test_frodokem.c

/* test_frodokem.c
 *
 * Copyright (C) 2006-2026 wolfSSL Inc.
 *
 * This file is part of wolfSSL.
 *
 * wolfSSL is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * wolfSSL is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

#include <tests/unit.h>

#ifdef NO_INLINE
    #include <wolfssl/wolfcrypt/misc.h>
#else
    #define WOLFSSL_MISC_INCLUDED
    #include <wolfcrypt/src/misc.c>
#endif

#ifdef WOLFSSL_HAVE_FRODOKEM
    #include <wolfssl/wolfcrypt/wc_frodokem.h>
    #include <wolfssl/wolfcrypt/hash.h>
    #include <wolfssl/wolfcrypt/sha256.h>
    #if defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC)
        #include <wolfssl/wolfcrypt/asn_public.h>
        #include <wolfssl/wolfcrypt/asn.h>
        #include <wolfssl/wolfcrypt/ecc.h>
    #endif
#endif
#include <wolfssl/wolfcrypt/types.h>
#include <tests/api/api.h>
#include <tests/api/test_frodokem.h>

#ifdef WOLFSSL_HAVE_FRODOKEM

/* The set of compiled-in key types, used to drive the functional tests. */
static const int frodokem_types[] = {
#ifdef WOLFSSL_FRODOKEM_SHAKE
#ifdef WOLFSSL_WC_FRODOKEM_640
    WC_FRODOKEM_640_SHAKE,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_976
    WC_FRODOKEM_976_SHAKE,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_1344
    WC_FRODOKEM_1344_SHAKE,
#endif
#endif /* WOLFSSL_FRODOKEM_SHAKE */
#ifdef WOLFSSL_FRODOKEM_AES
#ifdef WOLFSSL_WC_FRODOKEM_640
    WC_FRODOKEM_640_AES,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_976
    WC_FRODOKEM_976_AES,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_1344
    WC_FRODOKEM_1344_AES,
#endif
#endif /* WOLFSSL_FRODOKEM_AES */
#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
#ifdef WOLFSSL_FRODOKEM_SHAKE
#ifdef WOLFSSL_WC_FRODOKEM_640
    WC_EFRODOKEM_640_SHAKE,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_976
    WC_EFRODOKEM_976_SHAKE,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_1344
    WC_EFRODOKEM_1344_SHAKE,
#endif
#endif /* WOLFSSL_FRODOKEM_SHAKE */
#ifdef WOLFSSL_FRODOKEM_AES
#ifdef WOLFSSL_WC_FRODOKEM_640
    WC_EFRODOKEM_640_AES,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_976
    WC_EFRODOKEM_976_AES,
#endif
#ifdef WOLFSSL_WC_FRODOKEM_1344
    WC_EFRODOKEM_1344_AES,
#endif
#endif /* WOLFSSL_FRODOKEM_AES */
#endif /* WOLFSSL_FRODOKEM_EPHEMERAL */
    0 /* sentinel so the array is never empty */
};

#define FRODOKEM_TYPE_CNT \
    ((int)(sizeof(frodokem_types) / sizeof(frodokem_types[0])) - 1)

/* The KAT data is only used by the make-key/encapsulate/decapsulate KAT tests,
 * all of which need key generation to reconstruct the key. */
#if !defined(NO_SHA256) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM)

/* Known-answer test data derived from the official FrodoKEM and eFrodoKEM
 * KAT vectors (PQCkemKAT_*.rsp, count 0), for both the SHAKE and AES matrix A
 * generation variants. To keep the data compact the public key, secret key and
 * ciphertext are stored as SHA-256 digests; the shared secret is stored in
 * full. The seed randomness (kr = s || seedSE || z for key generation, er =
 * u || salt for encapsulation) is what the NIST AES-CTR DRBG produces for KAT
 * count 0. */

