wolfSSL · JacobBarthelmeh · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
@@ -199,7 +199,6 @@ CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
 CONFIG_WOLFSSL_CHACHA_POLY
 CONFIG_WOLFSSL_CRYPTO_CB
-CONFIG_WOLFSSL_CRYPTO_ONLY
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_DTLS
 CONFIG_WOLFSSL_ECC
@@ -768,10 +767,8 @@ USS_API
 VLT_TLS_NO_ECDH
 W64LIT_FORCE_LONG_LONG
 WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
-WC_AES_BS_WORD_SIZE
 WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH
 WC_AES_GCM_DEC_AUTH_EARLY
-WC_ALLOW_ECC_ZERO_HASH
 WC_ASN_HASH_SHA256
 WC_ASN_RUNTIME_DATE_CHECK_CONTROL
 WC_ASYNC_ENABLE_ECC_KEYGEN
@@ -800,8 +797,6 @@ WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS
 WC_CACHE_RESISTANT_BASE64_TABLE
 WC_DISABLE_RADIX_ZERO_PAD
 WC_DRBG_BANKREF
-WC_FIPS_AESGCM_NO_SHORT_NONCES
-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED
 WC_FIPS_ED25519CTX_NOT_APPROVED
 WC_FLAG_DONT_USE_AESNI
 WC_FORCE_LINUXKM_FORTIFY_SOURCE
@@ -812,22 +807,20 @@ WC_INIT_ERROR_WHEN_CONTENDED
 WC_LINUXKM_NO_ENTROPY_DAEMON
 WC_LINUXKM_NO_USE_HEAP_WRAPPERS
 WC_LINUXKM_SPIN_IN_ATOMIC
-WC_LINUXKM_SVR_NO_BATCHING
 WC_MLDSA_NO_ASM
 WC_MLKEM_KERNEL_ASM
-WC_NOISE_SRC_MAX
 WC_NO_ASYNC_SLEEP
 WC_NO_RNG_SIMPLE
 WC_NO_STATIC_ASSERT
 WC_NO_VERBOSE_RNG
 WC_PKCS11_FIND_WITH_ID_ONLY
 WC_PKCS12_PBKDF_USING_MP_API
-WC_PROTECT_ENCRYPTED_MEM
 WC_PUF_HELPER_COMPACT
 WC_PUF_SHA3
 WC_RNG_BANK_NO_DAEMON_SUPPORT
 WC_RNG_BANK_NO_DEFAULT_SUPPORT
 WC_RNG_BLOCKING
+WC_RNG_NO_BANKREF_SUPPORT
 WC_RNG_NO_FREE_HOOK
 WC_RNG_NO_LOCK
 WC_RNG_NO_LOCK_FULL_MUTEX
@@ -861,7 +854,6 @@ WC_STM32_SAES_DIAG
 WC_STRICT_SIG
 WC_SVR_DONT_USE_NATIVE_REG_BUFS
 WC_SVR_PR_EMERG_ON_ACCEL_FALLBACK
-WC_USE_PIE_FENCEPOSTS_FOR_FIPS
 WC_WANT_FLAG_DONT_USE_VECTOR_OPS
 WIFIESPAT
 WIFI_101
@@ -896,7 +888,6 @@ WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
 WOLFSSL_ARM_ARCH_NEON_64BIT
 WOLFSSL_ASCON_UNROLL
 WOLFSSL_ASN_EXTRA
-WOLFSSL_ASN_TEMPLATE_TYPE_CHECK
 WOLFSSL_ATECC508
 WOLFSSL_ATECC508A_NOSOFTECC
 WOLFSSL_ATECC508A_TLS
@@ -914,39 +905,19 @@ WOLFSSL_BIO_NO_FLOW_STATS
 WOLFSSL_BUILD_MSG_NO_ZERO_COPY
 WOLFSSL_BYTESWAP32_ASM
 WOLFSSL_C2000_AES
-WOLFSSL_C2000_AES_BASE
 WOLFSSL_C2000_AES_NO_LOCK
-WOLFSSL_C2000_AES_SS_BASE
-WOLFSSL_C2000_DEVID
 WOLFSSL_C2000_ENTROPY
-WOLFSSL_C2000_ENTROPY_APT_CUTOFF
-WOLFSSL_C2000_ENTROPY_APT_WINDOW
