Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix secret-dependent branch in poly_fromsg #55

Merged
merged 3 commits into from
Jun 13, 2024
Merged

Fix secret-dependent branch in poly_fromsg #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4997707
Fix secret-dependent branch in poly_fromsg
mkannwischer Jun 12, 2024
b1ee3dd
Merge branch 'main' into kyberbranch
mkannwischer Jun 13, 2024
6b7e904
Merge branch 'main' into kyberbranch
hanno-becker Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions mlkem/poly.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
#include "reduce.h"
#include "cbd.h"
#include "symmetric.h"
#include "verify.h"

/************************************************************
* Name: scalar_compress_q_16
Expand Down Expand Up @@ -260,16 +261,15 @@ void poly_frombytes(poly *r, const uint8_t a[KYBER_POLYBYTES]) {
**************************************************/
void poly_frommsg(poly *r, const uint8_t msg[KYBER_INDCPA_MSGBYTES]) {
unsigned int i, j;
int16_t mask;

#if (KYBER_INDCPA_MSGBYTES != KYBER_N/8)
#error "KYBER_INDCPA_MSGBYTES must be equal to KYBER_N/8 bytes!"
#endif

for (i = 0; i < KYBER_N / 8; i++) {
for (j = 0; j < 8; j++) {
mask = -(int16_t)((msg[i] >> j) & 1);
r->coeffs[8 * i + j] = mask & ((KYBER_Q + 1) / 2);
r->coeffs[8 * i + j] = 0;
cmov_int16(r->coeffs + 8 * i + j, ((KYBER_Q + 1) / 2), (msg[i] >> j) & 1);
}
}
}
Expand Down
16 changes: 16 additions & 0 deletions mlkem/verify.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,3 +46,19 @@ void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b) {
r[i] ^= b & (r[i] ^ x[i]);
}
}

/*************************************************
* Name: cmov_int16
*
* Description: Copy input v to *r if b is 1, don't modify *r if b is 0.
* Requires b to be in {0,1};
* Runs in constant time.
*
* Arguments: int16_t *r: pointer to output int16_t
* int16_t v: input int16_t
* uint8_t b: Condition bit; has to be in {0,1}
**************************************************/
void cmov_int16(int16_t *r, int16_t v, uint16_t b) {
b = -b;
*r ^= b & ((*r) ^ v);
}
3 changes: 3 additions & 0 deletions mlkem/verify.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,7 @@ int verify(const uint8_t *a, const uint8_t *b, size_t len);
#define cmov KYBER_NAMESPACE(cmov)
void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b);

#define cmov_int16 KYBER_NAMESPACE(cmov_int16)
void cmov_int16(int16_t *r, int16_t v, uint16_t b);

#endif