc_slhdsa_sign(void)
 644{
 645    EXPECT_DECLS;
 646#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
 647    SlhDsaKey key;
 648    WC_RNG rng;
 649    byte msg[64];
 650    byte* sig = NULL;
 651    word32 sigLen;
 652    word32 expSigLen;
 653    byte ctx[10];
 654
 655    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 656    ExpectNotNull(sig);
 657
 658    XMEMSET(&rng, 0, sizeof(WC_RNG));
 659    XMEMSET(msg, 0xAA, sizeof(msg));
 660    XMEMSET(ctx, 0x01, sizeof(ctx));
 661
 662    ExpectIntEQ(wc_InitRng(&rng), 0);
 663
 664    /* Test NULL parameter handling. */
 665    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 666    ExpectIntEQ(wc_SlhDsaKey_Sign(NULL, ctx, sizeof(ctx), msg, sizeof(msg),
 667        sig, &sigLen, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 668
 669    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 670        INVALID_DEVID), 0);
 671    expSigLen = TEST_SLHDSA_DEFAULT_SIG_LEN;
 672    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 673
 674    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 675    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), NULL, sizeof(msg),
 676        sig, &sigLen, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 677    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 678        NULL, &sigLen, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 679    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 680        sig, NULL, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 681    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 682        sig, &sigLen, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 683
 684    /* Test buffer too small. */
 685    sigLen = 10;
 686    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 687        sig, &sigLen, &rng), WC_NO_ERR_TRACE(BAD_LENGTH_E));
 688
 689    /* Test successful signing. */
 690    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 691    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 692        sig, &sigLen, &rng), 0);
 693    ExpectIntEQ(sigLen, expSigLen);
 694
 695    /* Test signing with NULL context (allowed). */
 696    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 697    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, NULL, 0, msg, sizeof(msg),
 698        sig, &sigLen, &rng), 0);
 699
 700    wc_SlhDsaKey_Free(&key);
 701
 702    /* Test SignDeterministic. */
 703    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 704        INVALID_DEVID), 0);
 705    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 706
 707    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 708    ExpectIntEQ(wc_SlhDsaKey_SignDeterministic(NULL, ctx, sizeof(ctx),
 709        msg, sizeof(msg), sig, &sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 710    ExpectIntEQ(wc_SlhDsaKey_SignDeterministic(&key, ctx, sizeof(ctx),
 711        msg, sizeof(msg), sig, &sigLen), 0);
 712    ExpectIntEQ(sigLen, expSigLen);
 713
 714    wc_SlhDsaKey_Free(&key);
 715
 716    /* Test SignWithRandom. */
 717    {
 718        byte addRnd[WC_SLHDSA_MAX_SEED];
 719        XMEMSET(addRnd, 0x55, sizeof(addRnd));
 720
 721        ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 722            INVALID_DEVID), 0);
 723        ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 724
 725        sigLen = WC_SLHDSA_MAX_SIG_LEN;
 726        ExpectIntEQ(wc_SlhDsaKey_SignWithRandom(NULL, ctx, sizeof(ctx),
 727            msg, sizeof(msg), sig, &sigLen, addRnd),
 728            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 729        ExpectIntEQ(wc_SlhDsaKey_SignWithRandom(&key, ctx, sizeof(ctx),
 730            msg, sizeof(msg), sig, &sigLen, NULL),
 731            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 732        ExpectIntEQ(wc_SlhDsaKey_SignWithRandom(&key, ctx, sizeof(ctx),
 733            msg, sizeof(msg), sig, &sigLen, addRnd), 0);
 734        ExpectIntEQ(sigLen, expSigLen);
 735
 736        wc_SlhDsaKey_Free(&key);
 737    }
 738
 739    wc_FreeRng(&rng);
 740    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 741#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
 742    return EXPECT_RESULT();
 743}
 744
 745/*
 746 * Test verification for SLH-DSA.
 747 */
 748int test_wc_slhdsa_verify(void)
 749{
 750    EXPECT_DECLS;
 751#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
 752    SlhDsaKey key;
 753    WC_RNG rng;
 754    byte msg[64];
 755    byte* sig = NULL;
 756    word32 sigLen;
 757    byte ctx[10];
 758
 759    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 760    ExpectNotNull(sig);
 761
 762    XMEMSET(&rng, 0, sizeof(WC_RNG));
 763    XMEMSET(msg, 0xAA, sizeof(msg));
 764    XMEMSET(ctx, 0x01, sizeof(ctx));
 765
 766    ExpectIntEQ(wc_InitRng(&rng), 0);
 767
 768    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
 769        INVALID_DEVID), 0);
 770    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 771
 772    /* Generate a signature. */
 773    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 774    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 775        sig, &sigLen, &rng), 0);
 776
 777    /* Test NULL parameter handling. */
 778    ExpectIntEQ(wc_SlhDsaKey_Verify(NULL, ctx, sizeof(ctx), msg, sizeof(msg),
 779        sig, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 780    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), NULL, sizeof(msg),
 781        sig, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 782    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 783        NULL, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 784
 785    /* Test successful verification. */
 786    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 787        sig, sigLen), 0);
 788
 789    /* Test verification with wrong message. */
 790    msg[0] ^= 0xFF;
 791    ExpectIntNE(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 792        sig, sigLen), 0);
 793    msg[0] ^= 0xFF;
 794
 795    /* Test verification with wrong context. */
 796    ctx[0] ^= 0xFF;
 797    ExpectIntNE(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 798        sig, sigLen), 0);
 799    ctx[0] ^= 0xFF;
 800
 801    /* Test verification with corrupted signature. */
 802    sig[0] ^= 0xFF;
 803    ExpectIntNE(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 804        sig, sigLen), 0);
 805    sig[0] ^= 0xFF;
 806
 807    /* Test verification with NULL context (allowed, but must match signing). */
 808    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 809    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, NULL, 0, msg, sizeof(msg),
 810        sig, &sigLen, &rng), 0);
 811    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, NULL, 0, msg, sizeof(msg),
 812        sig, sigLen), 0);
 813
 814    wc_SlhDsaKey_Free(&key);
 815
 816    wc_FreeRng(&rng);
 817    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 818#endif /* WOLFSSL_HAVE_SLHDSA */
 819    return EXPECT_RESULT();
 820}
 821
 822/*
 823 * Test combined sign and verify for all parameter sets.
 824 */
 825int test_wc_slhdsa_sign_vfy(void)
 826{
 827    EXPECT_DECLS;
 828#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
 829    SlhDsaKey key;
 830    WC_RNG rng;
 831    byte msg[64];
 832    byte* sig = NULL;
 833    word32 sigLen;
 834    byte ctx[10];
 835
 836    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 837    ExpectNotNull(sig);
 838
 839    XMEMSET(&rng, 0, sizeof(WC_RNG));
 840    XMEMSET(msg, 0xAA, sizeof(msg));
 841    XMEMSET(ctx, 0x01, sizeof(ctx));
 842
 843    ExpectIntEQ(wc_InitRng(&rng), 0);
 844
 845#ifdef WOLFSSL_SLHDSA_PARAM_128S
 846    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128S, NULL, INVALID_DEVID),
 847        0);
 848    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 849
 850    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 851    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 852        sig, &sigLen, &rng), 0);
 853    ExpectIntEQ(sigLen, WC_SLHDSA_SHAKE128S_SIG_LEN);
 854    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 855        sig, sigLen), 0);
 856
 857    wc_SlhDsaKey_Free(&key);
 858#endif
 859
 860#ifdef WOLFSSL_SLHDSA_PARAM_128F
 861    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128F, NULL, INVALID_DEVID),
 862        0);
 863    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 864
 865    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 866    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 867        sig, &sigLen, &rng), 0);
 868    ExpectIntEQ(sigLen, WC_SLHDSA_SHAKE128F_SIG_LEN);
 869    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 870        sig, sigLen), 0);
 871
 872    wc_SlhDsaKey_Free(&key);
 873#endif
 874
 875#ifdef WOLFSSL_SLHDSA_PARAM_192S
 876    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192S, NULL, INVALID_DEVID),
 877        0);
 878    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 879
 880    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 881    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 882        sig, &sigLen, &rng), 0);
 883    ExpectIntEQ(sigLen, (word32)wc_SlhDsaKey_SigSize(&key));
 884    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 885        sig, sigLen), 0);
 886
 887    wc_SlhDsaKey_Free(&key);
 888#endif
 889
 890#ifdef WOLFSSL_SLHDSA_PARAM_192F
 891    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192F, NULL, INVALID_DEVID),
 892        0);
 893    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 894
 895    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 896    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 897        sig, &sigLen, &rng), 0);
 898    ExpectIntEQ(sigLen, WC_SLHDSA_SHAKE192F_SIG_LEN);
 899    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 900        sig, sigLen), 0);
 901
 902    wc_SlhDsaKey_Free(&key);
 903#endif
 904
 905#ifdef WOLFSSL_SLHDSA_PARAM_256S
 906    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256S, NULL, INVALID_DEVID),
 907        0);
 908    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 909
 910    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 911    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 912        sig, &sigLen, &rng), 0);
 913    ExpectIntEQ(sigLen, WC_SLHDSA_SHAKE256S_SIG_LEN);
 914    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 915        sig, sigLen), 0);
 916
 917    wc_SlhDsaKey_Free(&key);
 918#endif
 919
 920#ifdef WOLFSSL_SLHDSA_PARAM_256F
 921    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256F, NULL, INVALID_DEVID),
 922        0);
 923    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 924
 925    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 926    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 927        sig, &sigLen, &rng), 0);
 928    ExpectIntEQ(sigLen, WC_SLHDSA_SHAKE256F_SIG_LEN);
 929    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 930        sig, sigLen), 0);
 931
 932    wc_SlhDsaKey_Free(&key);
 933#endif
 934
 935#ifdef WOLFSSL_SLHDSA_SHA2
 936#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
 937    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128S, NULL, INVALID_DEVID),
 938        0);
 939    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 940    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 941    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 942        sig, &sigLen, &rng), 0);
 943    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_128S_SIG_LEN);
 944    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 945        sig, sigLen), 0);
 946    wc_SlhDsaKey_Free(&key);
 947#endif
 948#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
 949    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128F, NULL, INVALID_DEVID),
 950        0);
 951    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 952    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 953    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 954        sig, &sigLen, &rng), 0);
 955    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_128F_SIG_LEN);
 956    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 957        sig, sigLen), 0);
 958    wc_SlhDsaKey_Free(&key);
 959#endif
 960#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
 961    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192S, NULL, INVALID_DEVID),
 962        0);
 963    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 964    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 965    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 966        sig, &sigLen, &rng), 0);
 967    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_192S_SIG_LEN);
 968    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 969        sig, sigLen), 0);
 970    wc_SlhDsaKey_Free(&key);
 971#endif
 972#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
 973    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192F, NULL, INVALID_DEVID),
 974        0);
 975    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 976    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 977    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 978        sig, &sigLen, &rng), 0);
 979    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_192F_SIG_LEN);
 980    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 981        sig, sigLen), 0);
 982    wc_SlhDsaKey_Free(&key);
 983#endif
 984#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
 985    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256S, NULL, INVALID_DEVID),
 986        0);
 987    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
 988    sigLen = WC_SLHDSA_MAX_SIG_LEN;
 989    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 990        sig, &sigLen, &rng), 0);
 991    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_256S_SIG_LEN);
 992    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
 993        sig, sigLen), 0);
 994    wc_SlhDsaKey_Free(&key);
 995#endif
 996#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
 997    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256F, NULL, INVALID_DEVID),
 998        0);
 999    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
1000    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1001    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
1002        sig, &sigLen, &rng), 0);
1003    ExpectIntEQ(sigLen, WC_SLHDSA_SHA2_256F_SIG_LEN);
1004    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
1005        sig, sigLen), 0);
1006    wc_SlhDsaKey_Free(&key);
1007#endif
1008#endif /* WOLFSSL_SLHDSA_SHA2 */
1009
1010    wc_FreeRng(&rng);
1011    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1012#endif /* WOLFSSL_HAVE_SLHDSA */
1013    return EXPECT_RESULT();
1014}
1015
1016/*
1017 * Test hash signing and verification for SLH-DSA.
