Skip to content

Replace V523_NONFIPS_SHAKE path reference to shake.c/h #11900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
philljj merged 2 commits into from
Oct 28, 2026
+35 −42
Merged

Replace V523_NONFIPS_SHAKE path reference to shake.c/h #11900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c81dcc6
Replace path to fips/v5.2.3-custom-shake-pq/<shake.c/h>
rlm2002 Oct 26, 2026
9eac0d0
Rename V523_NONFIPS_SHAKE to V5_NONFIPS_SHAKE
rlm2002 Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .wolfssl_known_macro_extras
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -795,7 +795,7 @@ USE_TLSV13
USE_WINDOWS_API
USE_WOLF_STRNSTR
USS_API
V523_NONFIPS_SHAKE
V5_NONFIPS_SHAKE
VLT_TLS_NO_ECDH
W64LIT_FORCE_LONG_LONG
WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
Expand Down
28 changes: 10 additions & 18 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -825,29 +825,21 @@ AS_CASE([$FIPS_VERSION],
)

case "$AM_CFLAGS $CPPFLAGS $CFLAGS $EXTRA_CFLAGS" in
Comment thread
philljj marked this conversation as resolved.
*-DV523_NONFIPS_SHAKE*) ENABLED_V523_NONFIPS_SHAKE=yes ;;
*) ENABLED_V523_NONFIPS_SHAKE=no ;;
*-DV5_NONFIPS_SHAKE*) ENABLED_V5_NONFIPS_SHAKE=yes ;;
*) ENABLED_V5_NONFIPS_SHAKE=no ;;
esac
if test "x$HAVE_FIPS_VERSION_MAJOR" != "x5"
then
ENABLED_V523_NONFIPS_SHAKE=no
fi
if test "x$HAVE_FIPS_VERSION_MINOR" != "x2"
then
ENABLED_V523_NONFIPS_SHAKE=no
fi
if test "x$HAVE_FIPS_VERSION_PATCH" != "x1"
then
ENABLED_V523_NONFIPS_SHAKE=no
ENABLED_V5_NONFIPS_SHAKE=no
fi
dnl shake.c/shake.h live in the internal fips repo, not this one; a wolfssl
dnl checkout without them dropped into fips/v5.2.3-custom-shake-pq/ would
dnl otherwise fail deep in the build with a bare "No rule to make target".
AS_IF([ test "x$ENABLED_V523_NONFIPS_SHAKE" = "xyes" && \
( ! test -s $srcdir/fips/v5.2.3-custom-shake-pq/shake.c || \
! test -s $srcdir/fips/v5.2.3-custom-shake-pq/shake.h ) ],
[AC_MSG_ERROR([fips/v5.2.3-custom-shake-pq/shake.c and/or shake.h not found. V523_NONFIPS_SHAKE needs the internal fips repo overlay.])])
AM_CONDITIONAL([BUILD_V523_NONFIPS_SHAKE],[test "x$ENABLED_V523_NONFIPS_SHAKE" = "xyes"])
dnl checkout without them dropped into wolfcrypt/src/ and wolfssl/wolfcrypt/
dnl would otherwise fail deep in the build with a bare "No rule to make target".
AS_IF([ test "x$ENABLED_V5_NONFIPS_SHAKE" = "xyes" && \
( ! test -s $srcdir/wolfcrypt/src/shake.c || \
! test -s $srcdir/wolfssl/wolfcrypt/shake.h ) ],
[AC_MSG_ERROR([wolfcrypt/src/shake.c and/or wolfssl/wolfcrypt/shake.h not found. V5_NONFIPS_SHAKE needs the internal fips repo overlay.])])
AM_CONDITIONAL([BUILD_V5_NONFIPS_SHAKE],[test "x$ENABLED_V5_NONFIPS_SHAKE" = "xyes"])

if test "$ENABLED_FIPS_DEV" = "yes"
then
Expand Down
4 changes: 2 additions & 2 deletions src/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -448,8 +448,8 @@ endif BUILD_SHA512

if BUILD_SHA3
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sha3.c
if BUILD_V523_NONFIPS_SHAKE
nodist_src_libwolfssl@LIBSUFFIX@_la_SOURCES = fips/v5.2.3-custom-shake-pq/shake.c
if BUILD_V5_NONFIPS_SHAKE
nodist_src_libwolfssl@LIBSUFFIX@_la_SOURCES = wolfcrypt/src/shake.c
endif
if BUILD_ARMASM_NEON
if BUILD_ARMASM_INLINE
Expand Down
4 changes: 2 additions & 2 deletions tests/api/test_sha3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/

