feat: update to liboqs 0.11.0 and various Rust changes

.github/workflows/ci.yml

@@ -83,4 +83,13 @@ jobs:
       - name: Cargo clippy
         run: cargo clippy
 
+  careful:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - uses: dtolnay/rust-toolchain@nightly
+      - run: cargo install cargo-careful
+      - run: cargo careful test --no-default-features --features non_portable,kems,sigs,std --manifest-path oqs/Cargo.toml
 #  vim: set ft=yaml ts=2 sw=2 tw=0 et :

CHANGELOG.md

@@ -1,3 +1,10 @@
+## oqs-sys v0.9.2
+
+- Update to liboqs 0.11.0
+- Expose ML-KEM, ML-DSA, Cross, and Mayo
+- Buffer Serialize/Deserialize uses serdect for hex when readable and binary when not
+- Implement Debug for all structs
+
 ## oqs-sys v0.9.1
 
 * Fix pkg-config version detection (#246)

oqs-sys/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "oqs-sys"
-version = "0.9.1+liboqs-0.9.0"
-authors = ["Thom Wiggers <[email protected]>"]
+version = "0.9.2+liboqs-0.11.0"
+authors = ["Thom Wiggers <[email protected]>", "Michael Lodder <[email protected]>"]
 edition = "2021"
 links = "oqs"
 description = "Bindings to liboqs"
@@ -20,7 +20,7 @@ libc = "0.2"
 [build-dependencies]
 pkg-config = "0.3"
 cmake = "0.1"
-bindgen = "0.69"
+bindgen = "0.70"
 build-deps = "0.1"
 
 [features]
@@ -30,17 +30,21 @@ docs = []
 non_portable = []
 vendored = []
 # algorithms: KEMs
-kems = ["classic_mceliece", "frodokem", "hqc", "kyber", "ntruprime"]
+kems = ["classic_mceliece", "frodokem", "hqc", "kyber", "ntruprime", "ml_kem"]
 bike = []  # BIKE is enabled by build.rs on non-windows targets
 classic_mceliece = []
 frodokem = []
 hqc = []
 kyber = []
 ntruprime = []
+ml_kem = []
 # algorithms: Signature schemes
-sigs = ["dilithium", "falcon", "sphincs"]
+sigs = ["cross", "dilithium", "falcon", "mayo", "ml_dsa", "sphincs"]
+cross = []
 dilithium = []
 falcon = []
+mayo = []
+ml_dsa = []
 sphincs = []
 
 [package.metadata.docs.rs]

oqs-sys/build.rs

@@ -22,8 +22,12 @@ fn generate_bindings(includedir: &Path, headerfile: &str, filter: &str) {
         // Whitelist OQS stuff
         .allowlist_recursively(false)
         .allowlist_type(filter)
+        .allowlist_type("secure_store_sk")
+        .allowlist_type("lock_key")
+        .allowlist_type("unlock_key")
         .allowlist_function(filter)
         .allowlist_var(filter)
+        .parse_callbacks(Box::new(bindgen::CargoCallbacks::new()))
         // Use core and libc
         .use_core()
         .ctypes_prefix("::libc")
@@ -69,10 +73,14 @@ fn build_from_source() -> PathBuf {
     algorithm_feature!("KEM", "hqc");
     algorithm_feature!("KEM", "kyber");
     algorithm_feature!("KEM", "ntruprime");
+    algorithm_feature!("KEM", "ml_kem");
 
     // signature schemes
     algorithm_feature!("SIG", "dilithium");
     algorithm_feature!("SIG", "falcon");
+    algorithm_feature!("SIG", "mayo");
+    algorithm_feature!("SIG", "cross");
+    algorithm_feature!("SIG", "ml_dsa");
     algorithm_feature!("SIG", "sphincs");
 
     if cfg!(windows) {

oqs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "oqs"
-version = "0.9.0"
+version = "0.9.1"
 authors = ["Thom Wiggers <[email protected]>"]
 edition = "2021"
 description = "A Rusty interface to Open-Quantum-Safe's liboqs"
@@ -13,28 +13,34 @@ license = "MIT OR Apache-2.0"
 libc = "0.2"
 cstr_core = { version = "0.2", default-features = false, features = ["alloc"] }
 serde = { version = "1.0", optional = true, default-features = false, features = ["derive", "alloc"] }
+serdect = { version = "0.3.0-rc.0", optional = true }
 
 [dependencies.oqs-sys]
 path = "../oqs-sys"
-version = "0.9.0"
+version = "0.9.2"
 default-features = false
 