1018 */
1019int test_wc_slhdsa_sign_hash(void)
1020{
1021    EXPECT_DECLS;
1022#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
1023    SlhDsaKey key;
1024    WC_RNG rng;
1025    byte hash[64];
1026    byte* sig = NULL;
1027    word32 sigLen;
1028    word32 expSigLen;
1029    byte ctx[10];
1030
1031    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1032    ExpectNotNull(sig);
1033
1034    XMEMSET(&rng, 0, sizeof(WC_RNG));
1035    XMEMSET(hash, 0xBB, sizeof(hash));
1036    XMEMSET(ctx, 0x01, sizeof(ctx));
1037
1038    ExpectIntEQ(wc_InitRng(&rng), 0);
1039
1040    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1041        INVALID_DEVID), 0);
1042    expSigLen = TEST_SLHDSA_DEFAULT_SIG_LEN;
1043    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
1044
1045    /* Test SignHash NULL parameter handling. Use 32-byte hash length so the
1046     * NULL check trips before the digest-length check (HashSLH-DSA expects
1047     * SHA-256 digest = 32 bytes). */
1048    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1049    ExpectIntEQ(wc_SlhDsaKey_SignHash(NULL, ctx, sizeof(ctx), hash,
1050        32, WC_HASH_TYPE_SHA256, sig, &sigLen, &rng),
1051        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1052    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), NULL,
1053        32, WC_HASH_TYPE_SHA256, sig, &sigLen, &rng),
1054        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1055    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash,
1056        32, WC_HASH_TYPE_SHA256, NULL, &sigLen, &rng),
1057        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1058    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash,
1059        32, WC_HASH_TYPE_SHA256, sig, NULL, &rng),
1060        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1061    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash,
1062        32, WC_HASH_TYPE_SHA256, sig, &sigLen, NULL),
1063        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1064
1065    /* HashSLH-DSA must reject digest lengths that don't match hashType. */
1066    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1067    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 31,
1068        WC_HASH_TYPE_SHA256, sig, &sigLen, &rng),
1069        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1070    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 33,
1071        WC_HASH_TYPE_SHA256, sig, &sigLen, &rng),
1072        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1073    /* Generate a real signature first so VerifyHash gets to its length check
1074     * rather than failing on signature size. */
1075    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1076        WC_HASH_TYPE_SHA256, sig, &sigLen, &rng), 0);
1077    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 31,
1078        WC_HASH_TYPE_SHA256, sig, sigLen),
1079        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1080    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 33,
1081        WC_HASH_TYPE_SHA256, sig, sigLen),
1082        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1083
1084    /* Unsupported hashType (FIPS 205 doesn't list WC_HASH_TYPE_NONE) hits
1085     * the default branch of slhdsakey_validate_prehash. */
1086    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1087    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1088        WC_HASH_TYPE_NONE, sig, &sigLen, &rng),
1089        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
1090
1091    /* Test SignHash with SHA-256. */
1092    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1093    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1094        WC_HASH_TYPE_SHA256, sig, &sigLen, &rng), 0);
1095    ExpectIntEQ(sigLen, expSigLen);
1096    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1097        WC_HASH_TYPE_SHA256, sig, sigLen), 0);
1098
1099    /* Test VerifyHash NULL parameter handling. */
1100    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(NULL, ctx, sizeof(ctx), hash, 32,
1101        WC_HASH_TYPE_SHA256, sig, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1102    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), NULL, 32,
1103        WC_HASH_TYPE_SHA256, sig, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1104    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1105        WC_HASH_TYPE_SHA256, NULL, sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1106
1107    /* Test VerifyHash with wrong hash. */
1108    hash[0] ^= 0xFF;
1109    ExpectIntNE(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1110        WC_HASH_TYPE_SHA256, sig, sigLen), 0);
1111    hash[0] ^= 0xFF;
1112
1113    /* Test SignHashDeterministic. */
1114    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1115    ExpectIntEQ(wc_SlhDsaKey_SignHashDeterministic(NULL, ctx, sizeof(ctx),
1116        hash, 32, WC_HASH_TYPE_SHA256, sig, &sigLen),
1117        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1118    ExpectIntEQ(wc_SlhDsaKey_SignHashDeterministic(&key, ctx, sizeof(ctx),
1119        hash, 32, WC_HASH_TYPE_SHA256, sig, &sigLen), 0);
1120    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1121        WC_HASH_TYPE_SHA256, sig, sigLen), 0);
1122
1123    /* Test SignHashWithRandom. */
1124    {
1125        byte addRnd[WC_SLHDSA_MAX_SEED];
1126        XMEMSET(addRnd, 0x55, sizeof(addRnd));
1127
1128        sigLen = WC_SLHDSA_MAX_SIG_LEN;
1129        ExpectIntEQ(wc_SlhDsaKey_SignHashWithRandom(NULL, ctx, sizeof(ctx),
1130            hash, 32, WC_HASH_TYPE_SHA256, sig, &sigLen, addRnd),
1131            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1132        ExpectIntEQ(wc_SlhDsaKey_SignHashWithRandom(&key, ctx, sizeof(ctx),
1133            hash, 32, WC_HASH_TYPE_SHA256, sig, &sigLen, NULL),
1134            WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1135        ExpectIntEQ(wc_SlhDsaKey_SignHashWithRandom(&key, ctx, sizeof(ctx),
1136            hash, 32, WC_HASH_TYPE_SHA256, sig, &sigLen, addRnd), 0);
1137        ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1138            WC_HASH_TYPE_SHA256, sig, sigLen), 0);
1139    }
1140
1141#ifdef WOLFSSL_SHA512
1142    /* SHA-512 round-trip exercises a 64-byte digest path. */
1143    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1144    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 64,
1145        WC_HASH_TYPE_SHA512, sig, &sigLen, &rng), 0);
1146    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 64,
1147        WC_HASH_TYPE_SHA512, sig, sigLen), 0);
1148    /* SHA-512 must also reject the wrong digest length. */
1149    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1150        WC_HASH_TYPE_SHA512, sig, &sigLen, &rng),
1151        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1152#endif
1153
1154#ifdef WOLFSSL_SHAKE128
1155    /* SHAKE128 PHM is fixed at 256 bits per FIPS 205 Section 10.2.2. */
1156    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1157    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1158        WC_HASH_TYPE_SHAKE128, sig, &sigLen, &rng), 0);
1159    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1160        WC_HASH_TYPE_SHAKE128, sig, sigLen), 0);
1161    /* SignHash and VerifyHash both reject mismatched digest length. */
1162    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 64,
1163        WC_HASH_TYPE_SHAKE128, sig, &sigLen, &rng),
1164        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1165    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 64,
1166        WC_HASH_TYPE_SHAKE128, sig, sigLen),
1167        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1168#endif
1169
1170#ifdef WOLFSSL_SHAKE256
1171    /* SHAKE256 PHM is fixed at 512 bits per FIPS 205 Section 10.2.2. */
1172    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1173    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 64,
1174        WC_HASH_TYPE_SHAKE256, sig, &sigLen, &rng), 0);
1175    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 64,
1176        WC_HASH_TYPE_SHAKE256, sig, sigLen), 0);
1177    /* SignHash and VerifyHash both reject mismatched digest length. */
1178    ExpectIntEQ(wc_SlhDsaKey_SignHash(&key, ctx, sizeof(ctx), hash, 32,
1179        WC_HASH_TYPE_SHAKE256, sig, &sigLen, &rng),
1180        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1181    ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, ctx, sizeof(ctx), hash, 32,
1182        WC_HASH_TYPE_SHAKE256, sig, sigLen),
1183        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1184#endif
1185
1186    wc_SlhDsaKey_Free(&key);
1187
1188    wc_FreeRng(&rng);
1189    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1190#endif /* WOLFSSL_HAVE_SLHDSA */
1191    return EXPECT_RESULT();
1192}
1193
1194/*
1195 * Test the FIPS 205 internal interface (M' supplied directly) for SLH-DSA.
1196 * Covers wc_SlhDsaKey_SignMsgDeterministic, wc_SlhDsaKey_SignMsgWithRandom,
1197 * and wc_SlhDsaKey_VerifyMsg, plus a HashSLH-DSA equivalence cross-check
1198 * that proves an externally-built M' matches the SignHash/VerifyHash path.
1199 */
1200int test_wc_slhdsa_sign_msg(void)
1201{
1202    EXPECT_DECLS;
1203#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
1204    !defined(NO_SHA256)
1205    SlhDsaKey key;
1206    WC_RNG rng;
1207    byte mprime[64];
1208    byte* sig = NULL;
1209    word32 sigLen;
1210    byte addRnd[WC_SLHDSA_MAX_SEED];
1211
1212    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1213    ExpectNotNull(sig);
1214
1215    XMEMSET(&rng, 0, sizeof(WC_RNG));
1216    XMEMSET(mprime, 0xAA, sizeof(mprime));
1217    XMEMSET(addRnd, 0x55, sizeof(addRnd));
1218
1219    ExpectIntEQ(wc_InitRng(&rng), 0);
1220
1221    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1222        INVALID_DEVID), 0);
1223    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
1224
1225    /* SignMsgDeterministic NULL-arg checks. */
1226    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1227    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(NULL, mprime, sizeof(mprime),
1228        sig, &sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1229    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, NULL, sizeof(mprime),
1230        sig, &sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1231    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, mprime, sizeof(mprime),
1232        NULL, &sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1233    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, mprime, sizeof(mprime),
1234        sig, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1235
1236    /* SignMsgDeterministic must reject sigSz smaller than params->sigLen. */
1237    sigLen = 1;
1238    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, mprime,
1239        sizeof(mprime), sig, &sigLen), WC_NO_ERR_TRACE(BAD_LENGTH_E));
1240
1241    /* Round-trip: Deterministic. */
1242    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1243    ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, mprime,
1244        sizeof(mprime), sig, &sigLen), 0);
1245    ExpectIntEQ(wc_SlhDsaKey_VerifyMsg(&key, mprime, sizeof(mprime), sig,
1246        sigLen), 0);
1247
1248    /* SignMsgWithRandom NULL-arg checks. */
1249    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1250    ExpectIntEQ(wc_SlhDsaKey_SignMsgWithRandom(NULL, mprime, sizeof(mprime),
1251        sig, &sigLen, addRnd), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1252    ExpectIntEQ(wc_SlhDsaKey_SignMsgWithRandom(&key, mprime, sizeof(mprime),
1253        sig, &sigLen, NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1254
1255    /* SignMsgWithRandom must reject sigSz smaller than params->sigLen. */
1256    sigLen = 1;
1257    ExpectIntEQ(wc_SlhDsaKey_SignMsgWithRandom(&key, mprime, sizeof(mprime),
1258        sig, &sigLen, addRnd), WC_NO_ERR_TRACE(BAD_LENGTH_E));
1259
1260    /* Round-trip: WithRandom. Reset sigLen explicitly so the test doesn't
1261     * silently rely on the previous call having set it to params->sigLen. */
1262    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1263    ExpectIntEQ(wc_SlhDsaKey_SignMsgWithRandom(&key, mprime, sizeof(mprime),
1264        sig, &sigLen, addRnd), 0);
1265    ExpectIntEQ(wc_SlhDsaKey_VerifyMsg(&key, mprime, sizeof(mprime), sig,
1266        sigLen), 0);
1267
1268    /* VerifyMsg NULL-arg checks. */
1269    ExpectIntEQ(wc_SlhDsaKey_VerifyMsg(NULL, mprime, sizeof(mprime), sig,
1270        sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1271    ExpectIntEQ(wc_SlhDsaKey_VerifyMsg(&key, NULL, sizeof(mprime), sig,
1272        sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1273    ExpectIntEQ(wc_SlhDsaKey_VerifyMsg(&key, mprime, sizeof(mprime), NULL,
1274        sigLen), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1275
1276    /* Equivalence cross-check: build M' = 0x01 || ctxSz || OID(SHA-256) ||
1277     * SHA256(orig) externally, sign it via SignMsgDeterministic, and verify
1278     * via VerifyHash with the same SHA-256 digest. Both paths must agree. */
1279    {
1280        static const byte sha256_oid[] = {
1281            0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
1282            0x04, 0x02, 0x01
1283        };
1284        static const byte orig[] = "Hello World!";
1285        byte digest[WC_SHA256_DIGEST_SIZE];
1286        byte built_mprime[2 + sizeof(sha256_oid) + WC_SHA256_DIGEST_SIZE];
1287        word32 idx = 0;
1288        word32 sigLen2;
1289
1290        ExpectIntEQ(wc_Sha256Hash(orig, (word32)sizeof(orig) - 1, digest), 0);
1291
1292        built_mprime[idx++] = 0x01;        /* HashSLH-DSA domain separator */
1293        built_mprime[idx++] = 0;           /* ctxSz = 0 */
1294        XMEMCPY(built_mprime + idx, sha256_oid, sizeof(sha256_oid));
1295        idx += (word32)sizeof(sha256_oid);
1296        XMEMCPY(built_mprime + idx, digest, sizeof(digest));
1297        idx += (word32)sizeof(digest);
1298
1299        sigLen = WC_SLHDSA_MAX_SIG_LEN;
1300        ExpectIntEQ(wc_SlhDsaKey_SignMsgDeterministic(&key, built_mprime,
1301            idx, sig, &sigLen), 0);
1302
1303        /* The same signature must verify via the HashSLH-DSA external API. */
1304        ExpectIntEQ(wc_SlhDsaKey_VerifyHash(&key, NULL, 0, digest,
1305            sizeof(digest), WC_HASH_TYPE_SHA256, sig, sigLen), 0);
1306
1307        /* And the deterministic HashSLH-DSA path must produce the SAME
1308         * signature bytes (this is the strongest interop check). */
1309        sigLen2 = WC_SLHDSA_MAX_SIG_LEN;
1310        {
1311            byte* sig2 = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL,
1312                DYNAMIC_TYPE_TMP_BUFFER);
1313            ExpectNotNull(sig2);
1314            ExpectIntEQ(wc_SlhDsaKey_SignHashDeterministic(&key, NULL, 0,
1315                digest, sizeof(digest), WC_HASH_TYPE_SHA256, sig2,
1316                &sigLen2), 0);
1317            ExpectIntEQ(sigLen2, sigLen);
1318            ExpectIntEQ(XMEMCMP(sig2, sig, sigLen), 0);
1319            XFREE(sig2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1320        }
1321    }
1322
1323    wc_SlhDsaKey_Free(&key);
1324    wc_FreeRng(&rng);
1325    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1326#endif
1327    return EXPECT_RESULT();
1328}
1329
1330/*
1331 * Test export and import for SLH-DSA keys.
