Skip to content

Add WOLFCOSE_LEAN config layer with WOLFCOSE_HAVE_* feature gates #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidangarske wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add WOLFCOSE_LEAN config layer with WOLFCOSE_HAVE_* feature gates #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
280a025
Add WOLFCOSE_LEAN config layer and gate sources/tests/examples on WOL…
aidangarske Jun 3, 2026
1000ac9
Document WOLFCOSE_LEAN config layer and WOLFCOSE_ENABLE_* extensions …
aidangarske Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions .github/workflows/misra-2023.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,16 +100,6 @@ jobs:
-DWOLFSSL_SHA384 -DWOLFSSL_SHA512 \
-DHAVE_AES_KEYWRAP -DWOLFSSL_AES_DIRECT \
-DHAVE_HKDF -DHAVE_AES_CBC \
-DWOLFCOSE_SIGN1 -DWOLFCOSE_SIGN1_SIGN -DWOLFCOSE_SIGN1_VERIFY \
-DWOLFCOSE_ENCRYPT0 -DWOLFCOSE_ENCRYPT0_ENCRYPT -DWOLFCOSE_ENCRYPT0_DECRYPT \
-DWOLFCOSE_MAC0 -DWOLFCOSE_MAC0_CREATE -DWOLFCOSE_MAC0_VERIFY \
-DWOLFCOSE_SIGN -DWOLFCOSE_SIGN_SIGN -DWOLFCOSE_SIGN_VERIFY \
-DWOLFCOSE_ENCRYPT -DWOLFCOSE_ENCRYPT_ENCRYPT -DWOLFCOSE_ENCRYPT_DECRYPT \
-DWOLFCOSE_MAC -DWOLFCOSE_MAC_CREATE -DWOLFCOSE_MAC_VERIFY \
-DWOLFCOSE_RECIPIENTS -DWOLFCOSE_KEY_WRAP \
-DWOLFCOSE_ECDH -DWOLFCOSE_ECDH_WRAP \
-DWOLFCOSE_CBOR_ENCODE -DWOLFCOSE_CBOR_DECODE \
-DWOLFCOSE_KEY_ENCODE -DWOLFCOSE_KEY_DECODE \
-DWOLFCOSE_FLOAT \
-I./include -isystem $WOLFSSL_DIR/include"
for f in src/*.c; do
Expand Down
16 changes: 15 additions & 1 deletion docs/Macros.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,20 @@
# Configuration Macros

wolfCOSE uses an opt-out design: all features are enabled by default, and you disable the ones you don't need with `WOLFCOSE_NO_*` defines. A more configurable model — opt-in tuning via `user_settings.h` for features that should not be on by default — is on the roadmap.
wolfCOSE has two configuration modes. The default is an opt-out full build: every algorithm wolfSSL provides is enabled, and you strip what you don't need with `WOLFCOSE_NO_*` defines. Alternatively, `WOLFCOSE_LEAN` switches to an opt-in core build and you add extensions with `WOLFCOSE_ENABLE_*`. See [Lean Configuration Layer](#lean-configuration-layer).

## Lean Configuration Layer

Defining `WOLFCOSE_LEAN` keeps only the core — `COSE_Sign1`/`Encrypt0`/`Mac0` with ES256, AES-GCM, and HMAC-SHA256 — and turns every other algorithm into an opt-in. This is the recommended starting point for constrained targets.

| Define | Description |
|--------|-------------|
| `WOLFCOSE_LEAN` | Core-only base; all extensions become opt-in |
| `WOLFCOSE_ENABLE_ALL` | Re-enable every extension on top of `WOLFCOSE_LEAN` |
| `WOLFCOSE_ENABLE_<X>` | Opt in a single extension (see list below) |

Extension names for `WOLFCOSE_ENABLE_<X>`: `ES384`, `ES512`, `EDDSA`, `ED448`, `RSAPSS`, `MLDSA`, `HMAC384`, `HMAC512`, `AESCCM`, `CHACHA20`, `AESMAC`, `AESWRAP`, `ECDH_ES`, `SIGN` (multi-signer), `ENCRYPT` (multi-recipient), `MAC` (multi-recipient).

An extension is compiled in when it is explicitly enabled (`WOLFCOSE_ENABLE_<X>` or `WOLFCOSE_ENABLE_ALL`), or — in a non-lean build — when wolfSSL provides the primitive and it is not opted out with `WOLFCOSE_NO_<X>`. Enabling an extension wolfSSL cannot provide is a compile error. The resolved state is exposed internally as read-only `WOLFCOSE_HAVE_<X>` gates (e.g. `WOLFCOSE_HAVE_MLDSA`); sources, tests, and examples compile against those, so you set `WOLFCOSE_ENABLE_*`/`WOLFCOSE_NO_*`, not `WOLFCOSE_HAVE_*`.

