Removed support for Falcon algorithms

Signed-off-by: David Dudas <david.dudas03@e-uvt.ro>

diff --git a/lib/algorithms.h b/lib/algorithms.h
index ee56714b990d4e10c0085385d9d516751b20f488..7bfe5670c8a83a7ea0b5c3d015069adec671f161 100644 (file)
--- a/lib/algorithms.h
+++ b/lib/algorithms.h
@@ -59,9 +59,6 @@
 #define IS_ML_DSA(x)                                                     \
        (((x) == GNUTLS_PK_ML_DSA_44) || ((x) == GNUTLS_PK_ML_DSA_65) || \
         ((x) == GNUTLS_PK_ML_DSA_87))
-
-#define IS_FALCON(x) \
-       (((x) == GNUTLS_PK_EXP_FALCON512) || ((x) == GNUTLS_PK_EXP_FALCON1024))
 #endif
 
 #define SIG_SEM_PRE_TLS12 (1 << 1)

diff --git a/lib/algorithms/publickey.c b/lib/algorithms/publickey.c
index 242cbfabbdae5ef7557ba9e453f92c7335b9f923..23af56ad535cf1c8b6c698d509d9966add7f297f 100644 (file)
--- a/lib/algorithms/publickey.c
+++ b/lib/algorithms/publickey.c
@@ -228,26 +228,6 @@ static const gnutls_pk_entry pk_algorithms[] = {
          .id = GNUTLS_PK_ML_DSA_87,
          .curve = GNUTLS_ECC_CURVE_INVALID,
          .no_prehashed = 1 },
-       { .name = "Falcon512",
-         .oid = FALCON512_OID,
-         .id = GNUTLS_PK_EXP_FALCON512,
-         .curve = GNUTLS_ECC_CURVE_INVALID,
-         .no_prehashed = 1 },
-       { .name = "Falcon1024",
-         .oid = FALCON1024_OID,
-         .id = GNUTLS_PK_EXP_FALCON1024,
-         .curve = GNUTLS_ECC_CURVE_INVALID,
-         .no_prehashed = 1 },
-       { .name = "Falcon512",
-         .oid = FALCON512_OID,
-         .id = GNUTLS_PK_EXP_FALCON512,
-         .curve = GNUTLS_ECC_CURVE_INVALID,
-         .no_prehashed = 1 },
-       { .name = "Falcon1024",
-         .oid = FALCON1024_OID,
-         .id = GNUTLS_PK_EXP_FALCON1024,
-         .curve = GNUTLS_ECC_CURVE_INVALID,
-         .no_prehashed = 1 },
 #endif
        { .name = "UNKNOWN",
          .oid = NULL,

diff --git a/lib/algorithms/secparams.c b/lib/algorithms/secparams.c
index 5308cdbf9badc1c9730e13912cd878372ca79d49..e0bfb8f278638e827f7af6ca04ca942c1bc48220 100644 (file)
--- a/lib/algorithms/secparams.c
+++ b/lib/algorithms/secparams.c
@@ -40,88 +40,93 @@ typedef struct {
        unsigned int ecc_bits; /* bits for ECC keys */
 #ifdef HAVE_LIBOQS
        unsigned int ml_dsa_bits;
-       unsigned int falcon_bits;
 #endif
 } gnutls_sec_params_entry;
 
