CMake: fix XMSS wiring and complete LMS/XMSS sub-option parity

.github/workflows/cmake.yml

@@ -71,6 +71,7 @@ jobs:
             -DWOLFSSL_TLSX:BOOL=yes -DWOLFSSL_TPM:BOOL=yes -DWOLFSSL_CLU:BOOL=yes -DWOLFSSL_USER_SETTINGS:BOOL=no \
             -DWOLFSSL_USER_SETTINGS_ASM:BOOL=no -DWOLFSSL_WOLFSSH:BOOL=ON -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes \
             -DWOLFSSL_MLKEM:BOOL=yes -DWOLFSSL_LMS:BOOL=yes -DWOLFSSL_LMSSHA256192:BOOL=yes \
+            -DWOLFSSL_XMSS:BOOL=yes \
             -DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \
             -DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
             -DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \

CMakeLists.txt

@@ -1010,6 +1010,18 @@ add_option(WOLFSSL_LMSNOSHA256256
     "Disable the LMS SHA_256_256 standard variant (default: disabled)"
     "no" "yes;no")
 
+add_option(WOLFSSL_LMSVERIFYONLY
+    "Enable the LMS/HSS verify-only implementation (default: disabled)"
+    "no" "yes;no")
+
+add_option(WOLFSSL_LMSSMALL
+    "Enable the smaller, slower LMS/HSS implementation (default: disabled)"
+    "no" "yes;no")
+
+add_option(WOLFSSL_LMSSHAKE256
+    "Enable the LMS SHAKE256 variant (default: disabled)"
+    "no" "yes;no")
+
 if (WOLFSSL_LMS)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS")
 
@@ -1026,6 +1038,24 @@ if (WOLFSSL_LMS)
 
         set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
     endif()
+
+    if (WOLFSSL_LMSVERIFYONLY)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_VERIFY_ONLY")
+
+        set_wolfssl_definitions("WOLFSSL_LMS_VERIFY_ONLY"   RESULT)
+    endif()
+
+    if (WOLFSSL_LMSSMALL)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_LMS_SMALL")
+
+        set_wolfssl_definitions("WOLFSSL_WC_LMS_SMALL"      RESULT)
+    endif()
+
+    if (WOLFSSL_LMSSHAKE256)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHAKE256")
+
+        set_wolfssl_definitions("WOLFSSL_LMS_SHAKE256"      RESULT)
+    endif()
 endif()
 
 # Experimental features
@@ -1122,6 +1152,32 @@ add_option(WOLFSSL_XMSS
     "Enable the wolfSSL XMSS implementation (default: disabled)"
     "no" "yes;no")
 
+add_option(WOLFSSL_XMSSVERIFYONLY
+    "Enable the XMSS/XMSS^MT verify-only implementation (default: disabled)"
+    "no" "yes;no")
+
+add_option(WOLFSSL_XMSSSMALL
+    "Enable the smaller, slower XMSS/XMSS^MT implementation (default: disabled)"
+    "no" "yes;no")
+
+if (WOLFSSL_XMSS)
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_XMSS")
+
+    set_wolfssl_definitions("WOLFSSL_HAVE_XMSS" RESULT)
+
+    if (WOLFSSL_XMSSVERIFYONLY)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_XMSS_VERIFY_ONLY")
+
+        set_wolfssl_definitions("WOLFSSL_XMSS_VERIFY_ONLY" RESULT)
+    endif()
+
+    if (WOLFSSL_XMSSSMALL)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_XMSS_SMALL")
+
+        set_wolfssl_definitions("WOLFSSL_WC_XMSS_SMALL"    RESULT)
+    endif()
+endif()
+
 # SLH-DSA
 add_option(WOLFSSL_SLHDSA
     "Enable the wolfSSL SLH-DSA implementation (default: disabled)"

cmake/options.h.in

@@ -409,10 +409,20 @@ extern "C" {
 #cmakedefine WOLFSSL_LMS_SHA256_192
 #undef  WOLFSSL_NO_LMS_SHA256_256
 #cmakedefine WOLFSSL_NO_LMS_SHA256_256
+#undef  WOLFSSL_LMS_VERIFY_ONLY
+#cmakedefine WOLFSSL_LMS_VERIFY_ONLY
+#undef  WOLFSSL_WC_LMS_SMALL
+#cmakedefine WOLFSSL_WC_LMS_SMALL
+#undef  WOLFSSL_LMS_SHAKE256
+#cmakedefine WOLFSSL_LMS_SHAKE256
 #undef WOLFSSL_HAVE_XMSS
 #cmakedefine WOLFSSL_HAVE_XMSS
 #undef WOLFSSL_WC_XMSS
 #cmakedefine WOLFSSL_WC_XMSS
+#undef  WOLFSSL_XMSS_VERIFY_ONLY
+#cmakedefine WOLFSSL_XMSS_VERIFY_ONLY
+#undef  WOLFSSL_WC_XMSS_SMALL
+#cmakedefine WOLFSSL_WC_XMSS_SMALL
 #undef HAVE_SECRET_CALLBACK
 #cmakedefine HAVE_SECRET_CALLBACK
 #undef WC_RSA_DIRECT

configure.ac

@@ -1993,7 +1993,7 @@ do
   no)
     ;;
   verify-only)
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY -DXMSS_VERIFY_ONLY"
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY"
     ;;
   small)
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_XMSS_SMALL"