1332 */
1333int test_wc_slhdsa_export_import(void)
1334{
1335    EXPECT_DECLS;
1336#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
1337    SlhDsaKey key;
1338    SlhDsaKey key2;
1339    WC_RNG rng;
1340    byte* privKey = NULL;
1341    byte* pubKey = NULL;
1342    word32 privKeyLen;
1343    word32 expPrivKeyLen;
1344    word32 pubKeyLen;
1345    word32 expPubKeyLen;
1346    byte msg[64];
1347    byte* sig = NULL;
1348    word32 sigLen;
1349    byte ctx[10];
1350
1351    privKey = (byte*)XMALLOC(WC_SLHDSA_MAX_PRIV_LEN, NULL,
1352        DYNAMIC_TYPE_TMP_BUFFER);
1353    ExpectNotNull(privKey);
1354    pubKey = (byte*)XMALLOC(WC_SLHDSA_MAX_PUB_LEN, NULL,
1355        DYNAMIC_TYPE_TMP_BUFFER);
1356    ExpectNotNull(pubKey);
1357    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1358    ExpectNotNull(sig);
1359
1360    XMEMSET(&rng, 0, sizeof(WC_RNG));
1361    XMEMSET(msg, 0xAA, sizeof(msg));
1362    XMEMSET(ctx, 0x01, sizeof(ctx));
1363
1364    ExpectIntEQ(wc_InitRng(&rng), 0);
1365
1366    /* Test NULL parameter handling for export functions. */
1367    privKeyLen = WC_SLHDSA_MAX_PRIV_LEN;
1368    pubKeyLen = WC_SLHDSA_MAX_PUB_LEN;
1369    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(NULL, privKey, &privKeyLen),
1370        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1371    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(NULL, pubKey, &pubKeyLen),
1372        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1373
1374    /* Test NULL parameter handling for import functions. */
1375    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(NULL, privKey, privKeyLen),
1376        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1377    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(NULL, pubKey, pubKeyLen),
1378        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1379
1380    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1381        INVALID_DEVID), 0);
1382    expPrivKeyLen = TEST_SLHDSA_DEFAULT_PRIV_LEN;
1383    expPubKeyLen = TEST_SLHDSA_DEFAULT_PUB_LEN;
1384    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
1385
1386    /* Test export with NULL buffer. */
1387    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(&key, NULL, &privKeyLen),
1388        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1389    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(&key, privKey, NULL),
1390        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1391    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&key, NULL, &pubKeyLen),
1392        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1393    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&key, pubKey, NULL),
1394        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1395
1396    /* Test export with buffer too small. */
1397    privKeyLen = 10;
1398    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(&key, privKey, &privKeyLen),
1399        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1400    pubKeyLen = 10;
1401    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&key, pubKey, &pubKeyLen),
1402        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1403
1404    /* Test successful export. */
1405    privKeyLen = WC_SLHDSA_MAX_PRIV_LEN;
1406    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(&key, privKey, &privKeyLen), 0);
1407    ExpectIntEQ(privKeyLen, expPrivKeyLen);
1408
1409    pubKeyLen = WC_SLHDSA_MAX_PUB_LEN;
1410    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&key, pubKey, &pubKeyLen), 0);
1411    ExpectIntEQ(pubKeyLen, expPubKeyLen);
1412
1413    /* Sign with original key. */
1414    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1415    ExpectIntEQ(wc_SlhDsaKey_Sign(&key, ctx, sizeof(ctx), msg, sizeof(msg),
1416        sig, &sigLen, &rng), 0);
1417
1418    /* Test import into new key and verify. */
1419    ExpectIntEQ(wc_SlhDsaKey_Init(&key2, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1420        INVALID_DEVID), 0);
1421
1422    /* Test import with NULL data. */
1423    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key2, NULL, privKeyLen),
1424        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1425    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key2, NULL, pubKeyLen),
1426        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1427
1428    /* Test import with wrong size. */
1429    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key2, privKey, 10),
1430        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1431    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key2, pubKey, 10),
1432        WC_NO_ERR_TRACE(BAD_LENGTH_E));
1433
1434    /* Test successful import of public key only. */
1435    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key2, pubKey, pubKeyLen), 0);
1436    /* Verify with imported public key. */
1437    ExpectIntEQ(wc_SlhDsaKey_Verify(&key2, ctx, sizeof(ctx), msg, sizeof(msg),
1438        sig, sigLen), 0);
1439    wc_SlhDsaKey_Free(&key2);
1440
1441    /* Test import of private key. */
1442    ExpectIntEQ(wc_SlhDsaKey_Init(&key2, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1443        INVALID_DEVID), 0);
1444    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key2, privKey, privKeyLen), 0);
1445    /* Sign with imported key. */
1446    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1447    ExpectIntEQ(wc_SlhDsaKey_Sign(&key2, ctx, sizeof(ctx), msg, sizeof(msg),
1448        sig, &sigLen, &rng), 0);
1449    /* Verify with original key. */
1450    ExpectIntEQ(wc_SlhDsaKey_Verify(&key, ctx, sizeof(ctx), msg, sizeof(msg),
1451        sig, sigLen), 0);
1452
1453    wc_SlhDsaKey_Free(&key2);
1454    wc_SlhDsaKey_Free(&key);
1455
1456    wc_FreeRng(&rng);
1457    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1458    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1459    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1460#endif /* WOLFSSL_HAVE_SLHDSA */
1461    return EXPECT_RESULT();
1462}
1463
1464/*
1465 * Test key check for SLH-DSA.
1466 */
1467int test_wc_slhdsa_check_key(void)
1468{
1469    EXPECT_DECLS;
1470#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
1471    SlhDsaKey key;
1472    WC_RNG rng;
1473    byte* privKey = NULL;
1474    byte* pubKey = NULL;
1475    word32 privKeyLen;
1476    word32 pubKeyLen;
1477
1478    privKey = (byte*)XMALLOC(WC_SLHDSA_MAX_PRIV_LEN, NULL,
1479        DYNAMIC_TYPE_TMP_BUFFER);
1480    ExpectNotNull(privKey);
1481    pubKey = (byte*)XMALLOC(WC_SLHDSA_MAX_PUB_LEN, NULL,
1482        DYNAMIC_TYPE_TMP_BUFFER);
1483    ExpectNotNull(pubKey);
1484
1485    XMEMSET(&rng, 0, sizeof(WC_RNG));
1486    ExpectIntEQ(wc_InitRng(&rng), 0);
1487
1488    /* Test NULL parameter handling. */
1489    ExpectIntEQ(wc_SlhDsaKey_CheckKey(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1490
1491    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1492        INVALID_DEVID), 0);
1493    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&key, &rng), 0);
1494
1495    /* Test check of valid key. */
1496    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), 0);
1497
1498    /* Export keys. */
1499    privKeyLen = WC_SLHDSA_MAX_PRIV_LEN;
1500    ExpectIntEQ(wc_SlhDsaKey_ExportPrivate(&key, privKey, &privKeyLen), 0);
1501    pubKeyLen = WC_SLHDSA_MAX_PUB_LEN;
1502    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&key, pubKey, &pubKeyLen), 0);
1503
1504    wc_SlhDsaKey_Free(&key);
1505
1506    /* Test check with only public key imported - requires private key. */
1507    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1508        INVALID_DEVID), 0);
1509    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key, pubKey, pubKeyLen), 0);
1510    /* CheckKey requires a private key to validate. */
1511    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), WC_NO_ERR_TRACE(MISSING_KEY));
1512    wc_SlhDsaKey_Free(&key);
1513
1514    /* Test check with only private key imported. */
1515    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1516        INVALID_DEVID), 0);
1517    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key, privKey, privKeyLen), 0);
1518    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), 0);
1519    wc_SlhDsaKey_Free(&key);
1520
1521    /* Test check with both keys imported. */
1522    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1523        INVALID_DEVID), 0);
1524    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key, pubKey, pubKeyLen), 0);
1525    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key, privKey, privKeyLen), 0);
1526    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), 0);
1527
1528    key.sk[0] ^= 0x01;
1529    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key),
1530        WC_NO_ERR_TRACE(WC_KEY_MISMATCH_E));
1531    wc_SlhDsaKey_Free(&key);
1532
1533    /* Regression: Private-then-Public order. ImportPrivate sets
1534     * flags = WC_SLHDSA_FLAG_BOTH_KEYS; if ImportPublic clobbered flags
1535     * with `=` instead of `|=`, the FLAG_PRIVATE bit would be dropped and
1536     * CheckKey would return MISSING_KEY. */
1537    ExpectIntEQ(wc_SlhDsaKey_Init(&key, TEST_SLHDSA_DEFAULT_PARAM, NULL,
1538        INVALID_DEVID), 0);
1539    ExpectIntEQ(wc_SlhDsaKey_ImportPrivate(&key, privKey, privKeyLen), 0);
1540    ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&key, pubKey, pubKeyLen), 0);
1541    ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), 0);
1542    wc_SlhDsaKey_Free(&key);
1543
1544    wc_FreeRng(&rng);
1545    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1546    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1547#endif /* WOLFSSL_HAVE_SLHDSA */
1548    return EXPECT_RESULT();
1549}
1550
1551#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
1552    defined(WC_ENABLE_ASYM_KEY_EXPORT)
1553/* Round-trip a single SLH-DSA parameter set through the DER codec:
1554 * generate -> KeyToDer -> PrivateKeyDecode -> sign/verify round-trip.
1555 * Also tests PublicKeyToDer -> PublicKeyDecode, and that the decode
1556 * correctly auto-detects the parameter set from the OID. */
1557static int slhdsa_der_roundtrip_one(enum SlhDsaParam param)
1558{
1559    EXPECT_DECLS;
1560    SlhDsaKey keyGen;
1561    SlhDsaKey keyPriv;
1562    SlhDsaKey keyPub;
1563    WC_RNG rng;
1564    byte* derBuf = NULL;
1565    byte* sig = NULL;
1566    const word32 derBufSz = 16 * 1024;
1567    word32 derLen = 0; /* initialize to suppress false -Wmaybe-uninitialized */
1568    word32 idx;
1569    word32 sigLen;
1570    enum SlhDsaParam placeholder = param;
1571    static const byte msg[] = "SLH-DSA DER round-trip";
1572    static const enum SlhDsaParam candidates[] = {
1573        SLHDSA_SHAKE256S, SLHDSA_SHAKE128F, SLHDSA_SHAKE192S,
1574        SLHDSA_SHAKE192F, SLHDSA_SHAKE256F, SLHDSA_SHAKE128S,
1575    #ifdef WOLFSSL_SLHDSA_SHA2
1576        SLHDSA_SHA2_128S, SLHDSA_SHA2_128F, SLHDSA_SHA2_192S,
1577        SLHDSA_SHA2_192F, SLHDSA_SHA2_256S, SLHDSA_SHA2_256F,
1578    #endif
1579    };
1580    size_t cIdx;
1581
1582    /* Pick a placeholder different from the encoded param so a regression
1583     * that disables OID auto-detection would fail the post-decode equality
1584     * check. Walk the candidate list and probe each via wc_SlhDsaKey_Init;
1585     * the first one that initialises successfully (i.e. is compiled in) is
1586     * used. Falls back to the encoded param if no other variant is
1587     * available, in which case the test reduces to a smoke check. */
1588    for (cIdx = 0; cIdx < sizeof(candidates)/sizeof(candidates[0]); cIdx++) {
1589        SlhDsaKey probe;
1590        if (candidates[cIdx] == param) {
1591            continue;
1592        }
1593        XMEMSET(&probe, 0, sizeof(probe));
1594        if (wc_SlhDsaKey_Init(&probe, candidates[cIdx], NULL,
1595                              INVALID_DEVID) == 0) {
1596            placeholder = candidates[cIdx];
1597            wc_SlhDsaKey_Free(&probe);
1598            break;
1599        }
1600    }
1601
1602    XMEMSET(&rng, 0, sizeof(rng));
1603    XMEMSET(&keyGen, 0, sizeof(keyGen));
1604    XMEMSET(&keyPriv, 0, sizeof(keyPriv));
1605    XMEMSET(&keyPub, 0, sizeof(keyPub));
1606
1607    derBuf = (byte*)XMALLOC(derBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1608    ExpectNotNull(derBuf);
1609    sig = (byte*)XMALLOC(WC_SLHDSA_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1610    ExpectNotNull(sig);
1611
1612    ExpectIntEQ(wc_InitRng(&rng), 0);
1613    ExpectIntEQ(wc_SlhDsaKey_Init(&keyGen, param, NULL, INVALID_DEVID), 0);
1614    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&keyGen, &rng), 0);
1615
1616    /* Size-query contract: passing output=NULL returns the encoded size
1617     * without touching the buffer. The real encode below must produce
1618     * exactly this many bytes -- a size-query regression (e.g. forgetting
1619     * to add verSz) would surface here as a mismatch. */
1620    {
1621        int querySize;
1622        ExpectIntGT(querySize = wc_SlhDsaKey_KeyToDer(&keyGen, NULL, 0), 0);
1623        ExpectIntGT(derLen = (word32)wc_SlhDsaKey_KeyToDer(&keyGen, derBuf,
1624            derBufSz), 0);
1625        ExpectIntEQ((int)derLen, querySize);
1626
1627        /* BUFFER_E contract: too-small buffer is rejected without writing
1628         * anything past the limit. Pass inLen = querySize - 1 so the
1629         * length check fails for any encoding. */
1630        ExpectIntEQ(wc_SlhDsaKey_KeyToDer(&keyGen, derBuf,
1631            (word32)(querySize - 1)), WC_NO_ERR_TRACE(BUFFER_E));
1632
1633        /* PrivateKeyToDer is an RFC 9909 alias of KeyToDer; sizes must
1634         * match and BUFFER_E must propagate. */
1635        ExpectIntEQ(wc_SlhDsaKey_PrivateKeyToDer(&keyGen, NULL, 0), querySize);
1636        ExpectIntEQ(wc_SlhDsaKey_PrivateKeyToDer(&keyGen, derBuf,
1637            (word32)(querySize - 1)), WC_NO_ERR_TRACE(BUFFER_E));
1638    }
1639
1640    /* Decode into a fresh key.  The decode must auto-detect the real
1641     * parameter set from the OID embedded in the DER encoding. */
1642    ExpectIntEQ(wc_SlhDsaKey_Init(&keyPriv, placeholder, NULL, INVALID_DEVID),
1643        0);
1644    idx = 0;
1645    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(derBuf, &idx, &keyPriv, derLen),
1646        0);
1647    /* Verify the decoded key reports the ORIGINAL parameter set. */
1648    if (keyPriv.params != NULL) {
1649        ExpectIntEQ((int)keyPriv.params->param, (int)param);
1650    }
1651    /* Byte-level equivalence check: re-encode the decoded private key
1652     * and compare against the original DER. This catches a regression
1653     * even in single-variant builds where placeholder == param made the
1654     * params equality test above tautological -- if the decoder ignored
1655     * the OID and kept stale state, the bytes won't match. */
1656    {
1657        byte* roundBuf = (byte*)XMALLOC(derBufSz, NULL,
1658            DYNAMIC_TYPE_TMP_BUFFER);
1659        word32 roundLen;
1660        ExpectNotNull(roundBuf);
1661        ExpectIntGT(roundLen = (word32)wc_SlhDsaKey_KeyToDer(&keyPriv,
1662            roundBuf, derBufSz), 0);
1663        ExpectIntEQ((int)roundLen, (int)derLen);
1664        if (roundBuf != NULL) {
1665            ExpectIntEQ(XMEMCMP(roundBuf, derBuf, roundLen), 0);
1666        }
1667        XFREE(roundBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1668    }
1669
1670    /* Sign with the decoded private key and verify with the originally
1671     * generated key. This proves the decoded key material is correct. */
1672    sigLen = WC_SLHDSA_MAX_SIG_LEN;
1673    ExpectIntEQ(wc_SlhDsaKey_Sign(&keyPriv, NULL, 0, msg, (word32)sizeof(msg),
1674        sig, &sigLen, &rng), 0);
1675    ExpectIntEQ(wc_SlhDsaKey_Verify(&keyGen, NULL, 0, msg, (word32)sizeof(msg),
1676        sig, sigLen), 0);
1677
1678    /* Also test PrivateKeyToDer -> PrivateKeyDecode round-trip. */
1679    {
1680        SlhDsaKey keyPriv2;
1681        word32 derLen2;
1682        word32 idx2 = 0;
1683        XMEMSET(&keyPriv2, 0, sizeof(keyPriv2));
1684        ExpectIntGT(derLen2 = (word32)wc_SlhDsaKey_PrivateKeyToDer(&keyGen,
1685            derBuf, derBufSz), 0);
1686        ExpectIntEQ(wc_SlhDsaKey_Init(&keyPriv2, placeholder, NULL,
1687            INVALID_DEVID), 0);
1688        ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(derBuf, &idx2, &keyPriv2,
1689            derLen2), 0);
1690        /* Verify the PrivateKeyToDer output matches KeyToDer. */
1691        sigLen = WC_SLHDSA_MAX_SIG_LEN;
1692        ExpectIntEQ(wc_SlhDsaKey_Sign(&keyPriv2, NULL, 0, msg,
1693            (word32)sizeof(msg), sig, &sigLen, &rng), 0);
1694        ExpectIntEQ(wc_SlhDsaKey_Verify(&keyGen, NULL, 0, msg,
1695            (word32)sizeof(msg), sig, sigLen), 0);
1696        wc_SlhDsaKey_Free(&keyPriv2);
1697    }
1698
1699    /* PKCS#8 v2 (RFC 5958) acceptance: the decoder explicitly allows
1700     * version=0 or version=1. The encoder only ever writes version=0,
1701     * so without a targeted check the v=1 branch would never fire and a
1702     * regression that rejected v2 wrappers (legal RFC 5958 OneAsymmetricKey
1703     * input from external tools) would slip through. Walk past the outer
1704     * SEQUENCE header (which uses short or long-form length depending on
1705     * the parameter set's encoded size) to land on the INTEGER version
1706     * field, then flip its value from 0 to 1. */
1707    {
1708        SlhDsaKey keyPrivV2;
1709        word32 idxV2 = 0;
1710        word32 verPos;
1711        byte saved;
1712
1713        XMEMSET(&keyPrivV2, 0, sizeof(keyPrivV2));
1714        ExpectIntGT((int)derLen, 5);
1715        ExpectIntEQ((int)derBuf[0], 0x30); /* outer SEQUENCE tag */
1716        if ((derBuf[1] & 0x80) == 0) {
1717            verPos = 2;                       /* short-form length */
1718        }
1719        else {
1720            verPos = 2 + (derBuf[1] & 0x7F);  /* long-form length */
1721        }
1722        ExpectIntLT((int)verPos + 3, (int)derLen);
1723        ExpectIntEQ((int)derBuf[verPos], 0x02);     /* INTEGER tag */
1724        ExpectIntEQ((int)derBuf[verPos + 1], 0x01); /* INTEGER length */
1725        ExpectIntEQ((int)derBuf[verPos + 2], 0x00); /* v0 baseline */
1726        saved = derBuf[verPos + 2];
1727        derBuf[verPos + 2] = 0x01;
1728
1729        ExpectIntEQ(wc_SlhDsaKey_Init(&keyPrivV2, placeholder, NULL,
1730            INVALID_DEVID), 0);
1731        ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(derBuf, &idxV2, &keyPrivV2,
1732            derLen), 0);
1733        if (keyPrivV2.params != NULL) {
1734            ExpectIntEQ((int)keyPrivV2.params->param, (int)param);
1735        }
1736        /* Confirm the v2-decoded private material is functionally
1737         * identical: a signature it produces verifies under keyGen. */
1738        sigLen = WC_SLHDSA_MAX_SIG_LEN;
1739        ExpectIntEQ(wc_SlhDsaKey_Sign(&keyPrivV2, NULL, 0, msg,
1740            (word32)sizeof(msg), sig, &sigLen, &rng), 0);
1741        ExpectIntEQ(wc_SlhDsaKey_Verify(&keyGen, NULL, 0, msg,
1742            (word32)sizeof(msg), sig, sigLen), 0);
1743        derBuf[verPos + 2] = saved;
1744        wc_SlhDsaKey_Free(&keyPrivV2);
1745    }
1746
1747    /* Now round-trip the public key alone, with size-query and BUFFER_E
1748     * contract checks for both withAlg modes. */
1749    {
1750        int querySpki, queryRaw;
1751        byte rawPub[WC_SLHDSA_MAX_PUB_LEN];
1752        word32 rawPubLen = (word32)sizeof(rawPub);
1753
1754        /* withAlg=1: full SubjectPublicKeyInfo (used by certificate code). */
1755        ExpectIntGT(querySpki = wc_SlhDsaKey_PublicKeyToDer(&keyGen, NULL, 0,
1756            1), 0);
1757        ExpectIntGT(derLen = (word32)wc_SlhDsaKey_PublicKeyToDer(&keyGen,
1758            derBuf, derBufSz, 1), 0);
1759        ExpectIntEQ((int)derLen, querySpki);
1760        ExpectIntEQ(wc_SlhDsaKey_PublicKeyToDer(&keyGen, derBuf,
1761            (word32)(querySpki - 1), 1), WC_NO_ERR_TRACE(BUFFER_E));
1762
1763        /* withAlg=0: raw 2*n public-key bytes only -- this is the path
1764         * SetKeyIdFromPublicKey in asn.c walks when computing SKID/AKID
1765         * for SLH-DSA certificates. Verify the bytes match what
1766         * ExportPublic produces so a regression in this branch (e.g.