 static const gnutls_sec_params_entry sec_params[] = {
        { "Insecure", GNUTLS_SEC_PARAM_INSECURE, 0, 0, 0, 0, 0,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
        { "Export", GNUTLS_SEC_PARAM_EXPORT, 42, 512, 0, 84, 0,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
        { "Very weak", GNUTLS_SEC_PARAM_VERY_WEAK, 64, 767, 0, 128, 0,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
        { "Weak", GNUTLS_SEC_PARAM_WEAK, 72, 1008, 1008, 160, 160,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
 #ifdef ENABLE_FIPS140
        { "Low", GNUTLS_SEC_PARAM_LOW, 80, 1024, 1024, 160, 160,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
-       { "Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1024, 1024, 192, 192,
+       {
+               "Legacy",
+               GNUTLS_SEC_PARAM_LEGACY,
+               96,
+               1024,
+               1024,
+               192,
+               192,
 #ifdef HAVE_LIBOQS
-         0, OQS_SIG_falcon_512_length_public_key
+               0,
 #endif
        },
        { "Medium", GNUTLS_SEC_PARAM_MEDIUM, 112, 2048, 2048, 224, 224,
 #ifdef HAVE_LIBOQS
-         OQS_SIG_ml_dsa_44_length_public_key, 0
+         OQS_SIG_ml_dsa_44_length_public_key
 #endif
        },
        { "High", GNUTLS_SEC_PARAM_HIGH, 128, 3072, 3072, 256, 256,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        },
 #else
        { "Low", GNUTLS_SEC_PARAM_LOW, 80, 1024, 1024, 160, 160,
 #ifdef HAVE_LIBOQS
-                0, 0
+                0
 #endif
        }, /* ENISA-LEGACY */
        { "Legacy", GNUTLS_SEC_PARAM_LEGACY, 96, 1776, 2048, 192, 192,
 #ifdef HAVE_LIBOQS
-                0, OQS_SIG_falcon_512_length_public_key
+                0
 #endif
         },
        { "Medium", GNUTLS_SEC_PARAM_MEDIUM, 112, 2048, 2048, 256, 224,
 #ifdef HAVE_LIBOQS
-                OQS_SIG_ml_dsa_44_length_public_key, 0
+                OQS_SIG_ml_dsa_44_length_public_key
 #endif
                 },
        { "High", GNUTLS_SEC_PARAM_HIGH, 128, 3072, 3072, 256, 256,
 #ifdef HAVE_LIBOQS
-                0, 0
+                0
 #endif
        },
 #endif
        { "Ultra", GNUTLS_SEC_PARAM_ULTRA, 192, 8192, 8192, 384, 384,
 #ifdef HAVE_LIBOQS
-         OQS_SIG_ml_dsa_65_length_public_key, 0
+         OQS_SIG_ml_dsa_65_length_public_key
 #endif
        },
        { "Future", GNUTLS_SEC_PARAM_FUTURE, 256, 15360, 15360, 512, 512,
 #ifdef HAVE_LIBOQS
-         OQS_SIG_ml_dsa_87_length_public_key,
-         OQS_SIG_falcon_1024_length_public_key
+         OQS_SIG_ml_dsa_87_length_public_key
 #endif
        },
        { NULL, 0, 0, 0, 0, 0, 0,
 #ifdef HAVE_LIBOQS
-         0, 0
+         0
 #endif
        }
 };
@@ -157,8 +162,6 @@ unsigned int gnutls_sec_param_to_pk_bits(gnutls_pk_algorithm_t algo,
 #ifdef HAVE_LIBOQS
                        else if (IS_ML_DSA(algo))
                                ret = p->ml_dsa_bits;
-                       else if (IS_FALCON(algo))
-                               ret = p->falcon_bits;
 #endif
                        else
                                ret = p->pk_bits;
@@ -296,12 +299,6 @@ gnutls_sec_param_t gnutls_pk_bits_to_sec_param(gnutls_pk_algorithm_t algo,
                                break;
                        ret = p->sec_param;
                }
-       } else if (IS_FALCON(algo)) {
-               for (p = sec_params; p->name; p++) {
-                       if (p->falcon_bits > bits)
-                               break;
-                       ret = p->sec_param;
-               }
 #endif
        } else {
                for (p = sec_params; p->name; p++) {