#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_SHAKE)
static const byte frodokem_kr_640_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,
};
static const byte frodokem_er_640_SHAKE[] = {
    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
    0x19,0x42,0xec,0xa8,0xf6,0xc0,0x01,0xba,0x26,0x20,0x2b,0xee,
    0x59,0xac,0x27,0x54,0x84,0xea,0x76,0x7d,0x41,0xd8,0xd3,0x57,
};
static const byte frodokem_hpk_640_SHAKE[] = {
    0x10,0xe6,0x3e,0xfe,0x34,0x0a,0x73,0xd4,0x6d,0x78,0xf7,0x68,
    0xcf,0xea,0x23,0x5d,0x0d,0x7d,0xa1,0xe9,0xc6,0x36,0xd6,0xed,
    0xc3,0x2d,0x2a,0x4e,0xd4,0xb1,0x3c,0xdc,
};
static const byte frodokem_hsk_640_SHAKE[] = {
    0x23,0x3a,0x52,0xe7,0x3b,0xf5,0xf1,0x6d,0xaa,0xd0,0x03,0xdd,
    0x15,0xce,0xa2,0x8e,0x30,0xdb,0xe6,0x42,0x61,0x58,0xbe,0x48,
    0x67,0x95,0x6a,0xff,0x03,0xd1,0x26,0x91,
};
static const byte frodokem_hct_640_SHAKE[] = {
    0x27,0x11,0xc7,0xe8,0x63,0xc9,0xd8,0x1c,0x08,0x18,0x2b,0x3e,
    0xe1,0xe1,0xc9,0x53,0xcb,0xff,0xb1,0x5d,0xd5,0x0b,0xff,0x88,
    0x25,0xc6,0xc2,0xa7,0x1a,0x4f,0xd0,0x1d,
};
static const byte frodokem_ss_640_SHAKE[] = {
    0x2e,0xd4,0x2c,0xe7,0xd5,0xdb,0xfb,0x11,0x5f,0x2e,0x2b,0xdc,
    0xb6,0x50,0xb3,0xfa,
};
#define FKAT_640_SHAKE \
    { WC_FRODOKEM_640_SHAKE, \
      frodokem_kr_640_SHAKE, \
      (word32)sizeof(frodokem_kr_640_SHAKE), \
      frodokem_er_640_SHAKE, \
      (word32)sizeof(frodokem_er_640_SHAKE), \
      frodokem_hpk_640_SHAKE, \
      frodokem_hsk_640_SHAKE, \
      frodokem_hct_640_SHAKE, \
      frodokem_ss_640_SHAKE, \
      (word32)sizeof(frodokem_ss_640_SHAKE) },
#else
#define FKAT_640_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE)
static const byte frodokem_kr_976_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
    0x17,0x50,0x84,0xaa,
};
static const byte frodokem_er_976_SHAKE[] = {
    0xee,0x71,0x67,0x62,0xc1,0x5e,0x3b,0x72,0xaa,0x76,0x50,0xa6,
    0x3b,0x9a,0x51,0x00,0x40,0xb0,0x3c,0x0f,0xe7,0x04,0x75,0xc0,
    0x46,0x3b,0xbc,0x45,0xa0,0xba,0x5b,0x79,0x80,0xdd,0x46,0xee,
    0xf8,0x2f,0xb0,0x62,0x03,0x50,0x77,0xd0,0x42,0xf3,0x06,0xbb,
    0x63,0x91,0x04,0x0e,0x0d,0xd9,0x65,0xf1,0xfd,0xa9,0xd1,0x83,
    0xca,0x9f,0xcc,0xb4,0x8f,0xc0,0x10,0xb1,0x84,0xab,0x00,0x33,
};
static const byte frodokem_hpk_976_SHAKE[] = {
    0x75,0xed,0x58,0xdd,0x9c,0xb2,0x50,0x1a,0xf1,0x3e,0x56,0xbb,
    0xd8,0x57,0x9b,0x73,0x17,0x99,0x8d,0x82,0x8c,0xa2,0x93,0xe3,
    0x98,0x09,0xf4,0x00,0x44,0x04,0xe7,0x89,
};
static const byte frodokem_hsk_976_SHAKE[] = {
    0x2e,0x79,0x47,0x64,0xc6,0xa3,0xe7,0xc1,0xa1,0x6f,0x00,0xa3,
    0xc3,0x45,0x59,0x1f,0xea,0x97,0x7c,0x21,0x3c,0x87,0x32,0xad,
    0x37,0x1a,0xb9,0x60,0x3e,0x5d,0x63,0xa9,
};
static const byte frodokem_hct_976_SHAKE[] = {
    0x6e,0x35,0x8f,0x98,0xcf,0x02,0xec,0xbf,0x38,0xb8,0xdf,0x50,
    0x61,0x49,0x1d,0xec,0x1e,0xae,0x05,0x2e,0xa6,0x80,0x65,0x61,
    0xc3,0xa4,0xaa,0x5e,0xd2,0x15,0xf7,0xa3,
};
static const byte frodokem_ss_976_SHAKE[] = {
    0x5b,0x6e,0x5a,0x69,0xa3,0xd5,0xf8,0xe7,0x5e,0xea,0x3a,0x6e,
    0x95,0x59,0x5e,0xd0,0x27,0x8d,0xa5,0x5b,0x8b,0x37,0x31,0x42,
};
#define FKAT_976_SHAKE \
    { WC_FRODOKEM_976_SHAKE, \
      frodokem_kr_976_SHAKE, \
      (word32)sizeof(frodokem_kr_976_SHAKE), \
      frodokem_er_976_SHAKE, \
      (word32)sizeof(frodokem_er_976_SHAKE), \
      frodokem_hpk_976_SHAKE, \
      frodokem_hsk_976_SHAKE, \
      frodokem_hct_976_SHAKE, \
      frodokem_ss_976_SHAKE, \
      (word32)sizeof(frodokem_ss_976_SHAKE) },
#else
#define FKAT_976_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_SHAKE)
static const byte frodokem_kr_1344_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
    0x17,0x50,0x84,0xaa,0x48,0x8b,0x3b,0x74,0x34,0x06,0x78,0xaa,
    0x38,0xe2,0x2e,0x96,0x28,0xb0,0xa1,0x61,0xfd,0xeb,0x0b,0xd2,
    0x52,0x17,0x3b,0x9c,
};
static const byte frodokem_er_1344_SHAKE[] = {
    0x9f,0x08,0x58,0x76,0x87,0xff,0x66,0x76,0x5c,0x67,0x1d,0xe7,
    0x3e,0x91,0x8d,0x28,0x23,0xca,0x57,0x3f,0xf4,0xe7,0xa3,0x1a,
    0x91,0x60,0x32,0x40,0x26,0xe5,0x40,0xea,0xcb,0x3a,0x04,0xe0,
    0xd5,0x4c,0x75,0xde,0xb9,0x70,0x5b,0xfd,0xfb,0xdf,0x93,0x5a,
    0x75,0x28,0x80,0x2e,0xe6,0xe5,0xb0,0xc6,0xa7,0x3b,0x2b,0x76,
    0x1d,0x9b,0xd0,0x84,0x8a,0x6e,0x4c,0xf3,0xfc,0x4c,0xa8,0x4f,
    0x14,0xe0,0x33,0x1a,0xf3,0x5b,0xfe,0xf4,0x1e,0x42,0xb1,0x3a,
    0x6d,0xae,0x6d,0xf9,0x37,0xf7,0x38,0xc1,0x85,0x7b,0xa1,0xca,
};
static const byte frodokem_hpk_1344_SHAKE[] = {
    0x97,0x4d,0x55,0x14,0xfb,0x13,0x11,0x4b,0xb6,0x67,0x52,0x7e,
    0x84,0x09,0x0b,0x6d,0xe0,0xdf,0xee,0xa0,0x14,0x35,0xc6,0x0a,
    0x3e,0xdc,0x57,0x0d,0x33,0x1a,0x5b,0xd6,
};
static const byte frodokem_hsk_1344_SHAKE[] = {
    0x02,0xd4,0xf7,0x10,0x96,0xb3,0x6f,0x46,0xa9,0x03,0xf7,0x7f,
    0xcc,0x9b,0x77,0x64,0x36,0x6d,0x9a,0x8f,0x84,0xf0,0x6c,0x9f,
    0x86,0xc4,0x64,0xcf,0x69,0x52,0x6d,0x8f,
};
static const byte frodokem_hct_1344_SHAKE[] = {
    0xaa,0x07,0x79,0x97,0x59,0xe8,0x7a,0xd1,0xd0,0x80,0xb2,0xd1,
    0xeb,0x31,0xd1,0x1e,0x3e,0xf9,0x3e,0x66,0x5d,0xf9,0xa8,0xba,
    0xe5,0x02,0x7f,0x4e,0x40,0xfc,0x7a,0x46,
};
static const byte frodokem_ss_1344_SHAKE[] = {
    0x8d,0x20,0xf9,0x71,0x46,0x4d,0xf1,0x9e,0x05,0x61,0xbd,0xd3,
    0x85,0xaf,0xd0,0xe2,0xef,0x0c,0xe2,0x12,0xef,0xd4,0x5a,0x63,
    0x2f,0x5d,0x2c,0x64,0xf3,0xd6,0x6a,0xac,
};
#define FKAT_1344_SHAKE \
    { WC_FRODOKEM_1344_SHAKE, \
      frodokem_kr_1344_SHAKE, \
      (word32)sizeof(frodokem_kr_1344_SHAKE), \
      frodokem_er_1344_SHAKE, \
      (word32)sizeof(frodokem_er_1344_SHAKE), \
      frodokem_hpk_1344_SHAKE, \
      frodokem_hsk_1344_SHAKE, \
      frodokem_hct_1344_SHAKE, \
      frodokem_ss_1344_SHAKE, \
      (word32)sizeof(frodokem_ss_1344_SHAKE) },
#else
#define FKAT_1344_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_AES)
static const byte frodokem_kr_640_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,
};
static const byte frodokem_er_640_AES[] = {
    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
    0x19,0x42,0xec,0xa8,0xf6,0xc0,0x01,0xba,0x26,0x20,0x2b,0xee,
    0x59,0xac,0x27,0x54,0x84,0xea,0x76,0x7d,0x41,0xd8,0xd3,0x57,
};
static const byte frodokem_hpk_640_AES[] = {
    0x44,0x19,0xf4,0xf1,0x4c,0x33,0x63,0x55,0x11,0x86,0xb9,0x93,
    0x82,0xbf,0x3e,0x62,0xac,0x23,0x82,0xb7,0xb5,0xd4,0xca,0x70,
    0x39,0x2d,0xda,0x58,0x69,0xc8,0xbd,0xa1,
};
static const byte frodokem_hsk_640_AES[] = {
    0x1e,0xfb,0x89,0xe5,0xfc,0x52,0xd2,0xbb,0xab,0x4a,0xdb,0xbb,
    0x65,0xda,0xfb,0x49,0x73,0xd8,0xbf,0x09,0x7f,0x86,0x7e,0xf8,
    0x6d,0xbe,0xa2,0xfd,0x51,0xe5,0xe3,0xea,
};
static const byte frodokem_hct_640_AES[] = {
    0x56,0xd2,0xbd,0xd0,0xc6,0xe9,0x2b,0xc3,0x65,0xf2,0x86,0xbe,
    0x75,0x7e,0x46,0xa0,0xe0,0x40,0xc8,0x75,0xef,0x50,0x20,0xbb,
    0xbf,0xab,0xee,0x00,0x28,0x52,0xe7,0xe4,
};
static const byte frodokem_ss_640_AES[] = {
    0xee,0x5b,0xa8,0xce,0xbb,0x0b,0x41,0xe9,0x03,0x0c,0xa1,0xfb,
    0xc3,0xbe,0xad,0xb9,
};
#define FKAT_640_AES \
    { WC_FRODOKEM_640_AES, \
      frodokem_kr_640_AES, \
      (word32)sizeof(frodokem_kr_640_AES), \
      frodokem_er_640_AES, \
      (word32)sizeof(frodokem_er_640_AES), \
      frodokem_hpk_640_AES, \
      frodokem_hsk_640_AES, \
      frodokem_hct_640_AES, \
      frodokem_ss_640_AES, \
      (word32)sizeof(frodokem_ss_640_AES) },
#else
#define FKAT_640_AES
#endif

#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_AES)
static const byte frodokem_kr_976_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
    0x17,0x50,0x84,0xaa,
};
static const byte frodokem_er_976_AES[] = {
    0xee,0x71,0x67,0x62,0xc1,0x5e,0x3b,0x72,0xaa,0x76,0x50,0xa6,
    0x3b,0x9a,0x51,0x00,0x40,0xb0,0x3c,0x0f,0xe7,0x04,0x75,0xc0,
    0x46,0x3b,0xbc,0x45,0xa0,0xba,0x5b,0x79,0x80,0xdd,0x46,0xee,
    0xf8,0x2f,0xb0,0x62,0x03,0x50,0x77,0xd0,0x42,0xf3,0x06,0xbb,
    0x63,0x91,0x04,0x0e,0x0d,0xd9,0x65,0xf1,0xfd,0xa9,0xd1,0x83,
    0xca,0x9f,0xcc,0xb4,0x8f,0xc0,0x10,0xb1,0x84,0xab,0x00,0x33,
};
static const byte frodokem_hpk_976_AES[] = {
    0x47,0x7d,0x38,0x49,0x0e,0x9c,0xf9,0x67,0xdd,0x03,0x8a,0xf6,
    0xb9,0x34,0xd0,0x75,0x12,0x7c,0x0d,0x05,0x15,0x9d,0xe0,0x4f,
    0xc9,0x37,0xb6,0x16,0x5b,0x3d,0xf2,0x1d,
};
static const byte frodokem_hsk_976_AES[] = {
    0x01,0x6e,0xbc,0x6e,0x61,0xcd,0xcf,0x75,0xac,0xf2,0x17,0xe3,
    0x7b,0xc9,0x2c,0xb5,0x57,0x7f,0x61,0xd1,0x4f,0x2c,0x83,0x8b,
    0xd1,0xa2,0x67,0x5a,0x4d,0x34,0x26,0xe8,
};
static const byte frodokem_hct_976_AES[] = {
    0x64,0x1f,0xa3,0x00,0x89,0xd3,0x97,0x82,0x8c,0xa9,0xd1,0xc0,
    0xf2,0x80,0x7b,0xeb,0xe8,0x70,0xa3,0xbd,0xc7,0xdc,0x5b,0xa8,
    0x86,0x6c,0x54,0x3e,0xbf,0x47,0xbc,0x98,
};
static const byte frodokem_ss_976_AES[] = {
    0xd9,0x38,0x8d,0x1b,0x0f,0x97,0xc5,0xdb,0x5f,0x9b,0x4a,0x7e,
    0x99,0x42,0x7c,0xfe,0x90,0xe3,0xe1,0x0c,0x5c,0x56,0x9d,0x02,
};
#define FKAT_976_AES \
    { WC_FRODOKEM_976_AES, \
      frodokem_kr_976_AES, \
      (word32)sizeof(frodokem_kr_976_AES), \
      frodokem_er_976_AES, \
      (word32)sizeof(frodokem_er_976_AES), \
      frodokem_hpk_976_AES, \
      frodokem_hsk_976_AES, \
      frodokem_hct_976_AES, \
      frodokem_ss_976_AES, \
      (word32)sizeof(frodokem_ss_976_AES) },
#else
#define FKAT_976_AES
#endif