1767         * accidentally emitting the SPKI envelope, or returning the
1768         * wrong length) breaks the test rather than silently corrupting
1769         * key identifiers in issued certs. */
1770        ExpectIntGT(queryRaw = wc_SlhDsaKey_PublicKeyToDer(&keyGen, NULL, 0,
1771            0), 0);
1772        ExpectIntEQ(queryRaw, (int)(2 * keyGen.params->n));
1773        ExpectIntGT(wc_SlhDsaKey_PublicKeyToDer(&keyGen, derBuf, derBufSz, 0),
1774            0);
1775        ExpectIntEQ(wc_SlhDsaKey_PublicKeyToDer(&keyGen, derBuf,
1776            (word32)(queryRaw - 1), 0), WC_NO_ERR_TRACE(BUFFER_E));
1777
1778        ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&keyGen, rawPub, &rawPubLen), 0);
1779        ExpectIntEQ((int)rawPubLen, queryRaw);
1780        ExpectIntEQ(XMEMCMP(derBuf, rawPub, rawPubLen), 0);
1781
1782        /* Re-encode the SPKI so the decode test below sees the
1783         * withAlg=1 buffer (raw output above is not decodable as SPKI). */
1784        ExpectIntGT(derLen = (word32)wc_SlhDsaKey_PublicKeyToDer(&keyGen,
1785            derBuf, derBufSz, 1), 0);
1786    }
1787
1788    ExpectIntEQ(wc_SlhDsaKey_Init(&keyPub, placeholder, NULL, INVALID_DEVID),
1789        0);
1790    idx = 0;
1791    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(derBuf, &idx, &keyPub, derLen), 0);
1792    if (keyPub.params != NULL) {
1793        ExpectIntEQ((int)keyPub.params->param, (int)param);
1794    }
1795    /* The decoded public key should verify the signature we just produced. */
1796    ExpectIntEQ(wc_SlhDsaKey_Verify(&keyPub, NULL, 0, msg, (word32)sizeof(msg),
1797        sig, sigLen), 0);
1798
1799    wc_SlhDsaKey_Free(&keyPub);
1800    wc_SlhDsaKey_Free(&keyPriv);
1801    wc_SlhDsaKey_Free(&keyGen);
1802    wc_FreeRng(&rng);
1803    XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1804    XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1805
1806    return EXPECT_RESULT();
1807}
1808#endif
1809
1810/*
1811 * DER codec round-trip test: encode each compiled-in SLH-DSA parameter set
1812 * to DER, decode it (without telling the decoder which parameter set it is),
1813 * confirm auto-detect produces the right parameter, and verify a signature
1814 * produced with the decoded key. This test would fail if PrivateKeyDecode
1815 * / PublicKeyDecode did not auto-detect the parameter set from the OID.
1816 */
1817int test_wc_slhdsa_der_roundtrip(void)
1818{
1819    EXPECT_DECLS;
1820#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
1821    defined(WC_ENABLE_ASYM_KEY_EXPORT)
1822#ifdef WOLFSSL_SLHDSA_PARAM_128S
1823    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE128S), TEST_SUCCESS);
1824#endif
1825#ifdef WOLFSSL_SLHDSA_PARAM_128F
1826    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE128F), TEST_SUCCESS);
1827#endif
1828#ifdef WOLFSSL_SLHDSA_PARAM_192S
1829    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE192S), TEST_SUCCESS);
1830#endif
1831#ifdef WOLFSSL_SLHDSA_PARAM_192F
1832    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE192F), TEST_SUCCESS);
1833#endif
1834#ifdef WOLFSSL_SLHDSA_PARAM_256S
1835    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE256S), TEST_SUCCESS);
1836#endif
1837#ifdef WOLFSSL_SLHDSA_PARAM_256F
1838    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHAKE256F), TEST_SUCCESS);
1839#endif
1840#ifdef WOLFSSL_SLHDSA_SHA2
1841#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
1842    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_128S), TEST_SUCCESS);
1843#endif
1844#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
1845    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_128F), TEST_SUCCESS);
1846#endif
1847#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
1848    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_192S), TEST_SUCCESS);
1849#endif
1850#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
1851    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_192F), TEST_SUCCESS);
1852#endif
1853#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
1854    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_256S), TEST_SUCCESS);
1855#endif
1856#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
1857    ExpectIntEQ(slhdsa_der_roundtrip_one(SLHDSA_SHA2_256F), TEST_SUCCESS);
1858#endif
1859#endif /* WOLFSSL_SLHDSA_SHA2 */
1860#endif /* WOLFSSL_HAVE_SLHDSA && !VERIFY_ONLY && WC_ENABLE_ASYM_KEY_EXPORT */
1861    return EXPECT_RESULT();
1862}
1863
1864/*
1865 * Negative / error-path tests for the DER encode/decode functions.
1866 */
1867int test_wc_slhdsa_der_negative(void)
1868{
1869    EXPECT_DECLS;
1870#ifdef WOLFSSL_HAVE_SLHDSA
1871    SlhDsaKey key;
1872    word32 idx;
1873    byte buf[16];
1874
1875    XMEMSET(&key, 0, sizeof(key));
1876
1877    /* PrivateKeyDecode: NULL parameters */
1878#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
1879    idx = 0;
1880    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(NULL, &idx, &key, 10),
1881        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1882    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(buf, NULL, &key, 10),
1883        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1884    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(buf, &idx, NULL, 10),
1885        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1886    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(buf, &idx, &key, 0),
1887        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1888    /* PrivateKeyDecode: truncated data */
1889    idx = 0;
1890    XMEMSET(buf, 0, sizeof(buf));
1891    ExpectIntNE(wc_SlhDsaKey_PrivateKeyDecode(buf, &idx, &key, sizeof(buf)), 0);
1892#endif
1893
1894    /* PublicKeyDecode: NULL parameters */
1895    idx = 0;
1896    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(NULL, &idx, &key, 10),
1897        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1898    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(buf, NULL, &key, 10),
1899        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1900    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(buf, &idx, NULL, 10),
1901        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1902    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(buf, &idx, &key, 0),
1903        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1904
1905#if defined(WC_ENABLE_ASYM_KEY_EXPORT) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
1906    /* KeyToDer / PrivateKeyToDer: NULL key */
1907    ExpectIntEQ(wc_SlhDsaKey_KeyToDer(NULL, buf, sizeof(buf)),
1908        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1909    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyToDer(NULL, buf, sizeof(buf)),
1910        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1911
1912    /* KeyToDer: public-only key should return MISSING_KEY. Build the
1913     * public-only state through the public API (generate a key, export
1914     * the public part, import it into a fresh key) rather than poking
1915     * key->flags directly. */
1916#ifdef WOLFSSL_SLHDSA_PARAM_128S
1917    {
1918        SlhDsaKey srcKey;
1919        SlhDsaKey pubOnly;
1920        WC_RNG rng;
1921        byte pub[WC_SLHDSA_MAX_PUB_LEN];
1922        word32 pubLen = (word32)sizeof(pub);
1923
1924        XMEMSET(&srcKey, 0, sizeof(srcKey));
1925        XMEMSET(&pubOnly, 0, sizeof(pubOnly));
1926        XMEMSET(&rng, 0, sizeof(rng));
1927
1928        ExpectIntEQ(wc_InitRng(&rng), 0);
1929        ExpectIntEQ(wc_SlhDsaKey_Init(&srcKey, SLHDSA_SHAKE128S, NULL,
1930            INVALID_DEVID), 0);
1931        ExpectIntEQ(wc_SlhDsaKey_MakeKey(&srcKey, &rng), 0);
1932        ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&srcKey, pub, &pubLen), 0);
1933
1934        ExpectIntEQ(wc_SlhDsaKey_Init(&pubOnly, SLHDSA_SHAKE128S, NULL,
1935            INVALID_DEVID), 0);
1936        ExpectIntEQ(wc_SlhDsaKey_ImportPublic(&pubOnly, pub, pubLen), 0);
1937        ExpectIntEQ(wc_SlhDsaKey_KeyToDer(&pubOnly, NULL, 0),
1938            WC_NO_ERR_TRACE(MISSING_KEY));
1939        ExpectIntEQ(wc_SlhDsaKey_PrivateKeyToDer(&pubOnly, NULL, 0),
1940            WC_NO_ERR_TRACE(MISSING_KEY));
1941        wc_SlhDsaKey_Free(&pubOnly);
1942        wc_SlhDsaKey_Free(&srcKey);
1943        wc_FreeRng(&rng);
1944    }
1945#endif
1946#endif /* WC_ENABLE_ASYM_KEY_EXPORT && !VERIFY_ONLY */
1947
1948    /* PublicKeyToDer: NULL key */
1949#ifdef WC_ENABLE_ASYM_KEY_EXPORT
1950    ExpectIntEQ(wc_SlhDsaKey_PublicKeyToDer(NULL, buf, sizeof(buf), 1),
1951        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1952#endif
1953
1954    /* RFC 5958 OneAsymmetricKey trailing-field validation:
1955     *   [0] IMPLICIT Attributes  OPTIONAL  -- at most once
1956     *   [1] IMPLICIT PublicKey   OPTIONAL  -- at most once, after [0]
1957     * The decoder must reject duplicates, out-of-order tags, and
1958     * unrecognised tags. Build a valid SHAKE128S DER then mutate it. */
1959#if defined(WC_ENABLE_ASYM_KEY_EXPORT) && \
1960    !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
1961    defined(WOLFSSL_SLHDSA_PARAM_128S)
1962    {
1963        SlhDsaKey srcKey;
1964        WC_RNG rng;
1965        byte goodDer[256];
1966        int goodLen = 0;
1967        size_t i;
1968        struct {
1969            const byte* trailing;
1970            word32      trailingLen;
1971            int         expectAccept; /* 0 = expect ASN_PARSE_E */
1972            const char* desc;
1973        } cases[5];
1974        const byte tDupAttr[]   = { 0xA0, 0x00, 0xA0, 0x00 };
1975        const byte tDupPub[]    = { 0xA1, 0x00, 0xA1, 0x00 };
1976        const byte tOutOfOrder[]= { 0xA1, 0x00, 0xA0, 0x00 };
1977        const byte tUnknown[]   = { 0xA2, 0x00 };
1978        const byte tValidAttr[] = { 0xA0, 0x00 };
1979
1980        cases[0].trailing = tDupAttr;
1981        cases[0].trailingLen = (word32)sizeof(tDupAttr);
1982        cases[0].expectAccept = 0;
1983        cases[0].desc = "duplicate [0] attributes";
1984        cases[1].trailing = tDupPub;
1985        cases[1].trailingLen = (word32)sizeof(tDupPub);
1986        cases[1].expectAccept = 0;
1987        cases[1].desc = "duplicate [1] publicKey";
1988        cases[2].trailing = tOutOfOrder;
1989        cases[2].trailingLen = (word32)sizeof(tOutOfOrder);
1990        cases[2].expectAccept = 0;
1991        cases[2].desc = "[1] before [0]";
1992        cases[3].trailing = tUnknown;
1993        cases[3].trailingLen = (word32)sizeof(tUnknown);
1994        cases[3].expectAccept = 0;
1995        cases[3].desc = "unknown context tag [2]";
1996        /* Sanity: a single [0] is permitted -- if this rejects, the
1997         * tightening above is overzealous and the four rejection cases
1998         * are testing nothing useful. */
1999        cases[4].trailing = tValidAttr;
2000        cases[4].trailingLen = (word32)sizeof(tValidAttr);
2001        cases[4].expectAccept = 1;
2002        cases[4].desc = "single [0] attributes (accepted)";
2003
2004        XMEMSET(&srcKey, 0, sizeof(srcKey));
