Add a reasonable ML-KEM API for public use.

Adapt the tests to use this API.

This does not yet make the symbols public in Symbols.list
which will happen shortly with a bump.

This includes some partial rototilling of the non-public
interfaces which will be shortly continued when the internal
code is deduplicated to not have multiple copies for ML-KEM
768 and ML-KEM 1024 (which is just an artifact of unravelling
the boring C++ code).

ok jsing@, tb@

1 files changed, 174 insertions, 128 deletions

diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c b/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
index adb1c47d8e..417d40555f 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_unittest.c,v 1.11 2025/05/21 03:46:20 tb Exp $ */
+/*      $OpenBSD: mlkem_unittest.c,v 1.12 2025/08/14 15:48:48 beck Exp $ */
 /*
  * Copyright (c) 2024 Google Inc.
  * Copyright (c) 2024 Bob Beck <beck@obtuse.com>
@@ -27,95 +27,161 @@
 
 #include "mlkem_tests_util.h"
 
-struct unittest_ctx {
-        void *priv;
-        void *pub;
-        void *priv2;
-        void *pub2;
-        uint8_t *encoded_public_key;
-        size_t encoded_public_key_len;
-        uint8_t *ciphertext;
-        size_t ciphertext_len;
-        mlkem_decap_fn decap;
-        mlkem_encap_fn encap;
-        mlkem_generate_key_fn generate_key;
-        mlkem_parse_private_key_fn parse_private_key;
-        mlkem_parse_public_key_fn parse_public_key;
-        mlkem_marshal_private_key_fn marshal_private_key;
-        mlkem_marshal_public_key_fn marshal_public_key;
-        mlkem_public_from_private_fn public_from_private;
-};
-
 static int
-MlKemUnitTest(struct unittest_ctx *ctx)
+MlKemUnitTest(int rank)
 {
-        uint8_t shared_secret1[MLKEM_SHARED_SECRET_BYTES];
-        uint8_t shared_secret2[MLKEM_SHARED_SECRET_BYTES];
+        MLKEM_private_key *priv = NULL, *priv2 = NULL, *priv3 = NULL;
+        MLKEM_public_key *pub = NULL, *pub2 = NULL, *pub3 = NULL;
+        uint8_t *encoded_public_key = NULL, *ciphertext = NULL,
+            *shared_secret2 = NULL, *shared_secret1 = NULL,
+            *encoded_private_key = NULL, *tmp_buf = NULL, *seed_buf = NULL;
+        size_t encoded_public_key_len, ciphertext_len,
+            encoded_private_key_len, tmp_buf_len;
         uint8_t first_two_bytes[2];
-        uint8_t *encoded_private_key = NULL, *tmp_buf = NULL;
-        size_t encoded_private_key_len, tmp_buf_len;
+        size_t s_len = 0;
         int failed = 0;
 
-        if (!ctx->generate_key(ctx->encoded_public_key, NULL, ctx->priv)) {
+        if ((pub = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+
+        if ((pub2 = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+
+        if ((priv = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if ((priv2 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if (!MLKEM_generate_key(priv, &encoded_public_key,
+            &encoded_public_key_len, &seed_buf, &s_len)) {
                 warnx("generate_key failed");
                 failed |= 1;
         }
 
-        memcpy(first_two_bytes, ctx->encoded_public_key, sizeof(first_two_bytes));
-        memset(ctx->encoded_public_key, 0xff, sizeof(first_two_bytes));
+        if (s_len != MLKEM_SEED_LENGTH) {
+                warnx("seed length %zu != %d", s_len, MLKEM_SEED_LENGTH);
+                failed |= 1;
+        }
+
+        if ((priv3 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if ((pub3 = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+
+        if (!MLKEM_private_key_from_seed(priv3, seed_buf, s_len)) {
+                warnx("private_key_from_seed failed");
+                failed |= 1;
+        }
+
+        free(seed_buf);
+        seed_buf = NULL;
+
+        if (!MLKEM_public_from_private(priv3, pub3)) {
+                warnx("public_from_private");
+                failed |= 1;
+        }
+
+        memcpy(first_two_bytes, encoded_public_key, sizeof(first_two_bytes));
+        memset(encoded_public_key, 0xff, sizeof(first_two_bytes));
 
         /* Parsing should fail because the first coefficient is >= kPrime. */
-        if (ctx->parse_public_key(ctx->pub, ctx->encoded_public_key,
-            ctx->encoded_public_key_len)) {
+        if (MLKEM_parse_public_key(pub, encoded_public_key,
+            encoded_public_key_len)) {
                 warnx("parse_public_key should have failed");
                 failed |= 1;
         }
 
