Update oqs-provider scripts for R4

[romen]

Here is my attempt at fixing the contents of the oqs-provider provider.

• It was missing the shell scripts for generate and verify
  • I imported (and edited) gen.sh, check.sh and the R3 versions from oqs-openssl111
  • By the way, the scripts in oqs-openssl111 are using config files which load providers, so I am not sure they work at all against the OQS OpenSSL 1.1.1 fork, so maybe that folder also needs some maintentance
• I added new gen_r4.sh and check_r4.sh, adhering to the new format
• I added artifacts_certs_r4.zip with the (currently limited) set of certificates that gen_r4.sh generates

Please provide feedback so I can improve the quality of this PR.

[romen]

Just added the current (limited) set of certificates that the script currently generates, see f772596

[romen]

@johngray-dev @praveksharma @ounsworth @feventura can I ask your feedback on this?

[praveksharma]

Thank you for updating this @romen! The new r4 scripts look good to me. I was wondering whether it would be easier to just remove Sphincs and Dilithium since other providers aren't submitting artefacts for those anymore.

Looks like oqsprovider is behind on SLH-DSA, ML-DSA, and the CMS artefacts. Am I missing anything?

[johngray-dev]

Yes, oqsprovider is behind on everything... If you look at the automated results matrix is essentially shows everyone as partial validation because oqs fails on everything... Event the OQS composite signatures implementation is behind.

[praveksharma]

If you look at the automated results matrix is essentially shows everyone as partial validation because oqs fails on everything.

I was just going off of algorithm availability. This table doesn't include OQS results because it hasn't been updated with the results from this branch. Am I looking at the table?

[baentsch]

Looks like oqsprovider is behind on SLH-DSA, ML-DSA

This isn't exactly surprising as the underlying liboqs does not support them at the spec'd level: open-quantum-safe/liboqs#1919, open-quantum-safe/liboqs#1894

Event the OQS composite signatures implementation is behind

That is surprising given open-quantum-safe/oqs-provider#549.

--> Which code version is being used in these tests? Has anyone created a current dockerfile with code from "main" for these tests as I did a long time ago in preparation for a hackathon? If it's still that old image run, failing interop is rather logical :-) @praveksharma ?

[romen]

The artifacts in this PR have been generated using openquantumsafe/oqs-ossl3:latest (914cd7795c16)

Which reports:

$ OPENSSL_CONF=/dev/null openssl list -provider oqsprovider -providers -verbose
Providers:
  oqsprovider
    name: OpenSSL OQS Provider
    version: 0.7.1-dev
    status: active
    build info: OQS Provider v.0.7.1-dev (8680f17) based on liboqs v.0.11.1-dev
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)

[johngray-dev]

To be fair, we did just publish draft-lamps-composite-signatures-03 on October 21st. I don't think Felipe has had time to update it yet. It does require use of the ML-DSA context, so ML-DSA would need to be offically supported before composite signatures can be updated. Thanks for all the work you do to make this available to us!

[CBonnell]

This LGTM. Are there any outstanding items that need to be addressed prior to merging?

[romen]

Thanks @CBonnell ! Looking at the CI artifacts, it seems we are not getting results/failures on the compat matrix output for all the algs, am I missing something or reading the output in the wrong way?

[romen]

For example in the pqc_hackathon_results_certs_r4.html output of the CI, I don't see an oqs-provider column, but I am missing why!
Can you help me? SHould this be addressed in this PR or separately?

[CBonnell]

Hi @romen, I think what you are seeing is correct. There are no r4 artifacts in the https://github.com/IETF-Hackathon/pqc-certificates/tree/master/providers/oqs-provider directory, so oqsprovider will not appear in the top-level table of producers.