fafbf296b1
Implement the X25519MLKEM768 hybrid key exchange group per draft-ietf-tls-ecdhe-mlkem-00, combining ML-KEM-768 (FIPS 203) with X25519 for post-quantum/classical hybrid key agreement. - New mlkem feature gating X25519MLKEM768 via boring's mlkem module - fips feature now implies mlkem so PQ is always available in FIPS mode - X25519MLKEM768 is the preferred (first) group in both FIPS and non-FIPS configurations when mlkem is enabled - Uses boring::mlkem for ML-KEM-768 and direct X25519 FFI for the classical component (no SPKI overhead) - Overrides start_and_complete() for server-side KEM encapsulation - Wire format: ML-KEM component first in all encodings (client share 1216 bytes, server share 1120 bytes, shared secret 64 bytes) - TLS 1.3 only (usable_for_version rejects TLS 1.2) - Unit tests: hybrid round-trip, invalid share rejection, version and FIPS flag checks - E2E tests: self-to-self PQ TLS handshake, FIPS group assertions - Cloudflare interop tests (ignored): verify kex=X25519MLKEM768 via /cdn-cgi/trace for TLS 1.3, verify classical fallback for TLS 1.2 - Update README with PQ section, feature docs, and FIPS KX updates
114 lines
2.9 KiB
YAML
114 lines
2.9 KiB
YAML
name: Rust check
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -Dwarnings
|
|
|
|
jobs:
|
|
fmt:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Check fmt
|
|
run: make fmt
|
|
|
|
test-default:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Lint (default features)
|
|
run: make lint FEATURES=""
|
|
- name: Test (default features)
|
|
run: make test FEATURES=""
|
|
- name: Build (default features)
|
|
run: make build FEATURES=""
|
|
|
|
test-tls12:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Lint (tls12)
|
|
run: make lint FEATURES="tls12"
|
|
- name: Test (tls12)
|
|
run: make test FEATURES="tls12"
|
|
- name: Build (tls12)
|
|
run: make build FEATURES="tls12"
|
|
|
|
test-logging-tls12:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Lint (logging,tls12)
|
|
run: make lint FEATURES="logging,tls12"
|
|
- name: Test (logging,tls12)
|
|
run: make test FEATURES="logging,tls12"
|
|
- name: Build (logging,tls12)
|
|
run: make build FEATURES="logging,tls12"
|
|
|
|
test-mlkem:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Lint (mlkem)
|
|
run: make lint FEATURES="mlkem"
|
|
- name: Test (mlkem)
|
|
run: make test FEATURES="mlkem"
|
|
- name: Build (mlkem)
|
|
run: make build FEATURES="mlkem"
|
|
|
|
test-mlkem-tls12:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Lint (mlkem,tls12)
|
|
run: make lint FEATURES="mlkem,tls12"
|
|
- name: Test (mlkem,tls12)
|
|
run: make test FEATURES="mlkem,tls12"
|
|
- name: Build (mlkem,tls12)
|
|
run: make build FEATURES="mlkem,tls12"
|
|
|
|
test-fips:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Test (fips)
|
|
run: cargo test -p boring-rustls-provider --all-targets --features fips
|
|
|
|
check-fips:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: sudo apt-get install -y cmake clang
|
|
- name: Check (fips)
|
|
run: cargo check -p boring-rustls-provider --all-targets --features fips
|
|
- name: Check (fips-precompiled)
|
|
run: cargo check -p boring-rustls-provider --all-targets --features fips-precompiled
|