-        memcpy(ctx->encoded_public_key, first_two_bytes, sizeof(first_two_bytes));
-        if (!ctx->parse_public_key(ctx->pub, ctx->encoded_public_key,
-            ctx->encoded_public_key_len)) {
-                warnx("MLKEM768_parse_public_key");
+        memcpy(encoded_public_key, first_two_bytes, sizeof(first_two_bytes));
+
+        MLKEM_public_key_free(pub);
+        if ((pub = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+        if (!MLKEM_parse_public_key(pub, encoded_public_key,
+            encoded_public_key_len)) {
+                warnx("MLKEM_parse_public_key");
+                failed |= 1;
+        }
+
+        if (!MLKEM_marshal_public_key(pub, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_public_key");
+                failed |= 1;
+        }
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d != %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
+                failed |= 1;
+        }
+
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
+            "encoded public keys") != 0) {
+                warnx("compare_data");
                 failed |= 1;
         }
+        free(tmp_buf);
+        tmp_buf = NULL;
+        tmp_buf_len = 0;
 
-        if (!ctx->marshal_public_key(ctx->pub, &tmp_buf, &tmp_buf_len)) {
+        if (!MLKEM_marshal_public_key(pub3, &tmp_buf, &tmp_buf_len)) {
                 warnx("marshal_public_key");
                 failed |= 1;
         }
-        if (ctx->encoded_public_key_len != tmp_buf_len) {
-                warnx("encoded public key lengths differ");
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d != %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
                 failed |= 1;
         }
 
-        if (compare_data(ctx->encoded_public_key, tmp_buf, tmp_buf_len,
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
             "encoded public keys") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
         free(tmp_buf);
         tmp_buf = NULL;
+        tmp_buf_len = 0;
 
-        ctx->public_from_private(ctx->pub2, ctx->priv);
-        if (!ctx->marshal_public_key(ctx->pub2, &tmp_buf, &tmp_buf_len)) {
+        if (!MLKEM_public_from_private(priv, pub2)) {
+                warnx("public_from_private");
+                failed |= 1;
+        }
+        if (!MLKEM_marshal_public_key(pub2, &tmp_buf, &tmp_buf_len)) {
                 warnx("marshal_public_key");
                 failed |= 1;
         }
-        if (ctx->encoded_public_key_len != tmp_buf_len) {
-                warnx("encoded public key lengths differ");
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
                 failed |= 1;
         }
 
-        if (compare_data(ctx->encoded_public_key, tmp_buf, tmp_buf_len,
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
             "encoded public keys") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
         free(tmp_buf);
         tmp_buf = NULL;
+        tmp_buf_len = 0;
 
-        if (!ctx->marshal_private_key(ctx->priv, &encoded_private_key,
+        if (!MLKEM_marshal_private_key(priv, &encoded_private_key,
             &encoded_private_key_len)) {
-                warnx("mlkem768_encode_private_key");
+                warnx("marshal_private_key");
                 failed |= 1;
         }
 
@@ -123,27 +189,34 @@ MlKemUnitTest(struct unittest_ctx *ctx)
         memset(encoded_private_key, 0xff, sizeof(first_two_bytes));
 
         /*  Parsing should fail because the first coefficient is >= kPrime. */
-        if (ctx->parse_private_key(ctx->priv2, encoded_private_key,
+        if (MLKEM_parse_private_key(priv2, encoded_private_key,
             encoded_private_key_len)) {
-                warnx("MLKEM768_parse_private_key should have failed");
+                warnx("parse_private_key should have failed");
                 failed |= 1;
         }
 
         memcpy(encoded_private_key, first_two_bytes, sizeof(first_two_bytes));
 
-        if (!ctx->parse_private_key(ctx->priv2, encoded_private_key,
+        MLKEM_private_key_free(priv2);
+        priv2 = NULL;
+
+        if ((priv2 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+        if (!MLKEM_parse_private_key(priv2, encoded_private_key,
             encoded_private_key_len)) {
-                warnx("MLKEM768_parse_private_key");
+                warnx("parse_private_key");
                 failed |= 1;
         }
 
-        if (!ctx->marshal_private_key(ctx->priv2, &tmp_buf, &tmp_buf_len)) {
-                warnx("encode_private_key");
+        if (!MLKEM_marshal_private_key(priv2, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_private_key");
                 failed |= 1;
         }
 
         if (encoded_private_key_len != tmp_buf_len) {
-                warnx("encode private key lengths differ");
+                warnx("encoded private key lengths differ");
                 failed |= 1;
         }
 
@@ -156,106 +229,79 @@ MlKemUnitTest(struct unittest_ctx *ctx)
         free(tmp_buf);
         tmp_buf = NULL;
 
-        ctx->encap(ctx->ciphertext, shared_secret1, ctx->pub);
-        if (!ctx->decap(shared_secret2, ctx->ciphertext, ctx->ciphertext_len,
-            ctx->priv)) {
+        if (!MLKEM_encap(pub, &ciphertext, &ciphertext_len, &shared_secret1,
+            &s_len)) {
+                warnx("encap failed using pub");
+                failed |= 1;
+        }
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (!MLKEM_decap(priv, ciphertext, ciphertext_len,
+            &shared_secret2, &s_len)) {
                 warnx("decap() failed using priv");
                 failed |= 1;
         }
-        if (compare_data(shared_secret1, shared_secret2, MLKEM_SHARED_SECRET_BYTES,
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (compare_data(shared_secret1, shared_secret2, s_len,
             "shared secrets with priv") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
 