#if defined(V523_NONFIPS_SHAKE)
#if defined(V5_NONFIPS_SHAKE)
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
Expand All @@ -28,7 +28,7 @@
#endif
#include <wolfssl/wolfcrypt/settings.h>
#ifdef WOLFSSL_SHA3
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#include <wolfssl/wolfcrypt/shake.h>
#endif
#endif

Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/benchmark/benchmark.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,8 @@
#include <wolfssl/wolfcrypt/memory.h>
#include <wolfssl/wolfcrypt/random.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif
#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/version.h>
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,8 @@

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif

/*
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/src/hash.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif

#ifndef NO_ASN
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/src/wc_mldsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,8 +182,8 @@

#if defined(WOLFSSL_HAVE_MLDSA)

#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif

#if FIPS_VERSION3_GE(7,0,0)
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/test/test.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@
#include <wolfssl/options.h>
#endif
#include <wolfssl/wolfcrypt/settings.h>
#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif

#ifdef WOLFSSL_DEBUG_TRACE_ERROR_CODES
Expand Down
4 changes: 2 additions & 2 deletions wolfssl/wolfcrypt/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,8 +173,8 @@ nobase_include_HEADERS+= wolfssl/wolfcrypt/port/silabs/silabs_cryptocb.h
nobase_include_HEADERS+= wolfssl/wolfcrypt/port/silabs/silabs_shim.h

if BUILD_SHA3
if BUILD_V523_NONFIPS_SHAKE
nobase_nodist_include_HEADERS=fips/v5.2.3-custom-shake-pq/shake.h
if BUILD_V5_NONFIPS_SHAKE
nobase_nodist_include_HEADERS=wolfssl/wolfcrypt/shake.h
endif
endif

Expand Down
7 changes: 4 additions & 3 deletions wolfssl/wolfcrypt/settings.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5702,9 +5702,10 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
#undef WOLFSSL_SHAKE256
#endif

#if defined(V523_NONFIPS_SHAKE) && \
(!defined(HAVE_FIPS) || !FIPS_VERSION3_EQ(5,2,1))
#error "V523_NONFIPS_SHAKE requires FIPS v5 cert4718 (5.2.1)"
/* Enable SHAKE 128/256 algorithms in a custom FIPS v5 build */
#if defined(V5_NONFIPS_SHAKE) && \
(!defined(HAVE_FIPS) || FIPS_VERSION3_LT(5,0,0) || FIPS_VERSION3_GE(6,0,0))
#error "V5_NONFIPS_SHAKE requires a FIPS v5 cert (ex. #5548, v5.2.3)"
#endif


Expand Down
4 changes: 2 additions & 2 deletions wolfssl/wolfcrypt/wc_mldsa.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,8 +97,8 @@

#if defined(WOLFSSL_HAVE_MLDSA)

Comment thread
philljj marked this conversation as resolved.
#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
#include <wolfssl/wolfcrypt/shake.h>
#endif
#include <wolfssl/wolfcrypt/sha3.h>
#ifndef WOLFSSL_MLDSA_VERIFY_ONLY
Expand Down
4 changes: 2 additions & 2 deletions wolfssl/wolfcrypt/wc_mlkem.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,12 @@
#include <wolfssl/wolfcrypt/types.h>
#include <wolfssl/wolfcrypt/random.h>
#include <wolfssl/wolfcrypt/sha3.h>
#if defined(WOLFSSL_SHA3) && defined(V523_NONFIPS_SHAKE)
#if defined(WOLFSSL_SHA3) && defined(V5_NONFIPS_SHAKE)
/* Must come after sha3.h here, unlike the other override sites: sha3.h
* processes first with SHAKE off, so shake.h's own fallback typedef and
* prototypes are what actually declare wc_Shake here. Moving it ahead
* breaks the build. */
#include <fips/v5.2.3-custom-shake-pq/shake.h>
#include <wolfssl/wolfcrypt/shake.h>
#endif

#ifdef WOLFSSL_HAVE_MLKEM
Expand Down
Loading