Default to RFC 9864 algorithm IDs and gate deprecated RFC 9053 IDs

.github/workflows/build-test.yml

@@ -161,6 +161,15 @@ jobs:
         make ext-sign-test CFLAGS="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -Os -Wall -Wextra -Wpedantic -Wshadow -Wconversion -I./include -isystem $WOLFSSL_DIR/include" \
                            LDFLAGS="-L$WOLFSSL_DIR/lib -lwolfssl"
 
+    - name: Run deprecated RFC 9053 alg IDs test
+      run: |
+        export WOLFSSL_DIR=$HOME/wolfssl-install
+        export LD_LIBRARY_PATH=$WOLFSSL_DIR/lib
+        export DYLD_LIBRARY_PATH=$WOLFSSL_DIR/lib
+        make deprecated-algs-test CFLAGS="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -Os -Wall -Wextra -Wpedantic -Wshadow -Wconversion -I./include -isystem $WOLFSSL_DIR/include" \
+                                  LDFLAGS="-L$WOLFSSL_DIR/lib -lwolfssl"
+
+
     - name: Run delegated signing forced-failure test
       run: |
         export WOLFSSL_DIR=$HOME/wolfssl-install

.github/workflows/cmdline-test.yml

@@ -79,3 +79,18 @@ jobs:
         export WOLFSSL_DIR=$HOME/wolfssl-install
         export LD_LIBRARY_PATH=$WOLFSSL_DIR/lib
         ./scripts/cmdline-test.sh ./tools/wolfcose_tool
+
+    - name: Build tool with deprecated RFC 9053 alg IDs
+      run: |
+        export WOLFSSL_DIR=$HOME/wolfssl-install
+        make tool CFLAGS="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -DWOLFCOSE_ENABLE_DEPRECATED_ALGS -Os -Wall -Wextra -Wpedantic -Wshadow -Wconversion -I./include -isystem $WOLFSSL_DIR/include" \
+                  LDFLAGS="-L$WOLFSSL_DIR/lib -lwolfssl"
+
+    - name: Run command-line tool test with deprecated alg names
+      env:
+        EXPECT_PQC: ${{ matrix.pqc }}
+        SIGN_ALGS: "ES256 ES384 ES512 EdDSA Ed448 ESP256 ESP384 ESP512 Ed25519"
+      run: |
+        export WOLFSSL_DIR=$HOME/wolfssl-install
+        export LD_LIBRARY_PATH=$WOLFSSL_DIR/lib
+        ./scripts/cmdline-test.sh ./tools/wolfcose_tool

.github/workflows/coverage.yml

@@ -73,3 +73,14 @@ jobs:
 
     - name: Check coverage thresholds
       run: sh scripts/check_coverage.sh wolfcose_eat_psa.c
+
+    - name: Run coverage with deprecated RFC 9053 alg IDs enabled
+      run: |
+        export WOLFSSL_DIR=$HOME/wolfssl-install
+        export LD_LIBRARY_PATH=$WOLFSSL_DIR/lib
+        make coverage-force-failure CC=gcc \
+          CFLAGS="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -DWOLFCOSE_ENABLE_DEPRECATED_ALGS -Os -Wall -Wextra -Wpedantic -Wshadow -Wconversion -I./include -isystem $WOLFSSL_DIR/include" \
+          LDFLAGS="-L$WOLFSSL_DIR/lib -lwolfssl"
+
+    - name: Check coverage thresholds (deprecated alg IDs)
+      run: sh scripts/check_coverage.sh

.github/workflows/lean-build.yml

@@ -166,6 +166,7 @@ jobs:
         build_cfg "WOLFCOSE_LEAN_VERIFY" -DWOLFCOSE_LEAN_VERIFY
         build_cfg "WOLFCOSE_LEAN_VERIFY + RFC 9783 PSA/EAT" \
             -DWOLFCOSE_LEAN_VERIFY -DWOLFCOSE_ENABLE_EAT_PSA \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
             -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT \
             -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 \
             -DWOLFCOSE_ENABLE_EAT_PSA_MAC0 -DWOLFCOSE_ENABLE_ES384 \
@@ -177,6 +178,11 @@ jobs:
             -DWOLFCOSE_NO_MAC -DWOLFCOSE_NO_RECIPIENTS
         build_cfg "WOLFCOSE_LEAN_MLDSA (sign+verify)" -DWOLFCOSE_LEAN_MLDSA
         build_cfg "WOLFCOSE_LEAN_VERIFY_MLDSA (verify-only)" -DWOLFCOSE_LEAN_VERIFY_MLDSA
+        build_cfg "deprecated RFC 9053 alg IDs" -DWOLFCOSE_ENABLE_DEPRECATED_ALGS
+        build_cfg "WOLFCOSE_LEAN + deprecated RFC 9053 alg IDs" -DWOLFCOSE_LEAN \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS
+        build_cfg "deprecated RFC 9053 alg IDs, Ed448 only" \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS -DWOLFCOSE_NO_EDDSA
         echo "All lean configurations compiled clean."
 