 [features]
 default = ["oqs-sys/openssl", "kems", "sigs", "std"]
+serde = ["dep:serde", "serdect"]
 std = []
 non_portable = ["oqs-sys/non_portable"]
 vendored = ["oqs-sys/vendored"]
 
 # algorithms: KEMs
-kems = ["oqs-sys/kems", "classic_mceliece", "frodokem", "hqc", "kyber", "ntruprime"]
+kems = ["oqs-sys/kems", "classic_mceliece", "frodokem", "hqc", "kyber", "ntruprime", "ml_kem"]
 bike = ["oqs-sys/bike"]  # not supported on Windows or 32-bit ARM
 classic_mceliece = ["oqs-sys/classic_mceliece"]
 frodokem = ["oqs-sys/frodokem"]
 hqc = ["oqs-sys/hqc"]
 kyber = ["oqs-sys/kyber"]
 ntruprime = ["oqs-sys/ntruprime"]
+ml_kem = ["oqs-sys/ml_kem"]
 # algorithms: Signature schemes
-sigs = ["oqs-sys/sigs", "dilithium", "falcon", "sphincs"]
+sigs = ["oqs-sys/sigs", "cross", "dilithium", "falcon", "mayo", "ml_dsa", "sphincs"]
+cross = ["oqs-sys/cross"]
 dilithium = ["oqs-sys/dilithium"]
 falcon = ["oqs-sys/falcon"]
+mayo = ["oqs-sys/mayo"]
+ml_dsa = ["oqs-sys/ml_dsa"]
 sphincs = ["oqs-sys/sphincs"]

oqs/src/kem.rs

@@ -5,6 +5,7 @@
 use alloc::vec::Vec;
 
 use core::ptr::NonNull;
+use core::str::FromStr;
 
 #[cfg(not(feature = "std"))]
 use cstr_core::CStr;
@@ -24,7 +25,7 @@ newtype_buffer!(Ciphertext, CiphertextRef);
 newtype_buffer!(SharedSecret, SharedSecretRef);
 
 macro_rules! implement_kems {
-    { $(($feat: literal) $kem: ident: $oqs_id: ident),* $(,)? } => (
+    { $(($feat: literal) $kem: ident: $oqs_id: ident: $str_name: literal),* $(,)? } => (
 
         /// Supported algorithms by OQS
         ///
@@ -49,6 +50,18 @@ macro_rules! implement_kems {
             id as *const _ as *const libc::c_char
         }
 
+        impl FromStr for Algorithm {
+            type Err = Error;
+            fn from_str(s: &str) -> Result<Self> {
+                match s {
+                    $(
+                       $str_name => Ok(Algorithm::$kem),
+                    )*
+                    _ => Err(Error::AlgorithmNotSupportedOrKnown),
+                }
+            }
+        }
+
         $(
             #[cfg(test)]
             #[allow(non_snake_case)]
@@ -108,40 +121,60 @@ macro_rules! implement_kems {
                         assert!(!version.is_empty());
                     }
                 }
+
+                #[test]
+                fn test_from_str() {
+                    let algo = Algorithm::$kem;
+                    let name = algo.name();
+                    let res = name.parse::<Algorithm>();
+                    if res.is_err() {
+                        assert!(false, "Failed to parse: {:?}", name);
+                    }
+                    let algo2 = res.unwrap();
+                    assert_eq!(algo, algo2);
+                }
             }
         )*
     )
 }
 