-        if (!ctx->decap(shared_secret2, ctx->ciphertext, ctx->ciphertext_len,
-            ctx->priv2)) {
+        free(shared_secret2);
+        shared_secret2 = NULL;
+
+        if (!MLKEM_decap(priv2, ciphertext, ciphertext_len,
+            &shared_secret2, &s_len)){
                 warnx("decap() failed using priv2");
                 failed |= 1;
         }
-        if (compare_data(shared_secret1, shared_secret2, MLKEM_SHARED_SECRET_BYTES,
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (compare_data(shared_secret1, shared_secret2, s_len,
             "shared secrets with priv2") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
 
+        MLKEM_public_key_free(pub);
+        MLKEM_public_key_free(pub2);
+        MLKEM_public_key_free(pub3);
+        MLKEM_private_key_free(priv);
+        MLKEM_private_key_free(priv2);
+        MLKEM_private_key_free(priv3);
+        free(encoded_public_key);
+        free(ciphertext);
         free(encoded_private_key);
+        free(shared_secret1);
+        free(shared_secret2);
 
         return failed;
 }
 
-static int
-mlkem768_unittest(void)
-{
-        struct MLKEM768_private_key mlkem768_priv, mlkem768_priv2;
-        struct MLKEM768_public_key mlkem768_pub, mlkem768_pub2;
-        uint8_t mlkem768_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES];
-        uint8_t mlkem768_ciphertext[MLKEM768_CIPHERTEXT_BYTES];
-        struct unittest_ctx mlkem768_test = {
-                .priv = &mlkem768_priv,
-                .pub = &mlkem768_pub,
-                .priv2 = &mlkem768_priv2,
-                .pub2 = &mlkem768_pub2,
-                .encoded_public_key = mlkem768_encoded_public_key,
-                .encoded_public_key_len = sizeof(mlkem768_encoded_public_key),
-                .ciphertext = mlkem768_ciphertext,
-                .ciphertext_len = sizeof(mlkem768_ciphertext),
-                .decap = mlkem768_decap,
-                .encap = mlkem768_encap,
-                .generate_key = mlkem768_generate_key,
-                .parse_private_key = mlkem768_parse_private_key,
-                .parse_public_key = mlkem768_parse_public_key,
-                .marshal_private_key = mlkem768_marshal_private_key,
-                .marshal_public_key = mlkem768_marshal_public_key,
-                .public_from_private = mlkem768_public_from_private,
-        };
-
-        return MlKemUnitTest(&mlkem768_test);
-}
-
-static int
-mlkem1024_unittest(void)
-{
-        struct MLKEM1024_private_key mlkem1024_priv, mlkem1024_priv2;
-        struct MLKEM1024_public_key mlkem1024_pub, mlkem1024_pub2;
-        uint8_t mlkem1024_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES];
-        uint8_t mlkem1024_ciphertext[MLKEM1024_CIPHERTEXT_BYTES];
-        struct unittest_ctx mlkem1024_test = {
-                .priv = &mlkem1024_priv,
-                .pub = &mlkem1024_pub,
-                .priv2 = &mlkem1024_priv2,
-                .pub2 = &mlkem1024_pub2,
-                .encoded_public_key = mlkem1024_encoded_public_key,
-                .encoded_public_key_len = sizeof(mlkem1024_encoded_public_key),
-                .ciphertext = mlkem1024_ciphertext,
-                .ciphertext_len = sizeof(mlkem1024_ciphertext),
-                .decap = mlkem1024_decap,
-                .encap = mlkem1024_encap,
-                .generate_key = mlkem1024_generate_key,
-                .parse_private_key = mlkem1024_parse_private_key,
-                .parse_public_key = mlkem1024_parse_public_key,
-                .marshal_private_key = mlkem1024_marshal_private_key,
-                .marshal_public_key = mlkem1024_marshal_public_key,
-                .public_from_private = mlkem1024_public_from_private,
-        };
-
-        return MlKemUnitTest(&mlkem1024_test);
-}
-
 int
 main(void)
 {
-        int failed = 0;
+        int ret = 0;
 
-        /*
-         * XXX - this is split into two helper functions since having a few
-         * ML-KEM key blobs on the stack makes Emscripten's stack explode,
-         * leading to inscrutable silent failures unless ASAN is enabled.
-         * Go figure.
-         */
+        ret |= MlKemUnitTest(RANK768);
+        ret |= MlKemUnitTest(RANK1024);
 
-        failed |= mlkem768_unittest();
-        failed |= mlkem1024_unittest();
-
-        return failed;
+        return ret;
 }