Add ML-DSA support

[Frauschi]

This PR adds ML-DSA signature support.

The following operations are supported:

• Key generation (new mechanism CKM_ML_DSA_KEY_PAIR_GEN for the existing C_GenerateKeyPair() method)
• Signature generation (new mechanisms CKM_ML_DSA and CKM_HASH_ML_DSA for the existing C_SignInit() and C_Sign() methods)
• Signature verification (same new mechanisms for C_VerifyInit() and C_Verify())
• Key import (via C_CreateObject())

Furthermore, the new key type CKK_ML_DSA has been added to support ML-DSA object handling.

Both the pure and pre-hash versions of ML-DSA are supported. For that, the new structures CK_SIGN_ADDITIONAL_CONTEXT and CK_HASH_SIGN_ADDITIONAL_CONTEXT are available to pass the optional context as well as the used hash function (in case of the pre-hash version). Not yet supported are the pre-hash versions that also offload the hashing onto the token.

To enable the functionality, use --enable-mldsa for autoconf and WOLFPKCS11_MLDSA for CMake. As ML-DSA is strictly a new PKCS#11 version 3.2 feature, we ensure that this is also enabled when ML-DSA is enabled (although only v2.40 interfaces are used currently).

The new functionality is also tested in the unit tests.

[Copilot]

Pull request overview

This PR adds comprehensive ML-DSA (Module-Lattice-Based Digital Signature Algorithm) signature support to wolfPKCS11 as a PKCS#11 v3.2 feature. ML-DSA is a post-quantum cryptographic signature scheme standardized by NIST.

Changes:

• Adds ML-DSA key generation, signing, verification, and import operations via new mechanisms (CKM_ML_DSA_KEY_PAIR_GEN, CKM_ML_DSA, CKM_HASH_ML_DSA)
• Implements new key type CKK_ML_DSA with support for three security levels (ML-DSA-44, ML-DSA-65, ML-DSA-87)
• Adds comprehensive test coverage for ML-DSA operations including key generation, storage, and sign/verify with both pure and pre-hash variants

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
wolfpkcs11/store.h	Adds storage type constants for ML-DSA private and public keys
wolfpkcs11/pkcs11.h	Defines ML-DSA key types, mechanisms, attributes, and parameter structures
wolfpkcs11/internal.h	Adds ML-DSA function declarations and includes dilithium header
tests/pkcs11v3test.c	Comprehensive ML-DSA test suite covering key generation, import, storage, and sign/verify
src/slot.c	Registers ML-DSA mechanisms and provides mechanism info
src/internal.c	Core ML-DSA implementation including key encoding/decoding, storage, and cryptographic operations
src/crypto.c	Integrates ML-DSA into PKCS#11 API functions (C_SignInit, C_Sign, C_VerifyInit, C_Verify, C_GenerateKeyPair, C_CreateObject)
configure.ac	Adds --enable-mldsa option with SHA3 dependency checking
CMakeLists.txt	Adds WOLFPKCS11_MLDSA build option
cmake/options.h.in	Defines WOLFPKCS11_MLDSA configuration macro
.github/workflows/*.yml	Updates CI workflows to test ML-DSA build configurations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JacobBarthelmeh]

Nice catch, this looks like it was the wrong macro guard before.

[JacobBarthelmeh]

Please add comments at the top of this function like the others. i.e expected return values and inputs.

[Frauschi]

Added

[Frauschi]

Incorporated the review feedback.

[Frauschi]

I think the failing Alpine tests are unrelated to this PR