Phase 2: PQ in boundary and SHA512 DRBG#9843
Open
kaleb-himes wants to merge 1 commit intowolfSSL:masterfrom
Open
Phase 2: PQ in boundary and SHA512 DRBG#9843kaleb-himes wants to merge 1 commit intowolfSSL:masterfrom
kaleb-himes wants to merge 1 commit intowolfSSL:masterfrom
Conversation
kaleb-himes
force-pushed
the
PQ-FS-2026-Part2
branch
from
82c3c5c to
f8d12a1
Compare
kaleb-himes
commented
Mar 1, 2026
Contributor
Author
There was a problem hiding this comment.
** NON-FIPS **
./wolfcrypt/benchmark/benchmark -rng -rng-sha512 -rng-init -rng-sha512-init
------------------------------------------------------------------------------
wolfSSL version 5.8.4
------------------------------------------------------------------------------
Math: Multi-Precision: Wolf(SP) word-size=64 bits=4096 sp_int.c
wolfCrypt Benchmark (block bytes 1048576, min 1.0 sec each)
RNG SHA-256 DRBG 205 MiB took 1.021 seconds, 200.853 MiB/s Cycles per byte = 17.50
RNG SHA-512 DRBG 380 MiB took 1.013 seconds, 375.166 MiB/s Cycles per byte = 9.37
RNG 256 SHA256 Init/Free 146504 ops took 1.000 sec, avg 0.007 ms, 146503.616 ops/sec, 3686366718 cycles 25162.2 Cycles/op
RNG 512 SHA512 Init/Free 204287 ops took 1.000 sec, avg 0.005 ms, 204285.977 ops/sec, 3686374128 cycles 18045.1 Cycles/op
Benchmark complete
** FIPS **
./wolfcrypt/benchmark/benchmark -rng -rng-sha512 -rng-init -rng-sha512-init
------------------------------------------------------------------------------
wolfSSL version 5.8.4
------------------------------------------------------------------------------
wolfCrypt Benchmark (block bytes 1048576, min 1.0 sec each)
RNG SHA-256 DRBG 205 MiB took 1.021 seconds, 200.763 MiB/s Cycles per byte = 17.51
RNG SHA-512 DRBG 375 MiB took 1.010 seconds, 371.333 MiB/s Cycles per byte = 9.47
RNG 256 SHA256 Init/Free 123726 ops took 1.000 sec, avg 0.008 ms, 123725.735 ops/sec, 3686363516 cycles 29794.6 Cycles/op
RNG 512 SHA512 Init/Free 172608 ops took 1.000 sec, avg 0.006 ms, 172607.506 ops/sec, 3686365894 cycles 21356.9 Cycles/op
Benchmark complete
Add rules to preserve module boundary in include.am Add HAVE_SELFTEST and rng_bank SHA512 awareness Fixed ML_KEM, SMALL_STACK tests, and avoidable internal SHA256-use for NSA 2.0 Fix windows ready and multi-test items Fix the --disable-rng build Fix RDSEED build failure Multi-test report fixes Updates after performance review Used asym_finish reporting for RNG's but we lose access when PSK only Continued updates to new benchmarks SHA512-DRBG default ENTROPY_SCALE_FACTOR on par with SHA256-DRBG
kaleb-himes
force-pushed
the
PQ-FS-2026-Part2
branch
from
af84f0f to
6f2187b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Phase 2 of the upcoming Post Quantum Full FIPS Submission. ML-KEM, ML-DSA, LMS (Verify), XMSS (Verify) added to module boundary along with a shiny new SHA512-DRBG implementation and NIST vector tests for sanity.
TODO: Once SLH-DSA is merged pull it into module boundary also and update this PR.
Testing
Many in-house FIPS custom scripts, optest app and harness.
Checklist