Release Summary:

Adds pure ML-KEM-1024 support: s2n_pure_mlkem_1024 KEM group is now negotiable.

Resolved issues:

Partially addresses #5152

Description of changes:

This is the 2nd part of adding pure ML-KEM support following #5468. This PR updates the handshake key share functions (sending & receiving) to enable pure ML-KEM negotiation. Changes overview:

1. Modify the hybrid-PQ key share functions in s2n_client_key_share.c and s2n_server_key_share.c to skip the ECC path for pure ML-KEM groups (i.e. using the placeholder curve s2n_ecc_curve_none).
2. Rename the hybrid-PQ functions, variables, and comments involved in these two files to match pure ML-KEM.
3. Remove or skip some checks for ecc_params.negotiated_curve and ecc_params.evp_pkey because pure ML-KEM groups don't contain an ECC curve.
4. Add s2n_pure_mlkem_1024 to ALL_SUPPORTED_KEM_GROUPS which is used by the test_all policy.
5. Define a pure ML-KEM test policy, which will fall back to ECC if ML-KEM is not supported, and run the TLS 1.3 PQ handshake test.
6. Skip the length-prefixed format tests for pure ML-KEM in s2n_server_key_share_extension_test and s2n_client_key_share_extension_pq_test.

Call-outs:

I discussed the length-prefixed PQ key share issue with Alex. The prefixed format is only used by TLS 1.2 and Draft 0 of TLS 1.3 (See Alex's previous PR). Since pure ML-KEM is added in later versions, it should always use the un-prefixed format.

Moreover, all of the length prefixing logic for PQ should eventually be removed from s2n-tls. It was only used in draft standards, and we have only promised customers to support PQ draft standards (i.e. tls13_pq_hybrid_draft_revision < 5) until end of 2025.

This will impact two unit tests that explicitly test prefixed PQ key shares: s2n_server_key_share_extension_test and s2n_client_key_share_extension_pq_test. I skipped the length-prefixed tests for pure ML-KEM as a workaround. This can be removed as we clean up the length-prefixed format for PQ and overhaul these unit tests.

Testing:

• I added a PQ handshake unit test for pure_mlkem1024_test_policy that only negotiates s2n_pure_mlkem_1024. It will fall back to the default ECC curve if the libcrypto does not support ML-KEM.
• Additionally, s2n_pure_mlkem_1024 is added to ALL_SUPPORTED_KEM_GROUPS; hence pure ML-KEM will run in all the unit tests using ALL_SUPPORTED_KEM_GROUPS.
• I also wrote a rust integration test with OpenSSL 3.5 and it passed.
• s2n_connection_size_test failed in the CI FreeBSD job: s2n_connection size (4368) no longer in (3924, 4360). Increase the max limit to 4400.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.