-WOLFSSL_C2000_ENTROPY_HMIN
-WOLFSSL_C2000_ENTROPY_MARGIN
-WOLFSSL_C2000_ENTROPY_NO_CLK_INIT
 WOLFSSL_C2000_ENTROPY_NO_LOCK
-WOLFSSL_C2000_ENTROPY_NUM_SRC
-WOLFSSL_C2000_ENTROPY_RCT_CUTOFF
-WOLFSSL_C2000_ENTROPY_REF_CLK
-WOLFSSL_C2000_ENTROPY_SRC0_CLK
-WOLFSSL_C2000_ENTROPY_SRC0_DCC
-WOLFSSL_C2000_ENTROPY_SRC1_CLK
-WOLFSSL_C2000_ENTROPY_SRC1_DCC
-WOLFSSL_C2000_ENTROPY_STARTUP_OCTETS
-WOLFSSL_C2000_ENTROPY_WINDOW
 WOLFSSL_CAAM_BLACK_KEY_AESCCM
 WOLFSSL_CAAM_BLACK_KEY_SM
 WOLFSSL_CAAM_NO_BLACK_KEY
 WOLFSSL_CALLBACKS
 WOLFSSL_CHACHA20_AVX512_ALWAYS
 WOLFSSL_CHACHA20_AVX512_NEVER
-WOLFSSL_CHACHA20_POLY1305_FUSED
 WOLFSSL_CHACHA20_POLY1305_FUSED_ALWAYS
-WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA
 WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_ALWAYS
 WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_NEVER
 WOLFSSL_CHACHA20_POLY1305_FUSED_NEVER
-WOLFSSL_CHACHA20_POLY1305_SHORT
 WOLFSSL_CHECK_DESKEY
 WOLFSSL_CHIBIOS
 WOLFSSL_CLANG_TIDY
@@ -960,7 +931,6 @@ WOLFSSL_DRBG_SHA256
 WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID
 WOLFSSL_DTLS13_NO_HRR_ON_RESUME
 WOLFSSL_DTLS_DISALLOW_FUTURE
-WOLFSSL_DTLS_NO_HVR_ON_RESUME
 WOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS
 WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT
 WOLFSSL_DUMP_MEMIO_STREAM
@@ -972,7 +942,6 @@ WOLFSSL_ECC_NO_SMALL_STACK
 WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED
 WOLFSSL_ECDSA_MATCH_HASH
 WOLFSSL_ECDSA_SET_K_ONE_LOOP
-WOLFSSL_ECIES_STATIC_GCM_NONCE
 WOLFSSL_EC_POINT_CMP_JACOBIAN
 WOLFSSL_ED448_NO_LARGE_CODE
 WOLFSSL_EDDSA_CHECK_PRIV_ON_SIGN
@@ -1009,7 +978,6 @@ WOLFSSL_IMX6_CAAM_RNG
 WOLFSSL_IMXRT_DCP
 WOLFSSL_ISOTP
 WOLFSSL_KEEP_HOST_HEADER_PROBES
-WOLFSSL_KEIL
 WOLFSSL_KEIL_NET
 WOLFSSL_KYBER_NO_DECAPSULATE
 WOLFSSL_KYBER_NO_ENCAPSULATE
@@ -1043,7 +1011,6 @@ WOLFSSL_MULTICIRCULATE_ALTNAMELIST
 WOLFSSL_MX2_CONF_INCLUDE
 WOLFSSL_NETX_DUO
 WOLFSSL_NEW_PRIME_CHECK
-WOLFSSL_NOISE_SRC
 WOLFSSL_NONBLOCK_OCSP
 WOLFSSL_NOSHA3_384
 WOLFSSL_NOT_WINDOWS_API
@@ -1109,7 +1076,6 @@ WOLFSSL_PASSTHRU_ERR
 WOLFSSL_PB
 WOLFSSL_PEER_ADDRESS_CHANGES
 WOLFSSL_PKCS11_RW_TOKENS
-WOLFSSL_POLY1305_AVX512
 WOLFSSL_POLY1305_AVX512_ALWAYS
 WOLFSSL_POLY1305_AVX512_NEVER
 WOLFSSL_POLY1305_IFMA_ALWAYS
@@ -1135,7 +1101,6 @@ WOLFSSL_RENESAS_RZN2L
 WOLFSSL_RENESAS_TLS
 WOLFSSL_RENESAS_TSIP_IAREWRX
 WOLFSSL_REQUIRE_TCA