diff --git a/lib/algorithms/sign.c b/lib/algorithms/sign.c
index cc1f231d86cde36601fa4835eaa85dcf868c7c75..6bbfe7e8c7d1860480a4a885d1f2bc878219776d 100644 (file)
--- a/lib/algorithms/sign.c
+++ b/lib/algorithms/sign.c
@@ -421,18 +421,6 @@ static SYSTEM_CONFIG_OR_CONST gnutls_sign_entry_st sign_algorithms[] = {
          .pk = GNUTLS_PK_ML_DSA_87,
          .hash = GNUTLS_DIG_SHAKE_256,
          .aid = TLS_SIGN_AID_UNKNOWN },
-       { .name = "Falcon512",
-         .oid = FALCON512_OID,
-         .id = GNUTLS_SIGN_EXP_FALCON512,
-         .pk = GNUTLS_PK_EXP_FALCON512,
-         .hash = GNUTLS_DIG_SHAKE_256,
-         .aid = TLS_SIGN_AID_UNKNOWN },
-       { .name = "Falcon1024",
-         .oid = FALCON1024_OID,
-         .id = GNUTLS_SIGN_EXP_FALCON1024,
-         .pk = GNUTLS_PK_EXP_FALCON1024,
-         .hash = GNUTLS_DIG_SHAKE_256,
-         .aid = TLS_SIGN_AID_UNKNOWN },
 #endif
        { .name = 0,
          .oid = 0,

diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
index 39f791429c6f9dbf69a65beb630b796d10d77d80..d35269cd3d6f004065f6f3c75de8796c452d66b6 100644 (file)
--- a/lib/crypto-backend.h
+++ b/lib/crypto-backend.h
@@ -280,7 +280,6 @@ void gnutls_pk_params_init(gnutls_pk_params_st *p);
 #define GOST_PRIVATE_PARAMS 3
 #ifdef HAVE_LIBOQS
 #define ML_DSA_PRIVATE_PARAMS 4
-#define FALCON_PRIVATE_PARAMS 4
 #endif
 
 #if MAX_PRIV_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0

diff --git a/lib/gnutls.asn b/lib/gnutls.asn
index 8f618e4afa436c0ede55eb093c5c77afe4a173b4..b6dbc716fabf4b4d5283e528fba2b88d2916d183 100644 (file)
--- a/lib/gnutls.asn
+++ b/lib/gnutls.asn
@@ -195,11 +195,4 @@ MLDSAPrivateKey ::= SEQUENCE {
        privateKey               OCTET STRING,
        publicKey                [1] OCTET STRING OPTIONAL
 }
-
-FalconPrivateKey ::= SEQUENCE {
-       version                  INTEGER,
-       privateKeyAlgorithm      AlgorithmIdentifier,
-       privateKey               OCTET STRING,
-       publicKey                [1] OCTET STRING OPTIONAL
-}
 END

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 603e8273a2f6d9da7ff9381c6ed91233a93d8a5f..7b2fb039f072a4f4149dd70fddfc8df44016aec8 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -915,11 +915,8 @@ typedef enum {
        GNUTLS_PK_MAX = GNUTLS_PK_ML_DSA_87,
 
        /* Experimental algorithms */
-       GNUTLS_PK_EXP_MIN = 256,
-       GNUTLS_PK_EXP_KYBER768 = 257,
-       GNUTLS_PK_EXP_FALCON512 = 258,
-       GNUTLS_PK_EXP_FALCON1024 = 259,
-       GNUTLS_PK_EXP_MAX = GNUTLS_PK_EXP_FALCON1024
+       GNUTLS_PK_EXP_KYBER768 = 256,
+       GNUTLS_PK_EXP_MAX = GNUTLS_PK_EXP_KYBER768
 } gnutls_pk_algorithm_t;
 
 const char *gnutls_pk_algorithm_get_name(gnutls_pk_algorithm_t algorithm);
@@ -1044,12 +1041,7 @@ typedef enum {
        GNUTLS_SIGN_ML_DSA_44 = 47,
        GNUTLS_SIGN_ML_DSA_65 = 48,
        GNUTLS_SIGN_ML_DSA_87 = 49,
-       GNUTLS_SIGN_MAX = GNUTLS_SIGN_ML_DSA_87,
-
-       GNUTLS_SIGN_EXP_MIN = 256,
-       GNUTLS_SIGN_EXP_FALCON512 = 257,
-       GNUTLS_SIGN_EXP_FALCON1024 = 258,
-       GNUTLS_SIGN_EXP_MAX = GNUTLS_SIGN_EXP_FALCON1024,
+       GNUTLS_SIGN_MAX = GNUTLS_SIGN_ML_DSA_87
 } gnutls_sign_algorithm_t;
 