+// List of supported KEM algorithms found in liboqs/src/kem/kem.h
 implement_kems! {
-    ("bike") BikeL1: OQS_KEM_alg_bike_l1,
-    ("bike") BikeL3: OQS_KEM_alg_bike_l3,
-    ("bike") BikeL5: OQS_KEM_alg_bike_l5,
-    ("classic_mceliece") ClassicMcEliece348864: OQS_KEM_alg_classic_mceliece_348864,
-    ("classic_mceliece") ClassicMcEliece348864f: OQS_KEM_alg_classic_mceliece_348864f,
-    ("classic_mceliece") ClassicMcEliece460896: OQS_KEM_alg_classic_mceliece_460896,
-    ("classic_mceliece") ClassicMcEliece460896f: OQS_KEM_alg_classic_mceliece_460896f,
-    ("classic_mceliece") ClassicMcEliece6688128: OQS_KEM_alg_classic_mceliece_6688128,
-    ("classic_mceliece") ClassicMcEliece6688128f: OQS_KEM_alg_classic_mceliece_6688128f,
-    ("classic_mceliece") ClassicMcEliece6960119: OQS_KEM_alg_classic_mceliece_6960119,
-    ("classic_mceliece") ClassicMcEliece6960119f: OQS_KEM_alg_classic_mceliece_6960119f,
-    ("classic_mceliece") ClassicMcEliece8192128: OQS_KEM_alg_classic_mceliece_8192128,
-    ("classic_mceliece") ClassicMcEliece8192128f: OQS_KEM_alg_classic_mceliece_8192128f,
-    ("hqc") Hqc128: OQS_KEM_alg_hqc_128,
-    ("hqc") Hqc192: OQS_KEM_alg_hqc_192,
-    ("hqc") Hqc256: OQS_KEM_alg_hqc_256,
-    ("kyber") Kyber512: OQS_KEM_alg_kyber_512,
-    ("kyber") Kyber768: OQS_KEM_alg_kyber_768,
-    ("kyber") Kyber1024: OQS_KEM_alg_kyber_1024,
-    ("ntruprime") NtruPrimeSntrup761: OQS_KEM_alg_ntruprime_sntrup761,
-    ("frodokem") FrodoKem640Aes: OQS_KEM_alg_frodokem_640_aes,
-    ("frodokem") FrodoKem640Shake: OQS_KEM_alg_frodokem_640_shake,
-    ("frodokem") FrodoKem976Aes: OQS_KEM_alg_frodokem_976_aes,
-    ("frodokem") FrodoKem976Shake: OQS_KEM_alg_frodokem_976_shake,
-    ("frodokem") FrodoKem1344Aes: OQS_KEM_alg_frodokem_1344_aes,
-    ("frodokem") FrodoKem1344Shake: OQS_KEM_alg_frodokem_1344_shake,
+    ("bike") BikeL1: OQS_KEM_alg_bike_l1: "BIKE-L1",
+    ("bike") BikeL3: OQS_KEM_alg_bike_l3: "BIKE-L3",
+    ("bike") BikeL5: OQS_KEM_alg_bike_l5: "BIKE-L5",
+    ("classic_mceliece") ClassicMcEliece348864: OQS_KEM_alg_classic_mceliece_348864: "Classic-McEliece-348864",
+    ("classic_mceliece") ClassicMcEliece348864f: OQS_KEM_alg_classic_mceliece_348864f: "Classic-McEliece-348864f",
+    ("classic_mceliece") ClassicMcEliece460896: OQS_KEM_alg_classic_mceliece_460896: "Classic-McEliece-460896",
+    ("classic_mceliece") ClassicMcEliece460896f: OQS_KEM_alg_classic_mceliece_460896f: "Classic-McEliece-460896f",
+    ("classic_mceliece") ClassicMcEliece6688128: OQS_KEM_alg_classic_mceliece_6688128: "Classic-McEliece-6688128",
+    ("classic_mceliece") ClassicMcEliece6688128f: OQS_KEM_alg_classic_mceliece_6688128f: "Classic-McEliece-6688128f",
+    ("classic_mceliece") ClassicMcEliece6960119: OQS_KEM_alg_classic_mceliece_6960119: "Classic-McEliece-6960119",
+    ("classic_mceliece") ClassicMcEliece6960119f: OQS_KEM_alg_classic_mceliece_6960119f: "Classic-McEliece-6960119f",
+    ("classic_mceliece") ClassicMcEliece8192128: OQS_KEM_alg_classic_mceliece_8192128: "Classic-McEliece-8192128",
+    ("classic_mceliece") ClassicMcEliece8192128f: OQS_KEM_alg_classic_mceliece_8192128f: "Classic-McEliece-8192128f",
+    ("hqc") Hqc128: OQS_KEM_alg_hqc_128: "HQC-128",
+    ("hqc") Hqc192: OQS_KEM_alg_hqc_192: "HQC-192",
+    ("hqc") Hqc256: OQS_KEM_alg_hqc_256: "HQC-256",
+    ("kyber") Kyber512: OQS_KEM_alg_kyber_512: "Kyber512",
+    ("kyber") Kyber768: OQS_KEM_alg_kyber_768: "Kyber768",
+    ("kyber") Kyber1024: OQS_KEM_alg_kyber_1024: "Kyber1024",
+    ("ntruprime") NtruPrimeSntrup761: OQS_KEM_alg_ntruprime_sntrup761: "sntrup761",
+    ("frodokem") FrodoKem640Aes: OQS_KEM_alg_frodokem_640_aes: "FrodoKEM-640-AES",
+    ("frodokem") FrodoKem640Shake: OQS_KEM_alg_frodokem_640_shake: "FrodoKEM-640-SHAKE",
+    ("frodokem") FrodoKem976Aes: OQS_KEM_alg_frodokem_976_aes: "FrodoKEM-976-AES",
+    ("frodokem") FrodoKem976Shake: OQS_KEM_alg_frodokem_976_shake: "FrodoKEM-976-SHAKE",
+    ("frodokem") FrodoKem1344Aes: OQS_KEM_alg_frodokem_1344_aes: "FrodoKEM-1344-AES",
+    ("frodokem") FrodoKem1344Shake: OQS_KEM_alg_frodokem_1344_shake: "FrodoKEM-1344-SHAKE",
+    ("ml_kem") MlKem512: OQS_KEM_alg_ml_kem_512: "ML-KEM-512",
+    ("ml_kem") MlKem768: OQS_KEM_alg_ml_kem_768: "ML-KEM-768",
+    ("ml_kem") MlKem1024: OQS_KEM_alg_ml_kem_1024: "ML-KEM-1024",
 }
 