-WOLFSSL_RISCV_ASM_INLINE
 WOLFSSL_RISCV_ASM_NO_UNALIGNED
 WOLFSSL_RNG_USE_FULL_SEED
 WOLFSSL_RSA_CHECK_D_ON_DECRYPT
@@ -1162,25 +1127,20 @@ WOLFSSL_SHA256_ALT_CH_MAJ
 WOLFSSL_SHA3_AVX2
 WOLFSSL_SHA3_NO_AVX2
 WOLFSSL_SHA3_PPC64_BLOCKS_N
-WOLFSSL_SHA512_HASHTYPE
 WOLFSSL_SHUTDOWNONCE
 WOLFSSL_SILABS_TRNG
 WOLFSSL_SLHDSA_FULL_HASH
 WOLFSSL_SLHDSA_NO_VERIFY_ONLY
 WOLFSSL_SNIFFER_NO_RECOVERY
-WOLFSSL_SP_ARM32_UDIV
 WOLFSSL_SP_FAST_NCT_EXPTMOD
 WOLFSSL_SP_INT_SQR_VOLATILE
 WOLFSSL_SP_USE_UDIV
 WOLFSSL_SSLKEYLOGFILE_USE_ENV
 WOLFSSL_STACK_CHECK
-WOLFSSL_STM32C5
 WOLFSSL_STM32F3
 WOLFSSL_STM32F427_RNG
 WOLFSSL_STM32U0
-WOLFSSL_STM32V8
 WOLFSSL_STM32_DHUK_UNWRAP
-WOLFSSL_STM32_USE_SAES
 WOLFSSL_STRONGEST_HASH_SIG
 WOLFSSL_STSAFE_TAKES_SLOT
 WOLFSSL_TELIT_M2MB
@@ -1200,7 +1160,6 @@ WOLFSSL_TLS13_DRAFT
 WOLFSSL_TLS13_IGNORE_AEAD_LIMITS
 WOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC
 WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT
-WOLFSSL_TLS13_SHA512
 WOLFSSL_TLS13_TICKET_BEFORE_FINISHED
 WOLFSSL_TLS13_TICKET_CHECK_PSK_MODES
 WOLFSSL_TLSX_PQC_MLKEM_STORE_PRIV_KEY
@@ -1215,19 +1174,16 @@ WOLFSSL_USER_THREADING
 WOLFSSL_USE_ESP32C3_CRYPT_HASH_HW
 WOLFSSL_USE_FLASHMEM
 WOLFSSL_USE_FORCE_ZERO
-WOLFSSL_USE_OPTIONS_H
 WOLFSSL_VA416X0_TRNG
 WOLFSSL_VALIDATE_DH_KEYGEN
 WOLFSSL_VALIDATE_MLDSA_KEYGEN
 WOLFSSL_VALIDATE_MLKEM_KEYGEN
 WOLFSSL_VALIDATE_SLHDSA_KEYGEN
 WOLFSSL_VAULTIC_DEBUG
 WOLFSSL_VERBOSE_LOGGING
-WOLFSSL_VERSAL_GEN2_ASU
 WOLFSSL_VERSAL_GEN2_ASU_CCM_ALIGN_DECLINE
 WOLFSSL_VERSAL_GEN2_ASU_CTR_WRAP_HW_FIXED
 WOLFSSL_VERSAL_GEN2_ASU_DEBUG
-WOLFSSL_VERSAL_GEN2_ASU_IPI_BASEADDR
 WOLFSSL_VERSAL_GEN2_ASU_NO_CLIENT_INIT
 WOLFSSL_VERSAL_GEN2_ASU_NO_COMP_KEY_WARN
 WOLFSSL_VERSAL_GEN2_ASU_NO_ECC_P521
@@ -1250,10 +1206,6 @@ WOLFSSL_X509_PEM
 WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE
 WOLFSSL_X509_STORE_CERTS
 WOLFSSL_X509_TINY
-WOLFSSL_X509_TINY_AKI
-WOLFSSL_X509_TINY_NAME_CONSTRAINTS
-WOLFSSL_X509_TINY_POLICIES
-WOLFSSL_X509_TINY_SKI
 WOLFSSL_X509_TRUSTED_CERTIFICATE_CALLBACK
 WOLFSSL_X509_VERIFY_ONLY
 WOLFSSL_XFREE_NO_NULLNESS_CHECK
@@ -1264,11 +1216,7 @@ WOLFSSL_ZEPHYR
 WOLF_ALLOW_BUILTIN
 WOLF_CONF_ASN_TIME
 WOLF_CRYPTO_CB_ASYNC_POLL
-WOLF_CRYPTO_CB_CMD
-WOLF_CRYPTO_CB_ONLY_FALCON
-WOLF_CRYPTO_CB_SEED_ONLY_TEST
 WOLF_CRYPTO_DEV
-WOLF_CRYPT_FIPS_H
 WOLF_NO_TRAILING_ENUM_COMMAS
 WindowsCE
 XASU_AES_INIT