## Message Type Gates

Expand Down
32 changes: 16 additions & 16 deletions examples/comprehensive/encrypt_all.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@
* @param useAad 0=no AAD, 1=with external AAD
* @return 0 on success, negative error code on failure.
*/
#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
static int test_encrypt0(int32_t alg, int keySz, int detached, int useAad)
{
int ret = 0;
Expand Down Expand Up @@ -164,10 +164,10 @@ static int test_encrypt0(int32_t alg, int keySz, int detached, int useAad)

return ret;
}
#endif /* HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_AESGCM */

/* ----- Multi-Recipient Encrypt Worker (Direct Key) ----- */
#if defined(HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT)
#if defined(WOLFCOSE_HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT)
static int test_encrypt_multi_direct(int32_t contentAlg, int keySz,
int recipCount, int detached, int useAad)
{
Expand Down Expand Up @@ -255,10 +255,10 @@ static int test_encrypt_multi_direct(int32_t contentAlg, int keySz,
}
return ret;
}
#endif /* HAVE_AESGCM && WOLFCOSE_ENCRYPT */
#endif /* WOLFCOSE_HAVE_AESGCM && WOLFCOSE_ENCRYPT */

/* ----- Multi-Recipient with Different Keys (Wrong Key Test) ----- */
#if defined(HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT)
#if defined(WOLFCOSE_HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT)
static int test_encrypt_wrong_key(void)
{
int ret = 0;
Expand Down Expand Up @@ -361,10 +361,10 @@ static int test_encrypt_wrong_key(void)
}
return ret;
}
#endif /* HAVE_AESGCM && WOLFCOSE_ENCRYPT */
#endif /* WOLFCOSE_HAVE_AESGCM && WOLFCOSE_ENCRYPT */

/* ----- Encrypt0 Test Runner (12 tests) ----- */
#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
static int test_encrypt0_all(void)
{
int ret = 0;
Expand Down Expand Up @@ -433,10 +433,10 @@ static int test_encrypt0_all(void)
printf("\nEncrypt0 Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_AESGCM */

/* ----- Multi-Recipient Test Runner ----- */
#if defined(HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT) && \
#if defined(WOLFCOSE_HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT) && \
!defined(WOLFCOSE_NO_ENCRYPT_ALL_MULTI)
static int test_encrypt_multi_all(void)
{
Expand Down Expand Up @@ -496,10 +496,10 @@ static int test_encrypt_multi_all(void)
printf("\nMulti-Recipient Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* HAVE_AESGCM && WOLFCOSE_ENCRYPT */
#endif /* WOLFCOSE_HAVE_AESGCM && WOLFCOSE_ENCRYPT */

/* ----- Interop Vector Tests ----- */
#if defined(HAVE_AESGCM) && !defined(WOLFCOSE_NO_ENCRYPT_ALL_INTEROP)
#if defined(WOLFCOSE_HAVE_AESGCM) && !defined(WOLFCOSE_NO_ENCRYPT_ALL_INTEROP)
static int test_encrypt0_interop(void)
{
int ret = 0;
Expand Down Expand Up @@ -572,7 +572,7 @@ static int test_encrypt0_interop(void)
printf("\nInterop Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* HAVE_AESGCM && !WOLFCOSE_NO_ENCRYPT_ALL_INTEROP */
#endif /* WOLFCOSE_HAVE_AESGCM && !WOLFCOSE_NO_ENCRYPT_ALL_INTEROP */

/* ----- Main Entry Point ----- */
int main(void)
Expand All @@ -583,20 +583,20 @@ int main(void)
printf("wolfCOSE Comprehensive Encrypt Tests\n");
printf("========================================\n");

#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
totalFailed += test_encrypt0_all();
#endif

#if defined(HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT) && \
#if defined(WOLFCOSE_HAVE_AESGCM) && defined(WOLFCOSE_ENCRYPT) && \
!defined(WOLFCOSE_NO_ENCRYPT_ALL_MULTI)
totalFailed += test_encrypt_multi_all();
#endif