 /**

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 2e27e60bef71e8b90b09aa51d025a362dfbbf25e..95df836d464d20047e908c0ba94093ccf3e110dd 100644 (file)
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -705,10 +705,6 @@ static const char *pk_to_liboqs_algo(gnutls_pk_algorithm_t algo)
                return OQS_SIG_alg_ml_dsa_65;
        case GNUTLS_PK_ML_DSA_87:
                return OQS_SIG_alg_ml_dsa_87;
-       case GNUTLS_PK_EXP_FALCON512:
-               return OQS_SIG_alg_falcon_512;
-       case GNUTLS_PK_EXP_FALCON1024:
-               return OQS_SIG_alg_falcon_1024;
        default:
                gnutls_assert();
                return NULL;
@@ -1865,9 +1861,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
 #ifdef HAVE_LIBOQS
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
-       case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024: {
+       case GNUTLS_PK_ML_DSA_87: {
                OQS_SIG *sig;
                OQS_STATUS rc;
                size_t size;
@@ -2281,9 +2275,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
 #ifdef HAVE_LIBOQS
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
-       case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024: {
+       case GNUTLS_PK_ML_DSA_87: {
                OQS_SIG *sig;
                OQS_STATUS rc;
 
@@ -2481,12 +2473,19 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk)
                return 1;
 #ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLKEM768:
-       case GNUTLS_PK_EXP_KYBER768:
+       case GNUTLS_PK_EXP_KYBER768: {
+               const char *algo_name;
+
+               if (_gnutls_liboqs_ensure() < 0)
+                       return 0;
+
+               algo_name = pk_to_liboqs_algo(pk);
+               return algo_name != NULL &&
+                      GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)(algo_name);
+       }
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
-       case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024: {
+       case GNUTLS_PK_ML_DSA_87: {
                const char *algo_name;
 
                if (_gnutls_liboqs_ensure() < 0)
@@ -2494,7 +2493,7 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk)
 
                algo_name = pk_to_liboqs_algo(pk);
                return algo_name != NULL &&
-                      GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)(algo_name);
+                      GNUTLS_OQS_FUNC(OQS_SIG_alg_is_enabled)(algo_name);
        }
 #endif
        default:
@@ -2711,8 +2710,6 @@ static int wrap_nettle_pk_generate_params(gnutls_pk_algorithm_t algo,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                break;
        default:
                gnutls_assert();
@@ -3964,8 +3961,6 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                if (params->pkflags & GNUTLS_PK_FLAG_PROVABLE)
                        return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
 
@@ -4279,12 +4274,23 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo,
        }
 #ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLKEM768:
-       case GNUTLS_PK_EXP_KYBER768:
+       case GNUTLS_PK_EXP_KYBER768: {
+               const char *algo_name;
+
+               if (_gnutls_liboqs_ensure() < 0)
+                       return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM);
+
+               algo_name = pk_to_liboqs_algo(algo);
+               if (algo_name == NULL ||
+                   !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)(algo_name))
+                       return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM);
+
+               ret = 0;
+               break;
+       }
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
-       case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024: {
+       case GNUTLS_PK_ML_DSA_87: {
                const char *algo_name;
 
                if (_gnutls_liboqs_ensure() < 0)
@@ -4292,8 +4298,9 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo,
 
                algo_name = pk_to_liboqs_algo(algo);
                if (algo_name == NULL ||
-                   !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)(algo_name))
+                   !GNUTLS_OQS_FUNC(OQS_SIG_alg_is_enabled)(algo_name)) {
                        return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM);
+               }
 
                ret = 0;
                break;

diff --git a/lib/privkey.c b/lib/privkey.c
index 519044466f56ca232c8353fc3a1f2a20acb4efcc..262aaf18eeb5e9bf6f44f983d3d67f76aedcb29c 100644 (file)
--- a/lib/privkey.c
+++ b/lib/privkey.c
@@ -247,8 +247,6 @@ static int privkey_to_pubkey(gnutls_pk_algorithm_t pk,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
 #endif
                ret = _gnutls_set_datum(&pub->raw_pub, priv->raw_pub.data,
                                        priv->raw_pub.size);