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -1358,6 +1358,10 @@ add_option(WOLFSSL_SLHDSA
     "Enable the wolfSSL SLH-DSA implementation (default: disabled)"
     "no" "yes;no")
 
+add_option(WOLFSSL_SLHDSAVERIFYONLY
+    "Enable the SLH-DSA verify-only implementation (default: disabled)"
+    "no" "yes;no")
+
 if (WOLFSSL_SLHDSA)
     message(STATUS "Automatically set related requirements for SLH-DSA")
     add_definitions("-DWOLFSSL_HAVE_SLHDSA")
@@ -1367,6 +1371,13 @@ if (WOLFSSL_SLHDSA)
     set_wolfssl_definitions("WOLFSSL_HAVE_SLHDSA" RESULT)
     set_wolfssl_definitions("WOLFSSL_WC_SLHDSA"   RESULT)
     set_wolfssl_definitions("WOLFSSL_SHAKE256"    RESULT)
+
+    if (WOLFSSL_SLHDSAVERIFYONLY)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SLHDSA_VERIFY_ONLY")
+
+        set_wolfssl_definitions("WOLFSSL_SLHDSA_VERIFY_ONLY" RESULT)
+    endif()
+
     message(STATUS "Looking for WOLFSSL_SLHDSA - found")
 endif()
 
