Add TPM 2.0 v1.85 PQC (ML-DSA and ML-KEM) Support #445
Conversation
| AM_CFLAGS="$AM_CFLAGS -DWOLFTPM_PROVISIONING" | ||
| fi | ||
|
|
||
| AC_ARG_ENABLE([v185], |
There was a problem hiding this comment.
I assume that turning on v185 is a superset of earlier versions. Meaning once turned on, we can still execute on older TPMs without re-compile.
There was a problem hiding this comment.
Hi Todd, yes we are still able to execute old commands with this on. Should we perhaps name this just --enable-pq or add a secondary option?
There was a problem hiding this comment.
What you have is fine. Just wanted clarification. Any luck testing on simulator yet?
There was a problem hiding this comment.
We do not have a way to test yet, but we should have some hardware soon.
| TPM_CC_PolicyAuthorizeNV = 0x00000192, | ||
| TPM_CC_EncryptDecrypt2 = 0x00000193, | ||
| TPM_CC_LAST = TPM_CC_EncryptDecrypt2, | ||
| TPM_CC_SignSequenceStart = 0x00000194, |
There was a problem hiding this comment.
These don't match the v1.85 spec in review.
TPM_CC_SignSequenceStart 0x000001AA same with the ones below
There was a problem hiding this comment.
Thank you for catching that I will fix it
3 participants
Description
This PR adds initial support for TPM 2.0 Library Specification v1.85 PQC APIs to wolfTPM.
It implements new ML-DSA (Dilithium) and ML-KEM (Kyber) commands that were not present in the v1.84 RFC.
New TPM v1.85 Features Added
ML-DSA (Dilithium) – Signature & Verification
TPM2_SignSequenceStartTPM2_VerifySequenceStartTPM2_SignSequenceCompleteTPM2_VerifySequenceCompleteTPM2_SignDigestTPM2_VerifyDigestSignatureThese commands add context-based and sequence-based signing/verification required for PQ signature schemes.
ML-KEM (Kyber) – Key Encapsulation
TPM2_Encapsulate(public-key operation)TPM2_Decapsulate(private-key operation)Supports generation and recovery of shared secrets via PQ KEM.
New Types, Enums, and Structures
New
TPM_CC_*command codes for all v1.85 PQ commandsNew structure tags:
TPM_ST_MESSAGE_VERIFIEDTPM_ST_DIGEST_VERIFIEDNew TPM2B types:
TPM2B_SIGNATURE_CTXTPM2B_KEM_CIPHERTEXTTPM2B_SHARED_SECRETNew input/output command structures added to
tpm2.hTesting
unit.c unit testing
test_wolfTPM2_MLDSA_*test_wolfTPM2_MLKEM_*TODO: