build: Fix OpenSSL version check for PQC

ML-KEM, ML-DSA and SLH-DSA all landed in OpenSSL 3.5.0, not 3.4.0.

ML-KEM+ML-DSA and SLH-DSA can be disabled by DISABLE_ML / DISABLE_SLH.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

10 files changed, 27 insertions, 46 deletions

diff --git a/cmake/dependencies/crypt/openssl.cmake b/cmake/dependencies/crypt/openssl.cmake
index 38eb826f..b0fa8d11 100644
--- a/cmake/dependencies/crypt/openssl.cmake
+++ b/cmake/dependencies/crypt/openssl.cmake
@@ -25,49 +25,32 @@ message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}")
 set(HAVE_OPENSSL TRUE CACHE INTERNAL
   "OpenSSL cryptography support available")
 
-if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0")
-  set(DISABLE_ML_KEM FALSE CACHE BOOL
-    "Disable ML-KEM support")
-  set(DISABLE_ML_DSA FALSE CACHE BOOL
-    "Disable ML-DSA support")
-  if(NOT DISABLE_ML_KEM)
-    set(HAVE_OPENSSL_ML_KEM TRUE CACHE INTERNAL
-      "OpenSSL ML-KEM available")
-    message(STATUS "OpenSSL ML-KEM support enabled")
-  else()
-    message(STATUS "OpenSSL ML-KEM support disabled")
-    unset(HAVE_OPENSSL_ML_KEM CACHE)
-  endif()
-  if(NOT DISABLE_ML_DSA)
-    set(HAVE_OPENSSL_ML_DSA TRUE CACHE INTERNAL
-      "OpenSSL ML-DSA available")
-    message(STATUS "OpenSSL ML-DSA support enabled")
-  else()
-    message(STATUS "OpenSSL ML-DSA support disabled")
-    unset(HAVE_OPENSSL_ML_DSA CACHE)
-  endif()
-else()
-  message(STATUS
-    "Install OpenSSL >= 3.4.0 for ML-KEM/ML-DSA")
-  unset(HAVE_OPENSSL_ML_KEM CACHE)
-  unset(HAVE_OPENSSL_ML_DSA CACHE)
-endif()
-
 if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.5.0")
-  set(DISABLE_SLH_DSA FALSE CACHE BOOL
+  set(DISABLE_ML FALSE CACHE BOOL
+    "Disable ML-KEM/ML-DSA support")
+  set(DISABLE_SLH FALSE CACHE BOOL
     "Disable SLH-DSA support")
-  if(NOT DISABLE_SLH_DSA)
-    set(HAVE_OPENSSL_SLH_DSA TRUE CACHE INTERNAL
+  if(NOT DISABLE_ML)
+    set(HAVE_ML TRUE CACHE INTERNAL
+      "OpenSSL ML-KEM/ML-DSA available")
+    message(STATUS "OpenSSL ML-KEM/ML-DSA support enabled")
+  else()
+    message(STATUS "OpenSSL ML-KEM/ML-DSA support disabled")
+    unset(HAVE_ML CACHE)
+  endif()
+  if(NOT DISABLE_SLH)
+    set(HAVE_SLH TRUE CACHE INTERNAL
       "OpenSSL SLH-DSA available")
     message(STATUS "OpenSSL SLH-DSA support enabled")
   else()
     message(STATUS "OpenSSL SLH-DSA support disabled")
-    unset(HAVE_OPENSSL_SLH_DSA CACHE)
+    unset(HAVE_SLH CACHE)
   endif()
 else()
   message(STATUS
-    "Install OpenSSL >= 3.5.0 for SLH-DSA")
-  unset(HAVE_OPENSSL_SLH_DSA CACHE)
+    "Install OpenSSL >= 3.5.0 for PQC (ML-KEM/ML-DSA/SLH-DSA)")
+  unset(HAVE_ML CACHE)
+  unset(HAVE_SLH CACHE)
 endif()
 
 # Secure memory options are in cmake/config/global.cmake
diff --git a/src/irmd/config.h.in b/src/irmd/config.h.in
index e14cff75..53f80ca4 100644
--- a/src/irmd/config.h.in
+++ b/src/irmd/config.h.in
@@ -82,8 +82,7 @@
 #cmakedefine HAVE_LIBGCRYPT
 #cmakedefine HAVE_OPENSSL
 #ifdef HAVE_OPENSSL
-#cmakedefine HAVE_OPENSSL_ML_KEM
-#cmakedefine HAVE_OPENSSL_ML_DSA
+#cmakedefine HAVE_ML
 #endif
 #define IRMD_SECMEM_MAX        @IRMD_SECMEM_MAX@
 #ifdef CONFIG_OUROBOROS_DEBUG
diff --git a/src/irmd/oap/io.c b/src/irmd/oap/io.c
index b5daa432..845723fa 100644
--- a/src/irmd/oap/io.c
+++ b/src/irmd/oap/io.c
@@ -133,7 +133,7 @@ int load_sec_config(const char *        name,
                 log_info("Key exchange not configured for %s.", name);
                 return 0;
         }
-#ifndef HAVE_OPENSSL_ML_KEM
+#ifndef HAVE_ML
         if (IS_KEM_ALGORITHM(cfg->x.str)) {
                 log_err("PQC not available, can't use %s for %s.",
                         cfg->x.str, name);
diff --git a/src/irmd/oap/tests/oap_test_ml_dsa.c b/src/irmd/oap/tests/oap_test_ml_dsa.c
index 8691aa00..21f2440b 100644
--- a/src/irmd/oap/tests/oap_test_ml_dsa.c
+++ b/src/irmd/oap/tests/oap_test_ml_dsa.c
@@ -454,7 +454,7 @@ int oap_test_ml_dsa(int    argc,
         (void) argc;
         (void) argv;
 