diff --git a/lib/pubkey.c b/lib/pubkey.c
index 057b2b4ed5e22201f9c40cf313710edb1b7bb577..76baa849735124c371d2b7269bce7d8165c9b205 100644 (file)
--- a/lib/pubkey.c
+++ b/lib/pubkey.c
@@ -63,8 +63,6 @@ static const struct pq_algorithm_pubkey_bits_st pq_pubkey_bits[] = {
        { GNUTLS_PK_ML_DSA_44, OQS_SIG_ml_dsa_44_length_public_key },
        { GNUTLS_PK_ML_DSA_65, OQS_SIG_ml_dsa_65_length_public_key },
        { GNUTLS_PK_ML_DSA_87, OQS_SIG_ml_dsa_87_length_public_key },
-       { GNUTLS_PK_EXP_FALCON512, OQS_SIG_falcon_512_length_public_key },
-       { GNUTLS_PK_EXP_FALCON1024, OQS_SIG_falcon_1024_length_public_key },
 
        { GNUTLS_PK_UNKNOWN, 0 }
 };
@@ -106,8 +104,6 @@ unsigned pubkey_to_bits(const gnutls_pk_params_st *params)
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                return pq_pubkey_to_bits(params->algo);
 #endif
        default:
@@ -398,8 +394,6 @@ int gnutls_pubkey_get_preferred_hash_algorithm(gnutls_pubkey_t key,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                if (hash)
                        *hash = GNUTLS_DIG_SHAKE_256;
                ret = 0;
@@ -2707,8 +2701,6 @@ int pubkey_verify_data(const gnutls_sign_entry_st *se, const mac_entry_st *me,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
 #endif
                if (_gnutls_pk_verify(se->pk, data, signature, params,
                                      sign_params) != 0) {

diff --git a/lib/x509/common.h b/lib/x509/common.h
index 69329083dad67eb1f7f941500c18f9f884e9a5bf..3b748b10b71c35a00aeab393344f79906b1039e6 100644 (file)
--- a/lib/x509/common.h
+++ b/lib/x509/common.h
@@ -118,12 +118,9 @@
 #define GOST28147_89_CPD_OID "1.2.643.2.2.31.4"
 
 #ifdef HAVE_LIBOQS
-#define ML_DSA_44_OID "1.3.6.1.4.1.2.267.12.4.4"
-#define ML_DSA_65_OID "1.3.6.1.4.1.2.267.12.6.5"
-#define ML_DSA_87_OID "1.3.6.1.4.1.2.267.12.8.7"
-
-#define FALCON512_OID "1.3.9999.3.1"
-#define FALCON1024_OID "1.3.9999.3.4"
+#define ML_DSA_44_OID "2.16.840.1.101.3.4.3.17"
+#define ML_DSA_65_OID "2.16.840.1.101.3.4.3.18"
+#define ML_DSA_87_OID "2.16.840.1.101.3.4.3.19"
 #endif
 
 #define ASN1_NULL "\x05\x00"

diff --git a/lib/x509/key_decode.c b/lib/x509/key_decode.c
index 07c71a72616f93c4dd890bb35857cd5288d72f6b..b25ad471230dcfe566f626529cad879ebe153eb8 100644 (file)
--- a/lib/x509/key_decode.c
+++ b/lib/x509/key_decode.c
@@ -739,8 +739,6 @@ int _gnutls_x509_read_pubkey(gnutls_pk_algorithm_t algo, uint8_t *der,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                ret = _gnutls_set_datum(&params->raw_pub, der, dersize);
                break;
 #endif
@@ -845,8 +843,6 @@ int _gnutls_x509_check_pubkey_params(gnutls_pk_params_st *params)
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
 #endif
                return 0;
        default:

diff --git a/lib/x509/key_encode.c b/lib/x509/key_encode.c
index 1927c9ec1b8d9ccf3a43289ad66fe7efc4c06526..df445dea2842b81ffc9ea6c28d522cd75e9898f8 100644 (file)
--- a/lib/x509/key_encode.c
+++ b/lib/x509/key_encode.c
@@ -306,8 +306,6 @@ int _gnutls_x509_write_pubkey_params(const gnutls_pk_params_st *params,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
 #endif
                der->data = NULL;
                der->size = 0;
@@ -348,8 +346,6 @@ int _gnutls_x509_write_pubkey(const gnutls_pk_params_st *params,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                return _gnutls_x509_write_pqc_alg_pubkey(params, der);
 #endif
        default:
@@ -1236,10 +1232,6 @@ static uint8_t _gnutls_get_pqc_alg_version(gnutls_pk_params_st *params)
                return '\x06';
        case GNUTLS_PK_ML_DSA_87:
                return '\x08';
-       case GNUTLS_PK_EXP_FALCON512:
-               return '\x01';
-       case GNUTLS_PK_EXP_FALCON1024:
-               return '\x02';
        default:
                return '\x00';
        }
@@ -1276,43 +1268,6 @@ static int _gnutls_asn1_encode_ml_dsa(asn1_node *c2,
 
        return GNUTLS_E_SUCCESS;
 
-cleanup:
-       asn1_delete_structure2(c2, ASN1_DELETE_FLAG_ZEROIZE);
-
-       return ret;
-}
-
-static int _gnutls_asn1_encode_falcon(asn1_node *c2,
-                                     gnutls_pk_params_st *params)
-{
-       int ret;
-       const char *oid;
-
-       oid = gnutls_pk_get_oid(params->algo);
-       if (oid == NULL)
-               return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-
-       /* first make sure that no previously allocated data are leaked */
-       if (*c2 != NULL) {
-               asn1_delete_structure(c2);
-               *c2 = NULL;
-       }
-
-       if ((ret = asn1_create_element(_gnutls_get_gnutls_asn(),
-                                      "GNUTLS.FalconPrivateKey", c2)) !=
-           ASN1_SUCCESS) {
-               gnutls_assert();
-               ret = _gnutls_asn2err(ret);
-               goto cleanup;
-
-               ret = _gnutls_asn1_encode_pqc_alg(
-                       c2, params, oid, _gnutls_get_pqc_alg_version(params));
-               if (ret < 0)
-                       goto cleanup;
-
-               return GNUTLS_E_SUCCESS;
-       }
-
 cleanup:
        asn1_delete_structure2(c2, ASN1_DELETE_FLAG_ZEROIZE);
 
@@ -1347,9 +1302,6 @@ int _gnutls_asn1_encode_privkey(asn1_node *c2, gnutls_pk_params_st *params)
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
                return _gnutls_asn1_encode_ml_dsa(c2, params);
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
-               return _gnutls_asn1_encode_falcon(c2, params);
 #endif
        default:
                return GNUTLS_E_UNIMPLEMENTED_FEATURE;

diff --git a/lib/x509/mpi.c b/lib/x509/mpi.c
index d836f912c49b9f68ee1a0e60baaf70bc51985d4c..af457e0455f6393a115e06ea42134445a4616fa0 100644 (file)
--- a/lib/x509/mpi.c
+++ b/lib/x509/mpi.c
@@ -137,9 +137,7 @@ int _gnutls_get_asn_mpis(asn1_node asn, const char *root,
 #ifdef HAVE_LIBOQS
            && pk_algorithm != GNUTLS_PK_ML_DSA_44 &&
            pk_algorithm != GNUTLS_PK_ML_DSA_65 &&
-           pk_algorithm != GNUTLS_PK_ML_DSA_87 &&
-           pk_algorithm != GNUTLS_PK_EXP_FALCON512 &&
-           pk_algorithm != GNUTLS_PK_EXP_FALCON1024
+           pk_algorithm != GNUTLS_PK_ML_DSA_87
 #endif
        ) {
                /* RSA, EdDSA and PQ algorithms do not use parameters */

diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index 566aa558a1c486db2d94bb419493a29193ab26da..f0c920da29abd7303e20bdeb2c0b96934d174946 100644 (file)
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -427,67 +427,6 @@ int _gnutls_privkey_decode_ml_dsa_key(asn1_node *pkey_asn,
 
        return 0;
 