#if defined(HAVE_AESGCM) && !defined(WOLFCOSE_NO_ENCRYPT_ALL_INTEROP)
#if defined(WOLFCOSE_HAVE_AESGCM) && !defined(WOLFCOSE_NO_ENCRYPT_ALL_INTEROP)
totalFailed += test_encrypt0_interop();
#endif

#ifndef HAVE_AESGCM
#ifndef WOLFCOSE_HAVE_AESGCM
printf("AES-GCM not available - encryption tests skipped\n");
#endif

Expand Down
76 changes: 38 additions & 38 deletions examples/comprehensive/errors_all.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,10 @@

#include <wolfcose/wolfcose.h>
#include <wolfssl/wolfcrypt/random.h>
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
#include <wolfssl/wolfcrypt/ecc.h>
#endif
#ifdef HAVE_ED25519
#ifdef WOLFCOSE_HAVE_EDDSA
#include <wolfssl/wolfcrypt/ed25519.h>
#endif
#include <stdio.h>
Expand Down Expand Up @@ -77,7 +77,7 @@
} while (0)

/* ----- Sign1 Tamper Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_tamper(int tamperPos)
{
int ret = 0;
Expand Down Expand Up @@ -157,10 +157,10 @@ static int test_sign1_tamper(int tamperPos)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

/* ----- Encrypt0 Tamper Tests ----- */
#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
static int test_encrypt0_tamper(int tamperPos)
{
int ret = 0;
Expand Down Expand Up @@ -223,10 +223,10 @@ static int test_encrypt0_tamper(int tamperPos)

return ret;
}
#endif /* HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_AESGCM */

/* ----- Mac0 Tamper Tests ----- */
#ifndef NO_HMAC
#ifdef WOLFCOSE_HAVE_HMAC256
static int test_mac0_tamper(int tamperPos)
{
int ret = 0;
Expand Down Expand Up @@ -285,10 +285,10 @@ static int test_mac0_tamper(int tamperPos)

return ret;
}
#endif /* !NO_HMAC */
#endif /* WOLFCOSE_HAVE_HMAC256 */

/* ----- Truncated Input Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_truncated(void)
{
int ret = 0;
Expand Down Expand Up @@ -350,9 +350,9 @@ static int test_sign1_truncated(void)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
static int test_encrypt0_truncated(void)
{
int ret = 0;
Expand Down Expand Up @@ -402,9 +402,9 @@ static int test_encrypt0_truncated(void)

return ret;
}
#endif /* HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_AESGCM */

#ifndef NO_HMAC
#ifdef WOLFCOSE_HAVE_HMAC256
static int test_mac0_truncated(void)
{
int ret = 0;
Expand Down Expand Up @@ -450,10 +450,10 @@ static int test_mac0_truncated(void)

return ret;
}
#endif /* !NO_HMAC */
#endif /* WOLFCOSE_HAVE_HMAC256 */

/* ----- AAD Mismatch Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_aad_mismatch(void)
{
int ret = 0;
Expand Down Expand Up @@ -519,9 +519,9 @@ static int test_sign1_aad_mismatch(void)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

#ifdef HAVE_AESGCM
#ifdef WOLFCOSE_HAVE_AESGCM
static int test_encrypt0_aad_mismatch(void)
{
int ret = 0;
Expand Down Expand Up @@ -574,9 +574,9 @@ static int test_encrypt0_aad_mismatch(void)

return ret;
}
#endif /* HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_AESGCM */

#ifndef NO_HMAC
#ifdef WOLFCOSE_HAVE_HMAC256
static int test_mac0_aad_mismatch(void)
{
int ret = 0;
Expand Down Expand Up @@ -626,10 +626,10 @@ static int test_mac0_aad_mismatch(void)

return ret;
}
#endif /* !NO_HMAC */
#endif /* WOLFCOSE_HAVE_HMAC256 */

/* ----- Detached Payload Missing Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_detached_missing(void)
{
int ret = 0;
Expand Down Expand Up @@ -693,10 +693,10 @@ static int test_sign1_detached_missing(void)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

/* ----- Wrong Key Type Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_with_symmetric_key(void)
{
int ret = 0;
Expand Down Expand Up @@ -737,9 +737,9 @@ static int test_sign1_with_symmetric_key(void)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

#if defined(HAVE_ECC) && defined(HAVE_AESGCM)
#if defined(WOLFCOSE_HAVE_ES256) && defined(WOLFCOSE_HAVE_AESGCM)
static int test_encrypt0_with_signing_key(void)
{
int ret = 0;
Expand Down Expand Up @@ -796,10 +796,10 @@ static int test_encrypt0_with_signing_key(void)
}
return ret;
}
#endif /* HAVE_ECC && HAVE_AESGCM */
#endif /* WOLFCOSE_HAVE_ES256 && WOLFCOSE_HAVE_AESGCM */

