CI: Add test for non-standard values of GEN_MATRIX_NBLOCKS

GEN_MATRIX_NBLOCKS is a heuristic value estimating the amount of rejection sampling input to sample 256 polynomial coefficients. While this value is hardcoded to 3 by default, one should be able to set it to any positive value. Moreover, some code-paths are not as easily reached with the default value, and testing a lower value increases the chances of catching bugs in those. This commit allows the user to specify GEN_MATRIX_NBLOCKS in the CFLAGS, and extends the CI to test the non-standard values 1,2, and 4. Signed-off-by: Hanno Becker <[email protected]>
pq-code-package · Nov 16, 2024 · 5f57c42 · 5f57c42
1 parent 4e62a9e
commit 5f57c42
Show file tree

Hide file tree

Showing 2 changed files with 59 additions and 1 deletion.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -182,7 +182,63 @@ jobs:
           nix-shell: ci-linter
           gh_token: ${{ secrets.GITHUB_TOKEN }}
           cross-prefix: "aarch64-unknown-linux-gnu-"
-
+  config_variations:
+    name: Non-standard configurations
+    needs: quickcheck
+    strategy:
+      fail-fast: false
+      matrix:
+        external:
+         - ${{ github.repository_owner != 'pq-code-package' }}
+        target:
+         - runner: pqcp-arm64
+           name: 'ubuntu-latest (aarch64)'
+         - runner: pqcp-x64
+           name: 'ubuntu-latest (x86_64)'
+        exclude:
+          - {external: true,
+             target: {
+               runner: pqcp-arm64,
+               name: 'ubuntu-latest (aarch64)',
+             }}
+          - {external: true,
+             target: {
+               runner: pqcp-x64,
+               name: 'ubuntu-latest (x86_64)',
+             }}
+    runs-on: ${{ matrix.target.runner }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: "GEN_MATRIX_NBLOCKS=1"
+        uses: ./.github/actions/multi-functest
+        with:
+          gh_token: ${{ secrets.GITHUB_TOKEN }}
+          compile_mode: native
+          cflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all -DGEN_MATRIX_NBLOCKS=1"
+          func: true
+          nistkat: true
+          kat: false
+          acvp: false
+      - name: "GEN_MATRIX_NBLOCKS=2"
+        uses: ./.github/actions/multi-functest
+        with:
+          gh_token: ${{ secrets.GITHUB_TOKEN }}
+          compile_mode: native
+          cflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all -DGEN_MATRIX_NBLOCKS=2"
+          func: true
+          nistkat: true
+          kat: false
+          acvp: false
+      - name: "GEN_MATRIX_NBLOCKS=4"
+        uses: ./.github/actions/multi-functest
+        with:
+          gh_token: ${{ secrets.GITHUB_TOKEN }}
+          compile_mode: native
+          cflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all -DGEN_MATRIX_NBLOCKS=4"
+          func: true
+          nistkat: true
+          kat: false
+          acvp: false
   ec2_functests:
     needs: quickcheck
     strategy:

diff --git a/mlkem/indcpa.c b/mlkem/indcpa.c
@@ -124,8 +124,10 @@ static void unpack_ciphertext(polyvec *b, poly *v,
   poly_decompress(v, c + MLKEM_POLYVECCOMPRESSEDBYTES);
 }
 
+#ifndef GEN_MATRIX_NBLOCKS
 #define GEN_MATRIX_NBLOCKS \
   ((12 * MLKEM_N / 8 * (1 << 12) / MLKEM_Q + SHAKE128_RATE) / SHAKE128_RATE)
+#endif
 
 // Generate four A matrix entries from a seed, using rejection
 // sampling on the output of a XOF.