#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_AES)
static const byte frodokem_kr_1344_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
    0x17,0x50,0x84,0xaa,0x48,0x8b,0x3b,0x74,0x34,0x06,0x78,0xaa,
    0x38,0xe2,0x2e,0x96,0x28,0xb0,0xa1,0x61,0xfd,0xeb,0x0b,0xd2,
    0x52,0x17,0x3b,0x9c,
};
static const byte frodokem_er_1344_AES[] = {
    0x9f,0x08,0x58,0x76,0x87,0xff,0x66,0x76,0x5c,0x67,0x1d,0xe7,
    0x3e,0x91,0x8d,0x28,0x23,0xca,0x57,0x3f,0xf4,0xe7,0xa3,0x1a,
    0x91,0x60,0x32,0x40,0x26,0xe5,0x40,0xea,0xcb,0x3a,0x04,0xe0,
    0xd5,0x4c,0x75,0xde,0xb9,0x70,0x5b,0xfd,0xfb,0xdf,0x93,0x5a,
    0x75,0x28,0x80,0x2e,0xe6,0xe5,0xb0,0xc6,0xa7,0x3b,0x2b,0x76,
    0x1d,0x9b,0xd0,0x84,0x8a,0x6e,0x4c,0xf3,0xfc,0x4c,0xa8,0x4f,
    0x14,0xe0,0x33,0x1a,0xf3,0x5b,0xfe,0xf4,0x1e,0x42,0xb1,0x3a,
    0x6d,0xae,0x6d,0xf9,0x37,0xf7,0x38,0xc1,0x85,0x7b,0xa1,0xca,
};
static const byte frodokem_hpk_1344_AES[] = {
    0xe2,0x83,0xbf,0xd5,0x9b,0xcc,0xa4,0xda,0x53,0x80,0xbc,0xa9,
    0xe4,0x3c,0x0d,0xfc,0xc3,0xb3,0xb2,0xb4,0xd3,0xf3,0xa0,0x2c,
    0x64,0x2e,0x0d,0x43,0x92,0x03,0xee,0x81,
};
static const byte frodokem_hsk_1344_AES[] = {
    0xee,0x4a,0x33,0x60,0x94,0x5b,0x71,0x8f,0xb1,0x04,0x74,0xe9,
    0xc6,0x64,0xe2,0xc3,0x9b,0xd7,0x7d,0xfd,0x6b,0xfe,0xba,0x73,
    0x3c,0x10,0xd2,0x69,0x50,0xf4,0x62,0xce,
};
static const byte frodokem_hct_1344_AES[] = {
    0x4a,0x37,0x7d,0xba,0x12,0xe3,0x78,0xeb,0x9a,0x82,0x32,0x02,
    0x81,0xc9,0xe8,0x61,0x08,0xd8,0x31,0xb2,0xde,0xba,0xe1,0xe1,
    0x9c,0xc5,0x19,0x5f,0xe8,0x6d,0x73,0x20,
};
static const byte frodokem_ss_1344_AES[] = {
    0x37,0x69,0x55,0x16,0x12,0x73,0xfc,0x66,0x7f,0x3f,0xea,0xe5,
    0xec,0x98,0x68,0x18,0x20,0xdb,0xd7,0x59,0x97,0x1b,0xb0,0xa2,
    0xd2,0xbe,0xc4,0x51,0x0f,0x55,0x7e,0x83,
};
#define FKAT_1344_AES \
    { WC_FRODOKEM_1344_AES, \
      frodokem_kr_1344_AES, \
      (word32)sizeof(frodokem_kr_1344_AES), \
      frodokem_er_1344_AES, \
      (word32)sizeof(frodokem_er_1344_AES), \
      frodokem_hpk_1344_AES, \
      frodokem_hsk_1344_AES, \
      frodokem_hct_1344_AES, \
      frodokem_ss_1344_AES, \
      (word32)sizeof(frodokem_ss_1344_AES) },
#else
#define FKAT_1344_AES
#endif

#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E640_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
};
static const byte frodokem_er_E640_SHAKE[] = {
    0x33,0xb3,0xc0,0x75,0x07,0xe4,0x20,0x17,0x48,0x49,0x4d,0x83,
    0x2b,0x6e,0xe2,0xa6,
};
static const byte frodokem_hpk_E640_SHAKE[] = {
    0x49,0xa3,0x03,0x46,0x0f,0x09,0x77,0x33,0x9c,0xbd,0x2c,0x1b,
    0x5a,0xa0,0xe7,0xaf,0x44,0xc5,0x02,0x49,0x17,0xf5,0xf7,0xac,
    0xed,0x47,0x25,0xe9,0xd4,0xa2,0xc6,0x14,
};
static const byte frodokem_hsk_E640_SHAKE[] = {
    0x85,0xd0,0xe3,0x16,0x3f,0x8c,0xae,0xbe,0xe1,0xb5,0x48,0x37,
    0xa4,0x70,0xe6,0xb0,0x49,0x83,0x78,0x4e,0x3c,0x3d,0x2b,0x2f,
    0x03,0x6b,0x7f,0x95,0x87,0x55,0x08,0xaa,
};
static const byte frodokem_hct_E640_SHAKE[] = {
    0x88,0xba,0x53,0x7b,0x53,0x6d,0x89,0xfd,0x0b,0x84,0xf8,0x60,
    0x4a,0x60,0x40,0xa9,0xdd,0x96,0x11,0x4e,0xe6,0xad,0x43,0x23,
    0x5c,0x95,0x1e,0xdf,0x42,0x6c,0x68,0x0d,
};
static const byte frodokem_ss_E640_SHAKE[] = {
    0x72,0x97,0x80,0xfc,0x51,0x65,0x7e,0x21,0x35,0x7f,0x03,0xa3,
    0x38,0x11,0x65,0x69,
};
#define FKAT_E640_SHAKE \
    { WC_EFRODOKEM_640_SHAKE, \
      frodokem_kr_E640_SHAKE, \
      (word32)sizeof(frodokem_kr_E640_SHAKE), \
      frodokem_er_E640_SHAKE, \
      (word32)sizeof(frodokem_er_E640_SHAKE), \
      frodokem_hpk_E640_SHAKE, \
      frodokem_hsk_E640_SHAKE, \
      frodokem_hct_E640_SHAKE, \
      frodokem_ss_E640_SHAKE, \
      (word32)sizeof(frodokem_ss_E640_SHAKE) },
#else
#define FKAT_E640_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E976_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,
};
static const byte frodokem_er_E976_SHAKE[] = {
    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
};
static const byte frodokem_hpk_E976_SHAKE[] = {
    0x94,0x9c,0xe7,0x6a,0xae,0x38,0xde,0xcd,0x41,0xe2,0x32,0x06,
    0x23,0x62,0xad,0xb8,0x92,0x46,0xba,0xce,0xfe,0x22,0x1f,0x80,
    0x32,0x5d,0x45,0x49,0x02,0x63,0x1c,0xe4,
};
static const byte frodokem_hsk_E976_SHAKE[] = {
    0x3d,0x5a,0x3a,0x15,0x0f,0xee,0xd6,0x4a,0x86,0x1f,0x7e,0x87,
    0xd4,0xee,0x83,0xb1,0x35,0xc8,0xb1,0xbe,0x43,0x9e,0x14,0x21,
    0xc4,0x19,0xbf,0x86,0xac,0x15,0xdc,0x50,
};
static const byte frodokem_hct_E976_SHAKE[] = {
    0xdf,0x84,0x22,0xbf,0xda,0xe4,0xe3,0x13,0x55,0x22,0x54,0xd4,
    0xc2,0x91,0xeb,0x17,0xf0,0xc6,0x0d,0x5c,0x46,0x01,0x3a,0x26,
    0x79,0x21,0x45,0xa4,0xc4,0x6f,0x4b,0x0e,
};
static const byte frodokem_ss_E976_SHAKE[] = {
    0xa9,0x81,0x65,0x53,0x9a,0x4a,0xad,0x97,0x90,0x23,0xd6,0x7b,
    0x43,0x5d,0x31,0x6f,0x00,0x7c,0x86,0xee,0xaf,0xdb,0x63,0xc7,
};
#define FKAT_E976_SHAKE \
    { WC_EFRODOKEM_976_SHAKE, \
      frodokem_kr_E976_SHAKE, \
      (word32)sizeof(frodokem_kr_E976_SHAKE), \
      frodokem_er_E976_SHAKE, \
      (word32)sizeof(frodokem_er_E976_SHAKE), \
      frodokem_hpk_E976_SHAKE, \
      frodokem_hsk_E976_SHAKE, \
      frodokem_hct_E976_SHAKE, \
      frodokem_ss_E976_SHAKE, \
      (word32)sizeof(frodokem_ss_E976_SHAKE) },
#else
#define FKAT_E976_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E1344_SHAKE[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,
};
static const byte frodokem_er_E1344_SHAKE[] = {
    0x8b,0xf0,0xf4,0x59,0xf0,0xfb,0x3e,0xa8,0xd3,0x27,0x64,0xc2,
    0x59,0xae,0x63,0x11,0x78,0x97,0x6b,0xaf,0x36,0x83,0xd3,0x33,
    0x83,0x18,0x8a,0x65,0xa4,0xc2,0x44,0x9b,
};
static const byte frodokem_hpk_E1344_SHAKE[] = {
    0x45,0x4d,0x55,0x2f,0x3c,0x25,0xaa,0xf0,0xe5,0xac,0xc1,0xa4,
    0xfc,0x43,0x10,0x98,0xb9,0x0c,0xe3,0x99,0x3e,0x86,0x42,0x68,
    0xa2,0x79,0x5a,0xe7,0xff,0x3c,0xe5,0xca,
};
static const byte frodokem_hsk_E1344_SHAKE[] = {
    0xbe,0x73,0xb2,0x19,0x69,0x05,0x4a,0x4f,0xd4,0x45,0x25,0x08,
    0x23,0xbe,0xd8,0xec,0x91,0xe6,0xa2,0x52,0x1b,0xce,0x0a,0xd0,
    0x97,0x49,0xdd,0x1e,0x6c,0xb8,0xd6,0x6f,
};
static const byte frodokem_hct_E1344_SHAKE[] = {
    0x2c,0x76,0xc5,0x40,0xee,0xba,0x95,0x1c,0x7e,0x16,0x68,0x99,
    0x3d,0x13,0xa3,0xe3,0xcc,0xfd,0xc8,0xbc,0xba,0x29,0x44,0x68,
    0x54,0x80,0xc2,0xb8,0x82,0x50,0xcc,0xf9,
};
static const byte frodokem_ss_E1344_SHAKE[] = {
    0x6d,0x69,0xdf,0x1a,0x90,0x96,0x8e,0xab,0xad,0xa6,0x9c,0xd3,
    0x0e,0xc6,0x81,0x3a,0x44,0x06,0x30,0x9d,0xac,0x17,0x44,0x29,
    0xa0,0x12,0x08,0x52,0xbf,0x82,0x64,0x60,
};
#define FKAT_E1344_SHAKE \
    { WC_EFRODOKEM_1344_SHAKE, \
      frodokem_kr_E1344_SHAKE, \
      (word32)sizeof(frodokem_kr_E1344_SHAKE), \
      frodokem_er_E1344_SHAKE, \
      (word32)sizeof(frodokem_er_E1344_SHAKE), \
      frodokem_hpk_E1344_SHAKE, \
      frodokem_hsk_E1344_SHAKE, \
      frodokem_hct_E1344_SHAKE, \
      frodokem_ss_E1344_SHAKE, \
      (word32)sizeof(frodokem_ss_E1344_SHAKE) },
#else
#define FKAT_E1344_SHAKE
#endif