@@ -3823,7 +3834,10 @@ if(WOLFSSL_RNG_BANK)
     if(NOT WOLFSSL_RNG)
         message(FATAL_ERROR "WOLFSSL_RNG_BANK requires WOLFSSL_RNG.")
     endif()
-    list(APPEND WOLFSSL_DEFINITIONS "-DWC_RNG_BANK_SUPPORT")
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_WC_RNG_BANK")
+    if(NOT WOLFSSL_FIPS)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWC_RNG_WANT_BANKREF_SUPPORT")
+    endif()
 endif()
 
 # RNG lock (share one WC_RNG between threads)

diff --git a/cmake/options.h.in b/cmake/options.h.in
@@ -457,6 +457,9 @@ extern "C" {
 #cmakedefine WOLFSSL_HAVE_SLHDSA
 #undef WOLFSSL_WC_SLHDSA
 #cmakedefine WOLFSSL_WC_SLHDSA
+#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
+#cmakedefine WOLFSSL_SLHDSA_VERIFY_ONLY
+#endif
 #undef WOLFSSL_PQC_HYBRIDS
 #cmakedefine WOLFSSL_PQC_HYBRIDS
 #undef WOLFSSL_EXTRA_PQC_HYBRIDS
@@ -603,8 +606,10 @@ extern "C" {
 #cmakedefine HAVE_CMAC_KDF
 #undef FP_ECC
 #cmakedefine FP_ECC
-#undef WC_RNG_BANK_SUPPORT
-#cmakedefine WC_RNG_BANK_SUPPORT
+#undef HAVE_WC_RNG_BANK
+#cmakedefine HAVE_WC_RNG_BANK
+#undef WC_RNG_WANT_BANKREF_SUPPORT
+#cmakedefine WC_RNG_WANT_BANKREF_SUPPORT
 #undef WC_RNG_NO_AUTO_LOCK
 #cmakedefine WC_RNG_NO_AUTO_LOCK
 #undef WC_RNG_AUTO_LOCK_DEFAULT_OFF

diff --git a/configure.ac b/configure.ac
@@ -2829,7 +2829,11 @@ if test "$ENABLED_RNG_BANK" = "yes"
 then
     AS_IF([test "$ENABLED_RNG" = "no"],
     AC_MSG_ERROR([--enable-rng-bank requires --enable-rng]))
-    AM_CFLAGS="$AM_CFLAGS -DWC_RNG_BANK_SUPPORT"
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_WC_RNG_BANK"
+    if test "$ENABLED_FIPS" = "no"
+    then
+        AM_CFLAGS="$AM_CFLAGS -DWC_RNG_WANT_BANKREF_SUPPORT"
+    fi
 fi
 
 
@@ -13501,11 +13505,11 @@ then
         *) ENABLED_RNG_AUTOFORK_FLAGS=yes ;;
     esac
     if test "$ENABLED_SELFTEST" = "yes" || test "x$ENABLED_HASHDRBG" != "xyes" || \
-       test "$ENABLED_ENTROPY_MEMUSE" != "no" || test "$ENABLED_RNG_BANK" = "yes" || \
+       test "$ENABLED_ENTROPY_MEMUSE" != "no" || \
        test "$ENABLED_RNG_AUTOFORK_FLAGS" = "no" || test "$ENABLED_WNR" = "yes" || \
        { test "$ENABLED_FIPS" = "yes" && test "${HAVE_FIPS_VERSION_MAJOR:-0}" -lt 7; }
     then
-        RNG_AUTOFORK_NEEDS="${RNG_AUTOFORK_NEEDS:+$RNG_AUTOFORK_NEEDS, and }getpid and the Hash DRBG with a heap, and none of selftest, FIPS before v7, entropy-memuse, rng-bank, static memory, netRandom, memory zero checking or memory tracking"
+        RNG_AUTOFORK_NEEDS="${RNG_AUTOFORK_NEEDS:+$RNG_AUTOFORK_NEEDS, and }getpid and the Hash DRBG with a heap, and none of selftest, FIPS before v7, entropy-memuse, static memory, netRandom, memory zero checking or memory tracking"
     fi
     if test -z "$RNG_AUTOFORK_NEEDS"
     then