     - name: Check PSA/EAT opt-in feature matrix

.github/workflows/minimal-build.yml

@@ -61,6 +61,14 @@ jobs:
             wolfssl_flags: "--enable-cryptonly --enable-ecc --enable-aesgcm --enable-keygen --enable-sha384 --enable-sha512 --enable-lowresource --enable-sp-math-all --disable-dh --disable-rsa --disable-aescbc --disable-sha --disable-md5 --disable-chacha --disable-poly1305 --disable-errorstrings"
             cache_key: wolfssl-ecc-only-v5
             cose_flags: "-DWOLFCOSE_LEAN"
+          - name: Deprecated RFC 9053 alg IDs (ES256/ES384/ES512/EdDSA-Ed25519)
+            wolfssl_flags: "--enable-cryptonly --enable-ecc --enable-ed25519 --enable-curve25519 --enable-aesgcm --enable-keygen --enable-sha384 --enable-sha512 --enable-lowresource --enable-sp-math-all --disable-dh --disable-rsa --disable-aescbc --disable-sha --disable-md5 --disable-chacha --disable-poly1305 --disable-errorstrings"
+            cache_key: wolfssl-ecc-ed25519-v1
+            cose_flags: "-DWOLFCOSE_ENABLE_DEPRECATED_ALGS"
+          - name: Lean core + deprecated RFC 9053 alg IDs
+            wolfssl_flags: "--enable-cryptonly --enable-ecc --enable-aesgcm --enable-keygen --enable-sha384 --enable-sha512 --enable-lowresource --enable-sp-math-all --disable-dh --disable-rsa --disable-aescbc --disable-sha --disable-md5 --disable-chacha --disable-poly1305 --disable-errorstrings"
+            cache_key: wolfssl-ecc-only-v5
+            cose_flags: "-DWOLFCOSE_LEAN -DWOLFCOSE_ENABLE_DEPRECATED_ALGS"
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/misra-2012.yml

@@ -97,6 +97,7 @@ jobs:
            -DWOLFCOSE_ENABLE_EAT_PSA_LEGACY \
            -DWOLFCOSE_ENABLE_EAT_PSA_UEID_RESOLVER \
            -DWOLFCOSE_ENABLE_EAT_PSA_COMPONENT_ITERATOR \
+           -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
            -I include -I "$HOME/wolfssl-install/include" \
            -fsyntax-only src/wolfcose_eat_psa.c tests/misra_consumer.c
 
@@ -124,6 +125,7 @@ jobs:
                  -DHAVE_HKDF \
                  -DHAVE_AES_CBC \
                  -DHAVE_HPKE \
+                 -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
                  -DWOLFCOSE_ENABLE_EAT_PSA \
                  -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT \
                  -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 \
@@ -141,6 +143,7 @@ jobs:
                  -DWOLFCOSE_ENABLE_HPKE_0_DECRYPT \
                  -DWOLFCOSE_ENABLE_HPKE_0_KE_ENCRYPT \
                  -DWOLFCOSE_ENABLE_HPKE_0_KE_DECRYPT \
+                 -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
                  -I include -I src -I $HOME/wolfssl-install/include \
                  src/*.c \
                  tests/misra_consumer.c \

.github/workflows/misra-2023.yml

@@ -112,6 +112,7 @@ jobs:
             -DWOLFCOSE_ENABLE_EAT_PSA_LEGACY \
             -DWOLFCOSE_ENABLE_EAT_PSA_UEID_RESOLVER \
             -DWOLFCOSE_ENABLE_EAT_PSA_COMPONENT_ITERATOR \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
             -I./include -isystem $WOLFSSL_DIR/include"
         for f in src/*.c; do
           gcc $MISRA_FLAGS -c "$f" -o /dev/null 2>&1 | tee -a compiler-warnings.txt || true
@@ -231,6 +232,7 @@ jobs:
             -DWOLFCOSE_SIGN1 -DWOLFCOSE_SIGN1_SIGN -DWOLFCOSE_SIGN1_VERIFY \
             -DWOLFCOSE_ENCRYPT0 -DWOLFCOSE_ENCRYPT0_ENCRYPT -DWOLFCOSE_ENCRYPT0_DECRYPT \
             -DWOLFCOSE_MAC0 -DWOLFCOSE_MAC0_CREATE -DWOLFCOSE_MAC0_VERIFY \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
             -DWOLFCOSE_ENABLE_EAT_PSA -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT \
             -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 -DWOLFCOSE_ENABLE_EAT_PSA_MAC0 \
             -DWOLFCOSE_ENABLE_EAT_PSA_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_LEGACY \
@@ -247,6 +249,7 @@ jobs:
             -DWOLFCOSE_KEY_ENCODE -DWOLFCOSE_KEY_DECODE \
             -DWOLFCOSE_FLOAT \
             -DWOLFCOSE_ENABLE_EXT_SIGN \
+            -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
             > clang-tidy-report.txt 2>&1 || true
 