#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_AES) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E640_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
};
static const byte frodokem_er_E640_AES[] = {
    0x33,0xb3,0xc0,0x75,0x07,0xe4,0x20,0x17,0x48,0x49,0x4d,0x83,
    0x2b,0x6e,0xe2,0xa6,
};
static const byte frodokem_hpk_E640_AES[] = {
    0x3d,0x9e,0xc6,0x83,0x5b,0x6e,0x15,0xd8,0x15,0xc2,0xf8,0x45,
    0x48,0x42,0x79,0xa7,0xcc,0x4b,0xf3,0xcc,0xc7,0x7d,0x00,0x29,
    0xd3,0xb6,0x95,0x47,0x34,0x19,0xf3,0x29,
};
static const byte frodokem_hsk_E640_AES[] = {
    0x80,0x96,0xbd,0x18,0x6c,0xf9,0x9d,0xfa,0x98,0x9a,0x78,0xe2,
    0x95,0xe9,0x58,0xcc,0x83,0x39,0xaf,0x24,0x5d,0x7b,0xe3,0x8d,
    0x88,0x70,0x4f,0x32,0x9a,0x00,0xba,0x66,
};
static const byte frodokem_hct_E640_AES[] = {
    0xa2,0xdb,0xb4,0xa4,0xbc,0x4b,0x72,0x92,0xf3,0x68,0xe7,0x1a,
    0x34,0x51,0xad,0x8d,0xcd,0x10,0x12,0x32,0x68,0x0c,0x24,0xa6,
    0x92,0xcc,0xe8,0xca,0xd4,0x03,0x48,0xea,
};
static const byte frodokem_ss_E640_AES[] = {
    0x9f,0x54,0x37,0x7d,0x45,0x20,0x90,0xf3,0x63,0x1e,0x45,0xb9,
    0x39,0x9a,0x28,0x92,
};
#define FKAT_E640_AES \
    { WC_EFRODOKEM_640_AES, \
      frodokem_kr_E640_AES, \
      (word32)sizeof(frodokem_kr_E640_AES), \
      frodokem_er_E640_AES, \
      (word32)sizeof(frodokem_er_E640_AES), \
      frodokem_hpk_E640_AES, \
      frodokem_hsk_E640_AES, \
      frodokem_hct_E640_AES, \
      frodokem_ss_E640_AES, \
      (word32)sizeof(frodokem_ss_E640_AES) },
#else
#define FKAT_E640_AES
#endif

#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_AES) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E976_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,
};
static const byte frodokem_er_E976_AES[] = {
    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
};
static const byte frodokem_hpk_E976_AES[] = {
    0xc6,0xc9,0x25,0x07,0xc1,0xf4,0x8c,0x20,0x89,0x76,0x8d,0xe0,
    0x14,0x22,0xa5,0x9c,0x2b,0xb8,0x5c,0xe5,0x6e,0x09,0x56,0x5c,
    0x5f,0x07,0xa9,0x0f,0x84,0x9c,0x45,0xc0,
};
static const byte frodokem_hsk_E976_AES[] = {
    0x07,0x74,0x6e,0x26,0x0b,0x4c,0x11,0x01,0x15,0x58,0xa9,0xb5,
    0x5e,0x1c,0x27,0xa3,0x76,0x0a,0x3b,0x98,0x0e,0x76,0xab,0x22,
    0x19,0xaf,0x01,0x85,0x41,0xff,0x00,0x45,
};
static const byte frodokem_hct_E976_AES[] = {
    0x16,0x05,0x08,0xa0,0xd9,0x3e,0x28,0xcd,0xd7,0xd7,0xf3,0xac,
    0x31,0x66,0x79,0x20,0x4e,0x24,0xf7,0x7d,0x57,0x1d,0x6d,0x31,
    0x8f,0x41,0x41,0xf2,0x51,0x87,0xfd,0xc2,
};
static const byte frodokem_ss_E976_AES[] = {
    0x59,0x4d,0xe8,0x44,0x73,0xb3,0x40,0x8e,0x35,0xf6,0xc4,0xd1,
    0xf2,0xf2,0xec,0x3b,0x56,0xd2,0xdd,0xa9,0x6f,0xa2,0x34,0x96,
};
#define FKAT_E976_AES \
    { WC_EFRODOKEM_976_AES, \
      frodokem_kr_E976_AES, \
      (word32)sizeof(frodokem_kr_E976_AES), \
      frodokem_er_E976_AES, \
      (word32)sizeof(frodokem_er_E976_AES), \
      frodokem_hpk_E976_AES, \
      frodokem_hsk_E976_AES, \
      frodokem_hct_E976_AES, \
      frodokem_ss_E976_AES, \
      (word32)sizeof(frodokem_ss_E976_AES) },
#else
#define FKAT_E976_AES
#endif

#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_AES) && \
    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
static const byte frodokem_kr_E1344_AES[] = {
    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,
};
static const byte frodokem_er_E1344_AES[] = {
    0x8b,0xf0,0xf4,0x59,0xf0,0xfb,0x3e,0xa8,0xd3,0x27,0x64,0xc2,
    0x59,0xae,0x63,0x11,0x78,0x97,0x6b,0xaf,0x36,0x83,0xd3,0x33,
    0x83,0x18,0x8a,0x65,0xa4,0xc2,0x44,0x9b,
};
static const byte frodokem_hpk_E1344_AES[] = {
    0xf4,0xc8,0x3f,0xd6,0xbd,0xbd,0xd1,0x49,0x30,0x7f,0x72,0xd6,
    0x7b,0xdd,0x83,0xaa,0x49,0xcd,0xa6,0xde,0xa6,0x9b,0xf3,0x64,
    0xe7,0xef,0x27,0x76,0xc3,0xb7,0x21,0xff,
};
static const byte frodokem_hsk_E1344_AES[] = {
    0xe4,0x99,0x44,0x64,0x5a,0xa1,0x19,0xb7,0x53,0xe1,0xdd,0x48,
    0x68,0xb4,0x19,0xc4,0x21,0xe9,0x04,0x61,0xde,0x23,0xbb,0xdc,
    0xd5,0x5e,0xa2,0x8c,0xa8,0xd1,0x59,0xf9,
};
static const byte frodokem_hct_E1344_AES[] = {
    0x25,0x27,0xe2,0xb6,0x22,0xec,0xa7,0x6d,0xc8,0xea,0x48,0x9d,
    0x51,0x6c,0x68,0x5c,0x4c,0x67,0x75,0x11,0x27,0xfd,0x3f,0x49,
    0x25,0xc6,0x91,0x55,0x60,0xe9,0xe8,0x43,
};
static const byte frodokem_ss_E1344_AES[] = {
    0xb2,0x43,0xfe,0x6d,0x7c,0x9b,0x38,0x29,0x25,0x2d,0x5a,0xec,
    0x09,0x0a,0x47,0x09,0xf5,0xe3,0x96,0xfd,0xef,0xe4,0xef,0x1a,
    0xa4,0xae,0x6c,0x94,0x98,0xcb,0xce,0x15,
};
#define FKAT_E1344_AES \
    { WC_EFRODOKEM_1344_AES, \
      frodokem_kr_E1344_AES, \
      (word32)sizeof(frodokem_kr_E1344_AES), \
      frodokem_er_E1344_AES, \
      (word32)sizeof(frodokem_er_E1344_AES), \
      frodokem_hpk_E1344_AES, \
      frodokem_hsk_E1344_AES, \
      frodokem_hct_E1344_AES, \
      frodokem_ss_E1344_AES, \
      (word32)sizeof(frodokem_ss_E1344_AES) },
#else
#define FKAT_E1344_AES
#endif