2005        XMEMSET(&rng, 0, sizeof(rng));
2006        ExpectIntEQ(wc_InitRng(&rng), 0);
2007        ExpectIntEQ(wc_SlhDsaKey_Init(&srcKey, SLHDSA_SHAKE128S, NULL,
2008            INVALID_DEVID), 0);
2009        ExpectIntEQ(wc_SlhDsaKey_MakeKey(&srcKey, &rng), 0);
2010        ExpectIntGT(goodLen = wc_SlhDsaKey_KeyToDer(&srcKey, goodDer,
2011            sizeof(goodDer)), 0);
2012
2013        /* The mutator below tweaks goodDer[1] (length byte) in place,
2014         * which only works if the encoder used short-form SEQUENCE
2015         * length. SHAKE128S body is ~82 bytes so this holds, but assert
2016         * it so a future encoder change surfaces here rather than
2017         * silently producing buffers that decode despite the mutation. */
2018        ExpectIntEQ((int)goodDer[0], 0x30);
2019        ExpectIntLT((int)goodDer[1], 0x80);
2020        ExpectIntLT((int)goodDer[1] + 4, 0x80);
2021
2022        for (i = 0; i < sizeof(cases)/sizeof(cases[0]); i++) {
2023            byte mut[260];
2024            word32 mutLen;
2025            word32 idx2 = 0;
2026            SlhDsaKey k;
2027            int decRet;
2028            XMEMSET(&k, 0, sizeof(k));
2029            XMEMCPY(mut, goodDer, (size_t)goodLen);
2030            XMEMCPY(mut + goodLen, cases[i].trailing, cases[i].trailingLen);
2031            mutLen = (word32)goodLen + cases[i].trailingLen;
2032            mut[1] = (byte)(goodDer[1] + cases[i].trailingLen);
2033            ExpectIntEQ(wc_SlhDsaKey_Init(&k, SLHDSA_SHAKE128S, NULL,
2034                INVALID_DEVID), 0);
2035            decRet = wc_SlhDsaKey_PrivateKeyDecode(mut, &idx2, &k, mutLen);
2036            if (cases[i].expectAccept) {
2037                ExpectIntEQ(decRet, 0);
2038            }
2039            else {
2040                ExpectIntEQ(decRet, WC_NO_ERR_TRACE(ASN_PARSE_E));
2041            }
2042            (void)cases[i].desc;
2043            wc_SlhDsaKey_Free(&k);
2044        }
2045
2046        wc_SlhDsaKey_Free(&srcKey);
2047        wc_FreeRng(&rng);
2048    }
2049#endif /* WC_ENABLE_ASYM_KEY_EXPORT && !VERIFY_ONLY && PARAM_128S */
2050
2051#endif /* WOLFSSL_HAVE_SLHDSA */
2052    return EXPECT_RESULT();
2053}
2054
2055#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
2056    !defined(NO_FILESYSTEM)
2057/* Load an RFC 9909 compliant DER file from disk and confirm that
2058 * wc_SlhDsaKey_PrivateKeyDecode accepts it, auto-detects the parameter
2059 * set from the OID, and produces a usable signing key. This test
2060 * exercises the on-disk certs/slhdsa/ fixtures - any future file-format
2061 * drift (nested wrapper, seed-only, wrong length) will be caught here. */
2062/* doSign=0 skips the sign/verify smoke check; the 192s and 256s parameter
2063 * sets are slow enough (multi-second per Sign) that running them on every
2064 * make-check would balloon test time. The decoder is still exercised. */
2065static int slhdsa_decode_file_one(const char *path, enum SlhDsaParam expected,
2066    int doSign)
2067{
2068    EXPECT_DECLS;
2069    XFILE f = XBADFILE;
2070    byte der[256];
2071    int derSz = 0;
2072    SlhDsaKey key;
2073    WC_RNG rng;
2074    word32 idx = 0;
2075    byte sig[WC_SLHDSA_MAX_SIG_LEN];
2076    word32 sigLen = (word32)sizeof(sig);
2077    static const byte msg[] = "slhdsa decode-file test";
2078
2079    XMEMSET(&key, 0, sizeof(key));
2080    XMEMSET(&rng, 0, sizeof(rng));
2081
2082    ExpectTrue((f = XFOPEN(path, "rb")) != XBADFILE);
2083    if (f != XBADFILE) {
2084        ExpectIntGT(derSz = (int)XFREAD(der, 1, sizeof(der), f), 0);
2085        XFCLOSE(f);
2086    }
2087
2088    /* Pick a seed param different from `expected` when more than one
2089     * variant is built. The decoder always overwrites this from the OID
2090     * in the DER, so a different placeholder actually tests the auto-
2091     * detect contract on disk-loaded fixtures (mirroring the helper
2092     * logic in slhdsa_der_roundtrip_one). Falls back to `expected` when
2093     * no alternative variant is available. */
2094    {
2095        static const enum SlhDsaParam candidates[] = {
2096            SLHDSA_SHAKE128S, SLHDSA_SHAKE128F, SLHDSA_SHAKE192S,
2097            SLHDSA_SHAKE192F, SLHDSA_SHAKE256S, SLHDSA_SHAKE256F,
2098        #ifdef WOLFSSL_SLHDSA_SHA2
2099            SLHDSA_SHA2_128S, SLHDSA_SHA2_128F, SLHDSA_SHA2_192S,
2100            SLHDSA_SHA2_192F, SLHDSA_SHA2_256S, SLHDSA_SHA2_256F,
2101        #endif
2102        };
2103        enum SlhDsaParam placeholder = expected;
2104        size_t cIdx;
2105        for (cIdx = 0; cIdx < sizeof(candidates)/sizeof(candidates[0]);
2106             cIdx++) {
2107            SlhDsaKey probe;
2108            if (candidates[cIdx] == expected) continue;
2109            XMEMSET(&probe, 0, sizeof(probe));
2110            if (wc_SlhDsaKey_Init(&probe, candidates[cIdx], NULL,
2111                                  INVALID_DEVID) == 0) {
2112                placeholder = candidates[cIdx];
2113                wc_SlhDsaKey_Free(&probe);
2114                break;
2115            }
2116        }
2117        ExpectIntEQ(wc_SlhDsaKey_Init(&key, placeholder, NULL, INVALID_DEVID),
2118            0);
2119    }
2120
2121    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(der, &idx, &key, (word32)derSz),
2122        0);
2123    ExpectNotNull(key.params);
2124    if (key.params != NULL) {
2125        ExpectIntEQ((int)key.params->param, (int)expected);
2126    }
2127
2128    if (doSign) {
2129        /* Sanity: signing works with the decoded key. */
2130        ExpectIntEQ(wc_InitRng(&rng), 0);
2131        ExpectIntEQ(wc_SlhDsaKey_Sign(&key, NULL, 0, msg, (word32)sizeof(msg),
2132            sig, &sigLen, &rng), 0);
2133        ExpectIntEQ(wc_SlhDsaKey_Verify(&key, NULL, 0, msg,
2134            (word32)sizeof(msg), sig, sigLen), 0);
2135        wc_FreeRng(&rng);
2136    }
2137    else {
2138        /* Cheap structural validation when the full sign/verify is
2139         * skipped (slow 192s/256s variants): catches an uninitialised SK
2140         * half or a botched SHA-2 precompute without paying the
2141         * multi-second cost of an actual Sign. */
2142        ExpectIntEQ(wc_SlhDsaKey_CheckKey(&key), 0);
2143    }
2144
2145    wc_SlhDsaKey_Free(&key);
2146    return EXPECT_RESULT();
2147}
2148#endif
2149
2150/* Load each checked-in bench_slhdsa_shake*_key.der fixture and confirm it
2151 * decodes via wc_SlhDsaKey_PrivateKeyDecode with correct auto-detection.
2152 * These fixtures are RFC 9909 compliant (bare OCTET STRING, 4*n bytes) -
2153 * this test would fail if the files drift to a non-compliant encoding
2154 * (e.g. nested OCTET STRING, seed-only). */
2155int test_wc_slhdsa_der_decode_files(void)
2156{
2157    EXPECT_DECLS;
2158#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
2159    !defined(NO_FILESYSTEM)
2160#ifdef WOLFSSL_SLHDSA_PARAM_128S
2161    ExpectIntEQ(slhdsa_decode_file_one(
2162        "./certs/slhdsa/bench_slhdsa_shake128s_key.der", SLHDSA_SHAKE128S, 1),
2163        TEST_SUCCESS);
2164#endif
2165#ifdef WOLFSSL_SLHDSA_PARAM_128F
2166    ExpectIntEQ(slhdsa_decode_file_one(
2167        "./certs/slhdsa/bench_slhdsa_shake128f_key.der", SLHDSA_SHAKE128F, 1),
2168        TEST_SUCCESS);
2169#endif
2170#ifdef WOLFSSL_SLHDSA_PARAM_192S
2171    ExpectIntEQ(slhdsa_decode_file_one(
2172        "./certs/slhdsa/bench_slhdsa_shake192s_key.der", SLHDSA_SHAKE192S, 0),
2173        TEST_SUCCESS);
2174#endif
2175#ifdef WOLFSSL_SLHDSA_PARAM_192F
2176    ExpectIntEQ(slhdsa_decode_file_one(
2177        "./certs/slhdsa/bench_slhdsa_shake192f_key.der", SLHDSA_SHAKE192F, 1),
2178        TEST_SUCCESS);
2179#endif
2180#ifdef WOLFSSL_SLHDSA_PARAM_256S
2181    ExpectIntEQ(slhdsa_decode_file_one(
2182        "./certs/slhdsa/bench_slhdsa_shake256s_key.der", SLHDSA_SHAKE256S, 0),
2183        TEST_SUCCESS);
2184#endif
2185#ifdef WOLFSSL_SLHDSA_PARAM_256F
2186    ExpectIntEQ(slhdsa_decode_file_one(
2187        "./certs/slhdsa/bench_slhdsa_shake256f_key.der", SLHDSA_SHAKE256F, 1),
2188        TEST_SUCCESS);
2189#endif
2190#ifdef WOLFSSL_SLHDSA_SHA2
2191#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
2192    ExpectIntEQ(slhdsa_decode_file_one(
2193        "./certs/slhdsa/bench_slhdsa_sha2_128s_key.der", SLHDSA_SHA2_128S, 1),
2194        TEST_SUCCESS);
2195#endif
2196#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
2197    ExpectIntEQ(slhdsa_decode_file_one(
2198        "./certs/slhdsa/bench_slhdsa_sha2_128f_key.der", SLHDSA_SHA2_128F, 1),
2199        TEST_SUCCESS);
2200#endif
2201#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
2202    ExpectIntEQ(slhdsa_decode_file_one(
2203        "./certs/slhdsa/bench_slhdsa_sha2_192s_key.der", SLHDSA_SHA2_192S, 0),
2204        TEST_SUCCESS);
2205#endif
2206#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
2207    ExpectIntEQ(slhdsa_decode_file_one(
2208        "./certs/slhdsa/bench_slhdsa_sha2_192f_key.der", SLHDSA_SHA2_192F, 1),
2209        TEST_SUCCESS);
2210#endif
2211#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
2212    ExpectIntEQ(slhdsa_decode_file_one(
2213        "./certs/slhdsa/bench_slhdsa_sha2_256s_key.der", SLHDSA_SHA2_256S, 0),
2214        TEST_SUCCESS);
2215#endif
2216#ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
2217    ExpectIntEQ(slhdsa_decode_file_one(
2218        "./certs/slhdsa/bench_slhdsa_sha2_256f_key.der", SLHDSA_SHA2_256F, 1),
2219        TEST_SUCCESS);
2220#endif
2221#endif /* WOLFSSL_SLHDSA_SHA2 */
2222#endif
2223    return EXPECT_RESULT();
2224}
2225
2226#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
2227/* Regression: wolfssl_x509_make_der and ConfirmSignature both pass the
2228 * raw 2*n public-key bytes (the BIT STRING contents stashed by StoreKey
2229 * into cert->publicKey) to wc_SlhDsaKey_PublicKeyDecode. Before the
2230 * raw-first fast path landed, that call returned ASN_PARSE_E because
2231 * DecodeAsymKeyPublic_Assign requires an SPKI SEQUENCE. This test pins
2232 * the new contract: when key->params is already set, raw bytes decode
2233 * directly, mirroring wc_Falcon_PublicKeyDecode and
2234 * wc_Dilithium_PublicKeyDecode. */
2235static int slhdsa_raw_public_decode_one(enum SlhDsaParam param)
2236{
2237    EXPECT_DECLS;
2238    SlhDsaKey src;
2239    SlhDsaKey dst;
2240    byte pub[WC_SLHDSA_MAX_PUB_LEN];
2241    word32 pubLen = (word32)sizeof(pub);
2242    word32 idx = 0;
2243    WC_RNG rng;
2244
2245    XMEMSET(&src, 0, sizeof(src));
2246    XMEMSET(&dst, 0, sizeof(dst));
2247    XMEMSET(&rng, 0, sizeof(rng));
2248
2249    ExpectIntEQ(wc_InitRng(&rng), 0);
2250    ExpectIntEQ(wc_SlhDsaKey_Init(&src, param, NULL, INVALID_DEVID), 0);
2251    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&src, &rng), 0);
2252    ExpectIntEQ(wc_SlhDsaKey_ExportPublic(&src, pub, &pubLen), 0);
2253
2254    /* Decode the raw public-key bytes via PublicKeyDecode. The fast
2255     * path triggers because key->params is set by Init. */
2256    ExpectIntEQ(wc_SlhDsaKey_Init(&dst, param, NULL, INVALID_DEVID), 0);
