Fix compiling when WOLFSSH_NO_NISTP256_MLKEM768_SHA256 is defined.

[tjko]

See #886

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

Pull request overview

Fixes a compile-time guard so KEXKEM message IDs remain available when only one of the ML-KEM768 SHA256 KEX variants is enabled (e.g., NIST P-256 disabled but Curve25519 still enabled), addressing build failures reported in #886.

Changes:

• Update #ifndef WOLFSSH_NO_NISTP256_MLKEM768_SHA256 to a combined preprocessor condition that accounts for both NISTP256 and Curve25519 ML-KEM768 SHA256 KEX options.
• Apply the same guard update for both MSGID_KEXKEM_INIT and MSGID_KEXKEM_REPLY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tjko]

Btw, seems like this check should also include WOLFSSH_NO_NISTP384_MLKEM1024_SHA384?

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[ejohnstown]

Could you remove the two guard checks and then squash the PR?

[Frauschi]

Thank you for the fix!

[ejohnstown]

This uncovered another bug. I have a fix for it. I'll need to get it merged before this.

[tjko]

This uncovered another bug. I have a fix for it. I'll need to get it merged before this.

I think I ran into that same issue (?) when trying to only have "mlkem768x25519-sha256" support enabled:

1969-12-31 16:00:16 [DEBUG] Decoding MSGID_KEXDH_INIT
1969-12-31 16:00:16 [DEBUG] Entering SendKexDhReply()
1969-12-31 16:00:16 [DEBUG] Using Ed25519 Host key
1969-12-31 16:00:16 [DEBUG] Entering KeyAgreeEcdhMlKem_server()
1969-12-31 16:00:17 [DEBUG] Leaving KeyAgreeEcdhMlKem_server(), ret = 0
1969-12-31 16:00:17 [DEBUG] Entering SignHEd25519()
1969-12-31 16:00:17 [DEBUG] Leaving SignHEd25519(), ret = 0
1969-12-31 16:00:17 [ERROR] cannot use FIPS KDF with ML-KEM

(update: looks like #889 fixes the issue I noticed)