-#ifdef HAVE_OPENSSL_ML_KEM
+#ifdef HAVE_ML
         ret |= test_oap_roundtrip_auth_only();
         ret |= test_oap_cli_md_pin_exempts_pqc();
         ret |= test_oap_srv_md_pin_exempts_pqc();
diff --git a/src/lib/config.h.in b/src/lib/config.h.in
index 26ebe56b..4ebaa194 100644
--- a/src/lib/config.h.in
+++ b/src/lib/config.h.in
@@ -33,9 +33,8 @@
 #cmakedefine HAVE_LIBGCRYPT
 #cmakedefine HAVE_OPENSSL
 #ifdef HAVE_OPENSSL
-#cmakedefine HAVE_OPENSSL_ML_KEM
-#cmakedefine HAVE_OPENSSL_ML_DSA
-#cmakedefine HAVE_OPENSSL_SLH_DSA
+#cmakedefine HAVE_ML
+#cmakedefine HAVE_SLH
 #define HAVE_ENCRYPTION
 #define SECMEM_MINSIZE           @SECMEM_MINSIZE@
 #endif
diff --git a/src/lib/crypt.c b/src/lib/crypt.c
index 5da9d392..e4cf7885 100644
--- a/src/lib/crypt.c
+++ b/src/lib/crypt.c
@@ -96,7 +96,7 @@ const uint16_t kex_supported_nids[] = {
         NID_secp384r1,        /* ECDH P-384,   192-bit          */
         NID_X448,             /* ECDH X448,    224-bit          */
         NID_secp521r1,        /* ECDH P-521,   256-bit          */
-#ifdef HAVE_OPENSSL_ML_KEM
+#ifdef HAVE_ML
         NID_MLKEM512,         /* ML-KEM-512,  PQC L1 (~AES-128) */
         NID_MLKEM768,         /* ML-KEM-768,  PQC L3 (~AES-192) */
         NID_MLKEM1024,        /* ML-KEM-1024, PQC L5 (~AES-256) */
diff --git a/src/lib/tests/auth_test_ml_dsa.c b/src/lib/tests/auth_test_ml_dsa.c
index cc72e61b..e324c32d 100644
--- a/src/lib/tests/auth_test_ml_dsa.c
+++ b/src/lib/tests/auth_test_ml_dsa.c
@@ -333,7 +333,7 @@ int auth_test_ml_dsa(int     argc,
         (void) argc;
         (void) argv;
 
-#ifdef HAVE_OPENSSL_ML_DSA
+#ifdef HAVE_ML
         ret |= test_auth_create_destroy_ctx();
         ret |= test_load_free_crt();
         ret |= test_load_free_privkey();
diff --git a/src/lib/tests/auth_test_slh_dsa.c b/src/lib/tests/auth_test_slh_dsa.c
index 511d20fe..e9af8da8 100644
--- a/src/lib/tests/auth_test_slh_dsa.c
+++ b/src/lib/tests/auth_test_slh_dsa.c
@@ -344,7 +344,7 @@ int auth_test_slh_dsa(int     argc,
         (void) argc;
         (void) argv;
 
-#ifdef HAVE_OPENSSL_SLH_DSA
+#ifdef HAVE_SLH
         ret |= test_auth_create_destroy_ctx();
         ret |= test_load_free_crt();
         ret |= test_load_free_privkey();
diff --git a/src/lib/tests/kex_test.c b/src/lib/tests/kex_test.c
index 0a00ccab..61383be0 100644
--- a/src/lib/tests/kex_test.c
+++ b/src/lib/tests/kex_test.c
@@ -305,7 +305,7 @@ static int test_kex_validate_algo(void)
                 goto fail;
         }
 
-#ifdef HAVE_OPENSSL_ML_KEM
+#ifdef HAVE_ML
         if (kex_validate_algo("ML-KEM-768") != 0) {
                 printf("ML-KEM-768 should be valid.\n");
                 goto fail;
diff --git a/src/lib/tests/kex_test_ml_kem.c b/src/lib/tests/kex_test_ml_kem.c
index 7761c3dc..1f7d7531 100644
--- a/src/lib/tests/kex_test_ml_kem.c
+++ b/src/lib/tests/kex_test_ml_kem.c
@@ -528,7 +528,7 @@ int kex_test_ml_kem(int     argc,
         (void) argc;
         (void) argv;
 
-#ifdef HAVE_OPENSSL_ML_KEM
+#ifdef HAVE_ML
         ret |= test_kex_load_kem_privkey();
         ret |= test_kex_load_kem_pubkey();
         ret |= test_kex_kem_all();