Skip to content

ML-DSA: make checking low constant time #11371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SparkiDev wants to merge 1 commit into
base: master
Choose a base branch
from
+92 −199
Open

ML-DSA: make checking low constant time #11371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 22 additions & 13 deletions wolfcrypt/src/wc_mldsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5658,27 +5658,38 @@ static void mldsa_vec_decompose(const sword32* r, byte k, sword32 gamma2,
* Many places in FIPS 204. One example from Algorithm 2:
* 23: if ||z||inf >= GAMMA1 - BETA or ..., then (z, h) = falsam
*
* Constant time with respect to the values of the polynomial. Whether any
* value is out of range is public - it is the result of the check - but which
* value is out of range is not. Therefore every value is checked and no early
* exit is performed.
*
* Values are always small - magnitude less than MLDSA_Q - and hi is positive
* and less than MLDSA_Q. The differences calculated below therefore never
* overflow 32 bits.
*
* @param [in] a Polynomial.
* @param [in] hi Largest value in range.
* @return 1 when all values are in range.
* @return 0 when at least one value is out of range.
*/
static int mldsa_check_low(const sword32* a, sword32 hi)
{
int ret = 1;
unsigned int j;
/* Calculate lowest range value. */
sword32 nhi = -hi;
/* Top bit stays set while all values checked are in range. */
word32 in = 0xffffffffU;

/* For each value of polynomial. */
for (j = 0; j < MLDSA_N; j++) {
/* Check range is -(hi-1)..(hi-1). */
if ((a[j] <= nhi) || (a[j] >= hi)) {
/* Check failed. */
ret = 0;
break;
}
/* Check range is -(hi-1)..(hi-1).
* Top bit of a[j] - hi is set when a[j] < hi.
* Top bit of nhi - a[j] is set when a[j] > nhi. */
in &= ((word32)a[j] - (word32)hi) & ((word32)nhi - (word32)a[j]);
}

return ret;
/* Top bit set when all values are in range. */
return (int)(in >> 31);
}

#if !defined(WOLFSSL_MLDSA_NO_VERIFY) || \
Expand All @@ -5698,12 +5709,10 @@ static int mldsa_vec_check_low_c(const sword32* a, byte l, sword32 hi)
int ret = 1;
unsigned int i;

/* For each polynomial of vector. */
/* For each polynomial of vector.
* Constant time - all polynomials are checked. */
for (i = 0; i < l; i++) {
ret = mldsa_check_low(a, hi);
if (ret == 0) {
break;
}
ret &= mldsa_check_low(a, hi);
/* Next polynomial. */
a += MLDSA_N;
}
Expand Down
125 changes: 33 additions & 92 deletions wolfcrypt/src/wc_mldsa_asm.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39065,6 +39065,7 @@ _wc_mldsa_vec_check_low_avx2:
movd %edx, %xmm3
vpbroadcastd %xmm2, %ymm2
vpbroadcastd %xmm3, %ymm3
vpxor %ymm8, %ymm8, %ymm8
L_mldsa_vec_check_low_vx2_start_256:
vmovdqu (%rdi), %ymm0
vmovdqu 32(%rdi), %ymm1
Expand All @@ -39075,10 +39076,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 64(%rdi), %ymm0
vmovdqu 96(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39088,10 +39086,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 128(%rdi), %ymm0
vmovdqu 160(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39101,10 +39096,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 192(%rdi), %ymm0
vmovdqu 224(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39114,10 +39106,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 256(%rdi), %ymm0
vmovdqu 288(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39127,10 +39116,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 320(%rdi), %ymm0
vmovdqu 352(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39140,10 +39126,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 384(%rdi), %ymm0
vmovdqu 416(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39153,10 +39136,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 448(%rdi), %ymm0
vmovdqu 480(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39166,10 +39146,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 512(%rdi), %ymm0
vmovdqu 544(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39179,10 +39156,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 576(%rdi), %ymm0
vmovdqu 608(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39192,10 +39166,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 640(%rdi), %ymm0
vmovdqu 672(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39205,10 +39176,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 704(%rdi), %ymm0
vmovdqu 736(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39218,10 +39186,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 768(%rdi), %ymm0
vmovdqu 800(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39231,10 +39196,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 832(%rdi), %ymm0
vmovdqu 864(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39244,10 +39206,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 896(%rdi), %ymm0
vmovdqu 928(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39257,10 +39216,7 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
vmovdqu 960(%rdi), %ymm0
vmovdqu 992(%rdi), %ymm1
vpcmpgtd %ymm2, %ymm0, %ymm4
Expand All @@ -39270,15 +39226,14 @@ L_mldsa_vec_check_low_vx2_start_256:
vpor %ymm5, %ymm4, %ymm4
vpor %ymm7, %ymm6, %ymm6
vpor %ymm6, %ymm4, %ymm4
vpmovmskb %ymm4, %rax
cmp $0x00, %rax
movq $0x00, %rax
jne L_mldsa_vec_check_low_vx2_done
vpor %ymm4, %ymm8, %ymm8
addq $0x400, %rdi
sub $0x01, %rsi
jne L_mldsa_vec_check_low_vx2_start_256
movq $0x01, %rax
L_mldsa_vec_check_low_vx2_done:
vpmovmskb %ymm8, %rax
cmpl $0x00, %eax
sete %al
movzbl %al, %eax
vzeroupper
repz retq
#ifndef __APPLE__
Expand Down Expand Up @@ -63501,6 +63456,7 @@ _wc_mldsa_vec_check_low_avx512:
movd %edx, %xmm3
vpbroadcastd %xmm2, %zmm2
vpbroadcastd %xmm3, %zmm3
kxorw %k5, %k5, %k5
L_mldsa_vec_check_low_avx512_start_256:
vmovdqu64 (%rdi), %zmm0
vmovdqu64 64(%rdi), %zmm1
Expand All @@ -63511,9 +63467,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 128(%rdi), %zmm0
vmovdqu64 192(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63523,9 +63477,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 256(%rdi), %zmm0
vmovdqu64 320(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63535,9 +63487,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 384(%rdi), %zmm0
vmovdqu64 448(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63547,9 +63497,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 512(%rdi), %zmm0
vmovdqu64 576(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63559,9 +63507,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 640(%rdi), %zmm0
vmovdqu64 704(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63571,9 +63517,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 768(%rdi), %zmm0
vmovdqu64 832(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63583,9 +63527,7 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
vmovdqu64 896(%rdi), %zmm0
vmovdqu64 960(%rdi), %zmm1
vpcmpgtd %zmm2, %zmm0, %k1
Expand All @@ -63595,14 +63537,13 @@ L_mldsa_vec_check_low_avx512_start_256:
korw %k3, %k1, %k1
korw %k4, %k2, %k2
korw %k2, %k1, %k1
kortestw %k1, %k1
movq $0x00, %rax
jne L_mldsa_vec_check_low_avx512_done
korw %k1, %k5, %k5
addq $0x400, %rdi
sub $0x01, %rsi
jne L_mldsa_vec_check_low_avx512_start_256
movq $0x01, %rax
L_mldsa_vec_check_low_avx512_done:
kortestw %k5, %k5
sete %al
movzbl %al, %eax
vzeroupper
repz retq
#ifndef __APPLE__
Expand Down
Loading
Loading