/* One known-answer entry per compiled parameter set / variant. */
typedef struct FrodoKemKat {
    int type;
    const byte* kr;
    word32 krLen;
    const byte* er;
    word32 erLen;
    const byte* hpk;
    const byte* hsk;
    const byte* hct;
    const byte* ss;
    word32 ssLen;
} FrodoKemKat;

static const FrodoKemKat frodokem_kats[] = {
    FKAT_640_SHAKE FKAT_976_SHAKE FKAT_1344_SHAKE
    FKAT_640_AES FKAT_976_AES FKAT_1344_AES
    FKAT_E640_SHAKE FKAT_E976_SHAKE FKAT_E1344_SHAKE
    FKAT_E640_AES FKAT_E976_AES FKAT_E1344_AES
    { 0 } /* sentinel so the array is never empty */
};

#define FRODOKEM_KAT_CNT \
    ((int)(sizeof(frodokem_kats) / sizeof(frodokem_kats[0])) - 1)

#endif /* !NO_SHA256 && !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
#endif /* WOLFSSL_HAVE_FRODOKEM */

/* KAT: key generation. Regenerate each key from fixed randomness and check the
 * encoded public and private keys against the expected SHA-256 digests. */
int test_wc_frodokem_make_key_kats(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
    int i;
    FrodoKemKey* key = NULL;
    byte* buf = NULL;
    byte hash[WC_SHA256_DIGEST_SIZE];
    word32 pkLen = 0;
    word32 skLen = 0;

    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    buf = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(buf);

    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
        const FrodoKemKat* k = &frodokem_kats[i];

        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
            (int)k->krLen), 0);

        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, buf, pkLen), 0);
        ExpectIntEQ(wc_Sha256Hash(buf, pkLen, hash), 0);
        ExpectIntEQ(XMEMCMP(hash, k->hpk, WC_SHA256_DIGEST_SIZE), 0);

        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, buf, skLen), 0);
        ExpectIntEQ(wc_Sha256Hash(buf, skLen, hash), 0);
        ExpectIntEQ(XMEMCMP(hash, k->hsk, WC_SHA256_DIGEST_SIZE), 0);

        wc_FrodoKemKey_Free(key);
    }

    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* KAT: encapsulation. Recreate the key, encapsulate with fixed randomness and
 * check the ciphertext digest and shared secret against expected values. */
int test_wc_frodokem_encapsulate_kats(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    byte* ct = NULL;
    byte hash[WC_SHA256_DIGEST_SIZE];
    byte ss[FRODOKEM_MAX_LENSEC];
    word32 ctLen = 0;
    word32 ssLen = 0;

    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);

    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
        const FrodoKemKat* k = &frodokem_kats[i];

        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
            (int)k->krLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);

        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, k->er,
            (int)k->erLen), 0);
        ExpectIntEQ(wc_Sha256Hash(ct, ctLen, hash), 0);
        ExpectIntEQ(XMEMCMP(hash, k->hct, WC_SHA256_DIGEST_SIZE), 0);
        ExpectIntEQ(XMEMCMP(ss, k->ss, ssLen), 0);

        wc_FrodoKemKey_Free(key);
    }

    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* key is freed at the bottom of each loop iteration; on the 0-iteration
     * allocation-failure path it was never initialised, so only the backing
     * memory is released here. */
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* KAT: decapsulation. Recreate the key and ciphertext, decapsulate and check
 * the recovered shared secret against the expected value. */
int test_wc_frodokem_decapsulate_kats(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    word32 ctLen = 0;
    word32 ssLen = 0;

    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);

    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
        const FrodoKemKat* k = &frodokem_kats[i];

        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
            (int)k->krLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, k->er,
            (int)k->erLen), 0);

        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ssDec, k->ss, ssLen), 0);

        wc_FrodoKemKey_Free(key);
    }

    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* key is freed at the bottom of each loop iteration; on the 0-iteration
     * allocation-failure path it was never initialised, so only the backing
     * memory is released here. */
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Full RNG-based round trip for every compiled variant: the decapsulated
 * shared secret must equal the encapsulated one.
 *
 * This loop, together with test_wc_frodokem_encode_decode() below, is what
 * exercises frodokem_gen_noise()'s (wc_frodokem_mat.c) two matrix-method
 * decisions:
 *   if (p->useShake256 && ((ret = wc_InitShake256(...)) == 0))
 *   if ((!p->useShake256) && ((ret = wc_InitShake128(...)) == 0))
 * p->useShake256 is a per-parameter-set constant (0 for FrodoKEM-640, 1 for
 * FrodoKEM-976/-1344) set independently of the SHAKE-vs-AES matrix-A
 * generation method, so frodokem_types[] - every compiled base parameter set
 * crossed with every compiled matrix method - drives the first operand of
 * both decisions to both true and false.
 *
 * MC/DC residual: each decision's second operand (the Init call succeeding)
 * cannot be driven false through the public API - that requires the
 * underlying SHAKE Init to fail, which needs fault injection, not reachable
 * input. */
int test_wc_frodokem_roundtrip(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    WC_RNG rng;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    word32 ctLen = 0;
    word32 ssLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* key is freed at the bottom of each loop iteration; on the 0-iteration
     * allocation-failure path it was never initialised, so only the backing
     * memory is released here. */
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Encode then decode the public and private keys and confirm the decoded key
 * pair still produces matching shared secrets. */
int test_wc_frodokem_encode_decode(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    FrodoKemKey* pubKey = NULL;
    FrodoKemKey* privKey = NULL;
    WC_RNG rng;
    byte* pkBuf = NULL;
    byte* skBuf = NULL;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    word32 pkLen = 0;
    word32 skLen = 0;
    word32 ctLen = 0;
    word32 ssLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    pubKey = (FrodoKemKey*)XMALLOC(sizeof(*pubKey), NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(pubKey);
    privKey = (FrodoKemKey*)XMALLOC(sizeof(*privKey), NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(privKey);
    pkBuf = (byte*)XMALLOC(FRODOKEM_MAX_PUBLIC_KEY_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(pkBuf);
    skBuf = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(skBuf);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        int type = frodokem_types[i];

        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_Init(pubKey, type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_Init(privKey, type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);

        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, pkBuf, pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, skBuf, skLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(pubKey, pkBuf, pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(privKey, skBuf, skLen), 0);

        /* Encapsulate to the decoded public key, decapsulate with the decoded
         * private key. */
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(pubKey, ct, ss, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(privKey, ssDec, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);

        wc_FrodoKemKey_Free(privKey);
        wc_FrodoKemKey_Free(pubKey);
        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(skBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(pkBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* The three keys are freed at the bottom of each loop iteration; on the
     * 0-iteration allocation-failure path they were never initialised, so only
     * the backing memory is released here. */
    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* A modified ciphertext must decapsulate (implicit rejection) to a shared
 * secret different from the one produced for the valid ciphertext. */
int test_wc_frodokem_decap_implicit_reject(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    WC_RNG rng;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    byte ssDec2[FRODOKEM_MAX_LENSEC];
    byte exp[FRODOKEM_MAX_LENSEC];
    wc_Shake sh;
    word32 ctLen = 0;
    word32 ssLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    XMEMSET(&sh, 0, sizeof(sh));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    /* Every compiled variant: a modified ciphertext must decapsulate to an
     * implicit-rejection secret, deterministically. */
    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
        /* Flip a bit in the ciphertext. */
        if (EXPECT_SUCCESS()) {
            ct[0] ^= 0xff;
        }
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
        ExpectIntNE(XMEMCMP(ss, ssDec, ssLen), 0);
        /* Implicit rejection is deterministic: decapsulating the same modified
         * ciphertext again yields the same shared secret (the SHAKE(c' || s)
         * value), not uninitialized/garbage data. */
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec2, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ssDec, ssDec2, ssLen), 0);
        /* Isolate the implicit-rejection property: the rejected secret must be
         * SHAKE(c1 || c2 || salt || s) over the STORED rejection secret s (not
         * k'). Recompute it (640 hashes with SHAKE128, 976/1344 with SHAKE256)
         * and confirm it matches - a select that used k' would not. */
        if ((frodokem_types[i] & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
            ExpectIntEQ(wc_InitShake128(&sh, NULL, INVALID_DEVID), 0);
            ExpectIntEQ(wc_Shake128_Update(&sh, ct, ctLen), 0);
            ExpectIntEQ(wc_Shake128_Update(&sh, key->s, ssLen), 0);
            ExpectIntEQ(wc_Shake128_Final(&sh, exp, ssLen), 0);
            wc_Shake128_Free(&sh);
        }
        else {
            ExpectIntEQ(wc_InitShake256(&sh, NULL, INVALID_DEVID), 0);
            ExpectIntEQ(wc_Shake256_Update(&sh, ct, ctLen), 0);
            ExpectIntEQ(wc_Shake256_Update(&sh, key->s, ssLen), 0);
            ExpectIntEQ(wc_Shake256_Final(&sh, exp, ssLen), 0);
            wc_Shake256_Free(&sh);
        }
        ExpectIntEQ(XMEMCMP(ssDec, exp, ssLen), 0);
        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* key is freed at the bottom of each loop iteration; on the 0-iteration
     * allocation-failure path it was never initialised, so only the backing
     * memory is released here. */
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Decapsulating with a public-key-only object must fail. */
int test_wc_frodokem_decapsulate_pubonly_fails(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    FrodoKemKey* pubKey = NULL;
    WC_RNG rng;
    byte* pkBuf = NULL;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    word32 pkLen = 0;
    word32 ctLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    pubKey = (FrodoKemKey*)XMALLOC(sizeof(*pubKey), NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(pubKey);
    pkBuf = (byte*)XMALLOC(FRODOKEM_MAX_PUBLIC_KEY_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(pkBuf);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    /* Every compiled variant: a public-key-only object cannot decapsulate. */
    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_Init(pubKey, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, pkBuf, pkLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(pubKey, pkBuf, pkLen), 0);
        /* Public-key-only object cannot decapsulate. */
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(pubKey, ssDec, ct, ctLen),
            WC_NO_ERR_TRACE(BAD_STATE_E));
        wc_FrodoKemKey_Free(pubKey);
        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(pkBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* A private key whose embedded public-key hash does not match the public key
 * must be rejected by decode. */
int test_wc_frodokem_decode_privkey_bad_pkh(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
    int i;
    FrodoKemKey* key = NULL;
    WC_RNG rng;
    byte* sk = NULL;
    word32 skLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    sk = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(sk);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    /* Every compiled variant: a corrupted embedded pkh is rejected. */
    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, sk, skLen), 0);

