Goal

Removes any reference that Kyber ever existed from s2n-tls's codebase.

Why

1. Kyber was a draft standard that predates MLKEM.
2. AWS-LC about to delete their Kyber implementation code.
3. Now that MLKEM is standardized and supported everywhere that Kyber was previously supported, we no longer need Kyber, and can delete any references to it.

How

• Did a bunch of grep -ni kyber -r . in the s2n-tls directory and deleted everything I could find.
• Where it was trivial, tests were updated in place to use MLKEM. Otherwise Kyber tests were deleted entirely.
• PQ TLS Policies that only had Kyber (and did not have MLKEM) were deleted and marked as deprecated.
• PQ TLS Policies that contained both MLKEM and Kyber, were updated in place to have Kyber removed from the bottom of the preference list.
• All references or usages of LibOQS is removed (since it was only used to test Kyber interoperability)

Callouts

1. There is still a lot of dead PQ TLS 1.2 code paths that are never used. Those still need to be removed eventually.
2. This PR deletes the s2n TLS Policy 20240730 which was previously pointed to by default_pq. I don't think that will cause any issues, but wanted to call that out for others to confirm.
3. test_all_fips was updated to add all MLKEM KeyShares since kem_preferences_all is now FIPS compliant.
4. Updated crypto/s2n_fips_rules.c so that pure ML-KEM-1024 would be detected as FIPS.
5. Note: As a rule of thumb, any PQ TLS Policy with the year "2023" or earlier in the name only contained Kyber and is now deprecated. PQ TLS Policies with the year "2024" or newer in the name contained both MLKEM and Kyber and are still supported by s2n (just with Kyber support removed).

Testing

Unit Testing on M4 Mac.

Related

Related to:

• Remove dependencies on Kyber #5699
• chore: Mark Kyber as unsupported on all LibCrypto variants #5701
• Remove PQ TLS 1.2 from all Security Policies #5194
• Remove PQ TLS 1.2 Support #4991

release summary: Delete all code that references Kyber

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.