/* ----- Empty Payload Tests ----- */
#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
static int test_sign1_empty_payload(void)
{
int ret = 0;
Expand Down Expand Up @@ -860,10 +860,10 @@ static int test_sign1_empty_payload(void)
}
return ret;
}
#endif /* HAVE_ECC */
#endif /* WOLFCOSE_HAVE_ES256 */

/* ----- Error Test Runners ----- */
#if defined(HAVE_ECC) && !defined(WOLFCOSE_NO_ERRORS_ALL_SIGN)
#if defined(WOLFCOSE_HAVE_ES256) && !defined(WOLFCOSE_NO_ERRORS_ALL_SIGN)
static int test_sign_errors_all(void)
{
int ret = 0;
Expand Down Expand Up @@ -913,9 +913,9 @@ static int test_sign_errors_all(void)
printf("\nSign1 Error Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* HAVE_ECC && !WOLFCOSE_NO_ERRORS_ALL_SIGN */
#endif /* WOLFCOSE_HAVE_ES256 && !WOLFCOSE_NO_ERRORS_ALL_SIGN */

#if defined(HAVE_AESGCM) && !defined(WOLFCOSE_NO_ERRORS_ALL_ENCRYPT)
#if defined(WOLFCOSE_HAVE_AESGCM) && !defined(WOLFCOSE_NO_ERRORS_ALL_ENCRYPT)
static int test_encrypt_errors_all(void)
{
int ret = 0;
Expand Down Expand Up @@ -947,7 +947,7 @@ static int test_encrypt_errors_all(void)
ret = test_encrypt0_aad_mismatch();
CHECK_RESULT(ret, "encrypt0_aad_mismatch");

#ifdef HAVE_ECC
#ifdef WOLFCOSE_HAVE_ES256
/* Wrong key type */
PRINT_TEST("encrypt0_with_signing_key");
ret = test_encrypt0_with_signing_key();
Expand All @@ -957,9 +957,9 @@ static int test_encrypt_errors_all(void)
printf("\nEncrypt0 Error Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* HAVE_AESGCM && !WOLFCOSE_NO_ERRORS_ALL_ENCRYPT */
#endif /* WOLFCOSE_HAVE_AESGCM && !WOLFCOSE_NO_ERRORS_ALL_ENCRYPT */

#if !defined(NO_HMAC) && !defined(WOLFCOSE_NO_ERRORS_ALL_MAC)
#if defined(WOLFCOSE_HAVE_HMAC256) && !defined(WOLFCOSE_NO_ERRORS_ALL_MAC)
static int test_mac_errors_all(void)
{
int ret = 0;
Expand Down Expand Up @@ -994,7 +994,7 @@ static int test_mac_errors_all(void)
printf("\nMac0 Error Summary: %d passed, %d failed\n", passed, failed);
return failed;
}
#endif /* !NO_HMAC && !WOLFCOSE_NO_ERRORS_ALL_MAC */
#endif /* WOLFCOSE_HAVE_HMAC256 && !WOLFCOSE_NO_ERRORS_ALL_MAC */

/* ----- Main Entry Point ----- */
int main(void)
Expand All @@ -1005,15 +1005,15 @@ int main(void)
printf("wolfCOSE Comprehensive Error Tests\n");
printf("========================================\n");

#if defined(HAVE_ECC) && !defined(WOLFCOSE_NO_ERRORS_ALL_SIGN)
#if defined(WOLFCOSE_HAVE_ES256) && !defined(WOLFCOSE_NO_ERRORS_ALL_SIGN)
totalFailed += test_sign_errors_all();
#endif

#if defined(HAVE_AESGCM) && !defined(WOLFCOSE_NO_ERRORS_ALL_ENCRYPT)
#if defined(WOLFCOSE_HAVE_AESGCM) && !defined(WOLFCOSE_NO_ERRORS_ALL_ENCRYPT)
totalFailed += test_encrypt_errors_all();
#endif

#if !defined(NO_HMAC) && !defined(WOLFCOSE_NO_ERRORS_ALL_MAC)
#if defined(WOLFCOSE_HAVE_HMAC256) && !defined(WOLFCOSE_NO_ERRORS_ALL_MAC)
totalFailed += test_mac_errors_all();
#endif

Expand Down
Loading
Loading