        /* A correctly encoded private key decodes. */
        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, sk, skLen), 0);

        /* Corrupt the stored public-key hash (the final lenSec bytes). */
        if (EXPECT_SUCCESS()) {
            sk[skLen - 1] ^= 0xff;
        }
        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, sk, skLen),
            WC_NO_ERR_TRACE(WC_KEY_MISMATCH_E));
        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(sk, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Bad-argument and bad-length handling. */
int test_wc_frodokem_bad_args(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM)
    FrodoKemKey* key = NULL;
    word32 len = 0;
    word32 pkLen = 0;
    word32 skLen = 0;
    int type = frodokem_types[0];
    byte small[8];
#ifndef WC_NO_RNG
    WC_RNG rng;

    /* Only used as a non-NULL WC_RNG* below; the paths exercised with it
     * return BAD_FUNC_ARG before the rng is ever dereferenced, so it does not
     * need to be initialized with wc_InitRng(). */
    XMEMSET(&rng, 0, sizeof(rng));
#endif

    XMEMSET(small, 0, sizeof(small));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);

    /* Constructor / destructor NULL handling. */
#ifndef WC_NO_CONSTRUCTORS
    ExpectIntEQ(wc_FrodoKemKey_Delete(NULL, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#endif
    ExpectIntEQ(wc_FrodoKemKey_Free(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));

    /* Init argument checks: NULL key, unknown type bits. */
    ExpectIntEQ(wc_FrodoKemKey_Init(NULL, type, NULL, INVALID_DEVID),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_Init(key, -1, NULL, INVALID_DEVID),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));

    /* Size queries reject NULL key and NULL output. */
    ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(NULL, &len),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(NULL, &len),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(NULL, &len),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(NULL, &len),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));

    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);

    /* Make key argument and length checks. */
#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(NULL, small, 0),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, NULL, 0),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, small, 1),
        WC_NO_ERR_TRACE(BUFFER_E));
#ifndef WC_NO_RNG
    ExpectIntEQ(wc_FrodoKemKey_MakeKey(NULL, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#endif
#endif /* !WOLFSSL_FRODOKEM_NO_MAKE_KEY */

    /* Encapsulate argument checks. */
#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
#ifndef WC_NO_RNG
    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(NULL, small, small, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#endif
    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(NULL, small, small,
        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    /* NULL ct / ss / rand are rejected independently of key state. */
    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, NULL, small,
        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, NULL,
        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, small,
        NULL, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#ifndef WC_NO_RNG
    /* Encapsulate rejects a NULL rng in isolation (ct and ss valid). */
    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, small, small, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    /* NULL ct / ss are rejected independently of each other (key and rng
     * valid): wc_FrodoKemKey_Encapsulate()'s
     * (key == NULL) || (ct == NULL) || (ss == NULL) || (rng == NULL) check. */
    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, NULL, small, &rng),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, small, NULL, &rng),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#endif
    /* Encapsulate on a key with no public key set reports bad state. */
    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, small,
        small, 0), WC_NO_ERR_TRACE(BAD_STATE_E));
#endif /* !WOLFSSL_FRODOKEM_NO_ENCAPSULATE */

    /* Decapsulate argument checks. */
#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(NULL, small, small, 0),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    /* NULL ss / ct are rejected independently of key state and length. */
    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, NULL, small, 0),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, small, NULL, 0),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#endif

    /* Encode / decode NULL handling. */
    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(NULL, small, pkLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, NULL, pkLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(NULL, small, skLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, NULL, skLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(NULL, small, pkLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(key, NULL, pkLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(NULL, small, skLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, NULL, skLen),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));

    /* Encoding before any key material is set must report bad state. The
     * wc_FrodoKemKey_EncodePrivateKey() call below drives
     * ((flags & FRODOKEM_FLAG_BOTH_SET) != FRODOKEM_FLAG_BOTH_SET) true with
     * flags == 0 (key only Init'd).
     *
     * MC/DC residual: the decision's second operand,
     * ((flags & FRODOKEM_FLAG_PKH_SET) == 0), cannot be independently toggled
     * through the public API while the first operand is held false. Every
     * place that assigns key->flags sets it to exactly one of three values -
     * 0 (Init, or a failed DecodePrivateKey), FRODOKEM_FLAG_PUB_SET alone
     * (DecodePublicKey), or FRODOKEM_FLAG_PRIV_SET | PUB_SET | PKH_SET
     * together (MakeKey, or a successful DecodePrivateKey) - and for all
     * three, ((flags & BOTH_SET) != BOTH_SET) and ((flags & PKH_SET) == 0)
     * always agree (both true for the first two, both false for the third).
     * There is no reachable state with BOTH_SET satisfied but PKH_SET clear,
     * so the second operand's independence pair cannot be constructed without
     * poking key->flags directly. */
    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, small, pkLen),
        WC_NO_ERR_TRACE(BAD_STATE_E));
    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, small, skLen),
        WC_NO_ERR_TRACE(BAD_STATE_E));

    /* Wrong encoded lengths on decode must report a buffer error. */
    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(key, small, pkLen - 1),
        WC_NO_ERR_TRACE(BUFFER_E));
    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, small, skLen - 1),
        WC_NO_ERR_TRACE(BUFFER_E));

    wc_FrodoKemKey_Free(key);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Encapsulate and decapsulate length checks on a fully made key. */
int test_wc_frodokem_op_len_checks(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    FrodoKemKey* key = NULL;
    WC_RNG rng;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte rnd[8];
    word32 ctLen = 0;
    int rngInit = 0;
    int i = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    XMEMSET(rnd, 0, sizeof(rnd));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    /* Repeat for every compiled variant: the bad-length thresholds differ
     * across the parameter sets and the standard/ephemeral split (encapsulate
     * checks lenSec + lenSalt, decapsulate checks ctSize), so a single variant
     * would not exercise them all. */
    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
            INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);

        /* Encapsulate with the wrong random length reports a buffer error (the
         * public key is set, so this reaches the length check, not bad
         * state). */
        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, rnd, 1),
            WC_NO_ERR_TRACE(BUFFER_E));
        /* Decapsulate with the wrong ciphertext length reports a buffer
         * error. */
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ss, ct, ctLen - 1),
            WC_NO_ERR_TRACE(BUFFER_E));

        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    /* key is freed at the bottom of each loop iteration; on the 0-iteration
     * allocation-failure path it was never initialised, so only the backing
     * memory is released here. */
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Constructor and destructor happy path. */
int test_wc_frodokem_new_delete(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_CONSTRUCTORS)
    FrodoKemKey* key = NULL;
    word32 pkLen = 0;

    /* New allocates and initializes the object. */
    key = wc_FrodoKemKey_New(frodokem_types[0], NULL, INVALID_DEVID);
    ExpectNotNull(key);
    /* Initialized: a size query on it succeeds and returns a non-zero size. */
    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
    ExpectIntGT(pkLen, 0);
    /* Delete frees the object and clears the caller's pointer. */
    ExpectIntEQ(wc_FrodoKemKey_Delete(key, &key), 0);
    ExpectNull(key);
#endif
    return EXPECT_RESULT();
}

