Put libcrux-ml-kem behind default feature gate

Author: ctz

.github/workflows/build.yml

@@ -56,6 +56,8 @@ jobs:
         run: cargo build -p graviola
       - name: Run tests (debug)
         run: cargo test
+      - name: Run tests (debug, --no-default-features)
+        run: cargo test --no-default-features
 
       - name: Build (release)
         run: cargo build -p graviola --release

rustls-graviola/Cargo.toml

@@ -11,7 +11,7 @@ readme = "README.md"
 
 [dependencies]
 graviola = { version = "0.3.0", path = "../graviola" }
-libcrux-ml-kem = { version = "0.0.6", default-features = false, features = ["mlkem768", "alloc"] }
+libcrux-ml-kem = { version = "0.0.6", default-features = false, features = ["mlkem768", "alloc"], optional = true }
 rustls = { version = "0.23.18", default-features = false, features = ["std", "tls12"] }
 
 [dev-dependencies]
@@ -24,3 +24,7 @@ hyper-util = { version = "0.1", default-features = false, features = ["server-au
 rustls = { version = "0.23.23", default-features = false, features = ["aws-lc-rs", "ring"] }
 tokio = { version = "1.0", features = ["io-std", "macros", "net", "rt-multi-thread"] }
 tokio-rustls = { version = "0.26", default-features = false }
+
+[features]
+default = ["libcrux-ml-kem"]
+libcrux-ml-kem = ["dep:libcrux-ml-kem"]

rustls-graviola/src/kx.rs

@@ -1,13 +1,16 @@
 use crypto::SupportedKxGroup;
 use graviola::key_agreement::{p256, p384, x25519};
+use rustls::crypto;
 use rustls::ffdhe_groups::FfdheGroup;
-use rustls::{NamedGroup, crypto};
 
+#[cfg(feature = "libcrux-ml-kem")]
 mod hybrid;
+#[cfg(feature = "libcrux-ml-kem")]
 mod mlkem;
 
 /// All key exchange algorithms, in order of preference.
 pub static ALL_KX_GROUPS: &[&dyn SupportedKxGroup] = &[
+    #[cfg(feature = "libcrux-ml-kem")]
     X25519MLKEM768,
     &X25519 as &dyn SupportedKxGroup,
     &P256 as &dyn SupportedKxGroup,
@@ -177,6 +180,7 @@ impl crypto::ActiveKeyExchange for ActiveP384 {
     }
 }
 
+#[cfg(feature = "libcrux-ml-kem")]
 pub static X25519MLKEM768: &dyn SupportedKxGroup = &hybrid::Hybrid {
     classical: &X25519,
     post_quantum: &mlkem::MlKem768,
@@ -186,11 +190,12 @@ pub static X25519MLKEM768: &dyn SupportedKxGroup = &hybrid::Hybrid {
         post_quantum_client_share_len: mlkem::MlKem768::ENCAPS_LEN,
         post_quantum_server_share_len: mlkem::MlKem768::CIPHERTEXT_LEN,
     },
-    name: NamedGroup::X25519MLKEM768,
+    name: rustls::NamedGroup::X25519MLKEM768,
 };
 
 #[cfg(test)]
 mod tests {
+    use rustls::NamedGroup;
     use rustls::ProtocolVersion;
 
     use super::*;

rustls-graviola/tests/pair.rs

@@ -58,6 +58,7 @@ fn all_suites() {
 #[test]
 fn all_key_exchanges() {
     // X25519MLKEM768 not supported by *ring*
+    #[cfg(feature = "libcrux-ml-kem")]
     for other in [OtherProvider::BaselineAwsLcRs, OtherProvider::SelfTest] {
         test_key_exchange(rustls_graviola::kx::X25519MLKEM768, other, KeyType::Rsa2048);
     }