-error:
-       asn1_delete_structure2(pkey_asn, ASN1_DELETE_FLAG_ZEROIZE);
-       gnutls_pk_params_clear(&pkey->params);
-       gnutls_pk_params_release(&pkey->params);
-       return result;
-}
-
-static const struct pqc_algorithm_version_st falcon_versions[] = {
-       { '\x01', GNUTLS_PK_EXP_FALCON512, OQS_SIG_falcon_512_length_secret_key,
-         OQS_SIG_falcon_512_length_public_key },
-       { '\x02', GNUTLS_PK_EXP_FALCON1024,
-         OQS_SIG_falcon_1024_length_secret_key,
-         OQS_SIG_falcon_1024_length_public_key },
-
-       { '\x00', GNUTLS_PK_UNKNOWN, 0, 0 }
-};
-
-static int _gnutls_set_falcon_params(const uint8_t *version,
-                                    gnutls_x509_privkey_t pkey)
-{
-       const struct pqc_algorithm_version_st *v = falcon_versions;
-       while (v->algorithm != GNUTLS_PK_UNKNOWN && v->version != *version)
-               v++;
-
-       pkey->params.raw_priv.size = v->secret_key_length;
-       pkey->params.raw_pub.size = v->public_key_length;
-       pkey->params.params_nr = FALCON_PRIVATE_PARAMS;
-       pkey->params.algo = v->algorithm;
-
-       if (v->algorithm == GNUTLS_PK_UNKNOWN)
-               return GNUTLS_E_UNKNOWN_ALGORITHM;
-
-       return 0;
-}
-
-int _gnutls_privkey_decode_falcon_key(asn1_node *pkey_asn,
-                                     const gnutls_datum_t *raw_key,
-                                     gnutls_x509_privkey_t pkey)
-{
-       int result;
-       uint8_t version;
-
-       gnutls_pk_params_init(&pkey->params);
-
-       if ((result = asn1_create_element(_gnutls_get_gnutls_asn(),
-                                         "GNUTLS.FalconPrivateKey",
-                                         pkey_asn)) != ASN1_SUCCESS) {
-               gnutls_assert();
-               return _gnutls_asn2err(result);
-       }
-
-       result = _gnutls_decode_pqc_keys(pkey_asn, raw_key, pkey, &version);
-       if (result < 0)
-               goto error;
-
-       result = _gnutls_set_falcon_params(&version, pkey);
-       if (result < 0)
-               goto error;
-
-       return 0;
-
 error:
        asn1_delete_structure2(pkey_asn, ASN1_DELETE_FLAG_ZEROIZE);
        gnutls_pk_params_clear(&pkey->params);
@@ -582,7 +521,6 @@ error:
 #define PEM_KEY_ECC "EC PRIVATE KEY"
 #ifdef HAVE_LIBOQS
 #define PEM_KEY_ML_DSA "ML-DSA PRIVATE KEY"
-#define PEM_KEY_FALCON "FALCON PRIVATE KEY"
 #endif
 #define PEM_KEY_PKCS8 "PRIVATE KEY"
 
@@ -695,17 +633,6 @@ int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
                                                key->params.algo =
                                                        GNUTLS_PK_ML_DSA_44;
                                        }
-                               } else if (left > sizeof(PEM_KEY_FALCON) &&
-                                          memcmp(ptr, PEM_KEY_FALCON,
-                                                 sizeof(PEM_KEY_FALCON) - 1) ==
-                                                  0) {
-                                       result = _gnutls_fbase64_decode(
-                                               PEM_KEY_FALCON, begin_ptr, left,
-                                               &_data);
-                                       if (result >= 0) {
-                                               key->params.algo =
-                                                       GNUTLS_PK_EXP_FALCON512;
-                                       }
 #endif
                                }
 
@@ -771,14 +698,6 @@ int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
                result = _gnutls_privkey_decode_ml_dsa_key(&key->key, &_data,
                                                           key);
 