/* A validly-formed type whose parameter set or A-generation method is not
 * compiled in must report NOT_COMPILED_IN (an ill-formed type is
 * BAD_FUNC_ARG). The compiled-variant list is the source of truth, so this
 * exercises the not-compiled path in single-variant / method-restricted builds
 * and is a self-consistent no-op when every variant is enabled. */
int test_wc_frodokem_not_compiled_in(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM)
    /* All twelve validly-formed variant types. These are bit combinations,
     * always defined regardless of what is compiled in. */
    static const int allTypes[] = {
        WC_FRODOKEM_640_SHAKE, WC_FRODOKEM_976_SHAKE, WC_FRODOKEM_1344_SHAKE,
        WC_FRODOKEM_640_AES, WC_FRODOKEM_976_AES, WC_FRODOKEM_1344_AES,
        WC_EFRODOKEM_640_SHAKE, WC_EFRODOKEM_976_SHAKE, WC_EFRODOKEM_1344_SHAKE,
        WC_EFRODOKEM_640_AES, WC_EFRODOKEM_976_AES, WC_EFRODOKEM_1344_AES
    };
    FrodoKemKey* key = NULL;
    int i, j, compiled;

    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);

    for (i = 0; (i < (int)(sizeof(allTypes) / sizeof(allTypes[0]))) &&
            EXPECT_SUCCESS(); i++) {
        /* Is this type one of the compiled-in variants? */
        compiled = 0;
        for (j = 0; j < FRODOKEM_TYPE_CNT; j++) {
            if (frodokem_types[j] == allTypes[i]) {
                compiled = 1;
                break;
            }
        }
        if (compiled) {
            /* A compiled variant initializes. */
            ExpectIntEQ(wc_FrodoKemKey_Init(key, allTypes[i], NULL,
                INVALID_DEVID), 0);
            wc_FrodoKemKey_Free(key);
        }
        else {
            /* A valid but not-compiled variant reports NOT_COMPILED_IN. */
            ExpectIntEQ(wc_FrodoKemKey_Init(key, allTypes[i], NULL,
                INVALID_DEVID), WC_NO_ERR_TRACE(NOT_COMPILED_IN));
        }
    }

    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* ASN.1 round trip: encode the public key as a SubjectPublicKeyInfo and the
 * private key as a PKCS#8 OneAsymmetricKey, decode each back into a fresh key
 * object (auto-detecting the type from the OID) and confirm the decoded keys
 * still produce matching shared secrets. The 640 parameter sets have no
 * standardised OID, so their encoding must be rejected. */
int test_wc_frodokem_asn1(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    defined(WC_ENABLE_ASYM_KEY_EXPORT) && \
    defined(WC_ENABLE_ASYM_KEY_IMPORT) && !defined(WC_NO_RNG) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
    int i;
    FrodoKemKey* key = NULL;
    int key_inited = 0;
    FrodoKemKey* key2 = NULL;
    int key2_inited = 0;
    WC_RNG rng;
    byte* der = NULL;
    byte* ct = NULL;
    byte ss[FRODOKEM_MAX_LENSEC];
    byte ssDec[FRODOKEM_MAX_LENSEC];
    int derLen = 0;
    word32 idx = 0;
    word32 ctLen = 0;
    word32 ssLen = 0;
    int rngInit = 0;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    key2 = (FrodoKemKey*)XMALLOC(sizeof(*key2), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key2);
    der = (byte*)XMALLOC(FRODOKEM_MAX_PRV_KEY_DER_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(der);
    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
        DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(ct);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        int type = frodokem_types[i];

        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
        if (EXPECT_SUCCESS())
            key_inited = 1;
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);

        if ((type & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
            /* 640 has no standardised OID: encoding must be rejected. */
            ExpectIntEQ(wc_FrodoKemKey_PublicKeyToDer(key, der,
                FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1),
                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
            ExpectIntEQ(wc_FrodoKemKey_PrivateKeyToDer(key, der,
                FRODOKEM_MAX_PRV_KEY_DER_SIZE),
                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
            if (key_inited) {
                wc_FrodoKemKey_Free(key);
                key_inited = 0;
            }
            continue;
        }

        /* Public key: SubjectPublicKeyInfo round trip (auto-detect type). */
        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
            FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
        XMEMSET(key2, 0, sizeof(*key2));
        key2->devId = INVALID_DEVID;
        idx = 0;
        ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key2, der, (word32)derLen,
            &idx), 0);
        if (EXPECT_SUCCESS())
            key2_inited = 1;
        ExpectIntEQ(key2->type, type);
        /* Encapsulate to the decoded public key; original decapsulates. */
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key2, ct, ss, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
        if (key2_inited) {
            wc_FrodoKemKey_Free(key2);
            key2_inited = 0;
        }

        /* Private key: PKCS#8 round trip; decoded key can decapsulate. */
        ExpectIntGT((derLen = wc_FrodoKemKey_PrivateKeyToDer(key, der,
            FRODOKEM_MAX_PRV_KEY_DER_SIZE)), 0);
        XMEMSET(key2, 0, sizeof(*key2));
        key2->devId = INVALID_DEVID;
        idx = 0;
        ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key2, der, (word32)derLen,
            &idx), 0);
        if (EXPECT_SUCCESS())
            key2_inited = 1;
        ExpectIntEQ(key2->type, type);
        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key2, ssDec, ct, ctLen), 0);
        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
        if (key2_inited) {
            wc_FrodoKemKey_Free(key2);
            key2_inited = 0;
        }

        /* Strict validation: decoding this key's DER into a key that was
         * initialized as a DIFFERENT variant must be rejected. */
        {
            int j;
            int other = -1;

            for (j = 0; j < FRODOKEM_TYPE_CNT; j++) {
                if ((frodokem_types[j] != type) &&
                        ((frodokem_types[j] & FRODOKEM_BASE_MASK) !=
                            WC_FRODOKEM_640)) {
                    other = frodokem_types[j];
                    break;
                }
            }
            if (other != -1) {
                ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
                    FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
                ExpectIntEQ(wc_FrodoKemKey_Init(key2, other, NULL,
                    INVALID_DEVID), 0);
                if (EXPECT_SUCCESS())
                    key2_inited = 1;
                idx = 0;
                ExpectIntNE(wc_FrodoKemKey_PublicKeyDecode(key2, der,
                    (word32)derLen, &idx), 0);
                if (key2_inited) {
                    wc_FrodoKemKey_Free(key2);
                    key2_inited = 0;
                }
            }
        }

        /* A truncated/corrupted DER must be rejected, not over-read. */
        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
            FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
        XMEMSET(key2, 0, sizeof(*key2));
        key2->devId = INVALID_DEVID;
        idx = 0;
        ExpectIntNE(wc_FrodoKemKey_PublicKeyDecode(key2, der,
            (word32)derLen / 2, &idx), 0);
        if (key_inited) {
            wc_FrodoKemKey_Free(key);
            key_inited = 0;
        }
    }

    /* NULL-argument checks. */
    idx = 0;
    ExpectIntEQ(wc_FrodoKemKey_PublicKeyToDer(NULL, der, 16, 1),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyToDer(NULL, der, 16),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    /* wc_FrodoKemKey_PublicKeyDecode()'s
     * (key == NULL) || (input == NULL) || (inOutIdx == NULL) check: each
     * operand driven true independently (key is a valid, if unusable,
     * object here - the NULL check short-circuits before it is
     * dereferenced). */
    ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(NULL, der, 16, &idx),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key, NULL, 16, &idx),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key, der, 16, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    /* Same check, same reasoning, in wc_FrodoKemKey_PrivateKeyDecode(). */
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(NULL, der, 16, &idx),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key, NULL, 16, &idx),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key, der, 16, NULL),
        WC_NO_ERR_TRACE(BAD_FUNC_ARG));

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Key-file I/O: a FrodoKEM key flows through the generic PUBLIC KEY / PKCS#8
 * PRIVATE KEY PEM containers (DER->PEM->DER round trip), and wc_GetKeyOID
 * recognizes a FrodoKEM private-key DER. */
int test_wc_frodokem_key_pem(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    defined(WC_ENABLE_ASYM_KEY_EXPORT) && \
    defined(WC_ENABLE_ASYM_KEY_IMPORT) && \
    defined(WOLFSSL_DER_TO_PEM) && defined(WOLFSSL_PEM_TO_DER) && \
    (defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)) && \
    !defined(WC_NO_RNG) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
    int i;
    FrodoKemKey* key = NULL;
    FrodoKemKey* key2 = NULL;
    WC_RNG rng;
    byte* der = NULL;
    byte* der2 = NULL;
    byte* pem = NULL;
    int rngInit = 0;
    int derLen;
    int der2Len;
    int pemLen;
    word32 idx;
    const word32 dersz = FRODOKEM_MAX_PRV_KEY_DER_SIZE;
    const word32 pemsz = FRODOKEM_MAX_PRV_KEY_DER_SIZE * 2;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    key2 = (FrodoKemKey*)XMALLOC(sizeof(*key2), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key2);
    der = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(der);
    der2 = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(der2);
    pem = (byte*)XMALLOC(pemsz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(pem);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
        int type = frodokem_types[i];

        if ((type & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
            continue;
        }

        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);

        /* Public key: DER -> PEM (PUBLIC KEY) -> DER -> decode. */
        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der, dersz,
            1)), 0);
        ExpectIntGT((pemLen = wc_DerToPem(der, (word32)derLen, pem, pemsz,
            PUBLICKEY_TYPE)), 0);
        ExpectIntGT((der2Len = wc_PubKeyPemToDer(pem, pemLen, der2, dersz)), 0);
        ExpectIntEQ(der2Len, derLen);
        ExpectIntEQ(XMEMCMP(der, der2, (size_t)derLen), 0);
        XMEMSET(key2, 0, sizeof(*key2));
        key2->devId = INVALID_DEVID;
        idx = 0;
        ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key2, der2,
            (word32)der2Len, &idx), 0);
        ExpectIntEQ(key2->type, type);
        wc_FrodoKemKey_Free(key2);