+// ("ml_kem") MlKem512Ipd: OQS_KEM_alg_ml_kem_512_ipd,
+// ("ml_kem") MlKem768Ipd: OQS_KEM_alg_ml_kem_768_ipd,
+// ("ml_kem") MlKem1024Ipd: OQS_KEM_alg_ml_kem_1024_ipd,
+
 impl Algorithm {
     /// Returns true if this algorithm is enabled in the linked version
     /// of liboqs
@@ -166,10 +199,9 @@ impl Algorithm {
     }
 }
 
-#[cfg(feature = "std")]
-impl std::fmt::Display for Algorithm {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        self.name().fmt(f)
+impl Display for Algorithm {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        Display::fmt(self.name(), f)
     }
 }
 
@@ -191,6 +223,47 @@ pub struct Kem {
     kem: NonNull<ffi::OQS_KEM>,
 }
 
+impl Debug for Kem {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Kem")
+            .field("algorithm", &self.algorithm)
+            .field(
+                "method_name",
+                &unsafe { CStr::from_ptr(self.kem.as_ref().method_name) }
+                    .to_str()
+                    .expect("method name"),
+            )
+            .field(
+                "alg_version",
+                &unsafe { CStr::from_ptr(self.kem.as_ref().alg_version) }
+                    .to_str()
+                    .expect("alg_version"),
+            )
+            .field(
+                "claimed_nist_level",
+                &unsafe { self.kem.as_ref() }.claimed_nist_level,
+            )
+            .field("ind_cca", &unsafe { self.kem.as_ref() }.ind_cca)
+            .field(
+                "length_public_key",
+                &unsafe { self.kem.as_ref() }.length_public_key,
+            )
+            .field(
+                "length_secret_key",
+                &unsafe { self.kem.as_ref() }.length_secret_key,
+            )
+            .field(
+                "length_ciphertext",
+                &unsafe { self.kem.as_ref() }.length_ciphertext,
+            )
+            .field(
+                "length_shared_secret",
+                &unsafe { self.kem.as_ref() }.length_shared_secret,
+            )
+            .finish()
+    }
+}
+
 unsafe impl Sync for Kem {}
 unsafe impl Send for Kem {}
 
@@ -200,8 +273,8 @@ impl Drop for Kem {
     }
 }
 
-impl core::convert::TryFrom<Algorithm> for Kem {
-    type Error = crate::Error;
+impl TryFrom<Algorithm> for Kem {
+    type Error = Error;
     fn try_from(alg: Algorithm) -> Result<Kem> {
         Kem::new(alg)
     }
@@ -314,7 +387,7 @@ impl Kem {
     /// Generate a new keypair
     pub fn keypair(&self) -> Result<(PublicKey, SecretKey)> {
         let kem = unsafe { self.kem.as_ref() };
-        let func = kem.keypair.unwrap();
+        let func = kem.keypair.expect("keypair function not available");
         let mut pk = PublicKey {
             bytes: Vec::with_capacity(kem.length_public_key),
         };
@@ -342,7 +415,7 @@ impl Kem {
             return Err(Error::InvalidLength);
         }
         let kem = unsafe { self.kem.as_ref() };
-        let func = kem.encaps.unwrap();
+        let func = kem.encaps.expect("encapsulate function not available");
         let mut ct = Ciphertext {
             bytes: Vec::with_capacity(kem.length_ciphertext),
         };
@@ -383,7 +456,7 @@ impl Kem {
         let mut ss = SharedSecret {
             bytes: Vec::with_capacity(kem.length_shared_secret),
         };
-        let func = kem.decaps.unwrap();
+        let func = kem.decaps.expect("decapsulate function not available");
         // Call decapsulate
         let status = unsafe { func(ss.bytes.as_mut_ptr(), ct.bytes.as_ptr(), sk.bytes.as_ptr()) };
         status_to_result(status)?;