     - name: clang-tidy summary

.github/workflows/stack-bounds.yml

@@ -51,7 +51,7 @@ jobs:
     - name: Build full PSA/EAT wolfCOSE (-Werror=vla, -fstack-usage)
       run: |
         export WOLFSSL_DIR=$HOME/wolfssl-full
-        EAT_FLAGS="-DWOLFCOSE_ENABLE_EAT_PSA -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 -DWOLFCOSE_ENABLE_EAT_PSA_MAC0 -DWOLFCOSE_ENABLE_EAT_PSA_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_MAC0_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_LEGACY -DWOLFCOSE_ENABLE_EAT_PSA_UEID_RESOLVER -DWOLFCOSE_ENABLE_EAT_PSA_COMPONENT_ITERATOR"
+        EAT_FLAGS="-DWOLFCOSE_ENABLE_DEPRECATED_ALGS -DWOLFCOSE_ENABLE_EAT_PSA -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 -DWOLFCOSE_ENABLE_EAT_PSA_MAC0 -DWOLFCOSE_ENABLE_EAT_PSA_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_MAC0_ISSUE -DWOLFCOSE_ENABLE_EAT_PSA_LEGACY -DWOLFCOSE_ENABLE_EAT_PSA_UEID_RESOLVER -DWOLFCOSE_ENABLE_EAT_PSA_COMPONENT_ITERATOR"
         make CFLAGS="-std=c11 -Os -Wall -Wextra -Wpedantic -Wshadow -Wconversion -Wvla -Werror=vla -fstack-usage -I./include -I$WOLFSSL_DIR/include $EAT_FLAGS" \
              LDFLAGS="-L$WOLFSSL_DIR/lib -lwolfssl"
         grep -q "wc_CoseEatPsaToken_Verify" src/wolfcose_eat_psa.su

.github/workflows/static-analysis.yml

@@ -77,6 +77,7 @@ jobs:
                  --error-exitcode=1 \
                  --suppress=missingIncludeSystem \
                  --inline-suppr \
+                 -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
                  -DWOLFCOSE_ENABLE_EAT_PSA \
                  -DWOLFCOSE_ENABLE_EAT_PSA_CURRENT \
                  -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1 \

IDE/STM32Cube/wolfcose_test.c

@@ -43,7 +43,7 @@ int wolfCOSETest(void)
     int keyInited = 0;
     int ret;
 
-    printf("Running wolfCOSE test (COSE_Sign1 ES256)...\n");
+    printf("Running wolfCOSE test (COSE_Sign1 ESP256)...\n");
 
     ret = wc_InitRng(&rng);
     if (ret == 0) {
@@ -62,7 +62,7 @@ int wolfCOSETest(void)
         ret = wc_CoseKey_SetEcc(&key, WOLFCOSE_CRV_P256, &eccKey);
     }
     if (ret == 0) {
-        ret = wc_CoseSign1_Sign(&key, WOLFCOSE_ALG_ES256,
+        ret = wc_CoseSign1_Sign(&key, WOLFCOSE_ALG_ESP256,
             NULL, 0, payload, payloadLen, NULL, 0, NULL, 0,
             scratch, sizeof(scratch), out, sizeof(out), &outLen, &rng);
     }
@@ -73,7 +73,7 @@ int wolfCOSETest(void)
     if (ret == 0) {
         if ((decPayload == NULL) || (decPayloadLen != payloadLen) ||
             (memcmp(decPayload, payload, decPayloadLen) != 0) ||
-            (hdr.alg != WOLFCOSE_ALG_ES256)) {
+            (hdr.alg != WOLFCOSE_ALG_ESP256)) {
             ret = -1;
         }
     }
@@ -96,8 +96,8 @@ int wolfCOSETest(void)
     }
     return ret;
 #else
-    /* ES256 COSE_Sign1 not compiled in; report not run so it is not read as pass */
-    printf("wolfCOSE test: needs ES256 with COSE_Sign1 sign and verify\n");
+    /* ESP256 COSE_Sign1 not compiled in; report not run so it is not read as pass */
+    printf("wolfCOSE test: needs ESP256 with COSE_Sign1 sign and verify\n");
     return -1;
 #endif
 }