diff --git a/linuxkm/Makefile b/linuxkm/Makefile
@@ -366,7 +366,7 @@ module-update-fips-hash: $(LIBWOLFSSL_NAME).ko
 	readarray -t verifyCore_attrs < <($(READELF) --wide --symbols "$<" | \
 	    sed -E -n 's/^[[:space:]]*[0-9]+: ([0-9a-fA-F]+)[[:space:]]+([0-9]+)[[:space:]]+OBJECT[[:space:]]+[A-Z]+[[:space:]]+[A-Z]+[[:space:]]+'"$${rodata_segment[0]}"'[[:space:]]+verifyCore$$/\1\n\2/p'); \
 	if [[ $${#verifyCore_attrs[@]} != 2 ]]; then echo '  unexpected verifyCore_attrs.' >&2; exit 1; fi
-	verifyCore_size=$$(("$${verifyCore_attrs[1]}" - 1))
+	verifyCore_size=$$(($${verifyCore_attrs[1]} - 1))
 	if [[ "$$verifyCore_size" != "64" && "$$verifyCore_size" != "128" ]]; then echo "	 verifyCore has unexpected length $${verifyCore_size}." >&2; exit 1; fi
 	verifyCore_offset=$$((0x$${rodata_segment[1]} + 0x$${verifyCore_attrs[0]}))
 	current_verifyCore=$$(dd bs=1 if="$<" skip=$$verifyCore_offset count=$$verifyCore_size status=none)

diff --git a/linuxkm/lkcapi_rsa_glue.c b/linuxkm/lkcapi_rsa_glue.c
@@ -633,14 +633,13 @@ static int km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid)
 }
 
 static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) {
-    switch (ctx->rng.status) {
-    case WC_DRBG_OK:
-#ifdef WC_HAVE_RNG_BANKREF
-    case WC_DRBG_BANKREF:
-#endif
+    if (ctx->rng.status == WC_DRBG_OK)
         return 0;
-    case WC_DRBG_NOT_INIT:
-    {
+#ifdef WC_RNG_FLAG_BANKREF
+    if (ctx->rng.flags & WC_RNG_FLAG_BANKREF)
+        return 0;
+#endif
+    if (ctx->rng.status == WC_DRBG_NOT_INIT) {
         int err = LKCAPI_INITRNG(&ctx->rng);
         if (err) {
             pr_err("%s: init rng returned: %d\n", WOLFKM_RSA_DRIVER, err);
@@ -651,7 +650,7 @@ static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) {
         }
         return 0;
     }
-    default:
+    else {
         return -EINVAL;
     }
 }

diff --git a/linuxkm/module_exports.c.template b/linuxkm/module_exports.c.template
@@ -67,7 +67,7 @@
         #include <wolfssl/wolfcrypt/wolfentropy.h>
     #endif
     #include <wolfssl/wolfcrypt/random.h>
-    #ifdef WC_RNG_BANK_SUPPORT
+    #ifdef HAVE_WC_RNG_BANK
         #include <wolfssl/wolfcrypt/rng_bank.h>
     #endif
 #endif

diff --git a/wolfcrypt/benchmark/fips_cast_bench.c b/wolfcrypt/benchmark/fips_cast_bench.c
@@ -476,7 +476,7 @@ static int bench_pct_mldsa(int iters)
 #endif /* WOLFSSL_HAVE_MLDSA */
 
 
-#ifdef WOLFSSL_HAVE_SLHDSA
+#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
 /* SLH-DSA elected the root recompute over sign and verify.  This times what
  * the module costs now, and the alternative it rejected, so the decision can
  * be rechecked rather than remembered. */
@@ -644,7 +644,7 @@ static int bench_pct_slhdsa(int iters)
     printf("\n");
     return failures;
 }
-#endif /* WOLFSSL_HAVE_SLHDSA */
+#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
 
 
 /* Returns the number of algorithms whose PCT measurement failed. */
@@ -699,7 +699,7 @@ static int bench_pct(int iters, const char* only)
         }
     }
 #endif
-#ifdef WOLFSSL_HAVE_SLHDSA
+#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY)
     if ((err == 0) && ((only == NULL) || (XSTRCMP(only, "slhdsa") == 0))) {
         rc = bench_pct_slhdsa(iters);
         if (rc < 0)