-               if (result < 0) {
-                       gnutls_assert();
-                       key->key = NULL;
-               }
-       } else if (key->params.algo == GNUTLS_PK_EXP_FALCON512) {
-               result = _gnutls_privkey_decode_falcon_key(&key->key, &_data,
-                                                          key);
-
                if (result < 0) {
                        gnutls_assert();
                        key->key = NULL;
@@ -963,13 +882,9 @@ int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
                                     memcmp(ptr, PEM_KEY_DSA,
                                            sizeof(PEM_KEY_DSA) - 1) == 0)
 #ifdef HAVE_LIBOQS
-                                   ||
-                                   (left > sizeof(PEM_KEY_ML_DSA) &&
-                                    memcmp(ptr, PEM_KEY_ML_DSA,
-                                           sizeof(PEM_KEY_ML_DSA) - 1) == 0) ||
-                                   (left > sizeof(PEM_KEY_FALCON) &&
-                                    memcmp(ptr, PEM_KEY_FALCON,
-                                           sizeof(PEM_KEY_FALCON) - 1) == 0)
+                                   || (left > sizeof(PEM_KEY_ML_DSA) &&
+                                       memcmp(ptr, PEM_KEY_ML_DSA,
+                                              sizeof(PEM_KEY_ML_DSA) - 1) == 0)
 #endif
                                ) {
                                        head_enc = 0;
@@ -1728,9 +1643,6 @@ static const char *set_msg(gnutls_x509_privkey_t key)
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
                return PEM_KEY_ML_DSA;
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
-               return PEM_KEY_FALCON;
 #endif
        default:
                return "UNKNOWN";

diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index fc49e9bf83c9ddf8693d533aee0ad4f164e05dd0..6eb75d444c5fea31feadde6eadd5af7c280bc556 100644 (file)
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -86,8 +86,6 @@ inline static int _encode_privkey(gnutls_x509_privkey_t pkey,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                ret = _gnutls_x509_encode_string(
                        ASN1_ETYPE_OCTET_STRING, pkey->params.raw_priv.data,
                        pkey->params.raw_priv.size + pkey->params.raw_pub.size,
@@ -1486,10 +1484,6 @@ static const struct pq_key_length_st pq_key_lengths[] = {
          OQS_SIG_ml_dsa_65_length_public_key },
        { GNUTLS_PK_ML_DSA_87, OQS_SIG_ml_dsa_87_length_secret_key,
          OQS_SIG_ml_dsa_87_length_public_key },
-       { GNUTLS_PK_EXP_FALCON512, OQS_SIG_falcon_512_length_secret_key,
-         OQS_SIG_falcon_512_length_public_key },
-       { GNUTLS_PK_EXP_FALCON1024, OQS_SIG_falcon_1024_length_secret_key,
-         OQS_SIG_falcon_1024_length_public_key },
 
        { GNUTLS_PK_UNKNOWN, 0, 0 }
 };
@@ -1648,8 +1642,6 @@ static int decode_private_key_info(const gnutls_datum_t *der,
        case GNUTLS_PK_ML_DSA_44:
        case GNUTLS_PK_ML_DSA_65:
        case GNUTLS_PK_ML_DSA_87:
-       case GNUTLS_PK_EXP_FALCON512:
-       case GNUTLS_PK_EXP_FALCON1024:
                result = _decode_pkcs8_pqc_alg_key(pkcs8_asn, pkey, oid);
                break;
 #endif

diff --git a/lib/x509/x509_int.h b/lib/x509/x509_int.h
index fbb3aefb5bfa07b30aa92ac2d348a40cf01ba977..b62d7e99c67d43fcad6368603c6d29a1a53617c8 100644 (file)
--- a/lib/x509/x509_int.h
+++ b/lib/x509/x509_int.h
@@ -249,10 +249,6 @@ int _gnutls_privkey_decode_ml_dsa_key(asn1_node *pkey_asn,
                                      const gnutls_datum_t *raw_key,
                                      gnutls_x509_privkey_t pkey);
 
-int _gnutls_privkey_decode_falcon_key(asn1_node *pkey_asn,
-                                     const gnutls_datum_t *raw_key,
-                                     gnutls_x509_privkey_t pkey);
-
 #endif
 
 int _gnutls_privkey_decode_eddsa_key(asn1_node *pkey_asn,