2257    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(pub, &idx, &dst, pubLen), 0);
2258    ExpectIntEQ((int)idx, (int)pubLen);
2259    ExpectNotNull(dst.params);
2260    if (dst.params != NULL) {
2261        ExpectIntEQ((int)dst.params->param, (int)param);
2262    }
2263
2264    wc_SlhDsaKey_Free(&dst);
2265    wc_SlhDsaKey_Free(&src);
2266    wc_FreeRng(&rng);
2267    return EXPECT_RESULT();
2268}
2269#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
2270
2271int test_wc_slhdsa_x509_i2d_roundtrip(void)
2272{
2273    EXPECT_DECLS;
2274#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
2275    /* Exercise the raw public-key fast path for every compiled-in variant
2276     * so a regression in n-dependent buffer math (32/48/64-byte keys)
2277     * fails the test even in restricted builds where SHAKE128S /
2278     * SHA2_128S happen to be excluded. */
2279#ifdef WOLFSSL_SLHDSA_PARAM_128S
2280    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE128S), TEST_SUCCESS);
2281#endif
2282#ifdef WOLFSSL_SLHDSA_PARAM_128F
2283    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE128F), TEST_SUCCESS);
2284#endif
2285#ifdef WOLFSSL_SLHDSA_PARAM_192S
2286    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE192S), TEST_SUCCESS);
2287#endif
2288#ifdef WOLFSSL_SLHDSA_PARAM_192F
2289    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE192F), TEST_SUCCESS);
2290#endif
2291#ifdef WOLFSSL_SLHDSA_PARAM_256S
2292    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE256S), TEST_SUCCESS);
2293#endif
2294#ifdef WOLFSSL_SLHDSA_PARAM_256F
2295    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHAKE256F), TEST_SUCCESS);
2296#endif
2297#ifdef WOLFSSL_SLHDSA_SHA2
2298    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128S
2299    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_128S), TEST_SUCCESS);
2300    #endif
2301    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_128F
2302    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_128F), TEST_SUCCESS);
2303    #endif
2304    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192S
2305    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_192S), TEST_SUCCESS);
2306    #endif
2307    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_192F
2308    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_192F), TEST_SUCCESS);
2309    #endif
2310    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256S
2311    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_256S), TEST_SUCCESS);
2312    #endif
2313    #ifdef WOLFSSL_SLHDSA_PARAM_SHA2_256F
2314    ExpectIntEQ(slhdsa_raw_public_decode_one(SLHDSA_SHA2_256F), TEST_SUCCESS);
2315    #endif
2316#endif /* WOLFSSL_SLHDSA_SHA2 */
2317#endif
2318    return EXPECT_RESULT();
2319}
2320
2321#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
2322    defined(WC_ENABLE_ASYM_KEY_EXPORT)
2323/* Build a DER blob using an enabled SLH-DSA variant and patch the
2324 * AlgorithmIdentifier OID's trailing byte to point at a *disabled*
2325 * variant, then push it through the decoders. The contract being
2326 * pinned is that wc_SlhDsaKey_PrivateKeyDecode / PublicKeyDecode pass
2327 * the wc_SlhDsaOidToParam NOT_COMPILED_IN result through verbatim
2328 * rather than collapsing it to ASN_PARSE_E -- if that breaks, x509 /
2329 * TLS lose the precise "variant unavailable" diagnostic and silently
2330 * report malformed-DER instead.
2331 *
2332 * All SLH-DSA OIDs share the prefix 2.16.840.1.101.3.4.3.X with X<128,
2333 * so DER encoding lengths match exactly and the trailing byte is the
2334 * sole discriminator -- patching it in place produces a structurally
2335 * valid SPKI/PKCS#8 buffer that only fails at the OID-lookup step.
2336 *
2337 * @param src             Enabled parameter set used to generate real DER.
2338 * @param targetOidByte   Trailing OID byte of the disabled variant.
2339 */
2340/* Marked WC_MAYBE_UNUSED because every call site below is gated on a
2341 * per-variant disable macro -- builds that leave every variant enabled
2342 * (e.g. --enable-fips=ready) preprocess all callers away. */
2343static WC_MAYBE_UNUSED int slhdsa_decode_disabled_oid_one(enum SlhDsaParam src,
2344    byte targetOidByte)
2345{
2346    EXPECT_DECLS;
2347    /* OID prefix common to every SLH-DSA variant. */
2348    static const byte oidPrefix[] = {
2349        0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03
2350    };
2351    SlhDsaKey srcKey;
2352    SlhDsaKey dstKey;
2353    WC_RNG rng;
2354    byte* derBuf = NULL;
2355    const word32 derBufSz = 16 * 1024;
2356    int derLen = 0;
2357    word32 idx;
2358    word32 j;
2359    int patched;
2360
2361    XMEMSET(&srcKey, 0, sizeof(srcKey));
2362    XMEMSET(&dstKey, 0, sizeof(dstKey));
2363    XMEMSET(&rng, 0, sizeof(rng));
2364
2365    derBuf = (byte*)XMALLOC(derBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2366    ExpectNotNull(derBuf);
2367    ExpectIntEQ(wc_InitRng(&rng), 0);
2368    ExpectIntEQ(wc_SlhDsaKey_Init(&srcKey, src, NULL, INVALID_DEVID), 0);
2369    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&srcKey, &rng), 0);
2370
2371    /* Public-key path: build SPKI, patch the variant byte, decode. */
2372    ExpectIntGT(derLen = wc_SlhDsaKey_PublicKeyToDer(&srcKey, derBuf, derBufSz,
2373        1), 0);
2374    patched = 0;
2375    for (j = 0; derLen > (int)sizeof(oidPrefix) &&
2376            j + sizeof(oidPrefix) < (word32)derLen; j++) {
2377        if (XMEMCMP(derBuf + j, oidPrefix, sizeof(oidPrefix)) == 0) {
2378            derBuf[j + sizeof(oidPrefix)] = targetOidByte;
2379            patched = 1;
2380            break;
2381        }
2382    }
2383    ExpectIntEQ(patched, 1);
2384    /* dstKey is zeroed (no params) so the raw fast path is skipped and
2385     * SPKI parsing surfaces the OID-lookup result. */
2386    idx = 0;
2387    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(derBuf, &idx, &dstKey,
2388        (word32)derLen), WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2389
2390    /* Private-key path: same scheme using the PKCS#8 wrapper. */
2391    ExpectIntGT(derLen = wc_SlhDsaKey_KeyToDer(&srcKey, derBuf, derBufSz), 0);
2392    patched = 0;
2393    for (j = 0; derLen > (int)sizeof(oidPrefix) &&
2394            j + sizeof(oidPrefix) < (word32)derLen; j++) {
2395        if (XMEMCMP(derBuf + j, oidPrefix, sizeof(oidPrefix)) == 0) {
2396            derBuf[j + sizeof(oidPrefix)] = targetOidByte;
2397            patched = 1;
2398            break;
2399        }
2400    }
2401    ExpectIntEQ(patched, 1);
2402    /* Free any state PublicKeyDecode may have established before the
2403     * second decode call reuses the key slot. */
2404    wc_SlhDsaKey_Free(&dstKey);
2405    XMEMSET(&dstKey, 0, sizeof(dstKey));
2406    idx = 0;
2407    ExpectIntEQ(wc_SlhDsaKey_PrivateKeyDecode(derBuf, &idx, &dstKey,
2408        (word32)derLen), WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2409
2410    wc_SlhDsaKey_Free(&dstKey);
2411    wc_SlhDsaKey_Free(&srcKey);
2412    wc_FreeRng(&rng);
2413    XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2414    return EXPECT_RESULT();
2415}
2416
2417/* Round-trip variant: same patcher path but the targetOidByte must equal
2418 * the source's own OID byte, so the decode is expected to succeed. Used
2419 * as an unconditional smoke check so test_wc_slhdsa_decoder_disabled_oid
2420 * exercises the patcher infrastructure even on builds with no per-variant
2421 * disable, where every disabled-branch in the caller is #if'd out. */
2422static int slhdsa_decode_disabled_oid_one_roundtrip(enum SlhDsaParam src,
2423    byte targetOidByte)
2424{
2425    EXPECT_DECLS;
2426    static const byte oidPrefix[] = {
2427        0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03
2428    };
2429    SlhDsaKey srcKey;
2430    SlhDsaKey dstKey;
2431    WC_RNG rng;
2432    byte* derBuf = NULL;
2433    const word32 derBufSz = 16 * 1024;
2434    int derLen = 0;
2435    word32 idx;
2436    word32 j;
2437    int patched;
2438
2439    XMEMSET(&srcKey, 0, sizeof(srcKey));
2440    XMEMSET(&dstKey, 0, sizeof(dstKey));
2441    XMEMSET(&rng, 0, sizeof(rng));
2442
2443    derBuf = (byte*)XMALLOC(derBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2444    ExpectNotNull(derBuf);
2445    ExpectIntEQ(wc_InitRng(&rng), 0);
2446    ExpectIntEQ(wc_SlhDsaKey_Init(&srcKey, src, NULL, INVALID_DEVID), 0);
2447    ExpectIntEQ(wc_SlhDsaKey_MakeKey(&srcKey, &rng), 0);
2448
2449    ExpectIntGT(derLen = wc_SlhDsaKey_PublicKeyToDer(&srcKey, derBuf, derBufSz,
2450        1), 0);
2451    patched = 0;
2452    for (j = 0; derLen > (int)sizeof(oidPrefix) &&
2453            j + sizeof(oidPrefix) < (word32)derLen; j++) {
2454        if (XMEMCMP(derBuf + j, oidPrefix, sizeof(oidPrefix)) == 0) {
2455            derBuf[j + sizeof(oidPrefix)] = targetOidByte;
2456            patched = 1;
2457            break;
2458        }
2459    }
2460    ExpectIntEQ(patched, 1);
2461    idx = 0;
2462    ExpectIntEQ(wc_SlhDsaKey_PublicKeyDecode(derBuf, &idx, &dstKey,
2463        (word32)derLen), 0);
2464
2465    wc_SlhDsaKey_Free(&dstKey);
2466    wc_SlhDsaKey_Free(&srcKey);
2467    wc_FreeRng(&rng);
2468    XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2469    return EXPECT_RESULT();
2470}
2471
2472/* Probe candidate parameter sets in priority order and return the first
2473 * one whose backend is built in. Used to source a real DER buffer for
2474 * slhdsa_decode_disabled_oid_one regardless of which variants the
2475 * current build excluded. Returns 1 on success, 0 if no variant is
2476 * available (which the build's #error guard makes impossible in
2477 * practice but the test handles defensively). */
2478static int slhdsa_pick_enabled_param(enum SlhDsaParam* out)
2479{
2480    static const enum SlhDsaParam candidates[] = {
2481        SLHDSA_SHAKE128S, SLHDSA_SHAKE128F, SLHDSA_SHAKE192S,
2482        SLHDSA_SHAKE192F, SLHDSA_SHAKE256S, SLHDSA_SHAKE256F,
2483    #ifdef WOLFSSL_SLHDSA_SHA2
2484        SLHDSA_SHA2_128S, SLHDSA_SHA2_128F, SLHDSA_SHA2_192S,
2485        SLHDSA_SHA2_192F, SLHDSA_SHA2_256S, SLHDSA_SHA2_256F,
2486    #endif
2487    };
2488    size_t i;
2489
2490    for (i = 0; i < sizeof(candidates)/sizeof(candidates[0]); i++) {
2491        SlhDsaKey probe;
2492        XMEMSET(&probe, 0, sizeof(probe));
2493        if (wc_SlhDsaKey_Init(&probe, candidates[i], NULL,
2494                              INVALID_DEVID) == 0) {
2495            wc_SlhDsaKey_Free(&probe);
2496            *out = candidates[i];
2497            return 1;
2498        }
2499    }
2500    return 0;
2501}
2502#endif /* WOLFSSL_HAVE_SLHDSA && !VERIFY_ONLY && WC_ENABLE_ASYM_KEY_EXPORT */
2503
2504/* Pin the per-variant disable contract: every parameter set whose enum
2505 * value is visible (so the test compiles) but whose backend is excluded
2506 * by a WOLFSSL_SLHDSA_PARAM_NO_* / WOLFSSL_SLHDSA_NO_* macro must surface
2507 * NOT_COMPILED_IN from wc_SlhDsaKey_Init instead of silently succeeding
2508 * or returning a generic error.