        /* Private key: PKCS#8 PEM round trip. */
        ExpectIntGT((derLen = wc_FrodoKemKey_PrivateKeyToDer(key, der,
            dersz)), 0);
        ExpectIntGT((pemLen = wc_DerToPem(der, (word32)derLen, pem, pemsz,
            PKCS8_PRIVATEKEY_TYPE)), 0);
        ExpectIntGT((der2Len = wc_KeyPemToDer(pem, pemLen, der2, dersz,
            "")), 0);
        XMEMSET(key2, 0, sizeof(*key2));
        key2->devId = INVALID_DEVID;
        idx = 0;
        ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key2, der2,
            (word32)der2Len, &idx), 0);
        ExpectIntEQ(key2->type, type);
        wc_FrodoKemKey_Free(key2);

        wc_FrodoKemKey_Free(key);
    }

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(der2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* X.509: build a certificate carrying a FrodoKEM subject public key (signed by
 * an ECC issuer key, since a KEM cannot self-sign), then parse it back and
 * confirm the FrodoKEM subject key is recognized. */
int test_wc_frodokem_x509(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
    !defined(WOLF_CRYPTO_CB_ONLY_FRODOKEM) && \
    defined(WOLFSSL_CERT_GEN) && defined(WOLFSSL_ASN_TEMPLATE) && \
    defined(HAVE_ECC) && \
    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
    !defined(NO_SHA256) && !defined(WC_NO_RNG) && \
    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
    FrodoKemKey* key = NULL;
    ecc_key* caKey = NULL;
    WC_RNG rng;
    Cert* cert = NULL;
    DecodedCert* dc = NULL;
    byte* der = NULL;
    int rngInit = 0;
    int bodySz = 0;
    int derSz = 0;
    const word32 dersz = FRODOKEM_MAX_PUB_KEY_DER_SIZE + 4096;

    XMEMSET(&rng, 0, sizeof(rng));
    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(key);
    caKey = (ecc_key*)XMALLOC(sizeof(*caKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(caKey);
    cert = (Cert*)XMALLOC(sizeof(*cert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(cert);
    dc = (DecodedCert*)XMALLOC(sizeof(*dc), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(dc);
    der = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(der);
    ExpectIntEQ(wc_InitRng(&rng), 0);
    if (EXPECT_SUCCESS()) {
        rngInit = 1;
    }

    /* Subject FrodoKEM key pair and issuer ECC signing key. */
    ExpectIntEQ(wc_FrodoKemKey_Init(key, WC_FRODOKEM_976_SHAKE, NULL,
        INVALID_DEVID), 0);
    ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
    ExpectIntEQ(wc_ecc_init(caKey), 0);
    ExpectIntEQ(wc_ecc_make_key(&rng, 32, caKey), 0);

    /* Build the certificate body carrying the FrodoKEM public key. */
    ExpectIntEQ(wc_InitCert(cert), 0);
    if (EXPECT_SUCCESS()) {
        XMEMCPY(cert->subject.country, "US", 3);
        XMEMCPY(cert->subject.commonName, "FrodoKEM Test", 14);
        cert->sigType = CTC_SHA256wECDSA;
        cert->selfSigned = 1;
    }
    /* Subject Key Identifier derived from the FrodoKEM public key. */
#ifdef WOLFSSL_CERT_EXT
    ExpectIntEQ(wc_SetSubjectKeyIdFromPublicKey_ex(cert, FRODOKEM_TYPE, key),
        0);
#endif
    ExpectIntGT((bodySz = wc_MakeCert_ex(cert, der, dersz, FRODOKEM_TYPE,
        key, &rng)), 0);
    /* Sign with the ECC issuer key (a KEM cannot produce signatures). */
    ExpectIntGT((derSz = wc_SignCert(bodySz, CTC_SHA256wECDSA, der, dersz,
        NULL, caKey, &rng)), 0);

    /* Parse the certificate and confirm the FrodoKEM subject key. */
    if (EXPECT_SUCCESS()) {
        wc_InitDecodedCert(dc, der, (word32)derSz, NULL);
        ExpectIntEQ(wc_ParseCert(dc, CERT_TYPE, NO_VERIFY, NULL), 0);
        ExpectIntEQ((int)dc->keyOID, FRODOKEM_976_SHAKEk);
        ExpectIntGT(dc->pubKeySize, 0);
        wc_FreeDecodedCert(dc);
    }

    /* Certificate request (PKCS#10) carrying the FrodoKEM public key. A KEM
     * cannot self-sign, so the request is signed with the ECC key. */
#ifdef WOLFSSL_CERT_REQ
    ExpectIntEQ(wc_InitCert(cert), 0);
    if (EXPECT_SUCCESS()) {
        XMEMCPY(cert->subject.country, "US", 3);
        XMEMCPY(cert->subject.commonName, "FrodoKEM CSR", 13);
        cert->sigType = CTC_SHA256wECDSA;
        cert->version = 0;   /* PKCS#10 (RFC 2986) requires version 0 */
    }
    ExpectIntGT((bodySz = wc_MakeCertReq_ex(cert, der, dersz, FRODOKEM_TYPE,
        key)), 0);
    ExpectIntGT((derSz = wc_SignCert(bodySz, CTC_SHA256wECDSA, der, dersz,
        NULL, caKey, &rng)), 0);
    if (EXPECT_SUCCESS()) {
        wc_InitDecodedCert(dc, der, (word32)derSz, NULL);
        ExpectIntEQ(wc_ParseCert(dc, CERTREQ_TYPE, NO_VERIFY, NULL), 0);
        ExpectIntEQ((int)dc->keyOID, FRODOKEM_976_SHAKEk);
        wc_FreeDecodedCert(dc);
    }
#endif

    if (rngInit) {
        DoExpectIntEQ(wc_FreeRng(&rng), 0);
    }
    wc_ecc_free(caKey);
    wc_FrodoKemKey_Free(key);
    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(dc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(caKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Parse the committed FrodoKEM certificate and CSR fixtures from
 * certs/frodokem/ and confirm the FrodoKEM subject key is recognized. */
int test_wc_frodokem_cert_file(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
    defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC) && \
    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_WC_FRODOKEM_1344) && \
    defined(WOLFSSL_FRODOKEM_SHAKE) && !defined(NO_FILESYSTEM)
    static const struct {
        const char* file;
        int type;
        int keySum;
    } fixtures[] = {
        { "./certs/frodokem/frodokem976-cert.der",  CERT_TYPE,
          FRODOKEM_976_SHAKEk },
        { "./certs/frodokem/frodokem976-req.der",   CERTREQ_TYPE,
          FRODOKEM_976_SHAKEk },
        { "./certs/frodokem/frodokem1344-cert.der", CERT_TYPE,
          FRODOKEM_1344_SHAKEk },
        { "./certs/frodokem/frodokem1344-req.der",  CERTREQ_TYPE,
          FRODOKEM_1344_SHAKEk }
    };
    byte* buf = NULL;
    DecodedCert* dc = NULL;
    XFILE f;
    size_t n;
    int i;

    buf = (byte*)XMALLOC(24000, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(buf);
    dc = (DecodedCert*)XMALLOC(sizeof(*dc), NULL, DYNAMIC_TYPE_TMP_BUFFER);
    ExpectNotNull(dc);

    for (i = 0; (i < (int)(sizeof(fixtures) / sizeof(fixtures[0]))) &&
            EXPECT_SUCCESS(); i++) {
        n = 0;
        if ((f = XFOPEN(fixtures[i].file, "rb")) != XBADFILE) {
            n = XFREAD(buf, 1, 24000, f);
            XFCLOSE(f);
        }
        ExpectIntGT((int)n, 0);
        if (EXPECT_SUCCESS()) {
            wc_InitDecodedCert(dc, buf, (word32)n, NULL);
            ExpectIntEQ(wc_ParseCert(dc, fixtures[i].type, NO_VERIFY, NULL), 0);
            ExpectIntEQ((int)dc->keyOID, fixtures[i].keySum);
            wc_FreeDecodedCert(dc);
        }
    }

    XFREE(dc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
    return EXPECT_RESULT();
}

/* Verify the committed FrodoKEM leaf certificates chain to the committed ECC
 * issuer certificate (exercises the full parse + signature-verify path). */
int test_wc_frodokem_cert_verify(void)
{
    EXPECT_DECLS;
#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
    defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC) && \
    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_WC_FRODOKEM_1344) && \
    defined(WOLFSSL_FRODOKEM_SHAKE) && !defined(NO_FILESYSTEM) && \
    !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)
    WOLFSSL_CERT_MANAGER* cm = NULL;

    ExpectNotNull(cm = wolfSSL_CertManagerNew());
    ExpectIntEQ(wolfSSL_CertManagerLoadCA(cm,
        "./certs/frodokem/frodokem-ca-ecc-cert.pem", NULL), WOLFSSL_SUCCESS);
    ExpectIntEQ(wolfSSL_CertManagerVerify(cm,
        "./certs/frodokem/frodokem976-cert.pem", WOLFSSL_FILETYPE_PEM),
        WOLFSSL_SUCCESS);
    ExpectIntEQ(wolfSSL_CertManagerVerify(cm,
        "./certs/frodokem/frodokem1344-cert.pem", WOLFSSL_FILETYPE_PEM),
        WOLFSSL_SUCCESS);
    wolfSSL_CertManagerFree(cm);
#endif
    return EXPECT_RESULT();
}