Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
### Issues:
CryptoAlg-2724
### Description of changes:
#### Parameterization of ML-DSA
Previous to this change, ML-DSA was implemented such that the code for a
parameter set was selected by defining the correct C pre-processor flag
(for example, if you want to compile the code for ML-DSA-65 parameter
set you would `#define DILITHIUM_MODE 3`).
The consequence of this was that we had to compile the code three times
for three ML-DSA parameter sets. We do this by adding a C file for each
parameter set where we first define the corresponding `DILITHIUM_MODE`
value and then include all the ML-DSA C files. Besides being an awkward
way to handle multiple parameter sets, this will not work for the FIPS
module where we bundle all C files inside `bcm.c` and compile it as a
single compilation unit.
In this change we refactor ML-DSA by parametrizing all functions that
depend on values that are specific to a parameter set, i.e., that
directly or indirectly depend on the value of `DILITHIUM_MODE`. To do
this, in `params.h` we define a structure that holds those ML-DSA
parameters and functions that initialize a given structure with values
corresponding to a parameter set. This structure can then be passed to
every function that requires it. For example, `polyvecl_add` function
was previously implemented as:
```
void polyvecl_add(polyvecl *w,
const polyvecl *u,
const polyvecl *v) {
unsigned int i;
for(i = 0; i < L; ++i)
poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
}
```
Is now changed to:
```
void polyvecl_add(ml_dsa_params *params,
polyvecl *w,
const polyvecl *u,
const polyvecl *v) {
unsigned int i;
for(i = 0; i < params->l; ++i)
poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
}
```
Of course, now we have to change all callers of `polyvecl_add` to also
have `ml_dsa_params` as an input argument, and then callers of the
caller, etc. These changes bubble up to the highest level API defined in
sign.h where we now have:
```
int crypto_sign_keypair(ml_dsa_params *params, uint8_t *pk, uint8_t *sk);
int crypto_sign_signature(ml_dsa_params *params,
uint8_t *sig, size_t *siglen,
const uint8_t *m, size_t mlen,
const uint8_t *ctx, size_t ctxlen,
const uint8_t *sk);
int crypto_sign(ml_dsa_params *params,
uint8_t *sm, size_t *smlen,
const uint8_t *m, size_t mlen,
const uint8_t *ctx, size_t ctxlen,
const uint8_t *sk);
int crypto_sign_verify(ml_dsa_params *params,
const uint8_t *sig, size_t siglen,
const uint8_t *m, size_t mlen,
const uint8_t *ctx, size_t ctxlen,
const uint8_t *pk);
int crypto_sign_open(ml_dsa_params *params,
uint8_t *m, size_t *mlen,
const uint8_t *sm, size_t smlen,
const uint8_t *ctx, size_t ctxlen,
const uint8_t *pk);
```
Then we can easily implement these functions for specific parameter
sets, which can be seen in `sig_dilithium3.c` file. For example:
```
int ml_dsa_65_keypair(uint8_t *public_key /* OUT */,
uint8_t *secret_key /* OUT */) {
ml_dsa_params params;
ml_dsa_65_params_init(¶ms);
return crypto_sign_keypair(¶ms, public_key, secret_key);
}
int ml_dsa_65_sign(uint8_t *sig /* OUT */,
size_t *sig_len /* OUT */,
const uint8_t *message /* IN */,
size_t message_len /* IN */,
const uint8_t *ctx /* IN */,
size_t ctx_len /* IN */,
const uint8_t *secret_key /* IN */) {
ml_dsa_params params;
ml_dsa_65_params_init(¶ms);
return crypto_sign_signature(¶ms, sig, sig_len, message, message_len,
ctx, ctx_len, secret_key);
}
int ml_dsa_65_verify(const uint8_t *message /* IN */,
size_t message_len /* IN */,
const uint8_t *sig /* IN */,
size_t sig_len /* IN */,
const uint8_t *ctx /* IN */,
size_t ctx_len /* IN */,
const uint8_t *public_key /* IN */) {
ml_dsa_params params;
ml_dsa_65_params_init(¶ms);
return crypto_sign_verify(¶ms, sig, sig_len, message, message_len,
ctx, ctx_len, public_key);
}
```
As such, files:
- `dilithium3r3_ref.c`
- `api.h`
- `config.h`
are no longer required, and have been removed.
#### Other Changes
Also modified in this PR are the KAT test framework in
`p_dilithium_test.cc`. This KAT framework has been modified to support
multiple levels of ML-DSA (to be added in a later PR).
### Call-outs:
See similar changes to ML-KEM in #1763
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.- Loading branch information