2509 *
2510 * This is the only API-level test for the granular disable surface and
2511 * also locks in the contract that wc_SlhDsaOidToParam/CertType in asn.c
2512 * piggyback on -- if Init drifts away from NOT_COMPILED_IN here, the
2513 * mapping helpers will likewise diverge and certificate handling will
2514 * lose its "variant unavailable" diagnostic. */
2515int test_wc_slhdsa_param_disabled(void)
2516{
2517    EXPECT_DECLS;
2518#ifdef WOLFSSL_HAVE_SLHDSA
2519    SlhDsaKey key;
2520    enum SlhDsaParam enabledProbe = SLHDSA_SHAKE128S;
2521    int haveEnabled;
2522
2523    XMEMSET(&key, 0, sizeof(key));
2524
2525    /* Positive smoke check: at least one variant must initialise. Without
2526     * this the disabled-variant branches below can all be #if'd out and
2527     * the test would silently pass on default builds, defeating its
2528     * documented purpose. The probe also validates the contract from the
2529     * other side -- Init must succeed for an enabled param. */
2530    haveEnabled = 0;
2531#if defined(WOLFSSL_SLHDSA_PARAM_128S)
2532    enabledProbe = SLHDSA_SHAKE128S; haveEnabled = 1;
2533#elif defined(WOLFSSL_SLHDSA_PARAM_128F)
2534    enabledProbe = SLHDSA_SHAKE128F; haveEnabled = 1;
2535#elif defined(WOLFSSL_SLHDSA_PARAM_192S)
2536    enabledProbe = SLHDSA_SHAKE192S; haveEnabled = 1;
2537#elif defined(WOLFSSL_SLHDSA_PARAM_192F)
2538    enabledProbe = SLHDSA_SHAKE192F; haveEnabled = 1;
2539#elif defined(WOLFSSL_SLHDSA_PARAM_256S)
2540    enabledProbe = SLHDSA_SHAKE256S; haveEnabled = 1;
2541#elif defined(WOLFSSL_SLHDSA_PARAM_256F)
2542    enabledProbe = SLHDSA_SHAKE256F; haveEnabled = 1;
2543#elif defined(WOLFSSL_SLHDSA_SHA2) && defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S)
2544    enabledProbe = SLHDSA_SHA2_128S; haveEnabled = 1;
2545#endif
2546    ExpectIntEQ(haveEnabled, 1);
2547    if (haveEnabled) {
2548        ExpectIntEQ(wc_SlhDsaKey_Init(&key, enabledProbe, NULL,
2549            INVALID_DEVID), 0);
2550        wc_SlhDsaKey_Free(&key);
2551        XMEMSET(&key, 0, sizeof(key));
2552    }
2553
2554#if defined(WOLFSSL_SLHDSA_PARAM_NO_128S) || \
2555    defined(WOLFSSL_SLHDSA_NO_128) || \
2556    defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2557    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128S, NULL, INVALID_DEVID),
2558        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2559#endif
2560#if defined(WOLFSSL_SLHDSA_PARAM_NO_128F) || \
2561    defined(WOLFSSL_SLHDSA_NO_128) || \
2562    defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2563    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE128F, NULL, INVALID_DEVID),
2564        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2565#endif
2566#if defined(WOLFSSL_SLHDSA_PARAM_NO_192S) || \
2567    defined(WOLFSSL_SLHDSA_NO_192) || \
2568    defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2569    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192S, NULL, INVALID_DEVID),
2570        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2571#endif
2572#if defined(WOLFSSL_SLHDSA_PARAM_NO_192F) || \
2573    defined(WOLFSSL_SLHDSA_NO_192) || \
2574    defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2575    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE192F, NULL, INVALID_DEVID),
2576        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2577#endif
2578#if defined(WOLFSSL_SLHDSA_PARAM_NO_256S) || \
2579    defined(WOLFSSL_SLHDSA_NO_256) || \
2580    defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2581    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256S, NULL, INVALID_DEVID),
2582        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2583#endif
2584#if defined(WOLFSSL_SLHDSA_PARAM_NO_256F) || \
2585    defined(WOLFSSL_SLHDSA_NO_256) || \
2586    defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2587    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHAKE256F, NULL, INVALID_DEVID),
2588        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2589#endif
2590
2591#ifdef WOLFSSL_SLHDSA_SHA2
2592    /* SHA-2 enum values are only declared when WOLFSSL_SLHDSA_SHA2 is set;
2593     * each per-variant disable below is checked under that gate. */
2594    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_128S
2595    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128S, NULL, INVALID_DEVID),
2596        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2597    #endif
2598    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_128F
2599    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_128F, NULL, INVALID_DEVID),
2600        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2601    #endif
2602    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_192S
2603    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192S, NULL, INVALID_DEVID),
2604        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2605    #endif
2606    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_192F
2607    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_192F, NULL, INVALID_DEVID),
2608        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2609    #endif
2610    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_256S
2611    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256S, NULL, INVALID_DEVID),
2612        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2613    #endif
2614    #ifdef WOLFSSL_SLHDSA_PARAM_NO_SHA2_256F
2615    ExpectIntEQ(wc_SlhDsaKey_Init(&key, SLHDSA_SHA2_256F, NULL, INVALID_DEVID),
2616        WC_NO_ERR_TRACE(NOT_COMPILED_IN));
2617    #endif
2618#endif /* WOLFSSL_SLHDSA_SHA2 */
2619
2620    (void)key;
2621#endif /* WOLFSSL_HAVE_SLHDSA */
2622    return EXPECT_RESULT();
2623}
2624
2625/* Decoder-level companion to test_wc_slhdsa_param_disabled: feed DER for
2626 * each disabled SLH-DSA OID into PrivateKeyDecode/PublicKeyDecode and
2627 * confirm they pass NOT_COMPILED_IN through verbatim. The Init-level
2628 * test above proves the mapping helper is correct; this one proves the
2629 * decoders honour it instead of collapsing the result to ASN_PARSE_E. */
2630int test_wc_slhdsa_decoder_disabled_oid(void)
2631{
2632    EXPECT_DECLS;
2633#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
2634    defined(WC_ENABLE_ASYM_KEY_EXPORT)
2635    enum SlhDsaParam src = SLHDSA_SHAKE128S;
2636    int haveSrc = slhdsa_pick_enabled_param(&src);
2637    ExpectIntEQ(haveSrc, 1);
2638
2639    if (haveSrc) {
2640        /* Positive smoke check: feed src's own OID through the patcher
2641         * (round-trip) and expect a clean decode, so the decoder path
2642         * actually exercises here even when no per-variant disable is
2643         * active. The trailing OID byte for SHAKE128S is 0x1A; we look
2644         * up the byte for `src` from a small table because src may not
2645         * be SHAKE128S in restricted builds. */
2646        {
2647            byte srcOidByte = 0;
2648            switch (src) {
2649                case SLHDSA_SHAKE128S: srcOidByte = 0x1A; break;
2650                case SLHDSA_SHAKE128F: srcOidByte = 0x1B; break;
2651                case SLHDSA_SHAKE192S: srcOidByte = 0x1C; break;
2652                case SLHDSA_SHAKE192F: srcOidByte = 0x1D; break;
2653                case SLHDSA_SHAKE256S: srcOidByte = 0x1E; break;
2654                case SLHDSA_SHAKE256F: srcOidByte = 0x1F; break;
2655            #ifdef WOLFSSL_SLHDSA_SHA2
2656                case SLHDSA_SHA2_128S: srcOidByte = 0x14; break;
2657                case SLHDSA_SHA2_128F: srcOidByte = 0x15; break;
2658                case SLHDSA_SHA2_192S: srcOidByte = 0x16; break;
2659                case SLHDSA_SHA2_192F: srcOidByte = 0x17; break;
2660                case SLHDSA_SHA2_256S: srcOidByte = 0x18; break;
2661                case SLHDSA_SHA2_256F: srcOidByte = 0x19; break;
2662            #endif
2663                default: break;
2664            }
2665            ExpectIntGT((int)srcOidByte, 0);
2666            /* Round-trip: patching src's OID to itself must still decode
2667             * successfully -- this fires unconditionally and validates
2668             * the patcher infrastructure even when no disable branch
2669             * below applies. */
2670            ExpectIntEQ(slhdsa_decode_disabled_oid_one_roundtrip(src,
2671                srcOidByte), TEST_SUCCESS);
2672        }
2673
2674        /* SHAKE family: trailing OID byte = 0x1A..0x1F. */
2675        #if defined(WOLFSSL_SLHDSA_PARAM_NO_128S) || \
2676            defined(WOLFSSL_SLHDSA_NO_128) || \
2677            defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2678        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1A), TEST_SUCCESS);
2679        #endif
2680        #if defined(WOLFSSL_SLHDSA_PARAM_NO_128F) || \
2681            defined(WOLFSSL_SLHDSA_NO_128) || \
2682            defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2683        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1B), TEST_SUCCESS);
2684        #endif
2685        #if defined(WOLFSSL_SLHDSA_PARAM_NO_192S) || \
2686            defined(WOLFSSL_SLHDSA_NO_192) || \
2687            defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2688        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1C), TEST_SUCCESS);
2689        #endif
2690        #if defined(WOLFSSL_SLHDSA_PARAM_NO_192F) || \
2691            defined(WOLFSSL_SLHDSA_NO_192) || \
2692            defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2693        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1D), TEST_SUCCESS);
2694        #endif
2695        #if defined(WOLFSSL_SLHDSA_PARAM_NO_256S) || \
2696            defined(WOLFSSL_SLHDSA_NO_256) || \
2697            defined(WOLFSSL_SLHDSA_PARAM_NO_SMALL)
2698        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1E), TEST_SUCCESS);
2699        #endif
2700        #if defined(WOLFSSL_SLHDSA_PARAM_NO_256F) || \
2701            defined(WOLFSSL_SLHDSA_NO_256) || \
2702            defined(WOLFSSL_SLHDSA_PARAM_NO_FAST)
2703        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x1F), TEST_SUCCESS);
2704        #endif
2705
2706        /* SHA-2 family: trailing OID byte = 0x14..0x19. The whole
2707         * family is also disabled when WOLFSSL_SLHDSA_SHA2 is unset. */
2708        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2709            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_128S)
2710        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x14), TEST_SUCCESS);
2711        #endif
2712        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2713            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_128F)
2714        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x15), TEST_SUCCESS);
2715        #endif
2716        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2717            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_192S)
2718        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x16), TEST_SUCCESS);
2719        #endif
2720        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2721            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_192F)
2722        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x17), TEST_SUCCESS);
2723        #endif
2724        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2725            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_256S)
2726        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x18), TEST_SUCCESS);
2727        #endif
2728        #if !defined(WOLFSSL_SLHDSA_SHA2) || \
2729            defined(WOLFSSL_SLHDSA_PARAM_NO_SHA2_256F)
2730        ExpectIntEQ(slhdsa_decode_disabled_oid_one(src, 0x19), TEST_SUCCESS);
2731        #endif
2732    }
2733#endif
2734    return EXPECT_RESULT();
2735}
2736
2737#ifdef TEST_SLHDSA_DEFAULT_PARAM
2738    #undef TEST_SLHDSA_DEFAULT_PARAM
2739    #undef TEST_SLHDSA_DEFAULT_SIG_LEN
2740    #undef TEST_SLHDSA_DEFAULT_PRIV_LEN
2741    #undef TEST_SLHDSA_DEFAULT_PUB_LEN
2742    #undef TEST_SLHDSA_DEFAULT_SEED_LEN
2743#endif