Hello SunnySunday and matemagico13,

my name is Anthony and I am a member of the wolfSSL team.

I built wolfSSL with the following configure line:

./configure --enable-dtls --enable-dtls13 --enable-mlkem --enable-dtls-frag-ch

Then I ran the example server and client as shown and got the output as shown:

 $ ./examples/server/server -u -v 4 --pqc ML_KEM_1024
Using Post-Quantum KEM: ML_KEM_1024
SSL version is DTLSv1.3
SSL cipher suite is TLS_AES_256_GCM_SHA384
SSL curve name is ML_KEM_1024
Client message: hello wolfssl

 $ ./examples/client/client -u -v 4
SSL version is DTLSv1.3
SSL cipher suite is TLS_AES_256_GCM_SHA384
SSL curve name is ML_KEM_1024
I hear you fa shizzle!

Note that the use of ML-KEM is clearly shown.  I made no modifications to the code. Please let me know if you have further questions.

Warm regards, Anthony .

These should be sufficient:

#define WOLFSSL_HAVE_MLKEM
#define WOLFSSL_WC_MLKEM
#define WOLFSSL_SHAKE128
#define WOLFSSL_SHAKE256

Hi Sunnysunday,
Did you mean ML-KEM?

You can use

WOLFSSL_API int wolfSSL_UseKeyShare(WOLFSSL* ssl, word16 group);

The following values for group are good:

WOLFSSL_ML_KEM_512
WOLFSSL_ML_KEM_768
WOLFSSL_ML_KEM_1024
WOLFSSL_SECP256R1MLKEM768
WOLFSSL_X25519MLKEM768
WOLFSSL_SECP384R1MLKEM1024
WOLFSSL_SECP256R1MLKEM512
WOLFSSL_SECP384R1MLKEM768
WOLFSSL_SECP521R1MLKEM1024
WOLFSSL_X25519MLKEM512
WOLFSSL_X448MLKEM768

Warm regards, Anthony

if "native", then gcc would be sufficient. Just about any C89 compliant compiler would be sufficient.

Can you let us know what build tools or toolchain you have available?

Bryce, 

in future, please direct questions to support@wolfssl.com .

Warm regards, Anthony

Excellent. I'm glad to see you made progress and found your own solution.  May I ask you about your project?  Is this out of person, professional or academic interest?

Warm regards, Anthony

Hi,

To be a bit more specific, make sure you have the following macros defined:

WOLFSSL_CUSTOM_CURVES
HAVE_ECC_BRAINPOOL

Warm regards, Anthony

Hello,
My name is Anthony and I am a member of the wolfSSL team.
The page you reference points to a place where you can download the certificate bundle. 

If you get them and put them in a directory, you can then use wolfSSL_CTX_load_verify_locations() to specify that directory location and it will have those.  If your system has a way to automatically update the certificates you can tell wolfSSL to check that location with the same API.

Warm regards, Anthony

HI DJ3434,

My name is Anthony and I am a member of the wolfSSL team.

This is an interesting result you are seeing. Its very odd and I've never seen such a report.  Do you have a simple example application that shows this behaviour?

Warm regards, Anthony

Hi Bryce,

my name is Anthony and I am a member of the wolfSSL team.  We talk about wolfCrypt's MISRA compliance in various blog posts.  For example here: https://www.wolfssl.com/wolfssl-conform … uidelines/ .

Generally speaking we'll need to understand your use case so we can specifically target what you need.  The best idea would be to send a message to support@wolfssl.com so we can get started on that confidential and private conversation.

Warm regards, Anthony

Hi Scott,

That happened in the following pull request: https://github.com/wolfSSL/wolfssl/pull/7923 and that made it into wolfSSL Release 5.7.4 (Oct 24, 2024).  Note that the previous value was 1024 which would allow RSA-512 keys.  Now that it is set to 2048 is will no longer allow RSA-512 but will allow RSA-1024.  I understand if this is somewhat confusing.  Sorry about that.

This affects, both keys that are generated and loaded.  Note that you can override this default by defining RSA_MIN_SIZE yourself.

If you have further questions, please do send to support@wolfssl.com as I can see you are a commercial customer of wolfSSL.

Warm regards, Anthony