[padelsbach]

wolfSSL commit 7f6d4daa96 enforces a minimum prehash size. WP tests use SHA256 (128b collision strength) with ML-DSA-65 (192 bits), and now fails.

Fixes failing wolfSSL PQC KAT and wolfSSL versions CI workflows.

[Copilot]

🟡 Changes recommended

Unconditional ML-DSA success tests fail DigestSignInit on valid builds without SHA-384 or SHA-512 and need guards for the corresponding digest features.

1 open issue

• Guard ML-DSA digest tests when SHA-384 or SHA-512 is disabled · New

What changed in this PR

Aligns wolfProvider’s HashML-DSA pre-hash validation with wolfSSL’s minimum-strength requirement, addressing the reported CI failures.

Changes:

• Rejects digests whose collision strength is below the ML-DSA parameter set’s security strength, unless weak pre-hashes are explicitly enabled.
• Adds an internal accessor for ML-DSA security strength.
• Expands tests to cover accepted and rejected digest choices across parameter sets.

File	Description
test/​test_mldsa.c	Adds table-driven pre-hash acceptance, rejection, and round-trip tests.
src/​wp_mldsa_sig.c	Enforces parameter-set-specific minimum pre-hash strength.
src/​wp_mldsa_kmgmt.c	Implements the security-strength accessor.
include/​wolfprovider/​alg_funcs.h	Declares the new internal accessor.

_{Review effort: Balanced}

[padelsbach]

jenkins retest this please (boz-xeon5 missing install android ndk, now installed)